connected-workspace-mcp 1.0.0

package/.env.example

@@ -0,0 +1,17 @@
+PA_MCP_TOKEN_PATH=
+# Defaults to the same directory as PA_MCP_TOKEN_PATH.
+PA_MCP_LOG_PATH=
+
+GOOGLE_CLIENT_ID=
+GOOGLE_CLIENT_SECRET=
+# Optional legacy fallback; normally saved in the user token store.
+GOOGLE_REFRESH_TOKEN=
+GOOGLE_REDIRECT_URI=http://localhost:3000
+
+LINKEDIN_CLIENT_ID=
+LINKEDIN_CLIENT_SECRET=
+# Optional legacy fallbacks; normally saved in the user token store.
+LINKEDIN_ACCESS_TOKEN=
+LINKEDIN_USER_URN=
+LINKEDIN_REDIRECT_URI=http://localhost:3001/callback
+LINKEDIN_API_VERSION=202609

package/CONTRIBUTING.md

@@ -0,0 +1,47 @@
+# Contributing
+
+Contributions to Connected Workspace MCP are welcome. Bug reports, focused
+feature proposals, documentation improvements, and pull requests are all
+useful.
+
+## Development Setup
+
+1. Fork and clone the repository.
+2. Install Node.js 20 or newer.
+3. Install dependencies with `npm ci`.
+4. Copy `.env.example` to `.env` only when live local testing is necessary.
+5. Build with `npm run build`.
+
+Do not commit `.env`, OAuth tokens, logs, email content, or LinkedIn post data.
+Use mocked provider clients in automated tests.
+
+## Making Changes
+
+- Keep provider authorization under `src/auth/<provider>/`.
+- Keep integration tools under `src/tools/<integration>/`.
+- Keep `src/index.ts` limited to client construction and tool registration.
+- Preserve the shared Google OAuth client used by Gmail and Calendar.
+- Add or update focused Jest coverage for behavior changes.
+- Avoid unrelated formatting or refactoring in the same pull request.
+
+## Validate
+
+Run the same checks used by pull-request automation:
+
+```powershell
+npm run format:check
+npm test
+npm run check
+npm run build
+```
+
+Tests must not contact live providers or mutate real accounts.
+
+## Pull Requests
+
+Describe the user-visible behavior, note any provider permissions or API
+products required, and include the validation performed. Link related issues
+and call out breaking changes explicitly.
+
+By contributing, you agree that your contributions are licensed under the
+[MIT License](LICENSE).

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Deepak Kamboj
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,123 @@
+# Connected Workspace MCP
+
+[![npm version](https://img.shields.io/npm/v/connected-workspace-mcp)](https://www.npmjs.com/package/connected-workspace-mcp)
+[![CI](https://github.com/deepakkamboj/connected-workspace-mcp/actions/workflows/ci.yml/badge.svg)](https://github.com/deepakkamboj/connected-workspace-mcp/actions/workflows/ci.yml)
+[![Node.js](https://img.shields.io/badge/Node.js-%3E%3D20-339933?logo=node.js&logoColor=white)](https://nodejs.org/)
+[![TypeScript](https://img.shields.io/badge/TypeScript-5.9-3178C6?logo=typescript&logoColor=white)](https://www.typescriptlang.org/)
+[![MCP](https://img.shields.io/badge/Model_Context_Protocol-v2-0A7EA4)](https://modelcontextprotocol.io/)
+[![License: MIT](https://img.shields.io/badge/License-MIT-brightgreen.svg)](LICENSE)
+
+A TypeScript stdio MCP server for Gmail, Google Calendar, and LinkedIn. It gives
+MCP-compatible assistants explicit tools for email, scheduling, professional
+profile access, and social publishing.
+
+Gmail and Calendar share one Google OAuth grant. LinkedIn uses a separate OAuth
+grant. Both providers persist tokens outside the package directory so the
+server can restart without repeated authorization.
+
+## Install
+
+Requires Node.js 20 or newer.
+
+```powershell
+npm install --global connected-workspace-mcp
+```
+
+Configure the provider credentials described in the auth guides, then run:
+
+```powershell
+connected-workspace-google-auth
+connected-workspace-linkedin-auth
+connected-workspace-mcp
+```
+
+With `npx`, keep credentials in a private file and pass only its path:
+
+```powershell
+npx -y connected-workspace-mcp --env-file "C:\Users\you\.connected-workspace-mcp\.env"
+```
+
+LinkedIn is optional. The server can run with only Google configured.
+
+## MCP Host Configuration
+
+```json
+{
+  "servers": {
+    "connected-workspace": {
+      "type": "stdio",
+      "command": "npx",
+      "args": [
+        "-y",
+        "connected-workspace-mcp",
+        "--env-file",
+        "C:\\Users\\you\\.connected-workspace-mcp\\.env"
+      ]
+    }
+  }
+}
+```
+
+The process can instead inherit provider environment variables directly. Never
+pass client secrets or tokens as command-line arguments.
+
+## Documentation
+
+- [Documentation index](docs/README.md)
+- [Installation and MCP host setup](docs/installation.md)
+- [Google OAuth setup](docs/google-auth.md)
+- [LinkedIn OAuth setup](docs/linkedin-auth.md)
+- [Configuration, token storage, and logs](docs/configuration.md)
+- [Tool reference](docs/tools.md)
+- [Authentication troubleshooting](docs/troubleshooting.md)
+- [npm publishing guide](docs/publishing.md)
+
+## Capabilities
+
+Gmail tools search and read messages, send new messages, reply in threads, and
+modify labels. Calendar tools list, create, update, and delete events, and query
+free/busy periods. LinkedIn tools read the authenticated profile and posts,
+inspect available engagement, publish text or image posts, and delete owned
+posts.
+
+Standard LinkedIn APIs do not support arbitrary edits to profile fields such as
+headline, experience, or skills. Available endpoints depend on the products and
+permissions approved for the LinkedIn app.
+
+## Local Development
+
+```powershell
+npm install
+Copy-Item .env.example .env
+npm run auth:google
+npm run auth:linkedin
+npm run build
+npm start
+```
+
+Run the deterministic mocked test suite and project checks with:
+
+```powershell
+npm test
+npm run check
+npm run format:check
+```
+
+Tests never contact live providers or mutate real accounts.
+
+## Contributing
+
+Contributions are welcome. Read [CONTRIBUTING.md](CONTRIBUTING.md) for project
+structure, security requirements, validation commands, and pull-request
+guidance.
+
+## Security
+
+Never commit `.env`, token files, or logs. The JSON-lines logger excludes tool
+arguments, message bodies, post content, and credentials. Configure your MCP
+host to require confirmation before write tools send email, modify calendars,
+or publish and delete LinkedIn posts.
+
+## License
+
+Licensed under the [MIT License](LICENSE).

package/dist/src/auth/google/authorize.js

@@ -0,0 +1,71 @@
+#!/usr/bin/env node
+import '../../config/bootstrap.js';
+import { createServer } from 'node:http';
+import { google } from 'googleapis';
+import { saveGoogleTokens, TOKEN_STORE_PATH } from '../token-store.js';
+import { logger } from '../../logging/logger.js';
+import { GOOGLE_SCOPES } from './index.js';
+const clientId = process.env.GOOGLE_CLIENT_ID;
+const clientSecret = process.env.GOOGLE_CLIENT_SECRET;
+const redirectUri = process.env.GOOGLE_REDIRECT_URI || 'http://localhost:3000';
+if (!clientId || !clientSecret) {
+    throw new Error('Set GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET in .env first.');
+}
+const callback = new URL(redirectUri);
+const auth = new google.auth.OAuth2(clientId, clientSecret, redirectUri);
+const authorizationUrl = auth.generateAuthUrl({
+    access_type: 'offline',
+    include_granted_scopes: true,
+    prompt: 'consent',
+    scope: GOOGLE_SCOPES,
+});
+const server = createServer(async (request, response) => {
+    const requestUrl = new URL(request.url || '/', redirectUri);
+    if (requestUrl.pathname !== callback.pathname) {
+        response.writeHead(404).end('Not found');
+        return;
+    }
+    const code = requestUrl.searchParams.get('code');
+    if (!code) {
+        response.writeHead(400).end('Google did not return an authorization code.');
+        return;
+    }
+    try {
+        const { tokens } = await auth.getToken(code);
+        if (!tokens.refresh_token) {
+            throw new Error('No refresh token returned. Revoke existing app access and authorize again.');
+        }
+        const grantedScopes = new Set((tokens.scope || '').split(' ').filter(Boolean));
+        const missingScopes = GOOGLE_SCOPES.filter((scope) => !grantedScopes.has(scope));
+        if (missingScopes.length > 0) {
+            throw new Error(`Authorization was incomplete. Approve these missing scopes: ${missingScopes.join(', ')}`);
+        }
+        await saveGoogleTokens({
+            accessToken: tokens.access_token || undefined,
+            refreshToken: tokens.refresh_token,
+            expiryDate: tokens.expiry_date || undefined,
+        });
+        response
+            .writeHead(200, { 'Content-Type': 'text/plain' })
+            .end('Google authorization complete. You can close this tab.');
+        await logger.info('Google authorization completed', {
+            tokenStore: TOKEN_STORE_PATH,
+        });
+        console.log(`Saved reusable Google credentials to ${TOKEN_STORE_PATH}.`);
+    }
+    catch (error) {
+        response
+            .writeHead(500)
+            .end('Google authorization failed. Check the terminal.');
+        await logger.error('Google authorization failed', error);
+        console.error(error);
+        process.exitCode = 1;
+    }
+    finally {
+        server.close();
+    }
+});
+server.listen(Number(callback.port || 80), callback.hostname, () => {
+    console.log('Open this URL in your browser:');
+    console.log(authorizationUrl);
+});

package/dist/src/auth/google/index.js

@@ -0,0 +1,27 @@
+import { google } from 'googleapis';
+import { loadGoogleTokens } from '../token-store.js';
+export const GOOGLE_SCOPES = [
+    'https://www.googleapis.com/auth/gmail.modify',
+    'https://www.googleapis.com/auth/gmail.send',
+    'https://www.googleapis.com/auth/gmail.compose',
+    'https://www.googleapis.com/auth/calendar',
+];
+function requiredEnv(name) {
+    const value = process.env[name];
+    if (!value)
+        throw new Error(`${name} is required. Copy .env.example to .env and run npm run auth:google.`);
+    return value;
+}
+export function createGoogleAuth() {
+    const storedTokens = loadGoogleTokens();
+    const auth = new google.auth.OAuth2(requiredEnv('GOOGLE_CLIENT_ID'), requiredEnv('GOOGLE_CLIENT_SECRET'), process.env.GOOGLE_REDIRECT_URI || 'http://localhost:3000');
+    const refreshToken = storedTokens?.refreshToken || process.env.GOOGLE_REFRESH_TOKEN;
+    if (!refreshToken)
+        throw new Error('Google is not authorized. Run npm run auth:google once.');
+    auth.setCredentials({
+        access_token: storedTokens?.accessToken,
+        refresh_token: refreshToken,
+        expiry_date: storedTokens?.expiryDate,
+    });
+    return auth;
+}

package/dist/src/auth/linkedin/authorize.js

@@ -0,0 +1,93 @@
+#!/usr/bin/env node
+import '../../config/bootstrap.js';
+import { randomBytes } from 'node:crypto';
+import { createServer } from 'node:http';
+import { saveLinkedInTokens, TOKEN_STORE_PATH } from '../token-store.js';
+import { logger } from '../../logging/logger.js';
+const clientId = process.env.LINKEDIN_CLIENT_ID;
+const clientSecret = process.env.LINKEDIN_CLIENT_SECRET;
+const redirectUri = process.env.LINKEDIN_REDIRECT_URI || 'http://localhost:3001/callback';
+if (!clientId || !clientSecret) {
+    throw new Error('Set LINKEDIN_CLIENT_ID and LINKEDIN_CLIENT_SECRET in .env first.');
+}
+const state = randomBytes(24).toString('hex');
+const callback = new URL(redirectUri);
+const authorizationUrl = new URL('https://www.linkedin.com/oauth/v2/authorization');
+authorizationUrl.search = new URLSearchParams({
+    response_type: 'code',
+    client_id: clientId,
+    redirect_uri: redirectUri,
+    state,
+    scope: 'openid profile email w_member_social',
+}).toString();
+const server = createServer(async (request, response) => {
+    const requestUrl = new URL(request.url || '/', redirectUri);
+    if (requestUrl.pathname !== callback.pathname) {
+        response.writeHead(404).end('Not found');
+        return;
+    }
+    if (requestUrl.searchParams.get('state') !== state) {
+        response.writeHead(400).end('Invalid OAuth state.');
+        return;
+    }
+    const code = requestUrl.searchParams.get('code');
+    if (!code) {
+        response
+            .writeHead(400)
+            .end('LinkedIn did not return an authorization code.');
+        return;
+    }
+    try {
+        const tokenResponse = await fetch('https://www.linkedin.com/oauth/v2/accessToken', {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+            body: new URLSearchParams({
+                grant_type: 'authorization_code',
+                code,
+                redirect_uri: redirectUri,
+                client_id: clientId,
+                client_secret: clientSecret,
+            }),
+        });
+        const tokens = (await tokenResponse.json());
+        if (!tokenResponse.ok || !tokens.access_token) {
+            throw new Error(tokens.error_description || 'LinkedIn token exchange failed.');
+        }
+        const profileResponse = await fetch('https://api.linkedin.com/v2/userinfo', {
+            headers: { Authorization: `Bearer ${tokens.access_token}` },
+        });
+        const profile = (await profileResponse.json());
+        if (!profileResponse.ok || !profile.sub)
+            throw new Error('LinkedIn profile lookup failed.');
+        await saveLinkedInTokens({
+            accessToken: tokens.access_token,
+            userUrn: `urn:li:person:${profile.sub}`,
+            refreshToken: tokens.refresh_token,
+            expiresAt: tokens.expires_in
+                ? Date.now() + tokens.expires_in * 1000
+                : undefined,
+        });
+        response
+            .writeHead(200, { 'Content-Type': 'text/plain' })
+            .end('LinkedIn authorization complete. You can close this tab.');
+        await logger.info('LinkedIn authorization completed', {
+            tokenStore: TOKEN_STORE_PATH,
+        });
+        console.log(`Saved reusable LinkedIn credentials to ${TOKEN_STORE_PATH}.`);
+    }
+    catch (error) {
+        response
+            .writeHead(500)
+            .end('LinkedIn authorization failed. Check the terminal.');
+        await logger.error('LinkedIn authorization failed', error);
+        console.error(error);
+        process.exitCode = 1;
+    }
+    finally {
+        server.close();
+    }
+});
+server.listen(Number(callback.port || 80), callback.hostname, () => {
+    console.log('Open this URL in your browser:');
+    console.log(authorizationUrl.toString());
+});

package/dist/src/auth/linkedin/index.js

@@ -0,0 +1,16 @@
+import { loadLinkedInTokens } from '../token-store.js';
+export function createLinkedInAuth() {
+    const storedTokens = loadLinkedInTokens();
+    const accessToken = storedTokens?.accessToken || process.env.LINKEDIN_ACCESS_TOKEN;
+    if (!accessToken)
+        throw new Error('LinkedIn is not authorized. Run npm run auth:linkedin once.');
+    const userUrn = storedTokens?.userUrn || process.env.LINKEDIN_USER_URN;
+    if (!userUrn)
+        throw new Error('LinkedIn user URN is missing. Run npm run auth:linkedin once.');
+    return {
+        accessToken,
+        userUrn,
+        apiVersion: process.env.LINKEDIN_API_VERSION || '202609',
+        expiresAt: storedTokens?.expiresAt,
+    };
+}

package/dist/src/auth/token-store.js

@@ -0,0 +1,36 @@
+import { existsSync, readFileSync } from 'node:fs';
+import { mkdir, rename, writeFile } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { dirname, join } from 'node:path';
+export const TOKEN_STORE_PATH = process.env.PA_MCP_TOKEN_PATH || join(homedir(), '.pa-mcp', 'tokens.json');
+function readStore() {
+    if (!existsSync(TOKEN_STORE_PATH))
+        return {};
+    try {
+        return JSON.parse(readFileSync(TOKEN_STORE_PATH, 'utf8'));
+    }
+    catch (error) {
+        throw new Error(`Could not read token store at ${TOKEN_STORE_PATH}: ${String(error)}`);
+    }
+}
+async function writeStore(store) {
+    await mkdir(dirname(TOKEN_STORE_PATH), { recursive: true });
+    const temporaryPath = `${TOKEN_STORE_PATH}.tmp`;
+    await writeFile(temporaryPath, `${JSON.stringify(store, null, 2)}\n`, {
+        encoding: 'utf8',
+        mode: 0o600,
+    });
+    await rename(temporaryPath, TOKEN_STORE_PATH);
+}
+export function loadGoogleTokens() {
+    return readStore().google;
+}
+export async function saveGoogleTokens(tokens) {
+    await writeStore({ ...readStore(), google: tokens });
+}
+export function loadLinkedInTokens() {
+    return readStore().linkedin;
+}
+export async function saveLinkedInTokens(tokens) {
+    await writeStore({ ...readStore(), linkedin: tokens });
+}

package/dist/src/config/arguments.js

@@ -0,0 +1,19 @@
+export function getEnvFilePath(args) {
+    for (let index = 0; index < args.length; index += 1) {
+        const argument = args[index];
+        if (argument === '--env-file') {
+            const path = args[index + 1];
+            if (!path || path.startsWith('--')) {
+                throw new Error('--env-file requires a path.');
+            }
+            return path;
+        }
+        if (argument.startsWith('--env-file=')) {
+            const path = argument.slice('--env-file='.length);
+            if (!path)
+                throw new Error('--env-file requires a path.');
+            return path;
+        }
+    }
+    return undefined;
+}

package/dist/src/config/bootstrap.js

@@ -0,0 +1,2 @@
+import { loadEnvironment } from './environment.js';
+loadEnvironment(process.argv.slice(2));

package/dist/src/config/environment.js

@@ -0,0 +1,14 @@
+import { resolve } from 'node:path';
+import { config } from 'dotenv';
+import { getEnvFilePath } from './arguments.js';
+export function loadEnvironment(args) {
+    const envFileArgument = getEnvFilePath(args);
+    const envFilePath = envFileArgument ? resolve(envFileArgument) : undefined;
+    const result = config(envFilePath ? { path: envFilePath, quiet: true } : { quiet: true });
+    if (envFilePath && result.error) {
+        throw new Error(`Unable to load environment file: ${envFilePath}`, {
+            cause: result.error,
+        });
+    }
+    return envFilePath;
+}

package/dist/src/index.js

@@ -0,0 +1,64 @@
+#!/usr/bin/env node
+import './config/bootstrap.js';
+import { McpServer } from '@modelcontextprotocol/server';
+import { StdioServerTransport } from '@modelcontextprotocol/server/stdio';
+import { google } from 'googleapis';
+import { createGoogleAuth } from './auth/google/index.js';
+import { registerCalendarTools } from './tools/calendar/index.js';
+import { registerGmailTools } from './tools/gmail/index.js';
+import { registerLinkedInTools } from './tools/linkedin/index.js';
+import { logger, LOG_FILE_PATH } from './logging/logger.js';
+import { getPackageMetadata } from './utils/common.js';
+const auth = createGoogleAuth();
+const gmail = google.gmail({ version: 'v1', auth });
+const calendar = google.calendar({ version: 'v3', auth });
+const packageMetadata = getPackageMetadata();
+const server = new McpServer(packageMetadata);
+try {
+    registerGmailTools(server, gmail);
+    registerCalendarTools(server, calendar);
+    registerLinkedInTools(server);
+    await logger.info('All MCP tools registered');
+}
+catch (error) {
+    await logger.error('Failed to register MCP tools', error);
+    process.exit(1);
+}
+let shuttingDown = false;
+async function cleanup(signal) {
+    if (shuttingDown)
+        return;
+    shuttingDown = true;
+    try {
+        await logger.info('MCP server shutting down', { signal });
+        await server.close();
+        await logger.info('MCP server shutdown completed');
+        process.exit(0);
+    }
+    catch (error) {
+        await logger.error('MCP server shutdown failed', error, { signal });
+        process.exit(1);
+    }
+}
+async function main() {
+    await logger.info('MCP server starting', {
+        logFile: LOG_FILE_PATH,
+        name: packageMetadata.name,
+        version: packageMetadata.version,
+    });
+    await server.connect(new StdioServerTransport());
+    await logger.info('MCP server connected');
+}
+main().catch((error) => {
+    void logger
+        .error('MCP server failed to start', error)
+        .finally(() => process.exit(1));
+});
+process.on('uncaughtException', (error) => {
+    void logger.error('Uncaught exception', error).finally(() => process.exit(1));
+});
+process.on('unhandledRejection', (error) => {
+    void logger.error('Unhandled rejection', error);
+});
+process.on('SIGTERM', () => void cleanup('SIGTERM'));
+process.on('SIGINT', () => void cleanup('SIGINT'));

package/dist/src/logging/logger.js

@@ -0,0 +1,66 @@
+import { existsSync, statSync } from 'node:fs';
+import { appendFile, mkdir, rename, rm } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+import { TOKEN_STORE_PATH } from '../auth/token-store.js';
+export const LOG_FILE_PATH = process.env.PA_MCP_LOG_PATH || join(dirname(TOKEN_STORE_PATH), 'pa-mcp.log');
+const MAX_LOG_BYTES = 5 * 1024 * 1024;
+export function redact(value) {
+    return value
+        .replace(/Bearer\s+[A-Za-z0-9._~+\/-]+/gi, 'Bearer [REDACTED]')
+        .replace(/(access_token|refresh_token|client_secret|authorization)["'=:\s]+[^\s,"'}]+/gi, '$1=[REDACTED]');
+}
+export function errorDetails(error) {
+    if (error instanceof Error) {
+        return {
+            errorName: error.name,
+            errorMessage: redact(error.message),
+            stack: error.stack ? redact(error.stack) : undefined,
+        };
+    }
+    return { errorMessage: redact(String(error)) };
+}
+async function rotateIfNeeded() {
+    if (!existsSync(LOG_FILE_PATH) ||
+        statSync(LOG_FILE_PATH).size < MAX_LOG_BYTES)
+        return;
+    const rotatedPath = `${LOG_FILE_PATH}.1`;
+    try {
+        await rm(rotatedPath, { force: true });
+        await rename(LOG_FILE_PATH, rotatedPath);
+    }
+    catch {
+        // A concurrent writer may already have rotated the file.
+    }
+}
+async function write(level, message, details) {
+    try {
+        await mkdir(dirname(LOG_FILE_PATH), { recursive: true });
+        await rotateIfNeeded();
+        const entry = JSON.stringify({
+            timestamp: new Date().toISOString(),
+            level,
+            message: redact(message),
+            processId: process.pid,
+            ...details,
+        });
+        await appendFile(LOG_FILE_PATH, `${entry}\n`, {
+            encoding: 'utf8',
+            mode: 0o600,
+        });
+    }
+    catch {
+        // Logging must never interrupt MCP protocol handling.
+    }
+}
+export const logger = {
+    debug: (message, details) => write('debug', message, details),
+    info: (message, details) => write('info', message, details),
+    warn: (message, details) => write('warn', message, details),
+    error: (message, error, details) => write('error', message, {
+        ...(error === undefined ? {} : errorDetails(error)),
+        ...details,
+    }),
+};
+export function publicErrorMessage(error) {
+    return redact(error instanceof Error ? error.message : 'Unexpected error');
+}