@jbctechsolutions/mcp-office365 2.5.1 → 4.0.0

package/dist/state/delta-store.js

@@ -0,0 +1,124 @@
+/**
+ * Copyright (c) 2026 JBC Tech Solutions, LLC
+ * Licensed under the MIT License. See LICENSE file in the project root.
+ */
+export class DeltaStore {
+    db;
+    now;
+    constructor(db, now) {
+        this.db = db;
+        this.now = now;
+    }
+    /** Returns the stored delta cursor for a resource, or null when un-synced. */
+    getDeltaLink(accountId, resource) {
+        const row = this.db
+            .prepare('SELECT delta_link FROM delta_links WHERE account_id = ? AND resource = ?')
+            .get(accountId, resource);
+        return row?.delta_link ?? null;
+    }
+    /** Returns the cursor plus its last-sync time (for age-based re-baseline), or null. */
+    getCursor(accountId, resource) {
+        const row = this.db
+            .prepare('SELECT delta_link, synced_at FROM delta_links WHERE account_id = ? AND resource = ?')
+            .get(accountId, resource);
+        if (row === undefined)
+            return null;
+        return { deltaLink: row.delta_link, syncedAt: row.synced_at };
+    }
+    /** Returns the set of graph ids already mirrored for a resource. */
+    getSeenIds(accountId, resource) {
+        const rows = this.db
+            .prepare('SELECT graph_id FROM delta_items WHERE account_id = ? AND resource = ?')
+            .all(accountId, resource);
+        return new Set(rows.map((r) => r.graph_id));
+    }
+    /** Looks up a single mirrored item (for labelling a delete), or null. */
+    getItem(accountId, resource, graphId) {
+        const raw = this.db
+            .prepare('SELECT graph_id, token, summary, snapshot FROM delta_items WHERE account_id = ? AND resource = ? AND graph_id = ?')
+            .get(accountId, resource, graphId);
+        if (raw === undefined)
+            return null;
+        return { graphId: raw.graph_id, token: raw.token, summary: raw.summary, snapshot: raw.snapshot };
+    }
+    /** Number of items mirrored for a resource (baseline / status reporting). */
+    countItems(accountId, resource) {
+        const row = this.db
+            .prepare('SELECT COUNT(*) AS n FROM delta_items WHERE account_id = ? AND resource = ?')
+            .get(accountId, resource);
+        return row.n;
+    }
+    /**
+     * Applies a completed sync round atomically: refresh the cursor and apply all
+     * upserts/deletes in one transaction, so a crash mid-write never leaves the
+     * mirror ahead of (or behind) its cursor. An empty `deltaLink` clears the
+     * cursor row, forcing the next call to re-baseline (used when Graph returns no
+     * usable deltaLink).
+     */
+    commit(commit) {
+        const apply = this.db.transaction((c) => {
+            // A baseline replaces the mirror wholesale, so no stale row from a prior
+            // (possibly cursor-less) round can survive to inflate counts or force a
+            // future add to misclassify as an update.
+            if (c.replaceMirror === true) {
+                this.db.prepare('DELETE FROM delta_items WHERE account_id = ? AND resource = ?').run(c.accountId, c.resource);
+            }
+            if (c.deltaLink.length > 0) {
+                this.db
+                    .prepare(`INSERT INTO delta_links (account_id, resource, delta_link, synced_at)
+             VALUES (@accountId, @resource, @deltaLink, @syncedAt)
+             ON CONFLICT(account_id, resource) DO UPDATE SET
+               delta_link = excluded.delta_link,
+               synced_at = excluded.synced_at`)
+                    .run({ accountId: c.accountId, resource: c.resource, deltaLink: c.deltaLink, syncedAt: c.syncedAt });
+            }
+            else {
+                this.db
+                    .prepare('DELETE FROM delta_links WHERE account_id = ? AND resource = ?')
+                    .run(c.accountId, c.resource);
+            }
+            const upsert = this.db.prepare(`INSERT INTO delta_items (account_id, resource, graph_id, token, summary, snapshot, first_seen, last_changed)
+         VALUES (@accountId, @resource, @graphId, @token, @summary, @snapshot, @now, @now)
+         ON CONFLICT(account_id, resource, graph_id) DO UPDATE SET
+           token = excluded.token,
+           summary = excluded.summary,
+           snapshot = excluded.snapshot,
+           last_changed = excluded.last_changed`);
+            for (const item of c.upserts) {
+                upsert.run({
+                    accountId: c.accountId,
+                    resource: c.resource,
+                    graphId: item.graphId,
+                    token: item.token,
+                    summary: item.summary,
+                    snapshot: item.snapshot ?? null,
+                    now: c.syncedAt,
+                });
+            }
+            const del = this.db.prepare('DELETE FROM delta_items WHERE account_id = ? AND resource = ? AND graph_id = ?');
+            for (const graphId of c.deletes) {
+                del.run(c.accountId, c.resource, graphId);
+            }
+        });
+        apply(commit);
+    }
+    /**
+     * Clears the cursor and mirror for a resource (or every resource for the
+     * account when `resource` is omitted), forcing a fresh baseline on the next
+     * sync. Local-only; never touches the user's Graph data.
+     */
+    reset(accountId, resource) {
+        const wipe = this.db.transaction(() => {
+            if (resource != null) {
+                this.db.prepare('DELETE FROM delta_links WHERE account_id = ? AND resource = ?').run(accountId, resource);
+                this.db.prepare('DELETE FROM delta_items WHERE account_id = ? AND resource = ?').run(accountId, resource);
+            }
+            else {
+                this.db.prepare('DELETE FROM delta_links WHERE account_id = ?').run(accountId);
+                this.db.prepare('DELETE FROM delta_items WHERE account_id = ?').run(accountId);
+            }
+        });
+        wipe();
+    }
+}
+//# sourceMappingURL=delta-store.js.map

package/dist/state/delta-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delta-store.js","sourceRoot":"","sources":["../../src/state/delta-store.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAiEH,MAAM,OAAO,UAAU;IACJ,EAAE,CAAK;IACP,GAAG,CAAe;IAEnC,YAAY,EAAM,EAAE,GAAiB;QACnC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;IACjB,CAAC;IAED,8EAA8E;IAC9E,YAAY,CAAC,SAAiB,EAAE,QAAgB;QAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE;aAChB,OAAO,CAAC,0EAA0E,CAAC;aACnF,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAuC,CAAC;QAClE,OAAO,GAAG,EAAE,UAAU,IAAI,IAAI,CAAC;IACjC,CAAC;IAED,uFAAuF;IACvF,SAAS,CAAC,SAAiB,EAAE,QAAgB;QAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE;aAChB,OAAO,CAAC,qFAAqF,CAAC;aAC9F,GAAG,CAAC,SAAS,EAAE,QAAQ,CAA0D,CAAC;QACrF,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QACnC,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,UAAU,EAAE,QAAQ,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC;IAChE,CAAC;IAED,oEAAoE;IACpE,UAAU,CAAC,SAAiB,EAAE,QAAgB;QAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE;aACjB,OAAO,CAAC,wEAAwE,CAAC;aACjF,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAgC,CAAC;QAC3D,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC9C,CAAC;IAED,yEAAyE;IACzE,OAAO,CAAC,SAAiB,EAAE,QAAgB,EAAE,OAAe;QAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE;aAChB,OAAO,CACN,mHAAmH,CACpH;aACA,GAAG,CAAC,SAAS,EAAE,QAAQ,EAAE,OAAO,CAA2B,CAAC;QAC/D,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QACnC,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC;IACnG,CAAC;IAED,6EAA6E;IAC7E,UAAU,CAAC,SAAiB,EAAE,QAAgB;QAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE;aAChB,OAAO,CAAC,6EAA6E,CAAC;aACtF,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAkB,CAAC;QAC7C,OAAO,GAAG,CAAC,CAAC,CAAC;IACf,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,MAAmB;QACxB,MAAM,KAAK,GAAG,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,CAAc,EAAQ,EAAE;YACzD,yEAAyE;YACzE,wEAAwE;YACxE,0CAA0C;YAC1C,IAAI,CAAC,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;gBAC7B,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,+DAA+D,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;YAChH,CAAC;YAED,IAAI,CAAC,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3B,IAAI,CAAC,EAAE;qBACJ,OAAO,CACN;;;;8CAIkC,CACnC;qBACA,GAAG,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;YACzG,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,EAAE;qBACJ,OAAO,CAAC,+DAA+D,CAAC;qBACxE,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;YAClC,CAAC;YAED,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAC5B;;;;;;gDAMwC,CACzC,CAAC;YACF,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;gBAC7B,MAAM,CAAC,GAAG,CAAC;oBACT,SAAS,EAAE,CAAC,CAAC,SAAS;oBACtB,QAAQ,EAAE,CAAC,CAAC,QAAQ;oBACpB,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,IAAI;oBAC/B,GAAG,EAAE,CAAC,CAAC,QAAQ;iBAChB,CAAC,CAAC;YACL,CAAC;YAED,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CACzB,gFAAgF,CACjF,CAAC;YACF,KAAK,MAAM,OAAO,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;gBAChC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC5C,CAAC;QACH,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,MAAM,CAAC,CAAC;IAChB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,SAAiB,EAAE,QAAiB;QACxC,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,GAAS,EAAE;YAC1C,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;gBACrB,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,+DAA+D,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;gBAC1G,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,+DAA+D,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;YAC5G,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,8CAA8C,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBAC/E,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,8CAA8C,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACjF,CAAC;QACH,CAAC,CAAC,CAAC;QACH,IAAI,EAAE,CAAC;IACT,CAAC;CACF"}

package/dist/state/migrate.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Copyright (c) 2026 JBC Tech Solutions, LLC
+ * Licensed under the MIT License. See LICENSE file in the project root.
+ */
+import type Database from 'better-sqlite3';
+type DB = Database.Database;
+/** Reads the applied schema version (0 when never migrated). */
+export declare function getSchemaVersion(db: DB): number;
+/**
+ * Applies pending schema migrations in order, each in its own transaction so a
+ * failure leaves the schema at the last good version. Running with no pending
+ * migrations is a no-op.
+ */
+export declare function runMigrations(db: DB): void;
+/**
+ * Copies a legacy `~/.outlook-mcp/tokens.json` into the new state dir exactly
+ * once (D15): only when the marker is unset AND the new dir has no tokens.json.
+ * The legacy dir is left untouched; the marker is set regardless so the check
+ * never repeats.
+ */
+export declare function migrateLegacyTokens(db: DB, newDir: string, legacyDir: string): void;
+export {};
+//# sourceMappingURL=migrate.d.ts.map

package/dist/state/migrate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrate.d.ts","sourceRoot":"","sources":["../../src/state/migrate.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAWH,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAO3C,KAAK,EAAE,GAAG,QAAQ,CAAC,QAAQ,CAAC;AAoB5B,gEAAgE;AAChE,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,EAAE,GAAG,MAAM,CAI/C;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,EAAE,EAAE,EAAE,GAAG,IAAI,CAqB1C;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,EAAE,EAAE,EAAE,EACN,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,GAChB,IAAI,CAgBN"}

package/dist/state/migrate.js

@@ -0,0 +1,81 @@
+/**
+ * Copyright (c) 2026 JBC Tech Solutions, LLC
+ * Licensed under the MIT License. See LICENSE file in the project root.
+ */
+/**
+ * Boot-time migrations for the durable state store (U4):
+ * - Schema migrations applied in order, tracked via the `meta` table (idempotent).
+ * - One-shot legacy token copy from `~/.outlook-mcp` (D15), never overwriting an
+ *   existing token cache, gated by a `meta` marker so it runs at most once.
+ */
+import { chmodSync, copyFileSync, existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { MIGRATIONS, META_SCHEMA_VERSION, META_LEGACY_TOKENS_MIGRATED, } from './schema.js';
+/** Creates the meta table if absent (needed before reading the schema version). */
+function ensureMetaTable(db) {
+    db.exec('CREATE TABLE IF NOT EXISTS meta (key TEXT PRIMARY KEY, value TEXT NOT NULL);');
+}
+function getMeta(db, key) {
+    const row = db.prepare('SELECT value FROM meta WHERE key = ?').get(key);
+    return row?.value ?? null;
+}
+function setMeta(db, key, value) {
+    db.prepare('INSERT INTO meta (key, value) VALUES (?, ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value').run(key, value);
+}
+/** Reads the applied schema version (0 when never migrated). */
+export function getSchemaVersion(db) {
+    const raw = getMeta(db, META_SCHEMA_VERSION);
+    const parsed = raw != null ? Number.parseInt(raw, 10) : 0;
+    return Number.isFinite(parsed) ? parsed : 0;
+}
+/**
+ * Applies pending schema migrations in order, each in its own transaction so a
+ * failure leaves the schema at the last good version. Running with no pending
+ * migrations is a no-op.
+ */
+export function runMigrations(db) {
+    ensureMetaTable(db);
+    let current = getSchemaVersion(db);
+    // Downgrade guard: a db migrated by a newer build (version beyond this build's
+    // migration count) must not be operated on blindly against an unknown schema.
+    // Throwing here routes the caller to its degraded in-memory fallback.
+    if (current > MIGRATIONS.length) {
+        throw new Error(`state.db schema version ${current} is newer than this build supports (${MIGRATIONS.length}).`);
+    }
+    while (current < MIGRATIONS.length) {
+        const sql = MIGRATIONS[current];
+        if (sql == null)
+            break;
+        const apply = db.transaction((migrationSql, next) => {
+            db.exec(migrationSql);
+            setMeta(db, META_SCHEMA_VERSION, String(next));
+        });
+        apply(sql, current + 1);
+        current += 1;
+    }
+}
+/**
+ * Copies a legacy `~/.outlook-mcp/tokens.json` into the new state dir exactly
+ * once (D15): only when the marker is unset AND the new dir has no tokens.json.
+ * The legacy dir is left untouched; the marker is set regardless so the check
+ * never repeats.
+ */
+export function migrateLegacyTokens(db, newDir, legacyDir) {
+    if (getMeta(db, META_LEGACY_TOKENS_MIGRATED) === '1') {
+        return;
+    }
+    const newTokens = join(newDir, 'tokens.json');
+    const legacyTokens = join(legacyDir, 'tokens.json');
+    if (!existsSync(newTokens) && existsSync(legacyTokens)) {
+        copyFileSync(legacyTokens, newTokens);
+        // The copied cache holds OAuth material — restrict it like state.db (D18).
+        try {
+            chmodSync(newTokens, 0o600);
+        }
+        catch {
+            // Best-effort; non-POSIX filesystems ignore modes.
+        }
+    }
+    setMeta(db, META_LEGACY_TOKENS_MIGRATED, '1');
+}
+//# sourceMappingURL=migrate.js.map

package/dist/state/migrate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrate.js","sourceRoot":"","sources":["../../src/state/migrate.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;;;GAKG;AAEH,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC9D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EACL,UAAU,EACV,mBAAmB,EACnB,2BAA2B,GAC5B,MAAM,aAAa,CAAC;AAIrB,mFAAmF;AACnF,SAAS,eAAe,CAAC,EAAM;IAC7B,EAAE,CAAC,IAAI,CAAC,8EAA8E,CAAC,CAAC;AAC1F,CAAC;AAED,SAAS,OAAO,CAAC,EAAM,EAAE,GAAW;IAClC,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,sCAAsC,CAAC,CAAC,GAAG,CAAC,GAAG,CAEzD,CAAC;IACd,OAAO,GAAG,EAAE,KAAK,IAAI,IAAI,CAAC;AAC5B,CAAC;AAED,SAAS,OAAO,CAAC,EAAM,EAAE,GAAW,EAAE,KAAa;IACjD,EAAE,CAAC,OAAO,CACR,mGAAmG,CACpG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AACpB,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,gBAAgB,CAAC,EAAM;IACrC,MAAM,GAAG,GAAG,OAAO,CAAC,EAAE,EAAE,mBAAmB,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1D,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,EAAM;IAClC,eAAe,CAAC,EAAE,CAAC,CAAC;IACpB,IAAI,OAAO,GAAG,gBAAgB,CAAC,EAAE,CAAC,CAAC;IACnC,+EAA+E;IAC/E,8EAA8E;IAC9E,sEAAsE;IACtE,IAAI,OAAO,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CACb,2BAA2B,OAAO,uCAAuC,UAAU,CAAC,MAAM,IAAI,CAC/F,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC;QACnC,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;QAChC,IAAI,GAAG,IAAI,IAAI;YAAE,MAAM;QACvB,MAAM,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,CAAC,YAAoB,EAAE,IAAY,EAAE,EAAE;YAClE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YACtB,OAAO,CAAC,EAAE,EAAE,mBAAmB,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QACjD,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,GAAG,EAAE,OAAO,GAAG,CAAC,CAAC,CAAC;QACxB,OAAO,IAAI,CAAC,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,EAAM,EACN,MAAc,EACd,SAAiB;IAEjB,IAAI,OAAO,CAAC,EAAE,EAAE,2BAA2B,CAAC,KAAK,GAAG,EAAE,CAAC;QACrD,OAAO;IACT,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC9C,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;IACpD,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QACvD,YAAY,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;QACtC,2EAA2E;QAC3E,IAAI,CAAC;YACH,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,mDAAmD;QACrD,CAAC;IACH,CAAC;IACD,OAAO,CAAC,EAAE,EAAE,2BAA2B,EAAE,GAAG,CAAC,CAAC;AAChD,CAAC"}

package/dist/state/schema.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Copyright (c) 2026 JBC Tech Solutions, LLC
+ * Licensed under the MIT License. See LICENSE file in the project root.
+ */
+/**
+ * SQLite schema for the durable state store (U4). Each entry in {@link MIGRATIONS}
+ * moves the schema forward by one version; the applied version is tracked in the
+ * `meta` table so boot migration is idempotent and ordered.
+ *
+ * Tables (D3/D7/D8):
+ * - `aliases`          — durable-ID token → Graph ID map (composite/mutable IDs).
+ * - `approval_tokens`  — two-phase approval tokens + redemption receipts.
+ * - `meta`             — schema version + one-shot migration markers.
+ * - `delta_links`      — per-resource Graph delta cursors (U12 mirror).
+ * - `delta_items`      — local mirror of seen items, to classify add/update/delete.
+ */
+/** Ordered forward migrations. Index i migrates schema version i → i+1. */
+export declare const MIGRATIONS: readonly string[];
+/** The schema version this build expects (equals the migration count). */
+export declare const SCHEMA_VERSION: number;
+/** meta keys. */
+export declare const META_SCHEMA_VERSION = "schema_version";
+export declare const META_LEGACY_TOKENS_MIGRATED = "legacy_tokens_migrated";
+/** Retention window for redeemed/expired approval tokens (D8): 90 days. */
+export declare const APPROVAL_RETENTION_MS: number;
+//# sourceMappingURL=schema.d.ts.map

package/dist/state/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../src/state/schema.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;;;;;;;;;GAWG;AAEH,2EAA2E;AAC3E,eAAO,MAAM,UAAU,EAAE,SAAS,MAAM,EAmDvC,CAAC;AAEF,0EAA0E;AAC1E,eAAO,MAAM,cAAc,QAAoB,CAAC;AAEhD,iBAAiB;AACjB,eAAO,MAAM,mBAAmB,mBAAmB,CAAC;AACpD,eAAO,MAAM,2BAA2B,2BAA2B,CAAC;AAEpE,2EAA2E;AAC3E,eAAO,MAAM,qBAAqB,QAA2B,CAAC"}

package/dist/state/schema.js

@@ -0,0 +1,77 @@
+/**
+ * Copyright (c) 2026 JBC Tech Solutions, LLC
+ * Licensed under the MIT License. See LICENSE file in the project root.
+ */
+/**
+ * SQLite schema for the durable state store (U4). Each entry in {@link MIGRATIONS}
+ * moves the schema forward by one version; the applied version is tracked in the
+ * `meta` table so boot migration is idempotent and ordered.
+ *
+ * Tables (D3/D7/D8):
+ * - `aliases`          — durable-ID token → Graph ID map (composite/mutable IDs).
+ * - `approval_tokens`  — two-phase approval tokens + redemption receipts.
+ * - `meta`             — schema version + one-shot migration markers.
+ * - `delta_links`      — per-resource Graph delta cursors (U12 mirror).
+ * - `delta_items`      — local mirror of seen items, to classify add/update/delete.
+ */
+/** Ordered forward migrations. Index i migrates schema version i → i+1. */
+export const MIGRATIONS = [
+    // v0 → v1: initial durable-state schema.
+    `
+  CREATE TABLE IF NOT EXISTS aliases (
+    token       TEXT PRIMARY KEY,
+    graph_id    TEXT NOT NULL,
+    entity_type TEXT NOT NULL,
+    account_id  TEXT NOT NULL,
+    mutable     INTEGER NOT NULL DEFAULT 0,
+    created_at  INTEGER NOT NULL
+  );
+
+  CREATE TABLE IF NOT EXISTS approval_tokens (
+    token         TEXT PRIMARY KEY,
+    operation_key TEXT UNIQUE,
+    action        TEXT NOT NULL,
+    target_json   TEXT NOT NULL,
+    content_hash  TEXT,
+    account_id    TEXT NOT NULL,
+    expires_at    INTEGER NOT NULL,
+    redeemed_at   INTEGER,
+    receipt_json  TEXT,
+    created_at    INTEGER NOT NULL
+  );
+
+  CREATE INDEX IF NOT EXISTS idx_approval_tokens_expires_at ON approval_tokens (expires_at);
+  `,
+    // v1 → v2: delta-sync mirror (U12). One cursor row per (account, resource),
+    // plus a per-item mirror so a subsequent delta round can tell an added item
+    // from an updated one (Graph delta reports both as a plain value entry).
+    `
+  CREATE TABLE IF NOT EXISTS delta_links (
+    account_id  TEXT NOT NULL,
+    resource    TEXT NOT NULL,
+    delta_link  TEXT NOT NULL,
+    synced_at   INTEGER NOT NULL,
+    PRIMARY KEY (account_id, resource)
+  );
+
+  CREATE TABLE IF NOT EXISTS delta_items (
+    account_id   TEXT NOT NULL,
+    resource     TEXT NOT NULL,
+    graph_id     TEXT NOT NULL,
+    token        TEXT NOT NULL,
+    summary      TEXT NOT NULL DEFAULT '',
+    snapshot     TEXT,
+    first_seen   INTEGER NOT NULL,
+    last_changed INTEGER NOT NULL,
+    PRIMARY KEY (account_id, resource, graph_id)
+  );
+  `,
+];
+/** The schema version this build expects (equals the migration count). */
+export const SCHEMA_VERSION = MIGRATIONS.length;
+/** meta keys. */
+export const META_SCHEMA_VERSION = 'schema_version';
+export const META_LEGACY_TOKENS_MIGRATED = 'legacy_tokens_migrated';
+/** Retention window for redeemed/expired approval tokens (D8): 90 days. */
+export const APPROVAL_RETENTION_MS = 90 * 24 * 60 * 60 * 1000;
+//# sourceMappingURL=schema.js.map

package/dist/state/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/state/schema.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;;;;;;;;;GAWG;AAEH,2EAA2E;AAC3E,MAAM,CAAC,MAAM,UAAU,GAAsB;IAC3C,yCAAyC;IACzC;;;;;;;;;;;;;;;;;;;;;;;;GAwBC;IACD,4EAA4E;IAC5E,4EAA4E;IAC5E,yEAAyE;IACzE;;;;;;;;;;;;;;;;;;;;GAoBC;CACF,CAAC;AAEF,0EAA0E;AAC1E,MAAM,CAAC,MAAM,cAAc,GAAG,UAAU,CAAC,MAAM,CAAC;AAEhD,iBAAiB;AACjB,MAAM,CAAC,MAAM,mBAAmB,GAAG,gBAAgB,CAAC;AACpD,MAAM,CAAC,MAAM,2BAA2B,GAAG,wBAAwB,CAAC;AAEpE,2EAA2E;AAC3E,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC"}

package/dist/state/store.d.ts

@@ -0,0 +1,155 @@
+/**
+ * Copyright (c) 2026 JBC Tech Solutions, LLC
+ * Licensed under the MIT License. See LICENSE file in the project root.
+ */
+import { DeltaStore } from './delta-store.js';
+/** A durable-ID alias row. */
+export interface AliasRow {
+    token: string;
+    graphId: string;
+    entityType: string;
+    accountId: string;
+    mutable: boolean;
+    createdAt: number;
+}
+/** Input for minting an alias. */
+export interface AliasInput {
+    token: string;
+    graphId: string;
+    entityType: string;
+    accountId: string;
+    mutable?: boolean;
+    createdAt?: number;
+}
+/** Input for staging a two-phase approval token. */
+export interface ApprovalTokenInput {
+    token: string;
+    operationKey?: string | null;
+    action: string;
+    targetJson: string;
+    contentHash?: string | null;
+    accountId: string;
+    expiresAt: number;
+    createdAt?: number;
+}
+/** A stored approval-token row (read view). */
+export interface ApprovalTokenRow {
+    token: string;
+    action: string;
+    targetJson: string;
+    contentHash: string | null;
+    expiresAt: number;
+    redeemedAt: number | null;
+    receiptJson: string | null;
+    createdAt: number;
+}
+/** Outcome of an atomic approval-token consume. */
+export type ConsumeResult = {
+    status: 'consumed';
+    receiptJson: string | null;
+} | {
+    status: 'already_redeemed';
+    receiptJson: string | null;
+} | {
+    status: 'expired';
+} | {
+    status: 'foreign_account';
+} | {
+    status: 'not_found';
+};
+/** Options for {@link StateStore.open}. */
+export interface StateStoreOptions {
+    /** Override the state directory (defaults to `~/.mcp-office365`). */
+    dir?: string;
+    /** Override the legacy directory to migrate tokens from. */
+    legacyDir?: string;
+    /** Clock, for deterministic tests. */
+    now?: () => number;
+    /** Warning sink (defaults to stderr). */
+    warn?: (message: string) => void;
+}
+export declare class StateStore {
+    /** True when running from an in-memory fallback (durability degraded). */
+    readonly degraded: boolean;
+    /** The db path, or ':memory:' when degraded. */
+    readonly path: string;
+    /** Effective `journal_mode` pragma (e.g. 'wal'). */
+    readonly journalMode: string;
+    /** Effective `busy_timeout` pragma in ms. */
+    readonly busyTimeout: number;
+    /** Delta-sync mirror storage (U12), sharing this store's connection. */
+    readonly delta: DeltaStore;
+    private readonly db;
+    private readonly now;
+    private constructor();
+    /**
+     * Opens (creating if needed) the durable store. On any failure to use the
+     * on-disk db (corrupt/locked file, unwritable dir) it degrades to an in-memory
+     * store, emits a stderr warning, and reports `degraded = true` — the server
+     * stays usable, only durability is lost for the run.
+     */
+    static open(options?: StateStoreOptions): StateStore;
+    /** Inserts or replaces a durable-ID alias. */
+    putAlias(input: AliasInput): void;
+    /**
+     * Resolves an alias token, scoped to `accountId` (D7 account stamping). The
+     * account is a mandatory, fail-closed argument: a row minted under a different
+     * account is invisible, so no caller can accidentally resolve a foreign
+     * account's durable ID into a live Graph ID by omitting the scope.
+     */
+    getAlias(token: string, accountId: string): AliasRow | null;
+    /**
+     * Atomically registers an alias with D1a collision enforcement, in a single
+     * IMMEDIATE transaction so the check-and-write is not a read-then-write race:
+     * two concurrent immutable registrations of the same token cannot both pass
+     * the check and then clobber each other. Returns `'collision'` when a
+     * *different* Graph ID already occupies the token for an immutable entity
+     * (neither the stored nor the new row is mutable); otherwise upserts and
+     * returns `'ok'`.
+     */
+    registerAlias(input: AliasInput): 'ok' | 'collision';
+    /**
+     * Returns an alias row regardless of account, or null. Reserved for two
+     * internal uses that must see across accounts: foreign-account disambiguation
+     * during resolution, and collision detection at mint time (D1a). It is NOT a
+     * resolution path — {@link getAlias} (account-scoped) is the only one of those.
+     */
+    getAliasUnscoped(token: string): AliasRow | null;
+    /**
+     * Returns the account a token was minted under (any account), or null when the
+     * token is unknown. Distinguishes "foreign account" from "unknown" during
+     * resolution so a foreign token yields a typed ID_FOREIGN_ACCOUNT.
+     */
+    getAliasAccount(token: string): string | null;
+    /**
+     * Reads an approval token scoped to `accountId` (or null). A read view for
+     * validation/preview; redemption still goes through {@link consumeApprovalToken}
+     * so the atomic guard is never bypassed.
+     */
+    getApprovalToken(token: string, accountId: string): ApprovalTokenRow | null;
+    /** Stages a two-phase approval token. */
+    putApprovalToken(input: ApprovalTokenInput): void;
+    /**
+     * Atomically consumes an approval token (D8). The guarded `UPDATE … WHERE
+     * redeemed_at IS NULL AND expires_at > now RETURNING` means only one caller —
+     * across processes sharing the db — can win the redemption; the loser sees
+     * `already_redeemed` and can return the stored receipt. Expiry is enforced
+     * here at the trust boundary (not left to callers): an expired token that
+     * still authorizes a send/delete would defeat the whole point of a time-boxed
+     * two-phase approval. Foreign-account tokens are refused.
+     */
+    consumeApprovalToken(args: {
+        token: string;
+        accountId: string;
+        receiptJson?: string | null;
+        now?: number;
+    }): ConsumeResult;
+    /**
+     * Deletes approval tokens whose expiry is older than the retention window
+     * (D8, 90 days). Recently-expired receipts linger so idempotent redemption
+     * still returns them. Returns the number of rows purged.
+     */
+    purgeExpired(now: number): number;
+    close(): void;
+}
+//# sourceMappingURL=store.d.ts.map

package/dist/state/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/state/store.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAmBH,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAQ9C,8BAA8B;AAC9B,MAAM,WAAW,QAAQ;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,kCAAkC;AAClC,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,oDAAoD;AACpD,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,+CAA+C;AAC/C,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,mDAAmD;AACnD,MAAM,MAAM,aAAa,GACrB;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAClD;IAAE,MAAM,EAAE,kBAAkB,CAAC;IAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAC1D;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,GACrB;IAAE,MAAM,EAAE,iBAAiB,CAAA;CAAE,GAC7B;IAAE,MAAM,EAAE,WAAW,CAAA;CAAE,CAAC;AAE5B,2CAA2C;AAC3C,MAAM,WAAW,iBAAiB;IAChC,qEAAqE;IACrE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,4DAA4D;IAC5D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,sCAAsC;IACtC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,yCAAyC;IACzC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CAClC;AAWD,qBAAa,UAAU;IACrB,0EAA0E;IAC1E,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,gDAAgD;IAChD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,oDAAoD;IACpD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,6CAA6C;IAC7C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,wEAAwE;IACxE,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAE3B,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAK;IACxB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IAEnC,OAAO;IAUP;;;;;OAKG;IACH,MAAM,CAAC,IAAI,CAAC,OAAO,GAAE,iBAAsB,GAAG,UAAU;IA8DxD,8CAA8C;IAC9C,QAAQ,CAAC,KAAK,EAAE,UAAU,GAAG,IAAI;IAqBjC;;;;;OAKG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,QAAQ,GAAG,IAAI;IAiB3D;;;;;;;;OAQG;IACH,aAAa,CAAC,KAAK,EAAE,UAAU,GAAG,IAAI,GAAG,WAAW;IAiBpD;;;;;OAKG;IACH,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,QAAQ,GAAG,IAAI;IAiBhD;;;;OAIG;IACH,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAM7C;;;;OAIG;IACH,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,gBAAgB,GAAG,IAAI;IAgC3E,yCAAyC;IACzC,gBAAgB,CAAC,KAAK,EAAE,kBAAkB,GAAG,IAAI;IAmBjD;;;;;;;;OAQG;IACH,oBAAoB,CAAC,IAAI,EAAE;QACzB,KAAK,EAAE,MAAM,CAAC;QACd,SAAS,EAAE,MAAM,CAAC;QAClB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC5B,GAAG,CAAC,EAAE,MAAM,CAAC;KACd,GAAG,aAAa;IAyCjB;;;;OAIG;IACH,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM;IAMjC,KAAK,IAAI,IAAI;CAGd"}