@mulmoclaude/core 0.19.1 → 0.20.1

package/assets/helps/error-recovery.md

@@ -296,3 +296,36 @@ minutes rather than stacking them on the same one.
 container from a Windows host (WSL2 + native `dockerd`), with the same mounts / env / argv the
 shipped builders produce, and asserts `handlePermission` comes back over the MCP handshake. See
 `docs/windows-docker-ci.md`.
+
+---
+
+## Google tool — link / credential / API errors
+
+### Symptoms
+
+- The `google` tool (or a `google.calendar.*` remote command) fails with **"Google account not linked on this host"**.
+- Errors mentioning **client_secret**: "no client_secret_*.json found" or "multiple client_secret_*.json files found".
+- **"Google Calendar API: HTTP 403"** with a hint about enabling the API.
+- **"could not obtain a Google access token"** (grant revoked).
+
+### Cause
+
+The `google` tool runs against a Google account linked **locally on this machine** — a refresh
+token stored at `~/.config/mulmo/google-token.json` (mode 600), obtained through a desktop
+OAuth (loopback + PKCE) consent using the client credentials in `~/.secrets/client_secret_*.json`.
+This is independent of claude.ai Google connectors. Each failure names its missing piece.
+
+### Fix
+
+- **Not linked / grant revoked** — ask the user to link (or re-link) the account: Settings →
+  Plugins → Google → "Link Google account", or run `yarn google:auth` in the repo. Then retry the
+  original call. Do NOT try to create or edit the token file yourself.
+- **No client secret** — the user must download the OAuth *desktop-app* client JSON from the
+  Google Cloud Console (APIs & Services → Credentials) and place it in `~/.secrets/` keeping the
+  `client_secret_*.json` filename (chmod 600).
+- **Multiple client secrets** — ask the user to keep exactly one `client_secret_*.json` in
+  `~/.secrets/`; the stored refresh token pairs with one OAuth client, so duplicates are refused
+  rather than guessed at.
+- **HTTP 403 from a Google API** — the API is not enabled for the user's Cloud project. Ask them
+  to enable it in the Cloud Console (APIs & Services → Library — e.g. "Google Calendar API"),
+  then retry. No re-link needed.

package/dist/google/auth.d.ts

@@ -0,0 +1,26 @@
+import { default as http } from 'node:http';
+import { Credentials } from 'google-auth-library';
+import { fetchWithTimeout } from './fetch.js';
+export declare const GOOGLE_CALENDAR_SCOPE = "https://www.googleapis.com/auth/calendar.events";
+export declare const GOOGLE_TASKS_SCOPE = "https://www.googleapis.com/auth/tasks";
+export declare const GOOGLE_DRIVE_FILE_SCOPE = "https://www.googleapis.com/auth/drive.file";
+/** Requested at consent as one set — matches the scopes registered on the
+ *  OAuth consent screen, so a single re-link covers every supported API
+ *  (Calendar now; Tasks / Drive tools ride the same grant later). */
+export declare const GOOGLE_SCOPES: string[];
+export interface AuthorizeGoogleOptions {
+    home?: string;
+    /** Called with the consent URL; open it in a browser (and/or print it). */
+    onAuthUrl?: (url: string) => void;
+    timeoutMs?: number;
+}
+export declare function getGoogleAccessToken(home?: string): Promise<string>;
+/** The revoke POST, injectable for tests. */
+export type RevokeFetch = typeof fetchWithTimeout;
+/** Revoke the grant at Google (best-effort) and delete the local token file.
+ *  Revoke failures are logged but never block the local delete — Google may
+ *  already consider the token invalid, and keeping the file would leave the
+ *  user unable to unlink. */
+export declare function unlinkGoogle(home?: string, revokeFetch?: RevokeFetch): Promise<void>;
+export declare const waitForAuthCode: (server: http.Server, expectedState: string, timeoutMs: number) => Promise<string>;
+export declare function authorizeGoogle(opts?: AuthorizeGoogleOptions): Promise<Credentials>;

package/dist/google/authFlow.d.ts

@@ -0,0 +1,13 @@
+import { authorizeGoogle } from './auth.js';
+export interface GoogleAuthFlowStatus {
+    pending: boolean;
+    lastError: string | null;
+}
+export interface GoogleAuthFlow {
+    start: () => Promise<{
+        authUrl: string;
+    }>;
+    status: () => GoogleAuthFlowStatus;
+}
+export declare const createGoogleAuthFlow: (authorize: typeof authorizeGoogle) => GoogleAuthFlow;
+export declare const googleAuthFlow: GoogleAuthFlow;

package/dist/google/calendar.d.ts

@@ -0,0 +1,24 @@
+export declare const DEFAULT_LIST_MAX_RESULTS = 10;
+export declare const MAX_LIST_RESULTS = 50;
+export interface CalendarEventInput {
+    summary: string;
+    startDateTime: string;
+    endDateTime: string;
+    description?: string;
+}
+export interface ListEventsInput {
+    timeMin?: string;
+    maxResults?: number;
+}
+export interface CalendarEventSummary {
+    id: string;
+    summary: string;
+    start: string;
+    end: string;
+    htmlLink: string;
+    status: string;
+}
+export declare const toEventSummary: (value: unknown) => CalendarEventSummary;
+export declare const calendarApiError: (status: number, body: string) => Error;
+export declare function createCalendarEvent(accessToken: string, input: CalendarEventInput): Promise<CalendarEventSummary>;
+export declare function listCalendarEvents(accessToken: string, input?: ListEventsInput): Promise<CalendarEventSummary[]>;

package/dist/google/clientSecret.d.ts

@@ -0,0 +1,11 @@
+export interface InstalledClientSecret {
+    client_id: string;
+    client_secret: string;
+}
+/** "ambiguous" (2+ files) is distinct from "missing" — the fixes differ
+ *  (remove duplicates vs download credentials), so the UI must not conflate
+ *  them. */
+export type ClientSecretPresence = "found" | "missing" | "ambiguous";
+export declare function clientSecretPresence(home?: string): Promise<ClientSecretPresence>;
+export declare function findClientSecretPath(home?: string): Promise<string>;
+export declare function loadClientSecret(home?: string): Promise<InstalledClientSecret>;

package/dist/google/datetime.d.ts

@@ -0,0 +1 @@
+export declare const isIsoDateTimeWithOffset: (value: string) => boolean;

package/dist/google/fetch.d.ts

@@ -0,0 +1,8 @@
+export declare const DEFAULT_FETCH_TIMEOUT_MS: number;
+export type FetchWithTimeoutInit = Parameters<typeof fetch>[1] & {
+    timeoutMs?: number;
+};
+/** `fetch` with a finite timeout. Rejects with a `TimeoutError` once
+ *  `timeoutMs` elapses. Composes with a caller-supplied `signal` so external
+ *  cancellation still works. */
+export declare function fetchWithTimeout(url: string | URL, init?: FetchWithTimeoutInit): Promise<Response>;

package/dist/google/fsJson.d.ts

@@ -0,0 +1,4 @@
+export declare function readJsonOrNull<T>(filePath: string): Promise<T | null>;
+/** tmp-write + rename so readers never see a half-written file; `mode`
+ *  applies to the tmp file and survives the rename. */
+export declare function writeJsonAtomicWithMode(filePath: string, data: unknown, mode: number): Promise<void>;

package/dist/google/host.d.ts

@@ -0,0 +1,10 @@
+export interface GoogleLogger {
+    error: (prefix: string, message: string, data?: Record<string, unknown>) => void;
+    warn: (prefix: string, message: string, data?: Record<string, unknown>) => void;
+    info: (prefix: string, message: string, data?: Record<string, unknown>) => void;
+    debug: (prefix: string, message: string, data?: Record<string, unknown>) => void;
+}
+export declare function configureGoogleHost(binding: {
+    log: GoogleLogger;
+}): void;
+export declare const log: GoogleLogger;

package/dist/google/index.cjs

@@ -0,0 +1,493 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_rolldown_runtime = require("../rolldown-runtime-D6vf50IK.cjs");
+let node_path = require("node:path");
+node_path = require_rolldown_runtime.__toESM(node_path, 1);
+let node_fs = require("node:fs");
+let node_fs_promises = require("node:fs/promises");
+let node_crypto = require("node:crypto");
+let node_os = require("node:os");
+let node_http = require("node:http");
+node_http = require_rolldown_runtime.__toESM(node_http, 1);
+let google_auth_library = require("google-auth-library");
+//#region src/google/host.ts
+var hostLog = {
+	error: () => void 0,
+	warn: () => void 0,
+	info: () => void 0,
+	debug: () => void 0
+};
+function configureGoogleHost(binding) {
+	hostLog = binding.log;
+}
+var log = {
+	error: (prefix, message, data) => hostLog.error(prefix, message, data),
+	warn: (prefix, message, data) => hostLog.warn(prefix, message, data),
+	info: (prefix, message, data) => hostLog.info(prefix, message, data),
+	debug: (prefix, message, data) => hostLog.debug(prefix, message, data)
+};
+//#endregion
+//#region src/google/datetime.ts
+var ISO_DATE_TIME_WITH_OFFSET_RE = /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(?:Z|[+-](\d{2}):(\d{2}))$/;
+var FRACTIONAL_SECONDS_RE = /\.\d+(?=Z|[+-])/;
+var MAX_HOUR = 23;
+var MAX_MINUTE = 59;
+var MAX_SECOND = 59;
+var isRealCalendarDate = (year, month, day) => {
+	const roundTrip = new Date(Date.UTC(year, month - 1, day));
+	return roundTrip.getUTCFullYear() === year && roundTrip.getUTCMonth() === month - 1 && roundTrip.getUTCDate() === day;
+};
+var isIsoDateTimeWithOffset = (value) => {
+	const match = ISO_DATE_TIME_WITH_OFFSET_RE.exec(value.replace(FRACTIONAL_SECONDS_RE, ""));
+	if (!match) return false;
+	const [year = 0, month = 0, day = 0, hour = 0, minute = 0, second = 0] = match.slice(1, 7).map(Number);
+	const timeInRange = hour <= MAX_HOUR && minute <= MAX_MINUTE && second <= MAX_SECOND;
+	const offsetInRange = match[7] === void 0 || Number(match[7]) <= MAX_HOUR && Number(match[8]) <= MAX_MINUTE;
+	return isRealCalendarDate(year, month, day) && timeInRange && offsetInRange;
+};
+//#endregion
+//#region src/google/paths.ts
+function googleConfigDir(home) {
+	return (0, node_path.join)(home ?? (0, node_os.homedir)(), ".config", "mulmo");
+}
+/** Pre-0.20.1 token dir (mulmoclaude-branded); reads migrate away from it. */
+function legacyGoogleTokenPath(home) {
+	return (0, node_path.join)(home ?? (0, node_os.homedir)(), ".config", "mulmoclaude", "google-token.json");
+}
+function googleTokenPath(home) {
+	return (0, node_path.join)(googleConfigDir(home), "google-token.json");
+}
+function googleSecretsDir(home) {
+	return (0, node_path.join)(home ?? (0, node_os.homedir)(), ".secrets");
+}
+//#endregion
+//#region src/google/util.ts
+var ONE_SECOND_MS = 1e3;
+var ONE_MINUTE_MS = 6e4;
+function errorMessage(err, fallback = "unknown error") {
+	if (err instanceof Error) return err.message || fallback;
+	const text = String(err);
+	return text === "" || text === "[object Object]" ? fallback : text;
+}
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** Clip a string to at most `max` chars; the ellipsis is included in the
+*  budget so output never exceeds `max`. */
+function truncate(text, max, ellipsis = "…") {
+	if (max <= 0) return "";
+	if (text.length <= max) return text;
+	return `${text.slice(0, Math.max(0, max - ellipsis.length))}${ellipsis}`;
+}
+//#endregion
+//#region src/google/clientSecret.ts
+var isInstalledClientSecret = (value) => {
+	if (!isRecord(value) || !isRecord(value.installed)) return false;
+	return typeof value.installed.client_id === "string" && typeof value.installed.client_secret === "string";
+};
+var isClientSecretFileName = (name) => name.startsWith("client_secret_") && name.endsWith(".json");
+async function listClientSecretFiles(home) {
+	return (await (0, node_fs_promises.readdir)(googleSecretsDir(home)).catch(() => [])).filter(isClientSecretFileName).sort();
+}
+async function clientSecretPresence(home) {
+	const matches = await listClientSecretFiles(home);
+	if (matches.length === 0) return "missing";
+	return matches.length === 1 ? "found" : "ambiguous";
+}
+async function findClientSecretPath(home) {
+	const dir = googleSecretsDir(home);
+	const matches = await listClientSecretFiles(home);
+	const [first, ...rest] = matches;
+	if (!first) throw new Error(`no client_secret_*.json found in ${dir} — download the OAuth desktop-app credentials JSON from the Google Cloud Console and place it there (mode 600)`);
+	if (rest.length > 0) throw new Error(`multiple client_secret_*.json files found in ${dir} (${matches.join(", ")}) — keep exactly one`);
+	return (0, node_path.join)(dir, first);
+}
+async function loadClientSecret(home) {
+	const filePath = await findClientSecretPath(home);
+	const raw = await (0, node_fs_promises.readFile)(filePath, "utf-8");
+	const parsed = JSON.parse(raw);
+	if (!isInstalledClientSecret(parsed)) throw new Error(`${filePath} is not a desktop-app OAuth client secret (missing "installed" with client_id / client_secret)`);
+	return {
+		client_id: parsed.installed.client_id,
+		client_secret: parsed.installed.client_secret
+	};
+}
+//#endregion
+//#region src/google/fsJson.ts
+async function readJsonOrNull(filePath) {
+	try {
+		const raw = await node_fs.promises.readFile(filePath, "utf-8");
+		return JSON.parse(raw);
+	} catch {
+		return null;
+	}
+}
+var IS_WINDOWS = process.platform === "win32";
+var RENAME_RETRY_DELAYS_MS = [
+	30,
+	100,
+	300
+];
+var hasErrnoCode = (err) => typeof err === "object" && err !== null && "code" in err && typeof err.code === "string";
+var isTransientRenameError = (err) => IS_WINDOWS && hasErrnoCode(err) && (err.code === "EPERM" || err.code === "EBUSY" || err.code === "EACCES");
+async function renameWithWindowsRetry(fromPath, toPath) {
+	for (const delayMs of RENAME_RETRY_DELAYS_MS) try {
+		await node_fs.promises.rename(fromPath, toPath);
+		return;
+	} catch (err) {
+		if (!isTransientRenameError(err)) throw err;
+		await new Promise((resolve) => setTimeout(resolve, delayMs));
+	}
+	await node_fs.promises.rename(fromPath, toPath);
+}
+/** tmp-write + rename so readers never see a half-written file; `mode`
+*  applies to the tmp file and survives the rename. */
+async function writeJsonAtomicWithMode(filePath, data, mode) {
+	const tmp = `${filePath}.tmp`;
+	await node_fs.promises.mkdir(node_path.default.dirname(filePath), { recursive: true });
+	try {
+		await node_fs.promises.writeFile(tmp, JSON.stringify(data, null, 2), {
+			encoding: "utf-8",
+			mode
+		});
+		await renameWithWindowsRetry(tmp, filePath);
+	} catch (err) {
+		await node_fs.promises.unlink(tmp).catch(() => void 0);
+		throw err;
+	}
+}
+//#endregion
+//#region src/google/tokenStore.ts
+var TOKEN_FILE_MODE = 384;
+function mergeGoogleTokens(existing, incoming) {
+	const merged = {
+		...existing,
+		...incoming
+	};
+	if (!incoming.refresh_token && existing?.refresh_token) merged.refresh_token = existing.refresh_token;
+	return merged;
+}
+var fileExists = async (filePath) => await (0, node_fs_promises.stat)(filePath).then(() => true, () => false);
+async function migrateLegacyTokenFile(home) {
+	const current = googleTokenPath(home);
+	const legacy = legacyGoogleTokenPath(home);
+	if (!await fileExists(legacy)) return;
+	await (0, node_fs_promises.mkdir)(node_path.default.dirname(current), { recursive: true });
+	try {
+		await (0, node_fs_promises.copyFile)(legacy, current, node_fs_promises.constants.COPYFILE_EXCL);
+	} catch {
+		return;
+	}
+	await (0, node_fs_promises.rm)(legacy, { force: true });
+}
+async function loadGoogleTokens(home) {
+	await migrateLegacyTokenFile(home).catch(() => void 0);
+	const current = await readJsonOrNull(googleTokenPath(home));
+	if (current) return current;
+	return await readJsonOrNull(legacyGoogleTokenPath(home));
+}
+async function saveGoogleTokens(incoming, home) {
+	const merged = mergeGoogleTokens(await loadGoogleTokens(home), incoming);
+	await writeJsonAtomicWithMode(googleTokenPath(home), merged, TOKEN_FILE_MODE);
+	return merged;
+}
+async function deleteGoogleTokens(home) {
+	await (0, node_fs_promises.rm)(googleTokenPath(home), { force: true });
+}
+//#endregion
+//#region src/google/fetch.ts
+var DEFAULT_FETCH_TIMEOUT_MS = 10 * ONE_SECOND_MS;
+/** `fetch` with a finite timeout. Rejects with a `TimeoutError` once
+*  `timeoutMs` elapses. Composes with a caller-supplied `signal` so external
+*  cancellation still works. */
+async function fetchWithTimeout(url, init = {}) {
+	const { timeoutMs = DEFAULT_FETCH_TIMEOUT_MS, signal: callerSignal, ...rest } = init;
+	if (callerSignal?.aborted) throw callerSignal.reason ?? new DOMException("Aborted", "AbortError");
+	const controller = new AbortController();
+	const timer = setTimeout(() => {
+		controller.abort(new DOMException(`fetch timed out after ${timeoutMs}ms`, "TimeoutError"));
+	}, timeoutMs);
+	const unsubscribeCaller = bridgeExternalSignal(callerSignal, controller);
+	try {
+		return await fetch(url, {
+			...rest,
+			signal: controller.signal
+		});
+	} finally {
+		clearTimeout(timer);
+		unsubscribeCaller?.();
+	}
+}
+function bridgeExternalSignal(external, controller) {
+	if (!external) return null;
+	const onAbort = () => controller.abort(external.reason);
+	external.addEventListener("abort", onAbort, { once: true });
+	return () => external.removeEventListener("abort", onAbort);
+}
+//#endregion
+//#region src/google/auth.ts
+var GOOGLE_CALENDAR_SCOPE = "https://www.googleapis.com/auth/calendar.events";
+var GOOGLE_TASKS_SCOPE = "https://www.googleapis.com/auth/tasks";
+var GOOGLE_DRIVE_FILE_SCOPE = "https://www.googleapis.com/auth/drive.file";
+/** Requested at consent as one set — matches the scopes registered on the
+*  OAuth consent screen, so a single re-link covers every supported API
+*  (Calendar now; Tasks / Drive tools ride the same grant later). */
+var GOOGLE_SCOPES = [
+	GOOGLE_CALENDAR_SCOPE,
+	GOOGLE_TASKS_SCOPE,
+	GOOGLE_DRIVE_FILE_SCOPE
+];
+var CALLBACK_PATH = "/oauth2callback";
+var AUTH_TIMEOUT_MS = 5 * ONE_MINUTE_MS;
+var STATE_BYTES = 16;
+var createClient = (secret, redirectUri) => new google_auth_library.OAuth2Client({
+	clientId: secret.client_id,
+	clientSecret: secret.client_secret,
+	redirectUri
+});
+var persistRotatedTokens = (client, home) => {
+	client.on("tokens", (tokens) => {
+		saveGoogleTokens(tokens, home).catch((err) => {
+			log.error("google", "failed to persist rotated tokens", { error: String(err) });
+		});
+	});
+};
+async function getGoogleAccessToken(home) {
+	const saved = await loadGoogleTokens(home);
+	if (!saved?.refresh_token) throw new Error("Google account not linked on this host — link it in Settings → Plugins → Google, or run `yarn google:auth`");
+	const client = createClient(await loadClientSecret(home));
+	client.setCredentials(saved);
+	persistRotatedTokens(client, home);
+	const { token } = await client.getAccessToken();
+	if (!token) throw new Error("could not obtain a Google access token — the grant may have been revoked; re-link the account");
+	return token;
+}
+var REVOKE_URL = "https://oauth2.googleapis.com/revoke";
+/** Revoke the grant at Google (best-effort) and delete the local token file.
+*  Revoke failures are logged but never block the local delete — Google may
+*  already consider the token invalid, and keeping the file would leave the
+*  user unable to unlink. */
+async function unlinkGoogle(home, revokeFetch = fetchWithTimeout) {
+	const saved = await loadGoogleTokens(home);
+	const token = saved?.refresh_token ?? saved?.access_token;
+	if (token) try {
+		const response = await revokeFetch(REVOKE_URL, {
+			method: "POST",
+			headers: { "Content-Type": "application/x-www-form-urlencoded" },
+			body: new URLSearchParams({ token }).toString()
+		});
+		if (!response.ok) log.warn("google", "token revoke returned non-ok", { status: response.status });
+	} catch (err) {
+		log.warn("google", "token revoke failed, deleting local tokens anyway", { error: errorMessage(err) });
+	}
+	await deleteGoogleTokens(home);
+}
+var startLoopbackServer = () => new Promise((resolve, reject) => {
+	const server = node_http.default.createServer();
+	server.once("error", reject);
+	server.listen(0, "127.0.0.1", () => {
+		const address = server.address();
+		if (address === null || typeof address === "string") {
+			reject(/* @__PURE__ */ new Error("loopback server has no port"));
+			return;
+		}
+		resolve({
+			server,
+			port: address.port
+		});
+	});
+});
+var authCodeFromCallback = (url, expectedState) => {
+	if (url.searchParams.get("state") !== expectedState) throw new Error("OAuth state mismatch — possible CSRF, aborting");
+	const error = url.searchParams.get("error");
+	if (error) throw new Error(`Google authorization failed: ${error}`);
+	const code = url.searchParams.get("code");
+	if (!code) throw new Error("authorization callback carried no code");
+	return code;
+};
+var respondHtml = (res, status, message) => {
+	res.writeHead(status, { "Content-Type": "text/html; charset=utf-8" });
+	res.end(`<html><body><h3>${message}</h3></body></html>`);
+};
+var waitForAuthCode = (server, expectedState, timeoutMs) => new Promise((resolve, reject) => {
+	const timer = setTimeout(() => reject(/* @__PURE__ */ new Error(`authorization timed out after ${timeoutMs / ONE_SECOND_MS}s`)), timeoutMs);
+	server.on("request", (req, res) => {
+		const url = new URL(req.url ?? "/", "http://127.0.0.1");
+		if (url.pathname !== CALLBACK_PATH) {
+			res.writeHead(404);
+			res.end();
+			return;
+		}
+		if (url.searchParams.get("state") !== expectedState) {
+			respondHtml(res, 400, "Invalid authorization callback. You can close this tab.");
+			return;
+		}
+		clearTimeout(timer);
+		try {
+			const code = authCodeFromCallback(url, expectedState);
+			respondHtml(res, 200, "Authorization complete — you can close this tab.");
+			resolve(code);
+		} catch (err) {
+			respondHtml(res, 400, "Authorization failed — see the terminal for details. You can close this tab.");
+			reject(err);
+		}
+	});
+});
+var buildConsentUrl = (client, codeChallenge, state) => client.generateAuthUrl({
+	access_type: "offline",
+	prompt: "consent",
+	scope: GOOGLE_SCOPES,
+	code_challenge_method: google_auth_library.CodeChallengeMethod.S256,
+	code_challenge: codeChallenge,
+	state
+});
+async function authorizeGoogle(opts = {}) {
+	const secret = await loadClientSecret(opts.home);
+	const { server, port } = await startLoopbackServer();
+	try {
+		const client = createClient(secret, `http://127.0.0.1:${port}${CALLBACK_PATH}`);
+		const { codeVerifier, codeChallenge } = await client.generateCodeVerifierAsync();
+		if (!codeChallenge) throw new Error("failed to derive a PKCE code challenge");
+		const state = (0, node_crypto.randomBytes)(STATE_BYTES).toString("hex");
+		opts.onAuthUrl?.(buildConsentUrl(client, codeChallenge, state));
+		const code = await waitForAuthCode(server, state, opts.timeoutMs ?? AUTH_TIMEOUT_MS);
+		const { tokens } = await client.getToken({
+			code,
+			codeVerifier
+		});
+		if (!tokens.refresh_token) throw new Error("Google returned no refresh token — remove this app under Google Account → Security → Third-party access, then retry");
+		return await saveGoogleTokens(tokens, opts.home);
+	} finally {
+		server.close();
+	}
+}
+//#endregion
+//#region src/google/authFlow.ts
+var createGoogleAuthFlow = (authorize) => {
+	let inFlightStart = null;
+	let flowRunning = false;
+	let lastError = null;
+	const launchFlow = () => new Promise((resolve, reject) => {
+		flowRunning = true;
+		authorize({ onAuthUrl: (url) => resolve({ authUrl: url }) }).then(() => log.info("google", "authorize flow completed")).catch((err) => {
+			lastError = errorMessage(err);
+			log.warn("google", "authorize flow failed", { error: lastError });
+			reject(err instanceof Error ? err : new Error(String(err)));
+		}).finally(() => {
+			flowRunning = false;
+			inFlightStart = null;
+		});
+	});
+	const start = () => {
+		if (inFlightStart) return inFlightStart;
+		lastError = null;
+		inFlightStart = launchFlow();
+		return inFlightStart;
+	};
+	const status = () => ({
+		pending: flowRunning,
+		lastError
+	});
+	return {
+		start,
+		status
+	};
+};
+var googleAuthFlow = createGoogleAuthFlow(authorizeGoogle);
+//#endregion
+//#region src/google/calendar.ts
+var CALENDAR_EVENTS_URL = "https://www.googleapis.com/calendar/v3/calendars/primary/events";
+var CALENDAR_TIMEOUT_MS = 30 * ONE_SECOND_MS;
+var ERROR_BODY_MAX_CHARS = 300;
+var HTTP_FORBIDDEN = 403;
+var DEFAULT_LIST_MAX_RESULTS = 10;
+var MAX_LIST_RESULTS = 50;
+var eventTime = (value) => {
+	if (!isRecord(value)) return "";
+	if (typeof value.dateTime === "string") return value.dateTime;
+	if (typeof value.date === "string") return value.date;
+	return "";
+};
+var toEventSummary = (value) => {
+	const record = isRecord(value) ? value : {};
+	return {
+		id: typeof record.id === "string" ? record.id : "",
+		summary: typeof record.summary === "string" ? record.summary : "",
+		start: eventTime(record.start),
+		end: eventTime(record.end),
+		htmlLink: typeof record.htmlLink === "string" ? record.htmlLink : "",
+		status: typeof record.status === "string" ? record.status : ""
+	};
+};
+var calendarApiError = (status, body) => {
+	const hint = status === HTTP_FORBIDDEN ? " (is the Google Calendar API enabled for the Cloud project?)" : "";
+	const detail = body ? ` — ${truncate(body, ERROR_BODY_MAX_CHARS)}` : "";
+	return /* @__PURE__ */ new Error(`Google Calendar API: HTTP ${status}${hint}${detail}`);
+};
+var calendarRequest = async (accessToken, url, init = {}) => {
+	const response = await fetchWithTimeout(url, {
+		...init,
+		timeoutMs: CALENDAR_TIMEOUT_MS,
+		headers: {
+			Authorization: `Bearer ${accessToken}`,
+			"Content-Type": "application/json"
+		}
+	});
+	if (!response.ok) {
+		const body = await response.text().catch((err) => errorMessage(err));
+		throw calendarApiError(response.status, body);
+	}
+	return await response.json();
+};
+async function createCalendarEvent(accessToken, input) {
+	const body = {
+		summary: input.summary,
+		description: input.description,
+		start: { dateTime: input.startDateTime },
+		end: { dateTime: input.endDateTime }
+	};
+	return toEventSummary(await calendarRequest(accessToken, CALENDAR_EVENTS_URL, {
+		method: "POST",
+		body: JSON.stringify(body)
+	}));
+}
+async function listCalendarEvents(accessToken, input = {}) {
+	const listed = await calendarRequest(accessToken, `${CALENDAR_EVENTS_URL}?${new URLSearchParams({
+		timeMin: input.timeMin ?? (/* @__PURE__ */ new Date()).toISOString(),
+		maxResults: String(input.maxResults ?? 10),
+		singleEvents: "true",
+		orderBy: "startTime"
+	}).toString()}`);
+	return (isRecord(listed) && Array.isArray(listed.items) ? listed.items : []).map(toEventSummary);
+}
+//#endregion
+exports.DEFAULT_LIST_MAX_RESULTS = DEFAULT_LIST_MAX_RESULTS;
+exports.GOOGLE_CALENDAR_SCOPE = GOOGLE_CALENDAR_SCOPE;
+exports.GOOGLE_DRIVE_FILE_SCOPE = GOOGLE_DRIVE_FILE_SCOPE;
+exports.GOOGLE_SCOPES = GOOGLE_SCOPES;
+exports.GOOGLE_TASKS_SCOPE = GOOGLE_TASKS_SCOPE;
+exports.MAX_LIST_RESULTS = MAX_LIST_RESULTS;
+exports.authorizeGoogle = authorizeGoogle;
+exports.calendarApiError = calendarApiError;
+exports.clientSecretPresence = clientSecretPresence;
+exports.configureGoogleHost = configureGoogleHost;
+exports.createCalendarEvent = createCalendarEvent;
+exports.createGoogleAuthFlow = createGoogleAuthFlow;
+exports.deleteGoogleTokens = deleteGoogleTokens;
+exports.findClientSecretPath = findClientSecretPath;
+exports.getGoogleAccessToken = getGoogleAccessToken;
+exports.googleAuthFlow = googleAuthFlow;
+exports.googleConfigDir = googleConfigDir;
+exports.googleSecretsDir = googleSecretsDir;
+exports.googleTokenPath = googleTokenPath;
+exports.isIsoDateTimeWithOffset = isIsoDateTimeWithOffset;
+exports.legacyGoogleTokenPath = legacyGoogleTokenPath;
+exports.listCalendarEvents = listCalendarEvents;
+exports.loadClientSecret = loadClientSecret;
+exports.loadGoogleTokens = loadGoogleTokens;
+exports.mergeGoogleTokens = mergeGoogleTokens;
+exports.saveGoogleTokens = saveGoogleTokens;
+exports.toEventSummary = toEventSummary;
+exports.unlinkGoogle = unlinkGoogle;
+exports.waitForAuthCode = waitForAuthCode;
+
+//# sourceMappingURL=index.cjs.map