@aitne/daemon 0.1.0

package/dist/services/mail/outlook/oauth-loopback.js

@@ -0,0 +1,223 @@
+import { createServer } from "node:http";
+import { randomUUID } from "node:crypto";
+import { CryptoProvider, } from "@azure/msal-node";
+import { buildLoopbackRedirectUri, OUTLOOK_LOOPBACK_REDIRECT_HOST, OUTLOOK_LOOPBACK_REDIRECT_PATH, OUTLOOK_SCOPES, } from "./client-config.js";
+import { createBootstrapMsalApp } from "./msal-app-factory.js";
+import { createLogger } from "../../../logging.js";
+const logger = createLogger("outlook-oauth-loopback");
+export class OAuthLoopbackTimeoutError extends Error {
+    code = "oauth_timeout";
+    constructor(timeoutMs) {
+        super(`OAuth loopback timed out after ${timeoutMs}ms`);
+        this.name = "OAuthLoopbackTimeoutError";
+    }
+}
+export class OAuthLoopbackError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = "OAuthLoopbackError";
+    }
+}
+/**
+ * §4 — strict Origin/Referer check on the callback as defence-in-depth for
+ * the socket-bind race (a same-user attacker binding :port first). PKCE state
+ * is the primary defence; this adds a cheap second layer.
+ *
+ * Referer absence is accepted because modern browsers strip Referer on
+ * HTTPS→HTTP transitions by default (Chrome: strict-origin-when-cross-origin).
+ * When it IS present, the host must end with a Microsoft identity domain.
+ * Same rule for Origin.
+ */
+const ALLOWED_REFERER_SUFFIXES = [
+    "login.microsoftonline.com",
+    "login.microsoft.com",
+    "login.live.com",
+    "login.windows.net",
+];
+export function isReferrerAllowed(rawValue) {
+    if (!rawValue)
+        return true; // absent — browser stripped it; state+PKCE still protect
+    try {
+        const url = new URL(rawValue);
+        const host = url.hostname.toLowerCase();
+        return ALLOWED_REFERER_SUFFIXES.some((suffix) => host === suffix || host.endsWith(`.${suffix}`));
+    }
+    catch {
+        return false;
+    }
+}
+const DEFAULT_TIMEOUT_MS = 5 * 60 * 1000; // 5 min — user has to grant consent
+/**
+ * End-to-end loopback PKCE flow (§6.1).
+ *
+ * 1. Generate PKCE codes via MSAL's CryptoProvider.
+ * 2. Bind an ephemeral http.Server on 127.0.0.1.
+ * 3. Build the auth URL with the resulting redirect URI.
+ * 4. Open the user's browser via {@link LoopbackOAuthDeps.openBrowser}.
+ * 5. Wait for the redirect, validate state, exchange code for tokens.
+ * 6. Serialize the in-memory cache for the caller to persist via
+ *    MailAccountRegistry.addAccount(secretPayload).
+ *
+ * The server is closed under all exit paths (success, error, timeout). State
+ * is single-use and validated via constant-time-ish equality.
+ */
+export async function runLoopbackOAuth(deps) {
+    const timeoutMs = deps.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const appFactory = deps.appFactory ?? createBootstrapMsalApp;
+    const app = appFactory(deps.clientConfig);
+    const cryptoProvider = new CryptoProvider();
+    const { verifier, challenge } = await cryptoProvider.generatePkceCodes();
+    const state = randomUUID();
+    const { server, port } = await bindLoopback();
+    const redirectUri = buildLoopbackRedirectUri(port);
+    try {
+        const authUrl = await app.getAuthCodeUrl({
+            scopes: [...OUTLOOK_SCOPES],
+            redirectUri,
+            codeChallenge: challenge,
+            codeChallengeMethod: "S256",
+            state,
+            prompt: "select_account",
+        });
+        const codePromise = waitForAuthorizationCode(server, state, timeoutMs);
+        const opener = deps.openBrowser ?? defaultOpenBrowser;
+        try {
+            await opener(authUrl);
+        }
+        catch (err) {
+            throw new OAuthLoopbackError("browser_open_failed", `Could not open browser. Falling back to device-code is the recommended path. Underlying: ${err.message}`);
+        }
+        const code = await codePromise;
+        const authResult = await app.acquireTokenByCode({
+            code,
+            scopes: [...OUTLOOK_SCOPES],
+            redirectUri,
+            codeVerifier: verifier,
+        });
+        if (!authResult.account?.username) {
+            throw new OAuthLoopbackError("missing_account", "MSAL did not return an account username — cannot persist Outlook account.");
+        }
+        const serializedCache = app.getTokenCache().serialize();
+        return {
+            authResult,
+            serializedCache,
+            email: authResult.account.username,
+        };
+    }
+    finally {
+        await closeServer(server);
+    }
+}
+async function bindLoopback() {
+    return new Promise((resolve, reject) => {
+        const server = createServer();
+        server.once("error", (err) => reject(err));
+        server.listen(0, OUTLOOK_LOOPBACK_REDIRECT_HOST, () => {
+            const address = server.address();
+            if (!address || typeof address === "string") {
+                reject(new Error("loopback server failed to bind a port"));
+                return;
+            }
+            resolve({ server, port: address.port });
+        });
+    });
+}
+function waitForAuthorizationCode(server, expectedState, timeoutMs) {
+    return new Promise((resolve, reject) => {
+        const timer = setTimeout(() => {
+            reject(new OAuthLoopbackTimeoutError(timeoutMs));
+        }, timeoutMs);
+        const onRequest = (req, res) => {
+            try {
+                if (!req.url) {
+                    respondHtml(res, 400, "Missing URL");
+                    return;
+                }
+                const url = new URL(req.url, `http://${OUTLOOK_LOOPBACK_REDIRECT_HOST}`);
+                if (url.pathname !== OUTLOOK_LOOPBACK_REDIRECT_PATH) {
+                    respondHtml(res, 404, "Not found");
+                    return;
+                }
+                // §4 strict Origin/Referer check — reject if present and not from a
+                // Microsoft identity domain. Missing values are accepted because
+                // browsers commonly strip Referer on HTTPS→HTTP redirects.
+                const refererHeader = firstHeader(req.headers.referer);
+                const originHeader = firstHeader(req.headers.origin);
+                if (!isReferrerAllowed(refererHeader) || !isReferrerAllowed(originHeader)) {
+                    respondHtml(res, 400, "Callback rejected: request origin does not look like a Microsoft sign-in page.");
+                    clearTimeout(timer);
+                    server.off("request", onRequest);
+                    reject(new OAuthLoopbackError("origin_mismatch", `Unexpected Origin/Referer: referer=${refererHeader ?? "∅"} origin=${originHeader ?? "∅"}`));
+                    return;
+                }
+                const error = url.searchParams.get("error");
+                if (error) {
+                    const description = url.searchParams.get("error_description") ?? "";
+                    respondHtml(res, 400, `Authorization failed: ${escapeHtml(error)} ${escapeHtml(description)}`);
+                    clearTimeout(timer);
+                    server.off("request", onRequest);
+                    reject(new OAuthLoopbackError("authorization_denied", `${error}: ${description}`));
+                    return;
+                }
+                const state = url.searchParams.get("state");
+                const code = url.searchParams.get("code");
+                if (!state || state !== expectedState) {
+                    respondHtml(res, 400, "Invalid OAuth state — start the flow again.");
+                    clearTimeout(timer);
+                    server.off("request", onRequest);
+                    reject(new OAuthLoopbackError("state_mismatch", "OAuth state mismatch"));
+                    return;
+                }
+                if (!code) {
+                    respondHtml(res, 400, "Missing authorization code.");
+                    clearTimeout(timer);
+                    server.off("request", onRequest);
+                    reject(new OAuthLoopbackError("missing_code", "No authorization code in callback"));
+                    return;
+                }
+                respondHtml(res, 200, "Authorization successful. You can close this window and return to the dashboard.");
+                clearTimeout(timer);
+                server.off("request", onRequest);
+                resolve(code);
+            }
+            catch (err) {
+                logger.error({ err }, "loopback handler error");
+                respondHtml(res, 500, "Internal error in loopback handler");
+                clearTimeout(timer);
+                server.off("request", onRequest);
+                reject(err);
+            }
+        };
+        server.on("request", onRequest);
+    });
+}
+async function closeServer(server) {
+    await new Promise((resolve) => {
+        server.close(() => resolve());
+    });
+}
+function respondHtml(res, status, message) {
+    res.statusCode = status;
+    res.setHeader("Content-Type", "text/html; charset=utf-8");
+    res.end(`<!doctype html><html><body style="font-family:system-ui;text-align:center;padding:60px"><h2>${escapeHtml(message)}</h2></body></html>`);
+}
+function firstHeader(value) {
+    if (!value)
+        return null;
+    return Array.isArray(value) ? (value[0] ?? null) : value;
+}
+function escapeHtml(input) {
+    return input
+        .replaceAll("&", "&amp;")
+        .replaceAll("<", "&lt;")
+        .replaceAll(">", "&gt;")
+        .replaceAll('"', "&quot;");
+}
+async function defaultOpenBrowser(url) {
+    // Lazily imported so unit tests don't pull in the cross-platform spawn deps.
+    const open = (await import("open")).default;
+    await open(url);
+}
+//# sourceMappingURL=oauth-loopback.js.map

package/dist/services/mail/outlook/oauth-loopback.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-loopback.js","sourceRoot":"","sources":["../../../../src/services/mail/outlook/oauth-loopback.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAA0D,MAAM,WAAW,CAAC;AACjG,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,cAAc,GAGf,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,wBAAwB,EACxB,8BAA8B,EAC9B,8BAA8B,EAC9B,cAAc,GAEf,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEnD,MAAM,MAAM,GAAG,YAAY,CAAC,wBAAwB,CAAC,CAAC;AAEtD,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IACzC,IAAI,GAAG,eAAe,CAAC;IAChC,YAAY,SAAiB;QAC3B,KAAK,CAAC,kCAAkC,SAAS,IAAI,CAAC,CAAC;QACvD,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1C,CAAC;CACF;AAED,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAClC,IAAI,CAAS;IACtB,YAAY,IAAY,EAAE,OAAe;QACvC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED;;;;;;;;;GASG;AACH,MAAM,wBAAwB,GAAG;IAC/B,2BAA2B;IAC3B,qBAAqB;IACrB,gBAAgB;IAChB,mBAAmB;CACpB,CAAC;AAEF,MAAM,UAAU,iBAAiB,CAAC,QAAmC;IACnE,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC,CAAC,yDAAyD;IACrF,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC9B,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QACxC,OAAO,wBAAwB,CAAC,IAAI,CAClC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,MAAM,EAAE,CAAC,CAC3D,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAkBD,MAAM,kBAAkB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,oCAAoC;AAE9E;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAuB;IAC5D,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC;IACvD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,sBAAsB,CAAC;IAC7D,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAE1C,MAAM,cAAc,GAAG,IAAI,cAAc,EAAE,CAAC;IAC5C,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,MAAM,cAAc,CAAC,iBAAiB,EAAE,CAAC;IACzE,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC;IAE3B,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,YAAY,EAAE,CAAC;IAC9C,MAAM,WAAW,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;IAEnD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC;YACvC,MAAM,EAAE,CAAC,GAAG,cAAc,CAAC;YAC3B,WAAW;YACX,aAAa,EAAE,SAAS;YACxB,mBAAmB,EAAE,MAAM;YAC3B,KAAK;YACL,MAAM,EAAE,gBAAgB;SACzB,CAAC,CAAC;QAEH,MAAM,WAAW,GAAG,wBAAwB,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;QAEvE,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,IAAI,kBAAkB,CAAC;QACtD,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,kBAAkB,CAC1B,qBAAqB,EACrB,4FACG,GAAa,CAAC,OACjB,EAAE,CACH,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC;QAC/B,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,kBAAkB,CAAC;YAC9C,IAAI;YACJ,MAAM,EAAE,CAAC,GAAG,cAAc,CAAC;YAC3B,WAAW;YACX,YAAY,EAAE,QAAQ;SACvB,CAAC,CAAC;QAEH,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC;YAClC,MAAM,IAAI,kBAAkB,CAC1B,iBAAiB,EACjB,2EAA2E,CAC5E,CAAC;QACJ,CAAC;QAED,MAAM,eAAe,GAAG,GAAG,CAAC,aAAa,EAAE,CAAC,SAAS,EAAE,CAAC;QACxD,OAAO;YACL,UAAU;YACV,eAAe;YACf,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,QAAQ;SACnC,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;AACH,CAAC;AAED,KAAK,UAAU,YAAY;IACzB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3C,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,8BAA8B,EAAE,GAAG,EAAE;YACpD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YACjC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;gBAC5C,MAAM,CAAC,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC,CAAC;gBAC3D,OAAO;YACT,CAAC;YACD,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,wBAAwB,CAC/B,MAAc,EACd,aAAqB,EACrB,SAAiB;IAEjB,OAAO,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC7C,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,MAAM,CAAC,IAAI,yBAAyB,CAAC,SAAS,CAAC,CAAC,CAAC;QACnD,CAAC,EAAE,SAAS,CAAC,CAAC;QAEd,MAAM,SAAS,GAAG,CAAC,GAAoB,EAAE,GAAmB,EAAE,EAAE;YAC9D,IAAI,CAAC;gBACH,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;oBACb,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,aAAa,CAAC,CAAC;oBACrC,OAAO;gBACT,CAAC;gBACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,8BAA8B,EAAE,CAAC,CAAC;gBACzE,IAAI,GAAG,CAAC,QAAQ,KAAK,8BAA8B,EAAE,CAAC;oBACpD,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;oBACnC,OAAO;gBACT,CAAC;gBAED,oEAAoE;gBACpE,iEAAiE;gBACjE,2DAA2D;gBAC3D,MAAM,aAAa,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;gBACvD,MAAM,YAAY,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;gBACrD,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC,IAAI,CAAC,iBAAiB,CAAC,YAAY,CAAC,EAAE,CAAC;oBAC1E,WAAW,CACT,GAAG,EACH,GAAG,EACH,gFAAgF,CACjF,CAAC;oBACF,YAAY,CAAC,KAAK,CAAC,CAAC;oBACpB,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;oBACjC,MAAM,CACJ,IAAI,kBAAkB,CACpB,iBAAiB,EACjB,sCAAsC,aAAa,IAAI,GAAG,WAAW,YAAY,IAAI,GAAG,EAAE,CAC3F,CACF,CAAC;oBACF,OAAO;gBACT,CAAC;gBAED,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBAC5C,IAAI,KAAK,EAAE,CAAC;oBACV,MAAM,WAAW,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,EAAE,CAAC;oBACpE,WAAW,CACT,GAAG,EACH,GAAG,EACH,yBAAyB,UAAU,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,WAAW,CAAC,EAAE,CACxE,CAAC;oBACF,YAAY,CAAC,KAAK,CAAC,CAAC;oBACpB,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;oBACjC,MAAM,CAAC,IAAI,kBAAkB,CAAC,sBAAsB,EAAE,GAAG,KAAK,KAAK,WAAW,EAAE,CAAC,CAAC,CAAC;oBACnF,OAAO;gBACT,CAAC;gBAED,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBAC5C,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBAC1C,IAAI,CAAC,KAAK,IAAI,KAAK,KAAK,aAAa,EAAE,CAAC;oBACtC,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,6CAA6C,CAAC,CAAC;oBACrE,YAAY,CAAC,KAAK,CAAC,CAAC;oBACpB,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;oBACjC,MAAM,CAAC,IAAI,kBAAkB,CAAC,gBAAgB,EAAE,sBAAsB,CAAC,CAAC,CAAC;oBACzE,OAAO;gBACT,CAAC;gBACD,IAAI,CAAC,IAAI,EAAE,CAAC;oBACV,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,6BAA6B,CAAC,CAAC;oBACrD,YAAY,CAAC,KAAK,CAAC,CAAC;oBACpB,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;oBACjC,MAAM,CAAC,IAAI,kBAAkB,CAAC,cAAc,EAAE,mCAAmC,CAAC,CAAC,CAAC;oBACpF,OAAO;gBACT,CAAC;gBAED,WAAW,CACT,GAAG,EACH,GAAG,EACH,kFAAkF,CACnF,CAAC;gBACF,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;gBACjC,OAAO,CAAC,IAAI,CAAC,CAAC;YAChB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,wBAAwB,CAAC,CAAC;gBAChD,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,oCAAoC,CAAC,CAAC;gBAC5D,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;gBACjC,MAAM,CAAC,GAAG,CAAC,CAAC;YACd,CAAC;QACH,CAAC,CAAC;QAEF,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,MAAc;IACvC,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;QAClC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAAC,GAAmB,EAAE,MAAc,EAAE,OAAe;IACvE,GAAG,CAAC,UAAU,GAAG,MAAM,CAAC;IACxB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,0BAA0B,CAAC,CAAC;IAC1D,GAAG,CAAC,GAAG,CACL,+FAA+F,UAAU,CACvG,OAAO,CACR,qBAAqB,CACvB,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,KAAoC;IACvD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AAC3D,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,KAAK;SACT,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC;SACxB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC;SACvB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC;SACvB,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;AAC/B,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,GAAW;IAC3C,6EAA6E;IAC7E,MAAM,IAAI,GAAG,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;IAC5C,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC;AAClB,CAAC"}

package/dist/services/mail/outlook/outlook-provider.d.ts

@@ -0,0 +1,100 @@
+import type { PublicClientApplication } from "@azure/msal-node";
+import type { DraftDetail, DraftSummary, FolderInfo, ListQuery, MailAccount, MailMessage, MailMessageSummary, MailProvider, PollCursor, PollResult, SendInput, SendResult, TagCatalog, ThreadView, UpdateDraftInput, UpdateDraftResult } from "../provider.js";
+import { GraphClient } from "./graph-client.js";
+import { OutlookGraphCalendarClient } from "../../calendar/outlook/graph-calendar-client.js";
+export interface OutlookProviderOptions {
+    account: MailAccount;
+    msalApp: PublicClientApplication;
+    /**
+     * Optional MSAL `homeAccountId`. Used as the primary lookup key into the
+     * MSAL token cache when set. If omitted, the provider falls back to looking
+     * up by `account.email` (`username`) — safe because each Outlook accountId
+     * maps to a per-account encrypted blob containing exactly one MSAL account.
+     */
+    homeAccountId?: string;
+    graphClient?: GraphClient;
+    /** Override for tests. */
+    fetchImpl?: typeof fetch;
+    concurrency?: number;
+    deltaPageSize?: number;
+    /**
+     * Account-level AbortSignal from `MailAccountRegistry.getAbortSignal`.
+     * Plumbed into {@link GraphClient} so pending fetches are cancelled when
+     * the account is removed or deactivated (§3.2). Caller-supplied `init.signal`
+     * on individual requests still wins if present.
+     */
+    abortSignal?: AbortSignal;
+}
+/**
+ * MailProvider implementation for Microsoft Graph (§3.1, §3.11).
+ * Two send patterns (§3.1.2):
+ *  - Reply: createReply → patch → send (3 calls)
+ *  - New:   create → send (2 calls)
+ * `draftOnly: true` stops at the create step in either path. NEVER /sendMail.
+ */
+export declare class OutlookGraphProvider implements MailProvider {
+    readonly kind: "outlook";
+    readonly account: MailAccount;
+    private readonly msalApp;
+    private readonly homeAccountId;
+    private readonly graphClient;
+    private readonly deltaPageSize;
+    private cachedToken;
+    /**
+     * Lazy singleton — the calendar surface shares the mail provider's
+     * GraphClient (and therefore its concurrency limiter + abortSignal), so
+     * repeated `createCalendarClient` calls must hand back the SAME wrapper
+     * instead of allocating a fresh one each time. Cleared with the rest of
+     * the per-account state when MSAL re-consent flips the token cache.
+     */
+    private cachedCalendarClient;
+    constructor(opts: OutlookProviderOptions);
+    private acquireAccessToken;
+    /**
+     * SETUP-FLOW-REDESIGN-PLAN §6.1 — share the same MSAL token cache + the
+     * mail surface's `GraphClient` with the on-demand Outlook calendar
+     * surface. The shared `GraphClient` carries:
+     *   - one ConcurrencyLimiter, so mail + calendar combined honour Graph's
+     *     4-concurrent / (app, tenant) cap (§3.8) instead of running a
+     *     parallel limiter per surface;
+     *   - the account-level `abortSignal` from `MailAccountRegistry`, so
+     *     `removeAccount` / `setActive(false)` cancels in-flight calendar
+     *     fetches the same way it cancels mail fetches.
+     *
+     * Cached so repeated route hits do not re-allocate the wrapper.
+     */
+    createCalendarClient(): OutlookGraphCalendarClient;
+    list(q: ListQuery): Promise<MailMessageSummary[]>;
+    get(id: string): Promise<MailMessage>;
+    send(input: SendInput): Promise<SendResult>;
+    private sendNew;
+    private sendReply;
+    modifyTags(id: string, add: string[], remove: string[]): Promise<void>;
+    markRead(id: string, read: boolean): Promise<void>;
+    trash(id: string): Promise<void>;
+    getAttachment(messageId: string, attachmentId: string): Promise<{
+        data: Buffer;
+        mimeType: string;
+    } | null>;
+    listFolders(): Promise<FolderInfo[]>;
+    pollSince(cursor: PollCursor | null, limit: number): Promise<PollResult>;
+    revoke(): Promise<void>;
+    untrash(id: string): Promise<void>;
+    archive(id: string): Promise<void>;
+    listTags(): Promise<TagCatalog>;
+    getThread(threadId: string, limit?: number): Promise<ThreadView>;
+    listDrafts(limit?: number): Promise<DraftSummary[]>;
+    getDraft(draftId: string): Promise<DraftDetail | null>;
+    createDraft(input: SendInput): Promise<{
+        id: string;
+    }>;
+    updateDraft(draftId: string, input: UpdateDraftInput): Promise<UpdateDraftResult>;
+    deleteDraft(draftId: string): Promise<void>;
+    sendDraft(draftId: string): Promise<{
+        id: string;
+        threadId?: string;
+    }>;
+    private toFullMessage;
+    private toSummary;
+}
+//# sourceMappingURL=outlook-provider.d.ts.map

package/dist/services/mail/outlook/outlook-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"outlook-provider.d.ts","sourceRoot":"","sources":["../../../../src/services/mail/outlook/outlook-provider.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAEV,uBAAuB,EACxB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EACV,WAAW,EACX,YAAY,EACZ,UAAU,EACV,SAAS,EACT,WAAW,EACX,WAAW,EACX,kBAAkB,EAClB,YAAY,EACZ,UAAU,EACV,UAAU,EACV,SAAS,EACT,UAAU,EACV,UAAU,EACV,UAAU,EACV,gBAAgB,EAChB,iBAAiB,EAClB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,WAAW,EAGZ,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,0BAA0B,EAAE,MAAM,iDAAiD,CAAC;AAyE7F,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,WAAW,CAAC;IACrB,OAAO,EAAE,uBAAuB,CAAC;IACjC;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,0BAA0B;IAC1B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED;;;;;;GAMG;AACH,qBAAa,oBAAqB,YAAW,YAAY;IACvD,QAAQ,CAAC,IAAI,EAAG,SAAS,CAAU;IACnC,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;IAC9B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA0B;IAClD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAgB;IAC9C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAc;IAC1C,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,WAAW,CAAmD;IACtE;;;;;;OAMG;IACH,OAAO,CAAC,oBAAoB,CAA2C;gBAE3D,IAAI,EAAE,sBAAsB;YAqB1B,kBAAkB;IA2ChC;;;;;;;;;;;;OAYG;IACH,oBAAoB,IAAI,0BAA0B;IAM5C,IAAI,CAAC,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAoBjD,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IA4BrC,IAAI,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC;YAOnC,OAAO;YAyBP,SAAS;IA4BjB,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAetE,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAQlD,KAAK,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQhC,aAAa,CACjB,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAwB/C,WAAW,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;IAcpC,SAAS,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAkCxE,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;IAavB,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQlC,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IASlC,QAAQ,IAAI,OAAO,CAAC,UAAU,CAAC;IAc/B,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAgBhE,UAAU,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IAgCnD,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAsCtD,WAAW,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IAsCtD,WAAW,CACf,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,gBAAgB,GACtB,OAAO,CAAC,iBAAiB,CAAC;IA6BvB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAO3C,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IA2B5E,OAAO,CAAC,aAAa;IAYrB,OAAO,CAAC,SAAS;CAmBlB"}