@struktoai/mirage-core/dist/core/google/config.js

A Unified Virtual Filesystem For AI Agents

// ========= Copyright 2026 @ Strukto.AI All Rights Reserved. =========
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
// ========= Copyright 2026 @ Strukto.AI All Rights Reserved. =========
import { z } from 'zod';
import { secretSchema, secretStr } from "../../vfs/secrets.js";
import { timeoutShape } from "../api/config.js";
export const GOOGLE_CREDENTIAL_ERROR = 'GoogleConfig needs either accessToken (a token or a provider callable) or both clientId and refreshToken';
// Both grants stand alone, so this is what keeps a mount from being built
// with no credential at all and failing on the first read instead. Mirrors
// python's `_one_credential` model validator.
function hasGoogleCredential(config) {
    if (config.accessToken !== undefined)
        return true;
    return config.clientId !== undefined && config.refreshToken !== undefined;
}
export const GoogleConfig = z
    .object({
    ...timeoutShape,
    // Two ways to authenticate, the same two MsGraphConfig offers: a token
    // (or provider) supplied by the caller, or the refresh-token grant where
    // mirage mints and renews the access token itself through TokenManager.
    accessToken: secretSchema(z.union([
        z.string(),
        z.custom((value) => typeof value === 'function'),
    ]))
        .optional()
        .describe('OAuth access token, or a function (sync or async) that returns one. Takes precedence over `clientId` and `refreshToken`.'),
    clientId: z
        .string()
        .optional()
        .describe('Google OAuth client ID. Required with `refreshToken` when `accessToken` is unset; mirage then mints and renews access tokens itself.'),
    // The PKCE verifier authenticates the client at the token endpoint, so
    // no secret is sent.
    clientSecret: secretStr()
        .optional()
        .describe('Google OAuth client secret, sent with the refresh-token grant. Omit it for a PKCE client.'),
    refreshToken: secretStr()
        .optional()
        .describe("User's OAuth refresh token. Required with `clientId` when `accessToken` is unset."),
    // Declared here rather than on a CLI-only extension: parse strips what
    // the schema does not name, and marking it secret is what keeps a
    // callback out of snapshot state.
    // Caller-supplied refresh strategy. When provided, TokenManager delegates
    // token refresh to this callback instead of calling Google's token endpoint
    // directly. Useful when the client_secret must stay on a backend (e.g. a
    // Vercel function proxy).
    refreshFn: secretSchema(z.custom((value) => typeof value === 'function'))
        .optional()
        .describe("Function that exchanges the refresh token for `{ accessToken, expiresIn }` instead of Google's token endpoint, so the client secret can stay on a backend. Still needs `clientId` and `refreshToken`."),
    apiBase: z
        .string()
        .optional()
        .describe("One base URL that replaces every Google API host and the OAuth token endpoint, such as a test server. Unset uses Google's hosts."),
    folderId: z
        .string()
        .optional()
        .describe('Drive folder ID the `gdrive` mount uses as its root instead of My Drive; it may be a folder in a Shared Drive. Other Google mounts ignore it.'),
})
    .refine(hasGoogleCredential, { message: GOOGLE_CREDENTIAL_ERROR });
//# sourceMappingURL=config.js.map