@rubytech/create-maxy-code 0.1.459 → 0.1.460

package/payload/server/server.js

@@ -113,15 +113,19 @@ import {
   writeAdminUserAndPerson
 } from "./chunk-POBXIHOF.js";
 import {
+  D1_MAX_SQL_STATEMENT_BYTES,
+  D1_QUERY_MAX_BODY_BYTES,
+  R2_OBJECT_ENVELOPE_MAX_BODY_BYTES,
   R2_OBJECT_MAX_BYTES,
   R2_OBJECT_PUT_MAX_BODY_BYTES,
+  STORAGE_RESOURCE_NAME_MAX_BODY_BYTES,
   authorizeAccess,
   listResources,
   makeHouseCfExec,
   registerResource,
   resolveOwner,
   tooLargeMessage
-} from "./chunk-Q6W4U6HL.js";
+} from "./chunk-JXWFVE5X.js";
 import {
   __commonJS,
   __toESM
@@ -8745,6 +8749,49 @@ function log(action, kind, account, target, owner, result, reason) {
 function cfExec() {
   return makeHouseCfExec(platformRoot());
 }
+async function readJsonBody(c) {
+  let parsed;
+  try {
+    parsed = await c.req.json();
+  } catch (err) {
+    if (err instanceof Error && err.name === "BodyLimitError") throw err;
+    return { ok: false, res: c.json({ error: "invalid-json" }, 400) };
+  }
+  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+    return { ok: false, res: c.json({ error: "invalid-json" }, 400) };
+  }
+  return { ok: true, body: parsed };
+}
+function nameBodyLimit(kind) {
+  return bodyLimit({
+    maxSize: STORAGE_RESOURCE_NAME_MAX_BODY_BYTES,
+    onError: (c) => {
+      log("write", kind, caller(c) ?? "none", "*", null, "deny", "name-body-too-large");
+      return c.json(
+        {
+          error: `request body exceeds the ${(STORAGE_RESOURCE_NAME_MAX_BODY_BYTES / 1024).toFixed(
+            1
+          )} KiB (${STORAGE_RESOURCE_NAME_MAX_BODY_BYTES} bytes) limit for a storage resource create, which carries only a name.`
+        },
+        413
+      );
+    }
+  });
+}
+var d1QueryBodyLimit = bodyLimit({
+  maxSize: D1_QUERY_MAX_BODY_BYTES,
+  onError: (c) => {
+    log("read", "d1", caller(c) ?? "none", "*", null, "deny", "sql-body-too-large");
+    return c.json(
+      {
+        error: `request body exceeds the ${(D1_QUERY_MAX_BODY_BYTES / 1024 / 1024).toFixed(
+          1
+        )} MiB (${D1_QUERY_MAX_BODY_BYTES} bytes) limit for a D1 query, which carries a database name and a SQL statement of at most ${D1_MAX_SQL_STATEMENT_BYTES} bytes.`
+      },
+      413
+    );
+  }
+});
 app3.get("/d1/list", async (c) => {
   const account = caller(c);
   if (!account) return c.json({ error: "no-caller" }, 403);
@@ -8759,10 +8806,12 @@ app3.get("/d1/list", async (c) => {
     await session.close();
   }
 });
-app3.post("/d1/create", async (c) => {
+app3.post("/d1/create", nameBodyLimit("d1"), async (c) => {
   const account = caller(c);
   if (!account) return c.json({ error: "no-caller" }, 403);
-  const { name } = await c.req.json();
+  const parsed = await readJsonBody(c);
+  if (!parsed.ok) return parsed.res;
+  const { name } = parsed.body;
   if (!name || typeof name !== "string") return c.json({ error: "name-required" }, 400);
   const session = getSession();
   try {
@@ -8781,10 +8830,12 @@ app3.post("/d1/create", async (c) => {
     await session.close();
   }
 });
-app3.post("/d1/query", async (c) => {
+app3.post("/d1/query", d1QueryBodyLimit, async (c) => {
   const account = caller(c);
   if (!account) return c.json({ error: "no-caller" }, 403);
-  const { name, sql } = await c.req.json();
+  const parsed = await readJsonBody(c);
+  if (!parsed.ok) return parsed.res;
+  const { name, sql } = parsed.body;
   if (!name || typeof name !== "string") return c.json({ error: "name-required" }, 400);
   if (!sql || typeof sql !== "string") return c.json({ error: "sql-required" }, 400);
   const session = getSession();
@@ -8815,10 +8866,12 @@ app3.get("/r2/list", async (c) => {
     await session.close();
   }
 });
-app3.post("/r2/create", async (c) => {
+app3.post("/r2/create", nameBodyLimit("r2"), async (c) => {
   const account = caller(c);
   if (!account) return c.json({ error: "no-caller" }, 403);
-  const { name } = await c.req.json();
+  const parsed = await readJsonBody(c);
+  if (!parsed.ok) return parsed.res;
+  const { name } = parsed.body;
   if (!name || typeof name !== "string") return c.json({ error: "name-required" }, 400);
   const session = getSession();
   try {
@@ -8869,7 +8922,39 @@ function readKey(body) {
   const key = body.key;
   return typeof key === "string" && key.length > 0 ? key : null;
 }
-app3.post("/r2/object/list", async (c) => {
+function envelopeBodyLimit(action) {
+  return bodyLimit({
+    maxSize: R2_OBJECT_ENVELOPE_MAX_BODY_BYTES,
+    // Names the limit rather than the object: the body is deliberately unparsed
+    // here, which is the whole point of the middleware, so the key is genuinely
+    // unknown — as recorded for put in 1695. Stated in KiB with exact bytes rather
+    // than the MiB the object messages use: 64 KiB renders as "0.1 MiB", which is
+    // less legible, not more. The exact bytes are there for the same reason
+    // tooLargeMessage carries them.
+    //
+    // The {error} body is the routes' convention, which the default's bare text
+    // is not. On the content-length branch no body is read and no handler runs, so
+    // this log line is the only trace the request ever existed.
+    //
+    // reason distinguishes this from put's body-too-large rather than reusing it.
+    // They are different events refusing bodies ~2,100x apart, and put and delete
+    // both log action=write, so a shared slug would make a 140 MB put denial and a
+    // 65 KiB delete denial byte-identical — the same conflation the reason field
+    // exists to prevent for ownership-vs-size.
+    onError: (c) => {
+      log(action, "r2", caller(c) ?? "none", "*", null, "deny", "envelope-too-large");
+      return c.json(
+        {
+          error: `request body exceeds the ${(R2_OBJECT_ENVELOPE_MAX_BODY_BYTES / 1024).toFixed(
+            1
+          )} KiB (${R2_OBJECT_ENVELOPE_MAX_BODY_BYTES} bytes) limit for an R2 object metadata envelope, which carries only a bucket and a key or prefix.`
+        },
+        413
+      );
+    }
+  });
+}
+app3.post("/r2/object/list", envelopeBodyLimit("list"), async (c) => {
   const gate = await objectGate(c, "list");
   if (!gate.ok) return gate.res;
   const prefix = gate.body.prefix;
@@ -8883,15 +8968,15 @@ app3.post("/r2/object/list", async (c) => {
     return c.json({ error: String(err) }, 500);
   }
 });
-app3.post("/r2/object/get", async (c) => {
+app3.post("/r2/object/get", envelopeBodyLimit("read"), async (c) => {
   const gate = await objectGate(c, "read");
   if (!gate.ok) return gate.res;
   const key = readKey(gate.body);
   if (!key) return c.json({ error: "key-required" }, 400);
   try {
     const cf = await cfExec();
-    const listed = await cf.r2ObjectList(gate.bucket, key);
-    const size = listed.find((o) => o.key === key)?.size;
+    const found = await cf.r2ObjectFind(gate.bucket, key);
+    const size = found?.size;
     if (typeof size !== "number" || !Number.isFinite(size) || size < 0) {
       log("read", "r2", caller(c) ?? "none", key, caller(c), "deny", "size-unknown");
       return c.json(
@@ -8962,7 +9047,7 @@ app3.post(
     }
   }
 );
-app3.post("/r2/object/delete", async (c) => {
+app3.post("/r2/object/delete", envelopeBodyLimit("write"), async (c) => {
   const gate = await objectGate(c, "write");
   if (!gate.ok) return gate.res;
   const key = readKey(gate.body);
@@ -8976,7 +9061,7 @@ app3.post("/r2/object/delete", async (c) => {
 });
 var storage_broker_default = app3;
 async function runStorageAudit(root) {
-  const { reconcileStorage } = await import("./src-3I2RYZFB.js");
+  const { reconcileStorage } = await import("./src-4F37OHLK.js");
   const session = getSession();
   try {
     const cf = await makeHouseCfExec(root);
@@ -9901,6 +9986,78 @@ function pickActivity(entries, grown, nowMs, concurrencyWindowMs) {
   return { hex: newest.hex, lastEmitAt: newest.mtimeMs, count };
 }
 
+// server/routes/stream-lifecycle.ts
+var GAUGE_INTERVAL_MS = 6e4;
+function isArmed(timer2) {
+  return timer2._destroyed !== true;
+}
+var Registration = class {
+  constructor(connId, channel, startedAt) {
+    this.connId = connId;
+    this.channel = channel;
+    this.startedAt = startedAt;
+  }
+  timers = [];
+  closed = false;
+  arm(timer2) {
+    this.timers.push(timer2);
+    return timer2;
+  }
+  teardown(reason) {
+    if (this.closed) return false;
+    this.closed = true;
+    for (const t of this.timers) clearInterval(t);
+    const stillArmed = this.timers.filter(isArmed).length;
+    if (stillArmed > 0) {
+      console.error(
+        `[wa-stream] op=teardown-defect conn=${this.connId} channel=${this.channel} stillArmed=${stillArmed} reason=${reason}`
+      );
+      return true;
+    }
+    registry.delete(this);
+    if (registry.size === 0) emitGauge();
+    return true;
+  }
+};
+var registry = /* @__PURE__ */ new Set();
+var gaugeTimer = null;
+function emitGauge() {
+  const now = Date.now();
+  const counts = { reader: 0, store: 0 };
+  let oldestMs = 0;
+  let stale = 0;
+  for (const reg of [...registry]) {
+    if (!reg.timers.some(isArmed)) {
+      stale++;
+      registry.delete(reg);
+      continue;
+    }
+    counts[reg.channel]++;
+    oldestMs = Math.max(oldestMs, now - reg.startedAt);
+  }
+  const armed = counts.reader + counts.store;
+  console.log(
+    `[wa-stream] op=gauge armed=${armed} reader=${counts.reader} store=${counts.store} oldestSec=${Math.floor(oldestMs / 1e3)} stale=${stale}`
+  );
+  if (armed === 0) stopGauge();
+}
+function startGauge() {
+  if (gaugeTimer) return;
+  gaugeTimer = setInterval(emitGauge, GAUGE_INTERVAL_MS);
+  gaugeTimer.unref();
+}
+function stopGauge() {
+  if (!gaugeTimer) return;
+  clearInterval(gaugeTimer);
+  gaugeTimer = null;
+}
+function openStream(connId, channel, startedAt) {
+  const reg = new Registration(connId, channel, startedAt);
+  registry.add(reg);
+  startGauge();
+  return reg;
+}
+
 // app/admin-types.ts
 var ACCEPT_MIME = "image/jpeg,image/png,image/gif,image/webp,application/pdf,text/plain,text/markdown,text/csv,text/html,text/calendar,application/zip,application/x-zip-compressed,application/vnd.openxmlformats-officedocument.wordprocessingml.document,application/vnd.oasis.opendocument.text,text/rtf,application/rtf,application/vnd.openxmlformats-officedocument.spreadsheetml.sheet,application/vnd.ms-excel,application/vnd.oasis.opendocument.spreadsheet,application/vnd.openxmlformats-officedocument.presentationml.presentation,application/vnd.ms-powerpoint,application/vnd.oasis.opendocument.presentation,audio/ogg,audio/opus,audio/mp4,audio/x-m4a,audio/mpeg,audio/webm,audio/wav,video/mp4,.docx,.odt,.rtf,.xlsx,.xls,.ods,.pptx,.ppt,.odp,.opus,.ogg,.m4a,.mp4,.mp3,.wav,.webm";
 var SUPPORTED_MIME_SET = new Set(ACCEPT_MIME.split(",").filter((t) => !t.startsWith(".")));
@@ -10209,6 +10366,8 @@ data: ${JSON.stringify(turn)}
   const connId = `${sessionId.slice(0, 8)}-${process.hrtime.bigint().toString(36).slice(-6)}`;
   const startedAt = Date.now();
   const lastEventId = c.req.header("Last-Event-ID");
+  let teardown = () => {
+  };
   const readable = new ReadableStream({
     start(controller) {
       const fileEnd0 = (() => {
@@ -10293,27 +10452,34 @@ data: ${JSON.stringify(obj)}
         actx.now = Date.now();
         runActivityTick(actx);
       };
-      const poll = setInterval(tick, 1e3);
-      const heartbeat = setInterval(() => {
-        try {
-          controller.enqueue(encoder.encode(": ping\n\n"));
-          console.log(`[wa-stream] op=heartbeat conn=${connId}`);
-        } catch {
-        }
-      }, 2e4);
-      c.req.raw.signal.addEventListener("abort", () => {
+      const lifecycle = openStream(connId, "reader", startedAt);
+      lifecycle.arm(setInterval(tick, 1e3));
+      lifecycle.arm(
+        setInterval(() => {
+          try {
+            controller.enqueue(encoder.encode(": ping\n\n"));
+            console.log(`[wa-stream] op=heartbeat conn=${connId}`);
+          } catch {
+            teardown("heartbeat-dead-controller");
+          }
+        }, 2e4)
+      );
+      teardown = (reason) => {
+        if (!lifecycle.teardown(reason)) return;
         watcher?.close();
-        clearInterval(poll);
-        clearInterval(heartbeat);
         if (actx.emittedHex !== null) {
           console.log(`[webchat-activity] op=clear key=${sessionKey} reason=stream-close`);
         }
-        console.log(`[wa-stream] op=close conn=${connId} ranMs=${Date.now() - startedAt} reason=client-abort`);
+        console.log(`[wa-stream] op=close conn=${connId} ranMs=${Date.now() - startedAt} reason=${reason}`);
         try {
           controller.close();
         } catch {
         }
-      });
+      };
+      c.req.raw.signal.addEventListener("abort", () => teardown("client-abort"));
+    },
+    cancel() {
+      teardown("client-cancel");
     }
   });
   return new Response(readable, {
@@ -10421,6 +10587,8 @@ app5.get("/store-stream", requireAdminSession, (c) => {
     }
     return turn;
   };
+  let teardown = () => {
+  };
   const readable = new ReadableStream({
     start(controller) {
       const send = (turn, id) => {
@@ -10518,23 +10686,30 @@ data: ${JSON.stringify(payload)}
         watcher = watch(file, drain);
       } catch {
       }
-      const poll = setInterval(drain, 1e3);
-      const heartbeat = setInterval(() => {
-        try {
-          controller.enqueue(encoder.encode(": ping\n\n"));
-        } catch {
-        }
-      }, 2e4);
-      c.req.raw.signal.addEventListener("abort", () => {
+      const lifecycle = openStream(connId, "store", startedAt);
+      lifecycle.arm(setInterval(drain, 1e3));
+      lifecycle.arm(
+        setInterval(() => {
+          try {
+            controller.enqueue(encoder.encode(": ping\n\n"));
+          } catch {
+            teardown("heartbeat-dead-controller");
+          }
+        }, 2e4)
+      );
+      teardown = (reason) => {
+        if (!lifecycle.teardown(reason)) return;
         watcher?.close();
-        clearInterval(poll);
-        clearInterval(heartbeat);
-        console.log(`[wa-reader] op=store-close conn=${connId} ranMs=${Date.now() - startedAt}`);
+        console.log(`[wa-reader] op=store-close conn=${connId} ranMs=${Date.now() - startedAt} reason=${reason}`);
         try {
           controller.close();
         } catch {
         }
-      });
+      };
+      c.req.raw.signal.addEventListener("abort", () => teardown("client-abort"));
+    },
+    cancel() {
+      teardown("client-cancel");
     }
   });
   return new Response(readable, {

package/payload/server/{src-3I2RYZFB.js → src-4F37OHLK.js}

@@ -1,7 +1,12 @@
 import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
 import {
+  D1_MAX_SQL_STATEMENT_BYTES,
+  D1_QUERY_MAX_BODY_BYTES,
+  JSON_STRING_WORST_CASE_EXPANSION,
+  R2_OBJECT_ENVELOPE_MAX_BODY_BYTES,
   R2_OBJECT_MAX_BYTES,
   R2_OBJECT_PUT_MAX_BODY_BYTES,
+  STORAGE_RESOURCE_NAME_MAX_BODY_BYTES,
   authorizeAccess,
   base64Ceiling,
   listResources,
@@ -15,11 +20,16 @@ import {
   stripAccountWideTokens,
   tooLargeMessage,
   validateMapping
-} from "./chunk-Q6W4U6HL.js";
+} from "./chunk-JXWFVE5X.js";
 import "./chunk-PFF6I7KP.js";
 export {
+  D1_MAX_SQL_STATEMENT_BYTES,
+  D1_QUERY_MAX_BODY_BYTES,
+  JSON_STRING_WORST_CASE_EXPANSION,
+  R2_OBJECT_ENVELOPE_MAX_BODY_BYTES,
   R2_OBJECT_MAX_BYTES,
   R2_OBJECT_PUT_MAX_BODY_BYTES,
+  STORAGE_RESOURCE_NAME_MAX_BODY_BYTES,
   authorizeAccess,
   base64Ceiling,
   listResources,

package/payload/platform/plugins/outlook/mcp/dist/__tests__/pkce-flow.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=pkce-flow.test.d.ts.map

package/payload/platform/plugins/outlook/mcp/dist/__tests__/pkce-flow.test.js

@@ -1,215 +0,0 @@
-import test from "node:test";
-import assert from "node:assert/strict";
-import { _internals, startPkceFlow } from "../auth/pkce-flow.js";
-const { sameLengthEqual } = _internals;
-// ---------------------------------------------------------------------------
-// sameLengthEqual: timing-safe state comparison
-// ---------------------------------------------------------------------------
-test("sameLengthEqual matches identical strings", () => {
-    assert.equal(sameLengthEqual("abcdef0123456789", "abcdef0123456789"), true);
-});
-test("sameLengthEqual rejects different equal-length strings", () => {
-    assert.equal(sameLengthEqual("abcdef0123456789", "abcdef0123456780"), false);
-});
-test("sameLengthEqual rejects length mismatch without throwing", () => {
-    assert.equal(sameLengthEqual("short", "longerstring"), false);
-});
-function mockFetch(handler) {
-    const calls = [];
-    const original = globalThis.fetch;
-    globalThis.fetch = (async (url, init) => {
-        const urlStr = typeof url === "string" ? url : url instanceof URL ? url.toString() : url.url;
-        // Pass loopback callbacks through to the real fetch — only the upstream
-        // token endpoint is intercepted. Otherwise the test's own callback
-        // request would loop back into the mock and never reach the bound server.
-        if (urlStr.startsWith("http://127.0.0.1:") || urlStr.startsWith("http://localhost:")) {
-            return original(url, init);
-        }
-        calls.push({ url: urlStr, init });
-        return handler(urlStr, init);
-    });
-    return {
-        calls,
-        restore: () => {
-            globalThis.fetch = original;
-        },
-    };
-}
-function tokenSuccess() {
-    return new Response(JSON.stringify({
-        access_token: "test-access",
-        refresh_token: "test-refresh",
-        expires_in: 3600,
-        token_type: "Bearer",
-        scope: "offline_access User.Read Mail.ReadWrite Mail.Send Calendars.ReadWrite Contacts.Read",
-    }), { status: 200, headers: { "Content-Type": "application/json" } });
-}
-function extractStateFromAuthUrl(authUrl) {
-    const url = new URL(authUrl);
-    const state = url.searchParams.get("state");
-    assert.ok(state, "auth URL must include state param");
-    return state;
-}
-function extractRedirectUriPort(redirectUri) {
-    const url = new URL(redirectUri);
-    return Number(url.port);
-}
-test("PKCE happy path: state matches → tokens exchanged", async () => {
-    const fetchMock = mockFetch(() => tokenSuccess());
-    try {
-        const flow = await startPkceFlow({
-            clientId: "test-client",
-            tenantId: "common",
-            accountId: "acct-pkce-1",
-        });
-        const state = extractStateFromAuthUrl(flow.authUrl);
-        const port = extractRedirectUriPort(flow.redirectUri);
-        // Drive the callback synthetically, as Microsoft would after consent.
-        const callbackResp = await fetch(`http://127.0.0.1:${port}/callback?code=fake-code&state=${state}`);
-        assert.equal(callbackResp.status, 200);
-        const result = await flow.result;
-        assert.equal(result.tokenResponse.access_token, "test-access");
-        assert.equal(result.tokenResponse.refresh_token, "test-refresh");
-        assert.deepEqual(result.scopes.sort(), [
-            "Calendars.ReadWrite",
-            "Contacts.Read",
-            "Mail.ReadWrite",
-            "Mail.Send",
-            "User.Read",
-            "offline_access",
-        ].sort());
-        // Token endpoint was called with code + verifier + redirect_uri.
-        assert.equal(fetchMock.calls.length, 1);
-        const body = String(fetchMock.calls[0].init?.body ?? "");
-        assert.match(body, /code=fake-code/);
-        assert.match(body, /code_verifier=/);
-        assert.match(body, /grant_type=authorization_code/);
-    }
-    finally {
-        fetchMock.restore();
-    }
-});
-test("PKCE state mismatch → flow rejects, token endpoint NOT called", async () => {
-    const fetchMock = mockFetch(() => {
-        throw new Error("token endpoint should not be called on state mismatch");
-    });
-    try {
-        const flow = await startPkceFlow({
-            clientId: "test-client",
-            tenantId: "common",
-            accountId: "acct-pkce-2",
-        });
-        // Subscribe BEFORE driving the callback — otherwise the rejection lands
-        // before any handler is attached and Node flags it as unhandled.
-        const rejection = assert.rejects(flow.result, /State mismatch/i);
-        const port = extractRedirectUriPort(flow.redirectUri);
-        const cbResp = await fetch(`http://127.0.0.1:${port}/callback?code=fake-code&state=wrong-state-value`);
-        assert.equal(cbResp.status, 400);
-        await rejection;
-        assert.equal(fetchMock.calls.length, 0, "token endpoint must not be called");
-    }
-    finally {
-        fetchMock.restore();
-    }
-});
-test("PKCE OAuth error in callback → flow rejects, no token call", async () => {
-    const fetchMock = mockFetch(() => {
-        throw new Error("token endpoint should not be called on OAuth error");
-    });
-    try {
-        const flow = await startPkceFlow({
-            clientId: "test-client",
-            tenantId: "common",
-            accountId: "acct-pkce-3",
-        });
-        const rejection = assert.rejects(flow.result, /OAuth error: access_denied/);
-        const state = extractStateFromAuthUrl(flow.authUrl);
-        const port = extractRedirectUriPort(flow.redirectUri);
-        const cbResp = await fetch(`http://127.0.0.1:${port}/callback?error=access_denied&error_description=user%20cancelled&state=${state}`);
-        assert.equal(cbResp.status, 400);
-        await rejection;
-        assert.equal(fetchMock.calls.length, 0);
-    }
-    finally {
-        fetchMock.restore();
-    }
-});
-test("PKCE callback missing code → flow rejects", async () => {
-    const fetchMock = mockFetch(() => {
-        throw new Error("token endpoint should not be called");
-    });
-    try {
-        const flow = await startPkceFlow({
-            clientId: "test-client",
-            tenantId: "common",
-            accountId: "acct-pkce-4",
-        });
-        const rejection = assert.rejects(flow.result, /No authorization code received/);
-        const state = extractStateFromAuthUrl(flow.authUrl);
-        const port = extractRedirectUriPort(flow.redirectUri);
-        const cbResp = await fetch(`http://127.0.0.1:${port}/callback?state=${state}`);
-        assert.equal(cbResp.status, 400);
-        await rejection;
-        assert.equal(fetchMock.calls.length, 0);
-    }
-    finally {
-        fetchMock.restore();
-    }
-});
-test("PKCE auth URL has S256 challenge + correct scopes + prompt=select_account", async () => {
-    // No mock needed — we assert URL structure and abort the flow without
-    // exchanging tokens. Sending an OAuth error in the callback closes the
-    // server and rejects flow.result loudly; we catch it explicitly.
-    const flow = await startPkceFlow({
-        clientId: "client-X",
-        tenantId: "common",
-        accountId: "acct-pkce-5",
-    });
-    const expectedRejection = assert.rejects(flow.result, /OAuth error/);
-    try {
-        const url = new URL(flow.authUrl);
-        assert.equal(url.searchParams.get("client_id"), "client-X");
-        assert.equal(url.searchParams.get("response_type"), "code");
-        assert.equal(url.searchParams.get("code_challenge_method"), "S256");
-        assert.equal(url.searchParams.get("prompt"), "select_account");
-        const challenge = url.searchParams.get("code_challenge");
-        assert.ok(challenge && challenge.length > 30, "challenge should be base64url-encoded SHA-256");
-        const scope = url.searchParams.get("scope") ?? "";
-        assert.match(scope, /offline_access/);
-        assert.match(scope, /User\.Read/);
-        assert.match(scope, /Mail\.ReadWrite/);
-        assert.match(scope, /Mail\.Send/);
-        assert.match(scope, /Calendars\.ReadWrite/);
-        assert.match(scope, /Contacts\.Read/);
-        // Abort the flow by sending an OAuth error. Server closes; result rejects.
-        const port = extractRedirectUriPort(flow.redirectUri);
-        const state = url.searchParams.get("state");
-        await fetch(`http://127.0.0.1:${port}/callback?error=access_denied&state=${state}`);
-    }
-    finally {
-        await expectedRejection;
-    }
-});
-test("PKCE redirect URI uses ephemeral loopback port (not fixed 49152)", async () => {
-    // No token-exchange mock — abort each flow with an OAuth error so the
-    // server closes without invoking exchangeCode.
-    const flow1 = await startPkceFlow({ clientId: "c", tenantId: "common", accountId: "a1" });
-    const flow2 = await startPkceFlow({ clientId: "c", tenantId: "common", accountId: "a2" });
-    const r1 = assert.rejects(flow1.result, /OAuth error/);
-    const r2 = assert.rejects(flow2.result, /OAuth error/);
-    try {
-        const port1 = extractRedirectUriPort(flow1.redirectUri);
-        const port2 = extractRedirectUriPort(flow2.redirectUri);
-        assert.ok(port1 > 0 && port1 < 65536);
-        assert.ok(port2 > 0 && port2 < 65536);
-        assert.notEqual(port1, port2, "two parallel flows must allocate different ephemeral ports");
-        const s1 = extractStateFromAuthUrl(flow1.authUrl);
-        const s2 = extractStateFromAuthUrl(flow2.authUrl);
-        await fetch(`http://127.0.0.1:${port1}/callback?error=access_denied&state=${s1}`);
-        await fetch(`http://127.0.0.1:${port2}/callback?error=access_denied&state=${s2}`);
-    }
-    finally {
-        await Promise.all([r1, r2]);
-    }
-});
-//# sourceMappingURL=pkce-flow.test.js.map

package/payload/platform/plugins/outlook/mcp/dist/__tests__/pkce-flow.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"pkce-flow.test.js","sourceRoot":"","sources":["../../src/__tests__/pkce-flow.test.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAEjE,MAAM,EAAE,eAAe,EAAE,GAAG,UAAU,CAAC;AAEvC,8EAA8E;AAC9E,gDAAgD;AAChD,8EAA8E;AAE9E,IAAI,CAAC,2CAA2C,EAAE,GAAG,EAAE;IACrD,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,EAAE,IAAI,CAAC,CAAC;AAC9E,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,wDAAwD,EAAE,GAAG,EAAE;IAClE,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,EAAE,KAAK,CAAC,CAAC;AAC/E,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,0DAA0D,EAAE,GAAG,EAAE;IACpE,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,OAAO,EAAE,cAAc,CAAC,EAAE,KAAK,CAAC,CAAC;AAChE,CAAC,CAAC,CAAC;AAiBH,SAAS,SAAS,CAAC,OAA0E;IAI3F,MAAM,KAAK,GAAwB,EAAE,CAAC;IACtC,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC;IAClC,UAAU,CAAC,KAAK,GAAG,CAAC,KAAK,EAAE,GAA2B,EAAE,IAAkB,EAAE,EAAE;QAC5E,MAAM,MAAM,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,YAAY,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;QAC7F,wEAAwE;QACxE,mEAAmE;QACnE,0EAA0E;QAC1E,IAAI,MAAM,CAAC,UAAU,CAAC,mBAAmB,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;YACrF,OAAO,QAAQ,CAAC,GAAqC,EAAE,IAAI,CAAC,CAAC;QAC/D,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAClC,OAAO,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC/B,CAAC,CAAiB,CAAC;IACnB,OAAO;QACL,KAAK;QACL,OAAO,EAAE,GAAG,EAAE;YACZ,UAAU,CAAC,KAAK,GAAG,QAAQ,CAAC;QAC9B,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,YAAY;IACnB,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC;QACb,YAAY,EAAE,aAAa;QAC3B,aAAa,EAAE,cAAc;QAC7B,UAAU,EAAE,IAAI;QAChB,UAAU,EAAE,QAAQ;QACpB,KAAK,EAAE,qFAAqF;KAC7F,CAAC,EACF,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAAC,OAAe;IAC9C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IAC7B,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,mCAAmC,CAAC,CAAC;IACtD,OAAO,KAAM,CAAC;AAChB,CAAC;AAED,SAAS,sBAAsB,CAAC,WAAmB;IACjD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IACjC,OAAO,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,IAAI,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;IACnE,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,EAAE,CAAC,YAAY,EAAE,CAAC,CAAC;IAClD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC;YAC/B,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,QAAQ;YAClB,SAAS,EAAE,aAAa;SACzB,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,uBAAuB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACpD,MAAM,IAAI,GAAG,sBAAsB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAEtD,sEAAsE;QACtE,MAAM,YAAY,GAAG,MAAM,KAAK,CAC9B,oBAAoB,IAAI,kCAAkC,KAAK,EAAE,CAClE,CAAC;QACF,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAEvC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC;QACjC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;QAC/D,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;QACjE,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE;YACrC,qBAAqB;YACrB,eAAe;YACf,gBAAgB;YAChB,WAAW;YACX,WAAW;YACX,gBAAgB;SACjB,CAAC,IAAI,EAAE,CAAC,CAAC;QAEV,iEAAiE;QACjE,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACxC,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;QACzD,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;QACrC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;QACrC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,+BAA+B,CAAC,CAAC;IACtD,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,OAAO,EAAE,CAAC;IACtB,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;IAC/E,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,EAAE;QAC/B,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC;YAC/B,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,QAAQ;YAClB,SAAS,EAAE,aAAa;SACzB,CAAC,CAAC;QACH,wEAAwE;QACxE,iEAAiE;QACjE,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;QACjE,MAAM,IAAI,GAAG,sBAAsB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACtD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,oBAAoB,IAAI,kDAAkD,CAAC,CAAC;QACvG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACjC,MAAM,SAAS,CAAC;QAChB,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,mCAAmC,CAAC,CAAC;IAC/E,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,OAAO,EAAE,CAAC;IACtB,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,4DAA4D,EAAE,KAAK,IAAI,EAAE;IAC5E,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,EAAE;QAC/B,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC;YAC/B,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,QAAQ;YAClB,SAAS,EAAE,aAAa;SACzB,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,4BAA4B,CAAC,CAAC;QAC5E,MAAM,KAAK,GAAG,uBAAuB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACpD,MAAM,IAAI,GAAG,sBAAsB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACtD,MAAM,MAAM,GAAG,MAAM,KAAK,CACxB,oBAAoB,IAAI,0EAA0E,KAAK,EAAE,CAC1G,CAAC;QACF,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACjC,MAAM,SAAS,CAAC;QAChB,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC1C,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,OAAO,EAAE,CAAC;IACtB,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;IAC3D,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,EAAE;QAC/B,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC;YAC/B,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,QAAQ;YAClB,SAAS,EAAE,aAAa;SACzB,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,gCAAgC,CAAC,CAAC;QAChF,MAAM,KAAK,GAAG,uBAAuB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACpD,MAAM,IAAI,GAAG,sBAAsB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACtD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,oBAAoB,IAAI,mBAAmB,KAAK,EAAE,CAAC,CAAC;QAC/E,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACjC,MAAM,SAAS,CAAC;QAChB,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC1C,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,OAAO,EAAE,CAAC;IACtB,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,2EAA2E,EAAE,KAAK,IAAI,EAAE;IAC3F,sEAAsE;IACtE,uEAAuE;IACvE,iEAAiE;IACjE,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC;QAC/B,QAAQ,EAAE,UAAU;QACpB,QAAQ,EAAE,QAAQ;QAClB,SAAS,EAAE,aAAa;KACzB,CAAC,CAAC;IACH,MAAM,iBAAiB,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACrE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,UAAU,CAAC,CAAC;QAC5D,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC,CAAC;QAC5D,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,CAAC,EAAE,MAAM,CAAC,CAAC;QACpE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,gBAAgB,CAAC,CAAC;QAC/D,MAAM,SAAS,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QACzD,MAAM,CAAC,EAAE,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,EAAE,EAAE,+CAA+C,CAAC,CAAC;QAC/F,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAClD,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;QACtC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;QAClC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;QACvC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;QAClC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,sBAAsB,CAAC,CAAC;QAC5C,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;QAEtC,2EAA2E;QAC3E,MAAM,IAAI,GAAG,sBAAsB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACtD,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAE,CAAC;QAC7C,MAAM,KAAK,CAAC,oBAAoB,IAAI,uCAAuC,KAAK,EAAE,CAAC,CAAC;IACtF,CAAC;YAAS,CAAC;QACT,MAAM,iBAAiB,CAAC;IAC1B,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;IAClF,sEAAsE;IACtE,+CAA+C;IAC/C,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1F,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1F,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACvD,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACvD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,sBAAsB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACxD,MAAM,KAAK,GAAG,sBAAsB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACxD,MAAM,CAAC,EAAE,CAAC,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,KAAK,CAAC,CAAC;QACtC,MAAM,CAAC,EAAE,CAAC,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,KAAK,CAAC,CAAC;QACtC,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,EAAE,4DAA4D,CAAC,CAAC;QAE5F,MAAM,EAAE,GAAG,uBAAuB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,EAAE,GAAG,uBAAuB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,KAAK,CAAC,oBAAoB,KAAK,uCAAuC,EAAE,EAAE,CAAC,CAAC;QAClF,MAAM,KAAK,CAAC,oBAAoB,KAAK,uCAAuC,EAAE,EAAE,CAAC,CAAC;IACpF,CAAC;YAAS,CAAC;QACT,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IAC9B,CAAC;AACH,CAAC,CAAC,CAAC"}