@jbctechsolutions/mcp-office365 2.5.1 → 4.0.0

package/dist/graph/client/graph-client.js

@@ -12,10 +12,47 @@
  * - Error handling
  */
 import 'isomorphic-fetch';
-import { Client } from '@microsoft/microsoft-graph-client';
+import { Client, ResponseType, AuthenticationHandler, RetryHandler, RetryHandlerOptions, RedirectHandler, HTTPMessageHandler, } from '@microsoft/microsoft-graph-client';
 import { getAccessToken } from '../auth/index.js';
 import { buildBatchPayload, splitIntoBatches, parseBatchResponse } from './batch.js';
 import { ResponseCache, CacheTTL, createCacheKey } from './cache.js';
+import { ImmutableIdMiddleware } from './immutable-id-middleware.js';
+// The SDK's RetryHandler only considers 429/503/504 retriable (its private
+// static RETRY_STATUS_CODES), gating `this.isRetry(response)` BEFORE our
+// shouldRetry callback runs — so a callback can only *narrow* that set, never
+// widen it. D5 also wants 502 Bad Gateway retried, so we widen the SDK's set
+// once at load. Our shouldRetry still narrows to idempotent GET/HEAD/OPTIONS,
+// and this server builds only its own client, so the shared-static mutation
+// has no cross-tenant effect.
+const RETRY_STATUS_CODES = RetryHandler
+    .RETRY_STATUS_CODES;
+if (Array.isArray(RETRY_STATUS_CODES) && !RETRY_STATUS_CODES.includes(502)) {
+    RETRY_STATUS_CODES.push(502);
+}
+/**
+ * D5 retry policy (exported for testing). Retries only idempotent reads on
+ * transient failures — 429 plus 502/503/504 — honoring Retry-After via the
+ * SDK-computed delay. NEVER retries a send/write once the body is on the wire:
+ * an ambiguous 429/5xx on a POST could double-send. Paired with the module-load
+ * widening above (the SDK gates 502 out by default), this makes 502 genuinely
+ * retriable for idempotent reads while leaving writes/sendMail untouched.
+ */
+export function shouldRetryGraphRequest(method, url, status) {
+    const m = method.toUpperCase();
+    if (m !== 'GET' && m !== 'HEAD' && m !== 'OPTIONS') {
+        return false;
+    }
+    // Never retry an OData action (POST-shaped operation like /sendMail, /reply,
+    // /createReply of writes) even if the transport surfaces it as a GET. Anchor
+    // the action to the end of the path (or a query string) so a drive item
+    // literally named e.g. "reply.docx" read via GET is still retriable.
+    if (/\/(sendMail|reply|forward|createReply|createForward)(?:\?|$)/i.test(url)) {
+        return false;
+    }
+    return status === 429 || status === 502 || status === 503 || status === 504;
+}
+/** Fields selected for message search results (shared across search mechanisms). */
+const MESSAGE_SEARCH_SELECT = 'id,subject,from,toRecipients,ccRecipients,receivedDateTime,sentDateTime,isRead,hasAttachments,importance,flag,bodyPreview,conversationId,internetMessageId,parentFolderId';
 /**
  * Graph client wrapper with caching and token management.
  */
@@ -32,18 +69,33 @@ export class GraphClient {
     // eslint-disable-next-line @typescript-eslint/require-await
     async getClient() {
         if (this.client == null) {
-            this.client = Client.init({
-                // eslint-disable-next-line @typescript-eslint/no-misused-promises
-                authProvider: async (done) => {
-                    try {
-                        const token = await getAccessToken(this.deviceCodeCallback);
-                        done(null, token);
-                    }
-                    catch (error) {
-                        done(error, null);
-                    }
-                },
-            });
+            const authProvider = {
+                getAccessToken: () => getAccessToken(this.deviceCodeCallback),
+            };
+            const shouldRetry = (_delay, _attempt, request, options, response) => {
+                const method = (options?.method ?? 'GET').toString();
+                // The SDK types `request` as RequestInfo, which resolves to `any` under
+                // this repo's lib config; cast to the shape we read to stay lint-clean.
+                const url = typeof request === 'string' ? request : String(request.url ?? '');
+                return shouldRetryGraphRequest(method, url, response?.status ?? 0);
+            };
+            // Chain mirrors the SDK default order (auth → retry → redirect → http),
+            // minus the cosmetic TelemetryHandler, plus the immutable-ID preference
+            // (U5b-3) sitting right after auth so its Prefer header rides every retry
+            // attempt without being re-appended. RedirectHandler matters: the binary
+            // download endpoints (/content, /photo/$value, meeting recordings) 302 to
+            // a pre-authenticated CDN URL, so the redirect must be followed explicitly
+            // rather than relying on the underlying fetch default.
+            const auth = new AuthenticationHandler(authProvider);
+            const immutableId = new ImmutableIdMiddleware();
+            const retry = new RetryHandler(new RetryHandlerOptions(undefined, undefined, shouldRetry));
+            const redirect = new RedirectHandler();
+            const http = new HTTPMessageHandler();
+            auth.setNext(immutableId);
+            immutableId.setNext(retry);
+            retry.setNext(redirect);
+            redirect.setNext(http);
+            this.client = Client.initWithMiddleware({ middleware: auth });
         }
         return this.client;
     }
@@ -160,7 +212,9 @@ export class GraphClient {
             .select('id,subject,from,toRecipients,ccRecipients,receivedDateTime,sentDateTime,isRead,hasAttachments,importance,flag,bodyPreview,conversationId,internetMessageId,parentFolderId')
             .top(limit)
             .get();
-        return response.value;
+        const messages = response.value;
+        await this.upgradeMessageIdsToImmutable(messages);
+        return messages;
     }
     /**
      * Searches messages in a specific folder.
@@ -173,35 +227,142 @@ export class GraphClient {
             .select('id,subject,from,toRecipients,ccRecipients,receivedDateTime,sentDateTime,isRead,hasAttachments,importance,flag,bodyPreview,conversationId,internetMessageId')
             .top(limit)
             .get();
-        return response.value;
+        const messages = response.value;
+        await this.upgradeMessageIdsToImmutable(messages);
+        return messages;
     }
     /**
-     * Searches messages using raw KQL (Keyword Query Language).
-     * Unlike searchMessages, the query is passed directly without quote-wrapping,
-     * enabling KQL operators like from:, subject:, hasAttachments:, received>=, AND, OR.
+     * Property-only structured search (U7 / D9): `$filter` on messages. The filter
+     * string is built server-side by the search compiler (validated OData syntax).
      */
-    async searchMessagesKql(query, limit = 50) {
+    async searchMessagesFilter(filter, limit = 50) {
         const client = await this.getClient();
+        // No $orderby: Graph returns InefficientFilter when a sender/flag $filter is
+        // combined with $orderby (D9 spike), and /me/messages already defaults to
+        // receivedDateTime desc, so results stay recent-first without it.
         const response = await client
             .api('/me/messages')
-            .search(query)
-            .select('id,subject,from,toRecipients,ccRecipients,receivedDateTime,sentDateTime,isRead,hasAttachments,importance,flag,bodyPreview,conversationId,internetMessageId,parentFolderId')
+            .filter(filter)
+            .select(MESSAGE_SEARCH_SELECT)
             .top(limit)
             .get();
         return response.value;
     }
     /**
-     * Searches messages in a specific folder using raw KQL.
+     * Free-text structured search (U7 / D9): quoted `$search` on messages. The
+     * search value is built by the compiler already correctly quoted (e.g.
+     * `"subject:report"`), which the D9 spike confirmed property-scopes correctly.
      */
-    async searchMessagesKqlInFolder(folderId, query, limit = 50) {
+    async searchMessagesSearchValue(searchValue, limit = 50) {
         const client = await this.getClient();
         const response = await client
-            .api(`/me/mailFolders/${folderId}/messages`)
-            .search(query)
-            .select('id,subject,from,toRecipients,ccRecipients,receivedDateTime,sentDateTime,isRead,hasAttachments,importance,flag,bodyPreview,conversationId,internetMessageId,parentFolderId')
+            .api('/me/messages')
+            .search(searchValue)
+            .select(MESSAGE_SEARCH_SELECT)
             .top(limit)
             .get();
-        return response.value;
+        const messages = response.value;
+        await this.upgradeMessageIdsToImmutable(messages);
+        return messages;
+    }
+    /**
+     * Mixed property + free-text structured search (U7 / D9): `POST /search/query`
+     * with a server-built KQL string — the only single-request path when both are
+     * present. Normalizes the hitsContainers response to a Message[].
+     *
+     * Limitation (verified in the D9 spike): /search/query populates from/subject/
+     * receivedDateTime/isRead/hasAttachments/parentFolderId, but NOT toRecipients
+     * or flag, regardless of the requested fields — so mixed-mode results carry no
+     * recipient list or flag. Acceptable for a result list (sender/subject/date
+     * are present); the property-only and free-text-only paths are unaffected.
+     */
+    async searchMessagesQuery(kql, limit = 50) {
+        const client = await this.getClient();
+        const body = {
+            requests: [
+                {
+                    entityTypes: ['message'],
+                    query: { queryString: kql },
+                    from: 0,
+                    size: limit,
+                    fields: MESSAGE_SEARCH_SELECT.split(','),
+                },
+            ],
+        };
+        const response = (await client.api('/search/query').post(body));
+        const hits = response.value?.[0]?.hitsContainers?.[0]?.hits ?? [];
+        // Guard against a hit without a resource so no undefined enters the mapper.
+        const messages = hits.map((h) => h.resource).filter((r) => r != null);
+        await this.upgradeMessageIdsToImmutable(messages);
+        return messages;
+    }
+    /**
+     * Translates Exchange item IDs between formats (U5b-3 / D2). Used to upgrade
+     * the mutable REST IDs that `$search` returns into immutable REST entry IDs, so
+     * search-minted self-encoding tokens (`em_`) survive a later move. Returns a map
+     * of source ID → immutable target ID; IDs that Graph could not translate are
+     * simply absent (partial success is normal and handled by the caller).
+     */
+    async translateExchangeIds(inputIds, sourceIdType = 'restId', targetIdType = 'restImmutableEntryId') {
+        const out = new Map();
+        if (inputIds.length === 0) {
+            return out;
+        }
+        const client = await this.getClient();
+        // Graph caps translateExchangeIds at 1000 input IDs per call; chunk to stay
+        // under it even though search result sets are far smaller.
+        for (let i = 0; i < inputIds.length; i += 1000) {
+            const chunk = inputIds.slice(i, i + 1000);
+            const response = (await client.api('/me/translateExchangeIds').post({
+                inputIds: chunk,
+                sourceIdType,
+                targetIdType,
+            }));
+            for (const pair of response.value ?? []) {
+                if (pair.sourceId != null && pair.sourceId.length > 0 && pair.targetId != null && pair.targetId.length > 0) {
+                    out.set(pair.sourceId, pair.targetId);
+                }
+            }
+        }
+        return out;
+    }
+    /**
+     * Rewrites the mutable `$search`-minted IDs on a message list to their
+     * immutable equivalents in place (U5b-3 / D2), so the mapper mints durable
+     * `em_` tokens. Graceful degradation: if translation fails wholesale (throw) or
+     * for individual IDs (absent from the map), those messages keep their mutable
+     * ID — the `em_` token still resolves this session, it just isn't move-durable.
+     * Returns the number of IDs left un-upgraded (the caller's `degraded_ids` count).
+     */
+    async upgradeMessageIdsToImmutable(messages) {
+        const mutableIds = messages
+            .map((m) => m.id)
+            .filter((id) => typeof id === 'string' && id.length > 0);
+        if (mutableIds.length === 0) {
+            return 0;
+        }
+        let translated;
+        try {
+            translated = await this.translateExchangeIds(mutableIds);
+        }
+        catch {
+            // Whole-batch failure (throttled/unavailable): leave every ID mutable.
+            return mutableIds.length;
+        }
+        let degraded = 0;
+        for (const message of messages) {
+            if (typeof message.id !== 'string' || message.id.length === 0) {
+                continue;
+            }
+            const immutable = translated.get(message.id);
+            if (immutable != null) {
+                message.id = immutable;
+            }
+            else {
+                degraded += 1;
+            }
+        }
+        return degraded;
     }
     /**
      * Lists messages in a conversation by conversationId.
@@ -237,27 +398,62 @@ export class GraphClient {
      */
     async getMessagesDelta(folderId, deltaLink) {
         const client = await this.getClient();
-        let response;
+        let page;
         if (deltaLink != null) {
-            response = await client.api(deltaLink).get();
+            page = await client.api(deltaLink).get();
         }
         else {
-            response = await client
+            page = await client
                 .api(`/me/mailFolders/${folderId}/messages/delta`)
                 .select('id,subject,from,toRecipients,ccRecipients,receivedDateTime,sentDateTime,isRead,hasAttachments,importance,flag,bodyPreview,conversationId,internetMessageId,parentFolderId')
                 .top(50)
                 .get();
         }
-        const messages = [...(response.value ?? [])];
-        let nextLink = response['@odata.nextLink'];
+        const messages = [...(page.value ?? [])];
+        // The deltaLink lands on the LAST page; paging through nextLinks and reading
+        // it from the first response would yield '' whenever the delta spans >1 page.
+        let nextLink = page['@odata.nextLink'];
         while (nextLink != null) {
-            const nextPage = await client.api(nextLink).get();
-            messages.push(...(nextPage.value ?? []));
-            nextLink = nextPage['@odata.nextLink'];
+            page = await client.api(nextLink).get();
+            messages.push(...(page.value ?? []));
+            nextLink = page['@odata.nextLink'];
         }
-        const newDeltaLink = response['@odata.deltaLink'] ?? '';
+        const newDeltaLink = page['@odata.deltaLink'] ?? '';
         return { messages, deltaLink: newDeltaLink };
     }
+    /**
+     * Gets calendar-view delta for incremental event sync (U12).
+     *
+     * The v1.0 event delta is served by `/me/calendarView/delta`, bounded by a
+     * start/end window that is baked into the returned deltaLink — subsequent
+     * rounds just follow that link. `$select` is unsupported here, so full event
+     * objects come back; deletes arrive as `@removed` entries. The deltaLink lands
+     * on the *last* page, so it is read after paging (not from the first response).
+     */
+    async getCalendarViewDelta(startDateTime, endDateTime, deltaLink) {
+        const client = await this.getClient();
+        let page;
+        if (deltaLink != null) {
+            page = await client.api(deltaLink).get();
+        }
+        else {
+            const start = encodeURIComponent(startDateTime);
+            const end = encodeURIComponent(endDateTime);
+            page = await client
+                .api(`/me/calendarView/delta?startDateTime=${start}&endDateTime=${end}`)
+                .header('Prefer', 'odata.maxpagesize=50')
+                .get();
+        }
+        const events = [...(page.value ?? [])];
+        let nextLink = page['@odata.nextLink'];
+        while (nextLink != null) {
+            page = await client.api(nextLink).get();
+            events.push(...(page.value ?? []));
+            nextLink = page['@odata.nextLink'];
+        }
+        const newDeltaLink = page['@odata.deltaLink'] ?? '';
+        return { events, deltaLink: newDeltaLink };
+    }
     // ===========================================================================
     // Mail Rules
     // ===========================================================================
@@ -560,7 +756,7 @@ export class GraphClient {
         const client = await this.getClient();
         return await client
             .api(`/me/contacts/${contactId}/photo/$value`)
-            .get();
+            .responseType(ResponseType.ARRAYBUFFER).get();
     }
     /**
      * Sets or updates the photo for a contact.
@@ -628,7 +824,7 @@ export class GraphClient {
         const client = await this.getClient();
         const response = await client
             .api('/me/todo/lists')
-            .select('id,displayName,isOwner,isShared,wellknownListName')
+            .select('id,displayName,wellknownListName')
             .get();
         const result = response.value;
         this.cache.set(cacheKey, result, CacheTTL.FOLDERS);
@@ -894,22 +1090,32 @@ export class GraphClient {
     /**
      * Creates a reply draft for a message.
      */
-    async createReplyDraft(messageId) {
+    async createReplyDraft(messageId, comment, body) {
         const client = await this.getClient();
+        const postBody = {};
+        if (comment != null)
+            postBody.comment = comment;
+        if (body != null)
+            postBody.message = { body };
         const result = await client
             .api(`/me/messages/${messageId}/createReply`)
-            .post(null);
+            .post(Object.keys(postBody).length > 0 ? postBody : null);
         this.cache.clear();
         return result;
     }
     /**
      * Creates a reply-all draft for a message.
      */
-    async createReplyAllDraft(messageId) {
+    async createReplyAllDraft(messageId, comment, body) {
         const client = await this.getClient();
+        const postBody = {};
+        if (comment != null)
+            postBody.comment = comment;
+        if (body != null)
+            postBody.message = { body };
         const result = await client
             .api(`/me/messages/${messageId}/createReplyAll`)
-            .post(null);
+            .post(Object.keys(postBody).length > 0 ? postBody : null);
         this.cache.clear();
         return result;
     }
@@ -1493,6 +1699,10 @@ export class GraphClient {
         const client = await this.getClient();
         return await client.api('/planner/buckets').post({ planId, name });
     }
+    async getBucket(bucketId) {
+        const client = await this.getClient();
+        return await client.api(`/planner/buckets/${bucketId}`).get();
+    }
     async updateBucket(bucketId, updates, etag) {
         const client = await this.getClient();
         return await client.api(`/planner/buckets/${bucketId}`).header('If-Match', etag).patch(updates);
@@ -1509,6 +1719,12 @@ export class GraphClient {
         const response = await client.api(`/planner/plans/${planId}/tasks`).get();
         return response.value;
     }
+    /** All Planner tasks assigned to the signed-in user, across every plan. */
+    async listMyPlannerTasks() {
+        const client = await this.getClient();
+        const response = await client.api('/me/planner/tasks').get();
+        return response.value;
+    }
     async getPlannerTask(taskId) {
         const client = await this.getClient();
         return await client.api(`/planner/tasks/${taskId}`).get();
@@ -1561,7 +1777,7 @@ export class GraphClient {
     }
     async getUserPhoto(identifier) {
         const client = await this.getClient();
-        return await client.api(`/users/${identifier}/photo/$value`).get();
+        return await client.api(`/users/${identifier}/photo/$value`).responseType(ResponseType.ARRAYBUFFER).get();
     }
     async getUserPresence(identifier) {
         const client = await this.getClient();
@@ -1572,6 +1788,116 @@ export class GraphClient {
         const response = await client.api('/communications/getPresencesByUserId').post({ ids: userIds });
         return response.value;
     }
+    // ===========================================================================
+    // Shared Mailbox / Delegate Access (/users/{upn}/...) — read-only (#40)
+    // ===========================================================================
+    //
+    // These mirror the `/me/...` read paths but target another user's mailbox,
+    // calendar, or drive via delegate/shared access. Unlike the `/me` variants,
+    // they deliberately DO NOT swallow errors: a 403 must surface (mapped to
+    // GRAPH_PERMISSION_DENIED at the dispatch chokepoint) so the caller learns
+    // they lack shared access rather than getting a silent empty/`null` result.
+    // Results are returned with raw Graph ids (durable tokens are `/me`- and
+    // account-scoped, so they cannot address another mailbox's items).
+    async listSharedMailFolders(mailbox) {
+        const client = await this.getClient();
+        const response = await client
+            .api(`/users/${encodeURIComponent(mailbox)}/mailFolders`)
+            .select('id,displayName,parentFolderId,totalItemCount,unreadItemCount')
+            .top(100)
+            .get();
+        return response.value;
+    }
+    async listSharedMessages(mailbox, folderId, limit = 25, unreadOnly = false) {
+        const client = await this.getClient();
+        const apiPath = folderId != null
+            ? `/users/${encodeURIComponent(mailbox)}/mailFolders/${encodeURIComponent(folderId)}/messages`
+            : `/users/${encodeURIComponent(mailbox)}/messages`;
+        let request = client
+            .api(apiPath)
+            .select('id,subject,from,toRecipients,ccRecipients,receivedDateTime,sentDateTime,isRead,hasAttachments,importance,flag,bodyPreview,conversationId')
+            .top(limit);
+        if (unreadOnly) {
+            // Graph rejects `$orderby` on a property not led by `$filter` (isRead),
+            // so drop the sort when filtering unread and rely on the default order.
+            request = request.filter('isRead eq false');
+        }
+        else {
+            request = request.orderby('receivedDateTime desc');
+        }
+        const response = await request.get();
+        return response.value;
+    }
+    async getSharedMessage(mailbox, messageId, includeBody = false) {
+        const client = await this.getClient();
+        const select = includeBody
+            ? 'id,subject,from,toRecipients,ccRecipients,receivedDateTime,sentDateTime,isRead,hasAttachments,importance,flag,body,bodyPreview,conversationId,parentFolderId'
+            : 'id,subject,from,toRecipients,ccRecipients,receivedDateTime,sentDateTime,isRead,hasAttachments,importance,flag,bodyPreview,conversationId,parentFolderId';
+        return await client
+            .api(`/users/${encodeURIComponent(mailbox)}/messages/${encodeURIComponent(messageId)}`)
+            .select(select)
+            .get();
+    }
+    async searchSharedMessages(mailbox, query, limit = 25) {
+        const client = await this.getClient();
+        // Mail $search cannot be combined with $orderby, so ordering is omitted.
+        // Strip embedded double quotes so a stray `"` can't break out of the
+        // quoted KQL `$search="..."` term.
+        const safeQuery = query.replace(/"/g, ' ');
+        const response = await client
+            .api(`/users/${encodeURIComponent(mailbox)}/messages`)
+            .query({ $search: `"${safeQuery}"` })
+            .select('id,subject,from,toRecipients,ccRecipients,receivedDateTime,sentDateTime,isRead,hasAttachments,importance,flag,bodyPreview,conversationId')
+            .top(limit)
+            .get();
+        return response.value;
+    }
+    async listSharedEvents(mailbox, limit = 25, startDate, endDate) {
+        const client = await this.getClient();
+        if (startDate != null && endDate != null) {
+            const response = await client
+                .api(`/users/${encodeURIComponent(mailbox)}/calendarView`)
+                .query({ startDateTime: startDate.toISOString(), endDateTime: endDate.toISOString() })
+                .select('id,subject,start,end,location,isAllDay,organizer,attendees,bodyPreview')
+                .orderby('start/dateTime')
+                .top(limit)
+                .get();
+            return response.value;
+        }
+        const response = await client
+            .api(`/users/${encodeURIComponent(mailbox)}/events`)
+            .select('id,subject,start,end,location,isAllDay,organizer,attendees,bodyPreview')
+            .orderby('start/dateTime')
+            .top(limit)
+            .get();
+        return response.value;
+    }
+    async getSharedEvent(mailbox, eventId) {
+        const client = await this.getClient();
+        return await client
+            .api(`/users/${encodeURIComponent(mailbox)}/events/${encodeURIComponent(eventId)}`)
+            .select('id,subject,start,end,location,isAllDay,organizer,attendees,body,recurrence,bodyPreview')
+            .get();
+    }
+    async listSharedDriveItems(mailbox, itemId) {
+        const client = await this.getClient();
+        const apiPath = itemId != null
+            ? `/users/${encodeURIComponent(mailbox)}/drive/items/${encodeURIComponent(itemId)}/children`
+            : `/users/${encodeURIComponent(mailbox)}/drive/root/children`;
+        const response = await client.api(apiPath).get();
+        return response.value;
+    }
+    async searchSharedDriveItems(mailbox, query, limit = 25) {
+        const client = await this.getClient();
+        // Escape for the OData string literal first (a lone `'` closes the literal;
+        // OData escapes it by doubling), then URL-encode the whole term.
+        const safeQuery = encodeURIComponent(query.replace(/'/g, "''"));
+        const response = await client
+            .api(`/users/${encodeURIComponent(mailbox)}/drive/root/search(q='${safeQuery}')`)
+            .top(limit)
+            .get();
+        return response.value;
+    }
     /**
      * Sends multiple requests in a single $batch call to the Graph API.
      * Automatically splits into multiple batches if there are more than 20 requests.
@@ -1595,11 +1921,13 @@ export class GraphClient {
     // ===========================================================================
     async listOnlineMeetings(limit = 20) {
         const client = await this.getClient();
+        // Graph rejects $top on /me/onlineMeetings, so limit client-side. Guard a
+        // negative limit (slice(0, -n) would count from the end).
+        const cap = Math.max(0, limit);
         const response = await client.api('/me/onlineMeetings')
-            .top(limit)
             .orderby('startDateTime desc')
             .get();
-        return response.value;
+        return response.value.slice(0, cap);
     }
     async getOnlineMeeting(meetingId) {
         const client = await this.getClient();
@@ -1612,7 +1940,7 @@ export class GraphClient {
     }
     async getMeetingRecordingContent(meetingId, recordingId) {
         const client = await this.getClient();
-        return await client.api(`/me/onlineMeetings/${meetingId}/recordings/${recordingId}/content`).get();
+        return await client.api(`/me/onlineMeetings/${meetingId}/recordings/${recordingId}/content`).responseType(ResponseType.ARRAYBUFFER).get();
     }
     async listMeetingTranscripts(meetingId) {
         const client = await this.getClient();
@@ -1685,7 +2013,7 @@ export class GraphClient {
     }
     async downloadDriveItem(itemId) {
         const client = await this.getClient();
-        return await client.api(`/me/drive/items/${itemId}/content`).get();
+        return await client.api(`/me/drive/items/${itemId}/content`).responseType(ResponseType.ARRAYBUFFER).get();
     }
     async uploadDriveItem(parentPath, fileName, content) {
         const client = await this.getClient();
@@ -1759,7 +2087,167 @@ export class GraphClient {
      */
     async downloadLibraryFile(driveId, itemId) {
         const client = await this.getClient();
-        return await client.api(`/drives/${driveId}/items/${itemId}/content`).get();
+        return await client.api(`/drives/${driveId}/items/${itemId}/content`).responseType(ResponseType.ARRAYBUFFER).get();
+    }
+    // ===========================================================================
+    // SharePoint Lists
+    // ===========================================================================
+    /**
+     * Lists the SharePoint lists in a site.
+     */
+    async listSharePointLists(siteId) {
+        const client = await this.getClient();
+        const response = await client
+            .api(`/sites/${siteId}/lists`)
+            .select('id,name,displayName,description,webUrl,createdDateTime,lastModifiedDateTime')
+            .get();
+        return response.value;
+    }
+    /**
+     * Gets a specific SharePoint list.
+     */
+    async getSharePointList(siteId, listId) {
+        const client = await this.getClient();
+        return await client.api(`/sites/${siteId}/lists/${listId}`).get();
+    }
+    /**
+     * Creates a SharePoint list in a site.
+     */
+    async createSharePointList(siteId, body) {
+        const client = await this.getClient();
+        return await client.api(`/sites/${siteId}/lists`).post(body);
+    }
+    /**
+     * Lists the column definitions for a SharePoint list.
+     */
+    async listSharePointListColumns(siteId, listId) {
+        const client = await this.getClient();
+        const response = await client
+            .api(`/sites/${siteId}/lists/${listId}/columns`)
+            .get();
+        return response.value;
+    }
+    /**
+     * Lists the items in a SharePoint list, expanding their field values.
+     */
+    async listSharePointListItems(siteId, listId, limit = 50) {
+        const client = await this.getClient();
+        const response = await client
+            .api(`/sites/${siteId}/lists/${listId}/items`)
+            .expand('fields')
+            .top(limit)
+            .get();
+        return response.value;
+    }
+    /**
+     * Gets a specific SharePoint list item, expanding its field values.
+     */
+    async getSharePointListItem(siteId, listId, itemId) {
+        const client = await this.getClient();
+        return await client
+            .api(`/sites/${siteId}/lists/${listId}/items/${itemId}`)
+            .expand('fields')
+            .get();
+    }
+    /**
+     * Creates an item in a SharePoint list from a map of column → value.
+     */
+    async createSharePointListItem(siteId, listId, fields) {
+        const client = await this.getClient();
+        return await client.api(`/sites/${siteId}/lists/${listId}/items`).post({ fields });
+    }
+    /**
+     * Updates the field values of a SharePoint list item.
+     */
+    async updateSharePointListItem(siteId, listId, itemId, fields) {
+        const client = await this.getClient();
+        return await client.api(`/sites/${siteId}/lists/${listId}/items/${itemId}/fields`).patch(fields);
+    }
+    /**
+     * Deletes an item from a SharePoint list.
+     */
+    async deleteSharePointListItem(siteId, listId, itemId) {
+        const client = await this.getClient();
+        await client.api(`/sites/${siteId}/lists/${listId}/items/${itemId}`).delete();
+    }
+    // ===========================================================================
+    // OneNote
+    // ===========================================================================
+    /**
+     * Lists all OneNote notebooks for the current user.
+     */
+    async listNotebooks() {
+        const client = await this.getClient();
+        const response = await client.api('/me/onenote/notebooks').get();
+        return response.value;
+    }
+    /**
+     * Lists OneNote sections, optionally scoped to a notebook.
+     */
+    async listNoteSections(notebookGraphId) {
+        const client = await this.getClient();
+        const apiPath = notebookGraphId != null
+            ? `/me/onenote/notebooks/${notebookGraphId}/sections`
+            : '/me/onenote/sections';
+        const response = await client.api(apiPath).get();
+        return response.value;
+    }
+    /**
+     * Lists OneNote pages, optionally scoped to a section.
+     */
+    async listNotePages(sectionGraphId) {
+        const client = await this.getClient();
+        if (sectionGraphId != null) {
+            const response = await client.api(`/me/onenote/sections/${sectionGraphId}/pages`).get();
+            return response.value;
+        }
+        const response = await client
+            .api('/me/onenote/pages')
+            .top(50)
+            .orderby('lastModifiedDateTime desc')
+            .get();
+        return response.value;
+    }
+    /**
+     * Gets a OneNote page's metadata.
+     */
+    async getNotePage(pageGraphId) {
+        const client = await this.getClient();
+        return await client.api(`/me/onenote/pages/${pageGraphId}`).get();
+    }
+    /**
+     * Gets a OneNote page's HTML content.
+     */
+    async getNotePageContent(pageGraphId) {
+        const client = await this.getClient();
+        return await client
+            .api(`/me/onenote/pages/${pageGraphId}/content`)
+            .responseType(ResponseType.TEXT)
+            .get();
+    }
+    /**
+     * Searches OneNote pages by keyword.
+     */
+    async searchNotePages(query) {
+        const client = await this.getClient();
+        // Strip embedded double-quotes so they can't unbalance the quoted $search
+        // expression (`$search="..."`) and 400 the request.
+        const safeQuery = query.replace(/"/g, '');
+        const response = await client
+            .api('/me/onenote/pages')
+            .search(`"${safeQuery}"`)
+            .get();
+        return response.value;
+    }
+    /**
+     * Creates a new OneNote page in a section from raw HTML.
+     */
+    async createNotePage(sectionGraphId, html) {
+        const client = await this.getClient();
+        return await client
+            .api(`/me/onenote/sections/${sectionGraphId}/pages`)
+            .header('Content-Type', 'text/html')
+            .post(html);
     }
 }
 /**