crewly 1.16.0 → 1.17.0

package/dist/backend/backend/src/services/google/gmail.service.js

@@ -0,0 +1,296 @@
+/**
+ * Gmail Service
+ *
+ * Search, read and send on the owner's mailbox through the Gmail REST API
+ * with a Cloud-minted access token. Messages are built locally as RFC 822
+ * and sent base64url-encoded; bodies are decoded here; attachments are
+ * listed but never downloaded.
+ *
+ * @module services/google/gmail.service
+ */
+import { GOOGLE_WORKSPACE_CONSTANTS } from '../../constants.js';
+import { GoogleWorkspaceError } from './google-workspace-token.service.js';
+import { buildGoogleUrl, googleRequest } from './google-api.client.js';
+// ---------------------------------------------------------------------------
+// Encoding helpers (exported for the tests and the controller's dry-run)
+// ---------------------------------------------------------------------------
+/**
+ * Standard base64url without padding — what `messages.send` expects in `raw`.
+ *
+ * @param input - Bytes or UTF-8 string
+ * @returns base64url string
+ */
+export function base64UrlEncode(input) {
+    return Buffer.from(input).toString('base64url');
+}
+/**
+ * Decode Gmail's base64url body data (tolerates standard base64 too).
+ *
+ * @param data - base64url string
+ * @returns UTF-8 text
+ */
+export function base64UrlDecode(data) {
+    return Buffer.from(data, 'base64url').toString('utf8');
+}
+/**
+ * RFC 2047 encoded-word for a header value that is not plain printable
+ * ASCII (a Chinese subject, an emoji); ASCII values are left untouched.
+ *
+ * @param value - Header value
+ * @returns The value as it should appear on the wire
+ */
+export function encodeHeaderValue(value) {
+    // eslint-disable-next-line no-control-regex
+    if (/^[\x20-\x7e]*$/.test(value))
+        return value;
+    return `=?UTF-8?B?${Buffer.from(value, 'utf8').toString('base64')}?=`;
+}
+/**
+ * Wrap a base64 body at the RFC 2045 line width.
+ *
+ * @param base64 - Unwrapped base64
+ * @returns CRLF-wrapped base64
+ */
+function wrapBase64(base64) {
+    const width = GOOGLE_WORKSPACE_CONSTANTS.MIME_LINE_WIDTH;
+    const lines = [];
+    for (let i = 0; i < base64.length; i += width)
+        lines.push(base64.slice(i, i + width));
+    return lines.join('\r\n');
+}
+/**
+ * Build the RFC 822 message for {@link GmailService.send}. The From header is
+ * left to Gmail (it fills in the authenticated user); the body is UTF-8
+ * text/plain, base64 transfer-encoded so any script is safe on the wire.
+ *
+ * @param input - Recipients, subject, body, optional reply threading
+ * @returns The raw message with CRLF line endings
+ * @throws GoogleWorkspaceError(400, validation) when `to` or `subject` is empty
+ */
+export function buildRfc822(input) {
+    const CODES = GOOGLE_WORKSPACE_CONSTANTS.ERROR_CODES;
+    if (!input.to?.trim())
+        throw new GoogleWorkspaceError(400, CODES.VALIDATION, '"to" is required');
+    if (!input.subject?.trim())
+        throw new GoogleWorkspaceError(400, CODES.VALIDATION, '"subject" is required');
+    const headers = [`To: ${input.to.trim()}`];
+    if (input.cc?.trim())
+        headers.push(`Cc: ${input.cc.trim()}`);
+    headers.push(`Subject: ${encodeHeaderValue(input.subject.trim())}`);
+    if (input.inReplyTo?.trim()) {
+        const ref = input.inReplyTo.trim();
+        headers.push(`In-Reply-To: ${ref}`, `References: ${ref}`);
+    }
+    headers.push('MIME-Version: 1.0', 'Content-Type: text/plain; charset="UTF-8"', 'Content-Transfer-Encoding: base64');
+    const body = wrapBase64(Buffer.from(input.text ?? '', 'utf8').toString('base64'));
+    return `${headers.join('\r\n')}\r\n\r\n${body}`;
+}
+/**
+ * Very small HTML → text: drop scripts/styles, turn block boundaries into
+ * newlines, strip tags, unescape the common entities, collapse blank runs.
+ * Only used when a message has no text/plain part.
+ *
+ * @param html - HTML source
+ * @returns Plain text
+ */
+export function stripHtml(html) {
+    return html
+        .replace(/<(script|style)[\s\S]*?<\/\1>/gi, '')
+        .replace(/<br\s*\/?>/gi, '\n')
+        .replace(/<\/(p|div|tr|li|h[1-6]|blockquote)>/gi, '\n')
+        .replace(/<[^>]+>/g, '')
+        .replace(/&nbsp;/gi, ' ')
+        .replace(/&amp;/gi, '&')
+        .replace(/&lt;/gi, '<')
+        .replace(/&gt;/gi, '>')
+        .replace(/&quot;/gi, '"')
+        .replace(/&#39;|&apos;/gi, "'")
+        .replace(/[ \t]+\n/g, '\n')
+        .replace(/\n{3,}/g, '\n\n')
+        .trim();
+}
+/**
+ * Case-insensitive header lookup.
+ *
+ * @param headers - Gmail header list
+ * @param name - Header name
+ * @returns Value or empty string
+ */
+function header(headers, name) {
+    const lower = name.toLowerCase();
+    return headers?.find((h) => h.name.toLowerCase() === lower)?.value ?? '';
+}
+/**
+ * Walk a MIME tree depth-first.
+ *
+ * @param part - Root part
+ * @param visit - Callback per part
+ */
+function walkParts(part, visit) {
+    if (!part)
+        return;
+    visit(part);
+    for (const child of part.parts ?? [])
+        walkParts(child, visit);
+}
+/**
+ * Pick the body: first text/plain part with inline data, else first text/html
+ * (stripped), else nothing.
+ *
+ * @param payload - Message payload
+ * @returns Body text and which kind it was
+ */
+function extractBody(payload) {
+    let plain;
+    let html;
+    walkParts(payload, (p) => {
+        if (p.filename || !p.body?.data)
+            return;
+        const mime = (p.mimeType ?? '').toLowerCase();
+        if (mime === 'text/plain' && plain === undefined)
+            plain = base64UrlDecode(p.body.data);
+        else if (mime === 'text/html' && html === undefined)
+            html = base64UrlDecode(p.body.data);
+    });
+    if (plain !== undefined)
+        return { body: plain, bodyType: 'text' };
+    if (html !== undefined)
+        return { body: stripHtml(html), bodyType: 'html' };
+    return { body: '', bodyType: 'none' };
+}
+/**
+ * Every part that carries a filename and an attachmentId.
+ *
+ * @param payload - Message payload
+ * @returns Attachment references
+ */
+function extractAttachments(payload) {
+    const out = [];
+    walkParts(payload, (p) => {
+        if (p.filename && p.body?.attachmentId) {
+            out.push({
+                filename: p.filename,
+                mimeType: p.mimeType ?? 'application/octet-stream',
+                size: p.body.size ?? 0,
+                attachmentId: p.body.attachmentId,
+            });
+        }
+    });
+    return out;
+}
+// ---------------------------------------------------------------------------
+// Service
+// ---------------------------------------------------------------------------
+/**
+ * Gmail operations on the signed-in owner's mailbox.
+ *
+ * @example
+ * ```ts
+ * const gmail = new GmailService({ tokens: GoogleWorkspaceTokenService.getInstance() });
+ * const hits = await gmail.search({ query: 'is:unread newer_than:1d' });
+ * ```
+ */
+export class GmailService {
+    deps;
+    base = GOOGLE_WORKSPACE_CONSTANTS.GMAIL_API_BASE;
+    /**
+     * @param deps - Token provider and optional fetch override
+     */
+    constructor(deps) {
+        this.deps = deps;
+    }
+    /**
+     * Gmail search (`messages.list`) followed by one metadata `messages.get`
+     * per hit for From / To / Subject / Date and the snippet.
+     *
+     * @param input - Gmail query string and result cap
+     * @returns Hits in Gmail's order (newest first)
+     * @throws GoogleWorkspaceError on auth / Google failures
+     */
+    async search(input) {
+        const query = (input.query ?? '').trim();
+        const max = clampMax(input.max, GOOGLE_WORKSPACE_CONSTANTS.GMAIL_DEFAULT_MAX_RESULTS, GOOGLE_WORKSPACE_CONSTANTS.GMAIL_MAX_RESULTS_CEILING);
+        const list = await googleRequest(this.deps, buildGoogleUrl(`${this.base}/messages`, { q: query, maxResults: max }));
+        const refs = list.messages ?? [];
+        if (refs.length === 0)
+            return [];
+        const messages = await Promise.all(refs.map((ref) => googleRequest(this.deps, buildGoogleUrl(`${this.base}/messages/${encodeURIComponent(ref.id)}`, {
+            format: 'metadata',
+            metadataHeaders: [...GOOGLE_WORKSPACE_CONSTANTS.GMAIL_SEARCH_HEADERS],
+        }))));
+        return messages.map((m) => {
+            const h = m.payload?.headers;
+            return {
+                id: m.id,
+                threadId: m.threadId,
+                from: header(h, 'From'),
+                to: header(h, 'To'),
+                subject: header(h, 'Subject'),
+                date: header(h, 'Date'),
+                snippet: m.snippet ?? '',
+                labelIds: m.labelIds ?? [],
+            };
+        });
+    }
+    /**
+     * Full `messages.get`; body decoded (text/plain preferred, stripped
+     * text/html as fallback), attachments listed only.
+     *
+     * @param id - Gmail message id
+     * @returns The message
+     * @throws GoogleWorkspaceError — 404 when Gmail has no such message
+     */
+    async read(id) {
+        if (!id?.trim()) {
+            throw new GoogleWorkspaceError(400, GOOGLE_WORKSPACE_CONSTANTS.ERROR_CODES.VALIDATION, 'message id is required');
+        }
+        const m = await googleRequest(this.deps, buildGoogleUrl(`${this.base}/messages/${encodeURIComponent(id.trim())}`, { format: 'full' }));
+        const h = m.payload?.headers;
+        const { body, bodyType } = extractBody(m.payload);
+        return {
+            id: m.id,
+            threadId: m.threadId,
+            from: header(h, 'From'),
+            to: header(h, 'To'),
+            cc: header(h, 'Cc'),
+            subject: header(h, 'Subject'),
+            date: header(h, 'Date'),
+            messageId: header(h, 'Message-ID'),
+            snippet: m.snippet ?? '',
+            body,
+            bodyType,
+            attachments: extractAttachments(m.payload),
+            labelIds: m.labelIds ?? [],
+        };
+    }
+    /**
+     * `messages.send` with a locally built RFC 822 message.
+     *
+     * @param input - Recipients, subject, text and optional reply threading
+     * @returns The sent message's id / threadId / labels
+     * @throws GoogleWorkspaceError(400, validation) for missing to/subject; auth / Google failures
+     */
+    async send(input) {
+        const raw = base64UrlEncode(buildRfc822(input));
+        const body = { raw };
+        if (input.threadId?.trim())
+            body.threadId = input.threadId.trim();
+        const sent = await googleRequest(this.deps, `${this.base}/messages/send`, { method: 'POST', body });
+        return { id: sent.id, threadId: sent.threadId, labelIds: sent.labelIds ?? [] };
+    }
+}
+/**
+ * Coerce a caller-supplied result cap into [1, ceiling], defaulting when
+ * absent or not a number.
+ *
+ * @param value - Requested cap
+ * @param fallback - Default
+ * @param ceiling - Hard maximum
+ * @returns The cap to send to Google
+ */
+export function clampMax(value, fallback, ceiling) {
+    if (value === undefined || !Number.isFinite(value))
+        return fallback;
+    return Math.min(Math.max(Math.floor(value), 1), ceiling);
+}
+//# sourceMappingURL=gmail.service.js.map

package/dist/backend/backend/src/services/google/gmail.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gmail.service.js","sourceRoot":"","sources":["../../../../../../backend/src/services/google/gmail.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAC3E,OAAO,EAAE,cAAc,EAAE,aAAa,EAAsB,MAAM,wBAAwB,CAAC;AAsG3F,8EAA8E;AAC9E,yEAAyE;AACzE,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,KAAsB;IACpD,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAClD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACzD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,4CAA4C;IAC5C,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/C,OAAO,aAAa,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC;AACxE,CAAC;AAED;;;;;GAKG;AACH,SAAS,UAAU,CAAC,MAAc;IAChC,MAAM,KAAK,GAAG,0BAA0B,CAAC,eAAe,CAAC;IACzD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,KAAK;QAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC;IACtF,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC5B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW,CAAC,KAAqB;IAC/C,MAAM,KAAK,GAAG,0BAA0B,CAAC,WAAW,CAAC;IACrD,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE;QAAE,MAAM,IAAI,oBAAoB,CAAC,GAAG,EAAE,KAAK,CAAC,UAAU,EAAE,kBAAkB,CAAC,CAAC;IACjG,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE;QAAE,MAAM,IAAI,oBAAoB,CAAC,GAAG,EAAE,KAAK,CAAC,UAAU,EAAE,uBAAuB,CAAC,CAAC;IAE3G,MAAM,OAAO,GAAa,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACrD,IAAI,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE;QAAE,OAAO,CAAC,IAAI,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC7D,OAAO,CAAC,IAAI,CAAC,YAAY,iBAAiB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;IACpE,IAAI,KAAK,CAAC,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QACnC,OAAO,CAAC,IAAI,CAAC,gBAAgB,GAAG,EAAE,EAAE,eAAe,GAAG,EAAE,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,CAAC,IAAI,CACV,mBAAmB,EACnB,2CAA2C,EAC3C,mCAAmC,CACpC,CAAC;IACF,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;IAClF,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC;AAClD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,OAAO,IAAI;SACR,OAAO,CAAC,iCAAiC,EAAE,EAAE,CAAC;SAC9C,OAAO,CAAC,cAAc,EAAE,IAAI,CAAC;SAC7B,OAAO,CAAC,uCAAuC,EAAE,IAAI,CAAC;SACtD,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;SACvB,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC;SACxB,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC;SACvB,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC;SACtB,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC;SACtB,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC;SACxB,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC;SAC9B,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC;SAC1B,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC;SAC1B,IAAI,EAAE,CAAC;AACZ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,MAAM,CAAC,OAAkC,EAAE,IAAY;IAC9D,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,OAAO,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;AAC3E,CAAC;AAED;;;;;GAKG;AACH,SAAS,SAAS,CAAC,IAA2B,EAAE,KAA6B;IAC3E,IAAI,CAAC,IAAI;QAAE,OAAO;IAClB,KAAK,CAAC,IAAI,CAAC,CAAC;IACZ,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI,EAAE;QAAE,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;GAMG;AACH,SAAS,WAAW,CAAC,OAA8B;IACjD,IAAI,KAAyB,CAAC;IAC9B,IAAI,IAAwB,CAAC;IAC7B,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;QACvB,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI;YAAE,OAAO;QACxC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QAC9C,IAAI,IAAI,KAAK,YAAY,IAAI,KAAK,KAAK,SAAS;YAAE,KAAK,GAAG,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;aAClF,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,SAAS;YAAE,IAAI,GAAG,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3F,CAAC,CAAC,CAAC;IACH,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IAClE,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IAC3E,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;AACxC,CAAC;AAED;;;;;GAKG;AACH,SAAS,kBAAkB,CAAC,OAA8B;IACxD,MAAM,GAAG,GAAsB,EAAE,CAAC;IAClC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;QACvB,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,YAAY,EAAE,CAAC;YACvC,GAAG,CAAC,IAAI,CAAC;gBACP,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,0BAA0B;gBAClD,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;gBACtB,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY;aAClC,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,GAAG,CAAC;AACb,CAAC;AAED,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,OAAO,YAAY;IACN,IAAI,CAAgB;IACpB,IAAI,GAAG,0BAA0B,CAAC,cAAc,CAAC;IAElE;;OAEG;IACH,YAAY,IAAmB;QAC7B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,MAAM,CAAC,KAAuB;QAClC,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACzC,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,0BAA0B,CAAC,yBAAyB,EAAE,0BAA0B,CAAC,yBAAyB,CAAC,CAAC;QAE5I,MAAM,IAAI,GAAG,MAAM,aAAa,CAC9B,IAAI,CAAC,IAAI,EACT,cAAc,CAAC,GAAG,IAAI,CAAC,IAAI,WAAW,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CACvE,CAAC;QACF,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;QACjC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QAEjC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAChC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CACf,aAAa,CACX,IAAI,CAAC,IAAI,EACT,cAAc,CAAC,GAAG,IAAI,CAAC,IAAI,aAAa,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE;YACpE,MAAM,EAAE,UAAU;YAClB,eAAe,EAAE,CAAC,GAAG,0BAA0B,CAAC,oBAAoB,CAAC;SACtE,CAAC,CACH,CACF,CACF,CAAC;QAEF,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YACxB,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC;YAC7B,OAAO;gBACL,EAAE,EAAE,CAAC,CAAC,EAAE;gBACR,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,IAAI,EAAE,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC;gBACvB,EAAE,EAAE,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC;gBACnB,OAAO,EAAE,MAAM,CAAC,CAAC,EAAE,SAAS,CAAC;gBAC7B,IAAI,EAAE,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC;gBACvB,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,EAAE;gBACxB,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,EAAE;aAC3B,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,IAAI,CAAC,EAAU;QACnB,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC;YAChB,MAAM,IAAI,oBAAoB,CAAC,GAAG,EAAE,0BAA0B,CAAC,WAAW,CAAC,UAAU,EAAE,wBAAwB,CAAC,CAAC;QACnH,CAAC;QACD,MAAM,CAAC,GAAG,MAAM,aAAa,CAC3B,IAAI,CAAC,IAAI,EACT,cAAc,CAAC,GAAG,IAAI,CAAC,IAAI,aAAa,kBAAkB,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAC7F,CAAC;QACF,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC;QAC7B,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAClD,OAAO;YACL,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,IAAI,EAAE,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC;YACvB,EAAE,EAAE,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC;YACnB,EAAE,EAAE,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC;YACnB,OAAO,EAAE,MAAM,CAAC,CAAC,EAAE,SAAS,CAAC;YAC7B,IAAI,EAAE,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC;YACvB,SAAS,EAAE,MAAM,CAAC,CAAC,EAAE,YAAY,CAAC;YAClC,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,EAAE;YACxB,IAAI;YACJ,QAAQ;YACR,WAAW,EAAE,kBAAkB,CAAC,CAAC,CAAC,OAAO,CAAC;YAC1C,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,EAAE;SAC3B,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,IAAI,CAAC,KAAqB;QAC9B,MAAM,GAAG,GAAG,eAAe,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;QAChD,MAAM,IAAI,GAAuC,EAAE,GAAG,EAAE,CAAC;QACzD,IAAI,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE;YAAE,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAElE,MAAM,IAAI,GAAG,MAAM,aAAa,CAAmB,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,IAAI,gBAAgB,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACtH,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;IACjF,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,QAAQ,CAAC,KAAyB,EAAE,QAAgB,EAAE,OAAe;IACnF,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IACpE,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;AAC3D,CAAC"}

package/dist/backend/backend/src/services/google/google-api.client.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Google API client — the one place Gmail and Calendar calls go through.
+ *
+ * Attaches the Cloud-minted access token, maps Google's HTTP failures to
+ * {@link GoogleWorkspaceError}, and drops the cached token on a 401 so the
+ * next call refreshes instead of failing the same way again.
+ *
+ * @module services/google/google-api.client
+ */
+/** The slice of GoogleWorkspaceTokenService the Google services need. */
+export interface GoogleTokenProvider {
+    getAccessToken(): Promise<string>;
+    clearCache(): void;
+}
+/** Shared constructor dependencies for Gmail / Calendar services. */
+export interface GoogleApiDeps {
+    tokens: GoogleTokenProvider;
+    fetchImpl?: typeof fetch;
+}
+/**
+ * Build a URL with query parameters; `undefined`/empty values are skipped and
+ * array values are repeated (Gmail's `metadataHeaders=A&metadataHeaders=B`).
+ *
+ * @param base - Absolute URL without query
+ * @param params - Query parameters
+ * @returns The full URL string
+ */
+export declare function buildGoogleUrl(base: string, params?: Record<string, string | number | string[] | undefined>): string;
+/**
+ * Authenticated JSON call to a Google API.
+ *
+ * @param deps - Token provider + fetch
+ * @param url - Absolute URL (use {@link buildGoogleUrl})
+ * @param init - Method and optional JSON body
+ * @returns The parsed JSON response
+ * @throws GoogleWorkspaceError — token failures pass through; Google 401 →
+ *   401 google_error (cache dropped), 403/404/429 keep their status, other
+ *   failures → 502 google_error, unreachable → 502 network
+ */
+export declare function googleRequest<T>(deps: GoogleApiDeps, url: string, init?: {
+    method?: 'GET' | 'POST';
+    body?: unknown;
+}): Promise<T>;
+//# sourceMappingURL=google-api.client.d.ts.map

package/dist/backend/backend/src/services/google/google-api.client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"google-api.client.d.ts","sourceRoot":"","sources":["../../../../../../backend/src/services/google/google-api.client.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAKH,yEAAyE;AACzE,MAAM,WAAW,mBAAmB;IAClC,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAClC,UAAU,IAAI,IAAI,CAAC;CACpB;AAED,qEAAqE;AACrE,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,mBAAmB,CAAC;IAC5B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAwBD;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAM,GAAG,MAAM,CAWxH;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,aAAa,CAAC,CAAC,EACnC,IAAI,EAAE,aAAa,EACnB,GAAG,EAAE,MAAM,EACX,IAAI,GAAE;IAAE,MAAM,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAA;CAAO,GACrD,OAAO,CAAC,CAAC,CAAC,CAsCZ"}

package/dist/backend/backend/src/services/google/google-api.client.js

@@ -0,0 +1,104 @@
+/**
+ * Google API client — the one place Gmail and Calendar calls go through.
+ *
+ * Attaches the Cloud-minted access token, maps Google's HTTP failures to
+ * {@link GoogleWorkspaceError}, and drops the cached token on a 401 so the
+ * next call refreshes instead of failing the same way again.
+ *
+ * @module services/google/google-api.client
+ */
+import { GOOGLE_WORKSPACE_CONSTANTS } from '../../constants.js';
+import { GoogleWorkspaceError } from './google-workspace-token.service.js';
+/**
+ * Extract the human message from a Google error body, tolerating both the
+ * object and the plain-string shapes Google uses.
+ *
+ * @param text - Raw response body
+ * @returns Message or undefined
+ */
+function googleErrorMessage(text) {
+    try {
+        const parsed = JSON.parse(text);
+        if (typeof parsed.error === 'string')
+            return parsed.error;
+        return parsed.error?.message;
+    }
+    catch {
+        return text ? text.slice(0, 200) : undefined;
+    }
+}
+/**
+ * Build a URL with query parameters; `undefined`/empty values are skipped and
+ * array values are repeated (Gmail's `metadataHeaders=A&metadataHeaders=B`).
+ *
+ * @param base - Absolute URL without query
+ * @param params - Query parameters
+ * @returns The full URL string
+ */
+export function buildGoogleUrl(base, params = {}) {
+    const url = new URL(base);
+    for (const [key, value] of Object.entries(params)) {
+        if (value === undefined || value === '')
+            continue;
+        if (Array.isArray(value)) {
+            for (const v of value)
+                url.searchParams.append(key, v);
+        }
+        else {
+            url.searchParams.set(key, String(value));
+        }
+    }
+    return url.toString();
+}
+/**
+ * Authenticated JSON call to a Google API.
+ *
+ * @param deps - Token provider + fetch
+ * @param url - Absolute URL (use {@link buildGoogleUrl})
+ * @param init - Method and optional JSON body
+ * @returns The parsed JSON response
+ * @throws GoogleWorkspaceError — token failures pass through; Google 401 →
+ *   401 google_error (cache dropped), 403/404/429 keep their status, other
+ *   failures → 502 google_error, unreachable → 502 network
+ */
+export async function googleRequest(deps, url, init = {}) {
+    const token = await deps.tokens.getAccessToken();
+    const fetchImpl = deps.fetchImpl ?? fetch;
+    const CODES = GOOGLE_WORKSPACE_CONSTANTS.ERROR_CODES;
+    let res;
+    try {
+        res = await fetchImpl(url, {
+            method: init.method ?? 'GET',
+            headers: {
+                Authorization: `Bearer ${token}`,
+                Accept: 'application/json',
+                ...(init.body !== undefined ? { 'Content-Type': 'application/json' } : {}),
+            },
+            body: init.body !== undefined ? JSON.stringify(init.body) : undefined,
+            signal: AbortSignal.timeout(GOOGLE_WORKSPACE_CONSTANTS.REQUEST_TIMEOUT_MS),
+        });
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        throw new GoogleWorkspaceError(502, CODES.NETWORK, `Google unreachable: ${message}`);
+    }
+    const text = await res.text();
+    if (!res.ok) {
+        const message = googleErrorMessage(text) ?? `Google request failed (${res.status})`;
+        if (res.status === 401) {
+            deps.tokens.clearCache();
+            throw new GoogleWorkspaceError(401, CODES.GOOGLE_ERROR, `Google rejected the access token: ${message}`);
+        }
+        const passthrough = res.status === 403 || res.status === 404 || res.status === 429;
+        throw new GoogleWorkspaceError(passthrough ? res.status : 502, CODES.GOOGLE_ERROR, message);
+    }
+    if (!text)
+        return {};
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        throw new GoogleWorkspaceError(502, CODES.GOOGLE_ERROR, 'Google returned a non-JSON response.');
+    }
+}
+//# sourceMappingURL=google-api.client.js.map

package/dist/backend/backend/src/services/google/google-api.client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"google-api.client.js","sourceRoot":"","sources":["../../../../../../backend/src/services/google/google-api.client.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAmB3E;;;;;;GAMG;AACH,SAAS,kBAAkB,CAAC,IAAY;IACtC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAoB,CAAC;QACnD,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ;YAAE,OAAO,MAAM,CAAC,KAAK,CAAC;QAC1D,OAAO,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/C,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,SAAiE,EAAE;IAC9G,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;IAC1B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE;YAAE,SAAS;QAClD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,KAAK,MAAM,CAAC,IAAI,KAAK;gBAAE,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACzD,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,IAAmB,EACnB,GAAW,EACX,OAAoD,EAAE;IAEtD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;IACjD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IAC1C,MAAM,KAAK,GAAG,0BAA0B,CAAC,WAAW,CAAC;IAErD,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,KAAK;YAC5B,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,KAAK,EAAE;gBAChC,MAAM,EAAE,kBAAkB;gBAC1B,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC3E;YACD,IAAI,EAAE,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;YACrE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,0BAA0B,CAAC,kBAAkB,CAAC;SAC3E,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,MAAM,IAAI,oBAAoB,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,EAAE,uBAAuB,OAAO,EAAE,CAAC,CAAC;IACvF,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,OAAO,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI,0BAA0B,GAAG,CAAC,MAAM,GAAG,CAAC;QACpF,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;YACzB,MAAM,IAAI,oBAAoB,CAAC,GAAG,EAAE,KAAK,CAAC,YAAY,EAAE,qCAAqC,OAAO,EAAE,CAAC,CAAC;QAC1G,CAAC;QACD,MAAM,WAAW,GAAG,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC;QACnF,MAAM,IAAI,oBAAoB,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IAC9F,CAAC;IACD,IAAI,CAAC,IAAI;QAAE,OAAO,EAAO,CAAC;IAC1B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,oBAAoB,CAAC,GAAG,EAAE,KAAK,CAAC,YAAY,EAAE,sCAAsC,CAAC,CAAC;IAClG,CAAC;AACH,CAAC"}

package/dist/backend/backend/src/services/google/google-workspace-token.service.d.ts

@@ -0,0 +1,159 @@
+/**
+ * Google Workspace Token Service
+ *
+ * Crewly Cloud holds the owner's Google OAuth grant; this service asks Cloud
+ * (`/api/cloud/google/workspace/token`) for a short-lived access token and
+ * caches it until shortly before expiry, so Gmail / Calendar calls made by
+ * this instance never carry the refresh token and mail content never passes
+ * through Cloud.
+ *
+ * Cloud auth reuses the Crewly Cloud session already held by
+ * `CloudClientService` (its access JWT as Bearer) — no separate login.
+ *
+ * @module services/google/google-workspace-token.service
+ */
+/** The slice of CloudClientService this service needs. */
+export interface GoogleWorkspaceCloudClient {
+    isConnected(): boolean;
+    getToken(): string | null;
+    getCloudUrl(): string | null;
+}
+/** Constructor dependencies (all optional — defaults are the real singletons). */
+export interface GoogleWorkspaceTokenServiceDeps {
+    cloud?: GoogleWorkspaceCloudClient;
+    fetchImpl?: typeof fetch;
+    now?: () => number;
+}
+/** Cloud's `/status` payload, plus whether this instance is signed in to Cloud at all. */
+export interface GoogleWorkspaceStatus {
+    /** True when Cloud holds a live Workspace grant for the signed-in account */
+    connected: boolean;
+    /** True when this instance is signed in to Crewly Cloud */
+    cloudConnected: boolean;
+    email?: string;
+    scopes?: string[];
+    grantedAt?: string;
+}
+/**
+ * Error raised for every Cloud / Google failure. `status` is the HTTP status
+ * the OSS controller should answer with and `code` is one of
+ * {@link GOOGLE_WORKSPACE_CONSTANTS.ERROR_CODES} (or `http_<n>` for anything
+ * unmapped), so the controller and the skills can branch without parsing text.
+ */
+export declare class GoogleWorkspaceError extends Error {
+    readonly status: number;
+    readonly code: string;
+    constructor(status: number, code: string, message: string);
+}
+/**
+ * Map a Cloud workspace-endpoint failure to the status/code this instance
+ * answers with. 404 (no grant) and 409 (grant revoked) both mean "not
+ * connected — go through the consent flow again"; 503 means Cloud itself has
+ * no Google client; 502 is Google refusing Cloud.
+ *
+ * @param httpStatus - Status Cloud answered with
+ * @param code - `code` (or `error`) field from Cloud's body, if any
+ * @param message - Human message from Cloud's body, if any
+ * @returns The error to throw
+ */
+export declare function mapCloudFailure(httpStatus: number, code: string | undefined, message: string | undefined): GoogleWorkspaceError;
+/**
+ * Fetches, caches and refreshes the Google access token that Cloud mints
+ * from the owner's stored grant.
+ *
+ * @example
+ * ```ts
+ * const token = await GoogleWorkspaceTokenService.getInstance().getAccessToken();
+ * ```
+ */
+export declare class GoogleWorkspaceTokenService {
+    private static instance;
+    private readonly logger;
+    private readonly cloud;
+    private readonly fetchImpl;
+    private readonly nowFn;
+    /** Cached token + absolute expiry (ms since epoch), or null. */
+    private cached;
+    /** The one refresh currently on the wire, so concurrent callers share it. */
+    private inflight;
+    /**
+     * @param deps - Cloud client slice, fetch and clock overrides (tests)
+     */
+    constructor(deps?: GoogleWorkspaceTokenServiceDeps);
+    /**
+     * Process-wide instance bound to the real CloudClientService.
+     *
+     * @returns The singleton
+     */
+    static getInstance(): GoogleWorkspaceTokenService;
+    /**
+     * Drop the singleton (tests).
+     */
+    static resetInstance(): void;
+    /**
+     * Whether this instance is signed in to Crewly Cloud (prerequisite for
+     * everything else here).
+     *
+     * @returns True when a Cloud URL and access JWT are available
+     */
+    isCloudAvailable(): boolean;
+    /**
+     * A Google access token that is valid for at least the refresh margin.
+     * Served from cache when possible; otherwise one Cloud round-trip shared
+     * by every concurrent caller.
+     *
+     * @returns Bearer token for Gmail / Calendar
+     * @throws GoogleWorkspaceError — not_logged_in / not_connected / not_configured / google_error / network
+     */
+    getAccessToken(): Promise<string>;
+    /**
+     * Forget the cached token so the next call refreshes (used after Google
+     * answers 401, or when the grant is revoked).
+     */
+    clearCache(): void;
+    /**
+     * Whether Cloud holds a Workspace grant, and for which email.
+     * Never throws for the two "not there" cases (no Cloud session / no grant);
+     * those come back as `connected: false`.
+     *
+     * @returns Connection status
+     * @throws GoogleWorkspaceError for Cloud outages / misconfiguration
+     */
+    status(): Promise<GoogleWorkspaceStatus>;
+    /**
+     * Ask Cloud to revoke the grant and forget it; also drops the local cache.
+     *
+     * @returns Whether Cloud had a grant to remove
+     * @throws GoogleWorkspaceError when not signed in to Cloud or Cloud fails
+     */
+    disconnect(): Promise<{
+        removed: boolean;
+    }>;
+    /**
+     * The Cloud consent-start URL for the browser: carries the current Cloud
+     * access JWT (Cloud accepts `?token=` because a top-level navigation cannot
+     * set a Bearer header) and where to land afterwards.
+     *
+     * @param returnUrl - Absolute dashboard URL Cloud redirects back to
+     * @returns Absolute URL to open
+     * @throws GoogleWorkspaceError(401, not_logged_in) when not signed in to Cloud
+     */
+    buildConnectUrl(returnUrl: string): string;
+    /**
+     * One Cloud `/token` round-trip; updates the cache.
+     *
+     * @returns The fresh access token
+     */
+    private refresh;
+    /**
+     * Authenticated call to a Cloud workspace endpoint using the Cloud session
+     * JWT. Unwraps the auth service's `{ success, data }` envelope.
+     *
+     * @param method - HTTP verb
+     * @param suffix - Path under CLOUD_PATH
+     * @returns The `data` payload
+     * @throws GoogleWorkspaceError mapped via {@link mapCloudFailure}
+     */
+    private cloudRequest;
+}
+//# sourceMappingURL=google-workspace-token.service.d.ts.map

package/dist/backend/backend/src/services/google/google-workspace-token.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"google-workspace-token.service.d.ts","sourceRoot":"","sources":["../../../../../../backend/src/services/google/google-workspace-token.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAMH,0DAA0D;AAC1D,MAAM,WAAW,0BAA0B;IACzC,WAAW,IAAI,OAAO,CAAC;IACvB,QAAQ,IAAI,MAAM,GAAG,IAAI,CAAC;IAC1B,WAAW,IAAI,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,kFAAkF;AAClF,MAAM,WAAW,+BAA+B;IAC9C,KAAK,CAAC,EAAE,0BAA0B,CAAC;IACnC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,0FAA0F;AAC1F,MAAM,WAAW,qBAAqB;IACpC,6EAA6E;IAC7E,SAAS,EAAE,OAAO,CAAC;IACnB,2DAA2D;IAC3D,cAAc,EAAE,OAAO,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAkBD;;;;;GAKG;AACH,qBAAa,oBAAqB,SAAQ,KAAK;aAE3B,MAAM,EAAE,MAAM;aACd,IAAI,EAAE,MAAM;gBADZ,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EAC5B,OAAO,EAAE,MAAM;CAKlB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,oBAAoB,CAe/H;AAED;;;;;;;;GAQG;AACH,qBAAa,2BAA2B;IACtC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAA4C;IAEnE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAkB;IACzC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA6B;IACnD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAe;IACzC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAe;IAErC,gEAAgE;IAChE,OAAO,CAAC,MAAM,CAAgG;IAC9G,6EAA6E;IAC7E,OAAO,CAAC,QAAQ,CAAgC;IAEhD;;OAEG;gBACS,IAAI,GAAE,+BAAoC;IAOtD;;;;OAIG;IACH,MAAM,CAAC,WAAW,IAAI,2BAA2B;IAOjD;;OAEG;IACH,MAAM,CAAC,aAAa,IAAI,IAAI;IAI5B;;;;;OAKG;IACH,gBAAgB,IAAI,OAAO;IAI3B;;;;;;;OAOG;IACG,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC;IAavC;;;OAGG;IACH,UAAU,IAAI,IAAI;IAIlB;;;;;;;OAOG;IACG,MAAM,IAAI,OAAO,CAAC,qBAAqB,CAAC;IAuB9C;;;;;OAKG;IACG,UAAU,IAAI,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IAMjD;;;;;;;;OAQG;IACH,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM;IAc1C;;;;OAIG;YACW,OAAO;IAsBrB;;;;;;;;OAQG;YACW,YAAY;CA8B3B"}