@dereekb/firebase-server 13.31.0 → 13.33.0

package/calcom/index.esm.js

@@ -0,0 +1,1437 @@
+import { calcomOAuthAuthorizeUrlFactory, CALCOM_OAUTH_SCOPE_DELIMITER, calcomAccessTokenFromTokenResponse, refreshAccessToken, CalcomOAuthAccessTokenError, CalcomOAuthAuthFailureError, CalcomServerFetchResponseError } from '@dereekb/calcom';
+import { CALCOM_USER_EXTERNAL_CONNECTION_PROVIDER_TYPE } from '@dereekb/firebase';
+import { userExternalConnectionOAuthControllerPath, userExternalConnectionOAuthRoutesForGlobalRouteExclude, userExternalConnectionOAuthServiceConfigFactory, UserExternalConnectionOAuthServiceConfig, UserExternalConnectionStateCoder, UserExternalConnectionServerActions, UserExternalConnectionAccessor, AbstractUserExternalConnectionOAuthService, mergeRefreshedUserExternalConnectionCredentials, DEFAULT_USER_EXTERNAL_CONNECTION_REFRESH_FAILURE_ERROR_CODE, userExternalConnectionProviderNotConnectedError, userExternalConnectionCredentialsExpiredError, AbstractUserExternalConnectionOAuthController } from '@dereekb/firebase-server/model';
+import { MS_IN_SECOND, HTTP_UNAUTHORIZED_STATUS_CODE } from '@dereekb/util';
+import { safeToJsDate } from '@dereekb/date';
+import { Injectable, Inject, Logger, Controller } from '@nestjs/common';
+import { CalcomOAuthApi, CalcomApi } from '@dereekb/calcom/nestjs';
+import { FetchResponseError, fetchJsonFunction, returnNullHandleFetchJsonParseErrorFunction } from '@dereekb/util/fetch';
+import { ConfigModule } from '@nestjs/config';
+import { FirebaseServerEnvService } from '@dereekb/firebase-server';
+
+function _type_of$3(obj) {
+    "@swc/helpers - typeof";
+    return obj && typeof Symbol !== "undefined" && obj.constructor === Symbol ? "symbol" : typeof obj;
+}
+function __decorate(decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if ((typeof Reflect === "undefined" ? "undefined" : _type_of$3(Reflect)) === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for(var i = decorators.length - 1; i >= 0; i--)if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+function __param(paramIndex, decorator) {
+    return function(target, key) {
+        decorator(target, key, paramIndex);
+    };
+}
+typeof SuppressedError === "function" ? SuppressedError : function(error, suppressed, message) {
+    var e = new Error(message);
+    return e.name = "SuppressedError", e.error = error, e.suppressed = suppressed, e;
+};
+
+function _assert_this_initialized$2(self) {
+    if (self === void 0) {
+        throw new ReferenceError("this hasn't been initialised - super() hasn't been called");
+    }
+    return self;
+}
+function _call_super$2(_this, derived, args) {
+    derived = _get_prototype_of$2(derived);
+    return _possible_constructor_return$2(_this, _is_native_reflect_construct$2() ? Reflect.construct(derived, args || [], _get_prototype_of$2(_this).constructor) : derived.apply(_this, args));
+}
+function _class_call_check$3(instance, Constructor) {
+    if (!(instance instanceof Constructor)) {
+        throw new TypeError("Cannot call a class as a function");
+    }
+}
+function _define_property$3(obj, key, value) {
+    if (key in obj) {
+        Object.defineProperty(obj, key, {
+            value: value,
+            enumerable: true,
+            configurable: true,
+            writable: true
+        });
+    } else {
+        obj[key] = value;
+    }
+    return obj;
+}
+function _get_prototype_of$2(o) {
+    _get_prototype_of$2 = Object.setPrototypeOf ? Object.getPrototypeOf : function getPrototypeOf(o) {
+        return o.__proto__ || Object.getPrototypeOf(o);
+    };
+    return _get_prototype_of$2(o);
+}
+function _inherits$2(subClass, superClass) {
+    if (typeof superClass !== "function" && superClass !== null) {
+        throw new TypeError("Super expression must either be null or a function");
+    }
+    subClass.prototype = Object.create(superClass && superClass.prototype, {
+        constructor: {
+            value: subClass,
+            writable: true,
+            configurable: true
+        }
+    });
+    if (superClass) _set_prototype_of$2(subClass, superClass);
+}
+function _object_spread$1(target) {
+    for(var i = 1; i < arguments.length; i++){
+        var source = arguments[i] != null ? arguments[i] : {};
+        var ownKeys = Object.keys(source);
+        if (typeof Object.getOwnPropertySymbols === "function") {
+            ownKeys = ownKeys.concat(Object.getOwnPropertySymbols(source).filter(function(sym) {
+                return Object.getOwnPropertyDescriptor(source, sym).enumerable;
+            }));
+        }
+        ownKeys.forEach(function(key) {
+            _define_property$3(target, key, source[key]);
+        });
+    }
+    return target;
+}
+function ownKeys$1(object, enumerableOnly) {
+    var keys = Object.keys(object);
+    if (Object.getOwnPropertySymbols) {
+        var symbols = Object.getOwnPropertySymbols(object);
+        keys.push.apply(keys, symbols);
+    }
+    return keys;
+}
+function _object_spread_props$1(target, source) {
+    source = source != null ? source : {};
+    if (Object.getOwnPropertyDescriptors) {
+        Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
+    } else {
+        ownKeys$1(Object(source)).forEach(function(key) {
+            Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
+        });
+    }
+    return target;
+}
+function _possible_constructor_return$2(self, call) {
+    if (call && (_type_of$2(call) === "object" || typeof call === "function")) {
+        return call;
+    }
+    return _assert_this_initialized$2(self);
+}
+function _set_prototype_of$2(o, p) {
+    _set_prototype_of$2 = Object.setPrototypeOf || function setPrototypeOf(o, p) {
+        o.__proto__ = p;
+        return o;
+    };
+    return _set_prototype_of$2(o, p);
+}
+function _type_of$2(obj) {
+    "@swc/helpers - typeof";
+    return obj && typeof Symbol !== "undefined" && obj.constructor === Symbol ? "symbol" : typeof obj;
+}
+function _is_native_reflect_construct$2() {
+    try {
+        var result = !Boolean.prototype.valueOf.call(Reflect.construct(Boolean, [], function() {}));
+    } catch (_) {}
+    return (_is_native_reflect_construct$2 = function() {
+        return !!result;
+    })();
+}
+/**
+ * Controller path the Cal.com external-connection OAuth endpoints are mounted at.
+ *
+ * Derived from the framework's path factory, the same expression the redirect URI and the
+ * global-prefix exclusion are built from, so the three cannot drift apart.
+ */ var CALCOM_USER_EXTERNAL_CONNECTION_OAUTH_CONTROLLER_PATH = userExternalConnectionOAuthControllerPath(CALCOM_USER_EXTERNAL_CONNECTION_PROVIDER_TYPE);
+/**
+ * Routes to exclude from an app's global API route prefix so the Cal.com callback controller stays
+ * mounted at `/oauth/calcom/*`.
+ *
+ * Spread this into the `exclude` list of the app's `globalApiRoutePrefix` config, alongside
+ * `FIREBASE_SERVER_OIDC_ROUTES_FOR_GLOBAL_ROUTE_EXCLUDE`.
+ */ var CALCOM_USER_EXTERNAL_CONNECTION_OAUTH_ROUTES_FOR_GLOBAL_ROUTE_EXCLUDE = userExternalConnectionOAuthRoutesForGlobalRouteExclude(CALCOM_USER_EXTERNAL_CONNECTION_PROVIDER_TYPE);
+/**
+ * The scopes requested when an app does not declare its own.
+ *
+ * Declared in code, deliberately NOT read from the environment: the set to request follows from what
+ * the integration actually does, so it is a property of the code rather than of a deployment.
+ * Requesting less than the code uses does not make it work — it moves the failure from the consent
+ * screen to the first API call.
+ *
+ * Least privilege for a per-user calendar connect: read which meeting types exist, read the user's
+ * availability, and read/write bookings. Excludes `EVENT_TYPE_WRITE` and `SCHEDULE_WRITE` —
+ * connecting a calendar does not involve editing the user's meeting types or availability — and
+ * `PROFILE_READ`, which is only needed to label the connection with the Cal.com account it belongs
+ * to.
+ *
+ * Cal.com refuses the authorize request outright when the requested set exceeds what the OAuth
+ * client is registered for ("Requested scope exceeds the client's registered scopes"). That is a
+ * registration problem: register the scopes the code needs, rather than narrowing the request to fit.
+ * An app whose integration genuinely does less can declare its own set on the module metadata, in
+ * code where it is reviewable.
+ */ var DEFAULT_CALCOM_OAUTH_SCOPES = [
+    'EVENT_TYPE_READ',
+    'SCHEDULE_READ',
+    'BOOKING_READ',
+    'BOOKING_WRITE'
+];
+/**
+ * Configuration for the {@link CalcomUserExternalConnectionOAuthService}.
+ *
+ * Extends the framework config with the one thing that is Cal.com's own — which scopes to request.
+ */ var CalcomUserExternalConnectionOAuthServiceConfig = /*#__PURE__*/ function(UserExternalConnectionOAuthServiceConfig) {
+    _inherits$2(CalcomUserExternalConnectionOAuthServiceConfig, UserExternalConnectionOAuthServiceConfig);
+    function CalcomUserExternalConnectionOAuthServiceConfig() {
+        _class_call_check$3(this, CalcomUserExternalConnectionOAuthServiceConfig);
+        var _this;
+        _this = _call_super$2(this, CalcomUserExternalConnectionOAuthServiceConfig, arguments), _define_property$3(_this, "scopes", void 0);
+        return _this;
+    }
+    return CalcomUserExternalConnectionOAuthServiceConfig;
+}(UserExternalConnectionOAuthServiceConfig);
+/**
+ * Builds the Cal.com connect flow's configuration from the app's configured origins.
+ *
+ * Nothing here is read from the environment as a value: the redirect URI is derived from the app's
+ * OAuth origin plus the mounted controller path, and the return URLs from the app URL plus
+ * code-declared paths. Registering Cal.com therefore adds no deployment configuration beyond the
+ * client credentials themselves.
+ *
+ * @param config - The env service, the return paths, and the optional scope override.
+ * @returns The validated service configuration.
+ */ function calcomUserExternalConnectionOAuthServiceConfigFactory(config) {
+    var envService = config.envService, successPath = config.successPath, failurePath = config.failurePath, scopes = config.scopes;
+    var baseConfig = userExternalConnectionOAuthServiceConfigFactory({
+        envService: envService,
+        providerType: CALCOM_USER_EXTERNAL_CONNECTION_PROVIDER_TYPE,
+        successPath: successPath,
+        failurePath: failurePath
+    });
+    return _object_spread_props$1(_object_spread$1({}, baseConfig), {
+        scopes: scopes !== null && scopes !== void 0 ? scopes : DEFAULT_CALCOM_OAUTH_SCOPES
+    });
+}
+
+function _assert_this_initialized$1(self) {
+    if (self === void 0) {
+        throw new ReferenceError("this hasn't been initialised - super() hasn't been called");
+    }
+    return self;
+}
+function asyncGeneratorStep$2(gen, resolve, reject, _next, _throw, key, arg) {
+    try {
+        var info = gen[key](arg);
+        var value = info.value;
+    } catch (error) {
+        reject(error);
+        return;
+    }
+    if (info.done) {
+        resolve(value);
+    } else {
+        Promise.resolve(value).then(_next, _throw);
+    }
+}
+function _async_to_generator$2(fn) {
+    return function() {
+        var self = this, args = arguments;
+        return new Promise(function(resolve, reject) {
+            var gen = fn.apply(self, args);
+            function _next(value) {
+                asyncGeneratorStep$2(gen, resolve, reject, _next, _throw, "next", value);
+            }
+            function _throw(err) {
+                asyncGeneratorStep$2(gen, resolve, reject, _next, _throw, "throw", err);
+            }
+            _next(undefined);
+        });
+    };
+}
+function _call_super$1(_this, derived, args) {
+    derived = _get_prototype_of$1(derived);
+    return _possible_constructor_return$1(_this, _is_native_reflect_construct$1() ? Reflect.construct(derived, [], _get_prototype_of$1(_this).constructor) : derived.apply(_this, args));
+}
+function _class_call_check$2(instance, Constructor) {
+    if (!(instance instanceof Constructor)) {
+        throw new TypeError("Cannot call a class as a function");
+    }
+}
+function _defineProperties(target, props) {
+    for(var i = 0; i < props.length; i++){
+        var descriptor = props[i];
+        descriptor.enumerable = descriptor.enumerable || false;
+        descriptor.configurable = true;
+        if ("value" in descriptor) descriptor.writable = true;
+        Object.defineProperty(target, descriptor.key, descriptor);
+    }
+}
+function _create_class(Constructor, protoProps, staticProps) {
+    if (protoProps) _defineProperties(Constructor.prototype, protoProps);
+    return Constructor;
+}
+function _define_property$2(obj, key, value) {
+    if (key in obj) {
+        Object.defineProperty(obj, key, {
+            value: value,
+            enumerable: true,
+            configurable: true,
+            writable: true
+        });
+    } else {
+        obj[key] = value;
+    }
+    return obj;
+}
+function _get_prototype_of$1(o) {
+    _get_prototype_of$1 = Object.setPrototypeOf ? Object.getPrototypeOf : function getPrototypeOf(o) {
+        return o.__proto__ || Object.getPrototypeOf(o);
+    };
+    return _get_prototype_of$1(o);
+}
+function _inherits$1(subClass, superClass) {
+    if (typeof superClass !== "function" && superClass !== null) {
+        throw new TypeError("Super expression must either be null or a function");
+    }
+    subClass.prototype = Object.create(superClass && superClass.prototype, {
+        constructor: {
+            value: subClass,
+            writable: true,
+            configurable: true
+        }
+    });
+    if (superClass) _set_prototype_of$1(subClass, superClass);
+}
+function _possible_constructor_return$1(self, call) {
+    if (call && (_type_of$1(call) === "object" || typeof call === "function")) {
+        return call;
+    }
+    return _assert_this_initialized$1(self);
+}
+function _set_prototype_of$1(o, p) {
+    _set_prototype_of$1 = Object.setPrototypeOf || function setPrototypeOf(o, p) {
+        o.__proto__ = p;
+        return o;
+    };
+    return _set_prototype_of$1(o, p);
+}
+function _type_of$1(obj) {
+    "@swc/helpers - typeof";
+    return obj && typeof Symbol !== "undefined" && obj.constructor === Symbol ? "symbol" : typeof obj;
+}
+function _is_native_reflect_construct$1() {
+    try {
+        var result = !Boolean.prototype.valueOf.call(Reflect.construct(Boolean, [], function() {}));
+    } catch (_) {}
+    return (_is_native_reflect_construct$1 = function() {
+        return !!result;
+    })();
+}
+function _ts_generator$2(thisArg, body) {
+    var f, y, t, _ = {
+        label: 0,
+        sent: function() {
+            if (t[0] & 1) throw t[1];
+            return t[1];
+        },
+        trys: [],
+        ops: []
+    }, g = Object.create((typeof Iterator === "function" ? Iterator : Object).prototype), d = Object.defineProperty;
+    return d(g, "next", {
+        value: verb(0)
+    }), d(g, "throw", {
+        value: verb(1)
+    }), d(g, "return", {
+        value: verb(2)
+    }), typeof Symbol === "function" && d(g, Symbol.iterator, {
+        value: function() {
+            return this;
+        }
+    }), g;
+    function verb(n) {
+        return function(v) {
+            return step([
+                n,
+                v
+            ]);
+        };
+    }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while(g && (g = 0, op[0] && (_ = 0)), _)try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [
+                op[0] & 2,
+                t.value
+            ];
+            switch(op[0]){
+                case 0:
+                case 1:
+                    t = op;
+                    break;
+                case 4:
+                    _.label++;
+                    return {
+                        value: op[1],
+                        done: false
+                    };
+                case 5:
+                    _.label++;
+                    y = op[1];
+                    op = [
+                        0
+                    ];
+                    continue;
+                case 7:
+                    op = _.ops.pop();
+                    _.trys.pop();
+                    continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) {
+                        _ = 0;
+                        continue;
+                    }
+                    if (op[0] === 3 && (!t || op[1] > t[0] && op[1] < t[3])) {
+                        _.label = op[1];
+                        break;
+                    }
+                    if (op[0] === 6 && _.label < t[1]) {
+                        _.label = t[1];
+                        t = op;
+                        break;
+                    }
+                    if (t && _.label < t[2]) {
+                        _.label = t[2];
+                        _.ops.push(op);
+                        break;
+                    }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop();
+                    continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) {
+            op = [
+                6,
+                e
+            ];
+            y = 0;
+        } finally{
+            f = t = 0;
+        }
+        if (op[0] & 5) throw op[1];
+        return {
+            value: op[0] ? op[1] : void 0,
+            done: true
+        };
+    }
+}
+/**
+ * Maps an exchanged Cal.com token to the credentials stored on the private connection document.
+ *
+ * The `refreshToken` written here is the rotated one from the exchange — Cal.com invalidates the
+ * token each use, so persisting the one we sent would break the next refresh.
+ *
+ * @param accessToken - The exchanged Cal.com access token.
+ * @returns The credentials to store.
+ */ function calcomUserExternalConnectionCredentials(accessToken) {
+    var token = accessToken.accessToken, refreshToken = accessToken.refreshToken, expiresAt = accessToken.expiresAt, scope = accessToken.scope;
+    // split on the same delimiter the authorize request joins with, so the round trip stays symmetric
+    var scopes = scope ? scope.split(CALCOM_OAUTH_SCOPE_DELIMITER).filter(function(x) {
+        return x.length > 0;
+    }) : undefined;
+    return {
+        accessToken: token,
+        refreshToken: refreshToken,
+        tokenType: 'Bearer',
+        issuedAt: new Date().toISOString(),
+        expiresAt: expiresAt.toISOString(),
+        scopes: scopes
+    };
+}
+/**
+ * Cal.com's half of the external-connection authorization-code handoff.
+ *
+ * Everything else — resolving who is connecting, surfacing a refusal, persisting the credentials,
+ * choosing the redirect — is the framework's.
+ */ var CalcomUserExternalConnectionOAuthService = /*#__PURE__*/ function(AbstractUserExternalConnectionOAuthService) {
+    _inherits$1(CalcomUserExternalConnectionOAuthService, AbstractUserExternalConnectionOAuthService);
+    function CalcomUserExternalConnectionOAuthService(config, stateCoder, userExternalConnectionActions, userExternalConnectionAccessor, oauthApi) {
+        _class_call_check$2(this, CalcomUserExternalConnectionOAuthService);
+        var _this;
+        _this = _call_super$1(this, CalcomUserExternalConnectionOAuthService), _define_property$2(_this, "config", void 0), _define_property$2(_this, "stateCoder", void 0), _define_property$2(_this, "userExternalConnectionActions", void 0), _define_property$2(_this, "userExternalConnectionAccessor", void 0), _define_property$2(_this, "oauthApi", void 0), _define_property$2(_this, "authorizeUrlFactory", void 0);
+        _this.config = config;
+        _this.stateCoder = stateCoder;
+        _this.userExternalConnectionActions = userExternalConnectionActions;
+        _this.userExternalConnectionAccessor = userExternalConnectionAccessor;
+        _this.oauthApi = oauthApi;
+        var scopes = config.scopes, userExternalConnectionOAuth = config.userExternalConnectionOAuth;
+        // read through the api rather than injecting CalcomOAuthServiceConfig directly, which the OAuth
+        // module does not export to its dependents
+        var clientId = oauthApi.config.calcomOAuth.clientId;
+        // CalcomOAuthServiceConfig accepts an api-key-only configuration, which has no client id — that
+        // would otherwise compose an authorize URL carrying `client_id=undefined` and fail at the
+        // consent screen rather than at startup
+        if (!clientId) {
+            throw new Error('CalcomUserExternalConnectionOAuthService requires a Cal.com OAuth clientId (CALCOM_CLIENT_ID). An api-key-only Cal.com configuration cannot run the per-user connect flow.');
+        }
+        _this.authorizeUrlFactory = calcomOAuthAuthorizeUrlFactory({
+            clientId: clientId,
+            redirectUri: userExternalConnectionOAuth.redirectUri,
+            scopes: scopes
+        });
+        return _this;
+    }
+    _create_class(CalcomUserExternalConnectionOAuthService, [
+        {
+            key: "authorizeUrlForState",
+            value: function authorizeUrlForState(state) {
+                return this.authorizeUrlFactory({
+                    state: state
+                });
+            }
+        },
+        {
+            key: "credentialsForAuthorizationCode",
+            value: function credentialsForAuthorizationCode(input) {
+                return _async_to_generator$2(function() {
+                    var accessToken;
+                    return _ts_generator$2(this, function(_state) {
+                        switch(_state.label){
+                            case 0:
+                                return [
+                                    4,
+                                    this.oauthApi.exchangeAuthorizationCodeToAccessToken({
+                                        code: input.code,
+                                        redirectUri: input.redirectUri
+                                    })
+                                ];
+                            case 1:
+                                accessToken = _state.sent();
+                                return [
+                                    2,
+                                    calcomUserExternalConnectionCredentials(accessToken)
+                                ];
+                        }
+                    });
+                }).call(this);
+            }
+        },
+        {
+            key: "refreshCredentials",
+            value: function refreshCredentials(input) {
+                return _async_to_generator$2(function() {
+                    var refreshToken, response;
+                    return _ts_generator$2(this, function(_state) {
+                        switch(_state.label){
+                            case 0:
+                                refreshToken = input.credentials.refreshToken;
+                                if (!refreshToken) {
+                                    throw new Error('CalcomUserExternalConnectionOAuthService.refreshCredentials: the stored credentials carry no refresh token.');
+                                }
+                                return [
+                                    4,
+                                    refreshAccessToken(this.oauthApi.oauthContext)({
+                                        refreshToken: refreshToken
+                                    })
+                                ];
+                            case 1:
+                                response = _state.sent();
+                                return [
+                                    2,
+                                    calcomUserExternalConnectionCredentials(calcomAccessTokenFromTokenResponse(response))
+                                ];
+                        }
+                    });
+                }).call(this);
+            }
+        }
+    ]);
+    return CalcomUserExternalConnectionOAuthService;
+}(AbstractUserExternalConnectionOAuthService);
+CalcomUserExternalConnectionOAuthService = __decorate([
+    Injectable(),
+    __param(0, Inject(CalcomUserExternalConnectionOAuthServiceConfig)),
+    __param(1, Inject(UserExternalConnectionStateCoder)),
+    __param(2, Inject(UserExternalConnectionServerActions)),
+    __param(3, Inject(UserExternalConnectionAccessor)),
+    __param(4, Inject(CalcomOAuthApi))
+], CalcomUserExternalConnectionOAuthService);
+
+function asyncGeneratorStep$1(gen, resolve, reject, _next, _throw, key, arg) {
+    try {
+        var info = gen[key](arg);
+        var value = info.value;
+    } catch (error) {
+        reject(error);
+        return;
+    }
+    if (info.done) {
+        resolve(value);
+    } else {
+        Promise.resolve(value).then(_next, _throw);
+    }
+}
+function _async_to_generator$1(fn) {
+    return function() {
+        var self = this, args = arguments;
+        return new Promise(function(resolve, reject) {
+            var gen = fn.apply(self, args);
+            function _next(value) {
+                asyncGeneratorStep$1(gen, resolve, reject, _next, _throw, "next", value);
+            }
+            function _throw(err) {
+                asyncGeneratorStep$1(gen, resolve, reject, _next, _throw, "throw", err);
+            }
+            _next(undefined);
+        });
+    };
+}
+function _ts_generator$1(thisArg, body) {
+    var f, y, t, _ = {
+        label: 0,
+        sent: function() {
+            if (t[0] & 1) throw t[1];
+            return t[1];
+        },
+        trys: [],
+        ops: []
+    }, g = Object.create((typeof Iterator === "function" ? Iterator : Object).prototype), d = Object.defineProperty;
+    return d(g, "next", {
+        value: verb(0)
+    }), d(g, "throw", {
+        value: verb(1)
+    }), d(g, "return", {
+        value: verb(2)
+    }), typeof Symbol === "function" && d(g, Symbol.iterator, {
+        value: function() {
+            return this;
+        }
+    }), g;
+    function verb(n) {
+        return function(v) {
+            return step([
+                n,
+                v
+            ]);
+        };
+    }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while(g && (g = 0, op[0] && (_ = 0)), _)try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [
+                op[0] & 2,
+                t.value
+            ];
+            switch(op[0]){
+                case 0:
+                case 1:
+                    t = op;
+                    break;
+                case 4:
+                    _.label++;
+                    return {
+                        value: op[1],
+                        done: false
+                    };
+                case 5:
+                    _.label++;
+                    y = op[1];
+                    op = [
+                        0
+                    ];
+                    continue;
+                case 7:
+                    op = _.ops.pop();
+                    _.trys.pop();
+                    continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) {
+                        _ = 0;
+                        continue;
+                    }
+                    if (op[0] === 3 && (!t || op[1] > t[0] && op[1] < t[3])) {
+                        _.label = op[1];
+                        break;
+                    }
+                    if (op[0] === 6 && _.label < t[1]) {
+                        _.label = t[1];
+                        t = op;
+                        break;
+                    }
+                    if (t && _.label < t[2]) {
+                        _.label = t[2];
+                        _.ops.push(op);
+                        break;
+                    }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop();
+                    continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) {
+            op = [
+                6,
+                e
+            ];
+            y = 0;
+        } finally{
+            f = t = 0;
+        }
+        if (op[0] & 5) throw op[1];
+        return {
+            value: op[0] ? op[1] : void 0,
+            done: true
+        };
+    }
+}
+/**
+ * Maps stored connection credentials to a {@link CalcomAccessToken}.
+ *
+ * @param credentials - The credentials stored for the `calcom` provider.
+ * @returns The equivalent Cal.com access token, or null when the credentials cannot form one.
+ */ function calcomAccessTokenFromUserExternalConnectionCredentials(credentials) {
+    var expiresAt = safeToJsDate(credentials === null || credentials === void 0 ? void 0 : credentials.expiresAt);
+    var result;
+    // Cal.com's token type requires all four, and its factory reads `expiresAt` to decide whether to
+    // refresh — a token synthesized without one would be treated as valid forever
+    if ((credentials === null || credentials === void 0 ? void 0 : credentials.refreshToken) && expiresAt != null) {
+        var _ref, _credentials_scopes;
+        var issuedAt = safeToJsDate(credentials.issuedAt);
+        var expiresIn = Math.round((expiresAt.getTime() - ((_ref = issuedAt === null || issuedAt === void 0 ? void 0 : issuedAt.getTime()) !== null && _ref !== void 0 ? _ref : Date.now())) / MS_IN_SECOND);
+        result = {
+            accessToken: credentials.accessToken,
+            refreshToken: credentials.refreshToken,
+            // re-joined on the delimiter the authorize request splits on, so the round trip stays symmetric
+            scope: ((_credentials_scopes = credentials.scopes) !== null && _credentials_scopes !== void 0 ? _credentials_scopes : []).join(CALCOM_OAUTH_SCOPE_DELIMITER),
+            expiresIn: expiresIn,
+            expiresAt: expiresAt
+        };
+    }
+    return result;
+}
+/**
+ * Creates a {@link CalcomAccessTokenCache} backed by a user's UserExternalConnection pair.
+ *
+ * This is what keeps a Cal.com connection working past its first refresh. Cal.com invalidates a
+ * refresh token on every use and returns a rotated one, but it hands that rotated token to its
+ * `CalcomAccessTokenCache` — not back to us. With the default in-memory or file cache, the token
+ * stored on `uecp` is spent the first time it is used: nothing looks wrong, the entry stays
+ * `connected`, and the next process that starts with a cold cache replays a dead token.
+ *
+ * Pointing the cache at the connection pair makes the pair the single store of record, so a rotation
+ * is durable the moment it happens.
+ *
+ * Deliberately NOT registered as a `CalcomOAuthAccessTokenCacheService`: that service's `cacheForKey`
+ * is keyed by an opaque string, whereas this cache is per-user and needs a uid. Build one per user at
+ * the call site and pass it in explicitly.
+ *
+ * @param config - The accessor, the actions, and the user the cache is for.
+ * @returns A CalcomAccessTokenCache reading and writing the user's connection pair.
+ */ function userExternalConnectionCalcomAccessTokenCache(config) {
+    var accessor = config.accessor, actions = config.actions, uid = config.uid;
+    var providerType = CALCOM_USER_EXTERNAL_CONNECTION_PROVIDER_TYPE;
+    var connection = accessor.accessorForUser({
+        uid: uid
+    })(providerType);
+    function loadCachedToken() {
+        return _async_to_generator$1(function() {
+            var credentials;
+            return _ts_generator$1(this, function(_state) {
+                switch(_state.label){
+                    case 0:
+                        return [
+                            4,
+                            connection.readUserExternalConnectionCredentials()
+                        ];
+                    case 1:
+                        credentials = _state.sent();
+                        return [
+                            2,
+                            calcomAccessTokenFromUserExternalConnectionCredentials(credentials)
+                        ];
+                }
+            });
+        })();
+    }
+    function updateCachedToken(accessToken) {
+        return _async_to_generator$1(function() {
+            var previous, refreshed, credentials;
+            return _ts_generator$1(this, function(_state) {
+                switch(_state.label){
+                    case 0:
+                        return [
+                            4,
+                            connection.readUserExternalConnectionCredentials()
+                        ];
+                    case 1:
+                        previous = _state.sent();
+                        refreshed = calcomUserExternalConnectionCredentials(accessToken);
+                        // merged rather than written verbatim, because the paired write replaces the provider's credentials
+                        // wholesale and Cal.com's token carries no account id or label
+                        credentials = previous == null ? refreshed : mergeRefreshedUserExternalConnectionCredentials({
+                            previous: previous,
+                            refreshed: refreshed
+                        });
+                        return [
+                            4,
+                            actions.refreshUserExternalConnectionCredentials({
+                                uid: uid,
+                                providerType: providerType,
+                                credentials: credentials
+                            })
+                        ];
+                    case 2:
+                        _state.sent();
+                        return [
+                            2
+                        ];
+                }
+            });
+        })();
+    }
+    return {
+        loadCachedToken: loadCachedToken,
+        updateCachedToken: updateCachedToken
+    };
+}
+
+function asyncGeneratorStep(gen, resolve, reject, _next, _throw, key, arg) {
+    try {
+        var info = gen[key](arg);
+        var value = info.value;
+    } catch (error) {
+        reject(error);
+        return;
+    }
+    if (info.done) {
+        resolve(value);
+    } else {
+        Promise.resolve(value).then(_next, _throw);
+    }
+}
+function _async_to_generator(fn) {
+    return function() {
+        var self = this, args = arguments;
+        return new Promise(function(resolve, reject) {
+            var gen = fn.apply(self, args);
+            function _next(value) {
+                asyncGeneratorStep(gen, resolve, reject, _next, _throw, "next", value);
+            }
+            function _throw(err) {
+                asyncGeneratorStep(gen, resolve, reject, _next, _throw, "throw", err);
+            }
+            _next(undefined);
+        });
+    };
+}
+function _class_call_check$1(instance, Constructor) {
+    if (!(instance instanceof Constructor)) {
+        throw new TypeError("Cannot call a class as a function");
+    }
+}
+function _define_property$1(obj, key, value) {
+    if (key in obj) {
+        Object.defineProperty(obj, key, {
+            value: value,
+            enumerable: true,
+            configurable: true,
+            writable: true
+        });
+    } else {
+        obj[key] = value;
+    }
+    return obj;
+}
+function _instanceof(left, right) {
+    "@swc/helpers - instanceof";
+    if (right != null && typeof Symbol !== "undefined" && right[Symbol.hasInstance]) {
+        return !!right[Symbol.hasInstance](left);
+    } else {
+        return left instanceof right;
+    }
+}
+function _object_spread(target) {
+    for(var i = 1; i < arguments.length; i++){
+        var source = arguments[i] != null ? arguments[i] : {};
+        var ownKeys = Object.keys(source);
+        if (typeof Object.getOwnPropertySymbols === "function") {
+            ownKeys = ownKeys.concat(Object.getOwnPropertySymbols(source).filter(function(sym) {
+                return Object.getOwnPropertyDescriptor(source, sym).enumerable;
+            }));
+        }
+        ownKeys.forEach(function(key) {
+            _define_property$1(target, key, source[key]);
+        });
+    }
+    return target;
+}
+function ownKeys(object, enumerableOnly) {
+    var keys = Object.keys(object);
+    if (Object.getOwnPropertySymbols) {
+        var symbols = Object.getOwnPropertySymbols(object);
+        keys.push.apply(keys, symbols);
+    }
+    return keys;
+}
+function _object_spread_props(target, source) {
+    source = source != null ? source : {};
+    if (Object.getOwnPropertyDescriptors) {
+        Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
+    } else {
+        ownKeys(Object(source)).forEach(function(key) {
+            Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
+        });
+    }
+    return target;
+}
+function _ts_generator(thisArg, body) {
+    var f, y, t, _ = {
+        label: 0,
+        sent: function() {
+            if (t[0] & 1) throw t[1];
+            return t[1];
+        },
+        trys: [],
+        ops: []
+    }, g = Object.create((typeof Iterator === "function" ? Iterator : Object).prototype), d = Object.defineProperty;
+    return d(g, "next", {
+        value: verb(0)
+    }), d(g, "throw", {
+        value: verb(1)
+    }), d(g, "return", {
+        value: verb(2)
+    }), typeof Symbol === "function" && d(g, Symbol.iterator, {
+        value: function() {
+            return this;
+        }
+    }), g;
+    function verb(n) {
+        return function(v) {
+            return step([
+                n,
+                v
+            ]);
+        };
+    }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while(g && (g = 0, op[0] && (_ = 0)), _)try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [
+                op[0] & 2,
+                t.value
+            ];
+            switch(op[0]){
+                case 0:
+                case 1:
+                    t = op;
+                    break;
+                case 4:
+                    _.label++;
+                    return {
+                        value: op[1],
+                        done: false
+                    };
+                case 5:
+                    _.label++;
+                    y = op[1];
+                    op = [
+                        0
+                    ];
+                    continue;
+                case 7:
+                    op = _.ops.pop();
+                    _.trys.pop();
+                    continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) {
+                        _ = 0;
+                        continue;
+                    }
+                    if (op[0] === 3 && (!t || op[1] > t[0] && op[1] < t[3])) {
+                        _.label = op[1];
+                        break;
+                    }
+                    if (op[0] === 6 && _.label < t[1]) {
+                        _.label = t[1];
+                        t = op;
+                        break;
+                    }
+                    if (t && _.label < t[2]) {
+                        _.label = t[2];
+                        _.ops.push(op);
+                        break;
+                    }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop();
+                    continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) {
+            op = [
+                6,
+                e
+            ];
+            y = 0;
+        } finally{
+            f = t = 0;
+        }
+        if (op[0] & 5) throw op[1];
+        return {
+            value: op[0] ? op[1] : void 0,
+            done: true
+        };
+    }
+}
+/**
+ * Maps an error thrown while calling Cal.com as a user to the code to record on their connection.
+ *
+ * Returns null for anything that is not the grant being refused — a rate limit, a validation error, a
+ * network failure, or a 403 all leave the connection itself intact, and marking it `error` for those
+ * would send the user to a reconnect that fixes nothing.
+ *
+ * @param error - The error thrown by a Cal.com call.
+ * @returns The error code to record, or null when the connection is not at fault.
+ *
+ * @__NO_SIDE_EFFECTS__
+ */ function userExternalConnectionErrorCodeFromCalcomError(error) {
+    var result;
+    if (_instanceof(error, CalcomOAuthAccessTokenError)) {
+        // `invalid_grant`, the only code this error carries. Recorded as `expired` rather than `revoked`
+        // for the same reason the reader does: the code cannot distinguish a revoked grant from a refresh
+        // token that was already spent, and telling the user they revoked access when they did not would
+        // send the UI down the wrong path
+        result = DEFAULT_USER_EXTERNAL_CONNECTION_REFRESH_FAILURE_ERROR_CODE;
+    } else if (_instanceof(error, CalcomOAuthAuthFailureError)) {
+        // no usable access token could be produced from the stored refresh token
+        result = 'unauthorized';
+    } else if (_instanceof(error, CalcomServerFetchResponseError)) {
+        result = error.responseError.response.status === HTTP_UNAUTHORIZED_STATUS_CODE ? 'unauthorized' : undefined;
+    } else if (_instanceof(error, FetchResponseError)) {
+        // the same rejection, for a response whose body Cal.com's error parser could not read
+        result = error.response.status === HTTP_UNAUTHORIZED_STATUS_CODE ? 'unauthorized' : undefined;
+    }
+    return result;
+}
+/**
+ * Turns a uid into a Cal.com API instance that acts as that user.
+ *
+ * The provider-specific sibling of `UserExternalConnectionReader.readerForUser`, and the only correct
+ * way to make per-user Cal.com calls in an app that stores connections on the pair:
+ *
+ * ```ts
+ * const calcom = await calcomUserContextService.calcomUserContextForUser({ uid });
+ * const me = await calcom.getMe();
+ * ```
+ *
+ * Do NOT assemble this by hand from `readUsableUserExternalConnectionCredentials()`. Cal.com runs its
+ * own refresh loop through the access token cache, so a reader refresh followed by a library refresh
+ * spends a rotated refresh token twice and destroys one of two valid grants.
+ */ var UserExternalConnectionCalcomUserContextService = function UserExternalConnectionCalcomUserContextService() {
+    _class_call_check$1(this, UserExternalConnectionCalcomUserContextService);
+};
+/**
+ * Creates a {@link UserExternalConnectionCalcomUserContextService}.
+ *
+ * Instances are NOT cached per user. Each call builds a fresh token factory, so the in-memory token
+ * tier lives only as long as the returned instance and one request's tokens are never visible to the
+ * next. The pair-backed cache means the cost of that is a document read, not a token refresh.
+ *
+ * @param config - The Cal.com API, the accessor, and the write surface.
+ * @returns A concrete UserExternalConnectionCalcomUserContextService implementation.
+ */ function userExternalConnectionCalcomUserContextService(config) {
+    var calcomApi = config.calcomApi, accessor = config.accessor, actions = config.actions;
+    var providerType = CALCOM_USER_EXTERNAL_CONNECTION_PROVIDER_TYPE;
+    var logger = new Logger('UserExternalConnectionCalcomUserContextService');
+    /**
+     * Records that Cal.com refused the user's grant.
+     *
+     * Never throws: the caller is already handling the provider's error, and losing that error to a
+     * failed write would be worse than not recording it.
+     *
+     * @param uid - The user whose grant was refused.
+     * @param error - The code to record.
+     */ function reportRefusedGrant(uid, error) {
+        return _async_to_generator(function() {
+            var entry, e;
+            return _ts_generator(this, function(_state) {
+                switch(_state.label){
+                    case 0:
+                        _state.trys.push([
+                            0,
+                            4,
+                            ,
+                            5
+                        ]);
+                        return [
+                            4,
+                            accessor.accessorForUser({
+                                uid: uid
+                            })(providerType).readUserExternalConnectionForProvider()
+                        ];
+                    case 1:
+                        entry = _state.sent().entry;
+                        if (!((entry === null || entry === void 0 ? void 0 : entry.st) !== 'error' || entry.er !== error)) return [
+                            3,
+                            3
+                        ];
+                        return [
+                            4,
+                            actions.markUserExternalConnectionError({
+                                uid: uid,
+                                providerType: providerType,
+                                error: error
+                            })
+                        ];
+                    case 2:
+                        _state.sent();
+                        _state.label = 3;
+                    case 3:
+                        return [
+                            3,
+                            5
+                        ];
+                    case 4:
+                        e = _state.sent();
+                        logger.error('Failed marking the "'.concat(providerType, '" connection error for uid "').concat(uid, '": '), e);
+                        return [
+                            3,
+                            5
+                        ];
+                    case 5:
+                        return [
+                            2
+                        ];
+                }
+            });
+        })();
+    }
+    /**
+     * Wraps a Cal.com fetch so a refused grant is always recorded on the connection.
+     *
+     * Wrapping the fetch rather than asking callers to report is what makes this impossible to forget,
+     * and it is the only layer that sees both failures: Cal.com resolves the access token inside the
+     * request's header factory, so a dead refresh token surfaces here exactly like a 401 response does.
+     *
+     * @param uid - The user the fetch acts as.
+     * @param fetch - The user context's fetch.
+     * @returns An equivalent fetch that records a refused grant before rethrowing.
+     */ function reportingFetch(uid, fetch) {
+        return function(input, init) {
+            return _async_to_generator(function() {
+                var result, e, error;
+                return _ts_generator(this, function(_state) {
+                    switch(_state.label){
+                        case 0:
+                            _state.trys.push([
+                                0,
+                                2,
+                                ,
+                                5
+                            ]);
+                            return [
+                                4,
+                                fetch(input, init)
+                            ];
+                        case 1:
+                            result = _state.sent(); // awaited so a thrown error is caught here
+                            return [
+                                3,
+                                5
+                            ];
+                        case 2:
+                            e = _state.sent();
+                            error = userExternalConnectionErrorCodeFromCalcomError(e);
+                            if (!(error != null)) return [
+                                3,
+                                4
+                            ];
+                            return [
+                                4,
+                                reportRefusedGrant(uid, error)
+                            ];
+                        case 3:
+                            _state.sent();
+                            _state.label = 4;
+                        case 4:
+                            throw e;
+                        case 5:
+                            return [
+                                2,
+                                result
+                            ];
+                    }
+                });
+            })();
+        };
+    }
+    function calcomUserContextForUser(input) {
+        return _async_to_generator(function() {
+            var uid, _ref, entry, credentials, refreshToken, accessTokenCache, userContext, fetch, fetchJson, reportingContext;
+            return _ts_generator(this, function(_state) {
+                switch(_state.label){
+                    case 0:
+                        uid = input.uid;
+                        return [
+                            4,
+                            accessor.accessorForUser({
+                                uid: uid
+                            })(providerType).readUserExternalConnectionForProvider()
+                        ];
+                    case 1:
+                        _ref = _state.sent(), entry = _ref.entry, credentials = _ref.credentials;
+                        // an absent entry, absent credentials, or an explicit disconnect all mean the same thing: there is
+                        // nothing here to act as, and the remedy is for the user to connect. An `error` entry is NOT
+                        // refused — it keeps its credentials precisely so a refresh can repair it, and the refresh Cal.com
+                        // runs through the cache writes back as `connected`, so a working grant heals the entry on first use
+                        if (entry == null || credentials == null || entry.st === 'disconnected') {
+                            throw userExternalConnectionProviderNotConnectedError(providerType);
+                        }
+                        refreshToken = credentials.refreshToken;
+                        // Cal.com issues an access token only in exchange for a refresh token, so without one there is
+                        // nothing to act with and no way to renew — a reconnect is the only remedy
+                        if (!refreshToken) {
+                            throw userExternalConnectionCredentialsExpiredError(providerType);
+                        }
+                        // the pair-backed cache, never the default: Cal.com invalidates a refresh token on every use and
+                        // hands the replacement to its cache, so any other cache leaves the stored token spent after one
+                        // use while the entry still reads `connected`
+                        accessTokenCache = userExternalConnectionCalcomAccessTokenCache({
+                            accessor: accessor,
+                            actions: actions,
+                            uid: uid
+                        });
+                        userContext = calcomApi.makeUserContext({
+                            refreshToken: refreshToken,
+                            accessTokenCache: accessTokenCache
+                        });
+                        fetch = reportingFetch(uid, userContext.userFetch);
+                        // rebuilt over the wrapped fetch rather than wrapped itself, so the reporting cannot be bypassed
+                        // by whichever of the two an API function reaches for. The parse handling matches the Cal.com
+                        // factory's, which is what the unwrapped `userFetchJson` was built with
+                        fetchJson = fetchJsonFunction(fetch, {
+                            handleFetchJsonParseErrorFunction: returnNullHandleFetchJsonParseErrorFunction
+                        });
+                        reportingContext = _object_spread_props(_object_spread({}, userContext), {
+                            fetch: fetch,
+                            fetchJson: fetchJson,
+                            userFetch: fetch,
+                            userFetchJson: fetchJson
+                        });
+                        return [
+                            2,
+                            calcomApi.makeContextInstance(reportingContext)
+                        ];
+                }
+            });
+        })();
+    }
+    return {
+        calcomUserContextForUser: calcomUserContextForUser
+    };
+}
+
+function _assert_this_initialized(self) {
+    if (self === void 0) {
+        throw new ReferenceError("this hasn't been initialised - super() hasn't been called");
+    }
+    return self;
+}
+function _call_super(_this, derived, args) {
+    derived = _get_prototype_of(derived);
+    return _possible_constructor_return(_this, _is_native_reflect_construct() ? Reflect.construct(derived, [], _get_prototype_of(_this).constructor) : derived.apply(_this, args));
+}
+function _class_call_check(instance, Constructor) {
+    if (!(instance instanceof Constructor)) {
+        throw new TypeError("Cannot call a class as a function");
+    }
+}
+function _define_property(obj, key, value) {
+    if (key in obj) {
+        Object.defineProperty(obj, key, {
+            value: value,
+            enumerable: true,
+            configurable: true,
+            writable: true
+        });
+    } else {
+        obj[key] = value;
+    }
+    return obj;
+}
+function _get_prototype_of(o) {
+    _get_prototype_of = Object.setPrototypeOf ? Object.getPrototypeOf : function getPrototypeOf(o) {
+        return o.__proto__ || Object.getPrototypeOf(o);
+    };
+    return _get_prototype_of(o);
+}
+function _inherits(subClass, superClass) {
+    if (typeof superClass !== "function" && superClass !== null) {
+        throw new TypeError("Super expression must either be null or a function");
+    }
+    subClass.prototype = Object.create(superClass && superClass.prototype, {
+        constructor: {
+            value: subClass,
+            writable: true,
+            configurable: true
+        }
+    });
+    if (superClass) _set_prototype_of(subClass, superClass);
+}
+function _possible_constructor_return(self, call) {
+    if (call && (_type_of(call) === "object" || typeof call === "function")) {
+        return call;
+    }
+    return _assert_this_initialized(self);
+}
+function _set_prototype_of(o, p) {
+    _set_prototype_of = Object.setPrototypeOf || function setPrototypeOf(o, p) {
+        o.__proto__ = p;
+        return o;
+    };
+    return _set_prototype_of(o, p);
+}
+function _type_of(obj) {
+    "@swc/helpers - typeof";
+    return obj && typeof Symbol !== "undefined" && obj.constructor === Symbol ? "symbol" : typeof obj;
+}
+function _is_native_reflect_construct() {
+    try {
+        var result = !Boolean.prototype.valueOf.call(Reflect.construct(Boolean, [], function() {}));
+    } catch (_) {}
+    return (_is_native_reflect_construct = function() {
+        return !!result;
+    })();
+}
+/**
+ * Endpoints for the Cal.com external-connection authorization-code handoff.
+ *
+ * Mounted at `/oauth/calcom`, matching the Angular registry's default authorize path of
+ * `/oauth/<providerType>/authorize`. Hosting rewrites do not strip the path, so this prefix is the
+ * public path — but an app with a global API route prefix must ALSO exclude these routes from it via
+ * {@link CALCOM_USER_EXTERNAL_CONNECTION_OAUTH_ROUTES_FOR_GLOBAL_ROUTE_EXCLUDE}, or they land under
+ * that prefix instead and no longer match the redirect URI registered with Cal.com.
+ *
+ * The `authorize` and `callback` routes come from the base class, so this declares only where they
+ * mount and which service serves them.
+ */ var CalcomUserExternalConnectionOAuthController = /*#__PURE__*/ function(AbstractUserExternalConnectionOAuthController) {
+    _inherits(CalcomUserExternalConnectionOAuthController, AbstractUserExternalConnectionOAuthController);
+    function CalcomUserExternalConnectionOAuthController(oauthService) {
+        _class_call_check(this, CalcomUserExternalConnectionOAuthController);
+        var _this;
+        _this = _call_super(this, CalcomUserExternalConnectionOAuthController), _define_property(_this, "oauthService", void 0);
+        _this.oauthService = oauthService;
+        return _this;
+    }
+    return CalcomUserExternalConnectionOAuthController;
+}(AbstractUserExternalConnectionOAuthController);
+CalcomUserExternalConnectionOAuthController = __decorate([
+    Controller(CALCOM_USER_EXTERNAL_CONNECTION_OAUTH_CONTROLLER_PATH),
+    __param(0, Inject(CalcomUserExternalConnectionOAuthService))
+], CalcomUserExternalConnectionOAuthController);
+
+function _array_like_to_array(arr, len) {
+    if (len == null || len > arr.length) len = arr.length;
+    for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
+    return arr2;
+}
+function _array_without_holes(arr) {
+    if (Array.isArray(arr)) return _array_like_to_array(arr);
+}
+function _iterable_to_array(iter) {
+    if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) return Array.from(iter);
+}
+function _non_iterable_spread() {
+    throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
+}
+function _to_consumable_array(arr) {
+    return _array_without_holes(arr) || _iterable_to_array(arr) || _unsupported_iterable_to_array(arr) || _non_iterable_spread();
+}
+function _unsupported_iterable_to_array(o, minLen) {
+    if (!o) return;
+    if (typeof o === "string") return _array_like_to_array(o, minLen);
+    var n = Object.prototype.toString.call(o).slice(8, -1);
+    if (n === "Object" && o.constructor) n = o.constructor.name;
+    if (n === "Map" || n === "Set") return Array.from(n);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array(o, minLen);
+}
+/**
+ * Convenience function used to generate ModuleMetadata for an app's Cal.com external-connection
+ * OAuth module.
+ *
+ * Opt-in, like the webhook module: importing the Cal.com OAuth module alone never mounts HTTP
+ * routes, so an app that only makes outbound Cal.com calls exposes no endpoints.
+ *
+ * The importing module must also supply `UserExternalConnectionServerActions` and
+ * `UserExternalConnectionStateCoder` — both exported by `appUserExternalConnectionModuleMetadata`,
+ * so pass that module in `imports`.
+ *
+ * @param config - The module metadata configuration.
+ * @returns NestJS ModuleMetadata mounting the Cal.com connect endpoints.
+ */ function appCalcomUserExternalConnectionOAuthModuleMetadata(config) {
+    var dependencyModule = config.dependencyModule, successPath = config.successPath, failurePath = config.failurePath, scopes = config.scopes, imports = config.imports, exports = config.exports, providers = config.providers;
+    var dependencyModuleImport = dependencyModule ? [
+        dependencyModule
+    ] : [];
+    return {
+        imports: [
+            ConfigModule
+        ].concat(_to_consumable_array(dependencyModuleImport), _to_consumable_array(imports !== null && imports !== void 0 ? imports : [])),
+        controllers: [
+            CalcomUserExternalConnectionOAuthController
+        ],
+        exports: [
+            CalcomUserExternalConnectionOAuthService
+        ].concat(_to_consumable_array(exports !== null && exports !== void 0 ? exports : [])),
+        providers: [
+            {
+                provide: CalcomUserExternalConnectionOAuthServiceConfig,
+                inject: [
+                    FirebaseServerEnvService
+                ],
+                useFactory: function useFactory(envService) {
+                    return calcomUserExternalConnectionOAuthServiceConfigFactory({
+                        envService: envService,
+                        successPath: successPath,
+                        failurePath: failurePath,
+                        scopes: scopes
+                    });
+                }
+            },
+            CalcomUserExternalConnectionOAuthService
+        ].concat(_to_consumable_array(providers !== null && providers !== void 0 ? providers : []))
+    };
+}
+// MARK: Calcom User Context Service
+/**
+ * Creates the NestJS provider for the {@link UserExternalConnectionCalcomUserContextService}.
+ *
+ * A provider rather than a module, because the three tokens it needs are never declared together:
+ * `CalcomApi` comes from the app's Cal.com module and the accessor and actions from its
+ * UserExternalConnection module. Declare this in a module that imports both.
+ *
+ * Separate from {@link appCalcomUserExternalConnectionOAuthModuleMetadata} on purpose — that module
+ * needs only `CalcomOAuthApi`, and folding this in would force every app running the connect flow to
+ * also provide `CalcomApi` whether it makes outbound Cal.com calls or not.
+ *
+ * @returns The NestJS provider.
+ *
+ * @__NO_SIDE_EFFECTS__
+ */ function userExternalConnectionCalcomUserContextServiceProvider() {
+    return {
+        provide: UserExternalConnectionCalcomUserContextService,
+        useFactory: function useFactory(calcomApi, accessor, actions) {
+            return userExternalConnectionCalcomUserContextService({
+                calcomApi: calcomApi,
+                accessor: accessor,
+                actions: actions
+            });
+        },
+        inject: [
+            CalcomApi,
+            UserExternalConnectionAccessor,
+            UserExternalConnectionServerActions
+        ]
+    };
+}
+
+export { CALCOM_USER_EXTERNAL_CONNECTION_OAUTH_CONTROLLER_PATH, CALCOM_USER_EXTERNAL_CONNECTION_OAUTH_ROUTES_FOR_GLOBAL_ROUTE_EXCLUDE, CalcomUserExternalConnectionOAuthController, CalcomUserExternalConnectionOAuthService, CalcomUserExternalConnectionOAuthServiceConfig, DEFAULT_CALCOM_OAUTH_SCOPES, UserExternalConnectionCalcomUserContextService, appCalcomUserExternalConnectionOAuthModuleMetadata, calcomAccessTokenFromUserExternalConnectionCredentials, calcomUserExternalConnectionCredentials, calcomUserExternalConnectionOAuthServiceConfigFactory, userExternalConnectionCalcomAccessTokenCache, userExternalConnectionCalcomUserContextService, userExternalConnectionCalcomUserContextServiceProvider, userExternalConnectionErrorCodeFromCalcomError };