runline 0.34.0 → 0.35.0

package/dist/plugins/gmail/src/index.js

@@ -1,14 +1,11 @@
 /**
  * Gmail plugin for runline.
  *
- * Authentication: OAuth2 user flow, seeded once via
- * `runline auth gmail`. The connection stores `clientId`,
- * `clientSecret`, `refreshToken`, plus cached `accessToken` +
- * `accessTokenExpiresAt`. When the cached token is missing or
- * within 60 s of expiry, the plugin refreshes against
- * `https://oauth2.googleapis.com/token` and persists the new
- * token via `ctx.updateConnection`. File-level locking inside
- * runline core keeps concurrent refreshes safe.
+ * Authentication: the Google grant's OAuth2 user flow, seeded once
+ * via `runline auth gmail`, or a service account. The connection
+ * stores `clientId`, `clientSecret` and `refreshToken`; the access
+ * token is refreshed lazily (60 s skew) and cached on the connection
+ * as the grant's, so every Google plugin sharing it signs with it.
  *
  * This plugin deliberately doesn't depend on nodemailer or
  * mailparser. MIME building is a minimal hand-rolled encoder
@@ -21,9 +18,10 @@
  * or parsed `payload` tree for format=full).
  */
 import * as t from "typebox";
+import { DownloadedFile, standardBase64 } from "../../_shared/base64.js";
 import { renderEmailJsx } from "../../_shared/emailJsx.js";
 import { pathSegment } from "../../_shared/credentials.js";
-import { googleCredential, googleJsonRequest } from "../../_shared/googleAuth.js";
+import { googleCredential, googleJsonRequest, googleOAuth, } from "../../_shared/googleAuth.js";
 import { GoogleTimestamp, Id, NonEmptyString, stringEnum, } from "../../_shared/googleSchemas.js";
 // ─── Request ─────────────────────────────────────────────────────
 const API_BASE = "https://gmail.googleapis.com/gmail/v1/users/me";
@@ -87,18 +85,6 @@ function header(name, value) {
 function foldedBase64ByteLength(length) {
     return length === 0 ? 0 : length + Math.floor((length - 1) / 76) * CRLF.length;
 }
-function normalizeMimeBase64(value, index) {
-    const compact = value.replace(/\s+/g, "");
-    if (!/^[A-Za-z0-9+/=_-]*$/.test(compact)) {
-        throw new Error(`gmail: attachment ${index} contentBase64 contains invalid base64 characters`);
-    }
-    const standard = compact.replace(/-/g, "+").replace(/_/g, "/");
-    const remainder = standard.length % 4;
-    if (remainder === 1) {
-        throw new Error(`gmail: attachment ${index} contentBase64 has invalid base64 length`);
-    }
-    return remainder === 0 ? standard : `${standard}${"=".repeat(4 - remainder)}`;
-}
 function foldBase64(encoded) {
     let folded = "";
     for (let i = 0; i < encoded.length; i += 76) {
@@ -135,10 +121,20 @@ function normalizeAttachment(input, index) {
     if (typeof contentBase64 !== "string") {
         throw new Error(`gmail: attachment ${index} contentBase64 must be a base64 string`);
     }
+    const normalized = standardBase64(contentBase64);
+    if (normalized === undefined) {
+        throw new Error(`gmail: attachment ${index} contentBase64 is not valid base64`);
+    }
+    // A download result passed as contentBase64 names its own file and type.
+    const result = typeof content === "object" && content ? content : {};
+    const named = (value) => typeof value === "string" && value ? value : undefined;
     return {
-        name: input.name ?? input.filename ?? `attachment-${index + 1}`,
-        mimeType: input.mimeType ?? "application/octet-stream",
-        contentBase64: normalizeMimeBase64(contentBase64, index),
+        name: input.name ??
+            input.filename ??
+            named(result.name) ??
+            `attachment-${index + 1}`,
+        mimeType: input.mimeType ?? named(result.mimeType) ?? "application/octet-stream",
+        contentBase64: normalized,
     };
 }
 function attachmentPart(att) {
@@ -432,9 +428,6 @@ function simplifyMessage(raw, labels) {
  * `References` headers plus the original `threadId`.
  */
 async function replyToMessage(ctx, messageId, p) {
-    if (p.replyToSenderOnly && p.replyToRecipientsOnly) {
-        throw new Error("gmail: replyToSenderOnly and replyToRecipientsOnly are mutually exclusive");
-    }
     // Render before any network round-trip so malformed jsx fails
     // without spending Gmail API calls.
     const { text, html } = await resolveBody(p);
@@ -515,10 +508,7 @@ const MessageListVisibility = stringEnum(["show", "hide"]);
 const MetadataHeaders = t.Array(t.String());
 const LabelIds = t.Array(NonEmptyString, { minItems: 1 });
 const MaxResults = t.Integer({ minimum: 1, maximum: 500 });
-const AttachmentContent = t.Union([
-    t.String(),
-    t.Object({ contentBase64: t.String() }, strict),
-]);
+const AttachmentContent = t.Union([t.String(), DownloadedFile]);
 const Attachment = t.Object({
     name: t.Optional(t.String()),
     filename: t.Optional(t.String()),
@@ -582,60 +572,7 @@ export default function gmail(rl) {
     rl.setName("gmail");
     rl.setVersion("0.1.0");
     rl.setCredential(googleCredential("gmail", SCOPES));
-    rl.setOAuth({
-        authUrl: "https://accounts.google.com/o/oauth2/v2/auth",
-        tokenUrl: "https://oauth2.googleapis.com/token",
-        scopes: SCOPES,
-        // access_type=offline + prompt=consent are both required to
-        // make Google return a refresh token. Without them, repeat
-        // logins skip the refresh_token field in the response.
-        authParams: { access_type: "offline", prompt: "consent" },
-        setupHelp: [
-            "You need a Google Cloud OAuth client. Takes ~5 minutes, one time.",
-            "Do the steps in order — skipping step 4 causes a 403 when you log in.",
-            "",
-            "1. Create a Google Cloud project (or pick an existing one):",
-            "     https://console.cloud.google.com/projectcreate",
-            "   Make sure the new project is selected in the top navigation dropdown.",
-            "",
-            "2. Enable the Gmail API for that project:",
-            "     https://console.cloud.google.com/apis/library/gmail.googleapis.com",
-            "   Click 'Enable'.",
-            "",
-            "3. Configure the OAuth consent screen (first time only):",
-            "     https://console.cloud.google.com/apis/credentials/consent",
-            "   Click 'Get started' and fill in:",
-            "     • App name: runline (or whatever)",
-            "     • User support email: your email",
-            "     • Audience: External",
-            "     • Developer contact: your email",
-            "   You can skip the Scopes screen — runline declares scopes at auth time.",
-            "",
-            "4. Add yourself as a test user (required — External apps in Testing mode",
-            "   only allow authentication from addresses on this list):",
-            "     https://console.cloud.google.com/auth/audience",
-            "   Under 'Test users', click '+ Add users' and enter the Gmail address",
-            "   you'll use to log in. Consent and refresh tokens expire every 7 days",
-            "   while the app is in Testing mode.",
-            "",
-            "5. Create the OAuth client:",
-            "     https://console.cloud.google.com/apis/credentials",
-            "     • + Create credentials → OAuth client ID",
-            "     • Application type: Web application",
-            "     • Name: runline (or whatever)",
-            "     • Authorized redirect URIs → + Add URI:",
-            "         {{redirectUri}}",
-            "     • Click Create, then copy the Client ID and Client Secret from the",
-            "       dialog — the secret is only shown once.",
-            "",
-            "6. Paste them below (or re-run with --client-id / --client-secret,",
-            "   or export GMAIL_CLIENT_ID and GMAIL_CLIENT_SECRET).",
-            "",
-            "During login you'll see a 'Google hasn't verified this app' warning.",
-            "Click 'Advanced → Go to runline (unsafe)' to continue — this is",
-            "expected for apps in Testing mode.",
-        ],
-    });
+    rl.setOAuth(googleOAuth("gmail", SCOPES, "GMAIL"));
     rl.setConnectionSchema({
         authMethod: { type: "string", required: false, description: "delegated or serviceAccount (legacy configs infer the method)" },
         clientId: {

package/dist/plugins/googleAppsScript/src/index.js

@@ -1,6 +1,6 @@
 import * as t from "typebox";
 import { pathSegment } from "../../_shared/credentials.js";
-import { googleCredential, googleJsonRequest, } from "../../_shared/googleAuth.js";
+import { googleCredential, googleJsonRequest, googleOAuth, } from "../../_shared/googleAuth.js";
 import { Id, NonEmptyString, PositiveInteger, stringEnum, } from "../../_shared/googleSchemas.js";
 const SCRIPT_API = "https://script.googleapis.com/v1";
 const DRIVE_API = "https://www.googleapis.com/drive/v3";
@@ -42,6 +42,7 @@ export default function googleAppsScript(rl) {
     rl.setName("googleAppsScript");
     rl.setVersion("1.0.0");
     rl.setCredential(googleCredential("googleAppsScript", SCOPES));
+    rl.setOAuth(googleOAuth("googleAppsScript", SCOPES, "GOOGLE_APPS_SCRIPT"));
     rl.setConnectionSchema({
         authMethod: {
             type: "string",

package/dist/plugins/googleCalendar/src/index.js

@@ -1,13 +1,10 @@
 /**
  * Google Calendar plugin for runline.
  *
- * Authentication mirrors the gmail plugin: OAuth2 user flow, seeded
- * once via `runline auth googleCalendar`. The connection stores
- * `clientId`, `clientSecret`, `refreshToken`, plus cached
- * `accessToken` + `accessTokenExpiresAt`. Token refresh is lazy —
- * when the cached token is missing or within 60 s of expiry the
- * plugin hits `https://oauth2.googleapis.com/token` and persists
- * the new token via `ctx.updateConnection`.
+ * Authentication mirrors the gmail plugin: the Google grant's OAuth2
+ * user flow, seeded once via `runline auth googleCalendar`, with the
+ * access token refreshed lazily (60 s skew) and cached on the
+ * connection as the grant's.
  *
  * Surface area:
  *
@@ -30,7 +27,7 @@
 import rrulePkg from "rrule";
 import * as t from "typebox";
 import { pathSegment } from "../../_shared/credentials.js";
-import { googleCredential, googleJsonRequest } from "../../_shared/googleAuth.js";
+import { googleCredential, googleJsonRequest, googleOAuth, } from "../../_shared/googleAuth.js";
 import { Id, NonEmptyString, NonEmptyStringArray, PositiveInteger, StringOrStringArray, stringEnum, } from "../../_shared/googleSchemas.js";
 // `rrule` ships as CJS; named imports fail under Node ESM.
 const { RRule } = rrulePkg;
@@ -503,37 +500,7 @@ export default function googleCalendar(rl) {
     rl.setName("googleCalendar");
     rl.setVersion("0.1.0");
     rl.setCredential(googleCredential("googleCalendar", SCOPES));
-    rl.setOAuth({
-        authUrl: "https://accounts.google.com/o/oauth2/v2/auth",
-        tokenUrl: "https://oauth2.googleapis.com/token",
-        scopes: SCOPES,
-        authParams: { access_type: "offline", prompt: "consent" },
-        setupHelp: [
-            "You need a Google Cloud OAuth client. Takes ~5 minutes, one time.",
-            "",
-            "1. Create or pick a Google Cloud project:",
-            "     https://console.cloud.google.com/projectcreate",
-            "",
-            "2. Enable the Google Calendar API:",
-            "     https://console.cloud.google.com/apis/library/calendar-json.googleapis.com",
-            "",
-            "3. Configure the OAuth consent screen (first time only):",
-            "     https://console.cloud.google.com/apis/credentials/consent",
-            "     • Audience: External",
-            "",
-            "4. Add yourself as a test user:",
-            "     https://console.cloud.google.com/auth/audience",
-            "",
-            "5. Create the OAuth client:",
-            "     https://console.cloud.google.com/apis/credentials",
-            "     • + Create credentials → OAuth client ID",
-            "     • Application type: Web application",
-            "     • Authorized redirect URIs → + Add URI: {{redirectUri}}",
-            "",
-            "6. Paste the Client ID and Client Secret below, or export",
-            "   GOOGLE_CALENDAR_CLIENT_ID and GOOGLE_CALENDAR_CLIENT_SECRET.",
-        ],
-    });
+    rl.setOAuth(googleOAuth("googleCalendar", SCOPES, "GOOGLE_CALENDAR"));
     rl.setConnectionSchema({
         authMethod: { type: "string", required: false, description: "delegated or serviceAccount (legacy configs infer the method)" },
         clientId: {

package/dist/plugins/googleContacts/src/index.js

@@ -25,7 +25,7 @@
  */
 import * as t from "typebox";
 import { pathSegment } from "../../_shared/credentials.js";
-import { googleCredential, googleJsonRequest } from "../../_shared/googleAuth.js";
+import { googleCredential, googleJsonRequest, googleOAuth, } from "../../_shared/googleAuth.js";
 import { Id, NonEmptyString, PositiveInteger, stringEnum, } from "../../_shared/googleSchemas.js";
 // ─── Fields ─────────────────────────────────────────────────────
 /**
@@ -375,37 +375,7 @@ export default function googleContacts(rl) {
     rl.setName("googleContacts");
     rl.setVersion("0.1.0");
     rl.setCredential(googleCredential("googleContacts", SCOPES));
-    rl.setOAuth({
-        authUrl: "https://accounts.google.com/o/oauth2/v2/auth",
-        tokenUrl: "https://oauth2.googleapis.com/token",
-        scopes: SCOPES,
-        authParams: { access_type: "offline", prompt: "consent" },
-        setupHelp: [
-            "You need a Google Cloud OAuth client. Takes ~5 minutes, one time.",
-            "",
-            "1. Create or pick a Google Cloud project:",
-            "     https://console.cloud.google.com/projectcreate",
-            "",
-            "2. Enable the People API:",
-            "     https://console.cloud.google.com/apis/library/people.googleapis.com",
-            "",
-            "3. Configure the OAuth consent screen:",
-            "     https://console.cloud.google.com/apis/credentials/consent",
-            "     • Audience: External",
-            "",
-            "4. Add yourself as a test user:",
-            "     https://console.cloud.google.com/auth/audience",
-            "",
-            "5. Create the OAuth client:",
-            "     https://console.cloud.google.com/apis/credentials",
-            "     • + Create credentials → OAuth client ID",
-            "     • Application type: Web application",
-            "     • Authorized redirect URIs → + Add URI: {{redirectUri}}",
-            "",
-            "6. Paste the Client ID and Client Secret below, or export",
-            "   GOOGLE_CONTACTS_CLIENT_ID and GOOGLE_CONTACTS_CLIENT_SECRET.",
-        ],
-    });
+    rl.setOAuth(googleOAuth("googleContacts", SCOPES, "GOOGLE_CONTACTS"));
     rl.setConnectionSchema({
         authMethod: { type: "string", required: false, description: "delegated or serviceAccount (legacy configs infer the method)" },
         clientId: { type: "string", required: false, env: "GOOGLE_CONTACTS_CLIENT_ID" },

package/dist/plugins/googleDocs/src/index.js

@@ -7,7 +7,7 @@
  * — the Docs API itself only creates blank documents without a
  * target folder.
  */
-import { googleCredential } from "../../_shared/googleAuth.js";
+import { googleCredential, googleOAuth } from "../../_shared/googleAuth.js";
 import { registerDocumentsActions } from "./documents.js";
 import { registerFormattingActions } from "./formatting.js";
 import { registerImagesActions } from "./images.js";
@@ -20,38 +20,7 @@ export default function googleDocs(rl) {
     rl.setName("googleDocs");
     rl.setVersion("0.1.0");
     rl.setCredential(googleCredential("googleDocs", SCOPES));
-    rl.setOAuth({
-        authUrl: "https://accounts.google.com/o/oauth2/v2/auth",
-        tokenUrl: "https://oauth2.googleapis.com/token",
-        scopes: SCOPES,
-        authParams: { access_type: "offline", prompt: "consent" },
-        setupHelp: [
-            "You need a Google Cloud OAuth client. Takes ~5 minutes, one time.",
-            "",
-            "1. Create or pick a Google Cloud project:",
-            "     https://console.cloud.google.com/projectcreate",
-            "",
-            "2. Enable the Google Docs API (and Drive API for document.create):",
-            "     https://console.cloud.google.com/apis/library/docs.googleapis.com",
-            "     https://console.cloud.google.com/apis/library/drive.googleapis.com",
-            "",
-            "3. Configure the OAuth consent screen:",
-            "     https://console.cloud.google.com/apis/credentials/consent",
-            "     • Audience: External",
-            "",
-            "4. Add yourself as a test user:",
-            "     https://console.cloud.google.com/auth/audience",
-            "",
-            "5. Create the OAuth client:",
-            "     https://console.cloud.google.com/apis/credentials",
-            "     • + Create credentials → OAuth client ID",
-            "     • Application type: Web application",
-            "     • Authorized redirect URIs → + Add URI: {{redirectUri}}",
-            "",
-            "6. Paste the Client ID and Client Secret below, or export",
-            "   GOOGLE_DOCS_CLIENT_ID and GOOGLE_DOCS_CLIENT_SECRET.",
-        ],
-    });
+    rl.setOAuth(googleOAuth("googleDocs", SCOPES, "GOOGLE_DOCS"));
     rl.setConnectionSchema({
         authMethod: {
             type: "string",

package/dist/plugins/googleDrive/src/index.js

@@ -53,11 +53,13 @@
  * for larger files, driven off whether the caller supplies bytes
  * (Buffer) vs a path (streamed).
  */
-import { createReadStream, readFileSync, statSync, writeFileSync } from "node:fs";
+import { createReadStream, statSync, writeFileSync } from "node:fs";
 import * as t from "typebox";
+import { standardBase64 } from "../../_shared/base64.js";
 import { jsonAnswer, pathSegment } from "../../_shared/credentials.js";
-import { googleCredential, googleJsonRequest, googleResponse, } from "../../_shared/googleAuth.js";
+import { googleCredential, googleJsonRequest, googleOAuth, googleResponse, } from "../../_shared/googleAuth.js";
 import { Id, NonEmptyString, RawGoogleObject, StringMap, StringOrStringArray, stringEnum, } from "../../_shared/googleSchemas.js";
+import { readLocalFile } from "../../_shared/localFile.js";
 const PermissionRole = stringEnum([
     "owner",
     "organizer",
@@ -142,9 +144,12 @@ async function paginateAll(ctx, path, key, qs) {
  * mimeType. For resumable uploads we keep paths as paths so we can
  * stream instead of buffering 500 MB in memory.
  */
-function resolveContent(p) {
+async function resolveContent(p) {
     if (typeof p.contentBase64 === "string") {
-        const buf = Buffer.from(p.contentBase64, "base64");
+        const base64 = standardBase64(p.contentBase64);
+        if (base64 === undefined)
+            throw new Error("googleDrive: contentBase64 is not valid base64");
+        const buf = Buffer.from(base64, "base64");
         return {
             buffer: buf,
             size: buf.byteLength,
@@ -168,9 +173,14 @@ function resolveContent(p) {
         const BUFFER_THRESHOLD = 5 * 1024 * 1024;
         const fileName = p.name ?? p.contentPath.split("/").pop();
         if (stat.size <= BUFFER_THRESHOLD) {
+            const buffer = await readLocalFile(p.contentPath, {
+                subject: "googleDrive: contentPath",
+                maxBytes: BUFFER_THRESHOLD,
+                oversize: "googleDrive: contentPath grew while reading; retry the upload",
+            });
             return {
-                buffer: readFileSync(p.contentPath),
-                size: stat.size,
+                buffer,
+                size: buffer.byteLength,
                 mimeType: p.mimeType,
                 fileName,
             };
@@ -351,37 +361,7 @@ export default function googleDrive(rl) {
     rl.setName("googleDrive");
     rl.setVersion("0.1.0");
     rl.setCredential(googleCredential("googleDrive", SCOPES));
-    rl.setOAuth({
-        authUrl: "https://accounts.google.com/o/oauth2/v2/auth",
-        tokenUrl: "https://oauth2.googleapis.com/token",
-        scopes: SCOPES,
-        authParams: { access_type: "offline", prompt: "consent" },
-        setupHelp: [
-            "You need a Google Cloud OAuth client. Takes ~5 minutes, one time.",
-            "",
-            "1. Create or pick a Google Cloud project:",
-            "     https://console.cloud.google.com/projectcreate",
-            "",
-            "2. Enable the Google Drive API:",
-            "     https://console.cloud.google.com/apis/library/drive.googleapis.com",
-            "",
-            "3. Configure the OAuth consent screen:",
-            "     https://console.cloud.google.com/apis/credentials/consent",
-            "     • Audience: External",
-            "",
-            "4. Add yourself as a test user:",
-            "     https://console.cloud.google.com/auth/audience",
-            "",
-            "5. Create the OAuth client:",
-            "     https://console.cloud.google.com/apis/credentials",
-            "     • + Create credentials → OAuth client ID",
-            "     • Application type: Web application",
-            "     • Authorized redirect URIs → + Add URI: {{redirectUri}}",
-            "",
-            "6. Paste the Client ID and Client Secret below, or export",
-            "   GOOGLE_DRIVE_CLIENT_ID and GOOGLE_DRIVE_CLIENT_SECRET.",
-        ],
-    });
+    rl.setOAuth(googleOAuth("googleDrive", SCOPES, "GOOGLE_DRIVE"));
     rl.setConnectionSchema({
         authMethod: { type: "string", required: false, description: "delegated or serviceAccount (legacy configs infer the method)" },
         clientId: {
@@ -457,7 +437,7 @@ export default function googleDrive(rl) {
         }),
         async execute(input, ctx) {
             const p = (input ?? {});
-            const content = resolveContent(p);
+            const content = await resolveContent(p);
             const metadata = {
                 name: content.fileName ?? "Untitled",
                 parents: [resolveParent(p.folderId, p.driveId)],
@@ -713,7 +693,7 @@ export default function googleDrive(rl) {
             // Step 1: upload new bytes if provided. Drive requires PATCH on
             // the upload endpoint for content replacement.
             if (hasBytes) {
-                const c = resolveContent(p);
+                const c = await resolveContent(p);
                 const mimeType = c.mimeType ?? p.mimeType ?? "application/octet-stream";
                 if (c.buffer) {
                     const url = new URL(`${API_BASE}/upload/drive/v3/files/${pathSegment(fileId)}`);
@@ -1494,9 +1474,6 @@ export default function googleDrive(rl) {
                 if (p[k] !== undefined)
                     body[k] = p[k];
             }
-            if (Object.keys(body).length === 0) {
-                throw new Error("googleDrive.revision.update: pass at least one of keepForever / published / publishAuto / publishedOutsideDomain.");
-            }
             return driveRequest(ctx, "PATCH", `/drive/v3/files/${pathSegment(p.fileId)}/revisions/${pathSegment(p.revisionId)}`, body, { fields: REVISION_FIELDS });
         },
     });
@@ -1682,9 +1659,6 @@ export default function googleDrive(rl) {
                 qs.removeExpiration = true;
             if (p.useDomainAdminAccess)
                 qs.useDomainAdminAccess = true;
-            if (Object.keys(body).length === 0 && !qs.removeExpiration) {
-                throw new Error("googleDrive.permission.update: pass at least one of role / expirationTime / removeExpiration.");
-            }
             return driveRequest(ctx, "PATCH", `/drive/v3/files/${pathSegment(p.fileId)}/permissions/${pathSegment(p.permissionId)}`, body, qs);
         },
     });

package/dist/plugins/googleImage/src/index.js

@@ -117,7 +117,7 @@ export default function googleImage(rl) {
             if (typeof p.prompt !== "string" || p.prompt.length === 0) {
                 throw new Error("googleImage: prompt is required");
             }
-            const img = readImageInput(p.imagePath, "googleImage");
+            const img = await readImageInput(p.imagePath, "googleImage");
             const model = p.model ?? "gemini-2.5-flash-image";
             const data = await generateContent(ctx, model, {
                 contents: [

package/dist/plugins/googleSheets/src/index.js

@@ -36,7 +36,7 @@
  */
 import * as t from "typebox";
 import { pathSegment } from "../../_shared/credentials.js";
-import { googleCredential, googleJsonRequest } from "../../_shared/googleAuth.js";
+import { googleCredential, googleJsonRequest, googleOAuth, } from "../../_shared/googleAuth.js";
 import { Id, JsonValue, NonEmptyString, NonNegativeInteger, PositiveInteger, RawGoogleObject, StringArray, stringEnum, } from "../../_shared/googleSchemas.js";
 const ROW_NUMBER = "row_number";
 const sheetReferenceSchema = t.Union([NonEmptyString, NonNegativeInteger]);
@@ -338,39 +338,7 @@ export default function googleSheets(rl) {
     rl.setName("googleSheets");
     rl.setVersion("0.1.0");
     rl.setCredential(googleCredential("googleSheets", SCOPES));
-    rl.setOAuth({
-        authUrl: "https://accounts.google.com/o/oauth2/v2/auth",
-        tokenUrl: "https://oauth2.googleapis.com/token",
-        scopes: SCOPES,
-        authParams: { access_type: "offline", prompt: "consent" },
-        setupHelp: [
-            "You need a Google Cloud OAuth client. Takes ~5 minutes, one time.",
-            "",
-            "1. Create or pick a Google Cloud project:",
-            "     https://console.cloud.google.com/projectcreate",
-            "",
-            "2. Enable the Google Sheets API (and Drive API, required for",
-            "   spreadsheet.delete):",
-            "     https://console.cloud.google.com/apis/library/sheets.googleapis.com",
-            "     https://console.cloud.google.com/apis/library/drive.googleapis.com",
-            "",
-            "3. Configure the OAuth consent screen:",
-            "     https://console.cloud.google.com/apis/credentials/consent",
-            "     • Audience: External",
-            "",
-            "4. Add yourself as a test user:",
-            "     https://console.cloud.google.com/auth/audience",
-            "",
-            "5. Create the OAuth client:",
-            "     https://console.cloud.google.com/apis/credentials",
-            "     • + Create credentials → OAuth client ID",
-            "     • Application type: Web application",
-            "     • Authorized redirect URIs → + Add URI: {{redirectUri}}",
-            "",
-            "6. Paste the Client ID and Client Secret below, or export",
-            "   GOOGLE_SHEETS_CLIENT_ID and GOOGLE_SHEETS_CLIENT_SECRET.",
-        ],
-    });
+    rl.setOAuth(googleOAuth("googleSheets", SCOPES, "GOOGLE_SHEETS"));
     rl.setConnectionSchema({
         authMethod: { type: "string", required: false, description: "delegated or serviceAccount (legacy configs infer the method)" },
         clientId: {

package/dist/plugins/googleSlides/src/index.js

@@ -22,7 +22,7 @@
 import { writeFileSync } from "node:fs";
 import * as t from "typebox";
 import { pathSegment } from "../../_shared/credentials.js";
-import { googleCredential, googleDownload, googleJsonRequest, } from "../../_shared/googleAuth.js";
+import { googleCredential, googleDownload, googleJsonRequest, googleOAuth, } from "../../_shared/googleAuth.js";
 import { Id, NonEmptyString, PositiveInteger, RawGoogleObject, StringArray, stringEnum, } from "../../_shared/googleSchemas.js";
 // ─── Request ─────────────────────────────────────────────────────
 const API_BASE = "https://slides.googleapis.com/v1";
@@ -47,37 +47,7 @@ export default function googleSlides(rl) {
     rl.setName("googleSlides");
     rl.setVersion("0.1.0");
     rl.setCredential(googleCredential("googleSlides", SCOPES));
-    rl.setOAuth({
-        authUrl: "https://accounts.google.com/o/oauth2/v2/auth",
-        tokenUrl: "https://oauth2.googleapis.com/token",
-        scopes: SCOPES,
-        authParams: { access_type: "offline", prompt: "consent" },
-        setupHelp: [
-            "You need a Google Cloud OAuth client. Takes ~5 minutes, one time.",
-            "",
-            "1. Create or pick a Google Cloud project:",
-            "     https://console.cloud.google.com/projectcreate",
-            "",
-            "2. Enable the Google Slides API:",
-            "     https://console.cloud.google.com/apis/library/slides.googleapis.com",
-            "",
-            "3. Configure the OAuth consent screen:",
-            "     https://console.cloud.google.com/apis/credentials/consent",
-            "     • Audience: External",
-            "",
-            "4. Add yourself as a test user:",
-            "     https://console.cloud.google.com/auth/audience",
-            "",
-            "5. Create the OAuth client:",
-            "     https://console.cloud.google.com/apis/credentials",
-            "     • + Create credentials → OAuth client ID",
-            "     • Application type: Web application",
-            "     • Authorized redirect URIs → + Add URI: {{redirectUri}}",
-            "",
-            "6. Paste the Client ID and Client Secret below, or export",
-            "   GOOGLE_SLIDES_CLIENT_ID and GOOGLE_SLIDES_CLIENT_SECRET.",
-        ],
-    });
+    rl.setOAuth(googleOAuth("googleSlides", SCOPES, "GOOGLE_SLIDES"));
     rl.setConnectionSchema({
         authMethod: { type: "string", required: false, description: "delegated or serviceAccount (legacy configs infer the method)" },
         clientId: {

package/dist/plugins/googleTasks/src/index.js

@@ -21,7 +21,7 @@
  */
 import * as t from "typebox";
 import { pathSegment } from "../../_shared/credentials.js";
-import { googleCredential, googleJsonRequest } from "../../_shared/googleAuth.js";
+import { googleCredential, googleJsonRequest, googleOAuth, } from "../../_shared/googleAuth.js";
 import { GoogleTimestamp, Id, stringEnum, } from "../../_shared/googleSchemas.js";
 // ─── Request ─────────────────────────────────────────────────────
 const API_BASE = "https://tasks.googleapis.com/tasks/v1";
@@ -71,37 +71,7 @@ export default function googleTasks(rl) {
     rl.setName("googleTasks");
     rl.setVersion("0.1.0");
     rl.setCredential(googleCredential("googleTasks", SCOPES));
-    rl.setOAuth({
-        authUrl: "https://accounts.google.com/o/oauth2/v2/auth",
-        tokenUrl: "https://oauth2.googleapis.com/token",
-        scopes: SCOPES,
-        authParams: { access_type: "offline", prompt: "consent" },
-        setupHelp: [
-            "You need a Google Cloud OAuth client. Takes ~5 minutes, one time.",
-            "",
-            "1. Create or pick a Google Cloud project:",
-            "     https://console.cloud.google.com/projectcreate",
-            "",
-            "2. Enable the Google Tasks API:",
-            "     https://console.cloud.google.com/apis/library/tasks.googleapis.com",
-            "",
-            "3. Configure the OAuth consent screen:",
-            "     https://console.cloud.google.com/apis/credentials/consent",
-            "     • Audience: External",
-            "",
-            "4. Add yourself as a test user:",
-            "     https://console.cloud.google.com/auth/audience",
-            "",
-            "5. Create the OAuth client:",
-            "     https://console.cloud.google.com/apis/credentials",
-            "     • + Create credentials → OAuth client ID",
-            "     • Application type: Web application",
-            "     • Authorized redirect URIs → + Add URI: {{redirectUri}}",
-            "",
-            "6. Paste the Client ID and Client Secret below, or export",
-            "   GOOGLE_TASKS_CLIENT_ID and GOOGLE_TASKS_CLIENT_SECRET.",
-        ],
-    });
+    rl.setOAuth(googleOAuth("googleTasks", SCOPES, "GOOGLE_TASKS"));
     rl.setConnectionSchema({
         authMethod: { type: "string", required: false, description: "delegated or serviceAccount (legacy configs infer the method)" },
         clientId: { type: "string", required: false, env: "GOOGLE_TASKS_CLIENT_ID" },

package/dist/plugins/highlevel/src/index.js

@@ -62,7 +62,10 @@ export default function highlevel(rl) {
         },
         async execute(input, ctx) {
             const locationId = locationOf(ctx);
-            const body = { ...input, locationId };
+            const body = {
+                ...input,
+                locationId,
+            };
             if (typeof body.tags === "string")
                 body.tags = body.tags
                     .split(",")
@@ -176,7 +179,10 @@ export default function highlevel(rl) {
         },
         async execute(input, ctx) {
             const locationId = locationOf(ctx);
-            const body = { ...input, locationId };
+            const body = {
+                ...input,
+                locationId,
+            };
             if (body.stageId) {
                 body.pipelineStageId = body.stageId;
                 delete body.stageId;