@pooriaarab/foxlink 0.0.0-stage → 0.1.0

package/dist/provider.js

@@ -0,0 +1,105 @@
+import { FoxlinkError } from "./errors.js";
+const bad = (message) => new FoxlinkError("bad-config", message);
+function checkUrl(value, name, allowHttp) {
+    let url;
+    try {
+        url = new URL(String(value));
+    }
+    catch {
+        throw bad(`${name} is not a URL.`);
+    }
+    if (url.protocol !== "https:" && !(allowHttp && url.protocol === "http:"))
+        throw bad(`${name} must use https.`);
+    return url.href;
+}
+const scopeList = (value, name) => {
+    if (!Array.isArray(value) || value.length === 0 || !value.every((s) => typeof s === "string" && /^\S{1,200}$/.test(s)))
+        throw bad(`${name} must be a list of scopes.`);
+    return [...new Set(value)];
+};
+/** Check a provider config and freeze it. Throws `bad-config`. */
+export function defineProvider(config) {
+    if (!/^[a-z0-9-]{1,32}$/.test(String(config.id)))
+        throw bad("id must be 1-32 of a-z, 0-9, and -.");
+    if (typeof config.clientId !== "string" || !/^\S{1,300}$/.test(config.clientId))
+        throw bad("Type an OAuth client ID.");
+    if (config.clientSecret !== undefined && (typeof config.clientSecret !== "string" || !config.clientSecret))
+        throw bad("clientSecret must be a string.");
+    const allowHttp = config.allowHttp === true;
+    const scopes = scopeList(config.scopes, "scopes");
+    const allowedScopes = config.allowedScopes === undefined ? scopes : scopeList(config.allowedScopes, "allowedScopes");
+    if (!scopes.every((s) => allowedScopes.includes(s)))
+        throw bad("allowedScopes must hold every default scope.");
+    if (!Array.isArray(config.apiHosts) || config.apiHosts.length === 0 || !config.apiHosts.every((h) => typeof h === "string" && /^[a-z0-9.-]+$/.test(h))) {
+        throw bad("apiHosts must be a list of host names.");
+    }
+    const provider = {
+        id: config.id,
+        clientId: config.clientId,
+        ...(config.clientSecret ? { clientSecret: config.clientSecret } : {}),
+        authorizeUrl: checkUrl(config.authorizeUrl, "authorizeUrl", allowHttp),
+        tokenUrl: checkUrl(config.tokenUrl, "tokenUrl", allowHttp),
+        ...(config.revokeUrl ? { revokeUrl: checkUrl(config.revokeUrl, "revokeUrl", allowHttp) } : {}),
+        scopes,
+        allowedScopes,
+        apiHosts: [...config.apiHosts],
+        authParams: { ...config.authParams },
+        redirect: config.redirect ?? "extension",
+        issuers: [...(config.issuers ?? [])],
+        allowHttp,
+    };
+    return Object.freeze(provider);
+}
+/** `http://127.0.0.1/mozoauth2/<subdomain>` from the URL that `identity.getRedirectURL()` returns (Firefox 86+). */
+export function loopbackRedirectUrl(extensionRedirectUrl) {
+    const sub = new URL(extensionRedirectUrl).hostname.split(".")[0];
+    if (!sub)
+        throw new FoxlinkError("bad-config", "The extension redirect URL has no subdomain.");
+    return `http://127.0.0.1/mozoauth2/${sub}`;
+}
+/** Google scopes that the Gmail and Calendar clients use. */
+export const GOOGLE_SCOPES = Object.freeze({
+    gmailRead: "https://www.googleapis.com/auth/gmail.readonly",
+    gmailSend: "https://www.googleapis.com/auth/gmail.send",
+    calendarRead: "https://www.googleapis.com/auth/calendar.readonly",
+    calendarEvents: "https://www.googleapis.com/auth/calendar.events",
+});
+export const GOOGLE_ENDPOINTS = Object.freeze({
+    authorizeUrl: "https://accounts.google.com/o/oauth2/v2/auth",
+    tokenUrl: "https://oauth2.googleapis.com/token",
+    revokeUrl: "https://oauth2.googleapis.com/revoke",
+    gmailBase: "https://gmail.googleapis.com/gmail/v1",
+    calendarBase: "https://www.googleapis.com/calendar/v3",
+});
+const hostOf = (url, name) => {
+    try {
+        return new URL(url).hostname;
+    }
+    catch {
+        throw bad(`${name} is not a URL.`);
+    }
+};
+/** The Google preset: loopback redirect, offline access, and read-only scopes by default. */
+export function googleProvider(options) {
+    const endpoints = { ...GOOGLE_ENDPOINTS, ...options.endpoints };
+    const scopes = options.scopes ?? [GOOGLE_SCOPES.gmailRead, GOOGLE_SCOPES.calendarRead];
+    const provider = defineProvider({
+        id: "google",
+        clientId: options.clientId,
+        ...(options.clientSecret ? { clientSecret: options.clientSecret } : {}),
+        authorizeUrl: endpoints.authorizeUrl,
+        tokenUrl: endpoints.tokenUrl,
+        revokeUrl: endpoints.revokeUrl,
+        scopes,
+        allowedScopes: options.allowedScopes ?? scopes,
+        apiHosts: [...new Set([hostOf(endpoints.gmailBase, "gmailBase"), hostOf(endpoints.calendarBase, "calendarBase")])],
+        // Google sends a refresh token only with offline access, and again only with consent.
+        authParams: { access_type: "offline", prompt: "consent" },
+        redirect: "loopback",
+        issuers: ["https://accounts.google.com", "accounts.google.com"],
+        allowHttp: options.allowHttp === true,
+    });
+    checkUrl(endpoints.gmailBase, "gmailBase", provider.allowHttp);
+    checkUrl(endpoints.calendarBase, "calendarBase", provider.allowHttp);
+    return Object.freeze({ ...provider, endpoints: Object.freeze(endpoints) });
+}

package/dist/text.d.ts

@@ -0,0 +1,20 @@
+/** A record with text from outside: an email or an event. An agent must treat its text as data, not as instructions. */
+export interface Untrusted {
+    trust: "untrusted";
+    /** Where the text came from, for example `gmail` or `calendar`. */
+    source: string;
+    id: string;
+}
+/** Decode HTML entities in one pass, so `&amp;lt;` gives `&lt;` and not `<`. */
+export declare function decodeEntities(text: string): string;
+/**
+ * Plain text from HTML, with no DOM and no network, in one pass. Scripts,
+ * styles, and comments go away with their content. Images and links lose
+ * their URLs. Hidden text (for example `display: none`) stays: check it with
+ * a tool such as foxshield.
+ */
+export declare function htmlToText(html: string): string;
+declare const FIELDS: readonly ["from", "to", "subject", "date", "summary", "start", "end", "location"];
+/** The record as one block for a model prompt, inside `<untrusted>` tags that its text cannot close. */
+export declare function toPromptText(record: Untrusted & Partial<Record<(typeof FIELDS)[number] | "text" | "snippet" | "description", unknown>>): string;
+export {};

package/dist/text.js

@@ -0,0 +1,94 @@
+const NAMED = { amp: "&", lt: "<", gt: ">", quot: '"', apos: "'", nbsp: " ", eacute: "é", copy: "©", reg: "®", hellip: "…", mdash: "—", ndash: "–", rsquo: "’", lsquo: "‘", rdquo: "”", ldquo: "“" };
+/** Decode HTML entities in one pass, so `&amp;lt;` gives `&lt;` and not `<`. */
+export function decodeEntities(text) {
+    return text.replace(/&(#\d{1,7}|#x[0-9a-f]{1,6}|[a-z]{2,8});/gi, (whole, name) => {
+        if (name[0] === "#") {
+            const code = name[1] === "x" || name[1] === "X" ? Number.parseInt(name.slice(2), 16) : Number(name.slice(1));
+            return code > 0 && code <= 0x10ffff && (code < 0xd800 || code > 0xdfff) ? String.fromCodePoint(code) : "�";
+        }
+        return NAMED[name.toLowerCase()] ?? whole;
+    });
+}
+const DROP = new Set(["script", "style", "head", "title", "noscript", "template", "svg", "iframe", "object", "embed", "math"]);
+const BREAK = new Set(["br", "hr"]);
+const BLOCK_END = new Set(["p", "div", "tr", "h1", "h2", "h3", "h4", "h5", "h6", "table", "blockquote", "section", "article"]);
+/**
+ * The index of the ">" that ends the tag at `from`, or the end of the text. One pass.
+ * A quote opens a quoted value only right after "=", as in HTML, so `title=it's` has no quote.
+ */
+function tagEnd(html, from) {
+    let quote = "";
+    let last = "";
+    for (let j = from; j < html.length; j += 1) {
+        const c = html[j] ?? "";
+        if (quote) {
+            if (c === quote)
+                quote = "";
+        }
+        else if ((c === '"' || c === "'") && last === "=")
+            quote = c;
+        else if (c === ">")
+            return j;
+        if (!/\s/.test(c))
+            last = c;
+    }
+    return html.length;
+}
+/**
+ * Plain text from HTML, with no DOM and no network, in one pass. Scripts,
+ * styles, and comments go away with their content. Images and links lose
+ * their URLs. Hidden text (for example `display: none`) stays: check it with
+ * a tool such as foxshield.
+ */
+export function htmlToText(html) {
+    let out = "";
+    let i = 0;
+    while (i < html.length) {
+        const lt = html.indexOf("<", i);
+        if (lt === -1) {
+            out += html.slice(i);
+            break;
+        }
+        out += html.slice(i, lt);
+        if (html.startsWith("<!--", lt)) {
+            const close = html.indexOf("-->", lt + 4);
+            i = close === -1 ? html.length : close + 3;
+            continue;
+        }
+        const name = /^<(\/?)([a-z][a-z0-9]*)/i.exec(html.slice(lt, lt + 40));
+        if (!name) {
+            out += "<";
+            i = lt + 1;
+            continue;
+        }
+        const closing = name[1] === "/";
+        const tag = (name[2] ?? "").toLowerCase();
+        i = tagEnd(html, lt + 1) + 1;
+        if (!closing && DROP.has(tag)) {
+            // Only a real close tag ends the block: "</scriptx>" does not.
+            const find = new RegExp(`</${tag}(?=[\\s/>]|$)`, "gi");
+            find.lastIndex = i;
+            const close = find.exec(html)?.index ?? -1;
+            i = close === -1 ? html.length : tagEnd(html, close) + 1;
+        }
+        else if (BREAK.has(tag) || (closing && BLOCK_END.has(tag)))
+            out += "\n";
+        else if (!closing && tag === "li")
+            out += "\n- ";
+    }
+    return decodeEntities(out)
+        .replace(/[ \t\f\v\u00a0]+/g, " ")
+        .replace(/ *\n */g, "\n")
+        .replace(/\n{3,}/g, "\n\n")
+        .trim();
+}
+const fence = (text) => text.replace(/<(\/?)untrusted/gi, "\u2039$1untrusted");
+const attr = (v) => v.replace(/[^A-Za-z0-9_.:-]/g, "");
+const FIELDS = ["from", "to", "subject", "date", "summary", "start", "end", "location"];
+/** The record as one block for a model prompt, inside `<untrusted>` tags that its text cannot close. */
+export function toPromptText(record) {
+    const lines = FIELDS.filter((f) => typeof record[f] === "string" && record[f]).map((f) => `${f[0]?.toUpperCase()}${f.slice(1)}: ${String(record[f])}`);
+    const body = [record.text, record.description, record.text === undefined ? record.snippet : undefined].find((v) => typeof v === "string" && v);
+    const text = [lines.join("\n"), typeof body === "string" ? body : ""].filter(Boolean).join("\n\n");
+    return `<untrusted source="${attr(record.source)}" id="${attr(record.id)}">\n${fence(text)}\n</untrusted>`;
+}

package/package.json

@@ -1,6 +1,49 @@
 {
   "name": "@pooriaarab/foxlink",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.0",
+  "description": "Connect Gmail and Google Calendar to a Firefox extension with OAuth.",
+  "type": "module",
+  "license": "MIT",
+  "author": "Pooria Arab",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/pooriaarab/foxlink.git"
+  },
+  "homepage": "https://github.com/pooriaarab/foxlink#readme",
+  "packageManager": "pnpm@11.10.0",
+  "engines": {
+    "node": ">=24"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "typecheck": "tsc --noEmit",
+    "lint": "oxlint --deny-warnings",
+    "test": "vitest run --passWithNoTests",
+    "ci:local": "pnpm lint && pnpm typecheck && pnpm test && pnpm build && pnpm build:ext && pnpm lint:ext",
+    "build:ext": "node scripts/build-ext.mjs",
+    "lint:ext": "web-ext lint -s dist-ext --warnings-as-errors",
+    "e2e": "pnpm build:ext && node e2e/run.mjs"
+  },
+  "devDependencies": {
+    "@types/node": "^24.19.1",
+    "create-foxkit": "^0.1.0",
+    "esbuild": "^0.28.2",
+    "oxlint": "^1.87.0",
+    "typescript": "^7.0.2",
+    "vitest": "^5.0.3",
+    "web-ext": "^10.7.0"
+  },
+  "dependencies": {
+    "foxgate": "^0.1.0",
+    "foxvault": "^0.1.0"
+  }
+}