google-apis-cli 0.1.0 → 0.3.0

package/dist/src/transport.js

@@ -0,0 +1,125 @@
+// Transport: sends a CallPlan and prints the response (epic #30 D13).
+// `authorize` adds the credential before every request; a non-2xx exits 1, a missing scope 2.
+import { setTimeout } from 'node:timers/promises';
+import { GapiError, reasonOf } from './errors.js';
+import { isRecord, parseOrText } from './json.js';
+import { batch } from './transport/batch.js';
+import { download } from './transport/download.js';
+import { backoff, NetworkError, RETRIES, retryAfter, retryable, } from './transport/retry.js';
+import { upload } from './transport/upload.js';
+export async function send(plan, deps) {
+    const call = caller(plan, deps);
+    const print = (data) => deps.out.write(`${JSON.stringify(data, null, 2)}\n`);
+    if (plan.send === 'upload') {
+        print(await json(await upload(plan, call, deps.sleep ?? setTimeout)));
+        return;
+    }
+    if (plan.send === 'download') {
+        print(await download(plan, call));
+        return;
+    }
+    if (plan.send === 'batch') {
+        const sent = await batch(plan, call);
+        const results = sent.results.map(({ status, text }) => ({
+            status,
+            body: text ? parseOrText(text) : undefined,
+        }));
+        // Results print before any failure: the parts already sent were acted on.
+        if (results.length > 0 || !sent.error)
+            print(plan.decode ? plan.decode(results) : results);
+        if (sent.error)
+            throw sent.error;
+        const failed = sent.results.filter((r) => r.status < 200 || r.status > 299);
+        // A part that lacks a scope gets the same exit 2 and hint as a single call.
+        const scope = failed.map((r) => failure(plan, r.status, r.text)).find((e) => e.exit === 2);
+        if (scope)
+            throw scope;
+        if (failed.length > 0) {
+            throw new GapiError(1, `${failed.length} of ${results.length} batch parts failed`);
+        }
+        return;
+    }
+    const init = {
+        method: plan.httpMethod,
+        headers: plan.headers,
+        body: plan.body === undefined ? undefined : JSON.stringify(plan.body),
+    };
+    if (plan.send === 'once') {
+        const data = await json(await call(plan.url, init));
+        print(plan.decode ? plan.decode(data) : data);
+        return;
+    }
+    // D6: one compact JSON line per page, until no nextPageToken or pageLimit pages. The next
+    // page repeats the call with only pageToken changed (AIP-158), in the query or the body.
+    const url = new URL(plan.url);
+    let pageInit = init;
+    for (let page = 1; page <= plan.pageLimit; page++) {
+        const data = await json(await call(url.href, pageInit));
+        deps.out.write(`${JSON.stringify(data)}\n`);
+        const token = isRecord(data) ? data.nextPageToken : undefined;
+        if (typeof token !== 'string' || !token)
+            return;
+        if (plan.paging === 'query') {
+            url.searchParams.set('pageToken', token);
+        }
+        else {
+            pageInit = { ...init, body: JSON.stringify({ ...plan.body, pageToken: token }) };
+        }
+    }
+}
+// Uploads and batches never retry here; a resumable upload resumes on its own.
+function caller(plan, { fetch, authorize, sleep = setTimeout }) {
+    const retry = plan.retry && plan.send !== 'upload' && plan.send !== 'batch';
+    return async (url, init, allowed) => {
+        for (let attempt = 0;; attempt++) {
+            const headers = { ...init.headers, ...(await authorize(plan.auth)) };
+            const res = await fetch(url, { ...init, headers }).catch((e) => {
+                const cause = e instanceof Error && e.cause !== undefined ? e.cause : e;
+                return new NetworkError(1, `network: ${reasonOf(cause)}`);
+            });
+            const last = !retry || attempt === RETRIES;
+            if (res instanceof NetworkError) {
+                if (last)
+                    throw res;
+                await sleep(backoff(attempt));
+                continue;
+            }
+            if (res.ok || allowed?.(res.status))
+                return res;
+            const text = await res.text();
+            if (last || !retryable(res.status, text))
+                throw failure(plan, res.status, text);
+            await sleep(Math.max(backoff(attempt), retryAfter(res)));
+        }
+    };
+}
+// A 2xx body that is not JSON is Google's surprise, not gapi's: exit 1 with the body.
+async function json(res) {
+    const text = await res.text();
+    if (!text)
+        return {};
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        throw new GapiError(1, `HTTP ${res.status}: the response body is not JSON`, text);
+    }
+}
+export function failure(plan, status, text) {
+    // A front-end error page can be HTML; keep it as text rather than fail on parse.
+    // A streaming method wraps the error in an array (Go googleapi errorReplyFromBody).
+    const parsed = parseOrText(text);
+    const body = Array.isArray(parsed) ? parsed[0] : parsed;
+    const error = isRecord(body) && isRecord(body.error) ? body.error : {};
+    // D8: the stored grant lacks this method's scope; a new consent fixes it. AIP-193: the
+    // (reason, domain) pair of the ErrorInfo detail identifies the error.
+    const info = (Array.isArray(error.details) ? error.details : []).find((d) => isRecord(d) && typeof d['@type'] === 'string' && d['@type'].endsWith('google.rpc.ErrorInfo'));
+    if (isRecord(info) &&
+        info.reason === 'ACCESS_TOKEN_SCOPE_INSUFFICIENT' &&
+        info.domain === 'googleapis.com') {
+        const scopes = plan.auth.scopes.join(', ');
+        return new GapiError(2, `missing scope (${scopes}); run gapi auth login`, body);
+    }
+    const message = typeof error.message === 'string' ? error.message : `HTTP ${status}`;
+    return new GapiError(1, message, body || undefined);
+}

package/dist/src/types.js

@@ -1,13 +1 @@
-// Shared types for the two seams: the declarative manifest row and the
-// executor's injected dependencies. Kept in one file so an API slice only
-// imports types, never redefines the contract.
-// Carries the Google REST error status + body up to the CLI's catch.
-export class RestError extends Error {
-    status;
-    body;
-    constructor(message, status, body) {
-        super(message);
-        this.status = status;
-        this.body = body;
-    }
-}
+export {};

package/package.json

@@ -1,21 +1,23 @@
 {
   "name": "google-apis-cli",
-  "version": "0.1.0",
-  "description": "One CLI (gapi) for Google Ads, GTM, GA4 (Admin+Data), Search Console, and Indexing. One login, all scopes, read+write.",
+  "version": "0.3.0",
+  "description": "One discovery-driven CLI (gapi) for 47 Google marketing and data APIs: Ads, GA4, Search Console, Tag Manager, Indexing, Merchant, Business Profile, SA360, CM360, DV360, YouTube, PageSpeed, CrUX, Sheets, Places and more. One login, read+write.",
   "type": "module",
   "bin": {
     "gapi": "dist/bin/gapi.js"
   },
   "engines": {
-    "node": ">=24"
+    "node": ">=26"
   },
   "scripts": {
     "test": "node --test",
     "typecheck": "tsc --noEmit",
     "lint": "biome check",
     "format": "biome check --write",
+    "discovery:check": "node scripts/discovery-check.ts",
+    "gen:skill": "node scripts/gen-skill.ts",
     "build": "rm -rf dist && tsc -p tsconfig.build.json",
-    "prepublishOnly": "pnpm typecheck && pnpm lint && pnpm test && pnpm build"
+    "prepublishOnly": "pnpm typecheck && pnpm lint && pnpm test && pnpm discovery:check && pnpm build"
   },
   "files": [
     "dist/"
@@ -29,6 +31,19 @@
     "analytics",
     "search-console",
     "indexing",
+    "merchant-api",
+    "business-profile",
+    "search-ads-360",
+    "campaign-manager-360",
+    "display-video-360",
+    "youtube",
+    "pagespeed",
+    "crux",
+    "bigquery-data-transfer",
+    "sheets",
+    "places",
+    "web-risk",
+    "discovery",
     "cli"
   ],
   "homepage": "https://github.com/realroboto/google-apis-cli#readme",
@@ -40,13 +55,13 @@
     "url": "https://github.com/realroboto/google-apis-cli/issues"
   },
   "dependencies": {
-    "google-auth-library": "^11.0.2"
+    "google-auth-library": "^11.3.3"
   },
   "license": "MIT",
   "devDependencies": {
-    "@biomejs/biome": "^2.5.13",
-    "@types/node": "^24.13.4",
+    "@biomejs/biome": "^2.6.5",
+    "@types/node": "^26.6.6",
     "typescript": "^7.0.2"
   },
-  "packageManager": "pnpm@12.3.4+sha512.961aa41fb077da3a04a441d9f8e15ebc0c96da8ef710b2eb67bf9ee7cb0610eabd48f1fd85f51cffe73846785fa0f87c56a3a872a1d893f8446741b5cce45457"
+  "packageManager": "pnpm@12.16.1+sha512.091d1dee7927575661b25dab3c2ae31cafc1c54d6b71ed6a6600cf0c1cb10434a447eae14015f1b23e2e6bedeed79df94a932e2164d2832280dce3fb32f656d1"
 }

package/dist/src/apis/ga4-admin-v1alpha.js

@@ -1,280 +0,0 @@
-const RO = ['analytics.readonly'];
-const RW = ['analytics.edit'];
-const USERS = ['analytics.manage.users'];
-export default {
-    api: 'ga4-admin-alpha',
-    baseUrl: 'https://analyticsadmin.googleapis.com',
-    resources: {
-        // --- access bindings (users/permissions), gated by analytics.manage.users ---
-        'access-bindings': {
-            list: {
-                httpMethod: 'GET',
-                pathTemplate: '/v1alpha/properties/{property}/accessBindings',
-                scopes: USERS,
-                listKey: 'accessBindings',
-            },
-            get: {
-                httpMethod: 'GET',
-                pathTemplate: '/v1alpha/properties/{property}/accessBindings/{accessBinding}',
-                scopes: USERS,
-            },
-            // The names to fetch are a trailing positional → ?names= (query seam).
-            'batch-get': {
-                httpMethod: 'GET',
-                pathTemplate: '/v1alpha/properties/{property}/accessBindings:batchGet',
-                scopes: USERS,
-                query: ['names'],
-            },
-            create: {
-                httpMethod: 'POST',
-                pathTemplate: '/v1alpha/properties/{property}/accessBindings',
-                scopes: USERS,
-            },
-            patch: {
-                httpMethod: 'PATCH',
-                pathTemplate: '/v1alpha/properties/{property}/accessBindings/{accessBinding}',
-                scopes: USERS,
-            },
-            delete: {
-                httpMethod: 'DELETE',
-                pathTemplate: '/v1alpha/properties/{property}/accessBindings/{accessBinding}',
-                scopes: USERS,
-            },
-            'batch-create': {
-                httpMethod: 'POST',
-                pathTemplate: '/v1alpha/properties/{property}/accessBindings:batchCreate',
-                scopes: USERS,
-            },
-            'batch-update': {
-                httpMethod: 'POST',
-                pathTemplate: '/v1alpha/properties/{property}/accessBindings:batchUpdate',
-                scopes: USERS,
-            },
-            'batch-delete': {
-                httpMethod: 'POST',
-                pathTemplate: '/v1alpha/properties/{property}/accessBindings:batchDelete',
-                scopes: USERS,
-            },
-        },
-        'account-access-bindings': {
-            list: {
-                httpMethod: 'GET',
-                pathTemplate: '/v1alpha/accounts/{account}/accessBindings',
-                scopes: USERS,
-                listKey: 'accessBindings',
-            },
-            get: {
-                httpMethod: 'GET',
-                pathTemplate: '/v1alpha/accounts/{account}/accessBindings/{accessBinding}',
-                scopes: USERS,
-            },
-            // The names to fetch are a trailing positional → ?names= (query seam).
-            'batch-get': {
-                httpMethod: 'GET',
-                pathTemplate: '/v1alpha/accounts/{account}/accessBindings:batchGet',
-                scopes: USERS,
-                query: ['names'],
-            },
-            create: {
-                httpMethod: 'POST',
-                pathTemplate: '/v1alpha/accounts/{account}/accessBindings',
-                scopes: USERS,
-            },
-            patch: {
-                httpMethod: 'PATCH',
-                pathTemplate: '/v1alpha/accounts/{account}/accessBindings/{accessBinding}',
-                scopes: USERS,
-            },
-            delete: {
-                httpMethod: 'DELETE',
-                pathTemplate: '/v1alpha/accounts/{account}/accessBindings/{accessBinding}',
-                scopes: USERS,
-            },
-            'batch-create': {
-                httpMethod: 'POST',
-                pathTemplate: '/v1alpha/accounts/{account}/accessBindings:batchCreate',
-                scopes: USERS,
-            },
-            'batch-update': {
-                httpMethod: 'POST',
-                pathTemplate: '/v1alpha/accounts/{account}/accessBindings:batchUpdate',
-                scopes: USERS,
-            },
-            'batch-delete': {
-                httpMethod: 'POST',
-                pathTemplate: '/v1alpha/accounts/{account}/accessBindings:batchDelete',
-                scopes: USERS,
-            },
-        },
-        // --- audiences (no delete: archived via :archive) ---
-        audiences: {
-            list: {
-                httpMethod: 'GET',
-                pathTemplate: '/v1alpha/properties/{property}/audiences',
-                scopes: RO,
-                listKey: 'audiences',
-            },
-            get: {
-                httpMethod: 'GET',
-                pathTemplate: '/v1alpha/properties/{property}/audiences/{audience}',
-                scopes: RO,
-            },
-            create: {
-                httpMethod: 'POST',
-                pathTemplate: '/v1alpha/properties/{property}/audiences',
-                scopes: RW,
-            },
-            patch: {
-                httpMethod: 'PATCH',
-                pathTemplate: '/v1alpha/properties/{property}/audiences/{audience}',
-                scopes: RW,
-            },
-            archive: {
-                httpMethod: 'POST',
-                pathTemplate: '/v1alpha/properties/{property}/audiences/{audience}:archive',
-                scopes: RW,
-            },
-        },
-        'calculated-metrics': {
-            list: {
-                httpMethod: 'GET',
-                pathTemplate: '/v1alpha/properties/{property}/calculatedMetrics',
-                scopes: RO,
-                listKey: 'calculatedMetrics',
-            },
-            get: {
-                httpMethod: 'GET',
-                pathTemplate: '/v1alpha/properties/{property}/calculatedMetrics/{calculatedMetric}',
-                scopes: RO,
-            },
-            create: {
-                httpMethod: 'POST',
-                pathTemplate: '/v1alpha/properties/{property}/calculatedMetrics',
-                scopes: RW,
-            },
-            patch: {
-                httpMethod: 'PATCH',
-                pathTemplate: '/v1alpha/properties/{property}/calculatedMetrics/{calculatedMetric}',
-                scopes: RW,
-            },
-            delete: {
-                httpMethod: 'DELETE',
-                pathTemplate: '/v1alpha/properties/{property}/calculatedMetrics/{calculatedMetric}',
-                scopes: RW,
-            },
-        },
-        'channel-groups': {
-            list: {
-                httpMethod: 'GET',
-                pathTemplate: '/v1alpha/properties/{property}/channelGroups',
-                scopes: RO,
-                listKey: 'channelGroups',
-            },
-            get: {
-                httpMethod: 'GET',
-                pathTemplate: '/v1alpha/properties/{property}/channelGroups/{channelGroup}',
-                scopes: RO,
-            },
-            create: {
-                httpMethod: 'POST',
-                pathTemplate: '/v1alpha/properties/{property}/channelGroups',
-                scopes: RW,
-            },
-            patch: {
-                httpMethod: 'PATCH',
-                pathTemplate: '/v1alpha/properties/{property}/channelGroups/{channelGroup}',
-                scopes: RW,
-            },
-            delete: {
-                httpMethod: 'DELETE',
-                pathTemplate: '/v1alpha/properties/{property}/channelGroups/{channelGroup}',
-                scopes: RW,
-            },
-        },
-        // --- subproperties & rollups ---
-        'rollup-properties': {
-            create: {
-                httpMethod: 'POST',
-                pathTemplate: '/v1alpha/properties:createRollupProperty',
-                scopes: RW,
-            },
-        },
-        subproperties: {
-            provision: {
-                httpMethod: 'POST',
-                pathTemplate: '/v1alpha/properties:provisionSubproperty',
-                scopes: RW,
-            },
-        },
-        'rollup-property-source-links': {
-            list: {
-                httpMethod: 'GET',
-                pathTemplate: '/v1alpha/properties/{property}/rollupPropertySourceLinks',
-                scopes: RO,
-                listKey: 'rollupPropertySourceLinks',
-            },
-            get: {
-                httpMethod: 'GET',
-                pathTemplate: '/v1alpha/properties/{property}/rollupPropertySourceLinks/{rollupPropertySourceLink}',
-                scopes: RO,
-            },
-            create: {
-                httpMethod: 'POST',
-                pathTemplate: '/v1alpha/properties/{property}/rollupPropertySourceLinks',
-                scopes: RW,
-            },
-            delete: {
-                httpMethod: 'DELETE',
-                pathTemplate: '/v1alpha/properties/{property}/rollupPropertySourceLinks/{rollupPropertySourceLink}',
-                scopes: RW,
-            },
-        },
-        'subproperty-event-filters': {
-            list: {
-                httpMethod: 'GET',
-                pathTemplate: '/v1alpha/properties/{property}/subpropertyEventFilters',
-                scopes: RO,
-                listKey: 'subpropertyEventFilters',
-            },
-            get: {
-                httpMethod: 'GET',
-                pathTemplate: '/v1alpha/properties/{property}/subpropertyEventFilters/{subpropertyEventFilter}',
-                scopes: RO,
-            },
-            create: {
-                httpMethod: 'POST',
-                pathTemplate: '/v1alpha/properties/{property}/subpropertyEventFilters',
-                scopes: RW,
-            },
-            patch: {
-                httpMethod: 'PATCH',
-                pathTemplate: '/v1alpha/properties/{property}/subpropertyEventFilters/{subpropertyEventFilter}',
-                scopes: RW,
-            },
-            delete: {
-                httpMethod: 'DELETE',
-                pathTemplate: '/v1alpha/properties/{property}/subpropertyEventFilters/{subpropertyEventFilter}',
-                scopes: RW,
-            },
-        },
-        // subproperty sync configs are auto-created → list/get/patch only.
-        'subproperty-sync-configs': {
-            list: {
-                httpMethod: 'GET',
-                pathTemplate: '/v1alpha/properties/{property}/subpropertySyncConfigs',
-                scopes: RO,
-                listKey: 'subpropertySyncConfigs',
-            },
-            get: {
-                httpMethod: 'GET',
-                pathTemplate: '/v1alpha/properties/{property}/subpropertySyncConfigs/{subpropertySyncConfig}',
-                scopes: RO,
-            },
-            patch: {
-                httpMethod: 'PATCH',
-                pathTemplate: '/v1alpha/properties/{property}/subpropertySyncConfigs/{subpropertySyncConfig}',
-                scopes: RW,
-            },
-        },
-    },
-};

package/dist/src/auth.js

@@ -1,172 +0,0 @@
-// The only module with real handlers: OAuth login, status, logout, and the
-// tokenProvider the executor injects. One consent grants all 13 scopes; the
-// refresh token is persisted and getAccessToken() rehydrates transparently.
-import { readFileSync, rmSync } from 'node:fs';
-import { createServer } from 'node:http';
-import { createInterface } from 'node:readline/promises';
-import { Writable } from 'node:stream';
-import { OAuth2Client } from 'google-auth-library';
-import { CONFIG_PATH, CONSENT_SCOPES, CREDENTIALS_PATH, getOAuthClient, readConfigFile, SCOPES, writeSecureJson, } from './config.js';
-const LOOPBACK_PORT = 4600; // fixed port; vmCODE forwards it for headless use
-function newClient(redirectUri) {
-    const { clientId, clientSecret } = getOAuthClient();
-    if (!clientId || !clientSecret) {
-        throw new Error('OAuth client not configured. Set GAPI_OAUTH_CLIENT_ID and GAPI_OAUTH_CLIENT_SECRET.');
-    }
-    return new OAuth2Client({ clientId, clientSecret, redirectUri });
-}
-function saveCredentials(tokens) {
-    writeSecureJson(CREDENTIALS_PATH, tokens);
-}
-export function loadCredentials() {
-    return JSON.parse(readFileSync(CREDENTIALS_PATH, 'utf8'));
-}
-const AUTH_OPTS = { access_type: 'offline', prompt: 'consent', scope: CONSENT_SCOPES };
-// Decode a JWT payload without verifying (display only; it is our own token).
-function accountFromIdToken(idToken) {
-    try {
-        const payload = JSON.parse(Buffer.from(idToken.split('.')[1], 'base64url').toString());
-        return payload.email || payload.sub || null;
-    }
-    catch {
-        return null;
-    }
-}
-// The single-consent authorization URL for a client (offline + all scopes).
-export function authUrl(client) {
-    return client.generateAuthUrl(AUTH_OPTS);
-}
-// --manual: print the consent URL, read the pasted code, exchange it.
-export async function loginManual({ prompt, } = {}) {
-    const client = newClient('urn:ietf:wg:oauth:2.0:oob');
-    const url = authUrl(client);
-    console.error(`Open this URL, grant access, then paste the code:\n${url}\n`);
-    const ask = prompt || defaultPrompt;
-    const code = (await ask('code: ')).trim();
-    const { tokens } = await client.getToken(code);
-    saveCredentials(tokens);
-    return tokens;
-}
-// Guided setup: prompt the OAuth Desktop client id/secret and the optional Ads
-// login-customer-id (MCC), then merge into ~/.config/gapi/config.json (mode
-// 600). A blank answer keeps the current stored value. `prompt` is injectable
-// for tests. The secret field is masked at the prompt and goes straight to the
-// file. config.ts reads these back with precedence env → config → embedded.
-const SETUP_FIELDS = [
-    { key: 'oauth_client_id', label: 'OAuth client id', required: true, secret: false },
-    { key: 'oauth_client_secret', label: 'OAuth client secret', required: true, secret: true },
-    {
-        key: 'login-customer-id',
-        label: 'Ads login-customer-id (optional, MCC)',
-        required: false,
-        secret: false,
-    },
-];
-export async function configureAuth({ prompt, } = {}) {
-    const ask = prompt || defaultPrompt;
-    const cfg = readConfigFile();
-    for (const { key, label, required, secret } of SETUP_FIELDS) {
-        const cur = cfg[key];
-        const hint = cur != null ? ' [keep current]' : required ? '' : ' (blank to skip)';
-        const v = (await ask(`${label}${hint}: `, { secret })).trim();
-        if (v)
-            cfg[key] = v;
-        else if (required && cur == null)
-            throw new Error(`${label} is required`);
-    }
-    writeSecureJson(CONFIG_PATH, cfg);
-    return cfg;
-}
-// `secret: true` keeps the typed value off the screen. Node has no masking
-// option, so point readline's echo at a sink and print the question ourselves.
-// `terminal: true` is what makes this safe: it puts the tty in raw mode, so the
-// driver stops echoing too and the sink is the only writer left. Streams are
-// injectable so the masking has a test.
-export async function defaultPrompt(q, { secret = false, input = process.stdin, output = process.stderr, terminal, } = {}) {
-    if (secret)
-        output.write(q);
-    const rl = createInterface({
-        input,
-        output: secret ? new Writable({ write: (_c, _e, cb) => cb() }) : output,
-        terminal: secret ? true : terminal,
-    });
-    try {
-        return await rl.question(secret ? '' : q);
-    }
-    finally {
-        rl.close();
-        if (secret)
-            output.write('\n'); // the swallowed Enter never printed one
-    }
-}
-// Loopback: run a local server on LOOPBACK_PORT, open the consent URL, capture
-// the redirect's ?code=, exchange it, shut down. `handleRedirect` is exported
-// for tests (simulate GET /?code=... without a real browser).
-export async function loginLoopback({ openUrl, } = {}) {
-    const redirectUri = `http://127.0.0.1:${LOOPBACK_PORT}`;
-    const client = newClient(redirectUri);
-    const url = authUrl(client);
-    return new Promise((resolve, reject) => {
-        const server = createServer(async (req, res) => {
-            try {
-                const tokens = await handleRedirect(client, req.url || '', redirectUri);
-                res.end('gapi: authorized. You can close this tab.');
-                server.close();
-                resolve(tokens);
-            }
-            catch (e) {
-                res.statusCode = 400;
-                res.end(`gapi: ${e instanceof Error ? e.message : String(e)}`);
-                server.close();
-                reject(e);
-            }
-        });
-        server.listen(LOOPBACK_PORT, () => {
-            console.error(`Waiting for consent at ${redirectUri}\nOpen:\n${url}`);
-            (openUrl || (() => { }))(url);
-        });
-    });
-}
-// Extract ?code=, exchange for tokens, persist. Shared by loopback + tests.
-export async function handleRedirect(client, reqUrl, base) {
-    const code = new URL(reqUrl, base).searchParams.get('code');
-    if (!code)
-        throw new Error('no code in redirect');
-    const { tokens } = await client.getToken(code);
-    saveCredentials(tokens);
-    return tokens;
-}
-// tokenProvider injected into the executor: rehydrate the refresh token and
-// let google-auth-library refresh the access token before each call.
-export function makeTokenProvider({ client: injected, } = {}) {
-    let client = injected;
-    return async () => {
-        if (!client) {
-            const c = newClient();
-            c.setCredentials(loadCredentials());
-            c.on('tokens', (t) => {
-                const cur = loadCredentials();
-                saveCredentials({ ...cur, ...t });
-            });
-            client = c;
-        }
-        const { token } = await client.getAccessToken();
-        if (!token)
-            throw new Error('no access token; run `gapi auth login`');
-        return token;
-    };
-}
-export function status() {
-    const creds = loadCredentials();
-    const granted = (creds.scope || '').split(' ').filter(Boolean);
-    const byUrl = Object.fromEntries(Object.entries(SCOPES).map(([k, v]) => [v, k]));
-    return {
-        account: creds.id_token ? accountFromIdToken(creds.id_token) : null,
-        hasRefreshToken: Boolean(creds.refresh_token),
-        expiryDate: creds.expiry_date ? new Date(creds.expiry_date).toISOString() : null,
-        scopes: granted.map((u) => byUrl[u] || u),
-    };
-}
-export function logout() {
-    rmSync(CREDENTIALS_PATH, { force: true });
-}