@zhin.js/plugin-calendar 0.0.0-stage → 0.1.1

package/lib/credential-store.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Persists OAuth refresh tokens in the plugin's database state (never in .env).
+ */
+import type { OAuthProviderKind, RefreshTokenStore } from "./token-manager.js";
+/** The subset of zhin's PluginStateStore used by the calendar plugin. */
+export interface CalendarStateStore {
+    get<T>(key: string): Promise<T | undefined>;
+    set(key: string, value: never): Promise<void>;
+    delete(key: string): Promise<void>;
+}
+/** Who completed the chat authorization and where to notify them later. */
+export interface CredentialOwner<Target = unknown> {
+    readonly sender_id: string;
+    readonly target: Target;
+}
+export interface StoredCredential<Target = unknown> {
+    readonly refresh_token: string;
+    readonly authorized_at: string;
+    readonly authorized_by: CredentialOwner<Target> | null;
+}
+export declare class CalendarCredentialStore {
+    #private;
+    constructor(state: CalendarStateStore);
+    get(provider: OAuthProviderKind): Promise<StoredCredential | undefined>;
+    save(provider: OAuthProviderKind, refreshToken: string, authorizedBy: CredentialOwner | null): Promise<void>;
+    delete(provider: OAuthProviderKind): Promise<void>;
+    /** Adapter for OAuthTokenManager: loads and saves only the refresh token. */
+    refreshTokenStore(provider: OAuthProviderKind): RefreshTokenStore;
+}
+//# sourceMappingURL=credential-store.d.ts.map

package/lib/credential-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-store.d.ts","sourceRoot":"","sources":["../src/credential-store.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAE/E,yEAAyE;AACzE,MAAM,WAAW,kBAAkB;IACjC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC;IAC5C,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACpC;AAED,2EAA2E;AAC3E,MAAM,WAAW,eAAe,CAAC,MAAM,GAAG,OAAO;IAC/C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,gBAAgB,CAAC,MAAM,GAAG,OAAO;IAChD,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,aAAa,EAAE,eAAe,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;CACxD;AAMD,qBAAa,uBAAuB;;gBAGtB,KAAK,EAAE,kBAAkB;IAI/B,GAAG,CACP,QAAQ,EAAE,iBAAiB,GAC1B,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC;IAUlC,IAAI,CACR,QAAQ,EAAE,iBAAiB,EAC3B,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,eAAe,GAAG,IAAI,GACnC,OAAO,CAAC,IAAI,CAAC;IASV,MAAM,CAAC,QAAQ,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;IAIxD,6EAA6E;IAC7E,iBAAiB,CAAC,QAAQ,EAAE,iBAAiB,GAAG,iBAAiB;CAalE"}

package/lib/credential-store.js

@@ -0,0 +1,42 @@
+function credentialKey(provider) {
+    return `oauth/${provider}`;
+}
+export class CalendarCredentialStore {
+    #state;
+    constructor(state) {
+        this.#state = state;
+    }
+    async get(provider) {
+        const stored = await this.#state.get(credentialKey(provider));
+        if (!stored || typeof stored.refresh_token !== "string") {
+            return undefined;
+        }
+        return stored;
+    }
+    async save(provider, refreshToken, authorizedBy) {
+        const credential = {
+            refresh_token: refreshToken,
+            authorized_at: new Date().toISOString(),
+            authorized_by: authorizedBy,
+        };
+        await this.#state.set(credentialKey(provider), credential);
+    }
+    async delete(provider) {
+        await this.#state.delete(credentialKey(provider));
+    }
+    /** Adapter for OAuthTokenManager: loads and saves only the refresh token. */
+    refreshTokenStore(provider) {
+        return {
+            load: async () => {
+                const credential = await this.get(provider);
+                return credential?.refresh_token;
+            },
+            save: async (refreshToken) => {
+                const existing = await this.get(provider);
+                const authorizedBy = existing?.authorized_by ?? null;
+                await this.save(provider, refreshToken, authorizedBy);
+            },
+        };
+    }
+}
+//# sourceMappingURL=credential-store.js.map

package/lib/credential-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-store.js","sourceRoot":"","sources":["../src/credential-store.ts"],"names":[],"mappings":"AAwBA,SAAS,aAAa,CAAC,QAA2B;IAChD,OAAO,SAAS,QAAQ,EAAE,CAAC;AAC7B,CAAC;AAED,MAAM,OAAO,uBAAuB;IACzB,MAAM,CAAqB;IAEpC,YAAY,KAAyB;QACnC,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;IACtB,CAAC;IAED,KAAK,CAAC,GAAG,CACP,QAA2B;QAE3B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAClC,aAAa,CAAC,QAAQ,CAAC,CACxB,CAAC;QACF,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,aAAa,KAAK,QAAQ,EAAE,CAAC;YACxD,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,IAAI,CACR,QAA2B,EAC3B,YAAoB,EACpB,YAAoC;QAEpC,MAAM,UAAU,GAAqB;YACnC,aAAa,EAAE,YAAY;YAC3B,aAAa,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACvC,aAAa,EAAE,YAAY;SAC5B,CAAC;QACF,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,UAAmB,CAAC,CAAC;IACtE,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,QAA2B;QACtC,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC;IACpD,CAAC;IAED,6EAA6E;IAC7E,iBAAiB,CAAC,QAA2B;QAC3C,OAAO;YACL,IAAI,EAAE,KAAK,IAAI,EAAE;gBACf,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBAC5C,OAAO,UAAU,EAAE,aAAa,CAAC;YACnC,CAAC;YACD,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE;gBAC3B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBAC1C,MAAM,YAAY,GAAG,QAAQ,EAAE,aAAa,IAAI,IAAI,CAAC;gBACrD,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC;YACxD,CAAC;SACF,CAAC;IACJ,CAAC;CACF"}

package/lib/free-time.d.ts

@@ -0,0 +1,13 @@
+import type { CalendarEvent, FreeSlot } from "./types.js";
+export interface FreeTimeOptions {
+    readonly from: Date;
+    readonly to: Date;
+    readonly durationMinutes: number;
+    readonly workDayStart: string;
+    readonly workDayEnd: string;
+    readonly timezone: string;
+    readonly events: readonly CalendarEvent[];
+}
+/** Returns free slots of at least `durationMinutes`, clipped to work hours. */
+export declare function findFreeSlots(options: FreeTimeOptions): FreeSlot[];
+//# sourceMappingURL=free-time.d.ts.map

package/lib/free-time.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"free-time.d.ts","sourceRoot":"","sources":["../src/free-time.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE1D,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,SAAS,aAAa,EAAE,CAAC;CAC3C;AAuBD,+EAA+E;AAC/E,wBAAgB,aAAa,CAAC,OAAO,EAAE,eAAe,GAAG,QAAQ,EAAE,CAoFlE"}

package/lib/free-time.js

@@ -0,0 +1,96 @@
+/**
+ * Finds free slots inside work hours between `from` and `to`, given busy events.
+ */
+import { formatInZone, parseDateTimeInZone, zonedParts, zonedTimeToUtc, } from "./time.js";
+function parseHm(value) {
+    const match = /^(\d{1,2}):(\d{2})$/.exec(value.trim());
+    if (!match)
+        throw new Error(`工作时间格式无效：${value}（示例：09:00）`);
+    return { hour: Number(match[1]), minute: Number(match[2]) };
+}
+/** Advance `instant` by one calendar day in `timeZone` (noon-based to avoid DST edges). */
+function nextCalendarDay(instant, timeZone) {
+    const parts = zonedParts(instant, timeZone);
+    return zonedTimeToUtc({
+        year: parts.year,
+        month: parts.month,
+        day: parts.day + 1,
+        hour: 12,
+        minute: 0,
+    }, timeZone);
+}
+/** Returns free slots of at least `durationMinutes`, clipped to work hours. */
+export function findFreeSlots(options) {
+    const startHm = parseHm(options.workDayStart);
+    const endHm = parseHm(options.workDayEnd);
+    const durationMs = options.durationMinutes * 60000;
+    if (durationMs <= 0)
+        throw new Error("时长必须大于 0 分钟");
+    const busy = options.events
+        .map((event) => ({
+        start: parseDateTimeInZone(event.start, options.timezone).getTime(),
+        end: parseDateTimeInZone(event.end, options.timezone).getTime(),
+    }))
+        .filter((interval) => Number.isFinite(interval.start) && Number.isFinite(interval.end))
+        .sort((a, b) => a.start - b.start);
+    const slots = [];
+    // Walk calendar days via noon anchors so dayEnd+1min cannot stall the loop.
+    let cursorNoon = zonedTimeToUtc((() => {
+        const parts = zonedParts(options.from, options.timezone);
+        return {
+            year: parts.year,
+            month: parts.month,
+            day: parts.day,
+            hour: 12,
+            minute: 0,
+        };
+    })(), options.timezone);
+    const toMs = options.to.getTime();
+    let guard = 0;
+    while (cursorNoon.getTime() < toMs + 24 * 3600 * 1000 && guard < 400) {
+        guard += 1;
+        const parts = zonedParts(cursorNoon, options.timezone);
+        const dayStart = zonedTimeToUtc({
+            year: parts.year,
+            month: parts.month,
+            day: parts.day,
+            hour: startHm.hour,
+            minute: startHm.minute,
+        }, options.timezone).getTime();
+        const dayEnd = zonedTimeToUtc({
+            year: parts.year,
+            month: parts.month,
+            day: parts.day,
+            hour: endHm.hour,
+            minute: endHm.minute,
+        }, options.timezone).getTime();
+        if (dayEnd <= options.from.getTime()) {
+            cursorNoon = nextCalendarDay(cursorNoon, options.timezone);
+            continue;
+        }
+        if (dayStart >= toMs)
+            break;
+        let freeStart = Math.max(dayStart, options.from.getTime());
+        const freeEndLimit = Math.min(dayEnd, toMs);
+        for (const interval of busy) {
+            if (interval.end <= freeStart || interval.start >= freeEndLimit)
+                continue;
+            if (interval.start - freeStart >= durationMs) {
+                slots.push({
+                    start: formatInZone(new Date(freeStart), options.timezone),
+                    end: formatInZone(new Date(interval.start), options.timezone),
+                });
+            }
+            freeStart = Math.max(freeStart, interval.end);
+        }
+        if (freeEndLimit - freeStart >= durationMs) {
+            slots.push({
+                start: formatInZone(new Date(freeStart), options.timezone),
+                end: formatInZone(new Date(freeEndLimit), options.timezone),
+            });
+        }
+        cursorNoon = nextCalendarDay(cursorNoon, options.timezone);
+    }
+    return slots;
+}
+//# sourceMappingURL=free-time.js.map

package/lib/free-time.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"free-time.js","sourceRoot":"","sources":["../src/free-time.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EACL,YAAY,EACZ,mBAAmB,EACnB,UAAU,EACV,cAAc,GACf,MAAM,WAAW,CAAC;AAanB,SAAS,OAAO,CAAC,KAAa;IAC5B,MAAM,KAAK,GAAG,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACvD,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,YAAY,KAAK,YAAY,CAAC,CAAC;IAC3D,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC9D,CAAC;AAED,2FAA2F;AAC3F,SAAS,eAAe,CAAC,OAAa,EAAE,QAAgB;IACtD,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC5C,OAAO,cAAc,CACnB;QACE,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,GAAG,EAAE,KAAK,CAAC,GAAG,GAAG,CAAC;QAClB,IAAI,EAAE,EAAE;QACR,MAAM,EAAE,CAAC;KACV,EACD,QAAQ,CACT,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,aAAa,CAAC,OAAwB;IACpD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC1C,MAAM,UAAU,GAAG,OAAO,CAAC,eAAe,GAAG,KAAK,CAAC;IACnD,IAAI,UAAU,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC;IAEpD,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM;SACxB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACf,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE;QACnE,GAAG,EAAE,mBAAmB,CAAC,KAAK,CAAC,GAAG,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE;KAChE,CAAC,CAAC;SACF,MAAM,CACL,CAAC,QAAQ,EAAE,EAAE,CACX,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CACnE;SACA,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;IAErC,MAAM,KAAK,GAAe,EAAE,CAAC;IAC7B,4EAA4E;IAC5E,IAAI,UAAU,GAAG,cAAc,CAC7B,CAAC,GAAG,EAAE;QACJ,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QACzD,OAAO;YACL,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,IAAI,EAAE,EAAE;YACR,MAAM,EAAE,CAAC;SACV,CAAC;IACJ,CAAC,CAAC,EAAE,EACJ,OAAO,CAAC,QAAQ,CACjB,CAAC;IACF,MAAM,IAAI,GAAG,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC;IAClC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,OAAO,UAAU,CAAC,OAAO,EAAE,GAAG,IAAI,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,IAAI,KAAK,GAAG,GAAG,EAAE,CAAC;QACrE,KAAK,IAAI,CAAC,CAAC;QACX,MAAM,KAAK,GAAG,UAAU,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QACvD,MAAM,QAAQ,GAAG,cAAc,CAC7B;YACE,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,MAAM,EAAE,OAAO,CAAC,MAAM;SACvB,EACD,OAAO,CAAC,QAAQ,CACjB,CAAC,OAAO,EAAE,CAAC;QACZ,MAAM,MAAM,GAAG,cAAc,CAC3B;YACE,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,EACD,OAAO,CAAC,QAAQ,CACjB,CAAC,OAAO,EAAE,CAAC;QACZ,IAAI,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;YACrC,UAAU,GAAG,eAAe,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;YAC3D,SAAS;QACX,CAAC;QACD,IAAI,QAAQ,IAAI,IAAI;YAAE,MAAM;QAE5B,IAAI,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3D,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC5C,KAAK,MAAM,QAAQ,IAAI,IAAI,EAAE,CAAC;YAC5B,IAAI,QAAQ,CAAC,GAAG,IAAI,SAAS,IAAI,QAAQ,CAAC,KAAK,IAAI,YAAY;gBAAE,SAAS;YAC1E,IAAI,QAAQ,CAAC,KAAK,GAAG,SAAS,IAAI,UAAU,EAAE,CAAC;gBAC7C,KAAK,CAAC,IAAI,CAAC;oBACT,KAAK,EAAE,YAAY,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,QAAQ,CAAC;oBAC1D,GAAG,EAAE,YAAY,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,QAAQ,CAAC;iBAC9D,CAAC,CAAC;YACL,CAAC;YACD,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;QAChD,CAAC;QACD,IAAI,YAAY,GAAG,SAAS,IAAI,UAAU,EAAE,CAAC;YAC3C,KAAK,CAAC,IAAI,CAAC;gBACT,KAAK,EAAE,YAAY,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,QAAQ,CAAC;gBAC1D,GAAG,EAAE,YAAY,CAAC,IAAI,IAAI,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC,QAAQ,CAAC;aAC5D,CAAC,CAAC;QACL,CAAC;QACD,UAAU,GAAG,eAAe,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/lib/http-callback.d.ts

@@ -0,0 +1,13 @@
+/**
+ * OAuth redirect endpoint mounted on zhin's shared HTTP host.
+ */
+import type { IncomingMessage, ServerResponse } from "node:http";
+import type { CallbackResult } from "./chat-auth.js";
+export interface CalendarRouteHost {
+    route(method: string, path: string, handler: (request: IncomingMessage, response: ServerResponse, url: URL) => void | Promise<void>, meta?: {
+        readonly summary?: string;
+        readonly tags?: readonly string[];
+    }): () => void;
+}
+export declare function registerOAuthCallbackRoute(http: CalendarRouteHost, callbackPath: string, handleCallback: (searchParams: URLSearchParams) => Promise<CallbackResult>): () => void;
+//# sourceMappingURL=http-callback.d.ts.map

package/lib/http-callback.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-callback.d.ts","sourceRoot":"","sources":["../src/http-callback.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAErD,MAAM,WAAW,iBAAiB;IAChC,KAAK,CACH,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,CACP,OAAO,EAAE,eAAe,EACxB,QAAQ,EAAE,cAAc,EACxB,GAAG,EAAE,GAAG,KACL,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,EACzB,IAAI,CAAC,EAAE;QAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,GACtE,MAAM,IAAI,CAAC;CACf;AAmBD,wBAAgB,0BAA0B,CACxC,IAAI,EAAE,iBAAiB,EACvB,YAAY,EAAE,MAAM,EACpB,cAAc,EAAE,CAAC,YAAY,EAAE,eAAe,KAAK,OAAO,CAAC,cAAc,CAAC,GACzE,MAAM,IAAI,CAcZ"}

package/lib/http-callback.js

@@ -0,0 +1,26 @@
+function escapeHtml(text) {
+    return text
+        .replaceAll("&", "&")
+        .replaceAll("<", "&lt;")
+        .replaceAll(">", "&gt;")
+        .replaceAll('"', "&quot;");
+}
+function renderPage(result) {
+    return [
+        "<!doctype html>",
+        '<meta charset="utf-8">',
+        "<title>zhin calendar</title>",
+        `<p>${escapeHtml(result.message)}</p>`,
+    ].join("\n");
+}
+export function registerOAuthCallbackRoute(http, callbackPath, handleCallback) {
+    return http.route("GET", callbackPath, async (_request, response, url) => {
+        const result = await handleCallback(url.searchParams);
+        response.writeHead(result.statusCode, {
+            "content-type": "text/html; charset=utf-8",
+            "cache-control": "no-store",
+        });
+        response.end(renderPage(result));
+    }, { summary: "Calendar OAuth callback", tags: ["calendar"] });
+}
+//# sourceMappingURL=http-callback.js.map

package/lib/http-callback.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-callback.js","sourceRoot":"","sources":["../src/http-callback.ts"],"names":[],"mappings":"AAmBA,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,IAAI;SACR,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC;SACxB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC;SACvB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC;SACvB,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,UAAU,CAAC,MAAsB;IACxC,OAAO;QACL,iBAAiB;QACjB,wBAAwB;QACxB,8BAA8B;QAC9B,MAAM,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM;KACvC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,IAAuB,EACvB,YAAoB,EACpB,cAA0E;IAE1E,OAAO,IAAI,CAAC,KAAK,CACf,KAAK,EACL,YAAY,EACZ,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE;QAChC,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACtD,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,EAAE;YACpC,cAAc,EAAE,0BAA0B;YAC1C,eAAe,EAAE,UAAU;SAC5B,CAAC,CAAC;QACH,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;IACnC,CAAC,EACD,EAAE,OAAO,EAAE,yBAAyB,EAAE,IAAI,EAAE,CAAC,UAAU,CAAC,EAAE,CAC3D,CAAC;AACJ,CAAC"}

package/lib/index.d.ts

@@ -0,0 +1,32 @@
+import type { CalendarConfig } from "./config.js";
+import type { CalendarProvider } from "./types.js";
+import type { CalendarCredentialStore } from "./credential-store.js";
+import { OAuthTokenManager, type AuthorizationLostListener, type OAuthProviderKind } from "./token-manager.js";
+export type { CalendarEvent, CreateEventInput, FreeSlot, CalendarProvider, } from "./types.js";
+export { findFreeSlots } from "./free-time.js";
+export { parseCalDavEvents } from "./caldav.js";
+export { calendarConfig, assertCalendarTimezone, type CalendarConfig, } from "./config.js";
+export { cleanSecret } from "./secrets.js";
+export { calendarRuntimeToken, type CalendarRuntime } from "./runtime.js";
+export { OAuthTokenManager, OAuthTokenError, authCommandFor, type OAuthProviderKind, type RefreshTokenStore, type TokenManagerOptions, type TokenSet, } from "./token-manager.js";
+export { CalendarCredentialStore, type CalendarStateStore, type CredentialOwner, type StoredCredential, } from "./credential-store.js";
+export { CalendarAuthService, DEFAULT_OAUTH_CALLBACK_PATH, buildRedirectUri, localOriginFromAddress, parseOAuthProvider, } from "./chat-auth.js";
+export { OAuthSessionRegistry, OAUTH_SESSION_TTL_MS } from "./oauth-session.js";
+export { buildAuthorizeUrl, createPkcePair, createOAuthState, exchangeAuthorizationCode, GOOGLE_AUTH_SCOPES, MICROSOFT_AUTH_SCOPES, } from "./oauth-auth.js";
+export { microsoftCalendarBase } from "./oauth.js";
+export interface CalendarProviderDependencies {
+    /** Token managers shared with the chat authorization flow. */
+    readonly managers?: Partial<Record<OAuthProviderKind, OAuthTokenManager>>;
+}
+export interface TokenManagerDependencies {
+    readonly credentials?: CalendarCredentialStore;
+    readonly onAuthorizationLost?: AuthorizationLostListener;
+}
+/**
+ * Creates one token manager per OAuth provider that has client credentials.
+ * Stored (chat-authorized) refresh tokens win over config/env values.
+ */
+export declare function createOAuthTokenManagers(config: CalendarConfig, dependencies?: TokenManagerDependencies): Partial<Record<OAuthProviderKind, OAuthTokenManager>>;
+/** Builds the configured provider, or `undefined` when none is enabled. */
+export declare function createCalendarProvider(config: CalendarConfig, dependencies?: CalendarProviderDependencies): CalendarProvider | undefined;
+//# sourceMappingURL=index.d.ts.map

package/lib/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAOlD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AACrE,OAAO,EACL,iBAAiB,EACjB,KAAK,yBAAyB,EAC9B,KAAK,iBAAiB,EACvB,MAAM,oBAAoB,CAAC;AAE5B,YAAY,EACV,aAAa,EACb,gBAAgB,EAChB,QAAQ,EACR,gBAAgB,GACjB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EACL,cAAc,EACd,sBAAsB,EACtB,KAAK,cAAc,GACpB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,oBAAoB,EAAE,KAAK,eAAe,EAAE,MAAM,cAAc,CAAC;AAC1E,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EACxB,KAAK,QAAQ,GACd,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,uBAAuB,EACvB,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACpB,KAAK,gBAAgB,GACtB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,mBAAmB,EACnB,2BAA2B,EAC3B,gBAAgB,EAChB,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAChF,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,yBAAyB,EACzB,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAEnD,MAAM,WAAW,4BAA4B;IAC3C,8DAA8D;IAC9D,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,CAAC,CAAC;CAC3E;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,WAAW,CAAC,EAAE,uBAAuB,CAAC;IAC/C,QAAQ,CAAC,mBAAmB,CAAC,EAAE,yBAAyB,CAAC;CAC1D;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,cAAc,EACtB,YAAY,GAAE,wBAA6B,GAC1C,OAAO,CAAC,MAAM,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,CAAC,CAiCvD;AAED,2EAA2E;AAC3E,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,cAAc,EACtB,YAAY,GAAE,4BAAiC,GAC9C,gBAAgB,GAAG,SAAS,CAyE9B"}

package/lib/index.js

@@ -0,0 +1,122 @@
+import { cleanSecret } from "./secrets.js";
+import { createCalDavProvider } from "./caldav.js";
+import { createGoogleCalendarProvider, createMicrosoftCalendarProvider, } from "./oauth.js";
+import { OAuthTokenManager, } from "./token-manager.js";
+export { findFreeSlots } from "./free-time.js";
+export { parseCalDavEvents } from "./caldav.js";
+export { calendarConfig, assertCalendarTimezone, } from "./config.js";
+export { cleanSecret } from "./secrets.js";
+export { calendarRuntimeToken } from "./runtime.js";
+export { OAuthTokenManager, OAuthTokenError, authCommandFor, } from "./token-manager.js";
+export { CalendarCredentialStore, } from "./credential-store.js";
+export { CalendarAuthService, DEFAULT_OAUTH_CALLBACK_PATH, buildRedirectUri, localOriginFromAddress, parseOAuthProvider, } from "./chat-auth.js";
+export { OAuthSessionRegistry, OAUTH_SESSION_TTL_MS } from "./oauth-session.js";
+export { buildAuthorizeUrl, createPkcePair, createOAuthState, exchangeAuthorizationCode, GOOGLE_AUTH_SCOPES, MICROSOFT_AUTH_SCOPES, } from "./oauth-auth.js";
+export { microsoftCalendarBase } from "./oauth.js";
+/**
+ * Creates one token manager per OAuth provider that has client credentials.
+ * Stored (chat-authorized) refresh tokens win over config/env values.
+ */
+export function createOAuthTokenManagers(config, dependencies = {}) {
+    const managers = {};
+    const google = config.google;
+    const microsoft = config.microsoft;
+    const googleClientId = cleanSecret(google?.client_id ?? "");
+    const googleClientSecret = cleanSecret(google?.client_secret ?? "");
+    if (googleClientId && googleClientSecret) {
+        managers.google = new OAuthTokenManager({
+            provider: "google",
+            clientId: googleClientId,
+            clientSecret: googleClientSecret,
+            initialRefreshToken: cleanSecret(google?.refresh_token ?? ""),
+            tokenFile: cleanSecret(google?.token_file ?? "") || undefined,
+            tokenStore: dependencies.credentials?.refreshTokenStore("google"),
+            onAuthorizationLost: dependencies.onAuthorizationLost,
+        });
+    }
+    const microsoftClientId = cleanSecret(microsoft?.client_id ?? "");
+    if (microsoftClientId) {
+        managers.microsoft = new OAuthTokenManager({
+            provider: "microsoft",
+            clientId: microsoftClientId,
+            clientSecret: cleanSecret(microsoft?.client_secret ?? "") || undefined,
+            tenant: microsoft?.tenant || "common",
+            initialRefreshToken: cleanSecret(microsoft?.refresh_token ?? ""),
+            tokenFile: cleanSecret(microsoft?.token_file ?? "") || undefined,
+            tokenStore: dependencies.credentials?.refreshTokenStore("microsoft"),
+            onAuthorizationLost: dependencies.onAuthorizationLost,
+        });
+    }
+    return managers;
+}
+/** Builds the configured provider, or `undefined` when none is enabled. */
+export function createCalendarProvider(config, dependencies = {}) {
+    const caldav = config.caldav;
+    const google = config.google;
+    const microsoft = config.microsoft;
+    const managers = dependencies.managers;
+    if (config.provider === "caldav" &&
+        caldav?.enabled &&
+        cleanSecret(caldav.calendar_url ?? "")) {
+        return createCalDavProvider({
+            calendarUrl: cleanSecret(caldav.calendar_url ?? ""),
+            username: cleanSecret(caldav.username ?? ""),
+            password: cleanSecret(caldav.password ?? ""),
+            timezone: config.timezone,
+        });
+    }
+    if (config.provider === "google" && google?.enabled) {
+        const calendarId = (google.calendar_id || "primary").trim() || "primary";
+        const sharedManager = managers?.google;
+        if (sharedManager) {
+            return createGoogleCalendarProvider({
+                clientId: cleanSecret(google.client_id ?? ""),
+                tokenManager: sharedManager,
+                calendarId,
+                timezone: config.timezone,
+            });
+        }
+        const clientId = cleanSecret(google.client_id ?? "");
+        const clientSecret = cleanSecret(google.client_secret ?? "");
+        const refreshToken = cleanSecret(google.refresh_token ?? "");
+        if (!clientId || !clientSecret || !refreshToken) {
+            return undefined;
+        }
+        return createGoogleCalendarProvider({
+            clientId,
+            clientSecret,
+            refreshToken,
+            calendarId,
+            timezone: config.timezone,
+            tokenFile: cleanSecret(google.token_file ?? "") || undefined,
+        });
+    }
+    if (config.provider === "microsoft" && microsoft?.enabled) {
+        const calendarId = (microsoft.calendar_id ?? "").trim();
+        const sharedManager = managers?.microsoft;
+        if (sharedManager) {
+            return createMicrosoftCalendarProvider({
+                clientId: cleanSecret(microsoft.client_id ?? ""),
+                tokenManager: sharedManager,
+                calendarId,
+                timezone: config.timezone,
+            });
+        }
+        const clientId = cleanSecret(microsoft.client_id ?? "");
+        const refreshToken = cleanSecret(microsoft.refresh_token ?? "");
+        if (!clientId || !refreshToken) {
+            return undefined;
+        }
+        return createMicrosoftCalendarProvider({
+            clientId,
+            clientSecret: cleanSecret(microsoft.client_secret ?? "") || undefined,
+            refreshToken,
+            calendarId,
+            timezone: config.timezone,
+            tenant: microsoft.tenant || "common",
+            tokenFile: cleanSecret(microsoft.token_file ?? "") || undefined,
+        });
+    }
+    return undefined;
+}
+//# sourceMappingURL=index.js.map

package/lib/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EACL,4BAA4B,EAC5B,+BAA+B,GAChC,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,iBAAiB,GAGlB,MAAM,oBAAoB,CAAC;AAQ5B,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EACL,cAAc,EACd,sBAAsB,GAEvB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,oBAAoB,EAAwB,MAAM,cAAc,CAAC;AAC1E,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,cAAc,GAKf,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,uBAAuB,GAIxB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,mBAAmB,EACnB,2BAA2B,EAC3B,gBAAgB,EAChB,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAChF,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,yBAAyB,EACzB,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAYnD;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CACtC,MAAsB,EACtB,eAAyC,EAAE;IAE3C,MAAM,QAAQ,GAA0D,EAAE,CAAC;IAC3E,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7B,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;IAEnC,MAAM,cAAc,GAAG,WAAW,CAAC,MAAM,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC;IAC5D,MAAM,kBAAkB,GAAG,WAAW,CAAC,MAAM,EAAE,aAAa,IAAI,EAAE,CAAC,CAAC;IACpE,IAAI,cAAc,IAAI,kBAAkB,EAAE,CAAC;QACzC,QAAQ,CAAC,MAAM,GAAG,IAAI,iBAAiB,CAAC;YACtC,QAAQ,EAAE,QAAQ;YAClB,QAAQ,EAAE,cAAc;YACxB,YAAY,EAAE,kBAAkB;YAChC,mBAAmB,EAAE,WAAW,CAAC,MAAM,EAAE,aAAa,IAAI,EAAE,CAAC;YAC7D,SAAS,EAAE,WAAW,CAAC,MAAM,EAAE,UAAU,IAAI,EAAE,CAAC,IAAI,SAAS;YAC7D,UAAU,EAAE,YAAY,CAAC,WAAW,EAAE,iBAAiB,CAAC,QAAQ,CAAC;YACjE,mBAAmB,EAAE,YAAY,CAAC,mBAAmB;SACtD,CAAC,CAAC;IACL,CAAC;IAED,MAAM,iBAAiB,GAAG,WAAW,CAAC,SAAS,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC;IAClE,IAAI,iBAAiB,EAAE,CAAC;QACtB,QAAQ,CAAC,SAAS,GAAG,IAAI,iBAAiB,CAAC;YACzC,QAAQ,EAAE,WAAW;YACrB,QAAQ,EAAE,iBAAiB;YAC3B,YAAY,EAAE,WAAW,CAAC,SAAS,EAAE,aAAa,IAAI,EAAE,CAAC,IAAI,SAAS;YACtE,MAAM,EAAE,SAAS,EAAE,MAAM,IAAI,QAAQ;YACrC,mBAAmB,EAAE,WAAW,CAAC,SAAS,EAAE,aAAa,IAAI,EAAE,CAAC;YAChE,SAAS,EAAE,WAAW,CAAC,SAAS,EAAE,UAAU,IAAI,EAAE,CAAC,IAAI,SAAS;YAChE,UAAU,EAAE,YAAY,CAAC,WAAW,EAAE,iBAAiB,CAAC,WAAW,CAAC;YACpE,mBAAmB,EAAE,YAAY,CAAC,mBAAmB;SACtD,CAAC,CAAC;IACL,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,sBAAsB,CACpC,MAAsB,EACtB,eAA6C,EAAE;IAE/C,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7B,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7B,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;IACnC,MAAM,QAAQ,GAAG,YAAY,CAAC,QAAQ,CAAC;IAEvC,IACE,MAAM,CAAC,QAAQ,KAAK,QAAQ;QAC5B,MAAM,EAAE,OAAO;QACf,WAAW,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC,EACtC,CAAC;QACD,OAAO,oBAAoB,CAAC;YAC1B,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC;YACnD,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC;YAC5C,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC;YAC5C,QAAQ,EAAE,MAAM,CAAC,QAAQ;SAC1B,CAAC,CAAC;IACL,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;QACpD,MAAM,UAAU,GAAG,CAAC,MAAM,CAAC,WAAW,IAAI,SAAS,CAAC,CAAC,IAAI,EAAE,IAAI,SAAS,CAAC;QACzE,MAAM,aAAa,GAAG,QAAQ,EAAE,MAAM,CAAC;QACvC,IAAI,aAAa,EAAE,CAAC;YAClB,OAAO,4BAA4B,CAAC;gBAClC,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC;gBAC7C,YAAY,EAAE,aAAa;gBAC3B,UAAU;gBACV,QAAQ,EAAE,MAAM,CAAC,QAAQ;aAC1B,CAAC,CAAC;QACL,CAAC;QACD,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;QACrD,MAAM,YAAY,GAAG,WAAW,CAAC,MAAM,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;QAC7D,MAAM,YAAY,GAAG,WAAW,CAAC,MAAM,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;QAC7D,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,IAAI,CAAC,YAAY,EAAE,CAAC;YAChD,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,4BAA4B,CAAC;YAClC,QAAQ;YACR,YAAY;YACZ,YAAY;YACZ,UAAU;YACV,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,SAAS,EAAE,WAAW,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC,IAAI,SAAS;SAC7D,CAAC,CAAC;IACL,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,KAAK,WAAW,IAAI,SAAS,EAAE,OAAO,EAAE,CAAC;QAC1D,MAAM,UAAU,GAAG,CAAC,SAAS,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACxD,MAAM,aAAa,GAAG,QAAQ,EAAE,SAAS,CAAC;QAC1C,IAAI,aAAa,EAAE,CAAC;YAClB,OAAO,+BAA+B,CAAC;gBACrC,QAAQ,EAAE,WAAW,CAAC,SAAS,CAAC,SAAS,IAAI,EAAE,CAAC;gBAChD,YAAY,EAAE,aAAa;gBAC3B,UAAU;gBACV,QAAQ,EAAE,MAAM,CAAC,QAAQ;aAC1B,CAAC,CAAC;QACL,CAAC;QACD,MAAM,QAAQ,GAAG,WAAW,CAAC,SAAS,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;QACxD,MAAM,YAAY,GAAG,WAAW,CAAC,SAAS,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;QAChE,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,EAAE,CAAC;YAC/B,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,+BAA+B,CAAC;YACrC,QAAQ;YACR,YAAY,EAAE,WAAW,CAAC,SAAS,CAAC,aAAa,IAAI,EAAE,CAAC,IAAI,SAAS;YACrE,YAAY;YACZ,UAAU;YACV,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,MAAM,EAAE,SAAS,CAAC,MAAM,IAAI,QAAQ;YACpC,SAAS,EAAE,WAAW,CAAC,SAAS,CAAC,UAAU,IAAI,EAAE,CAAC,IAAI,SAAS;SAChE,CAAC,CAAC;IACL,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/lib/oauth-auth.d.ts

@@ -0,0 +1,37 @@
+export declare const GOOGLE_AUTH_SCOPES: readonly ["https://www.googleapis.com/auth/calendar.events", "https://www.googleapis.com/auth/calendar.readonly"];
+export declare const MICROSOFT_AUTH_SCOPES: readonly ["offline_access", "Calendars.ReadWrite", "User.Read"];
+export interface PkcePair {
+    readonly verifier: string;
+    readonly challenge: string;
+}
+/** RFC 7636 S256 PKCE pair. */
+export declare function createPkcePair(random?: () => Buffer): PkcePair;
+export declare function createOAuthState(random?: () => Buffer): string;
+export interface AuthUrlOptions {
+    readonly provider: "google" | "microsoft";
+    readonly clientId: string;
+    readonly redirectUri: string;
+    readonly state: string;
+    readonly codeChallenge: string;
+    readonly tenant?: string;
+}
+/** Builds the browser authorize URL (PKCE S256). */
+export declare function buildAuthorizeUrl(options: AuthUrlOptions): string;
+export interface ExchangeOptions {
+    readonly provider: "google" | "microsoft";
+    readonly clientId: string;
+    readonly clientSecret?: string;
+    readonly tenant?: string;
+    readonly redirectUri: string;
+    readonly code: string;
+    readonly codeVerifier: string;
+    readonly fetchImpl?: typeof fetch;
+}
+export interface ExchangedTokens {
+    readonly accessToken: string;
+    readonly refreshToken: string;
+    readonly expiresIn: number;
+}
+/** Exchanges an authorization code for tokens (PKCE). */
+export declare function exchangeAuthorizationCode(options: ExchangeOptions): Promise<ExchangedTokens>;
+//# sourceMappingURL=oauth-auth.d.ts.map

package/lib/oauth-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-auth.d.ts","sourceRoot":"","sources":["../src/oauth-auth.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,kBAAkB,mHAGrB,CAAC;AAEX,eAAO,MAAM,qBAAqB,iEAIxB,CAAC;AAEX,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,+BAA+B;AAC/B,wBAAgB,cAAc,CAC5B,MAAM,GAAE,MAAM,MAA8B,GAC3C,QAAQ,CAIV;AAED,wBAAgB,gBAAgB,CAC9B,MAAM,GAAE,MAAM,MAA8B,GAC3C,MAAM,CAER;AAMD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,QAAQ,EAAE,QAAQ,GAAG,WAAW,CAAC;IAC1C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,oDAAoD;AACpD,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,cAAc,GAAG,MAAM,CA2BjE;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,QAAQ,EAAE,QAAQ,GAAG,WAAW,CAAC;IAC1C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CACnC;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,yDAAyD;AACzD,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC,eAAe,CAAC,CA6C1B"}

package/lib/oauth-auth.js

@@ -0,0 +1,91 @@
+/**
+ * OAuth authorization-code + PKCE helpers for the one-time auth CLI.
+ */
+import { createHash, randomBytes } from "node:crypto";
+export const GOOGLE_AUTH_SCOPES = [
+    "https://www.googleapis.com/auth/calendar.events",
+    "https://www.googleapis.com/auth/calendar.readonly",
+];
+export const MICROSOFT_AUTH_SCOPES = [
+    "offline_access",
+    "Calendars.ReadWrite",
+    "User.Read",
+];
+/** RFC 7636 S256 PKCE pair. */
+export function createPkcePair(random = () => randomBytes(32)) {
+    const verifier = base64Url(random());
+    const challenge = base64Url(createHash("sha256").update(verifier).digest());
+    return { verifier, challenge };
+}
+export function createOAuthState(random = () => randomBytes(16)) {
+    return base64Url(random());
+}
+function base64Url(buffer) {
+    return buffer.toString("base64url");
+}
+/** Builds the browser authorize URL (PKCE S256). */
+export function buildAuthorizeUrl(options) {
+    if (options.provider === "google") {
+        const url = new URL("https://accounts.google.com/o/oauth2/v2/auth");
+        url.searchParams.set("client_id", options.clientId);
+        url.searchParams.set("redirect_uri", options.redirectUri);
+        url.searchParams.set("response_type", "code");
+        url.searchParams.set("scope", GOOGLE_AUTH_SCOPES.join(" "));
+        url.searchParams.set("access_type", "offline");
+        url.searchParams.set("prompt", "consent");
+        url.searchParams.set("state", options.state);
+        url.searchParams.set("code_challenge", options.codeChallenge);
+        url.searchParams.set("code_challenge_method", "S256");
+        return url.toString();
+    }
+    const tenant = options.tenant?.trim() || "common";
+    const url = new URL(`https://login.microsoftonline.com/${tenant}/oauth2/v2.0/authorize`);
+    url.searchParams.set("client_id", options.clientId);
+    url.searchParams.set("redirect_uri", options.redirectUri);
+    url.searchParams.set("response_type", "code");
+    url.searchParams.set("response_mode", "query");
+    url.searchParams.set("scope", MICROSOFT_AUTH_SCOPES.join(" "));
+    url.searchParams.set("state", options.state);
+    url.searchParams.set("code_challenge", options.codeChallenge);
+    url.searchParams.set("code_challenge_method", "S256");
+    return url.toString();
+}
+/** Exchanges an authorization code for tokens (PKCE). */
+export async function exchangeAuthorizationCode(options) {
+    const body = new URLSearchParams({
+        client_id: options.clientId,
+        code: options.code,
+        redirect_uri: options.redirectUri,
+        grant_type: "authorization_code",
+        code_verifier: options.codeVerifier,
+    });
+    if (options.clientSecret?.trim())
+        body.set("client_secret", options.clientSecret.trim());
+    const url = options.provider === "google"
+        ? "https://oauth2.googleapis.com/token"
+        : `https://login.microsoftonline.com/${options.tenant?.trim() || "common"}/oauth2/v2.0/token`;
+    const fetchImpl = options.fetchImpl ?? fetch;
+    const response = await fetchImpl(url, {
+        method: "POST",
+        headers: { "content-type": "application/x-www-form-urlencoded" },
+        body,
+    });
+    const data = (await response.json());
+    if (!response.ok) {
+        const desc = String(data.error_description ?? data.error ?? response.statusText);
+        throw new Error(`${options.provider}: 换取 token 失败：${desc}`);
+    }
+    const refreshToken = String(data.refresh_token ?? "");
+    const accessToken = String(data.access_token ?? "");
+    if (!refreshToken) {
+        throw new Error(`${options.provider}: 响应没有 refresh_token。Google 请确认 access_type=offline&prompt=consent；Microsoft 请确认已请求 offline_access。`);
+    }
+    if (!accessToken)
+        throw new Error(`${options.provider}: 响应缺少 access_token`);
+    return {
+        accessToken,
+        refreshToken,
+        expiresIn: Number(data.expires_in ?? 3600),
+    };
+}
+//# sourceMappingURL=oauth-auth.js.map

package/lib/oauth-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-auth.js","sourceRoot":"","sources":["../src/oauth-auth.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAEtD,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,iDAAiD;IACjD,mDAAmD;CAC3C,CAAC;AAEX,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,gBAAgB;IAChB,qBAAqB;IACrB,WAAW;CACH,CAAC;AAOX,+BAA+B;AAC/B,MAAM,UAAU,cAAc,CAC5B,SAAuB,GAAG,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC;IAE5C,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;IACrC,MAAM,SAAS,GAAG,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5E,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,SAAuB,GAAG,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC;IAE5C,OAAO,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,SAAS,CAAC,MAAc;IAC/B,OAAO,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACtC,CAAC;AAWD,oDAAoD;AACpD,MAAM,UAAU,iBAAiB,CAAC,OAAuB;IACvD,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,8CAA8C,CAAC,CAAC;QACpE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QACpD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;QAC1D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;QAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;QAC/C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAC1C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QAC7C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;QAC9D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;QACtD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;IACxB,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,QAAQ,CAAC;IAClD,MAAM,GAAG,GAAG,IAAI,GAAG,CACjB,qCAAqC,MAAM,wBAAwB,CACpE,CAAC;IACF,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IACpD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IAC1D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;IAC/C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAC7C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;IAC9D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;IACtD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAmBD,yDAAyD;AACzD,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,OAAwB;IAExB,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAC/B,SAAS,EAAE,OAAO,CAAC,QAAQ;QAC3B,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,YAAY,EAAE,OAAO,CAAC,WAAW;QACjC,UAAU,EAAE,oBAAoB;QAChC,aAAa,EAAE,OAAO,CAAC,YAAY;KACpC,CAAC,CAAC;IACH,IAAI,OAAO,CAAC,YAAY,EAAE,IAAI,EAAE;QAC9B,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,OAAO,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC;IAEzD,MAAM,GAAG,GACP,OAAO,CAAC,QAAQ,KAAK,QAAQ;QAC3B,CAAC,CAAC,qCAAqC;QACvC,CAAC,CAAC,qCACE,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,QAC5B,oBAAoB,CAAC;IAE3B,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;IAC7C,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;QACpC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI;KACL,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAC;IAChE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,MAAM,CACjB,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC,KAAK,IAAI,QAAQ,CAAC,UAAU,CAC5D,CAAC;QACF,MAAM,IAAI,KAAK,CAAC,GAAG,OAAO,CAAC,QAAQ,iBAAiB,IAAI,EAAE,CAAC,CAAC;IAC9D,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;IACtD,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;IACpD,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CACb,GAAG,OAAO,CAAC,QAAQ,qGAAqG,CACzH,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,WAAW;QACd,MAAM,IAAI,KAAK,CAAC,GAAG,OAAO,CAAC,QAAQ,qBAAqB,CAAC,CAAC;IAC5D,OAAO;QACL,WAAW;QACX,YAAY;QACZ,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC;KAC3C,CAAC;AACJ,CAAC"}

package/lib/oauth-session.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Short-lived, single-use OAuth authorization sessions keyed by `state`.
+ * Kept in memory: a restart simply invalidates pending links.
+ */
+import type { OAuthProviderKind } from "./token-manager.js";
+export declare const OAUTH_SESSION_TTL_MS: number;
+export interface OAuthSession<Requester> {
+    readonly provider: OAuthProviderKind;
+    readonly state: string;
+    readonly codeVerifier: string;
+    readonly redirectUri: string;
+    readonly requester: Requester;
+    readonly expiresAt: number;
+}
+export declare class OAuthSessionRegistry<Requester> {
+    #private;
+    constructor(options?: {
+        now?: () => number;
+        ttlMs?: number;
+    });
+    create(session: Omit<OAuthSession<Requester>, "expiresAt">): OAuthSession<Requester>;
+    /** Removes and returns the session; a state can only be consumed once. */
+    consume(state: string): OAuthSession<Requester> | undefined;
+    pruneExpired(): void;
+    get size(): number;
+}
+//# sourceMappingURL=oauth-session.d.ts.map

package/lib/oauth-session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-session.d.ts","sourceRoot":"","sources":["../src/oauth-session.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAE5D,eAAO,MAAM,oBAAoB,QAAiB,CAAC;AAEnD,MAAM,WAAW,YAAY,CAAC,SAAS;IACrC,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IACrC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,qBAAa,oBAAoB,CAAC,SAAS;;gBAK7B,OAAO,GAAE;QAAE,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAO;IAKhE,MAAM,CACJ,OAAO,EAAE,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,EAAE,WAAW,CAAC,GAClD,YAAY,CAAC,SAAS,CAAC;IAU1B,0EAA0E;IAC1E,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC,GAAG,SAAS;IAY3D,YAAY,IAAI,IAAI;IASpB,IAAI,IAAI,IAAI,MAAM,CAEjB;CACF"}