@aitne/daemon 0.1.0

package/dist/services/mail/outlook/auth-failure-classifier.js

@@ -0,0 +1,91 @@
+/**
+ * AADSTS error codes that mean "the refresh token will not work without
+ * re-consent" — password change, MFA re-prompt, conditional access, etc.
+ * Reference: https://learn.microsoft.com/en-us/entra/identity-platform/reference-error-codes
+ */
+const RECONSENT_AADSTS_CODES = new Set([
+    "AADSTS50173", // FreshTokenNeeded — re-authentication required
+    "AADSTS700082", // ExpiredOrRevokedRefreshTokenLifetime
+    "AADSTS700084", // RefreshTokenExpiredDueToInactivity
+    "AADSTS50076", // MFA required — InteractionRequired
+    "AADSTS50079", // MFA strong-auth registration required
+    "AADSTS50078", // MFA strong-auth required by policy
+    "AADSTS65001", // ConsentRequired — admin or user consent needed
+    "AADSTS50105", // EntitlementGrantsNotFound — user no longer assigned
+    "AADSTS50056", // InvalidPasswordExpiresOnDate — password reset
+    "AADSTS530003", // DevicePolicyError — conditional access
+    "AADSTS530004", // DeviceCompliancePolicy — conditional access
+]);
+/**
+ * MSAL error names indicating interactive re-auth is required. Note: `error`
+ * objects from MSAL include `errorCode` ("invalid_grant") and an `errorMessage`
+ * containing the raw AADSTS string ("AADSTS50173: ...") — both are inspected.
+ */
+const RECONSENT_MSAL_ERROR_NAMES = new Set([
+    "InteractionRequiredAuthError",
+    "BrowserAuthError", // covers user_cancelled, etc.
+]);
+const RECONSENT_OAUTH_ERROR_CODES = new Set([
+    "invalid_grant", // refresh token rejected
+    "interaction_required",
+    "consent_required",
+    "login_required",
+    "mfa_required",
+    "invalid_client", // client deleted or disabled
+    "unauthorized_client",
+]);
+/**
+ * Map a captured failure to an AuthStatus update. The `transient` outcome
+ * means "do not change auth_status; bump consecutive_error_count and let the
+ * caller decide whether to flip to degraded."
+ */
+export function classifyAuthFailure(input) {
+    const message = input.message ?? "";
+    const aadstsMatch = message.match(/AADSTS\d+/);
+    const aadstsCode = aadstsMatch ? aadstsMatch[0] : null;
+    if (aadstsCode && RECONSENT_AADSTS_CODES.has(aadstsCode)) {
+        return { status: "requires_consent", reason: aadstsCode };
+    }
+    if (input.errorCode && RECONSENT_OAUTH_ERROR_CODES.has(input.errorCode)) {
+        return { status: "requires_consent", reason: input.errorCode };
+    }
+    if (input.errorName && RECONSENT_MSAL_ERROR_NAMES.has(input.errorName)) {
+        return { status: "requires_consent", reason: input.errorName };
+    }
+    if (input.httpStatus === 401 || input.httpStatus === 403) {
+        // Graph returned 401/403 but token-refresh layer didn't classify it as
+        // re-consent. Could be a permission gap or transient — surface as degraded
+        // so the dashboard shows it; bumping consecutive_error_count is the
+        // caller's job.
+        return { status: "degraded", reason: `http_${input.httpStatus}` };
+    }
+    if (input.httpStatus && input.httpStatus >= 500) {
+        return { status: "transient", reason: `http_${input.httpStatus}` };
+    }
+    if (input.httpStatus === 429) {
+        return { status: "transient", reason: "rate_limited" };
+    }
+    return { status: "transient", reason: input.errorCode ?? input.errorName ?? "unknown" };
+}
+export const TRANSIENT_BACKOFF_THRESHOLD = 10;
+/**
+ * Whether {@link consecutiveErrorCount} has crossed the threshold to flip a
+ * `transient` failure into a persistent `degraded` AuthStatus. Mirrors §3.7
+ * "5xx > 10 consecutive attempts → degraded".
+ */
+export function shouldEscalateToDegraded(consecutiveErrorCount, threshold = TRANSIENT_BACKOFF_THRESHOLD) {
+    return consecutiveErrorCount > threshold;
+}
+export function effectiveAuthStatus(classified, consecutiveErrorCount) {
+    if (classified.status === "healthy")
+        return "healthy";
+    if (classified.status === "requires_consent")
+        return "requires_consent";
+    if (classified.status === "degraded")
+        return "degraded";
+    // transient
+    if (shouldEscalateToDegraded(consecutiveErrorCount))
+        return "degraded";
+    return null;
+}
+//# sourceMappingURL=auth-failure-classifier.js.map

package/dist/services/mail/outlook/auth-failure-classifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-failure-classifier.js","sourceRoot":"","sources":["../../../../src/services/mail/outlook/auth-failure-classifier.ts"],"names":[],"mappings":"AAQA;;;;GAIG;AACH,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAS;IAC7C,aAAa,EAAE,gDAAgD;IAC/D,cAAc,EAAE,uCAAuC;IACvD,cAAc,EAAE,qCAAqC;IACrD,aAAa,EAAE,qCAAqC;IACpD,aAAa,EAAE,wCAAwC;IACvD,aAAa,EAAE,qCAAqC;IACpD,aAAa,EAAE,iDAAiD;IAChE,aAAa,EAAE,sDAAsD;IACrE,aAAa,EAAE,gDAAgD;IAC/D,cAAc,EAAE,yCAAyC;IACzD,cAAc,EAAE,8CAA8C;CAC/D,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,0BAA0B,GAAG,IAAI,GAAG,CAAS;IACjD,8BAA8B;IAC9B,kBAAkB,EAAE,8BAA8B;CACnD,CAAC,CAAC;AAEH,MAAM,2BAA2B,GAAG,IAAI,GAAG,CAAS;IAClD,eAAe,EAAE,yBAAyB;IAC1C,sBAAsB;IACtB,kBAAkB;IAClB,gBAAgB;IAChB,cAAc;IACd,gBAAgB,EAAE,6BAA6B;IAC/C,qBAAqB;CACtB,CAAC,CAAC;AAaH;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAoB;IACtD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC;IACpC,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAG,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAEvD,IAAI,UAAU,IAAI,sBAAsB,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;QACzD,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAC5D,CAAC;IAED,IAAI,KAAK,CAAC,SAAS,IAAI,2BAA2B,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QACxE,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;IACjE,CAAC;IAED,IAAI,KAAK,CAAC,SAAS,IAAI,0BAA0B,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QACvE,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;IACjE,CAAC;IAED,IAAI,KAAK,CAAC,UAAU,KAAK,GAAG,IAAI,KAAK,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;QACzD,uEAAuE;QACvE,2EAA2E;QAC3E,oEAAoE;QACpE,gBAAgB;QAChB,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,KAAK,CAAC,UAAU,EAAE,EAAE,CAAC;IACpE,CAAC;IAED,IAAI,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,UAAU,IAAI,GAAG,EAAE,CAAC;QAChD,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,KAAK,CAAC,UAAU,EAAE,EAAE,CAAC;IACrE,CAAC;IAED,IAAI,KAAK,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;QAC7B,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IACzD,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,SAAS,IAAI,SAAS,EAAE,CAAC;AAC1F,CAAC;AAED,MAAM,CAAC,MAAM,2BAA2B,GAAG,EAAE,CAAC;AAE9C;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CACtC,qBAA6B,EAC7B,SAAS,GAAG,2BAA2B;IAEvC,OAAO,qBAAqB,GAAG,SAAS,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,UAA6B,EAC7B,qBAA6B;IAE7B,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACtD,IAAI,UAAU,CAAC,MAAM,KAAK,kBAAkB;QAAE,OAAO,kBAAkB,CAAC;IACxE,IAAI,UAAU,CAAC,MAAM,KAAK,UAAU;QAAE,OAAO,UAAU,CAAC;IACxD,YAAY;IACZ,IAAI,wBAAwB,CAAC,qBAAqB,CAAC;QAAE,OAAO,UAAU,CAAC;IACvE,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/services/mail/outlook/client-config.d.ts

@@ -0,0 +1,34 @@
+import type { EncryptedBlobStore } from "../../../secrets/encrypted-blob-store.js";
+export declare const OUTLOOK_CLIENT_CONFIG_BLOB = "mail:outlook:client-config";
+/** Per §6.1: BYOA registration. One client config covers all Outlook accounts. */
+export interface OutlookClientConfig {
+    clientId: string;
+    /** Tenant `"common"` works for any org + personal MSA accounts. */
+    tenant: string;
+}
+export declare class OutlookClientConfigMissingError extends Error {
+    readonly code = "outlook_client_config_missing";
+    constructor();
+}
+export declare function parseOutlookClientConfig(raw: string): OutlookClientConfig;
+export declare function serializeOutlookClientConfig(config: OutlookClientConfig): string;
+export declare function loadOutlookClientConfig(blobStore: EncryptedBlobStore): Promise<OutlookClientConfig | null>;
+export declare function saveOutlookClientConfig(blobStore: EncryptedBlobStore, config: OutlookClientConfig): Promise<void>;
+export declare const OUTLOOK_AUTHORITY_BASE = "https://login.microsoftonline.com";
+export declare function authorityForTenant(tenant: string): string;
+/**
+ * Scopes per §6.1 — Mail.ReadWrite subsumes Mail.Read. `offline_access`
+ * is required for refresh-token issuance. SETUP-FLOW-REDESIGN-PLAN §6.1
+ * adds `Calendars.ReadWrite` so the same OAuth consent serves both Mail
+ * and Calendar; the Calendar wizard step does not trigger a second
+ * consent screen when Mail is already authenticated. Pre-release
+ * caveat: any cache row written before this change holds a token whose
+ * scope set excludes `Calendars.ReadWrite`; first Calendar use will
+ * 401 once and the loopback flow re-prompts the user.
+ */
+export declare const OUTLOOK_SCOPES: readonly string[];
+/** Per §4: Azure since 2020 special-cases loopback regardless of port. Use 127.0.0.1, not localhost. */
+export declare const OUTLOOK_LOOPBACK_REDIRECT_HOST = "127.0.0.1";
+export declare const OUTLOOK_LOOPBACK_REDIRECT_PATH = "/callback";
+export declare function buildLoopbackRedirectUri(port: number): string;
+//# sourceMappingURL=client-config.d.ts.map

package/dist/services/mail/outlook/client-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-config.d.ts","sourceRoot":"","sources":["../../../../src/services/mail/outlook/client-config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AAEnF,eAAO,MAAM,0BAA0B,+BAA+B,CAAC;AAEvE,kFAAkF;AAClF,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,mEAAmE;IACnE,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,qBAAa,+BAAgC,SAAQ,KAAK;IACxD,QAAQ,CAAC,IAAI,mCAAmC;;CAOjD;AAED,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,mBAAmB,CASzE;AAED,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,mBAAmB,GAAG,MAAM,CAEhF;AAED,wBAAsB,uBAAuB,CAC3C,SAAS,EAAE,kBAAkB,GAC5B,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAIrC;AAED,wBAAsB,uBAAuB,CAC3C,SAAS,EAAE,kBAAkB,EAC7B,MAAM,EAAE,mBAAmB,GAC1B,OAAO,CAAC,IAAI,CAAC,CAKf;AAED,eAAO,MAAM,sBAAsB,sCAAsC,CAAC;AAE1E,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,cAAc,EAAE,SAAS,MAAM,EAM3C,CAAC;AAEF,wGAAwG;AACxG,eAAO,MAAM,8BAA8B,cAAc,CAAC;AAC1D,eAAO,MAAM,8BAA8B,cAAc,CAAC;AAE1D,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE7D"}

package/dist/services/mail/outlook/client-config.js

@@ -0,0 +1,58 @@
+export const OUTLOOK_CLIENT_CONFIG_BLOB = "mail:outlook:client-config";
+export class OutlookClientConfigMissingError extends Error {
+    code = "outlook_client_config_missing";
+    constructor() {
+        super("Outlook client config not configured. PUT /api/config/mail/outlook/client-config first.");
+        this.name = "OutlookClientConfigMissingError";
+    }
+}
+export function parseOutlookClientConfig(raw) {
+    const parsed = JSON.parse(raw);
+    if (!parsed || typeof parsed.clientId !== "string" || parsed.clientId.length === 0) {
+        throw new Error("Invalid Outlook client config: missing clientId");
+    }
+    const tenant = typeof parsed.tenant === "string" && parsed.tenant.length > 0
+        ? parsed.tenant
+        : "common";
+    return { clientId: parsed.clientId, tenant };
+}
+export function serializeOutlookClientConfig(config) {
+    return JSON.stringify({ clientId: config.clientId, tenant: config.tenant });
+}
+export async function loadOutlookClientConfig(blobStore) {
+    const raw = await blobStore.readUtf8(OUTLOOK_CLIENT_CONFIG_BLOB);
+    if (!raw)
+        return null;
+    return parseOutlookClientConfig(raw);
+}
+export async function saveOutlookClientConfig(blobStore, config) {
+    await blobStore.writeUtf8(OUTLOOK_CLIENT_CONFIG_BLOB, serializeOutlookClientConfig(config));
+}
+export const OUTLOOK_AUTHORITY_BASE = "https://login.microsoftonline.com";
+export function authorityForTenant(tenant) {
+    return `${OUTLOOK_AUTHORITY_BASE}/${tenant}`;
+}
+/**
+ * Scopes per §6.1 — Mail.ReadWrite subsumes Mail.Read. `offline_access`
+ * is required for refresh-token issuance. SETUP-FLOW-REDESIGN-PLAN §6.1
+ * adds `Calendars.ReadWrite` so the same OAuth consent serves both Mail
+ * and Calendar; the Calendar wizard step does not trigger a second
+ * consent screen when Mail is already authenticated. Pre-release
+ * caveat: any cache row written before this change holds a token whose
+ * scope set excludes `Calendars.ReadWrite`; first Calendar use will
+ * 401 once and the loopback flow re-prompts the user.
+ */
+export const OUTLOOK_SCOPES = [
+    "offline_access",
+    "User.Read",
+    "Mail.ReadWrite",
+    "Mail.Send",
+    "Calendars.ReadWrite",
+];
+/** Per §4: Azure since 2020 special-cases loopback regardless of port. Use 127.0.0.1, not localhost. */
+export const OUTLOOK_LOOPBACK_REDIRECT_HOST = "127.0.0.1";
+export const OUTLOOK_LOOPBACK_REDIRECT_PATH = "/callback";
+export function buildLoopbackRedirectUri(port) {
+    return `http://${OUTLOOK_LOOPBACK_REDIRECT_HOST}:${port}${OUTLOOK_LOOPBACK_REDIRECT_PATH}`;
+}
+//# sourceMappingURL=client-config.js.map

package/dist/services/mail/outlook/client-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-config.js","sourceRoot":"","sources":["../../../../src/services/mail/outlook/client-config.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,0BAA0B,GAAG,4BAA4B,CAAC;AASvE,MAAM,OAAO,+BAAgC,SAAQ,KAAK;IAC/C,IAAI,GAAG,+BAA+B,CAAC;IAChD;QACE,KAAK,CACH,yFAAyF,CAC1F,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,iCAAiC,CAAC;IAChD,CAAC;CACF;AAED,MAAM,UAAU,wBAAwB,CAAC,GAAW;IAClD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAiC,CAAC;IAC/D,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnF,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;QAC1E,CAAC,CAAC,MAAM,CAAC,MAAM;QACf,CAAC,CAAC,QAAQ,CAAC;IACb,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,MAA2B;IACtE,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,SAA6B;IAE7B,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,0BAA0B,CAAC,CAAC;IACjE,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,OAAO,wBAAwB,CAAC,GAAG,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,SAA6B,EAC7B,MAA2B;IAE3B,MAAM,SAAS,CAAC,SAAS,CACvB,0BAA0B,EAC1B,4BAA4B,CAAC,MAAM,CAAC,CACrC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,sBAAsB,GAAG,mCAAmC,CAAC;AAE1E,MAAM,UAAU,kBAAkB,CAAC,MAAc;IAC/C,OAAO,GAAG,sBAAsB,IAAI,MAAM,EAAE,CAAC;AAC/C,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,cAAc,GAAsB;IAC/C,gBAAgB;IAChB,WAAW;IACX,gBAAgB;IAChB,WAAW;IACX,qBAAqB;CACtB,CAAC;AAEF,wGAAwG;AACxG,MAAM,CAAC,MAAM,8BAA8B,GAAG,WAAW,CAAC;AAC1D,MAAM,CAAC,MAAM,8BAA8B,GAAG,WAAW,CAAC;AAE1D,MAAM,UAAU,wBAAwB,CAAC,IAAY;IACnD,OAAO,UAAU,8BAA8B,IAAI,IAAI,GAAG,8BAA8B,EAAE,CAAC;AAC7F,CAAC"}

package/dist/services/mail/outlook/delta-cursor.d.ts

@@ -0,0 +1,66 @@
+import type { PollCursor } from "../provider.js";
+export type GraphCursor = Extract<PollCursor, {
+    kind: "graph";
+}>;
+export interface DeltaPage<T = unknown> {
+    value: T[];
+    nextLink: string | null;
+    deltaLink: string | null;
+}
+/**
+ * Build the initial delta URL for the given Inbox folder.
+ * Caller passes through {@link extractDeltaPage} to interpret the response.
+ */
+export declare function buildInboxDeltaUrl(opts: {
+    base?: string;
+    pageSize: number;
+    selectFields: readonly string[];
+}): string;
+/**
+ * Resolve the URL to fetch on the next call.
+ *
+ * - `nextLink` (mid-pagination) → caller is mid-page; re-poll immediately and
+ *   set `drained: false`.
+ * - `deltaLink` (end-of-page)   → caller is caught up; persist for next tick
+ *   and set `drained: true`.
+ * - No cursor                   → fall back to the initial delta URL.
+ */
+export declare function resolveDeltaUrl(cursor: GraphCursor | null, initialUrl: string): {
+    url: string;
+    isContinuation: boolean;
+};
+/**
+ * Pick `nextLink` over `deltaLink` (Graph guarantees only one is present per
+ * page). The unused field is normalized to null so downstream code never sees
+ * stale state from a prior page.
+ */
+export declare function extractDeltaPage<T = unknown>(body: {
+    value?: T[];
+    "@odata.nextLink"?: string;
+    "@odata.deltaLink"?: string;
+}): DeltaPage<T>;
+export interface CursorAdvance {
+    cursor: GraphCursor;
+    drained: boolean;
+}
+/**
+ * Translate a delta page into the next cursor + drained flag (§3.4 / §3.1.1).
+ * `drained=false` instructs the poller to re-call immediately to consume the
+ * remaining pages before yielding back to the timer.
+ */
+export declare function advanceCursor(page: DeltaPage): CursorAdvance;
+export interface RemovedAnnotation {
+    id?: string;
+    "@removed"?: {
+        reason?: string;
+    };
+}
+/**
+ * `@removed.reason` is `deleted` (purged) or `changed` (moved out of Inbox /
+ * label removed). For Inbox-scoped delta both mean "no longer in the
+ * watched view" — surface to {@link PollResult.removedIds}.
+ */
+export declare function isRemovedItem(item: RemovedAnnotation): boolean;
+export declare function parseGraphCursorJson(raw: string | null | undefined): GraphCursor | null;
+export declare function serializeGraphCursor(cursor: GraphCursor): string;
+//# sourceMappingURL=delta-cursor.d.ts.map

package/dist/services/mail/outlook/delta-cursor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delta-cursor.d.ts","sourceRoot":"","sources":["../../../../src/services/mail/outlook/delta-cursor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAEjD,MAAM,MAAM,WAAW,GAAG,OAAO,CAAC,UAAU,EAAE;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC,CAAC;AAEjE,MAAM,WAAW,SAAS,CAAC,CAAC,GAAG,OAAO;IACpC,KAAK,EAAE,CAAC,EAAE,CAAC;IACX,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE;IACvC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;CACjC,GAAG,MAAM,CAMT;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,WAAW,GAAG,IAAI,EAC1B,UAAU,EAAE,MAAM,GACjB;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,OAAO,CAAA;CAAE,CAK1C;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE;IAClD,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;IACZ,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B,GAAG,SAAS,CAAC,CAAC,CAAC,CAUf;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,WAAW,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,SAAS,GAAG,aAAa,CAQ5D;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,UAAU,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAClC;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAG9D;AAED,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,WAAW,GAAG,IAAI,CASvF;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,CAEhE"}

package/dist/services/mail/outlook/delta-cursor.js

@@ -0,0 +1,85 @@
+/**
+ * Build the initial delta URL for the given Inbox folder.
+ * Caller passes through {@link extractDeltaPage} to interpret the response.
+ */
+export function buildInboxDeltaUrl(opts) {
+    const base = opts.base ?? "https://graph.microsoft.com/v1.0";
+    const params = new URLSearchParams();
+    params.set("$select", opts.selectFields.join(","));
+    params.set("$top", String(opts.pageSize));
+    return `${base}/me/mailFolders/Inbox/messages/delta?${params.toString()}`;
+}
+/**
+ * Resolve the URL to fetch on the next call.
+ *
+ * - `nextLink` (mid-pagination) → caller is mid-page; re-poll immediately and
+ *   set `drained: false`.
+ * - `deltaLink` (end-of-page)   → caller is caught up; persist for next tick
+ *   and set `drained: true`.
+ * - No cursor                   → fall back to the initial delta URL.
+ */
+export function resolveDeltaUrl(cursor, initialUrl) {
+    if (!cursor)
+        return { url: initialUrl, isContinuation: false };
+    if (cursor.nextLink)
+        return { url: cursor.nextLink, isContinuation: true };
+    if (cursor.deltaLink)
+        return { url: cursor.deltaLink, isContinuation: true };
+    return { url: initialUrl, isContinuation: false };
+}
+/**
+ * Pick `nextLink` over `deltaLink` (Graph guarantees only one is present per
+ * page). The unused field is normalized to null so downstream code never sees
+ * stale state from a prior page.
+ */
+export function extractDeltaPage(body) {
+    return {
+        value: Array.isArray(body.value) ? body.value : [],
+        nextLink: typeof body["@odata.nextLink"] === "string"
+            ? body["@odata.nextLink"]
+            : null,
+        deltaLink: typeof body["@odata.deltaLink"] === "string"
+            ? body["@odata.deltaLink"]
+            : null,
+    };
+}
+/**
+ * Translate a delta page into the next cursor + drained flag (§3.4 / §3.1.1).
+ * `drained=false` instructs the poller to re-call immediately to consume the
+ * remaining pages before yielding back to the timer.
+ */
+export function advanceCursor(page) {
+    if (page.nextLink) {
+        return { cursor: { kind: "graph", nextLink: page.nextLink }, drained: false };
+    }
+    if (page.deltaLink) {
+        return { cursor: { kind: "graph", deltaLink: page.deltaLink }, drained: true };
+    }
+    return { cursor: { kind: "graph" }, drained: true };
+}
+/**
+ * `@removed.reason` is `deleted` (purged) or `changed` (moved out of Inbox /
+ * label removed). For Inbox-scoped delta both mean "no longer in the
+ * watched view" — surface to {@link PollResult.removedIds}.
+ */
+export function isRemovedItem(item) {
+    const reason = item["@removed"]?.reason;
+    return reason === "deleted" || reason === "changed";
+}
+export function parseGraphCursorJson(raw) {
+    if (!raw)
+        return null;
+    try {
+        const parsed = JSON.parse(raw);
+        if (parsed.kind !== "graph")
+            return null;
+        return parsed;
+    }
+    catch {
+        return null;
+    }
+}
+export function serializeGraphCursor(cursor) {
+    return JSON.stringify(cursor);
+}
+//# sourceMappingURL=delta-cursor.js.map

package/dist/services/mail/outlook/delta-cursor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delta-cursor.js","sourceRoot":"","sources":["../../../../src/services/mail/outlook/delta-cursor.ts"],"names":[],"mappings":"AAUA;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAIlC;IACC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,kCAAkC,CAAC;IAC7D,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;IACrC,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACnD,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC1C,OAAO,GAAG,IAAI,wCAAwC,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;AAC5E,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAC7B,MAA0B,EAC1B,UAAkB;IAElB,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;IAC/D,IAAI,MAAM,CAAC,QAAQ;QAAE,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,QAAQ,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC;IAC3E,IAAI,MAAM,CAAC,SAAS;QAAE,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,SAAS,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC;IAC7E,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;AACpD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAc,IAI7C;IACC,OAAO;QACL,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;QAClD,QAAQ,EAAE,OAAO,IAAI,CAAC,iBAAiB,CAAC,KAAK,QAAQ;YACnD,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC;YACzB,CAAC,CAAC,IAAI;QACR,SAAS,EAAE,OAAO,IAAI,CAAC,kBAAkB,CAAC,KAAK,QAAQ;YACrD,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC;YAC1B,CAAC,CAAC,IAAI;KACT,CAAC;AACJ,CAAC;AAOD;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,IAAe;IAC3C,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClB,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAChF,CAAC;IACD,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACnB,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACjF,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AACtD,CAAC;AAOD;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,IAAuB;IACnD,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IACxC,OAAO,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,GAA8B;IACjE,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAsB,CAAC;QACpD,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO;YAAE,OAAO,IAAI,CAAC;QACzC,OAAO,MAAqB,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,MAAmB;IACtD,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;AAChC,CAAC"}

package/dist/services/mail/outlook/graph-client.d.ts

@@ -0,0 +1,98 @@
+/**
+ * Thin raw-fetch wrapper around Microsoft Graph v1.0 (§3.5).
+ *
+ * Why not the SDK: the official `@microsoft/microsoft-graph-client` is
+ * unmaintained (last release ~3yr) and the new Kiota-based SDK is preview.
+ * The mail surface we need is ~8 endpoints — wrapping fetch is less code
+ * than adapting either SDK.
+ *
+ * The token-acquisition layer is injected (so unit tests don't need MSAL)
+ * and the concurrency limiter respects Graph's per-(app,tenant) cap of 4
+ * concurrent requests (§3.8) — we leave 1 of 4 for ad-hoc UI calls.
+ */
+export declare const GRAPH_BASE_URL = "https://graph.microsoft.com/v1.0";
+export type GraphMethod = "GET" | "POST" | "PATCH" | "DELETE";
+export interface GraphTokenProvider {
+    /** Returns a bearer access token. May trigger a silent refresh. */
+    getAccessToken(): Promise<string>;
+    /** Forces the next call to refresh — invoked when Graph returns 401. */
+    invalidateToken(): void;
+}
+export interface GraphRequestInit {
+    method?: GraphMethod;
+    /** Either a path beginning with `/` (joined to GRAPH_BASE_URL) or an absolute URL. */
+    url: string;
+    body?: unknown;
+    /** Extra headers — `Authorization` and `Content-Type` are always set internally. */
+    headers?: Record<string, string>;
+    /** Disable the 401 → invalidate-and-retry-once dance (used by the retry itself). */
+    skipAuthRetry?: boolean;
+    /** Per-call timeout signal; the caller is responsible for combining with cancellation. */
+    signal?: AbortSignal;
+}
+export declare class GraphError extends Error {
+    readonly httpStatus: number;
+    readonly responseBody: string | null;
+    readonly graphCode: string | null;
+    readonly retryAfterSeconds: number | null;
+    constructor(opts: {
+        message: string;
+        httpStatus: number;
+        responseBody: string | null;
+        graphCode: string | null;
+        retryAfterSeconds: number | null;
+    });
+}
+interface ParsedRetryAfter {
+    seconds: number | null;
+}
+export declare function parseRetryAfter(headerValue: string | null, now?: () => Date): ParsedRetryAfter;
+export declare function resolveGraphUrl(urlOrPath: string, base?: string): string;
+export declare function extractGraphError(body: unknown): {
+    code: string | null;
+    message: string | null;
+};
+/**
+ * Bounded FIFO concurrency limiter. Used by GraphClient to cap simultaneous
+ * Graph requests. Pure mechanism; no Graph-specific knowledge.
+ */
+export declare class ConcurrencyLimiter {
+    private readonly maxConcurrent;
+    private active;
+    private readonly queue;
+    constructor(maxConcurrent: number);
+    run<T>(task: () => Promise<T>): Promise<T>;
+    private drain;
+}
+export interface GraphClientOptions {
+    tokenProvider: GraphTokenProvider;
+    concurrency?: number;
+    /** Override for tests; defaults to global fetch. */
+    fetchImpl?: typeof fetch;
+    /** Cap on automatic 429 retries per request (default 1). */
+    maxRetryAfterRetries?: number;
+    /** Override `now` for testing Retry-After date math. */
+    now?: () => Date;
+    /**
+     * Account-level AbortSignal (§3.2). Applied to every request when the caller
+     * hasn't supplied its own `init.signal`. Used by the registry to cancel
+     * in-flight polls on `removeAccount` / `setActive(false)`.
+     */
+    defaultSignal?: AbortSignal;
+}
+export declare class GraphClient {
+    private readonly tokenProvider;
+    private readonly limiter;
+    private readonly fetchImpl;
+    private readonly maxRetryAfterRetries;
+    private readonly now;
+    private readonly defaultSignal;
+    constructor(options: GraphClientOptions);
+    /** Issue a JSON-bodied request and parse the JSON response. */
+    requestJson<T = unknown>(init: GraphRequestInit): Promise<T>;
+    /** Issue a request that does not have a JSON body. */
+    requestVoid(init: GraphRequestInit): Promise<void>;
+    private executeWithRetries;
+}
+export {};
+//# sourceMappingURL=graph-client.d.ts.map

package/dist/services/mail/outlook/graph-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"graph-client.d.ts","sourceRoot":"","sources":["../../../../src/services/mail/outlook/graph-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,eAAO,MAAM,cAAc,qCAAqC,CAAC;AAEjE,MAAM,MAAM,WAAW,GAAG,KAAK,GAAG,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAC;AAE9D,MAAM,WAAW,kBAAkB;IACjC,mEAAmE;IACnE,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAClC,wEAAwE;IACxE,eAAe,IAAI,IAAI,CAAC;CACzB;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,sFAAsF;IACtF,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,oFAAoF;IACpF,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,oFAAoF;IACpF,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,0FAA0F;IAC1F,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,qBAAa,UAAW,SAAQ,KAAK;IACnC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;gBAE9B,IAAI,EAAE;QAChB,OAAO,EAAE,MAAM,CAAC;QAChB,UAAU,EAAE,MAAM,CAAC;QACnB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;QAC5B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;KAClC;CAQF;AAED,UAAU,gBAAgB;IACxB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED,wBAAgB,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,EAAE,GAAG,GAAE,MAAM,IAAuB,GAAG,gBAAgB,CAYhH;AAED,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,GAAE,MAAuB,GAAG,MAAM,CAIxF;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,OAAO,GAAG;IAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAWhG;AAQD;;;GAGG;AACH,qBAAa,kBAAkB;IAIjB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAH1C,OAAO,CAAC,MAAM,CAAK;IACnB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA8B;gBAEvB,aAAa,EAAE,MAAM;IAIlD,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAO1C,OAAO,CAAC,KAAK;CAiBd;AAED,MAAM,WAAW,kBAAkB;IACjC,aAAa,EAAE,kBAAkB,CAAC;IAClC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oDAAoD;IACpD,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,4DAA4D;IAC5D,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,wDAAwD;IACxD,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB;;;;OAIG;IACH,aAAa,CAAC,EAAE,WAAW,CAAC;CAC7B;AAED,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAqB;IACnD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqB;IAC7C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAe;IACzC,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAS;IAC9C,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAa;IACjC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAqB;gBAEvC,OAAO,EAAE,kBAAkB;IASvC,+DAA+D;IACzD,WAAW,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,CAAC,CAAC;IAIlE,sDAAsD;IAChD,WAAW,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC;YAI1C,kBAAkB;CA4DjC"}