@aitne/daemon 0.1.0

package/dist/services/mail/outlook/graph-client.js

@@ -0,0 +1,198 @@
+/**
+ * Thin raw-fetch wrapper around Microsoft Graph v1.0 (§3.5).
+ *
+ * Why not the SDK: the official `@microsoft/microsoft-graph-client` is
+ * unmaintained (last release ~3yr) and the new Kiota-based SDK is preview.
+ * The mail surface we need is ~8 endpoints — wrapping fetch is less code
+ * than adapting either SDK.
+ *
+ * The token-acquisition layer is injected (so unit tests don't need MSAL)
+ * and the concurrency limiter respects Graph's per-(app,tenant) cap of 4
+ * concurrent requests (§3.8) — we leave 1 of 4 for ad-hoc UI calls.
+ */
+export const GRAPH_BASE_URL = "https://graph.microsoft.com/v1.0";
+export class GraphError extends Error {
+    httpStatus;
+    responseBody;
+    graphCode;
+    retryAfterSeconds;
+    constructor(opts) {
+        super(opts.message);
+        this.name = "GraphError";
+        this.httpStatus = opts.httpStatus;
+        this.responseBody = opts.responseBody;
+        this.graphCode = opts.graphCode;
+        this.retryAfterSeconds = opts.retryAfterSeconds;
+    }
+}
+export function parseRetryAfter(headerValue, now = () => new Date()) {
+    if (!headerValue)
+        return { seconds: null };
+    const trimmed = headerValue.trim();
+    if (/^\d+$/.test(trimmed)) {
+        return { seconds: Math.max(0, parseInt(trimmed, 10)) };
+    }
+    const parsed = Date.parse(trimmed);
+    if (!Number.isNaN(parsed)) {
+        const diffMs = parsed - now().getTime();
+        return { seconds: Math.max(0, Math.ceil(diffMs / 1000)) };
+    }
+    return { seconds: null };
+}
+export function resolveGraphUrl(urlOrPath, base = GRAPH_BASE_URL) {
+    if (/^https?:\/\//i.test(urlOrPath))
+        return urlOrPath;
+    if (urlOrPath.startsWith("/"))
+        return `${base}${urlOrPath}`;
+    return `${base}/${urlOrPath}`;
+}
+export function extractGraphError(body) {
+    if (!body || typeof body !== "object")
+        return { code: null, message: null };
+    const error = body.error;
+    if (!error || typeof error !== "object")
+        return { code: null, message: null };
+    const code = typeof error.code === "string"
+        ? error.code
+        : null;
+    const message = typeof error.message === "string"
+        ? error.message
+        : null;
+    return { code, message };
+}
+/**
+ * Bounded FIFO concurrency limiter. Used by GraphClient to cap simultaneous
+ * Graph requests. Pure mechanism; no Graph-specific knowledge.
+ */
+export class ConcurrencyLimiter {
+    maxConcurrent;
+    active = 0;
+    queue = [];
+    constructor(maxConcurrent) {
+        this.maxConcurrent = maxConcurrent;
+        if (maxConcurrent < 1)
+            throw new Error("ConcurrencyLimiter: maxConcurrent must be >= 1");
+    }
+    run(task) {
+        return new Promise((resolve, reject) => {
+            this.queue.push({ run: task, resolve: resolve, reject });
+            this.drain();
+        });
+    }
+    drain() {
+        while (this.active < this.maxConcurrent && this.queue.length > 0) {
+            const next = this.queue.shift();
+            /* c8 ignore next 1 -- queue.length>0 above guarantees shift() returns; defensive only */
+            if (!next)
+                return;
+            this.active++;
+            next
+                .run()
+                .then((value) => next.resolve(value))
+                .catch((err) => next.reject(err))
+                .finally(() => {
+                this.active--;
+                this.drain();
+            });
+        }
+    }
+}
+export class GraphClient {
+    tokenProvider;
+    limiter;
+    fetchImpl;
+    maxRetryAfterRetries;
+    now;
+    defaultSignal;
+    constructor(options) {
+        this.tokenProvider = options.tokenProvider;
+        this.limiter = new ConcurrencyLimiter(options.concurrency ?? 3);
+        this.fetchImpl = options.fetchImpl ?? globalThis.fetch.bind(globalThis);
+        this.maxRetryAfterRetries = options.maxRetryAfterRetries ?? 1;
+        this.now = options.now ?? (() => new Date());
+        this.defaultSignal = options.defaultSignal ?? null;
+    }
+    /** Issue a JSON-bodied request and parse the JSON response. */
+    async requestJson(init) {
+        return this.limiter.run(() => this.executeWithRetries(init, 0));
+    }
+    /** Issue a request that does not have a JSON body. */
+    async requestVoid(init) {
+        await this.limiter.run(() => this.executeWithRetries(init, 0));
+    }
+    async executeWithRetries(init, retryCount) {
+        const token = await this.tokenProvider.getAccessToken();
+        const headers = {
+            Authorization: `Bearer ${token}`,
+            Accept: "application/json",
+            ...(init.headers ?? {}),
+        };
+        if (init.body !== undefined) {
+            headers["Content-Type"] = headers["Content-Type"] ?? "application/json";
+        }
+        const url = resolveGraphUrl(init.url);
+        const signal = init.signal ?? this.defaultSignal ?? undefined;
+        const response = await this.fetchImpl(url, {
+            method: init.method ?? "GET",
+            headers,
+            body: init.body === undefined
+                ? undefined
+                : typeof init.body === "string"
+                    ? init.body
+                    : JSON.stringify(init.body),
+            signal,
+        });
+        if (response.status === 401 && !init.skipAuthRetry) {
+            this.tokenProvider.invalidateToken();
+            return this.executeWithRetries({ ...init, skipAuthRetry: true }, retryCount);
+        }
+        if (response.status === 429 || response.status === 503) {
+            const retryAfter = parseRetryAfter(response.headers.get("retry-after"), this.now);
+            if (retryAfter.seconds !== null && retryCount < this.maxRetryAfterRetries) {
+                await sleep(retryAfter.seconds * 1000);
+                return this.executeWithRetries(init, retryCount + 1);
+            }
+            // Fall through and surface as GraphError below.
+        }
+        if (!response.ok) {
+            const bodyText = await safeReadText(response);
+            const parsed = bodyText ? safeParseJson(bodyText) : null;
+            const { code, message } = extractGraphError(parsed);
+            const retryAfter = parseRetryAfter(response.headers.get("retry-after"), this.now);
+            throw new GraphError({
+                message: message ?? `Graph ${response.status} ${response.statusText}`,
+                httpStatus: response.status,
+                responseBody: bodyText,
+                graphCode: code,
+                retryAfterSeconds: retryAfter.seconds,
+            });
+        }
+        if (response.status === 204) {
+            return undefined;
+        }
+        const text = await safeReadText(response);
+        if (!text)
+            return undefined;
+        return JSON.parse(text);
+    }
+}
+async function safeReadText(response) {
+    try {
+        return await response.text();
+    }
+    catch {
+        return null;
+    }
+}
+function safeParseJson(text) {
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return null;
+    }
+}
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+//# sourceMappingURL=graph-client.js.map

package/dist/services/mail/outlook/graph-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"graph-client.js","sourceRoot":"","sources":["../../../../src/services/mail/outlook/graph-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,MAAM,CAAC,MAAM,cAAc,GAAG,kCAAkC,CAAC;AAwBjE,MAAM,OAAO,UAAW,SAAQ,KAAK;IAC1B,UAAU,CAAS;IACnB,YAAY,CAAgB;IAC5B,SAAS,CAAgB;IACzB,iBAAiB,CAAgB;IAE1C,YAAY,IAMX;QACC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACpB,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;QACzB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QAClC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;QACtC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAChC,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,iBAAiB,CAAC;IAClD,CAAC;CACF;AAMD,MAAM,UAAU,eAAe,CAAC,WAA0B,EAAE,MAAkB,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE;IAC5F,IAAI,CAAC,WAAW;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3C,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC;IACzD,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACnC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;QACxC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,EAAE,CAAC;IAC5D,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,SAAiB,EAAE,OAAe,cAAc;IAC9E,IAAI,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IACtD,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,IAAI,GAAG,SAAS,EAAE,CAAC;IAC5D,OAAO,GAAG,IAAI,IAAI,SAAS,EAAE,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAa;IAC7C,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC5E,MAAM,KAAK,GAAI,IAA4B,CAAC,KAAK,CAAC;IAClD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC9E,MAAM,IAAI,GAAG,OAAQ,KAA4B,CAAC,IAAI,KAAK,QAAQ;QACjE,CAAC,CAAE,KAA0B,CAAC,IAAI;QAClC,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,OAAO,GAAG,OAAQ,KAA+B,CAAC,OAAO,KAAK,QAAQ;QAC1E,CAAC,CAAE,KAA6B,CAAC,OAAO;QACxC,CAAC,CAAC,IAAI,CAAC;IACT,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC3B,CAAC;AAQD;;;GAGG;AACH,MAAM,OAAO,kBAAkB;IAIA;IAHrB,MAAM,GAAG,CAAC,CAAC;IACF,KAAK,GAA2B,EAAE,CAAC;IAEpD,YAA6B,aAAqB;QAArB,kBAAa,GAAb,aAAa,CAAQ;QAChD,IAAI,aAAa,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IAC3F,CAAC;IAED,GAAG,CAAI,IAAsB;QAC3B,OAAO,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACxC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,OAA+B,EAAE,MAAM,EAAE,CAAC,CAAC;YACjF,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,KAAK;QACX,OAAO,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACjE,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YAChC,yFAAyF;YACzF,IAAI,CAAC,IAAI;gBAAE,OAAO;YAClB,IAAI,CAAC,MAAM,EAAE,CAAC;YACd,IAAI;iBACD,GAAG,EAAE;iBACL,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;iBACpC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;iBAChC,OAAO,CAAC,GAAG,EAAE;gBACZ,IAAI,CAAC,MAAM,EAAE,CAAC;gBACd,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,CAAC,CAAC,CAAC;QACP,CAAC;IACH,CAAC;CAEF;AAmBD,MAAM,OAAO,WAAW;IACL,aAAa,CAAqB;IAClC,OAAO,CAAqB;IAC5B,SAAS,CAAe;IACxB,oBAAoB,CAAS;IAC7B,GAAG,CAAa;IAChB,aAAa,CAAqB;IAEnD,YAAY,OAA2B;QACrC,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;QAC3C,IAAI,CAAC,OAAO,GAAG,IAAI,kBAAkB,CAAC,OAAO,CAAC,WAAW,IAAI,CAAC,CAAC,CAAC;QAChE,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACxE,IAAI,CAAC,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,IAAI,CAAC,CAAC;QAC9D,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAC7C,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,IAAI,CAAC;IACrD,CAAC;IAED,+DAA+D;IAC/D,KAAK,CAAC,WAAW,CAAc,IAAsB;QACnD,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAI,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACrE,CAAC;IAED,sDAAsD;IACtD,KAAK,CAAC,WAAW,CAAC,IAAsB;QACtC,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAO,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACvE,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAAI,IAAsB,EAAE,UAAkB;QAC5E,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,cAAc,EAAE,CAAC;QACxD,MAAM,OAAO,GAA2B;YACtC,aAAa,EAAE,UAAU,KAAK,EAAE;YAChC,MAAM,EAAE,kBAAkB;YAC1B,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;SACxB,CAAC;QACF,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,CAAC,cAAc,CAAC,GAAG,OAAO,CAAC,cAAc,CAAC,IAAI,kBAAkB,CAAC;QAC1E,CAAC;QAED,MAAM,GAAG,GAAG,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,aAAa,IAAI,SAAS,CAAC;QAC9D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE;YACzC,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,KAAK;YAC5B,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,IAAI,KAAK,SAAS;gBAC3B,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ;oBAC7B,CAAC,CAAC,IAAI,CAAC,IAAI;oBACX,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;YAC/B,MAAM;SACP,CAAC,CAAC;QAEH,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACnD,IAAI,CAAC,aAAa,CAAC,eAAe,EAAE,CAAC;YACrC,OAAO,IAAI,CAAC,kBAAkB,CAAI,EAAE,GAAG,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,EAAE,UAAU,CAAC,CAAC;QAClF,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvD,MAAM,UAAU,GAAG,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;YAClF,IAAI,UAAU,CAAC,OAAO,KAAK,IAAI,IAAI,UAAU,GAAG,IAAI,CAAC,oBAAoB,EAAE,CAAC;gBAC1E,MAAM,KAAK,CAAC,UAAU,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;gBACvC,OAAO,IAAI,CAAC,kBAAkB,CAAI,IAAI,EAAE,UAAU,GAAG,CAAC,CAAC,CAAC;YAC1D,CAAC;YACD,gDAAgD;QAClD,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAC;YAC9C,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACzD,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;YACpD,MAAM,UAAU,GAAG,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;YAClF,MAAM,IAAI,UAAU,CAAC;gBACnB,OAAO,EAAE,OAAO,IAAI,SAAS,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE;gBACrE,UAAU,EAAE,QAAQ,CAAC,MAAM;gBAC3B,YAAY,EAAE,QAAQ;gBACtB,SAAS,EAAE,IAAI;gBACf,iBAAiB,EAAE,UAAU,CAAC,OAAO;aACtC,CAAC,CAAC;QACL,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC5B,OAAO,SAAyB,CAAC;QACnC,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI;YAAE,OAAO,SAAyB,CAAC;QAC5C,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,CAAC;IAC/B,CAAC;CACF;AAED,KAAK,UAAU,YAAY,CAAC,QAAkB;IAC5C,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC"}

package/dist/services/mail/outlook/msal-app-factory.d.ts

@@ -0,0 +1,20 @@
+import { PublicClientApplication } from "@azure/msal-node";
+import { type OutlookClientConfig } from "./client-config.js";
+import type { EncryptedBlobStore } from "../../../secrets/encrypted-blob-store.js";
+/**
+ * PCA used during the *bootstrap* OAuth flow. No cache plugin — the cache
+ * lives in process memory until the caller serializes it post-success and
+ * hands the payload to MailAccountRegistry.addAccount(secretPayload).
+ *
+ * This sidesteps the chicken-and-egg of "the cache plugin needs an accountId,
+ * but the accountId only exists after addAccount has run." The runtime PCA
+ * (see {@link createRuntimeMsalApp}) gets the cache plugin pointed at the
+ * stable accountId-derived blob name.
+ */
+export declare function createBootstrapMsalApp(clientConfig: OutlookClientConfig): PublicClientApplication;
+/**
+ * PCA used at runtime for an existing account. Cache plugin reads/writes the
+ * per-account blob on every acquireTokenSilent — MSAL handles refresh.
+ */
+export declare function createRuntimeMsalApp(clientConfig: OutlookClientConfig, accountId: string, blobStore: EncryptedBlobStore): PublicClientApplication;
+//# sourceMappingURL=msal-app-factory.d.ts.map

package/dist/services/mail/outlook/msal-app-factory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"msal-app-factory.d.ts","sourceRoot":"","sources":["../../../../src/services/mail/outlook/msal-app-factory.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EAGxB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAsB,KAAK,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAClF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AAMnF;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CACpC,YAAY,EAAE,mBAAmB,GAChC,uBAAuB,CAiBzB;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,YAAY,EAAE,mBAAmB,EACjC,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,kBAAkB,GAC5B,uBAAuB,CAsBzB"}

package/dist/services/mail/outlook/msal-app-factory.js

@@ -0,0 +1,62 @@
+import { PublicClientApplication, LogLevel, } from "@azure/msal-node";
+import { authorityForTenant } from "./client-config.js";
+import { EncryptedBlobCachePlugin } from "./msal-cache-plugin.js";
+import { createLogger } from "../../../logging.js";
+const logger = createLogger("outlook-msal");
+/**
+ * PCA used during the *bootstrap* OAuth flow. No cache plugin — the cache
+ * lives in process memory until the caller serializes it post-success and
+ * hands the payload to MailAccountRegistry.addAccount(secretPayload).
+ *
+ * This sidesteps the chicken-and-egg of "the cache plugin needs an accountId,
+ * but the accountId only exists after addAccount has run." The runtime PCA
+ * (see {@link createRuntimeMsalApp}) gets the cache plugin pointed at the
+ * stable accountId-derived blob name.
+ */
+export function createBootstrapMsalApp(clientConfig) {
+    const config = {
+        auth: {
+            clientId: clientConfig.clientId,
+            authority: authorityForTenant(clientConfig.tenant),
+        },
+        system: {
+            loggerOptions: {
+                loggerCallback: (level, message) => {
+                    if (level === LogLevel.Error)
+                        logger.error({ msal: message }, "msal error");
+                },
+                piiLoggingEnabled: false,
+                logLevel: LogLevel.Error,
+            },
+        },
+    };
+    return new PublicClientApplication(config);
+}
+/**
+ * PCA used at runtime for an existing account. Cache plugin reads/writes the
+ * per-account blob on every acquireTokenSilent — MSAL handles refresh.
+ */
+export function createRuntimeMsalApp(clientConfig, accountId, blobStore) {
+    const config = {
+        auth: {
+            clientId: clientConfig.clientId,
+            authority: authorityForTenant(clientConfig.tenant),
+        },
+        cache: {
+            cachePlugin: new EncryptedBlobCachePlugin(blobStore, accountId),
+        },
+        system: {
+            loggerOptions: {
+                loggerCallback: (level, message) => {
+                    if (level === LogLevel.Error) {
+                        logger.error({ msal: message, accountId }, "msal error");
+                    }
+                },
+                piiLoggingEnabled: false,
+                logLevel: LogLevel.Error,
+            },
+        },
+    };
+    return new PublicClientApplication(config);
+}
+//# sourceMappingURL=msal-app-factory.js.map

package/dist/services/mail/outlook/msal-app-factory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"msal-app-factory.js","sourceRoot":"","sources":["../../../../src/services/mail/outlook/msal-app-factory.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EAEvB,QAAQ,GACT,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,kBAAkB,EAA4B,MAAM,oBAAoB,CAAC;AAElF,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEnD,MAAM,MAAM,GAAG,YAAY,CAAC,cAAc,CAAC,CAAC;AAE5C;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CACpC,YAAiC;IAEjC,MAAM,MAAM,GAAkB;QAC5B,IAAI,EAAE;YACJ,QAAQ,EAAE,YAAY,CAAC,QAAQ;YAC/B,SAAS,EAAE,kBAAkB,CAAC,YAAY,CAAC,MAAM,CAAC;SACnD;QACD,MAAM,EAAE;YACN,aAAa,EAAE;gBACb,cAAc,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;oBACjC,IAAI,KAAK,KAAK,QAAQ,CAAC,KAAK;wBAAE,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,YAAY,CAAC,CAAC;gBAC9E,CAAC;gBACD,iBAAiB,EAAE,KAAK;gBACxB,QAAQ,EAAE,QAAQ,CAAC,KAAK;aACzB;SACF;KACF,CAAC;IACF,OAAO,IAAI,uBAAuB,CAAC,MAAM,CAAC,CAAC;AAC7C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAClC,YAAiC,EACjC,SAAiB,EACjB,SAA6B;IAE7B,MAAM,MAAM,GAAkB;QAC5B,IAAI,EAAE;YACJ,QAAQ,EAAE,YAAY,CAAC,QAAQ;YAC/B,SAAS,EAAE,kBAAkB,CAAC,YAAY,CAAC,MAAM,CAAC;SACnD;QACD,KAAK,EAAE;YACL,WAAW,EAAE,IAAI,wBAAwB,CAAC,SAAS,EAAE,SAAS,CAAC;SAChE;QACD,MAAM,EAAE;YACN,aAAa,EAAE;gBACb,cAAc,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;oBACjC,IAAI,KAAK,KAAK,QAAQ,CAAC,KAAK,EAAE,CAAC;wBAC7B,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,YAAY,CAAC,CAAC;oBAC3D,CAAC;gBACH,CAAC;gBACD,iBAAiB,EAAE,KAAK;gBACxB,QAAQ,EAAE,QAAQ,CAAC,KAAK;aACzB;SACF;KACF,CAAC;IACF,OAAO,IAAI,uBAAuB,CAAC,MAAM,CAAC,CAAC;AAC7C,CAAC"}

package/dist/services/mail/outlook/msal-cache-plugin.d.ts

@@ -0,0 +1,19 @@
+import type { ICachePlugin, TokenCacheContext } from "@azure/msal-node";
+import type { EncryptedBlobStore } from "../../../secrets/encrypted-blob-store.js";
+/**
+ * Persists MSAL's serialized token cache for one Outlook account into the
+ * EncryptedBlobStore. We do NOT roll our own refresh-token handling — MSAL
+ * does this when its cache is populated and `acquireTokenSilent()` is called.
+ *
+ * Blob layout: `mail:outlook:<accountId>` containing the JSON returned by
+ * `cache.serialize()`. Per-account cache because each Microsoft account has
+ * its own home tenant + claims state.
+ */
+export declare class EncryptedBlobCachePlugin implements ICachePlugin {
+    private readonly blobStore;
+    private readonly blobName;
+    constructor(blobStore: EncryptedBlobStore, accountId: string);
+    beforeCacheAccess(context: TokenCacheContext): Promise<void>;
+    afterCacheAccess(context: TokenCacheContext): Promise<void>;
+}
+//# sourceMappingURL=msal-cache-plugin.d.ts.map

package/dist/services/mail/outlook/msal-cache-plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"msal-cache-plugin.d.ts","sourceRoot":"","sources":["../../../../src/services/mail/outlook/msal-cache-plugin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACxE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AAGnF;;;;;;;;GAQG;AACH,qBAAa,wBAAyB,YAAW,YAAY;IAIzD,OAAO,CAAC,QAAQ,CAAC,SAAS;IAH5B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;gBAGf,SAAS,EAAE,kBAAkB,EAC9C,SAAS,EAAE,MAAM;IAKb,iBAAiB,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;IAO5D,gBAAgB,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;CAKlE"}

package/dist/services/mail/outlook/msal-cache-plugin.js

@@ -0,0 +1,30 @@
+import { mailAccountBlobName } from "../provider.js";
+/**
+ * Persists MSAL's serialized token cache for one Outlook account into the
+ * EncryptedBlobStore. We do NOT roll our own refresh-token handling — MSAL
+ * does this when its cache is populated and `acquireTokenSilent()` is called.
+ *
+ * Blob layout: `mail:outlook:<accountId>` containing the JSON returned by
+ * `cache.serialize()`. Per-account cache because each Microsoft account has
+ * its own home tenant + claims state.
+ */
+export class EncryptedBlobCachePlugin {
+    blobStore;
+    blobName;
+    constructor(blobStore, accountId) {
+        this.blobStore = blobStore;
+        this.blobName = mailAccountBlobName("outlook", accountId);
+    }
+    async beforeCacheAccess(context) {
+        const raw = await this.blobStore.readUtf8(this.blobName);
+        if (raw) {
+            context.tokenCache.deserialize(raw);
+        }
+    }
+    async afterCacheAccess(context) {
+        if (context.cacheHasChanged) {
+            await this.blobStore.writeUtf8(this.blobName, context.tokenCache.serialize());
+        }
+    }
+}
+//# sourceMappingURL=msal-cache-plugin.js.map

package/dist/services/mail/outlook/msal-cache-plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"msal-cache-plugin.js","sourceRoot":"","sources":["../../../../src/services/mail/outlook/msal-cache-plugin.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAErD;;;;;;;;GAQG;AACH,MAAM,OAAO,wBAAwB;IAIhB;IAHF,QAAQ,CAAS;IAElC,YACmB,SAA6B,EAC9C,SAAiB;QADA,cAAS,GAAT,SAAS,CAAoB;QAG9C,IAAI,CAAC,QAAQ,GAAG,mBAAmB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,OAA0B;QAChD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACzD,IAAI,GAAG,EAAE,CAAC;YACR,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,OAA0B;QAC/C,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;YAC5B,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;CACF"}

package/dist/services/mail/outlook/oauth-device-code.d.ts

@@ -0,0 +1,26 @@
+import type { AuthenticationResult, PublicClientApplication } from "@azure/msal-node";
+import { type OutlookClientConfig } from "./client-config.js";
+export interface DeviceCodePromptInfo {
+    userCode: string;
+    verificationUri: string;
+    expiresIn: number;
+    message: string;
+}
+export interface DeviceCodeOAuthDeps {
+    clientConfig: OutlookClientConfig;
+    /** Receives the polling-instructions payload so the dashboard can show user_code + verification_uri. */
+    onPrompt: (info: DeviceCodePromptInfo) => void | Promise<void>;
+    appFactory?: (config: OutlookClientConfig) => PublicClientApplication;
+}
+export interface DeviceCodeOAuthResult {
+    authResult: AuthenticationResult;
+    serializedCache: string;
+    email: string;
+}
+/**
+ * Device-code fallback (§6.1) for headless or browser-less environments.
+ * MSAL handles polling internally — the caller just receives the prompt and
+ * the eventual AuthenticationResult.
+ */
+export declare function runDeviceCodeOAuth(deps: DeviceCodeOAuthDeps): Promise<DeviceCodeOAuthResult>;
+//# sourceMappingURL=oauth-device-code.d.ts.map

package/dist/services/mail/outlook/oauth-device-code.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-device-code.d.ts","sourceRoot":"","sources":["../../../../src/services/mail/outlook/oauth-device-code.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AACtF,OAAO,EAEL,KAAK,mBAAmB,EACzB,MAAM,oBAAoB,CAAC;AAG5B,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,mBAAmB;IAClC,YAAY,EAAE,mBAAmB,CAAC;IAClC,wGAAwG;IACxG,QAAQ,EAAE,CAAC,IAAI,EAAE,oBAAoB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/D,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,mBAAmB,KAAK,uBAAuB,CAAC;CACvE;AAED,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,oBAAoB,CAAC;IACjC,eAAe,EAAE,MAAM,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,qBAAqB,CAAC,CA0BhC"}

package/dist/services/mail/outlook/oauth-device-code.js

@@ -0,0 +1,32 @@
+import { OUTLOOK_SCOPES, } from "./client-config.js";
+import { createBootstrapMsalApp } from "./msal-app-factory.js";
+/**
+ * Device-code fallback (§6.1) for headless or browser-less environments.
+ * MSAL handles polling internally — the caller just receives the prompt and
+ * the eventual AuthenticationResult.
+ */
+export async function runDeviceCodeOAuth(deps) {
+    const appFactory = deps.appFactory ?? createBootstrapMsalApp;
+    const app = appFactory(deps.clientConfig);
+    const authResult = await app.acquireTokenByDeviceCode({
+        scopes: [...OUTLOOK_SCOPES],
+        deviceCodeCallback: (info) => {
+            void deps.onPrompt({
+                userCode: info.userCode,
+                verificationUri: info.verificationUri,
+                expiresIn: info.expiresIn,
+                message: info.message,
+            });
+        },
+    });
+    if (!authResult || !authResult.account?.username) {
+        throw new Error("device_code_no_account");
+    }
+    const serializedCache = app.getTokenCache().serialize();
+    return {
+        authResult,
+        serializedCache,
+        email: authResult.account.username,
+    };
+}
+//# sourceMappingURL=oauth-device-code.js.map

package/dist/services/mail/outlook/oauth-device-code.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-device-code.js","sourceRoot":"","sources":["../../../../src/services/mail/outlook/oauth-device-code.ts"],"names":[],"mappings":"AACA,OAAO,EACL,cAAc,GAEf,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAsB/D;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAAyB;IAEzB,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,sBAAsB,CAAC;IAC7D,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAE1C,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,wBAAwB,CAAC;QACpD,MAAM,EAAE,CAAC,GAAG,cAAc,CAAC;QAC3B,kBAAkB,EAAE,CAAC,IAAI,EAAE,EAAE;YAC3B,KAAK,IAAI,CAAC,QAAQ,CAAC;gBACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,eAAe,EAAE,IAAI,CAAC,eAAe;gBACrC,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,OAAO,EAAE,IAAI,CAAC,OAAO;aACtB,CAAC,CAAC;QACL,CAAC;KACF,CAAC,CAAC;IAEH,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC5C,CAAC;IAED,MAAM,eAAe,GAAG,GAAG,CAAC,aAAa,EAAE,CAAC,SAAS,EAAE,CAAC;IACxD,OAAO;QACL,UAAU;QACV,eAAe;QACf,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,QAAQ;KACnC,CAAC;AACJ,CAAC"}

package/dist/services/mail/outlook/oauth-loopback.d.ts

@@ -0,0 +1,41 @@
+import { type AuthenticationResult, type PublicClientApplication } from "@azure/msal-node";
+import { type OutlookClientConfig } from "./client-config.js";
+export declare class OAuthLoopbackTimeoutError extends Error {
+    readonly code = "oauth_timeout";
+    constructor(timeoutMs: number);
+}
+export declare class OAuthLoopbackError extends Error {
+    readonly code: string;
+    constructor(code: string, message: string);
+}
+export declare function isReferrerAllowed(rawValue: string | null | undefined): boolean;
+export interface LoopbackOAuthResult {
+    authResult: AuthenticationResult;
+    serializedCache: string;
+    email: string;
+}
+export interface LoopbackOAuthDeps {
+    clientConfig: OutlookClientConfig;
+    /** Override for tests. Receives the auth URL and is expected to "open" the browser. */
+    openBrowser?: (url: string) => Promise<unknown> | void;
+    /** Override for tests. Total wait time across the loopback exchange. */
+    timeoutMs?: number;
+    /** Override the MSAL app factory (used by unit tests). */
+    appFactory?: (config: OutlookClientConfig) => PublicClientApplication;
+}
+/**
+ * End-to-end loopback PKCE flow (§6.1).
+ *
+ * 1. Generate PKCE codes via MSAL's CryptoProvider.
+ * 2. Bind an ephemeral http.Server on 127.0.0.1.
+ * 3. Build the auth URL with the resulting redirect URI.
+ * 4. Open the user's browser via {@link LoopbackOAuthDeps.openBrowser}.
+ * 5. Wait for the redirect, validate state, exchange code for tokens.
+ * 6. Serialize the in-memory cache for the caller to persist via
+ *    MailAccountRegistry.addAccount(secretPayload).
+ *
+ * The server is closed under all exit paths (success, error, timeout). State
+ * is single-use and validated via constant-time-ish equality.
+ */
+export declare function runLoopbackOAuth(deps: LoopbackOAuthDeps): Promise<LoopbackOAuthResult>;
+//# sourceMappingURL=oauth-loopback.d.ts.map

package/dist/services/mail/outlook/oauth-loopback.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-loopback.d.ts","sourceRoot":"","sources":["../../../../src/services/mail/outlook/oauth-loopback.ts"],"names":[],"mappings":"AAEA,OAAO,EAEL,KAAK,oBAAoB,EACzB,KAAK,uBAAuB,EAC7B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAKL,KAAK,mBAAmB,EACzB,MAAM,oBAAoB,CAAC;AAM5B,qBAAa,yBAA0B,SAAQ,KAAK;IAClD,QAAQ,CAAC,IAAI,mBAAmB;gBACpB,SAAS,EAAE,MAAM;CAI9B;AAED,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;gBACV,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CAK1C;AAmBD,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAW9E;AAED,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,oBAAoB,CAAC;IACjC,eAAe,EAAE,MAAM,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,iBAAiB;IAChC,YAAY,EAAE,mBAAmB,CAAC;IAClC,uFAAuF;IACvF,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC;IACvD,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,0DAA0D;IAC1D,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,mBAAmB,KAAK,uBAAuB,CAAC;CACvE;AAID;;;;;;;;;;;;;GAaG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CA4D5F"}