@rubytech/create-maxy-code 0.1.0

package/payload/platform/plugins/outlook/mcp/dist/index.js

@@ -0,0 +1,152 @@
+#!/usr/bin/env node
+/**
+ * @maxy/outlook MCP server.
+ *
+ * Read-only Microsoft Graph access for Outlook.com / Microsoft 365 mailboxes.
+ * Admin agent only. Public-agent surface is explicitly excluded.
+ *
+ * Auth: per-account OAuth Auth Code + PKCE. Tokens persist encrypted to
+ *   {ACCOUNTS_DIR}/{accountId}/secrets/outlook/{tokens.enc, .key}
+ *
+ * Required environment:
+ *   ACCOUNT_ID            — provided by getMcpServers when spawned per account.
+ *   PLATFORM_ROOT         — repo root; used to derive ACCOUNTS_DIR.
+ *   OUTLOOK_CLIENT_ID     — Azure AD app (client) ID. Operator-set per install.
+ *   OUTLOOK_TENANT_ID     — Azure tenant ("common" for multi-tenant). Default "common".
+ */
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { resolve } from "node:path";
+import { z } from "zod";
+import { TokenStore } from "./auth/token-store.js";
+import { runAccountRegister } from "./tools/account-register.js";
+import { runMailList } from "./tools/mail-list.js";
+import { runMailSearch } from "./tools/mail-search.js";
+import { runCalendarList } from "./tools/calendar-list.js";
+import { runCalendarEvent } from "./tools/calendar-event.js";
+import { runContactsList } from "./tools/contacts-list.js";
+import { runMailboxInfo } from "./tools/mailbox-info.js";
+const ACCOUNT_ID = process.env.ACCOUNT_ID;
+const PLATFORM_ROOT = process.env.PLATFORM_ROOT ?? process.cwd();
+const ACCOUNTS_DIR = resolve(PLATFORM_ROOT, "..", "data/accounts");
+const OUTLOOK_CLIENT_ID = process.env.OUTLOOK_CLIENT_ID ?? "";
+const OUTLOOK_TENANT_ID = process.env.OUTLOOK_TENANT_ID ?? "common";
+if (!ACCOUNT_ID) {
+    process.stderr.write("[outlook-mcp] FATAL: ACCOUNT_ID env var is required\n");
+    process.exit(1);
+}
+function getStore() {
+    return new TokenStore(ACCOUNT_ID, ACCOUNTS_DIR);
+}
+function getConfig() {
+    if (!OUTLOOK_CLIENT_ID) {
+        throw new Error("OUTLOOK_CLIENT_ID is not configured. Set it in the operator's Maxy install before using outlook tools.");
+    }
+    return {
+        clientId: OUTLOOK_CLIENT_ID,
+        tenantId: OUTLOOK_TENANT_ID,
+        accountId: ACCOUNT_ID,
+        tokenStore: getStore(),
+    };
+}
+function ok(payload) {
+    return {
+        content: [
+            { type: "text", text: typeof payload === "string" ? payload : JSON.stringify(payload, null, 2) },
+        ],
+    };
+}
+function fail(message) {
+    return { content: [{ type: "text", text: message }], isError: true };
+}
+const server = new McpServer({
+    name: "outlook",
+    version: "0.1.0",
+});
+server.tool("outlook-account-register", "Initiate the OAuth Auth Code + PKCE flow for this account. Returns an authorization URL the operator opens in the VNC browser. Tool blocks until the operator completes consent (5-minute timeout) or fails loudly.", {}, async () => {
+    try {
+        const config = getConfig();
+        const result = await runAccountRegister({
+            accountId: ACCOUNT_ID,
+            clientId: config.clientId,
+            tenantId: config.tenantId,
+            tokenStore: config.tokenStore,
+        });
+        return ok(result);
+    }
+    catch (err) {
+        return fail(`outlook-account-register failed: ${err.message}`);
+    }
+});
+// @ts-expect-error — MCP SDK server.tool() type inference exceeds depth limit with Zod v4
+server.tool("outlook-mail-list", "List recent messages in the mailbox. Defaults to top=25 ordered by receivedDateTime DESC. Folder defaults to Inbox; pass a folder displayName or id for other folders. Returns id, subject, from, receivedDateTime, bodyPreview, isRead.", {
+    top: z.number().int().min(1).max(250).optional(),
+    folder: z.string().optional(),
+}, async ({ top, folder }) => {
+    try {
+        const items = await runMailList(getConfig(), { top, folder });
+        return ok(items);
+    }
+    catch (err) {
+        return fail(`outlook-mail-list failed: ${err.message}`);
+    }
+});
+server.tool("outlook-mail-search", "Search mail with Microsoft Graph $search. The query is enclosed in quotes and applied with ConsistencyLevel=eventual. Returns the same shape as outlook-mail-list.", {
+    query: z.string().min(1),
+    top: z.number().int().min(1).max(250).optional(),
+}, async ({ query, top }) => {
+    try {
+        const items = await runMailSearch(getConfig(), { query, top });
+        return ok(items);
+    }
+    catch (err) {
+        return fail(`outlook-mail-search failed: ${err.message}`);
+    }
+});
+server.tool("outlook-calendar-list", "List calendar events in the next rangeDays days (default 7, max 365). Returns id, subject, start, end, location, attendees, isAllDay, organizer.", {
+    rangeDays: z.number().int().min(1).max(365).optional(),
+    top: z.number().int().min(1).max(500).optional(),
+}, async ({ rangeDays, top }) => {
+    try {
+        const events = await runCalendarList(getConfig(), { rangeDays, top });
+        return ok(events);
+    }
+    catch (err) {
+        return fail(`outlook-calendar-list failed: ${err.message}`);
+    }
+});
+server.tool("outlook-calendar-event", "Fetch a single calendar event by id, including the full body, attendees, and webLink.", {
+    eventId: z.string().min(1),
+}, async ({ eventId }) => {
+    try {
+        const detail = await runCalendarEvent(getConfig(), { eventId });
+        return ok(detail);
+    }
+    catch (err) {
+        return fail(`outlook-calendar-event failed: ${err.message}`);
+    }
+});
+server.tool("outlook-contacts-list", "List contacts. Defaults to top=50, max 250. Returns id, displayName, emailAddresses, phones, jobTitle, companyName.", {
+    top: z.number().int().min(1).max(250).optional(),
+}, async ({ top }) => {
+    try {
+        const items = await runContactsList(getConfig(), { top });
+        return ok(items);
+    }
+    catch (err) {
+        return fail(`outlook-contacts-list failed: ${err.message}`);
+    }
+});
+server.tool("outlook-mailbox-info", "Health probe — reports auth state, refresh-window status, and top-level folder count for this account. Useful for answering 'did account X auth?' without grepping logs.", {}, async () => {
+    try {
+        const info = await runMailboxInfo(getConfig());
+        return ok(info);
+    }
+    catch (err) {
+        return fail(`outlook-mailbox-info failed: ${err.message}`);
+    }
+});
+const transport = new StdioServerTransport();
+await server.connect(transport);
+process.stderr.write(`[outlook-mcp] ready account=${ACCOUNT_ID}\n`);
+//# sourceMappingURL=index.js.map

package/payload/platform/plugins/outlook/mcp/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAGnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAEzD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;AAC1C,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;AACjE,MAAM,YAAY,GAAG,OAAO,CAAC,aAAa,EAAE,IAAI,EAAE,eAAe,CAAC,CAAC;AACnE,MAAM,iBAAiB,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAC;AAC9D,MAAM,iBAAiB,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,QAAQ,CAAC;AAEpE,IAAI,CAAC,UAAU,EAAE,CAAC;IAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC9E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,SAAS,QAAQ;IACf,OAAO,IAAI,UAAU,CAAC,UAAW,EAAE,YAAY,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,SAAS;IAChB,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,wGAAwG,CACzG,CAAC;IACJ,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,iBAAiB;QAC3B,QAAQ,EAAE,iBAAiB;QAC3B,SAAS,EAAE,UAAW;QACtB,UAAU,EAAE,QAAQ,EAAE;KACvB,CAAC;AACJ,CAAC;AAED,SAAS,EAAE,CAAC,OAAgB;IAC1B,OAAO;QACL,OAAO,EAAE;YACP,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;SACjG;KACF,CAAC;AACJ,CAAC;AAED,SAAS,IAAI,CAAC,OAAe;IAI3B,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AACvE,CAAC;AAED,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;IAC3B,IAAI,EAAE,SAAS;IACf,OAAO,EAAE,OAAO;CACjB,CAAC,CAAC;AAEH,MAAM,CAAC,IAAI,CACT,0BAA0B,EAC1B,qNAAqN,EACrN,EAAE,EACF,KAAK,IAAI,EAAE;IACT,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC;YACtC,SAAS,EAAE,UAAW;YACtB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,UAAU,EAAE,MAAM,CAAC,UAAU;SAC9B,CAAC,CAAC;QACH,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;IACpB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,IAAI,CAAC,oCAAqC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5E,CAAC;AACH,CAAC,CACF,CAAC;AAEF,0FAA0F;AAC1F,MAAM,CAAC,IAAI,CACT,mBAAmB,EACnB,0OAA0O,EAC1O;IACE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAChD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC9B,EACD,KAAK,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE;IACxB,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,SAAS,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;QAC9D,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC;IACnB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,IAAI,CAAC,6BAA8B,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IACrE,CAAC;AACH,CAAC,CACF,CAAC;AAEF,MAAM,CAAC,IAAI,CACT,qBAAqB,EACrB,oKAAoK,EACpK;IACE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CACjD,EACD,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE;IACvB,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QAC/D,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC;IACnB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,IAAI,CAAC,+BAAgC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IACvE,CAAC;AACH,CAAC,CACF,CAAC;AAEF,MAAM,CAAC,IAAI,CACT,uBAAuB,EACvB,kJAAkJ,EAClJ;IACE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACtD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CACjD,EACD,KAAK,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,EAAE;IAC3B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;QACtE,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;IACpB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,IAAI,CAAC,iCAAkC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IACzE,CAAC;AACH,CAAC,CACF,CAAC;AAEF,MAAM,CAAC,IAAI,CACT,wBAAwB,EACxB,uFAAuF,EACvF;IACE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC3B,EACD,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE;IACpB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QAChE,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;IACpB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,IAAI,CAAC,kCAAmC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC,CACF,CAAC;AAEF,MAAM,CAAC,IAAI,CACT,uBAAuB,EACvB,qHAAqH,EACrH;IACE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CACjD,EACD,KAAK,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE;IAChB,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,SAAS,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QAC1D,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC;IACnB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,IAAI,CAAC,iCAAkC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IACzE,CAAC;AACH,CAAC,CACF,CAAC;AAEF,MAAM,CAAC,IAAI,CACT,sBAAsB,EACtB,0KAA0K,EAC1K,EAAE,EACF,KAAK,IAAI,EAAE;IACT,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,SAAS,EAAE,CAAC,CAAC;QAC/C,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;IAClB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,IAAI,CAAC,gCAAiC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IACxE,CAAC;AACH,CAAC,CACF,CAAC;AAEF,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;AAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;AAChC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,+BAA+B,UAAU,IAAI,CAAC,CAAC"}

package/payload/platform/plugins/outlook/mcp/dist/lib/graph-client.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Microsoft Graph client wrapper.
+ *
+ * Builds a `Client` from `@microsoft/microsoft-graph-client` whose auth provider
+ * pulls from the per-account TokenStore, with auto-refresh when the access
+ * token is within the refresh threshold of expiry.
+ *
+ * Centralises error classification — every Graph error decision keys off the
+ * status code and the structured `error.code` field, never the prose body.
+ * Aligns with `feedback_no_stdout_parsing_for_control_flow.md`.
+ */
+import { Client } from "@microsoft/microsoft-graph-client";
+import type { TokenStore } from "../auth/token-store.js";
+export interface GraphClientConfig {
+    clientId: string;
+    tenantId: string;
+    accountId: string;
+    tokenStore: TokenStore;
+}
+export type GraphErrorClass = {
+    kind: "auth";
+    statusCode: number;
+    code: string;
+} | {
+    kind: "rate-limit-recoverable";
+    statusCode: number;
+    retryAfterMs: number;
+} | {
+    kind: "rate-limit-terminal";
+    statusCode: number;
+} | {
+    kind: "on-prem";
+    statusCode: number;
+    mailServer?: string;
+} | {
+    kind: "5xx";
+    statusCode: number;
+    code: string;
+} | {
+    kind: "other";
+    statusCode: number;
+    code: string;
+};
+export declare function classifyGraphError(err: unknown): GraphErrorClass;
+/**
+ * Factory wrapping `Client.init`. Exported as a named function so tests can
+ * `vi.spyOn(graphClient, "createGraphClient")` reliably (avoids the
+ * destructured-ESM mock no-op pitfall).
+ */
+export declare function createGraphClient(config: GraphClientConfig): Client;
+export declare function getOrRefreshAccessToken(config: GraphClientConfig): Promise<string>;
+/**
+ * Run a Graph call with classification, single retry on `auth` (refresh +
+ * retry once), and respect for 429 Retry-After. All terminal classes throw
+ * with operator-readable messages.
+ */
+export declare function callGraph<T>(config: GraphClientConfig, invoke: (client: Client) => Promise<T>, opts?: {
+    tool: string;
+}): Promise<T>;
+//# sourceMappingURL=graph-client.d.ts.map

package/payload/platform/plugins/outlook/mcp/dist/lib/graph-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"graph-client.d.ts","sourceRoot":"","sources":["../../src/lib/graph-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,mCAAmC,CAAC;AAE3D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAGzD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,UAAU,CAAC;CACxB;AAED,MAAM,MAAM,eAAe,GACvB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAClD;IAAE,IAAI,EAAE,wBAAwB,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAC5E;IAAE,IAAI,EAAE,qBAAqB,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GACnD;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAC5D;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACjD;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAqDxD,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,GAAG,eAAe,CA2BhE;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,iBAAiB,GAAG,MAAM,CAWnE;AAED,wBAAsB,uBAAuB,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,CAgDxF;AAED;;;;GAIG;AACH,wBAAsB,SAAS,CAAC,CAAC,EAC/B,MAAM,EAAE,iBAAiB,EACzB,MAAM,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,EACtC,IAAI,GAAE;IAAE,IAAI,EAAE,MAAM,CAAA;CAAsB,GACzC,OAAO,CAAC,CAAC,CAAC,CAsDZ"}

package/payload/platform/plugins/outlook/mcp/dist/lib/graph-client.js

@@ -0,0 +1,189 @@
+/**
+ * Microsoft Graph client wrapper.
+ *
+ * Builds a `Client` from `@microsoft/microsoft-graph-client` whose auth provider
+ * pulls from the per-account TokenStore, with auto-refresh when the access
+ * token is within the refresh threshold of expiry.
+ *
+ * Centralises error classification — every Graph error decision keys off the
+ * status code and the structured `error.code` field, never the prose body.
+ * Aligns with `feedback_no_stdout_parsing_for_control_flow.md`.
+ */
+import { Client } from "@microsoft/microsoft-graph-client";
+import { refreshAccessToken } from "../auth/pkce-flow.js";
+import { log } from "./log.js";
+/** Pull (statusCode, code, headers) from whatever shape the SDK threw. */
+function normalizeGraphError(err) {
+    const e = err;
+    const statusCode = e.statusCode ?? e.status ?? 0;
+    let code = e.code ?? "";
+    if (!code && typeof e.body === "string") {
+        try {
+            const parsed = JSON.parse(e.body);
+            code = parsed.error?.code ?? "";
+        }
+        catch {
+            // body wasn't JSON; leave code empty
+        }
+    }
+    else if (!code && e.body && typeof e.body === "object") {
+        code = e.body.error?.code ?? "";
+    }
+    let retryAfterHeader = null;
+    let mailServerHeader = null;
+    const fetchHeaders = e.response?.headers;
+    if (fetchHeaders && typeof fetchHeaders.get === "function") {
+        retryAfterHeader = fetchHeaders.get("retry-after") ?? null;
+        mailServerHeader = fetchHeaders.get("x-mailbox-server") ?? null;
+    }
+    else if (e.headers instanceof Map) {
+        retryAfterHeader = e.headers.get("retry-after") ?? e.headers.get("Retry-After") ?? null;
+        mailServerHeader = e.headers.get("x-mailbox-server") ?? null;
+    }
+    else if (e.headers && typeof e.headers === "object") {
+        const h = e.headers;
+        retryAfterHeader =
+            h["retry-after"] ?? h["Retry-After"] ?? h["RETRY-AFTER"] ?? null;
+        mailServerHeader = h["x-mailbox-server"] ?? h["X-MailboxServer"] ?? null;
+    }
+    return { statusCode, code, retryAfterHeader, mailServerHeader };
+}
+export function classifyGraphError(err) {
+    const norm = normalizeGraphError(err);
+    const { statusCode, code, retryAfterHeader, mailServerHeader } = norm;
+    if (statusCode === 401) {
+        return { kind: "auth", statusCode, code: code || "Unauthenticated" };
+    }
+    if (statusCode === 429) {
+        if (retryAfterHeader) {
+            const seconds = Number(retryAfterHeader);
+            if (Number.isFinite(seconds) && seconds >= 0) {
+                return {
+                    kind: "rate-limit-recoverable",
+                    statusCode,
+                    retryAfterMs: seconds * 1000,
+                };
+            }
+        }
+        return { kind: "rate-limit-terminal", statusCode };
+    }
+    if (statusCode === 503 && code === "MailboxNotEnabledForRESTAPI") {
+        return { kind: "on-prem", statusCode, mailServer: mailServerHeader ?? undefined };
+    }
+    if (statusCode >= 500 && statusCode < 600) {
+        return { kind: "5xx", statusCode, code: code || "ServerError" };
+    }
+    return { kind: "other", statusCode, code: code || "Unknown" };
+}
+/**
+ * Factory wrapping `Client.init`. Exported as a named function so tests can
+ * `vi.spyOn(graphClient, "createGraphClient")` reliably (avoids the
+ * destructured-ESM mock no-op pitfall).
+ */
+export function createGraphClient(config) {
+    return Client.init({
+        authProvider: async (done) => {
+            try {
+                const token = await getOrRefreshAccessToken(config);
+                done(null, token);
+            }
+            catch (err) {
+                done(err, null);
+            }
+        },
+    });
+}
+export async function getOrRefreshAccessToken(config) {
+    const { tokenStore, clientId, tenantId, accountId } = config;
+    const blob = tokenStore.read();
+    if (!blob) {
+        throw new Error(`auth-required: Outlook not connected for account=${accountId}; run outlook-account-register.`);
+    }
+    if (tokenStore.refreshTokenExpired() || !blob.refreshToken) {
+        throw new Error(`auth-required: Outlook refresh token expired for account=${accountId}; run outlook-account-register.`);
+    }
+    if (!tokenStore.needsRefresh()) {
+        return blob.accessToken;
+    }
+    const oldExpSec = Math.floor(blob.accessTokenExpiry / 1000);
+    try {
+        const refreshed = await refreshAccessToken({
+            clientId,
+            tenantId,
+            refreshToken: blob.refreshToken,
+        });
+        const updated = tokenStore.store(refreshed.access_token, refreshed.refresh_token ?? blob.refreshToken, refreshed.expires_in, { graphUserId: blob.graphUserId, scopes: blob.scopes });
+        log({
+            event: "token-refreshed",
+            account: accountId,
+            oldExpSec,
+            newExpSec: Math.floor(updated.accessTokenExpiry / 1000),
+        });
+        return updated.accessToken;
+    }
+    catch (err) {
+        log({
+            event: "token-refresh-failed",
+            account: accountId,
+            reason: err.message,
+        });
+        tokenStore.clear();
+        throw new Error(`Outlook token refresh failed for account=${accountId}; re-auth required.`);
+    }
+}
+/**
+ * Run a Graph call with classification, single retry on `auth` (refresh +
+ * retry once), and respect for 429 Retry-After. All terminal classes throw
+ * with operator-readable messages.
+ */
+export async function callGraph(config, invoke, opts = { tool: "graph" }) {
+    let attempts = 0;
+    // Up to 3 attempts: original, one for auth-refresh, one for 429-recoverable.
+    while (true) {
+        attempts += 1;
+        const client = createGraphClient(config);
+        try {
+            return await invoke(client);
+        }
+        catch (err) {
+            const cls = classifyGraphError(err);
+            log({
+                event: "graph-error",
+                account: config.accountId,
+                status: cls.statusCode,
+                code: "code" in cls ? cls.code : "",
+                retryAfterMs: cls.kind === "rate-limit-recoverable" ? cls.retryAfterMs : null,
+            });
+            if (cls.kind === "on-prem") {
+                log({
+                    event: "on-prem-rejected",
+                    account: config.accountId,
+                    mailServer: cls.mailServer ?? "unknown",
+                });
+                throw new Error("Microsoft Graph does not support on-premises Exchange. Use Task 769 (IMAP).");
+            }
+            if (cls.kind === "rate-limit-terminal") {
+                throw new Error(`Outlook rate-limited without Retry-After hint (account=${config.accountId}, tool=${opts.tool}).`);
+            }
+            if (cls.kind === "auth" && attempts === 1) {
+                // Force a refresh on the next iteration by clearing the local cache
+                // and explicitly refreshing, then retry.
+                await getOrRefreshAccessToken({ ...config });
+                continue;
+            }
+            if (cls.kind === "auth") {
+                throw new Error(`Outlook auth expired for account=${config.accountId}; run outlook-account-register.`);
+            }
+            if (cls.kind === "rate-limit-recoverable" && attempts === 1) {
+                await new Promise((resolve) => setTimeout(resolve, cls.retryAfterMs));
+                continue;
+            }
+            if (cls.kind === "5xx" && attempts === 1) {
+                await new Promise((resolve) => setTimeout(resolve, 500));
+                continue;
+            }
+            throw err;
+        }
+    }
+}
+//# sourceMappingURL=graph-client.js.map

package/payload/platform/plugins/outlook/mcp/dist/lib/graph-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"graph-client.js","sourceRoot":"","sources":["../../src/lib/graph-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,mCAAmC,CAAC;AAC3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE1D,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAwB/B,0EAA0E;AAC1E,SAAS,mBAAmB,CAAC,GAAY;IACvC,MAAM,CAAC,GAAG,GAOT,CAAC;IAEF,MAAM,UAAU,GAAG,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC;IAEjD,IAAI,IAAI,GAAG,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;IACxB,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACxC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAkC,CAAC;YACnE,IAAI,GAAG,MAAM,CAAC,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,qCAAqC;QACvC,CAAC;IACH,CAAC;SAAM,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACzD,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC;IAClC,CAAC;IAED,IAAI,gBAAgB,GAAkB,IAAI,CAAC;IAC3C,IAAI,gBAAgB,GAAkB,IAAI,CAAC;IAC3C,MAAM,YAAY,GAAG,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC;IACzC,IAAI,YAAY,IAAI,OAAO,YAAY,CAAC,GAAG,KAAK,UAAU,EAAE,CAAC;QAC3D,gBAAgB,GAAG,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC;QAC3D,gBAAgB,GAAG,YAAY,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,IAAI,CAAC;IAClE,CAAC;SAAM,IAAI,CAAC,CAAC,OAAO,YAAY,GAAG,EAAE,CAAC;QACpC,gBAAgB,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC;QACxF,gBAAgB,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,IAAI,CAAC;IAC/D,CAAC;SAAM,IAAI,CAAC,CAAC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QACtD,MAAM,CAAC,GAAG,CAAC,CAAC,OAAiC,CAAC;QAC9C,gBAAgB;YACd,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC;QACnE,gBAAgB,GAAG,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,iBAAiB,CAAC,IAAI,IAAI,CAAC;IAC3E,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,GAAY;IAC7C,MAAM,IAAI,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,GAAG,IAAI,CAAC;IAEtE,IAAI,UAAU,KAAK,GAAG,EAAE,CAAC;QACvB,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,IAAI,iBAAiB,EAAE,CAAC;IACvE,CAAC;IACD,IAAI,UAAU,KAAK,GAAG,EAAE,CAAC;QACvB,IAAI,gBAAgB,EAAE,CAAC;YACrB,MAAM,OAAO,GAAG,MAAM,CAAC,gBAAgB,CAAC,CAAC;YACzC,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC;gBAC7C,OAAO;oBACL,IAAI,EAAE,wBAAwB;oBAC9B,UAAU;oBACV,YAAY,EAAE,OAAO,GAAG,IAAI;iBAC7B,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,qBAAqB,EAAE,UAAU,EAAE,CAAC;IACrD,CAAC;IACD,IAAI,UAAU,KAAK,GAAG,IAAI,IAAI,KAAK,6BAA6B,EAAE,CAAC;QACjE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,gBAAgB,IAAI,SAAS,EAAE,CAAC;IACpF,CAAC;IACD,IAAI,UAAU,IAAI,GAAG,IAAI,UAAU,GAAG,GAAG,EAAE,CAAC;QAC1C,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,IAAI,aAAa,EAAE,CAAC;IAClE,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,IAAI,SAAS,EAAE,CAAC;AAChE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAyB;IACzD,OAAO,MAAM,CAAC,IAAI,CAAC;QACjB,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YAC3B,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,uBAAuB,CAAC,MAAM,CAAC,CAAC;gBACpD,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACpB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,GAAY,EAAE,IAAI,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,MAAyB;IACrE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC;IAC7D,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC;IAC/B,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CACb,oDAAoD,SAAS,iCAAiC,CAC/F,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,CAAC,mBAAmB,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CACb,4DAA4D,SAAS,iCAAiC,CACvG,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAC;IAC5D,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC;YACzC,QAAQ;YACR,QAAQ;YACR,YAAY,EAAE,IAAI,CAAC,YAAY;SAChC,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAC9B,SAAS,CAAC,YAAY,EACtB,SAAS,CAAC,aAAa,IAAI,IAAI,CAAC,YAAY,EAC5C,SAAS,CAAC,UAAU,EACpB,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CACvD,CAAC;QACF,GAAG,CAAC;YACF,KAAK,EAAE,iBAAiB;YACxB,OAAO,EAAE,SAAS;YAClB,SAAS;YACT,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;SACxD,CAAC,CAAC;QACH,OAAO,OAAO,CAAC,WAAW,CAAC;IAC7B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC;YACF,KAAK,EAAE,sBAAsB;YAC7B,OAAO,EAAE,SAAS;YAClB,MAAM,EAAG,GAAa,CAAC,OAAO;SAC/B,CAAC,CAAC;QACH,UAAU,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CACb,4CAA4C,SAAS,qBAAqB,CAC3E,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,MAAyB,EACzB,MAAsC,EACtC,OAAyB,EAAE,IAAI,EAAE,OAAO,EAAE;IAE1C,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,6EAA6E;IAC7E,OAAO,IAAI,EAAE,CAAC;QACZ,QAAQ,IAAI,CAAC,CAAC;QACd,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC;YACH,OAAO,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC;QAC9B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;YACpC,GAAG,CAAC;gBACF,KAAK,EAAE,aAAa;gBACpB,OAAO,EAAE,MAAM,CAAC,SAAS;gBACzB,MAAM,EAAE,GAAG,CAAC,UAAU;gBACtB,IAAI,EAAE,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;gBACnC,YAAY,EAAE,GAAG,CAAC,IAAI,KAAK,wBAAwB,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI;aAC9E,CAAC,CAAC;YACH,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC3B,GAAG,CAAC;oBACF,KAAK,EAAE,kBAAkB;oBACzB,OAAO,EAAE,MAAM,CAAC,SAAS;oBACzB,UAAU,EAAE,GAAG,CAAC,UAAU,IAAI,SAAS;iBACxC,CAAC,CAAC;gBACH,MAAM,IAAI,KAAK,CACb,6EAA6E,CAC9E,CAAC;YACJ,CAAC;YACD,IAAI,GAAG,CAAC,IAAI,KAAK,qBAAqB,EAAE,CAAC;gBACvC,MAAM,IAAI,KAAK,CACb,0DAA0D,MAAM,CAAC,SAAS,UAAU,IAAI,CAAC,IAAI,IAAI,CAClG,CAAC;YACJ,CAAC;YACD,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;gBAC1C,oEAAoE;gBACpE,yCAAyC;gBACzC,MAAM,uBAAuB,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;gBAC7C,SAAS;YACX,CAAC;YACD,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBACxB,MAAM,IAAI,KAAK,CACb,oCAAoC,MAAM,CAAC,SAAS,iCAAiC,CACtF,CAAC;YACJ,CAAC;YACD,IAAI,GAAG,CAAC,IAAI,KAAK,wBAAwB,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;gBAC5D,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC;gBACtE,SAAS;YACX,CAAC;YACD,IAAI,GAAG,CAAC,IAAI,KAAK,KAAK,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;gBACzC,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;gBACzD,SAAS;YACX,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;AACH,CAAC"}

package/payload/platform/plugins/outlook/mcp/dist/lib/log.d.ts

@@ -0,0 +1,23 @@
+/**
+ * [outlook-mcp] structured logger.
+ *
+ * Every log line is prefixed `[outlook-mcp]` and rendered as `key=value` pairs
+ * (Pino-compatible shape). Bearer tokens and `access_token=` query strings are
+ * redacted before writing — defense in depth even though tools never log them.
+ */
+export declare function redact(value: string): string;
+/**
+ * Log an event line. The first key in `fields` (typically `event`) becomes the
+ * top-level event tag; remaining keys are rendered as `k=v` pairs.
+ *
+ *   log({ event: "mail-list", account: "abc", count: 25, elapsedMs: 320 })
+ *     → [outlook-mcp] mail-list account=abc count=25 elapsedMs=320
+ */
+export declare function log(fields: {
+    event: string;
+} & Record<string, unknown>): void;
+/** Truncate a string to N chars, replacing the tail with `…` if it overflowed. */
+export declare function trunc(value: string, max: number): string;
+/** Hex-prefix of a SHA-256 challenge for log identification (8 chars). */
+export declare function challengePrefix(challenge: string): string;
+//# sourceMappingURL=log.d.ts.map

package/payload/platform/plugins/outlook/mcp/dist/lib/log.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"log.d.ts","sourceRoot":"","sources":["../../src/lib/log.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH,wBAAgB,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAI5C;AAcD;;;;;;GAMG;AACH,wBAAgB,GAAG,CAAC,MAAM,EAAE;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAO7E;AAED,kFAAkF;AAClF,wBAAgB,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAGxD;AAED,0EAA0E;AAC1E,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAEzD"}

package/payload/platform/plugins/outlook/mcp/dist/lib/log.js

@@ -0,0 +1,53 @@
+/**
+ * [outlook-mcp] structured logger.
+ *
+ * Every log line is prefixed `[outlook-mcp]` and rendered as `key=value` pairs
+ * (Pino-compatible shape). Bearer tokens and `access_token=` query strings are
+ * redacted before writing — defense in depth even though tools never log them.
+ */
+const REDACT_BEARER = /Bearer\s+[A-Za-z0-9._\-+/=]+/g;
+const REDACT_ACCESS_TOKEN = /access_token=[A-Za-z0-9._\-+/=]+/g;
+export function redact(value) {
+    return value
+        .replace(REDACT_BEARER, "Bearer <REDACTED>")
+        .replace(REDACT_ACCESS_TOKEN, "access_token=<REDACTED>");
+}
+function fmt(value) {
+    if (value === null || value === undefined)
+        return "null";
+    if (typeof value === "string") {
+        if (/[\s"=]/.test(value)) {
+            return `"${redact(value).replace(/"/g, '\\"')}"`;
+        }
+        return redact(value);
+    }
+    if (typeof value === "number" || typeof value === "boolean")
+        return String(value);
+    return `"${redact(JSON.stringify(value)).replace(/"/g, '\\"')}"`;
+}
+/**
+ * Log an event line. The first key in `fields` (typically `event`) becomes the
+ * top-level event tag; remaining keys are rendered as `k=v` pairs.
+ *
+ *   log({ event: "mail-list", account: "abc", count: 25, elapsedMs: 320 })
+ *     → [outlook-mcp] mail-list account=abc count=25 elapsedMs=320
+ */
+export function log(fields) {
+    const { event, ...rest } = fields;
+    const parts = [event];
+    for (const [key, value] of Object.entries(rest)) {
+        parts.push(`${key}=${fmt(value)}`);
+    }
+    process.stderr.write(`[outlook-mcp] ${parts.join(" ")}\n`);
+}
+/** Truncate a string to N chars, replacing the tail with `…` if it overflowed. */
+export function trunc(value, max) {
+    if (value.length <= max)
+        return value;
+    return value.slice(0, max - 1) + "…";
+}
+/** Hex-prefix of a SHA-256 challenge for log identification (8 chars). */
+export function challengePrefix(challenge) {
+    return challenge.slice(0, 8);
+}
+//# sourceMappingURL=log.js.map

package/payload/platform/plugins/outlook/mcp/dist/lib/log.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"log.js","sourceRoot":"","sources":["../../src/lib/log.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,aAAa,GAAG,+BAA+B,CAAC;AACtD,MAAM,mBAAmB,GAAG,mCAAmC,CAAC;AAEhE,MAAM,UAAU,MAAM,CAAC,KAAa;IAClC,OAAO,KAAK;SACT,OAAO,CAAC,aAAa,EAAE,mBAAmB,CAAC;SAC3C,OAAO,CAAC,mBAAmB,EAAE,yBAAyB,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,GAAG,CAAC,KAAc;IACzB,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACzD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC;QACnD,CAAC;QACD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IAClF,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC;AACnE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,GAAG,CAAC,MAAmD;IACrE,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAC;IAClC,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,CAAC;IACtB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAC7D,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,KAAK,CAAC,KAAa,EAAE,GAAW;IAC9C,IAAI,KAAK,CAAC,MAAM,IAAI,GAAG;QAAE,OAAO,KAAK,CAAC;IACtC,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC;AACvC,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,eAAe,CAAC,SAAiB;IAC/C,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAC/B,CAAC"}

package/payload/platform/plugins/outlook/mcp/dist/tools/account-register.d.ts

@@ -0,0 +1,26 @@
+import type { TokenStore } from "../auth/token-store.js";
+export interface AccountRegisterArgs {
+    accountId: string;
+    clientId: string;
+    tenantId: string;
+    tokenStore: TokenStore;
+}
+export interface AccountRegisterResult {
+    status: "registered";
+    authUrl: string;
+    graphUserId: string;
+    scopes: string[];
+    tokenExpSec: number;
+}
+/**
+ * Run the PKCE register flow end-to-end:
+ *   1. Bind a loopback callback server, build the auth URL, return URL to operator.
+ *   2. Wait for the callback (5-min timeout).
+ *   3. Exchange code → tokens; persist encrypted to per-account store.
+ *   4. Fetch /me to record graphUserId for log lines.
+ *
+ * The MCP tool layer prints the auth URL prominently in the tool response so
+ * the operator can paste it into the VNC browser.
+ */
+export declare function runAccountRegister(args: AccountRegisterArgs): Promise<AccountRegisterResult>;
+//# sourceMappingURL=account-register.d.ts.map

package/payload/platform/plugins/outlook/mcp/dist/tools/account-register.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-register.d.ts","sourceRoot":"","sources":["../../src/tools/account-register.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAGzD,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,UAAU,CAAC;CACxB;AAED,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,YAAY,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;CACrB;AAQD;;;;;;;;;GASG;AACH,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAiDlG"}

package/payload/platform/plugins/outlook/mcp/dist/tools/account-register.js

@@ -0,0 +1,50 @@
+import { startPkceFlow } from "../auth/pkce-flow.js";
+import { log } from "../lib/log.js";
+/**
+ * Run the PKCE register flow end-to-end:
+ *   1. Bind a loopback callback server, build the auth URL, return URL to operator.
+ *   2. Wait for the callback (5-min timeout).
+ *   3. Exchange code → tokens; persist encrypted to per-account store.
+ *   4. Fetch /me to record graphUserId for log lines.
+ *
+ * The MCP tool layer prints the auth URL prominently in the tool response so
+ * the operator can paste it into the VNC browser.
+ */
+export async function runAccountRegister(args) {
+    const flow = await startPkceFlow({
+        clientId: args.clientId,
+        tenantId: args.tenantId,
+        accountId: args.accountId,
+    });
+    process.stderr.write(`[outlook-mcp] OPERATOR ACTION: open this URL in the VNC browser to authorize Outlook for account=${args.accountId}:\n${flow.authUrl}\n`);
+    const { tokenResponse, scopes } = await flow.result;
+    // Fetch /me with the raw access token directly — bypasses TokenStore so we
+    // can persist a single, complete blob (with graphUserId) in one write. If
+    // /me fails, no tokens hit disk and the operator simply re-runs register.
+    const meResp = await fetch("https://graph.microsoft.com/v1.0/me?$select=id,mail,userPrincipalName", {
+        headers: { Authorization: `Bearer ${tokenResponse.access_token}` },
+    });
+    if (!meResp.ok) {
+        const text = await meResp.text();
+        throw new Error(`Failed to fetch /me after token exchange (status=${meResp.status}): ${text}`);
+    }
+    const me = (await meResp.json());
+    const graphUserId = me.id ?? me.mail ?? me.userPrincipalName ?? "unknown";
+    args.tokenStore.store(tokenResponse.access_token, tokenResponse.refresh_token ?? null, tokenResponse.expires_in, { graphUserId, scopes });
+    const tokenExpSec = Math.floor((args.tokenStore.read()?.accessTokenExpiry ?? 0) / 1000);
+    log({
+        event: "auth-ok",
+        account: args.accountId,
+        graphUserId,
+        scopes: scopes.join(","),
+        tokenExpSec,
+    });
+    return {
+        status: "registered",
+        authUrl: flow.authUrl,
+        graphUserId,
+        scopes,
+        tokenExpSec,
+    };
+}
+//# sourceMappingURL=account-register.js.map

package/payload/platform/plugins/outlook/mcp/dist/tools/account-register.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-register.js","sourceRoot":"","sources":["../../src/tools/account-register.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAErD,OAAO,EAAE,GAAG,EAAE,MAAM,eAAe,CAAC;AAuBpC;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAAyB;IAChE,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC;QAC/B,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,SAAS,EAAE,IAAI,CAAC,SAAS;KAC1B,CAAC,CAAC;IAEH,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,oGAAoG,IAAI,CAAC,SAAS,MAAM,IAAI,CAAC,OAAO,IAAI,CACzI,CAAC;IAEF,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC;IAEpD,2EAA2E;IAC3E,0EAA0E;IAC1E,0EAA0E;IAC1E,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,uEAAuE,EAAE;QAClG,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,aAAa,CAAC,YAAY,EAAE,EAAE;KACnE,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,oDAAoD,MAAM,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;IACjG,CAAC;IACD,MAAM,EAAE,GAAG,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAoB,CAAC;IACpD,MAAM,WAAW,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,iBAAiB,IAAI,SAAS,CAAC;IAE1E,IAAI,CAAC,UAAU,CAAC,KAAK,CACnB,aAAa,CAAC,YAAY,EAC1B,aAAa,CAAC,aAAa,IAAI,IAAI,EACnC,aAAa,CAAC,UAAU,EACxB,EAAE,WAAW,EAAE,MAAM,EAAE,CACxB,CAAC;IAEF,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,iBAAiB,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACxF,GAAG,CAAC;QACF,KAAK,EAAE,SAAS;QAChB,OAAO,EAAE,IAAI,CAAC,SAAS;QACvB,WAAW;QACX,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;QACxB,WAAW;KACZ,CAAC,CAAC;IAEH,OAAO;QACL,MAAM,EAAE,YAAY;QACpB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,WAAW;QACX,MAAM;QACN,WAAW;KACZ,CAAC;AACJ,CAAC"}

package/payload/platform/plugins/outlook/mcp/dist/tools/calendar-event.d.ts

@@ -0,0 +1,12 @@
+import type { GraphClientConfig } from "../lib/graph-client.js";
+import { type CalendarEventItem } from "./calendar-list.js";
+export interface CalendarEventArgs {
+    eventId: string;
+}
+export interface CalendarEventDetail extends CalendarEventItem {
+    bodyPreview: string;
+    body: string;
+    webLink: string | null;
+}
+export declare function runCalendarEvent(config: GraphClientConfig, args: CalendarEventArgs): Promise<CalendarEventDetail>;
+//# sourceMappingURL=calendar-event.d.ts.map

package/payload/platform/plugins/outlook/mcp/dist/tools/calendar-event.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"calendar-event.d.ts","sourceRoot":"","sources":["../../src/tools/calendar-event.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAGhE,OAAO,EAAc,KAAK,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAExE,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,mBAAoB,SAAQ,iBAAiB;IAC5D,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAqBD,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,iBAAiB,EACzB,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC,mBAAmB,CAAC,CAiC9B"}