@mj-biz-apps/common-activity-sync 5.42.0 → 5.44.0

package/dist/participants.js

@@ -56,4 +56,52 @@ export function MatchesParticipantScope(scope, c) {
             return c.Internal > 0 && external > 0;
     }
 }
+/** Parse one rule set's `InternalDomains`. Blank and null are legitimately "none declared". */
+export function ParseInternalDomains(raw, ruleSetName) {
+    const text = (raw ?? '').trim();
+    if (!text)
+        return { Ok: true, Domains: [] };
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        return {
+            Ok: false,
+            Issue: `Rule set "${ruleSetName}" has InternalDomains that is not valid JSON. Expected an array like ["bluecypress.io"].`,
+        };
+    }
+    if (!Array.isArray(parsed)) {
+        return {
+            Ok: false,
+            Issue: `Rule set "${ruleSetName}" has InternalDomains that is not a JSON array. Expected e.g. ["bluecypress.io"].`,
+        };
+    }
+    const domains = [];
+    for (const entry of parsed) {
+        // Normalised exactly as ClassifyParticipants normalises what it compares against, so a list
+        // written "@Bluecypress.IO" still matches an address at bluecypress.io.
+        const d = String(entry ?? '').trim().toLowerCase().replace(/^@/, '');
+        if (d && !domains.includes(d))
+            domains.push(d);
+    }
+    return { Ok: true, Domains: domains };
+}
+/**
+ * The warning for rules that test participants when no domain list exists.
+ *
+ * Returns null when there is nothing to say. This is a WARNING rather than a refusal because the run
+ * is still meaningful — the rules simply do not filter the way they read, and saying so is the
+ * difference between a surprising sync and an inexplicable one.
+ */
+export function ParticipantScopeWarning(rules, internalDomains) {
+    if (internalDomains.length > 0)
+        return null;
+    const scoped = rules.filter((r) => r.ParticipantScope && r.ParticipantScope !== 'Any');
+    if (scoped.length === 0)
+        return null;
+    return (`${scoped.length} rule(s) test ParticipantScope, but no bound rule set defines InternalDomains. ` +
+        'Every participant therefore counts as External, so those rules do not filter what they appear ' +
+        'to. Set InternalDomains on the rule set.');
+}
 //# sourceMappingURL=participants.js.map

package/dist/participants.js.map

@@ -1 +1 @@
-{"version":3,"file":"participants.js","sourceRoot":"","sources":["../src/participants.ts"],"names":[],"mappings":"AAoCA;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAChC,YAAwC,EACxC,eAAkC;IAElC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9F,MAAM,WAAW,GAA2B,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IAErF,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QAC7C,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YAClB,WAAW,CAAC,OAAO,EAAE,CAAC;QAC1B,CAAC;aAAM,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC7B,WAAW,CAAC,QAAQ,EAAE,CAAC;QAC3B,CAAC;aAAM,CAAC;YACJ,WAAW,CAAC,QAAQ,EAAE,CAAC;QAC3B,CAAC;IACL,CAAC;IACD,OAAO,WAAW,CAAC;AACvB,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,QAAQ,CAAC,OAAe;IACpC,MAAM,EAAE,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtC,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC1D,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAuB,EAAE,CAAyB;IACtF,MAAM,QAAQ,GAAG,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,OAAO,CAAC;IACxC,QAAQ,KAAK,EAAE,CAAC;QACZ,KAAK,KAAK;YACN,OAAO,IAAI,CAAC;QAChB,KAAK,aAAa;YACd,OAAO,CAAC,CAAC,QAAQ,GAAG,CAAC,IAAI,QAAQ,KAAK,CAAC,CAAC;QAC5C,KAAK,aAAa;YACd,OAAO,QAAQ,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC;QAC5C,KAAK,aAAa;YACd,OAAO,QAAQ,GAAG,CAAC,CAAC;QACxB,KAAK,aAAa;YACd,OAAO,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC;QAC1B,KAAK,OAAO;YACR,OAAO,CAAC,CAAC,QAAQ,GAAG,CAAC,IAAI,QAAQ,GAAG,CAAC,CAAC;IAC9C,CAAC;AACL,CAAC"}
+{"version":3,"file":"participants.js","sourceRoot":"","sources":["../src/participants.ts"],"names":[],"mappings":"AAoCA;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAChC,YAAwC,EACxC,eAAkC;IAElC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9F,MAAM,WAAW,GAA2B,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IAErF,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QAC7C,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YAClB,WAAW,CAAC,OAAO,EAAE,CAAC;QAC1B,CAAC;aAAM,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC7B,WAAW,CAAC,QAAQ,EAAE,CAAC;QAC3B,CAAC;aAAM,CAAC;YACJ,WAAW,CAAC,QAAQ,EAAE,CAAC;QAC3B,CAAC;IACL,CAAC;IACD,OAAO,WAAW,CAAC;AACvB,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,QAAQ,CAAC,OAAe;IACpC,MAAM,EAAE,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtC,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC1D,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAuB,EAAE,CAAyB;IACtF,MAAM,QAAQ,GAAG,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,OAAO,CAAC;IACxC,QAAQ,KAAK,EAAE,CAAC;QACZ,KAAK,KAAK;YACN,OAAO,IAAI,CAAC;QAChB,KAAK,aAAa;YACd,OAAO,CAAC,CAAC,QAAQ,GAAG,CAAC,IAAI,QAAQ,KAAK,CAAC,CAAC;QAC5C,KAAK,aAAa;YACd,OAAO,QAAQ,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC;QAC5C,KAAK,aAAa;YACd,OAAO,QAAQ,GAAG,CAAC,CAAC;QACxB,KAAK,aAAa;YACd,OAAO,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC;QAC1B,KAAK,OAAO;YACR,OAAO,CAAC,CAAC,QAAQ,GAAG,CAAC,IAAI,QAAQ,GAAG,CAAC,CAAC;IAC9C,CAAC;AACL,CAAC;AAeD,+FAA+F;AAC/F,MAAM,UAAU,oBAAoB,CAAC,GAA8B,EAAE,WAAmB;IACpF,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAChC,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAE5C,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACD,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACL,OAAO;YACH,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,aAAa,WAAW,0FAA0F;SAC5H,CAAC;IACN,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACzB,OAAO;YACH,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,aAAa,WAAW,mFAAmF;SACrH,CAAC;IACN,CAAC;IACD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QACzB,4FAA4F;QAC5F,wEAAwE;QACxE,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACrE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAC1C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CACnC,KAAsD,EACtD,eAAkC;IAElC,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,gBAAgB,IAAI,CAAC,CAAC,gBAAgB,KAAK,KAAK,CAAC,CAAC;IACvF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,CACH,GAAG,MAAM,CAAC,MAAM,iFAAiF;QACjG,gGAAgG;QAChG,0CAA0C,CAC7C,CAAC;AACN,CAAC"}

package/dist/providers/GraphCalendarTransport.d.ts

@@ -0,0 +1,115 @@
+/**
+ * The live calendar transport: MJ's Communication MS Graph provider, with credentials from MJ's
+ * Credentials engine.
+ *
+ * WRAPS, DOES NOT REIMPLEMENT — and until recently there was nothing to wrap. `MSGraphProvider` could
+ * send, read, reply, forward, draft, move, archive, search and subscribe, and had no calendar API at
+ * all, while the piece that would have made one possible (`getGraphClient`, which owns token
+ * acquisition and the credential-keyed client cache) is private. Building a client here would have
+ * forked exactly the behaviour `BaseActivitySyncProvider` says to wrap. So calendar retrieval was
+ * added to MJ first and this wraps it.
+ *
+ * WHY IT READS SourceData RATHER THAN Events. `GetEventsResult.Events` is MJ's normalized shape and
+ * is deliberately thin; `MapGraphEvent` in this package is written against Graph's own `event`
+ * resource and reads fields the normalized form drops (`iCalUId`, attendee `type`, `bodyPreview`
+ * nuances). `SourceData` carries the payload verbatim, which is what `NormalizedItem.Raw` is meant to
+ * preserve. Same choice, for the same reason, as the message transport.
+ *
+ * THE CREDENTIAL IS NEVER HELD. Resolved per fetch and passed straight into the call. `clientSecret`
+ * is flagged `isSecret` on the "Azure Service Principal" credential type, so MJ decrypts it at load
+ * and it lives only for the duration of the request. Never logged, never cached on this object,
+ * never interpolated into an issue string.
+ *
+ * @module @mj-biz-apps/common-activity-sync
+ */
+import type { BaseCommunicationProvider } from '@memberjunction/communication-types';
+import type { UserInfo } from '@memberjunction/core';
+import type { ActivitySourceQuery, RawBatch } from '../types.js';
+import type { ActivityMessageTransport } from './MessageTransport.js';
+import { type GraphServicePrincipal } from './GraphCommunicationTransport.js';
+/**
+ * How far back a FIRST run reaches when the connection has no calendar watermark.
+ *
+ * A bound is required rather than optional: `/calendarView` refuses a request without one, and the
+ * alternative endpoint returns series masters instead of occurrences. Thirty days is a starting
+ * point, not a rule — it is a constructor argument, and a run that falls back to it says so in its
+ * issues rather than letting an operator believe the whole calendar was read.
+ */
+export declare const DEFAULT_FIRST_RUN_LOOKBACK_DAYS = 30;
+/**
+ * How far FORWARD a read reaches.
+ *
+ * Not zero, deliberately. `Activity.Status` includes `Scheduled`, so a meeting that has not happened
+ * yet is a thing this schema models, and a calendar sync that only ever looked backwards could not
+ * produce one.
+ */
+export declare const DEFAULT_FORWARD_HORIZON_DAYS = 30;
+/** The slice of MJ's communication provider this uses. Structural, to avoid a hard runtime import. */
+export interface GraphEventReader {
+    GetEvents(params: {
+        Identifier?: string;
+        NumEvents: number;
+        StartDateTime?: Date;
+        EndDateTime?: Date;
+        IncludeCancelled?: boolean;
+        ContextData?: Record<string, unknown>;
+    }, credentials?: unknown): Promise<{
+        Success: boolean;
+        Events?: unknown[];
+        SourceData?: unknown[];
+        ErrorMessage?: string;
+        RecurrenceExpanded?: boolean;
+    }>;
+}
+/**
+ * COMPILE-TIME PROOF THAT THE STRUCTURAL TYPE ABOVE IS NOT FICTION.
+ *
+ * Declared structurally so this package takes no runtime dependency on the Communication engine. The
+ * cost of that is that nothing checks the shape against MJ: the only value ever assigned to it in
+ * tests is a stub, and a stub cast with `as unknown as` bypasses checking entirely. Drift in MJ's
+ * `GetEvents` would then surface on the FIRST LIVE CALL and nowhere earlier.
+ *
+ * So the compiler checks it instead. `@memberjunction/communication-types` is already a declared peer
+ * and this is a TYPE-only import, so no runtime dependency is added and these lines emit no
+ * JavaScript. If MJ changes the signature, the BUILD breaks here rather than a live sync.
+ */
+type AssertTrue<T extends true> = T;
+export type GraphEventReaderMatchesMJ = AssertTrue<BaseCommunicationProvider extends GraphEventReader ? true : false>;
+/** How the two collaborators are obtained. Injected, so neither engine is a runtime dependency. */
+export interface GraphCalendarTransportDeps {
+    ResolveCredential(): Promise<GraphServicePrincipal>;
+    ResolveProvider(): Promise<GraphEventReader>;
+    ContextUser?: UserInfo;
+}
+export declare class GraphCalendarTransport implements ActivityMessageTransport {
+    private readonly Deps;
+    private readonly LookbackDays;
+    private readonly ForwardDays;
+    /** Injectable so a test can pin the window without freezing global time. */
+    private readonly Now;
+    readonly Describe = "Microsoft Graph calendar (live, via MJ Communication)";
+    readonly IsLive = true;
+    constructor(Deps: GraphCalendarTransportDeps, LookbackDays?: number, ForwardDays?: number, 
+    /** Injectable so a test can pin the window without freezing global time. */
+    Now?: () => Date);
+    Fetch(query: ActivitySourceQuery): Promise<RawBatch>;
+}
+/**
+ * Build the deps from MJ's engines, resolving both lazily.
+ *
+ * Separate from the class so the class stays testable with neither engine loaded — the tests inject
+ * their own deps, which is also how a recorded run avoids dragging the Credentials engine into a
+ * replay that has no credential to resolve.
+ */
+export declare function MJGraphCalendarTransportDeps(args: {
+    CredentialName: string;
+    ContextUser?: UserInfo;
+    GetCredentialEngine: () => {
+        getCredential<T>(name: string, options?: Record<string, unknown>): Promise<{
+            values: T;
+        }>;
+    };
+    GetCommunicationProvider: (name: string) => GraphEventReader | null | undefined;
+}): GraphCalendarTransportDeps;
+export {};
+//# sourceMappingURL=GraphCalendarTransport.d.ts.map

package/dist/providers/GraphCalendarTransport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"GraphCalendarTransport.d.ts","sourceRoot":"","sources":["../../src/providers/GraphCalendarTransport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,qCAAqC,CAAC;AACrF,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAErD,OAAO,KAAK,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAGtE,OAAO,EAGH,KAAK,qBAAqB,EAC7B,MAAM,kCAAkC,CAAC;AAE1C;;;;;;;GAOG;AACH,eAAO,MAAM,+BAA+B,KAAK,CAAC;AAElD;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,KAAK,CAAC;AAE/C,sGAAsG;AACtG,MAAM,WAAW,gBAAgB;IAC7B,SAAS,CACL,MAAM,EAAE;QACJ,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,SAAS,EAAE,MAAM,CAAC;QAClB,aAAa,CAAC,EAAE,IAAI,CAAC;QACrB,WAAW,CAAC,EAAE,IAAI,CAAC;QACnB,gBAAgB,CAAC,EAAE,OAAO,CAAC;QAC3B,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACzC,EACD,WAAW,CAAC,EAAE,OAAO,GACtB,OAAO,CAAC;QACP,OAAO,EAAE,OAAO,CAAC;QACjB,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC;QACnB,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC;QACvB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,kBAAkB,CAAC,EAAE,OAAO,CAAC;KAChC,CAAC,CAAC;CACN;AAED;;;;;;;;;;;GAWG;AACH,KAAK,UAAU,CAAC,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC;AACpC,MAAM,MAAM,yBAAyB,GAAG,UAAU,CAC9C,yBAAyB,SAAS,gBAAgB,GAAG,IAAI,GAAG,KAAK,CACpE,CAAC;AAEF,mGAAmG;AACnG,MAAM,WAAW,0BAA0B;IACvC,iBAAiB,IAAI,OAAO,CAAC,qBAAqB,CAAC,CAAC;IACpD,eAAe,IAAI,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC7C,WAAW,CAAC,EAAE,QAAQ,CAAC;CAC1B;AAED,qBAAa,sBAAuB,YAAW,wBAAwB;IAK/D,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,4EAA4E;IAC5E,OAAO,CAAC,QAAQ,CAAC,GAAG;IARxB,SAAgB,QAAQ,2DAA2D;IACnF,SAAgB,MAAM,QAAQ;gBAGT,IAAI,EAAE,0BAA0B,EAChC,YAAY,GAAE,MAAwC,EACtD,WAAW,GAAE,MAAqC;IACnE,4EAA4E;IAC3D,GAAG,GAAE,MAAM,IAAuB;IAG1C,KAAK,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,QAAQ,CAAC;CAkGpE;AAED;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAAC,IAAI,EAAE;IAC/C,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,QAAQ,CAAC;IACvB,mBAAmB,EAAE,MAAM;QACvB,aAAa,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC;YAAE,MAAM,EAAE,CAAC,CAAA;SAAE,CAAC,CAAC;KAC7F,CAAC;IACF,wBAAwB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,gBAAgB,GAAG,IAAI,GAAG,SAAS,CAAC;CACnF,GAAG,0BAA0B,CAyB7B"}

package/dist/providers/GraphCalendarTransport.js

@@ -0,0 +1,139 @@
+// Reused, not redeclared: mail and calendar reach the SAME MJ provider under the same registration
+// name and resolve the SAME credential type. Two copies could drift into naming different things.
+import { GRAPH_COMMUNICATION_PROVIDER, GRAPH_CREDENTIAL_TYPE, } from './GraphCommunicationTransport.js';
+/**
+ * How far back a FIRST run reaches when the connection has no calendar watermark.
+ *
+ * A bound is required rather than optional: `/calendarView` refuses a request without one, and the
+ * alternative endpoint returns series masters instead of occurrences. Thirty days is a starting
+ * point, not a rule — it is a constructor argument, and a run that falls back to it says so in its
+ * issues rather than letting an operator believe the whole calendar was read.
+ */
+export const DEFAULT_FIRST_RUN_LOOKBACK_DAYS = 30;
+/**
+ * How far FORWARD a read reaches.
+ *
+ * Not zero, deliberately. `Activity.Status` includes `Scheduled`, so a meeting that has not happened
+ * yet is a thing this schema models, and a calendar sync that only ever looked backwards could not
+ * produce one.
+ */
+export const DEFAULT_FORWARD_HORIZON_DAYS = 30;
+export class GraphCalendarTransport {
+    constructor(Deps, LookbackDays = DEFAULT_FIRST_RUN_LOOKBACK_DAYS, ForwardDays = DEFAULT_FORWARD_HORIZON_DAYS, 
+    /** Injectable so a test can pin the window without freezing global time. */
+    Now = () => new Date()) {
+        this.Deps = Deps;
+        this.LookbackDays = LookbackDays;
+        this.ForwardDays = ForwardDays;
+        this.Now = Now;
+        this.Describe = 'Microsoft Graph calendar (live, via MJ Communication)';
+        this.IsLive = true;
+    }
+    async Fetch(query) {
+        const issues = [];
+        const credential = await this.Deps.ResolveCredential();
+        const missing = ['tenantId', 'clientId', 'clientSecret'].filter((k) => !String(credential?.[k] ?? '').trim());
+        if (missing.length > 0) {
+            // Field NAMES are reported, never values. The names are what an operator needs in order
+            // to fix it, and one of the values is a secret.
+            throw new Error(`The "${GRAPH_CREDENTIAL_TYPE}" credential is missing required field(s): ${missing.join(', ')}. ` +
+                'Complete it in MJ before enabling live fetch.');
+        }
+        const now = this.Now();
+        /**
+         * THE WINDOW IS ROLLING, AND DELIBERATELY IGNORES THE WATERMARK.
+         *
+         * `WatermarkBasisForKind('Calendar')` is `ObservationTime` — for a calendar the watermark
+         * records WHEN WE LAST LOOKED, not how far through the data we got. That basis is correct and
+         * the reason is in its own docblock: a meeting can be dated in the future, so an item-time
+         * watermark would skip straight past anything scheduled earlier than the newest thing seen.
+         *
+         * This used to pass that same value as `StartDateTime`, which filters on the EVENT'S OWN time.
+         * The two are different quantities and using one as the other loses data silently: run 1 at T0
+         * sets the watermark to T0, and a meeting that took place last week but is added to the
+         * calendar tomorrow starts before T0, so it falls outside run 2's window — and outside every
+         * later window, since each one starts later still. It is never read, on any run, with no issue
+         * raised and `Success = true`. Retroactive additions and back-dated invitations are ordinary
+         * calendar behaviour, not an edge case.
+         *
+         * So the window is always `[now - LookbackDays, now + ForwardDays]` and the same events are
+         * re-read every run. That is not waste: de-duplication is by `ExternalID` in the writer, so a
+         * re-read costs one lookup and writes nothing, while a missed event is unrecoverable.
+         */
+        const start = new Date(now.getTime() - this.LookbackDays * 86_400_000);
+        const end = new Date(now.getTime() + this.ForwardDays * 86_400_000);
+        if (!query.Since) {
+            // Said out loud on the FIRST run only, because that is when someone expects full history.
+            // On later runs the same bound applies and saying so every time would be noise.
+            issues.push(`First calendar run for ${query.Mailbox}: the window starts ${this.LookbackDays} days ` +
+                `back (${start.toISOString()}). Anything older was not read.`);
+        }
+        const provider = await this.Deps.ResolveProvider();
+        const result = await provider.GetEvents({
+            Identifier: query.Mailbox,
+            NumEvents: query.Limit,
+            StartDateTime: start,
+            EndDateTime: end,
+            // A cancellation is a real thing that happened to a meeting somebody attended, and
+            // `MapGraphEvent` already carries `Cancelled` through to the Activity.
+            IncludeCancelled: true,
+        }, 
+        // Same MJ requirements as the message path, for the same reasons — see
+        // GraphCommunicationTransport: accountEmail is validated before any request and the
+        // credential type does not carry it, and disableEnvironmentFallback stops a gap being
+        // filled from AZURE_* on the host, which is the difference between failing on a missing
+        // field and reading a calendar nobody asked for.
+        { ...credential, accountEmail: query.Mailbox, disableEnvironmentFallback: true });
+        if (!result?.Success) {
+            throw new Error(result?.ErrorMessage?.trim() || `Graph returned no calendar result for mailbox "${query.Mailbox}".`);
+        }
+        // BOTH BOUNDS WERE SENT, so MJ should have expanded recurrence. If it says otherwise the
+        // payloads are series MASTERS, and one row would be filed for a weekly meeting at whatever
+        // date the series began. That is wrong in a way no downstream check would catch, because a
+        // master and an occurrence look alike.
+        if (result.RecurrenceExpanded === false) {
+            issues.push('Graph did not expand recurring series despite a bounded window, so repeating meetings ' +
+                'are represented by their series master rather than by occurrences. Times for those ' +
+                'will be the start of the series.');
+        }
+        const payloads = (result.SourceData ?? []);
+        const capped = payloads.length >= query.Limit;
+        if (capped) {
+            issues.push(`The calendar read hit its limit of ${query.Limit} events for ${query.Mailbox}; ` +
+                'the window may hold more than this pass returned.');
+        }
+        return { Payloads: payloads, Issues: issues, Capped: capped };
+    }
+}
+/**
+ * Build the deps from MJ's engines, resolving both lazily.
+ *
+ * Separate from the class so the class stays testable with neither engine loaded — the tests inject
+ * their own deps, which is also how a recorded run avoids dragging the Credentials engine into a
+ * replay that has no credential to resolve.
+ */
+export function MJGraphCalendarTransportDeps(args) {
+    return {
+        ContextUser: args.ContextUser,
+        async ResolveCredential() {
+            const resolved = await args
+                .GetCredentialEngine()
+                .getCredential(args.CredentialName, { contextUser: args.ContextUser });
+            if (!resolved?.values) {
+                throw new Error(`Credential "${args.CredentialName}" resolved with no values.`);
+            }
+            return resolved.values;
+        },
+        async ResolveProvider() {
+            const provider = args.GetCommunicationProvider(GRAPH_COMMUNICATION_PROVIDER);
+            if (!provider) {
+                // A REGISTRATION problem, not a credential one. Saying which keeps an operator from
+                // hunting for a secret that is present and correct.
+                throw new Error(`MJ communication provider "${GRAPH_COMMUNICATION_PROVIDER}" is not registered. ` +
+                    'Ensure @memberjunction/communication-ms-graph is loaded in this host.');
+            }
+            return provider;
+        },
+    };
+}
+//# sourceMappingURL=GraphCalendarTransport.js.map

package/dist/providers/GraphCalendarTransport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"GraphCalendarTransport.js","sourceRoot":"","sources":["../../src/providers/GraphCalendarTransport.ts"],"names":[],"mappings":"AA6BA,mGAAmG;AACnG,kGAAkG;AAClG,OAAO,EACH,4BAA4B,EAC5B,qBAAqB,GAExB,MAAM,kCAAkC,CAAC;AAE1C;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,EAAE,CAAC;AAElD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,EAAE,CAAC;AA+C/C,MAAM,OAAO,sBAAsB;IAI/B,YACqB,IAAgC,EAChC,eAAuB,+BAA+B,EACtD,cAAsB,4BAA4B;IACnE,4EAA4E;IAC3D,MAAkB,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE;QAJlC,SAAI,GAAJ,IAAI,CAA4B;QAChC,iBAAY,GAAZ,YAAY,CAA0C;QACtD,gBAAW,GAAX,WAAW,CAAuC;QAElD,QAAG,GAAH,GAAG,CAA+B;QARvC,aAAQ,GAAG,uDAAuD,CAAC;QACnE,WAAM,GAAG,IAAI,CAAC;IAQ3B,CAAC;IAEG,KAAK,CAAC,KAAK,CAAC,KAA0B;QACzC,MAAM,MAAM,GAAa,EAAE,CAAC;QAE5B,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvD,MAAM,OAAO,GAAI,CAAC,UAAU,EAAE,UAAU,EAAE,cAAc,CAAW,CAAC,MAAM,CACtE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAC/C,CAAC;QACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,wFAAwF;YACxF,gDAAgD;YAChD,MAAM,IAAI,KAAK,CACX,QAAQ,qBAAqB,8CAA8C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;gBAC7F,+CAA+C,CACtD,CAAC;QACN,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB;;;;;;;;;;;;;;;;;;;WAmBG;QACH,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,CAAC;QACvE,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,CAAC;QAEpE,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACf,0FAA0F;YAC1F,gFAAgF;YAChF,MAAM,CAAC,IAAI,CACP,0BAA0B,KAAK,CAAC,OAAO,uBAAuB,IAAI,CAAC,YAAY,QAAQ;gBACnF,SAAS,KAAK,CAAC,WAAW,EAAE,iCAAiC,CACpE,CAAC;QACN,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;QACnD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,SAAS,CACnC;YACI,UAAU,EAAE,KAAK,CAAC,OAAO;YACzB,SAAS,EAAE,KAAK,CAAC,KAAK;YACtB,aAAa,EAAE,KAAK;YACpB,WAAW,EAAE,GAAG;YAChB,mFAAmF;YACnF,uEAAuE;YACvE,gBAAgB,EAAE,IAAI;SACzB;QACD,uEAAuE;QACvE,oFAAoF;QACpF,sFAAsF;QACtF,wFAAwF;QACxF,iDAAiD;QACjD,EAAE,GAAG,UAAU,EAAE,YAAY,EAAE,KAAK,CAAC,OAAO,EAAE,0BAA0B,EAAE,IAAI,EAAE,CACnF,CAAC;QAEF,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CACX,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,kDAAkD,KAAK,CAAC,OAAO,IAAI,CACtG,CAAC;QACN,CAAC;QAED,yFAAyF;QACzF,2FAA2F;QAC3F,2FAA2F;QAC3F,uCAAuC;QACvC,IAAI,MAAM,CAAC,kBAAkB,KAAK,KAAK,EAAE,CAAC;YACtC,MAAM,CAAC,IAAI,CACP,wFAAwF;gBACpF,qFAAqF;gBACrF,kCAAkC,CACzC,CAAC;QACN,CAAC;QAED,MAAM,QAAQ,GAAG,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAA8B,CAAC;QAExE,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC;QAC9C,IAAI,MAAM,EAAE,CAAC;YACT,MAAM,CAAC,IAAI,CACP,sCAAsC,KAAK,CAAC,KAAK,eAAe,KAAK,CAAC,OAAO,IAAI;gBAC7E,mDAAmD,CAC1D,CAAC;QACN,CAAC;QAED,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAClE,CAAC;CACJ;AAED;;;;;;GAMG;AACH,MAAM,UAAU,4BAA4B,CAAC,IAO5C;IACG,OAAO;QACH,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,KAAK,CAAC,iBAAiB;YACnB,MAAM,QAAQ,GAAG,MAAM,IAAI;iBACtB,mBAAmB,EAAE;iBACrB,aAAa,CAAwB,IAAI,CAAC,cAAc,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;YAClG,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;gBACpB,MAAM,IAAI,KAAK,CAAC,eAAe,IAAI,CAAC,cAAc,4BAA4B,CAAC,CAAC;YACpF,CAAC;YACD,OAAO,QAAQ,CAAC,MAAM,CAAC;QAC3B,CAAC;QACD,KAAK,CAAC,eAAe;YACjB,MAAM,QAAQ,GAAG,IAAI,CAAC,wBAAwB,CAAC,4BAA4B,CAAC,CAAC;YAC7E,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACZ,oFAAoF;gBACpF,oDAAoD;gBACpD,MAAM,IAAI,KAAK,CACX,8BAA8B,4BAA4B,uBAAuB;oBAC7E,uEAAuE,CAC9E,CAAC;YACN,CAAC;YACD,OAAO,QAAQ,CAAC;QACpB,CAAC;KACJ,CAAC;AACN,CAAC"}

package/dist/providers/GraphCommunicationTransport.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"GraphCommunicationTransport.d.ts","sourceRoot":"","sources":["../../src/providers/GraphCommunicationTransport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,qCAAqC,CAAC;AACrF,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAErD,OAAO,KAAK,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAEtE;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,4BAA4B,CAAC;AAE/D,qGAAqG;AACrG,eAAO,MAAM,4BAA4B,oBAAoB,CAAC;AAE9D,8DAA8D;AAC9D,MAAM,WAAW,qBAAqB;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;CACxB;AAED,sGAAsG;AACtG,MAAM,WAAW,kBAAkB;IAC/B,WAAW,CACP,MAAM,EAAE;QACJ,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,WAAW,EAAE,MAAM,CAAC;QACpB,UAAU,CAAC,EAAE,OAAO,CAAC;QACrB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACzC,EACD,WAAW,CAAC,EAAE,OAAO,GACtB,OAAO,CAAC;QACP,OAAO,EAAE,OAAO,CAAC;QACjB,QAAQ,CAAC,EAAE,OAAO,EAAE,CAAC;QACrB,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC;QACvB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,cAAc,CAAC,EAAE,OAAO,CAAC;KAC5B,CAAC,CAAC;CACN;AAED;;;;;;;;;;;;;GAaG;AACH,KAAK,UAAU,CAAC,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC;AACpC,MAAM,MAAM,2BAA2B,GAAG,UAAU,CAChD,yBAAyB,SAAS,kBAAkB,GAAG,IAAI,GAAG,KAAK,CACtE,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,WAAW,kBAAkB;IAC/B,iBAAiB,IAAI,OAAO,CAAC,qBAAqB,CAAC,CAAC;IACpD,eAAe,IAAI,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC/C,WAAW,CAAC,EAAE,QAAQ,CAAC;CAC1B;AAED,qBAAa,2BAA4B,YAAW,wBAAwB;IAIrD,OAAO,CAAC,QAAQ,CAAC,IAAI;IAHxC,SAAgB,QAAQ,kDAAkD;IAC1E,SAAgB,MAAM,QAAQ;gBAEM,IAAI,EAAE,kBAAkB;IAE/C,KAAK,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,QAAQ,CAAC;CAoEpE;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE;IACvC,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,QAAQ,CAAC;IACvB,mBAAmB,EAAE,MAAM;QACvB,aAAa,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC;YAAE,MAAM,EAAE,CAAC,CAAA;SAAE,CAAC,CAAC;KAC7F,CAAC;IACF,wBAAwB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,kBAAkB,GAAG,IAAI,GAAG,SAAS,CAAC;CACrF,GAAG,kBAAkB,CAyBrB"}
+{"version":3,"file":"GraphCommunicationTransport.d.ts","sourceRoot":"","sources":["../../src/providers/GraphCommunicationTransport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,qCAAqC,CAAC;AACrF,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAErD,OAAO,KAAK,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAEtE;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,4BAA4B,CAAC;AAE/D,qGAAqG;AACrG,eAAO,MAAM,4BAA4B,oBAAoB,CAAC;AAE9D,8DAA8D;AAC9D,MAAM,WAAW,qBAAqB;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;CACxB;AAED,sGAAsG;AACtG,MAAM,WAAW,kBAAkB;IAC/B,WAAW,CACP,MAAM,EAAE;QACJ,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,WAAW,EAAE,MAAM,CAAC;QACpB,UAAU,CAAC,EAAE,OAAO,CAAC;QACrB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACzC,EACD,WAAW,CAAC,EAAE,OAAO,GACtB,OAAO,CAAC;QACP,OAAO,EAAE,OAAO,CAAC;QACjB,QAAQ,CAAC,EAAE,OAAO,EAAE,CAAC;QACrB,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC;QACvB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,cAAc,CAAC,EAAE,OAAO,CAAC;KAC5B,CAAC,CAAC;CACN;AAED;;;;;;;;;;;;;GAaG;AACH,KAAK,UAAU,CAAC,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC;AACpC,MAAM,MAAM,2BAA2B,GAAG,UAAU,CAChD,yBAAyB,SAAS,kBAAkB,GAAG,IAAI,GAAG,KAAK,CACtE,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,WAAW,kBAAkB;IAC/B,iBAAiB,IAAI,OAAO,CAAC,qBAAqB,CAAC,CAAC;IACpD,eAAe,IAAI,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC/C,WAAW,CAAC,EAAE,QAAQ,CAAC;CAC1B;AAED,qBAAa,2BAA4B,YAAW,wBAAwB;IAIrD,OAAO,CAAC,QAAQ,CAAC,IAAI;IAHxC,SAAgB,QAAQ,kDAAkD;IAC1E,SAAgB,MAAM,QAAQ;gBAEM,IAAI,EAAE,kBAAkB;IAE/C,KAAK,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,QAAQ,CAAC;CAkFpE;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE;IACvC,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,QAAQ,CAAC;IACvB,mBAAmB,EAAE,MAAM;QACvB,aAAa,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC;YAAE,MAAM,EAAE,CAAC,CAAA;SAAE,CAAC,CAAC;KAC7F,CAAC;IACF,wBAAwB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,kBAAkB,GAAG,IAAI,GAAG,SAAS,CAAC;CACrF,GAAG,kBAAkB,CAyBrB"}

package/dist/providers/GraphCommunicationTransport.js

@@ -53,11 +53,25 @@ export class GraphCommunicationTransport {
             throw new Error(result?.ErrorMessage?.trim() || `Graph returned no result for mailbox "${query.Mailbox}".`);
         }
         const payloads = (result.SourceData ?? []);
-        const capped = !!query.Since && payloads.length >= query.Limit;
+        // A FULL PAGE MEANS THERE MAY BE MORE, WATERMARK OR NOT.
+        //
+        // This used to require `query.Since`, which left the FIRST run — the one most likely to
+        // overflow a page — unprotected. No date bound is sent, so Graph returns the newest `Limit`
+        // messages; `BaseActivitySyncProvider` then computes a high watermark from them and the next
+        // run asks for everything AFTER the newest. Every message older than that first page is
+        // skipped permanently, and the run reports Success with no issue. A mailbox with more history
+        // than one page silently loses all of it.
+        //
+        // `Capped` also withholds the watermark upstream, which is what actually prevents the loss;
+        // the issue below is how anyone finds out a re-run is needed.
+        const capped = payloads.length >= query.Limit;
         if (capped) {
-            issues.push(`Fetched the maximum of ${query.Limit} message(s) for "${query.Mailbox}" while a watermark was set, ` +
-                'so older items may remain unread. Re-run to continue, or raise the limit. A server-side date ' +
-                'bound (MemberJunction/MJ#4123) removes this entirely.');
+            const context = query.Since
+                ? 'while a watermark was set, so older items may remain unread'
+                : 'on a FIRST run with no watermark, so anything older than this page has not been read';
+            issues.push(`Fetched the maximum of ${query.Limit} message(s) for "${query.Mailbox}" ${context}. ` +
+                'The watermark is being withheld so nothing is skipped — re-run to continue, or raise ' +
+                'the limit. A server-side date bound (MemberJunction/MJ#4123) removes this entirely.');
         }
         // `Capped` is what actually protects the mail; the issue above only TELLS someone. Without
         // it the watermark advanced to the newest item in a truncated batch and the remainder was

package/dist/providers/GraphCommunicationTransport.js.map

@@ -1 +1 @@
-{"version":3,"file":"GraphCommunicationTransport.js","sourceRoot":"","sources":["../../src/providers/GraphCommunicationTransport.ts"],"names":[],"mappings":"AA6BA;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,yBAAyB,CAAC;AAE/D,qGAAqG;AACrG,MAAM,CAAC,MAAM,4BAA4B,GAAG,iBAAiB,CAAC;AA4D9D,MAAM,OAAO,2BAA2B;IAIpC,YAAoC,IAAwB;QAAxB,SAAI,GAAJ,IAAI,CAAoB;QAH5C,aAAQ,GAAG,8CAA8C,CAAC;QAC1D,WAAM,GAAG,IAAI,CAAC;IAEiC,CAAC;IAEzD,KAAK,CAAC,KAAK,CAAC,KAA0B;QACzC,MAAM,MAAM,GAAa,EAAE,CAAC;QAE5B,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvD,MAAM,OAAO,GAAI,CAAC,UAAU,EAAE,UAAU,EAAE,cAAc,CAAW,CAAC,MAAM,CACtE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAC/C,CAAC;QACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,wFAAwF;YACxF,gDAAgD;YAChD,MAAM,IAAI,KAAK,CACX,QAAQ,qBAAqB,8CAA8C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;gBAC7F,+CAA+C,CACtD,CAAC;QACN,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;QAEnD,wFAAwF;QACxF,mFAAmF;QACnF,yFAAyF;QACzF,iFAAiF;QACjF,sFAAsF;QACtF,0FAA0F;QAC1F,2FAA2F;QAC3F,qFAAqF;QACrF,wFAAwF;QACxF,0FAA0F;QAC1F,4DAA4D;QAC5D,EAAE;QACF,wFAAwF;QACxF,4FAA4F;QAC5F,0FAA0F;QAC1F,2FAA2F;QAC3F,4FAA4F;QAC5F,0FAA0F;QAC1F,2FAA2F;QAC3F,uFAAuF;QACvF,EAAE;QACF,8FAA8F;QAC9F,4FAA4F;QAC5F,6FAA6F;QAC7F,gFAAgF;QAChF,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,WAAW,CACrC,EAAE,UAAU,EAAE,KAAK,CAAC,OAAO,EAAE,WAAW,EAAE,KAAK,CAAC,KAAK,EAAE,EACvD,EAAE,GAAG,UAAU,EAAE,YAAY,EAAE,KAAK,CAAC,OAAO,EAAE,0BAA0B,EAAE,IAAI,EAAE,CACnF,CAAC;QAEF,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,yCAAyC,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC;QAChH,CAAC;QAED,MAAM,QAAQ,GAAG,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAA8B,CAAC;QAExE,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,QAAQ,CAAC,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC;QAC/D,IAAI,MAAM,EAAE,CAAC;YACT,MAAM,CAAC,IAAI,CACP,0BAA0B,KAAK,CAAC,KAAK,oBAAoB,KAAK,CAAC,OAAO,+BAA+B;gBACjG,+FAA+F;gBAC/F,uDAAuD,CAC9D,CAAC;QACN,CAAC;QAED,2FAA2F;QAC3F,0FAA0F;QAC1F,oBAAoB;QACpB,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAClE,CAAC;CACJ;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAOpC;IACG,OAAO;QACH,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,KAAK,CAAC,iBAAiB;YACnB,MAAM,QAAQ,GAAG,MAAM,IAAI;iBACtB,mBAAmB,EAAE;iBACrB,aAAa,CAAwB,IAAI,CAAC,cAAc,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;YAClG,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;gBACpB,MAAM,IAAI,KAAK,CAAC,eAAe,IAAI,CAAC,cAAc,4BAA4B,CAAC,CAAC;YACpF,CAAC;YACD,OAAO,QAAQ,CAAC,MAAM,CAAC;QAC3B,CAAC;QACD,KAAK,CAAC,eAAe;YACjB,MAAM,QAAQ,GAAG,IAAI,CAAC,wBAAwB,CAAC,4BAA4B,CAAC,CAAC;YAC7E,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACZ,oFAAoF;gBACpF,oDAAoD;gBACpD,MAAM,IAAI,KAAK,CACX,8BAA8B,4BAA4B,uBAAuB;oBAC7E,uEAAuE,CAC9E,CAAC;YACN,CAAC;YACD,OAAO,QAAQ,CAAC;QACpB,CAAC;KACJ,CAAC;AACN,CAAC"}
+{"version":3,"file":"GraphCommunicationTransport.js","sourceRoot":"","sources":["../../src/providers/GraphCommunicationTransport.ts"],"names":[],"mappings":"AA6BA;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,yBAAyB,CAAC;AAE/D,qGAAqG;AACrG,MAAM,CAAC,MAAM,4BAA4B,GAAG,iBAAiB,CAAC;AA4D9D,MAAM,OAAO,2BAA2B;IAIpC,YAAoC,IAAwB;QAAxB,SAAI,GAAJ,IAAI,CAAoB;QAH5C,aAAQ,GAAG,8CAA8C,CAAC;QAC1D,WAAM,GAAG,IAAI,CAAC;IAEiC,CAAC;IAEzD,KAAK,CAAC,KAAK,CAAC,KAA0B;QACzC,MAAM,MAAM,GAAa,EAAE,CAAC;QAE5B,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvD,MAAM,OAAO,GAAI,CAAC,UAAU,EAAE,UAAU,EAAE,cAAc,CAAW,CAAC,MAAM,CACtE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAC/C,CAAC;QACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,wFAAwF;YACxF,gDAAgD;YAChD,MAAM,IAAI,KAAK,CACX,QAAQ,qBAAqB,8CAA8C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;gBAC7F,+CAA+C,CACtD,CAAC;QACN,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;QAEnD,wFAAwF;QACxF,mFAAmF;QACnF,yFAAyF;QACzF,iFAAiF;QACjF,sFAAsF;QACtF,0FAA0F;QAC1F,2FAA2F;QAC3F,qFAAqF;QACrF,wFAAwF;QACxF,0FAA0F;QAC1F,4DAA4D;QAC5D,EAAE;QACF,wFAAwF;QACxF,4FAA4F;QAC5F,0FAA0F;QAC1F,2FAA2F;QAC3F,4FAA4F;QAC5F,0FAA0F;QAC1F,2FAA2F;QAC3F,uFAAuF;QACvF,EAAE;QACF,8FAA8F;QAC9F,4FAA4F;QAC5F,6FAA6F;QAC7F,gFAAgF;QAChF,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,WAAW,CACrC,EAAE,UAAU,EAAE,KAAK,CAAC,OAAO,EAAE,WAAW,EAAE,KAAK,CAAC,KAAK,EAAE,EACvD,EAAE,GAAG,UAAU,EAAE,YAAY,EAAE,KAAK,CAAC,OAAO,EAAE,0BAA0B,EAAE,IAAI,EAAE,CACnF,CAAC;QAEF,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,yCAAyC,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC;QAChH,CAAC;QAED,MAAM,QAAQ,GAAG,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAA8B,CAAC;QAExE,yDAAyD;QACzD,EAAE;QACF,wFAAwF;QACxF,4FAA4F;QAC5F,6FAA6F;QAC7F,wFAAwF;QACxF,8FAA8F;QAC9F,0CAA0C;QAC1C,EAAE;QACF,4FAA4F;QAC5F,8DAA8D;QAC9D,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC;QAC9C,IAAI,MAAM,EAAE,CAAC;YACT,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK;gBACvB,CAAC,CAAC,6DAA6D;gBAC/D,CAAC,CAAC,sFAAsF,CAAC;YAC7F,MAAM,CAAC,IAAI,CACP,0BAA0B,KAAK,CAAC,KAAK,oBAAoB,KAAK,CAAC,OAAO,KAAK,OAAO,IAAI;gBAClF,uFAAuF;gBACvF,qFAAqF,CAC5F,CAAC;QACN,CAAC;QAED,2FAA2F;QAC3F,0FAA0F;QAC1F,oBAAoB;QACpB,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAClE,CAAC;CACJ;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAOpC;IACG,OAAO;QACH,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,KAAK,CAAC,iBAAiB;YACnB,MAAM,QAAQ,GAAG,MAAM,IAAI;iBACtB,mBAAmB,EAAE;iBACrB,aAAa,CAAwB,IAAI,CAAC,cAAc,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;YAClG,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;gBACpB,MAAM,IAAI,KAAK,CAAC,eAAe,IAAI,CAAC,cAAc,4BAA4B,CAAC,CAAC;YACpF,CAAC;YACD,OAAO,QAAQ,CAAC,MAAM,CAAC;QAC3B,CAAC;QACD,KAAK,CAAC,eAAe;YACjB,MAAM,QAAQ,GAAG,IAAI,CAAC,wBAAwB,CAAC,4BAA4B,CAAC,CAAC;YAC7E,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACZ,oFAAoF;gBACpF,oDAAoD;gBACpD,MAAM,IAAI,KAAK,CACX,8BAA8B,4BAA4B,uBAAuB;oBAC7E,uEAAuE,CAC9E,CAAC;YACN,CAAC;YACD,OAAO,QAAQ,CAAC;QACpB,CAAC;KACJ,CAAC;AACN,CAAC"}

package/dist/providers/GraphMessageMapper.d.ts

@@ -27,6 +27,8 @@ export interface GraphMessage {
     ccRecipients?: GraphRecipient[] | null;
     bccRecipients?: GraphRecipient[] | null;
     [key: string]: unknown;
+    /** Graph's own flag. Cheap; the attachment LIST costs a separate call per message. */
+    hasAttachments?: boolean;
 }
 export interface MapResult {
     Items: NormalizedItem[];

package/dist/providers/GraphMessageMapper.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"GraphMessageMapper.d.ts","sourceRoot":"","sources":["../../src/providers/GraphMessageMapper.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAsC,cAAc,EAAE,MAAM,aAAa,CAAC;AAEtF,MAAM,WAAW,iBAAiB;IAC9B,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,MAAM,WAAW,cAAc;IAC3B,YAAY,CAAC,EAAE,iBAAiB,GAAG,IAAI,CAAC;CAC3C;AAED,MAAM,WAAW,YAAY;IACzB,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,IAAI,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IAC1C,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,IAAI,CAAC,EAAE,cAAc,GAAG,IAAI,CAAC;IAC7B,MAAM,CAAC,EAAE,cAAc,GAAG,IAAI,CAAC;IAC/B,YAAY,CAAC,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC;IACvC,YAAY,CAAC,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC;IACvC,aAAa,CAAC,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC;IACxC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,SAAS;IACtB,KAAK,EAAE,cAAc,EAAE,CAAC;IACxB,MAAM,EAAE,MAAM,EAAE,CAAC;CACpB;AAuCD,wBAAgB,eAAe,CAC3B,OAAO,EAAE,YAAY,EACrB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EAAE,GACjB,cAAc,GAAG,IAAI,CAsCvB;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,GAAG,SAAS,CAkB7E"}
+{"version":3,"file":"GraphMessageMapper.d.ts","sourceRoot":"","sources":["../../src/providers/GraphMessageMapper.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAsC,cAAc,EAAE,MAAM,aAAa,CAAC;AAEtF,MAAM,WAAW,iBAAiB;IAC9B,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,MAAM,WAAW,cAAc;IAC3B,YAAY,CAAC,EAAE,iBAAiB,GAAG,IAAI,CAAC;CAC3C;AAED,MAAM,WAAW,YAAY;IACzB,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,IAAI,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IAC1C,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,IAAI,CAAC,EAAE,cAAc,GAAG,IAAI,CAAC;IAC7B,MAAM,CAAC,EAAE,cAAc,GAAG,IAAI,CAAC;IAC/B,YAAY,CAAC,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC;IACvC,YAAY,CAAC,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC;IACvC,aAAa,CAAC,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC;IACxC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IACvB,sFAAsF;IACtF,cAAc,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,MAAM,WAAW,SAAS;IACtB,KAAK,EAAE,cAAc,EAAE,CAAC;IACxB,MAAM,EAAE,MAAM,EAAE,CAAC;CACpB;AAuCD,wBAAgB,eAAe,CAC3B,OAAO,EAAE,YAAY,EACrB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EAAE,GACjB,cAAc,GAAG,IAAI,CAyCvB;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,GAAG,SAAS,CAkB7E"}

package/dist/providers/GraphMessageMapper.js

@@ -57,6 +57,9 @@ export function MapGraphMessage(message, mailbox, issues) {
         ExternalID: id,
         ExternalThreadID: (message.conversationId ?? '').trim() || null,
         TypeCode: 'Email',
+        // Graph's flag, taken at face value. Absent means "not told", which we treat as none rather
+        // than paying a per-message list call on the chance something is there.
+        HasAttachments: message.hasAttachments === true,
         Subject: (message.subject ?? '').trim() || '(no subject)',
         Body: (message.bodyPreview ?? message.body?.content ?? '').trim() || null,
         StartedAt: startedAt,

package/dist/providers/GraphMessageMapper.js.map

@@ -1 +1 @@
-{"version":3,"file":"GraphMessageMapper.js","sourceRoot":"","sources":["../../src/providers/GraphMessageMapper.ts"],"names":[],"mappings":"AAqCA,SAAS,eAAe,CAAC,OAAe;IACpC,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,OAAO,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC5B,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACtC,CAAC;AAED,SAAS,eAAe,CACpB,SAA4C,EAC5C,IAA6B,EAC7B,MAAgB,EAChB,OAAe;IAEf,MAAM,EAAE,GAAG,SAAS,EAAE,YAAY,IAAI,IAAI,CAAC;IAC3C,MAAM,GAAG,GAAG,CAAC,EAAE,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACvC,MAAM,IAAI,GAAG,CAAC,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;IAC7C,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,IAAI,GAAG,EAAE,CAAC;YACN,MAAM,CAAC,IAAI,CAAC,GAAG,OAAO,KAAK,IAAI,2CAA2C,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACrG,CAAC;QACD,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;AACtF,CAAC;AAED,SAAS,eAAe,CAAC,OAAe,EAAE,YAA+B;IACrE,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAC/B,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;IACzD,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,CAAC,OAAO,KAAK,GAAG,CAAC,CAAC;IAClF,MAAM,aAAa,GAAG,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,KAAK,GAAG,CAAC;IACrD,IAAI,aAAa,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,UAAU,CAAC;IAC5D,OAAO,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,eAAe,CAC3B,OAAqB,EACrB,OAAe,EACf,MAAgB;IAEhB,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACrC,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;IAC9D,IAAI,CAAC,EAAE,EAAE,CAAC;QACN,MAAM,CAAC,IAAI,CAAC,qEAAqE,CAAC,CAAC;QACnF,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,MAAM,YAAY,GAAsB,EAAE,CAAC;IAC3C,MAAM,IAAI,GAAG,CAAC,CAAyB,EAAQ,EAAE;QAC7C,IAAI,CAAC;YAAE,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAChC,CAAC,CAAC;IACF,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC/E,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,YAAY,IAAI,EAAE;QAAE,IAAI,CAAC,eAAe,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC5F,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,YAAY,IAAI,EAAE;QAAE,IAAI,CAAC,eAAe,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC5F,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,aAAa,IAAI,EAAE;QAAE,IAAI,CAAC,eAAe,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAE9F,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,YAAY,IAAI,OAAO,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9E,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACjD,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;QAClD,MAAM,CAAC,IAAI,CAAC,GAAG,OAAO,oDAAoD,CAAC,CAAC;QAC5E,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,OAAO;QACH,UAAU,EAAE,EAAE;QACd,gBAAgB,EAAE,CAAC,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI;QAC/D,QAAQ,EAAE,OAAO;QACjB,OAAO,EAAE,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,cAAc;QACzD,IAAI,EAAE,CAAC,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,IAAI,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI;QACzE,SAAS,EAAE,SAAS;QACpB,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,eAAe,CAAC,OAAO,EAAE,YAAY,CAAC;QACjD,YAAY,EAAE,YAAY;QAC1B,SAAS,EAAE,KAAK;QAChB,GAAG,EAAE,OAAkC;KAC1C,CAAC;AACN,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAAgB,EAAE,OAAe;IAC9D,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,GAAG,GAAG,OAAiD,CAAC;IAC9D,MAAM,IAAI,GAAc,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QACtC,CAAC,CAAC,GAAG;QACL,CAAC,CAAC,KAAK,CAAC,OAAO,CAAE,GAA2B,EAAE,KAAK,CAAC;YAClD,CAAC,CAAE,GAA4B,CAAC,KAAK;YACrC,CAAC,CAAC,EAAE,CAAC;IACX,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CAAC,qFAAqF,CAAC,CAAC;QACnG,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACzC,CAAC;IACD,MAAM,KAAK,GAAqB,EAAE,CAAC;IACnC,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,eAAe,CAAC,KAAqB,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACvE,IAAI,MAAM;YAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAC5C,CAAC"}
+{"version":3,"file":"GraphMessageMapper.js","sourceRoot":"","sources":["../../src/providers/GraphMessageMapper.ts"],"names":[],"mappings":"AAuCA,SAAS,eAAe,CAAC,OAAe;IACpC,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,OAAO,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC5B,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACtC,CAAC;AAED,SAAS,eAAe,CACpB,SAA4C,EAC5C,IAA6B,EAC7B,MAAgB,EAChB,OAAe;IAEf,MAAM,EAAE,GAAG,SAAS,EAAE,YAAY,IAAI,IAAI,CAAC;IAC3C,MAAM,GAAG,GAAG,CAAC,EAAE,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACvC,MAAM,IAAI,GAAG,CAAC,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;IAC7C,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,IAAI,GAAG,EAAE,CAAC;YACN,MAAM,CAAC,IAAI,CAAC,GAAG,OAAO,KAAK,IAAI,2CAA2C,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACrG,CAAC;QACD,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;AACtF,CAAC;AAED,SAAS,eAAe,CAAC,OAAe,EAAE,YAA+B;IACrE,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAC/B,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;IACzD,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,CAAC,OAAO,KAAK,GAAG,CAAC,CAAC;IAClF,MAAM,aAAa,GAAG,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,KAAK,GAAG,CAAC;IACrD,IAAI,aAAa,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,UAAU,CAAC;IAC5D,OAAO,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,eAAe,CAC3B,OAAqB,EACrB,OAAe,EACf,MAAgB;IAEhB,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACrC,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;IAC9D,IAAI,CAAC,EAAE,EAAE,CAAC;QACN,MAAM,CAAC,IAAI,CAAC,qEAAqE,CAAC,CAAC;QACnF,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,MAAM,YAAY,GAAsB,EAAE,CAAC;IAC3C,MAAM,IAAI,GAAG,CAAC,CAAyB,EAAQ,EAAE;QAC7C,IAAI,CAAC;YAAE,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAChC,CAAC,CAAC;IACF,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC/E,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,YAAY,IAAI,EAAE;QAAE,IAAI,CAAC,eAAe,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC5F,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,YAAY,IAAI,EAAE;QAAE,IAAI,CAAC,eAAe,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC5F,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,aAAa,IAAI,EAAE;QAAE,IAAI,CAAC,eAAe,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAE9F,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,YAAY,IAAI,OAAO,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9E,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACjD,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;QAClD,MAAM,CAAC,IAAI,CAAC,GAAG,OAAO,oDAAoD,CAAC,CAAC;QAC5E,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,OAAO;QACH,UAAU,EAAE,EAAE;QACd,gBAAgB,EAAE,CAAC,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI;QAC/D,QAAQ,EAAE,OAAO;QACjB,4FAA4F;QAC5F,wEAAwE;QACxE,cAAc,EAAE,OAAO,CAAC,cAAc,KAAK,IAAI;QAC/C,OAAO,EAAE,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,cAAc;QACzD,IAAI,EAAE,CAAC,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,IAAI,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI;QACzE,SAAS,EAAE,SAAS;QACpB,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,eAAe,CAAC,OAAO,EAAE,YAAY,CAAC;QACjD,YAAY,EAAE,YAAY;QAC1B,SAAS,EAAE,KAAK;QAChB,GAAG,EAAE,OAAkC;KAC1C,CAAC;AACN,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAAgB,EAAE,OAAe;IAC9D,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,GAAG,GAAG,OAAiD,CAAC;IAC9D,MAAM,IAAI,GAAc,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QACtC,CAAC,CAAC,GAAG;QACL,CAAC,CAAC,KAAK,CAAC,OAAO,CAAE,GAA2B,EAAE,KAAK,CAAC;YAClD,CAAC,CAAE,GAA4B,CAAC,KAAK;YACrC,CAAC,CAAC,EAAE,CAAC;IACX,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CAAC,qFAAqF,CAAC,CAAC;QACnG,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACzC,CAAC;IACD,MAAM,KAAK,GAAqB,EAAE,CAAC;IACnC,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,eAAe,CAAC,KAAqB,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACvE,IAAI,MAAM;YAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAC5C,CAAC"}

package/dist/providers/MSGraphActivitySyncProvider.d.ts

@@ -1,16 +1,43 @@
 import { BaseActivitySyncProvider } from '../BaseActivitySyncProvider.js';
 import type { ActivitySourceQuery, NormalizedItem, RawBatch } from '../types.js';
 import type { ActivityMessageTransport, ActivityTransportContext, ActivityTransportFactory } from './MessageTransport.js';
+/**
+ * Why live fetch is off, and what to do about it.
+ *
+ * NAMING THE WAY OUT MATTERS AS MUCH AS THE REFUSAL: without it an operator who HAS checked the
+ * policy has no supported next step, and the tempting one is to go editing a database row.
+ *
+ * An earlier version of this string named only one of them — "call AllowLiveMailboxFetch() with the
+ * group the policy names" — which was wrong twice over. It assumed every deployment ends up with an
+ * Exchange RBAC assignment, when `TenantWideAccepted` exists precisely because most will not; an
+ * operator in a tenant with no RBAC owner read that as "you are blocked" and was left with inventing
+ * a group name or bypassing the gate. And it pointed at a FUNCTION when the path a deployment
+ * actually takes is `LoadLiveMailboxPolicyFromEnv`, already wired into `common-server`'s bootstrap,
+ * which reads environment variables. Telling someone to write code they do not need to write is the
+ * same defect in miniature: a documented route that is not the route.
+ *
+ * The variable names are referenced rather than imported — `common-server` depends on this package,
+ * not the other way round — which is the same way the attestation's own docblock already refers to
+ * `LoadLiveMailboxPolicyFromEnv` by name.
+ */
 export declare const LIVE_GRAPH_REFUSAL: string;
 export declare const NO_TRANSPORT_REFUSAL: string;
 export declare const NO_CREDENTIAL_REF_REFUSAL: string;
 export declare class MSGraphActivitySyncProvider extends BaseActivitySyncProvider {
     /**
-     * Default FALSE. Turning it on is a deliberate act by someone who has confirmed the
-     * Application Access Policy exists. Nothing in this package does that for you.
+     * Turning it on is a deliberate act by someone who has confirmed the Application Access
+     * Policy exists. Nothing in this package does that for you.
      *
      * It gates the LIVE transport only — a recorded transport needs no such confirmation
      * because it reaches no mailbox, and is allowed through below.
+     *
+     * DEFAULTS TO THE HOST'S ATTESTATION, NOT TO FALSE. A bare `false` made this unreachable in
+     * the only way that ships: `MJGlobal.ClassFactory` builds plugins with no arguments, so
+     * through the engine this was permanently off and the parameter could be set by tests and
+     * the demo alone. That is the same defect the transport factory had — a seam that was
+     * described, exported, and impossible to reach — so it gets the same fix, a host registry.
+     * With no attestation registered the default is still false, so an unconfigured host refuses
+     * exactly as before.
      */
     private readonly AllowLiveFetch;
     /** Where messages come from. Without one this provider refuses rather than pretending. */
@@ -33,11 +60,19 @@ export declare class MSGraphActivitySyncProvider extends BaseActivitySyncProvide
     get IsLive(): boolean;
     constructor(
     /**
-     * Default FALSE. Turning it on is a deliberate act by someone who has confirmed the
-     * Application Access Policy exists. Nothing in this package does that for you.
+     * Turning it on is a deliberate act by someone who has confirmed the Application Access
+     * Policy exists. Nothing in this package does that for you.
      *
      * It gates the LIVE transport only — a recorded transport needs no such confirmation
      * because it reaches no mailbox, and is allowed through below.
+     *
+     * DEFAULTS TO THE HOST'S ATTESTATION, NOT TO FALSE. A bare `false` made this unreachable in
+     * the only way that ships: `MJGlobal.ClassFactory` builds plugins with no arguments, so
+     * through the engine this was permanently off and the parameter could be set by tests and
+     * the demo alone. That is the same defect the transport factory had — a seam that was
+     * described, exported, and impossible to reach — so it gets the same fix, a host registry.
+     * With no attestation registered the default is still false, so an unconfigured host refuses
+     * exactly as before.
      */
     AllowLiveFetch?: boolean, 
     /** Where messages come from. Without one this provider refuses rather than pretending. */

package/dist/providers/MSGraphActivitySyncProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"MSGraphActivitySyncProvider.d.ts","sourceRoot":"","sources":["../../src/providers/MSGraphActivitySyncProvider.ts"],"names":[],"mappings":"AAsBA,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AAC1E,OAAO,KAAK,EAAE,mBAAmB,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAGjF,OAAO,KAAK,EACR,wBAAwB,EACxB,wBAAwB,EACxB,wBAAwB,EAC3B,MAAM,uBAAuB,CAAC;AAE/B,eAAO,MAAM,kBAAkB,QAIoD,CAAC;AAEpF,eAAO,MAAM,oBAAoB,QAEmB,CAAC;AAErD,eAAO,MAAM,yBAAyB,QAGX,CAAC;AAE5B,qBACa,2BAA4B,SAAQ,wBAAwB;IAoBjE;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,0FAA0F;IAC1F,OAAO,CAAC,SAAS,CAAC;IAClB,6EAA6E;IAC7E,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;IA9B7B,SAAgB,IAAI,EAAG,SAAS,CAAU;IAC1C,SAAgB,gBAAgB,kBAAkB;IAElD;;;;;;;;;;OAUG;IACH,IAAW,MAAM,IAAI,OAAO,CAE3B;;IAGG;;;;;;OAMG;IACc,cAAc,GAAE,OAAe;IAChD,0FAA0F;IAClF,SAAS,CAAC,EAAE,wBAAwB,YAAA;IAC5C,6EAA6E;IAC5D,OAAO,CAAC,EAAE,wBAAwB,YAAA;IAKvD,4FAA4F;IAC5F,OAAO,CAAC,oBAAoB,CAAuB;IAEnD;;;;;;;;;;;OAWG;IACa,SAAS,CAAC,OAAO,EAAE,wBAAwB,GAAG,IAAI;cAkClD,QAAQ,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,QAAQ,CAAC;IAsCvE,SAAS,CAAC,SAAS,CAAC,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,mBAAmB,GAAG,cAAc,EAAE;CAuBnF"}
+{"version":3,"file":"MSGraphActivitySyncProvider.d.ts","sourceRoot":"","sources":["../../src/providers/MSGraphActivitySyncProvider.ts"],"names":[],"mappings":"AAyBA,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AAC1E,OAAO,KAAK,EAAE,mBAAmB,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAGjF,OAAO,KAAK,EACR,wBAAwB,EACxB,wBAAwB,EACxB,wBAAwB,EAC3B,MAAM,uBAAuB,CAAC;AAE/B;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,kBAAkB,QAS4B,CAAC;AAE5D,eAAO,MAAM,oBAAoB,QAEmB,CAAC;AAErD,eAAO,MAAM,yBAAyB,QAGX,CAAC;AAE5B,qBACa,2BAA4B,SAAQ,wBAAwB;IAoBjE;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,0FAA0F;IAC1F,OAAO,CAAC,SAAS,CAAC;IAClB,6EAA6E;IAC7E,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;IAtC7B,SAAgB,IAAI,EAAG,SAAS,CAAU;IAC1C,SAAgB,gBAAgB,kBAAkB;IAElD;;;;;;;;;;OAUG;IACH,IAAW,MAAM,IAAI,OAAO,CAE3B;;IAGG;;;;;;;;;;;;;;OAcG;IACc,cAAc,GAAE,OAAsC;IACvE,0FAA0F;IAClF,SAAS,CAAC,EAAE,wBAAwB,YAAA;IAC5C,6EAA6E;IAC5D,OAAO,CAAC,EAAE,wBAAwB,YAAA;IAKvD,4FAA4F;IAC5F,OAAO,CAAC,oBAAoB,CAAuB;IAEnD;;;;;;;;;;;OAWG;IACa,SAAS,CAAC,OAAO,EAAE,wBAAwB,GAAG,IAAI;cAkClD,QAAQ,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,QAAQ,CAAC;IAsCvE,SAAS,CAAC,SAAS,CAAC,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,mBAAmB,GAAG,cAAc,EAAE;CAuBnF"}

package/dist/providers/MSGraphActivitySyncProvider.js

@@ -20,21 +20,48 @@ var __metadata = (this && this.__metadata) || function (k, v) {
  * provider and MJ's Credentials engine; a recorded one replays captured payloads through the same
  * mapping. Only the outermost call differs between them.
  *
- * THE TENANT-WIDE READ IS STILL REFUSED BY DEFAULT. `AllowLiveFetch` remains false, and the reason
- * is unchanged: app-only `Mail.Read` reads EVERY mailbox in the tenant until an Exchange Application
- * Access Policy scopes the app registration to a security group. Wiring a transport does not make
- * that safe, so the gate stays, and stays default-off.
+ * THE TENANT-WIDE READ IS STILL REFUSED BY DEFAULT. The reason is unchanged: app-only `Mail.Read`
+ * reads EVERY mailbox in the tenant until an Exchange Application Access Policy scopes the app
+ * registration to a security group. Wiring a transport does not make that safe, so the gate stays.
+ *
+ * What changed is that the gate is now REACHABLE. It defaults to the host's attestation
+ * (`AllowLiveMailboxFetch`) rather than to a bare `false` that `ClassFactory` could never override —
+ * an unconfigured host still refuses, but a scoped one can say so in the one place that ships.
  *
  * @module @mj-biz-apps/common-activity-sync
  */
 import { RegisterClass } from '@memberjunction/global';
 import { BaseActivitySyncProvider } from '../BaseActivitySyncProvider.js';
 import { MapGraphMessages } from './GraphMessageMapper.js';
-import { HostActivityTransportFactory } from './MessageTransport.js';
+import { HostActivityTransportFactory, HostAllowsLiveMailboxFetch } from './MessageTransport.js';
+/**
+ * Why live fetch is off, and what to do about it.
+ *
+ * NAMING THE WAY OUT MATTERS AS MUCH AS THE REFUSAL: without it an operator who HAS checked the
+ * policy has no supported next step, and the tempting one is to go editing a database row.
+ *
+ * An earlier version of this string named only one of them — "call AllowLiveMailboxFetch() with the
+ * group the policy names" — which was wrong twice over. It assumed every deployment ends up with an
+ * Exchange RBAC assignment, when `TenantWideAccepted` exists precisely because most will not; an
+ * operator in a tenant with no RBAC owner read that as "you are blocked" and was left with inventing
+ * a group name or bypassing the gate. And it pointed at a FUNCTION when the path a deployment
+ * actually takes is `LoadLiveMailboxPolicyFromEnv`, already wired into `common-server`'s bootstrap,
+ * which reads environment variables. Telling someone to write code they do not need to write is the
+ * same defect in miniature: a documented route that is not the route.
+ *
+ * The variable names are referenced rather than imported — `common-server` depends on this package,
+ * not the other way round — which is the same way the attestation's own docblock already refers to
+ * `LoadLiveMailboxPolicyFromEnv` by name.
+ */
 export const LIVE_GRAPH_REFUSAL = 'Live Graph fetch is disabled. MSGraphProvider uses app-only auth, so Mail.Read reads ' +
     'EVERY mailbox in the tenant until an Exchange Application Access Policy scopes the ' +
-    'app registration to a security group. Confirm that policy exists before enabling ' +
-    'this, and use a recorded transport or FixtureActivitySyncProvider until then.';
+    'app registration to a security group. Find out whether that policy exists before enabling ' +
+    'this, and use a recorded transport or FixtureActivitySyncProvider until then. ' +
+    'Then record the answer, whichever it is: the app IS scoped and you name the group, or it is ' +
+    'not and the tenant-wide grant is accepted deliberately, in writing, by a named person on a ' +
+    'date. Both are legitimate. Not knowing is not. A host that reads deployment configuration ' +
+    'sets its ACTIVITY_SYNC_MAILBOX_POLICY_* variables (see @mj-biz-apps/common-server); anything ' +
+    'else calls AllowLiveMailboxFetch() once at bootstrap.';
 export const NO_TRANSPORT_REFUSAL = 'No mailbox transport was supplied. Construct this provider with a GraphCommunicationTransport ' +
     '(live) or a RecordedMessageTransport (replay).';
 export const NO_CREDENTIAL_REF_REFUSAL = 'This ActivitySyncConnection names no credential. Set its CredentialsRef to the NAME of an ' +
@@ -57,13 +84,21 @@ let MSGraphActivitySyncProvider = class MSGraphActivitySyncProvider extends Base
     }
     constructor(
     /**
-     * Default FALSE. Turning it on is a deliberate act by someone who has confirmed the
-     * Application Access Policy exists. Nothing in this package does that for you.
+     * Turning it on is a deliberate act by someone who has confirmed the Application Access
+     * Policy exists. Nothing in this package does that for you.
      *
      * It gates the LIVE transport only — a recorded transport needs no such confirmation
      * because it reaches no mailbox, and is allowed through below.
+     *
+     * DEFAULTS TO THE HOST'S ATTESTATION, NOT TO FALSE. A bare `false` made this unreachable in
+     * the only way that ships: `MJGlobal.ClassFactory` builds plugins with no arguments, so
+     * through the engine this was permanently off and the parameter could be set by tests and
+     * the demo alone. That is the same defect the transport factory had — a seam that was
+     * described, exported, and impossible to reach — so it gets the same fix, a host registry.
+     * With no attestation registered the default is still false, so an unconfigured host refuses
+     * exactly as before.
      */
-    AllowLiveFetch = false, 
+    AllowLiveFetch = HostAllowsLiveMailboxFetch(), 
     /** Where messages come from. Without one this provider refuses rather than pretending. */
     Transport, 
     /** How a host builds a transport for a connection. See {@link Configure}. */