const googleUserConsentBlockedScopes = new Set([  "https://www.googleapis.com/auth/chat.bot",  "https://www.googleapis.com/auth/chat.import",  // Gmail sharing-setting writes require a service account with domain-wide  // delegation, not the authorization-code flow used by user connections.  "https://www.googleapis.com/auth/gmail.settings.sharing",  "https://www.googleapis.com/auth/keep",  "https://www.googleapis.com/auth/keep.readonly",]); const googleUserConsentBlockedScopePrefixes = [  "https://www.googleapis.com/auth/chat.app.",  // Contextual Calendar add-on scopes are minted for add-on executions.  "https://www.googleapis.com/auth/calendar.addons.",  // Contextual Gmail add-on scopes are minted for add-on executions, not a  // standalone web OAuth connection.  "https://www.googleapis.com/auth/gmail.addons.",]; const googleMailScopesCoveredByFullAccess = new Set([  "https://www.googleapis.com/auth/gmail.compose",  "https://www.googleapis.com/auth/gmail.insert",  "https://www.googleapis.com/auth/gmail.labels",  "https://www.googleapis.com/auth/gmail.metadata",  "https://www.googleapis.com/auth/gmail.modify",  "https://www.googleapis.com/auth/gmail.readonly",  "https://www.googleapis.com/auth/gmail.send",]); const auth = (scope: string): string => `https://www.googleapis.com/auth/${scope}`; const googleDriveScopesCoveredByFullAccess = new Set([  auth("drive.appdata"),  auth("drive.file"),  auth("drive.meet.readonly"),  auth("drive.metadata"),  auth("drive.metadata.readonly"),  auth("drive.photos.readonly"),  auth("drive.readonly"),  auth("drive.scripts"),]); const exactBroadScopeGroups: Readonly<Record<string, ReadonlySet<string>>> = {  [auth("documents")]: new Set([auth("documents.readonly")]),  [auth("presentations")]: new Set([auth("presentations.readonly")]),  [auth("spreadsheets")]: new Set([auth("spreadsheets.readonly")]),  [auth("forms.body")]: new Set([auth("forms.body.readonly")]),  [auth("tasks")]: new Set([auth("tasks.readonly")]),  [auth("contacts")]: new Set([auth("contacts.readonly")]),  [auth("chat.spaces")]: new Set([auth("chat.spaces.readonly")]),  [auth("chat.memberships")]: new Set([auth("chat.memberships.readonly")]),  [auth("chat.messages")]: new Set([auth("chat.messages.readonly")]),  [auth("chat.customemojis")]: new Set([auth("chat.customemojis.readonly")]),  [auth("webmasters")]: new Set([auth("webmasters.readonly")]),  [auth("cloud-platform")]: new Set([auth("cloud-platform.read-only")]),  [auth("script.projects")]: new Set([auth("script.projects.readonly")]),  [auth("script.deployments")]: new Set([auth("script.deployments.readonly")]),  [auth("classroom.announcements")]: new Set([auth("classroom.announcements.readonly")]),  [auth("classroom.courses")]: new Set([auth("classroom.courses.readonly")]),  [auth("classroom.coursework.me")]: new Set([    auth("classroom.coursework.me.readonly"),    auth("classroom.student-submissions.me.readonly"),  ]),  [auth("classroom.coursework.students")]: new Set([    auth("classroom.coursework.students.readonly"),    auth("classroom.student-submissions.students.readonly"),  ]),  [auth("classroom.courseworkmaterials")]: new Set([    auth("classroom.courseworkmaterials.readonly"),  ]),  [auth("classroom.rosters")]: new Set([auth("classroom.rosters.readonly")]),  [auth("classroom.topics")]: new Set([auth("classroom.topics.readonly")]),  [auth("admin.chrome.printers")]: new Set([auth("admin.chrome.printers.readonly")]),  [auth("admin.directory.customer")]: new Set([auth("admin.directory.customer.readonly")]),  [auth("admin.directory.device.chromeos")]: new Set([    auth("admin.directory.device.chromeos.readonly"),  ]),  [auth("admin.directory.device.mobile")]: new Set([    auth("admin.directory.device.mobile.action"),    auth("admin.directory.device.mobile.readonly"),  ]),  [auth("admin.directory.domain")]: new Set([auth("admin.directory.domain.readonly")]),  [auth("admin.directory.group")]: new Set([    auth("admin.directory.group.readonly"),    auth("admin.directory.group.member"),    auth("admin.directory.group.member.readonly"),  ]),  [auth("admin.directory.orgunit")]: new Set([auth("admin.directory.orgunit.readonly")]),  [auth("admin.directory.resource.calendar")]: new Set([    auth("admin.directory.resource.calendar.readonly"),  ]),  [auth("admin.directory.rolemanagement")]: new Set([    auth("admin.directory.rolemanagement.readonly"),  ]),  [auth("admin.directory.user")]: new Set([    auth("admin.directory.user.alias"),    auth("admin.directory.user.alias.readonly"),    auth("admin.directory.user.readonly"),  ]),  [auth("admin.directory.userschema")]: new Set([auth("admin.directory.userschema.readonly")]),}; const googleBroadScopeGroups: readonly {  readonly broad: string;  readonly covers: (scope: string) => boolean;}[] = [  {    broad: "https://mail.google.com/",    // Full mailbox access covers message, draft, label, and send operations,    // but Google requires gmail.settings.basic separately for filter writes.    covers: (scope) => googleMailScopesCoveredByFullAccess.has(scope),  },  {    broad: "https://www.googleapis.com/auth/calendar",    covers: (scope) => scope.startsWith("https://www.googleapis.com/auth/calendar."),  },  {    broad: "https://www.googleapis.com/auth/drive",    // Do not swallow independent scopes such as drive.apps.readonly,    // drive.activity, drive.install, or future drive.* scopes.    covers: (scope) => googleDriveScopesCoveredByFullAccess.has(scope),  },  ...Object.entries(exactBroadScopeGroups).map(([broad, covered]) => ({    broad,    covers: (scope: string) => covered.has(scope),  })),]; const normalizeGoogleIdentityScope = (scope: string): string =>  scope === "https://www.googleapis.com/auth/userinfo.email"    ? "email"    : scope === "https://www.googleapis.com/auth/userinfo.profile"      ? "profile"      : scope; const orderedUniqueScopes = (scopes: Iterable<string>): string[] => {  const ordered: string[] = [];  const seen = new Set<string>();  for (const scope of scopes) {    const trimmed = scope.trim();    if (!trimmed || seen.has(trimmed)) continue;    seen.add(trimmed);    ordered.push(trimmed);  }  return ordered;}; export const isGoogleUserConsentOAuthScope = (scope: string): boolean =>  !googleUserConsentBlockedScopes.has(scope) &&  !googleUserConsentBlockedScopePrefixes.some((prefix) => scope.startsWith(prefix)); export const filterGoogleUserConsentOAuthScopes = (scopes: Iterable<string>): string[] =>  orderedUniqueScopes(scopes).filter(isGoogleUserConsentOAuthScope); export const compactGoogleOAuthScopes = (scopes: Iterable<string>): string[] => {  const ordered = filterGoogleUserConsentOAuthScopes([...scopes].map(normalizeGoogleIdentityScope));  const present = new Set(ordered);  return ordered.filter(    (scope) =>      !googleBroadScopeGroups.some(        (group) => scope !== group.broad && present.has(group.broad) && group.covers(scope),      ),  );};