@chibitek/chibi 0.1.173 → 0.1.175

package/dist-server/server/oauth-calendar-tools.js

@@ -0,0 +1,551 @@
+// Google Calendar and Outlook calendar tools: list, create, read, change and
+// cancel events, including one occurrence, this and following, or a series.
+import { z } from "zod";
+import { GRAPH, READS, SENDS, ToolInputError, accountArg, addresses, base, bounded, call, graphRecipient, json, noNewlines, parse, recipient, } from "./oauth-account-core.js";
+const CALENDAR = "https://www.googleapis.com/calendar/v3";
+function isoInstant(value) {
+    return /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}(?::\d{2}(?:\.\d+)?)?(?:Z|[+-]\d{2}:\d{2})$/.test(value) && Number.isFinite(Date.parse(value));
+}
+function isoDateOrTime(value) {
+    return /^\d{4}-\d{2}-\d{2}$/.test(value) || /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}(?::\d{2}(?:\.\d+)?)?(?:Z|[+-]\d{2}:\d{2})?$/.test(value);
+}
+const listEventsArgs = base.extend({
+    timeMin: z.string().refine(isoInstant, "timeMin must be an ISO 8601 date-time with a time zone, e.g. 2026-10-01T00:00:00Z"),
+    timeMax: z.string().refine(isoInstant, "timeMax must be an ISO 8601 date-time with a time zone, e.g. 2026-10-08T00:00:00Z"),
+    calendarId: z.string().min(1).max(320).optional(),
+    max: z.number().int().min(1).max(100).optional(),
+}).strict();
+const createEventArgs = base.extend({
+    summary: z.string().min(1).max(1_000).refine(noNewlines, "summary must be one line"),
+    start: z.string().refine(isoDateOrTime, "start must be YYYY-MM-DD or an ISO 8601 date-time"),
+    end: z.string().refine(isoDateOrTime, "end must be YYYY-MM-DD or an ISO 8601 date-time"),
+    timeZone: z.string().min(1).max(64).regex(/^[A-Za-z0-9_+\-/ ]+$/).optional(),
+    description: z.string().max(8_000).optional(),
+    location: z.string().max(1_000).optional(),
+    attendees: z.array(z.string()).max(50).optional(),
+    calendarId: z.string().min(1).max(320).optional(),
+}).strict();
+const eventArgs = base.extend({ id: z.string().min(1).max(512).regex(/^[A-Za-z0-9!_.=+\-/~:]+$/, "not a valid id"), calendarId: z.string().min(1).max(320).optional() }).strict();
+const scopeArg = z.enum(["occurrence", "following", "series"]).optional();
+const notifyArg = z.enum(["all", "externalOnly", "none"]);
+const updateEventArgs = eventArgs.extend({
+    scope: scopeArg,
+    notify: notifyArg,
+    summary: createEventArgs.shape.summary.optional(),
+    start: createEventArgs.shape.start.optional(),
+    end: createEventArgs.shape.end.optional(),
+    timeZone: createEventArgs.shape.timeZone,
+    description: createEventArgs.shape.description,
+    location: createEventArgs.shape.location,
+    attendees: z.array(z.string()).max(50).optional(),
+    addAttendees: z.array(z.string()).max(50).optional(),
+    removeAttendees: z.array(z.string()).max(50).optional(),
+    room: z.string().max(320).optional(),
+}).strict();
+const deleteEventArgs = eventArgs.extend({ scope: scopeArg, notify: notifyArg }).strict();
+/** Graph has no way to change a meeting quietly: the organizer's edits
+ * always reach the guests, so Outlook tools only accept notify "all". */
+const outlookUpdateEventArgs = updateEventArgs.omit({ calendarId: true }).extend({ notify: z.literal("all") }).strict();
+const outlookDeleteEventArgs = deleteEventArgs.omit({ calendarId: true }).extend({ notify: z.literal("all") }).strict();
+const listEventsSchema = (withCalendar) => ({
+    type: "object",
+    properties: {
+        account: accountArg,
+        timeMin: { type: "string", description: "Start of the window, ISO 8601 with a time zone (e.g. 2026-10-01T00:00:00Z)." },
+        timeMax: { type: "string", description: "End of the window, ISO 8601 with a time zone." },
+        ...(withCalendar ? { calendarId: { type: "string", description: "Calendar id; defaults to the primary calendar." } } : {}),
+        max: { type: "integer", minimum: 1, maximum: 100, description: "Most events to return (default 25)." },
+    },
+    required: ["timeMin", "timeMax"],
+    additionalProperties: false,
+});
+const createEventSchema = (withCalendar) => ({
+    type: "object",
+    properties: {
+        account: accountArg,
+        summary: { type: "string", description: "Event title." },
+        start: { type: "string", description: "YYYY-MM-DD for an all-day event, or an ISO 8601 date-time. Without an offset, pass timeZone." },
+        end: { type: "string", description: "Same format as start. For all-day events this is the day after the last day." },
+        timeZone: { type: "string", description: "IANA time zone such as America/Los_Angeles, used when start/end have no offset." },
+        description: { type: "string" },
+        location: { type: "string" },
+        attendees: { type: "array", items: { type: "string" }, description: "Guest email addresses. They receive an invitation." },
+        ...(withCalendar ? { calendarId: { type: "string", description: "Calendar id; defaults to the primary calendar." } } : {}),
+    },
+    required: ["summary", "start", "end"],
+    additionalProperties: false,
+});
+const calendarProp = { calendarId: { type: "string", description: "Calendar id; defaults to the primary calendar." } };
+const eventIdProp = { type: "string", description: "Event id from the list tool: one occurrence of a recurring event, or a single event." };
+const scopeProp = {
+    type: "string",
+    enum: ["occurrence", "following", "series"],
+    description: "For a recurring event: this occurrence only (default), this and following, or the whole series. Pass the occurrence's id either way; the series is found from it.",
+};
+const notifyProp = (outlook) => outlook
+    ? { type: "string", enum: ["all"], description: "Outlook always tells the guests about the organizer's changes; pass all to go ahead." }
+    : { type: "string", enum: ["all", "externalOnly", "none"], description: "Who gets an email about the change: all guests, only guests outside your organization, or nobody." };
+const eventSchema = (withCalendar) => ({
+    type: "object",
+    properties: { account: accountArg, id: eventIdProp, ...(withCalendar ? calendarProp : {}) },
+    required: ["id"],
+    additionalProperties: false,
+});
+const updateEventSchema = (withCalendar) => ({
+    type: "object",
+    properties: {
+        account: accountArg,
+        id: eventIdProp,
+        ...(withCalendar ? calendarProp : {}),
+        scope: scopeProp,
+        notify: notifyProp(!withCalendar),
+        summary: { type: "string", description: "New title." },
+        description: { type: "string", description: "New description; replaces the old one." },
+        location: { type: "string" },
+        start: { type: "string", description: "New start, same format as when creating. Pass start and end together. To move a whole series, give a UTC offset." },
+        end: { type: "string", description: "New end, same format as start." },
+        timeZone: { type: "string", description: "IANA time zone for start/end without an offset." },
+        attendees: { type: "array", items: { type: "string" }, description: "Replace the whole guest list with these addresses. Guests who stay keep their reply." },
+        addAttendees: { type: "array", items: { type: "string" }, description: "Guests to add." },
+        removeAttendees: { type: "array", items: { type: "string" }, description: "Guests to remove." },
+        room: { type: "string", description: "Room or resource email address; replaces the room already booked." },
+    },
+    required: ["id", "notify"],
+    additionalProperties: false,
+});
+const deleteEventSchema = (withCalendar) => ({
+    type: "object",
+    properties: { account: accountArg, id: eventIdProp, ...(withCalendar ? calendarProp : {}), scope: scopeProp, notify: notifyProp(!withCalendar) },
+    required: ["id", "notify"],
+    additionalProperties: false,
+});
+export const GOOGLE_CALENDAR_TOOLS = [
+    { name: "calendar_list_events", provider: "google", family: "calendar", description: "List Google Calendar events between two times.", inputSchema: listEventsSchema(true), annotations: READS, args: listEventsArgs },
+    { name: "calendar_create_event", provider: "google", family: "calendar", description: "Create a Google Calendar event. Attendees receive an invitation.", inputSchema: createEventSchema(true), annotations: SENDS, args: createEventArgs },
+    { name: "calendar_get_event", provider: "google", family: "calendar", description: "Read one Google Calendar event by id: details, its series (recurringEventId, recurrence) and each guest's reply.", inputSchema: eventSchema(true), annotations: READS, args: eventArgs },
+    { name: "calendar_update_event", provider: "google", family: "calendar", description: "Change a Google Calendar event: title, description, location, times, guests or room, for one occurrence, this and following, or the whole series. notify chooses who is emailed.", inputSchema: updateEventSchema(true), annotations: SENDS, args: updateEventArgs },
+    { name: "calendar_delete_event", provider: "google", family: "calendar", description: "Cancel a Google Calendar event: one occurrence, this and following, or the whole series. notify chooses who is emailed.", inputSchema: deleteEventSchema(true), annotations: SENDS, args: deleteEventArgs },
+];
+export const OUTLOOK_CALENDAR_TOOLS = [
+    { name: "outlook_calendar_list_events", provider: "microsoft", family: "outlookCalendar", description: "List Outlook calendar events between two times (times are returned in UTC).", inputSchema: listEventsSchema(false), annotations: READS, args: listEventsArgs.omit({ calendarId: true }) },
+    { name: "outlook_calendar_create_event", provider: "microsoft", family: "outlookCalendar", description: "Create an Outlook calendar event. Attendees receive an invitation.", inputSchema: createEventSchema(false), annotations: SENDS, args: createEventArgs.omit({ calendarId: true }) },
+    { name: "outlook_calendar_get_event", provider: "microsoft", family: "outlookCalendar", description: "Read one Outlook calendar event by id: details, its series (seriesMasterId, recurrence) and each guest's reply (times in UTC).", inputSchema: eventSchema(false), annotations: READS, args: eventArgs.omit({ calendarId: true }) },
+    { name: "outlook_calendar_update_event", provider: "microsoft", family: "outlookCalendar", description: "Change an Outlook calendar event: title, description, location, times, guests or room, for one occurrence, this and following, or the whole series. Guests are told.", inputSchema: updateEventSchema(false), annotations: SENDS, args: outlookUpdateEventArgs },
+    { name: "outlook_calendar_delete_event", provider: "microsoft", family: "outlookCalendar", description: "Cancel an Outlook calendar event: one occurrence, this and following, or the whole series. Guests are told.", inputSchema: deleteEventSchema(false), annotations: SENDS, args: outlookDeleteEventArgs },
+];
+function guestEdit(args) {
+    const replace = args.attendees === undefined ? undefined : addresses(args.attendees, "attendees");
+    const add = addresses(args.addAttendees, "addAttendees");
+    const remove = addresses(args.removeAttendees, "removeAttendees");
+    const room = args.room === undefined ? undefined : addresses(args.room, "room")[0];
+    if (replace && (add.length || remove.length))
+        throw new ToolInputError("Pass attendees to replace the guest list, or addAttendees/removeAttendees, not both");
+    return replace || add.length || remove.length || room ? { replace, add, remove, room } : null;
+}
+/** Apply a guest edit to a provider's attendee list. Guests who stay keep
+ * their original entry, so their reply survives. */
+function editGuests(current, email, isRoom, make, edit) {
+    const same = (a, b) => a.toLowerCase() === b.toLowerCase();
+    const people = current.filter((guest) => !isRoom(guest));
+    let next;
+    if (edit.replace) {
+        next = edit.replace.map((address) => people.find((guest) => same(email(guest), address)) ?? make(address, false));
+    }
+    else {
+        for (const address of edit.remove) {
+            if (!people.some((guest) => same(email(guest), address)))
+                throw new ToolInputError(`removeAttendees: ${address} is not a guest of this event`);
+        }
+        next = people.filter((guest) => !edit.remove.some((address) => same(email(guest), address)));
+        for (const address of edit.add)
+            if (!next.some((guest) => same(email(guest), address)))
+                next.push(make(address, false));
+    }
+    return [...next, ...(edit.room ? [make(edit.room, true)] : current.filter(isRoom))];
+}
+function needsChange(args, fields) {
+    if (!Object.keys(fields).length && args.start === undefined && args.end === undefined)
+        throw new ToolInputError("Nothing to change: pass at least one field to update");
+    if ((args.start === undefined) !== (args.end === undefined))
+        throw new ToolInputError("Pass start and end together");
+}
+const DATE = /^\d{4}-\d{2}-\d{2}$/;
+/** Milliseconds for a date, an instant, or a wall-clock time read as UTC. */
+const millis = (value) => Date.parse(DATE.test(value) ? `${value}T00:00:00Z` : /(?:Z|[+-]\d{2}:\d{2})$/.test(value) ? value : `${value.slice(0, 19)}Z`);
+/** Move a whole series as far as one of its occurrences is being moved:
+ * the series' first start, shifted, plus the new duration. */
+function shiftSeries(seriesStart, occurrenceStart, allDay, start, end) {
+    if (DATE.test(start) !== allDay)
+        throw new ToolInputError("A whole series cannot switch between all-day and timed; change one occurrence or this and following");
+    if (!allDay && !/(?:Z|[+-]\d{2}:\d{2})$/.test(start))
+        throw new ToolInputError("start: to move a whole series, give a UTC offset (e.g. 2026-10-01T15:00:00-07:00)");
+    const moved = millis(seriesStart) + millis(start) - millis(occurrenceStart);
+    return [moved, moved + millis(end) - millis(start)];
+}
+function dayBefore(date) {
+    const day = new Date(`${date}T00:00:00Z`);
+    day.setUTCDate(day.getUTCDate() - 1);
+    return day.toISOString().slice(0, 10);
+}
+// ── Google ────────────────────────────────────────────────────────────────
+const googleTime = z.object({ dateTime: z.string().optional(), date: z.string().optional(), timeZone: z.string().optional() });
+// Loose, so a guest entry or a copied series keeps fields this file never reads.
+const googleAttendee = z.object({ email: z.string().optional(), responseStatus: z.string().optional(), resource: z.boolean().optional() }).passthrough();
+const googleEventSchema = z.object({
+    id: z.string(),
+    summary: z.string().optional(),
+    description: z.string().optional(),
+    location: z.string().optional(),
+    status: z.string().optional(),
+    htmlLink: z.string().optional(),
+    start: googleTime.optional(),
+    end: googleTime.optional(),
+    organizer: z.object({ email: z.string().optional() }).optional(),
+    attendees: z.array(googleAttendee).optional(),
+    recurringEventId: z.string().optional(),
+    originalStartTime: googleTime.optional(),
+    recurrence: z.array(z.string()).optional(),
+}).passthrough();
+function googleEvent(event) {
+    return {
+        id: event.id,
+        summary: event.summary,
+        start: event.start?.dateTime ?? event.start?.date,
+        end: event.end?.dateTime ?? event.end?.date,
+        location: event.location,
+        organizer: event.organizer?.email,
+        attendees: event.attendees?.map((attendee) => `${attendee.email ?? ""}${attendee.resource ? " (room)" : ""}${attendee.responseStatus ? ` (${attendee.responseStatus})` : ""}`),
+        description: event.description ? bounded(event.description, 2_000) : undefined,
+        recurringEventId: event.recurringEventId,
+        recurrence: event.recurrence,
+        link: event.htmlLink,
+    };
+}
+async function calendarListEvents(ctx, account, args) {
+    const calendarId = encodeURIComponent(args.calendarId ?? "primary");
+    const query = new URLSearchParams({ timeMin: args.timeMin, timeMax: args.timeMax, singleEvents: "true", orderBy: "startTime", maxResults: String(args.max ?? 25) });
+    const list = parse(z.object({ items: z.array(googleEventSchema).optional(), timeZone: z.string().optional() }), await call(ctx, account, `${CALENDAR}/calendars/${calendarId}/events?${query}`, { expect: "json" }), "Calendar");
+    return json({ account: account.email, timeZone: list.timeZone, events: (list.items ?? []).map(googleEvent) });
+}
+function eventTime(value, timeZone, field) {
+    if (/^\d{4}-\d{2}-\d{2}$/.test(value))
+        return { allDay: true, date: value };
+    const hasOffset = /(?:Z|[+-]\d{2}:\d{2})$/.test(value);
+    if (!hasOffset && !timeZone)
+        throw new ToolInputError(`${field}: add a UTC offset (e.g. 2026-10-01T15:00:00-07:00) or pass timeZone`);
+    return { allDay: false, dateTime: value, hasOffset };
+}
+function googleTimes(startValue, endValue, timeZone) {
+    const start = eventTime(startValue, timeZone, "start");
+    const end = eventTime(endValue, timeZone, "end");
+    if (start.allDay !== end.allDay)
+        throw new ToolInputError("start and end must both be dates or both be date-times");
+    const time = (value) => value.allDay
+        ? { date: value.date }
+        : { dateTime: value.dateTime, ...(timeZone ? { timeZone } : {}) };
+    return { start: time(start), end: time(end) };
+}
+async function calendarCreateEvent(ctx, account, args) {
+    const attendees = addresses(args.attendees, "attendees");
+    const body = {
+        summary: args.summary,
+        ...(args.description ? { description: args.description } : {}),
+        ...(args.location ? { location: args.location } : {}),
+        ...googleTimes(args.start, args.end, args.timeZone),
+        ...(attendees.length ? { attendees: attendees.map((email) => ({ email })) } : {}),
+    };
+    const calendarId = encodeURIComponent(args.calendarId ?? "primary");
+    const query = new URLSearchParams({ sendUpdates: attendees.length ? "all" : "none" });
+    const created = parse(googleEventSchema, await call(ctx, account, `${CALENDAR}/calendars/${calendarId}/events?${query}`, {
+        method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify(body), expect: "json",
+    }), "Calendar");
+    return json({ account: account.email, created: googleEvent(created) });
+}
+const eventUrl = (calendarId, id, query) => `${CALENDAR}/calendars/${encodeURIComponent(calendarId ?? "primary")}/events${id ? `/${encodeURIComponent(id)}` : ""}${query ? `?${new URLSearchParams(query)}` : ""}`;
+const when = (time) => time?.dateTime ?? time?.date ?? "";
+async function googleGet(ctx, account, calendarId, id) {
+    return parse(googleEventSchema, await call(ctx, account, eventUrl(calendarId, id), { expect: "json" }), "Calendar");
+}
+async function googleSave(ctx, account, method, url, body) {
+    return parse(googleEventSchema, await call(ctx, account, url, { method, headers: { "content-type": "application/json" }, body: JSON.stringify(body), expect: "json" }), "Calendar");
+}
+/** The event a scoped change lands on. An occurrence names its series in
+ * recurringEventId; after an earlier "this and following" split that is the
+ * newer series (an id ending in _R<date>), which is the one to change. */
+async function googleTarget(ctx, account, args) {
+    const scope = args.scope ?? "occurrence";
+    const event = await googleGet(ctx, account, args.calendarId, args.id);
+    if (scope === "occurrence" && event.recurrence)
+        throw new ToolInputError(`${args.id} is a whole series: pass the id of one occurrence (from calendar_list_events), or scope "series"`);
+    if (scope === "occurrence" || (!event.recurringEventId && !event.recurrence))
+        return { scope: "occurrence", event, series: event };
+    const series = event.recurringEventId ? await googleGet(ctx, account, args.calendarId, event.recurringEventId) : event;
+    const first = !event.originalStartTime || millis(when(event.originalStartTime)) === millis(when(series.start));
+    return { scope: first ? "series" : scope, event, series };
+}
+function googleFields(args, current) {
+    const guests = guestEdit(args);
+    return {
+        ...(args.summary !== undefined ? { summary: args.summary } : {}),
+        ...(args.description !== undefined ? { description: args.description } : {}),
+        ...(args.location !== undefined ? { location: args.location } : {}),
+        ...(guests ? {
+            attendees: editGuests(current.attendees ?? [], (guest) => guest.email ?? "", (guest) => guest.resource === true, (email, resource) => (resource ? { email, resource } : { email }), guests),
+        } : {}),
+    };
+}
+/** End a series just before one occurrence: UNTIL replaces any COUNT. */
+function capRecurrence(rules, from) {
+    const until = from.date ? dayBefore(from.date).replace(/-/g, "") : new Date(millis(from.dateTime ?? "") - 1_000).toISOString().replace(/[-:]|\.\d{3}/g, "");
+    return rules.map((rule) => rule.startsWith("RRULE:")
+        ? `RRULE:${[...rule.slice(6).split(";").filter((part) => !/^(UNTIL|COUNT)=/i.test(part)), `UNTIL=${until}`].join(";")}`
+        : rule);
+}
+/** What a new "this and following" series copies from the old one. */
+const SERIES_FIELDS = ["summary", "description", "location", "attendees", "colorId", "reminders", "transparency", "visibility", "guestsCanModify", "guestsCanInviteOthers", "guestsCanSeeOtherGuests"];
+async function calendarGetEvent(ctx, account, args) {
+    return json({ account: account.email, event: googleEvent(await googleGet(ctx, account, args.calendarId, args.id)) });
+}
+async function calendarUpdateEvent(ctx, account, args) {
+    const { scope, event, series } = await googleTarget(ctx, account, args);
+    const fields = googleFields(args, series);
+    needsChange(args, fields);
+    const notify = { sendUpdates: args.notify };
+    if (scope === "occurrence") {
+        const times = args.start !== undefined ? googleTimes(args.start, args.end, args.timeZone) : {};
+        const updated = await googleSave(ctx, account, "PATCH", eventUrl(args.calendarId, event.id, notify), { ...fields, ...times });
+        return json({ account: account.email, scope, updated: googleEvent(updated) });
+    }
+    if (scope === "series") {
+        let times = {};
+        if (args.start !== undefined) {
+            const allDay = Boolean(event.start?.date);
+            const [start, end] = shiftSeries(when(series.start), when(event.start), allDay, args.start, args.end);
+            const at = (ms) => allDay ? { date: new Date(ms).toISOString().slice(0, 10) } : { dateTime: new Date(ms).toISOString(), timeZone: args.timeZone ?? series.start?.timeZone };
+            times = { start: at(start), end: at(end) };
+        }
+        const updated = await googleSave(ctx, account, "PATCH", eventUrl(args.calendarId, series.id, notify), { ...fields, ...times });
+        return json({ account: account.email, scope, updated: googleEvent(updated) });
+    }
+    // Google has no "this and following" edit: start a new series at this
+    // occurrence, then end the old one before it. Creating first means a
+    // failure leaves a duplicate to delete, never lost future meetings.
+    if (series.recurrence?.some((rule) => /^RRULE:.*\bCOUNT=/i.test(rule))) {
+        throw new ToolInputError("This series ends after a set number of times, so it cannot be split: change one occurrence or the whole series");
+    }
+    const copied = Object.fromEntries(SERIES_FIELDS.filter((key) => series[key] !== undefined).map((key) => [key, series[key]]));
+    const times = args.start !== undefined ? googleTimes(args.start, args.end, args.timeZone) : { start: event.start, end: event.end };
+    const created = await googleSave(ctx, account, "POST", eventUrl(args.calendarId, "", notify), { ...copied, ...fields, ...times, recurrence: series.recurrence });
+    await googleSave(ctx, account, "PATCH", eventUrl(args.calendarId, series.id, notify), { recurrence: capRecurrence(series.recurrence ?? [], event.originalStartTime ?? {}) });
+    return json({ account: account.email, scope, updated: googleEvent(created), endedSeries: series.id, note: "The old series now ends before this occurrence; a new series with the changes starts here." });
+}
+async function calendarDeleteEvent(ctx, account, args) {
+    const { scope, event, series } = await googleTarget(ctx, account, args);
+    const notify = { sendUpdates: args.notify };
+    if (scope === "following") {
+        await googleSave(ctx, account, "PATCH", eventUrl(args.calendarId, series.id, notify), { recurrence: capRecurrence(series.recurrence ?? [], event.originalStartTime ?? {}) });
+    }
+    else {
+        await call(ctx, account, eventUrl(args.calendarId, (scope === "series" ? series : event).id, notify), { method: "DELETE", expect: "none" });
+    }
+    return json({ account: account.email, cancelled: true, scope, id: scope === "occurrence" ? event.id : series.id });
+}
+// ── Microsoft Graph ───────────────────────────────────────────────────────
+const graphTime = z.object({ dateTime: z.string().optional(), timeZone: z.string().optional() });
+const graphEventSchema = z.object({
+    id: z.string(),
+    subject: z.string().nullable().optional(),
+    start: graphTime.optional(),
+    end: graphTime.optional(),
+    isAllDay: z.boolean().optional(),
+    location: z.object({ displayName: z.string().optional() }).nullable().optional(),
+    organizer: graphRecipient.nullable().optional(),
+    attendees: z.array(graphRecipient.extend({ type: z.string().optional(), status: z.object({ response: z.string().optional() }).optional() })).optional(),
+    webLink: z.string().optional(),
+    bodyPreview: z.string().optional(),
+    body: z.object({ contentType: z.string().optional(), content: z.string().optional() }).optional(),
+    type: z.string().optional(),
+    seriesMasterId: z.string().nullable().optional(),
+    originalStartTimeZone: z.string().optional(),
+    recurrence: z.object({
+        pattern: z.record(z.string(), z.unknown()),
+        range: z.object({ type: z.string(), startDate: z.string().optional(), endDate: z.string().optional() }).passthrough(),
+    }).nullable().optional(),
+});
+function graphEvent(event) {
+    return {
+        id: event.id,
+        summary: event.subject,
+        start: event.start?.dateTime ? `${event.start.dateTime}${event.start.timeZone === "UTC" ? "Z" : ` (${event.start.timeZone ?? ""})`}` : undefined,
+        end: event.end?.dateTime ? `${event.end.dateTime}${event.end.timeZone === "UTC" ? "Z" : ` (${event.end.timeZone ?? ""})`}` : undefined,
+        allDay: event.isAllDay,
+        location: event.location?.displayName || undefined,
+        organizer: recipient(event.organizer),
+        attendees: event.attendees?.map((attendee) => `${recipient(attendee) ?? ""}${attendee.type === "resource" ? " (room)" : ""}${attendee.status?.response ? ` (${attendee.status.response})` : ""}`),
+        preview: event.bodyPreview ? bounded(event.bodyPreview, 1_000) : undefined,
+        type: event.type,
+        seriesMasterId: event.seriesMasterId ?? undefined,
+        recurrence: event.recurrence ?? undefined,
+        link: event.webLink,
+    };
+}
+async function outlookListEvents(ctx, account, args) {
+    const query = new URLSearchParams({
+        startDateTime: new Date(args.timeMin).toISOString(),
+        endDateTime: new Date(args.timeMax).toISOString(),
+        $top: String(args.max ?? 25),
+        $orderby: "start/dateTime",
+        $select: "id,subject,start,end,isAllDay,location,organizer,attendees,webLink,bodyPreview",
+    });
+    const list = parse(z.object({ value: z.array(graphEventSchema) }), await call(ctx, account, `${GRAPH}/me/calendarView?${query}`, {
+        headers: { prefer: 'outlook.timezone="UTC"' }, expect: "json",
+    }), "Outlook calendar");
+    return json({ account: account.email, timeZone: "UTC", events: list.value.map(graphEvent) });
+}
+/** Graph wants a wall-clock time plus a zone: a time with an offset is
+ * converted to UTC, one without keeps the zone the bot named. */
+export function graphDateTime(value, timeZone, field) {
+    if (/^\d{4}-\d{2}-\d{2}$/.test(value))
+        return { dateTime: `${value}T00:00:00`, timeZone: timeZone ?? "UTC", allDay: true };
+    if (/(?:Z|[+-]\d{2}:\d{2})$/.test(value)) {
+        const parsed = Date.parse(value);
+        if (!Number.isFinite(parsed))
+            throw new ToolInputError(`${field}: not a valid date-time`);
+        return { dateTime: new Date(parsed).toISOString().replace(/\.\d{3}Z$/, ""), timeZone: "UTC", allDay: false };
+    }
+    if (!timeZone)
+        throw new ToolInputError(`${field}: add a UTC offset (e.g. 2026-10-01T15:00:00-07:00) or pass timeZone`);
+    return { dateTime: value, timeZone, allDay: false };
+}
+function graphTimes(startValue, endValue, timeZone) {
+    const start = graphDateTime(startValue, timeZone, "start");
+    const end = graphDateTime(endValue, timeZone, "end");
+    if (start.allDay !== end.allDay)
+        throw new ToolInputError("start and end must both be dates or both be date-times");
+    return { start: { dateTime: start.dateTime, timeZone: start.timeZone }, end: { dateTime: end.dateTime, timeZone: end.timeZone }, isAllDay: start.allDay };
+}
+async function outlookCreateEvent(ctx, account, args) {
+    const attendees = addresses(args.attendees, "attendees");
+    const created = await graphSave(ctx, account, "POST", `${GRAPH}/me/events`, {
+        subject: args.summary,
+        ...(args.description ? { body: { contentType: "Text", content: args.description } } : {}),
+        ...graphTimes(args.start, args.end, args.timeZone),
+        ...(args.location ? { location: { displayName: args.location } } : {}),
+        ...(attendees.length ? { attendees: attendees.map((address) => ({ emailAddress: { address }, type: "required" })) } : {}),
+    });
+    return json({ account: account.email, created: graphEvent(created) });
+}
+const GRAPH_EVENT_FIELDS = "id,subject,start,end,isAllDay,location,organizer,attendees,webLink,bodyPreview,body,type,seriesMasterId,recurrence,originalStartTimeZone";
+const UTC = 'outlook.timezone="UTC"';
+const graphEventUrl = (id) => `${GRAPH}/me/events/${encodeURIComponent(id)}`;
+async function graphGet(ctx, account, id, prefer = UTC) {
+    return parse(graphEventSchema, await call(ctx, account, `${graphEventUrl(id)}?${new URLSearchParams({ $select: GRAPH_EVENT_FIELDS })}`, { headers: { prefer }, expect: "json" }), "Outlook calendar");
+}
+async function graphSave(ctx, account, method, url, body) {
+    return parse(graphEventSchema, await call(ctx, account, url, {
+        method, headers: { "content-type": "application/json", prefer: UTC }, body: JSON.stringify(body), expect: "json",
+    }), "Outlook calendar");
+}
+/** Same as googleTarget: an occurrence or exception names its series in
+ * seriesMasterId. */
+async function graphTarget(ctx, account, args) {
+    const scope = args.scope ?? "occurrence";
+    const event = await graphGet(ctx, account, args.id);
+    if (scope === "occurrence" && event.type === "seriesMaster")
+        throw new ToolInputError(`${args.id} is a whole series: pass the id of one occurrence (from outlook_calendar_list_events), or scope "series"`);
+    if (scope === "occurrence" || (!event.seriesMasterId && event.type !== "seriesMaster"))
+        return { scope: "occurrence", event, series: event };
+    const series = event.type === "seriesMaster" ? event : await graphGet(ctx, account, event.seriesMasterId);
+    const first = event.type === "seriesMaster" || millis(event.start?.dateTime ?? "") === millis(series.start?.dateTime ?? "");
+    return { scope: first ? "series" : scope, event, series };
+}
+/** Graph keeps each guest's reply by address, so only these two fields go back. */
+const graphGuests = (event) => (event.attendees ?? []).map((guest) => ({ emailAddress: { address: guest.emailAddress?.address ?? "" }, type: guest.type ?? "required" }));
+function graphFields(args, current) {
+    const guests = guestEdit(args);
+    return {
+        ...(args.summary !== undefined ? { subject: args.summary } : {}),
+        ...(args.description !== undefined ? { body: { contentType: "Text", content: args.description } } : {}),
+        ...(args.location !== undefined ? { location: { displayName: args.location } } : {}),
+        ...(guests ? {
+            attendees: editGuests(graphGuests(current), (guest) => guest.emailAddress.address, (guest) => guest.type === "resource", (address, room) => ({ emailAddress: { address }, type: room ? "resource" : "required" }), guests),
+        } : {}),
+    };
+}
+/** The local day an occurrence falls on, in its series' own time zone. */
+async function seriesDay(ctx, account, event, series) {
+    const local = await graphGet(ctx, account, event.id, `outlook.timezone="${series.originalStartTimeZone ?? "UTC"}"`);
+    return { local, day: (local.start?.dateTime ?? "").slice(0, 10) };
+}
+function endSeriesBefore(series, day) {
+    const recurrence = series.recurrence;
+    return { recurrence: { pattern: recurrence.pattern, range: { ...recurrence.range, type: "endDate", endDate: dayBefore(day) } } };
+}
+async function outlookGetEvent(ctx, account, args) {
+    const event = await graphGet(ctx, account, args.id, `${UTC}, outlook.body-content-type="text"`);
+    return json({ account: account.email, timeZone: "UTC", event: { ...graphEvent(event), description: event.body?.content ? bounded(event.body.content, 2_000) : undefined } });
+}
+async function outlookUpdateEvent(ctx, account, args) {
+    const { scope, event, series } = await graphTarget(ctx, account, args);
+    const fields = graphFields(args, series);
+    needsChange(args, fields);
+    if (scope === "occurrence") {
+        const updated = await graphSave(ctx, account, "PATCH", graphEventUrl(event.id), { ...fields, ...(args.start !== undefined ? graphTimes(args.start, args.end, args.timeZone) : {}) });
+        return json({ account: account.email, scope, updated: graphEvent(updated) });
+    }
+    const zone = series.originalStartTimeZone ?? "UTC";
+    if (scope === "series") {
+        let times = {};
+        if (args.start !== undefined) {
+            // Shift the series' first start in its own zone, so it keeps its wall-clock time across DST.
+            const local = await graphGet(ctx, account, series.id, `outlook.timezone="${zone}"`);
+            const [start, end] = shiftSeries(local.start?.dateTime ?? "", event.start?.dateTime ?? "", event.isAllDay === true, args.start, args.end);
+            const at = (ms) => ({ dateTime: new Date(ms).toISOString().slice(0, 19), timeZone: zone });
+            times = { start: at(start), end: at(end) };
+        }
+        const updated = await graphSave(ctx, account, "PATCH", graphEventUrl(series.id), { ...fields, ...times });
+        return json({ account: account.email, scope, updated: graphEvent(updated) });
+    }
+    // Graph has no "this and following" edit either: same split as Google.
+    if (!series.recurrence || series.recurrence.range.type === "numbered") {
+        throw new ToolInputError("This series ends after a set number of times, so it cannot be split: change one occurrence or the whole series");
+    }
+    const { local, day } = await seriesDay(ctx, account, event, series);
+    const times = args.start !== undefined
+        ? graphTimes(args.start, args.end, args.timeZone)
+        : { start: { dateTime: local.start?.dateTime, timeZone: zone }, end: { dateTime: local.end?.dateTime, timeZone: zone }, isAllDay: series.isAllDay === true };
+    const created = await graphSave(ctx, account, "POST", `${GRAPH}/me/events`, {
+        subject: series.subject,
+        ...(series.body?.content ? { body: series.body } : {}),
+        ...(series.location?.displayName ? { location: { displayName: series.location.displayName } } : {}),
+        attendees: graphGuests(series),
+        ...fields,
+        ...times,
+        recurrence: { pattern: series.recurrence.pattern, range: { ...series.recurrence.range, startDate: day } },
+    });
+    await graphSave(ctx, account, "PATCH", graphEventUrl(series.id), endSeriesBefore(series, day));
+    return json({ account: account.email, scope, updated: graphEvent(created), endedSeries: series.id, note: "The old series now ends before this occurrence; a new series with the changes starts here." });
+}
+async function outlookDeleteEvent(ctx, account, args) {
+    const { scope, event, series } = await graphTarget(ctx, account, args);
+    if (scope === "following") {
+        const { day } = await seriesDay(ctx, account, event, series);
+        await graphSave(ctx, account, "PATCH", graphEventUrl(series.id), endSeriesBefore(series, day));
+    }
+    else {
+        await call(ctx, account, graphEventUrl((scope === "series" ? series : event).id), { method: "DELETE", expect: "none" });
+    }
+    return json({ account: account.email, cancelled: true, scope, id: scope === "occurrence" ? event.id : series.id });
+}
+export const CALENDAR_RUNNERS = {
+    calendar_list_events: calendarListEvents,
+    calendar_create_event: calendarCreateEvent,
+    calendar_get_event: calendarGetEvent,
+    calendar_update_event: calendarUpdateEvent,
+    calendar_delete_event: calendarDeleteEvent,
+    outlook_calendar_list_events: outlookListEvents,
+    outlook_calendar_create_event: outlookCreateEvent,
+    outlook_calendar_get_event: outlookGetEvent,
+    outlook_calendar_update_event: outlookUpdateEvent,
+    outlook_calendar_delete_event: outlookDeleteEvent,
+};

package/dist-server/server/paw/service.js

@@ -89,7 +89,8 @@ export class PawService {
                 this.store.setBaseline(path, readText(this.root, path) ?? "");
             this.state = { ...this.state, template: "chibitek" };
         }
-        const result = applyInterview(this.root, { ...answers, name: answers.name || this.options.person().name }, { personEmail: this.options.person().email });
+        // an About me already there (written by hand, or filled from Nexus) is kept
+        const result = applyInterview(this.root, { ...answers, name: answers.name || this.options.person().name }, { personEmail: this.options.person().email, keepAboutMe: Boolean(this.aboutMe().trim()) });
         this.saveState({ ...this.state, departments: result.departments, interviewedAt: Date.now() });
         return this.status();
     }

package/dist-server/server/paw/workspace.js

@@ -187,7 +187,8 @@ export function applyInterview(root, answers, options = {}) {
         }
     }
     const aboutMe = aboutMeMarkdown(answers, department?.name ?? "", options.now);
-    writeText(root, "me/about-me.md", aboutMe);
+    if (!options.keepAboutMe)
+        writeText(root, "me/about-me.md", aboutMe);
     applyLocks(root, manifest, options.personEmail ?? "");
     return { departments, aboutMe };
 }

package/dist-server/server/vault/routes.js

@@ -1,4 +1,5 @@
 import { PASS } from "../routes/table.js";
+import { VaultCsvError, vaultLoginsFromCsv } from "../../shared/vault-csv.js";
 import { VaultError } from "./store.js";
 /** The owner is supplied by the authenticated host, never from request JSON.
  * Authorization runs on reads too, and is checked again after reading a body. */
@@ -13,6 +14,25 @@ export function createVaultRoutes(deps) {
         const store = deps.store();
         if (!store)
             return json(res, 503, { error: "Vault encryption is unavailable. Unlock the secure store and try again." });
+        if (path === "/api/vault/import") {
+            if (method !== "POST")
+                return json(res, 405, { error: "Method not allowed." });
+            const body = await readBody(req, 8_000_000).catch(() => null);
+            if (deps.owner(req, auth) !== ownerId || deps.store() !== store)
+                return json(res, 403, { error: "Vault access changed. Try again." });
+            if (typeof body?.csv !== "string")
+                return json(res, 400, { error: "Choose a CSV file exported from your password manager." });
+            try {
+                const { logins, skipped } = vaultLoginsFromCsv(body.csv);
+                return json(res, 200, { ...store.importLogins(ownerId, logins), skipped });
+            }
+            catch (error) {
+                // Neither message echoes anything from a row.
+                if (error instanceof VaultError || error instanceof VaultCsvError)
+                    return json(res, 400, { error: error.message });
+                return json(res, 503, { error: "Vault could not complete the request." });
+            }
+        }
         const item = /^\/api\/vault\/([0-9a-f-]{36})$/.exec(path);
         if (path !== "/api/vault" && !item)
             return json(res, 404, { error: "Vault item is unavailable." });

package/dist-server/server/vault/store.js

@@ -143,6 +143,30 @@ export class VaultStore {
             return vaultMetadata(item);
         });
     }
+    /** Adds logins in one write. A login already saved for the same website
+     * and username is left as it is and counted in `duplicates`. */
+    importLogins(ownerId, logins) {
+        owner(ownerId);
+        const parsed = logins.map((input) => vaultInputSchema.safeParse(input));
+        if (parsed.some((result) => !result.success))
+            throw new VaultError("Invalid Vault item.");
+        return this.mutate((items) => {
+            const key = (item) => item.kind === "login" ? `${item.website}\n${item.username}` : "";
+            const seen = new Set(items.filter((item) => item.ownerId === ownerId).map(key));
+            const now = Date.now();
+            let added = 0;
+            for (const { data } of parsed) {
+                if (seen.has(key(data)))
+                    continue;
+                seen.add(key(data));
+                items.push({ ...data, id: randomUUID(), ownerId, createdAt: now, updatedAt: now });
+                added++;
+            }
+            if (items.length > MAX_ITEMS)
+                throw new VaultError(`Vault holds up to ${MAX_ITEMS} items. This import would go over that.`);
+            return { added, duplicates: logins.length - added };
+        });
+    }
     update(ownerId, id, input) {
         owner(ownerId);
         if (!input || typeof input !== "object" || Array.isArray(input))