@rubytech/create-maxy-code 0.1.445 → 0.1.447

package/payload/platform/plugins/outlook/mcp/dist/lib/html-to-text.js

@@ -0,0 +1,24 @@
+/**
+ * Decode a Graph HTML mail body to readable plain text. No external dep: drop
+ * script/style, convert block boundaries to newlines, strip remaining tags,
+ * decode the common named + numeric entities, collapse runs of blank lines.
+ * Not a full HTML parser — good enough to read a mail body. Used by
+ * outlook-mail-fetch-body (full read) and outlook-mail-otp-extract.
+ */
+const NAMED = {
+    amp: "&", lt: "<", gt: ">", quot: '"', apos: "'", nbsp: " ",
+    mdash: "—", ndash: "–", hellip: "…", rsquo: "’",
+    lsquo: "‘", ldquo: "“", rdquo: "”",
+};
+export function htmlToText(html) {
+    let s = html.replace(/<(script|style)[\s\S]*?<\/\1>/gi, "");
+    s = s.replace(/<br\s*\/?>/gi, "\n");
+    s = s.replace(/<\/(p|div|tr|li|h[1-6]|table|blockquote)>/gi, "\n");
+    s = s.replace(/<[^>]+>/g, "");
+    s = s.replace(/&#(\d+);/g, (_, n) => String.fromCodePoint(Number(n)));
+    s = s.replace(/&#x([0-9a-f]+);/gi, (_, n) => String.fromCodePoint(parseInt(n, 16)));
+    s = s.replace(/&([a-z]+);/gi, (m, name) => NAMED[name.toLowerCase()] ?? m);
+    s = s.replace(/[ \t]+\n/g, "\n").replace(/\n{3,}/g, "\n\n");
+    return s.trim();
+}
+//# sourceMappingURL=html-to-text.js.map

package/payload/platform/plugins/outlook/mcp/dist/lib/html-to-text.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"html-to-text.js","sourceRoot":"","sources":["../../src/lib/html-to-text.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,KAAK,GAA2B;IACpC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG;IAC3D,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG;IAC/C,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG;CACnC,CAAC;AAEF,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,iCAAiC,EAAE,EAAE,CAAC,CAAC;IAC5D,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;IACpC,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,6CAA6C,EAAE,IAAI,CAAC,CAAC;IACnE,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC9B,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACtE,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IACpF,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3E,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAC5D,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;AAClB,CAAC"}

package/payload/platform/plugins/outlook/mcp/dist/lib/otp.d.ts

@@ -0,0 +1,2 @@
+export declare function extractOtpFromText(text: string): string | null;
+//# sourceMappingURL=otp.d.ts.map

package/payload/platform/plugins/outlook/mcp/dist/lib/otp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"otp.d.ts","sourceRoot":"","sources":["../../src/lib/otp.ts"],"names":[],"mappings":"AAgBA,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CA+B9D"}

package/payload/platform/plugins/outlook/mcp/dist/lib/otp.js

@@ -0,0 +1,49 @@
+/**
+ * OTP extraction — one-time verification code parsing from a mail body.
+ * Copied verbatim from the email plugin's email-otp-extract so both mail
+ * surfaces recognise the same code shapes. Source-agnostic: it takes decoded
+ * text and returns the code (or null); the Graph fetch/poll lives in the tool.
+ *
+ * OTP context patterns — phrases that typically surround a verification code.
+ * None use the /g flag — they are stateless and safe for repeated exec() calls.
+ */
+const OTP_CONTEXT_PATTERNS = [
+    /(?:verification|verify|security|confirmation|one[- ]time|otp|login|sign[- ]?in|access)\s*(?:code|pin|number|token)\s*(?:is|:)?\s*(\d{4,8})/i,
+    /(\d{4,8})\s*(?:is your|is the)\s*(?:verification|security|confirmation|one[- ]time|otp|login|sign[- ]?in)/i,
+    /(?:code|pin|token)\s*(?:is|:)\s*(\d{4,8})/i,
+    /(?:enter|use|input|type)\s*(?:the\s*)?(?:code\s*)?(\d{4,8})/i,
+];
+export function extractOtpFromText(text) {
+    // Try context-aware patterns first
+    for (const pattern of OTP_CONTEXT_PATTERNS) {
+        const match = pattern.exec(text);
+        if (match?.[1])
+            return match[1];
+    }
+    // Fallback: extract standalone 4-8 digit numbers, filtering false positives.
+    // Pattern created locally to avoid /g lastIndex state leaking between calls.
+    const standalonePattern = /\b(\d{4,8})\b/g;
+    const matches = [];
+    let match;
+    while ((match = standalonePattern.exec(text)) !== null) {
+        const num = match[1];
+        // Filter out likely years (1900-2099)
+        if (/^(19|20)\d{2}$/.test(num))
+            continue;
+        // Filter out numbers that are part of a phone-like sequence
+        const surrounding = text.slice(Math.max(0, match.index - 5), match.index + num.length + 5);
+        if (/\+?\d[\d\s\-()]{9,}/.test(surrounding))
+            continue;
+        matches.push(num);
+    }
+    // If exactly one candidate remains, it's likely the OTP
+    if (matches.length === 1)
+        return matches[0];
+    // Multiple candidates — prefer 6-digit codes (most common OTP length)
+    const sixDigit = matches.find((m) => m.length === 6);
+    if (sixDigit)
+        return sixDigit;
+    // Return the first candidate if any exist
+    return matches[0] ?? null;
+}
+//# sourceMappingURL=otp.js.map

package/payload/platform/plugins/outlook/mcp/dist/lib/otp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"otp.js","sourceRoot":"","sources":["../../src/lib/otp.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,MAAM,oBAAoB,GAAa;IACrC,6IAA6I;IAC7I,4GAA4G;IAC5G,4CAA4C;IAC5C,8DAA8D;CAC/D,CAAC;AAEF,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,mCAAmC;IACnC,KAAK,MAAM,OAAO,IAAI,oBAAoB,EAAE,CAAC;QAC3C,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC;IAED,6EAA6E;IAC7E,6EAA6E;IAC7E,MAAM,iBAAiB,GAAG,gBAAgB,CAAC;IAC3C,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,KAA6B,CAAC;IAClC,OAAO,CAAC,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACvD,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACrB,sCAAsC;QACtC,IAAI,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,SAAS;QACzC,4DAA4D;QAC5D,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC3F,IAAI,qBAAqB,CAAC,IAAI,CAAC,WAAW,CAAC;YAAE,SAAS;QACtD,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpB,CAAC;IAED,wDAAwD;IACxD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC;IAE5C,sEAAsE;IACtE,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC;IACrD,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAE9B,0CAA0C;IAC1C,OAAO,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AAC5B,CAAC"}

package/payload/platform/plugins/outlook/mcp/dist/lib/outbound-attachments.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Outbound attachment resolver for outlook-mail-reply. Mirrors the email
+ * plugin's account-scope check (realpath under the account directory, regular
+ * file, size cap), then classifies each file by how it must reach the reply
+ * draft:
+ *
+ *   - `inline`  — at or under Graph's ~3 MB fileAttachment limit; sent as a
+ *                 single base64 `POST /messages/{id}/attachments`.
+ *   - `session` — above the inline limit and up to the 25 MB account cap; sent
+ *                 through a Graph upload session (see `upload-session.ts`).
+ *
+ * The account cap (25 MB) matches the email plugin's outbound cap, so an
+ * Outlook reply and the equivalent IMAP reply carry the same maximum.
+ *
+ * Resolution reads no bytes — it returns per-file metadata (path, size, mode)
+ * so `mail-reply` can choose the path. Path validation still happens before any
+ * Graph write, so a bad path leaves no orphan draft; bytes are read at send
+ * time by `toInlineAttachment` (inline) or the upload session (session).
+ */
+/** Graph fileAttachment inline limit for POST /messages/{id}/attachments. */
+export declare const OUTLOOK_ATTACHMENT_INLINE_MAX_BYTES: number;
+/** Per-file account cap; parity with the email plugin's outbound cap. */
+export declare const OUTLOOK_ATTACHMENT_MAX_BYTES: number;
+export interface GraphFileAttachment {
+    "@odata.type": "#microsoft.graph.fileAttachment";
+    name: string;
+    contentType: string;
+    contentBytes: string;
+}
+/** A validated, account-scoped file and the Graph path it must take. */
+export interface OutboundAttachment {
+    /** realpath, verified under the account directory. */
+    path: string;
+    name: string;
+    contentType: string;
+    size: number;
+    mode: "inline" | "session";
+}
+/** ACCOUNT_DIR (spawn-set) wins; else derive from PLATFORM_ROOT + accountId,
+ *  matching the email plugin's resolver. Null when neither resolves. */
+export declare function resolveAccountDir(accountId: string): string | null;
+/**
+ * Validate agent-supplied paths and classify each as inline or session. Each
+ * path must realpath to a regular file under the account directory and be within
+ * the 25 MB account cap. Any violation throws a precise error naming the
+ * offending path, so the caller sends nothing rather than a reply that silently
+ * drops the file. Absent/empty input returns [] (a text-only reply).
+ */
+export declare function resolveOutboundAttachments(accountId: string, paths: string[] | undefined): OutboundAttachment[];
+/**
+ * Read an inline attachment's bytes and base64-encode them into the Graph
+ * fileAttachment shape a reply draft accepts. Only called for `mode: "inline"`
+ * files; larger files go through the upload session instead.
+ */
+export declare function toInlineAttachment(att: OutboundAttachment): GraphFileAttachment;
+/** The " with N attachment(s): a, b" suffix for a reply success message. */
+export declare function attachNote(names: string[]): string;
+//# sourceMappingURL=outbound-attachments.d.ts.map

package/payload/platform/plugins/outlook/mcp/dist/lib/outbound-attachments.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"outbound-attachments.d.ts","sourceRoot":"","sources":["../../src/lib/outbound-attachments.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAKH,6EAA6E;AAC7E,eAAO,MAAM,mCAAmC,QAAkB,CAAC;AACnE,yEAAyE;AACzE,eAAO,MAAM,4BAA4B,QAAmB,CAAC;AAE7D,MAAM,WAAW,mBAAmB;IAClC,aAAa,EAAE,iCAAiC,CAAC;IACjD,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,wEAAwE;AACxE,MAAM,WAAW,kBAAkB;IACjC,sDAAsD;IACtD,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,QAAQ,GAAG,SAAS,CAAC;CAC5B;AAqBD;wEACwE;AACxE,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAQlE;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CACxC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EAAE,GAAG,SAAS,GAC1B,kBAAkB,EAAE,CAgDtB;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,kBAAkB,GAAG,mBAAmB,CAO/E;AAED,4EAA4E;AAC5E,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,CAGlD"}

package/payload/platform/plugins/outlook/mcp/dist/lib/outbound-attachments.js

@@ -0,0 +1,127 @@
+/**
+ * Outbound attachment resolver for outlook-mail-reply. Mirrors the email
+ * plugin's account-scope check (realpath under the account directory, regular
+ * file, size cap), then classifies each file by how it must reach the reply
+ * draft:
+ *
+ *   - `inline`  — at or under Graph's ~3 MB fileAttachment limit; sent as a
+ *                 single base64 `POST /messages/{id}/attachments`.
+ *   - `session` — above the inline limit and up to the 25 MB account cap; sent
+ *                 through a Graph upload session (see `upload-session.ts`).
+ *
+ * The account cap (25 MB) matches the email plugin's outbound cap, so an
+ * Outlook reply and the equivalent IMAP reply carry the same maximum.
+ *
+ * Resolution reads no bytes — it returns per-file metadata (path, size, mode)
+ * so `mail-reply` can choose the path. Path validation still happens before any
+ * Graph write, so a bad path leaves no orphan draft; bytes are read at send
+ * time by `toInlineAttachment` (inline) or the upload session (session).
+ */
+import { readFileSync, realpathSync, statSync } from "node:fs";
+import { basename, extname, join } from "node:path";
+/** Graph fileAttachment inline limit for POST /messages/{id}/attachments. */
+export const OUTLOOK_ATTACHMENT_INLINE_MAX_BYTES = 3 * 1024 * 1024;
+/** Per-file account cap; parity with the email plugin's outbound cap. */
+export const OUTLOOK_ATTACHMENT_MAX_BYTES = 25 * 1024 * 1024;
+const MIME = {
+    ".pdf": "application/pdf",
+    ".png": "image/png",
+    ".jpg": "image/jpeg",
+    ".jpeg": "image/jpeg",
+    ".gif": "image/gif",
+    ".txt": "text/plain",
+    ".csv": "text/csv",
+    ".doc": "application/msword",
+    ".docx": "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+    ".xls": "application/vnd.ms-excel",
+    ".xlsx": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+    ".zip": "application/zip",
+};
+function contentTypeOf(rp) {
+    return MIME[extname(rp).toLowerCase()] ?? "application/octet-stream";
+}
+/** ACCOUNT_DIR (spawn-set) wins; else derive from PLATFORM_ROOT + accountId,
+ *  matching the email plugin's resolver. Null when neither resolves. */
+export function resolveAccountDir(accountId) {
+    const direct = process.env.ACCOUNT_DIR;
+    if (direct && direct.trim())
+        return direct;
+    const platformRoot = process.env.PLATFORM_ROOT;
+    if (platformRoot && accountId && !accountId.includes("/") && !accountId.includes("..")) {
+        return join(platformRoot, "..", "data", "accounts", accountId);
+    }
+    return null;
+}
+/**
+ * Validate agent-supplied paths and classify each as inline or session. Each
+ * path must realpath to a regular file under the account directory and be within
+ * the 25 MB account cap. Any violation throws a precise error naming the
+ * offending path, so the caller sends nothing rather than a reply that silently
+ * drops the file. Absent/empty input returns [] (a text-only reply).
+ */
+export function resolveOutboundAttachments(accountId, paths) {
+    if (!paths || paths.length === 0)
+        return [];
+    const dir = resolveAccountDir(accountId);
+    if (!dir) {
+        throw new Error("Cannot attach files: no account context (ACCOUNT_DIR unset and PLATFORM_ROOT+ACCOUNT_ID unavailable) to validate paths against.");
+    }
+    let accountResolved;
+    try {
+        accountResolved = realpathSync(dir);
+    }
+    catch (err) {
+        throw new Error(`Cannot attach files: account directory ${dir} is not accessible (${err instanceof Error ? err.message : String(err)}).`);
+    }
+    const out = [];
+    for (const p of paths) {
+        let rp;
+        try {
+            rp = realpathSync(p);
+        }
+        catch (err) {
+            if (err.code === "ENOENT") {
+                throw new Error(`Attachment not found: ${p}`);
+            }
+            throw new Error(`Cannot read attachment ${p}: ${err instanceof Error ? err.message : String(err)}`);
+        }
+        if (!rp.startsWith(accountResolved + "/")) {
+            throw new Error(`Attachment ${p} is outside the account directory and cannot be sent.`);
+        }
+        const st = statSync(rp);
+        if (!st.isFile()) {
+            throw new Error(`Attachment ${p} is not a regular file.`);
+        }
+        if (st.size > OUTLOOK_ATTACHMENT_MAX_BYTES) {
+            throw new Error(`Attachment ${basename(rp)} is ${(st.size / 1024 / 1024).toFixed(1)} MB; Outlook reply attachments are capped at 25 MB per file.`);
+        }
+        out.push({
+            path: rp,
+            name: basename(rp),
+            contentType: contentTypeOf(rp),
+            size: st.size,
+            mode: st.size > OUTLOOK_ATTACHMENT_INLINE_MAX_BYTES ? "session" : "inline",
+        });
+    }
+    return out;
+}
+/**
+ * Read an inline attachment's bytes and base64-encode them into the Graph
+ * fileAttachment shape a reply draft accepts. Only called for `mode: "inline"`
+ * files; larger files go through the upload session instead.
+ */
+export function toInlineAttachment(att) {
+    return {
+        "@odata.type": "#microsoft.graph.fileAttachment",
+        name: att.name,
+        contentType: att.contentType,
+        contentBytes: readFileSync(att.path).toString("base64"),
+    };
+}
+/** The " with N attachment(s): a, b" suffix for a reply success message. */
+export function attachNote(names) {
+    if (names.length === 0)
+        return "";
+    return ` with ${names.length} attachment(s): ${names.join(", ")}`;
+}
+//# sourceMappingURL=outbound-attachments.js.map

package/payload/platform/plugins/outlook/mcp/dist/lib/outbound-attachments.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"outbound-attachments.js","sourceRoot":"","sources":["../../src/lib/outbound-attachments.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEpD,6EAA6E;AAC7E,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AACnE,yEAAyE;AACzE,MAAM,CAAC,MAAM,4BAA4B,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAmB7D,MAAM,IAAI,GAA2B;IACnC,MAAM,EAAE,iBAAiB;IACzB,MAAM,EAAE,WAAW;IACnB,MAAM,EAAE,YAAY;IACpB,OAAO,EAAE,YAAY;IACrB,MAAM,EAAE,WAAW;IACnB,MAAM,EAAE,YAAY;IACpB,MAAM,EAAE,UAAU;IAClB,MAAM,EAAE,oBAAoB;IAC5B,OAAO,EAAE,yEAAyE;IAClF,MAAM,EAAE,0BAA0B;IAClC,OAAO,EAAE,mEAAmE;IAC5E,MAAM,EAAE,iBAAiB;CAC1B,CAAC;AAEF,SAAS,aAAa,CAAC,EAAU;IAC/B,OAAO,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,0BAA0B,CAAC;AACvE,CAAC;AAED;wEACwE;AACxE,MAAM,UAAU,iBAAiB,CAAC,SAAiB;IACjD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;IACvC,IAAI,MAAM,IAAI,MAAM,CAAC,IAAI,EAAE;QAAE,OAAO,MAAM,CAAC;IAC3C,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;IAC/C,IAAI,YAAY,IAAI,SAAS,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACvF,OAAO,IAAI,CAAC,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B,CACxC,SAAiB,EACjB,KAA2B;IAE3B,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC5C,MAAM,GAAG,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IACzC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CACb,iIAAiI,CAClI,CAAC;IACJ,CAAC;IACD,IAAI,eAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,eAAe,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,0CAA0C,GAAG,uBAAuB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CACzH,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAyB,EAAE,CAAC;IACrC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,EAAU,CAAC;QACf,IAAI,CAAC;YACH,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;QACvB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACrD,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,EAAE,CAAC,CAAC;YAChD,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACtG,CAAC;QACD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,eAAe,GAAG,GAAG,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,uDAAuD,CAAC,CAAC;QAC1F,CAAC;QACD,MAAM,EAAE,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC;QACxB,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,yBAAyB,CAAC,CAAC;QAC5D,CAAC;QACD,IAAI,EAAE,CAAC,IAAI,GAAG,4BAA4B,EAAE,CAAC;YAC3C,MAAM,IAAI,KAAK,CACb,cAAc,QAAQ,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,8DAA8D,CAClI,CAAC;QACJ,CAAC;QACD,GAAG,CAAC,IAAI,CAAC;YACP,IAAI,EAAE,EAAE;YACR,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC;YAClB,WAAW,EAAE,aAAa,CAAC,EAAE,CAAC;YAC9B,IAAI,EAAE,EAAE,CAAC,IAAI;YACb,IAAI,EAAE,EAAE,CAAC,IAAI,GAAG,mCAAmC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ;SAC3E,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAuB;IACxD,OAAO;QACL,aAAa,EAAE,iCAAiC;QAChD,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,YAAY,EAAE,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;KACxD,CAAC;AACJ,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,UAAU,CAAC,KAAe;IACxC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAClC,OAAO,SAAS,KAAK,CAAC,MAAM,mBAAmB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;AACpE,CAAC"}

package/payload/platform/plugins/outlook/mcp/dist/lib/upload-session.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Graph upload-session path for reply attachments above the inline limit.
+ *
+ * Two steps, distinct in auth and host:
+ *   1. `POST /me/messages/{draftId}/attachments/createUploadSession` — through
+ *      the Graph SDK (auth handled by `postGraph`), returns a pre-authenticated
+ *      `uploadUrl`.
+ *   2. Chunked `PUT` to that `uploadUrl` — a plain fetch to a non-Graph host
+ *      with NO bearer token (the URL itself is the credential). Each chunk is a
+ *      multiple of 320 KiB except the last, per Graph's contract, and carries a
+ *      `Content-Range` header. Graph returns 200 for an intermediate chunk and
+ *      201 for the final one.
+ *
+ * Every non-2xx PUT throws with the response status and body preserved, so a
+ * session that stalls mid-chunk is diagnosable rather than silent.
+ */
+import type { GraphClientConfig } from "./graph-client.js";
+import type { OutboundAttachment } from "./outbound-attachments.js";
+/** Chunk size for the upload PUT: 3.125 MiB, a whole multiple of 320 KiB as
+ *  Graph requires for every chunk except the final remainder. */
+export declare const UPLOAD_CHUNK_BYTES: number;
+/**
+ * Upload one large attachment to an existing reply draft via a Graph upload
+ * session. Returns the number of chunks PUT (for observability). The draft must
+ * already exist; the attachment must have passed `resolveOutboundAttachments`.
+ */
+export declare function uploadAttachmentSession(config: GraphClientConfig, draftId: string, att: OutboundAttachment): Promise<number>;
+//# sourceMappingURL=upload-session.d.ts.map

package/payload/platform/plugins/outlook/mcp/dist/lib/upload-session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"upload-session.d.ts","sourceRoot":"","sources":["../../src/lib/upload-session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE3D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAEpE;iEACiE;AACjE,eAAO,MAAM,kBAAkB,QAAkB,CAAC;AAMlD;;;;GAIG;AACH,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,iBAAiB,EACzB,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,kBAAkB,GACtB,OAAO,CAAC,MAAM,CAAC,CAoCjB"}

package/payload/platform/plugins/outlook/mcp/dist/lib/upload-session.js

@@ -0,0 +1,54 @@
+/**
+ * Graph upload-session path for reply attachments above the inline limit.
+ *
+ * Two steps, distinct in auth and host:
+ *   1. `POST /me/messages/{draftId}/attachments/createUploadSession` — through
+ *      the Graph SDK (auth handled by `postGraph`), returns a pre-authenticated
+ *      `uploadUrl`.
+ *   2. Chunked `PUT` to that `uploadUrl` — a plain fetch to a non-Graph host
+ *      with NO bearer token (the URL itself is the credential). Each chunk is a
+ *      multiple of 320 KiB except the last, per Graph's contract, and carries a
+ *      `Content-Range` header. Graph returns 200 for an intermediate chunk and
+ *      201 for the final one.
+ *
+ * Every non-2xx PUT throws with the response status and body preserved, so a
+ * session that stalls mid-chunk is diagnosable rather than silent.
+ */
+import { readFileSync } from "node:fs";
+import { postGraph } from "./graph-client.js";
+/** Chunk size for the upload PUT: 3.125 MiB, a whole multiple of 320 KiB as
+ *  Graph requires for every chunk except the final remainder. */
+export const UPLOAD_CHUNK_BYTES = 320 * 1024 * 10;
+/**
+ * Upload one large attachment to an existing reply draft via a Graph upload
+ * session. Returns the number of chunks PUT (for observability). The draft must
+ * already exist; the attachment must have passed `resolveOutboundAttachments`.
+ */
+export async function uploadAttachmentSession(config, draftId, att) {
+    const { json } = await postGraph(config, `/me/messages/${encodeURIComponent(draftId)}/attachments/createUploadSession`, { AttachmentItem: { attachmentType: "file", name: att.name, size: att.size, contentType: att.contentType } }, { tool: "mail-reply" });
+    const uploadUrl = json?.uploadUrl;
+    if (!uploadUrl) {
+        throw new Error(`outlook-mail-reply: createUploadSession for ${att.name} returned no uploadUrl.`);
+    }
+    const buf = readFileSync(att.path);
+    const total = buf.length;
+    let start = 0;
+    let chunks = 0;
+    while (start < total) {
+        const end = Math.min(start + UPLOAD_CHUNK_BYTES, total);
+        const slice = buf.subarray(start, end);
+        const res = await fetch(uploadUrl, {
+            method: "PUT",
+            headers: { "Content-Range": `bytes ${start}-${end - 1}/${total}` },
+            body: slice,
+        });
+        if (!res.ok) {
+            const text = await res.text().catch(() => "");
+            throw new Error(`outlook-mail-reply: upload session PUT ${res.status} for ${att.name} (bytes ${start}-${end - 1}/${total}): ${text.slice(0, 300) || "no response body"}`);
+        }
+        chunks += 1;
+        start = end;
+    }
+    return chunks;
+}
+//# sourceMappingURL=upload-session.js.map

package/payload/platform/plugins/outlook/mcp/dist/lib/upload-session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"upload-session.js","sourceRoot":"","sources":["../../src/lib/upload-session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEvC,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAG9C;iEACiE;AACjE,MAAM,CAAC,MAAM,kBAAkB,GAAG,GAAG,GAAG,IAAI,GAAG,EAAE,CAAC;AAMlD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,MAAyB,EACzB,OAAe,EACf,GAAuB;IAEvB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,SAAS,CAC9B,MAAM,EACN,gBAAgB,kBAAkB,CAAC,OAAO,CAAC,kCAAkC,EAC7E,EAAE,cAAc,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,EAAE,EAC5G,EAAE,IAAI,EAAE,YAAY,EAAE,CACvB,CAAC;IACF,MAAM,SAAS,GAAI,IAA6B,EAAE,SAAS,CAAC;IAC5D,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,+CAA+C,GAAG,CAAC,IAAI,yBAAyB,CACjF,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC;IACzB,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,OAAO,KAAK,GAAG,KAAK,EAAE,CAAC;QACrB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,kBAAkB,EAAE,KAAK,CAAC,CAAC;QACxD,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACvC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,SAAS,EAAE;YACjC,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,eAAe,EAAE,SAAS,KAAK,IAAI,GAAG,GAAG,CAAC,IAAI,KAAK,EAAE,EAAE;YAClE,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAC9C,MAAM,IAAI,KAAK,CACb,0CAA0C,GAAG,CAAC,MAAM,QAAQ,GAAG,CAAC,IAAI,WAAW,KAAK,IAAI,GAAG,GAAG,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,kBAAkB,EAAE,CACzJ,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,CAAC,CAAC;QACZ,KAAK,GAAG,GAAG,CAAC;IACd,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/payload/platform/plugins/outlook/mcp/dist/tools/draft-edit.d.ts

@@ -0,0 +1,21 @@
+import type { GraphClientConfig } from "../lib/graph-client.js";
+export interface DraftEditArgs {
+    draftId: string;
+    to?: string[];
+    cc?: string[];
+    bcc?: string[];
+    subject?: string;
+    body?: string;
+    isHtml?: boolean;
+}
+/**
+ * Update an existing draft in place via PATCH /me/messages/{draftId}. Graph
+ * drafts are mutable, so no delete-and-reappend. Only the supplied fields are
+ * patched; at least one editable field is required. Graph rejects a PATCH on a
+ * sent (non-draft) message — that error is surfaced to the caller unchanged.
+ */
+export declare function runDraftEdit(config: GraphClientConfig, args: DraftEditArgs): Promise<{
+    draftId: string;
+    updated: true;
+}>;
+//# sourceMappingURL=draft-edit.d.ts.map

package/payload/platform/plugins/outlook/mcp/dist/tools/draft-edit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"draft-edit.d.ts","sourceRoot":"","sources":["../../src/tools/draft-edit.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAIhE,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;IACd,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAMD;;;;;GAKG;AACH,wBAAsB,YAAY,CAChC,MAAM,EAAE,iBAAiB,EACzB,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,IAAI,CAAA;CAAE,CAAC,CAyB7C"}

package/payload/platform/plugins/outlook/mcp/dist/tools/draft-edit.js

@@ -0,0 +1,38 @@
+import { patchGraph } from "../lib/graph-client.js";
+import { log } from "../lib/log.js";
+function recip(list) {
+    return list.map((address) => ({ emailAddress: { address } }));
+}
+/**
+ * Update an existing draft in place via PATCH /me/messages/{draftId}. Graph
+ * drafts are mutable, so no delete-and-reappend. Only the supplied fields are
+ * patched; at least one editable field is required. Graph rejects a PATCH on a
+ * sent (non-draft) message — that error is surfaced to the caller unchanged.
+ */
+export async function runDraftEdit(config, args) {
+    const patch = {};
+    if (args.subject !== undefined)
+        patch.subject = args.subject;
+    if (args.body !== undefined) {
+        patch.body = { contentType: args.isHtml ? "HTML" : "Text", content: args.body };
+    }
+    if (args.to !== undefined)
+        patch.toRecipients = recip(args.to);
+    if (args.cc !== undefined)
+        patch.ccRecipients = recip(args.cc);
+    if (args.bcc !== undefined)
+        patch.bccRecipients = recip(args.bcc);
+    if (Object.keys(patch).length === 0) {
+        throw new Error("outlook-draft-edit: pass at least one field to change (to, cc, bcc, subject, or body).");
+    }
+    await patchGraph(config, `/me/messages/${encodeURIComponent(args.draftId)}`, patch, { tool: "draft-edit" });
+    log({
+        event: "draft-edit",
+        op: "draft-edit",
+        account: config.accountId,
+        id: args.draftId,
+        fields: Object.keys(patch).join(","),
+    });
+    return { draftId: args.draftId, updated: true };
+}
+//# sourceMappingURL=draft-edit.js.map

package/payload/platform/plugins/outlook/mcp/dist/tools/draft-edit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"draft-edit.js","sourceRoot":"","sources":["../../src/tools/draft-edit.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,GAAG,EAAE,MAAM,eAAe,CAAC;AAYpC,SAAS,KAAK,CAAC,IAAc;IAC3B,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,YAAY,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAChE,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAAyB,EACzB,IAAmB;IAEnB,MAAM,KAAK,GAA4B,EAAE,CAAC;IAC1C,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS;QAAE,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IAC7D,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC5B,KAAK,CAAC,IAAI,GAAG,EAAE,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;IAClF,CAAC;IACD,IAAI,IAAI,CAAC,EAAE,KAAK,SAAS;QAAE,KAAK,CAAC,YAAY,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC/D,IAAI,IAAI,CAAC,EAAE,KAAK,SAAS;QAAE,KAAK,CAAC,YAAY,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC/D,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS;QAAE,KAAK,CAAC,aAAa,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAElE,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CACb,wFAAwF,CACzF,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,CAAC,MAAM,EAAE,gBAAgB,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;IAC5G,GAAG,CAAC;QACF,KAAK,EAAE,YAAY;QACnB,EAAE,EAAE,YAAY;QAChB,OAAO,EAAE,MAAM,CAAC,SAAS;QACzB,EAAE,EAAE,IAAI,CAAC,OAAO;QAChB,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;KACrC,CAAC,CAAC;IACH,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAClD,CAAC"}

package/payload/platform/plugins/outlook/mcp/dist/tools/mail-delete.d.ts

@@ -0,0 +1,14 @@
+import type { GraphClientConfig } from "../lib/graph-client.js";
+/**
+ * Move each named message to Deleted Items (POST /me/messages/{id}/move with
+ * destinationId "deleteditems"). Recoverable — never hard-deletes, never
+ * expunges. A message already gone (Graph 404) is counted not-moved without
+ * failing the rest; any other Graph error aborts the batch.
+ */
+export declare function runMailDelete(config: GraphClientConfig, args: {
+    ids: string[];
+}): Promise<{
+    moved: string[];
+    notMoved: string[];
+}>;
+//# sourceMappingURL=mail-delete.d.ts.map

package/payload/platform/plugins/outlook/mcp/dist/tools/mail-delete.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mail-delete.d.ts","sourceRoot":"","sources":["../../src/tools/mail-delete.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAIhE;;;;;GAKG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,iBAAiB,EACzB,IAAI,EAAE;IAAE,GAAG,EAAE,MAAM,EAAE,CAAA;CAAE,GACtB,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAgClD"}

package/payload/platform/plugins/outlook/mcp/dist/tools/mail-delete.js

@@ -0,0 +1,39 @@
+import { postGraph } from "../lib/graph-client.js";
+import { log } from "../lib/log.js";
+/**
+ * Move each named message to Deleted Items (POST /me/messages/{id}/move with
+ * destinationId "deleteditems"). Recoverable — never hard-deletes, never
+ * expunges. A message already gone (Graph 404) is counted not-moved without
+ * failing the rest; any other Graph error aborts the batch.
+ */
+export async function runMailDelete(config, args) {
+    const moved = [];
+    const notMoved = [];
+    for (const id of args.ids) {
+        try {
+            await postGraph(config, `/me/messages/${encodeURIComponent(id)}/move`, { destinationId: "deleteditems" }, { tool: "mail-delete" });
+            moved.push(id);
+        }
+        catch (err) {
+            // Key the "already gone" decision off the structured status code the
+            // writeGraph error carries (err.statusCode), never the prose message —
+            // matching graph-client's classification doctrine. A 404 means the id was
+            // already gone; any other status aborts the batch.
+            if (err.statusCode === 404) {
+                notMoved.push(id);
+            }
+            else {
+                throw err;
+            }
+        }
+    }
+    log({
+        event: "mail-delete",
+        op: "delete",
+        account: config.accountId,
+        moved: moved.length,
+        notMoved: notMoved.length,
+    });
+    return { moved, notMoved };
+}
+//# sourceMappingURL=mail-delete.js.map

package/payload/platform/plugins/outlook/mcp/dist/tools/mail-delete.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mail-delete.js","sourceRoot":"","sources":["../../src/tools/mail-delete.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACnD,OAAO,EAAE,GAAG,EAAE,MAAM,eAAe,CAAC;AAEpC;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAAyB,EACzB,IAAuB;IAEvB,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,SAAS,CACb,MAAM,EACN,gBAAgB,kBAAkB,CAAC,EAAE,CAAC,OAAO,EAC7C,EAAE,aAAa,EAAE,cAAc,EAAE,EACjC,EAAE,IAAI,EAAE,aAAa,EAAE,CACxB,CAAC;YACF,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,qEAAqE;YACrE,uEAAuE;YACvE,0EAA0E;YAC1E,mDAAmD;YACnD,IAAK,GAA+B,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;gBACxD,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACpB,CAAC;iBAAM,CAAC;gBACN,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;IACH,CAAC;IACD,GAAG,CAAC;QACF,KAAK,EAAE,aAAa;QACpB,EAAE,EAAE,QAAQ;QACZ,OAAO,EAAE,MAAM,CAAC,SAAS;QACzB,KAAK,EAAE,KAAK,CAAC,MAAM;QACnB,QAAQ,EAAE,QAAQ,CAAC,MAAM;KAC1B,CAAC,CAAC;IACH,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;AAC7B,CAAC"}

package/payload/platform/plugins/outlook/mcp/dist/tools/mail-fetch-body.d.ts

@@ -0,0 +1,23 @@
+import type { GraphClientConfig } from "../lib/graph-client.js";
+export interface FetchBodyResult {
+    id: string;
+    subject: string | null;
+    from: string | null;
+    to: string[];
+    cc: string[];
+    receivedDateTime: string;
+    conversationId: string | null;
+    isRead: boolean;
+    contentType: "html" | "text";
+    body: string;
+}
+/**
+ * Read the COMPLETE body of one message by id. Graph's bodyPreview (returned by
+ * outlook-mail-list/-search) is capped near 255 chars; this requests the full
+ * `body` and decodes HTML to text. Never falls back to bodyPreview — an empty
+ * body is returned as-is (empty), and the logged `bytes` surfaces a shortfall.
+ */
+export declare function runMailFetchBody(config: GraphClientConfig, args: {
+    messageId: string;
+}): Promise<FetchBodyResult>;
+//# sourceMappingURL=mail-fetch-body.d.ts.map

package/payload/platform/plugins/outlook/mcp/dist/tools/mail-fetch-body.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mail-fetch-body.d.ts","sourceRoot":"","sources":["../../src/tools/mail-fetch-body.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAKhE,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,EAAE,EAAE,MAAM,EAAE,CAAC;IACb,EAAE,EAAE,MAAM,EAAE,CAAC;IACb,gBAAgB,EAAE,MAAM,CAAC;IACzB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,MAAM,EAAE,OAAO,CAAC;IAChB,WAAW,EAAE,MAAM,GAAG,MAAM,CAAC;IAC7B,IAAI,EAAE,MAAM,CAAC;CACd;AAwBD;;;;;GAKG;AACH,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,iBAAiB,EACzB,IAAI,EAAE;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,GAC1B,OAAO,CAAC,eAAe,CAAC,CAqC1B"}

package/payload/platform/plugins/outlook/mcp/dist/tools/mail-fetch-body.js

@@ -0,0 +1,44 @@
+import { callGraph } from "../lib/graph-client.js";
+import { htmlToText } from "../lib/html-to-text.js";
+import { log } from "../lib/log.js";
+const SELECT = "id,subject,from,toRecipients,ccRecipients,receivedDateTime,conversationId,isRead,body";
+function addrs(list) {
+    return (list ?? []).map((r) => r.emailAddress?.address).filter((a) => !!a);
+}
+/**
+ * Read the COMPLETE body of one message by id. Graph's bodyPreview (returned by
+ * outlook-mail-list/-search) is capped near 255 chars; this requests the full
+ * `body` and decodes HTML to text. Never falls back to bodyPreview — an empty
+ * body is returned as-is (empty), and the logged `bytes` surfaces a shortfall.
+ */
+export async function runMailFetchBody(config, args) {
+    const msg = await callGraph(config, async (client) => (await client
+        .api(`/me/messages/${encodeURIComponent(args.messageId)}`)
+        .select(SELECT)
+        .get()), { tool: "mail-fetch-body" });
+    const rawType = (msg.body?.contentType ?? "text").toLowerCase();
+    const contentType = rawType === "html" ? "html" : "text";
+    const raw = msg.body?.content ?? "";
+    const body = contentType === "html" ? htmlToText(raw) : raw;
+    log({
+        event: "mail-fetch-body",
+        op: "fetch-body",
+        account: config.accountId,
+        id: args.messageId,
+        bytes: body.length,
+        contentType,
+    });
+    return {
+        id: msg.id,
+        subject: msg.subject ?? null,
+        from: msg.from?.emailAddress?.address ?? null,
+        to: addrs(msg.toRecipients),
+        cc: addrs(msg.ccRecipients),
+        receivedDateTime: msg.receivedDateTime,
+        conversationId: msg.conversationId ?? null,
+        isRead: msg.isRead ?? false,
+        contentType,
+        body,
+    };
+}
+//# sourceMappingURL=mail-fetch-body.js.map

package/payload/platform/plugins/outlook/mcp/dist/tools/mail-fetch-body.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mail-fetch-body.js","sourceRoot":"","sources":["../../src/tools/mail-fetch-body.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,GAAG,EAAE,MAAM,eAAe,CAAC;AA8BpC,MAAM,MAAM,GACV,uFAAuF,CAAC;AAE1F,SAAS,KAAK,CAAC,IAAgC;IAC7C,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1F,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAyB,EACzB,IAA2B;IAE3B,MAAM,GAAG,GAAG,MAAM,SAAS,CACzB,MAAM,EACN,KAAK,EAAE,MAAM,EAAE,EAAE,CACf,CAAC,MAAM,MAAM;SACV,GAAG,CAAC,gBAAgB,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;SACzD,MAAM,CAAC,MAAM,CAAC;SACd,GAAG,EAAE,CAAe,EACzB,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAC5B,CAAC;IAEF,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,WAAW,IAAI,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;IAChE,MAAM,WAAW,GAAoB,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;IAC1E,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,EAAE,OAAO,IAAI,EAAE,CAAC;IACpC,MAAM,IAAI,GAAG,WAAW,KAAK,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAE5D,GAAG,CAAC;QACF,KAAK,EAAE,iBAAiB;QACxB,EAAE,EAAE,YAAY;QAChB,OAAO,EAAE,MAAM,CAAC,SAAS;QACzB,EAAE,EAAE,IAAI,CAAC,SAAS;QAClB,KAAK,EAAE,IAAI,CAAC,MAAM;QAClB,WAAW;KACZ,CAAC,CAAC;IAEH,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,IAAI;QAC5B,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,YAAY,EAAE,OAAO,IAAI,IAAI;QAC7C,EAAE,EAAE,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC;QAC3B,EAAE,EAAE,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC;QAC3B,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;QACtC,cAAc,EAAE,GAAG,CAAC,cAAc,IAAI,IAAI;QAC1C,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,KAAK;QAC3B,WAAW;QACX,IAAI;KACL,CAAC;AACJ,CAAC"}

package/payload/platform/plugins/outlook/mcp/dist/tools/mail-otp-extract.d.ts

@@ -0,0 +1,22 @@
+import type { GraphClientConfig } from "../lib/graph-client.js";
+export interface OtpArgs {
+    sender: string;
+    subjectPattern?: string;
+    timeout?: number;
+}
+export interface OtpResult {
+    success: boolean;
+    code?: string;
+    message: string;
+    from?: string;
+    subject?: string;
+}
+/**
+ * Poll the inbox for a one-time code from a specific sender. Lists recent
+ * messages, keeps those whose sender matches `sender` (and optional subject
+ * regex), reads each candidate's full body via runMailFetchBody, and extracts
+ * the code. Scans immediately, then polls every 5 s until `timeout` (default
+ * 60 s). The OTP extractor is shared verbatim with the email plugin.
+ */
+export declare function runMailOtpExtract(config: GraphClientConfig, args: OtpArgs): Promise<OtpResult>;
+//# sourceMappingURL=mail-otp-extract.d.ts.map

package/payload/platform/plugins/outlook/mcp/dist/tools/mail-otp-extract.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mail-otp-extract.d.ts","sourceRoot":"","sources":["../../src/tools/mail-otp-extract.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAQhE,MAAM,WAAW,OAAO;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AACD,MAAM,WAAW,SAAS;IACxB,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAmDD;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,iBAAiB,EACzB,IAAI,EAAE,OAAO,GACZ,OAAO,CAAC,SAAS,CAAC,CAqDpB"}