@rubytech/create-maxy-code 0.1.451 → 0.1.453

package/payload/platform/plugins/cloudflare/bin/cf-token.sh

@@ -20,7 +20,7 @@ RETRIES="${CF_VERIFY_RETRIES:-10}"
 die() { echo "[cf-token] error: $*" >&2; exit 1; }
 
 scope="${1:-}"; secrets="${2:-}"
-case "$scope" in pages|d1|dns|access) ;; *) die "unknown scope '${scope}'; use pages|d1|dns|access";; esac
+case "$scope" in pages|d1|storage|calendar-d1|dns|access) ;; *) die "unknown scope '${scope}'; use pages|d1|storage|calendar-d1|dns|access";; esac
 [ -n "$secrets" ] && [ -r "$secrets" ] || die "secrets file not readable: '${secrets}'"
 
 # House-credential fallback (Task 1662). After the 1631 storage-isolation
@@ -76,6 +76,14 @@ case "$scope" in
   pages|d1) suffix="pages-d1"; key="CF_PAGES_D1_TOKEN"; legacy="CF_PAGES_TOKEN"
             # exact permission-group names separated by ';'
             names="Pages Write;D1 Write"; res='{"com.cloudflare.api.account.'"$ACC"'":"*"}';;
+  storage)  suffix="storage"; key="CF_STORAGE_TOKEN"
+            # Task 1670 — the storage broker mints one data token from the house
+            # minter carrying both D1 and R2 write. Account-scoped like pages/d1.
+            names="D1 Write;Workers R2 Storage Write"; res='{"com.cloudflare.api.account.'"$ACC"'":"*"}';;
+  calendar-d1) suffix="calendar-d1"; key="CF_CALENDAR_D1_TOKEN"
+            # Task 1670 — the booking calendar mints a D1-only token from the
+            # house minter (no R2; least privilege for reconcile/publish).
+            names="D1 Write"; res='{"com.cloudflare.api.account.'"$ACC"'":"*"}';;
   dns)      suffix="dns"; key="CF_DNS_TOKEN"
             # zone-scoped: res is set after the master-prefix routing (nesting differs)
             names="DNS Write"; zone_scoped=1;;

package/payload/platform/plugins/cloudflare/references/api.md

@@ -11,7 +11,7 @@ Canonical reference (always the source of truth for request shapes, never mirror
 There are two distinct tokens in play. Keep them separate.
 
 - **Master token** — fully-scoped, long-lived, provisioned **once** by the operator in the dashboard (see § Provisioning the master token, below). Broad enough to manage Pages, D1, DNS, **and** create API tokens. The agent reads it only to mint per-scope tokens. It is never passed to `wrangler`, never put on a command line that gets echoed, never printed.
-- **Per-scope narrow token** — scoped to exactly one operation class (a single-zone DNS edit, a one-project Pages deploy, a D1 query), with a **deterministic name** (`<brand>-pages-d1`, `<brand>-dns`, `<brand>-access`). There is **one** such token per scope. The agent loads it from the secrets file; **if absent, it mints it once** from the master — correctly scoped, **no expiry — permanent and reused** — and persists it back to the secrets file. Thereafter it is loaded and reused, never re-minted. Exported into the environment for the one `wrangler` / API call; never echoed into chat, never written into a project tree.
+- **Per-scope narrow token** — scoped to exactly one operation class (a single-zone DNS edit, a one-project Pages deploy, a D1 query), with a **deterministic name** (`<brand>-pages-d1`, `<brand>-dns`, `<brand>-access`, and the house-code data scopes `<brand>-storage` = D1+R2 and `<brand>-calendar-d1` = D1). There is **one** such token per scope. The agent loads it from the secrets file; **if absent, it mints it once** from the master — correctly scoped, **no expiry — permanent and reused** — and persists it back to the secrets file. Thereafter it is loaded and reused, never re-minted. Exported into the environment for the one `wrangler` / API call; never echoed into chat, never written into a project tree.
 
 Why one-per-scope instead of one-per-operation: the operator provisions the master once; the agent provisions each narrow token once and reuses it, so the account never fills with throwaway tokens, no broad token is ever exported to a tool that could log it, and decay is handled structurally by the reconcile pass (§ Reconcile) rather than by per-token TTL. The narrow token persists alongside the master in the same `600`-mode secrets file but is **strictly narrower** than the master — so the binding "never export the master to `wrangler`" is preserved while the narrow token gains reuse.
 
@@ -162,6 +162,8 @@ No `expires_on`: the per-scope token is permanent and reused, so decay is the jo
 
 **Per-scope token resources.** Each reused per-scope token carries the resource that matches its operation class. The Pages-and-D1 token (`<brand>-pages-d1`) and the Access token (`<brand>-access`) are account-scoped: `"resources": { "com.cloudflare.api.account.${CLOUDFLARE_ACCOUNT_ID}": "*" }`. The DNS token (`<brand>-dns`) is zone-scoped, and since it is a single stable token reused across every zone the install routes, its resource covers the account's zones — but the exact shape depends on the master's prefix (see § Token type — route endpoints by prefix): a `cfut_…` master takes the flat `"resources": { "com.cloudflare.api.account.zone.*": "*" }`, while a `cfat_…` master requires the zone nested under the account, `"resources": { "com.cloudflare.api.account.${CLOUDFLARE_ACCOUNT_ID}": { "com.cloudflare.api.account.zone.*": "*" } }` (the flat shape returns `1001` on an account-owned master). A per-zone DNS token would defeat the one-stable-token-per-scope model (one token, reused, not one per zone); the minted token is still strictly narrower than the master, which already carries Zone DNS Edit over the zones in scope.
 
+**House-code data scopes.** The house credential in `cloudflare-house.env` is a **minter**, not a data token, on **every** install, not only multi-tenant ones: the booking calendar and storage broker read it house-only fleet-wide (no per-account fallback), and mint their own account-scoped data tokens from that minter rather than use it directly (a minter returns `10000` on D1/R2). The multi-tenant install adds isolation on top of this same file (§ Multi-tenant installs); the single-tenant install simply reads its calendar/broker credential here. The scopes are — `<brand>-storage` (`D1 Write` + `Workers R2 Storage Write`, key `CF_STORAGE_TOKEN`) and `<brand>-calendar-d1` (`D1 Write`, key `CF_CALENDAR_D1_TOKEN`) — persisted house-side in `cloudflare-house.env` and reused. This is the same mint-or-reuse `cf-token.sh` machinery the hosting scopes use; the only difference is the consumer is trusted house code rather than the agent.
+
 **Redaction is binding.** Every example above pipes the token into a variable or an `Authorization` header and never to stdout. The agent surfaces the operation as verb + target — "minting a Pages-deploy token", "creating CNAME `chat.example.com`" — never the secret. A failure surfaces the API error body with any `Authorization` value masked.
 
 ### A freshly-minted token is not instantly usable — verify with backoff

package/payload/platform/plugins/cloudflare/skills/cloudflare/SKILL.md

@@ -29,7 +29,7 @@ This is the entry point for every Cloudflare task on the install. Pick the opera
 
 Neither the master token nor any per-scope token is ever written into a project tree, committed, or echoed into chat — the per-scope tokens persist only in the account-scoped secrets file, never in a deployable project tree.
 
-On a multi-client install where client sub-accounts share one Cloudflare account, the master lives house-only at `config/cloudflare-house.env` and sub-account D1/R2 data work goes through the storage broker, not raw `wrangler`. This skill's tunnel operations are per-brand isolated and unchanged. The admin-run scopes (Pages, DNS, Access) stay admin/house-run: because the per-account secrets file no longer carries the master, `cf-token.sh` resolves and mints those scope tokens against the house credential (`config/cloudflare-house.env`) and persists them there, surfacing `src=house` on its `[cf-token]` lifeline. Hosting a client site to Pages is therefore an admin/house action, never a sub-account one, consistent with the isolation posture. See `references/api.md` and `.docs/cloudflare-storage-isolation.md`.
+On a multi-client install where client sub-accounts share one Cloudflare account, the master lives house-only at `config/cloudflare-house.env` and sub-account D1/R2 data work goes through the storage broker, not raw `wrangler`. This skill's tunnel operations are per-brand isolated and unchanged. The admin-run scopes (Pages, DNS, Access) stay admin/house-run: because the per-account secrets file no longer carries the master, `cf-token.sh` resolves and mints those scope tokens against the house credential (`config/cloudflare-house.env`) and persists them there, surfacing `src=house` on its `[cf-token]` lifeline. Hosting a client site to Pages is therefore an admin/house action, never a sub-account one, consistent with the isolation posture. The house credential in `config/cloudflare-house.env` is a **minter**, not a data token, on **every** install, not only multi-tenant ones: the booking calendar and storage broker read it house-only fleet-wide (no per-account fallback), so they mint their own account-scoped data tokens from that minter — `CF_STORAGE_TOKEN` (D1 + R2) and `CF_CALENDAR_D1_TOKEN` (D1) — rather than use the minter directly, which returns `10000` on D1/R2. Multi-tenant installs add per-account isolation on top of this same file; single-tenant installs simply read their calendar/broker credential here. See `references/api.md` and `.docs/cloudflare-storage-isolation.md`.
 
 ### Resolve the per-scope token before any `wrangler` / API call (binding)
 

package/payload/platform/plugins/docs/references/outlook-guide.md

@@ -6,7 +6,7 @@ The `outlook` plugin gives the admin agent access to Microsoft 365 / Outlook.com
 
 1. **No app to register.** The client ID ships with the brand (`brand.json#outlookClientId`), and the installer stamps it onto the session-manager env, so there is zero operator Azure work. On a brand that ships an empty value the plugin stays inert until its vendor app exists — see `platform/plugins/outlook/references/auth.md` for the one-time-per-brand vendor provisioning runbook (a vendor step, not an operator or end-user step), including setting **Allow public client flows** to Yes.
 2. **Per account: register the Outlook account** — in admin chat, ask the agent to "register my Outlook account". The agent runs `outlook-account-register`, which returns a short user code and the URL `microsoft.com/devicelogin` and relays both to you.
-3. **Consent on any device** — open `microsoft.com/devicelogin` on your phone or laptop, enter the code, sign in to your Microsoft account, and consent to the requested scopes (`offline_access`, `User.Read`, `Mail.ReadWrite`, `Mail.Send`, `Calendars.ReadWrite`, `Contacts.Read`). `Mail.Send` enables sending and `Calendars.ReadWrite` enables calendar control; a mailbox last consented on an older read-only scope set must re-register before send or any calendar write succeeds. The agent finishes by calling `outlook-account-register-poll`.
+3. **Consent on any device** — open `microsoft.com/devicelogin` on your phone or laptop, enter the code, sign in to your Microsoft account, and consent to the requested scopes (`offline_access`, `User.Read`, `Mail.ReadWrite`, `Mail.Send`, `Calendars.ReadWrite`, `Contacts.Read`). `Mail.Send` enables sending and `Calendars.ReadWrite` enables calendar control; a mailbox last consented on an older read-only scope set must re-register before send or any calendar write succeeds. Nothing else to do: the server finishes the sign-in automatically once you consent, usually within about half a minute, and the mailbox is then connected.
 4. **Done.** Subsequent tool calls (mail, calendar, contacts) use the persisted refresh token transparently.
 5. **Several mailboxes on one account.** Register again to add a second mailbox; it is stored alongside the first, not in place of it. Every operational tool then takes an optional `mailbox` argument — an email address or graphUserId. With one mailbox, omit it. With two or more, name it; omitting it returns a refusal listing the connected mailboxes. `outlook-mailbox-list` shows every connected mailbox. Only one registration runs at a time per account; starting another while one is live returns an in-progress signal.
 
@@ -16,8 +16,8 @@ The `outlook` plugin gives the admin agent access to Microsoft 365 / Outlook.com
 |------|---------|
 | `outlook-account-register` | Start the device-code flow for this account. Returns a user code + `microsoft.com/devicelogin` URL immediately; does not block. |
 | `outlook-account-register-poll` | Finish the device-code flow. One check per call: returns pending, registered, expired, or denied. |
-| `outlook-mail-list` | Recent mail. Default top=25, folder=Inbox. `folder` takes a well-known name or alias (case/space-insensitive): Inbox, Sent Items/sent, Drafts, Deleted Items/trash, Junk Email/junk/spam, Archive, Outbox — or a raw folder id. Custom folder names are not resolved. |
-| `outlook-mail-search` | Microsoft Graph `$search` over the mailbox. Preview-only, like `outlook-mail-list`. |
+| `outlook-mail-list` | Mail newest-first. Default top=25, folder=Inbox. `folder` takes a well-known name or alias (case/space-insensitive): Inbox, Sent Items/sent, Drafts, Deleted Items/trash, Junk Email/junk/spam, Archive, Outbox — or a raw folder id. Custom folder names are not resolved. `since`/`before` (ISO date-times) narrow by receipt date. The 250-per-page figure is not a ceiling: the reply carries `nextCursor` when older mail remains — pass it back as `cursor` to page further back. Filter by sender/subject via `outlook-mail-search`. |
+| `outlook-mail-search` | Microsoft Graph `$search` (KQL) over the mailbox. Preview-only, like `outlook-mail-list`, and pages the same way via `nextCursor`/`cursor`. Put sender/subject/recipient/date filters in the query: `from:`, `to:`, `subject:`, `received>=`. Graph forbids `$search`+`$filter`, so a strict date window is on `outlook-mail-list`. |
 | `outlook-mail-fetch-body` | Complete body of one message by id (`GET /me/messages/{id}?$select=body`). HTML decoded to text, no preview cap. The full-read path — list/search return Microsoft's ~255-char preview only. Returns the envelope plus the whole body. |
 | `outlook-mail-reply` | Reply in-thread (`createReply` / `createReplyAll` + send). Threads natively via conversationId. `replyAll`, added cc/bcc, and account-scoped file attachments (up to 25 MB per file; files over Graph's ~3 MB inline limit use a chunked upload session). Body is plain text, prepended above the quote. Needs `Mail.ReadWrite` + `Mail.Send`. |
 | `outlook-mail-delete` | Move messages to Deleted Items (`POST /me/messages/{id}/move`). Recoverable — never hard-deletes. An id already gone is counted not-moved. Needs `Mail.ReadWrite`. |

package/payload/platform/plugins/outlook/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "outlook",
-  "description": "Microsoft 365 / Outlook.com via Microsoft Graph. Mail is read (list, search, full-body), reply, delete, and compose (draft, draft-edit, send); contacts are read-only; calendar is read + control. Per-account OAuth device-code flow; no client secret. One account can hold several mailboxes at once; every operational tool takes an optional mailbox selector (email or graphUserId) and refuses ambiguously when two or more are attached and none is named. Tools — outlook-account-register / outlook-account-register-poll: device-code register (start + poll); outlook-mail-list / outlook-mail-search: inbox triage (~255-char preview); outlook-mail-fetch-body: full body of one message by id; outlook-mail-reply: in-thread reply (replyAll, cc/bcc, attachments); outlook-mail-delete: move to Deleted Items (recoverable); outlook-mail-otp-extract: poll for a one-time code; outlook-mail-send / outlook-draft / outlook-draft-edit / outlook-draft-send: compose, edit, and send; outlook-calendar-list / outlook-calendar-event: read calendar; outlook-calendar-create / outlook-calendar-update / outlook-calendar-cancel / outlook-calendar-respond / outlook-calendar-freebusy: control calendar; outlook-contacts-list: contacts; outlook-mailbox-info: auth state + folder count for one mailbox; outlook-mailbox-list: every connected mailbox.",
+  "description": "Microsoft 365 / Outlook.com via Microsoft Graph. Mail is read (list, search, full-body), reply, delete, and compose (draft, draft-edit, send); contacts are read-only; calendar is read + control. Per-account OAuth device-code flow; no client secret. One account can hold several mailboxes at once; every operational tool takes an optional mailbox selector (email or graphUserId) and refuses ambiguously when two or more are attached and none is named. Tools — outlook-account-register / outlook-account-register-poll: device-code register (start + poll); outlook-mail-list / outlook-mail-search: inbox triage (~255-char preview) with a date window (list) or KQL from:/subject: filters (search) and a nextCursor for paging beyond the newest page; outlook-mail-fetch-body: full body of one message by id; outlook-mail-reply: in-thread reply (replyAll, cc/bcc, attachments); outlook-mail-delete: move to Deleted Items (recoverable); outlook-mail-otp-extract: poll for a one-time code; outlook-mail-send / outlook-draft / outlook-draft-edit / outlook-draft-send: compose, edit, and send; outlook-calendar-list / outlook-calendar-event: read calendar; outlook-calendar-create / outlook-calendar-update / outlook-calendar-cancel / outlook-calendar-respond / outlook-calendar-freebusy: control calendar; outlook-contacts-list: contacts; outlook-mailbox-info: auth state + folder count for one mailbox; outlook-mailbox-list: every connected mailbox.",
   "version": "0.1.0",
   "author": {
     "name": "Rubytech LLC"

package/payload/platform/plugins/outlook/PLUGIN.md

@@ -1,6 +1,6 @@
 ---
 name: outlook
-description: Microsoft 365 / Outlook.com via Microsoft Graph. Mail is read (list, search, full-body), reply, delete, and compose (draft, draft-edit, send); contacts are read-only; calendar is read + control. Per-account OAuth device-code flow; no client secret. One account can hold several mailboxes at once; every operational tool takes an optional mailbox selector (email or graphUserId) and refuses ambiguously when two or more are attached and none is named. Tools — outlook-account-register / outlook-account-register-poll: device-code register (start + poll); outlook-mail-list / outlook-mail-search: inbox triage (~255-char preview); outlook-mail-fetch-body: full body of one message by id; outlook-mail-reply: in-thread reply (replyAll, cc/bcc, attachments); outlook-mail-delete: move to Deleted Items (recoverable); outlook-mail-otp-extract: poll for a one-time code; outlook-mail-send / outlook-draft / outlook-draft-edit / outlook-draft-send: compose, edit, and send; outlook-calendar-list / outlook-calendar-event: read calendar; outlook-calendar-create / outlook-calendar-update / outlook-calendar-cancel / outlook-calendar-respond / outlook-calendar-freebusy: control calendar; outlook-contacts-list: contacts; outlook-mailbox-info: auth state + folder count for one mailbox; outlook-mailbox-list: every connected mailbox.
+description: Microsoft 365 / Outlook.com via Microsoft Graph. Mail is read (list, search, full-body), reply, delete, and compose (draft, draft-edit, send); contacts are read-only; calendar is read + control. Per-account OAuth device-code flow; no client secret. One account can hold several mailboxes at once; every operational tool takes an optional mailbox selector (email or graphUserId) and refuses ambiguously when two or more are attached and none is named. Tools — outlook-account-register / outlook-account-register-poll: device-code register (start + poll); outlook-mail-list / outlook-mail-search: inbox triage (~255-char preview) with a date window (list) or KQL from:/subject: filters (search) and a nextCursor for paging beyond the newest page; outlook-mail-fetch-body: full body of one message by id; outlook-mail-reply: in-thread reply (replyAll, cc/bcc, attachments); outlook-mail-delete: move to Deleted Items (recoverable); outlook-mail-otp-extract: poll for a one-time code; outlook-mail-send / outlook-draft / outlook-draft-edit / outlook-draft-send: compose, edit, and send; outlook-calendar-list / outlook-calendar-event: read calendar; outlook-calendar-create / outlook-calendar-update / outlook-calendar-cancel / outlook-calendar-respond / outlook-calendar-freebusy: control calendar; outlook-contacts-list: contacts; outlook-mailbox-info: auth state + folder count for one mailbox; outlook-mailbox-list: every connected mailbox.
 tools:
   - name: outlook-account-register
     publicAllowlist: false
@@ -93,9 +93,9 @@ Microsoft Graph access for Outlook.com / Microsoft 365 mailboxes. Mail is read (
 
 ## Capabilities
 
-- **Register:** `outlook-account-register` — starts the OAuth device-code flow against the brand's Entra app and returns a user code + verification URL immediately. The operator opens `microsoft.com/devicelogin` on any device, enters the code, and consents. `outlook-account-register-poll` completes registration — one check per call. Registering a second mailbox on the same account adds it alongside the first rather than replacing it; each mailbox holds its own encrypted tokens (AES-256-CBC) under a shared account key. One device-code flow runs at a time per account; starting another while one is live returns an `in-progress` signal.
+- **Register:** `outlook-account-register` — starts the OAuth device-code flow against the brand's Entra app and returns a user code + verification URL immediately. The operator opens `microsoft.com/devicelogin` on any device, enters the code, and consents. The always-running server then completes registration on its own: a self-contained dispatcher (`dist/scripts/complete-registration.js`), armed on a 30 s interval, polls every live pending code to a terminal outcome, so a mailbox connects once the operator consents with no agent action. `outlook-account-register-poll` remains the manual path and the fallback, one check per call. Registering a second mailbox on the same account adds it alongside the first rather than replacing it; each mailbox holds its own encrypted tokens (AES-256-CBC) under a shared account key. One device-code flow runs at a time per account; starting another while one is live returns an `in-progress` signal. Observability: `devicecode-autopoll` per poll cycle and an independent `devicecode-stranded` audit for any pending code left un-harvested past its lifetime.
 - **Multiple mailboxes:** one account can hold several mailboxes. Every operational tool takes an optional `mailbox` argument (email or graphUserId). With one mailbox, omit it. With two or more, name it — omitting it returns a refusal listing the connected mailboxes. `outlook-mailbox-list` shows them all.
-- **Mail (read):** `outlook-mail-list` returns recent messages and `outlook-mail-search` runs a Graph `$search` query — both return Microsoft's short `bodyPreview` (~255 chars) for cheap triage. `outlook-mail-fetch-body` reads the COMPLETE body of one message by id (HTML decoded to text, no preview cap) — the full-read path.
+- **Mail (read):** `outlook-mail-list` returns messages newest-first with an optional `since`/`before` date window, and `outlook-mail-search` runs a Graph `$search` (KQL) query where `from:`/`to:`/`subject:`/`received>=` filters live — both return Microsoft's short `bodyPreview` (~255 chars) for cheap triage and a `nextCursor` for paging beyond the 250-per-page window (the cursor is an opaque `@odata.nextLink`; pass it back as `cursor`). Graph forbids `$search`+`$filter`, so the strict date window is on the list tool and sender/subject filtering is on the search tool. `outlook-mail-fetch-body` reads the COMPLETE body of one message by id (HTML decoded to text, no preview cap) — the full-read path.
 - **Mail (reply / delete):** `outlook-mail-reply` replies in-thread (native `conversationId` threading) with `replyAll`, added cc/bcc, and account-scoped file attachments (up to 25 MB per file — files over Graph's ~3 MB inline limit stream through a chunked upload session); the body is prepended above the quoted original. `outlook-mail-delete` moves messages to Deleted Items (recoverable — never hard-deletes). Both require `Mail.ReadWrite` (reply also needs `Mail.Send`).
 - **Mail (OTP):** `outlook-mail-otp-extract` polls the inbox for a one-time verification code from a named sender, reading full bodies to extract it — used during service authentication.
 - **Mail (send / draft):** `outlook-mail-send` sends via `POST /me/sendMail` (success asserted on Graph 202); `outlook-draft` creates a draft and returns its id; `outlook-draft-edit` updates an existing draft in place (Graph drafts are mutable); `outlook-draft-send` sends an existing draft by id. Recipients are to/cc/bcc arrays; body is HTML or plain text via `isHtml`. Requires `Mail.Send` + `Mail.ReadWrite`; a mailbox on the old read-only consent returns an actionable "re-register to grant send" signal.

package/payload/platform/plugins/outlook/mcp/dist/__tests__/complete-registration.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=complete-registration.test.d.ts.map

package/payload/platform/plugins/outlook/mcp/dist/__tests__/complete-registration.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"complete-registration.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/complete-registration.test.ts"],"names":[],"mappings":""}

package/payload/platform/plugins/outlook/mcp/dist/__tests__/complete-registration.test.js

@@ -0,0 +1,131 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { PendingStore } from "../auth/pending-store.js";
+import { MailboxRegistry } from "../auth/mailbox-registry.js";
+import { pollRegistrationToTerminal } from "../auth/complete-registration.js";
+const mk = () => {
+    const dir = mkdtempSync(join(tmpdir(), "outlook-complete-"));
+    return { dir, cleanup: () => rmSync(dir, { recursive: true, force: true }) };
+};
+function withFetch(seq) {
+    const original = globalThis.fetch;
+    let i = 0;
+    globalThis.fetch = (async () => seq[Math.min(i++, seq.length - 1)]());
+    return () => {
+        globalThis.fetch = original;
+    };
+}
+function captureStderr() {
+    const chunks = [];
+    const orig = process.stderr.write.bind(process.stderr);
+    process.stderr.write = (s) => {
+        chunks.push(String(s));
+        return true;
+    };
+    return { text: () => chunks.join(""), restore: () => { process.stderr.write = orig; } };
+}
+const json = (o, status = 200) => new Response(JSON.stringify(o), { status, headers: { "Content-Type": "application/json" } });
+const cfg = { clientId: "cid", tenantId: "common" };
+const pendingEntry = () => ({
+    deviceCode: "DEV",
+    scopes: ["Mail.Read"],
+    intervalSec: 5,
+    expiresAtMs: Date.now() + 900_000,
+    issuedAtMs: Date.now(),
+});
+const noSleep = async () => { };
+test("polls to registered with no manual poll call and logs devicecode-autopoll", async () => {
+    const { dir, cleanup } = mk();
+    const ps = new PendingStore("acct-1", dir);
+    ps.write(pendingEntry());
+    const reg = new MailboxRegistry("acct-1", dir);
+    const restore = withFetch([
+        () => json({ error: "authorization_pending" }, 400), // one wait...
+        () => json({ access_token: "AT", refresh_token: "RT", expires_in: 3600, token_type: "Bearer", scope: "Mail.Read" }),
+        () => json({ id: "gid-1", mail: "info@ecolecltd.co.uk" }), // /me
+    ]);
+    const cap = captureStderr();
+    try {
+        const res = await pollRegistrationToTerminal({ accountId: "acct-1", ...cfg, registry: reg, pendingStore: ps, sleep: noSleep });
+        cap.restore();
+        assert.equal(res.status, "registered");
+        assert.equal(ps.read(), null, "pending cleared on completion");
+        assert.equal(reg.storeFor("gid-1").read()?.accessToken, "AT");
+        assert.match(cap.text(), /devicecode-autopoll account=acct-1/);
+    }
+    finally {
+        cap.restore();
+        restore();
+        cleanup();
+    }
+});
+test("expired_token terminates as expired with pending cleared", async () => {
+    const { dir, cleanup } = mk();
+    const ps = new PendingStore("acct-2", dir);
+    ps.write(pendingEntry());
+    const restore = withFetch([() => json({ error: "expired_token" }, 400)]);
+    try {
+        const res = await pollRegistrationToTerminal({ accountId: "acct-2", ...cfg, registry: new MailboxRegistry("acct-2", dir), pendingStore: ps, sleep: noSleep });
+        assert.equal(res.status, "expired");
+        assert.equal(ps.census(), 0);
+    }
+    finally {
+        restore();
+        cleanup();
+    }
+});
+test("access_denied terminates as denied with pending cleared", async () => {
+    const { dir, cleanup } = mk();
+    const ps = new PendingStore("acct-3", dir);
+    ps.write(pendingEntry());
+    const restore = withFetch([() => json({ error: "access_denied" }, 400)]);
+    try {
+        const res = await pollRegistrationToTerminal({ accountId: "acct-3", ...cfg, registry: new MailboxRegistry("acct-3", dir), pendingStore: ps, sleep: noSleep });
+        assert.equal(res.status, "denied");
+        assert.equal(ps.census(), 0);
+    }
+    finally {
+        restore();
+        cleanup();
+    }
+});
+test("slow_down bumps the wait interval before the next poll", async () => {
+    const { dir, cleanup } = mk();
+    const ps = new PendingStore("acct-4", dir);
+    ps.write(pendingEntry()); // intervalSec 5
+    const sleeps = [];
+    const restore = withFetch([
+        () => json({ error: "slow_down" }, 400), // bumps stored interval 5 -> 10
+        () => json({ error: "authorization_pending" }, 400),
+        () => json({ access_token: "AT", refresh_token: "RT", expires_in: 3600, token_type: "Bearer", scope: "Mail.Read" }),
+        () => json({ id: "gid-4", mail: "a@b.com" }),
+    ]);
+    try {
+        await pollRegistrationToTerminal({
+            accountId: "acct-4", ...cfg, registry: new MailboxRegistry("acct-4", dir), pendingStore: ps,
+            sleep: async (ms) => { sleeps.push(ms); },
+        });
+        assert.equal(sleeps[0], 10_000, "slow_down must bump the first wait from 5s to 10s");
+    }
+    finally {
+        restore();
+        cleanup();
+    }
+});
+test("no pending entry terminates as expired without throwing", async () => {
+    const { dir, cleanup } = mk();
+    try {
+        const res = await pollRegistrationToTerminal({
+            accountId: "acct-5", ...cfg, registry: new MailboxRegistry("acct-5", dir),
+            pendingStore: new PendingStore("acct-5", dir), sleep: noSleep,
+        });
+        assert.equal(res.status, "expired");
+    }
+    finally {
+        cleanup();
+    }
+});
+//# sourceMappingURL=complete-registration.test.js.map

package/payload/platform/plugins/outlook/mcp/dist/__tests__/complete-registration.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"complete-registration.test.js","sourceRoot":"","sources":["../../src/__tests__/complete-registration.test.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,0BAA0B,EAAE,MAAM,kCAAkC,CAAC;AAE9E,MAAM,EAAE,GAAG,GAAG,EAAE;IACd,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,mBAAmB,CAAC,CAAC,CAAC;IAC7D,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;AAC/E,CAAC,CAAC;AACF,SAAS,SAAS,CAAC,GAA0B;IAC3C,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC;IAClC,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,UAAU,CAAC,KAAK,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,CAAiB,CAAC;IACtF,OAAO,GAAG,EAAE;QACV,UAAU,CAAC,KAAK,GAAG,QAAQ,CAAC;IAC9B,CAAC,CAAC;AACJ,CAAC;AACD,SAAS,aAAa;IACpB,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACtD,OAAO,CAAC,MAAM,CAAC,KAA2C,GAAG,CAAC,CAAS,EAAE,EAAE;QAC1E,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IACF,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,GAAI,OAAO,CAAC,MAAM,CAAC,KAAiB,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;AACvG,CAAC;AACD,MAAM,IAAI,GAAG,CAAC,CAAU,EAAE,MAAM,GAAG,GAAG,EAAE,EAAE,CACxC,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;AAC/F,MAAM,GAAG,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;AACpD,MAAM,YAAY,GAAG,GAAG,EAAE,CAAC,CAAC;IAC1B,UAAU,EAAE,KAAK;IACjB,MAAM,EAAE,CAAC,WAAW,CAAC;IACrB,WAAW,EAAE,CAAC;IACd,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;IACjC,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE;CACvB,CAAC,CAAC;AACH,MAAM,OAAO,GAAG,KAAK,IAAI,EAAE,GAAE,CAAC,CAAC;AAE/B,IAAI,CAAC,2EAA2E,EAAE,KAAK,IAAI,EAAE;IAC3F,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC;IAC9B,MAAM,EAAE,GAAG,IAAI,YAAY,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC3C,EAAE,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC;IACzB,MAAM,GAAG,GAAG,IAAI,eAAe,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC/C,MAAM,OAAO,GAAG,SAAS,CAAC;QACxB,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,EAAE,GAAG,CAAC,EAAE,cAAc;QACnE,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;QACnH,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC,EAAE,MAAM;KAClE,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,0BAA0B,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,YAAY,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;QAC/H,GAAG,CAAC,OAAO,EAAE,CAAC;QACd,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QACvC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,+BAA+B,CAAC,CAAC;QAC/D,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC;QAC9D,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,oCAAoC,CAAC,CAAC;IACjE,CAAC;YAAS,CAAC;QACT,GAAG,CAAC,OAAO,EAAE,CAAC;QACd,OAAO,EAAE,CAAC;QACV,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;IAC1E,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC;IAC9B,MAAM,EAAE,GAAG,IAAI,YAAY,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC3C,EAAE,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC;IACzB,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;IACzE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,0BAA0B,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,GAAG,EAAE,QAAQ,EAAE,IAAI,eAAe,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;QAC9J,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QACpC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;IAC/B,CAAC;YAAS,CAAC;QACT,OAAO,EAAE,CAAC;QACV,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;IACzE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC;IAC9B,MAAM,EAAE,GAAG,IAAI,YAAY,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC3C,EAAE,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC;IACzB,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;IACzE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,0BAA0B,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,GAAG,EAAE,QAAQ,EAAE,IAAI,eAAe,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;QAC9J,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACnC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;IAC/B,CAAC;YAAS,CAAC;QACT,OAAO,EAAE,CAAC;QACV,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;IACxE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC;IAC9B,MAAM,EAAE,GAAG,IAAI,YAAY,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC3C,EAAE,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,gBAAgB;IAC1C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,OAAO,GAAG,SAAS,CAAC;QACxB,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,EAAE,gCAAgC;QACzE,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,EAAE,GAAG,CAAC;QACnD,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;QACnH,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;KAC7C,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,0BAA0B,CAAC;YAC/B,SAAS,EAAE,QAAQ,EAAE,GAAG,GAAG,EAAE,QAAQ,EAAE,IAAI,eAAe,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE,YAAY,EAAE,EAAE;YAC3F,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;SAC1C,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,mDAAmD,CAAC,CAAC;IACvF,CAAC;YAAS,CAAC;QACT,OAAO,EAAE,CAAC;QACV,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;IACzE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,0BAA0B,CAAC;YAC3C,SAAS,EAAE,QAAQ,EAAE,GAAG,GAAG,EAAE,QAAQ,EAAE,IAAI,eAAe,CAAC,QAAQ,EAAE,GAAG,CAAC;YACzE,YAAY,EAAE,IAAI,YAAY,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,OAAO;SAC9D,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACtC,CAAC;YAAS,CAAC;QACT,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC,CAAC,CAAC"}

package/payload/platform/plugins/outlook/mcp/dist/__tests__/graph-client-paged.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=graph-client-paged.test.d.ts.map

package/payload/platform/plugins/outlook/mcp/dist/__tests__/graph-client-paged.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"graph-client-paged.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/graph-client-paged.test.ts"],"names":[],"mappings":""}

package/payload/platform/plugins/outlook/mcp/dist/__tests__/graph-client-paged.test.js

@@ -0,0 +1,55 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { TokenStore } from "../auth/token-store.js";
+import { callGraphPaged } from "../lib/graph-client.js";
+function configWithToken(accountId) {
+    const dir = mkdtempSync(join(tmpdir(), "outlook-paged-"));
+    const tokenStore = new TokenStore(accountId, dir);
+    tokenStore.store("access-token", "refresh-token", 3600, { scopes: ["Mail.Read"] });
+    return { clientId: "test-client", tenantId: "common", accountId, tokenStore };
+}
+function mockGraph(status, bodyObj) {
+    const calls = [];
+    const original = globalThis.fetch;
+    globalThis.fetch = (async (input, init) => {
+        const req = input instanceof Request ? input : null;
+        const url = req ? req.url : typeof input === "string" ? input : input.toString();
+        if (!url.includes("graph.microsoft.com"))
+            return original(input, init);
+        calls.push(url);
+        const payload = bodyObj === null ? null : JSON.stringify(bodyObj);
+        const headers = bodyObj === null ? undefined : { "content-type": "application/json" };
+        return new Response(payload, { status, headers });
+    });
+    return { restore: () => { globalThis.fetch = original; }, calls };
+}
+test("callGraphPaged returns value and nextLink when present", async () => {
+    const mock = mockGraph(200, {
+        value: [{ id: "A" }, { id: "B" }],
+        "@odata.nextLink": "https://graph.microsoft.com/v1.0/me/messages?$skiptoken=XYZ",
+    });
+    try {
+        const page = await callGraphPaged(configWithToken("acct-p1"), (client) => client.api("/me/messages").top(2), { tool: "test" });
+        assert.deepEqual(page.value, [{ id: "A" }, { id: "B" }]);
+        assert.equal(page.nextLink, "https://graph.microsoft.com/v1.0/me/messages?$skiptoken=XYZ");
+        assert.equal(mock.calls.length, 1);
+    }
+    finally {
+        mock.restore();
+    }
+});
+test("callGraphPaged returns nextLink null and empty value defaults", async () => {
+    const mock = mockGraph(200, {});
+    try {
+        const page = await callGraphPaged(configWithToken("acct-p2"), (client) => client.api("/me/messages"), { tool: "test" });
+        assert.deepEqual(page.value, []);
+        assert.equal(page.nextLink, null);
+    }
+    finally {
+        mock.restore();
+    }
+});
+//# sourceMappingURL=graph-client-paged.test.js.map

package/payload/platform/plugins/outlook/mcp/dist/__tests__/graph-client-paged.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"graph-client-paged.test.js","sourceRoot":"","sources":["../../src/__tests__/graph-client-paged.test.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACtC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEpD,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAExD,SAAS,eAAe,CAAC,SAAiB;IACxC,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAClD,UAAU,CAAC,KAAK,CAAC,cAAc,EAAE,eAAe,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IACnF,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;AAChF,CAAC;AAED,SAAS,SAAS,CAAC,MAAc,EAAE,OAAuB;IACxD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC;IAClC,UAAU,CAAC,KAAK,GAAG,CAAC,KAAK,EAAE,KAA6B,EAAE,IAAkB,EAAE,EAAE;QAC9E,MAAM,GAAG,GAAG,KAAK,YAAY,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;QACpD,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;QACjF,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,qBAAqB,CAAC;YAAE,OAAO,QAAQ,CAAC,KAAuC,EAAE,IAAI,CAAC,CAAC;QACzG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChB,MAAM,OAAO,GAAG,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAClE,MAAM,OAAO,GAAG,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;QACtF,OAAO,IAAI,QAAQ,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IACpD,CAAC,CAAiB,CAAC;IACnB,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,UAAU,CAAC,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;AACpE,CAAC;AAED,IAAI,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;IACxE,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,EAAE;QAC1B,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC;QACjC,iBAAiB,EAAE,6DAA6D;KACjF,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,cAAc,CAC/B,eAAe,CAAC,SAAS,CAAC,EAC1B,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAC7C,EAAE,IAAI,EAAE,MAAM,EAAE,CACjB,CAAC;QACF,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QACzD,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,6DAA6D,CAAC,CAAC;QAC3F,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACrC,CAAC;YAAS,CAAC;QACT,IAAI,CAAC,OAAO,EAAE,CAAC;IACjB,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;IAC/E,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,cAAc,CAC/B,eAAe,CAAC,SAAS,CAAC,EAC1B,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,EACtC,EAAE,IAAI,EAAE,MAAM,EAAE,CACjB,CAAC;QACF,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACjC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACpC,CAAC;YAAS,CAAC;QACT,IAAI,CAAC,OAAO,EAAE,CAAC;IACjB,CAAC;AACH,CAAC,CAAC,CAAC"}

package/payload/platform/plugins/outlook/mcp/dist/__tests__/mail-list-paging.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=mail-list-paging.test.d.ts.map

package/payload/platform/plugins/outlook/mcp/dist/__tests__/mail-list-paging.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mail-list-paging.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/mail-list-paging.test.ts"],"names":[],"mappings":""}

package/payload/platform/plugins/outlook/mcp/dist/__tests__/mail-list-paging.test.js

@@ -0,0 +1,120 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { TokenStore } from "../auth/token-store.js";
+import { runMailList } from "../tools/mail-list.js";
+function configWithToken(accountId) {
+    const dir = mkdtempSync(join(tmpdir(), "outlook-mllist-"));
+    const tokenStore = new TokenStore(accountId, dir);
+    tokenStore.store("access-token", "refresh-token", 3600, { scopes: ["Mail.Read"] });
+    return { clientId: "test-client", tenantId: "common", accountId, tokenStore };
+}
+function mockGraph(bodyObj) {
+    const urls = [];
+    const original = globalThis.fetch;
+    globalThis.fetch = (async (input, init) => {
+        const req = input instanceof Request ? input : null;
+        const url = req ? req.url : typeof input === "string" ? input : input.toString();
+        if (!url.includes("graph.microsoft.com"))
+            return original(input, init);
+        urls.push(url);
+        return new Response(JSON.stringify(bodyObj), { status: 200, headers: { "content-type": "application/json" } });
+    });
+    return { restore: () => { globalThis.fetch = original; }, urls };
+}
+const EMPTY = { value: [] };
+test("since builds a receivedDateTime ge filter", async () => {
+    const mock = mockGraph(EMPTY);
+    try {
+        await runMailList(configWithToken("a1"), { since: "2024-01-01" });
+        const filter = new URL(mock.urls[0]).searchParams.get("$filter");
+        assert.equal(filter, "receivedDateTime ge 2024-01-01T00:00:00.000Z");
+    }
+    finally {
+        mock.restore();
+    }
+});
+test("since and before AND-combine into one filter", async () => {
+    const mock = mockGraph(EMPTY);
+    try {
+        await runMailList(configWithToken("a2"), { since: "2024-01-01", before: "2024-02-01" });
+        const filter = new URL(mock.urls[0]).searchParams.get("$filter");
+        assert.equal(filter, "receivedDateTime ge 2024-01-01T00:00:00.000Z and receivedDateTime le 2024-02-01T00:00:00.000Z");
+    }
+    finally {
+        mock.restore();
+    }
+});
+test("no date args -> no $filter (unchanged behaviour)", async () => {
+    const mock = mockGraph(EMPTY);
+    try {
+        const r = await runMailList(configWithToken("a3"), {});
+        assert.equal(new URL(mock.urls[0]).searchParams.get("$filter"), null);
+        assert.equal(r.nextCursor, null);
+        assert.deepEqual(r.items, []);
+    }
+    finally {
+        mock.restore();
+    }
+});
+test("nextCursor surfaced from @odata.nextLink", async () => {
+    const link = "https://graph.microsoft.com/v1.0/me/mailFolders/Inbox/messages?$skiptoken=ABC";
+    const mock = mockGraph({ value: [], "@odata.nextLink": link });
+    try {
+        const r = await runMailList(configWithToken("a4"), {});
+        assert.equal(r.nextCursor, link);
+    }
+    finally {
+        mock.restore();
+    }
+});
+test("cursor delegates to the nextLink URL and builds no filter", async () => {
+    const cursor = "https://graph.microsoft.com/v1.0/me/mailFolders/Inbox/messages?$skiptoken=ABC";
+    const mock = mockGraph(EMPTY);
+    try {
+        await runMailList(configWithToken("a5"), { cursor, since: "2024-01-01" });
+        assert.equal(mock.urls.length, 1);
+        assert.match(mock.urls[0], /\$skiptoken=ABC/);
+        assert.equal(new URL(mock.urls[0]).searchParams.get("$filter"), null, "cursor path must not add a filter");
+    }
+    finally {
+        mock.restore();
+    }
+});
+test("unparseable since throws before any Graph call", async () => {
+    const mock = mockGraph(EMPTY);
+    try {
+        await assert.rejects(runMailList(configWithToken("a6"), { since: "not-a-date" }), /not a valid date/);
+        assert.equal(mock.urls.length, 0);
+    }
+    finally {
+        mock.restore();
+    }
+});
+test("unparseable before throws before any Graph call", async () => {
+    const mock = mockGraph(EMPTY);
+    try {
+        await assert.rejects(runMailList(configWithToken("a7"), { before: "nope" }), /not a valid date/);
+        assert.equal(mock.urls.length, 0);
+    }
+    finally {
+        mock.restore();
+    }
+});
+test("cursor path ignores an invalid since (all other filter args are ignored)", async () => {
+    const cursor = "https://graph.microsoft.com/v1.0/me/mailFolders/Inbox/messages?$skiptoken=ABC";
+    const mock = mockGraph(EMPTY);
+    try {
+        // A paging call carries a cursor; a stale/garbage since must not abort it,
+        // because the nextLink already bakes in the original window.
+        await runMailList(configWithToken("a8"), { cursor, since: "not-a-date" });
+        assert.equal(mock.urls.length, 1);
+        assert.match(mock.urls[0], /\$skiptoken=ABC/);
+    }
+    finally {
+        mock.restore();
+    }
+});
+//# sourceMappingURL=mail-list-paging.test.js.map

package/payload/platform/plugins/outlook/mcp/dist/__tests__/mail-list-paging.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mail-list-paging.test.js","sourceRoot":"","sources":["../../src/__tests__/mail-list-paging.test.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACtC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEpD,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAEpD,SAAS,eAAe,CAAC,SAAiB;IACxC,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAC3D,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAClD,UAAU,CAAC,KAAK,CAAC,cAAc,EAAE,eAAe,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IACnF,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;AAChF,CAAC;AAED,SAAS,SAAS,CAAC,OAAgB;IACjC,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC;IAClC,UAAU,CAAC,KAAK,GAAG,CAAC,KAAK,EAAE,KAA6B,EAAE,IAAkB,EAAE,EAAE;QAC9E,MAAM,GAAG,GAAG,KAAK,YAAY,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;QACpD,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;QACjF,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,qBAAqB,CAAC;YAAE,OAAO,QAAQ,CAAC,KAAuC,EAAE,IAAI,CAAC,CAAC;QACzG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACf,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;IACjH,CAAC,CAAiB,CAAC;IACnB,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,UAAU,CAAC,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;AACnE,CAAC;AAED,MAAM,KAAK,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;AAE5B,IAAI,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;IAC3D,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,WAAW,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;QAClE,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACjE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,8CAA8C,CAAC,CAAC;IACvE,CAAC;YAAS,CAAC;QAAC,IAAI,CAAC,OAAO,EAAE,CAAC;IAAC,CAAC;AAC/B,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;IAC9D,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,WAAW,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;QACxF,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACjE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,+FAA+F,CAAC,CAAC;IACxH,CAAC;YAAS,CAAC;QAAC,IAAI,CAAC,OAAO,EAAE,CAAC;IAAC,CAAC;AAC/B,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;IAClE,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,WAAW,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QACvD,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,CAAC;QACtE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QACjC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAChC,CAAC;YAAS,CAAC;QAAC,IAAI,CAAC,OAAO,EAAE,CAAC;IAAC,CAAC;AAC/B,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;IAC1D,MAAM,IAAI,GAAG,+EAA+E,CAAC;IAC7F,MAAM,IAAI,GAAG,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/D,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,WAAW,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QACvD,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IACnC,CAAC;YAAS,CAAC;QAAC,IAAI,CAAC,OAAO,EAAE,CAAC;IAAC,CAAC;AAC/B,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;IAC3E,MAAM,MAAM,GAAG,+EAA+E,CAAC;IAC/F,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,WAAW,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;QAC1E,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAClC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC;QAC9C,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,mCAAmC,CAAC,CAAC;IAC7G,CAAC;YAAS,CAAC;QAAC,IAAI,CAAC,OAAO,EAAE,CAAC;IAAC,CAAC;AAC/B,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;IAChE,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,EAAE,kBAAkB,CAAC,CAAC;QACtG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACpC,CAAC;YAAS,CAAC;QAAC,IAAI,CAAC,OAAO,EAAE,CAAC;IAAC,CAAC;AAC/B,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;IACjE,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,kBAAkB,CAAC,CAAC;QACjG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACpC,CAAC;YAAS,CAAC;QAAC,IAAI,CAAC,OAAO,EAAE,CAAC;IAAC,CAAC;AAC/B,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,0EAA0E,EAAE,KAAK,IAAI,EAAE;IAC1F,MAAM,MAAM,GAAG,+EAA+E,CAAC;IAC/F,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAC9B,IAAI,CAAC;QACH,2EAA2E;QAC3E,6DAA6D;QAC7D,MAAM,WAAW,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;QAC1E,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAClC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC;IAChD,CAAC;YAAS,CAAC;QAAC,IAAI,CAAC,OAAO,EAAE,CAAC;IAAC,CAAC;AAC/B,CAAC,CAAC,CAAC"}

package/payload/platform/plugins/outlook/mcp/dist/__tests__/mail-search-paging.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=mail-search-paging.test.d.ts.map

package/payload/platform/plugins/outlook/mcp/dist/__tests__/mail-search-paging.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mail-search-paging.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/mail-search-paging.test.ts"],"names":[],"mappings":""}

package/payload/platform/plugins/outlook/mcp/dist/__tests__/mail-search-paging.test.js

@@ -0,0 +1,66 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { TokenStore } from "../auth/token-store.js";
+import { runMailSearch } from "../tools/mail-search.js";
+function configWithToken(accountId) {
+    const dir = mkdtempSync(join(tmpdir(), "outlook-mlsearch-"));
+    const tokenStore = new TokenStore(accountId, dir);
+    tokenStore.store("access-token", "refresh-token", 3600, { scopes: ["Mail.Read"] });
+    return { clientId: "test-client", tenantId: "common", accountId, tokenStore };
+}
+function mockGraph(bodyObj) {
+    const urls = [];
+    const original = globalThis.fetch;
+    globalThis.fetch = (async (input, init) => {
+        const req = input instanceof Request ? input : null;
+        const url = req ? req.url : typeof input === "string" ? input : input.toString();
+        if (!url.includes("graph.microsoft.com"))
+            return original(input, init);
+        urls.push(url);
+        return new Response(JSON.stringify(bodyObj), { status: 200, headers: { "content-type": "application/json" } });
+    });
+    return { restore: () => { globalThis.fetch = original; }, urls };
+}
+test("search surfaces nextCursor from @odata.nextLink", async () => {
+    const link = "https://graph.microsoft.com/v1.0/me/messages?$search=%22invoice%22&$skiptoken=ABC";
+    const mock = mockGraph({ value: [], "@odata.nextLink": link });
+    try {
+        const r = await runMailSearch(configWithToken("s1"), { query: "invoice" });
+        assert.equal(r.nextCursor, link);
+        assert.match(mock.urls[0], /\$search=/);
+    }
+    finally {
+        mock.restore();
+    }
+});
+test("cursor delegates to the nextLink and re-applies ConsistencyLevel", async () => {
+    const cursor = "https://graph.microsoft.com/v1.0/me/messages?$search=%22invoice%22&$skiptoken=ABC";
+    let sawConsistency = false;
+    const original = globalThis.fetch;
+    const urls = [];
+    globalThis.fetch = (async (input, init) => {
+        const req = input instanceof Request ? input : null;
+        const url = req ? req.url : typeof input === "string" ? input : input.toString();
+        if (!url.includes("graph.microsoft.com"))
+            return original(input, init);
+        urls.push(url);
+        const headerVal = req
+            ? req.headers.get("ConsistencyLevel")
+            : init?.headers?.["ConsistencyLevel"];
+        if (headerVal === "eventual")
+            sawConsistency = true;
+        return new Response(JSON.stringify({ value: [] }), { status: 200, headers: { "content-type": "application/json" } });
+    });
+    try {
+        await runMailSearch(configWithToken("s2"), { query: "ignored-when-cursor", cursor });
+        assert.match(urls[0], /\$skiptoken=ABC/);
+        assert.equal(sawConsistency, true, "ConsistencyLevel: eventual must be re-applied on the cursor request");
+    }
+    finally {
+        globalThis.fetch = original;
+    }
+});
+//# sourceMappingURL=mail-search-paging.test.js.map

package/payload/platform/plugins/outlook/mcp/dist/__tests__/mail-search-paging.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mail-search-paging.test.js","sourceRoot":"","sources":["../../src/__tests__/mail-search-paging.test.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACtC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEpD,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAExD,SAAS,eAAe,CAAC,SAAiB;IACxC,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,mBAAmB,CAAC,CAAC,CAAC;IAC7D,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAClD,UAAU,CAAC,KAAK,CAAC,cAAc,EAAE,eAAe,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IACnF,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;AAChF,CAAC;AAED,SAAS,SAAS,CAAC,OAAgB;IACjC,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC;IAClC,UAAU,CAAC,KAAK,GAAG,CAAC,KAAK,EAAE,KAA6B,EAAE,IAAkB,EAAE,EAAE;QAC9E,MAAM,GAAG,GAAG,KAAK,YAAY,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;QACpD,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;QACjF,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,qBAAqB,CAAC;YAAE,OAAO,QAAQ,CAAC,KAAuC,EAAE,IAAI,CAAC,CAAC;QACzG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACf,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;IACjH,CAAC,CAAiB,CAAC;IACnB,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,UAAU,CAAC,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;AACnE,CAAC;AAED,IAAI,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;IACjE,MAAM,IAAI,GAAG,mFAAmF,CAAC;IACjG,MAAM,IAAI,GAAG,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/D,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,aAAa,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QAC3E,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QACjC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;IAC1C,CAAC;YAAS,CAAC;QAAC,IAAI,CAAC,OAAO,EAAE,CAAC;IAAC,CAAC;AAC/B,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;IAClF,MAAM,MAAM,GAAG,mFAAmF,CAAC;IACnG,IAAI,cAAc,GAAG,KAAK,CAAC;IAC3B,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC;IAClC,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,UAAU,CAAC,KAAK,GAAG,CAAC,KAAK,EAAE,KAA6B,EAAE,IAAkB,EAAE,EAAE;QAC9E,MAAM,GAAG,GAAG,KAAK,YAAY,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;QACpD,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;QACjF,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,qBAAqB,CAAC;YAAE,OAAO,QAAQ,CAAC,KAAuC,EAAE,IAAI,CAAC,CAAC;QACzG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACf,MAAM,SAAS,GAAG,GAAG;YACnB,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;YACrC,CAAC,CAAE,IAAI,EAAE,OAA8C,EAAE,CAAC,kBAAkB,CAAC,CAAC;QAChF,IAAI,SAAS,KAAK,UAAU;YAAE,cAAc,GAAG,IAAI,CAAC;QACpD,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;IACvH,CAAC,CAAiB,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,aAAa,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,qBAAqB,EAAE,MAAM,EAAE,CAAC,CAAC;QACrF,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC;QACzC,MAAM,CAAC,KAAK,CAAC,cAAc,EAAE,IAAI,EAAE,qEAAqE,CAAC,CAAC;IAC5G,CAAC;YAAS,CAAC;QAAC,UAAU,CAAC,KAAK,GAAG,QAAQ,CAAC;IAAC,CAAC;AAC5C,CAAC,CAAC,CAAC"}

package/payload/platform/plugins/outlook/mcp/dist/__tests__/pending-scan.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=pending-scan.test.d.ts.map

package/payload/platform/plugins/outlook/mcp/dist/__tests__/pending-scan.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pending-scan.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/pending-scan.test.ts"],"names":[],"mappings":""}