@mulmoclaude/core 0.20.2 → 0.22.0

package/dist/google/index.js

@@ -76,31 +76,44 @@ function truncate(text, max, ellipsis = "…") {
 }
 //#endregion
 //#region src/google/clientSecret.ts
+var isNonEmptyString = (value) => typeof value === "string" && value !== "";
 var isInstalledClientSecret = (value) => {
 	if (!isRecord(value) || !isRecord(value.installed)) return false;
-	return typeof value.installed.client_id === "string" && typeof value.installed.client_secret === "string";
+	return isNonEmptyString(value.installed.client_id) && isNonEmptyString(value.installed.client_secret);
 };
 var isClientSecretFileName = (name) => name.startsWith("client_secret_") && name.endsWith(".json");
-async function listClientSecretFiles(home) {
-	return (await readdir(googleSecretsDir(home)).catch(() => [])).filter(isClientSecretFileName).sort();
+var readIfDesktopClient = async (filePath) => {
+	try {
+		return isInstalledClientSecret(JSON.parse(await readFile(filePath, "utf-8"))) ? filePath : null;
+	} catch {
+		return null;
+	}
+};
+/** Absolute paths of every desktop-app client JSON in `~/.secrets/`. */
+async function listDesktopClientSecretFiles(home) {
+	const dir = googleSecretsDir(home);
+	const candidates = (await readdir(dir).catch(() => [])).filter(isClientSecretFileName).sort();
+	return (await Promise.all(candidates.map((name) => readIfDesktopClient(join(dir, name))))).filter((path) => path !== null);
 }
 async function clientSecretPresence(home) {
-	const matches = await listClientSecretFiles(home);
+	const matches = await listDesktopClientSecretFiles(home);
 	if (matches.length === 0) return "missing";
 	return matches.length === 1 ? "found" : "ambiguous";
 }
 async function findClientSecretPath(home) {
 	const dir = googleSecretsDir(home);
-	const matches = await listClientSecretFiles(home);
+	const matches = await listDesktopClientSecretFiles(home);
 	const [first, ...rest] = matches;
-	if (!first) throw new Error(`no client_secret_*.json found in ${dir} — download the OAuth desktop-app credentials JSON from the Google Cloud Console and place it there (mode 600)`);
-	if (rest.length > 0) throw new Error(`multiple client_secret_*.json files found in ${dir} (${matches.join(", ")}) — keep exactly one`);
-	return join(dir, first);
+	if (!first) throw new Error(`no desktop-app client_secret_*.json found in ${dir} — this host links through the sign-in service instead`);
+	if (rest.length > 0) {
+		const names = matches.map((path) => path.slice(dir.length + 1)).join(", ");
+		throw new Error(`multiple desktop-app client_secret_*.json files found in ${dir} (${names}) — keep exactly one`);
+	}
+	return first;
 }
 async function loadClientSecret(home) {
 	const filePath = await findClientSecretPath(home);
-	const raw = await readFile(filePath, "utf-8");
-	const parsed = JSON.parse(raw);
+	const parsed = JSON.parse(await readFile(filePath, "utf-8"));
 	if (!isInstalledClientSecret(parsed)) throw new Error(`${filePath} is not a desktop-app OAuth client secret (missing "installed" with client_id / client_secret)`);
 	return {
 		client_id: parsed.installed.client_id,
@@ -160,6 +173,7 @@ function mergeGoogleTokens(existing, incoming) {
 		...incoming
 	};
 	if (!incoming.refresh_token && existing?.refresh_token) merged.refresh_token = existing.refresh_token;
+	if (!incoming.issuedVia && existing?.issuedVia) merged.issuedVia = existing.issuedVia;
 	return merged;
 }
 var fileExists = async (filePath) => await stat(filePath).then(() => true, () => false);
@@ -220,6 +234,113 @@ function bridgeExternalSignal(external, controller) {
 	return () => external.removeEventListener("abort", onAbort);
 }
 //#endregion
+//#region src/google/broker.ts
+var DEFAULT_BROKER_BASE_URL = "https://asia-northeast1-mulmoserver.cloudfunctions.net";
+var BROKER_TIMEOUT_MS = 20 * ONE_SECOND_MS;
+var withoutTrailingSlashes = (url) => {
+	let end = url.length;
+	while (end > 0 && url[end - 1] === "/") end -= 1;
+	return url.slice(0, end);
+};
+/** `MULMO_GOOGLE_BROKER_URL` lets a fork / staging deploy point elsewhere
+*  without a code change; unset means the shipped broker. */
+var brokerBaseUrl = (override = process.env.MULMO_GOOGLE_BROKER_URL) => withoutTrailingSlashes(override ?? DEFAULT_BROKER_BASE_URL);
+var LOOPBACK_HOSTNAMES = /* @__PURE__ */ new Set([
+	"127.0.0.1",
+	"localhost",
+	"::1",
+	"[::1]"
+]);
+/** Codes, PKCE verifiers and refresh tokens travel to the broker, so cleartext
+*  is refused outright — an override pointed at `http://…` would put them on
+*  the wire. Loopback stays allowed: that is where tests stub the broker, and
+*  it never leaves the machine. */
+var assertSecureBrokerUrl = (url) => {
+	let parsed;
+	try {
+		parsed = new URL(url);
+	} catch {
+		throw new Error(`invalid Google sign-in service URL: ${url}`);
+	}
+	if (parsed.protocol === "https:") return;
+	if (parsed.protocol === "http:" && LOOPBACK_HOSTNAMES.has(parsed.hostname)) return;
+	throw new Error(`the Google sign-in service must be reached over HTTPS (got ${parsed.protocol}//${parsed.host})`);
+};
+var brokerFetch = async (url, init = {}) => {
+	assertSecureBrokerUrl(url);
+	let response;
+	try {
+		response = await fetchWithTimeout(url, {
+			...init,
+			timeoutMs: BROKER_TIMEOUT_MS,
+			headers: { "Content-Type": "application/json" }
+		});
+	} catch (err) {
+		throw new Error(`Google sign-in service unreachable — check the network connection and retry (${errorMessage(err)})`);
+	}
+	if (!response.ok) throw new Error(`Google sign-in service returned HTTP ${response.status}`);
+	try {
+		return await response.json();
+	} catch {
+		throw new Error("Google sign-in service returned a malformed response");
+	}
+};
+var GOOGLE_CONSENT_HOST = "accounts.google.com";
+/** The returned URL is opened in the user's browser, so it must be Google's
+*  own consent page and nothing else — a mis-pointed or hostile broker (the
+*  base URL is overridable) could otherwise hand back a phishing page wearing
+*  a sign-in flow. Cheap to assert, and Google's endpoint host is fixed. */
+var assertGoogleConsentUrl = (authUrl) => {
+	let parsed;
+	try {
+		parsed = new URL(authUrl);
+	} catch {
+		throw new Error("Google sign-in service returned an unusable authorization URL");
+	}
+	if (parsed.protocol !== "https:" || parsed.hostname !== GOOGLE_CONSENT_HOST) throw new Error(`Google sign-in service returned an authorization URL that is not Google's consent page (${parsed.protocol}//${parsed.host})`);
+};
+async function brokerStart(port, codeChallenge, baseUrl = brokerBaseUrl()) {
+	const payload = await brokerFetch(`${baseUrl}/googleOAuthStart?${new URLSearchParams({
+		port: String(port),
+		code_challenge: codeChallenge
+	}).toString()}`);
+	const record = isRecord(payload) ? payload : {};
+	if (typeof record.auth_url !== "string" || typeof record.state !== "string") throw new Error("Google sign-in service returned an unexpected response (missing auth_url / state)");
+	assertGoogleConsentUrl(record.auth_url);
+	return {
+		authUrl: record.auth_url,
+		state: record.state
+	};
+}
+var toCredentials = (payload, existingRefreshToken) => {
+	const record = isRecord(payload) ? payload : {};
+	if (typeof record.access_token !== "string") throw new Error("Google sign-in service returned no access token");
+	const refreshToken = typeof record.refresh_token === "string" ? record.refresh_token : existingRefreshToken;
+	return {
+		access_token: record.access_token,
+		...refreshToken ? { refresh_token: refreshToken } : {},
+		...typeof record.expiry_date === "number" ? { expiry_date: record.expiry_date } : {}
+	};
+};
+async function brokerExchange(input, baseUrl = brokerBaseUrl()) {
+	const credentials = toCredentials(await brokerFetch(`${baseUrl}/googleOAuthExchange`, {
+		method: "POST",
+		body: JSON.stringify({
+			code: input.code,
+			state: input.state,
+			code_verifier: input.codeVerifier
+		})
+	}));
+	if (!credentials.refresh_token) throw new Error("Google returned no refresh token — remove this app under Google Account → Security → Third-party access, then retry");
+	return credentials;
+}
+async function brokerRefresh(refreshToken, baseUrl = brokerBaseUrl()) {
+	return toCredentials(await brokerFetch(`${baseUrl}/googleOAuthRefresh`, {
+		method: "POST",
+		body: JSON.stringify({ refresh_token: refreshToken })
+	}), refreshToken);
+}
+//#endregion
 //#region src/google/auth.ts
 var GOOGLE_CALENDAR_SCOPE = "https://www.googleapis.com/auth/calendar.events";
 var GOOGLE_TASKS_SCOPE = "https://www.googleapis.com/auth/tasks";
@@ -235,6 +356,9 @@ var GOOGLE_SCOPES = [
 var CALLBACK_PATH = "/oauth2callback";
 var AUTH_TIMEOUT_MS = 5 * ONE_MINUTE_MS;
 var STATE_BYTES = 16;
+/** Renew a minute early so a call can't start with a token that expires
+*  mid-flight. */
+var EXPIRY_MARGIN_MS = ONE_MINUTE_MS;
 var createClient = (secret, redirectUri) => new OAuth2Client({
 	clientId: secret.client_id,
 	clientSecret: secret.client_secret,
@@ -247,15 +371,29 @@ var persistRotatedTokens = (client, home) => {
 		});
 	});
 };
-async function getGoogleAccessToken(home) {
-	const saved = await loadGoogleTokens(home);
-	if (!saved?.refresh_token) throw new Error("Google account not linked on this host — ask the user to link their Google account in this app's settings, then retry");
+var REVOKED_GRANT_MESSAGE = "could not obtain a Google access token — the grant may have been revoked; re-link the account";
+var localAccessToken = async (saved, home) => {
+	const presence = await clientSecretPresence(home);
+	if (presence === "ambiguous") await loadClientSecret(home);
+	if (presence === "missing") throw new Error("the saved Google link was created with an OAuth client that is no longer configured on this host — ask the user to link their Google account again in this app's settings");
 	const client = createClient(await loadClientSecret(home));
 	client.setCredentials(saved);
 	persistRotatedTokens(client, home);
 	const { token } = await client.getAccessToken();
-	if (!token) throw new Error("could not obtain a Google access token — the grant may have been revoked; re-link the account");
+	if (!token) throw new Error(REVOKED_GRANT_MESSAGE);
 	return token;
+};
+var brokerAccessToken = async (saved, home) => {
+	if (typeof saved.expiry_date === "number" && saved.access_token && saved.expiry_date - EXPIRY_MARGIN_MS > Date.now()) return saved.access_token;
+	const refreshed = await brokerRefresh(saved.refresh_token ?? "");
+	if (!refreshed.access_token) throw new Error(REVOKED_GRANT_MESSAGE);
+	await saveGoogleTokens(refreshed, home);
+	return refreshed.access_token;
+};
+async function getGoogleAccessToken(home) {
+	const saved = await loadGoogleTokens(home);
+	if (!saved?.refresh_token) throw new Error("Google account not linked on this host — ask the user to link their Google account in this app's settings, then retry");
+	return saved.issuedVia === "broker" ? await brokerAccessToken(saved, home) : await localAccessToken(saved, home);
 }
 var REVOKE_URL = "https://oauth2.googleapis.com/revoke";
 /** Revoke the grant at Google (best-effort) and delete the local token file.
@@ -336,22 +474,49 @@ var buildConsentUrl = (client, codeChallenge, state) => client.generateAuthUrl({
 	code_challenge: codeChallenge,
 	state
 });
+var generatePkce = async () => {
+	const { codeVerifier, codeChallenge } = await new OAuth2Client().generateCodeVerifierAsync();
+	if (!codeChallenge) throw new Error("failed to derive a PKCE code challenge");
+	return {
+		codeVerifier,
+		codeChallenge
+	};
+};
+var authorizeWithLocalClient = async (secret, server, port, opts) => {
+	const client = createClient(secret, `http://127.0.0.1:${port}${CALLBACK_PATH}`);
+	const { codeVerifier, codeChallenge } = await client.generateCodeVerifierAsync();
+	if (!codeChallenge) throw new Error("failed to derive a PKCE code challenge");
+	const state = randomBytes(STATE_BYTES).toString("hex");
+	opts.onAuthUrl?.(buildConsentUrl(client, codeChallenge, state));
+	const code = await waitForAuthCode(server, state, opts.timeoutMs ?? AUTH_TIMEOUT_MS);
+	const { tokens } = await client.getToken({
+		code,
+		codeVerifier
+	});
+	if (!tokens.refresh_token) throw new Error("Google returned no refresh token — remove this app under Google Account → Security → Third-party access, then retry");
+	return tokens;
+};
+var authorizeWithBroker = async (server, port, opts) => {
+	const { codeVerifier, codeChallenge } = await generatePkce();
+	const { authUrl, state } = await brokerStart(port, codeChallenge);
+	opts.onAuthUrl?.(authUrl);
+	return await brokerExchange({
+		code: await waitForAuthCode(server, state, opts.timeoutMs ?? AUTH_TIMEOUT_MS),
+		state,
+		codeVerifier
+	});
+};
 async function authorizeGoogle(opts = {}) {
-	const secret = await loadClientSecret(opts.home);
+	const presence = await clientSecretPresence(opts.home);
+	if (presence === "ambiguous") await loadClientSecret(opts.home);
+	const useLocalClient = presence === "found";
 	const { server, port } = await startLoopbackServer();
 	try {
-		const client = createClient(secret, `http://127.0.0.1:${port}${CALLBACK_PATH}`);
-		const { codeVerifier, codeChallenge } = await client.generateCodeVerifierAsync();
-		if (!codeChallenge) throw new Error("failed to derive a PKCE code challenge");
-		const state = randomBytes(STATE_BYTES).toString("hex");
-		opts.onAuthUrl?.(buildConsentUrl(client, codeChallenge, state));
-		const code = await waitForAuthCode(server, state, opts.timeoutMs ?? AUTH_TIMEOUT_MS);
-		const { tokens } = await client.getToken({
-			code,
-			codeVerifier
-		});
-		if (!tokens.refresh_token) throw new Error("Google returned no refresh token — remove this app under Google Account → Security → Third-party access, then retry");
-		return await saveGoogleTokens(tokens, opts.home);
+		const issuedVia = useLocalClient ? "local" : "broker";
+		return await saveGoogleTokens({
+			...useLocalClient ? await authorizeWithLocalClient(await loadClientSecret(opts.home), server, port, opts) : await authorizeWithBroker(server, port, opts),
+			issuedVia
+		}, opts.home);
 	} finally {
 		server.close();
 	}
@@ -390,50 +555,67 @@ var createGoogleAuthFlow = (authorize) => {
 };
 var googleAuthFlow = createGoogleAuthFlow(authorizeGoogle);
 //#endregion
-//#region src/google/calendar.ts
-var CALENDAR_EVENTS_URL = "https://www.googleapis.com/calendar/v3/calendars/primary/events";
-var CALENDAR_TIMEOUT_MS = 30 * ONE_SECOND_MS;
+//#region src/google/apiClient.ts
+var GOOGLE_API_TIMEOUT_MS = 30 * ONE_SECOND_MS;
 var ERROR_BODY_MAX_CHARS = 300;
 var HTTP_FORBIDDEN = 403;
 var DEFAULT_LIST_MAX_RESULTS = 10;
 var MAX_LIST_RESULTS = 50;
-var eventTime = (value) => {
-	if (!isRecord(value)) return "";
-	if (typeof value.dateTime === "string") return value.dateTime;
-	if (typeof value.date === "string") return value.date;
-	return "";
-};
-var toEventSummary = (value) => {
-	const record = isRecord(value) ? value : {};
-	return {
-		id: typeof record.id === "string" ? record.id : "",
-		summary: typeof record.summary === "string" ? record.summary : "",
-		start: eventTime(record.start),
-		end: eventTime(record.end),
-		htmlLink: typeof record.htmlLink === "string" ? record.htmlLink : "",
-		status: typeof record.status === "string" ? record.status : ""
-	};
-};
-var calendarApiError = (status, body) => {
-	const hint = status === HTTP_FORBIDDEN ? " (is the Google Calendar API enabled for the Cloud project?)" : "";
+/** 403 usually means the API is not enabled for the user's Cloud project —
+*  name the API so the agent's recovery guidance can be specific. */
+var googleApiError = (apiLabel, status, body) => {
+	const hint = status === HTTP_FORBIDDEN ? ` (is the ${apiLabel} enabled for the Cloud project?)` : "";
 	const detail = body ? ` — ${truncate(body, ERROR_BODY_MAX_CHARS)}` : "";
-	return /* @__PURE__ */ new Error(`Google Calendar API: HTTP ${status}${hint}${detail}`);
+	return /* @__PURE__ */ new Error(`${apiLabel}: HTTP ${status}${hint}${detail}`);
 };
-var calendarRequest = async (accessToken, url, init = {}) => {
+async function googleRequest(apiLabel, accessToken, url, init = {}) {
+	const { contentType = "application/json", expectText = false, ...rest } = init;
 	const response = await fetchWithTimeout(url, {
-		...init,
-		timeoutMs: CALENDAR_TIMEOUT_MS,
+		...rest,
+		timeoutMs: GOOGLE_API_TIMEOUT_MS,
 		headers: {
 			Authorization: `Bearer ${accessToken}`,
-			"Content-Type": "application/json"
+			"Content-Type": contentType
 		}
 	});
 	if (!response.ok) {
 		const body = await response.text().catch((err) => errorMessage(err));
-		throw calendarApiError(response.status, body);
+		throw googleApiError(apiLabel, response.status, body);
 	}
+	if (expectText) return await response.text();
+	if (response.status === 204) return {};
 	return await response.json();
+}
+var stringField = (record, key) => typeof record[key] === "string" ? record[key] : "";
+var asRecord = (value) => isRecord(value) ? value : {};
+var itemsOf = (value) => {
+	const record = asRecord(value);
+	return Array.isArray(record.items) ? record.items : [];
+};
+//#endregion
+//#region src/google/calendar.ts
+var CALENDAR_EVENTS_URL = "https://www.googleapis.com/calendar/v3/calendars/primary/events";
+var CALENDAR_API_LABEL = "Google Calendar API";
+var eventTime = (value) => {
+	if (!isRecord(value)) return "";
+	if (typeof value.dateTime === "string") return value.dateTime;
+	if (typeof value.date === "string") return value.date;
+	return "";
+};
+var toEventSummary = (value) => {
+	const record = asRecord(value);
+	return {
+		id: stringField(record, "id"),
+		summary: stringField(record, "summary"),
+		start: eventTime(record.start),
+		end: eventTime(record.end),
+		htmlLink: stringField(record, "htmlLink"),
+		status: stringField(record, "status")
+	};
 };
+/** Kept as a named export for the existing unit tests / callers; the shared
+*  helper now carries the wording. */
+var calendarApiError = (status, body) => googleApiError(CALENDAR_API_LABEL, status, body);
 async function createCalendarEvent(accessToken, input) {
 	const body = {
 		summary: input.summary,
@@ -441,21 +623,169 @@ async function createCalendarEvent(accessToken, input) {
 		start: { dateTime: input.startDateTime },
 		end: { dateTime: input.endDateTime }
 	};
-	return toEventSummary(await calendarRequest(accessToken, CALENDAR_EVENTS_URL, {
+	return toEventSummary(await googleRequest(CALENDAR_API_LABEL, accessToken, CALENDAR_EVENTS_URL, {
 		method: "POST",
 		body: JSON.stringify(body)
 	}));
 }
 async function listCalendarEvents(accessToken, input = {}) {
-	const listed = await calendarRequest(accessToken, `${CALENDAR_EVENTS_URL}?${new URLSearchParams({
+	const record = asRecord(await googleRequest(CALENDAR_API_LABEL, accessToken, `${CALENDAR_EVENTS_URL}?${new URLSearchParams({
 		timeMin: input.timeMin ?? (/* @__PURE__ */ new Date()).toISOString(),
 		maxResults: String(input.maxResults ?? 10),
 		singleEvents: "true",
 		orderBy: "startTime"
-	}).toString()}`);
-	return (isRecord(listed) && Array.isArray(listed.items) ? listed.items : []).map(toEventSummary);
+	}).toString()}`));
+	return (Array.isArray(record.items) ? record.items : []).map(toEventSummary);
+}
+//#endregion
+//#region src/google/tasks.ts
+var TASKS_BASE_URL = "https://tasks.googleapis.com/tasks/v1";
+var TASKS_API_LABEL = "Google Tasks API";
+var DEFAULT_TASK_LIST_ID = "@default";
+var TASK_STATUS_COMPLETED = "completed";
+var MAX_TASK_LISTS = 50;
+var toTaskListSummary = (value) => {
+	const record = asRecord(value);
+	return {
+		id: stringField(record, "id"),
+		title: stringField(record, "title")
+	};
+};
+var toTaskSummary = (value) => {
+	const record = asRecord(value);
+	return {
+		id: stringField(record, "id"),
+		title: stringField(record, "title"),
+		status: stringField(record, "status"),
+		due: stringField(record, "due"),
+		notes: stringField(record, "notes")
+	};
+};
+var tasksUrl = (taskListId, suffix = "") => `${TASKS_BASE_URL}/lists/${encodeURIComponent(taskListId ?? DEFAULT_TASK_LIST_ID)}/tasks${suffix}`;
+async function listTaskLists(accessToken) {
+	return itemsOf(await googleRequest(TASKS_API_LABEL, accessToken, `${TASKS_BASE_URL}/users/@me/lists?maxResults=${MAX_TASK_LISTS}`)).map(toTaskListSummary);
+}
+async function listTasks(accessToken, input = {}) {
+	const params = new URLSearchParams({
+		maxResults: String(input.maxResults ?? 10),
+		showCompleted: String(input.showCompleted ?? false)
+	});
+	return itemsOf(await googleRequest(TASKS_API_LABEL, accessToken, `${tasksUrl(input.taskListId)}?${params.toString()}`)).map(toTaskSummary);
+}
+async function createTask(accessToken, input) {
+	const body = {
+		title: input.title,
+		notes: input.notes,
+		due: input.due
+	};
+	return toTaskSummary(await googleRequest(TASKS_API_LABEL, accessToken, tasksUrl(input.taskListId), {
+		method: "POST",
+		body: JSON.stringify(body)
+	}));
+}
+async function completeTask(accessToken, input) {
+	return toTaskSummary(await googleRequest(TASKS_API_LABEL, accessToken, tasksUrl(input.taskListId, `/${encodeURIComponent(input.taskId)}`), {
+		method: "PATCH",
+		body: JSON.stringify({ status: TASK_STATUS_COMPLETED })
+	}));
+}
+async function deleteTask(accessToken, input) {
+	await googleRequest(TASKS_API_LABEL, accessToken, tasksUrl(input.taskListId, `/${encodeURIComponent(input.taskId)}`), { method: "DELETE" });
+}
+//#endregion
+//#region src/google/driveFile.ts
+var DRIVE_FILES_URL = "https://www.googleapis.com/drive/v3/files";
+var DRIVE_UPLOAD_URL = "https://www.googleapis.com/upload/drive/v3/files";
+var DRIVE_API_LABEL = "Google Drive API";
+var DEFAULT_MIME_TYPE = "text/plain";
+var FILE_FIELDS = "id,name,mimeType,webViewLink,modifiedTime";
+var MAX_READ_CHARS = 1e5;
+var TEXT_MIME_PREFIXES = [
+	"text/",
+	"application/json",
+	"application/xml",
+	"application/javascript"
+];
+var toDriveFileSummary = (value) => {
+	const record = asRecord(value);
+	return {
+		id: stringField(record, "id"),
+		name: stringField(record, "name"),
+		mimeType: stringField(record, "mimeType"),
+		webViewLink: stringField(record, "webViewLink"),
+		modifiedTime: stringField(record, "modifiedTime")
+	};
+};
+var isTextMimeType = (mimeType) => TEXT_MIME_PREFIXES.some((prefix) => mimeType.startsWith(prefix));
+async function listDriveFiles(accessToken, input = {}) {
+	const record = asRecord(await googleRequest(DRIVE_API_LABEL, accessToken, `${DRIVE_FILES_URL}?${new URLSearchParams({
+		pageSize: String(input.maxResults ?? 10),
+		fields: `files(${FILE_FIELDS})`,
+		orderBy: "modifiedTime desc"
+	}).toString()}`));
+	return (Array.isArray(record.files) ? record.files : []).map(toDriveFileSummary);
+}
+var BOUNDARY_BYTES = 16;
+/** Fresh per request: a fixed boundary appearing inside file content would
+*  split the payload at the wrong place, so Drive would store a truncated or
+*  mangled file. Random 128 bits makes an accidental — or crafted — collision
+*  infeasible; `newMultipartBoundary` is re-derived until it is absent from
+*  the body it must delimit. */
+var newMultipartBoundary = () => `mulmo-drive-${randomBytes(BOUNDARY_BYTES).toString("hex")}`;
+var MIME_TYPE_RE = /^[A-Za-z0-9!#$&^_.+-]+\/[A-Za-z0-9!#$&^_.+-]+$/;
+var assertSafeMimeType = (mimeType) => {
+	if (!MIME_TYPE_RE.test(mimeType)) throw new Error(`Google Drive API: invalid mimeType '${mimeType}' — expected a plain type/subtype such as text/plain`);
+	return mimeType;
+};
+var buildMultipartBody = (metadata, content, mimeType, boundary) => [
+	`--${boundary}`,
+	"Content-Type: application/json; charset=UTF-8",
+	"",
+	JSON.stringify(metadata),
+	`--${boundary}`,
+	`Content-Type: ${mimeType}`,
+	"",
+	content,
+	`--${boundary}--`,
+	""
+].join("\r\n");
+/** A boundary that appears nowhere in the parts it delimits. */
+var pickBoundary = (parts, generate = newMultipartBoundary) => {
+	const collides = (candidate) => parts.some((part) => part.includes(candidate));
+	let boundary = generate();
+	while (collides(boundary)) boundary = generate();
+	return boundary;
+};
+async function createDriveFile(accessToken, input) {
+	const mimeType = assertSafeMimeType(input.mimeType ?? DEFAULT_MIME_TYPE);
+	const metadata = {
+		name: input.name,
+		mimeType
+	};
+	const boundary = pickBoundary([input.content, JSON.stringify(metadata)]);
+	return toDriveFileSummary(await googleRequest(DRIVE_API_LABEL, accessToken, `${DRIVE_UPLOAD_URL}?${new URLSearchParams({
+		uploadType: "multipart",
+		fields: FILE_FIELDS
+	}).toString()}`, {
+		method: "POST",
+		contentType: `multipart/related; boundary=${boundary}`,
+		body: buildMultipartBody(metadata, input.content, mimeType, boundary)
+	}));
+}
+async function readDriveFile(accessToken, input) {
+	const fileId = encodeURIComponent(input.fileId);
+	const file = toDriveFileSummary(await googleRequest(DRIVE_API_LABEL, accessToken, `${DRIVE_FILES_URL}/${fileId}?fields=${FILE_FIELDS}`));
+	if (!isTextMimeType(file.mimeType)) throw new Error(`Google Drive API: '${file.name}' is ${file.mimeType || "a binary file"} — only text files can be read as content`);
+	const raw = await googleRequest(DRIVE_API_LABEL, accessToken, `${DRIVE_FILES_URL}/${fileId}?alt=media`, { expectText: true });
+	return {
+		file,
+		content: typeof raw === "string" ? raw.slice(0, MAX_READ_CHARS) : ""
+	};
+}
+async function deleteDriveFile(accessToken, input) {
+	await googleRequest(DRIVE_API_LABEL, accessToken, `${DRIVE_FILES_URL}/${encodeURIComponent(input.fileId)}`, { method: "DELETE" });
 }
 //#endregion
-export { DEFAULT_LIST_MAX_RESULTS, GOOGLE_CALENDAR_SCOPE, GOOGLE_DRIVE_FILE_SCOPE, GOOGLE_SCOPES, GOOGLE_TASKS_SCOPE, MAX_LIST_RESULTS, authorizeGoogle, calendarApiError, clientSecretPresence, configureGoogleHost, createCalendarEvent, createGoogleAuthFlow, deleteGoogleTokens, findClientSecretPath, getGoogleAccessToken, googleAuthFlow, googleConfigDir, googleSecretsDir, googleTokenPath, isIsoDateTimeWithOffset, legacyGoogleTokenPath, listCalendarEvents, loadClientSecret, loadGoogleTokens, mergeGoogleTokens, saveGoogleTokens, toEventSummary, unlinkGoogle, waitForAuthCode };
+export { DEFAULT_LIST_MAX_RESULTS, GOOGLE_CALENDAR_SCOPE, GOOGLE_DRIVE_FILE_SCOPE, GOOGLE_SCOPES, GOOGLE_TASKS_SCOPE, MAX_LIST_RESULTS, assertSafeMimeType, authorizeGoogle, brokerBaseUrl, brokerExchange, brokerRefresh, brokerStart, buildMultipartBody, calendarApiError, clientSecretPresence, completeTask, configureGoogleHost, createCalendarEvent, createDriveFile, createGoogleAuthFlow, createTask, deleteDriveFile, deleteGoogleTokens, deleteTask, findClientSecretPath, getGoogleAccessToken, googleApiError, googleAuthFlow, googleConfigDir, googleSecretsDir, googleTokenPath, isIsoDateTimeWithOffset, isTextMimeType, legacyGoogleTokenPath, listCalendarEvents, listDriveFiles, listTaskLists, listTasks, loadClientSecret, loadGoogleTokens, mergeGoogleTokens, pickBoundary, readDriveFile, saveGoogleTokens, toDriveFileSummary, toEventSummary, toTaskListSummary, toTaskSummary, unlinkGoogle, waitForAuthCode };
 
 //# sourceMappingURL=index.js.map