@rubytech/create-maxy-code 0.1.470 → 0.1.472

package/payload/platform/plugins/google/mcp/dist/auth/token-store.js

@@ -0,0 +1,138 @@
+/**
+ * Per-account encrypted token store for Google OAuth credentials.
+ *
+ *   {ACCOUNTS_DIR}/{accountId}/secrets/google/.key                       AES-256-CBC key, 32 random bytes base64, mode 0600
+ *   {ACCOUNTS_DIR}/{accountId}/secrets/google/accounts/{key}/tokens.enc  "<iv-hex>:<cipher-hex>" of the JSON blob
+ *
+ * The AES key is per-account and shared by every Google account connected
+ * under it; account isolation is unchanged — account A's key cannot decrypt
+ * account B's tokens.
+ *
+ * Divergence from the Outlook store this mirrors: the atomic write uses a
+ * UNIQUE temp name. Outlook used a fixed `${tokensPath}.tmp`, so two racing
+ * refreshes could rename each other's partial file and wipe valid tokens
+ * (Task 1601).
+ */
+import { createCipheriv, createDecipheriv, randomBytes } from "node:crypto";
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync, } from "node:fs";
+import { join } from "node:path";
+export const REFRESH_THRESHOLD_MS = 5 * 60 * 1000;
+/** Filesystem-safe directory name for a Google account key (an email). The true
+ *  identity is never read back from this name — it lives in the blob — so a
+ *  lossy fold is harmless. */
+export function sanitizeAccountKey(key) {
+    return key.replace(/[^A-Za-z0-9._-]/g, "_");
+}
+export class TokenStore {
+    accountId;
+    accountsDir;
+    accountKey;
+    cached = null;
+    key = null;
+    secretsDir;
+    mailboxDir;
+    tokensPath;
+    keyPath;
+    constructor(accountId, accountsDir, accountKey) {
+        this.accountId = accountId;
+        this.accountsDir = accountsDir;
+        this.accountKey = accountKey;
+        this.secretsDir = join(accountsDir, accountId, "secrets", "google");
+        this.mailboxDir = join(this.secretsDir, "accounts", sanitizeAccountKey(accountKey));
+        this.tokensPath = join(this.mailboxDir, "tokens.enc");
+        this.keyPath = join(this.secretsDir, ".key");
+    }
+    loadKey() {
+        if (this.key)
+            return this.key;
+        mkdirSync(this.secretsDir, { recursive: true, mode: 0o700 });
+        if (existsSync(this.keyPath)) {
+            this.key = Buffer.from(readFileSync(this.keyPath, "utf-8").trim(), "base64");
+        }
+        else {
+            const k = randomBytes(32);
+            writeFileSync(this.keyPath, k.toString("base64"), { mode: 0o600 });
+            chmodSync(this.keyPath, 0o600);
+            this.key = k;
+        }
+        return this.key;
+    }
+    encrypt(plain) {
+        const iv = randomBytes(16);
+        const c = createCipheriv("aes-256-cbc", this.loadKey(), iv);
+        return `${iv.toString("hex")}:${c.update(plain, "utf8", "hex") + c.final("hex")}`;
+    }
+    decrypt(raw) {
+        const [ivHex, payload] = raw.split(":");
+        const d = createDecipheriv("aes-256-cbc", this.loadKey(), Buffer.from(ivHex, "hex"));
+        return d.update(payload, "hex", "utf8") + d.final("utf8");
+    }
+    /** The temp path a write would use. Exposed so a test can assert the
+     *  Task-1601 invariant directly: distinct writers, and successive writes by
+     *  one writer, never nominate the same path. */
+    nextTempPath() {
+        return `${this.tokensPath}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`;
+    }
+    /** Test seam for the failure path — a write that throws must leave the
+     *  previous good file untouched. */
+    writeBlobForTest(blob) {
+        this.writeBlob(blob);
+    }
+    /** Atomic write with a UNIQUE temp name — see the class comment (Task 1601).
+     *  A failed write removes its own temp and rethrows, never leaving debris and
+     *  never clearing the previous good file. */
+    writeBlob(blob) {
+        const ciphertext = this.encrypt(JSON.stringify(blob));
+        mkdirSync(this.mailboxDir, { recursive: true, mode: 0o700 });
+        const temp = this.nextTempPath();
+        try {
+            writeFileSync(temp, ciphertext, { mode: 0o600 });
+            chmodSync(temp, 0o600);
+            renameSync(temp, this.tokensPath);
+        }
+        catch (err) {
+            try {
+                rmSync(temp, { force: true });
+            }
+            catch {
+                /* best effort */
+            }
+            throw err;
+        }
+        this.cached = blob;
+    }
+    read() {
+        if (this.cached)
+            return this.cached;
+        if (!existsSync(this.tokensPath))
+            return null;
+        const raw = readFileSync(this.tokensPath, "utf-8").trim();
+        if (!raw)
+            return null;
+        const blob = JSON.parse(this.decrypt(raw));
+        this.cached = blob;
+        return blob;
+    }
+    store(accessToken, refreshToken, expiresInSeconds, extras = {}) {
+        const now = Date.now();
+        const prev = this.read();
+        const blob = {
+            accessToken,
+            // Google omits refresh_token on refresh responses; never downgrade a
+            // held refresh token to null because this response lacked one.
+            refreshToken: refreshToken ?? prev?.refreshToken ?? null,
+            accessTokenExpiry: now + expiresInSeconds * 1000,
+            lastRefresh: now,
+            email: extras.email ?? prev?.email ?? null,
+            scopes: extras.scopes ?? prev?.scopes ?? [],
+        };
+        this.writeBlob(blob);
+        return blob;
+    }
+    clear() {
+        this.cached = null;
+        if (existsSync(this.tokensPath))
+            rmSync(this.tokensPath, { force: true });
+    }
+}
+//# sourceMappingURL=token-store.js.map

package/payload/platform/plugins/google/mcp/dist/auth/token-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-store.js","sourceRoot":"","sources":["../../src/auth/token-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC5E,OAAO,EACL,SAAS,EACT,UAAU,EACV,SAAS,EACT,YAAY,EACZ,UAAU,EACV,MAAM,EACN,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAWlD;;8BAE8B;AAC9B,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC5C,OAAO,GAAG,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,OAAO,UAAU;IASV;IACA;IACA;IAVH,MAAM,GAAqB,IAAI,CAAC;IAChC,GAAG,GAAkB,IAAI,CAAC;IACzB,UAAU,CAAS;IACnB,UAAU,CAAS;IACnB,UAAU,CAAS;IACX,OAAO,CAAS;IAEjC,YACW,SAAiB,EACjB,WAAmB,EACnB,UAAkB;QAFlB,cAAS,GAAT,SAAS,CAAQ;QACjB,gBAAW,GAAX,WAAW,CAAQ;QACnB,eAAU,GAAV,UAAU,CAAQ;QAE3B,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;QACpE,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,EAAE,kBAAkB,CAAC,UAAU,CAAC,CAAC,CAAC;QACpF,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QACtD,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC/C,CAAC;IAEO,OAAO;QACb,IAAI,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC,GAAG,CAAC;QAC9B,SAAS,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7D,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7B,IAAI,CAAC,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC;QAC/E,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;YAC1B,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACnE,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAC/B,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC,GAAG,CAAC;IAClB,CAAC;IAEO,OAAO,CAAC,KAAa;QAC3B,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC3B,MAAM,CAAC,GAAG,cAAc,CAAC,aAAa,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;QAC5D,OAAO,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;IACpF,CAAC;IAEO,OAAO,CAAC,GAAW;QACzB,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxC,MAAM,CAAC,GAAG,gBAAgB,CAAC,aAAa,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;QACrF,OAAO,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC5D,CAAC;IAED;;oDAEgD;IAChD,YAAY;QACV,OAAO,GAAG,IAAI,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;IACnF,CAAC;IAED;wCACoC;IACpC,gBAAgB,CAAC,IAAe;QAC9B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;IAED;;iDAE6C;IACrC,SAAS,CAAC,IAAe;QAC/B,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QACtD,SAAS,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7D,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACjC,IAAI,CAAC;YACH,aAAa,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACjD,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACvB,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC;gBACH,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAChC,CAAC;YAAC,MAAM,CAAC;gBACP,iBAAiB;YACnB,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;IACrB,CAAC;IAED,IAAI;QACF,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC;QACpC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;YAAE,OAAO,IAAI,CAAC;QAC9C,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QAC1D,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAc,CAAC;QACxD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CACH,WAAmB,EACnB,YAA2B,EAC3B,gBAAwB,EACxB,SAAuD,EAAE;QAEzD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACzB,MAAM,IAAI,GAAc;YACtB,WAAW;YACX,qEAAqE;YACrE,+DAA+D;YAC/D,YAAY,EAAE,YAAY,IAAI,IAAI,EAAE,YAAY,IAAI,IAAI;YACxD,iBAAiB,EAAE,GAAG,GAAG,gBAAgB,GAAG,IAAI;YAChD,WAAW,EAAE,GAAG;YAChB,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,IAAI,EAAE,KAAK,IAAI,IAAI;YAC1C,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,IAAI,EAAE,MAAM,IAAI,EAAE;SAC5C,CAAC;QACF,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK;QACH,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5E,CAAC;CACF"}

package/payload/platform/plugins/google/mcp/dist/index.d.ts

@@ -0,0 +1,25 @@
+#!/usr/bin/env node
+/**
+ * @maxy/google MCP server.
+ *
+ * Live Google Calendar for one account: read plus create, update, cancel,
+ * respond and free/busy. Admin agent only; no public surface.
+ *
+ * Auth: per-account OAuth authorization-code + PKCE. The consent URL is minted
+ *   here; the exchange happens in platform/ui, which holds the house-only
+ *   client secret. Tokens persist encrypted to
+ *   {ACCOUNTS_DIR}/{accountId}/secrets/google/accounts/{email}/tokens.enc
+ *
+ * There is deliberately no Gmail surface — mail runs on the `email` plugin's
+ * IMAP/SMTP path, and Gmail's restricted scopes would force Google's annual
+ * security assessment. Calendar is a sensitive scope only.
+ *
+ * Required environment:
+ *   ACCOUNT_ID          — provided by getMcpServers when spawned per account.
+ *   PLATFORM_ROOT       — repo root; used to derive ACCOUNTS_DIR.
+ *   GOOGLE_CLIENT_ID    — brand.json#googleClientId. Operator-set per brand.
+ *   GOOGLE_PUBLIC_BASE  — https origin of this install's public host.
+ *   MAXY_UI_INTERNAL_PORT — loopback port of platform/ui (holds the secret).
+ */
+export {};
+//# sourceMappingURL=index.d.ts.map

package/payload/platform/plugins/google/mcp/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;;;;GAqBG"}

package/payload/platform/plugins/google/mcp/dist/index.js

@@ -0,0 +1,300 @@
+#!/usr/bin/env node
+/**
+ * @maxy/google MCP server.
+ *
+ * Live Google Calendar for one account: read plus create, update, cancel,
+ * respond and free/busy. Admin agent only; no public surface.
+ *
+ * Auth: per-account OAuth authorization-code + PKCE. The consent URL is minted
+ *   here; the exchange happens in platform/ui, which holds the house-only
+ *   client secret. Tokens persist encrypted to
+ *   {ACCOUNTS_DIR}/{accountId}/secrets/google/accounts/{email}/tokens.enc
+ *
+ * There is deliberately no Gmail surface — mail runs on the `email` plugin's
+ * IMAP/SMTP path, and Gmail's restricted scopes would force Google's annual
+ * security assessment. Calendar is a sensitive scope only.
+ *
+ * Required environment:
+ *   ACCOUNT_ID          — provided by getMcpServers when spawned per account.
+ *   PLATFORM_ROOT       — repo root; used to derive ACCOUNTS_DIR.
+ *   GOOGLE_CLIENT_ID    — brand.json#googleClientId. Operator-set per brand.
+ *   GOOGLE_PUBLIC_BASE  — https origin of this install's public host.
+ *   MAXY_UI_INTERNAL_PORT — loopback port of platform/ui (holds the secret).
+ */
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { resolve, join } from "node:path";
+import { existsSync } from "node:fs";
+import { z } from "zod";
+import { TokenStore } from "./auth/token-store.js";
+import { log } from "./lib/log.js";
+import { runAccountRegisterStart, runAccountRegisterPoll, listConnected, } from "./tools/account-register.js";
+import { runCalendarList } from "./tools/calendar-list.js";
+import { runCalendarEvent } from "./tools/calendar-event.js";
+import { runCalendarCreate } from "./tools/calendar-create.js";
+import { runCalendarUpdate } from "./tools/calendar-update.js";
+import { runCalendarCancel } from "./tools/calendar-cancel.js";
+import { runCalendarRespond } from "./tools/calendar-respond.js";
+import { runCalendarFreebusy } from "./tools/calendar-freebusy.js";
+import { runAccountInfo } from "./tools/account-info.js";
+import { runAccountList } from "./tools/account-list.js";
+import { lifelineTool } from "../../../../lib/mcp-lifeline/dist/index.js";
+// Plugin-system boot tolerance — see Task 202. Module init must never exit;
+// the plugin-system spawn enumerates tools/list before any per-account env is
+// set. Per-call refusal preserves isolation without emptying the registry.
+const ACCOUNT_ID = process.env.ACCOUNT_ID ?? null;
+const PLATFORM_ROOT = process.env.PLATFORM_ROOT ?? process.cwd();
+const ACCOUNTS_DIR = resolve(PLATFORM_ROOT, "..", "data/accounts");
+const GOOGLE_CLIENT_ID = process.env.GOOGLE_CLIENT_ID ?? "";
+const GOOGLE_PUBLIC_BASE = process.env.GOOGLE_PUBLIC_BASE ?? "";
+// The loopback UI port is per-brand and already on the spawn env. A guessed
+// default would be a brand-isolation hazard on a co-resident host: brand A
+// would POST its refresh to brand B's server, which would service it with
+// brand B's house client secret. Unset is refused per call, never defaulted.
+const UI_INTERNAL_PORT = process.env.MAXY_UI_INTERNAL_PORT ?? "";
+// Presence is checked before register; the contents are never read here.
+const HOUSE_ENV_PATH = join(PLATFORM_ROOT, "config", "google-house.env");
+// Standing per-boot reconciliation of expected (brand.json googleClientId,
+// stamped onto the session-manager env) vs actual. clientIdConfigured=false on
+// a brand that ships a value is the mis-stamp signature.
+process.stderr.write(`[google-mcp] boot accountId=${ACCOUNT_ID ?? "null"} clientIdConfigured=${GOOGLE_CLIENT_ID ? "true" : "false"} publicBaseConfigured=${GOOGLE_PUBLIC_BASE ? "true" : "false"} uiPortConfigured=${UI_INTERNAL_PORT ? "true" : "false"} houseSecretPresent=${existsSync(HOUSE_ENV_PATH) ? "true" : "false"}\n`);
+function refuseNoAccount(toolName) {
+    process.stderr.write(`[google-mcp] tool=${toolName} refuse reason=no-account-context\n`);
+    return {
+        content: [
+            {
+                type: "text",
+                text: `${toolName} cannot execute: this MCP instance was launched without ACCOUNT_ID (plugin-system metadata-only mode). Per-account access requires ACCOUNT_ID at spawn.`,
+            },
+        ],
+        isError: true,
+    };
+}
+function ok(payload) {
+    return {
+        content: [
+            {
+                type: "text",
+                text: typeof payload === "string" ? payload : JSON.stringify(payload, null, 2),
+            },
+        ],
+    };
+}
+function fail(message) {
+    return { content: [{ type: "text", text: message }], isError: true };
+}
+/** Optional account selector. One Maxy account can hold several Google
+ *  accounts; omit when there is one, name it when there are more. */
+const accountArg = z
+    .string()
+    .optional()
+    .describe("Target Google account (its email address). Omit when a single Google account is connected. With two or more, omitting it returns a refusal listing them; call google-account-list to see them.");
+/**
+ * Resolve a config for the named or sole connected Google account. Resolution
+ * order: explicit `account` -> the sole connected account -> a typed refusal
+ * naming the candidates. Every resolution logs one cred-resolve line, so a
+ * wrong or absent selector is diagnosable from that line alone.
+ */
+function getConfig(account) {
+    if (!ACCOUNT_ID)
+        throw new Error("getConfig() called without ACCOUNT_ID — handler guard missing");
+    if (!GOOGLE_CLIENT_ID) {
+        throw new Error("GOOGLE_CLIENT_ID is not configured for this brand; google tools are inert until a vendor app exists.");
+    }
+    const connected = listConnected(ACCOUNT_ID, ACCOUNTS_DIR);
+    let key;
+    if (account) {
+        key = account;
+    }
+    else if (connected.length === 1) {
+        key = connected[0].email;
+    }
+    else if (connected.length === 0) {
+        throw new Error("no Google account connected for this account; run google-account-register");
+    }
+    else {
+        throw new Error(`two or more Google accounts are connected (${connected.map((c) => c.email).join(", ")}); name one with the account argument`);
+    }
+    log({
+        tag: "[google-mcp]",
+        op: "cred-resolve",
+        account: ACCOUNT_ID,
+        target: key,
+        source: account ? "arg" : "sole",
+    });
+    if (!UI_INTERNAL_PORT) {
+        throw new Error("MAXY_UI_INTERNAL_PORT is not set; the token-refresh endpoint cannot be addressed without it. Refusing rather than guessing a port, which on a co-resident host would reach another brand's server.");
+    }
+    return {
+        accountId: ACCOUNT_ID,
+        clientId: GOOGLE_CLIENT_ID,
+        store: new TokenStore(ACCOUNT_ID, ACCOUNTS_DIR, key),
+        refreshEndpoint: `http://127.0.0.1:${UI_INTERNAL_PORT}/api/google/oauth/refresh`,
+    };
+}
+const server = new McpServer({ name: "google", version: "0.1.0" });
+lifelineTool(server, "google-account-register", "Start connecting a Google Calendar for this account. Returns a consent URL immediately — relay it to the user, who opens it on any device, signs in and approves. Then call google-account-register-poll to confirm. Does NOT block. Refuses while another registration is already live.", {}, async () => {
+    if (!ACCOUNT_ID)
+        return refuseNoAccount("google-account-register");
+    try {
+        if (!GOOGLE_CLIENT_ID) {
+            return fail("GOOGLE_CLIENT_ID is not configured for this brand; google tools are inert until a vendor app exists.");
+        }
+        if (!GOOGLE_PUBLIC_BASE) {
+            return fail("GOOGLE_PUBLIC_BASE is not configured; the consent redirect cannot be built without this install's public host.");
+        }
+        // Pre-flight the house secret by PRESENCE ONLY — never read, the secret
+        // must not enter this process. Without this the operator discovers the
+        // gap only at the callback, i.e. after they have already consented, and
+        // the failure looks like a broken flow rather than a missing file.
+        if (!existsSync(HOUSE_ENV_PATH)) {
+            return fail(`The Google client secret is not installed on this device. Create ${HOUSE_ENV_PATH} (mode 600) containing GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET from the brand's Google Cloud OAuth client, then try again. Without it the consent flow completes and then fails at the final step.`);
+        }
+        const res = await runAccountRegisterStart({
+            accountId: ACCOUNT_ID,
+            accountsDir: ACCOUNTS_DIR,
+            clientId: GOOGLE_CLIENT_ID,
+            publicBase: GOOGLE_PUBLIC_BASE,
+        });
+        return ok(res);
+    }
+    catch (err) {
+        return fail(`google-account-register failed: ${err.message}`);
+    }
+});
+lifelineTool(server, "google-account-register-poll", "Report the state of a Google Calendar registration for this account: registered, pending, expired, or none. Reads local stores only — no network call.", {}, async () => {
+    if (!ACCOUNT_ID)
+        return refuseNoAccount("google-account-register-poll");
+    try {
+        return ok(await runAccountRegisterPoll({ accountId: ACCOUNT_ID, accountsDir: ACCOUNTS_DIR }));
+    }
+    catch (err) {
+        return fail(`google-account-register-poll failed: ${err.message}`);
+    }
+});
+lifelineTool(server, "google-calendar-list", "List calendar events in the next rangeDays days (default 7, max 365). Returns id, summary, start, end, location, attendees, allDay, organizer, htmlLink. Recurring series are expanded into instances.", {
+    rangeDays: z.number().int().min(1).max(365).optional(),
+    maxResults: z.number().int().min(1).max(250).optional(),
+    account: accountArg,
+}, async ({ rangeDays, maxResults, account }) => {
+    if (!ACCOUNT_ID)
+        return refuseNoAccount("google-calendar-list");
+    try {
+        return ok(await runCalendarList(getConfig(account), { rangeDays, maxResults }));
+    }
+    catch (err) {
+        return fail(`google-calendar-list failed: ${err.message}`);
+    }
+});
+lifelineTool(server, "google-calendar-event", "Fetch a single calendar event by id.", { eventId: z.string().min(1), account: accountArg }, async ({ eventId, account }) => {
+    if (!ACCOUNT_ID)
+        return refuseNoAccount("google-calendar-event");
+    try {
+        return ok(await runCalendarEvent(getConfig(account), { eventId }));
+    }
+    catch (err) {
+        return fail(`google-calendar-event failed: ${err.message}`);
+    }
+});
+lifelineTool(server, "google-calendar-create", "Create a calendar event. Times are RFC3339 (2026-07-20T09:00:00Z) unless allDay is true, in which case they are dates (2026-07-20). Attendees are notified.", {
+    summary: z.string().min(1),
+    start: z.string().min(1),
+    end: z.string().min(1),
+    location: z.string().optional(),
+    description: z.string().optional(),
+    attendees: z.array(z.string()).optional(),
+    allDay: z.boolean().optional(),
+    account: accountArg,
+}, async ({ account, ...args }) => {
+    if (!ACCOUNT_ID)
+        return refuseNoAccount("google-calendar-create");
+    try {
+        return ok(await runCalendarCreate(getConfig(account), args));
+    }
+    catch (err) {
+        return fail(`google-calendar-create failed: ${err.message}`);
+    }
+});
+lifelineTool(server, "google-calendar-update", "Update an existing calendar event. Only the fields you name are changed; omitted fields are left as they are. Attendees are notified.", {
+    eventId: z.string().min(1),
+    summary: z.string().optional(),
+    start: z.string().optional(),
+    end: z.string().optional(),
+    location: z.string().optional(),
+    description: z.string().optional(),
+    attendees: z.array(z.string()).optional(),
+    allDay: z.boolean().optional(),
+    account: accountArg,
+}, async ({ account, ...args }) => {
+    if (!ACCOUNT_ID)
+        return refuseNoAccount("google-calendar-update");
+    try {
+        return ok(await runCalendarUpdate(getConfig(account), args));
+    }
+    catch (err) {
+        return fail(`google-calendar-update failed: ${err.message}`);
+    }
+});
+lifelineTool(server, "google-calendar-cancel", "Cancel (delete) a calendar event by id. Attendees are notified.", { eventId: z.string().min(1), account: accountArg }, async ({ eventId, account }) => {
+    if (!ACCOUNT_ID)
+        return refuseNoAccount("google-calendar-cancel");
+    try {
+        return ok(await runCalendarCancel(getConfig(account), { eventId }));
+    }
+    catch (err) {
+        return fail(`google-calendar-cancel failed: ${err.message}`);
+    }
+});
+lifelineTool(server, "google-calendar-respond", "Respond to an invitation on behalf of the connected account: accepted, declined or tentative. Every other attendee's response is left untouched.", {
+    eventId: z.string().min(1),
+    response: z.enum(["accepted", "declined", "tentative"]),
+    account: accountArg,
+}, async ({ eventId, response, account }) => {
+    if (!ACCOUNT_ID)
+        return refuseNoAccount("google-calendar-respond");
+    try {
+        return ok(await runCalendarRespond(getConfig(account), { eventId, response }));
+    }
+    catch (err) {
+        return fail(`google-calendar-respond failed: ${err.message}`);
+    }
+});
+lifelineTool(server, "google-calendar-freebusy", "Busy blocks between start and end (RFC3339) for the account's own calendar, or for the calendar ids you name. Free time is the complement.", {
+    start: z.string().min(1),
+    end: z.string().min(1),
+    calendars: z.array(z.string()).optional(),
+    account: accountArg,
+}, async ({ start, end, calendars, account }) => {
+    if (!ACCOUNT_ID)
+        return refuseNoAccount("google-calendar-freebusy");
+    try {
+        return ok(await runCalendarFreebusy(getConfig(account), { start, end, calendars }));
+    }
+    catch (err) {
+        return fail(`google-calendar-freebusy failed: ${err.message}`);
+    }
+});
+lifelineTool(server, "google-account-info", "Auth state for one connected Google account: connected, whether its access token is near expiry, and the granted scopes. Local stores only.", { email: z.string().min(1) }, async ({ email }) => {
+    if (!ACCOUNT_ID)
+        return refuseNoAccount("google-account-info");
+    try {
+        return ok(runAccountInfo({ accountId: ACCOUNT_ID, accountsDir: ACCOUNTS_DIR, email }));
+    }
+    catch (err) {
+        return fail(`google-account-info failed: ${err.message}`);
+    }
+});
+lifelineTool(server, "google-account-list", "Every Google account connected to this account, each with its own status. Local stores only, no network. A count alone is not 'connected' — check each status.", {}, async () => {
+    if (!ACCOUNT_ID)
+        return refuseNoAccount("google-account-list");
+    try {
+        return ok(runAccountList({ accountId: ACCOUNT_ID, accountsDir: ACCOUNTS_DIR }));
+    }
+    catch (err) {
+        return fail(`google-account-list failed: ${err.message}`);
+    }
+});
+const transport = new StdioServerTransport();
+await server.connect(transport);
+process.stderr.write(`[google-mcp] ready account=${ACCOUNT_ID ?? "null"}\n`);
+//# sourceMappingURL=index.js.map

package/payload/platform/plugins/google/mcp/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAEnD,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAEnC,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACtB,aAAa,GACd,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,4CAA4C,CAAC;AAE1E,4EAA4E;AAC5E,8EAA8E;AAC9E,2EAA2E;AAC3E,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC;AAClD,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;AACjE,MAAM,YAAY,GAAG,OAAO,CAAC,aAAa,EAAE,IAAI,EAAE,eAAe,CAAC,CAAC;AACnE,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,EAAE,CAAC;AAC5D,MAAM,kBAAkB,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,EAAE,CAAC;AAChE,4EAA4E;AAC5E,2EAA2E;AAC3E,0EAA0E;AAC1E,6EAA6E;AAC7E,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,EAAE,CAAC;AACjE,yEAAyE;AACzE,MAAM,cAAc,GAAG,IAAI,CAAC,aAAa,EAAE,QAAQ,EAAE,kBAAkB,CAAC,CAAC;AAEzE,2EAA2E;AAC3E,+EAA+E;AAC/E,yDAAyD;AACzD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,+BAA+B,UAAU,IAAI,MAAM,uBAAuB,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,yBAAyB,kBAAkB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,qBAAqB,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,uBAAuB,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,IAAI,CAC5S,CAAC;AAEF,SAAS,eAAe,CAAC,QAAgB;IACvC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,QAAQ,qCAAqC,CAAC,CAAC;IACzF,OAAO;QACL,OAAO,EAAE;YACP;gBACE,IAAI,EAAE,MAAe;gBACrB,IAAI,EAAE,GAAG,QAAQ,yJAAyJ;aAC3K;SACF;QACD,OAAO,EAAE,IAAI;KACd,CAAC;AACJ,CAAC;AAED,SAAS,EAAE,CAAC,OAAgB;IAC1B,OAAO;QACL,OAAO,EAAE;YACP;gBACE,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;aAC/E;SACF;KACF,CAAC;AACJ,CAAC;AAED,SAAS,IAAI,CAAC,OAAe;IAI3B,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AACvE,CAAC;AAED;qEACqE;AACrE,MAAM,UAAU,GAAG,CAAC;KACjB,MAAM,EAAE;KACR,QAAQ,EAAE;KACV,QAAQ,CACP,gMAAgM,CACjM,CAAC;AAEJ;;;;;GAKG;AACH,SAAS,SAAS,CAAC,OAAgB;IACjC,IAAI,CAAC,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IAClG,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,sGAAsG,CACvG,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,aAAa,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAC1D,IAAI,GAAW,CAAC;IAChB,IAAI,OAAO,EAAE,CAAC;QACZ,GAAG,GAAG,OAAO,CAAC;IAChB,CAAC;SAAM,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClC,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC3B,CAAC;SAAM,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAC;IAC/F,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,KAAK,CACb,8CAA8C,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,uCAAuC,CAC9H,CAAC;IACJ,CAAC;IACD,GAAG,CAAC;QACF,GAAG,EAAE,cAAc;QACnB,EAAE,EAAE,cAAc;QAClB,OAAO,EAAE,UAAU;QACnB,MAAM,EAAE,GAAG;QACX,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM;KACjC,CAAC,CAAC;IACH,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,oMAAoM,CACrM,CAAC;IACJ,CAAC;IACD,OAAO;QACL,SAAS,EAAE,UAAU;QACrB,QAAQ,EAAE,gBAAgB;QAC1B,KAAK,EAAE,IAAI,UAAU,CAAC,UAAU,EAAE,YAAY,EAAE,GAAG,CAAC;QACpD,eAAe,EAAE,oBAAoB,gBAAgB,2BAA2B;KACjF,CAAC;AACJ,CAAC;AAED,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;AAEnE,YAAY,CACV,MAAM,EACN,yBAAyB,EACzB,0RAA0R,EAC1R,EAAE,EACF,KAAK,IAAI,EAAE;IACT,IAAI,CAAC,UAAU;QAAE,OAAO,eAAe,CAAC,yBAAyB,CAAC,CAAC;IACnE,IAAI,CAAC;QACH,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,OAAO,IAAI,CACT,sGAAsG,CACvG,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACxB,OAAO,IAAI,CACT,gHAAgH,CACjH,CAAC;QACJ,CAAC;QACD,wEAAwE;QACxE,uEAAuE;QACvE,wEAAwE;QACxE,mEAAmE;QACnE,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;YAChC,OAAO,IAAI,CACT,oEAAoE,cAAc,sMAAsM,CACzR,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,uBAAuB,CAAC;YACxC,SAAS,EAAE,UAAU;YACrB,WAAW,EAAE,YAAY;YACzB,QAAQ,EAAE,gBAAgB;YAC1B,UAAU,EAAE,kBAAkB;SAC/B,CAAC,CAAC;QACH,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC;IACjB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,IAAI,CAAC,mCAAoC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IAC3E,CAAC;AACH,CAAC,CACF,CAAC;AAEF,YAAY,CACV,MAAM,EACN,8BAA8B,EAC9B,wJAAwJ,EACxJ,EAAE,EACF,KAAK,IAAI,EAAE;IACT,IAAI,CAAC,UAAU;QAAE,OAAO,eAAe,CAAC,8BAA8B,CAAC,CAAC;IACxE,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,MAAM,sBAAsB,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC;IAChG,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,IAAI,CAAC,wCAAyC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IAChF,CAAC;AACH,CAAC,CACF,CAAC;AAEF,YAAY,CACV,MAAM,EACN,sBAAsB,EACtB,wMAAwM,EACxM;IACE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACtD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACvD,OAAO,EAAE,UAAU;CACpB,EACD,KAAK,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,EAAE;IAC3C,IAAI,CAAC,UAAU;QAAE,OAAO,eAAe,CAAC,sBAAsB,CAAC,CAAC;IAChE,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,MAAM,eAAe,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;IAClF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,IAAI,CAAC,gCAAiC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IACxE,CAAC;AACH,CAAC,CACF,CAAC;AAEF,YAAY,CACV,MAAM,EACN,uBAAuB,EACvB,sCAAsC,EACtC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,EACnD,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE;IAC7B,IAAI,CAAC,UAAU;QAAE,OAAO,eAAe,CAAC,uBAAuB,CAAC,CAAC;IACjE,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,MAAM,gBAAgB,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IACrE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,IAAI,CAAC,iCAAkC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IACzE,CAAC;AACH,CAAC,CACF,CAAC;AAEF,YAAY,CACV,MAAM,EACN,wBAAwB,EACxB,6JAA6J,EAC7J;IACE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACzC,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC9B,OAAO,EAAE,UAAU;CACpB,EACD,KAAK,EAAE,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE;IAC7B,IAAI,CAAC,UAAU;QAAE,OAAO,eAAe,CAAC,wBAAwB,CAAC,CAAC;IAClE,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,MAAM,iBAAiB,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IAC/D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,IAAI,CAAC,kCAAmC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC,CACF,CAAC;AAEF,YAAY,CACV,MAAM,EACN,wBAAwB,EACxB,uIAAuI,EACvI;IACE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACzC,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC9B,OAAO,EAAE,UAAU;CACpB,EACD,KAAK,EAAE,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE;IAC7B,IAAI,CAAC,UAAU;QAAE,OAAO,eAAe,CAAC,wBAAwB,CAAC,CAAC;IAClE,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,MAAM,iBAAiB,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IAC/D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,IAAI,CAAC,kCAAmC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC,CACF,CAAC;AAEF,YAAY,CACV,MAAM,EACN,wBAAwB,EACxB,iEAAiE,EACjE,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,EACnD,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE;IAC7B,IAAI,CAAC,UAAU;QAAE,OAAO,eAAe,CAAC,wBAAwB,CAAC,CAAC;IAClE,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,MAAM,iBAAiB,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IACtE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,IAAI,CAAC,kCAAmC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC,CACF,CAAC;AAEF,YAAY,CACV,MAAM,EACN,yBAAyB,EACzB,kJAAkJ,EAClJ;IACE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;IACvD,OAAO,EAAE,UAAU;CACpB,EACD,KAAK,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE;IACvC,IAAI,CAAC,UAAU;QAAE,OAAO,eAAe,CAAC,yBAAyB,CAAC,CAAC;IACnE,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,MAAM,kBAAkB,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;IACjF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,IAAI,CAAC,mCAAoC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IAC3E,CAAC;AACH,CAAC,CACF,CAAC;AAEF,YAAY,CACV,MAAM,EACN,0BAA0B,EAC1B,4IAA4I,EAC5I;IACE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACzC,OAAO,EAAE,UAAU;CACpB,EACD,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,EAAE;IAC3C,IAAI,CAAC,UAAU;QAAE,OAAO,eAAe,CAAC,0BAA0B,CAAC,CAAC;IACpE,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,MAAM,mBAAmB,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IACtF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,IAAI,CAAC,oCAAqC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5E,CAAC;AACH,CAAC,CACF,CAAC;AAEF,YAAY,CACV,MAAM,EACN,qBAAqB,EACrB,6IAA6I,EAC7I,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAC5B,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;IAClB,IAAI,CAAC,UAAU;QAAE,OAAO,eAAe,CAAC,qBAAqB,CAAC,CAAC;IAC/D,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,cAAc,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACzF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,IAAI,CAAC,+BAAgC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IACvE,CAAC;AACH,CAAC,CACF,CAAC;AAEF,YAAY,CACV,MAAM,EACN,qBAAqB,EACrB,gKAAgK,EAChK,EAAE,EACF,KAAK,IAAI,EAAE;IACT,IAAI,CAAC,UAAU;QAAE,OAAO,eAAe,CAAC,qBAAqB,CAAC,CAAC;IAC/D,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,cAAc,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC;IAClF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,IAAI,CAAC,+BAAgC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IACvE,CAAC;AACH,CAAC,CACF,CAAC;AAEF,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;AAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;AAChC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,8BAA8B,UAAU,IAAI,MAAM,IAAI,CAAC,CAAC"}

package/payload/platform/plugins/google/mcp/dist/lib/google-client.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Authenticated access to Google Calendar API v3.
+ *
+ * Refresh is delegated to platform/ui rather than performed here. A
+ * Web-application OAuth client must present its client_secret at Google's
+ * token endpoint, and that secret is house-only (${PLATFORM_ROOT}/config/
+ * google-house.env) — it must never reach a per-account MCP spawn. The server
+ * holds it and exposes POST /api/google/oauth/refresh for this purpose.
+ */
+import { TokenStore, type TokenBlob } from "../auth/token-store.js";
+export interface GoogleConfig {
+    accountId: string;
+    clientId: string;
+    store: TokenStore;
+    /** Loopback URL of the platform/ui route that holds the client secret. */
+    refreshEndpoint: string;
+}
+export declare function buildQuery(q: Record<string, string | number | undefined>): string;
+export declare function isExpiring(blob: TokenBlob): boolean;
+export declare function callCalendar<T>(config: GoogleConfig, path: string, init?: {
+    method?: string;
+    body?: unknown;
+    query?: Record<string, string | number | undefined>;
+}): Promise<T>;
+/** The primary calendar's id IS the account's email address. Used instead of a
+ *  userinfo call, because the identity scopes are deliberately not requested. */
+export declare function resolvePrimaryEmail(config: GoogleConfig): Promise<string>;
+//# sourceMappingURL=google-client.d.ts.map

package/payload/platform/plugins/google/mcp/dist/lib/google-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"google-client.d.ts","sourceRoot":"","sources":["../../src/lib/google-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,UAAU,EAAwB,KAAK,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAK1F,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,UAAU,CAAC;IAClB,0EAA0E;IAC1E,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,wBAAgB,UAAU,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC,GAAG,MAAM,CAOjF;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAEnD;AA6CD,wBAAsB,YAAY,CAAC,CAAC,EAClC,MAAM,EAAE,YAAY,EACpB,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE;IACJ,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC,CAAC;CAChD,GACL,OAAO,CAAC,CAAC,CAAC,CA8BZ;AAED;iFACiF;AACjF,wBAAsB,mBAAmB,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAG/E"}

package/payload/platform/plugins/google/mcp/dist/lib/google-client.js

@@ -0,0 +1,102 @@
+/**
+ * Authenticated access to Google Calendar API v3.
+ *
+ * Refresh is delegated to platform/ui rather than performed here. A
+ * Web-application OAuth client must present its client_secret at Google's
+ * token endpoint, and that secret is house-only (${PLATFORM_ROOT}/config/
+ * google-house.env) — it must never reach a per-account MCP spawn. The server
+ * holds it and exposes POST /api/google/oauth/refresh for this purpose.
+ */
+import { REFRESH_THRESHOLD_MS } from "../auth/token-store.js";
+import { log } from "./log.js";
+const CALENDAR_BASE = "https://www.googleapis.com/calendar/v3";
+export function buildQuery(q) {
+    const parts = [];
+    for (const [k, v] of Object.entries(q)) {
+        if (v === undefined)
+            continue;
+        parts.push(`${encodeURIComponent(k)}=${encodeURIComponent(String(v))}`);
+    }
+    return parts.length ? `?${parts.join("&")}` : "";
+}
+export function isExpiring(blob) {
+    return blob.accessTokenExpiry - Date.now() <= REFRESH_THRESHOLD_MS;
+}
+/**
+ * Refresh through platform/ui. An IO or HTTP failure here NEVER clears held
+ * tokens — it throws, leaving the store untouched, so a transient outage
+ * cannot cost the account its credentials (Task 1601's lesson applied to the
+ * refresh path rather than the write path).
+ */
+async function refresh(config, blob) {
+    if (!blob.refreshToken) {
+        throw new Error("no refresh token held for this Google account; run google-account-register");
+    }
+    const res = await fetch(config.refreshEndpoint, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ accountId: config.accountId, refreshToken: blob.refreshToken }),
+    });
+    const text = await res.text();
+    if (!res.ok) {
+        log({
+            tag: "[google-mcp]",
+            op: "refresh-failed",
+            account: config.accountId,
+            status: res.status,
+            body: text.slice(0, 300),
+        });
+        throw new Error(`token refresh failed (${res.status}): ${text.slice(0, 300)}`);
+    }
+    const json = JSON.parse(text);
+    const next = config.store.store(json.access_token, null, json.expires_in, {
+        scopes: json.scope ? json.scope.split(" ") : undefined,
+    });
+    log({ tag: "[google-mcp]", op: "refresh-ok", account: config.accountId, ttlSec: json.expires_in });
+    return next;
+}
+async function accessToken(config) {
+    const blob = config.store.read();
+    if (!blob) {
+        throw new Error("no Google account connected for this account; run google-account-register");
+    }
+    if (!isExpiring(blob))
+        return blob.accessToken;
+    return (await refresh(config, blob)).accessToken;
+}
+export async function callCalendar(config, path, init = {}) {
+    const token = await accessToken(config);
+    const url = `${CALENDAR_BASE}${path}${buildQuery(init.query ?? {})}`;
+    const res = await fetch(url, {
+        method: init.method ?? "GET",
+        headers: {
+            authorization: `Bearer ${token}`,
+            ...(init.body === undefined ? {} : { "content-type": "application/json" }),
+        },
+        body: init.body === undefined ? undefined : JSON.stringify(init.body),
+    });
+    const text = await res.text();
+    if (!res.ok) {
+        // Cardinal observability rule: never discard an error body.
+        log({
+            tag: "[google-mcp]",
+            op: "api-error",
+            account: config.accountId,
+            path,
+            status: res.status,
+            body: text.slice(0, 500),
+        });
+        if (res.status === 403 && text.includes("insufficient")) {
+            throw new Error(`Google refused this call for missing scope (403). The connected account granted a narrower consent than https://www.googleapis.com/auth/calendar. Re-run google-account-register to re-consent. Body: ${text.slice(0, 300)}`);
+        }
+        throw new Error(`Google Calendar API ${res.status}: ${text.slice(0, 300)}`);
+    }
+    return (text ? JSON.parse(text) : {});
+}
+/** The primary calendar's id IS the account's email address. Used instead of a
+ *  userinfo call, because the identity scopes are deliberately not requested. */
+export async function resolvePrimaryEmail(config) {
+    const cal = await callCalendar(config, "/calendars/primary");
+    return cal.id;
+}
+//# sourceMappingURL=google-client.js.map

package/payload/platform/plugins/google/mcp/dist/lib/google-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"google-client.js","sourceRoot":"","sources":["../../src/lib/google-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAc,oBAAoB,EAAkB,MAAM,wBAAwB,CAAC;AAC1F,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAE/B,MAAM,aAAa,GAAG,wCAAwC,CAAC;AAU/D,MAAM,UAAU,UAAU,CAAC,CAA8C;IACvE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,IAAI,CAAC,KAAK,SAAS;YAAE,SAAS;QAC9B,KAAK,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,CAAC,CAAC,IAAI,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAe;IACxC,OAAO,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,oBAAoB,CAAC;AACrE,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,OAAO,CAAC,MAAoB,EAAE,IAAe;IAC1D,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAC;IAChG,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,eAAe,EAAE;QAC9C,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC;KACvF,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,GAAG,CAAC;YACF,GAAG,EAAE,cAAc;YACnB,EAAE,EAAE,gBAAgB;YACpB,OAAO,EAAE,MAAM,CAAC,SAAS;YACzB,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;SACzB,CAAC,CAAC;QACH,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,CAAC,MAAM,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IACjF,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAiE,CAAC;IAC9F,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE;QACxE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;KACvD,CAAC,CAAC;IACH,GAAG,CAAC,EAAE,GAAG,EAAE,cAAc,EAAE,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;IACnG,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,MAAoB;IAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IACjC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAC;IAC/F,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,WAAW,CAAC;IAC/C,OAAO,CAAC,MAAM,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC;AACnD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAAoB,EACpB,IAAY,EACZ,OAII,EAAE;IAEN,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,GAAG,GAAG,GAAG,aAAa,GAAG,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC;IACrE,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAC3B,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,KAAK;QAC5B,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,KAAK,EAAE;YAChC,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;SAC3E;QACD,IAAI,EAAE,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;KACtE,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,4DAA4D;QAC5D,GAAG,CAAC;YACF,GAAG,EAAE,cAAc;YACnB,EAAE,EAAE,WAAW;YACf,OAAO,EAAE,MAAM,CAAC,SAAS;YACzB,IAAI;YACJ,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;SACzB,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CACb,yMAAyM,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAC9N,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,uBAAuB,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,EAAQ,CAAM,CAAC;AACpD,CAAC;AAED;iFACiF;AACjF,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,MAAoB;IAC5D,MAAM,GAAG,GAAG,MAAM,YAAY,CAAiB,MAAM,EAAE,oBAAoB,CAAC,CAAC;IAC7E,OAAO,GAAG,CAAC,EAAE,CAAC;AAChB,CAAC"}

package/payload/platform/plugins/google/mcp/dist/lib/log.d.ts

@@ -0,0 +1,3 @@
+/** One structured stderr line. Never throws; logging must not break a tool. */
+export declare function log(fields: Record<string, string | number | boolean | null | undefined>): void;
+//# sourceMappingURL=log.d.ts.map

package/payload/platform/plugins/google/mcp/dist/lib/log.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"log.d.ts","sourceRoot":"","sources":["../../src/lib/log.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,wBAAgB,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,GAAG,SAAS,CAAC,GAAG,IAAI,CAW9F"}