@alisio/plugin-google-chat 0.1.0

package/dist/text.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"text.js","sourceRoot":"","sources":["../src/text.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,4CAA4C;IAC5C,oJAAoJ;CACrJ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAEZ,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,CAAC;AACpC,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,CAAC;AACtC,MAAM,CAAC,MAAM,iBAAiB,GAAG,yBAAyB,CAAC;AAE3D,qFAAqF;AACrF,MAAM,QAAQ,GAAG,sBAAsB,CAAC;AAExC,qEAAqE;AACrE,SAAS,cAAc,CAAC,KAAa;IACnC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACnD,OAAO,KAAK,GAAG,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC;AAC1D,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,0BAA0B,CAAC,KAAa;IACtD,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,SAAS,IAAI,KAAK;QAC3B,GAAG,IAAI,cAAc,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IACzE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,KAAK,MAAM,SAAS,IAAI,KAAK;QAAE,IAAI,cAAc,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IAC9F,OAAO,KAAK,CAAC;AACf,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,KAAK,CAAC,KAAa,EAAE,GAAW;IAC9C,IAAI,KAAK,CAAC,MAAM,IAAI,GAAG;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,GAAG,IAAI,iBAAiB,CAAC,MAAM;QAAE,OAAO,iBAAiB,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IACzF,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,GAAG,iBAAiB,CAAC,MAAM,CAAC,GAAG,iBAAiB,EAAE,CAAC;AACjF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAc,EAAE,GAAG,GAAG,eAAe;IACtE,MAAM,GAAG,GACP,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACjG,MAAM,UAAU,GAAG,0BAA0B,CAAC,GAAG,CAAC;SAC/C,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC;SACvB,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC;SAC1B,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAC9B,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACjG,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;AACpC,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,OAAO,KAAK,CAAC,GAAG,gBAAgB,OAAO,IAAI,EAAE,EAAE,gBAAgB,CAAC,CAAC;AACnE,CAAC"}

package/dist/time.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Injectable time seams. Tests pass a fixed clock and a recording sleep so no
+ * test ever waits on a wall clock or reaches the network.
+ */
+export interface Clock {
+    now(): number;
+}
+export declare const systemClock: Clock;
+export type Sleep = (milliseconds: number, signal?: AbortSignal) => Promise<void>;
+/** Sleep that rejects immediately when the supplied signal aborts. */
+export declare const systemSleep: Sleep;
+//# sourceMappingURL=time.d.ts.map

package/dist/time.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"time.d.ts","sourceRoot":"","sources":["../src/time.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,WAAW,KAAK;IACpB,GAAG,IAAI,MAAM,CAAC;CACf;AAED,eAAO,MAAM,WAAW,EAAE,KAAiC,CAAC;AAE5D,MAAM,MAAM,KAAK,GAAG,CAAC,YAAY,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAQlF,sEAAsE;AACtE,eAAO,MAAM,WAAW,EAAE,KAgBtB,CAAC"}

package/dist/time.js

@@ -0,0 +1,24 @@
+export const systemClock = { now: () => Date.now() };
+function abortError() {
+    const error = new Error("aborted");
+    error.name = "AbortError";
+    return error;
+}
+/** Sleep that rejects immediately when the supplied signal aborts. */
+export const systemSleep = (milliseconds, signal) => new Promise((resolve, reject) => {
+    if (signal?.aborted) {
+        reject(abortError());
+        return;
+    }
+    const timer = setTimeout(() => {
+        signal?.removeEventListener("abort", onAbort);
+        resolve();
+    }, milliseconds);
+    function onAbort() {
+        clearTimeout(timer);
+        signal?.removeEventListener("abort", onAbort);
+        reject(abortError());
+    }
+    signal?.addEventListener("abort", onAbort, { once: true });
+});
+//# sourceMappingURL=time.js.map

package/dist/time.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"time.js","sourceRoot":"","sources":["../src/time.ts"],"names":[],"mappings":"AAQA,MAAM,CAAC,MAAM,WAAW,GAAU,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;AAI5D,SAAS,UAAU;IACjB,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC;IACnC,KAAK,CAAC,IAAI,GAAG,YAAY,CAAC;IAC1B,OAAO,KAAK,CAAC;AACf,CAAC;AAED,sEAAsE;AACtE,MAAM,CAAC,MAAM,WAAW,GAAU,CAAC,YAAY,EAAE,MAAM,EAAE,EAAE,CACzD,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;IACpC,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;QACpB,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IACD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;QAC5B,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC9C,OAAO,EAAE,CAAC;IACZ,CAAC,EAAE,YAAY,CAAC,CAAC;IACjB,SAAS,OAAO;QACd,YAAY,CAAC,KAAK,CAAC,CAAC;QACpB,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC9C,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;IACvB,CAAC;IACD,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;AAC7D,CAAC,CAAC,CAAC"}

package/dist/token-set.d.ts

@@ -0,0 +1,26 @@
+/**
+ * An OAuth token set. The access and refresh tokens are attached as
+ * non-enumerable properties, so `JSON.stringify` and `util.inspect` never reveal
+ * them. Only `serializeTokenSet` writes them, and only into the plugin-owned
+ * `0600` token file.
+ */
+export interface TokenSet {
+    readonly accessToken: string;
+    readonly refreshToken: string | undefined;
+    readonly expiry: number | undefined;
+    readonly scopes: readonly string[];
+    readonly tokenType: string;
+}
+export declare function createTokenSet(input: {
+    accessToken: string;
+    refreshToken: string | undefined;
+    expiry: number | undefined;
+    scopes: readonly string[];
+    tokenType: string;
+}): TokenSet;
+/** Serialize for disk. This is the only place token material is written out. */
+export declare function serializeTokenSet(token: TokenSet): string;
+/** Validate a parsed token file. Never echoes any value on failure. */
+export declare function parseTokenSet(raw: unknown): TokenSet;
+export declare function isExpired(token: TokenSet, now: number, skewMs: number): boolean;
+//# sourceMappingURL=token-set.d.ts.map

package/dist/token-set.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-set.d.ts","sourceRoot":"","sources":["../src/token-set.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AACH,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;CACnB,GAAG,QAAQ,CAyBX;AAED,gFAAgF;AAChF,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,QAAQ,GAAG,MAAM,CAUzD;AAED,uEAAuE;AACvE,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,GAAG,QAAQ,CAqBpD;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAG/E"}

package/dist/token-set.js

@@ -0,0 +1,62 @@
+import { GoogleChatError } from "./errors.js";
+export function createTokenSet(input) {
+    const token = {};
+    Object.defineProperties(token, {
+        accessToken: {
+            value: input.accessToken,
+            enumerable: false,
+            writable: false,
+            configurable: false,
+        },
+        refreshToken: {
+            value: input.refreshToken,
+            enumerable: false,
+            writable: false,
+            configurable: false,
+        },
+        expiry: { value: input.expiry, enumerable: true, writable: false, configurable: false },
+        scopes: {
+            value: Object.freeze([...input.scopes]),
+            enumerable: true,
+            writable: false,
+            configurable: false,
+        },
+        tokenType: { value: input.tokenType, enumerable: true, writable: false, configurable: false },
+    });
+    return Object.freeze(token);
+}
+/** Serialize for disk. This is the only place token material is written out. */
+export function serializeTokenSet(token) {
+    const record = {
+        version: 1,
+        accessToken: token.accessToken,
+        expiry: token.expiry ?? null,
+        scopes: [...token.scopes],
+        tokenType: token.tokenType,
+    };
+    if (token.refreshToken !== undefined)
+        record.refreshToken = token.refreshToken;
+    return `${JSON.stringify(record, null, 2)}\n`;
+}
+/** Validate a parsed token file. Never echoes any value on failure. */
+export function parseTokenSet(raw) {
+    if (!raw || typeof raw !== "object" || Array.isArray(raw))
+        throw new GoogleChatError("configuration missing or invalid", "the stored Google Chat token file is malformed; delete it and run google-chat-auth again");
+    const value = raw;
+    const accessToken = value.accessToken;
+    if (typeof accessToken !== "string" || accessToken === "")
+        throw new GoogleChatError("configuration missing or invalid", "the stored Google Chat token file has no access token; run google-chat-auth again");
+    const refreshToken = typeof value.refreshToken === "string" ? value.refreshToken : undefined;
+    const expiry = typeof value.expiry === "number" && Number.isFinite(value.expiry) ? value.expiry : undefined;
+    const scopes = Array.isArray(value.scopes)
+        ? value.scopes.filter((scope) => typeof scope === "string")
+        : [];
+    const tokenType = typeof value.tokenType === "string" ? value.tokenType : "Bearer";
+    return createTokenSet({ accessToken, refreshToken, expiry, scopes, tokenType });
+}
+export function isExpired(token, now, skewMs) {
+    if (token.expiry === undefined)
+        return false;
+    return now >= token.expiry - skewMs;
+}
+//# sourceMappingURL=token-set.js.map

package/dist/token-set.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-set.js","sourceRoot":"","sources":["../src/token-set.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAgB9C,MAAM,UAAU,cAAc,CAAC,KAM9B;IACC,MAAM,KAAK,GAAG,EAAc,CAAC;IAC7B,MAAM,CAAC,gBAAgB,CAAC,KAAK,EAAE;QAC7B,WAAW,EAAE;YACX,KAAK,EAAE,KAAK,CAAC,WAAW;YACxB,UAAU,EAAE,KAAK;YACjB,QAAQ,EAAE,KAAK;YACf,YAAY,EAAE,KAAK;SACpB;QACD,YAAY,EAAE;YACZ,KAAK,EAAE,KAAK,CAAC,YAAY;YACzB,UAAU,EAAE,KAAK;YACjB,QAAQ,EAAE,KAAK;YACf,YAAY,EAAE,KAAK;SACpB;QACD,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE;QACvF,MAAM,EAAE;YACN,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;YACvC,UAAU,EAAE,IAAI;YAChB,QAAQ,EAAE,KAAK;YACf,YAAY,EAAE,KAAK;SACpB;QACD,SAAS,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE;KAC9F,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAa,CAAC;AAC1C,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,iBAAiB,CAAC,KAAe;IAC/C,MAAM,MAAM,GAA4B;QACtC,OAAO,EAAE,CAAC;QACV,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,IAAI;QAC5B,MAAM,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC;QACzB,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC;IACF,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS;QAAE,MAAM,CAAC,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;IAC/E,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;AAChD,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,aAAa,CAAC,GAAY;IACxC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QACvD,MAAM,IAAI,eAAe,CACvB,kCAAkC,EAClC,0FAA0F,CAC3F,CAAC;IACJ,MAAM,KAAK,GAAG,GAA8B,CAAC;IAC7C,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;IACtC,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,KAAK,EAAE;QACvD,MAAM,IAAI,eAAe,CACvB,kCAAkC,EAClC,mFAAmF,CACpF,CAAC;IACJ,MAAM,YAAY,GAAG,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7F,MAAM,MAAM,GACV,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/F,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;QACxC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;QAC5E,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,SAAS,GAAG,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;IACnF,OAAO,cAAc,CAAC,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;AAClF,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,KAAe,EAAE,GAAW,EAAE,MAAc;IACpE,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7C,OAAO,GAAG,IAAI,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC;AACtC,CAAC"}

package/dist/token.d.ts

@@ -0,0 +1,30 @@
+import type { OAuthConfig } from "./config.js";
+import type { Clock } from "./time.js";
+import { type TokenSet } from "./token-set.js";
+import type { Fetcher } from "./transport.js";
+export * from "./token-set.js";
+/** Plugin-owned token persistence at `<configHome>/google-chat/token.json`. */
+export declare class TokenStore {
+    readonly path: string;
+    constructor(path: string);
+    read(): TokenSet | null;
+    /** Atomically write the token file with `0600`, creating parents with `0700`. */
+    write(token: TokenSet): void;
+    clear(): void;
+}
+export interface RefreshContext {
+    oauth: OAuthConfig;
+    fetcher: Fetcher;
+    clock: Clock;
+    signal: AbortSignal;
+    skewMs: number;
+}
+/**
+ * Return a usable access token, refreshing once when the stored token is
+ * expired. A refresh failure that reports `invalid_grant` clears the store so
+ * the operator is told to re-authorize instead of retrying a dead token.
+ */
+export declare function obtainAccessToken(store: TokenStore, context: RefreshContext, options?: {
+    force?: boolean;
+}): Promise<TokenSet>;
+//# sourceMappingURL=token.d.ts.map

package/dist/token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../src/token.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAG/C,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAKL,KAAK,QAAQ,EACd,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAE9C,cAAc,gBAAgB,CAAC;AAE/B,+EAA+E;AAC/E,qBAAa,UAAU;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,YAAY,IAAI,EAAE,MAAM,EAEvB;IAED,IAAI,IAAI,QAAQ,GAAG,IAAI,CAqBtB;IAED,iFAAiF;IACjF,KAAK,CAAC,KAAK,EAAE,QAAQ,GAAG,IAAI,CA2B3B;IAED,KAAK,IAAI,IAAI,CAMZ;CACF;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,WAAW,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,KAAK,CAAC;IACb,MAAM,EAAE,WAAW,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,UAAU,EACjB,OAAO,EAAE,cAAc,EACvB,OAAO,GAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAO,GAChC,OAAO,CAAC,QAAQ,CAAC,CA4CnB"}

package/dist/token.js

@@ -0,0 +1,119 @@
+import { chmodSync, closeSync, fsyncSync, mkdirSync, openSync, readFileSync, renameSync, rmSync, writeSync, } from "node:fs";
+import { dirname } from "node:path";
+import { GoogleChatError } from "./errors.js";
+import { refreshAccessToken } from "./oauth.js";
+import { createTokenSet, isExpired, parseTokenSet, serializeTokenSet, } from "./token-set.js";
+export * from "./token-set.js";
+/** Plugin-owned token persistence at `<configHome>/google-chat/token.json`. */
+export class TokenStore {
+    path;
+    constructor(path) {
+        this.path = path;
+    }
+    read() {
+        let text;
+        try {
+            text = readFileSync(this.path, "utf8");
+        }
+        catch (error) {
+            if (error.code === "ENOENT")
+                return null;
+            throw new GoogleChatError("configuration missing or invalid", "the stored Google Chat token file could not be read");
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(text);
+        }
+        catch {
+            throw new GoogleChatError("configuration missing or invalid", "the stored Google Chat token file is not valid JSON; delete it and run google-chat-auth again");
+        }
+        return parseTokenSet(parsed);
+    }
+    /** Atomically write the token file with `0600`, creating parents with `0700`. */
+    write(token) {
+        const directory = dirname(this.path);
+        mkdirSync(directory, { recursive: true, mode: 0o700 });
+        try {
+            chmodSync(directory, 0o700);
+        }
+        catch {
+            // Hardening only.
+        }
+        const temp = `${this.path}.${process.pid}.tmp`;
+        const descriptor = openSync(temp, "w", 0o600);
+        try {
+            writeSync(descriptor, serializeTokenSet(token), 0, "utf8");
+            fsyncSync(descriptor);
+        }
+        finally {
+            closeSync(descriptor);
+        }
+        try {
+            chmodSync(temp, 0o600);
+        }
+        catch {
+            // Hardening only.
+        }
+        renameSync(temp, this.path);
+        try {
+            chmodSync(this.path, 0o600);
+        }
+        catch {
+            // Hardening only.
+        }
+    }
+    clear() {
+        try {
+            rmSync(this.path, { force: true });
+        }
+        catch {
+            // Best effort; the file may already be absent.
+        }
+    }
+}
+/**
+ * Return a usable access token, refreshing once when the stored token is
+ * expired. A refresh failure that reports `invalid_grant` clears the store so
+ * the operator is told to re-authorize instead of retrying a dead token.
+ */
+export async function obtainAccessToken(store, context, options = {}) {
+    const current = store.read();
+    if (current === null)
+        throw new GoogleChatError("not authenticated", "no stored Google authorization; run google-chat-auth to authorize a user account");
+    if (options.force !== true && !isExpired(current, context.clock.now(), context.skewMs))
+        return current;
+    if (current.refreshToken === undefined)
+        throw new GoogleChatError("not authenticated", "the stored Google authorization expired and has no refresh token; run google-chat-auth again");
+    let refreshed;
+    try {
+        refreshed = await refreshAccessToken({
+            config: context.oauth,
+            refreshToken: current.refreshToken,
+            fetcher: context.fetcher,
+            signal: context.signal,
+        });
+    }
+    catch (error) {
+        if (error instanceof GoogleChatError && error.code === "not authenticated") {
+            try {
+                store.clear();
+            }
+            catch {
+                // Clearing is best effort; the original error is what matters.
+            }
+        }
+        throw error;
+    }
+    const next = createTokenSet({
+        accessToken: refreshed.accessToken,
+        refreshToken: refreshed.refreshToken ?? current.refreshToken,
+        expiry: refreshed.expiresIn === undefined
+            ? current.expiry
+            : context.clock.now() + refreshed.expiresIn * 1000,
+        scopes: refreshed.scopes.length > 0 ? refreshed.scopes : current.scopes,
+        tokenType: refreshed.tokenType,
+    });
+    store.write(next);
+    return next;
+}
+//# sourceMappingURL=token.js.map

package/dist/token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.js","sourceRoot":"","sources":["../src/token.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,EACT,SAAS,EACT,SAAS,EACT,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,UAAU,EACV,MAAM,EACN,SAAS,GACV,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAEhD,OAAO,EACL,cAAc,EACd,SAAS,EACT,aAAa,EACb,iBAAiB,GAElB,MAAM,gBAAgB,CAAC;AAGxB,cAAc,gBAAgB,CAAC;AAE/B,+EAA+E;AAC/E,MAAM,OAAO,UAAU;IACZ,IAAI,CAAS;IAEtB,YAAY,IAAY;QACtB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,IAAI;QACF,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YACpE,MAAM,IAAI,eAAe,CACvB,kCAAkC,EAClC,qDAAqD,CACtD,CAAC;QACJ,CAAC;QACD,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,eAAe,CACvB,kCAAkC,EAClC,+FAA+F,CAChG,CAAC;QACJ,CAAC;QACD,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;IAED,iFAAiF;IACjF,KAAK,CAAC,KAAe;QACnB,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrC,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACvD,IAAI,CAAC;YACH,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,kBAAkB;QACpB,CAAC;QACD,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;QAC/C,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QAC9C,IAAI,CAAC;YACH,SAAS,CAAC,UAAU,EAAE,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;YAC3D,SAAS,CAAC,UAAU,CAAC,CAAC;QACxB,CAAC;gBAAS,CAAC;YACT,SAAS,CAAC,UAAU,CAAC,CAAC;QACxB,CAAC;QACD,IAAI,CAAC;YACH,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,kBAAkB;QACpB,CAAC;QACD,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,CAAC;YACH,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,kBAAkB;QACpB,CAAC;IACH,CAAC;IAED,KAAK;QACH,IAAI,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC;YACP,+CAA+C;QACjD,CAAC;IACH,CAAC;CACF;AAUD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,KAAiB,EACjB,OAAuB,EACvB,OAAO,GAAwB,EAAE;IAEjC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,KAAK,IAAI;QAClB,MAAM,IAAI,eAAe,CACvB,mBAAmB,EACnB,kFAAkF,CACnF,CAAC;IACJ,IAAI,OAAO,CAAC,KAAK,KAAK,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,OAAO,CAAC,MAAM,CAAC;QACpF,OAAO,OAAO,CAAC;IACjB,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS;QACpC,MAAM,IAAI,eAAe,CACvB,mBAAmB,EACnB,8FAA8F,CAC/F,CAAC;IACJ,IAAI,SAAyD,CAAC;IAC9D,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,kBAAkB,CAAC;YACnC,MAAM,EAAE,OAAO,CAAC,KAAK;YACrB,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,MAAM,EAAE,OAAO,CAAC,MAAM;SACvB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,eAAe,IAAI,KAAK,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;YAC3E,IAAI,CAAC;gBACH,KAAK,CAAC,KAAK,EAAE,CAAC;YAChB,CAAC;YAAC,MAAM,CAAC;gBACP,+DAA+D;YACjE,CAAC;QACH,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IACD,MAAM,IAAI,GAAG,cAAc,CAAC;QAC1B,WAAW,EAAE,SAAS,CAAC,WAAW;QAClC,YAAY,EAAE,SAAS,CAAC,YAAY,IAAI,OAAO,CAAC,YAAY;QAC5D,MAAM,EACJ,SAAS,CAAC,SAAS,KAAK,SAAS;YAC/B,CAAC,CAAC,OAAO,CAAC,MAAM;YAChB,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,SAAS,GAAG,IAAI;QACtD,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM;QACvE,SAAS,EAAE,SAAS,CAAC,SAAS;KAC/B,CAAC,CAAC;IACH,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClB,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/toolkit.d.ts

@@ -0,0 +1,14 @@
+import type { JsonSchema, ToolDefinition } from "@alisio/sdk";
+export interface ToolSpec {
+    name: string;
+    description: string;
+    inputSchema: JsonSchema;
+    run(input: Record<string, unknown>, context: {
+        signal: AbortSignal;
+    }): Promise<string>;
+}
+/** A read-only tool: it transmits data but never mutates remote state. */
+export declare function externalTool(spec: ToolSpec): ToolDefinition;
+/** A mutating tool. Capability gating happens inside `run`, before any request. */
+export declare function writeTool(spec: ToolSpec): ToolDefinition;
+//# sourceMappingURL=toolkit.d.ts.map

package/dist/toolkit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"toolkit.d.ts","sourceRoot":"","sources":["../src/toolkit.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAc,MAAM,aAAa,CAAC;AAG1E,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,UAAU,CAAC;IACxB,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE;QAAE,MAAM,EAAE,WAAW,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACxF;AAMD,0EAA0E;AAC1E,wBAAgB,YAAY,CAAC,IAAI,EAAE,QAAQ,GAAG,cAAc,CAc3D;AAED,mFAAmF;AACnF,wBAAgB,SAAS,CAAC,IAAI,EAAE,QAAQ,GAAG,cAAc,CAcxD"}

package/dist/toolkit.js

@@ -0,0 +1,39 @@
+import { safeMessage } from "./errors.js";
+function errorResult(error) {
+    return { isError: true, content: [{ type: "text", text: safeMessage(error) }] };
+}
+/** A read-only tool: it transmits data but never mutates remote state. */
+export function externalTool(spec) {
+    return {
+        name: spec.name,
+        description: spec.description,
+        effect: "external",
+        inputSchema: spec.inputSchema,
+        async execute(input, context) {
+            try {
+                return { content: [{ type: "text", text: await spec.run(input, context) }] };
+            }
+            catch (error) {
+                return errorResult(error);
+            }
+        },
+    };
+}
+/** A mutating tool. Capability gating happens inside `run`, before any request. */
+export function writeTool(spec) {
+    return {
+        name: spec.name,
+        description: spec.description,
+        effect: "write",
+        inputSchema: spec.inputSchema,
+        async execute(input, context) {
+            try {
+                return { content: [{ type: "text", text: await spec.run(input, context) }] };
+            }
+            catch (error) {
+                return errorResult(error);
+            }
+        },
+    };
+}
+//# sourceMappingURL=toolkit.js.map

package/dist/toolkit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"toolkit.js","sourceRoot":"","sources":["../src/toolkit.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAS1C,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;AAClF,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,YAAY,CAAC,IAAc;IACzC,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,MAAM,EAAE,UAAU;QAClB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO;YAC1B,IAAI,CAAC;gBACH,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;YAC/E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,SAAS,CAAC,IAAc;IACtC,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,MAAM,EAAE,OAAO;QACf,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO;YAC1B,IAAI,CAAC;gBACH,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;YAC/E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/tools.d.ts

@@ -0,0 +1,5 @@
+import type { ToolDefinition } from "@alisio/sdk";
+import type { GoogleChatClient } from "./http.js";
+/** Build the seven Google Chat tools. Reads are `external`; mutations are `write`. */
+export declare function createGoogleChatTools(client: GoogleChatClient): ToolDefinition[];
+//# sourceMappingURL=tools.d.ts.map

package/dist/tools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tools.d.ts","sourceRoot":"","sources":["../src/tools.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,KAAK,EAAE,gBAAgB,EAAc,MAAM,WAAW,CAAC;AAmD9D,sFAAsF;AACtF,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,gBAAgB,GAAG,cAAc,EAAE,CAqThF"}