@ganju/utils 0.0.4 → 0.0.6

package/dist/accessToken.d.ts

@@ -0,0 +1,25 @@
+/** The SHA-256 of a presented token, in the encoding the column stores. */
+export declare const hashAccessToken: (token: string) => Promise<string>;
+/**
+ * Cheap enough to run before the database is touched: a bearer token that does
+ * not carry the prefix is an OAuth token, and belongs on the other path.
+ */
+export declare const isAccessToken: (token: string) => boolean;
+/**
+ * What the dashboard shows beside a token's name.
+ *
+ * Enough to tell two rows apart when someone is deciding which to revoke, and
+ * deliberately taken from the *front* of the secret rather than the end: a
+ * prefix narrows a brute-force search by exactly as much as a suffix would, and
+ * a value people are used to seeing truncated at the end reads as complete when
+ * it is the end that is shown.
+ */
+export declare const accessTokenHint: (token: string) => string;
+export interface MintedAccessToken {
+    /** The only time this value exists. Returned to the caller, never stored. */
+    token: string;
+    tokenHash: string;
+    hint: string;
+}
+export declare const mintAccessToken: () => Promise<MintedAccessToken>;
+//# sourceMappingURL=accessToken.d.ts.map

package/dist/accessToken.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"accessToken.d.ts","sourceRoot":"","sources":["../src/accessToken.ts"],"names":[],"mappings":"AA+BA,2EAA2E;AAC3E,eAAO,MAAM,eAAe,GAAU,OAAO,MAAM,KAAG,OAAO,CAAC,MAAM,CAMnE,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,aAAa,GAAI,OAAO,MAAM,KAAG,OACG,CAAC;AAElD;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe,GAAI,OAAO,MAAM,KAAG,MAI1B,CAAC;AAEvB,MAAM,WAAW,iBAAiB;IAChC,6EAA6E;IAC7E,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,eAAO,MAAM,eAAe,QAAa,OAAO,CAAC,iBAAiB,CASjE,CAAC"}

package/dist/accessToken.js

@@ -0,0 +1,65 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.mintAccessToken = exports.accessTokenHint = exports.isAccessToken = exports.hashAccessToken = void 0;
+const constants_1 = require("./constants");
+/**
+ * Minting and recognising a personal access token.
+ *
+ * The value exists in plaintext exactly once — in the response to the request
+ * that created it — and what the database holds is its SHA-256. That is the
+ * property the whole credential rests on: a leaked backup, a stray log line, or
+ * a support engineer reading the row learns nothing they could present as the
+ * token, and there is no path in the product that can print one back, because
+ * there is nothing to print.
+ *
+ * SHA-256 rather than a password hash on purpose. A password is a low-entropy
+ * secret a person chose, so the cost of hashing it is what stands between a
+ * stolen table and the passwords in it; this is 32 bytes from a CSPRNG, where
+ * that cost buys nothing and would be paid on every authenticated request. It
+ * is also the hash `oauth_client.client_secret` already uses in this system, so
+ * there is one answer here to "how is a machine credential stored".
+ */
+const HINT_SEPARATOR = '…';
+const base64url = (bytes) => {
+    let binary = '';
+    for (const byte of bytes)
+        binary += String.fromCharCode(byte);
+    return btoa(binary)
+        .replace(/\+/g, '-')
+        .replace(/\//g, '_')
+        .replace(/=+$/, '');
+};
+/** The SHA-256 of a presented token, in the encoding the column stores. */
+const hashAccessToken = async (token) => {
+    const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(token));
+    return base64url(new Uint8Array(digest));
+};
+exports.hashAccessToken = hashAccessToken;
+/**
+ * Cheap enough to run before the database is touched: a bearer token that does
+ * not carry the prefix is an OAuth token, and belongs on the other path.
+ */
+const isAccessToken = (token) => token.startsWith(constants_1.constants.ACCESS_TOKEN_PREFIX);
+exports.isAccessToken = isAccessToken;
+/**
+ * What the dashboard shows beside a token's name.
+ *
+ * Enough to tell two rows apart when someone is deciding which to revoke, and
+ * deliberately taken from the *front* of the secret rather than the end: a
+ * prefix narrows a brute-force search by exactly as much as a suffix would, and
+ * a value people are used to seeing truncated at the end reads as complete when
+ * it is the end that is shown.
+ */
+const accessTokenHint = (token) => `${token.slice(0, constants_1.constants.ACCESS_TOKEN_PREFIX.length + constants_1.constants.ACCESS_TOKEN_HINT_CHARS)}${HINT_SEPARATOR}`;
+exports.accessTokenHint = accessTokenHint;
+const mintAccessToken = async () => {
+    const bytes = new Uint8Array(constants_1.constants.ACCESS_TOKEN_BYTES);
+    crypto.getRandomValues(bytes);
+    const token = `${constants_1.constants.ACCESS_TOKEN_PREFIX}${base64url(bytes)}`;
+    return {
+        token,
+        tokenHash: await (0, exports.hashAccessToken)(token),
+        hint: (0, exports.accessTokenHint)(token)
+    };
+};
+exports.mintAccessToken = mintAccessToken;

package/dist/constants.d.ts

@@ -451,6 +451,7 @@ export declare const constants: {
     CALCOM_API_VERSION_EVENT_TYPES: string;
     CALCOM_API_VERSION_SLOTS: string;
     CALCOM_API_VERSION_BOOKINGS: string;
+    CALCOM_API_VERSION_ME: string;
     CALCOM_TOOL_KEY_PREFIX: string;
     TAVILY_API_BASE: string;
     TAVILY_SEARCH_DEPTH_BASIC: "basic";
@@ -618,6 +619,15 @@ export declare const constants: {
     CLI_OAUTH_REDIRECT_PORTS: number[];
     CLI_OAUTH_SCOPES: string[];
     CLI_TOKEN_REFRESH_SKEW_SECONDS: number;
+    ACCESS_TOKEN_PREFIX: string;
+    ACCESS_TOKEN_BYTES: number;
+    ACCESS_TOKEN_HINT_CHARS: number;
+    ACCESS_TOKEN_NAME_MAX: number;
+    ACCESS_TOKEN_MAX_PER_PROJECT: number;
+    ACCESS_TOKEN_MAX_EXPIRY_DAYS: number;
+    ACCESS_TOKEN_LAST_USED_INTERVAL_MS: number;
+    ACCESS_TOKEN_UNSCOPED_PATHS: string[];
+    ACCESS_TOKEN_SCOPE_MESSAGE: string;
     CUSTOM_CODE_LOGS_DEFAULT_LIMIT: number;
     CUSTOM_CODE_LOGS_MAX_LIMIT: number;
     BOT_GRANT_TYPE: string;

package/dist/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AA6JA,QAAA,MAAM,yBAAyB,EAAiB,UAAU,CAAC;AAC3D,QAAA,MAAM,+BAA+B,EAAuB,gBAAgB,CAAC;AAC7E,QAAA,MAAM,8BAA8B,EAAsB,eAAe,CAAC;AAC1E,QAAA,MAAM,wBAAwB,EAAgB,SAAS,CAAC;AAuCxD,QAAA,MAAM,sBAAsB,EAAiB,UAAU,CAAC;AACxD,QAAA,MAAM,4BAA4B,EAAuB,gBAAgB,CAAC;AAC1E,QAAA,MAAM,oBAAoB,EAAe,QAAQ,CAAC;AAClD,QAAA,MAAM,oBAAoB,EAAe,QAAQ,CAAC;AAmYlD,QAAA,MAAM,sBAAsB,EAAkB,WAAW,CAAC;AAC1D,QAAA,MAAM,mBAAmB,EAAe,QAAQ,CAAC;AAGjD,QAAA,MAAM,mBAAmB,EAAe,QAAQ,CAAC;AAkTjD,MAAM,MAAM,mBAAmB,GAC3B;IACE,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,QAAQ,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,GACD;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAC3D;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,SAAS,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAC9D;IACE,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,QAAQ,CAAC;IACf,OAAO,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC5C,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,GACD;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,UAAU,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAg6BpE,UAAU,UAAU;IAElB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAGhC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IAMjC,sBAAsB,EAAE,MAAM,CAAC;IAM/B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,SAAS,EAAE,OAAO,CAAC;IAKnB,eAAe,EAAE,OAAO,CAAC;IAOzB,gBAAgB,EAAE,OAAO,CAAC;IAK1B,2BAA2B,EAAE,MAAM,GAAG,IAAI,CAAC;IAG3C,gBAAgB,EAAE,MAAM,CAAC;IACzB,qBAAqB,EAAE,MAAM,CAAC;CAC/B;AAqKD,YAAY,EAAE,UAAU,EAAE,CAAC;AAE3B,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;eA51DhB,OAAO,yBAAyB,GAChC,OAAO,+BAA+B,GACtC,OAAO,8BAA8B,GACrC,OAAO,wBAAwB;eAC5B,MAAM;;;;;;;;;;;;;;;;;;eAsCT,OAAO,sBAAsB,GAC7B,OAAO,4BAA4B,GACnC,OAAO,oBAAoB,GAC3B,OAAO,oBAAoB;eACxB,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBA6YT,OAAO,mBAAmB,GAC1B,OAAO,mBAAmB,GAC1B,OAAO,sBAAsB;eAC1B,MAAM;eACN,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;eA6NwB,MAAM,GAAG,MAAM;cAAQ,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuuDnE,CAAC"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AA6JA,QAAA,MAAM,yBAAyB,EAAiB,UAAU,CAAC;AAC3D,QAAA,MAAM,+BAA+B,EAAuB,gBAAgB,CAAC;AAC7E,QAAA,MAAM,8BAA8B,EAAsB,eAAe,CAAC;AAC1E,QAAA,MAAM,wBAAwB,EAAgB,SAAS,CAAC;AAuCxD,QAAA,MAAM,sBAAsB,EAAiB,UAAU,CAAC;AACxD,QAAA,MAAM,4BAA4B,EAAuB,gBAAgB,CAAC;AAC1E,QAAA,MAAM,oBAAoB,EAAe,QAAQ,CAAC;AAClD,QAAA,MAAM,oBAAoB,EAAe,QAAQ,CAAC;AAmYlD,QAAA,MAAM,sBAAsB,EAAkB,WAAW,CAAC;AAC1D,QAAA,MAAM,mBAAmB,EAAe,QAAQ,CAAC;AAGjD,QAAA,MAAM,mBAAmB,EAAe,QAAQ,CAAC;AAkTjD,MAAM,MAAM,mBAAmB,GAC3B;IACE,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,QAAQ,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,GACD;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAC3D;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,SAAS,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAC9D;IACE,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,QAAQ,CAAC;IACf,OAAO,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC5C,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,GACD;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,UAAU,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAk9BpE,UAAU,UAAU;IAElB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAGhC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IAMjC,sBAAsB,EAAE,MAAM,CAAC;IAM/B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,SAAS,EAAE,OAAO,CAAC;IAKnB,eAAe,EAAE,OAAO,CAAC;IAOzB,gBAAgB,EAAE,OAAO,CAAC;IAK1B,2BAA2B,EAAE,MAAM,GAAG,IAAI,CAAC;IAG3C,gBAAgB,EAAE,MAAM,CAAC;IACzB,qBAAqB,EAAE,MAAM,CAAC;CAC/B;AAqKD,YAAY,EAAE,UAAU,EAAE,CAAC;AAE3B,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;eA94DhB,OAAO,yBAAyB,GAChC,OAAO,+BAA+B,GACtC,OAAO,8BAA8B,GACrC,OAAO,wBAAwB;eAC5B,MAAM;;;;;;;;;;;;;;;;;;eAsCT,OAAO,sBAAsB,GAC7B,OAAO,4BAA4B,GACnC,OAAO,oBAAoB,GAC3B,OAAO,oBAAoB;eACxB,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBA6YT,OAAO,mBAAmB,GAC1B,OAAO,mBAAmB,GAC1B,OAAO,sBAAsB;eAC1B,MAAM;eACN,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;eA6NwB,MAAM,GAAG,MAAM;cAAQ,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmyDnE,CAAC"}

package/dist/constants.js

@@ -877,6 +877,7 @@ const CALCOM_API_BASE = 'https://api.cal.com/v2';
 const CALCOM_API_VERSION_EVENT_TYPES = '2024-06-14';
 const CALCOM_API_VERSION_SLOTS = '2024-09-04';
 const CALCOM_API_VERSION_BOOKINGS = '2026-02-25';
+const CALCOM_API_VERSION_ME = '2024-06-14';
 const CALCOM_TOOL_KEY_PREFIX = 'calcom-';
 // Tavily web search. The key is validated against the live API before it is
 // persisted (a minimal 1-result search), then stored as an artifact_credential
@@ -1439,6 +1440,46 @@ const ARTIFACT_SCOPE_PREFIX = 'artifact:';
 // loopback matching, where the port is ignored for a 127.0.0.0/8 redirect, but
 // that is one library's behaviour and this is a login that has already opened
 // someone's browser by the time it would fail.
+// A personal access token — the durable credential a machine with no browser
+// uses, where an OAuth access token's one hour is not enough. Bound to one
+// project, because that is the unit a deploy pipeline works on: one repository,
+// one artifact, one credential in its CI settings.
+//
+// The prefix is part of the value rather than decoration: it is what lets the
+// middleware tell one of these from an OAuth token before it decides which
+// lookup to make, and it is what secret scanners match on when one leaks into a
+// repository. The rest is 32 random bytes, base64url — the token is the only
+// place the value ever exists in plaintext, since what is stored is its hash.
+const ACCESS_TOKEN_PREFIX = 'ganju_pat_';
+const ACCESS_TOKEN_BYTES = 32;
+// Enough of the secret to recognise a row by, and not enough to be worth
+// stealing. Shown in the dashboard and by `ganju token list` beside the name.
+const ACCESS_TOKEN_HINT_CHARS = 6;
+const ACCESS_TOKEN_NAME_MAX = 100;
+// A ceiling per project, so a compromised session cannot quietly mint an
+// unbounded set of credentials that each survive the session being ended.
+const ACCESS_TOKEN_MAX_PER_PROJECT = 20;
+// An expiry is optional, because a scheduled deploy that dies on a date nobody
+// wrote down is its own kind of outage — but a year is the longest we will
+// write one for.
+const ACCESS_TOKEN_MAX_EXPIRY_DAYS = 365;
+// `last_used_at` is a convenience, not an audit log, so it is written at most
+// this often per token rather than on every request. The question it answers —
+// "is anything still using this, or can I revoke it" — does not get a better
+// answer from minute-level precision, and the write would otherwise land on the
+// hot path of every CI request.
+const ACCESS_TOKEN_LAST_USED_INTERVAL_MS = 5 * 60 * 1000;
+// The only path a personal access token may reach without naming the project it
+// is scoped to, and only on GET. `/me` reports who the token is, which is how
+// the CLI confirms a machine is authenticated at all, and tells it nothing it
+// does not already hold.
+//
+// Everything else is refused, organization routes included — billing, members,
+// the model configs and the other projects are not what a deploy credential is
+// for. The list is deliberately this short: a route added later is closed by
+// omission rather than open by it.
+const ACCESS_TOKEN_UNSCOPED_PATHS = ['/me'];
+const ACCESS_TOKEN_SCOPE_MESSAGE = 'This token is scoped to a different project';
 // Recent custom-tool invocations, as `ganju logs` reads them.
 const CUSTOM_CODE_LOGS_DEFAULT_LIMIT = 20;
 const CUSTOM_CODE_LOGS_MAX_LIMIT = 100;
@@ -2100,6 +2141,7 @@ exports.constants = {
     CALCOM_API_VERSION_EVENT_TYPES,
     CALCOM_API_VERSION_SLOTS,
     CALCOM_API_VERSION_BOOKINGS,
+    CALCOM_API_VERSION_ME,
     CALCOM_TOOL_KEY_PREFIX,
     TAVILY_API_BASE,
     TAVILY_SEARCH_DEPTH_BASIC,
@@ -2267,6 +2309,15 @@ exports.constants = {
     CLI_OAUTH_REDIRECT_PORTS: cliConstants_1.CLI_OAUTH_REDIRECT_PORTS,
     CLI_OAUTH_SCOPES: cliConstants_1.CLI_OAUTH_SCOPES,
     CLI_TOKEN_REFRESH_SKEW_SECONDS: cliConstants_1.CLI_TOKEN_REFRESH_SKEW_SECONDS,
+    ACCESS_TOKEN_PREFIX,
+    ACCESS_TOKEN_BYTES,
+    ACCESS_TOKEN_HINT_CHARS,
+    ACCESS_TOKEN_NAME_MAX,
+    ACCESS_TOKEN_MAX_PER_PROJECT,
+    ACCESS_TOKEN_MAX_EXPIRY_DAYS,
+    ACCESS_TOKEN_LAST_USED_INTERVAL_MS,
+    ACCESS_TOKEN_UNSCOPED_PATHS,
+    ACCESS_TOKEN_SCOPE_MESSAGE,
     CUSTOM_CODE_LOGS_DEFAULT_LIMIT,
     CUSTOM_CODE_LOGS_MAX_LIMIT,
     BOT_GRANT_TYPE,

package/dist/index.d.ts

@@ -15,6 +15,7 @@ import type { OAuthProviderConfig } from './oauthProviders';
 import type { ExposableResource } from './exposedResource';
 import type { CustomCodeProject, ProjectPathIssue } from './customCodeProject';
 import type { AttachmentResource, ResolvedAttachment, ResolveAttachmentResult } from './attachment';
+import type { MintedAccessToken } from './accessToken';
 import type { CatalogGroup, CatalogTool, CatalogToolDescriptor, ToolGroupKey, ToolKey } from './toolCatalog';
 import type { Separator, ChunkMetadata, PreparedChunk } from './chunking';
 import type { RateLimitRetryOptions } from './retry';
@@ -868,6 +869,28 @@ export declare const utils: {
             userId: import("zod").ZodUUID;
             organizationId: import("zod").ZodUUID;
         }, import("zod/v4/core").$strip>;
+        ACCESS_TOKEN_CREATE: import("zod").ZodObject<{
+            name: import("zod").ZodString;
+            expiresInDays: import("zod").ZodOptional<import("zod").ZodNullable<import("zod").ZodNumber>>;
+            userId: import("zod").ZodUUID;
+            organizationId: import("zod").ZodUUID;
+            projectId: import("zod").ZodUUID;
+        }, import("zod/v4/core").$strip>;
+        ACCESS_TOKEN_CREATE_VIEW: import("zod").ZodObject<{
+            name: import("zod").ZodString;
+            expiresInDays: import("zod").ZodOptional<import("zod").ZodNullable<import("zod").ZodNumber>>;
+        }, import("zod/v4/core").$strip>;
+        ACCESS_TOKEN_LIST: import("zod").ZodObject<{
+            userId: import("zod").ZodUUID;
+            organizationId: import("zod").ZodUUID;
+            projectId: import("zod").ZodUUID;
+        }, import("zod/v4/core").$strip>;
+        ACCESS_TOKEN_REMOVE: import("zod").ZodObject<{
+            tokenId: import("zod").ZodUUID;
+            userId: import("zod").ZodUUID;
+            organizationId: import("zod").ZodUUID;
+            projectId: import("zod").ZodUUID;
+        }, import("zod/v4/core").$strip>;
         CHANNEL_CONFIG: import("zod").ZodObject<{
             debounceMs: import("zod").ZodOptional<import("zod").ZodNumber>;
         }, import("zod/v4/core").$loose>;
@@ -2138,6 +2161,7 @@ export declare const utils: {
         CALCOM_API_VERSION_EVENT_TYPES: string;
         CALCOM_API_VERSION_SLOTS: string;
         CALCOM_API_VERSION_BOOKINGS: string;
+        CALCOM_API_VERSION_ME: string;
         CALCOM_TOOL_KEY_PREFIX: string;
         TAVILY_API_BASE: string;
         TAVILY_SEARCH_DEPTH_BASIC: "basic";
@@ -2305,6 +2329,15 @@ export declare const utils: {
         CLI_OAUTH_REDIRECT_PORTS: number[];
         CLI_OAUTH_SCOPES: string[];
         CLI_TOKEN_REFRESH_SKEW_SECONDS: number;
+        ACCESS_TOKEN_PREFIX: string;
+        ACCESS_TOKEN_BYTES: number;
+        ACCESS_TOKEN_HINT_CHARS: number;
+        ACCESS_TOKEN_NAME_MAX: number;
+        ACCESS_TOKEN_MAX_PER_PROJECT: number;
+        ACCESS_TOKEN_MAX_EXPIRY_DAYS: number;
+        ACCESS_TOKEN_LAST_USED_INTERVAL_MS: number;
+        ACCESS_TOKEN_UNSCOPED_PATHS: string[];
+        ACCESS_TOKEN_SCOPE_MESSAGE: string;
         CUSTOM_CODE_LOGS_DEFAULT_LIMIT: number;
         CUSTOM_CODE_LOGS_MAX_LIMIT: number;
         BOT_GRANT_TYPE: string;
@@ -2386,6 +2419,10 @@ export declare const utils: {
     languageFromHeader: (header?: string | null) => string;
     slugifyTitle: (title: string) => string;
     resourceUriFromTitle: (title: string) => string;
+    accessTokenHint: (token: string) => string;
+    hashAccessToken: (token: string) => Promise<string>;
+    isAccessToken: (token: string) => boolean;
+    mintAccessToken: () => Promise<MintedAccessToken>;
     TOOL_CATALOG: readonly [{
         readonly key: "gmail";
         readonly title: "Gmail";
@@ -2842,8 +2879,14 @@ export declare const utils: {
     buildReauthMetadata: (previous: Record<string, unknown> | null, reason: string) => Record<string, unknown>;
     clearReauthMetadata: (previous: Record<string, unknown> | null) => Record<string, unknown> | null;
     isCredentialNeedingReauth: (metadata: unknown) => boolean;
+    isValidTimeZone: (value: unknown) => value is string;
+    readCredentialTimeZone: (metadata: unknown) => string | null;
+    credentialTimeZoneIsStale: (metadata: unknown, now?: number) => boolean;
+    writeCredentialTimeZone: (previous: unknown, timeZone: string | null, now?: Date) => Record<string, unknown>;
+    fetchGoogleCalendarTimeZone: (accessToken: string) => Promise<string | null>;
+    fetchCalcomTimeZone: (apiKey: string) => Promise<string | null>;
     PlanLimitError: typeof PlanLimitError;
     isPlanLimitError: (error: unknown) => error is PlanLimitError;
 };
-export type { CustomCodeProject, ProjectPathIssue, CatalogGroup, CatalogTool, CatalogToolDescriptor, ToolGroupKey, ToolKey, CalendarConfigField, JsonSchema, SchemaViolation, MimeAttachment, MimeMessageInput, GmailOperation, GmailSendRequest, GmailSendResponse, OutlookOperation, OutlookSendRequest, OutlookSendResponse, SlackOperation, SlackSendRequest, SlackSendResponse, SlackSendRemoteResourceRequest, TelegramSendRequest, TelegramSendResponse, TelegramSendRemoteResourceRequest, DiscordSendRequest, DiscordSendResponse, DiscordSendRemoteResourceRequest, WhatsappSendRequest, WhatsappSendResponse, WhatsappSendRemoteResourceRequest, EnvSource, Separator, ChunkMetadata, PreparedChunk, ExtractedDocument, ExtractedDocumentMetadata, ExtractedDocumentSource, RateLimitRetryOptions, QueueBatchLike, QueueMessageLike, ProcessQueueBatchHandlers, ChannelNotifier, ToolStatusEvent, BufferedChannelMessage, ChannelBufferEnvelope, ChannelBufferFlush, Source, ResourceUrlContext, SourceButton, RefreshOAuthTokenInput, RefreshedOAuthToken, HttpEndpointToolConfig, McpProxyToolConfig, McpProxyDiscoveredTool, McpProxyDiscoveredResource, McpProxyDiscoveredPrompt, McpProxyDiscovery, CustomCodeToolConfig, CustomCodeToolManifest, CustomCodeManifest, CustomCodeSendFile, CustomCodeCreateResource, CustomCodeTokenPayload, OAuthProviderConfig, AttachmentResource, ResolvedAttachment, ResolveAttachmentResult, ExposableResource, PlanLimitDetails, PlanLimits };
+export type { MintedAccessToken, CustomCodeProject, ProjectPathIssue, CatalogGroup, CatalogTool, CatalogToolDescriptor, ToolGroupKey, ToolKey, CalendarConfigField, JsonSchema, SchemaViolation, MimeAttachment, MimeMessageInput, GmailOperation, GmailSendRequest, GmailSendResponse, OutlookOperation, OutlookSendRequest, OutlookSendResponse, SlackOperation, SlackSendRequest, SlackSendResponse, SlackSendRemoteResourceRequest, TelegramSendRequest, TelegramSendResponse, TelegramSendRemoteResourceRequest, DiscordSendRequest, DiscordSendResponse, DiscordSendRemoteResourceRequest, WhatsappSendRequest, WhatsappSendResponse, WhatsappSendRemoteResourceRequest, EnvSource, Separator, ChunkMetadata, PreparedChunk, ExtractedDocument, ExtractedDocumentMetadata, ExtractedDocumentSource, RateLimitRetryOptions, QueueBatchLike, QueueMessageLike, ProcessQueueBatchHandlers, ChannelNotifier, ToolStatusEvent, BufferedChannelMessage, ChannelBufferEnvelope, ChannelBufferFlush, Source, ResourceUrlContext, SourceButton, RefreshOAuthTokenInput, RefreshedOAuthToken, HttpEndpointToolConfig, McpProxyToolConfig, McpProxyDiscoveredTool, McpProxyDiscoveredResource, McpProxyDiscoveredPrompt, McpProxyDiscovery, CustomCodeToolConfig, CustomCodeToolManifest, CustomCodeManifest, CustomCodeSendFile, CustomCodeCreateResource, CustomCodeTokenPayload, OAuthProviderConfig, AttachmentResource, ResolvedAttachment, ResolveAttachmentResult, ExposableResource, PlanLimitDetails, PlanLimits };
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,sBAAsB,EACtB,kBAAkB,EAClB,sBAAsB,EACtB,0BAA0B,EAC1B,wBAAwB,EACxB,iBAAiB,EACjB,oBAAoB,EACpB,sBAAsB,EACtB,kBAAkB,EAClB,kBAAkB,EAClB,wBAAwB,EACzB,MAAM,UAAU,CAAC;AAElB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAC1C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAyCvD,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,KAAK,EACV,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EAClB,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EACV,mBAAmB,EACnB,oBAAoB,EACpB,iCAAiC,EAClC,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EACV,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACpB,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EACV,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,8BAA8B,EAC/B,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EACV,kBAAkB,EAClB,mBAAmB,EACnB,gCAAgC,EACjC,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EACV,mBAAmB,EACnB,oBAAoB,EACpB,iCAAiC,EAClC,MAAM,gBAAgB,CAAC;AAKxB,OAAO,EACL,UAAU,EAGX,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAU9D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAEhE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAG5D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAW3D,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC/E,OAAO,KAAK,EACV,kBAAkB,EAClB,kBAAkB,EAClB,uBAAuB,EACxB,MAAM,cAAc,CAAC;AAgBtB,OAAO,KAAK,EACV,YAAY,EACZ,WAAW,EACX,qBAAqB,EACrB,YAAY,EACZ,OAAO,EACR,MAAM,eAAe,CAAC;AAiBvB,OAAO,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAI1E,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAC;AAErD,OAAO,KAAK,EACV,cAAc,EACd,gBAAgB,EAChB,yBAAyB,EAC1B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EACV,iBAAiB,EACjB,yBAAyB,EACzB,uBAAuB,EACxB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,KAAK,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAM1E,OAAO,KAAK,EACV,sBAAsB,EACtB,qBAAqB,EACrB,kBAAkB,EACnB,MAAM,mBAAmB,CAAC;AAS3B,OAAO,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAC1E,OAAO,EAEL,wBAAwB,EAIzB,MAAM,SAAS,CAAC;AACjB,OAAO,KAAK,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAC;AAC3E,OAAO,EAAE,cAAc,EAAoB,MAAM,kBAAkB,CAAC;AACpE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C,eAAO,MAAM,KAAK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;aArGf,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;kBAhHiB,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mBA0DF,CAAC;oBAEd,CAAC;;;;aA0BkB,CAAC;mBAA8B,CAAC;WACvC,CAAC;gBACf,CAAC;gBAA4B,CAAA;;;mBAoBK,CAAC;oBACjC,CAAC;;;;;;;;;;;;;;;kBA3Dc,CAAC;;;;;;;sBAqCR,CAAC;;;;;;;;;CA2Of,CAAC;AAEF,YAAY,EACV,iBAAiB,EACjB,gBAAgB,EAChB,YAAY,EACZ,WAAW,EACX,qBAAqB,EACrB,YAAY,EACZ,OAAO,EACP,mBAAmB,EACnB,UAAU,EACV,eAAe,EACf,cAAc,EACd,gBAAgB,EAChB,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACnB,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,8BAA8B,EAC9B,mBAAmB,EACnB,oBAAoB,EACpB,iCAAiC,EACjC,kBAAkB,EAClB,mBAAmB,EACnB,gCAAgC,EAChC,mBAAmB,EACnB,oBAAoB,EACpB,iCAAiC,EACjC,SAAS,EACT,SAAS,EACT,aAAa,EACb,aAAa,EACb,iBAAiB,EACjB,yBAAyB,EACzB,uBAAuB,EACvB,qBAAqB,EACrB,cAAc,EACd,gBAAgB,EAChB,yBAAyB,EACzB,eAAe,EACf,eAAe,EACf,sBAAsB,EACtB,qBAAqB,EACrB,kBAAkB,EAClB,MAAM,EACN,kBAAkB,EAClB,YAAY,EACZ,sBAAsB,EACtB,mBAAmB,EACnB,sBAAsB,EACtB,kBAAkB,EAClB,sBAAsB,EACtB,0BAA0B,EAC1B,wBAAwB,EACxB,iBAAiB,EACjB,oBAAoB,EACpB,sBAAsB,EACtB,kBAAkB,EAClB,kBAAkB,EAClB,wBAAwB,EACxB,sBAAsB,EACtB,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EAClB,uBAAuB,EACvB,iBAAiB,EACjB,gBAAgB,EAChB,UAAU,EACX,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,sBAAsB,EACtB,kBAAkB,EAClB,sBAAsB,EACtB,0BAA0B,EAC1B,wBAAwB,EACxB,iBAAiB,EACjB,oBAAoB,EACpB,sBAAsB,EACtB,kBAAkB,EAClB,kBAAkB,EAClB,wBAAwB,EACzB,MAAM,UAAU,CAAC;AAElB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAC1C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAyCvD,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,KAAK,EACV,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EAClB,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EACV,mBAAmB,EACnB,oBAAoB,EACpB,iCAAiC,EAClC,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EACV,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACpB,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EACV,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,8BAA8B,EAC/B,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EACV,kBAAkB,EAClB,mBAAmB,EACnB,gCAAgC,EACjC,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EACV,mBAAmB,EACnB,oBAAoB,EACpB,iCAAiC,EAClC,MAAM,gBAAgB,CAAC;AAKxB,OAAO,EACL,UAAU,EAGX,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAU9D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAEhE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAG5D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAW3D,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC/E,OAAO,KAAK,EACV,kBAAkB,EAClB,kBAAkB,EAClB,uBAAuB,EACxB,MAAM,cAAc,CAAC;AActB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AASvD,OAAO,KAAK,EACV,YAAY,EACZ,WAAW,EACX,qBAAqB,EACrB,YAAY,EACZ,OAAO,EACR,MAAM,eAAe,CAAC;AAiBvB,OAAO,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAI1E,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAC;AAErD,OAAO,KAAK,EACV,cAAc,EACd,gBAAgB,EAChB,yBAAyB,EAC1B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EACV,iBAAiB,EACjB,yBAAyB,EACzB,uBAAuB,EACxB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,KAAK,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAM1E,OAAO,KAAK,EACV,sBAAsB,EACtB,qBAAqB,EACrB,kBAAkB,EACnB,MAAM,mBAAmB,CAAC;AAS3B,OAAO,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAC1E,OAAO,EAEL,wBAAwB,EAIzB,MAAM,SAAS,CAAC;AACjB,OAAO,KAAK,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAC;AAS3E,OAAO,EAAE,cAAc,EAAoB,MAAM,kBAAkB,CAAC;AACpE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C,eAAO,MAAM,KAAK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;aApHf,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;kBAhHiB,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mBA0DF,CAAC;oBAEd,CAAC;;;;aA0BkB,CAAC;mBAA8B,CAAC;WACvC,CAAC;gBACf,CAAC;gBAA4B,CAAA;;;mBAoBK,CAAC;oBACjC,CAAC;;;;;;;;;;;;;;;kBA3Dc,CAAC;;;;;;;sBAqCR,CAAC;;;;;;;;;;;;;;;CAoQf,CAAC;AAEF,YAAY,EACV,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,EAChB,YAAY,EACZ,WAAW,EACX,qBAAqB,EACrB,YAAY,EACZ,OAAO,EACP,mBAAmB,EACnB,UAAU,EACV,eAAe,EACf,cAAc,EACd,gBAAgB,EAChB,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACnB,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,8BAA8B,EAC9B,mBAAmB,EACnB,oBAAoB,EACpB,iCAAiC,EACjC,kBAAkB,EAClB,mBAAmB,EACnB,gCAAgC,EAChC,mBAAmB,EACnB,oBAAoB,EACpB,iCAAiC,EACjC,SAAS,EACT,SAAS,EACT,aAAa,EACb,aAAa,EACb,iBAAiB,EACjB,yBAAyB,EACzB,uBAAuB,EACvB,qBAAqB,EACrB,cAAc,EACd,gBAAgB,EAChB,yBAAyB,EACzB,eAAe,EACf,eAAe,EACf,sBAAsB,EACtB,qBAAqB,EACrB,kBAAkB,EAClB,MAAM,EACN,kBAAkB,EAClB,YAAY,EACZ,sBAAsB,EACtB,mBAAmB,EACnB,sBAAsB,EACtB,kBAAkB,EAClB,sBAAsB,EACtB,0BAA0B,EAC1B,wBAAwB,EACxB,iBAAiB,EACjB,oBAAoB,EACpB,sBAAsB,EACtB,kBAAkB,EAClB,kBAAkB,EAClB,wBAAwB,EACxB,sBAAsB,EACtB,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EAClB,uBAAuB,EACvB,iBAAiB,EACjB,gBAAgB,EAChB,UAAU,EACX,CAAC"}

package/dist/index.js

@@ -31,6 +31,7 @@ const languageCookieDomain_1 = require("./languageCookieDomain");
 const localizeZodIssue_1 = require("./localizeZodIssue");
 const slugifyTitle_1 = require("./slugifyTitle");
 const resourceUri_1 = require("./resourceUri");
+const accessToken_1 = require("./accessToken");
 const toolCatalog_1 = require("./toolCatalog");
 const tallyUsageKinds_1 = require("./tallyUsageKinds");
 const formatFilename_1 = require("./formatFilename");
@@ -44,6 +45,7 @@ const channelNotifier_1 = require("./channelNotifier");
 const channelDebounce_1 = require("./channelDebounce");
 const sources_1 = require("./sources");
 const oauth_1 = require("./oauth");
+const vendorTimeZone_1 = require("./vendorTimeZone");
 const planLimitError_1 = require("./planLimitError");
 exports.utils = {
     Schema: schema_1.Schema,
@@ -113,6 +115,10 @@ exports.utils = {
     languageFromHeader: localizeZodIssue_1.languageFromHeader,
     slugifyTitle: slugifyTitle_1.slugifyTitle,
     resourceUriFromTitle: resourceUri_1.resourceUriFromTitle,
+    accessTokenHint: accessToken_1.accessTokenHint,
+    hashAccessToken: accessToken_1.hashAccessToken,
+    isAccessToken: accessToken_1.isAccessToken,
+    mintAccessToken: accessToken_1.mintAccessToken,
     TOOL_CATALOG: toolCatalog_1.TOOL_CATALOG,
     TOOL_KEYS: toolCatalog_1.TOOL_KEYS,
     describeCatalogTool: toolCatalog_1.describeCatalogTool,
@@ -152,6 +158,12 @@ exports.utils = {
     buildReauthMetadata: oauth_1.buildReauthMetadata,
     clearReauthMetadata: oauth_1.clearReauthMetadata,
     isCredentialNeedingReauth: oauth_1.isCredentialNeedingReauth,
+    isValidTimeZone: vendorTimeZone_1.isValidTimeZone,
+    readCredentialTimeZone: vendorTimeZone_1.readCredentialTimeZone,
+    credentialTimeZoneIsStale: vendorTimeZone_1.credentialTimeZoneIsStale,
+    writeCredentialTimeZone: vendorTimeZone_1.writeCredentialTimeZone,
+    fetchGoogleCalendarTimeZone: vendorTimeZone_1.fetchGoogleCalendarTimeZone,
+    fetchCalcomTimeZone: vendorTimeZone_1.fetchCalcomTimeZone,
     PlanLimitError: planLimitError_1.PlanLimitError,
     isPlanLimitError: planLimitError_1.isPlanLimitError
 };

package/dist/schema.d.ts

@@ -1255,6 +1255,28 @@ export declare const Schema: {
         userId: z.ZodUUID;
         organizationId: z.ZodUUID;
     }, z.core.$strip>;
+    ACCESS_TOKEN_CREATE: z.ZodObject<{
+        name: z.ZodString;
+        expiresInDays: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+        userId: z.ZodUUID;
+        organizationId: z.ZodUUID;
+        projectId: z.ZodUUID;
+    }, z.core.$strip>;
+    ACCESS_TOKEN_CREATE_VIEW: z.ZodObject<{
+        name: z.ZodString;
+        expiresInDays: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+    }, z.core.$strip>;
+    ACCESS_TOKEN_LIST: z.ZodObject<{
+        userId: z.ZodUUID;
+        organizationId: z.ZodUUID;
+        projectId: z.ZodUUID;
+    }, z.core.$strip>;
+    ACCESS_TOKEN_REMOVE: z.ZodObject<{
+        tokenId: z.ZodUUID;
+        userId: z.ZodUUID;
+        organizationId: z.ZodUUID;
+        projectId: z.ZodUUID;
+    }, z.core.$strip>;
     CHANNEL_CONFIG: z.ZodObject<{
         debounceMs: z.ZodOptional<z.ZodNumber>;
     }, z.core.$loose>;

package/dist/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AA+qBxB,QAAA,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0FrB,CAAC;AAyDN,QAAA,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;iBAmCpB,CAAC;AAWH,QAAA,MAAM,kBAAkB;;;;;;;;;;iBA+CtB,CAAC;AAiCH,QAAA,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAapB,CAAC;AAYH,QAAA,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAgCxB,CAAC;AA4LH,QAAA,MAAM,kCAAkC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA4DpC,CAAC;AA4BL,QAAA,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yBAkDzB,CAAC;AAwGH,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsGlB,CAAC;AAGF,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAG1E,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAIlE,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAMtE,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAGtE,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAMtE,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAIvE,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAC5C,OAAO,kCAAkC,CAC1C,CAAC;AAKF,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,OAAO,CAAC;CACtB;AAKD,MAAM,WAAW,0BAA0B;IACzC,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAKD,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,EAAE,CAAC;CAC1E;AAMD,MAAM,WAAW,iBAAiB;IAChC,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACjD,KAAK,EAAE,sBAAsB,EAAE,CAAC;IAChC,SAAS,CAAC,EAAE,0BAA0B,EAAE,CAAC;IACzC,OAAO,CAAC,EAAE,wBAAwB,EAAE,CAAC;CACtC"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AA6tBxB,QAAA,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0FrB,CAAC;AAyDN,QAAA,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;iBAmCpB,CAAC;AAWH,QAAA,MAAM,kBAAkB;;;;;;;;;;iBA+CtB,CAAC;AAiCH,QAAA,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAapB,CAAC;AAYH,QAAA,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAgCxB,CAAC;AA4LH,QAAA,MAAM,kCAAkC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA4DpC,CAAC;AA4BL,QAAA,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yBAkDzB,CAAC;AAwGH,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA0GlB,CAAC;AAGF,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAG1E,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAIlE,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAMtE,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAGtE,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAMtE,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAIvE,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAC5C,OAAO,kCAAkC,CAC1C,CAAC;AAKF,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,OAAO,CAAC;CACtB;AAKD,MAAM,WAAW,0BAA0B;IACzC,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAKD,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,EAAE,CAAC;CAC1E;AAMD,MAAM,WAAW,iBAAiB;IAChC,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACjD,KAAK,EAAE,sBAAsB,EAAE,CAAC;IAChC,SAAS,CAAC,EAAE,0BAA0B,EAAE,CAAC;IACzC,OAAO,CAAC,EAAE,wBAAwB,EAAE,CAAC;CACtC"}

package/dist/schema.js

@@ -519,6 +519,48 @@ const ORGANIZATION_REMOVE_LLM = zod_1.z.object({
     userId: zod_1.z.uuid(),
     organizationId: zod_1.z.uuid()
 });
+// Personal access tokens. `name` is required rather than optional because it is
+// the only thing anyone has to go on when deciding whether revoking a row will
+// break a deploy, and a list of unnamed credentials is a list nobody prunes.
+//
+// `expiresInDays` is what the caller sends; `expiresAt` is what the row stores.
+// A duration is what someone actually decides ("ninety days"), and computing the
+// date on the server means a clock the client got wrong cannot mint a token that
+// outlives what was asked for. Null is a token that does not expire, which is a
+// real answer for a scheduled deploy and is why it is spelled explicitly rather
+// than reached by leaving the field out.
+const ACCESS_TOKEN_CREATE = zod_1.z.object({
+    name: zod_1.z.string().trim().min(1).max(constants_1.constants.ACCESS_TOKEN_NAME_MAX),
+    expiresInDays: zod_1.z
+        .number()
+        .int()
+        .min(1)
+        .max(constants_1.constants.ACCESS_TOKEN_MAX_EXPIRY_DAYS)
+        .nullable()
+        .optional(),
+    userId: zod_1.z.uuid(),
+    organizationId: zod_1.z.uuid(),
+    projectId: zod_1.z.uuid()
+});
+const ACCESS_TOKEN_LIST = zod_1.z.object({
+    userId: zod_1.z.uuid(),
+    organizationId: zod_1.z.uuid(),
+    projectId: zod_1.z.uuid()
+});
+const ACCESS_TOKEN_REMOVE = zod_1.z.object({
+    tokenId: zod_1.z.uuid(),
+    userId: zod_1.z.uuid(),
+    organizationId: zod_1.z.uuid(),
+    projectId: zod_1.z.uuid()
+});
+// The ids the route already carries come off: the dashboard reads them from the
+// URL it is on, so a form asking for them again is a second place for them to be
+// wrong.
+const ACCESS_TOKEN_CREATE_VIEW = ACCESS_TOKEN_CREATE.omit({
+    userId: true,
+    organizationId: true,
+    projectId: true
+});
 const ORGANIZATION_CREATE_LLM_VIEW = ORGANIZATION_CREATE_LLM.omit({
     userId: true,
     organizationId: true
@@ -1345,6 +1387,10 @@ exports.Schema = {
     ORGANIZATION_UPDATE_LLM,
     ORGANIZATION_UPDATE_LLM_VIEW,
     ORGANIZATION_REMOVE_LLM,
+    ACCESS_TOKEN_CREATE,
+    ACCESS_TOKEN_CREATE_VIEW,
+    ACCESS_TOKEN_LIST,
+    ACCESS_TOKEN_REMOVE,
     CHANNEL_CONFIG,
     CHANNEL_CREATE,
     CHANNEL_CREATE_VIEW,

package/dist/vendorTimeZone.d.ts

@@ -0,0 +1,57 @@
+/**
+ * Is this a time zone the runtime actually knows?
+ *
+ * Everything downstream — `Intl.DateTimeFormat`, Google's `start.timeZone`,
+ * Cal.com's `attendee.timeZone` — throws or 400s on a name it cannot resolve.
+ * A vendor returning something unexpected must degrade to "we don't know"
+ * rather than poison every later call with a value that cannot be used.
+ */
+export declare const isValidTimeZone: (value: unknown) => value is string;
+/** The cached zone on a credential's metadata, or null. */
+export declare const readCredentialTimeZone: (metadata: unknown) => string | null;
+/**
+ * Should we ask the vendor again?
+ *
+ * True when there is nothing cached, when the stamp is missing or unreadable,
+ * or when the TTL has passed. A cache with no stamp is treated as stale rather
+ * than as fresh-forever — the conservative direction, since the only cost is
+ * one request.
+ */
+export declare const credentialTimeZoneIsStale: (metadata: unknown, now?: number) => boolean;
+/**
+ * Merge a freshly read zone into a credential's metadata.
+ *
+ * Merges rather than replaces, because this column also carries the reauth
+ * markers — writing a bare `{ timeZone }` here would clear `needsReauth` and
+ * silently re-enable a connection the refresh path had flagged as broken.
+ *
+ * A null zone (the vendor could not tell us) still stamps the check, so a
+ * provider that never reports one is asked once a day rather than on every
+ * single call.
+ */
+export declare const writeCredentialTimeZone: (previous: unknown, timeZone: string | null, now?: Date) => Record<string, unknown>;
+/**
+ * The zone Google Calendar is configured in, from the primary calendar.
+ *
+ * Deliberately NOT `GET /users/me/settings/timezone`, which is the more
+ * direct answer to "what did the user configure" and needs
+ * `calendar.settings.readonly` — a scope we do not request and could not add
+ * without sending every already-connected user back through consent. The
+ * primary calendar's zone is the same value in every case that matters, and
+ * `calendar.readonly` already covers it.
+ *
+ * Returns null on any failure. Not knowing the zone is a state the callers
+ * handle; a throw here would take a tool call or a chat turn with it.
+ */
+export declare const fetchGoogleCalendarTimeZone: (accessToken: string) => Promise<string | null>;
+/**
+ * The zone on the connected Cal.com profile.
+ *
+ * This is the host's zone — the one their availability is written in — which
+ * is what "9am" means when the artifact owner or their bot says it. It is not
+ * the attendee's zone; see the booking handler for why we use it there anyway.
+ *
+ * Same null-on-failure contract as the Google reader above.
+ */
+export declare const fetchCalcomTimeZone: (apiKey: string) => Promise<string | null>;
+//# sourceMappingURL=vendorTimeZone.d.ts.map

package/dist/vendorTimeZone.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vendorTimeZone.d.ts","sourceRoot":"","sources":["../src/vendorTimeZone.ts"],"names":[],"mappings":"AAiCA;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,GAAI,OAAO,OAAO,KAAG,KAAK,IAAI,MAQzD,CAAC;AAEF,2DAA2D;AAC3D,eAAO,MAAM,sBAAsB,GAAI,UAAU,OAAO,KAAG,MAAM,GAAG,IAInE,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,yBAAyB,GACpC,UAAU,OAAO,EACjB,MAAK,MAAmB,KACvB,OAOF,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,uBAAuB,GAClC,UAAU,OAAO,EACjB,UAAU,MAAM,GAAG,IAAI,EACvB,MAAK,IAAiB,KACrB,MAAM,CAAC,MAAM,EAAE,OAAO,CAYxB,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,2BAA2B,GACtC,aAAa,MAAM,KAClB,OAAO,CAAC,MAAM,GAAG,IAAI,CAiBvB,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,GAC9B,QAAQ,MAAM,KACb,OAAO,CAAC,MAAM,GAAG,IAAI,CAkBvB,CAAC"}

package/dist/vendorTimeZone.js

@@ -0,0 +1,165 @@
+"use strict";
+// The time zone the user configured with the vendor, and where we keep it.
+//
+// Every scheduling question the model answers is a time-zone question first:
+// "tomorrow at 9" is not an instant until you know whose 9 it is. We had two
+// sources for that and neither worked. `artifact_tool.config.defaultTimeZone`
+// is only written when the owner opens a dropdown and changes it, so in
+// practice it is empty. The fallbacks underneath it were `undefined` (Google
+// then uses the calendar's own zone, which only helps when the timestamp has no
+// offset) and the string 'UTC' (Cal.com, which books the attendee in UTC and
+// tells nobody).
+//
+// But the user already answered this question — in Google Calendar's settings,
+// and in their Cal.com profile. So we ask the vendor instead of asking the
+// owner again, and the answer becomes the default under any explicit choice.
+//
+// It is cached on `artifact_credential.metadata` because that is what it is a
+// property of: the connected account, not the tool row. One artifact can have
+// six calendar tools installed and they all share one connection, so the
+// connection is the only place the answer belongs exactly once.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.fetchCalcomTimeZone = exports.fetchGoogleCalendarTimeZone = exports.writeCredentialTimeZone = exports.credentialTimeZoneIsStale = exports.readCredentialTimeZone = exports.isValidTimeZone = void 0;
+const constants_1 = require("./constants");
+// Metadata keys on artifact_credential. Namespaced with a prefix that will not
+// collide with the reauth markers written by the OAuth refresh path.
+const TIME_ZONE_KEY = 'timeZone';
+const TIME_ZONE_CHECKED_AT_KEY = 'timeZoneCheckedAt';
+// How long a cached zone is trusted. A day, because this changes when somebody
+// moves or travels — rarely, and never urgently. The cost of being briefly
+// stale is one meeting in the old zone; the cost of a shorter TTL is a vendor
+// round trip on the path of a tool call.
+const TIME_ZONE_TTL_MS = 24 * 60 * 60 * 1000;
+/**
+ * Is this a time zone the runtime actually knows?
+ *
+ * Everything downstream — `Intl.DateTimeFormat`, Google's `start.timeZone`,
+ * Cal.com's `attendee.timeZone` — throws or 400s on a name it cannot resolve.
+ * A vendor returning something unexpected must degrade to "we don't know"
+ * rather than poison every later call with a value that cannot be used.
+ */
+const isValidTimeZone = (value) => {
+    if (typeof value !== 'string' || !value.trim())
+        return false;
+    try {
+        new Intl.DateTimeFormat('en-US', { timeZone: value.trim() });
+        return true;
+    }
+    catch {
+        return false;
+    }
+};
+exports.isValidTimeZone = isValidTimeZone;
+/** The cached zone on a credential's metadata, or null. */
+const readCredentialTimeZone = (metadata) => {
+    if (!metadata || typeof metadata !== 'object')
+        return null;
+    const value = metadata[TIME_ZONE_KEY];
+    return (0, exports.isValidTimeZone)(value) ? value.trim() : null;
+};
+exports.readCredentialTimeZone = readCredentialTimeZone;
+/**
+ * Should we ask the vendor again?
+ *
+ * True when there is nothing cached, when the stamp is missing or unreadable,
+ * or when the TTL has passed. A cache with no stamp is treated as stale rather
+ * than as fresh-forever — the conservative direction, since the only cost is
+ * one request.
+ */
+const credentialTimeZoneIsStale = (metadata, now = Date.now()) => {
+    if (!(0, exports.readCredentialTimeZone)(metadata))
+        return true;
+    const raw = metadata[TIME_ZONE_CHECKED_AT_KEY];
+    if (typeof raw !== 'string')
+        return true;
+    const checkedAt = Date.parse(raw);
+    if (!Number.isFinite(checkedAt))
+        return true;
+    return now - checkedAt >= TIME_ZONE_TTL_MS;
+};
+exports.credentialTimeZoneIsStale = credentialTimeZoneIsStale;
+/**
+ * Merge a freshly read zone into a credential's metadata.
+ *
+ * Merges rather than replaces, because this column also carries the reauth
+ * markers — writing a bare `{ timeZone }` here would clear `needsReauth` and
+ * silently re-enable a connection the refresh path had flagged as broken.
+ *
+ * A null zone (the vendor could not tell us) still stamps the check, so a
+ * provider that never reports one is asked once a day rather than on every
+ * single call.
+ */
+const writeCredentialTimeZone = (previous, timeZone, now = new Date()) => {
+    const base = previous && typeof previous === 'object'
+        ? { ...previous }
+        : {};
+    if ((0, exports.isValidTimeZone)(timeZone)) {
+        base[TIME_ZONE_KEY] = timeZone.trim();
+    }
+    else {
+        delete base[TIME_ZONE_KEY];
+    }
+    base[TIME_ZONE_CHECKED_AT_KEY] = now.toISOString();
+    return base;
+};
+exports.writeCredentialTimeZone = writeCredentialTimeZone;
+/**
+ * The zone Google Calendar is configured in, from the primary calendar.
+ *
+ * Deliberately NOT `GET /users/me/settings/timezone`, which is the more
+ * direct answer to "what did the user configure" and needs
+ * `calendar.settings.readonly` — a scope we do not request and could not add
+ * without sending every already-connected user back through consent. The
+ * primary calendar's zone is the same value in every case that matters, and
+ * `calendar.readonly` already covers it.
+ *
+ * Returns null on any failure. Not knowing the zone is a state the callers
+ * handle; a throw here would take a tool call or a chat turn with it.
+ */
+const fetchGoogleCalendarTimeZone = async (accessToken) => {
+    try {
+        const response = await fetch(`${constants_1.constants.GOOGLE_CALENDAR_API_BASE}/calendars/primary`, {
+            headers: {
+                Authorization: `Bearer ${accessToken}`,
+                Accept: 'application/json'
+            }
+        });
+        if (!response.ok)
+            return null;
+        const payload = (await response.json());
+        return (0, exports.isValidTimeZone)(payload?.timeZone) ? payload.timeZone.trim() : null;
+    }
+    catch {
+        return null;
+    }
+};
+exports.fetchGoogleCalendarTimeZone = fetchGoogleCalendarTimeZone;
+/**
+ * The zone on the connected Cal.com profile.
+ *
+ * This is the host's zone — the one their availability is written in — which
+ * is what "9am" means when the artifact owner or their bot says it. It is not
+ * the attendee's zone; see the booking handler for why we use it there anyway.
+ *
+ * Same null-on-failure contract as the Google reader above.
+ */
+const fetchCalcomTimeZone = async (apiKey) => {
+    try {
+        const response = await fetch(`${constants_1.constants.CALCOM_API_BASE}/me`, {
+            headers: {
+                Authorization: `Bearer ${apiKey}`,
+                'cal-api-version': constants_1.constants.CALCOM_API_VERSION_ME,
+                Accept: 'application/json'
+            }
+        });
+        if (!response.ok)
+            return null;
+        const payload = (await response.json());
+        const value = payload?.data?.timeZone;
+        return (0, exports.isValidTimeZone)(value) ? value.trim() : null;
+    }
+    catch {
+        return null;
+    }
+};
+exports.fetchCalcomTimeZone = fetchCalcomTimeZone;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ganju/utils",
-  "version": "0.0.4",
+  "version": "0.0.6",
   "description": "Shared constants, schemas and helpers for Ganju",
   "license": "Apache-2.0",
   "author": "MontoyaAndres <andresmontoyafcb@gmail.com>",

package/src/accessToken.ts

@@ -0,0 +1,79 @@
+import { constants } from './constants';
+
+/**
+ * Minting and recognising a personal access token.
+ *
+ * The value exists in plaintext exactly once — in the response to the request
+ * that created it — and what the database holds is its SHA-256. That is the
+ * property the whole credential rests on: a leaked backup, a stray log line, or
+ * a support engineer reading the row learns nothing they could present as the
+ * token, and there is no path in the product that can print one back, because
+ * there is nothing to print.
+ *
+ * SHA-256 rather than a password hash on purpose. A password is a low-entropy
+ * secret a person chose, so the cost of hashing it is what stands between a
+ * stolen table and the passwords in it; this is 32 bytes from a CSPRNG, where
+ * that cost buys nothing and would be paid on every authenticated request. It
+ * is also the hash `oauth_client.client_secret` already uses in this system, so
+ * there is one answer here to "how is a machine credential stored".
+ */
+
+const HINT_SEPARATOR = '…';
+
+const base64url = (bytes: Uint8Array): string => {
+  let binary = '';
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary)
+    .replace(/\+/g, '-')
+    .replace(/\//g, '_')
+    .replace(/=+$/, '');
+};
+
+/** The SHA-256 of a presented token, in the encoding the column stores. */
+export const hashAccessToken = async (token: string): Promise<string> => {
+  const digest = await crypto.subtle.digest(
+    'SHA-256',
+    new TextEncoder().encode(token)
+  );
+  return base64url(new Uint8Array(digest));
+};
+
+/**
+ * Cheap enough to run before the database is touched: a bearer token that does
+ * not carry the prefix is an OAuth token, and belongs on the other path.
+ */
+export const isAccessToken = (token: string): boolean =>
+  token.startsWith(constants.ACCESS_TOKEN_PREFIX);
+
+/**
+ * What the dashboard shows beside a token's name.
+ *
+ * Enough to tell two rows apart when someone is deciding which to revoke, and
+ * deliberately taken from the *front* of the secret rather than the end: a
+ * prefix narrows a brute-force search by exactly as much as a suffix would, and
+ * a value people are used to seeing truncated at the end reads as complete when
+ * it is the end that is shown.
+ */
+export const accessTokenHint = (token: string): string =>
+  `${token.slice(
+    0,
+    constants.ACCESS_TOKEN_PREFIX.length + constants.ACCESS_TOKEN_HINT_CHARS
+  )}${HINT_SEPARATOR}`;
+
+export interface MintedAccessToken {
+  /** The only time this value exists. Returned to the caller, never stored. */
+  token: string;
+  tokenHash: string;
+  hint: string;
+}
+
+export const mintAccessToken = async (): Promise<MintedAccessToken> => {
+  const bytes = new Uint8Array(constants.ACCESS_TOKEN_BYTES);
+  crypto.getRandomValues(bytes);
+  const token = `${constants.ACCESS_TOKEN_PREFIX}${base64url(bytes)}`;
+  return {
+    token,
+    tokenHash: await hashAccessToken(token),
+    hint: accessTokenHint(token)
+  };
+};

package/src/constants.ts

@@ -1054,6 +1054,7 @@ const CALCOM_API_BASE = 'https://api.cal.com/v2';
 const CALCOM_API_VERSION_EVENT_TYPES = '2024-06-14';
 const CALCOM_API_VERSION_SLOTS = '2024-09-04';
 const CALCOM_API_VERSION_BOOKINGS = '2026-02-25';
+const CALCOM_API_VERSION_ME = '2024-06-14';
 
 const CALCOM_TOOL_KEY_PREFIX = 'calcom-';
 
@@ -1695,6 +1696,55 @@ const ARTIFACT_SCOPE_PREFIX = 'artifact:';
 // that is one library's behaviour and this is a login that has already opened
 // someone's browser by the time it would fail.
 
+// A personal access token — the durable credential a machine with no browser
+// uses, where an OAuth access token's one hour is not enough. Bound to one
+// project, because that is the unit a deploy pipeline works on: one repository,
+// one artifact, one credential in its CI settings.
+//
+// The prefix is part of the value rather than decoration: it is what lets the
+// middleware tell one of these from an OAuth token before it decides which
+// lookup to make, and it is what secret scanners match on when one leaks into a
+// repository. The rest is 32 random bytes, base64url — the token is the only
+// place the value ever exists in plaintext, since what is stored is its hash.
+const ACCESS_TOKEN_PREFIX = 'ganju_pat_';
+const ACCESS_TOKEN_BYTES = 32;
+
+// Enough of the secret to recognise a row by, and not enough to be worth
+// stealing. Shown in the dashboard and by `ganju token list` beside the name.
+const ACCESS_TOKEN_HINT_CHARS = 6;
+
+const ACCESS_TOKEN_NAME_MAX = 100;
+
+// A ceiling per project, so a compromised session cannot quietly mint an
+// unbounded set of credentials that each survive the session being ended.
+const ACCESS_TOKEN_MAX_PER_PROJECT = 20;
+
+// An expiry is optional, because a scheduled deploy that dies on a date nobody
+// wrote down is its own kind of outage — but a year is the longest we will
+// write one for.
+const ACCESS_TOKEN_MAX_EXPIRY_DAYS = 365;
+
+// `last_used_at` is a convenience, not an audit log, so it is written at most
+// this often per token rather than on every request. The question it answers —
+// "is anything still using this, or can I revoke it" — does not get a better
+// answer from minute-level precision, and the write would otherwise land on the
+// hot path of every CI request.
+const ACCESS_TOKEN_LAST_USED_INTERVAL_MS = 5 * 60 * 1000;
+
+// The only path a personal access token may reach without naming the project it
+// is scoped to, and only on GET. `/me` reports who the token is, which is how
+// the CLI confirms a machine is authenticated at all, and tells it nothing it
+// does not already hold.
+//
+// Everything else is refused, organization routes included — billing, members,
+// the model configs and the other projects are not what a deploy credential is
+// for. The list is deliberately this short: a route added later is closed by
+// omission rather than open by it.
+const ACCESS_TOKEN_UNSCOPED_PATHS = ['/me'];
+
+const ACCESS_TOKEN_SCOPE_MESSAGE =
+  'This token is scoped to a different project';
+
 // Recent custom-tool invocations, as `ganju logs` reads them.
 const CUSTOM_CODE_LOGS_DEFAULT_LIMIT = 20;
 const CUSTOM_CODE_LOGS_MAX_LIMIT = 100;
@@ -2429,6 +2479,7 @@ export const constants = {
   CALCOM_API_VERSION_EVENT_TYPES,
   CALCOM_API_VERSION_SLOTS,
   CALCOM_API_VERSION_BOOKINGS,
+  CALCOM_API_VERSION_ME,
   CALCOM_TOOL_KEY_PREFIX,
   TAVILY_API_BASE,
   TAVILY_SEARCH_DEPTH_BASIC,
@@ -2596,6 +2647,15 @@ export const constants = {
   CLI_OAUTH_REDIRECT_PORTS,
   CLI_OAUTH_SCOPES,
   CLI_TOKEN_REFRESH_SKEW_SECONDS,
+  ACCESS_TOKEN_PREFIX,
+  ACCESS_TOKEN_BYTES,
+  ACCESS_TOKEN_HINT_CHARS,
+  ACCESS_TOKEN_NAME_MAX,
+  ACCESS_TOKEN_MAX_PER_PROJECT,
+  ACCESS_TOKEN_MAX_EXPIRY_DAYS,
+  ACCESS_TOKEN_LAST_USED_INTERVAL_MS,
+  ACCESS_TOKEN_UNSCOPED_PATHS,
+  ACCESS_TOKEN_SCOPE_MESSAGE,
   CUSTOM_CODE_LOGS_DEFAULT_LIMIT,
   CUSTOM_CODE_LOGS_MAX_LIMIT,
   BOT_GRANT_TYPE,

package/src/index.ts

@@ -135,6 +135,13 @@ import { languageCookieDomain } from './languageCookieDomain';
 import { localizeZodIssue, languageFromHeader } from './localizeZodIssue';
 import { slugifyTitle } from './slugifyTitle';
 import { resourceUriFromTitle } from './resourceUri';
+import {
+  accessTokenHint,
+  hashAccessToken,
+  isAccessToken,
+  mintAccessToken
+} from './accessToken';
+import type { MintedAccessToken } from './accessToken';
 import {
   TOOL_CATALOG,
   TOOL_KEYS,
@@ -211,6 +218,14 @@ import {
   isCredentialNeedingReauth
 } from './oauth';
 import type { RefreshOAuthTokenInput, RefreshedOAuthToken } from './oauth';
+import {
+  isValidTimeZone,
+  readCredentialTimeZone,
+  credentialTimeZoneIsStale,
+  writeCredentialTimeZone,
+  fetchGoogleCalendarTimeZone,
+  fetchCalcomTimeZone
+} from './vendorTimeZone';
 import { PlanLimitError, isPlanLimitError } from './planLimitError';
 import type { PlanLimitDetails } from './planLimitError';
 import type { PlanLimits } from './constants';
@@ -283,6 +298,10 @@ export const utils = {
   languageFromHeader,
   slugifyTitle,
   resourceUriFromTitle,
+  accessTokenHint,
+  hashAccessToken,
+  isAccessToken,
+  mintAccessToken,
   TOOL_CATALOG,
   TOOL_KEYS,
   describeCatalogTool,
@@ -322,11 +341,18 @@ export const utils = {
   buildReauthMetadata,
   clearReauthMetadata,
   isCredentialNeedingReauth,
+  isValidTimeZone,
+  readCredentialTimeZone,
+  credentialTimeZoneIsStale,
+  writeCredentialTimeZone,
+  fetchGoogleCalendarTimeZone,
+  fetchCalcomTimeZone,
   PlanLimitError,
   isPlanLimitError
 };
 
 export type {
+  MintedAccessToken,
   CustomCodeProject,
   ProjectPathIssue,
   CatalogGroup,

package/src/schema.ts

@@ -603,6 +603,52 @@ const ORGANIZATION_REMOVE_LLM = z.object({
   organizationId: z.uuid()
 });
 
+// Personal access tokens. `name` is required rather than optional because it is
+// the only thing anyone has to go on when deciding whether revoking a row will
+// break a deploy, and a list of unnamed credentials is a list nobody prunes.
+//
+// `expiresInDays` is what the caller sends; `expiresAt` is what the row stores.
+// A duration is what someone actually decides ("ninety days"), and computing the
+// date on the server means a clock the client got wrong cannot mint a token that
+// outlives what was asked for. Null is a token that does not expire, which is a
+// real answer for a scheduled deploy and is why it is spelled explicitly rather
+// than reached by leaving the field out.
+const ACCESS_TOKEN_CREATE = z.object({
+  name: z.string().trim().min(1).max(constants.ACCESS_TOKEN_NAME_MAX),
+  expiresInDays: z
+    .number()
+    .int()
+    .min(1)
+    .max(constants.ACCESS_TOKEN_MAX_EXPIRY_DAYS)
+    .nullable()
+    .optional(),
+  userId: z.uuid(),
+  organizationId: z.uuid(),
+  projectId: z.uuid()
+});
+
+const ACCESS_TOKEN_LIST = z.object({
+  userId: z.uuid(),
+  organizationId: z.uuid(),
+  projectId: z.uuid()
+});
+
+const ACCESS_TOKEN_REMOVE = z.object({
+  tokenId: z.uuid(),
+  userId: z.uuid(),
+  organizationId: z.uuid(),
+  projectId: z.uuid()
+});
+
+// The ids the route already carries come off: the dashboard reads them from the
+// URL it is on, so a form asking for them again is a second place for them to be
+// wrong.
+const ACCESS_TOKEN_CREATE_VIEW = ACCESS_TOKEN_CREATE.omit({
+  userId: true,
+  organizationId: true,
+  projectId: true
+});
+
 const ORGANIZATION_CREATE_LLM_VIEW = ORGANIZATION_CREATE_LLM.omit({
   userId: true,
   organizationId: true
@@ -1513,6 +1559,10 @@ export const Schema = {
   ORGANIZATION_UPDATE_LLM,
   ORGANIZATION_UPDATE_LLM_VIEW,
   ORGANIZATION_REMOVE_LLM,
+  ACCESS_TOKEN_CREATE,
+  ACCESS_TOKEN_CREATE_VIEW,
+  ACCESS_TOKEN_LIST,
+  ACCESS_TOKEN_REMOVE,
   CHANNEL_CONFIG,
   CHANNEL_CREATE,
   CHANNEL_CREATE_VIEW,

package/src/vendorTimeZone.ts

@@ -0,0 +1,171 @@
+// The time zone the user configured with the vendor, and where we keep it.
+//
+// Every scheduling question the model answers is a time-zone question first:
+// "tomorrow at 9" is not an instant until you know whose 9 it is. We had two
+// sources for that and neither worked. `artifact_tool.config.defaultTimeZone`
+// is only written when the owner opens a dropdown and changes it, so in
+// practice it is empty. The fallbacks underneath it were `undefined` (Google
+// then uses the calendar's own zone, which only helps when the timestamp has no
+// offset) and the string 'UTC' (Cal.com, which books the attendee in UTC and
+// tells nobody).
+//
+// But the user already answered this question — in Google Calendar's settings,
+// and in their Cal.com profile. So we ask the vendor instead of asking the
+// owner again, and the answer becomes the default under any explicit choice.
+//
+// It is cached on `artifact_credential.metadata` because that is what it is a
+// property of: the connected account, not the tool row. One artifact can have
+// six calendar tools installed and they all share one connection, so the
+// connection is the only place the answer belongs exactly once.
+
+import { constants } from './constants';
+
+// Metadata keys on artifact_credential. Namespaced with a prefix that will not
+// collide with the reauth markers written by the OAuth refresh path.
+const TIME_ZONE_KEY = 'timeZone';
+const TIME_ZONE_CHECKED_AT_KEY = 'timeZoneCheckedAt';
+
+// How long a cached zone is trusted. A day, because this changes when somebody
+// moves or travels — rarely, and never urgently. The cost of being briefly
+// stale is one meeting in the old zone; the cost of a shorter TTL is a vendor
+// round trip on the path of a tool call.
+const TIME_ZONE_TTL_MS = 24 * 60 * 60 * 1000;
+
+/**
+ * Is this a time zone the runtime actually knows?
+ *
+ * Everything downstream — `Intl.DateTimeFormat`, Google's `start.timeZone`,
+ * Cal.com's `attendee.timeZone` — throws or 400s on a name it cannot resolve.
+ * A vendor returning something unexpected must degrade to "we don't know"
+ * rather than poison every later call with a value that cannot be used.
+ */
+export const isValidTimeZone = (value: unknown): value is string => {
+  if (typeof value !== 'string' || !value.trim()) return false;
+  try {
+    new Intl.DateTimeFormat('en-US', { timeZone: value.trim() });
+    return true;
+  } catch {
+    return false;
+  }
+};
+
+/** The cached zone on a credential's metadata, or null. */
+export const readCredentialTimeZone = (metadata: unknown): string | null => {
+  if (!metadata || typeof metadata !== 'object') return null;
+  const value = (metadata as Record<string, unknown>)[TIME_ZONE_KEY];
+  return isValidTimeZone(value) ? value.trim() : null;
+};
+
+/**
+ * Should we ask the vendor again?
+ *
+ * True when there is nothing cached, when the stamp is missing or unreadable,
+ * or when the TTL has passed. A cache with no stamp is treated as stale rather
+ * than as fresh-forever — the conservative direction, since the only cost is
+ * one request.
+ */
+export const credentialTimeZoneIsStale = (
+  metadata: unknown,
+  now: number = Date.now()
+): boolean => {
+  if (!readCredentialTimeZone(metadata)) return true;
+  const raw = (metadata as Record<string, unknown>)[TIME_ZONE_CHECKED_AT_KEY];
+  if (typeof raw !== 'string') return true;
+  const checkedAt = Date.parse(raw);
+  if (!Number.isFinite(checkedAt)) return true;
+  return now - checkedAt >= TIME_ZONE_TTL_MS;
+};
+
+/**
+ * Merge a freshly read zone into a credential's metadata.
+ *
+ * Merges rather than replaces, because this column also carries the reauth
+ * markers — writing a bare `{ timeZone }` here would clear `needsReauth` and
+ * silently re-enable a connection the refresh path had flagged as broken.
+ *
+ * A null zone (the vendor could not tell us) still stamps the check, so a
+ * provider that never reports one is asked once a day rather than on every
+ * single call.
+ */
+export const writeCredentialTimeZone = (
+  previous: unknown,
+  timeZone: string | null,
+  now: Date = new Date()
+): Record<string, unknown> => {
+  const base =
+    previous && typeof previous === 'object'
+      ? { ...(previous as Record<string, unknown>) }
+      : {};
+  if (isValidTimeZone(timeZone)) {
+    base[TIME_ZONE_KEY] = timeZone.trim();
+  } else {
+    delete base[TIME_ZONE_KEY];
+  }
+  base[TIME_ZONE_CHECKED_AT_KEY] = now.toISOString();
+  return base;
+};
+
+/**
+ * The zone Google Calendar is configured in, from the primary calendar.
+ *
+ * Deliberately NOT `GET /users/me/settings/timezone`, which is the more
+ * direct answer to "what did the user configure" and needs
+ * `calendar.settings.readonly` — a scope we do not request and could not add
+ * without sending every already-connected user back through consent. The
+ * primary calendar's zone is the same value in every case that matters, and
+ * `calendar.readonly` already covers it.
+ *
+ * Returns null on any failure. Not knowing the zone is a state the callers
+ * handle; a throw here would take a tool call or a chat turn with it.
+ */
+export const fetchGoogleCalendarTimeZone = async (
+  accessToken: string
+): Promise<string | null> => {
+  try {
+    const response = await fetch(
+      `${constants.GOOGLE_CALENDAR_API_BASE}/calendars/primary`,
+      {
+        headers: {
+          Authorization: `Bearer ${accessToken}`,
+          Accept: 'application/json'
+        }
+      }
+    );
+    if (!response.ok) return null;
+    const payload = (await response.json()) as { timeZone?: unknown };
+    return isValidTimeZone(payload?.timeZone) ? payload.timeZone.trim() : null;
+  } catch {
+    return null;
+  }
+};
+
+/**
+ * The zone on the connected Cal.com profile.
+ *
+ * This is the host's zone — the one their availability is written in — which
+ * is what "9am" means when the artifact owner or their bot says it. It is not
+ * the attendee's zone; see the booking handler for why we use it there anyway.
+ *
+ * Same null-on-failure contract as the Google reader above.
+ */
+export const fetchCalcomTimeZone = async (
+  apiKey: string
+): Promise<string | null> => {
+  try {
+    const response = await fetch(`${constants.CALCOM_API_BASE}/me`, {
+      headers: {
+        Authorization: `Bearer ${apiKey}`,
+        'cal-api-version': constants.CALCOM_API_VERSION_ME,
+        Accept: 'application/json'
+      }
+    });
+    if (!response.ok) return null;
+    const payload = (await response.json()) as {
+      data?: { timeZone?: unknown };
+    };
+    const value = payload?.data?.timeZone;
+    return isValidTimeZone(value) ? value.trim() : null;
+  } catch {
+    return null;
+  }
+};