@rubytech/create-maxy-code 0.1.469 → 0.1.471

package/payload/platform/plugins/google/mcp/dist/index.js

@@ -0,0 +1,300 @@
+#!/usr/bin/env node
+/**
+ * @maxy/google MCP server.
+ *
+ * Live Google Calendar for one account: read plus create, update, cancel,
+ * respond and free/busy. Admin agent only; no public surface.
+ *
+ * Auth: per-account OAuth authorization-code + PKCE. The consent URL is minted
+ *   here; the exchange happens in platform/ui, which holds the house-only
+ *   client secret. Tokens persist encrypted to
+ *   {ACCOUNTS_DIR}/{accountId}/secrets/google/accounts/{email}/tokens.enc
+ *
+ * There is deliberately no Gmail surface — mail runs on the `email` plugin's
+ * IMAP/SMTP path, and Gmail's restricted scopes would force Google's annual
+ * security assessment. Calendar is a sensitive scope only.
+ *
+ * Required environment:
+ *   ACCOUNT_ID          — provided by getMcpServers when spawned per account.
+ *   PLATFORM_ROOT       — repo root; used to derive ACCOUNTS_DIR.
+ *   GOOGLE_CLIENT_ID    — brand.json#googleClientId. Operator-set per brand.
+ *   GOOGLE_PUBLIC_BASE  — https origin of this install's public host.
+ *   MAXY_UI_INTERNAL_PORT — loopback port of platform/ui (holds the secret).
+ */
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { resolve, join } from "node:path";
+import { existsSync } from "node:fs";
+import { z } from "zod";
+import { TokenStore } from "./auth/token-store.js";
+import { log } from "./lib/log.js";
+import { runAccountRegisterStart, runAccountRegisterPoll, listConnected, } from "./tools/account-register.js";
+import { runCalendarList } from "./tools/calendar-list.js";
+import { runCalendarEvent } from "./tools/calendar-event.js";
+import { runCalendarCreate } from "./tools/calendar-create.js";
+import { runCalendarUpdate } from "./tools/calendar-update.js";
+import { runCalendarCancel } from "./tools/calendar-cancel.js";
+import { runCalendarRespond } from "./tools/calendar-respond.js";
+import { runCalendarFreebusy } from "./tools/calendar-freebusy.js";
+import { runAccountInfo } from "./tools/account-info.js";
+import { runAccountList } from "./tools/account-list.js";
+import { lifelineTool } from "../../../../lib/mcp-lifeline/dist/index.js";
+// Plugin-system boot tolerance — see Task 202. Module init must never exit;
+// the plugin-system spawn enumerates tools/list before any per-account env is
+// set. Per-call refusal preserves isolation without emptying the registry.
+const ACCOUNT_ID = process.env.ACCOUNT_ID ?? null;
+const PLATFORM_ROOT = process.env.PLATFORM_ROOT ?? process.cwd();
+const ACCOUNTS_DIR = resolve(PLATFORM_ROOT, "..", "data/accounts");
+const GOOGLE_CLIENT_ID = process.env.GOOGLE_CLIENT_ID ?? "";
+const GOOGLE_PUBLIC_BASE = process.env.GOOGLE_PUBLIC_BASE ?? "";
+// The loopback UI port is per-brand and already on the spawn env. A guessed
+// default would be a brand-isolation hazard on a co-resident host: brand A
+// would POST its refresh to brand B's server, which would service it with
+// brand B's house client secret. Unset is refused per call, never defaulted.
+const UI_INTERNAL_PORT = process.env.MAXY_UI_INTERNAL_PORT ?? "";
+// Presence is checked before register; the contents are never read here.
+const HOUSE_ENV_PATH = join(PLATFORM_ROOT, "config", "google-house.env");
+// Standing per-boot reconciliation of expected (brand.json googleClientId,
+// stamped onto the session-manager env) vs actual. clientIdConfigured=false on
+// a brand that ships a value is the mis-stamp signature.
+process.stderr.write(`[google-mcp] boot accountId=${ACCOUNT_ID ?? "null"} clientIdConfigured=${GOOGLE_CLIENT_ID ? "true" : "false"} publicBaseConfigured=${GOOGLE_PUBLIC_BASE ? "true" : "false"} uiPortConfigured=${UI_INTERNAL_PORT ? "true" : "false"} houseSecretPresent=${existsSync(HOUSE_ENV_PATH) ? "true" : "false"}\n`);
+function refuseNoAccount(toolName) {
+    process.stderr.write(`[google-mcp] tool=${toolName} refuse reason=no-account-context\n`);
+    return {
+        content: [
+            {
+                type: "text",
+                text: `${toolName} cannot execute: this MCP instance was launched without ACCOUNT_ID (plugin-system metadata-only mode). Per-account access requires ACCOUNT_ID at spawn.`,
+            },
+        ],
+        isError: true,
+    };
+}
+function ok(payload) {
+    return {
+        content: [
+            {
+                type: "text",
+                text: typeof payload === "string" ? payload : JSON.stringify(payload, null, 2),
+            },
+        ],
+    };
+}
+function fail(message) {
+    return { content: [{ type: "text", text: message }], isError: true };
+}
+/** Optional account selector. One Maxy account can hold several Google
+ *  accounts; omit when there is one, name it when there are more. */
+const accountArg = z
+    .string()
+    .optional()
+    .describe("Target Google account (its email address). Omit when a single Google account is connected. With two or more, omitting it returns a refusal listing them; call google-account-list to see them.");
+/**
+ * Resolve a config for the named or sole connected Google account. Resolution
+ * order: explicit `account` -> the sole connected account -> a typed refusal
+ * naming the candidates. Every resolution logs one cred-resolve line, so a
+ * wrong or absent selector is diagnosable from that line alone.
+ */
+function getConfig(account) {
+    if (!ACCOUNT_ID)
+        throw new Error("getConfig() called without ACCOUNT_ID — handler guard missing");
+    if (!GOOGLE_CLIENT_ID) {
+        throw new Error("GOOGLE_CLIENT_ID is not configured for this brand; google tools are inert until a vendor app exists.");
+    }
+    const connected = listConnected(ACCOUNT_ID, ACCOUNTS_DIR);
+    let key;
+    if (account) {
+        key = account;
+    }
+    else if (connected.length === 1) {
+        key = connected[0].email;
+    }
+    else if (connected.length === 0) {
+        throw new Error("no Google account connected for this account; run google-account-register");
+    }
+    else {
+        throw new Error(`two or more Google accounts are connected (${connected.map((c) => c.email).join(", ")}); name one with the account argument`);
+    }
+    log({
+        tag: "[google-mcp]",
+        op: "cred-resolve",
+        account: ACCOUNT_ID,
+        target: key,
+        source: account ? "arg" : "sole",
+    });
+    if (!UI_INTERNAL_PORT) {
+        throw new Error("MAXY_UI_INTERNAL_PORT is not set; the token-refresh endpoint cannot be addressed without it. Refusing rather than guessing a port, which on a co-resident host would reach another brand's server.");
+    }
+    return {
+        accountId: ACCOUNT_ID,
+        clientId: GOOGLE_CLIENT_ID,
+        store: new TokenStore(ACCOUNT_ID, ACCOUNTS_DIR, key),
+        refreshEndpoint: `http://127.0.0.1:${UI_INTERNAL_PORT}/api/google/oauth/refresh`,
+    };
+}
+const server = new McpServer({ name: "google", version: "0.1.0" });
+lifelineTool(server, "google-account-register", "Start connecting a Google Calendar for this account. Returns a consent URL immediately — relay it to the user, who opens it on any device, signs in and approves. Then call google-account-register-poll to confirm. Does NOT block. Refuses while another registration is already live.", {}, async () => {
+    if (!ACCOUNT_ID)
+        return refuseNoAccount("google-account-register");
+    try {
+        if (!GOOGLE_CLIENT_ID) {
+            return fail("GOOGLE_CLIENT_ID is not configured for this brand; google tools are inert until a vendor app exists.");
+        }
+        if (!GOOGLE_PUBLIC_BASE) {
+            return fail("GOOGLE_PUBLIC_BASE is not configured; the consent redirect cannot be built without this install's public host.");
+        }
+        // Pre-flight the house secret by PRESENCE ONLY — never read, the secret
+        // must not enter this process. Without this the operator discovers the
+        // gap only at the callback, i.e. after they have already consented, and
+        // the failure looks like a broken flow rather than a missing file.
+        if (!existsSync(HOUSE_ENV_PATH)) {
+            return fail(`The Google client secret is not installed on this device. Create ${HOUSE_ENV_PATH} (mode 600) containing GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET from the brand's Google Cloud OAuth client, then try again. Without it the consent flow completes and then fails at the final step.`);
+        }
+        const res = await runAccountRegisterStart({
+            accountId: ACCOUNT_ID,
+            accountsDir: ACCOUNTS_DIR,
+            clientId: GOOGLE_CLIENT_ID,
+            publicBase: GOOGLE_PUBLIC_BASE,
+        });
+        return ok(res);
+    }
+    catch (err) {
+        return fail(`google-account-register failed: ${err.message}`);
+    }
+});
+lifelineTool(server, "google-account-register-poll", "Report the state of a Google Calendar registration for this account: registered, pending, expired, or none. Reads local stores only — no network call.", {}, async () => {
+    if (!ACCOUNT_ID)
+        return refuseNoAccount("google-account-register-poll");
+    try {
+        return ok(await runAccountRegisterPoll({ accountId: ACCOUNT_ID, accountsDir: ACCOUNTS_DIR }));
+    }
+    catch (err) {
+        return fail(`google-account-register-poll failed: ${err.message}`);
+    }
+});
+lifelineTool(server, "google-calendar-list", "List calendar events in the next rangeDays days (default 7, max 365). Returns id, summary, start, end, location, attendees, allDay, organizer, htmlLink. Recurring series are expanded into instances.", {
+    rangeDays: z.number().int().min(1).max(365).optional(),
+    maxResults: z.number().int().min(1).max(250).optional(),
+    account: accountArg,
+}, async ({ rangeDays, maxResults, account }) => {
+    if (!ACCOUNT_ID)
+        return refuseNoAccount("google-calendar-list");
+    try {
+        return ok(await runCalendarList(getConfig(account), { rangeDays, maxResults }));
+    }
+    catch (err) {
+        return fail(`google-calendar-list failed: ${err.message}`);
+    }
+});
+lifelineTool(server, "google-calendar-event", "Fetch a single calendar event by id.", { eventId: z.string().min(1), account: accountArg }, async ({ eventId, account }) => {
+    if (!ACCOUNT_ID)
+        return refuseNoAccount("google-calendar-event");
+    try {
+        return ok(await runCalendarEvent(getConfig(account), { eventId }));
+    }
+    catch (err) {
+        return fail(`google-calendar-event failed: ${err.message}`);
+    }
+});
+lifelineTool(server, "google-calendar-create", "Create a calendar event. Times are RFC3339 (2026-07-20T09:00:00Z) unless allDay is true, in which case they are dates (2026-07-20). Attendees are notified.", {
+    summary: z.string().min(1),
+    start: z.string().min(1),
+    end: z.string().min(1),
+    location: z.string().optional(),
+    description: z.string().optional(),
+    attendees: z.array(z.string()).optional(),
+    allDay: z.boolean().optional(),
+    account: accountArg,
+}, async ({ account, ...args }) => {
+    if (!ACCOUNT_ID)
+        return refuseNoAccount("google-calendar-create");
+    try {
+        return ok(await runCalendarCreate(getConfig(account), args));
+    }
+    catch (err) {
+        return fail(`google-calendar-create failed: ${err.message}`);
+    }
+});
+lifelineTool(server, "google-calendar-update", "Update an existing calendar event. Only the fields you name are changed; omitted fields are left as they are. Attendees are notified.", {
+    eventId: z.string().min(1),
+    summary: z.string().optional(),
+    start: z.string().optional(),
+    end: z.string().optional(),
+    location: z.string().optional(),
+    description: z.string().optional(),
+    attendees: z.array(z.string()).optional(),
+    allDay: z.boolean().optional(),
+    account: accountArg,
+}, async ({ account, ...args }) => {
+    if (!ACCOUNT_ID)
+        return refuseNoAccount("google-calendar-update");
+    try {
+        return ok(await runCalendarUpdate(getConfig(account), args));
+    }
+    catch (err) {
+        return fail(`google-calendar-update failed: ${err.message}`);
+    }
+});
+lifelineTool(server, "google-calendar-cancel", "Cancel (delete) a calendar event by id. Attendees are notified.", { eventId: z.string().min(1), account: accountArg }, async ({ eventId, account }) => {
+    if (!ACCOUNT_ID)
+        return refuseNoAccount("google-calendar-cancel");
+    try {
+        return ok(await runCalendarCancel(getConfig(account), { eventId }));
+    }
+    catch (err) {
+        return fail(`google-calendar-cancel failed: ${err.message}`);
+    }
+});
+lifelineTool(server, "google-calendar-respond", "Respond to an invitation on behalf of the connected account: accepted, declined or tentative. Every other attendee's response is left untouched.", {
+    eventId: z.string().min(1),
+    response: z.enum(["accepted", "declined", "tentative"]),
+    account: accountArg,
+}, async ({ eventId, response, account }) => {
+    if (!ACCOUNT_ID)
+        return refuseNoAccount("google-calendar-respond");
+    try {
+        return ok(await runCalendarRespond(getConfig(account), { eventId, response }));
+    }
+    catch (err) {
+        return fail(`google-calendar-respond failed: ${err.message}`);
+    }
+});
+lifelineTool(server, "google-calendar-freebusy", "Busy blocks between start and end (RFC3339) for the account's own calendar, or for the calendar ids you name. Free time is the complement.", {
+    start: z.string().min(1),
+    end: z.string().min(1),
+    calendars: z.array(z.string()).optional(),
+    account: accountArg,
+}, async ({ start, end, calendars, account }) => {
+    if (!ACCOUNT_ID)
+        return refuseNoAccount("google-calendar-freebusy");
+    try {
+        return ok(await runCalendarFreebusy(getConfig(account), { start, end, calendars }));
+    }
+    catch (err) {
+        return fail(`google-calendar-freebusy failed: ${err.message}`);
+    }
+});
+lifelineTool(server, "google-account-info", "Auth state for one connected Google account: connected, whether its access token is near expiry, and the granted scopes. Local stores only.", { email: z.string().min(1) }, async ({ email }) => {
+    if (!ACCOUNT_ID)
+        return refuseNoAccount("google-account-info");
+    try {
+        return ok(runAccountInfo({ accountId: ACCOUNT_ID, accountsDir: ACCOUNTS_DIR, email }));
+    }
+    catch (err) {
+        return fail(`google-account-info failed: ${err.message}`);
+    }
+});
+lifelineTool(server, "google-account-list", "Every Google account connected to this account, each with its own status. Local stores only, no network. A count alone is not 'connected' — check each status.", {}, async () => {
+    if (!ACCOUNT_ID)
+        return refuseNoAccount("google-account-list");
+    try {
+        return ok(runAccountList({ accountId: ACCOUNT_ID, accountsDir: ACCOUNTS_DIR }));
+    }
+    catch (err) {
+        return fail(`google-account-list failed: ${err.message}`);
+    }
+});
+const transport = new StdioServerTransport();
+await server.connect(transport);
+process.stderr.write(`[google-mcp] ready account=${ACCOUNT_ID ?? "null"}\n`);
+//# sourceMappingURL=index.js.map

package/payload/platform/plugins/google/mcp/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAEnD,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAEnC,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACtB,aAAa,GACd,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,4CAA4C,CAAC;AAE1E,4EAA4E;AAC5E,8EAA8E;AAC9E,2EAA2E;AAC3E,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC;AAClD,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;AACjE,MAAM,YAAY,GAAG,OAAO,CAAC,aAAa,EAAE,IAAI,EAAE,eAAe,CAAC,CAAC;AACnE,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,EAAE,CAAC;AAC5D,MAAM,kBAAkB,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,EAAE,CAAC;AAChE,4EAA4E;AAC5E,2EAA2E;AAC3E,0EAA0E;AAC1E,6EAA6E;AAC7E,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,EAAE,CAAC;AACjE,yEAAyE;AACzE,MAAM,cAAc,GAAG,IAAI,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,CAAC;AAEzE,2EAA2E;AAC3E,+EAA+E;AAC/E,yDAAyD;AACzD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,+BAA+B,UAAU,IAAI,MAAM,uBAAuB,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,yBAAyB,kBAAkB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,qBAAqB,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,uBAAuB,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,IAAI,CAC5S,CAAC;AAEF,SAAS,eAAe,CAAC,QAAgB;IACvC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,QAAQ,qCAAqC,CAAC,CAAC;IACzF,OAAO;QACL,OAAO,EAAE;YACP;gBACE,IAAI,EAAE,MAAe;gBACrB,IAAI,EAAE,GAAG,QAAQ,yJAAyJ;aAC3K;SACF;QACD,OAAO,EAAE,IAAI;KACd,CAAC;AACJ,CAAC;AAED,SAAS,EAAE,CAAC,OAAgB;IAC1B,OAAO;QACL,OAAO,EAAE;YACP;gBACE,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;aAC/E;SACF;KACF,CAAC;AACJ,CAAC;AAED,SAAS,IAAI,CAAC,OAAe;IAI3B,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AACvE,CAAC;AAED;qEACqE;AACrE,MAAM,UAAU,GAAG,CAAC;KACjB,MAAM,EAAE;KACR,QAAQ,EAAE;KACV,QAAQ,CACP,gMAAgM,CACjM,CAAC;AAEJ;;;;;GAKG;AACH,SAAS,SAAS,CAAC,OAAgB;IACjC,IAAI,CAAC,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IAClG,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,sGAAsG,CACvG,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,aAAa,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAC1D,IAAI,GAAW,CAAC;IAChB,IAAI,OAAO,EAAE,CAAC;QACZ,GAAG,GAAG,OAAO,CAAC;IAChB,CAAC;SAAM,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClC,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC3B,CAAC;SAAM,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAC;IAC/F,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,KAAK,CACb,8CAA8C,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,uCAAuC,CAC9H,CAAC;IACJ,CAAC;IACD,GAAG,CAAC;QACF,GAAG,EAAE,cAAc;QACnB,EAAE,EAAE,cAAc;QAClB,OAAO,EAAE,UAAU;QACnB,MAAM,EAAE,GAAG;QACX,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM;KACjC,CAAC,CAAC;IACH,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,oMAAoM,CACrM,CAAC;IACJ,CAAC;IACD,OAAO;QACL,SAAS,EAAE,UAAU;QACrB,QAAQ,EAAE,gBAAgB;QAC1B,KAAK,EAAE,IAAI,UAAU,CAAC,UAAU,EAAE,YAAY,EAAE,GAAG,CAAC;QACpD,eAAe,EAAE,oBAAoB,gBAAgB,2BAA2B;KACjF,CAAC;AACJ,CAAC;AAED,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;AAEnE,YAAY,CACV,MAAM,EACN,yBAAyB,EACzB,0RAA0R,EAC1R,EAAE,EACF,KAAK,IAAI,EAAE;IACT,IAAI,CAAC,UAAU;QAAE,OAAO,eAAe,CAAC,yBAAyB,CAAC,CAAC;IACnE,IAAI,CAAC;QACH,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,OAAO,IAAI,CACT,sGAAsG,CACvG,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACxB,OAAO,IAAI,CACT,gHAAgH,CACjH,CAAC;QACJ,CAAC;QACD,wEAAwE;QACxE,uEAAuE;QACvE,wEAAwE;QACxE,mEAAmE;QACnE,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;YAChC,OAAO,IAAI,CACT,oEAAoE,cAAc,sMAAsM,CACzR,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,uBAAuB,CAAC;YACxC,SAAS,EAAE,UAAU;YACrB,WAAW,EAAE,YAAY;YACzB,QAAQ,EAAE,gBAAgB;YAC1B,UAAU,EAAE,kBAAkB;SAC/B,CAAC,CAAC;QACH,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC;IACjB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,IAAI,CAAC,mCAAoC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IAC3E,CAAC;AACH,CAAC,CACF,CAAC;AAEF,YAAY,CACV,MAAM,EACN,8BAA8B,EAC9B,wJAAwJ,EACxJ,EAAE,EACF,KAAK,IAAI,EAAE;IACT,IAAI,CAAC,UAAU;QAAE,OAAO,eAAe,CAAC,8BAA8B,CAAC,CAAC;IACxE,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,MAAM,sBAAsB,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC;IAChG,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,IAAI,CAAC,wCAAyC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IAChF,CAAC;AACH,CAAC,CACF,CAAC;AAEF,YAAY,CACV,MAAM,EACN,sBAAsB,EACtB,wMAAwM,EACxM;IACE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACtD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACvD,OAAO,EAAE,UAAU;CACpB,EACD,KAAK,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,EAAE;IAC3C,IAAI,CAAC,UAAU;QAAE,OAAO,eAAe,CAAC,sBAAsB,CAAC,CAAC;IAChE,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,MAAM,eAAe,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;IAClF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,IAAI,CAAC,gCAAiC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IACxE,CAAC;AACH,CAAC,CACF,CAAC;AAEF,YAAY,CACV,MAAM,EACN,uBAAuB,EACvB,sCAAsC,EACtC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,EACnD,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE;IAC7B,IAAI,CAAC,UAAU;QAAE,OAAO,eAAe,CAAC,uBAAuB,CAAC,CAAC;IACjE,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,MAAM,gBAAgB,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IACrE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,IAAI,CAAC,iCAAkC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IACzE,CAAC;AACH,CAAC,CACF,CAAC;AAEF,YAAY,CACV,MAAM,EACN,wBAAwB,EACxB,6JAA6J,EAC7J;IACE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACzC,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC9B,OAAO,EAAE,UAAU;CACpB,EACD,KAAK,EAAE,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE;IAC7B,IAAI,CAAC,UAAU;QAAE,OAAO,eAAe,CAAC,wBAAwB,CAAC,CAAC;IAClE,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,MAAM,iBAAiB,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IAC/D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,IAAI,CAAC,kCAAmC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC,CACF,CAAC;AAEF,YAAY,CACV,MAAM,EACN,wBAAwB,EACxB,uIAAuI,EACvI;IACE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACzC,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC9B,OAAO,EAAE,UAAU;CACpB,EACD,KAAK,EAAE,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE;IAC7B,IAAI,CAAC,UAAU;QAAE,OAAO,eAAe,CAAC,wBAAwB,CAAC,CAAC;IAClE,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,MAAM,iBAAiB,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IAC/D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,IAAI,CAAC,kCAAmC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC,CACF,CAAC;AAEF,YAAY,CACV,MAAM,EACN,wBAAwB,EACxB,iEAAiE,EACjE,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,EACnD,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE;IAC7B,IAAI,CAAC,UAAU;QAAE,OAAO,eAAe,CAAC,wBAAwB,CAAC,CAAC;IAClE,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,MAAM,iBAAiB,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IACtE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,IAAI,CAAC,kCAAmC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC,CACF,CAAC;AAEF,YAAY,CACV,MAAM,EACN,yBAAyB,EACzB,kJAAkJ,EAClJ;IACE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;IACvD,OAAO,EAAE,UAAU;CACpB,EACD,KAAK,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE;IACvC,IAAI,CAAC,UAAU;QAAE,OAAO,eAAe,CAAC,yBAAyB,CAAC,CAAC;IACnE,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,MAAM,kBAAkB,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;IACjF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,IAAI,CAAC,mCAAoC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IAC3E,CAAC;AACH,CAAC,CACF,CAAC;AAEF,YAAY,CACV,MAAM,EACN,0BAA0B,EAC1B,4IAA4I,EAC5I;IACE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACzC,OAAO,EAAE,UAAU;CACpB,EACD,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,EAAE;IAC3C,IAAI,CAAC,UAAU;QAAE,OAAO,eAAe,CAAC,0BAA0B,CAAC,CAAC;IACpE,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,MAAM,mBAAmB,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IACtF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,IAAI,CAAC,oCAAqC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5E,CAAC;AACH,CAAC,CACF,CAAC;AAEF,YAAY,CACV,MAAM,EACN,qBAAqB,EACrB,6IAA6I,EAC7I,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAC5B,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;IAClB,IAAI,CAAC,UAAU;QAAE,OAAO,eAAe,CAAC,qBAAqB,CAAC,CAAC;IAC/D,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,cAAc,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACzF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,IAAI,CAAC,+BAAgC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IACvE,CAAC;AACH,CAAC,CACF,CAAC;AAEF,YAAY,CACV,MAAM,EACN,qBAAqB,EACrB,gKAAgK,EAChK,EAAE,EACF,KAAK,IAAI,EAAE;IACT,IAAI,CAAC,UAAU;QAAE,OAAO,eAAe,CAAC,qBAAqB,CAAC,CAAC;IAC/D,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,cAAc,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC;IAClF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,IAAI,CAAC,+BAAgC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IACvE,CAAC;AACH,CAAC,CACF,CAAC;AAEF,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;AAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;AAChC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,8BAA8B,UAAU,IAAI,MAAM,IAAI,CAAC,CAAC"}

package/payload/platform/plugins/google/mcp/dist/lib/google-client.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Authenticated access to Google Calendar API v3.
+ *
+ * Refresh is delegated to platform/ui rather than performed here. A
+ * Web-application OAuth client must present its client_secret at Google's
+ * token endpoint, and that secret is house-only (${PLATFORM_ROOT}/config/
+ * google-house.env) — it must never reach a per-account MCP spawn. The server
+ * holds it and exposes POST /api/google/oauth/refresh for this purpose.
+ */
+import { TokenStore, type TokenBlob } from "../auth/token-store.js";
+export interface GoogleConfig {
+    accountId: string;
+    clientId: string;
+    store: TokenStore;
+    /** Loopback URL of the platform/ui route that holds the client secret. */
+    refreshEndpoint: string;
+}
+export declare function buildQuery(q: Record<string, string | number | undefined>): string;
+export declare function isExpiring(blob: TokenBlob): boolean;
+export declare function callCalendar<T>(config: GoogleConfig, path: string, init?: {
+    method?: string;
+    body?: unknown;
+    query?: Record<string, string | number | undefined>;
+}): Promise<T>;
+/** The primary calendar's id IS the account's email address. Used instead of a
+ *  userinfo call, because the identity scopes are deliberately not requested. */
+export declare function resolvePrimaryEmail(config: GoogleConfig): Promise<string>;
+//# sourceMappingURL=google-client.d.ts.map

package/payload/platform/plugins/google/mcp/dist/lib/google-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"google-client.d.ts","sourceRoot":"","sources":["../../src/lib/google-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,UAAU,EAAwB,KAAK,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAK1F,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,UAAU,CAAC;IAClB,0EAA0E;IAC1E,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,wBAAgB,UAAU,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC,GAAG,MAAM,CAOjF;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAEnD;AA6CD,wBAAsB,YAAY,CAAC,CAAC,EAClC,MAAM,EAAE,YAAY,EACpB,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE;IACJ,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC,CAAC;CAChD,GACL,OAAO,CAAC,CAAC,CAAC,CA8BZ;AAED;iFACiF;AACjF,wBAAsB,mBAAmB,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAG/E"}

package/payload/platform/plugins/google/mcp/dist/lib/google-client.js

@@ -0,0 +1,102 @@
+/**
+ * Authenticated access to Google Calendar API v3.
+ *
+ * Refresh is delegated to platform/ui rather than performed here. A
+ * Web-application OAuth client must present its client_secret at Google's
+ * token endpoint, and that secret is house-only (${PLATFORM_ROOT}/config/
+ * google-house.env) — it must never reach a per-account MCP spawn. The server
+ * holds it and exposes POST /api/google/oauth/refresh for this purpose.
+ */
+import { REFRESH_THRESHOLD_MS } from "../auth/token-store.js";
+import { log } from "./log.js";
+const CALENDAR_BASE = "https://www.googleapis.com/calendar/v3";
+export function buildQuery(q) {
+    const parts = [];
+    for (const [k, v] of Object.entries(q)) {
+        if (v === undefined)
+            continue;
+        parts.push(`${encodeURIComponent(k)}=${encodeURIComponent(String(v))}`);
+    }
+    return parts.length ? `?${parts.join("&")}` : "";
+}
+export function isExpiring(blob) {
+    return blob.accessTokenExpiry - Date.now() <= REFRESH_THRESHOLD_MS;
+}
+/**
+ * Refresh through platform/ui. An IO or HTTP failure here NEVER clears held
+ * tokens — it throws, leaving the store untouched, so a transient outage
+ * cannot cost the account its credentials (Task 1601's lesson applied to the
+ * refresh path rather than the write path).
+ */
+async function refresh(config, blob) {
+    if (!blob.refreshToken) {
+        throw new Error("no refresh token held for this Google account; run google-account-register");
+    }
+    const res = await fetch(config.refreshEndpoint, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ accountId: config.accountId, refreshToken: blob.refreshToken }),
+    });
+    const text = await res.text();
+    if (!res.ok) {
+        log({
+            tag: "[google-mcp]",
+            op: "refresh-failed",
+            account: config.accountId,
+            status: res.status,
+            body: text.slice(0, 300),
+        });
+        throw new Error(`token refresh failed (${res.status}): ${text.slice(0, 300)}`);
+    }
+    const json = JSON.parse(text);
+    const next = config.store.store(json.access_token, null, json.expires_in, {
+        scopes: json.scope ? json.scope.split(" ") : undefined,
+    });
+    log({ tag: "[google-mcp]", op: "refresh-ok", account: config.accountId, ttlSec: json.expires_in });
+    return next;
+}
+async function accessToken(config) {
+    const blob = config.store.read();
+    if (!blob) {
+        throw new Error("no Google account connected for this account; run google-account-register");
+    }
+    if (!isExpiring(blob))
+        return blob.accessToken;
+    return (await refresh(config, blob)).accessToken;
+}
+export async function callCalendar(config, path, init = {}) {
+    const token = await accessToken(config);
+    const url = `${CALENDAR_BASE}${path}${buildQuery(init.query ?? {})}`;
+    const res = await fetch(url, {
+        method: init.method ?? "GET",
+        headers: {
+            authorization: `Bearer ${token}`,
+            ...(init.body === undefined ? {} : { "content-type": "application/json" }),
+        },
+        body: init.body === undefined ? undefined : JSON.stringify(init.body),
+    });
+    const text = await res.text();
+    if (!res.ok) {
+        // Cardinal observability rule: never discard an error body.
+        log({
+            tag: "[google-mcp]",
+            op: "api-error",
+            account: config.accountId,
+            path,
+            status: res.status,
+            body: text.slice(0, 500),
+        });
+        if (res.status === 403 && text.includes("insufficient")) {
+            throw new Error(`Google refused this call for missing scope (403). The connected account granted a narrower consent than https://www.googleapis.com/auth/calendar. Re-run google-account-register to re-consent. Body: ${text.slice(0, 300)}`);
+        }
+        throw new Error(`Google Calendar API ${res.status}: ${text.slice(0, 300)}`);
+    }
+    return (text ? JSON.parse(text) : {});
+}
+/** The primary calendar's id IS the account's email address. Used instead of a
+ *  userinfo call, because the identity scopes are deliberately not requested. */
+export async function resolvePrimaryEmail(config) {
+    const cal = await callCalendar(config, "/calendars/primary");
+    return cal.id;
+}
+//# sourceMappingURL=google-client.js.map

package/payload/platform/plugins/google/mcp/dist/lib/google-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"google-client.js","sourceRoot":"","sources":["../../src/lib/google-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAc,oBAAoB,EAAkB,MAAM,wBAAwB,CAAC;AAC1F,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAE/B,MAAM,aAAa,GAAG,wCAAwC,CAAC;AAU/D,MAAM,UAAU,UAAU,CAAC,CAA8C;IACvE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,IAAI,CAAC,KAAK,SAAS;YAAE,SAAS;QAC9B,KAAK,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,CAAC,CAAC,IAAI,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAe;IACxC,OAAO,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,oBAAoB,CAAC;AACrE,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,OAAO,CAAC,MAAoB,EAAE,IAAe;IAC1D,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAC;IAChG,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,eAAe,EAAE;QAC9C,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC;KACvF,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,GAAG,CAAC;YACF,GAAG,EAAE,cAAc;YACnB,EAAE,EAAE,gBAAgB;YACpB,OAAO,EAAE,MAAM,CAAC,SAAS;YACzB,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;SACzB,CAAC,CAAC;QACH,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,CAAC,MAAM,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IACjF,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAiE,CAAC;IAC9F,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE;QACxE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;KACvD,CAAC,CAAC;IACH,GAAG,CAAC,EAAE,GAAG,EAAE,cAAc,EAAE,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;IACnG,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,MAAoB;IAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IACjC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAC;IAC/F,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,WAAW,CAAC;IAC/C,OAAO,CAAC,MAAM,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC;AACnD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAAoB,EACpB,IAAY,EACZ,OAII,EAAE;IAEN,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,GAAG,GAAG,GAAG,aAAa,GAAG,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC;IACrE,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAC3B,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,KAAK;QAC5B,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,KAAK,EAAE;YAChC,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;SAC3E;QACD,IAAI,EAAE,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;KACtE,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,4DAA4D;QAC5D,GAAG,CAAC;YACF,GAAG,EAAE,cAAc;YACnB,EAAE,EAAE,WAAW;YACf,OAAO,EAAE,MAAM,CAAC,SAAS;YACzB,IAAI;YACJ,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;SACzB,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CACb,yMAAyM,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAC9N,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,uBAAuB,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,EAAQ,CAAM,CAAC;AACpD,CAAC;AAED;iFACiF;AACjF,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,MAAoB;IAC5D,MAAM,GAAG,GAAG,MAAM,YAAY,CAAiB,MAAM,EAAE,oBAAoB,CAAC,CAAC;IAC7E,OAAO,GAAG,CAAC,EAAE,CAAC;AAChB,CAAC"}

package/payload/platform/plugins/google/mcp/dist/lib/log.d.ts

@@ -0,0 +1,3 @@
+/** One structured stderr line. Never throws; logging must not break a tool. */
+export declare function log(fields: Record<string, string | number | boolean | null | undefined>): void;
+//# sourceMappingURL=log.d.ts.map

package/payload/platform/plugins/google/mcp/dist/lib/log.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"log.d.ts","sourceRoot":"","sources":["../../src/lib/log.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,wBAAgB,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,GAAG,SAAS,CAAC,GAAG,IAAI,CAW9F"}

package/payload/platform/plugins/google/mcp/dist/lib/log.js

@@ -0,0 +1,16 @@
+/** One structured stderr line. Never throws; logging must not break a tool. */
+export function log(fields) {
+    try {
+        const parts = [];
+        for (const [k, v] of Object.entries(fields)) {
+            if (v === undefined)
+                continue;
+            parts.push(`${k}=${v === null ? "null" : String(v)}`);
+        }
+        process.stderr.write(`${parts.join(" ")}\n`);
+    }
+    catch {
+        /* logging must never throw */
+    }
+}
+//# sourceMappingURL=log.js.map

package/payload/platform/plugins/google/mcp/dist/lib/log.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"log.js","sourceRoot":"","sources":["../../src/lib/log.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,MAAM,UAAU,GAAG,CAAC,MAAoE;IACtF,IAAI,CAAC;QACH,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5C,IAAI,CAAC,KAAK,SAAS;gBAAE,SAAS;YAC9B,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACxD,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,8BAA8B;IAChC,CAAC;AACH,CAAC"}

package/payload/platform/plugins/google/mcp/dist/tools/account-info.d.ts

@@ -0,0 +1,12 @@
+/** Auth state for one connected Google account, read from local stores only. */
+export declare function runAccountInfo(args: {
+    accountId: string;
+    accountsDir: string;
+    email: string;
+}): {
+    email: string;
+    connected: boolean;
+    expiring: boolean;
+    scopes: string[];
+};
+//# sourceMappingURL=account-info.d.ts.map

package/payload/platform/plugins/google/mcp/dist/tools/account-info.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-info.d.ts","sourceRoot":"","sources":["../../src/tools/account-info.ts"],"names":[],"mappings":"AAGA,gFAAgF;AAChF,wBAAgB,cAAc,CAAC,IAAI,EAAE;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;CACf,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAgB7E"}

package/payload/platform/plugins/google/mcp/dist/tools/account-info.js

@@ -0,0 +1,23 @@
+import { TokenStore } from "../auth/token-store.js";
+import { isExpiring } from "../lib/google-client.js";
+/** Auth state for one connected Google account, read from local stores only. */
+export function runAccountInfo(args) {
+    let blob = null;
+    try {
+        blob = new TokenStore(args.accountId, args.accountsDir, args.email).read();
+    }
+    catch {
+        // An unreadable blob is reported as not-connected rather than thrown, so a
+        // corrupt store is diagnosable through this tool instead of crashing it.
+        return { email: args.email, connected: false, expiring: false, scopes: [] };
+    }
+    if (!blob)
+        return { email: args.email, connected: false, expiring: false, scopes: [] };
+    return {
+        email: blob.email ?? args.email,
+        connected: true,
+        expiring: isExpiring(blob),
+        scopes: blob.scopes,
+    };
+}
+//# sourceMappingURL=account-info.js.map

package/payload/platform/plugins/google/mcp/dist/tools/account-info.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-info.js","sourceRoot":"","sources":["../../src/tools/account-info.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAErD,gFAAgF;AAChF,MAAM,UAAU,cAAc,CAAC,IAI9B;IACC,IAAI,IAAI,GAAG,IAAI,CAAC;IAChB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7E,CAAC;IAAC,MAAM,CAAC;QACP,2EAA2E;QAC3E,yEAAyE;QACzE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAC9E,CAAC;IACD,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACvF,OAAO;QACL,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK;QAC/B,SAAS,EAAE,IAAI;QACf,QAAQ,EAAE,UAAU,CAAC,IAAI,CAAC;QAC1B,MAAM,EAAE,IAAI,CAAC,MAAM;KACpB,CAAC;AACJ,CAAC"}

package/payload/platform/plugins/google/mcp/dist/tools/account-list.d.ts

@@ -0,0 +1,12 @@
+import { type ConnectedAccount } from "./account-register.js";
+/** Every connected Google account on this account, from local stores only — no
+ *  network. `count` alone is not "connected": each entry carries its own status
+ *  so an unreadable blob is distinguishable from a healthy one. */
+export declare function runAccountList(args: {
+    accountId: string;
+    accountsDir: string;
+}): {
+    count: number;
+    accounts: ConnectedAccount[];
+};
+//# sourceMappingURL=account-list.d.ts.map

package/payload/platform/plugins/google/mcp/dist/tools/account-list.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-list.d.ts","sourceRoot":"","sources":["../../src/tools/account-list.ts"],"names":[],"mappings":"AAAA,OAAO,EAAiB,KAAK,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAE7E;;mEAEmE;AACnE,wBAAgB,cAAc,CAAC,IAAI,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAAG;IAChF,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,gBAAgB,EAAE,CAAC;CAC9B,CAGA"}

package/payload/platform/plugins/google/mcp/dist/tools/account-list.js

@@ -0,0 +1,9 @@
+import { listConnected } from "./account-register.js";
+/** Every connected Google account on this account, from local stores only — no
+ *  network. `count` alone is not "connected": each entry carries its own status
+ *  so an unreadable blob is distinguishable from a healthy one. */
+export function runAccountList(args) {
+    const accounts = listConnected(args.accountId, args.accountsDir);
+    return { count: accounts.length, accounts };
+}
+//# sourceMappingURL=account-list.js.map

package/payload/platform/plugins/google/mcp/dist/tools/account-list.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-list.js","sourceRoot":"","sources":["../../src/tools/account-list.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAyB,MAAM,uBAAuB,CAAC;AAE7E;;mEAEmE;AACnE,MAAM,UAAU,cAAc,CAAC,IAAgD;IAI7E,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IACjE,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC;AAC9C,CAAC"}

package/payload/platform/plugins/google/mcp/dist/tools/account-register.d.ts

@@ -0,0 +1,42 @@
+export declare const CALENDAR_SCOPE = "https://www.googleapis.com/auth/calendar";
+/** Google refuses an authorization code older than roughly ten minutes; a
+ *  pending entry past that is stranded, not live. */
+export declare const PENDING_LIFETIME_SEC = 600;
+export declare function newPkce(): {
+    verifier: string;
+    challenge: string;
+};
+export declare function buildConsentUrl(args: {
+    clientId: string;
+    redirectUri: string;
+    state: string;
+    challenge: string;
+    accountId: string;
+}): string;
+export interface ConnectedAccount {
+    email: string;
+    status: "ok" | "unreadable";
+}
+/** Enumerate connected Google accounts from local stores only — no network.
+ *  A count alone is not "connected": each entry carries its own status so an
+ *  unreadable blob is distinguishable from a healthy one. */
+export declare function listConnected(accountId: string, accountsDir: string): ConnectedAccount[];
+export declare function runAccountRegisterStart(args: {
+    accountId: string;
+    accountsDir: string;
+    clientId: string;
+    publicBase: string;
+}): Promise<{
+    status: "pending" | "in-progress";
+    consentUrl?: string;
+    ageSec?: number;
+}>;
+export declare function runAccountRegisterPoll(args: {
+    accountId: string;
+    accountsDir: string;
+}): Promise<{
+    status: "registered" | "pending" | "expired" | "none";
+    accounts: ConnectedAccount[];
+    ageSec?: number;
+}>;
+//# sourceMappingURL=account-register.d.ts.map

package/payload/platform/plugins/google/mcp/dist/tools/account-register.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-register.d.ts","sourceRoot":"","sources":["../../src/tools/account-register.ts"],"names":[],"mappings":"AAgBA,eAAO,MAAM,cAAc,6CAA6C,CAAC;AAGzE;qDACqD;AACrD,eAAO,MAAM,oBAAoB,MAAM,CAAC;AAExC,wBAAgB,OAAO,IAAI;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAGjE;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB,GAAG,MAAM,CAgBT;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,IAAI,GAAG,YAAY,CAAC;CAC7B;AAED;;6DAE6D;AAC7D,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,gBAAgB,EAAE,CAaxF;AAED,wBAAsB,uBAAuB,CAAC,IAAI,EAAE;IAClD,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;CACpB,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,SAAS,GAAG,aAAa,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CA4BvF;AAED,wBAAsB,sBAAsB,CAAC,IAAI,EAAE;IACjD,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC;IACV,MAAM,EAAE,YAAY,GAAG,SAAS,GAAG,SAAS,GAAG,MAAM,CAAC;IACtD,QAAQ,EAAE,gBAAgB,EAAE,CAAC;IAC7B,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC,CAUD"}