@vess-id/ai-identity 0.16.0 → 0.17.0

package/dist/index.mjs

@@ -6353,6 +6353,33 @@ var ACTION_REGISTRY = {
       },
       version: "1.0.0"
     },
+    {
+      action: "calendar.freebusy",
+      resource_type: "calendar:calendar",
+      required_relations: ["viewer", "editor", "admin", "owner"],
+      required_scopes: ["https://www.googleapis.com/auth/calendar.readonly"],
+      capability: "calendar.read.basic",
+      // Availability probe used to check a calendar's busy/free intervals before
+      // proposing meeting slots. Returns only busy time ranges — never event
+      // details (title, attendees, description) — so it stays low-risk read.
+      input_schema: {
+        type: "object",
+        properties: {
+          calendarId: { type: "string", description: "Calendar ID (email address). Defaults to primary calendar." },
+          timeMin: { type: "string", description: 'Lower bound (inclusive) of the window to check, as ISO 8601 datetime, e.g. "2025-01-15T00:00:00Z"' },
+          timeMax: { type: "string", description: 'Upper bound (exclusive) of the window to check, as ISO 8601 datetime, e.g. "2025-01-16T00:00:00Z"' }
+        },
+        required: ["timeMin", "timeMax"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "calendar.read" },
+      effects: ["Read:FreeBusy"],
+      risk: "low",
+      target_bindings: {
+        resource_id: { source: "param", param: "calendarId", required: false, default: "primary" }
+      },
+      version: "1.0.0"
+    },
     {
       action: "calendar.event.create",
       resource_type: "calendar:event",
@@ -7674,9 +7701,21 @@ var ACTION_REGISTRY = {
     },
     // ─── Scheduling Actions (internal) ───
     // scheduling.request is a meeting-time negotiation façade over inbox.send.
-    // Candidate slots are computed LLM-side from the user calendar; the server
-    // only validates them. Like the inbox actions it is internal (no external
-    // OAuth provider), so it carries the single nominal base scope `inbox`.
+    // Candidate slots may be supplied two ways (server-side EXCLUSIVE — exactly
+    // one): (a) `candidates` — the agent computes them LLM-side from the user
+    // calendar and the server validates + freebusy-filters them, or (b)
+    // `candidateWindow` — the agent hands the server a { start, end } window and
+    // the server generates busy-free candidates from the sender's Google
+    // Calendar. Like the inbox actions it is internal (no external OAuth
+    // provider), so it carries the single nominal base scope `inbox`.
+    //
+    // NOTE: the candidates/candidateWindow exclusivity is expressed here as
+    // `oneOf` for documentation + the deep JSON-Schema authorities, but the SDK's
+    // hand-written `validateActionInput` is a SHALLOW shape gate that does NOT
+    // interpret `oneOf` (neither key is in top-level `required`). The exclusivity
+    // (exactly one of candidates/candidateWindow) is ENFORCED server-side in
+    // SchedulingRequestService — see that service for the 400s on both-given /
+    // both-missing.
     // Spec: docs/specs/2026-06-10-inbox-intent-routing-design.md §2.1
     {
       action: "scheduling.request",
@@ -7694,7 +7733,7 @@ var ACTION_REGISTRY = {
             type: "array",
             minItems: 1,
             maxItems: 10,
-            description: "Candidate slots computed by the agent from the user calendar (LLM-side computation; the server only validates)",
+            description: "Explicit candidate slots computed by the agent from the user calendar. The server validates them AND (when Google Calendar is connected) filters out any that conflict with the sender's calendar. Mutually exclusive with candidateWindow \u2014 supply exactly one.",
             items: {
               type: "object",
               properties: {
@@ -7705,9 +7744,33 @@ var ACTION_REGISTRY = {
               additionalProperties: false
             }
           },
+          candidateWindow: {
+            type: "object",
+            description: "A { start, end } search window (ISO 8601, span \u2264 62 days). The server generates busy-free candidate slots from the sender's Google Calendar within it. Mutually exclusive with candidates \u2014 supply exactly one. Requires a connected Google Calendar.",
+            properties: {
+              start: { type: "string", description: "ISO 8601 window start" },
+              end: { type: "string", description: "ISO 8601 window end" }
+            },
+            required: ["start", "end"],
+            additionalProperties: false
+          },
+          hold: {
+            type: "boolean",
+            description: "When true (or omitted, when the sender's delegation policy has holds enabled), tentatively hold the offered slots on the sender's calendar as [\u4EEE] events until the counterpart responds or the request expires. Pass false to skip holds for this request. Only takes effect when the sender has an enabled scheduling delegation policy."
+          },
           message: { type: "string", description: "Optional human-readable message" }
         },
-        required: ["to", "topic", "durationMinutes", "candidates"],
+        // candidates / candidateWindow are intentionally NOT in `required`: the
+        // exclusive-choice is documented via `oneOf` and enforced server-side.
+        // Each oneOf branch re-declares its property locally (empty `properties`
+        // entry) so AJV strict mode (`strictRequired`) sees the required key as
+        // defined within the branch scope — the value shape itself is validated
+        // by the top-level `properties` above.
+        required: ["to", "topic", "durationMinutes"],
+        oneOf: [
+          { required: ["candidates"], properties: { candidates: {} } },
+          { required: ["candidateWindow"], properties: { candidateWindow: {} } }
+        ],
         additionalProperties: false
       },
       constraints: { rate_bucket: "inbox.write" },
@@ -7788,8 +7851,8 @@ var ACTION_REGISTRY = {
     },
     {
       capability: "calendar.read.basic",
-      description: "Read and list Google Calendar events",
-      includes: ["calendar.event.list", "calendar.event.read"],
+      description: "Read and list Google Calendar events, and check free/busy availability",
+      includes: ["calendar.event.list", "calendar.event.read", "calendar.freebusy"],
       version: "1.0.0"
     },
     {