@rubytech/create-maxy-code 0.1.440 → 0.1.441

package/payload/platform/plugins/outlook/mcp/dist/auth/mailbox-registry.d.ts

@@ -0,0 +1,81 @@
+/**
+ * Per-account registry of Outlook mailboxes.
+ *
+ * A sub-account can hold N mailboxes at once. Each mailbox is its own encrypted
+ * `tokens.enc` under `secrets/outlook/mailboxes/<graphUserId>/`, sharing the one
+ * account-level AES `.key`. This registry enumerates them, migrates the legacy
+ * single-mailbox layout on first read, and resolves a caller's mailbox selector
+ * down to the right TokenStore.
+ *
+ * Migration preserves the AES key, so the legacy ciphertext is valid as-is under
+ * the new path — migration is a file move, never a re-encrypt, and never forces
+ * a re-auth.
+ */
+import { TokenStore } from "./token-store.js";
+export interface MailboxDescriptor {
+    /** Sanitized directory name under `mailboxes/` — an opaque handle. */
+    mailboxKey: string;
+    graphUserId: string | null;
+    mail: string | null;
+    scopes: string[];
+    tokenExpSec: number | null;
+    refreshExpired: boolean;
+    /** false when the blob failed to decrypt or parse — surfaced, not hidden. */
+    readable: boolean;
+}
+export type ResolveResult = {
+    kind: "ok";
+    store: TokenStore;
+    descriptor: MailboxDescriptor;
+} | {
+    kind: "none";
+} | {
+    kind: "ambiguous";
+    identities: string[];
+} | {
+    kind: "notfound";
+    selector: string;
+    identities: string[];
+};
+export interface CredResolveEvent {
+    event: "cred-resolve";
+    account: string;
+    mailbox: string;
+    source: "arg" | "sole" | "none" | "refused";
+}
+/**
+ * The observability line for a resolution: names the *resolved* mailbox and how
+ * it was chosen, so a wrong or absent selector is diagnosable from one line
+ * without decrypting the store. Pure — computed from the resolve result and the
+ * caller's selector, so selection (not a silent default) is testable.
+ */
+export declare function credResolveEvent(resolved: ResolveResult, account: string, selector?: string): CredResolveEvent;
+export declare class MailboxRegistry {
+    readonly accountId: string;
+    private readonly accountsDir;
+    private readonly secretsDir;
+    private readonly mailboxesDir;
+    private readonly legacyTokensPath;
+    constructor(accountId: string, accountsDir: string);
+    /**
+     * Move a pre-migration `secrets/outlook/tokens.enc` into
+     * `mailboxes/<graphUserId>/tokens.enc`. Idempotent: a no-op once the legacy
+     * file is gone. Reads the blob only to learn its mailbox key; the ciphertext
+     * itself is moved unchanged (same account key).
+     */
+    private migrateLegacy;
+    /** Every mailbox attached to this account, migrating legacy on first read. */
+    list(): MailboxDescriptor[];
+    private describe;
+    /**
+     * Resolve a mailbox selector to a TokenStore. Order: explicit selector
+     * (matched against graphUserId or mail, case-insensitive) → the sole readable
+     * mailbox → ambiguous (≥2 readable, none named) → none (zero readable).
+     * Unreadable mailboxes are never addressable.
+     */
+    resolve(selector?: string): ResolveResult;
+    /** A TokenStore for a specific mailbox key (a graphUserId at register time, or
+     * a descriptor's mailboxKey). Overwrites that mailbox in place on store(). */
+    storeFor(mailboxKey: string): TokenStore;
+}
+//# sourceMappingURL=mailbox-registry.d.ts.map

package/payload/platform/plugins/outlook/mcp/dist/auth/mailbox-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mailbox-registry.d.ts","sourceRoot":"","sources":["../../src/auth/mailbox-registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,OAAO,EAAE,UAAU,EAAsB,MAAM,kBAAkB,CAAC;AAElE,MAAM,WAAW,iBAAiB;IAChC,sEAAsE;IACtE,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,cAAc,EAAE,OAAO,CAAC;IACxB,6EAA6E;IAC7E,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,MAAM,aAAa,GACrB;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,UAAU,CAAC;IAAC,UAAU,EAAE,iBAAiB,CAAA;CAAE,GAChE;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAChB;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,UAAU,EAAE,MAAM,EAAE,CAAA;CAAE,GAC3C;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAUjE,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,cAAc,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;CAC7C;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,aAAa,EACvB,OAAO,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,MAAM,GAChB,gBAAgB,CAalB;AAED,qBAAa,eAAe;aAMR,SAAS,EAAE,MAAM;IACjC,OAAO,CAAC,QAAQ,CAAC,WAAW;IAN9B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAS;gBAGxB,SAAS,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM;IAOtC;;;;;OAKG;IACH,OAAO,CAAC,aAAa;IA4BrB,8EAA8E;IAC9E,IAAI,IAAI,iBAAiB,EAAE;IAa3B,OAAO,CAAC,QAAQ;IAqBhB;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,aAAa;IA8BzC;kFAC8E;IAC9E,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,UAAU;CAGzC"}

package/payload/platform/plugins/outlook/mcp/dist/auth/mailbox-registry.js

@@ -0,0 +1,171 @@
+/**
+ * Per-account registry of Outlook mailboxes.
+ *
+ * A sub-account can hold N mailboxes at once. Each mailbox is its own encrypted
+ * `tokens.enc` under `secrets/outlook/mailboxes/<graphUserId>/`, sharing the one
+ * account-level AES `.key`. This registry enumerates them, migrates the legacy
+ * single-mailbox layout on first read, and resolves a caller's mailbox selector
+ * down to the right TokenStore.
+ *
+ * Migration preserves the AES key, so the legacy ciphertext is valid as-is under
+ * the new path — migration is a file move, never a re-encrypt, and never forces
+ * a re-auth.
+ */
+import { existsSync, mkdirSync, readdirSync, renameSync, unlinkSync } from "node:fs";
+import { join } from "node:path";
+import { TokenStore, sanitizeMailboxKey } from "./token-store.js";
+/** Human-readable identity for refusal messages: prefer the email, fall back to
+ * the graphUserId, then to the directory handle. An unreadable mailbox is tagged
+ * so a refusal listing it is honest about why it cannot be selected. */
+function identityOf(d) {
+    if (!d.readable)
+        return `${d.mailboxKey} (unreadable)`;
+    return d.mail ?? d.graphUserId ?? d.mailboxKey;
+}
+/**
+ * The observability line for a resolution: names the *resolved* mailbox and how
+ * it was chosen, so a wrong or absent selector is diagnosable from one line
+ * without decrypting the store. Pure — computed from the resolve result and the
+ * caller's selector, so selection (not a silent default) is testable.
+ */
+export function credResolveEvent(resolved, account, selector) {
+    if (resolved.kind === "ok") {
+        return {
+            event: "cred-resolve",
+            account,
+            mailbox: identityOf(resolved.descriptor),
+            source: selector ? "arg" : "sole",
+        };
+    }
+    if (resolved.kind === "none") {
+        return { event: "cred-resolve", account, mailbox: "", source: "none" };
+    }
+    return { event: "cred-resolve", account, mailbox: selector ?? "", source: "refused" };
+}
+export class MailboxRegistry {
+    accountId;
+    accountsDir;
+    secretsDir;
+    mailboxesDir;
+    legacyTokensPath;
+    constructor(accountId, accountsDir) {
+        this.accountId = accountId;
+        this.accountsDir = accountsDir;
+        this.secretsDir = join(accountsDir, accountId, "secrets", "outlook");
+        this.mailboxesDir = join(this.secretsDir, "mailboxes");
+        this.legacyTokensPath = join(this.secretsDir, "tokens.enc");
+    }
+    /**
+     * Move a pre-migration `secrets/outlook/tokens.enc` into
+     * `mailboxes/<graphUserId>/tokens.enc`. Idempotent: a no-op once the legacy
+     * file is gone. Reads the blob only to learn its mailbox key; the ciphertext
+     * itself is moved unchanged (same account key).
+     */
+    migrateLegacy() {
+        if (!existsSync(this.legacyTokensPath))
+            return;
+        let key = "unknown";
+        try {
+            const blob = new TokenStore(this.accountId, this.accountsDir).read();
+            if (blob?.graphUserId)
+                key = blob.graphUserId;
+        }
+        catch {
+            // Undecryptable legacy blob: park it under a stable handle rather than
+            // discard it, so it surfaces as an unreadable mailbox instead of vanishing.
+            key = "legacy-unreadable";
+        }
+        const destDir = join(this.mailboxesDir, sanitizeMailboxKey(key));
+        const destPath = join(destDir, "tokens.enc");
+        mkdirSync(destDir, { recursive: true, mode: 0o700 });
+        try {
+            if (existsSync(destPath)) {
+                // A mailbox with this key already exists — the legacy copy is redundant.
+                unlinkSync(this.legacyTokensPath);
+            }
+            else {
+                renameSync(this.legacyTokensPath, destPath);
+            }
+        }
+        catch (err) {
+            // A second process for the same account migrated first, so the legacy
+            // source is already gone. Treat as done rather than crashing the tool call.
+            if (err.code !== "ENOENT")
+                throw err;
+        }
+    }
+    /** Every mailbox attached to this account, migrating legacy on first read. */
+    list() {
+        this.migrateLegacy();
+        if (!existsSync(this.mailboxesDir))
+            return [];
+        const out = [];
+        for (const entry of readdirSync(this.mailboxesDir, { withFileTypes: true })) {
+            if (!entry.isDirectory())
+                continue;
+            const mailboxKey = entry.name;
+            if (!existsSync(join(this.mailboxesDir, mailboxKey, "tokens.enc")))
+                continue;
+            out.push(this.describe(mailboxKey));
+        }
+        return out;
+    }
+    describe(mailboxKey) {
+        const store = new TokenStore(this.accountId, this.accountsDir, mailboxKey);
+        try {
+            const blob = store.read();
+            if (!blob) {
+                return { mailboxKey, graphUserId: null, mail: null, scopes: [], tokenExpSec: null, refreshExpired: false, readable: false };
+            }
+            return {
+                mailboxKey,
+                graphUserId: blob.graphUserId,
+                mail: blob.mail,
+                scopes: blob.scopes,
+                tokenExpSec: Math.floor(blob.accessTokenExpiry / 1000),
+                refreshExpired: store.refreshTokenExpired(),
+                readable: true,
+            };
+        }
+        catch {
+            return { mailboxKey, graphUserId: null, mail: null, scopes: [], tokenExpSec: null, refreshExpired: false, readable: false };
+        }
+    }
+    /**
+     * Resolve a mailbox selector to a TokenStore. Order: explicit selector
+     * (matched against graphUserId or mail, case-insensitive) → the sole readable
+     * mailbox → ambiguous (≥2 readable, none named) → none (zero readable).
+     * Unreadable mailboxes are never addressable.
+     */
+    resolve(selector) {
+        const all = this.list();
+        const addressable = all.filter((d) => d.readable);
+        if (selector) {
+            const needle = selector.toLowerCase();
+            const match = addressable.find((d) => d.graphUserId?.toLowerCase() === needle ||
+                d.mail?.toLowerCase() === needle);
+            if (match) {
+                return { kind: "ok", store: this.storeFor(match.mailboxKey), descriptor: match };
+            }
+            return { kind: "notfound", selector, identities: all.map(identityOf) };
+        }
+        // Ambiguity is decided by the number of mailboxes *attached* (readable or
+        // not), never the readable subset. If a second mailbox is transiently
+        // unreadable, this still refuses rather than silently resolving to the one
+        // that happens to be readable — which would send from the wrong mailbox.
+        if (all.length === 0)
+            return { kind: "none" };
+        if (all.length === 1) {
+            return addressable.length === 1
+                ? { kind: "ok", store: this.storeFor(addressable[0].mailboxKey), descriptor: addressable[0] }
+                : { kind: "none" };
+        }
+        return { kind: "ambiguous", identities: all.map(identityOf) };
+    }
+    /** A TokenStore for a specific mailbox key (a graphUserId at register time, or
+     * a descriptor's mailboxKey). Overwrites that mailbox in place on store(). */
+    storeFor(mailboxKey) {
+        return new TokenStore(this.accountId, this.accountsDir, mailboxKey);
+    }
+}
+//# sourceMappingURL=mailbox-registry.js.map

package/payload/platform/plugins/outlook/mcp/dist/auth/mailbox-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mailbox-registry.js","sourceRoot":"","sources":["../../src/auth/mailbox-registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrF,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAoBlE;;wEAEwE;AACxE,SAAS,UAAU,CAAC,CAAoB;IACtC,IAAI,CAAC,CAAC,CAAC,QAAQ;QAAE,OAAO,GAAG,CAAC,CAAC,UAAU,eAAe,CAAC;IACvD,OAAO,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,UAAU,CAAC;AACjD,CAAC;AASD;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAC9B,QAAuB,EACvB,OAAe,EACf,QAAiB;IAEjB,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QAC3B,OAAO;YACL,KAAK,EAAE,cAAc;YACrB,OAAO;YACP,OAAO,EAAE,UAAU,CAAC,QAAQ,CAAC,UAAU,CAAC;YACxC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM;SAClC,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC7B,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACzE,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AACxF,CAAC;AAED,MAAM,OAAO,eAAe;IAMR;IACC;IANF,UAAU,CAAS;IACnB,YAAY,CAAS;IACrB,gBAAgB,CAAS;IAE1C,YACkB,SAAiB,EAChB,WAAmB;QADpB,cAAS,GAAT,SAAS,CAAQ;QAChB,gBAAW,GAAX,WAAW,CAAQ;QAEpC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;QACrE,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;QACvD,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAC9D,CAAC;IAED;;;;;OAKG;IACK,aAAa;QACnB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,gBAAgB,CAAC;YAAE,OAAO;QAC/C,IAAI,GAAG,GAAG,SAAS,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,CAAC;YACrE,IAAI,IAAI,EAAE,WAAW;gBAAE,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC;QAChD,CAAC;QAAC,MAAM,CAAC;YACP,uEAAuE;YACvE,4EAA4E;YAC5E,GAAG,GAAG,mBAAmB,CAAC;QAC5B,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC;QACjE,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QAC7C,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACrD,IAAI,CAAC;YACH,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACzB,yEAAyE;gBACzE,UAAU,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;YACpC,CAAC;iBAAM,CAAC;gBACN,UAAU,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,sEAAsE;YACtE,4EAA4E;YAC5E,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,GAAG,CAAC;QAClE,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,IAAI;QACF,IAAI,CAAC,aAAa,EAAE,CAAC;QACrB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC;YAAE,OAAO,EAAE,CAAC;QAC9C,MAAM,GAAG,GAAwB,EAAE,CAAC;QACpC,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YAC5E,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE;gBAAE,SAAS;YACnC,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC;YAC9B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC;gBAAE,SAAS;YAC7E,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;QACtC,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAEO,QAAQ,CAAC,UAAkB;QACjC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;QAC3E,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;YAC1B,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;YAC9H,CAAC;YACD,OAAO;gBACL,UAAU;gBACV,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;gBACtD,cAAc,EAAE,KAAK,CAAC,mBAAmB,EAAE;gBAC3C,QAAQ,EAAE,IAAI;aACf,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QAC9H,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,OAAO,CAAC,QAAiB;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACxB,MAAM,WAAW,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAElD,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;YACtC,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAC5B,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,MAAM;gBACvC,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,MAAM,CACnC,CAAC;YACF,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;YACnF,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;QACzE,CAAC;QAED,0EAA0E;QAC1E,sEAAsE;QACtE,2EAA2E;QAC3E,yEAAyE;QACzE,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAC9C,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrB,OAAO,WAAW,CAAC,MAAM,KAAK,CAAC;gBAC7B,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE;gBAC7F,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QACvB,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;IAChE,CAAC;IAED;kFAC8E;IAC9E,QAAQ,CAAC,UAAkB;QACzB,OAAO,IAAI,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;IACtE,CAAC;CACF"}

package/payload/platform/plugins/outlook/mcp/dist/auth/token-store.d.ts

@@ -24,16 +24,30 @@ export interface TokenBlob {
     refreshTokenExpiry: number;
     lastRefresh: number;
     graphUserId: string | null;
+    mail: string | null;
     scopes: string[];
 }
+/** Filesystem-safe mailbox directory name. graphUserId (a GUID) passes through
+ * unchanged; a fallback mail/UPN identity has its unsafe characters folded to
+ * '_'. The true identity is never read back from this name — it lives in the
+ * blob (graphUserId, mail) — so a lossy fold is harmless. */
+export declare function sanitizeMailboxKey(key: string): string;
 export declare class TokenStore {
     readonly accountId: string;
+    readonly mailboxKey?: string | undefined;
     private cachedBlob;
     private encryptionKey;
     private readonly secretsDir;
     private readonly tokensPath;
     private readonly keyPath;
-    constructor(accountId: string, accountsDir: string);
+    /**
+     * @param mailboxKey When set, tokens live under `mailboxes/<key>/tokens.enc`
+     *   so N mailboxes coexist under one account. When omitted, the legacy
+     *   `tokens.enc` path is used — retained for reading pre-migration installs.
+     *   The AES `.key` is always account-level (`secrets/outlook/.key`) and shared
+     *   by every mailbox within the account; account isolation is unchanged.
+     */
+    constructor(accountId: string, accountsDir: string, mailboxKey?: string | undefined);
     /** Load (or create) the AES key. Idempotent and TOCTOU-safe via wx flag. */
     private loadKey;
     private encrypt;
@@ -44,6 +58,7 @@ export declare class TokenStore {
     read(): TokenBlob | null;
     store(accessToken: string, refreshToken: string | null, expiresInSeconds: number, extras?: {
         graphUserId?: string | null;
+        mail?: string | null;
         scopes?: string[];
     }): TokenBlob;
     private tryReadSilent;

package/payload/platform/plugins/outlook/mcp/dist/auth/token-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"token-store.d.ts","sourceRoot":"","sources":["../../src/auth/token-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAkBH,MAAM,WAAW,SAAS;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,qBAAa,UAAU;aAQH,SAAS,EAAE,MAAM;IAPnC,OAAO,CAAC,UAAU,CAA0B;IAC5C,OAAO,CAAC,aAAa,CAAuB;IAC5C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;gBAGf,SAAS,EAAE,MAAM,EACjC,WAAW,EAAE,MAAM;IAOrB,4EAA4E;IAC5E,OAAO,CAAC,OAAO;IAuCf,OAAO,CAAC,OAAO;IASf,OAAO,CAAC,OAAO;IAaf,6EAA6E;IAC7E,OAAO,CAAC,SAAS;IASjB,oEAAoE;IACpE,IAAI,IAAI,SAAS,GAAG,IAAI;IAWxB,KAAK,CACH,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GAAG,IAAI,EAC3B,gBAAgB,EAAE,MAAM,EACxB,MAAM,GAAE;QAAE,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;KAAO,GAC9D,SAAS;IAkBZ,OAAO,CAAC,aAAa;IAQrB;;;OAGG;IACH,YAAY,IAAI,OAAO;IAMvB,SAAS,IAAI,OAAO;IAIpB,mBAAmB,IAAI,OAAO;IAM9B,KAAK,IAAI,IAAI;CAId;AAED,kDAAkD;AAClD,eAAO,MAAM,kBAAkB,QAAuB,CAAC"}
+{"version":3,"file":"token-store.d.ts","sourceRoot":"","sources":["../../src/auth/token-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAkBH,MAAM,WAAW,SAAS;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;;6DAG6D;AAC7D,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED,qBAAa,UAAU;aAeH,SAAS,EAAE,MAAM;aAEjB,UAAU,CAAC,EAAE,MAAM;IAhBrC,OAAO,CAAC,UAAU,CAA0B;IAC5C,OAAO,CAAC,aAAa,CAAuB;IAC5C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IAEjC;;;;;;OAMG;gBAEe,SAAS,EAAE,MAAM,EACjC,WAAW,EAAE,MAAM,EACH,UAAU,CAAC,EAAE,MAAM,YAAA;IASrC,4EAA4E;IAC5E,OAAO,CAAC,OAAO;IAuCf,OAAO,CAAC,OAAO;IASf,OAAO,CAAC,OAAO;IAaf,6EAA6E;IAC7E,OAAO,CAAC,SAAS;IAYjB,oEAAoE;IACpE,IAAI,IAAI,SAAS,GAAG,IAAI;IAWxB,KAAK,CACH,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GAAG,IAAI,EAC3B,gBAAgB,EAAE,MAAM,EACxB,MAAM,GAAE;QAAE,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;KAAO,GACpF,SAAS;IAmBZ,OAAO,CAAC,aAAa;IAQrB;;;OAGG;IACH,YAAY,IAAI,OAAO;IAMvB,SAAS,IAAI,OAAO;IAIpB,mBAAmB,IAAI,OAAO;IAM9B,KAAK,IAAI,IAAI;CAId;AAED,kDAAkD;AAClD,eAAO,MAAM,kBAAkB,QAAuB,CAAC"}

package/payload/platform/plugins/outlook/mcp/dist/auth/token-store.js

@@ -19,20 +19,38 @@
  */
 import { createCipheriv, createDecipheriv, randomBytes } from "node:crypto";
 import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync, } from "node:fs";
-import { join } from "node:path";
+import { dirname, join } from "node:path";
 const REFRESH_THRESHOLD_MS = 5 * 60 * 1000; // 5 minutes
 const REFRESH_TOKEN_LIFETIME_MS = 90 * 24 * 60 * 60 * 1000; // 90 days
+/** Filesystem-safe mailbox directory name. graphUserId (a GUID) passes through
+ * unchanged; a fallback mail/UPN identity has its unsafe characters folded to
+ * '_'. The true identity is never read back from this name — it lives in the
+ * blob (graphUserId, mail) — so a lossy fold is harmless. */
+export function sanitizeMailboxKey(key) {
+    return key.replace(/[^A-Za-z0-9._-]/g, "_");
+}
 export class TokenStore {
     accountId;
+    mailboxKey;
     cachedBlob = null;
     encryptionKey = null;
     secretsDir;
     tokensPath;
     keyPath;
-    constructor(accountId, accountsDir) {
+    /**
+     * @param mailboxKey When set, tokens live under `mailboxes/<key>/tokens.enc`
+     *   so N mailboxes coexist under one account. When omitted, the legacy
+     *   `tokens.enc` path is used — retained for reading pre-migration installs.
+     *   The AES `.key` is always account-level (`secrets/outlook/.key`) and shared
+     *   by every mailbox within the account; account isolation is unchanged.
+     */
+    constructor(accountId, accountsDir, mailboxKey) {
         this.accountId = accountId;
+        this.mailboxKey = mailboxKey;
         this.secretsDir = join(accountsDir, accountId, "secrets", "outlook");
-        this.tokensPath = join(this.secretsDir, "tokens.enc");
+        this.tokensPath = mailboxKey
+            ? join(this.secretsDir, "mailboxes", sanitizeMailboxKey(mailboxKey), "tokens.enc")
+            : join(this.secretsDir, "tokens.enc");
         this.keyPath = join(this.secretsDir, ".key");
     }
     /** Load (or create) the AES key. Idempotent and TOCTOU-safe via wx flag. */
@@ -95,6 +113,9 @@ export class TokenStore {
     /** Atomic write — temp + rename. Either old or new tokens, never partial. */
     writeBlob(blob) {
         const ciphertext = this.encrypt(JSON.stringify(blob));
+        // The mailbox subdir may not exist yet; loadKey only creates the
+        // account-level secretsDir. mode 0700 matches the secrets dir.
+        mkdirSync(dirname(this.tokensPath), { recursive: true, mode: 0o700 });
         const temp = `${this.tokensPath}.tmp`;
         writeFileSync(temp, ciphertext, { mode: 0o600 });
         chmodSync(temp, 0o600);
@@ -127,6 +148,7 @@ export class TokenStore {
                 : (previous?.refreshTokenExpiry ?? now + REFRESH_TOKEN_LIFETIME_MS),
             lastRefresh: now,
             graphUserId: extras.graphUserId ?? previous?.graphUserId ?? null,
+            mail: extras.mail ?? previous?.mail ?? null,
             scopes: extras.scopes ?? previous?.scopes ?? [],
         };
         this.writeBlob(blob);

package/payload/platform/plugins/outlook/mcp/dist/auth/token-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"token-store.js","sourceRoot":"","sources":["../../src/auth/token-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC5E,OAAO,EACL,SAAS,EACT,UAAU,EACV,SAAS,EACT,YAAY,EACZ,UAAU,EACV,QAAQ,EACR,UAAU,EACV,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,MAAM,oBAAoB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,YAAY;AACxD,MAAM,yBAAyB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,UAAU;AAYtE,MAAM,OAAO,UAAU;IAQH;IAPV,UAAU,GAAqB,IAAI,CAAC;IACpC,aAAa,GAAkB,IAAI,CAAC;IAC3B,UAAU,CAAS;IACnB,UAAU,CAAS;IACnB,OAAO,CAAS;IAEjC,YACkB,SAAiB,EACjC,WAAmB;QADH,cAAS,GAAT,SAAS,CAAQ;QAGjC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;QACrE,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QACtD,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC/C,CAAC;IAED,4EAA4E;IACpE,OAAO;QACb,IAAI,IAAI,CAAC,aAAa;YAAE,OAAO,IAAI,CAAC,aAAa,CAAC;QAElD,SAAS,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7D,SAAS,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAElC,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACpC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,KAAK;gBAAE,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAClE,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;YACvD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YACvC,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;gBACtB,MAAM,IAAI,KAAK,CACb,2BAA2B,IAAI,CAAC,SAAS,uBAAuB,GAAG,CAAC,MAAM,aAAa,IAAI,CAAC,OAAO,uCAAuC,CAC3I,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,aAAa,GAAG,GAAG,CAAC;YACzB,OAAO,GAAG,CAAC;QACb,CAAC;QAED,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC/B,IAAI,CAAC;YACH,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE;gBACrD,IAAI,EAAE,IAAI;gBACV,IAAI,EAAE,KAAK;aACZ,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,uDAAuD;YACvD,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACrD,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;gBACvD,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;gBAChD,OAAO,IAAI,CAAC,aAAa,CAAC;YAC5B,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC;QAC5B,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,OAAO,CAAC,SAAiB;QAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QAC3B,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC3B,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QACtD,IAAI,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QACxD,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACjC,OAAO,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,SAAS,EAAE,CAAC;IAC9C,CAAC;IAEO,OAAO,CAAC,OAAe;QAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QAC3B,MAAM,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC5C,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QAC1D,IAAI,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QAC/D,SAAS,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACpC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,6EAA6E;IACrE,SAAS,CAAC,IAAe;QAC/B,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QACtD,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,UAAU,MAAM,CAAC;QACtC,aAAa,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACjD,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACvB,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QAClC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;IACzB,CAAC;IAED,oEAAoE;IACpE,IAAI;QACF,IAAI,IAAI,CAAC,UAAU;YAAE,OAAO,IAAI,CAAC,UAAU,CAAC;QAC5C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;YAAE,OAAO,IAAI,CAAC;QAC9C,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QAC1D,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAc,CAAC;QAC3C,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CACH,WAAmB,EACnB,YAA2B,EAC3B,gBAAwB,EACxB,SAA6D,EAAE;QAE/D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;QACzD,MAAM,IAAI,GAAc;YACtB,WAAW;YACX,YAAY,EAAE,YAAY,IAAI,QAAQ,EAAE,YAAY,IAAI,IAAI;YAC5D,iBAAiB,EAAE,GAAG,GAAG,gBAAgB,GAAG,IAAI;YAChD,kBAAkB,EAAE,YAAY;gBAC9B,CAAC,CAAC,GAAG,GAAG,yBAAyB;gBACjC,CAAC,CAAC,CAAC,QAAQ,EAAE,kBAAkB,IAAI,GAAG,GAAG,yBAAyB,CAAC;YACrE,WAAW,EAAE,GAAG;YAChB,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,QAAQ,EAAE,WAAW,IAAI,IAAI;YAChE,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,QAAQ,EAAE,MAAM,IAAI,EAAE;SAChD,CAAC;QACF,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,aAAa;QACnB,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC;QACrB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,YAAY;QACV,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC;QACxB,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,iBAAiB,GAAG,oBAAoB,CAAC;IACpE,CAAC;IAED,SAAS;QACP,OAAO,IAAI,CAAC,IAAI,EAAE,KAAK,IAAI,CAAC;IAC9B,CAAC;IAED,mBAAmB;QACjB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC;QACxB,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,kBAAkB,CAAC;IAC9C,CAAC;IAED,KAAK;QACH,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QACvB,IAAI,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;YAAE,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC/D,CAAC;CACF;AAED,kDAAkD;AAClD,MAAM,CAAC,MAAM,kBAAkB,GAAG,oBAAoB,CAAC"}
+{"version":3,"file":"token-store.js","sourceRoot":"","sources":["../../src/auth/token-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC5E,OAAO,EACL,SAAS,EACT,UAAU,EACV,SAAS,EACT,YAAY,EACZ,UAAU,EACV,QAAQ,EACR,UAAU,EACV,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE1C,MAAM,oBAAoB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,YAAY;AACxD,MAAM,yBAAyB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,UAAU;AAatE;;;6DAG6D;AAC7D,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC5C,OAAO,GAAG,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,OAAO,UAAU;IAeH;IAEA;IAhBV,UAAU,GAAqB,IAAI,CAAC;IACpC,aAAa,GAAkB,IAAI,CAAC;IAC3B,UAAU,CAAS;IACnB,UAAU,CAAS;IACnB,OAAO,CAAS;IAEjC;;;;;;OAMG;IACH,YACkB,SAAiB,EACjC,WAAmB,EACH,UAAmB;QAFnB,cAAS,GAAT,SAAS,CAAQ;QAEjB,eAAU,GAAV,UAAU,CAAS;QAEnC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;QACrE,IAAI,CAAC,UAAU,GAAG,UAAU;YAC1B,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,EAAE,kBAAkB,CAAC,UAAU,CAAC,EAAE,YAAY,CAAC;YAClF,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QACxC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC/C,CAAC;IAED,4EAA4E;IACpE,OAAO;QACb,IAAI,IAAI,CAAC,aAAa;YAAE,OAAO,IAAI,CAAC,aAAa,CAAC;QAElD,SAAS,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7D,SAAS,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAElC,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACpC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,KAAK;gBAAE,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAClE,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;YACvD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YACvC,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;gBACtB,MAAM,IAAI,KAAK,CACb,2BAA2B,IAAI,CAAC,SAAS,uBAAuB,GAAG,CAAC,MAAM,aAAa,IAAI,CAAC,OAAO,uCAAuC,CAC3I,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,aAAa,GAAG,GAAG,CAAC;YACzB,OAAO,GAAG,CAAC;QACb,CAAC;QAED,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC/B,IAAI,CAAC;YACH,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE;gBACrD,IAAI,EAAE,IAAI;gBACV,IAAI,EAAE,KAAK;aACZ,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,uDAAuD;YACvD,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACrD,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;gBACvD,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;gBAChD,OAAO,IAAI,CAAC,aAAa,CAAC;YAC5B,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC;QAC5B,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,OAAO,CAAC,SAAiB;QAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QAC3B,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC3B,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QACtD,IAAI,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QACxD,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACjC,OAAO,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,SAAS,EAAE,CAAC;IAC9C,CAAC;IAEO,OAAO,CAAC,OAAe;QAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QAC3B,MAAM,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC5C,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QAC1D,IAAI,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QAC/D,SAAS,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACpC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,6EAA6E;IACrE,SAAS,CAAC,IAAe;QAC/B,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QACtD,iEAAiE;QACjE,+DAA+D;QAC/D,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACtE,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,UAAU,MAAM,CAAC;QACtC,aAAa,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACjD,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACvB,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QAClC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;IACzB,CAAC;IAED,oEAAoE;IACpE,IAAI;QACF,IAAI,IAAI,CAAC,UAAU;YAAE,OAAO,IAAI,CAAC,UAAU,CAAC;QAC5C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;YAAE,OAAO,IAAI,CAAC;QAC9C,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QAC1D,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAc,CAAC;QAC3C,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CACH,WAAmB,EACnB,YAA2B,EAC3B,gBAAwB,EACxB,SAAmF,EAAE;QAErF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;QACzD,MAAM,IAAI,GAAc;YACtB,WAAW;YACX,YAAY,EAAE,YAAY,IAAI,QAAQ,EAAE,YAAY,IAAI,IAAI;YAC5D,iBAAiB,EAAE,GAAG,GAAG,gBAAgB,GAAG,IAAI;YAChD,kBAAkB,EAAE,YAAY;gBAC9B,CAAC,CAAC,GAAG,GAAG,yBAAyB;gBACjC,CAAC,CAAC,CAAC,QAAQ,EAAE,kBAAkB,IAAI,GAAG,GAAG,yBAAyB,CAAC;YACrE,WAAW,EAAE,GAAG;YAChB,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,QAAQ,EAAE,WAAW,IAAI,IAAI;YAChE,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,QAAQ,EAAE,IAAI,IAAI,IAAI;YAC3C,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,QAAQ,EAAE,MAAM,IAAI,EAAE;SAChD,CAAC;QACF,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,aAAa;QACnB,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC;QACrB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,YAAY;QACV,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC;QACxB,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,iBAAiB,GAAG,oBAAoB,CAAC;IACpE,CAAC;IAED,SAAS;QACP,OAAO,IAAI,CAAC,IAAI,EAAE,KAAK,IAAI,CAAC;IAC9B,CAAC;IAED,mBAAmB;QACjB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC;QACxB,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,kBAAkB,CAAC;IAC9C,CAAC;IAED,KAAK;QACH,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QACvB,IAAI,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;YAAE,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC/D,CAAC;CACF;AAED,kDAAkD;AAClD,MAAM,CAAC,MAAM,kBAAkB,GAAG,oBAAoB,CAAC"}