dayhand 0.0.0-stage → 0.14.0

package/backend/convex/calendar.ts

@@ -0,0 +1,61 @@
+// HTTP endpoints of the calendar feed (docs/calendar.md).
+//   GET  /cal/<token>.ics          the plan as iCalendar (the token is the only key)
+//   GET  /calendar/feed            the feed's addresses, or null  (personal API key)
+//   POST /calendar/feed            turn the feed on               (personal API key)
+//   POST /calendar/feed/rotate     a new address; the old one 404 (personal API key)
+//   POST /calendar/feed/revoke     turn the feed off              (personal API key)
+// The token is never logged; a wrong, old or malformed one is a plain 404.
+import { internal } from "./_generated/api";
+import type { CalendarFeed } from "./calendarFeeds";
+import { httpAction } from "./_generated/server";
+import { json } from "./lib/http";
+import { parseCalendarToken } from "./lib/secrets";
+import { accountOwner, keyIdentity } from "./pairing";
+
+const FEED_PATH = /^\/cal\/([^/]+)\.ics$/;
+const noStore = { "Cache-Control": "no-store" };
+
+const notFound = () => new Response("Not found\n", { status: 404, headers: { "Content-Type": "text/plain; charset=utf-8", ...noStore } });
+
+export const feed = httpAction(async (ctx, request) => {
+  const match = FEED_PATH.exec(new URL(request.url).pathname);
+  const token = match ? parseCalendarToken(match[1]) : null;
+  if (!token) return notFound();
+  const text = await ctx.runQuery(internal.calendarFeeds.render, { ...token, at: Date.now() });
+  if (text === null) return notFound();
+  return new Response(text, {
+    status: 200,
+    headers: {
+      "Content-Type": "text/calendar; charset=utf-8",
+      "Content-Disposition": 'inline; filename="dayhand.ics"',
+      // Calendar apps poll; a short private cache spares the deployment, and no shared cache keeps the plan.
+      "Cache-Control": "private, max-age=300",
+      "Referrer-Policy": "no-referrer",
+      "X-Robots-Tag": "noindex, nofollow",
+    },
+  });
+});
+
+export const getFeed = httpAction(async (ctx, request) => {
+  const owner = await accountOwner(ctx, request);
+  if (owner instanceof Response) return owner;
+  return json({ feed: await ctx.runQuery(internal.calendarFeeds.get, keyIdentity(owner)) }, 200, noStore);
+});
+
+const create = (replace: boolean) =>
+  httpAction(async (ctx, request) => {
+    const owner = await accountOwner(ctx, request);
+    if (owner instanceof Response) return owner;
+    const created: CalendarFeed = await ctx.runAction(internal.calendarFeeds.create, { ...keyIdentity(owner), replace });
+    return json({ feed: created }, 200, noStore);
+  });
+
+export const enableFeed = create(false);
+export const rotateFeed = create(true);
+
+export const revokeFeed = httpAction(async (ctx, request) => {
+  const owner = await accountOwner(ctx, request);
+  if (owner instanceof Response) return owner;
+  return json(await ctx.runMutation(internal.calendarFeeds.revoke, keyIdentity(owner)), 200, noStore);
+});
+

package/backend/convex/calendarFeeds.ts

@@ -0,0 +1,105 @@
+// The read-only calendar feed: one secret address per user that serves the
+// plan as iCalendar (lib/ical.ts) to Google Calendar, Apple Calendar and
+// anything else that subscribes by URL. A new address replaces the old one,
+// which then answers 404. Tokens are drawn in actions (mutations have a
+// deterministic random source) and never written to logs or to the history.
+// Threat model: docs/calendar.md.
+import { v } from "convex/values";
+import { internal } from "./_generated/api";
+import { internalAction, internalMutation, internalQuery, type MutationCtx, type QueryCtx } from "./_generated/server";
+import { identityOf, loadSettings, recordEvent, type Identity } from "./lib/core";
+import { renderCalendar } from "./lib/ical";
+import { newCalendarToken, timingSafeEqual } from "./lib/secrets";
+import { identityFields as identityArgs } from "./lib/validators";
+
+export type CalendarFeed = { url: string; webcalUrl: string; googleCalendarUrl: string; createdAt: number };
+
+/** The deployment's HTTP actions URL, which serves /cal/. */
+function siteUrl(): string {
+  const url = process.env.CONVEX_SITE_URL;
+  if (!url) throw new Error("CONVEX_SITE_URL is not set");
+  return url.replace(/\/+$/, "");
+}
+
+/** The addresses of a feed: https for copying, webcal:// for Apple Calendar, and Google Calendar's "add by URL" link. */
+export function feedView(row: { selector: string; secret: string; createdAt: number }): CalendarFeed {
+  const url = `${siteUrl()}/cal/${row.selector}${row.secret}.ics`;
+  const webcalUrl = url.replace(/^https?:\/\//, "webcal://");
+  return {
+    url,
+    webcalUrl,
+    googleCalendarUrl: `https://calendar.google.com/calendar/render?cid=${encodeURIComponent(webcalUrl)}`,
+    createdAt: row.createdAt,
+  };
+}
+
+async function feedRow(ctx: QueryCtx, userId: string) {
+  return ctx.db
+    .query("calendarFeeds")
+    .withIndex("by_user", (q) => q.eq("userId", userId))
+    .unique();
+}
+
+/** The user's feed, or null when it is off. */
+export async function getFeed(ctx: QueryCtx, identity: Identity): Promise<CalendarFeed | null> {
+  const row = await feedRow(ctx, identity.userId);
+  return row ? feedView(row) : null;
+}
+
+export const get = internalQuery({ args: identityArgs, handler: (ctx, input) => getFeed(ctx, input) });
+
+/**
+ * Turns the feed on and returns it. With `replace`, a new address replaces
+ * the current one (which stops working at once); without, an existing feed
+ * is returned as it is.
+ */
+export const create = internalAction({
+  args: { ...identityArgs, replace: v.optional(v.boolean()) },
+  handler: async (ctx, input): Promise<CalendarFeed> => {
+    const { selector, secret } = newCalendarToken();
+    return ctx.runMutation(internal.calendarFeeds.store, { ...input, selector, secret });
+  },
+});
+
+export const store = internalMutation({
+  args: { ...identityArgs, replace: v.optional(v.boolean()), selector: v.string(), secret: v.string() },
+  handler: async (ctx, input): Promise<CalendarFeed> => {
+    const { userId, replace, selector, secret } = input;
+    const current = await feedRow(ctx, userId);
+    if (current && !replace) return feedView(current);
+    const createdAt = Date.now();
+    if (current) await ctx.db.patch(current._id, { selector, secret, createdAt });
+    else await ctx.db.insert("calendarFeeds", { userId, selector, secret, createdAt });
+    await recordEvent(ctx, identityOf(input), { action: current ? "calendarFeed.rotate" : "calendarFeed.create" });
+    return feedView({ selector, secret, createdAt });
+  },
+});
+
+/** Turns the feed off: its address answers 404 from now on. */
+export async function revokeFeed(ctx: MutationCtx, identity: Identity): Promise<{ revoked: boolean }> {
+  const current = await feedRow(ctx, identity.userId);
+  if (!current) return { revoked: false };
+  await ctx.db.delete(current._id);
+  await recordEvent(ctx, identityOf(identity), { action: "calendarFeed.revoke" });
+  return { revoked: true };
+}
+
+export const revoke = internalMutation({ args: identityArgs, handler: (ctx, input) => revokeFeed(ctx, input) });
+
+/** The calendar behind a feed token, or null when no feed has it. */
+export const render = internalQuery({
+  args: { selector: v.string(), secret: v.string(), at: v.number() },
+  handler: async (ctx, { selector, secret, at }): Promise<string | null> => {
+    const row = await ctx.db
+      .query("calendarFeeds")
+      .withIndex("by_selector", (q) => q.eq("selector", selector))
+      .unique();
+    if (!row || !timingSafeEqual(row.secret, secret)) return null;
+    const settings = await loadSettings(ctx, row.userId);
+    const tasks = await ctx.db
+      .query("tasks")
+      .withIndex("by_user", (q) => q.eq("userId", row.userId))
+      .collect();
+    return renderCalendar(tasks, { ...settings, at });
+  },
+});

package/backend/convex/callLimits.ts

@@ -0,0 +1,67 @@
+// Limits on MCP and REST calls per API key or agent connection (OAuth): a fixed
+// one-minute window that starts at the first call, separately for reads and writes. A call over the limit is
+// refused before it runs and says when to try again.
+import { v, type Infer } from "convex/values";
+import type { Id } from "./_generated/dataModel";
+import { internalMutation, type MutationCtx } from "./_generated/server";
+
+export const CALL_WINDOW_MS = 60 * 1000;
+export const CALL_LIMITS = { read: 120, write: 60 } as const;
+
+const kindValidator = v.union(v.literal("read"), v.literal("write"));
+export type CallKind = Infer<typeof kindValidator>;
+
+/** The outcome of a call against the limit, with what the REST API shows in its X-RateLimit-* headers. */
+export type CallAllowance = { limit: number; remaining: number; resetAt: number } & ({ ok: true } | { ok: false; retryAfterMs: number });
+
+type Subject = { keyId?: Id<"apiKeys">; connectionId?: Id<"oauthGrants"> };
+
+/** The counters of one key or one connection, of one kind or of both. */
+function rowsOf(ctx: MutationCtx, { keyId, connectionId }: Subject, kind?: CallKind) {
+  if (keyId) {
+    return ctx.db.query("callLimits").withIndex("by_key_kind", (q) => (kind ? q.eq("keyId", keyId).eq("kind", kind) : q.eq("keyId", keyId)));
+  }
+  return ctx.db
+    .query("callLimits")
+    .withIndex("by_connection_kind", (q) => (kind ? q.eq("connectionId", connectionId).eq("kind", kind) : q.eq("connectionId", connectionId)));
+}
+
+const subjectArgs = { keyId: v.optional(v.id("apiKeys")), connectionId: v.optional(v.id("oauthGrants")) };
+
+/** Counts one call of `kind` with the key or connection (exactly one of them); refused calls are not counted. */
+export const consume = internalMutation({
+  args: { ...subjectArgs, kind: kindValidator },
+  handler: async (ctx, { keyId, connectionId, kind }): Promise<CallAllowance> => {
+    if (!keyId === !connectionId) throw new Error("consume needs exactly one of keyId and connectionId");
+    const subject = keyId ? { keyId } : { connectionId };
+    const now = Date.now();
+    const limit = CALL_LIMITS[kind];
+    const row = await rowsOf(ctx, subject, kind).unique();
+    const fresh = { ok: true as const, limit, remaining: limit - 1, resetAt: now + CALL_WINDOW_MS };
+    if (!row) {
+      await ctx.db.insert("callLimits", { ...subject, kind, windowStart: now, calls: 1 });
+      return fresh;
+    }
+    if (now - row.windowStart >= CALL_WINDOW_MS) {
+      await ctx.db.patch(row._id, { windowStart: now, calls: 1 });
+      return fresh;
+    }
+    const resetAt = row.windowStart + CALL_WINDOW_MS;
+    if (row.calls >= limit) return { ok: false, limit, remaining: 0, resetAt, retryAfterMs: resetAt - now };
+    await ctx.db.patch(row._id, { calls: row.calls + 1 });
+    return { ok: true, limit, remaining: limit - row.calls - 1, resetAt };
+  },
+});
+
+/**
+ * Clears a key's or a connection's counters, e.g. after a runaway agent:
+ * `npx convex run callLimits:reset '{"keyId":"…"}'` (or `'{"connectionId":"…"}'`).
+ */
+export const reset = internalMutation({
+  args: subjectArgs,
+  handler: async (ctx, { keyId, connectionId }) => {
+    if (!keyId === !connectionId) throw new Error("reset needs exactly one of keyId and connectionId");
+    const rows = await rowsOf(ctx, keyId ? { keyId } : { connectionId }).collect();
+    for (const row of rows) await ctx.db.delete(row._id);
+  },
+});

package/backend/convex/connections.ts

@@ -0,0 +1,28 @@
+// Agent connections (OAuth, docs/oauth.md) managed with a personal API key:
+//   GET  /connections         list connections   (dayhand connection list)
+//   POST /connections/revoke  revoke one          (dayhand connection revoke)
+// Like /devices, these accept only API keys: an OAuth token cannot manage connections.
+import { internal } from "./_generated/api";
+import { httpAction } from "./_generated/server";
+import { errorResponse, json, readJsonBody } from "./lib/http";
+import { accountOwner, domainError, keyIdentity } from "./pairing";
+
+export const listConnections = httpAction(async (ctx, request) => {
+  const owner = await accountOwner(ctx, request);
+  if (owner instanceof Response) return owner;
+  return json({ connections: await ctx.runQuery(internal.oauthOwner.list, keyIdentity(owner)) });
+});
+
+export const revokeConnection = httpAction(async (ctx, request) => {
+  const owner = await accountOwner(ctx, request);
+  if (owner instanceof Response) return owner;
+  const body = await readJsonBody(request);
+  if (!body || typeof body.connectionId !== "string") {
+    return errorResponse(400, "invalid_request", "Body must be JSON with a string `connectionId`");
+  }
+  try {
+    return json(await ctx.runMutation(internal.oauthOwner.revoke, { ...keyIdentity(owner), id: body.connectionId }));
+  } catch (error) {
+    return domainError(error);
+  }
+});

package/backend/convex/crons.ts

@@ -0,0 +1,18 @@
+import { cronJobs } from "convex/server";
+import { internal } from "./_generated/api";
+
+const crons = cronJobs();
+
+// Empties the trash of tasks deleted more than 30 days ago.
+crons.daily("purge expired trash", { hourUTC: 3, minuteUTC: 30 }, internal.ops.purgeTrash, {});
+
+// Removes pairing codes that expired more than a day ago.
+crons.daily("purge expired pairing codes", { hourUTC: 3, minuteUTC: 45 }, internal.devices.purgeExpiredCodes, {});
+
+// Removes OAuth requests and tokens that ended more than a day ago, and unused client registrations.
+crons.daily("purge expired oauth records", { hourUTC: 4, minuteUTC: 0 }, internal.oauth.purgeExpired, {});
+
+// Drops webhook delivery log entries older than 30 days.
+crons.daily("purge old webhook deliveries", { hourUTC: 4, minuteUTC: 15 }, internal.webhooks.purgeDeliveries, {});
+
+export default crons;

package/backend/convex/devices.ts

@@ -0,0 +1,224 @@
+// Phone pairing: one-time pairing codes, long-lived revocable device tokens
+// and the failed-attempt limit of the pairing endpoint. Codes and tokens are
+// generated in actions; only SHA-256 hashes of their secret parts are stored.
+// The HTTP endpoints are in pairing.ts.
+import { v } from "convex/values";
+import { internal } from "./_generated/api";
+import type { Id } from "./_generated/dataModel";
+import { internalAction, internalMutation, internalQuery, type MutationCtx } from "./_generated/server";
+import { appSubject } from "./lib/appToken";
+import { fail, identityOf, recordEvent } from "./lib/core";
+import { serverEnv } from "./lib/env";
+import { formatPairingCode, newPairingCode, parsePairingCode, sha256Hex, timingSafeEqual } from "./lib/secrets";
+import { identityFields as identityArgs } from "./lib/validators";
+
+export const PAIRING_CODE_TTL_MS = 10 * 60 * 1000;
+const MAX_CODE_ATTEMPTS = 5;
+const PAIR_BUCKET = "pair";
+const PAIR_FAILURE_LIMIT = 10;
+const PAIR_FAILURE_WINDOW_MS = 10 * 60 * 1000;
+const CODE_RETENTION_MS = 24 * 60 * 60 * 1000;
+const MAX_NAME = 100;
+
+export function checkDeviceName(name: string): string {
+  const trimmed = name.trim();
+  if (!trimmed || trimmed.length > MAX_NAME) fail("invalid_argument", `deviceName must be 1 to ${MAX_NAME} characters`);
+  return trimmed;
+}
+
+// ---- Pairing codes ----
+
+/** Creates a pairing code for `userId`; the plain code is returned exactly once. `ttlMs` is only for tests. */
+export const createPairingCode = internalAction({
+  args: { ...identityArgs, createdBy: v.optional(v.string()), ttlMs: v.optional(v.number()) },
+  handler: async (ctx, input): Promise<{ code: string; expiresAt: number }> => {
+    const ttlMs = Math.min(Math.max(input.ttlMs ?? PAIRING_CODE_TTL_MS, 1), PAIRING_CODE_TTL_MS);
+    // A new selector rarely collides with an active code; draw again if it does.
+    for (let attempt = 0; attempt < 5; attempt++) {
+      const code = newPairingCode();
+      const parsed = parsePairingCode(code)!;
+      const expiresAt: number | null = await ctx.runMutation(internal.devices.insertCode, {
+        ...identityOf(input),
+        createdBy: input.createdBy ?? "admin",
+        selector: parsed.selector,
+        secretHash: await sha256Hex(parsed.secret),
+        ttlMs,
+      });
+      if (expiresAt !== null) return { code: formatPairingCode(code), expiresAt };
+    }
+    throw new Error("Could not draw an unused pairing code");
+  },
+});
+
+export const insertCode = internalMutation({
+  args: { ...identityArgs, createdBy: v.string(), selector: v.string(), secretHash: v.string(), ttlMs: v.number() },
+  handler: async (ctx, input) => {
+    const { userId, createdBy, selector, secretHash, ttlMs } = input;
+    const issuer = serverEnv("JWT_ISSUER") ?? "";
+    if (!appSubject(userId, issuer)) {
+      fail("invalid_argument", `User ${userId} cannot sign in to the app: app users are "${issuer}|<subject>"`);
+    }
+    const now = Date.now();
+    const sameSelector = await ctx.db
+      .query("pairingCodes")
+      .withIndex("by_selector", (q) => q.eq("selector", selector))
+      .collect();
+    if (sameSelector.some((c) => c.usedAt === undefined && c.expiresAt > now)) return null;
+    const expiresAt = now + ttlMs;
+    const id = await ctx.db.insert("pairingCodes", {
+      userId,
+      selector,
+      secretHash,
+      createdBy,
+      createdAt: now,
+      expiresAt,
+      failedAttempts: 0,
+    });
+    await recordEvent(ctx, identityOf(input), { action: "device.pairingCode", after: { codeId: id, createdBy, expiresAt } });
+    return expiresAt;
+  },
+});
+
+// ---- Failed-attempt limit of POST /auth/pair ----
+// One counter for the whole deployment (the endpoint is unauthenticated, so
+// there is no user to count per). Over the limit, codes are not checked at all.
+
+async function pairLimitRow(ctx: MutationCtx) {
+  return ctx.db
+    .query("authLimits")
+    .withIndex("by_bucket", (q) => q.eq("bucket", PAIR_BUCKET))
+    .unique();
+}
+
+async function recordPairFailure(ctx: MutationCtx, now: number) {
+  const row = await pairLimitRow(ctx);
+  if (!row) {
+    await ctx.db.insert("authLimits", { bucket: PAIR_BUCKET, windowStart: now, failures: 1 });
+  } else if (now - row.windowStart >= PAIR_FAILURE_WINDOW_MS) {
+    await ctx.db.patch(row._id, { windowStart: now, failures: 1 });
+  } else {
+    await ctx.db.patch(row._id, { failures: row.failures + 1 });
+  }
+}
+
+/** Clears the failed-attempt counter, e.g. after an attacker locked pairing: `npx convex run devices:resetPairLimit`. */
+export const resetPairLimit = internalMutation({
+  args: {},
+  handler: async (ctx) => {
+    const row = await pairLimitRow(ctx);
+    if (row) await ctx.db.delete(row._id);
+  },
+});
+
+type RedeemResult =
+  | { ok: true; deviceId: Id<"devices"> }
+  | { ok: false; reason: "invalid" }
+  | { ok: false; reason: "rate_limited"; retryAfterMs: number };
+
+/**
+ * Exchanges a pairing code for a new device, at most once. Failures return
+ * instead of throwing so that the failure counters are saved.
+ */
+export const redeemCode = internalMutation({
+  args: {
+    selector: v.string(),
+    secretHash: v.string(),
+    deviceName: v.string(),
+    deviceSelector: v.string(),
+    deviceSecretHash: v.string(),
+  },
+  handler: async (ctx, input): Promise<RedeemResult> => {
+    const now = Date.now();
+    const limit = await pairLimitRow(ctx);
+    if (limit && now - limit.windowStart < PAIR_FAILURE_WINDOW_MS && limit.failures >= PAIR_FAILURE_LIMIT) {
+      return { ok: false, reason: "rate_limited", retryAfterMs: limit.windowStart + PAIR_FAILURE_WINDOW_MS - now };
+    }
+    const code = (
+      await ctx.db
+        .query("pairingCodes")
+        .withIndex("by_selector", (q) => q.eq("selector", input.selector))
+        .collect()
+    ).find((c) => c.usedAt === undefined && c.expiresAt > now && c.failedAttempts < MAX_CODE_ATTEMPTS);
+    if (!code || !timingSafeEqual(code.secretHash, input.secretHash)) {
+      if (code) await ctx.db.patch(code._id, { failedAttempts: code.failedAttempts + 1 });
+      await recordPairFailure(ctx, now);
+      return { ok: false, reason: "invalid" };
+    }
+    await ctx.db.patch(code._id, { usedAt: now });
+    const name = checkDeviceName(input.deviceName);
+    const deviceId = await ctx.db.insert("devices", {
+      userId: code.userId,
+      name,
+      selector: input.deviceSelector,
+      secretHash: input.deviceSecretHash,
+      pairedBy: code.createdBy,
+      createdAt: now,
+    });
+    await recordEvent(ctx, { userId: code.userId, actor: "app" }, { action: "device.pair", after: { deviceId, name } });
+    return { ok: true, deviceId };
+  },
+});
+
+/** Run daily by the cron: removes codes that expired more than a day ago. */
+export const purgeExpiredCodes = internalMutation({
+  args: {},
+  handler: async (ctx) => {
+    const expired = await ctx.db
+      .query("pairingCodes")
+      .withIndex("by_expiresAt", (q) => q.lt("expiresAt", Date.now() - CODE_RETENTION_MS))
+      .take(500);
+    for (const code of expired) await ctx.db.delete(code._id);
+    return { purged: expired.length };
+  },
+});
+
+// ---- Devices ----
+
+/** Resolves an active device from its token; records the use. Null when unknown, wrong or revoked. */
+export const useToken = internalMutation({
+  args: { selector: v.string(), secretHash: v.string() },
+  handler: async (ctx, { selector, secretHash }) => {
+    const device = await ctx.db
+      .query("devices")
+      .withIndex("by_selector", (q) => q.eq("selector", selector))
+      .unique();
+    if (!device || device.revokedAt !== undefined || !timingSafeEqual(device.secretHash, secretHash)) return null;
+    await ctx.db.patch(device._id, { lastUsedAt: Date.now() });
+    return { userId: device.userId, deviceId: device._id };
+  },
+});
+
+/** Device metadata for `dayhand devices`; never the hash. */
+export const list = internalQuery({
+  args: identityArgs,
+  handler: async (ctx, { userId }) => {
+    const devices = await ctx.db
+      .query("devices")
+      .withIndex("by_user", (q) => q.eq("userId", userId))
+      .collect();
+    return devices.map((d) => ({
+      id: d._id,
+      name: d.name,
+      pairedBy: d.pairedBy,
+      createdAt: d.createdAt,
+      lastUsedAt: d.lastUsedAt ?? null,
+      revokedAt: d.revokedAt ?? null,
+    }));
+  },
+});
+
+/** The device gets no new app tokens; a token it already holds expires within an hour. */
+export const revoke = internalMutation({
+  args: { ...identityArgs, deviceId: v.string() },
+  handler: async (ctx, input) => {
+    const { userId, deviceId } = input;
+    const id = ctx.db.normalizeId("devices", deviceId);
+    const device = id ? await ctx.db.get(id) : null;
+    if (!device || device.userId !== userId) fail("not_found", `Device ${deviceId} not found`);
+    if (device.revokedAt !== undefined) return { id: device._id, revokedAt: device.revokedAt };
+    const revokedAt = Date.now();
+    await ctx.db.patch(device._id, { revokedAt });
+    await recordEvent(ctx, identityOf(input), { action: "device.revoke", after: { deviceId: device._id, name: device.name } });
+    return { id: device._id, revokedAt };
+  },
+});

package/backend/convex/http.ts

@@ -0,0 +1,56 @@
+import { httpRouter } from "convex/server";
+import { enableFeed, feed, getFeed, revokeFeed, rotateFeed } from "./calendar";
+import { listConnections, revokeConnection } from "./connections";
+import { handleOther, handlePost } from "./mcp";
+import {
+  authorizationServerMetadata,
+  authorize,
+  authorizeContinue,
+  authorizeStatus,
+  protectedResourceMetadata,
+  register,
+  revoke,
+  token as oauthToken,
+} from "./oauthHttp";
+import { createCode, listDevices, pair, revokeDevice, token } from "./pairing";
+import { handle as handleRest } from "./rest";
+
+const http = httpRouter();
+
+http.route({ path: "/mcp", method: "POST", handler: handlePost });
+http.route({ path: "/mcp", method: "GET", handler: handleOther });
+http.route({ path: "/mcp", method: "DELETE", handler: handleOther });
+
+http.route({ path: "/auth/pair", method: "POST", handler: pair });
+http.route({ path: "/auth/token", method: "POST", handler: token });
+http.route({ path: "/devices/pairing-code", method: "POST", handler: createCode });
+http.route({ path: "/devices", method: "GET", handler: listDevices });
+http.route({ path: "/devices/revoke", method: "POST", handler: revokeDevice });
+
+// OAuth 2.1 for MCP clients such as the Claude apps (docs/oauth.md).
+http.route({ path: "/.well-known/oauth-protected-resource", method: "GET", handler: protectedResourceMetadata });
+http.route({ path: "/.well-known/oauth-protected-resource/mcp", method: "GET", handler: protectedResourceMetadata });
+http.route({ path: "/.well-known/oauth-authorization-server", method: "GET", handler: authorizationServerMetadata });
+http.route({ path: "/oauth/authorize", method: "GET", handler: authorize });
+http.route({ path: "/oauth/authorize/status", method: "POST", handler: authorizeStatus });
+http.route({ path: "/oauth/authorize/continue", method: "POST", handler: authorizeContinue });
+http.route({ path: "/oauth/token", method: "POST", handler: oauthToken });
+http.route({ path: "/oauth/register", method: "POST", handler: register });
+http.route({ path: "/oauth/revoke", method: "POST", handler: revoke });
+http.route({ path: "/connections", method: "GET", handler: listConnections });
+http.route({ path: "/connections/revoke", method: "POST", handler: revokeConnection });
+
+// Convex routes only GET, POST, PUT, DELETE, OPTIONS and PATCH, so the feed is
+// a plain iCalendar file, not CalDAV (docs/calendar.md).
+http.route({ pathPrefix: "/cal/", method: "GET", handler: feed });
+http.route({ path: "/calendar/feed", method: "GET", handler: getFeed });
+http.route({ path: "/calendar/feed", method: "POST", handler: enableFeed });
+http.route({ path: "/calendar/feed/rotate", method: "POST", handler: rotateFeed });
+http.route({ path: "/calendar/feed/revoke", method: "POST", handler: revokeFeed });
+
+// The REST API for integrations (docs/api.md); rest.ts routes below the prefix.
+for (const method of ["GET", "POST", "PATCH", "DELETE"] as const) {
+  http.route({ pathPrefix: "/api/v1/", method, handler: handleRest });
+}
+
+export default http;