${meta.join(\" · \")}

` : \"\"\n }`;\n}\n\n/** Calendar colour class plus, when the event is off, the muting class. */\nconst evClasses = (e: CalendarEvent, cls: Map) =>\n `ev ${cls.get(e.calendarId) ?? \"\"}${isOff(e) ? \" dec\" : \"\"}`;\n\nconst evCell = (e: CalendarEvent, cls: Map, max?: number, keepT = false) =>\n `

${titleHtml(e, max, keepT)}

`;\n\n/**\n * Timed events as table rows. A run of overlapping events renders side by side\n * so a double-booked slot looks crowded rather than reading as two unrelated\n * entries. Titles are clipped there — on a phone those columns are ~150px, and\n * a long title turns into a twenty-line tower.\n */\nfunction scheduledRows(events: CalendarEvent[], tz: string, cls: Map): string {\n return overlapClusters(events)\n .map((cluster) => {\n const first = cluster[0]!;\n const time = `${esc(formatTime(first.start, tz))}`;\n if (cluster.length === 1) return `${time}${evCell(first, cls)}`;\n\n const columns = cluster\n .map((e) =>\n `

${esc(formatTime(e.start, tz))}${\n titleHtml(e, OVERLAP_MAX)\n }

`\n )\n .join(\"\");\n\n // An event you declined, or one the organizer called off, is not a\n // double-booking, so it doesn't trigger the red banner — but it still\n // renders in its column, because seeing what fell away is the point of\n // keeping it.\n const clashing = cluster.filter((e) => !isOff(e)).length;\n const banner = clashing > 1 ? `

${clashing} overlapping

` : \"\";\n\n return `${time}${banner}` +\n `${columns}

`;\n })\n .join(\"\");\n}\n\n/** `T ` kept on today's-list items here too — same legibility reason as the\n * today block. Other all-day items still have their prefix stripped. */\nconst allDayRows = (bucket: DayBucket, cls: Map) =>\n [\n ...bucket.tItems.map((e) =>\n `•${evCell(e, cls, undefined, true)}`\n ),\n ...bucket.otherAllDay.map((e) => `•${evCell(e, cls)}`),\n ].join(\"\");\n\nconst label = (text: string, count: number) =>\n `

${esc(text)} ${count}

`;\n\nfunction taskRows(tasks: Task[]): string {\n return orderTasks(tasks)\n .map((t) => {\n const open = isOpen(t);\n // Icons are literal markup, not ::before — Gmail strips pseudo-elements —\n // and plain Unicode rather than images, so there's no asset to load.\n const body = open ? esc(t.title) : `${esc(t.title)}`;\n return `

${\n open ? \"○\" : \"✓\"\n }${link(t.webViewLink, body)}

`;\n })\n .join(\"\");\n}\n\nfunction todayHtml(bucket: DayBucket, tz: string, tasksToday: Task[], cls: Map) {\n const parts = [`

${esc(formatDayLong(bucket.day, tz))}

`];\n\n if (bucket.scheduled.length) {\n parts.push(label(\"scheduled\", bucket.scheduled.length));\n parts.push(`${scheduledRows(bucket.scheduled, tz, cls)}

`);\n } else {\n parts.push(`

nothing scheduled

`);\n }\n\n for (\n const [text, items, keepT] of [\n [\"today's list\", bucket.tItems, true],\n [\"other all-day\", bucket.otherAllDay, false],\n ] as const\n ) {\n if (!items.length) continue;\n parts.push(label(text, items.length));\n parts.push(\n `${\n items\n .map((e) => `${evCell(e, cls, undefined, keepT)}`)\n .join(\"\")\n }

•

`,\n );\n }\n\n if (tasksToday.length) {\n parts.push(label(\"tasks due today\", tasksToday.length));\n parts.push(taskRows(tasksToday));\n }\n return `

${parts.join(\"\")}

`;\n}\n\nfunction nearHtml(bucket: DayBucket, tz: string, cls: Map) {\n const timed = scheduledRows(bucket.scheduled, tz, cls);\n const allDay = allDayRows(bucket, cls);\n // Separate tables rather than one: the untimed items are a different kind of\n // thing from the day's actual schedule, and want visual daylight between them.\n const body = [\n timed && `${timed}

`,\n allDay && `

${allDay}

`,\n ].filter(Boolean).join(\"\") || `

Clear.

`;\n\n return `

${\n esc(formatDayShort(bucket.day, tz))\n }

${body}

`;\n}\n\n/**\n * Compact tier. Timed events stay inline on the day's line — they're short and\n * read well as a run. All-day items get one indented line each, clipped to the\n * column width rather than wrapped, so the block stays scannable at this size.\n */\nfunction farHtml(bucket: DayBucket, tz: string) {\n // No room for the meta line at this size, so the state rides as a marker on\n // the title and items that aren't happening are struck through.\n const timed = bucket.scheduled\n .map((e) => {\n const s = stateOf(e);\n const mark = s ? `${s.mark} ` : \"\";\n const title = esc(shortTitle(e.title, 34));\n return `${esc(formatTimeTerse(e.start, tz))} ${mark}${\n isOff(e) ? `${title}` : title\n }`;\n })\n .join(` · `);\n\n const allDay = [...bucket.tItems, ...bucket.otherAllDay]\n .map((e) => {\n const { stamp } = splitTitle(e.title);\n const lead = stamp ? `${esc(stamp)} ` : \"\";\n return `

${lead}${esc(shortTitle(e.title, 64))}

`;\n })\n .join(\"\");\n\n const body = timed || allDay\n ? `${timed ? `

${timed}

` : \"\"}${allDay}`\n : `clear`;\n return `${\n esc(formatDayShort(bucket.day, tz))\n }${body}`;\n}\n\nconst taskGroup = (heading: string, tasks: Task[], over = false) =>\n tasks.length\n ? `

${\n esc(heading)\n } ${tasks.length}

${taskRows(tasks)}

`\n : \"\";\n\nfunction renderHtml(digest: Digest, buckets: DayBucket[], preheader: string): string {\n const tz = digest.timeZone;\n const [today, ...rest] = buckets;\n if (!today) return \"

Empty window.

\";\n\n const { css, cls } = calendarStyles(digest);\n\n const near = rest.slice(0, NEAR_DAYS);\n const far = rest.slice(NEAR_DAYS);\n const tasks = partitionTasks(digest);\n const hr = `

`;\n\n // Zero-width joiners stop the client pulling body text into the preview after\n // the preheader ends.\n const pre = `

${esc(preheader)}${\" ‌\".repeat(30)}

`;\n\n const sections = [\n todayHtml(today, tz, tasks.today, cls),\n near.length &&\n `${hr}

next ${near.length} days

${\n near.map((b) => nearHtml(b, tz, cls)).join(\"\")\n }`,\n far.length &&\n `${hr}

following ${far.length} days

${\n far.map((b) => farHtml(b, tz)).join(\"\")\n }

`,\n (tasks.overdue.length || tasks.ahead.length) &&\n `${hr}

tasks ${tasks.overdue.length + tasks.ahead.length}

` +\n taskGroup(\"overdue\", tasks.overdue, true) +\n groupTasksByDay(tasks.ahead)\n .map(([day, items]) => taskGroup(formatDayShort(day, tz), items))\n .join(\"\"),\n digest.warnings.length &&\n `${hr}

${digest.warnings.map(esc).join(\"
\")}

`,\n ].filter(Boolean).join(\"\");\n\n // A complete document, not a fragment: Gmail drops ` +\n `

${pre}${sections}

`;\n}\n\n// --------------------------------------------------------------------- entry\n\nexport function render(digest: Digest): Rendered {\n const buckets = bucketize(digest);\n const today = buckets[0];\n const tz = digest.timeZone;\n\n const preheader = today ? terseAgenda(today, tz) : \"nothing scheduled\";\n\n // A fixed label to make the digest recognizable at a glance, then MM-DD, then\n // the day's actual events cut short. The label costs notification width, so\n // what follows it stays terse. The date keeps Gmail from collapsing every send\n // into one thread, which it does to same-subject mail.\n const subject = `CAL DIGEST ${(today?.day ?? digest.window.startDay).slice(5)} · ` +\n (today ? terseAgenda(today, tz, 5, 12) : \"nothing scheduled\");\n\n return {\n subject,\n preheader,\n text: renderText(digest, buckets),\n html: renderHtml(digest, buckets, preheader),\n };\n}\n",[],[184,282],"21d185d2-defe-44f8-bc9e-5d99afd7fcdb","main.ts","115fed5e-8aa7-11f1-8c4e-1607ee4eb77e",62,["D",1785948827434],"import { buildDigest } from \"./digest.ts\";\nimport { render } from \"./render.ts\";\n\n/** Minimal --flag / --flag=value parser. Hand-rolled to keep the project free\n * of external dependencies, so files drop into Val Town unchanged. */\nfunction parseArgs(argv: string[]): Record {\n const out: Record = {};\n for (const arg of argv) {\n if (!arg.startsWith(\"--\")) continue;\n const [key, ...rest] = arg.slice(2).split(\"=\");\n out[key!] = rest.length > 0 ? rest.join(\"=\") : true;\n }\n return out;\n}\n\n/** CLI entrypoint. Defaults to the plain-text digest; other formats on request. */\nif (import.meta.main) {\n const args = parseArgs(Deno.args);\n\n if (args.help) {\n console.log(`Pull Google Calendar + Tasks and render a digest.\n\n --days=N window length in days, counting today (default 8)\n --start=YYYY-MM-DD first day (default today in --tz)\n --tz=ZONE IANA zone defining \"today\" (default DIGEST_TZ or America/Los_Angeles)\n --lookback=N days back to include completed tasks (default 7, 0 = none)\n --no-tasks skip the Tasks API\n --all-calendars include secondary calendars, not just the primary one\n\n --html emit the HTML email body (a complete document, as sent)\n --json emit the raw normalized digest\n --subject emit just the subject line and notification preheader\n --summary print counts to stderr\n`);\n Deno.exit(0);\n }\n\n const digest = await buildDigest({\n days: typeof args.days === \"string\" ? Number(args.days) : undefined,\n start: typeof args.start === \"string\" ? args.start : undefined,\n timeZone: typeof args.tz === \"string\" ? args.tz : undefined,\n includeTasks: !args[\"no-tasks\"],\n primaryOnly: args[\"all-calendars\"] ? false : undefined,\n completedLookbackDays: typeof args.lookback === \"string\" ? Number(args.lookback) : undefined,\n });\n\n // Warnings go to stderr so redirecting stdout keeps the payload clean.\n for (const warning of digest.warnings) console.error(`warning: ${warning}`);\n\n if (args.summary) {\n const pending = digest.tasks.filter((t) => t.status === \"needsAction\").length;\n console.error(\n `${digest.calendars.length} calendars, ${digest.events.length} events, ` +\n `${digest.tasks.length} tasks (${pending} pending) ` +\n `over ${digest.window.days}d from ${digest.window.startDay} [${digest.timeZone}]`,\n );\n } else if (args.json) {\n console.log(JSON.stringify(digest, null, 2));\n } else {\n const out = render(digest);\n if (args.subject) console.log(`${out.subject}\\n\\n${out.preheader}`);\n else if (args.html) console.log(out.html);\n else console.log(out.text);\n }\n}\n",[],[184,290],"5ffe7ca9-7ced-47ec-b6df-8063ebbc3c48","google.ts","1188f064-8aa7-11f1-a0ab-1607ee4eb77e",10,["D",1785258558316],"import { getAccessToken } from \"./auth.ts\";\n\n/** Retryable transient statuses. 403 is deliberately excluded — from Google it's\n * usually a permissions/quota-project problem that retrying won't fix. */\nconst RETRY_STATUSES = new Set([429, 500, 502, 503, 504]);\nconst MAX_ATTEMPTS = 4;\n\nconst sleep = (ms: number) => new Promise((r) => setTimeout(r, ms));\n\nexport class GoogleApiError extends Error {\n constructor(readonly status: number, readonly url: string, readonly body: string) {\n super(`Google API ${status} for ${url}: ${body}`);\n this.name = \"GoogleApiError\";\n }\n}\n\nasync function authedFetch(url: string, attempt = 1): Promise {\n const token = await getAccessToken();\n const res = await fetch(url, {\n headers: { authorization: `Bearer ${token}`, accept: \"application/json\" },\n });\n\n if (res.ok) return res;\n\n // A 401 mid-run means the cached access token went stale. Re-mint once and\n // retry; if it happens twice the credential itself is bad, so let it throw.\n if (res.status === 401 && attempt === 1) {\n await res.body?.cancel();\n await getAccessToken(true);\n return authedFetch(url, attempt + 1);\n }\n\n if (RETRY_STATUSES.has(res.status) && attempt < MAX_ATTEMPTS) {\n await res.body?.cancel();\n // Exponential backoff with jitter: ~500ms, 1s, 2s.\n await sleep(2 ** (attempt - 1) * 500 + Math.random() * 250);\n return authedFetch(url, attempt + 1);\n }\n\n throw new GoogleApiError(res.status, url, await res.text());\n}\n\n/**\n * Walk a paginated Google list endpoint to exhaustion.\n *\n * Both APIs silently truncate to a small default page size (Tasks defaults to\n * 20), so callers must always paginate rather than trusting a single response.\n */\nexport async function paginate(\n baseUrl: string,\n params: Record,\n itemsKey = \"items\",\n): Promise {\n const out: T[] = [];\n let pageToken: string | undefined;\n\n do {\n const url = new URL(baseUrl);\n for (const [k, v] of Object.entries(params)) url.searchParams.set(k, v);\n if (pageToken) url.searchParams.set(\"pageToken\", pageToken);\n\n const res = await authedFetch(url.toString());\n const json = await res.json() as Record;\n\n const items = json[itemsKey];\n if (Array.isArray(items)) out.push(...items as T[]);\n\n pageToken = typeof json.nextPageToken === \"string\" ? json.nextPageToken : undefined;\n } while (pageToken);\n\n return out;\n}\n\n/** Run tasks with bounded concurrency so fanning out over calendars doesn't\n * open dozens of sockets at once (and trip rate limits). */\nexport async function mapWithConcurrency(\n items: T[],\n limit: number,\n fn: (item: T) => Promise,\n): Promise {\n const results: R[] = new Array(items.length);\n let cursor = 0;\n\n const workers = Array.from({ length: Math.min(limit, items.length) }, async () => {\n while (cursor < items.length) {\n const index = cursor++;\n results[index] = await fn(items[index]!);\n }\n });\n\n await Promise.all(workers);\n return results;\n}\n",[],[184,298],"fe8d830a-b1d7-4b0d-ada1-39c1547a9153","env.ts","11442c4a-8aa7-11f1-a4e4-1607ee4eb77e",["D",1785258557895],"/**\n * Env access that works identically under local Deno (via --env-file=.env)\n * and on Val Town (via its env var UI). No dotenv dependency either way.\n */\n\nexport function required(name: string): string {\n const value = Deno.env.get(name);\n if (!value) {\n throw new Error(\n `Missing required env var ${name}. ` +\n `Locally: add it to .env (see .env.example). On Val Town: set it in the val's env vars.`,\n );\n }\n return value;\n}\n\nexport function optional(name: string, fallback: string): string {\n return Deno.env.get(name) ?? fallback;\n}\n",[],[184,306],"836ad998-23be-442d-882e-55a4879cd323","digest.ts","11922fbc-8aa7-11f1-8c0e-1607ee4eb77e",59,["D",1785948827595],"import { listAllEvents, listCalendars } from \"./calendar.ts\";\nimport { optional } from \"./env.ts\";\nimport { listAllTasks, listTaskLists } from \"./tasks.ts\";\nimport { addDays, startOfDay, todayIn } from \"./tz.ts\";\nimport type { Digest } from \"./types.ts\";\n\n/** Fallback when DIGEST_TZ isn't set. Never the host's zone — see src/tz.ts. */\nconst DEFAULT_TZ = \"America/Los_Angeles\";\n\nexport interface DigestOptions {\n /**\n * Days in the window, counting today. Defaults to 8: today, the next 2 days,\n * and the 5 after that — the three tiers the digest renders.\n */\n days?: number;\n /** Calendar date (YYYY-MM-DD) to start from. Defaults to today in `timeZone`. */\n start?: string;\n /** IANA zone that defines \"today\" and day boundaries. Defaults to DIGEST_TZ. */\n timeZone?: string;\n /** Skip the Tasks API entirely. */\n includeTasks?: boolean;\n /**\n * Restrict to the calendar Google flags as `primary` — the user's own.\n * That flag is authoritative and survives renaming, so no calendar name or\n * ID ever needs to appear in the source. Secondary calendars carry no\n * equivalent marker, so including a subset of *those* would need explicit\n * configuration. Defaults to DIGEST_PRIMARY_ONLY, itself defaulting to true.\n */\n primaryOnly?: boolean;\n /**\n * How far back to fetch *completed* tasks. They're displayed under their due\n * date, not their completion date, so this needs slack for work finished\n * early. Set to 0 to fetch only open tasks.\n */\n completedLookbackDays?: number;\n}\n\n/**\n * Pull the full window of calendar events and tasks and return it normalized.\n *\n * Deliberately free of formatting and delivery concerns so it can be dropped\n * into a Val Town cron val unchanged.\n */\nexport async function buildDigest(options: DigestOptions = {}): Promise {\n const {\n days = 8,\n start,\n timeZone = optional(\"DIGEST_TZ\", DEFAULT_TZ),\n includeTasks = true,\n completedLookbackDays = 14,\n primaryOnly = optional(\"DIGEST_PRIMARY_ONLY\", \"1\") !== \"0\",\n } = options;\n\n if (!Number.isInteger(days) || days < 1) {\n throw new Error(`days must be a positive integer, got ${days}`);\n }\n if (!Number.isInteger(completedLookbackDays) || completedLookbackDays < 0) {\n throw new Error(\n `completedLookbackDays must be a non-negative integer, got ${completedLookbackDays}`,\n );\n }\n if (start && !/^\\d{4}-\\d{2}-\\d{2}$/.test(start)) {\n throw new Error(`Invalid start date \"${start}\" — expected YYYY-MM-DD`);\n }\n\n const startDay = start ?? todayIn(timeZone);\n const endDay = addDays(startDay, days);\n\n // RFC3339 with an offset; a bare YYYY-MM-DD is rejected by the API.\n const timeMin = startOfDay(startDay, timeZone).toISOString();\n const timeMax = startOfDay(endDay, timeZone).toISOString();\n\n const completedSince = completedLookbackDays > 0\n ? startOfDay(addDays(startDay, -completedLookbackDays), timeZone).toISOString()\n : undefined;\n\n const warnings: string[] = [];\n\n const [allCalendars, taskLists] = await Promise.all([\n listCalendars(),\n includeTasks ? listTaskLists() : Promise.resolve([]),\n ]);\n\n const calendars = primaryOnly ? allCalendars.filter((c) => c.primary) : allCalendars;\n if (primaryOnly && calendars.length === 0) {\n warnings.push(\"No calendar is flagged primary; falling back to all readable calendars.\");\n calendars.push(...allCalendars);\n }\n\n const [events, tasks] = await Promise.all([\n listAllEvents(calendars, timeMin, timeMax, warnings),\n includeTasks ? listAllTasks(taskLists, warnings, completedSince) : Promise.resolve([]),\n ]);\n\n return {\n generatedAt: new Date().toISOString(),\n timeZone,\n window: { start: timeMin, end: timeMax, days, startDay, endDay, completedSince },\n calendars,\n events,\n tasks,\n warnings,\n };\n}\n",[],[184,313],"e6a93906-6a80-42af-a7f8-de37946908e8","calendar.ts","11b2b070-8aa7-11f1-b718-1607ee4eb77e",43,["D",1785514584596],"import { mapWithConcurrency, paginate } from \"./google.ts\";\nimport type { Calendar, CalendarEvent, Rsvp } from \"./types.ts\";\n\nconst BASE = \"https://www.googleapis.com/calendar/v3\";\n\ninterface RawCalendarListEntry {\n id: string;\n summary?: string;\n summaryOverride?: string;\n description?: string;\n timeZone?: string;\n primary?: boolean;\n accessRole: string;\n backgroundColor?: string;\n deleted?: boolean;\n selected?: boolean;\n}\n\ninterface RawEventDate {\n date?: string;\n dateTime?: string;\n timeZone?: string;\n}\n\ninterface RawAttendee {\n email?: string;\n self?: boolean;\n organizer?: boolean;\n responseStatus?: string;\n resource?: boolean;\n}\n\ninterface RawEvent {\n id: string;\n summary?: string;\n description?: string;\n location?: string;\n start?: RawEventDate;\n end?: RawEventDate;\n status?: string;\n htmlLink?: string;\n hangoutLink?: string;\n organizer?: { email?: string; displayName?: string; self?: boolean };\n attendees?: RawAttendee[];\n recurringEventId?: string;\n transparency?: string;\n eventType?: string;\n}\n\nexport async function listCalendars(): Promise {\n const raw = await paginate(`${BASE}/users/me/calendarList`, {\n maxResults: \"250\",\n minAccessRole: \"reader\",\n showDeleted: \"false\",\n });\n\n return raw\n .filter((c) => !c.deleted)\n .map((c) => ({\n id: c.id,\n // summaryOverride is the name *you* gave a calendar someone shared with\n // you, and should win over the owner's own title.\n name: c.summaryOverride ?? c.summary ?? c.id,\n description: c.description,\n timeZone: c.timeZone,\n primary: c.primary === true,\n accessRole: c.accessRole,\n backgroundColor: c.backgroundColor,\n }));\n}\n\nfunction normalizeEvent(raw: RawEvent, calendar: Calendar): CalendarEvent {\n // All-day events carry `date`; timed events carry `dateTime`.\n const allDay = Boolean(raw.start?.date);\n const start = raw.start?.dateTime ?? raw.start?.date ?? \"\";\n const end = raw.end?.dateTime ?? raw.end?.date ?? \"\";\n\n const self = raw.attendees?.find((a) => a.self);\n const selfResponse = (self?.responseStatus ?? \"unknown\") as Rsvp;\n\n // A meeting called off by the person who called it stays `confirmed` — the\n // only trace is their own attendee entry flipping to declined. Google Calendar\n // strikes those through in the grid, so the digest has to look here too. Your\n // own entry is excluded: declining your own event is just an RSVP, and\n // `selfResponse` already carries it.\n const organizerDeclined = raw.attendees?.some((a) =>\n !a.self && a.responseStatus === \"declined\" &&\n (a.organizer === true || (!!raw.organizer?.email && a.email === raw.organizer.email))\n ) ?? false;\n\n return {\n id: raw.id,\n calendarId: calendar.id,\n calendarName: calendar.name,\n title: raw.summary ?? \"(no title)\",\n description: raw.description,\n location: raw.location,\n start,\n end,\n allDay,\n // The field is omitted entirely for busy events, so absence means busy.\n busy: raw.transparency !== \"transparent\",\n eventType: raw.eventType,\n status: raw.status,\n htmlLink: raw.htmlLink,\n hangoutLink: raw.hangoutLink,\n organizer: raw.organizer?.email,\n selfResponse,\n organizerDeclined,\n // Rooms and equipment are attendees too; they shouldn't inflate the count.\n attendeeCount: raw.attendees?.filter((a) => !a.resource).length ?? 0,\n recurringEventId: raw.recurringEventId,\n };\n}\n\nasync function listEventsForCalendar(\n calendar: Calendar,\n timeMin: string,\n timeMax: string,\n): Promise {\n const raw = await paginate(\n `${BASE}/calendars/${encodeURIComponent(calendar.id)}/events`,\n {\n timeMin,\n timeMax,\n // Expands recurring series into concrete instances. Without this you get\n // RRULEs back and have to interpret them yourself.\n singleEvents: \"true\",\n orderBy: \"startTime\",\n maxResults: \"2500\",\n },\n );\n\n return raw\n .filter((e) => e.status !== \"cancelled\")\n .map((e) => normalizeEvent(e, calendar));\n}\n\n/**\n * Fetch events across every readable calendar and merge into one time-ordered\n * list. A single calendar failing (deleted, permissions changed) degrades to a\n * warning rather than sinking the whole run.\n */\nexport async function listAllEvents(\n calendars: Calendar[],\n timeMin: string,\n timeMax: string,\n warnings: string[],\n): Promise {\n const perCalendar = await mapWithConcurrency(calendars, 5, async (calendar) => {\n try {\n return await listEventsForCalendar(calendar, timeMin, timeMax);\n } catch (err) {\n warnings.push(\n `Calendar \"${calendar.name}\" (${calendar.id}) failed: ${\n err instanceof Error ? err.message : String(err)\n }`,\n );\n return [] as CalendarEvent[];\n }\n });\n\n return perCalendar.flat().sort((a, b) =>\n sortKey(a) - sortKey(b) || a.title.localeCompare(b.title)\n );\n}\n\n/** Comparable instant for merge-sorting across calendars. Timed events from\n * different calendars can carry different UTC offsets, so string comparison\n * isn't reliably chronological. All-day events anchor to local midnight, which\n * lands them ahead of that day's timed events. */\nfunction sortKey(event: CalendarEvent): number {\n const parsed = Date.parse(event.allDay ? `${event.start}T00:00:00` : event.start);\n return Number.isNaN(parsed) ? Infinity : parsed;\n}\n",[],[184,321],"128b4b7b-59ad-423a-87ab-4f2c0f79d3c2","auth.ts","120122f0-8aa7-11f1-98ee-1607ee4eb77e",20,["D",1785258557793],"import { required } from \"./env.ts\";\n\nconst TOKEN_ENDPOINT = \"https://oauth2.googleapis.com/token\";\n\n/**\n * Scopes requested at consent time. Read-only on both APIs: a leaked token\n * can't mutate anything. Adding a scope later means redoing the consent flow,\n * so both are requested up front.\n */\nexport const SCOPES = [\n \"https://www.googleapis.com/auth/calendar.readonly\",\n \"https://www.googleapis.com/auth/tasks.readonly\",\n];\n\ninterface TokenResponse {\n access_token: string;\n expires_in: number;\n refresh_token?: string;\n scope?: string;\n token_type: string;\n}\n\nlet cached: { token: string; expiresAt: number } | null = null;\n\n/**\n * Exchange the long-lived refresh token for a short-lived access token.\n *\n * The refresh token is a static credential — it does not rotate on use, so it\n * lives in env vars and never needs to be written back anywhere. The access\n * token it mints lasts ~1h; we memoize it per-process purely so that a single\n * run fanning out across many calendars doesn't re-mint on every request.\n */\nexport async function getAccessToken(forceRefresh = false): Promise {\n // 60s of slack so we never hand out a token that expires mid-flight.\n if (!forceRefresh && cached && Date.now() < cached.expiresAt - 60_000) {\n return cached.token;\n }\n\n const body = new URLSearchParams({\n client_id: required(\"GOOGLE_CLIENT_ID\"),\n client_secret: required(\"GOOGLE_CLIENT_SECRET\"),\n refresh_token: required(\"GOOGLE_REFRESH_TOKEN\"),\n grant_type: \"refresh_token\",\n });\n\n const res = await fetch(TOKEN_ENDPOINT, {\n method: \"POST\",\n headers: { \"content-type\": \"application/x-www-form-urlencoded\" },\n body,\n });\n\n if (!res.ok) {\n const detail = await res.text();\n throw new Error(\n `Token refresh failed (${res.status}): ${detail}\\n\\n` +\n `If this says \"invalid_grant\", the refresh token was revoked or expired. ` +\n `Most common cause: the Google Cloud app is still in \"Testing\" publishing status, ` +\n `which expires refresh tokens after 7 days. Set it to \"In production\", ` +\n `then re-run \\`deno task auth\\`.`,\n );\n }\n\n const json: TokenResponse = await res.json();\n cached = {\n token: json.access_token,\n expiresAt: Date.now() + json.expires_in * 1000,\n };\n return cached.token;\n}\n",[],[184,329],["D",1785258557589],[207,208,209,210,211,212,213,214,215,216,217],[184],"d5677b89-74f4-4dfe-89f1-9a1296fb66e9","authorize.ts","1139a090-8aa7-11f1-b668-1607ee4eb77e",["D",1785258557792],"/**\n * One-time OAuth consent, run locally, to mint a refresh token.\n *\n * This is setup tooling — it is NOT part of the runtime. The digest itself\n * never performs a browser redirect; it only ever exchanges the refresh token\n * this script produces for a short-lived access token.\n *\n * Uses the loopback flow, which Google permits for \"Desktop app\" OAuth clients:\n * we listen on localhost, Google redirects the browser back to us with a code,\n * and we trade that code for tokens. No public URL or tunnel required.\n *\n * deno task auth\n */\nimport { SCOPES } from \"../src/auth.ts\";\nimport { required } from \"../src/env.ts\";\n\nconst PORT = 8976;\n// 127.0.0.1 rather than localhost: on dual-stack machines `localhost` can\n// resolve to ::1, which would miss a server bound to the v4 loopback. Google\n// accepts either form for Desktop app clients, and the redirect URI has to\n// match what we actually listen on exactly.\nconst HOST = \"127.0.0.1\";\nconst REDIRECT_URI = `http://${HOST}:${PORT}`;\n\nfunction base64url(bytes: ArrayBuffer): string {\n return btoa(String.fromCharCode(...new Uint8Array(bytes)))\n .replace(/\\+/g, \"-\")\n .replace(/\\//g, \"_\")\n .replace(/=+$/, \"\");\n}\n\nfunction randomToken(): string {\n return base64url(crypto.getRandomValues(new Uint8Array(32)).buffer);\n}\n\nfunction page(title: string, detail: string): Response {\n return new Response(\n `${title}\n \n

${title}

${detail}

`,\n { status: 200, headers: { \"content-type\": \"text/html; charset=utf-8\" } },\n );\n}\n\nconst clientId = required(\"GOOGLE_CLIENT_ID\");\nconst clientSecret = required(\"GOOGLE_CLIENT_SECRET\");\n\n// PKCE: proves the code is being redeemed by whoever requested it.\nconst verifier = randomToken();\nconst challenge = base64url(\n await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(verifier)),\n);\nconst state = randomToken();\n\nconst authUrl = new URL(\"https://accounts.google.com/o/oauth2/v2/auth\");\nauthUrl.search = new URLSearchParams({\n client_id: clientId,\n redirect_uri: REDIRECT_URI,\n response_type: \"code\",\n scope: SCOPES.join(\" \"),\n // offline is what makes Google issue a refresh token at all...\n access_type: \"offline\",\n // ...and consent forces a fresh one even if you've approved this app before.\n // Without it, a repeat authorization returns only an access token.\n prompt: \"consent\",\n code_challenge: challenge,\n code_challenge_method: \"S256\",\n state,\n}).toString();\n\nconsole.error(\"\\nOpen this URL in your browser to authorize:\\n\");\nconsole.error(authUrl.toString());\nconsole.error(`\\nWaiting for the redirect back to ${REDIRECT_URI} ...\\n`);\n\nconst code = await new Promise((resolve, reject) => {\n const server = Deno.serve({ port: PORT, hostname: HOST, onListen: () => {} }, (req) => {\n const url = new URL(req.url);\n // Browsers also request /favicon.ico here; ignore anything without a result.\n // 204 must carry a null body.\n if (!url.searchParams.has(\"code\") && !url.searchParams.has(\"error\")) {\n return new Response(null, { status: 204 });\n }\n\n const error = url.searchParams.get(\"error\");\n if (error) {\n queueMicrotask(() => server.shutdown().then(() => reject(new Error(error))));\n return page(\"Authorization failed\", `Google returned: ${error}`);\n }\n\n if (url.searchParams.get(\"state\") !== state) {\n queueMicrotask(() => server.shutdown().then(() => reject(new Error(\"state mismatch\"))));\n return page(\"Authorization failed\", \"State parameter did not match.\");\n }\n\n const received = url.searchParams.get(\"code\")!;\n queueMicrotask(() => server.shutdown().then(() => resolve(received)));\n return page(\"Authorized\", \"You can close this tab and return to the terminal.\");\n });\n});\n\nconst res = await fetch(\"https://oauth2.googleapis.com/token\", {\n method: \"POST\",\n headers: { \"content-type\": \"application/x-www-form-urlencoded\" },\n body: new URLSearchParams({\n client_id: clientId,\n client_secret: clientSecret,\n code,\n code_verifier: verifier,\n grant_type: \"authorization_code\",\n redirect_uri: REDIRECT_URI,\n }),\n});\n\nif (!res.ok) {\n console.error(`\\nToken exchange failed (${res.status}):\\n${await res.text()}`);\n Deno.exit(1);\n}\n\nconst token = await res.json();\n\nif (!token.refresh_token) {\n console.error(\n \"\\nGoogle did not return a refresh_token. This usually means the app was \" +\n \"already authorized and `prompt=consent` was dropped. Revoke access at \" +\n \"https://myaccount.google.com/permissions and re-run.\",\n );\n Deno.exit(1);\n}\n\nconsole.error(\"\\nSuccess. Add this line to your .env:\\n\");\nconsole.log(`GOOGLE_REFRESH_TOKEN=${token.refresh_token}`);\nconsole.error(`\\nGranted scopes: ${token.scope ?? \"(none reported)\"}`);\nconsole.error(\n '\\nReminder: while the Google Cloud app is in \"Testing\" publishing status, ' +\n 'this token expires in 7 days. Set it to \"In production\" to keep it.\\n',\n);\n",[],[190,340],["D",1785258557429],[205],[190],["D",1785258556623],{"_11":12,"_86":82},{"_11":12,"_80":-5,"_81":82,"_45":46,"_83":84,"_85":38},{"_29":30,"_13":26,"_20":21,"_27":28,"_31":-5,"_32":-5,"_75":-5,"_76":-5,"_77":-5,"_78":14,"_79":12},"ctx",{"_68":-5,"_108":386,"_387":388,"_389":390,"_391":38,"_392":38,"_393":38,"_394":129,"_395":-5,"_396":-7,"_397":-7,"_398":52,"_399":38,"_400":38,"_401":-5,"_402":38,"_403":38,"_404":38,"_405":-5},"ENV",{"_357":358,"_359":360,"_361":26,"_362":363,"_364":365,"_366":367,"_368":369,"_370":371,"_372":373,"_374":375,"_376":377,"_378":379,"_380":381,"_382":383,"_384":385},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Branches1

Branches
1