@mulmoclaude/core 1.13.0 → 1.14.0

package/dist/google/index.cjs

@@ -1,12 +1,12 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_rolldown_runtime = require("../rolldown-runtime-D6vf50IK.cjs");
-const require_dist = require("../dist-21pMsI1a.cjs");
+const require_dist = require("../dist-CsgSfWwR.cjs");
 const require_text = require("../text-CaAh9ZSO.cjs");
 const require_atomic = require("../atomic-C_7YpMiM.cjs");
 const require_utils_fetch = require("../utils/fetch.cjs");
-const require_calendarGrid = require("../calendarGrid-CaS9er8i.cjs");
-const require_project = require("../project-CCtT_fQr.cjs");
-const require_discovery = require("../discovery-DAoMnBYM.cjs");
+const require_calendarGrid = require("../calendarGrid-BQYqOCnF.cjs");
+const require_project = require("../project-C1ep9pvo.cjs");
+const require_discovery = require("../discovery-CRDx6TS4.cjs");
 let node_fs = require("node:fs");
 let node_path = require("node:path");
 node_path = require_rolldown_runtime.__toESM(node_path, 1);
@@ -593,6 +593,7 @@ var CALENDAR_LIST_PAGE_SIZE = 250;
 var MAX_CALENDAR_LIST_PAGES = 40;
 var EVENT_SYNC_PAGE_SIZE = 2500;
 var MAX_EVENT_SYNC_PAGES = 200;
+var CALENDAR_META_PAGE_SIZE = 1;
 var HTTP_GONE = 410;
 var EVENT_ABSENT_STATUSES = [404, HTTP_GONE];
 /** An `If-Match` write whose etag no longer matches — someone else changed the
@@ -804,20 +805,34 @@ async function collectCalendarPages(fetchPage, maxPages = MAX_CALENDAR_LIST_PAGE
 	}
 	return calendars;
 }
-/** The calendars the user has added/subscribed to (primary + secondary +
-*  shared), each with its id, name and colour, following pagination. Needs the
-*  calendar-list read scope (GOOGLE_CALENDARLIST_SCOPE). */
-/** One calendar's own resource, addressed by id rather than looked up in the
-*  user's list.
+var toCalendarMeta = (value) => {
+	const record = asRecord(value);
+	return {
+		timeZone: stringField(record, "timeZone"),
+		accessRole: stringField(record, "accessRole")
+	};
+};
+/** One calendar's zone and the caller's role on it, read by id rather than
+*  looked up in the user's list.
 *
 *  `calendarList` only holds calendars the user has ADDED; a calendar shared
-*  with them can be readable and writable by id without appearing there. This is
-*  how a push learns such a calendar's `timeZone`. Note the resource carries no
-*  `accessRole` — that is a calendarList property — so reachability here says
-*  nothing about writability. */
-async function getCalendar(accessToken, calendarId) {
-	return toCalendarSummary(await googleRequest(CALENDAR_API_LABEL, accessToken, `${CALENDAR_BASE_URL}/calendars/${encodeURIComponent(canonicalCalendarId(calendarId))}`));
+*  with them can be readable and writable by id without appearing there, and a
+*  push still needs its zone to send an offset-less `dateTime`.
+*
+*  Deliberately `events.list` and NOT `calendars.get`: the latter takes only
+*  full-calendar scopes (`calendar`, `calendar.readonly`, `calendar.calendars*`)
+*  and this app asks for none of them, so it answers 403 for every account it
+*  links (#2735). The events list carries the same `timeZone` — plus the
+*  `accessRole` the calendar resource does not have — under `calendar.events`,
+*  which the push already holds because it writes with it. Only the envelope is
+*  read; the one event asked for is the smallest page Google will serve. */
+async function getCalendarMeta(accessToken, calendarId) {
+	const params = new URLSearchParams({ maxResults: String(CALENDAR_META_PAGE_SIZE) });
+	return toCalendarMeta(await googleRequest(CALENDAR_API_LABEL, accessToken, `${eventsUrl(calendarId)}?${params.toString()}`));
 }
+/** The calendars the user has added/subscribed to (primary + secondary +
+*  shared), each with its id, name and colour, following pagination. Needs the
+*  calendar-list read scope (GOOGLE_CALENDARLIST_SCOPE). */
 async function listCalendars(accessToken) {
 	return collectCalendarPages(async (pageToken) => {
 		const params = new URLSearchParams({ maxResults: String(CALENDAR_LIST_PAGE_SIZE) });
@@ -868,9 +883,7 @@ async function readLockRaw(lockPath) {
 function parseLock(raw) {
 	try {
 		const parsed = JSON.parse(raw);
-		if (typeof parsed !== "object" || parsed === null) return null;
-		const { holder } = parsed;
-		return typeof holder === "string" ? { holder } : null;
+		return require_dist.hasStringProp(parsed, "holder") ? { holder: parsed.holder } : null;
 	} catch {
 		return null;
 	}
@@ -1369,7 +1382,7 @@ var PUSHABLE_SOURCE_FIELDS = [
 	"description",
 	"location"
 ];
-var isPushableSource = (source) => PUSHABLE_SOURCE_FIELDS.includes(source);
+var isPushableSource = (source) => PUSHABLE_SOURCE_FIELDS.some((field) => field === source);
 /** The subset of a schema's `map` a push can act on: collection field → event field. */
 function pushableMap(map) {
 	return Object.fromEntries(Object.entries(map).filter((entry) => isPushableSource(entry[1])));
@@ -1491,21 +1504,28 @@ function locallyDeletedIds(shadow, presentIds) {
 var WRITABLE_ACCESS_ROLES = ["owner", "writer"];
 /** Whether to refuse the whole push before touching a single event.
 *
-*  Only on POSITIVE evidence of a non-writable role. An unlisted calendar is
-*  unknown and must fall through: hard-denying it would block the feature
-*  outright for a calendar the user can in fact write to. Those attempts surface
-*  Google's own 403 per record if the write really is not allowed. */
+*  Only on POSITIVE evidence of a non-writable role. A calendar whose role
+*  neither source reported is unknown and must fall through: hard-denying it
+*  would block the feature outright for a calendar the user can in fact write
+*  to. Those attempts surface Google's own 403 per record if the write really is
+*  not allowed. */
 var isDeniedAccessRole = (accessRole) => accessRole !== null && !WRITABLE_ACCESS_ROLES.includes(accessRole);
+/** A role Google left blank is UNKNOWN, not a denial. `isDeniedAccessRole`
+*  refuses every role it does not recognise — `""` included — so passing an
+*  unreported one straight through would refuse a calendar Google simply said
+*  nothing about. */
+var reportedAccessRole = (accessRole) => accessRole || null;
 /** Resolve the calendar a schema names, for its writability and its timezone.
 *
-*  The list is consulted first because only it reports `accessRole`, which is
-*  what lets a read-only calendar be refused with the real reason instead of an
-*  opaque per-event 403. `"primary"` is matched on the `primary` flag, not the
-*  id — the primary calendar's own id is the account's email address, which never
-*  equals the literal the schema declares.
+*  The list is consulted first because it answers for every added calendar in
+*  one call the push already makes. `"primary"` is matched on the `primary`
+*  flag, not the id — the primary calendar's own id is the account's email
+*  address, which never equals the literal the schema declares.
 *
-*  A calendar absent from the list is NOT denied: it is fetched by id for its
-*  timezone and its role left unknown. A 404 there means the calendar really is
+*  A calendar absent from the list is NOT denied: `calendarList` holds only the
+*  calendars the user has added, so one shared with write access can be missing
+*  from it (Codex review). It is asked about itself instead, which reports the
+*  same zone AND the real role. A 404 there means the calendar is genuinely
 *  unreachable, and propagates as a `failed` outcome. */
 async function liveCalendarMeta(accessToken, calendarId) {
 	const key = canonicalCalendarId(calendarId);
@@ -1515,10 +1535,13 @@ async function liveCalendarMeta(accessToken, calendarId) {
 		accessRole: listed.accessRole,
 		timeZone: listed.timeZone
 	};
-	const direct = await getCalendar(accessToken, calendarId);
-	log.info("google", "calendar is not in the user's list — pushing without an up-front role check", { calendarId: key });
+	const direct = await getCalendarMeta(accessToken, calendarId);
+	log.info("google", "calendar is not in the user's list — role read from the calendar itself", {
+		calendarId: key,
+		accessRole: direct.accessRole
+	});
 	return {
-		accessRole: null,
+		accessRole: reportedAccessRole(direct.accessRole),
 		timeZone: direct.timeZone
 	};
 }
@@ -1703,9 +1726,9 @@ async function createOrAdopt(ctx, eventId, record) {
 }
 /** A 403 on a write is a permissions answer, but `googleApiError` appends the
 *  "is the API enabled for the Cloud project?" hint to every 403 — true for a
-*  disabled API, misleading here. Reached when the up-front role check could not
-*  run because the calendar is not in the user's list, which is exactly when the
-*  user needs the real reason. */
+*  disabled API, misleading here. Reached when the up-front gate let the push
+*  through on an unknown role, which is exactly when the user needs the real
+*  reason. */
 function writeFailure(eventId, error) {
 	if (isGoogleApiError(error) && error.status === 403) return {
 		kind: "skipped",
@@ -2734,9 +2757,9 @@ exports.deleteGoogleTokens = deleteGoogleTokens;
 exports.deleteTask = deleteTask;
 exports.fieldText = fieldText;
 exports.findClientSecretPath = findClientSecretPath;
-exports.getCalendar = getCalendar;
 exports.getCalendarColors = getCalendarColors;
 exports.getCalendarEvent = getCalendarEvent;
+exports.getCalendarMeta = getCalendarMeta;
 exports.getGoogleAccessToken = getGoogleAccessToken;
 exports.googleApiError = googleApiError;
 exports.googleAuthFlow = googleAuthFlow;
@@ -2783,6 +2806,7 @@ exports.pushCollectionNow = pushCollectionNow;
 exports.pushableMap = pushableMap;
 exports.readDriveFile = readDriveFile;
 exports.releaseOrphanedCalendarToken = releaseOrphanedCalendarToken;
+exports.reportedAccessRole = reportedAccessRole;
 exports.resolveEventSpan = resolveEventSpan;
 exports.saveCalendarShadow = saveCalendarShadow;
 exports.saveCalendarSyncToken = saveCalendarSyncToken;
@@ -2794,6 +2818,7 @@ exports.syncCalendarForCollection = syncCalendarForCollection;
 exports.syncCalendarGroup = syncCalendarGroup;
 exports.syncDueCalendarCollections = syncDueCalendarCollections;
 exports.syncNewCalendarCollections = syncNewCalendarCollections;
+exports.toCalendarMeta = toCalendarMeta;
 exports.toCalendarSummary = toCalendarSummary;
 exports.toCollectionDateTime = toCollectionDateTime;
 exports.toCollectionRecord = toCollectionRecord;