@vellumai/assistant 0.6.3 → 0.6.5

package/src/util/pricing.ts

@@ -21,6 +21,7 @@ const ANTHROPIC_FAST_MODE_MULTIPLIER = 6;
  */
 const PROVIDER_PRICING: Record<string, Record<string, ModelPricing>> = {
   anthropic: {
+    "claude-opus-4-7": { inputPer1M: 5, outputPer1M: 25 },
     "claude-opus-4-6": { inputPer1M: 5, outputPer1M: 25 },
     "claude-opus-4": { inputPer1M: 15, outputPer1M: 75 },
     "claude-sonnet-4": { inputPer1M: 3, outputPer1M: 15 },
@@ -42,9 +43,9 @@ const PROVIDER_PRICING: Record<string, Record<string, ModelPricing>> = {
     "o4-mini": { inputPer1M: 1.1, outputPer1M: 4.4 },
   },
   gemini: {
-    "gemini-3-flash": { inputPer1M: 0.5, outputPer1M: 3 },
-    "gemini-2.5-pro": { inputPer1M: 1.25, outputPer1M: 10 },
     "gemini-2.5-flash": { inputPer1M: 0.15, outputPer1M: 0.6 },
+    "gemini-2.5-flash-lite": { inputPer1M: 0.02, outputPer1M: 0.1 },
+    "gemini-2.5-pro": { inputPer1M: 1.25, outputPer1M: 10 },
     "gemini-2.0-flash": { inputPer1M: 0.1, outputPer1M: 0.4 },
   },
   fireworks: {
@@ -55,6 +56,54 @@ const PROVIDER_PRICING: Record<string, Record<string, ModelPricing>> = {
   },
 };
 
+/**
+ * Identify a model ID as an Anthropic model — accepts both the OpenRouter
+ * prefix form (`anthropic/claude-opus-4.6`) and the bare Anthropic slug
+ * (`claude-opus-4-6`) that `response.model` sometimes carries.
+ */
+function isAnthropicModelId(model: string): boolean {
+  return model.startsWith("anthropic/") || model.startsWith("claude-");
+}
+
+/**
+ * Normalize an OpenRouter-style Anthropic model ID for lookup against the
+ * Anthropic catalog: strip the `anthropic/` prefix, convert OpenRouter's
+ * dot-separated version tokens (`claude-opus-4.6`) to the dash form Anthropic
+ * uses natively (`claude-opus-4-6`), and swap OpenRouter's version-first
+ * response form (`claude-4-7-opus-20260416`) into Anthropic's model-first
+ * catalog form (`claude-opus-4-7-20260416`) so the prefix match succeeds.
+ */
+function normalizeAnthropicModelId(model: string): string {
+  const bare = model.startsWith("anthropic/")
+    ? model.slice("anthropic/".length)
+    : model;
+  const dashed = bare.replace(/\./g, "-");
+  const versionFirst = dashed.match(
+    /^claude-(\d+(?:-\d+)*)-(opus|sonnet|haiku)(-.+)?$/,
+  );
+  if (versionFirst) {
+    const [, version, family, suffix] = versionFirst;
+    return `claude-${family}-${version}${suffix ?? ""}`;
+  }
+  return dashed;
+}
+
+/**
+ * Whether Anthropic's pricing rules (cache-read/write multipliers, fast-mode
+ * surcharge) apply for the given provider/model. True for direct Anthropic
+ * calls and for Anthropic models routed through OpenRouter — OpenRouter
+ * proxies to Anthropic's Messages API, so the usage response carries the
+ * same cache and speed fields and is charged at Anthropic's rates.
+ */
+export function usesAnthropicPricingRules(
+  provider: string,
+  model: string,
+): boolean {
+  if (provider === "anthropic") return true;
+  if (provider === "openrouter" && isAnthropicModelId(model)) return true;
+  return false;
+}
+
 /**
  * Look up pricing for a model within a provider's catalog.
  * Tries exact match first, then longest prefix match.
@@ -147,12 +196,14 @@ function getAnthropicCacheWriteTokens(usage: PricingUsage): {
  */
 function calculateUsageCost(
   provider: string,
+  model: string,
   pricing: ModelPricing,
   usage: PricingUsage,
 ): number {
+  const useAnthropicRules = usesAnthropicPricingRules(provider, model);
   // Anthropic fast mode: 6x multiplier on base rates (cache multipliers stack on top)
   const speedMultiplier =
-    provider === "anthropic" && usage.speed === "fast"
+    useAnthropicRules && usage.speed === "fast"
       ? ANTHROPIC_FAST_MODE_MULTIPLIER
       : 1;
   const effectivePricing: ModelPricing = {
@@ -169,7 +220,7 @@ function calculateUsageCost(
     usage.outputTokens,
   );
 
-  if (provider !== "anthropic") {
+  if (!useAnthropicRules) {
     return (
       directInputCost +
       outputCost +
@@ -223,6 +274,27 @@ export function resolvePricingForUsage(
   model: string,
   usage: PricingUsage,
 ): PricingResult {
+  // Anthropic models routed through OpenRouter: look up against the Anthropic
+  // catalog using the normalized bare slug. OpenRouter bills these calls at
+  // Anthropic's rates and the underlying Messages API response includes
+  // Anthropic's cache- and speed-metadata fields.
+  if (provider === "openrouter" && isAnthropicModelId(model)) {
+    const anthropicCatalog = PROVIDER_PRICING.anthropic;
+    if (anthropicCatalog) {
+      const pricing = findPricing(
+        anthropicCatalog,
+        normalizeAnthropicModelId(model),
+      );
+      if (pricing) {
+        return {
+          estimatedCostUsd: calculateUsageCost(provider, model, pricing, usage),
+          pricingStatus: "priced",
+        };
+      }
+    }
+    return { estimatedCostUsd: null, pricingStatus: "unpriced" };
+  }
+
   const providerCatalog = PROVIDER_PRICING[provider];
   if (!providerCatalog) {
     return { estimatedCostUsd: null, pricingStatus: "unpriced" };
@@ -234,7 +306,7 @@ export function resolvePricingForUsage(
   }
 
   return {
-    estimatedCostUsd: calculateUsageCost(provider, pricing, usage),
+    estimatedCostUsd: calculateUsageCost(provider, model, pricing, usage),
     pricingStatus: "priced",
   };
 }
@@ -253,6 +325,7 @@ export function resolvePricingForUsageWithOverrides(
     return {
       estimatedCostUsd: calculateUsageCost(
         provider,
+        model,
         {
           inputPer1M: bestOverride.inputPer1M,
           outputPer1M: bestOverride.outputPer1M,

package/src/util/spawn.ts

@@ -22,7 +22,7 @@ export function spawnWithTimeout(
   timeoutMs: number,
 ): Promise<{ exitCode: number; stdout: string; stderr: string }> {
   return new Promise((resolve, reject) => {
-    // Augment PATH so Homebrew-installed tools (ffmpeg, ffprobe, whisper-cpp)
+    // Augment PATH so Homebrew-installed tools (ffmpeg, ffprobe)
     // are found even when the daemon runs as a bundled binary with minimal PATH.
     const proc = Bun.spawn(cmd, {
       stdout: "pipe",

package/src/util/truncate.ts

@@ -1,6 +1,8 @@
+import { safeStringSlice } from "./unicode.js";
+
 /** Truncate a string to `maxLen` characters, appending `suffix` if truncated. */
 export function truncate(str: string, maxLen: number, suffix = "..."): string {
   if (str.length <= maxLen) return str;
-  if (maxLen < suffix.length) return str.slice(0, maxLen);
-  return str.slice(0, maxLen - suffix.length) + suffix;
+  if (maxLen < suffix.length) return safeStringSlice(str, 0, maxLen);
+  return safeStringSlice(str, 0, maxLen - suffix.length) + suffix;
 }

package/src/util/unicode.ts

@@ -0,0 +1,201 @@
+/**
+ * UTF-16 surrogate-pair-safe string utilities.
+ *
+ * JavaScript strings are UTF-16. Code points above the BMP (emoji, many CJK
+ * characters, mathematical symbols, etc.) are stored as surrogate pairs — a
+ * high surrogate (U+D800–U+DBFF) followed by a low surrogate (U+DC00–U+DFFF).
+ * `String.prototype.slice` operates on code units, not code points, so naive
+ * slicing can split a pair and leave an orphaned surrogate. Orphaned
+ * surrogates are invalid UTF-16 and cause `JSON.stringify` output to be
+ * rejected by strict JSON parsers (including Anthropic's API).
+ */
+
+const HIGH_SURROGATE_START = 0xd800;
+const HIGH_SURROGATE_END = 0xdbff;
+const LOW_SURROGATE_START = 0xdc00;
+const LOW_SURROGATE_END = 0xdfff;
+const REPLACEMENT_CHAR = "\ufffd";
+
+function isHighSurrogate(code: number): boolean {
+  return code >= HIGH_SURROGATE_START && code <= HIGH_SURROGATE_END;
+}
+
+function isLowSurrogate(code: number): boolean {
+  return code >= LOW_SURROGATE_START && code <= LOW_SURROGATE_END;
+}
+
+/**
+ * Slice a string like `String.prototype.slice`, but never cut a UTF-16
+ * surrogate pair in half.
+ *
+ * If the character at `end - 1` is a high surrogate *and* there is more of
+ * the string beyond `end` (so cutting would actually orphan it), `end` is
+ * decremented by one.
+ *
+ * If the character at `start` is a low surrogate *and* `start > 0` (so we
+ * would be starting mid-pair), `start` is incremented by one.
+ *
+ * When `end === str.length` we do not touch a trailing high surrogate: if it
+ * was already orphaned upstream, repairing it here would silently mutate
+ * content. That is the sanitizer's job, not this function's.
+ */
+export function safeStringSlice(
+  str: string,
+  start = 0,
+  end: number = str.length,
+): string {
+  let safeStart = Math.max(0, Math.min(str.length, start));
+  let safeEnd = Math.max(safeStart, Math.min(str.length, end));
+
+  if (safeEnd < str.length && safeEnd > safeStart) {
+    const lastCode = str.charCodeAt(safeEnd - 1);
+    if (isHighSurrogate(lastCode)) {
+      safeEnd--;
+    }
+  }
+
+  if (safeStart > 0 && safeStart < str.length) {
+    const firstCode = str.charCodeAt(safeStart);
+    if (isLowSurrogate(firstCode)) {
+      safeStart++;
+      if (safeStart > safeEnd) safeEnd = safeStart;
+    }
+  }
+
+  return str.slice(safeStart, safeEnd);
+}
+
+/**
+ * Replace every orphaned UTF-16 surrogate in `str` with U+FFFD
+ * (REPLACEMENT CHARACTER).
+ *
+ * Returns the original reference if no changes were needed, so callers can
+ * check `result === input` as a cheap "nothing was stripped" signal.
+ */
+export function stripOrphanedSurrogates(str: string): string {
+  let needsFix = false;
+  for (let i = 0; i < str.length; i++) {
+    const code = str.charCodeAt(i);
+    if (isHighSurrogate(code)) {
+      const next = i + 1 < str.length ? str.charCodeAt(i + 1) : 0;
+      if (!isLowSurrogate(next)) {
+        needsFix = true;
+        break;
+      }
+      i++;
+    } else if (isLowSurrogate(code)) {
+      needsFix = true;
+      break;
+    }
+  }
+  if (!needsFix) return str;
+
+  let out = "";
+  for (let i = 0; i < str.length; i++) {
+    const code = str.charCodeAt(i);
+    if (isHighSurrogate(code)) {
+      const next = i + 1 < str.length ? str.charCodeAt(i + 1) : 0;
+      if (isLowSurrogate(next)) {
+        out += str[i] + str[i + 1];
+        i++;
+      } else {
+        out += REPLACEMENT_CHAR;
+      }
+    } else if (isLowSurrogate(code)) {
+      out += REPLACEMENT_CHAR;
+    } else {
+      out += str[i];
+    }
+  }
+  return out;
+}
+
+/**
+ * Result of a deep sanitization walk. If `changed` is false the caller should
+ * use the original reference it passed in; `value` is only meaningful when
+ * `changed` is true.
+ */
+export interface DeepSanitizeResult<T> {
+  value: T;
+  changed: boolean;
+  /** Count of string values that had at least one orphan replaced. */
+  fixedStringCount: number;
+}
+
+/**
+ * Recursively walk arrays and plain objects, replacing orphaned surrogates in
+ * every string value. Non-plain objects (class instances, Date, Buffer, Map,
+ * Set, etc.) and non-string primitives are returned unchanged.
+ *
+ * On the happy path (no orphans found anywhere in the tree) the original
+ * reference is returned verbatim — no copies are made.
+ */
+export function stripOrphanedSurrogatesDeep<T>(input: T): DeepSanitizeResult<T> {
+  let fixedStringCount = 0;
+
+  const walk = (value: unknown): { value: unknown; changed: boolean } => {
+    if (typeof value === "string") {
+      const cleaned = stripOrphanedSurrogates(value);
+      if (cleaned !== value) {
+        fixedStringCount++;
+        return { value: cleaned, changed: true };
+      }
+      return { value, changed: false };
+    }
+
+    if (Array.isArray(value)) {
+      let next: unknown[] | null = null;
+      for (let i = 0; i < value.length; i++) {
+        const result = walk(value[i]);
+        if (result.changed && next === null) {
+          next = [];
+          for (let j = 0; j < i; j++) {
+            next.push(value[j]);
+          }
+        }
+        if (next !== null) {
+          next.push(result.value);
+        }
+      }
+      return next !== null
+        ? { value: next, changed: true }
+        : { value, changed: false };
+    }
+
+    if (value != null && typeof value === "object") {
+      const proto = Object.getPrototypeOf(value);
+      if (proto !== Object.prototype && proto !== null) {
+        return { value, changed: false };
+      }
+      const source = value as Record<string, unknown>;
+      const keys = Object.keys(source);
+      let next: Record<string, unknown> | null = null;
+      for (let i = 0; i < keys.length; i++) {
+        const key = keys[i]!;
+        const result = walk(source[key]);
+        if (result.changed && next === null) {
+          next = {};
+          for (let j = 0; j < i; j++) {
+            const priorKey = keys[j]!;
+            next[priorKey] = source[priorKey];
+          }
+        }
+        if (next !== null) {
+          next[key] = result.value;
+        }
+      }
+      return next !== null
+        ? { value: next, changed: true }
+        : { value, changed: false };
+    }
+
+    return { value, changed: false };
+  };
+
+  const result = walk(input);
+  return {
+    value: result.value as T,
+    changed: result.changed,
+    fixedStringCount,
+  };
+}

package/src/version.ts

@@ -1,36 +1,31 @@
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
 
+const DEV_VERSION_SENTINEL = "0.0.0-dev";
+
+function readPackageVersion(): string | undefined {
+  try {
+    const pkgPath = join(
+      import.meta.dirname ?? __dirname,
+      "..",
+      "package.json",
+    );
+    const pkg = JSON.parse(readFileSync(pkgPath, "utf-8"));
+    if (pkg.version && typeof pkg.version === "string") return pkg.version;
+  } catch {
+    // package.json missing or unreadable
+  }
+  return undefined;
+}
+
 function resolveVersion(): string {
   const envVersion = process.env.APP_VERSION;
 
-  // When APP_VERSION is not set, we're in local development — return the dev
-  // sentinel so Sentry (and similar) classify the session as "development".
-  if (!envVersion) return "0.0.0-dev";
-
-  // CI sets APP_VERSION to the dev placeholder during builds; resolve it to
-  // the package.json release version so Sentry gets a meaningful release tag.
-  if (envVersion === "0.0.0-dev") {
-    try {
-      const pkgPath = join(
-        import.meta.dirname ?? __dirname,
-        "..",
-        "package.json",
-      );
-      const pkg = JSON.parse(readFileSync(pkgPath, "utf-8"));
-      if (pkg.version && typeof pkg.version === "string") return pkg.version;
-    } catch {
-      // package.json missing or unreadable
-    }
-    return "0.0.0-dev";
-  }
+  if (envVersion && envVersion !== DEV_VERSION_SENTINEL) return envVersion;
 
-  return envVersion;
+  return readPackageVersion() ?? DEV_VERSION_SENTINEL;
 }
 
-// Version is embedded at compile time via --define in CI.
-// Falls back to "0.0.0-dev" for local development, or resolves the dev
-// placeholder to package.json version when explicitly set in CI.
 export const APP_VERSION: string = resolveVersion();
 
 // Commit SHA is embedded at compile time via --define in CI.

package/src/watcher/engine.ts

@@ -19,6 +19,7 @@ import {
   insertWatcherEvent,
   resetStuckWatchers,
   setWatcherConversationId,
+  skipWatcherPoll,
   updateEventDisposition,
 } from "./watcher-store.js";
 
@@ -76,6 +77,28 @@ export async function runWatchersOnce(
       continue;
     }
 
+    // Pre-poll credential gate: skip if token is irrecoverably broken.
+    // Prevents wasting API calls and burning through circuit breaker
+    // attempts on credentials that need manual reauthorization.
+    try {
+      const { checkCredentialForProvider } =
+        await import("../credential-health/credential-health-service.js");
+      const health = await checkCredentialForProvider(
+        watcher.credentialService,
+      );
+      if (
+        health &&
+        (health.status === "revoked" ||
+          health.status === "missing_token" ||
+          (health.status === "expired" && !health.canAutoRecover))
+      ) {
+        skipWatcherPoll(watcher.id, `Credential unhealthy: ${health.details}`);
+        continue;
+      }
+    } catch {
+      // Non-fatal: proceed with normal poll if health check fails
+    }
+
     try {
       const config = watcher.configJson ? JSON.parse(watcher.configJson) : {};
 
@@ -157,7 +180,7 @@ export async function runWatchersOnce(
         // Do NOT call provider.cleanup() here — auto-disable is reversible.
         // If the watcher is re-enabled later, it must diff against the same
         // baseline to avoid missing events that occurred while disabled.
-        // Cleanup is only correct on true deletion (see tools/watcher/delete.ts).
+        // Cleanup is only correct on true deletion (see watcher delete IPC route).
         log.warn(
           { watcherId: watcher.id, name: watcher.name },
           "Watcher disabled by circuit breaker",

package/src/watcher/providers/google-calendar.ts

@@ -6,15 +6,9 @@
  * Falls back to listing recent upcoming events if the syncToken has expired (410 Gone).
  */
 
-import {
-  CalendarApiError,
-  listEvents,
-} from "../../config/bundled-skills/google-calendar/calendar-client.js";
-import type { CalendarEvent } from "../../config/bundled-skills/google-calendar/types.js";
 import type { OAuthConnection } from "../../oauth/connection.js";
 import { resolveOAuthConnection } from "../../oauth/connection-resolver.js";
-
-const GOOGLE_CALENDAR_BASE_URL = "https://www.googleapis.com/calendar/v3";
+import { wrapUntrustedContent } from "../../security/untrusted-content.js";
 import { getLogger } from "../../util/logger.js";
 import type {
   FetchResult,
@@ -22,6 +16,133 @@ import type {
   WatcherProvider,
 } from "../provider-types.js";
 
+const GOOGLE_CALENDAR_BASE_URL = "https://www.googleapis.com/calendar/v3";
+
+// ---------------------------------------------------------------------------
+// Local types & helpers used by the watcher provider
+// ---------------------------------------------------------------------------
+
+/** Event time - either a dateTime with timezone or a date for all-day events. */
+interface EventDateTime {
+  dateTime?: string;
+  date?: string;
+  timeZone?: string;
+}
+
+/** Calendar event attendee. */
+interface EventAttendee {
+  email: string;
+  displayName?: string;
+  responseStatus?: "needsAction" | "declined" | "tentative" | "accepted";
+  self?: boolean;
+  organizer?: boolean;
+  optional?: boolean;
+}
+
+/** Calendar event organizer. */
+interface EventOrganizer {
+  email?: string;
+  displayName?: string;
+  self?: boolean;
+}
+
+/** A single Google Calendar event. */
+interface CalendarEvent {
+  id: string;
+  status?: "confirmed" | "tentative" | "cancelled";
+  summary?: string;
+  description?: string;
+  location?: string;
+  start?: EventDateTime;
+  end?: EventDateTime;
+  attendees?: EventAttendee[];
+  organizer?: EventOrganizer;
+  htmlLink?: string;
+  created?: string;
+  updated?: string;
+}
+
+/** Events list response. */
+interface CalendarEventsListResponse {
+  items?: CalendarEvent[];
+  nextPageToken?: string;
+  nextSyncToken?: string;
+}
+
+class CalendarApiError extends Error {
+  constructor(
+    public readonly status: number,
+    public readonly statusText: string,
+    message: string,
+  ) {
+    super(message);
+    this.name = "CalendarApiError";
+  }
+}
+
+/** List events from a calendar. */
+async function listEvents(
+  connection: OAuthConnection,
+  calendarId = "primary",
+  options?: {
+    timeMin?: string;
+    timeMax?: string;
+    maxResults?: number;
+    query?: string;
+    singleEvents?: boolean;
+    orderBy?: "startTime" | "updated";
+    pageToken?: string;
+    syncToken?: string;
+  },
+): Promise<CalendarEventsListResponse> {
+  const query: Record<string, string> = {};
+
+  if (options?.timeMin) query.timeMin = options.timeMin;
+  if (options?.timeMax) query.timeMax = options.timeMax;
+  query.maxResults = String(options?.maxResults ?? 25);
+  if (options?.query) query.q = options.query;
+
+  // Default to expanding recurring events into instances
+  const singleEvents = options?.singleEvents ?? true;
+  query.singleEvents = String(singleEvents);
+
+  if (singleEvents && options?.orderBy) {
+    query.orderBy = options.orderBy;
+  } else if (singleEvents) {
+    query.orderBy = "startTime";
+  }
+
+  if (options?.pageToken) query.pageToken = options.pageToken;
+  if (options?.syncToken) query.syncToken = options.syncToken;
+
+  const resp = await connection.request({
+    method: "GET",
+    path: `/calendars/${encodeURIComponent(calendarId)}/events`,
+    query,
+    baseUrl: GOOGLE_CALENDAR_BASE_URL,
+    headers: {
+      "Content-Type": "application/json",
+    },
+  });
+
+  if (resp.status < 200 || resp.status >= 300) {
+    const bodyStr =
+      typeof resp.body === "string"
+        ? resp.body
+        : JSON.stringify(resp.body ?? "");
+    throw new CalendarApiError(
+      resp.status,
+      "",
+      `Calendar API ${resp.status}: ${bodyStr}`,
+    );
+  }
+
+  if (resp.status === 204 || resp.body === undefined) {
+    return undefined as unknown as CalendarEventsListResponse;
+  }
+  return resp.body as CalendarEventsListResponse;
+}
+
 const log = getLogger("watcher:google-calendar");
 
 /** The credential service — calendar shares OAuth tokens with Gmail. */
@@ -44,7 +165,12 @@ function eventToItem(event: CalendarEvent, eventType: string): WatcherItem {
       start,
       end,
       location: event.location ?? "",
-      description: event.description ?? "",
+      description: event.description
+        ? wrapUntrustedContent(event.description, {
+            source: "calendar",
+            maxChars: 5000,
+          })
+        : "",
       status: event.status ?? "confirmed",
       organizer: event.organizer?.email ?? "",
       attendees:

package/src/watcher/providers/outlook-calendar.ts

@@ -8,8 +8,6 @@
  * token has expired (410 Gone).
  */
 
-import { OutlookCalendarApiError } from "../../config/bundled-skills/outlook-calendar/calendar-client.js";
-import type { OutlookCalendarEvent } from "../../config/bundled-skills/outlook-calendar/types.js";
 import type { OAuthConnection } from "../../oauth/connection.js";
 import { resolveOAuthConnection } from "../../oauth/connection-resolver.js";
 import { getLogger } from "../../util/logger.js";
@@ -19,6 +17,48 @@ import type {
   WatcherProvider,
 } from "../provider-types.js";
 
+// ---------------------------------------------------------------------------
+// Local types & helpers used by the watcher provider
+// ---------------------------------------------------------------------------
+
+/** Microsoft Graph date+time pair. timeZone may be omitted when dateTime carries an offset. */
+interface OutlookDateTimeZone {
+  dateTime: string;
+  timeZone?: string;
+}
+
+/** A single calendar event from Microsoft Graph (subset used by watcher). */
+interface OutlookCalendarEvent {
+  id: string;
+  subject?: string;
+  bodyPreview?: string;
+  start?: OutlookDateTimeZone;
+  end?: OutlookDateTimeZone;
+  location?: { displayName?: string };
+  attendees?: Array<{
+    emailAddress: { address: string };
+    status?: { response: string };
+  }>;
+  organizer?: { emailAddress: { address: string; name?: string } };
+  isAllDay?: boolean;
+  isCancelled?: boolean;
+  showAs?: string;
+  webLink?: string;
+  createdDateTime?: string;
+  lastModifiedDateTime?: string;
+}
+
+class OutlookCalendarApiError extends Error {
+  constructor(
+    public readonly status: number,
+    public readonly statusText: string,
+    message: string,
+  ) {
+    super(message);
+    this.name = "OutlookCalendarApiError";
+  }
+}
+
 const CREDENTIAL_SERVICE = "outlook";
 const log = getLogger("watcher:outlook-calendar");