@sentry/junior-google 0.0.0-stage → 0.238.0

package/dist/index.js

@@ -0,0 +1,1460 @@
+// src/index.ts
+import {
+  defineJuniorPlugin
+} from "@sentry/junior-plugin-api";
+
+// src/cli.ts
+import { createServer } from "http";
+import { userInfo } from "os";
+import { InvalidArgumentError } from "commander";
+
+// src/config.ts
+var GOOGLE_CLIENT_ID_ENV = "GOOGLE_WORKSPACE_CLIENT_ID";
+var GOOGLE_CLIENT_SECRET_ENV = "GOOGLE_WORKSPACE_CLIENT_SECRET";
+var GOOGLE_ACCOUNT_EMAIL_ENV = "GOOGLE_WORKSPACE_ACCOUNT_EMAIL";
+var GOOGLE_ALLOWED_DOMAINS_ENV = "GOOGLE_WORKSPACE_ALLOWED_DOMAINS";
+var GOOGLE_CALENDAR_SCOPES = [
+  "https://www.googleapis.com/auth/calendar.events.freebusy",
+  "https://www.googleapis.com/auth/calendar.events.owned",
+  "https://www.googleapis.com/auth/calendar.events.readonly"
+];
+var GOOGLE_IDENTITY_SCOPES = ["openid", "email"];
+function readEnv(name) {
+  const value = process.env[name]?.trim();
+  return value ? value : void 0;
+}
+function readList(name) {
+  return (readEnv(name) ?? "").split(",").map((value) => value.trim().toLowerCase()).filter(Boolean);
+}
+function emailDomain(email) {
+  const at = email.lastIndexOf("@");
+  if (at <= 0 || at === email.length - 1) {
+    return void 0;
+  }
+  return email.slice(at + 1).toLowerCase();
+}
+function readGoogleConfig() {
+  const clientId = readEnv(GOOGLE_CLIENT_ID_ENV);
+  const clientSecret = readEnv(GOOGLE_CLIENT_SECRET_ENV);
+  const accountEmail = readEnv(GOOGLE_ACCOUNT_EMAIL_ENV)?.toLowerCase();
+  if (!clientId || !clientSecret || !accountEmail) {
+    return void 0;
+  }
+  const accountDomain = emailDomain(accountEmail);
+  if (!accountDomain) {
+    throw new Error(`${GOOGLE_ACCOUNT_EMAIL_ENV} must be an email address`);
+  }
+  const allowedDomains = readList(GOOGLE_ALLOWED_DOMAINS_ENV);
+  return {
+    accountEmail,
+    allowedDomains: allowedDomains.length ? allowedDomains : [accountDomain],
+    clientId,
+    clientSecret
+  };
+}
+
+// src/oauth.ts
+import { createHash, randomBytes } from "crypto";
+import { z } from "zod";
+
+// src/store.ts
+import { and, eq } from "drizzle-orm";
+
+// src/db/schema.ts
+import { bigint, pgTable, text } from "drizzle-orm/pg-core";
+var juniorGoogleAccounts = pgTable("junior_google_accounts", {
+  accountEmail: text("account_email").primaryKey(),
+  refreshToken: text("refresh_token").notNull(),
+  scope: text("scope").notNull(),
+  connectedBy: text("connected_by").notNull(),
+  connectedAtMs: bigint("connected_at_ms", { mode: "number" }).notNull()
+});
+
+// src/store.ts
+async function getGoogleAccount(db, accountEmail) {
+  const [row] = await db.select().from(juniorGoogleAccounts).where(eq(juniorGoogleAccounts.accountEmail, accountEmail)).limit(1);
+  return row;
+}
+async function saveGoogleAccount(db, record) {
+  await db.insert(juniorGoogleAccounts).values(record).onConflictDoUpdate({
+    target: juniorGoogleAccounts.accountEmail,
+    set: {
+      refreshToken: record.refreshToken,
+      scope: record.scope,
+      connectedBy: record.connectedBy,
+      connectedAtMs: record.connectedAtMs
+    }
+  });
+}
+async function deleteRejectedGoogleAccount(db, record) {
+  await db.delete(juniorGoogleAccounts).where(
+    and(
+      eq(juniorGoogleAccounts.accountEmail, record.accountEmail),
+      eq(juniorGoogleAccounts.refreshToken, record.refreshToken)
+    )
+  );
+}
+function googleAccountStatus(record) {
+  return {
+    accountEmail: record.accountEmail,
+    connectedAt: new Date(record.connectedAtMs).toISOString(),
+    connectedBy: record.connectedBy,
+    scope: record.scope
+  };
+}
+
+// src/oauth.ts
+var AUTHORIZE_ENDPOINT = "https://accounts.google.com/o/oauth2/v2/auth";
+var TOKEN_ENDPOINT = "https://oauth2.googleapis.com/token";
+var REVOKE_ENDPOINT = "https://oauth2.googleapis.com/revoke";
+var GOOGLE_ISSUERS = /* @__PURE__ */ new Set([
+  "accounts.google.com",
+  "https://accounts.google.com"
+]);
+var GoogleConnectError = class extends Error {
+  name = "GoogleConnectError";
+};
+var tokenResponseSchema = z.object({
+  access_token: z.string().min(1),
+  expires_in: z.number().positive(),
+  id_token: z.string().min(1).optional(),
+  refresh_token: z.string().min(1).optional(),
+  scope: z.string().optional()
+});
+var tokenErrorSchema = z.object({ error: z.string() });
+var idTokenClaimsSchema = z.object({
+  aud: z.string(),
+  email: z.string(),
+  email_verified: z.boolean().optional(),
+  iss: z.string()
+});
+function createGoogleSignInRequest() {
+  return {
+    codeVerifier: randomBytes(32).toString("base64url"),
+    state: randomBytes(24).toString("base64url")
+  };
+}
+function googleAuthorizationUrl(input) {
+  const url = new URL(AUTHORIZE_ENDPOINT);
+  const challenge = createHash("sha256").update(input.request.codeVerifier).digest("base64url");
+  url.search = new URLSearchParams({
+    access_type: "offline",
+    client_id: input.config.clientId,
+    code_challenge: challenge,
+    code_challenge_method: "S256",
+    login_hint: input.config.accountEmail,
+    // Always ask for consent so Google returns a refresh token.
+    prompt: "consent select_account",
+    redirect_uri: input.redirectUri,
+    response_type: "code",
+    scope: [...GOOGLE_IDENTITY_SCOPES, ...GOOGLE_CALENDAR_SCOPES].join(" "),
+    state: input.request.state
+  }).toString();
+  return url.toString();
+}
+async function postTokenEndpoint(body) {
+  const response = await fetch(TOKEN_ENDPOINT, {
+    body: new URLSearchParams(body),
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    method: "POST"
+  });
+  const parsed = await response.json().catch(() => void 0);
+  if (response.ok) {
+    return { ok: true, value: parsed };
+  }
+  const error = tokenErrorSchema.safeParse(parsed);
+  return {
+    ok: false,
+    error: error.success ? error.data.error : `http_${response.status}`
+  };
+}
+function decodeIdTokenClaims(idToken) {
+  try {
+    const payload = idToken.split(".")[1] ?? "";
+    return idTokenClaimsSchema.parse(
+      JSON.parse(Buffer.from(payload, "base64url").toString("utf8"))
+    );
+  } catch {
+    return void 0;
+  }
+}
+function grantedScopes(tokens) {
+  return (tokens.scope ?? "").split(/\s+/).filter(Boolean).sort();
+}
+function verifyGrant(tokens, config) {
+  const claims = tokens.id_token ? decodeIdTokenClaims(tokens.id_token) : void 0;
+  if (!claims || !GOOGLE_ISSUERS.has(claims.iss) || claims.aud !== config.clientId || claims.email_verified !== true) {
+    return { reason: "Google did not return a valid account identity." };
+  }
+  const email = claims.email.toLowerCase();
+  if (email !== config.accountEmail) {
+    return {
+      reason: `You signed in as ${email}. Sign in as ${config.accountEmail} instead.`
+    };
+  }
+  const granted = new Set(grantedScopes(tokens));
+  const missing = GOOGLE_CALENDAR_SCOPES.filter((scope) => !granted.has(scope));
+  if (missing.length > 0) {
+    return {
+      reason: `Google did not grant every Calendar permission. Start again and allow all requested access. Missing: ${missing.join(", ")}`
+    };
+  }
+  if (!tokens.refresh_token) {
+    return { reason: "Google did not return a refresh token. Start again." };
+  }
+  return { refreshToken: tokens.refresh_token };
+}
+async function connectGoogleAccount(input) {
+  const result = await postTokenEndpoint({
+    client_id: input.config.clientId,
+    client_secret: input.config.clientSecret,
+    code: input.code,
+    code_verifier: input.codeVerifier,
+    grant_type: "authorization_code",
+    redirect_uri: input.redirectUri
+  });
+  if (!result.ok) {
+    throw new GoogleConnectError(
+      `Google rejected the sign-in (${result.error}). Start again.`
+    );
+  }
+  const tokens = tokenResponseSchema.parse(result.value);
+  const grant = verifyGrant(tokens, input.config);
+  if ("reason" in grant) {
+    await fetch(REVOKE_ENDPOINT, {
+      body: new URLSearchParams({
+        token: tokens.refresh_token ?? tokens.access_token
+      }),
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      method: "POST"
+    }).catch(() => void 0);
+    throw new GoogleConnectError(grant.reason);
+  }
+  const scope = grantedScopes(tokens).join(" ");
+  await saveGoogleAccount(input.db, {
+    accountEmail: input.config.accountEmail,
+    connectedAtMs: Date.now(),
+    connectedBy: input.connectedBy,
+    refreshToken: grant.refreshToken,
+    scope
+  });
+  return { accountEmail: input.config.accountEmail, scope };
+}
+async function refreshGoogleAccessToken(input) {
+  const result = await postTokenEndpoint({
+    client_id: input.config.clientId,
+    client_secret: input.config.clientSecret,
+    grant_type: "refresh_token",
+    refresh_token: input.refreshToken
+  });
+  if (!result.ok) {
+    if (result.error === "invalid_grant") {
+      return void 0;
+    }
+    throw new Error(`Google token refresh failed (${result.error})`);
+  }
+  const tokens = tokenResponseSchema.parse(result.value);
+  return {
+    accessToken: tokens.access_token,
+    expiresAtMs: Date.now() + tokens.expires_in * 1e3
+  };
+}
+
+// src/cli.ts
+var DEFAULT_LOOPBACK_PORT = 8765;
+var SIGN_IN_TIMEOUT_MS = 5 * 60 * 1e3;
+function parsePort(value) {
+  const port = Number(value);
+  if (!Number.isInteger(port) || port < 1024 || port > 65535) {
+    throw new InvalidArgumentError("--port must be between 1024 and 65535");
+  }
+  return port;
+}
+async function requireConfig(ctx) {
+  const config = readGoogleConfig();
+  if (!config) {
+    await ctx.io.writeError(
+      `Google plugin is not configured. Set ${GOOGLE_CLIENT_ID_ENV}, ${GOOGLE_CLIENT_SECRET_ENV}, and ${GOOGLE_ACCOUNT_EMAIL_ENV}.
+`
+    );
+  }
+  return config;
+}
+async function waitForLoopbackCode(input) {
+  return await new Promise((resolve, reject) => {
+    const server = createServer((request, response) => {
+      const url = new URL(request.url ?? "/", "http://127.0.0.1");
+      if (url.pathname !== "/oauth/callback") {
+        response.writeHead(404).end();
+        return;
+      }
+      const finish = (message, result) => {
+        response.writeHead(200, {
+          Connection: "close",
+          "Content-Type": "text/plain; charset=utf-8",
+          "Referrer-Policy": "no-referrer"
+        }).end(`${message}
+You can close this window.
+`);
+        clearTimeout(timer);
+        server.close();
+        result();
+      };
+      if (url.searchParams.get("state") !== input.state) {
+        finish(
+          "Sign-in state did not match.",
+          () => reject(new GoogleConnectError("Sign-in state did not match."))
+        );
+        return;
+      }
+      const error = url.searchParams.get("error");
+      const code = url.searchParams.get("code");
+      if (error || !code) {
+        const message = `Google sign-in did not finish (${error ?? "no code"}).`;
+        finish(message, () => reject(new GoogleConnectError(message)));
+        return;
+      }
+      finish(
+        "Google sign-in received. Return to your terminal.",
+        () => resolve(code)
+      );
+    });
+    const timer = setTimeout(() => {
+      server.close();
+      reject(new GoogleConnectError("Timed out waiting for Google sign-in."));
+    }, SIGN_IN_TIMEOUT_MS);
+    server.once("error", (error) => {
+      clearTimeout(timer);
+      reject(error);
+    });
+    server.listen(input.port, "127.0.0.1", () => {
+      Promise.resolve(input.onListening()).catch((error) => {
+        clearTimeout(timer);
+        server.close();
+        reject(error);
+      });
+    });
+  });
+}
+async function runConnect(ctx, options) {
+  const config = await requireConfig(ctx);
+  if (!config) return 1;
+  const redirectUri = `http://127.0.0.1:${options.port}/oauth/callback`;
+  const signIn = createGoogleSignInRequest();
+  try {
+    const code = await waitForLoopbackCode({
+      onListening: () => ctx.io.writeOutput(
+        [
+          `Open this URL in a browser and sign in as ${config.accountEmail}:`,
+          "",
+          googleAuthorizationUrl({ config, redirectUri, request: signIn }),
+          "",
+          `Waiting for Google to redirect to ${redirectUri} ...`,
+          ""
+        ].join("\n")
+      ),
+      port: options.port,
+      state: signIn.state
+    });
+    const connected = await connectGoogleAccount({
+      code,
+      codeVerifier: signIn.codeVerifier,
+      config,
+      connectedBy: `cli:${userInfo().username}`,
+      db: ctx.db,
+      redirectUri
+    });
+    await ctx.io.writeOutput(
+      `Connected ${connected.accountEmail} (scopes: ${connected.scope}).
+`
+    );
+    return 0;
+  } catch (error) {
+    if (error instanceof GoogleConnectError) {
+      await ctx.io.writeError(`${error.message}
+`);
+      return 1;
+    }
+    throw error;
+  }
+}
+async function runStatus(ctx) {
+  const config = await requireConfig(ctx);
+  if (!config) return 1;
+  const record = await getGoogleAccount(
+    ctx.db,
+    config.accountEmail
+  );
+  if (!record) {
+    await ctx.io.writeOutput(
+      `account=${config.accountEmail}
+status=not_connected
+`
+    );
+    return 0;
+  }
+  const status = googleAccountStatus(record);
+  await ctx.io.writeOutput(
+    [
+      `account=${status.accountEmail}`,
+      "status=connected",
+      `connected_at=${status.connectedAt}`,
+      `connected_by=${status.connectedBy}`,
+      `scope=${status.scope}`,
+      ""
+    ].join("\n")
+  );
+  return 0;
+}
+function createGoogleCliCommand() {
+  return {
+    name: "google",
+    summary: "Connect and inspect Junior's Google account",
+    configure(command, junior) {
+      command.command("connect").description(
+        "Sign in as Junior's Google account in a browser and store the grant"
+      ).option(
+        "--port <port>",
+        "Loopback port registered as an OAuth redirect URI",
+        parsePort,
+        DEFAULT_LOOPBACK_PORT
+      ).action(
+        junior.action(async (ctx, options) => {
+          return await runConnect(ctx, options);
+        })
+      );
+      command.command("status").description("Show whether Junior's Google account is connected").action(junior.action(async (ctx) => await runStatus(ctx)));
+    }
+  };
+}
+
+// src/credentials.ts
+import {
+  EgressPolicyDenied
+} from "@sentry/junior-plugin-api";
+var GOOGLE_API_DOMAIN = "www.googleapis.com";
+var GRANT_NAME = "account";
+var LEASE_SAFETY_MS = 6e4;
+var GOOGLE_OPERATIONS = {
+  "google.calendar.event.create": {
+    access: "write",
+    method: "POST",
+    path: /^\/calendar\/v3\/calendars\/primary\/events$/
+  },
+  "google.calendar.event.get": {
+    access: "read",
+    method: "GET",
+    path: /^\/calendar\/v3\/calendars\/primary\/events\/[A-Za-z0-9_]+$/
+  },
+  "google.calendar.event.update": {
+    access: "write",
+    method: "PATCH",
+    path: /^\/calendar\/v3\/calendars\/primary\/events\/[A-Za-z0-9_]+$/
+  },
+  "google.calendar.events.list": {
+    access: "read",
+    method: "GET",
+    path: /^\/calendar\/v3\/calendars\/[^/]+\/events$/
+  },
+  "google.calendar.freebusy.query": {
+    access: "read",
+    method: "POST",
+    path: /^\/calendar\/v3\/freeBusy$/
+  }
+};
+function googleGrantForEgress(ctx) {
+  const operation = ctx.request.operation;
+  const rule = operation ? GOOGLE_OPERATIONS[operation] : void 0;
+  if (!rule) {
+    throw new EgressPolicyDenied(
+      "Google APIs are only available through Junior's Google tools."
+    );
+  }
+  const url = new URL(ctx.request.url);
+  if (url.hostname !== GOOGLE_API_DOMAIN || ctx.request.method.toUpperCase() !== rule.method || !rule.path.test(url.pathname)) {
+    throw new EgressPolicyDenied(
+      `Google request does not match operation ${operation}.`
+    );
+  }
+  return {
+    access: rule.access,
+    name: GRANT_NAME,
+    reason: `Use Junior's Google account for ${operation}`
+  };
+}
+function unavailable(message) {
+  return { type: "unavailable", message };
+}
+var NOT_CONNECTED_MESSAGE = `Junior's Google account is not connected. A Junior admin must connect it on the dashboard Admin page or with \`junior google connect\`.`;
+async function issueGoogleCredential(ctx) {
+  if (ctx.grant.name !== GRANT_NAME) {
+    throw new Error(
+      `Google plugin cannot issue unknown grant "${ctx.grant.name}".`
+    );
+  }
+  const config = readGoogleConfig();
+  if (!config) {
+    return unavailable(
+      "The Google plugin is not configured on this deployment."
+    );
+  }
+  const db = ctx.db;
+  const record = await getGoogleAccount(db, config.accountEmail);
+  if (!record) {
+    return unavailable(NOT_CONNECTED_MESSAGE);
+  }
+  const token = await refreshGoogleAccessToken({
+    config,
+    refreshToken: record.refreshToken
+  });
+  if (!token) {
+    await deleteRejectedGoogleAccount(db, record);
+    ctx.log.warn("google.account.token_rejected", {
+      "app.google.account": config.accountEmail
+    });
+    return unavailable(
+      `Google revoked Junior's access. ${NOT_CONNECTED_MESSAGE}`
+    );
+  }
+  return {
+    type: "lease",
+    lease: {
+      account: { id: config.accountEmail, label: config.accountEmail },
+      expiresAt: new Date(token.expiresAtMs - LEASE_SAFETY_MS).toISOString(),
+      headerTransforms: [
+        {
+          domain: GOOGLE_API_DOMAIN,
+          headers: { Authorization: `Bearer ${token.accessToken}` }
+        }
+      ]
+    }
+  };
+}
+
+// src/setup-routes.ts
+var GOOGLE_PLUGIN_ROUTE_PREFIX = "/api/plugins/google";
+var SIGN_IN_COOKIE = "junior_google_sign_in";
+var SIGN_IN_COOKIE_PATH = `${GOOGLE_PLUGIN_ROUTE_PREFIX}/oauth`;
+var SIGN_IN_MAX_AGE_SECONDS = 600;
+var SETUP_PAGE_PATH = "/plugins/google/account";
+function escapeHtml(value) {
+  return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&#39;");
+}
+function htmlPage(title, body, init = {}) {
+  return new Response(
+    `<!doctype html><html><head><meta charset="utf-8"><title>${escapeHtml(title)}</title><style>body{font-family:system-ui,sans-serif;max-width:40rem;margin:3rem auto;padding:0 1rem;line-height:1.5}code{background:#f3f3f3;padding:0 .2rem}a.button{display:inline-block;padding:.5rem 1rem;border:1px solid #333;border-radius:.4rem;text-decoration:none;color:inherit}</style></head><body><h1>${escapeHtml(title)}</h1>${body}</body></html>`,
+    {
+      status: init.status ?? 200,
+      headers: {
+        "Cache-Control": "no-store",
+        "Content-Security-Policy": "default-src 'none'; style-src 'unsafe-inline'",
+        "Content-Type": "text/html; charset=utf-8",
+        // The callback URL carries the authorization code.
+        "Referrer-Policy": "no-referrer",
+        ...init.headers
+      }
+    }
+  );
+}
+function googleCallbackUrl(request) {
+  const base = process.env.JUNIOR_BASE_URL?.trim() || new URL(request.url).origin;
+  return new URL(
+    `${GOOGLE_PLUGIN_ROUTE_PREFIX}/oauth/callback`,
+    base.endsWith("/") ? base : `${base}/`
+  ).toString();
+}
+function adminEmail(context) {
+  const user = context?.auth.user;
+  const email = user?.email?.trim().toLowerCase();
+  if (!email || user?.emailVerified !== true || user.isAdmin !== true) {
+    return void 0;
+  }
+  return email;
+}
+function forbidden() {
+  return htmlPage(
+    "Google setup",
+    "<p>Only Junior admins can connect Junior's Google account. An operator can grant the role with <code>junior admin grant &lt;email&gt;</code>.</p>",
+    { status: 403 }
+  );
+}
+function readCookie(request, name) {
+  for (const part of (request.headers.get("cookie") ?? "").split(";")) {
+    const [key, ...rest] = part.trim().split("=");
+    if (key === name) {
+      return rest.join("=");
+    }
+  }
+  return void 0;
+}
+function signInCookie(value, maxAgeSeconds) {
+  return `${SIGN_IN_COOKIE}=${value}; Path=${SIGN_IN_COOKIE_PATH}; Max-Age=${maxAgeSeconds}; HttpOnly; Secure; SameSite=Lax`;
+}
+function startSignIn(config, request) {
+  const signIn = createGoogleSignInRequest();
+  const location = googleAuthorizationUrl({
+    config,
+    redirectUri: googleCallbackUrl(request),
+    request: signIn
+  });
+  return new Response(null, {
+    status: 302,
+    headers: {
+      "Cache-Control": "no-store",
+      Location: location,
+      "Set-Cookie": signInCookie(
+        `${signIn.state}.${signIn.codeVerifier}`,
+        SIGN_IN_MAX_AGE_SECONDS
+      )
+    }
+  });
+}
+async function finishSignIn(input) {
+  const url = new URL(input.request.url);
+  const clearCookie = { "Set-Cookie": signInCookie("", 0) };
+  const failed = (message, status = 400) => htmlPage(
+    "Google setup failed",
+    `<p>${escapeHtml(message)}</p><p><a href="${SETUP_PAGE_PATH}">Back to setup</a></p>`,
+    { headers: clearCookie, status }
+  );
+  const [expectedState, codeVerifier] = (readCookie(input.request, SIGN_IN_COOKIE) ?? "").split(".");
+  const state = url.searchParams.get("state");
+  if (!expectedState || !codeVerifier || state !== expectedState) {
+    return failed("This sign-in link expired or did not start here.");
+  }
+  const providerError = url.searchParams.get("error");
+  if (providerError) {
+    return failed(`Google sign-in did not finish (${providerError}).`);
+  }
+  const code = url.searchParams.get("code");
+  if (!code) {
+    return failed("Google did not return an authorization code.");
+  }
+  try {
+    const connected = await connectGoogleAccount({
+      code,
+      codeVerifier,
+      config: input.config,
+      connectedBy: input.connectedBy,
+      db: input.db,
+      redirectUri: googleCallbackUrl(input.request)
+    });
+    return htmlPage(
+      "Google connected",
+      `<p>Junior now acts as <code>${escapeHtml(connected.accountEmail)}</code>.</p><p><a href="${SETUP_PAGE_PATH}">Back to setup</a></p>`,
+      { headers: clearCookie }
+    );
+  } catch (error) {
+    if (error instanceof GoogleConnectError) {
+      return failed(error.message);
+    }
+    throw error;
+  }
+}
+function createGoogleSetupRoutes(input) {
+  return {
+    async fetch(request, context) {
+      const { pathname } = new URL(request.url);
+      if (request.method !== "GET") {
+        return new Response("Method not allowed", { status: 405 });
+      }
+      const admin = adminEmail(context);
+      if (!admin) {
+        return forbidden();
+      }
+      switch (pathname) {
+        case "/oauth/start":
+          return startSignIn(input.config, request);
+        case "/oauth/callback":
+          return await finishSignIn({ ...input, connectedBy: admin, request });
+        default:
+          return new Response("Not found", { status: 404 });
+      }
+    }
+  };
+}
+function createGoogleSetupPage() {
+  return {
+    id: "account",
+    label: "Google account",
+    description: "Connect the Google Workspace account that Junior acts as.",
+    navigation: "admin",
+    async read(ctx) {
+      const config = readGoogleConfig();
+      if (!config) {
+        return {
+          type: "list",
+          records: [
+            {
+              id: "not-configured",
+              title: "Not configured",
+              description: `Set ${GOOGLE_CLIENT_ID_ENV}, ${GOOGLE_CLIENT_SECRET_ENV}, and ${GOOGLE_ACCOUNT_EMAIL_ENV} on the deployment.`
+            }
+          ]
+        };
+      }
+      const record = await getGoogleAccount(
+        ctx.db,
+        config.accountEmail
+      );
+      const status = record ? googleAccountStatus(record) : void 0;
+      return {
+        type: "list",
+        records: [
+          {
+            id: config.accountEmail,
+            title: config.accountEmail,
+            description: status ? "Connected. Reconnect after Google revokes access or Junior needs new permissions." : `Not connected. Sign in as ${config.accountEmail}, not as yourself.`,
+            ...status ? {
+              metadata: [
+                { label: "Connected by", value: status.connectedBy },
+                { label: "Connected at", value: status.connectedAt },
+                { label: "Scopes", value: status.scope }
+              ]
+            } : void 0,
+            actions: [
+              {
+                href: `${GOOGLE_PLUGIN_ROUTE_PREFIX}/oauth/start`,
+                label: status ? "Reconnect" : "Connect",
+                method: "GET"
+              }
+            ]
+          }
+        ]
+      };
+    }
+  };
+}
+
+// src/tools/create-event.ts
+import { createHash as createHash2, randomUUID } from "crypto";
+import {
+  definePluginTool,
+  PluginToolInputError as PluginToolInputError2,
+  pluginToolOutputSchema
+} from "@sentry/junior-plugin-api";
+import { z as z3 } from "zod";
+
+// src/tools/shared.ts
+import {
+  PluginToolInputError
+} from "@sentry/junior-plugin-api";
+import { z as z2 } from "zod";
+var emailListSchema = (max) => z2.array(z2.string().trim().toLowerCase().pipe(z2.email())).max(max).describe("Attendee email addresses.");
+var timeZoneSchema = z2.string().min(1).refine(isTimeZone, "timeZone must be an IANA time zone").describe(
+  "IANA time zone used to read and show times, such as America/Los_Angeles."
+);
+function isTimeZone(value) {
+  try {
+    new Intl.DateTimeFormat("en-US", { timeZone: value });
+    return true;
+  } catch {
+    return false;
+  }
+}
+function requireAllowedEmails(emails, allowedDomains) {
+  const outside = emails.filter((email) => {
+    const domain = emailDomain(email);
+    return !domain || !allowedDomains.includes(domain);
+  });
+  if (outside.length > 0) {
+    throw new PluginToolInputError(
+      `Junior can only schedule with people at ${allowedDomains.join(", ")}. Not allowed: ${outside.join(", ")}`
+    );
+  }
+}
+async function requesterEmail(ctx) {
+  return (await ctx.users.resolveActor())?.user?.email?.trim().toLowerCase();
+}
+async function withRequester(ctx, emails) {
+  const requester = await requesterEmail(ctx);
+  const domain = requester ? emailDomain(requester) : void 0;
+  const all = requester && domain && ctx.allowedDomains.includes(domain) ? [requester, ...emails] : emails;
+  return [...new Set(all)];
+}
+var googleErrorSchema = z2.object({
+  error: z2.object({ message: z2.string().optional() }).optional()
+});
+async function googleApiRequest(ctx, input) {
+  const url = new URL(`https://${GOOGLE_API_DOMAIN}${input.path}`);
+  for (const [key, value] of Object.entries(input.query ?? {})) {
+    url.searchParams.set(key, value);
+  }
+  const response = await ctx.egress.fetch({
+    operation: input.operation,
+    provider: "google",
+    request: new Request(url, {
+      method: GOOGLE_OPERATIONS[input.operation].method,
+      headers: {
+        Accept: "application/json",
+        "Content-Type": "application/json"
+      },
+      body: input.body === void 0 ? void 0 : JSON.stringify(input.body)
+    })
+  });
+  const body = await response.json().catch(() => void 0);
+  return { body, status: response.status };
+}
+function googleApiError(operation, response) {
+  const parsed = googleErrorSchema.safeParse(response.body);
+  const detail = parsed.success ? parsed.data.error?.message : void 0;
+  const message = `Google ${operation} failed with HTTP ${response.status}${detail ? `: ${detail}` : ""}`;
+  return response.status === 400 ? new PluginToolInputError(message) : new Error(message);
+}
+function formatInterval(startMs, endMs, timeZone) {
+  const day = new Intl.DateTimeFormat("en-US", {
+    day: "numeric",
+    month: "short",
+    timeZone,
+    weekday: "short"
+  }).format(startMs);
+  const time = new Intl.DateTimeFormat("en-US", {
+    hour: "2-digit",
+    hourCycle: "h23",
+    minute: "2-digit",
+    timeZone,
+    timeZoneName: "short"
+  });
+  return `${day}, ${time.format(startMs)} \u2013 ${time.format(endMs)}`;
+}
+var MAX_EVENT_MS = 8 * 60 * 60 * 1e3;
+var ownEventSchema = z2.object({
+  attendees: z2.array(
+    z2.object({ email: z2.string(), responseStatus: z2.string().optional() }).loose()
+  ).optional(),
+  end: z2.object({ dateTime: z2.string() }),
+  hangoutLink: z2.string().optional(),
+  htmlLink: z2.string().optional(),
+  id: z2.string(),
+  organizer: z2.object({ self: z2.boolean().optional() }).optional(),
+  start: z2.object({ dateTime: z2.string() }),
+  summary: z2.string().optional()
+});
+function ownEventResult(event, timeZone) {
+  return {
+    attendees: (event.attendees ?? []).map((attendee) => attendee.email),
+    end: event.end.dateTime,
+    eventId: event.id,
+    label: formatInterval(
+      Date.parse(event.start.dateTime),
+      Date.parse(event.end.dateTime),
+      timeZone
+    ),
+    start: event.start.dateTime,
+    ...event.summary ? { title: event.summary } : void 0,
+    ...event.htmlLink ? { url: event.htmlLink } : void 0,
+    ...event.hangoutLink ? { videoCallUrl: event.hangoutLink } : void 0
+  };
+}
+var ownEventOutputFields = {
+  attendees: z2.array(z2.string()),
+  end: z2.string(),
+  eventId: z2.string(),
+  label: z2.string(),
+  start: z2.string(),
+  title: z2.string().optional(),
+  url: z2.string().optional(),
+  videoCallUrl: z2.string().optional()
+};
+
+// src/tools/create-event.ts
+var inputSchema = z3.object({
+  title: z3.string().trim().min(1).max(200),
+  description: z3.string().max(4e3).optional().describe(
+    "Event description. Do not include private details the attendees should not see."
+  ),
+  start: z3.iso.datetime({ offset: true }).describe("Event start, RFC 3339 with offset."),
+  end: z3.iso.datetime({ offset: true }).describe("Event end, RFC 3339 with offset."),
+  timeZone: timeZoneSchema,
+  attendees: emailListSchema(50).describe(
+    "Email addresses to invite. Junior adds the requester automatically when it knows their email."
+  ),
+  addVideoCall: z3.boolean().default(true).describe("Add a Google Meet link.")
+}).strict();
+var outputSchema = pluginToolOutputSchema.extend({
+  target: z3.literal("createCalendarEvent"),
+  created: z3.boolean(),
+  ...ownEventOutputFields
+});
+function calendarEventId(toolCallId) {
+  return createHash2("sha256").update(`junior-google:${toolCallId ?? randomUUID()}`).digest("hex").slice(0, 40);
+}
+function createCreateCalendarEventTool(ctx) {
+  return definePluginTool({
+    annotations: {
+      destructiveHint: false,
+      idempotentHint: true,
+      openWorldHint: true,
+      readOnlyHint: false
+    },
+    describeProposal(input) {
+      return `Create Google Calendar event "${input.title}" from ${input.start} to ${input.end} and email invites to ${input.attendees.join(", ") || "the requester"}.`;
+    },
+    description: "Create a Google Calendar event organized by Junior's own Google account and email invites to the attendees. Use after the requester confirms the time. Only people in the company's Google Workspace domains can be invited.",
+    inputSchema,
+    outputSchema,
+    async execute(input, options) {
+      const startMs = Date.parse(input.start);
+      const endMs = Date.parse(input.end);
+      if (endMs <= startMs) {
+        throw new PluginToolInputError2("end must be after start.");
+      }
+      if (endMs - startMs > MAX_EVENT_MS) {
+        throw new PluginToolInputError2("Events can be at most 8 hours long.");
+      }
+      const attendees = await withRequester(ctx, input.attendees);
+      if (attendees.length === 0) {
+        throw new PluginToolInputError2("Invite at least one attendee.");
+      }
+      requireAllowedEmails(attendees, ctx.allowedDomains);
+      const eventId = calendarEventId(options.toolCallId);
+      const response = await googleApiRequest(ctx, {
+        body: {
+          attendees: attendees.map((email) => ({ email })),
+          ...input.addVideoCall ? {
+            conferenceData: {
+              createRequest: {
+                conferenceSolutionKey: { type: "hangoutsMeet" },
+                requestId: eventId
+              }
+            }
+          } : void 0,
+          ...input.description ? { description: input.description } : void 0,
+          end: { dateTime: input.end, timeZone: input.timeZone },
+          guestsCanModify: false,
+          id: eventId,
+          start: { dateTime: input.start, timeZone: input.timeZone },
+          summary: input.title
+        },
+        operation: "google.calendar.event.create",
+        path: "/calendar/v3/calendars/primary/events",
+        query: {
+          conferenceDataVersion: input.addVideoCall ? "1" : "0",
+          sendUpdates: "all"
+        }
+      });
+      let created = true;
+      let event = response;
+      if (response.status === 409) {
+        created = false;
+        event = await googleApiRequest(ctx, {
+          operation: "google.calendar.event.get",
+          path: `/calendar/v3/calendars/primary/events/${eventId}`
+        });
+        if (event.status !== 200) {
+          throw googleApiError("google.calendar.event.get", event);
+        }
+      } else if (response.status !== 200) {
+        throw googleApiError("google.calendar.event.create", response);
+      }
+      return {
+        target: "createCalendarEvent",
+        created,
+        ...ownEventResult(ownEventSchema.parse(event.body), input.timeZone)
+      };
+    }
+  });
+}
+
+// src/tools/find-meeting-times.ts
+import {
+  definePluginTool as definePluginTool2,
+  PluginToolInputError as PluginToolInputError3,
+  pluginToolOutputSchema as pluginToolOutputSchema2
+} from "@sentry/junior-plugin-api";
+import { z as z4 } from "zod";
+var MAX_WINDOW_MS = 14 * 24 * 60 * 60 * 1e3;
+var clockTimeSchema = z4.string().regex(/^([01]\d|2[0-3]):[0-5]\d$/, "Use 24-hour HH:MM");
+var inputSchema2 = z4.object({
+  attendees: emailListSchema(20).min(1).describe(
+    "Email addresses of the people who must attend. Junior adds the requester automatically when it knows their email."
+  ),
+  durationMinutes: z4.number().int().min(15).max(480),
+  timeMin: z4.iso.datetime({ offset: true }).describe("Start of the search window, RFC 3339 with offset."),
+  timeMax: z4.iso.datetime({ offset: true }).describe(
+    "End of the search window, RFC 3339 with offset. At most 14 days after timeMin."
+  ),
+  timeZone: timeZoneSchema,
+  workdayStart: clockTimeSchema.default("09:00").describe("Earliest local start time in timeZone, 24-hour HH:MM."),
+  workdayEnd: clockTimeSchema.default("17:00").describe("Latest local end time in timeZone, 24-hour HH:MM."),
+  maxResults: z4.number().int().min(1).max(20).default(5)
+}).strict();
+var slotSchema = z4.object({
+  end: z4.string(),
+  label: z4.string(),
+  start: z4.string()
+});
+var outputSchema2 = pluginToolOutputSchema2.extend({
+  target: z4.literal("findMeetingTimes"),
+  checked: z4.array(z4.string()),
+  slots: z4.array(slotSchema),
+  timeZone: z4.string(),
+  unavailable: z4.array(z4.object({ email: z4.string(), reason: z4.string() }))
+});
+var freeBusyResponseSchema = z4.object({
+  calendars: z4.record(
+    z4.string(),
+    z4.object({
+      busy: z4.array(z4.object({ end: z4.string(), start: z4.string() })).default([]),
+      errors: z4.array(z4.object({ reason: z4.string() })).optional()
+    })
+  )
+});
+function localParts(ms, format) {
+  const parts = Object.fromEntries(
+    format.formatToParts(ms).map((part) => [part.type, part.value])
+  );
+  return {
+    date: `${parts.year}-${parts.month}-${parts.day}`,
+    minutes: Number(parts.hour) * 60 + Number(parts.minute),
+    weekday: parts.weekday ?? ""
+  };
+}
+function clockMinutes(value) {
+  const [hours, minutes] = value.split(":").map(Number);
+  return hours * 60 + minutes;
+}
+function findFreeSlots(input) {
+  const durationMs = input.durationMinutes * 6e4;
+  const stepMs = (input.durationMinutes < 30 ? 15 : 30) * 6e4;
+  const format = new Intl.DateTimeFormat("en-US", {
+    day: "2-digit",
+    hour: "2-digit",
+    hourCycle: "h23",
+    minute: "2-digit",
+    month: "2-digit",
+    timeZone: input.timeZone,
+    weekday: "short",
+    year: "numeric"
+  });
+  const dayStart = clockMinutes(input.workdayStart);
+  const dayEnd = clockMinutes(input.workdayEnd);
+  const slots = [];
+  let startMs = Math.ceil(input.timeMinMs / stepMs) * stepMs;
+  while (startMs + durationMs <= input.timeMaxMs && slots.length < input.maxResults) {
+    const endMs = startMs + durationMs;
+    const start = localParts(startMs, format);
+    const end = localParts(endMs, format);
+    const inWorkday = start.weekday !== "Sat" && start.weekday !== "Sun" && start.date === end.date && start.minutes >= dayStart && end.minutes <= dayEnd;
+    const free = input.busy.every(
+      (busy) => busy.endMs <= startMs || busy.startMs >= endMs
+    );
+    if (inWorkday && free) {
+      slots.push({ startMs, endMs });
+      startMs = endMs;
+    } else {
+      startMs += stepMs;
+    }
+  }
+  return slots;
+}
+function createFindMeetingTimesTool(ctx) {
+  return definePluginTool2({
+    annotations: {
+      destructiveHint: false,
+      idempotentHint: true,
+      openWorldHint: true,
+      readOnlyHint: true
+    },
+    description: "Find meeting times when every attendee is free, using Google Calendar free/busy data from Junior's own Google account. Returns open slots only, never event details. Only people in the company's Google Workspace domains can be checked. People listed in `unavailable` were not checked; tell the user instead of treating them as free.",
+    inputSchema: inputSchema2,
+    outputSchema: outputSchema2,
+    async execute(input) {
+      const timeMinMs = Math.max(Date.parse(input.timeMin), Date.now());
+      const timeMaxMs = Date.parse(input.timeMax);
+      if (timeMaxMs <= timeMinMs) {
+        throw new PluginToolInputError3(
+          "timeMax must be after timeMin and now."
+        );
+      }
+      if (timeMaxMs - timeMinMs > MAX_WINDOW_MS) {
+        throw new PluginToolInputError3("Search at most 14 days at a time.");
+      }
+      if (clockMinutes(input.workdayEnd) <= clockMinutes(input.workdayStart)) {
+        throw new PluginToolInputError3(
+          "workdayEnd must be after workdayStart."
+        );
+      }
+      const attendees = await withRequester(ctx, input.attendees);
+      requireAllowedEmails(attendees, ctx.allowedDomains);
+      const response = await googleApiRequest(ctx, {
+        body: {
+          items: attendees.map((id) => ({ id })),
+          timeMax: new Date(timeMaxMs).toISOString(),
+          timeMin: new Date(timeMinMs).toISOString()
+        },
+        operation: "google.calendar.freebusy.query",
+        path: "/calendar/v3/freeBusy"
+      });
+      if (response.status !== 200) {
+        throw googleApiError("google.calendar.freebusy.query", response);
+      }
+      const { calendars } = freeBusyResponseSchema.parse(response.body);
+      const checked = [];
+      const unavailable2 = [];
+      const busy = [];
+      for (const email of attendees) {
+        const calendar = calendars[email];
+        const error = calendar?.errors?.[0]?.reason;
+        if (!calendar || error) {
+          unavailable2.push({ email, reason: error ?? "notFound" });
+          continue;
+        }
+        checked.push(email);
+        for (const interval of calendar.busy) {
+          busy.push({
+            endMs: Date.parse(interval.end),
+            startMs: Date.parse(interval.start)
+          });
+        }
+      }
+      const slots = checked.length === 0 ? [] : findFreeSlots({
+        busy,
+        durationMinutes: input.durationMinutes,
+        maxResults: input.maxResults,
+        timeMaxMs,
+        timeMinMs,
+        timeZone: input.timeZone,
+        workdayEnd: input.workdayEnd,
+        workdayStart: input.workdayStart
+      });
+      return {
+        target: "findMeetingTimes",
+        checked,
+        slots: slots.map((slot) => ({
+          end: new Date(slot.endMs).toISOString(),
+          label: formatInterval(slot.startMs, slot.endMs, input.timeZone),
+          start: new Date(slot.startMs).toISOString()
+        })),
+        timeZone: input.timeZone,
+        unavailable: unavailable2
+      };
+    }
+  });
+}
+
+// src/tools/list-events.ts
+import {
+  definePluginTool as definePluginTool3,
+  PluginToolInputError as PluginToolInputError4,
+  pluginToolOutputSchema as pluginToolOutputSchema3
+} from "@sentry/junior-plugin-api";
+import { z as z5 } from "zod";
+var MAX_WINDOW_MS2 = 31 * 24 * 60 * 60 * 1e3;
+var inputSchema3 = z5.object({
+  calendar: z5.string().trim().toLowerCase().pipe(z5.email()).describe("Email address of the person whose calendar to read."),
+  timeMin: z5.iso.datetime({ offset: true }).describe("Start of the window, RFC 3339 with offset."),
+  timeMax: z5.iso.datetime({ offset: true }).describe(
+    "End of the window, RFC 3339 with offset. At most 31 days after timeMin."
+  ),
+  timeZone: timeZoneSchema,
+  maxResults: z5.number().int().min(1).max(100).default(50)
+}).strict();
+var eventSchema = z5.object({
+  attendees: z5.array(z5.string()).optional(),
+  end: z5.string(),
+  eventId: z5.string(),
+  label: z5.string(),
+  location: z5.string().optional(),
+  organizer: z5.string().optional(),
+  start: z5.string(),
+  title: z5.string().optional(),
+  url: z5.string().optional(),
+  videoCallUrl: z5.string().optional()
+});
+var outputSchema3 = pluginToolOutputSchema3.extend({
+  target: z5.literal("listCalendarEvents"),
+  calendar: z5.string(),
+  events: z5.array(eventSchema),
+  timeZone: z5.string(),
+  truncated: z5.boolean(),
+  visible: z5.boolean()
+});
+var eventTimeSchema = z5.object({
+  date: z5.string().optional(),
+  dateTime: z5.string().optional()
+});
+var listResponseSchema = z5.object({
+  items: z5.array(
+    z5.object({
+      attendees: z5.array(z5.object({ email: z5.string() })).optional(),
+      end: eventTimeSchema,
+      hangoutLink: z5.string().optional(),
+      htmlLink: z5.string().optional(),
+      id: z5.string(),
+      location: z5.string().optional(),
+      organizer: z5.object({ email: z5.string().optional() }).optional(),
+      start: eventTimeSchema,
+      status: z5.string().optional(),
+      summary: z5.string().optional()
+    })
+  ).default([]),
+  nextPageToken: z5.string().optional()
+});
+function lastAllDayDate(end) {
+  if (!end.date) return void 0;
+  const day = /* @__PURE__ */ new Date(`${end.date}T00:00:00Z`);
+  day.setUTCDate(day.getUTCDate() - 1);
+  return day.toISOString().slice(0, 10);
+}
+function eventLabel(start, end, timeZone) {
+  if (start.dateTime && end.dateTime) {
+    return formatInterval(
+      Date.parse(start.dateTime),
+      Date.parse(end.dateTime),
+      timeZone
+    );
+  }
+  const first = start.date ?? "unknown date";
+  const last = lastAllDayDate(end);
+  return last && last !== first ? `${first} to ${last}, all day` : `${first}, all day`;
+}
+function createListCalendarEventsTool(ctx) {
+  return definePluginTool3({
+    annotations: {
+      destructiveHint: false,
+      idempotentHint: true,
+      openWorldHint: true,
+      readOnlyHint: true
+    },
+    description: "List events on a colleague's Google Calendar, as seen by Junior's own Google account. Shows titles, times, locations, organizer, and attendees when the calendar's sharing settings allow it. Events without a title are busy blocks the owner did not share. Only calendars in the company's Google Workspace domains can be read. Calendar details can be private: share only what the requester needs, and avoid repeating them in public channels.",
+    inputSchema: inputSchema3,
+    outputSchema: outputSchema3,
+    async execute(input) {
+      const timeMinMs = Date.parse(input.timeMin);
+      const timeMaxMs = Date.parse(input.timeMax);
+      if (timeMaxMs <= timeMinMs) {
+        throw new PluginToolInputError4("timeMax must be after timeMin.");
+      }
+      if (timeMaxMs - timeMinMs > MAX_WINDOW_MS2) {
+        throw new PluginToolInputError4("Read at most 31 days at a time.");
+      }
+      requireAllowedEmails([input.calendar], ctx.allowedDomains);
+      const response = await googleApiRequest(ctx, {
+        operation: "google.calendar.events.list",
+        path: `/calendar/v3/calendars/${encodeURIComponent(input.calendar)}/events`,
+        query: {
+          maxResults: String(input.maxResults),
+          orderBy: "startTime",
+          singleEvents: "true",
+          timeMax: new Date(timeMaxMs).toISOString(),
+          timeMin: new Date(timeMinMs).toISOString(),
+          timeZone: input.timeZone
+        }
+      });
+      const result = {
+        target: "listCalendarEvents",
+        calendar: input.calendar,
+        timeZone: input.timeZone
+      };
+      if (response.status === 404) {
+        return { ...result, events: [], truncated: false, visible: false };
+      }
+      if (response.status !== 200) {
+        throw googleApiError("google.calendar.events.list", response);
+      }
+      const { items, nextPageToken } = listResponseSchema.parse(response.body);
+      return {
+        ...result,
+        events: items.filter((event) => event.status !== "cancelled").map((event) => ({
+          end: event.end.dateTime ?? lastAllDayDate(event.end) ?? "",
+          eventId: event.id,
+          label: eventLabel(event.start, event.end, input.timeZone),
+          start: event.start.dateTime ?? event.start.date ?? "",
+          ...event.summary ? { title: event.summary } : void 0,
+          ...event.location ? { location: event.location } : void 0,
+          ...event.organizer?.email ? { organizer: event.organizer.email } : void 0,
+          ...event.attendees ? { attendees: event.attendees.map((person) => person.email) } : void 0,
+          ...event.htmlLink ? { url: event.htmlLink } : void 0,
+          ...event.hangoutLink ? { videoCallUrl: event.hangoutLink } : void 0
+        })),
+        truncated: nextPageToken !== void 0,
+        visible: true
+      };
+    }
+  });
+}
+
+// src/tools/update-event.ts
+import {
+  definePluginTool as definePluginTool4,
+  PluginToolInputError as PluginToolInputError5,
+  pluginToolOutputSchema as pluginToolOutputSchema4
+} from "@sentry/junior-plugin-api";
+import { z as z6 } from "zod";
+var inputSchema4 = z6.object({
+  eventId: z6.string().regex(/^[A-Za-z0-9_]{5,1024}$/, "Use an event id from a Calendar tool").describe(
+    "Event id from createCalendarEvent or listCalendarEvents. Only events that Junior organizes can be changed."
+  ),
+  title: z6.string().trim().min(1).max(200).optional(),
+  description: z6.string().max(4e3).optional().describe(
+    "Replacement description. Do not include private details the attendees should not see."
+  ),
+  start: z6.iso.datetime({ offset: true }).optional().describe("New start, RFC 3339 with offset. Give end too."),
+  end: z6.iso.datetime({ offset: true }).optional().describe("New end, RFC 3339 with offset. Give start too."),
+  timeZone: timeZoneSchema,
+  addAttendees: emailListSchema(50).default([]).describe("Email addresses to invite."),
+  removeAttendees: emailListSchema(50).default([]).describe("Email addresses to remove from the event.")
+}).strict().refine(
+  (input) => input.start === void 0 === (input.end === void 0),
+  {
+    message: "Give both start and end to move an event."
+  }
+).refine(
+  (input) => input.title !== void 0 || input.description !== void 0 || input.start !== void 0 || input.addAttendees.length > 0 || input.removeAttendees.length > 0,
+  { message: "Give at least one change." }
+);
+var outputSchema4 = pluginToolOutputSchema4.extend({
+  target: z6.literal("updateCalendarEvent"),
+  ...ownEventOutputFields
+});
+function createUpdateCalendarEventTool(ctx) {
+  return definePluginTool4({
+    annotations: {
+      destructiveHint: false,
+      idempotentHint: true,
+      openWorldHint: true,
+      readOnlyHint: false
+    },
+    describeProposal(input) {
+      const changes = [
+        input.title && `rename it to "${input.title}"`,
+        input.start && `move it to ${input.start} \u2013 ${input.end}`,
+        input.description !== void 0 && "replace the description",
+        input.addAttendees.length > 0 && `invite ${input.addAttendees.join(", ")}`,
+        input.removeAttendees.length > 0 && `remove ${input.removeAttendees.join(", ")}`
+      ].filter(Boolean);
+      return `Update Google Calendar event ${input.eventId}: ${changes.join("; ")}. Attendees get an email about the change.`;
+    },
+    description: "Change a Google Calendar event organized by Junior's own Google account: title, description, time, or attendees. Google emails the attendees about the change. Only people invited to the event can ask for changes, and only people in the company's Google Workspace domains can be invited. Use after the requester confirms the change.",
+    inputSchema: inputSchema4,
+    outputSchema: outputSchema4,
+    async execute(input) {
+      if (input.start && input.end) {
+        const durationMs = Date.parse(input.end) - Date.parse(input.start);
+        if (durationMs <= 0) {
+          throw new PluginToolInputError5("end must be after start.");
+        }
+        if (durationMs > MAX_EVENT_MS) {
+          throw new PluginToolInputError5("Events can be at most 8 hours long.");
+        }
+      }
+      requireAllowedEmails(input.addAttendees, ctx.allowedDomains);
+      const requester = await requesterEmail(ctx);
+      if (!requester) {
+        throw new PluginToolInputError5(
+          "Junior does not know the requester's email, so it cannot check that they may change this event."
+        );
+      }
+      const path = `/calendar/v3/calendars/primary/events/${input.eventId}`;
+      const current = await googleApiRequest(ctx, {
+        operation: "google.calendar.event.get",
+        path
+      });
+      if (current.status === 404) {
+        throw new PluginToolInputError5(
+          `Junior's calendar has no event ${input.eventId}.`
+        );
+      }
+      if (current.status !== 200) {
+        throw googleApiError("google.calendar.event.get", current);
+      }
+      const event = ownEventSchema.parse(current.body);
+      if (event.organizer?.self !== true) {
+        throw new PluginToolInputError5(
+          "Junior does not organize this event, so it cannot change it."
+        );
+      }
+      const attendees = event.attendees ?? [];
+      const emailKey = (email) => email.toLowerCase();
+      if (!attendees.some((attendee) => emailKey(attendee.email) === requester)) {
+        throw new PluginToolInputError5(
+          "Only people invited to this event can ask Junior to change it."
+        );
+      }
+      const removed = new Set(input.removeAttendees);
+      const kept = attendees.filter(
+        (attendee) => !removed.has(emailKey(attendee.email))
+      );
+      const existing = new Set(
+        kept.map((attendee) => emailKey(attendee.email))
+      );
+      const added = input.addAttendees.filter((email) => !existing.has(email)).map((email) => ({ email }));
+      const attendeesChanged = kept.length !== attendees.length || added.length;
+      const response = await googleApiRequest(ctx, {
+        body: {
+          ...input.title !== void 0 && { summary: input.title },
+          ...input.description !== void 0 && {
+            description: input.description
+          },
+          ...input.start && input.end && {
+            end: { dateTime: input.end, timeZone: input.timeZone },
+            start: { dateTime: input.start, timeZone: input.timeZone }
+          },
+          ...attendeesChanged && { attendees: [...kept, ...added] }
+        },
+        operation: "google.calendar.event.update",
+        path,
+        query: { sendUpdates: "all" }
+      });
+      if (response.status !== 200) {
+        throw googleApiError("google.calendar.event.update", response);
+      }
+      return {
+        target: "updateCalendarEvent",
+        ...ownEventResult(ownEventSchema.parse(response.body), input.timeZone)
+      };
+    }
+  });
+}
+
+// src/index.ts
+function googlePlugin() {
+  return defineJuniorPlugin({
+    packageName: "@sentry/junior-google",
+    manifest: {
+      name: "google",
+      displayName: "Google Workspace",
+      description: "Google Calendar scheduling as Junior's own Google Workspace account",
+      domains: [GOOGLE_API_DOMAIN],
+      envVars: {
+        [GOOGLE_CLIENT_ID_ENV]: {},
+        [GOOGLE_CLIENT_SECRET_ENV]: {},
+        [GOOGLE_ACCOUNT_EMAIL_ENV]: {},
+        [GOOGLE_ALLOWED_DOMAINS_ENV]: {}
+      }
+    },
+    cli: {
+      commands: [createGoogleCliCommand()]
+    },
+    userPages: [createGoogleSetupPage()],
+    hooks: {
+      apiRoutes(ctx) {
+        const config = readGoogleConfig();
+        return config ? createGoogleSetupRoutes({ config, db: ctx.db }) : void 0;
+      },
+      grantForEgress: googleGrantForEgress,
+      issueCredential: issueGoogleCredential,
+      tools(ctx) {
+        const config = readGoogleConfig();
+        if (!config) {
+          return {};
+        }
+        const toolContext = {
+          allowedDomains: config.allowedDomains,
+          egress: ctx.egress,
+          users: ctx.users
+        };
+        return {
+          createCalendarEvent: createCreateCalendarEventTool(toolContext),
+          findMeetingTimes: createFindMeetingTimesTool(toolContext),
+          listCalendarEvents: createListCalendarEventsTool(toolContext),
+          updateCalendarEvent: createUpdateCalendarEventTool(toolContext)
+        };
+      }
+    }
+  });
+}
+export {
+  googlePlugin
+};