@oomol-lab/open-connector 1.6.4 → 1.7.0

package/src/providers/gmail/attachment-stream.js

@@ -0,0 +1,162 @@
+import { providerResponseError, ProviderRequestError } from "../provider-runtime.js";
+const chunkSize = 16 * 1024;
+const maxEnvelopeCharacters = 16 * 1024;
+/** Decode MessagePartBody.data while retaining only a small JSON envelope and one base64 block. */
+export function decodeGmailAttachment(body, maxBytes) {
+    const decoder = new TextDecoder("utf-8", { fatal: true });
+    const parser = new AttachmentParser(maxBytes);
+    return body.pipeThrough(new TransformStream({
+        transform(chunk, controller) {
+            for (let offset = 0; offset < chunk.length; offset += chunkSize) {
+                parser.push(decoder.decode(chunk.subarray(offset, offset + chunkSize), { stream: true }), controller);
+            }
+        },
+        flush(controller) {
+            parser.push(decoder.decode(), controller);
+            parser.finish();
+        },
+    }));
+}
+/** Strip only the top-level data string; JSON.parse validates the remaining bounded envelope at EOF. */
+class AttachmentParser {
+    maxBytes;
+    envelope = "";
+    depth = 0;
+    previous = "";
+    stringKind;
+    escaped = false;
+    keyToken = "";
+    key = "";
+    keys = new Set();
+    sawData = false;
+    dataEscape = "";
+    base64 = "";
+    padding = false;
+    sizeBytes = 0;
+    constructor(maxBytes) {
+        this.maxBytes = maxBytes;
+    }
+    push(text, controller) {
+        for (const character of text) {
+            if (this.stringKind === "data") {
+                this.pushData(character, controller);
+                continue;
+            }
+            this.envelope += character;
+            if (this.envelope.length > maxEnvelopeCharacters) {
+                throw providerResponseError("Gmail attachment JSON envelope is too large");
+            }
+            if (this.stringKind) {
+                if (this.stringKind === "key")
+                    this.keyToken += character;
+                if (this.escaped) {
+                    this.escaped = false;
+                }
+                else if (character === "\\") {
+                    this.escaped = true;
+                }
+                else if (character === '"') {
+                    if (this.stringKind === "key") {
+                        this.key = JSON.parse(this.keyToken);
+                        if (this.keys.has(this.key))
+                            throw providerResponseError("Duplicate Gmail attachment field");
+                        this.keys.add(this.key);
+                    }
+                    this.stringKind = undefined;
+                    this.previous = '"';
+                }
+                continue;
+            }
+            if (character === '"') {
+                if (this.depth === 1 && (this.previous === "{" || this.previous === ",")) {
+                    this.stringKind = "key";
+                    this.keyToken = '"';
+                }
+                else if (this.depth === 1 && this.previous === ":" && this.key === "data") {
+                    this.stringKind = "data";
+                    this.sawData = true;
+                }
+                else {
+                    this.stringKind = "other";
+                }
+            }
+            else if (character === "{" || character === "[") {
+                this.depth++;
+            }
+            else if (character === "}" || character === "]") {
+                this.depth--;
+            }
+            if (!/\s/.test(character))
+                this.previous = character;
+        }
+    }
+    finish() {
+        let envelope;
+        try {
+            envelope = JSON.parse(this.envelope);
+        }
+        catch {
+            throw providerResponseError("Invalid Gmail attachment JSON");
+        }
+        if (!this.sawData ||
+            this.stringKind ||
+            envelope?.data !== "" ||
+            !Number.isSafeInteger(envelope.size) ||
+            envelope.size !== this.sizeBytes) {
+            throw providerResponseError("Gmail attachment is incomplete or its size does not match");
+        }
+    }
+    pushData(character, controller) {
+        if (this.dataEscape) {
+            this.dataEscape += character;
+            if (this.dataEscape === "\\u" || (this.dataEscape.startsWith("\\u") && this.dataEscape.length < 6))
+                return;
+            try {
+                character = JSON.parse(`"${this.dataEscape}"`);
+            }
+            catch {
+                throw providerResponseError("Invalid Gmail attachment JSON escape");
+            }
+            this.dataEscape = "";
+        }
+        else if (character === "\\") {
+            this.dataEscape = character;
+            return;
+        }
+        else if (character === '"') {
+            // Buffer's decoder is permissive. Round-tripping the tail rejects bad padding and unused bits.
+            const tail = Buffer.from(this.base64, "base64url");
+            if (!/^[A-Za-z0-9_-]*={0,2}$/.test(this.base64) ||
+                (this.padding && this.base64.length % 4 !== 0) ||
+                tail.toString("base64url") !== this.base64.replace(/=+$/, "")) {
+                throw providerResponseError("Invalid Gmail attachment base64url data");
+            }
+            this.emit(tail, controller);
+            this.base64 = "";
+            this.stringKind = undefined;
+            this.previous = '"';
+            this.envelope += '"';
+            return;
+        }
+        if (!/^[A-Za-z0-9_=-]$/.test(character) || (this.padding && character !== "=")) {
+            throw providerResponseError("Invalid Gmail attachment base64url data");
+        }
+        this.padding ||= character === "=";
+        this.base64 += character;
+        if (this.padding && this.base64.length > chunkSize + 2) {
+            throw providerResponseError("Invalid Gmail attachment base64url padding");
+        }
+        if (!this.padding && this.base64.length === chunkSize) {
+            this.emit(Buffer.from(this.base64, "base64url"), controller);
+            this.base64 = "";
+        }
+    }
+    emit(bytes, controller) {
+        this.sizeBytes += bytes.length;
+        if (this.sizeBytes > this.maxBytes) {
+            throw new ProviderRequestError(413, `Gmail attachment exceeds transit file limit of ${this.maxBytes} bytes`);
+        }
+        if (bytes.length)
+            controller.enqueue(bytes);
+    }
+}

package/src/providers/gmail/executors.d.ts

@@ -1,10 +1,12 @@
-import type { CredentialValidators, ProviderExecutors, ProviderProxyExecutor } from "../../core/types.ts";
+import type { CredentialValidators, ExecutionContext, ProviderExecutors, ProviderProxyExecutor } from "../../core/types.ts";
 import type { ProviderActionHandlers } from "../provider-runtime.ts";
 declare const service = "gmail";
 interface ActionContext {
     userId: string;
     accessToken: string;
     fetcher: typeof fetch;
+    transitFiles?: ExecutionContext["transitFiles"];
+    signal?: AbortSignal;
 }
 type ActionHandler = (input: Record<string, unknown>, context: ActionContext) => Promise<unknown>;
 export declare const gmailActionHandlers: ProviderActionHandlers<typeof service, ActionHandler>;

package/src/providers/gmail/executors.js

@@ -1,12 +1,40 @@
-import { googleBearerProxyAuth, googleServiceAccountValidator, resolveGoogleAccessToken } from "../google-auth.js";
-import { defineProviderExecutors, defineProviderProxy, ProviderRequestError, readProviderJsonBody, } from "../provider-runtime.js";
+import { looseArray, optionalRecord, optionalString } from "../../core/cast.js";
+import { encodePathSegment } from "../../core/request.js";
+import { googleBearerProxyAuth, googleServiceAccountValidator, resolveGoogleAccessToken, } from "../googledrive/runtime-auth.js";
+import { defineProviderExecutors, defineProviderProxy, ProviderRequestError, readProviderErrorTextBody, readProviderJsonBody, requiredInputString, runProviderRequest, withRetryAfterSeconds, } from "../provider-runtime.js";
+import { decodeGmailAttachment } from "./attachment-stream.js";
 import { buildRecipients, encodeMimeMessage, extractBodyContent, firstAddress, normalizeGmailMessage, normalizeMessageId, normalizeThreadId, parseAddressList, readHeader, resolveReplyHeaders, summarizeGmailMessage, } from "./message.js";
 import { gmailOAuthScopes } from "./scopes.js";
 const service = "gmail";
 const gmailApiBaseUrl = "https://gmail.googleapis.com/gmail/v1";
 const detailHydrationBatchSize = 10;
+// Attachments may reach Gmail's 25 MB cap, and the base64 JSON envelope is a third larger again;
+// the default 30 s request budget covers fetch, decode, and disk write, so give this transfer longer.
+const attachmentDownloadTimeoutMs = 120_000;
 const defaultFetchEmailsMaxResults = 20;
 export const gmailActionHandlers = {
+    async download_attachment(input, context) {
+        const { transitFiles, fetcher, accessToken } = context;
+        if (!transitFiles?.createFromStream) {
+            throw new ProviderRequestError(400, "Gmail attachment downloads require a streaming transit file backend (filesystem).");
+        }
+        const messageId = requiredInputString(input.messageId, "messageId");
+        const attachmentId = requiredInputString(input.attachmentId, "attachmentId");
+        const userId = optionalString(input.userId) ?? context.userId;
+        const url = `${gmailUserUrl(userId, "messages")}/${encodePathSegment(messageId)}/attachments/${encodePathSegment(attachmentId)}?fields=data,size`;
+        return runProviderRequest({ signal: context.signal, label: "Gmail attachment", timeoutMs: attachmentDownloadTimeoutMs }, async (signal) => {
+            const response = await fetcher(url, { headers: { authorization: `Bearer ${accessToken}` }, signal });
+            await assertGmailResponse(response);
+            if (!response.body)
+                throw new ProviderRequestError(502, "Gmail attachment response has no body");
+            return transitFiles.createFromStream({
+                body: decodeGmailAttachment(response.body, transitFiles.maxBytes),
+                name: optionalString(input.fileName) ?? "attachment",
+                mimeType: optionalString(input.mimeType) ?? "application/octet-stream",
+                signal,
+            });
+        });
+    },
     async search_threads(input, { userId, accessToken, fetcher }) {
         const output = await listThreads(input, userId, accessToken, fetcher);
         return {
@@ -175,13 +203,20 @@ export const executors = defineProviderExecutors({
             fetcher,
             signal: context.signal,
         });
-        return { userId: "me", accessToken: resolved.accessToken, fetcher };
+        return {
+            userId: "me",
+            accessToken: resolved.accessToken,
+            fetcher,
+            transitFiles: context.transitFiles,
+            signal: context.signal,
+        };
     },
 });
 export const proxy = defineProviderProxy({
     service,
     baseUrl: gmailApiBaseUrl,
     auth: googleBearerProxyAuth(gmailOAuthScopes),
+    readError: readGmailError,
 });
 export const credentialValidators = {
     async oauth2(input, { fetcher }) {
@@ -733,31 +768,24 @@ async function assertGmailResponse(response) {
     if (response.ok) {
         return;
     }
-    const text = await response.text().catch(() => "");
-    const message = readGmailErrorMessage(text) || `gmail request failed with ${response.status}`;
-    if (response.status === 400) {
-        throw new ProviderRequestError(400, message);
-    }
-    if (response.status === 401 || response.status === 403) {
-        throw new ProviderRequestError(response.status, message);
-    }
-    if (response.status === 429) {
-        throw new ProviderRequestError(429, message);
-    }
-    throw new ProviderRequestError(response.status, message);
-}
-function readGmailErrorMessage(text) {
-    if (!text) {
-        return "";
-    }
+    throw await readGmailError(response);
+}
+const gmailQuotaReasons = new Set([
+    "rateLimitExceeded",
+    "userRateLimitExceeded",
+    "dailyLimitExceeded",
+    "quotaExceeded",
+]);
+async function readGmailError(response) {
+    const text = await readProviderErrorTextBody(response, "gmail error response");
+    let error;
     try {
-        const payload = JSON.parse(text);
-        if (typeof payload.error === "string") {
-            return payload.error;
-        }
-        return payload.error?.message ?? text;
+        error = optionalRecord(optionalRecord(JSON.parse(text))?.error);
     }
     catch {
-        return text;
+        // A malformed response must not expose its raw body or change status classification.
     }
+    const rateLimited = response.status === 403 &&
+        looseArray(error?.errors).some((entry) => gmailQuotaReasons.has(optionalString(optionalRecord(entry)?.reason) ?? ""));
+    return new ProviderRequestError(response.status, optionalString(error?.message) ?? `gmail request failed with ${response.status}`, withRetryAfterSeconds(response), rateLimited ? "rate_limited" : undefined);
 }

package/src/providers/gmail/message.d.ts

@@ -20,6 +20,7 @@ export interface GmailMessageResource {
     internalDate?: string;
     labelIds?: string[];
     snippet?: string;
+    sizeEstimate?: number;
     raw?: string;
     payload?: GmailMessagePart;
 }
@@ -39,13 +40,7 @@ export interface GmailAttachmentSummary {
     mimeType: string;
     size: number;
 }
-export interface NormalizedGmailMessage {
-    messageId: string;
-    threadId: string;
-    labelIds: string[];
-    subject: string;
-    sender: string;
-    to: string;
+export interface NormalizedGmailMessage extends GmailMessageSummary {
     preview: {
         subject: string;
         body: string;
@@ -53,7 +48,6 @@ export interface NormalizedGmailMessage {
     payload: GmailMessagePart | null;
     messageText: string;
     attachmentList: GmailAttachmentSummary[];
-    messageTimestamp: string;
     raw?: string;
 }
 export interface GmailMessageSummary {
@@ -64,6 +58,10 @@ export interface GmailMessageSummary {
     sender: string;
     to: string;
     messageTimestamp: string;
+    historyId?: string;
+    internalDate?: string;
+    sizeEstimate?: number;
+    snippet?: string;
 }
 export interface MimeMessageInput {
     to: string[];

package/src/providers/gmail/message.js

@@ -8,6 +8,10 @@ export function summarizeGmailMessage(resource) {
         sender: readHeader(headers, "From"),
         to: readHeader(headers, "To"),
         messageTimestamp: toMessageTimestamp(resource.internalDate, readHeader(headers, "Date")),
+        historyId: resource.historyId,
+        internalDate: resource.internalDate,
+        sizeEstimate: resource.sizeEstimate,
+        snippet: resource.snippet,
     };
 }
 export function normalizeGmailMessage(resource) {

package/src/providers/gmail/scopes.d.ts

@@ -10,4 +10,36 @@ export declare const gmailComposeScopes: string[];
 export declare const gmailSendScopes: string[];
 export declare const gmailLabelScopes: string[];
 export declare const gmailSettingsBasicScopes: string[];
+/**
+ * The scopes a SERVICE ACCOUNT token is minted for, and the ones the proxy
+ * resolves with. Unchanged: a domain-wide-delegation grant lists these exact
+ * scopes in the Workspace admin console, and a token request naming a scope the
+ * admin has not authorized fails outright — so this list cannot grow without
+ * breaking every existing service-account connection.
+ */
 export declare const gmailOAuthScopes: string[];
+/**
+ * The scopes a user OAuth authorization may request — the menu, not a minimum.
+ *
+ * `gmail.readonly` is here and not in {@link gmailOAuthScopes} because the two
+ * lists answer different questions. That one asks "what does a service account
+ * token need to cover every action"; `modify` subsumes `readonly` there, so
+ * adding it would be redundant at best and, through domain-wide delegation,
+ * breaking at worst.
+ *
+ * This one is what `filterDeclaredScopes` intersects a caller's
+ * `requestedScopes` against, so a scope absent here cannot be requested AT ALL.
+ * Leaving `readonly` out therefore forced every read-only integration to
+ * authorize `gmail.modify` — write, label and trash on the user's mailbox — in
+ * order to call actions that declare `gmailReadScopes`. That is the opposite of
+ * least privilege, and it is invisible: consent succeeds, so nothing reports
+ * that more was granted than the integration can use.
+ *
+ * Note for anyone storing a client config WITHOUT `requestedScopes`:
+ * `getEffectiveScopes` falls back to this whole list, so such a config now asks
+ * for four scopes rather than three. `readonly` is subsumed by `modify`, so no
+ * new capability is granted — but the consent screen gains a line, and a
+ * deployment that wants the narrow set should say so explicitly with
+ * `requestedScopes`, which is the correct posture regardless.
+ */
+export declare const gmailAuthorizableScopes: string[];

package/src/providers/gmail/scopes.js

@@ -10,4 +10,41 @@ export const gmailComposeScopes = [gmailComposeScope];
 export const gmailSendScopes = [gmailSendScope];
 export const gmailLabelScopes = [gmailLabelsScope];
 export const gmailSettingsBasicScopes = [gmailSettingsBasicScope];
+/**
+ * The scopes a SERVICE ACCOUNT token is minted for, and the ones the proxy
+ * resolves with. Unchanged: a domain-wide-delegation grant lists these exact
+ * scopes in the Workspace admin console, and a token request naming a scope the
+ * admin has not authorized fails outright — so this list cannot grow without
+ * breaking every existing service-account connection.
+ */
 export const gmailOAuthScopes = [gmailModifyScope, gmailLabelsScope, gmailSettingsBasicScope];
+/**
+ * The scopes a user OAuth authorization may request — the menu, not a minimum.
+ *
+ * `gmail.readonly` is here and not in {@link gmailOAuthScopes} because the two
+ * lists answer different questions. That one asks "what does a service account
+ * token need to cover every action"; `modify` subsumes `readonly` there, so
+ * adding it would be redundant at best and, through domain-wide delegation,
+ * breaking at worst.
+ *
+ * This one is what `filterDeclaredScopes` intersects a caller's
+ * `requestedScopes` against, so a scope absent here cannot be requested AT ALL.
+ * Leaving `readonly` out therefore forced every read-only integration to
+ * authorize `gmail.modify` — write, label and trash on the user's mailbox — in
+ * order to call actions that declare `gmailReadScopes`. That is the opposite of
+ * least privilege, and it is invisible: consent succeeds, so nothing reports
+ * that more was granted than the integration can use.
+ *
+ * Note for anyone storing a client config WITHOUT `requestedScopes`:
+ * `getEffectiveScopes` falls back to this whole list, so such a config now asks
+ * for four scopes rather than three. `readonly` is subsumed by `modify`, so no
+ * new capability is granted — but the consent screen gains a line, and a
+ * deployment that wants the narrow set should say so explicitly with
+ * `requestedScopes`, which is the correct posture regardless.
+ */
+export const gmailAuthorizableScopes = [
+    gmailReadonlyScope,
+    gmailModifyScope,
+    gmailLabelsScope,
+    gmailSettingsBasicScope,
+];

package/src/providers/google_analytics/executors.js

@@ -1,6 +1,6 @@
 import { compactObject, objectArray, optionalBooleanOrNull, optionalIntegerOrNull, optionalObjectArray, optionalRecord as asOptionalObject, optionalScalarString, optionalString as optionalNonEmptyString, optionalStringOrNull, requiredRecord, } from "../../core/cast.js";
-import { defineGoogleProviderExecutors, googleBearerProxyAuth, googleServiceAccountValidator } from "../google-auth.js";
-import { googleJsonRequest } from "../google-runtime.js";
+import { defineGoogleProviderExecutors, googleBearerProxyAuth, googleServiceAccountValidator, } from "../googledrive/runtime-auth.js";
+import { googleJsonRequest } from "../googledrive/runtime-request.js";
 import { defineProviderProxy, ProviderRequestError } from "../provider-runtime.js";
 import { googleAnalyticsOAuthScopes } from "./scopes.js";
 const service = "google_analytics";

package/src/providers/google_analytics/scopes.js

@@ -1,5 +1,10 @@
+import { googleIdentityScopes } from "../googleads/scopes.js";
 export const googleAnalyticsReadonlyScope = "https://www.googleapis.com/auth/analytics.readonly";
 export const googleAnalyticsEditScope = "https://www.googleapis.com/auth/analytics.edit";
 export const googleAnalyticsReadScopes = [googleAnalyticsReadonlyScope];
 export const googleAnalyticsWriteScopes = [googleAnalyticsEditScope];
-export const googleAnalyticsOAuthScopes = [googleAnalyticsReadonlyScope, googleAnalyticsEditScope];
+export const googleAnalyticsOAuthScopes = [
+    googleAnalyticsReadonlyScope,
+    googleAnalyticsEditScope,
+    ...googleIdentityScopes,
+];

package/src/providers/google_bigquery/executors.js

@@ -1,6 +1,6 @@
 import { booleanString, compactObject, optionalBoolean, optionalInteger as asOptionalInteger, requiredRecord, } from "../../core/cast.js";
-import { defineGoogleProviderExecutors, googleBearerProxyAuth, googleServiceAccountValidator } from "../google-auth.js";
-import { googleJsonRequest, googleRequest } from "../google-runtime.js";
+import { defineGoogleProviderExecutors, googleBearerProxyAuth, googleServiceAccountValidator, } from "../googledrive/runtime-auth.js";
+import { googleJsonRequest, googleRequest } from "../googledrive/runtime-request.js";
 import { defineProviderProxy, ProviderRequestError } from "../provider-runtime.js";
 import { googleBigQueryOAuthScopes } from "./scopes.js";
 const bigQueryApiBaseUrl = "https://bigquery.googleapis.com/bigquery/v2";

package/src/providers/google_bigquery/scopes.js

@@ -1,3 +1,4 @@
+import { googleIdentityScopes } from "../googleads/scopes.js";
 export const bigQueryScope = "https://www.googleapis.com/auth/bigquery";
 export const bigQueryReadOnlyScope = "https://www.googleapis.com/auth/bigquery.readonly";
 export const bigQueryInsertDataScope = "https://www.googleapis.com/auth/bigquery.insertdata";
@@ -14,4 +15,5 @@ export const googleBigQueryOAuthScopes = [
     bigQueryInsertDataScope,
     devStorageReadOnlyScope,
     devStorageReadWriteScope,
+    ...googleIdentityScopes,
 ];

package/src/providers/google_search_console/executors.js

@@ -1,6 +1,6 @@
 import { compactObject, optionalNumber, optionalRecord as asOptionalObject, optionalString as asOptionalString, pickOptionalInteger, pickOptionalString as pickNonEmptyString, } from "../../core/cast.js";
-import { defineGoogleProviderExecutors, googleBearerProxyAuth, googleServiceAccountValidator } from "../google-auth.js";
-import { googleJsonRequest, googleRequest } from "../google-runtime.js";
+import { defineGoogleProviderExecutors, googleBearerProxyAuth, googleServiceAccountValidator, } from "../googledrive/runtime-auth.js";
+import { googleJsonRequest, googleRequest } from "../googledrive/runtime-request.js";
 import { defineProviderProxy, ProviderRequestError } from "../provider-runtime.js";
 import { googleSearchConsoleOAuthScopes } from "./scopes.js";
 const service = "google_search_console";

package/src/providers/google_search_console/scopes.js

@@ -1,3 +1,4 @@
+import { googleIdentityScopes } from "../googleads/scopes.js";
 export const googleSearchConsoleReadonlyScope = "https://www.googleapis.com/auth/webmasters.readonly";
 export const googleSearchConsoleFullScope = "https://www.googleapis.com/auth/webmasters";
 export const googleSearchConsoleReadScopes = [googleSearchConsoleReadonlyScope];
@@ -5,4 +6,5 @@ export const googleSearchConsoleWriteScopes = [googleSearchConsoleFullScope];
 export const googleSearchConsoleOAuthScopes = [
     googleSearchConsoleReadonlyScope,
     googleSearchConsoleFullScope,
+    ...googleIdentityScopes,
 ];

package/src/providers/googleads/executors.js

@@ -1,6 +1,6 @@
 import { createHash } from "node:crypto";
 import { compactObject, objectArray, optionalBoolean, optionalRecord, optionalScalarString, optionalString, } from "../../core/cast.js";
-import { googleJsonRequest, googleRequest } from "../google-runtime.js";
+import { googleJsonRequest, googleRequest } from "../googledrive/runtime-request.js";
 import { defineProviderExecutors, defineProviderProxy, ProviderRequestError, requireOAuthCredential, requiredInputString, } from "../provider-runtime.js";
 import { googleAdsScope } from "./scopes.js";
 export const googleAdsApiBaseUrl = "https://googleads.googleapis.com/v22";

package/src/providers/googleads/scopes.d.ts

@@ -1,5 +1,3 @@
 export declare const googleAdsScope = "https://www.googleapis.com/auth/adwords";
-export declare const googleOpenIdScope = "openid";
-export declare const googleEmailScope = "email";
-export declare const googleProfileScope = "profile";
+export declare const googleIdentityScopes: string[];
 export declare const googleAdsOAuthScopes: string[];

package/src/providers/googleads/scopes.js

@@ -1,5 +1,3 @@
 export const googleAdsScope = "https://www.googleapis.com/auth/adwords";
-export const googleOpenIdScope = "openid";
-export const googleEmailScope = "email";
-export const googleProfileScope = "profile";
-export const googleAdsOAuthScopes = [googleAdsScope, googleOpenIdScope, googleEmailScope, googleProfileScope];
+export const googleIdentityScopes = ["openid", "email", "profile"];
+export const googleAdsOAuthScopes = [googleAdsScope, ...googleIdentityScopes];

package/src/providers/googlecalendar/executors.js

@@ -1,5 +1,5 @@
 import { compactObject, optionalString, pickOptionalBoolean, pickOptionalInteger, pickOptionalString, requiredRecord, } from "../../core/cast.js";
-import { defineGoogleProviderExecutors, googleBearerProxyAuth, googleServiceAccountValidator } from "../google-auth.js";
+import { defineGoogleProviderExecutors, googleBearerProxyAuth, googleServiceAccountValidator, } from "../googledrive/runtime-auth.js";
 import { combineProviderActionHandlers, defineProviderProxy, ProviderRequestError } from "../provider-runtime.js";
 import { googlecalendarEventActionHandlers } from "./runtime-events.js";
 import { googlecalendarApiBaseUrl, googlecalendarJsonRequest, googlecalendarRequest, resolveCalendarId, resolveRuleId, resolveSettingId, } from "./runtime-shared.js";

package/src/providers/googlecalendar/runtime-shared.js

@@ -1,5 +1,5 @@
 import { optionalRecord, optionalString as asOptionalString, pickOptionalString } from "../../core/cast.js";
-import { providerUserAgent, ProviderRequestError } from "../provider-runtime.js";
+import { providerUserAgent, ProviderRequestError, withRetryAfterSeconds } from "../provider-runtime.js";
 export const googlecalendarApiBaseUrl = "https://www.googleapis.com/calendar/v3";
 const service = "googlecalendar";
 const googleDefaultRequestTimeoutMs = 30_000;
@@ -142,7 +142,7 @@ async function assertGoogleResponse(response) {
         return;
     }
     const { message, details } = await extractGoogleError(response);
-    throw new ProviderRequestError(response.status, message, details);
+    throw new ProviderRequestError(response.status, message, withRetryAfterSeconds(response, details));
 }
 async function extractGoogleError(response) {
     const rawText = await response.text().catch(() => "");

package/src/providers/googlecalendar/scopes.js

@@ -1,3 +1,4 @@
+import { googleIdentityScopes } from "../googleads/scopes.js";
 export const googleCalendarReadonlyScope = "https://www.googleapis.com/auth/calendar.readonly";
 export const googleCalendarEventsScope = "https://www.googleapis.com/auth/calendar.events";
 export const googleCalendarCalendarsScope = "https://www.googleapis.com/auth/calendar.calendars";
@@ -22,4 +23,5 @@ export const googlecalendarOAuthScopes = [
     googleCalendarSettingsReadonlyScope,
     googleCalendarAclsScope,
     googleCalendarAclsReadonlyScope,
+    ...googleIdentityScopes,
 ];

package/src/providers/googlechat/executors.d.ts

@@ -1,8 +1,6 @@
 import type { CredentialValidators, ProviderExecutors, ProviderProxyExecutor } from "../../core/types.ts";
 import type { ProviderActionHandlers } from "../provider-runtime.ts";
-import type { OAuthProviderContext } from "../provider-runtime.ts";
-export declare const googleChatApiBaseUrl = "https://chat.googleapis.com/v1";
-type GoogleChatRuntimeContext = OAuthProviderContext;
+import type { GoogleChatRuntimeContext } from "./runtime.ts";
 type GoogleChatActionHandler = (input: Record<string, unknown>, context: GoogleChatRuntimeContext) => Promise<unknown>;
 export declare const googleChatActionHandlers: ProviderActionHandlers<"googlechat", GoogleChatActionHandler>;
 export declare const executors: ProviderExecutors;