source-package.json — Approval-Gated Calendar

{
  "schema_version": 1,
  "runtimes": [
    {
      "name": "python",
      "versions": [
        "3.10"
      ]
    }
  ],
  "dependencies": [],
  "operations": [
    {
      "kind": "list",
      "description": "List calendar events in a time window.",
      "target_restrictions": [
        "Only the selected mailbox and time window"
      ]
    },
    {
      "kind": "search",
      "description": "Fetch every calendarView page for the selected mailbox and interval, then filter subjects locally.",
      "target_restrictions": [
        "Only the selected mailbox and time window"
      ]
    },
    {
      "kind": "read",
      "description": "Show one event or read attendee availability.",
      "target_restrictions": [
        "Only caller-selected mailbox, event or attendees"
      ]
    },
    {
      "kind": "create",
      "description": "Create an event and send invitations after digest approval.",
      "target_restrictions": [
        "Only the exact mailbox and event fields in the approved dry run"
      ]
    },
    {
      "kind": "modify",
      "description": "Cancel one event and send a cancellation after digest approval.",
      "target_restrictions": [
        "Only the approved mailbox, event ID, changeKey and comment"
      ]
    }
  ],
  "authorization": {
    "mode": "oauth_application",
    "scopes": [
      "Calendars.Read",
      "Calendars.ReadWrite"
    ],
    "credential_requirements": [
      "M365_TENANT_ID",
      "M365_CLIENT_ID",
      "M365_CLIENT_SECRET",
      "Optional M365_DEFAULT_USER"
    ]
  },
  "network": {
    "domains": [
      "graph.microsoft.com",
      "login.microsoftonline.com"
    ],
    "destinations": [
      "Microsoft Graph calendar and Microsoft Entra ID token endpoint",
      "urllib honors HTTPS_PROXY, https_proxy, NO_PROXY, no_proxy and macOS or Windows system proxy; TLS still terminates at the declared hosts",
      "Entra receives tenant path, client ID, secret and OAuth scope at login.microsoftonline.com.",
      "Graph receives bearer token, mailbox/event IDs, interval, attendee addresses, event fields and cancellation comment at graph.microsoft.com.",
      "Fetched pagination links and redirects stay on the original host and selected endpoint; calendar links preserve the start/end interval.",
      "System DNS resolves the declared hostnames, or a configured proxy hostname; no attendee-domain lookup occurs."
    ]
  },
  "safety": {
    "read_only_by_default": true,
    "dry_run_supported": true,
    "consequential_writes_require_authorization": true,
    "validation_controls": [
      "Create and cancel require a SHA-256 digest of the complete dry-run plan",
      "Cancel binds event changeKey and checks it again before the write",
      "HTTPS host guard checks each redirect; writes are never retried blindly",
      "Fake transport needs M365_CALENDAR_FAKE_TRANSPORT and M365_CALENDAR_ALLOW_FAKE=zero-width-lab-test-suite-only",
      "Fake fixture is checked before every network request",
      "Partial lists are marked incomplete and exit 2 unless --allow-partial",
      "Fixture and each HTTP response bounded to 1048576 bytes; malformed fixture/success JSON and required response shapes rejected; malformed HTTP error bodies retain status",
      "Traversal and encoded separators rejected before requests; pagination stays at selected endpoint",
      "Cancellation check is not atomic: an event can change between GET and POST; no provider conditional-cancel guarantee is claimed",
      "JSON depth capped at 64; non-finite constants rejected; calendar pagination and redirects preserve start/end interval"
    ],
    "target_restrictions": [
      "Only the mailbox selected by --user or M365_DEFAULT_USER",
      "Only exact approved event and cancellation targets"
    ]
  },
  "tests": {
    "files": [
      "tests/test_approval_gated_calendar.py",
      "tests/test_hygiene.py"
    ],
    "fixtures": "synthetic_only",
    "provenance": "creator",
    "evidence": [
      "CLI subprocess tests use sys.executable and synthetic fake Graph responses",
      "Hygiene test checks shipped text",
      "Tests cover reads, digest binding, conflicts, partial results and escaping"
    ]
  }
}

License: MIT (read it).

Back to the listing