@mj-biz-apps/common-activity-sync 5.41.0 → 5.43.0

package/dist/attachments.js

@@ -0,0 +1,147 @@
+/**
+ * Which attachments an included activity should keep.
+ *
+ * WHY THIS EXISTS. `ActivitySyncRule.IncludeAttachments` describes itself as "1 = also pull
+ * attachments into ActivityFile rows", `MaxAttachmentBytes` sits beside it, and the `ActivityFile`
+ * table with its `Kind` value list (Body / Attachment / Ics) is migrated and in metadata — and
+ * nothing anywhere read any of it. A rule that asked for attachments got none, silently. That is the
+ * same shape as the `CredentialsRef` and `InternalDomains` gaps: schema and documentation written
+ * ahead of the wiring, with every test passing because nothing exercised the unwired path.
+ *
+ * DECIDED AT WRITE TIME, FROM THE RULE THAT DECIDED. Rules are evaluated after the fetch, so the
+ * question "does this item want its attachments?" cannot be answered while fetching. The item
+ * carries only the cheap `HasAttachments` flag; this turns that plus the winning rule into an
+ * instruction, and the expensive per-message attachment call is paid only for items that were
+ * actually included by a rule that asked.
+ *
+ * @module @mj-biz-apps/common-activity-sync
+ */
+/**
+ * Turn the deciding rule plus the item's flag into an instruction.
+ *
+ * NO RULE MEANS NO ATTACHMENTS. An item can be included by the KnownParticipant stage or by a
+ * provider-type default policy rather than by a rule, and neither expresses an attachment choice.
+ * Defaulting to "fetch" there would pull every attachment in a mailbox on the strength of a decision
+ * nobody made about attachments — the expensive, surprising direction to be wrong in.
+ */
+export function AttachmentPolicyFor(rule, item) {
+    const wanted = rule?.IncludeAttachments === true;
+    // No point paying for a list when the source already said there is nothing to list.
+    const fetch = wanted && item?.HasAttachments === true;
+    const cap = rule?.MaxAttachmentBytes;
+    return {
+        Fetch: fetch,
+        // 0 and negative are treated as "no cap" rather than "keep nothing": a cap of zero is far
+        // more likely to be an unset column than a deliberate instruction to discard everything.
+        MaxBytes: typeof cap === 'number' && cap > 0 ? cap : null,
+    };
+}
+/**
+ * Choose which candidates to keep, and record why the rest were dropped.
+ *
+ * EVERY EXCLUSION IS REPORTED. Silently dropping a 30MB signed contract because it exceeded a cap is
+ * the failure this whole package keeps being written against: the sync reports success, the activity
+ * is filed, and the thing someone actually wanted is missing with nothing to show it ever existed.
+ *
+ * INLINE ATTACHMENTS ARE DROPPED BY DEFAULT. They are body furniture — signature logos, tracking
+ * pixels, embedded screenshots already visible in the body text — and `ActivityFile.Kind` has a
+ * separate `Body` for the body itself. Keeping them would fill file storage with corporate logos,
+ * one copy per email. They are still reported, so a deployment that wants them can see what it is
+ * missing rather than wonder.
+ */
+export function SelectAttachments(candidates, policy) {
+    const selection = { Keep: [], Skipped: [] };
+    if (!policy.Fetch)
+        return selection;
+    for (const candidate of candidates) {
+        if (candidate.IsInline === true) {
+            selection.Skipped.push({ Filename: candidate.Filename, Size: candidate.Size, Reason: 'inline' });
+            continue;
+        }
+        // A missing or nonsensical size with a cap in force cannot be checked. Keeping it would let
+        // exactly the oversize file the cap exists to stop through the one gap in the check.
+        if (policy.MaxBytes !== null && !(typeof candidate.Size === 'number' && candidate.Size >= 0)) {
+            selection.Skipped.push({ Filename: candidate.Filename, Size: -1, Reason: 'no-size' });
+            continue;
+        }
+        if (policy.MaxBytes !== null && candidate.Size > policy.MaxBytes) {
+            selection.Skipped.push({ Filename: candidate.Filename, Size: candidate.Size, Reason: 'too-large' });
+            continue;
+        }
+        selection.Keep.push(candidate);
+    }
+    return selection;
+}
+/**
+ * The human-readable account of what was dropped, or null when nothing was.
+ *
+ * One line per reason rather than per file: a message with forty inline logos should not produce
+ * forty issues and bury the one that says a contract was too large.
+ */
+export function AttachmentSkipReport(externalID, selection) {
+    if (selection.Skipped.length === 0)
+        return null;
+    const byReason = new Map();
+    for (const s of selection.Skipped) {
+        const list = byReason.get(s.Reason) ?? [];
+        list.push(s.Filename);
+        byReason.set(s.Reason, list);
+    }
+    const phrases = [];
+    const inline = byReason.get('inline');
+    if (inline)
+        phrases.push(`${inline.length} inline (body images, not filed as attachments)`);
+    const large = byReason.get('too-large');
+    if (large)
+        phrases.push(`${large.length} over the size cap: ${large.join(', ')}`);
+    const noSize = byReason.get('no-size');
+    if (noSize)
+        phrases.push(`${noSize.length} of unknown size, skipped because a cap is in force: ${noSize.join(', ')}`);
+    return `Message ${externalID}: attachments not stored — ${phrases.join('; ')}.`;
+}
+/**
+ * Where attachment bytes go.
+ *
+ * A SEAM, NOT AN IMPLEMENTATION, and for the same reason the transport is one: storing a file means
+ * MJ's `FileStorageEngine` plus a configured `FileStorageAccount`, and a host that syncs only
+ * metadata should need neither. The host that has them registers a sink; one that has not gets a
+ * reported refusal rather than activities quietly filed without the attachments their rule asked for.
+ *
+ * `ActivityFile` holds a `FileID` — a foreign key into `__mj.File` — not the bytes. So an
+ * implementation's job is to put the bytes wherever this deployment keeps files, create the `File`
+ * row, and hand back its id for linking.
+ */
+/**
+ * The sink this host stores attachment bytes through, if it has one.
+ *
+ * ── WHY A REGISTRY AND NOT ONLY A CONSTRUCTOR ARGUMENT ──────────────────────────────────────────
+ *
+ * `ActivitySyncEngine` takes a sink as its fourth constructor parameter, and the only production
+ * construction is `new ActivitySyncEngine()` with no arguments — in `sync-activities.action.ts`,
+ * which an Action framework calls, so there is nowhere for a host to pass one. A host that
+ * implemented `ActivityFileSink` exactly as documented had no supported way to hand it over, and
+ * `Store()` therefore had no caller on any real path.
+ *
+ * That is the same shape as the defects this package was just fixed for: a seam described in detail,
+ * exported, and reachable only through a door nothing opens. It needed the treatment
+ * `RegisterActivityTransportFactory` already gives the transport — a host registers once at
+ * bootstrap, and the engine asks.
+ *
+ * A sink passed to the CONSTRUCTOR still wins, for the same reason it does there: tests and the demo
+ * supply their own, and a process-wide registration must not reach in and replace it.
+ */
+let hostFileSink = null;
+/**
+ * Register the sink this host stores attachment bytes through. Pass null to clear it.
+ *
+ * Idempotent and last-call-wins, matching the transport factory: a host that boots twice in one
+ * process must not end up with two, and there is no sensible way to merge them.
+ */
+export function RegisterActivityFileSink(sink) {
+    hostFileSink = sink;
+}
+/** The registered sink, or null when this host stores no attachment bytes. */
+export function HostActivityFileSink() {
+    return hostFileSink;
+}
+//# sourceMappingURL=attachments.js.map

package/dist/attachments.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attachments.js","sourceRoot":"","sources":["../src/attachments.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAiCH;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAC/B,IAA6C,EAC7C,IAAkC;IAElC,MAAM,MAAM,GAAG,IAAI,EAAE,kBAAkB,KAAK,IAAI,CAAC;IACjD,oFAAoF;IACpF,MAAM,KAAK,GAAG,MAAM,IAAI,IAAI,EAAE,cAAc,KAAK,IAAI,CAAC;IACtD,MAAM,GAAG,GAAG,IAAI,EAAE,kBAAkB,CAAC;IACrC,OAAO;QACH,KAAK,EAAE,KAAK;QACZ,0FAA0F;QAC1F,yFAAyF;QACzF,QAAQ,EAAE,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI;KAC5D,CAAC;AACN,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,iBAAiB,CAC7B,UAA0C,EAC1C,MAAwB;IAExB,MAAM,SAAS,GAAwB,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACjE,IAAI,CAAC,MAAM,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAEpC,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACjC,IAAI,SAAS,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;YAC9B,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;YACjG,SAAS;QACb,CAAC;QACD,4FAA4F;QAC5F,qFAAqF;QACrF,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,IAAI,CAAC,CAAC,OAAO,SAAS,CAAC,IAAI,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,IAAI,CAAC,CAAC,EAAE,CAAC;YAC3F,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;YACtF,SAAS;QACb,CAAC;QACD,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,IAAI,SAAS,CAAC,IAAI,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;YAC/D,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;YACpG,SAAS;QACb,CAAC;QACD,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,SAAS,CAAC;AACrB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAChC,UAAkB,EAClB,SAA8B;IAE9B,IAAI,SAAS,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEhD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkC,CAAC;IAC3D,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAC1C,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QACtB,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACjC,CAAC;IAED,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,MAAM;QAAE,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,iDAAiD,CAAC,CAAC;IAC5F,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACxC,IAAI,KAAK;QAAE,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,uBAAuB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAClF,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACvC,IAAI,MAAM;QAAE,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,wDAAwD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEtH,OAAO,WAAW,UAAU,8BAA8B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;AACpF,CAAC;AAED;;;;;;;;;;;GAWG;AACH;;;;;;;;;;;;;;;;;;GAkBG;AACH,IAAI,YAAY,GAA4B,IAAI,CAAC;AAEjD;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAA6B;IAClE,YAAY,GAAG,IAAI,CAAC;AACxB,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,oBAAoB;IAChC,OAAO,YAAY,CAAC;AACxB,CAAC"}

package/dist/index.d.ts

@@ -11,6 +11,7 @@ export * from './types.js';
 export * from './watermark.js';
 export * from './qualification.js';
 export * from './participants.js';
+export * from './attachments.js';
 export * from './run.js';
 export * from './BaseActivitySyncProvider.js';
 export * from './BaseActivitySyncExtension.js';
@@ -28,5 +29,6 @@ export * from './providers/MSGraphCalendarSyncProvider.js';
 export * from './providers/GraphMessageMapper.js';
 export * from './providers/MessageTransport.js';
 export * from './providers/GraphCommunicationTransport.js';
+export * from './providers/GraphCalendarTransport.js';
 export * from './providers/RecordedMessageTransport.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,cAAc,YAAY,CAAC;AAC3B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,oBAAoB,CAAC;AACnC,cAAc,mBAAmB,CAAC;AAClC,cAAc,UAAU,CAAC;AACzB,cAAc,+BAA+B,CAAC;AAC9C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,mBAAmB,CAAC;AAClC,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,yBAAyB,CAAC;AACxC,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,4CAA4C,CAAC;AAC3D,cAAc,4CAA4C,CAAC;AAC3D,cAAc,4CAA4C,CAAC;AAC3D,cAAc,mCAAmC,CAAC;AAClD,cAAc,iCAAiC,CAAC;AAChD,cAAc,4CAA4C,CAAC;AAC3D,cAAc,yCAAyC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,cAAc,YAAY,CAAC;AAC3B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,oBAAoB,CAAC;AACnC,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,UAAU,CAAC;AACzB,cAAc,+BAA+B,CAAC;AAC9C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,mBAAmB,CAAC;AAClC,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,yBAAyB,CAAC;AACxC,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,4CAA4C,CAAC;AAC3D,cAAc,4CAA4C,CAAC;AAC3D,cAAc,4CAA4C,CAAC;AAC3D,cAAc,mCAAmC,CAAC;AAClD,cAAc,iCAAiC,CAAC;AAChD,cAAc,4CAA4C,CAAC;AAC3D,cAAc,uCAAuC,CAAC;AACtD,cAAc,yCAAyC,CAAC"}

package/dist/index.js

@@ -11,6 +11,7 @@ export * from './types.js';
 export * from './watermark.js';
 export * from './qualification.js';
 export * from './participants.js';
+export * from './attachments.js';
 export * from './run.js';
 export * from './BaseActivitySyncProvider.js';
 export * from './BaseActivitySyncExtension.js';
@@ -28,5 +29,6 @@ export * from './providers/MSGraphCalendarSyncProvider.js';
 export * from './providers/GraphMessageMapper.js';
 export * from './providers/MessageTransport.js';
 export * from './providers/GraphCommunicationTransport.js';
+export * from './providers/GraphCalendarTransport.js';
 export * from './providers/RecordedMessageTransport.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,cAAc,YAAY,CAAC;AAC3B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,oBAAoB,CAAC;AACnC,cAAc,mBAAmB,CAAC;AAClC,cAAc,UAAU,CAAC;AACzB,cAAc,+BAA+B,CAAC;AAC9C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,mBAAmB,CAAC;AAClC,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,yBAAyB,CAAC;AACxC,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,4CAA4C,CAAC;AAC3D,cAAc,4CAA4C,CAAC;AAC3D,cAAc,4CAA4C,CAAC;AAC3D,cAAc,mCAAmC,CAAC;AAClD,cAAc,iCAAiC,CAAC;AAChD,cAAc,4CAA4C,CAAC;AAC3D,cAAc,yCAAyC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,cAAc,YAAY,CAAC;AAC3B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,oBAAoB,CAAC;AACnC,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,UAAU,CAAC;AACzB,cAAc,+BAA+B,CAAC;AAC9C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,mBAAmB,CAAC;AAClC,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,yBAAyB,CAAC;AACxC,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,4CAA4C,CAAC;AAC3D,cAAc,4CAA4C,CAAC;AAC3D,cAAc,4CAA4C,CAAC;AAC3D,cAAc,mCAAmC,CAAC;AAClD,cAAc,iCAAiC,CAAC;AAChD,cAAc,4CAA4C,CAAC;AAC3D,cAAc,uCAAuC,CAAC;AACtD,cAAc,yCAAyC,CAAC"}

package/dist/participants.d.ts

@@ -44,4 +44,34 @@ export declare function DomainOf(address: string): string | null;
  * `Unknown` sides with external throughout, per the reasoning on {@link ClassifyParticipants}.
  */
 export declare function MatchesParticipantScope(scope: ParticipantScope, c: ParticipantComposition): boolean;
+/**
+ * What `ActivitySyncRuleSet.InternalDomains` holds, parsed.
+ *
+ * The column documents itself as "Required for any rule using ParticipantScope" and stores a JSON
+ * array, e.g. `["bluecypress.io"]`. Nothing read it until now — the engine passed a hard-coded empty
+ * list — so every participant classified as External and every participant rule silently inverted.
+ *
+ * A parse failure is NOT degraded to an empty list. Empty is the dangerous value here: it makes
+ * `HasExternal` match the purely internal chatter it exists to exclude. "Internal" is a property of
+ * the deployment, so guessing it is worse than refusing to run.
+ */
+export type InternalDomainsParse = {
+    Ok: true;
+    Domains: string[];
+} | {
+    Ok: false;
+    Issue: string;
+};
+/** Parse one rule set's `InternalDomains`. Blank and null are legitimately "none declared". */
+export declare function ParseInternalDomains(raw: string | null | undefined, ruleSetName: string): InternalDomainsParse;
+/**
+ * The warning for rules that test participants when no domain list exists.
+ *
+ * Returns null when there is nothing to say. This is a WARNING rather than a refusal because the run
+ * is still meaningful — the rules simply do not filter the way they read, and saying so is the
+ * difference between a surprising sync and an inexplicable one.
+ */
+export declare function ParticipantScopeWarning(rules: readonly {
+    ParticipantScope?: string | null;
+}[], internalDomains: readonly string[]): string | null;
 //# sourceMappingURL=participants.d.ts.map

package/dist/participants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"participants.d.ts","sourceRoot":"","sources":["../src/participants.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD;;;;;;;GAOG;AACH,MAAM,MAAM,gBAAgB,GACtB,KAAK,GACL,aAAa,GACb,aAAa,GACb,aAAa,GACb,aAAa,GACb,OAAO,CAAC;AAEd,oFAAoF;AACpF,MAAM,WAAW,sBAAsB;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,iFAAiF;IACjF,OAAO,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAChC,YAAY,EAAE,SAAS,eAAe,EAAE,EACxC,eAAe,EAAE,SAAS,MAAM,EAAE,GACnC,sBAAsB,CAexB;AAED,gFAAgF;AAChF,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAOvD;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,gBAAgB,EAAE,CAAC,EAAE,sBAAsB,GAAG,OAAO,CAgBnG"}
+{"version":3,"file":"participants.d.ts","sourceRoot":"","sources":["../src/participants.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD;;;;;;;GAOG;AACH,MAAM,MAAM,gBAAgB,GACtB,KAAK,GACL,aAAa,GACb,aAAa,GACb,aAAa,GACb,aAAa,GACb,OAAO,CAAC;AAEd,oFAAoF;AACpF,MAAM,WAAW,sBAAsB;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,iFAAiF;IACjF,OAAO,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAChC,YAAY,EAAE,SAAS,eAAe,EAAE,EACxC,eAAe,EAAE,SAAS,MAAM,EAAE,GACnC,sBAAsB,CAexB;AAED,gFAAgF;AAChF,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAOvD;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,gBAAgB,EAAE,CAAC,EAAE,sBAAsB,GAAG,OAAO,CAgBnG;AAED;;;;;;;;;;GAUG;AACH,MAAM,MAAM,oBAAoB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAElG,+FAA+F;AAC/F,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,WAAW,EAAE,MAAM,GAAG,oBAAoB,CA2B9G;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CACnC,KAAK,EAAE,SAAS;IAAE,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,EAAE,EACtD,eAAe,EAAE,SAAS,MAAM,EAAE,GACnC,MAAM,GAAG,IAAI,CASf"}

package/dist/participants.js

@@ -56,4 +56,52 @@ export function MatchesParticipantScope(scope, c) {
             return c.Internal > 0 && external > 0;
     }
 }
+/** Parse one rule set's `InternalDomains`. Blank and null are legitimately "none declared". */
+export function ParseInternalDomains(raw, ruleSetName) {
+    const text = (raw ?? '').trim();
+    if (!text)
+        return { Ok: true, Domains: [] };
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        return {
+            Ok: false,
+            Issue: `Rule set "${ruleSetName}" has InternalDomains that is not valid JSON. Expected an array like ["bluecypress.io"].`,
+        };
+    }
+    if (!Array.isArray(parsed)) {
+        return {
+            Ok: false,
+            Issue: `Rule set "${ruleSetName}" has InternalDomains that is not a JSON array. Expected e.g. ["bluecypress.io"].`,
+        };
+    }
+    const domains = [];
+    for (const entry of parsed) {
+        // Normalised exactly as ClassifyParticipants normalises what it compares against, so a list
+        // written "@Bluecypress.IO" still matches an address at bluecypress.io.
+        const d = String(entry ?? '').trim().toLowerCase().replace(/^@/, '');
+        if (d && !domains.includes(d))
+            domains.push(d);
+    }
+    return { Ok: true, Domains: domains };
+}
+/**
+ * The warning for rules that test participants when no domain list exists.
+ *
+ * Returns null when there is nothing to say. This is a WARNING rather than a refusal because the run
+ * is still meaningful — the rules simply do not filter the way they read, and saying so is the
+ * difference between a surprising sync and an inexplicable one.
+ */
+export function ParticipantScopeWarning(rules, internalDomains) {
+    if (internalDomains.length > 0)
+        return null;
+    const scoped = rules.filter((r) => r.ParticipantScope && r.ParticipantScope !== 'Any');
+    if (scoped.length === 0)
+        return null;
+    return (`${scoped.length} rule(s) test ParticipantScope, but no bound rule set defines InternalDomains. ` +
+        'Every participant therefore counts as External, so those rules do not filter what they appear ' +
+        'to. Set InternalDomains on the rule set.');
+}
 //# sourceMappingURL=participants.js.map

package/dist/participants.js.map

@@ -1 +1 @@
-{"version":3,"file":"participants.js","sourceRoot":"","sources":["../src/participants.ts"],"names":[],"mappings":"AAoCA;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAChC,YAAwC,EACxC,eAAkC;IAElC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9F,MAAM,WAAW,GAA2B,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IAErF,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QAC7C,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YAClB,WAAW,CAAC,OAAO,EAAE,CAAC;QAC1B,CAAC;aAAM,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC7B,WAAW,CAAC,QAAQ,EAAE,CAAC;QAC3B,CAAC;aAAM,CAAC;YACJ,WAAW,CAAC,QAAQ,EAAE,CAAC;QAC3B,CAAC;IACL,CAAC;IACD,OAAO,WAAW,CAAC;AACvB,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,QAAQ,CAAC,OAAe;IACpC,MAAM,EAAE,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtC,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC1D,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAuB,EAAE,CAAyB;IACtF,MAAM,QAAQ,GAAG,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,OAAO,CAAC;IACxC,QAAQ,KAAK,EAAE,CAAC;QACZ,KAAK,KAAK;YACN,OAAO,IAAI,CAAC;QAChB,KAAK,aAAa;YACd,OAAO,CAAC,CAAC,QAAQ,GAAG,CAAC,IAAI,QAAQ,KAAK,CAAC,CAAC;QAC5C,KAAK,aAAa;YACd,OAAO,QAAQ,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC;QAC5C,KAAK,aAAa;YACd,OAAO,QAAQ,GAAG,CAAC,CAAC;QACxB,KAAK,aAAa;YACd,OAAO,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC;QAC1B,KAAK,OAAO;YACR,OAAO,CAAC,CAAC,QAAQ,GAAG,CAAC,IAAI,QAAQ,GAAG,CAAC,CAAC;IAC9C,CAAC;AACL,CAAC"}
+{"version":3,"file":"participants.js","sourceRoot":"","sources":["../src/participants.ts"],"names":[],"mappings":"AAoCA;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAChC,YAAwC,EACxC,eAAkC;IAElC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9F,MAAM,WAAW,GAA2B,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IAErF,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QAC7C,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YAClB,WAAW,CAAC,OAAO,EAAE,CAAC;QAC1B,CAAC;aAAM,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC7B,WAAW,CAAC,QAAQ,EAAE,CAAC;QAC3B,CAAC;aAAM,CAAC;YACJ,WAAW,CAAC,QAAQ,EAAE,CAAC;QAC3B,CAAC;IACL,CAAC;IACD,OAAO,WAAW,CAAC;AACvB,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,QAAQ,CAAC,OAAe;IACpC,MAAM,EAAE,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtC,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC1D,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAuB,EAAE,CAAyB;IACtF,MAAM,QAAQ,GAAG,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,OAAO,CAAC;IACxC,QAAQ,KAAK,EAAE,CAAC;QACZ,KAAK,KAAK;YACN,OAAO,IAAI,CAAC;QAChB,KAAK,aAAa;YACd,OAAO,CAAC,CAAC,QAAQ,GAAG,CAAC,IAAI,QAAQ,KAAK,CAAC,CAAC;QAC5C,KAAK,aAAa;YACd,OAAO,QAAQ,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC;QAC5C,KAAK,aAAa;YACd,OAAO,QAAQ,GAAG,CAAC,CAAC;QACxB,KAAK,aAAa;YACd,OAAO,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC;QAC1B,KAAK,OAAO;YACR,OAAO,CAAC,CAAC,QAAQ,GAAG,CAAC,IAAI,QAAQ,GAAG,CAAC,CAAC;IAC9C,CAAC;AACL,CAAC;AAeD,+FAA+F;AAC/F,MAAM,UAAU,oBAAoB,CAAC,GAA8B,EAAE,WAAmB;IACpF,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAChC,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAE5C,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACD,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACL,OAAO;YACH,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,aAAa,WAAW,0FAA0F;SAC5H,CAAC;IACN,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACzB,OAAO;YACH,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,aAAa,WAAW,mFAAmF;SACrH,CAAC;IACN,CAAC;IACD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QACzB,4FAA4F;QAC5F,wEAAwE;QACxE,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACrE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAC1C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CACnC,KAAsD,EACtD,eAAkC;IAElC,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,gBAAgB,IAAI,CAAC,CAAC,gBAAgB,KAAK,KAAK,CAAC,CAAC;IACvF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,CACH,GAAG,MAAM,CAAC,MAAM,iFAAiF;QACjG,gGAAgG;QAChG,0CAA0C,CAC7C,CAAC;AACN,CAAC"}

package/dist/providers/GraphCalendarTransport.d.ts

@@ -0,0 +1,115 @@
+/**
+ * The live calendar transport: MJ's Communication MS Graph provider, with credentials from MJ's
+ * Credentials engine.
+ *
+ * WRAPS, DOES NOT REIMPLEMENT — and until recently there was nothing to wrap. `MSGraphProvider` could
+ * send, read, reply, forward, draft, move, archive, search and subscribe, and had no calendar API at
+ * all, while the piece that would have made one possible (`getGraphClient`, which owns token
+ * acquisition and the credential-keyed client cache) is private. Building a client here would have
+ * forked exactly the behaviour `BaseActivitySyncProvider` says to wrap. So calendar retrieval was
+ * added to MJ first and this wraps it.
+ *
+ * WHY IT READS SourceData RATHER THAN Events. `GetEventsResult.Events` is MJ's normalized shape and
+ * is deliberately thin; `MapGraphEvent` in this package is written against Graph's own `event`
+ * resource and reads fields the normalized form drops (`iCalUId`, attendee `type`, `bodyPreview`
+ * nuances). `SourceData` carries the payload verbatim, which is what `NormalizedItem.Raw` is meant to
+ * preserve. Same choice, for the same reason, as the message transport.
+ *
+ * THE CREDENTIAL IS NEVER HELD. Resolved per fetch and passed straight into the call. `clientSecret`
+ * is flagged `isSecret` on the "Azure Service Principal" credential type, so MJ decrypts it at load
+ * and it lives only for the duration of the request. Never logged, never cached on this object,
+ * never interpolated into an issue string.
+ *
+ * @module @mj-biz-apps/common-activity-sync
+ */
+import type { BaseCommunicationProvider } from '@memberjunction/communication-types';
+import type { UserInfo } from '@memberjunction/core';
+import type { ActivitySourceQuery, RawBatch } from '../types.js';
+import type { ActivityMessageTransport } from './MessageTransport.js';
+import { type GraphServicePrincipal } from './GraphCommunicationTransport.js';
+/**
+ * How far back a FIRST run reaches when the connection has no calendar watermark.
+ *
+ * A bound is required rather than optional: `/calendarView` refuses a request without one, and the
+ * alternative endpoint returns series masters instead of occurrences. Thirty days is a starting
+ * point, not a rule — it is a constructor argument, and a run that falls back to it says so in its
+ * issues rather than letting an operator believe the whole calendar was read.
+ */
+export declare const DEFAULT_FIRST_RUN_LOOKBACK_DAYS = 30;
+/**
+ * How far FORWARD a read reaches.
+ *
+ * Not zero, deliberately. `Activity.Status` includes `Scheduled`, so a meeting that has not happened
+ * yet is a thing this schema models, and a calendar sync that only ever looked backwards could not
+ * produce one.
+ */
+export declare const DEFAULT_FORWARD_HORIZON_DAYS = 30;
+/** The slice of MJ's communication provider this uses. Structural, to avoid a hard runtime import. */
+export interface GraphEventReader {
+    GetEvents(params: {
+        Identifier?: string;
+        NumEvents: number;
+        StartDateTime?: Date;
+        EndDateTime?: Date;
+        IncludeCancelled?: boolean;
+        ContextData?: Record<string, unknown>;
+    }, credentials?: unknown): Promise<{
+        Success: boolean;
+        Events?: unknown[];
+        SourceData?: unknown[];
+        ErrorMessage?: string;
+        RecurrenceExpanded?: boolean;
+    }>;
+}
+/**
+ * COMPILE-TIME PROOF THAT THE STRUCTURAL TYPE ABOVE IS NOT FICTION.
+ *
+ * Declared structurally so this package takes no runtime dependency on the Communication engine. The
+ * cost of that is that nothing checks the shape against MJ: the only value ever assigned to it in
+ * tests is a stub, and a stub cast with `as unknown as` bypasses checking entirely. Drift in MJ's
+ * `GetEvents` would then surface on the FIRST LIVE CALL and nowhere earlier.
+ *
+ * So the compiler checks it instead. `@memberjunction/communication-types` is already a declared peer
+ * and this is a TYPE-only import, so no runtime dependency is added and these lines emit no
+ * JavaScript. If MJ changes the signature, the BUILD breaks here rather than a live sync.
+ */
+type AssertTrue<T extends true> = T;
+export type GraphEventReaderMatchesMJ = AssertTrue<BaseCommunicationProvider extends GraphEventReader ? true : false>;
+/** How the two collaborators are obtained. Injected, so neither engine is a runtime dependency. */
+export interface GraphCalendarTransportDeps {
+    ResolveCredential(): Promise<GraphServicePrincipal>;
+    ResolveProvider(): Promise<GraphEventReader>;
+    ContextUser?: UserInfo;
+}
+export declare class GraphCalendarTransport implements ActivityMessageTransport {
+    private readonly Deps;
+    private readonly LookbackDays;
+    private readonly ForwardDays;
+    /** Injectable so a test can pin the window without freezing global time. */
+    private readonly Now;
+    readonly Describe = "Microsoft Graph calendar (live, via MJ Communication)";
+    readonly IsLive = true;
+    constructor(Deps: GraphCalendarTransportDeps, LookbackDays?: number, ForwardDays?: number, 
+    /** Injectable so a test can pin the window without freezing global time. */
+    Now?: () => Date);
+    Fetch(query: ActivitySourceQuery): Promise<RawBatch>;
+}
+/**
+ * Build the deps from MJ's engines, resolving both lazily.
+ *
+ * Separate from the class so the class stays testable with neither engine loaded — the tests inject
+ * their own deps, which is also how a recorded run avoids dragging the Credentials engine into a
+ * replay that has no credential to resolve.
+ */
+export declare function MJGraphCalendarTransportDeps(args: {
+    CredentialName: string;
+    ContextUser?: UserInfo;
+    GetCredentialEngine: () => {
+        getCredential<T>(name: string, options?: Record<string, unknown>): Promise<{
+            values: T;
+        }>;
+    };
+    GetCommunicationProvider: (name: string) => GraphEventReader | null | undefined;
+}): GraphCalendarTransportDeps;
+export {};
+//# sourceMappingURL=GraphCalendarTransport.d.ts.map

package/dist/providers/GraphCalendarTransport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"GraphCalendarTransport.d.ts","sourceRoot":"","sources":["../../src/providers/GraphCalendarTransport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,qCAAqC,CAAC;AACrF,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAErD,OAAO,KAAK,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAGtE,OAAO,EAGH,KAAK,qBAAqB,EAC7B,MAAM,kCAAkC,CAAC;AAE1C;;;;;;;GAOG;AACH,eAAO,MAAM,+BAA+B,KAAK,CAAC;AAElD;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,KAAK,CAAC;AAE/C,sGAAsG;AACtG,MAAM,WAAW,gBAAgB;IAC7B,SAAS,CACL,MAAM,EAAE;QACJ,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,SAAS,EAAE,MAAM,CAAC;QAClB,aAAa,CAAC,EAAE,IAAI,CAAC;QACrB,WAAW,CAAC,EAAE,IAAI,CAAC;QACnB,gBAAgB,CAAC,EAAE,OAAO,CAAC;QAC3B,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACzC,EACD,WAAW,CAAC,EAAE,OAAO,GACtB,OAAO,CAAC;QACP,OAAO,EAAE,OAAO,CAAC;QACjB,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC;QACnB,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC;QACvB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,kBAAkB,CAAC,EAAE,OAAO,CAAC;KAChC,CAAC,CAAC;CACN;AAED;;;;;;;;;;;GAWG;AACH,KAAK,UAAU,CAAC,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC;AACpC,MAAM,MAAM,yBAAyB,GAAG,UAAU,CAC9C,yBAAyB,SAAS,gBAAgB,GAAG,IAAI,GAAG,KAAK,CACpE,CAAC;AAEF,mGAAmG;AACnG,MAAM,WAAW,0BAA0B;IACvC,iBAAiB,IAAI,OAAO,CAAC,qBAAqB,CAAC,CAAC;IACpD,eAAe,IAAI,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC7C,WAAW,CAAC,EAAE,QAAQ,CAAC;CAC1B;AAED,qBAAa,sBAAuB,YAAW,wBAAwB;IAK/D,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,4EAA4E;IAC5E,OAAO,CAAC,QAAQ,CAAC,GAAG;IARxB,SAAgB,QAAQ,2DAA2D;IACnF,SAAgB,MAAM,QAAQ;gBAGT,IAAI,EAAE,0BAA0B,EAChC,YAAY,GAAE,MAAwC,EACtD,WAAW,GAAE,MAAqC;IACnE,4EAA4E;IAC3D,GAAG,GAAE,MAAM,IAAuB;IAG1C,KAAK,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,QAAQ,CAAC;CAkGpE;AAED;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAAC,IAAI,EAAE;IAC/C,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,QAAQ,CAAC;IACvB,mBAAmB,EAAE,MAAM;QACvB,aAAa,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC;YAAE,MAAM,EAAE,CAAC,CAAA;SAAE,CAAC,CAAC;KAC7F,CAAC;IACF,wBAAwB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,gBAAgB,GAAG,IAAI,GAAG,SAAS,CAAC;CACnF,GAAG,0BAA0B,CAyB7B"}

package/dist/providers/GraphCalendarTransport.js

@@ -0,0 +1,139 @@
+// Reused, not redeclared: mail and calendar reach the SAME MJ provider under the same registration
+// name and resolve the SAME credential type. Two copies could drift into naming different things.
+import { GRAPH_COMMUNICATION_PROVIDER, GRAPH_CREDENTIAL_TYPE, } from './GraphCommunicationTransport.js';
+/**
+ * How far back a FIRST run reaches when the connection has no calendar watermark.
+ *
+ * A bound is required rather than optional: `/calendarView` refuses a request without one, and the
+ * alternative endpoint returns series masters instead of occurrences. Thirty days is a starting
+ * point, not a rule — it is a constructor argument, and a run that falls back to it says so in its
+ * issues rather than letting an operator believe the whole calendar was read.
+ */
+export const DEFAULT_FIRST_RUN_LOOKBACK_DAYS = 30;
+/**
+ * How far FORWARD a read reaches.
+ *
+ * Not zero, deliberately. `Activity.Status` includes `Scheduled`, so a meeting that has not happened
+ * yet is a thing this schema models, and a calendar sync that only ever looked backwards could not
+ * produce one.
+ */
+export const DEFAULT_FORWARD_HORIZON_DAYS = 30;
+export class GraphCalendarTransport {
+    constructor(Deps, LookbackDays = DEFAULT_FIRST_RUN_LOOKBACK_DAYS, ForwardDays = DEFAULT_FORWARD_HORIZON_DAYS, 
+    /** Injectable so a test can pin the window without freezing global time. */
+    Now = () => new Date()) {
+        this.Deps = Deps;
+        this.LookbackDays = LookbackDays;
+        this.ForwardDays = ForwardDays;
+        this.Now = Now;
+        this.Describe = 'Microsoft Graph calendar (live, via MJ Communication)';
+        this.IsLive = true;
+    }
+    async Fetch(query) {
+        const issues = [];
+        const credential = await this.Deps.ResolveCredential();
+        const missing = ['tenantId', 'clientId', 'clientSecret'].filter((k) => !String(credential?.[k] ?? '').trim());
+        if (missing.length > 0) {
+            // Field NAMES are reported, never values. The names are what an operator needs in order
+            // to fix it, and one of the values is a secret.
+            throw new Error(`The "${GRAPH_CREDENTIAL_TYPE}" credential is missing required field(s): ${missing.join(', ')}. ` +
+                'Complete it in MJ before enabling live fetch.');
+        }
+        const now = this.Now();
+        /**
+         * THE WINDOW IS ROLLING, AND DELIBERATELY IGNORES THE WATERMARK.
+         *
+         * `WatermarkBasisForKind('Calendar')` is `ObservationTime` — for a calendar the watermark
+         * records WHEN WE LAST LOOKED, not how far through the data we got. That basis is correct and
+         * the reason is in its own docblock: a meeting can be dated in the future, so an item-time
+         * watermark would skip straight past anything scheduled earlier than the newest thing seen.
+         *
+         * This used to pass that same value as `StartDateTime`, which filters on the EVENT'S OWN time.
+         * The two are different quantities and using one as the other loses data silently: run 1 at T0
+         * sets the watermark to T0, and a meeting that took place last week but is added to the
+         * calendar tomorrow starts before T0, so it falls outside run 2's window — and outside every
+         * later window, since each one starts later still. It is never read, on any run, with no issue
+         * raised and `Success = true`. Retroactive additions and back-dated invitations are ordinary
+         * calendar behaviour, not an edge case.
+         *
+         * So the window is always `[now - LookbackDays, now + ForwardDays]` and the same events are
+         * re-read every run. That is not waste: de-duplication is by `ExternalID` in the writer, so a
+         * re-read costs one lookup and writes nothing, while a missed event is unrecoverable.
+         */
+        const start = new Date(now.getTime() - this.LookbackDays * 86_400_000);
+        const end = new Date(now.getTime() + this.ForwardDays * 86_400_000);
+        if (!query.Since) {
+            // Said out loud on the FIRST run only, because that is when someone expects full history.
+            // On later runs the same bound applies and saying so every time would be noise.
+            issues.push(`First calendar run for ${query.Mailbox}: the window starts ${this.LookbackDays} days ` +
+                `back (${start.toISOString()}). Anything older was not read.`);
+        }
+        const provider = await this.Deps.ResolveProvider();
+        const result = await provider.GetEvents({
+            Identifier: query.Mailbox,
+            NumEvents: query.Limit,
+            StartDateTime: start,
+            EndDateTime: end,
+            // A cancellation is a real thing that happened to a meeting somebody attended, and
+            // `MapGraphEvent` already carries `Cancelled` through to the Activity.
+            IncludeCancelled: true,
+        }, 
+        // Same MJ requirements as the message path, for the same reasons — see
+        // GraphCommunicationTransport: accountEmail is validated before any request and the
+        // credential type does not carry it, and disableEnvironmentFallback stops a gap being
+        // filled from AZURE_* on the host, which is the difference between failing on a missing
+        // field and reading a calendar nobody asked for.
+        { ...credential, accountEmail: query.Mailbox, disableEnvironmentFallback: true });
+        if (!result?.Success) {
+            throw new Error(result?.ErrorMessage?.trim() || `Graph returned no calendar result for mailbox "${query.Mailbox}".`);
+        }
+        // BOTH BOUNDS WERE SENT, so MJ should have expanded recurrence. If it says otherwise the
+        // payloads are series MASTERS, and one row would be filed for a weekly meeting at whatever
+        // date the series began. That is wrong in a way no downstream check would catch, because a
+        // master and an occurrence look alike.
+        if (result.RecurrenceExpanded === false) {
+            issues.push('Graph did not expand recurring series despite a bounded window, so repeating meetings ' +
+                'are represented by their series master rather than by occurrences. Times for those ' +
+                'will be the start of the series.');
+        }
+        const payloads = (result.SourceData ?? []);
+        const capped = payloads.length >= query.Limit;
+        if (capped) {
+            issues.push(`The calendar read hit its limit of ${query.Limit} events for ${query.Mailbox}; ` +
+                'the window may hold more than this pass returned.');
+        }
+        return { Payloads: payloads, Issues: issues, Capped: capped };
+    }
+}
+/**
+ * Build the deps from MJ's engines, resolving both lazily.
+ *
+ * Separate from the class so the class stays testable with neither engine loaded — the tests inject
+ * their own deps, which is also how a recorded run avoids dragging the Credentials engine into a
+ * replay that has no credential to resolve.
+ */
+export function MJGraphCalendarTransportDeps(args) {
+    return {
+        ContextUser: args.ContextUser,
+        async ResolveCredential() {
+            const resolved = await args
+                .GetCredentialEngine()
+                .getCredential(args.CredentialName, { contextUser: args.ContextUser });
+            if (!resolved?.values) {
+                throw new Error(`Credential "${args.CredentialName}" resolved with no values.`);
+            }
+            return resolved.values;
+        },
+        async ResolveProvider() {
+            const provider = args.GetCommunicationProvider(GRAPH_COMMUNICATION_PROVIDER);
+            if (!provider) {
+                // A REGISTRATION problem, not a credential one. Saying which keeps an operator from
+                // hunting for a secret that is present and correct.
+                throw new Error(`MJ communication provider "${GRAPH_COMMUNICATION_PROVIDER}" is not registered. ` +
+                    'Ensure @memberjunction/communication-ms-graph is loaded in this host.');
+            }
+            return provider;
+        },
+    };
+}
+//# sourceMappingURL=GraphCalendarTransport.js.map

package/dist/providers/GraphCalendarTransport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"GraphCalendarTransport.js","sourceRoot":"","sources":["../../src/providers/GraphCalendarTransport.ts"],"names":[],"mappings":"AA6BA,mGAAmG;AACnG,kGAAkG;AAClG,OAAO,EACH,4BAA4B,EAC5B,qBAAqB,GAExB,MAAM,kCAAkC,CAAC;AAE1C;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,EAAE,CAAC;AAElD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,EAAE,CAAC;AA+C/C,MAAM,OAAO,sBAAsB;IAI/B,YACqB,IAAgC,EAChC,eAAuB,+BAA+B,EACtD,cAAsB,4BAA4B;IACnE,4EAA4E;IAC3D,MAAkB,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE;QAJlC,SAAI,GAAJ,IAAI,CAA4B;QAChC,iBAAY,GAAZ,YAAY,CAA0C;QACtD,gBAAW,GAAX,WAAW,CAAuC;QAElD,QAAG,GAAH,GAAG,CAA+B;QARvC,aAAQ,GAAG,uDAAuD,CAAC;QACnE,WAAM,GAAG,IAAI,CAAC;IAQ3B,CAAC;IAEG,KAAK,CAAC,KAAK,CAAC,KAA0B;QACzC,MAAM,MAAM,GAAa,EAAE,CAAC;QAE5B,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvD,MAAM,OAAO,GAAI,CAAC,UAAU,EAAE,UAAU,EAAE,cAAc,CAAW,CAAC,MAAM,CACtE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAC/C,CAAC;QACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,wFAAwF;YACxF,gDAAgD;YAChD,MAAM,IAAI,KAAK,CACX,QAAQ,qBAAqB,8CAA8C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;gBAC7F,+CAA+C,CACtD,CAAC;QACN,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB;;;;;;;;;;;;;;;;;;;WAmBG;QACH,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,CAAC;QACvE,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,CAAC;QAEpE,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACf,0FAA0F;YAC1F,gFAAgF;YAChF,MAAM,CAAC,IAAI,CACP,0BAA0B,KAAK,CAAC,OAAO,uBAAuB,IAAI,CAAC,YAAY,QAAQ;gBACnF,SAAS,KAAK,CAAC,WAAW,EAAE,iCAAiC,CACpE,CAAC;QACN,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;QACnD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,SAAS,CACnC;YACI,UAAU,EAAE,KAAK,CAAC,OAAO;YACzB,SAAS,EAAE,KAAK,CAAC,KAAK;YACtB,aAAa,EAAE,KAAK;YACpB,WAAW,EAAE,GAAG;YAChB,mFAAmF;YACnF,uEAAuE;YACvE,gBAAgB,EAAE,IAAI;SACzB;QACD,uEAAuE;QACvE,oFAAoF;QACpF,sFAAsF;QACtF,wFAAwF;QACxF,iDAAiD;QACjD,EAAE,GAAG,UAAU,EAAE,YAAY,EAAE,KAAK,CAAC,OAAO,EAAE,0BAA0B,EAAE,IAAI,EAAE,CACnF,CAAC;QAEF,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CACX,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,kDAAkD,KAAK,CAAC,OAAO,IAAI,CACtG,CAAC;QACN,CAAC;QAED,yFAAyF;QACzF,2FAA2F;QAC3F,2FAA2F;QAC3F,uCAAuC;QACvC,IAAI,MAAM,CAAC,kBAAkB,KAAK,KAAK,EAAE,CAAC;YACtC,MAAM,CAAC,IAAI,CACP,wFAAwF;gBACpF,qFAAqF;gBACrF,kCAAkC,CACzC,CAAC;QACN,CAAC;QAED,MAAM,QAAQ,GAAG,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAA8B,CAAC;QAExE,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC;QAC9C,IAAI,MAAM,EAAE,CAAC;YACT,MAAM,CAAC,IAAI,CACP,sCAAsC,KAAK,CAAC,KAAK,eAAe,KAAK,CAAC,OAAO,IAAI;gBAC7E,mDAAmD,CAC1D,CAAC;QACN,CAAC;QAED,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAClE,CAAC;CACJ;AAED;;;;;;GAMG;AACH,MAAM,UAAU,4BAA4B,CAAC,IAO5C;IACG,OAAO;QACH,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,KAAK,CAAC,iBAAiB;YACnB,MAAM,QAAQ,GAAG,MAAM,IAAI;iBACtB,mBAAmB,EAAE;iBACrB,aAAa,CAAwB,IAAI,CAAC,cAAc,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;YAClG,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;gBACpB,MAAM,IAAI,KAAK,CAAC,eAAe,IAAI,CAAC,cAAc,4BAA4B,CAAC,CAAC;YACpF,CAAC;YACD,OAAO,QAAQ,CAAC,MAAM,CAAC;QAC3B,CAAC;QACD,KAAK,CAAC,eAAe;YACjB,MAAM,QAAQ,GAAG,IAAI,CAAC,wBAAwB,CAAC,4BAA4B,CAAC,CAAC;YAC7E,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACZ,oFAAoF;gBACpF,oDAAoD;gBACpD,MAAM,IAAI,KAAK,CACX,8BAA8B,4BAA4B,uBAAuB;oBAC7E,uEAAuE,CAC9E,CAAC;YACN,CAAC;YACD,OAAO,QAAQ,CAAC;QACpB,CAAC;KACJ,CAAC;AACN,CAAC"}

package/dist/providers/GraphCommunicationTransport.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"GraphCommunicationTransport.d.ts","sourceRoot":"","sources":["../../src/providers/GraphCommunicationTransport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,qCAAqC,CAAC;AACrF,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAErD,OAAO,KAAK,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAEtE;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,4BAA4B,CAAC;AAE/D,qGAAqG;AACrG,eAAO,MAAM,4BAA4B,oBAAoB,CAAC;AAE9D,8DAA8D;AAC9D,MAAM,WAAW,qBAAqB;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;CACxB;AAED,sGAAsG;AACtG,MAAM,WAAW,kBAAkB;IAC/B,WAAW,CACP,MAAM,EAAE;QACJ,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,WAAW,EAAE,MAAM,CAAC;QACpB,UAAU,CAAC,EAAE,OAAO,CAAC;QACrB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACzC,EACD,WAAW,CAAC,EAAE,OAAO,GACtB,OAAO,CAAC;QACP,OAAO,EAAE,OAAO,CAAC;QACjB,QAAQ,CAAC,EAAE,OAAO,EAAE,CAAC;QACrB,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC;QACvB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,cAAc,CAAC,EAAE,OAAO,CAAC;KAC5B,CAAC,CAAC;CACN;AAED;;;;;;;;;;;;;GAaG;AACH,KAAK,UAAU,CAAC,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC;AACpC,MAAM,MAAM,2BAA2B,GAAG,UAAU,CAChD,yBAAyB,SAAS,kBAAkB,GAAG,IAAI,GAAG,KAAK,CACtE,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,WAAW,kBAAkB;IAC/B,iBAAiB,IAAI,OAAO,CAAC,qBAAqB,CAAC,CAAC;IACpD,eAAe,IAAI,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC/C,WAAW,CAAC,EAAE,QAAQ,CAAC;CAC1B;AAED,qBAAa,2BAA4B,YAAW,wBAAwB;IAIrD,OAAO,CAAC,QAAQ,CAAC,IAAI;IAHxC,SAAgB,QAAQ,kDAAkD;IAC1E,SAAgB,MAAM,QAAQ;gBAEM,IAAI,EAAE,kBAAkB;IAE/C,KAAK,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,QAAQ,CAAC;CAoEpE;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE;IACvC,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,QAAQ,CAAC;IACvB,mBAAmB,EAAE,MAAM;QACvB,aAAa,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC;YAAE,MAAM,EAAE,CAAC,CAAA;SAAE,CAAC,CAAC;KAC7F,CAAC;IACF,wBAAwB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,kBAAkB,GAAG,IAAI,GAAG,SAAS,CAAC;CACrF,GAAG,kBAAkB,CAyBrB"}
+{"version":3,"file":"GraphCommunicationTransport.d.ts","sourceRoot":"","sources":["../../src/providers/GraphCommunicationTransport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,qCAAqC,CAAC;AACrF,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAErD,OAAO,KAAK,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAEtE;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,4BAA4B,CAAC;AAE/D,qGAAqG;AACrG,eAAO,MAAM,4BAA4B,oBAAoB,CAAC;AAE9D,8DAA8D;AAC9D,MAAM,WAAW,qBAAqB;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;CACxB;AAED,sGAAsG;AACtG,MAAM,WAAW,kBAAkB;IAC/B,WAAW,CACP,MAAM,EAAE;QACJ,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,WAAW,EAAE,MAAM,CAAC;QACpB,UAAU,CAAC,EAAE,OAAO,CAAC;QACrB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACzC,EACD,WAAW,CAAC,EAAE,OAAO,GACtB,OAAO,CAAC;QACP,OAAO,EAAE,OAAO,CAAC;QACjB,QAAQ,CAAC,EAAE,OAAO,EAAE,CAAC;QACrB,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC;QACvB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,cAAc,CAAC,EAAE,OAAO,CAAC;KAC5B,CAAC,CAAC;CACN;AAED;;;;;;;;;;;;;GAaG;AACH,KAAK,UAAU,CAAC,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC;AACpC,MAAM,MAAM,2BAA2B,GAAG,UAAU,CAChD,yBAAyB,SAAS,kBAAkB,GAAG,IAAI,GAAG,KAAK,CACtE,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,WAAW,kBAAkB;IAC/B,iBAAiB,IAAI,OAAO,CAAC,qBAAqB,CAAC,CAAC;IACpD,eAAe,IAAI,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC/C,WAAW,CAAC,EAAE,QAAQ,CAAC;CAC1B;AAED,qBAAa,2BAA4B,YAAW,wBAAwB;IAIrD,OAAO,CAAC,QAAQ,CAAC,IAAI;IAHxC,SAAgB,QAAQ,kDAAkD;IAC1E,SAAgB,MAAM,QAAQ;gBAEM,IAAI,EAAE,kBAAkB;IAE/C,KAAK,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,QAAQ,CAAC;CAkFpE;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE;IACvC,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,QAAQ,CAAC;IACvB,mBAAmB,EAAE,MAAM;QACvB,aAAa,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC;YAAE,MAAM,EAAE,CAAC,CAAA;SAAE,CAAC,CAAC;KAC7F,CAAC;IACF,wBAAwB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,kBAAkB,GAAG,IAAI,GAAG,SAAS,CAAC;CACrF,GAAG,kBAAkB,CAyBrB"}

package/dist/providers/GraphCommunicationTransport.js

@@ -53,11 +53,25 @@ export class GraphCommunicationTransport {
             throw new Error(result?.ErrorMessage?.trim() || `Graph returned no result for mailbox "${query.Mailbox}".`);
         }
         const payloads = (result.SourceData ?? []);
-        const capped = !!query.Since && payloads.length >= query.Limit;
+        // A FULL PAGE MEANS THERE MAY BE MORE, WATERMARK OR NOT.
+        //
+        // This used to require `query.Since`, which left the FIRST run — the one most likely to
+        // overflow a page — unprotected. No date bound is sent, so Graph returns the newest `Limit`
+        // messages; `BaseActivitySyncProvider` then computes a high watermark from them and the next
+        // run asks for everything AFTER the newest. Every message older than that first page is
+        // skipped permanently, and the run reports Success with no issue. A mailbox with more history
+        // than one page silently loses all of it.
+        //
+        // `Capped` also withholds the watermark upstream, which is what actually prevents the loss;
+        // the issue below is how anyone finds out a re-run is needed.
+        const capped = payloads.length >= query.Limit;
         if (capped) {
-            issues.push(`Fetched the maximum of ${query.Limit} message(s) for "${query.Mailbox}" while a watermark was set, ` +
-                'so older items may remain unread. Re-run to continue, or raise the limit. A server-side date ' +
-                'bound (MemberJunction/MJ#4123) removes this entirely.');
+            const context = query.Since
+                ? 'while a watermark was set, so older items may remain unread'
+                : 'on a FIRST run with no watermark, so anything older than this page has not been read';
+            issues.push(`Fetched the maximum of ${query.Limit} message(s) for "${query.Mailbox}" ${context}. ` +
+                'The watermark is being withheld so nothing is skipped — re-run to continue, or raise ' +
+                'the limit. A server-side date bound (MemberJunction/MJ#4123) removes this entirely.');
         }
         // `Capped` is what actually protects the mail; the issue above only TELLS someone. Without
         // it the watermark advanced to the newest item in a truncated batch and the remainder was