@rubytech/create-maxy-code 0.1.472 → 0.1.473

package/payload/platform/plugins/google/mcp/dist/lib/google-client.d.ts

@@ -1,26 +1,29 @@
 /**
  * Authenticated access to Google Calendar API v3.
  *
- * Refresh is delegated to platform/ui rather than performed here. A
- * Web-application OAuth client must present its client_secret at Google's
- * token endpoint, and that secret is house-only (${PLATFORM_ROOT}/config/
- * google-house.env) — it must never reach a per-account MCP spawn. The server
- * holds it and exposes POST /api/google/oauth/refresh for this purpose.
+ * Refresh happens HERE, direct to Google. The vendor app is a Desktop
+ * (installed app) client, whose secret ships in brand config — Google states an
+ * installed-app secret "is obviously not treated as a secret" — so there is no
+ * server-side holder to delegate to and no reason to route through one.
  */
 import { TokenStore, type TokenBlob } from "../auth/token-store.js";
 export interface GoogleConfig {
     accountId: string;
     clientId: string;
+    /** Ships in brand config alongside the client id. Sanctioned for installed
+     *  apps; PKCE remains the protection against an intercepted code. */
+    clientSecret: string;
     store: TokenStore;
-    /** Loopback URL of the platform/ui route that holds the client secret. */
-    refreshEndpoint: string;
 }
 export declare function buildQuery(q: Record<string, string | number | undefined>): string;
 export declare function isExpiring(blob: TokenBlob): boolean;
+/** Test seam. Production callers reach this through callCalendar. */
+export declare function accessTokenForTest(config: GoogleConfig, doFetch: typeof fetch): Promise<string>;
 export declare function callCalendar<T>(config: GoogleConfig, path: string, init?: {
     method?: string;
     body?: unknown;
     query?: Record<string, string | number | undefined>;
+    fetchImpl?: typeof fetch;
 }): Promise<T>;
 /** The primary calendar's id IS the account's email address. Used instead of a
  *  userinfo call, because the identity scopes are deliberately not requested. */

package/payload/platform/plugins/google/mcp/dist/lib/google-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"google-client.d.ts","sourceRoot":"","sources":["../../src/lib/google-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,UAAU,EAAwB,KAAK,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAK1F,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,UAAU,CAAC;IAClB,0EAA0E;IAC1E,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,wBAAgB,UAAU,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC,GAAG,MAAM,CAOjF;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAEnD;AA6CD,wBAAsB,YAAY,CAAC,CAAC,EAClC,MAAM,EAAE,YAAY,EACpB,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE;IACJ,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC,CAAC;CAChD,GACL,OAAO,CAAC,CAAC,CAAC,CA8BZ;AAED;iFACiF;AACjF,wBAAsB,mBAAmB,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAG/E"}
+{"version":3,"file":"google-client.d.ts","sourceRoot":"","sources":["../../src/lib/google-client.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,UAAU,EAAwB,KAAK,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAM1F,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB;yEACqE;IACrE,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,UAAU,CAAC;CACnB;AAED,wBAAgB,UAAU,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC,GAAG,MAAM,CAOjF;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAEnD;AAwDD,qEAAqE;AACrE,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,YAAY,EACpB,OAAO,EAAE,OAAO,KAAK,GACpB,OAAO,CAAC,MAAM,CAAC,CAEjB;AAED,wBAAsB,YAAY,CAAC,CAAC,EAClC,MAAM,EAAE,YAAY,EACpB,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE;IACJ,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC,CAAC;IACpD,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CACrB,GACL,OAAO,CAAC,CAAC,CAAC,CA+BZ;AAED;iFACiF;AACjF,wBAAsB,mBAAmB,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAG/E"}

package/payload/platform/plugins/google/mcp/dist/lib/google-client.js

@@ -1,15 +1,15 @@
 /**
  * Authenticated access to Google Calendar API v3.
  *
- * Refresh is delegated to platform/ui rather than performed here. A
- * Web-application OAuth client must present its client_secret at Google's
- * token endpoint, and that secret is house-only (${PLATFORM_ROOT}/config/
- * google-house.env) — it must never reach a per-account MCP spawn. The server
- * holds it and exposes POST /api/google/oauth/refresh for this purpose.
+ * Refresh happens HERE, direct to Google. The vendor app is a Desktop
+ * (installed app) client, whose secret ships in brand config — Google states an
+ * installed-app secret "is obviously not treated as a secret" — so there is no
+ * server-side holder to delegate to and no reason to route through one.
  */
 import { REFRESH_THRESHOLD_MS } from "../auth/token-store.js";
 import { log } from "./log.js";
 const CALENDAR_BASE = "https://www.googleapis.com/calendar/v3";
+const TOKEN_URL = "https://oauth2.googleapis.com/token";
 export function buildQuery(q) {
     const parts = [];
     for (const [k, v] of Object.entries(q)) {
@@ -28,14 +28,19 @@ export function isExpiring(blob) {
  * cannot cost the account its credentials (Task 1601's lesson applied to the
  * refresh path rather than the write path).
  */
-async function refresh(config, blob) {
+async function refresh(config, blob, doFetch) {
     if (!blob.refreshToken) {
         throw new Error("no refresh token held for this Google account; run google-account-register");
     }
-    const res = await fetch(config.refreshEndpoint, {
+    const res = await doFetch(TOKEN_URL, {
         method: "POST",
-        headers: { "content-type": "application/json" },
-        body: JSON.stringify({ accountId: config.accountId, refreshToken: blob.refreshToken }),
+        headers: { "content-type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({
+            client_id: config.clientId,
+            client_secret: config.clientSecret,
+            refresh_token: blob.refreshToken,
+            grant_type: "refresh_token",
+        }),
     });
     const text = await res.text();
     if (!res.ok) {
@@ -46,6 +51,8 @@ async function refresh(config, blob) {
             status: res.status,
             body: text.slice(0, 300),
         });
+        // Throwing leaves the store untouched, so a transient outage never costs
+        // the account its credentials.
         throw new Error(`token refresh failed (${res.status}): ${text.slice(0, 300)}`);
     }
     const json = JSON.parse(text);
@@ -55,19 +62,24 @@ async function refresh(config, blob) {
     log({ tag: "[google-mcp]", op: "refresh-ok", account: config.accountId, ttlSec: json.expires_in });
     return next;
 }
-async function accessToken(config) {
+async function accessToken(config, doFetch) {
     const blob = config.store.read();
     if (!blob) {
         throw new Error("no Google account connected for this account; run google-account-register");
     }
     if (!isExpiring(blob))
         return blob.accessToken;
-    return (await refresh(config, blob)).accessToken;
+    return (await refresh(config, blob, doFetch)).accessToken;
+}
+/** Test seam. Production callers reach this through callCalendar. */
+export async function accessTokenForTest(config, doFetch) {
+    return accessToken(config, doFetch);
 }
 export async function callCalendar(config, path, init = {}) {
-    const token = await accessToken(config);
+    const doFetch = init.fetchImpl ?? fetch;
+    const token = await accessToken(config, doFetch);
     const url = `${CALENDAR_BASE}${path}${buildQuery(init.query ?? {})}`;
-    const res = await fetch(url, {
+    const res = await doFetch(url, {
         method: init.method ?? "GET",
         headers: {
             authorization: `Bearer ${token}`,

package/payload/platform/plugins/google/mcp/dist/lib/google-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"google-client.js","sourceRoot":"","sources":["../../src/lib/google-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAc,oBAAoB,EAAkB,MAAM,wBAAwB,CAAC;AAC1F,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAE/B,MAAM,aAAa,GAAG,wCAAwC,CAAC;AAU/D,MAAM,UAAU,UAAU,CAAC,CAA8C;IACvE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,IAAI,CAAC,KAAK,SAAS;YAAE,SAAS;QAC9B,KAAK,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,CAAC,CAAC,IAAI,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAe;IACxC,OAAO,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,oBAAoB,CAAC;AACrE,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,OAAO,CAAC,MAAoB,EAAE,IAAe;IAC1D,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAC;IAChG,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,eAAe,EAAE;QAC9C,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC;KACvF,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,GAAG,CAAC;YACF,GAAG,EAAE,cAAc;YACnB,EAAE,EAAE,gBAAgB;YACpB,OAAO,EAAE,MAAM,CAAC,SAAS;YACzB,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;SACzB,CAAC,CAAC;QACH,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,CAAC,MAAM,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IACjF,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAiE,CAAC;IAC9F,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE;QACxE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;KACvD,CAAC,CAAC;IACH,GAAG,CAAC,EAAE,GAAG,EAAE,cAAc,EAAE,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;IACnG,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,MAAoB;IAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IACjC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAC;IAC/F,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,WAAW,CAAC;IAC/C,OAAO,CAAC,MAAM,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC;AACnD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAAoB,EACpB,IAAY,EACZ,OAII,EAAE;IAEN,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,GAAG,GAAG,GAAG,aAAa,GAAG,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC;IACrE,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAC3B,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,KAAK;QAC5B,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,KAAK,EAAE;YAChC,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;SAC3E;QACD,IAAI,EAAE,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;KACtE,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,4DAA4D;QAC5D,GAAG,CAAC;YACF,GAAG,EAAE,cAAc;YACnB,EAAE,EAAE,WAAW;YACf,OAAO,EAAE,MAAM,CAAC,SAAS;YACzB,IAAI;YACJ,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;SACzB,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CACb,yMAAyM,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAC9N,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,uBAAuB,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,EAAQ,CAAM,CAAC;AACpD,CAAC;AAED;iFACiF;AACjF,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,MAAoB;IAC5D,MAAM,GAAG,GAAG,MAAM,YAAY,CAAiB,MAAM,EAAE,oBAAoB,CAAC,CAAC;IAC7E,OAAO,GAAG,CAAC,EAAE,CAAC;AAChB,CAAC"}
+{"version":3,"file":"google-client.js","sourceRoot":"","sources":["../../src/lib/google-client.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAc,oBAAoB,EAAkB,MAAM,wBAAwB,CAAC;AAC1F,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAE/B,MAAM,aAAa,GAAG,wCAAwC,CAAC;AAC/D,MAAM,SAAS,GAAG,qCAAqC,CAAC;AAWxD,MAAM,UAAU,UAAU,CAAC,CAA8C;IACvE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,IAAI,CAAC,KAAK,SAAS;YAAE,SAAS;QAC9B,KAAK,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,CAAC,CAAC,IAAI,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAe;IACxC,OAAO,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,oBAAoB,CAAC;AACrE,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,OAAO,CACpB,MAAoB,EACpB,IAAe,EACf,OAAqB;IAErB,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAC;IAChG,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,SAAS,EAAE;QACnC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,IAAI,eAAe,CAAC;YACxB,SAAS,EAAE,MAAM,CAAC,QAAQ;YAC1B,aAAa,EAAE,MAAM,CAAC,YAAY;YAClC,aAAa,EAAE,IAAI,CAAC,YAAY;YAChC,UAAU,EAAE,eAAe;SAC5B,CAAC;KACH,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,GAAG,CAAC;YACF,GAAG,EAAE,cAAc;YACnB,EAAE,EAAE,gBAAgB;YACpB,OAAO,EAAE,MAAM,CAAC,SAAS;YACzB,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;SACzB,CAAC,CAAC;QACH,yEAAyE;QACzE,+BAA+B;QAC/B,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,CAAC,MAAM,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IACjF,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAiE,CAAC;IAC9F,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE;QACxE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;KACvD,CAAC,CAAC;IACH,GAAG,CAAC,EAAE,GAAG,EAAE,cAAc,EAAE,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;IACnG,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,MAAoB,EAAE,OAAqB;IACpE,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IACjC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAC;IAC/F,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,WAAW,CAAC;IAC/C,OAAO,CAAC,MAAM,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC;AAC5D,CAAC;AAED,qEAAqE;AACrE,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAoB,EACpB,OAAqB;IAErB,OAAO,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAAoB,EACpB,IAAY,EACZ,OAKI,EAAE;IAEN,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IACxC,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjD,MAAM,GAAG,GAAG,GAAG,aAAa,GAAG,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC;IACrE,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE;QAC7B,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,KAAK;QAC5B,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,KAAK,EAAE;YAChC,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;SAC3E;QACD,IAAI,EAAE,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;KACtE,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,4DAA4D;QAC5D,GAAG,CAAC;YACF,GAAG,EAAE,cAAc;YACnB,EAAE,EAAE,WAAW;YACf,OAAO,EAAE,MAAM,CAAC,SAAS;YACzB,IAAI;YACJ,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;SACzB,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CACb,yMAAyM,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAC9N,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,uBAAuB,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,EAAQ,CAAM,CAAC;AACpD,CAAC;AAED;iFACiF;AACjF,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,MAAoB;IAC5D,MAAM,GAAG,GAAG,MAAM,YAAY,CAAiB,MAAM,EAAE,oBAAoB,CAAC,CAAC;IAC7E,OAAO,GAAG,CAAC,EAAE,CAAC;AAChB,CAAC"}

package/payload/platform/plugins/google/mcp/dist/tools/account-register.d.ts

@@ -6,26 +6,32 @@ export declare function newPkce(): {
     verifier: string;
     challenge: string;
 };
-/** The `state` value carries BOTH the account id and the nonce, as
- *  `<accountId>.<nonce>`.
+/** Desktop (installed app) clients permit ONLY loopback redirects. https is
+ *  rejected outright and custom URI schemes are withdrawn, so this is the whole
+ *  option space.
  *
- *  It cannot ride on the redirect_uri: Google requires redirect_uri to match a
- *  registered value EXACTLY, so a per-request query parameter makes every
- *  authorization request fail with redirect_uri_mismatch. Google's own guidance
- *  names `state` as the mechanism for per-request application state.
+ *  The IP literal is mandatory. RFC 8252 s7.3 makes the port irrelevant when
+ *  matching a loopback redirect, but only for `127.0.0.1` / `::1` — NOT for the
+ *  hostname `localhost`, which strict servers match literally.
  *
- *  Putting the account id in an attacker-visible field is safe because it is
- *  routing information, not authorisation: the callback still requires the
- *  nonce half to equal the one stored in that account's pending entry, and an
- *  attacker cannot produce a valid nonce for an account they do not control. */
-export declare function encodeState(accountId: string, nonce: string): string;
-export declare function decodeState(state: string): {
-    accountId: string;
-    nonce: string;
-} | null;
+ *  Nothing listens on this port, by design: the consenting browser is on the
+ *  user's own phone, so the redirect fails to load and the user copies the code
+ *  out of the address bar. The value is fixed so the consent URL is
+ *  deterministic and one register's logs compare against another's. */
+export declare const LOOPBACK_REDIRECT_URI = "http://127.0.0.1:8571";
+/** `state` is an opaque CSRF nonce and nothing more.
+ *
+ *  It deliberately does NOT carry the account id. Under the Desktop flow the
+ *  pending entry is keyed on the spawn's own ACCOUNT_ID, so submit can only ever
+ *  read its own account's pending, and PKCE binds the code to that entry's
+ *  verifier. Routing information in `state` would therefore buy nothing, while
+ *  putting an account uuid into a URL opened on a personal phone, stored in
+ *  browser history and Google's logs, and pasted back through chat.
+ *
+ *  (Task 1761 encoded `<accountId>.<nonce>` because a shared hosted callback had
+ *  to route an inbound request to an account. That callback is gone.) */
 export declare function buildConsentUrl(args: {
     clientId: string;
-    redirectUri: string;
     state: string;
     challenge: string;
     accountId: string;
@@ -42,7 +48,6 @@ export declare function runAccountRegisterStart(args: {
     accountId: string;
     accountsDir: string;
     clientId: string;
-    publicBase: string;
 }): Promise<{
     status: "pending" | "in-progress";
     consentUrl?: string;
@@ -56,4 +61,40 @@ export declare function runAccountRegisterPoll(args: {
     accounts: ConnectedAccount[];
     ageSec?: number;
 }>;
+/** Users paste what they can see, and what they can see is Google's loopback
+ *  redirect — which ALWAYS carries `scope` alongside `code`, and often
+ *  `authuser` and `prompt` too. So the realistic pastes are a whole URL or a
+ *  `code=…&scope=…` fragment, not a bare value.
+ *
+ *  Extracting `code` properly matters because a mangled value reaches Google as
+ *  an opaque string and comes back `invalid_grant`, which reads to the user as
+ *  "your code expired" and sends them round the consent loop again. It never
+ *  says the paste was the problem.
+ *
+ *  A malformed percent escape must not throw either: `decodeURIComponent` raises
+ *  URIError on a stray `%`, and surfacing that instead of Google's own error
+ *  would be our parser blaming the user for a value Google would have explained.
+ */
+export declare function normalisePastedCode(raw: string): string;
+/**
+ * Finish a registration from the code the user pasted back.
+ *
+ * The exchange happens HERE, in the plugin, because a Desktop client's secret
+ * ships in brand config — there is no server-side holder to delegate to. The
+ * redirect_uri sent here is the same constant the consent URL carried; Google
+ * compares them byte for byte.
+ */
+export declare function runAccountRegisterSubmit(args: {
+    accountId: string;
+    accountsDir: string;
+    clientId: string;
+    clientSecret: string;
+    code: string;
+    fetchImpl?: typeof fetch;
+}): Promise<{
+    status: "registered";
+    email: string;
+    refreshTokenIssued: boolean;
+    warning?: string;
+}>;
 //# sourceMappingURL=account-register.d.ts.map

package/payload/platform/plugins/google/mcp/dist/tools/account-register.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"account-register.d.ts","sourceRoot":"","sources":["../../src/tools/account-register.ts"],"names":[],"mappings":"AAgBA,eAAO,MAAM,cAAc,6CAA6C,CAAC;AAGzE;qDACqD;AACrD,eAAO,MAAM,oBAAoB,MAAM,CAAC;AAExC,wBAAgB,OAAO,IAAI;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAGjE;AAED;;;;;;;;;;;gFAWgF;AAChF,wBAAgB,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAEpE;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAItF;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB,GAAG,MAAM,CAeT;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,IAAI,GAAG,YAAY,CAAC;CAC7B;AAED;;6DAE6D;AAC7D,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,gBAAgB,EAAE,CAaxF;AAED,wBAAsB,uBAAuB,CAAC,IAAI,EAAE;IAClD,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;CACpB,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,SAAS,GAAG,aAAa,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAgCvF;AAED,wBAAsB,sBAAsB,CAAC,IAAI,EAAE;IACjD,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC;IACV,MAAM,EAAE,YAAY,GAAG,SAAS,GAAG,SAAS,GAAG,MAAM,CAAC;IACtD,QAAQ,EAAE,gBAAgB,EAAE,CAAC;IAC7B,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC,CAUD"}
+{"version":3,"file":"account-register.d.ts","sourceRoot":"","sources":["../../src/tools/account-register.ts"],"names":[],"mappings":"AAiBA,eAAO,MAAM,cAAc,6CAA6C,CAAC;AAKzE;qDACqD;AACrD,eAAO,MAAM,oBAAoB,MAAM,CAAC;AAExC,wBAAgB,OAAO,IAAI;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAGjE;AAED;;;;;;;;;;;uEAWuE;AACvE,eAAO,MAAM,qBAAqB,0BAA0B,CAAC;AAE7D;;;;;;;;;;yEAUyE;AACzE,wBAAgB,eAAe,CAAC,IAAI,EAAE;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB,GAAG,MAAM,CAaT;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,IAAI,GAAG,YAAY,CAAC;CAC7B;AAED;;6DAE6D;AAC7D,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,gBAAgB,EAAE,CAaxF;AAED,wBAAsB,uBAAuB,CAAC,IAAI,EAAE;IAClD,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;CAClB,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,SAAS,GAAG,aAAa,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CA0BvF;AAED,wBAAsB,sBAAsB,CAAC,IAAI,EAAE;IACjD,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC;IACV,MAAM,EAAE,YAAY,GAAG,SAAS,GAAG,SAAS,GAAG,MAAM,CAAC;IACtD,QAAQ,EAAE,gBAAgB,EAAE,CAAC;IAC7B,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC,CAUD;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAoBvD;AAED;;;;;;;GAOG;AACH,wBAAsB,wBAAwB,CAAC,IAAI,EAAE;IACnD,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,kBAAkB,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CA0ElG"}

package/payload/platform/plugins/google/mcp/dist/tools/account-register.js

@@ -2,10 +2,11 @@
  * Register flow: authorization-code + PKCE.
  *
  * `runAccountRegisterStart` mints the PKCE pair and `state`, persists them, and
- * returns a consent URL the operator opens on any device. Google redirects to
- * platform/ui's /api/google/oauth/callback, which holds the client secret,
- * exchanges the code, and writes tokens. `runAccountRegisterPoll` then reports
- * the outcome from local state only — no network.
+ * returns a consent URL the user opens on any device. Google redirects to a
+ * loopback address nothing listens on, so the page fails to load and the user
+ * copies the code from the address bar; `runAccountRegisterSubmit` exchanges it
+ * here, in-process, using the brand-config client secret.
+ * `runAccountRegisterPoll` reports the outcome from local state only.
  */
 import { createHash, randomBytes } from "node:crypto";
 import { existsSync, readdirSync } from "node:fs";
@@ -15,6 +16,8 @@ import { TokenStore } from "../auth/token-store.js";
 import { log } from "../lib/log.js";
 export const CALENDAR_SCOPE = "https://www.googleapis.com/auth/calendar";
 const AUTH_URL = "https://accounts.google.com/o/oauth2/v2/auth";
+const TOKEN_URL = "https://oauth2.googleapis.com/token";
+const PRIMARY_CALENDAR_URL = "https://www.googleapis.com/calendar/v3/calendars/primary";
 /** Google refuses an authorization code older than roughly ten minutes; a
  *  pending entry past that is stranded, not live. */
 export const PENDING_LIFETIME_SEC = 600;
@@ -22,33 +25,34 @@ export function newPkce() {
     const verifier = randomBytes(48).toString("base64url");
     return { verifier, challenge: createHash("sha256").update(verifier).digest("base64url") };
 }
-/** The `state` value carries BOTH the account id and the nonce, as
- *  `<accountId>.<nonce>`.
+/** Desktop (installed app) clients permit ONLY loopback redirects. https is
+ *  rejected outright and custom URI schemes are withdrawn, so this is the whole
+ *  option space.
  *
- *  It cannot ride on the redirect_uri: Google requires redirect_uri to match a
- *  registered value EXACTLY, so a per-request query parameter makes every
- *  authorization request fail with redirect_uri_mismatch. Google's own guidance
- *  names `state` as the mechanism for per-request application state.
+ *  The IP literal is mandatory. RFC 8252 s7.3 makes the port irrelevant when
+ *  matching a loopback redirect, but only for `127.0.0.1` / `::1` — NOT for the
+ *  hostname `localhost`, which strict servers match literally.
  *
- *  Putting the account id in an attacker-visible field is safe because it is
- *  routing information, not authorisation: the callback still requires the
- *  nonce half to equal the one stored in that account's pending entry, and an
- *  attacker cannot produce a valid nonce for an account they do not control. */
-export function encodeState(accountId, nonce) {
-    return `${accountId}.${nonce}`;
-}
-export function decodeState(state) {
-    const idx = state.lastIndexOf(".");
-    if (idx <= 0 || idx === state.length - 1)
-        return null;
-    return { accountId: state.slice(0, idx), nonce: state.slice(idx + 1) };
-}
+ *  Nothing listens on this port, by design: the consenting browser is on the
+ *  user's own phone, so the redirect fails to load and the user copies the code
+ *  out of the address bar. The value is fixed so the consent URL is
+ *  deterministic and one register's logs compare against another's. */
+export const LOOPBACK_REDIRECT_URI = "http://127.0.0.1:8571";
+/** `state` is an opaque CSRF nonce and nothing more.
+ *
+ *  It deliberately does NOT carry the account id. Under the Desktop flow the
+ *  pending entry is keyed on the spawn's own ACCOUNT_ID, so submit can only ever
+ *  read its own account's pending, and PKCE binds the code to that entry's
+ *  verifier. Routing information in `state` would therefore buy nothing, while
+ *  putting an account uuid into a URL opened on a personal phone, stored in
+ *  browser history and Google's logs, and pasted back through chat.
+ *
+ *  (Task 1761 encoded `<accountId>.<nonce>` because a shared hosted callback had
+ *  to route an inbound request to an account. That callback is gone.) */
 export function buildConsentUrl(args) {
-    // redirect_uri is sent VERBATIM — no query string. See encodeState above.
-    const redirect = args.redirectUri;
     const q = new URLSearchParams({
         client_id: args.clientId,
-        redirect_uri: redirect,
+        redirect_uri: LOOPBACK_REDIRECT_URI,
         response_type: "code",
         scope: CALENDAR_SCOPE,
         access_type: "offline",
@@ -91,24 +95,18 @@ export async function runAccountRegisterStart(args) {
         });
         return { status: "in-progress", ageSec: age };
     }
-    const nonce = randomBytes(16).toString("hex");
-    const state = encodeState(args.accountId, nonce);
+    const state = randomBytes(16).toString("hex");
     const { verifier, challenge } = newPkce();
-    log({ tag: "[google-oauth]", op: "register", account: args.accountId, reg: nonce });
-    // The pending entry stores the NONCE, not the composed state: the account is
-    // already implied by which account's store this is, and comparing the nonce
-    // alone keeps the check independent of the encoding.
-    pending.write({ state: nonce, verifier, createdAt: Date.now() });
-    log({ tag: "[google-oauth]", op: "pending-write", reg: nonce, account: args.accountId });
-    const redirectUri = `${args.publicBase}/api/google/oauth/callback`;
+    log({ tag: "[google-oauth]", op: "register", account: args.accountId, reg: state });
+    pending.write({ state, verifier, createdAt: Date.now() });
+    log({ tag: "[google-oauth]", op: "pending-write", reg: state, account: args.accountId });
     const consentUrl = buildConsentUrl({
         clientId: args.clientId,
-        redirectUri,
         state,
         challenge,
         accountId: args.accountId,
     });
-    log({ tag: "[google-oauth]", op: "consent-url", reg: nonce, scopes: CALENDAR_SCOPE, redirect: redirectUri });
+    log({ tag: "[google-oauth]", op: "consent-url", reg: state, scopes: CALENDAR_SCOPE, redirect: LOOPBACK_REDIRECT_URI });
     return { status: "pending", consentUrl };
 }
 export async function runAccountRegisterPoll(args) {
@@ -123,4 +121,112 @@ export async function runAccountRegisterPoll(args) {
     }
     return { status: "pending", accounts, ageSec: age };
 }
+/** Users paste what they can see, and what they can see is Google's loopback
+ *  redirect — which ALWAYS carries `scope` alongside `code`, and often
+ *  `authuser` and `prompt` too. So the realistic pastes are a whole URL or a
+ *  `code=…&scope=…` fragment, not a bare value.
+ *
+ *  Extracting `code` properly matters because a mangled value reaches Google as
+ *  an opaque string and comes back `invalid_grant`, which reads to the user as
+ *  "your code expired" and sends them round the consent loop again. It never
+ *  says the paste was the problem.
+ *
+ *  A malformed percent escape must not throw either: `decodeURIComponent` raises
+ *  URIError on a stray `%`, and surfacing that instead of Google's own error
+ *  would be our parser blaming the user for a value Google would have explained.
+ */
+export function normalisePastedCode(raw) {
+    const s = raw.trim();
+    // A full URL, or a query fragment carrying more than one parameter.
+    if (s.includes("://") || s.startsWith("?") || s.includes("&")) {
+        const query = s.slice(s.indexOf("?") >= 0 ? s.indexOf("?") + 1 : 0);
+        const fromQuery = new URLSearchParams(query).get("code");
+        if (fromQuery)
+            return fromQuery.trim();
+    }
+    let out = s;
+    if (out.startsWith("code="))
+        out = out.slice("code=".length);
+    if (out.includes("%")) {
+        try {
+            out = decodeURIComponent(out);
+        }
+        catch {
+            // Leave it as pasted; Google's error is more useful than ours.
+        }
+    }
+    return out.trim();
+}
+/**
+ * Finish a registration from the code the user pasted back.
+ *
+ * The exchange happens HERE, in the plugin, because a Desktop client's secret
+ * ships in brand config — there is no server-side holder to delegate to. The
+ * redirect_uri sent here is the same constant the consent URL carried; Google
+ * compares them byte for byte.
+ */
+export async function runAccountRegisterSubmit(args) {
+    const doFetch = args.fetchImpl ?? fetch;
+    const pending = new PendingStore(args.accountId, args.accountsDir);
+    const held = pending.read();
+    if (!held) {
+        throw new Error("no registration in progress; run google-account-register first");
+    }
+    const code = normalisePastedCode(args.code);
+    log({ tag: "[google-oauth]", op: "submit", account: args.accountId, reg: held.state });
+    const res = await doFetch(TOKEN_URL, {
+        method: "POST",
+        headers: { "content-type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({
+            code,
+            client_id: args.clientId,
+            client_secret: args.clientSecret,
+            redirect_uri: LOOPBACK_REDIRECT_URI,
+            grant_type: "authorization_code",
+            code_verifier: held.verifier,
+        }),
+    });
+    const text = await res.text();
+    if (!res.ok) {
+        // Never discard the body: invalid_grant means expired or already used,
+        // redirect_uri_mismatch means the sent and registered redirects diverged.
+        log({
+            tag: "[google-oauth]", op: "submit", reg: held.state,
+            outcome: "error", status: res.status, body: text.slice(0, 300),
+        });
+        throw new Error(`token exchange failed (${res.status}): ${text.slice(0, 300)}`);
+    }
+    const tok = JSON.parse(text);
+    // Identity comes from the primary calendar's id, which IS the address, so the
+    // identity scopes are never requested.
+    const calRes = await doFetch(PRIMARY_CALENDAR_URL, {
+        headers: { authorization: `Bearer ${tok.access_token}` },
+    });
+    const calText = await calRes.text();
+    if (!calRes.ok) {
+        throw new Error(`identity lookup failed (${calRes.status}): ${calText.slice(0, 200)}`);
+    }
+    const email = JSON.parse(calText).id;
+    const stored = new TokenStore(args.accountId, args.accountsDir, email).store(tok.access_token, tok.refresh_token ?? null, tok.expires_in, { email, scopes: tok.scope ? tok.scope.split(" ") : [] });
+    log({
+        tag: "[google-oauth]", op: "tokens-write", reg: held.state,
+        account: args.accountId, refreshIssued: tok.refresh_token ? "true" : "false",
+    });
+    pending.clear();
+    log({ tag: "[google-oauth]", op: "registered", reg: held.state, account: args.accountId, email });
+    // A connection with no refresh token works for about an hour and then dies.
+    // Reporting only in the log would tell the operator "connected" and leave the
+    // failure to surface later as an unexplained loss of access.
+    const refreshTokenIssued = Boolean(stored.refreshToken);
+    return {
+        status: "registered",
+        email,
+        refreshTokenIssued,
+        ...(refreshTokenIssued
+            ? {}
+            : {
+                warning: "Google returned no refresh token, so this connection will stop working when the access token expires in about an hour. Re-run google-account-register to reconnect.",
+            }),
+    };
+}
 //# sourceMappingURL=account-register.js.map

package/payload/platform/plugins/google/mcp/dist/tools/account-register.js.map

@@ -1 +1 @@
-{"version":3,"file":"account-register.js","sourceRoot":"","sources":["../../src/tools/account-register.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAClD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,GAAG,EAAE,MAAM,eAAe,CAAC;AAEpC,MAAM,CAAC,MAAM,cAAc,GAAG,0CAA0C,CAAC;AACzE,MAAM,QAAQ,GAAG,8CAA8C,CAAC;AAEhE;qDACqD;AACrD,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,CAAC;AAExC,MAAM,UAAU,OAAO;IACrB,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACvD,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;AAC5F,CAAC;AAED;;;;;;;;;;;gFAWgF;AAChF,MAAM,UAAU,WAAW,CAAC,SAAiB,EAAE,KAAa;IAC1D,OAAO,GAAG,SAAS,IAAI,KAAK,EAAE,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,MAAM,GAAG,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACtD,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,CAAC;AACzE,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAM/B;IACC,0EAA0E;IAC1E,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC;IAClC,MAAM,CAAC,GAAG,IAAI,eAAe,CAAC;QAC5B,SAAS,EAAE,IAAI,CAAC,QAAQ;QACxB,YAAY,EAAE,QAAQ;QACtB,aAAa,EAAE,MAAM;QACrB,KAAK,EAAE,cAAc;QACrB,WAAW,EAAE,SAAS;QACtB,MAAM,EAAE,SAAS;QACjB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,cAAc,EAAE,IAAI,CAAC,SAAS;QAC9B,qBAAqB,EAAE,MAAM;KAC9B,CAAC,CAAC;IACH,OAAO,GAAG,QAAQ,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;AACvC,CAAC;AAOD;;6DAE6D;AAC7D,MAAM,UAAU,aAAa,CAAC,SAAiB,EAAE,WAAmB;IAClE,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;IAC1E,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IAChC,MAAM,GAAG,GAAuB,EAAE,CAAC;IACnC,KAAK,MAAM,GAAG,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,SAAS,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;YAChE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;QACrG,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,IAK7C;IACC,MAAM,OAAO,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IACnE,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAC7B,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,GAAG,oBAAoB,EAAE,CAAC;QAC/C,GAAG,CAAC;YACF,GAAG,EAAE,gBAAgB;YACrB,EAAE,EAAE,kBAAkB;YACtB,OAAO,EAAE,IAAI,CAAC,SAAS;YACvB,MAAM,EAAE,aAAa;YACrB,MAAM,EAAE,GAAG;SACZ,CAAC,CAAC;QACH,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;IAChD,CAAC;IACD,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACjD,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,OAAO,EAAE,CAAC;IAC1C,GAAG,CAAC,EAAE,GAAG,EAAE,gBAAgB,EAAE,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;IACpF,6EAA6E;IAC7E,4EAA4E;IAC5E,qDAAqD;IACrD,OAAO,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACjE,GAAG,CAAC,EAAE,GAAG,EAAE,gBAAgB,EAAE,EAAE,EAAE,eAAe,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IACzF,MAAM,WAAW,GAAG,GAAG,IAAI,CAAC,UAAU,4BAA4B,CAAC;IACnE,MAAM,UAAU,GAAG,eAAe,CAAC;QACjC,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,WAAW;QACX,KAAK;QACL,SAAS;QACT,SAAS,EAAE,IAAI,CAAC,SAAS;KAC1B,CAAC,CAAC;IACH,GAAG,CAAC,EAAE,GAAG,EAAE,gBAAgB,EAAE,EAAE,EAAE,aAAa,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;IAC7G,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;AAC3C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,IAG5C;IAKC,MAAM,OAAO,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IACnE,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAC7B,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IACjE,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC;IACvF,IAAI,GAAG,IAAI,oBAAoB,EAAE,CAAC;QAChC,GAAG,CAAC,EAAE,GAAG,EAAE,gBAAgB,EAAE,EAAE,EAAE,kBAAkB,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAC7F,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;IACtD,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AACtD,CAAC"}
+{"version":3,"file":"account-register.js","sourceRoot":"","sources":["../../src/tools/account-register.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAClD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,GAAG,EAAE,MAAM,eAAe,CAAC;AAEpC,MAAM,CAAC,MAAM,cAAc,GAAG,0CAA0C,CAAC;AACzE,MAAM,QAAQ,GAAG,8CAA8C,CAAC;AAChE,MAAM,SAAS,GAAG,qCAAqC,CAAC;AACxD,MAAM,oBAAoB,GAAG,0DAA0D,CAAC;AAExF;qDACqD;AACrD,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,CAAC;AAExC,MAAM,UAAU,OAAO;IACrB,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACvD,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;AAC5F,CAAC;AAED;;;;;;;;;;;uEAWuE;AACvE,MAAM,CAAC,MAAM,qBAAqB,GAAG,uBAAuB,CAAC;AAE7D;;;;;;;;;;yEAUyE;AACzE,MAAM,UAAU,eAAe,CAAC,IAK/B;IACC,MAAM,CAAC,GAAG,IAAI,eAAe,CAAC;QAC5B,SAAS,EAAE,IAAI,CAAC,QAAQ;QACxB,YAAY,EAAE,qBAAqB;QACnC,aAAa,EAAE,MAAM;QACrB,KAAK,EAAE,cAAc;QACrB,WAAW,EAAE,SAAS;QACtB,MAAM,EAAE,SAAS;QACjB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,cAAc,EAAE,IAAI,CAAC,SAAS;QAC9B,qBAAqB,EAAE,MAAM;KAC9B,CAAC,CAAC;IACH,OAAO,GAAG,QAAQ,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;AACvC,CAAC;AAOD;;6DAE6D;AAC7D,MAAM,UAAU,aAAa,CAAC,SAAiB,EAAE,WAAmB;IAClE,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;IAC1E,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IAChC,MAAM,GAAG,GAAuB,EAAE,CAAC;IACnC,KAAK,MAAM,GAAG,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,SAAS,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;YAChE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;QACrG,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,IAI7C;IACC,MAAM,OAAO,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IACnE,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAC7B,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,GAAG,oBAAoB,EAAE,CAAC;QAC/C,GAAG,CAAC;YACF,GAAG,EAAE,gBAAgB;YACrB,EAAE,EAAE,kBAAkB;YACtB,OAAO,EAAE,IAAI,CAAC,SAAS;YACvB,MAAM,EAAE,aAAa;YACrB,MAAM,EAAE,GAAG;SACZ,CAAC,CAAC;QACH,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;IAChD,CAAC;IACD,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,OAAO,EAAE,CAAC;IAC1C,GAAG,CAAC,EAAE,GAAG,EAAE,gBAAgB,EAAE,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;IACpF,OAAO,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAC1D,GAAG,CAAC,EAAE,GAAG,EAAE,gBAAgB,EAAE,EAAE,EAAE,eAAe,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IACzF,MAAM,UAAU,GAAG,eAAe,CAAC;QACjC,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,KAAK;QACL,SAAS;QACT,SAAS,EAAE,IAAI,CAAC,SAAS;KAC1B,CAAC,CAAC;IACH,GAAG,CAAC,EAAE,GAAG,EAAE,gBAAgB,EAAE,EAAE,EAAE,aAAa,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE,qBAAqB,EAAE,CAAC,CAAC;IACvH,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;AAC3C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,IAG5C;IAKC,MAAM,OAAO,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IACnE,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAC7B,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IACjE,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC;IACvF,IAAI,GAAG,IAAI,oBAAoB,EAAE,CAAC;QAChC,GAAG,CAAC,EAAE,GAAG,EAAE,gBAAgB,EAAE,EAAE,EAAE,kBAAkB,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAC7F,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;IACtD,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AACtD,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC7C,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAErB,oEAAoE;IACpE,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9D,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACpE,MAAM,SAAS,GAAG,IAAI,eAAe,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACzD,IAAI,SAAS;YAAE,OAAO,SAAS,CAAC,IAAI,EAAE,CAAC;IACzC,CAAC;IAED,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7D,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACtB,IAAI,CAAC;YACH,GAAG,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAChC,CAAC;QAAC,MAAM,CAAC;YACP,+DAA+D;QACjE,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;AACpB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,IAO9C;IACC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IACxC,MAAM,OAAO,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IACnE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IACpF,CAAC;IACD,MAAM,IAAI,GAAG,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5C,GAAG,CAAC,EAAE,GAAG,EAAE,gBAAgB,EAAE,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IACvF,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,SAAS,EAAE;QACnC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,IAAI,eAAe,CAAC;YACxB,IAAI;YACJ,SAAS,EAAE,IAAI,CAAC,QAAQ;YACxB,aAAa,EAAE,IAAI,CAAC,YAAY;YAChC,YAAY,EAAE,qBAAqB;YACnC,UAAU,EAAE,oBAAoB;YAChC,aAAa,EAAE,IAAI,CAAC,QAAQ;SAC7B,CAAC;KACH,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,uEAAuE;QACvE,0EAA0E;QAC1E,GAAG,CAAC;YACF,GAAG,EAAE,gBAAgB,EAAE,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK;YACpD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;SAC/D,CAAC,CAAC;QACH,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,CAAC,MAAM,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAK1B,CAAC;IACF,8EAA8E;IAC9E,uCAAuC;IACvC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,oBAAoB,EAAE;QACjD,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,GAAG,CAAC,YAAY,EAAE,EAAE;KACzD,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;IACpC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,2BAA2B,MAAM,CAAC,MAAM,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IACzF,CAAC;IACD,MAAM,KAAK,GAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAoB,CAAC,EAAE,CAAC;IACzD,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,KAAK,CAC1E,GAAG,CAAC,YAAY,EAChB,GAAG,CAAC,aAAa,IAAI,IAAI,EACzB,GAAG,CAAC,UAAU,EACd,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CACzD,CAAC;IACF,GAAG,CAAC;QACF,GAAG,EAAE,gBAAgB,EAAE,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK;QAC1D,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,aAAa,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;KAC7E,CAAC,CAAC;IACH,OAAO,CAAC,KAAK,EAAE,CAAC;IAChB,GAAG,CAAC,EAAE,GAAG,EAAE,gBAAgB,EAAE,EAAE,EAAE,YAAY,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;IAClG,4EAA4E;IAC5E,8EAA8E;IAC9E,6DAA6D;IAC7D,MAAM,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACxD,OAAO;QACL,MAAM,EAAE,YAAY;QACpB,KAAK;QACL,kBAAkB;QAClB,GAAG,CAAC,kBAAkB;YACpB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE,OAAO,EACL,qKAAqK;aACxK,CAAC;KACP,CAAC;AACJ,CAAC"}