dayhand 0.0.0-stage → 0.14.0

package/backend/convex/_generated/server.d.ts

@@ -0,0 +1,162 @@
+/* eslint-disable */
+/**
+ * Generated utilities for implementing server-side Convex query and mutation functions.
+ *
+ * THIS CODE IS AUTOMATICALLY GENERATED.
+ *
+ * To regenerate, run `npx convex dev`.
+ * @module
+ */
+
+import {
+  ActionBuilder,
+  HttpActionBuilder,
+  MutationBuilder,
+  QueryBuilder,
+  GenericActionCtx,
+  GenericMutationCtx,
+  GenericQueryCtx,
+  GenericDatabaseReader,
+  GenericDatabaseWriter,
+} from "convex/server";
+import type { DataModel } from "./dataModel.js";
+
+/**
+ * Typesafe environment variables.
+ *
+ * This includes platform-provided env vars and any variables declared in
+ * `convex.config.ts`.
+ */
+type Env = {
+  readonly CONVEX_CLOUD_URL: string;
+  readonly CONVEX_SITE_URL: string;
+};
+
+/**
+ * Define a query in this Convex app's public API.
+ *
+ * This function will be allowed to read your Convex database and will be accessible from the client.
+ *
+ * @param func - The query function. It receives a {@link QueryCtx} as its first argument.
+ * @returns The wrapped query. Include this as an `export` to name it and make it accessible.
+ */
+export declare const query: QueryBuilder<DataModel, "public">;
+
+/**
+ * Define a query that is only accessible from other Convex functions (but not from the client).
+ *
+ * This function will be allowed to read from your Convex database. It will not be accessible from the client.
+ *
+ * @param func - The query function. It receives a {@link QueryCtx} as its first argument.
+ * @returns The wrapped query. Include this as an `export` to name it and make it accessible.
+ */
+export declare const internalQuery: QueryBuilder<DataModel, "internal">;
+
+/**
+ * Define a mutation in this Convex app's public API.
+ *
+ * This function will be allowed to modify your Convex database and will be accessible from the client.
+ *
+ * @param func - The mutation function. It receives a {@link MutationCtx} as its first argument.
+ * @returns The wrapped mutation. Include this as an `export` to name it and make it accessible.
+ */
+export declare const mutation: MutationBuilder<DataModel, "public">;
+
+/**
+ * Define a mutation that is only accessible from other Convex functions (but not from the client).
+ *
+ * This function will be allowed to modify your Convex database. It will not be accessible from the client.
+ *
+ * @param func - The mutation function. It receives a {@link MutationCtx} as its first argument.
+ * @returns The wrapped mutation. Include this as an `export` to name it and make it accessible.
+ */
+export declare const internalMutation: MutationBuilder<DataModel, "internal">;
+
+/**
+ * Define an action in this Convex app's public API.
+ *
+ * An action is a function which can execute any JavaScript code, including non-deterministic
+ * code and code with side-effects, like calling third-party services.
+ * They can be run in Convex's JavaScript environment or in Node.js using the "use node" directive.
+ * They can interact with the database indirectly by calling queries and mutations using the {@link ActionCtx}.
+ *
+ * @param func - The action. It receives an {@link ActionCtx} as its first argument.
+ * @returns The wrapped action. Include this as an `export` to name it and make it accessible.
+ */
+export declare const action: ActionBuilder<DataModel, "public">;
+
+/**
+ * Define an action that is only accessible from other Convex functions (but not from the client).
+ *
+ * @param func - The function. It receives an {@link ActionCtx} as its first argument.
+ * @returns The wrapped function. Include this as an `export` to name it and make it accessible.
+ */
+export declare const internalAction: ActionBuilder<DataModel, "internal">;
+
+/**
+ * Define an HTTP action.
+ *
+ * The wrapped function will be used to respond to HTTP requests received
+ * by a Convex deployment if the requests matches the path and method where
+ * this action is routed. Be sure to route your httpAction in `convex/http.js`.
+ *
+ * @param func - The function. It receives an {@link ActionCtx} as its first argument
+ * and a Fetch API `Request` object as its second.
+ * @returns The wrapped function. Import this function from `convex/http.js` and route it to hook it up.
+ */
+export declare const httpAction: HttpActionBuilder;
+
+/**
+ * Typesafe environment variables.
+ *
+ * This includes platform-provided env vars and any variables declared in
+ * `convex.config.ts`.
+ */
+export declare const env: Env;
+
+/**
+ * A set of services for use within Convex query functions.
+ *
+ * The query context is passed as the first argument to any Convex query
+ * function run on the server.
+ *
+ * This differs from the {@link MutationCtx} because all of the services are
+ * read-only.
+ */
+export type QueryCtx = GenericQueryCtx<DataModel>;
+
+/**
+ * A set of services for use within Convex mutation functions.
+ *
+ * The mutation context is passed as the first argument to any Convex mutation
+ * function run on the server.
+ */
+export type MutationCtx = GenericMutationCtx<DataModel>;
+
+/**
+ * A set of services for use within Convex action functions.
+ *
+ * The action context is passed as the first argument to any Convex action
+ * function run on the server.
+ */
+export type ActionCtx = GenericActionCtx<DataModel>;
+
+/**
+ * An interface to read from the database within Convex query functions.
+ *
+ * The two entry points are {@link DatabaseReader.get}, which fetches a single
+ * document by its {@link Id}, or {@link DatabaseReader.query}, which starts
+ * building a query.
+ */
+export type DatabaseReader = GenericDatabaseReader<DataModel>;
+
+/**
+ * An interface to read from and write to the database within Convex mutation
+ * functions.
+ *
+ * Convex guarantees that all writes within a single mutation are
+ * executed atomically, so you never have to worry about partial writes leaving
+ * your data in an inconsistent state. See [the Convex Guide](https://docs.convex.dev/understanding/convex-fundamentals/functions#atomicity-and-optimistic-concurrency-control)
+ * for the guarantees Convex provides your functions.
+ */
+export type DatabaseWriter = GenericDatabaseWriter<DataModel>;

package/backend/convex/_generated/server.js

@@ -0,0 +1,101 @@
+/* eslint-disable */
+/**
+ * Generated utilities for implementing server-side Convex query and mutation functions.
+ *
+ * THIS CODE IS AUTOMATICALLY GENERATED.
+ *
+ * To regenerate, run `npx convex dev`.
+ * @module
+ */
+
+import {
+  actionGeneric,
+  httpActionGeneric,
+  queryGeneric,
+  mutationGeneric,
+  internalActionGeneric,
+  internalMutationGeneric,
+  internalQueryGeneric,
+} from "convex/server";
+
+/**
+ * Define a query in this Convex app's public API.
+ *
+ * This function will be allowed to read your Convex database and will be accessible from the client.
+ *
+ * @param func - The query function. It receives a {@link QueryCtx} as its first argument.
+ * @returns The wrapped query. Include this as an `export` to name it and make it accessible.
+ */
+export const query = queryGeneric;
+
+/**
+ * Define a query that is only accessible from other Convex functions (but not from the client).
+ *
+ * This function will be allowed to read from your Convex database. It will not be accessible from the client.
+ *
+ * @param func - The query function. It receives a {@link QueryCtx} as its first argument.
+ * @returns The wrapped query. Include this as an `export` to name it and make it accessible.
+ */
+export const internalQuery = internalQueryGeneric;
+
+/**
+ * Define a mutation in this Convex app's public API.
+ *
+ * This function will be allowed to modify your Convex database and will be accessible from the client.
+ *
+ * @param func - The mutation function. It receives a {@link MutationCtx} as its first argument.
+ * @returns The wrapped mutation. Include this as an `export` to name it and make it accessible.
+ */
+export const mutation = mutationGeneric;
+
+/**
+ * Define a mutation that is only accessible from other Convex functions (but not from the client).
+ *
+ * This function will be allowed to modify your Convex database. It will not be accessible from the client.
+ *
+ * @param func - The mutation function. It receives a {@link MutationCtx} as its first argument.
+ * @returns The wrapped mutation. Include this as an `export` to name it and make it accessible.
+ */
+export const internalMutation = internalMutationGeneric;
+
+/**
+ * Define an action in this Convex app's public API.
+ *
+ * An action is a function which can execute any JavaScript code, including non-deterministic
+ * code and code with side-effects, like calling third-party services.
+ * They can be run in Convex's JavaScript environment or in Node.js using the "use node" directive.
+ * They can interact with the database indirectly by calling queries and mutations using the {@link ActionCtx}.
+ *
+ * @param func - The action. It receives an {@link ActionCtx} as its first argument.
+ * @returns The wrapped action. Include this as an `export` to name it and make it accessible.
+ */
+export const action = actionGeneric;
+
+/**
+ * Define an action that is only accessible from other Convex functions (but not from the client).
+ *
+ * @param func - The function. It receives an {@link ActionCtx} as its first argument.
+ * @returns The wrapped function. Include this as an `export` to name it and make it accessible.
+ */
+export const internalAction = internalActionGeneric;
+
+/**
+ * Define an HTTP action.
+ *
+ * The wrapped function will be used to respond to HTTP requests received
+ * by a Convex deployment if the requests matches the path and method where
+ * this action is routed. Be sure to route your httpAction in `convex/http.js`.
+ *
+ * @param func - The function. It receives an {@link ActionCtx} as its first argument
+ * and a Fetch API `Request` object as its second.
+ * @returns The wrapped function. Import this function from `convex/http.js` and route it to hook it up.
+ */
+export const httpAction = httpActionGeneric;
+
+/**
+ * Typesafe environment variables.
+ *
+ * This includes platform-provided env vars and any variables declared in
+ * `convex.config.ts`.
+ */
+export const env = process.env;

package/backend/convex/apiKeys.ts

@@ -0,0 +1,171 @@
+// Personal API keys for the agent (MCP and CLI) and for integrations (REST,
+// docs/api.md). Only the SHA-256 hash is stored; the key is shown once, when
+// it is created. A key's kind (cli or agent) is the actor of the changes made
+// with it; the default is agent. Since 0.8.0 a key has a scope (read, write
+// or full; absent = full) and may expire. A key created with another key
+// (POST /api/v1/keys) only reads or writes and works only while that key does.
+import { v } from "convex/values";
+import { internal } from "./_generated/api";
+import type { Doc, Id } from "./_generated/dataModel";
+import { internalAction, internalMutation, internalQuery, type QueryCtx } from "./_generated/server";
+import { args } from "./lib/args";
+import { fail, identityOf, recordEvent } from "./lib/core";
+import { randomBase64url, sha256Hex } from "./lib/secrets";
+import { identityFields as identityArgs, keyKindValidator, keyScopeValidator, type KeyKind, type KeyScope } from "./lib/validators";
+
+// New keys start with dayhand_; keys from before the rename keep helm_ and still work (they are found by their hash).
+const KEY_PREFIX = "dayhand_";
+const MAX_NAME = 100;
+const DEFAULT_KIND: KeyKind = "agent";
+const DEFAULT_SCOPE: KeyScope = "full";
+
+/** Kind of a stored key; keys from before kinds existed are agent keys. */
+const kindOf = (key: { kind?: KeyKind }): KeyKind => key.kind ?? DEFAULT_KIND;
+/** Scope of a stored key; keys from before scopes existed may do everything. */
+export const scopeOf = (key: { scope?: KeyScope }): KeyScope => key.scope ?? DEFAULT_SCOPE;
+
+const SCOPE_RANK: Record<KeyScope, number> = { read: 0, write: 1, full: 2 };
+/** Whether a key of scope `has` may do what needs `needs` (read < write < full). */
+export const scopeCovers = (has: KeyScope, needs: KeyScope) => SCOPE_RANK[has] >= SCOPE_RANK[needs];
+
+export const hashKey = sha256Hex;
+
+function newKey(): string {
+  // Actions have a real random source (mutations are deterministic).
+  return KEY_PREFIX + randomBase64url(32);
+}
+
+export type CreatedKey = {
+  id: Id<"apiKeys">;
+  name: string;
+  kind: KeyKind;
+  scope: KeyScope;
+  expiresAt: number | null;
+  key: string;
+};
+
+/** Domain operation createApiKey: returns the plain key exactly once. */
+export const create = internalAction({
+  args: { ...identityArgs, ...args.createApiKey },
+  handler: async (ctx, input): Promise<CreatedKey> => {
+    const key = newKey();
+    const id: Id<"apiKeys"> = await ctx.runMutation(internal.apiKeys.insert, { ...input, hash: await hashKey(key) });
+    return {
+      id,
+      name: input.name.trim(),
+      kind: input.kind ?? DEFAULT_KIND,
+      scope: input.scope ?? DEFAULT_SCOPE,
+      expiresAt: input.expiresAt ?? null,
+      key,
+    };
+  },
+});
+
+export const insert = internalMutation({
+  args: { ...identityArgs, ...args.createApiKey, hash: v.string() },
+  handler: async (ctx, input) => {
+    const name = input.name.trim();
+    if (!name || name.length > MAX_NAME) fail("invalid_argument", `name must be 1 to ${MAX_NAME} characters`);
+    const now = Date.now();
+    if (input.expiresAt !== undefined && (!Number.isFinite(input.expiresAt) || input.expiresAt <= now)) {
+      fail("invalid_argument", "expiresAt must be a time in the future (Unix milliseconds)");
+    }
+    const kind = input.kind ?? DEFAULT_KIND;
+    const scope = input.scope ?? DEFAULT_SCOPE;
+    // A key made with a key: never more than read or write, and never beyond its parent.
+    const parentKeyId = input.keyId;
+    if (parentKeyId !== undefined) {
+      if (scope === "full") fail("invalid_argument", "A key created with an API key can only have scope read or write");
+      const parent = await ctx.db.get(parentKeyId);
+      if (parent?.expiresAt !== undefined && (input.expiresAt === undefined || input.expiresAt > parent.expiresAt)) {
+        fail("invalid_argument", "The new key must expire no later than the key that creates it");
+      }
+    }
+    const id = await ctx.db.insert("apiKeys", {
+      userId: input.userId,
+      name,
+      kind,
+      scope,
+      expiresAt: input.expiresAt,
+      parentKeyId,
+      hash: input.hash,
+      createdAt: now,
+    });
+    const after = { keyId: id, name, kind, scope, ...(input.expiresAt !== undefined ? { expiresAt: input.expiresAt } : {}) };
+    await recordEvent(ctx, identityOf(input), { action: "apiKey.create", after });
+    return id;
+  },
+});
+
+/** Domain operation revokeApiKey: the key (and every key it created) stops working on the next request. */
+export const revoke = internalMutation({
+  args: { ...identityArgs, ...args.revokeApiKey },
+  handler: async (ctx, input) => {
+    const { userId, keyId } = input;
+    const key = await ctx.db.get(keyId);
+    if (!key || key.userId !== userId) fail("not_found", `API key ${keyId} not found`);
+    if (key.revokedAt !== undefined) return { id: key._id, revokedAt: key.revokedAt };
+    const revokedAt = Date.now();
+    await ctx.db.patch(key._id, { revokedAt });
+    await recordEvent(ctx, identityOf(input), { action: "apiKey.revoke", after: { keyId, name: key.name } });
+    return { id: key._id, revokedAt };
+  },
+});
+
+export type KeyView = {
+  id: Id<"apiKeys">;
+  name: string;
+  kind: KeyKind;
+  scope: KeyScope;
+  createdAt: number;
+  expiresAt: number | null;
+  revokedAt: number | null;
+  createdWith: Id<"apiKeys"> | null;
+};
+
+const keyView = (k: Doc<"apiKeys">): KeyView => ({
+  id: k._id,
+  name: k.name,
+  kind: kindOf(k),
+  scope: scopeOf(k),
+  createdAt: k.createdAt,
+  expiresAt: k.expiresAt ?? null,
+  revokedAt: k.revokedAt ?? null,
+  createdWith: k.parentKeyId ?? null,
+});
+
+/** Key metadata for the settings screen and GET /api/v1/keys; never the hash. */
+export async function listKeys(ctx: QueryCtx, userId: string): Promise<KeyView[]> {
+  const keys = await ctx.db
+    .query("apiKeys")
+    .withIndex("by_user", (q) => q.eq("userId", userId))
+    .collect();
+  return keys.map(keyView);
+}
+
+export const list = internalQuery({
+  args: identityArgs,
+  handler: (ctx, { userId }) => listKeys(ctx, userId),
+});
+
+/** A key works when it is not revoked, not expired, and the key that created it still works. */
+const works = (key: Doc<"apiKeys"> | null, now: number): key is Doc<"apiKeys"> =>
+  key !== null && key.revokedAt === undefined && (key.expiresAt === undefined || key.expiresAt > now);
+
+/**
+ * Resolves the owner of a working key from its hash; null when unknown, revoked or expired.
+ * `now` comes from the caller so a cached result never outlives an expiry.
+ */
+export const verify = internalQuery({
+  args: { hash: v.string(), now: v.optional(v.number()) },
+  handler: async (ctx, { hash, now }) => {
+    const at = now ?? Date.now();
+    const key = await ctx.db
+      .query("apiKeys")
+      .withIndex("by_hash", (q) => q.eq("hash", hash))
+      .unique();
+    if (!works(key, at)) return null;
+    if (key.parentKeyId !== undefined && !works(await ctx.db.get(key.parentKeyId), at)) return null;
+    return { userId: key.userId, keyId: key._id, name: key.name, kind: kindOf(key), scope: scopeOf(key), expiresAt: key.expiresAt ?? null };
+  },
+});

package/backend/convex/app.ts

@@ -0,0 +1,197 @@
+// Thin layer for the Dayhand app: the caller is the authenticated user and
+// the actor is "app". Every function delegates to the domain layer.
+import { internal } from "./_generated/api";
+import type { Id } from "./_generated/dataModel";
+import { v } from "convex/values";
+import { action, mutation, query } from "./_generated/server";
+import { listKeys, type CreatedKey } from "./apiKeys";
+import { getFeed, revokeFeed, type CalendarFeed } from "./calendarFeeds";
+import {
+  decideRequest,
+  listConnections as listConnectionsOp,
+  lookupRequest,
+  revokeConnection as revokeConnectionOp,
+} from "./oauthOwner";
+import { args } from "./lib/args";
+import { fail, type Identity } from "./lib/core";
+import { exportPlan as exportPlanOp } from "./lib/exportPlan";
+import { scopeValidator } from "./lib/oauthConfig";
+import { getSettings as getSettingsOp, updateSettings as updateSettingsOp } from "./lib/settingsOps";
+import { releaseTask } from "./lib/agentWork";
+import { getAgentControls as getAgentControlsOp, setAgentsPaused, setToolPolicy as setToolPolicyOp } from "./lib/agentControls";
+import { decideApproval as decideApprovalOp, listApprovals as listApprovalsOp } from "./lib/approvals";
+import { planHealth as planHealthOp } from "./lib/health";
+import { TOOLS } from "./lib/mcpTools";
+import {
+  acceptProposal as acceptProposalOp,
+  listProposals as listProposalsOp,
+  mergeProposal as mergeProposalOp,
+  rejectProposal as rejectProposalOp,
+} from "./lib/proposals";
+import {
+  addTask,
+  archiveTask,
+  completeTask,
+  rescheduleTask,
+  restoreTask,
+  setNow as setNowOp,
+  setStatus as setStatusOp,
+  softDeleteTask,
+  updateTask,
+} from "./lib/taskOps";
+import {
+  board as boardOp,
+  getTask as getTaskOp,
+  listAll as listAllOp,
+  listToday as listTodayOp,
+  listTrash as listTrashOp,
+} from "./lib/views";
+
+type AuthCtx = { auth: { getUserIdentity: () => Promise<{ tokenIdentifier: string } | null> } };
+
+async function appUser(ctx: AuthCtx): Promise<Identity> {
+  const identity = await ctx.auth.getUserIdentity();
+  if (!identity) fail("unauthenticated", "Sign in required");
+  return { userId: identity.tokenIdentifier, actor: "app" };
+}
+
+export const add = mutation({ args: args.add, handler: async (ctx, a) => addTask(ctx, await appUser(ctx), a) });
+export const update = mutation({
+  args: args.update,
+  handler: async (ctx, a) => updateTask(ctx, await appUser(ctx), a),
+});
+export const setStatus = mutation({
+  args: args.setStatus,
+  handler: async (ctx, a) => setStatusOp(ctx, await appUser(ctx), a),
+});
+export const setNow = mutation({ args: args.setNow, handler: async (ctx, a) => setNowOp(ctx, await appUser(ctx), a) });
+export const complete = mutation({
+  args: args.complete,
+  handler: async (ctx, a) => completeTask(ctx, await appUser(ctx), a),
+});
+export const reschedule = mutation({
+  args: args.reschedule,
+  handler: async (ctx, a) => rescheduleTask(ctx, await appUser(ctx), a),
+});
+export const archive = mutation({
+  args: args.archive,
+  handler: async (ctx, a) => archiveTask(ctx, await appUser(ctx), a),
+});
+export const softDelete = mutation({
+  args: args.softDelete,
+  handler: async (ctx, a) => softDeleteTask(ctx, await appUser(ctx), a),
+});
+export const restore = mutation({
+  args: args.restore,
+  handler: async (ctx, a) => restoreTask(ctx, await appUser(ctx), a),
+});
+// The owner takes a task over from an agent: the claim ends at once (owner wins).
+export const release = mutation({
+  args: args.release,
+  handler: async (ctx, a) => releaseTask(ctx, await appUser(ctx), a),
+});
+export const updateSettings = mutation({
+  args: args.updateSettings,
+  handler: async (ctx, a) => updateSettingsOp(ctx, await appUser(ctx), a),
+});
+
+// Approval requests (docs/agent-work.md#5-approval-requests): the phone lists them and decides.
+export const listApprovals = query({
+  args: args.listApprovals,
+  handler: async (ctx, a) => listApprovalsOp(ctx, await appUser(ctx), a),
+});
+export const decideApproval = mutation({
+  args: args.decideApproval,
+  handler: async (ctx, a) => decideApprovalOp(ctx, await appUser(ctx), a),
+});
+
+// The agent switch and tool policies (docs/agent-work.md#6-pausing-agents-and-tool-policies).
+export const getAgentControls = query({ args: {}, handler: async (ctx) => getAgentControlsOp(ctx, await appUser(ctx)) });
+export const pauseAgents = mutation({
+  args: args.pauseAgents,
+  handler: async (ctx, a) => setAgentsPaused(ctx, await appUser(ctx), a),
+});
+export const setToolPolicy = mutation({
+  args: args.setToolPolicy,
+  handler: async (ctx, a) =>
+    setToolPolicyOp(ctx, await appUser(ctx), a, TOOLS.filter((t) => t.kind === "write" && !t.ownerOnly).map((t) => t.name)),
+});
+
+// The proposal inbox (docs/agent-work.md#7-the-proposal-inbox).
+export const listProposals = query({ args: {}, handler: async (ctx) => listProposalsOp(ctx, await appUser(ctx)) });
+export const acceptProposal = mutation({
+  args: args.acceptProposal,
+  handler: async (ctx, a) => acceptProposalOp(ctx, await appUser(ctx), a),
+});
+export const mergeProposal = mutation({
+  args: args.mergeProposal,
+  handler: async (ctx, a) => mergeProposalOp(ctx, await appUser(ctx), a),
+});
+export const rejectProposal = mutation({
+  args: args.rejectProposal,
+  handler: async (ctx, a) => rejectProposalOp(ctx, await appUser(ctx), a),
+});
+
+// The plan health report (docs/agent-work.md#8-the-plan-health-report).
+export const planHealth = query({ args: args.planHealth, handler: async (ctx, a) => planHealthOp(ctx, await appUser(ctx), a) });
+
+export const listToday = query({
+  args: args.listToday,
+  handler: async (ctx, a) => listTodayOp(ctx, await appUser(ctx), a),
+});
+export const listAll = query({ args: args.listAll, handler: async (ctx, a) => listAllOp(ctx, await appUser(ctx), a) });
+export const listTrash = query({ args: args.listTrash, handler: async (ctx) => listTrashOp(ctx, await appUser(ctx)) });
+export const board = query({ args: args.board, handler: async (ctx, a) => boardOp(ctx, await appUser(ctx), a) });
+export const getTask = query({ args: args.getTask, handler: async (ctx, a) => getTaskOp(ctx, await appUser(ctx), a) });
+export const exportPlan = query({
+  args: args.exportPlan,
+  handler: async (ctx, a) => exportPlanOp(ctx, await appUser(ctx), a),
+});
+export const getSettings = query({ args: args.getSettings, handler: async (ctx) => getSettingsOp(ctx, await appUser(ctx)) });
+
+export const createApiKey = action({
+  args: args.createApiKey,
+  handler: async (ctx, a): Promise<CreatedKey> => ctx.runAction(internal.apiKeys.create, { ...(await appUser(ctx)), ...a }),
+});
+export const revokeApiKey = mutation({
+  args: args.revokeApiKey,
+  handler: async (ctx, a): Promise<{ id: Id<"apiKeys">; revokedAt: number }> =>
+    ctx.runMutation(internal.apiKeys.revoke, { ...(await appUser(ctx)), ...a }),
+});
+export const listApiKeys = query({
+  args: args.listApiKeys,
+  handler: async (ctx) => listKeys(ctx, (await appUser(ctx)).userId),
+});
+
+// The calendar feed (calendarFeeds.ts): its addresses, turning it on, a new address, off.
+export const getCalendarFeed = query({
+  args: {},
+  handler: async (ctx): Promise<CalendarFeed | null> => getFeed(ctx, await appUser(ctx)),
+});
+export const createCalendarFeed = action({
+  args: { replace: v.optional(v.boolean()) },
+  handler: async (ctx, a): Promise<CalendarFeed> => ctx.runAction(internal.calendarFeeds.create, { ...(await appUser(ctx)), ...a }),
+});
+export const revokeCalendarFeed = mutation({
+  args: {},
+  handler: async (ctx): Promise<{ revoked: boolean }> => revokeFeed(ctx, await appUser(ctx)),
+});
+
+// Agent connections (OAuth, docs/oauth.md): the phone approves a connection by the
+// code its browser page shows, and lists and revokes connections.
+export const lookupConnectionRequest = mutation({
+  args: { code: v.string() },
+  handler: async (ctx, { code }) => lookupRequest(ctx, await appUser(ctx), code),
+});
+export const decideConnectionRequest = mutation({
+  args: { code: v.string(), approve: v.boolean(), scopes: v.optional(v.array(scopeValidator)) },
+  handler: async (ctx, a) => decideRequest(ctx, await appUser(ctx), a),
+});
+export const listConnections = query({
+  args: {},
+  handler: async (ctx) => listConnectionsOp(ctx, (await appUser(ctx)).userId),
+});
+export const revokeConnection = mutation({
+  args: { connectionId: v.string() },
+  handler: async (ctx, { connectionId }) => revokeConnectionOp(ctx, await appUser(ctx), connectionId),
+});

package/backend/convex/auth.config.ts

@@ -0,0 +1,28 @@
+// App sign-in: a custom JWT (ES256) whose public key is a JWKS data URI in
+// deployment environment variables, so no external identity provider is
+// needed. `npm run backend:start` generates a local key pair and sets both.
+// Deployments from before the rename have them as HELM_* (lib/env.ts). Convex
+// refuses a push when this file reads a variable the deployment does not have,
+// so the old name is read only when the new one is missing. The audience
+// stays "helm": tokens already on phones carry it.
+function variable(name: string): string {
+  try {
+    const value = process.env[`DAYHAND_${name}`];
+    if (value) return value;
+  } catch {
+    // The deployment has no DAYHAND_<name>.
+  }
+  return process.env[`HELM_${name}`]!;
+}
+
+export default {
+  providers: [
+    {
+      type: "customJwt",
+      applicationID: "helm",
+      issuer: variable("JWT_ISSUER"),
+      jwks: variable("JWKS"),
+      algorithm: "ES256",
+    },
+  ],
+};