@rubytech/create-maxy-code 0.1.478 → 0.1.480

package/payload/platform/plugins/outlook/mcp/dist/lib/graph-client.js

@@ -10,7 +10,7 @@
  * Aligns with `feedback_no_stdout_parsing_for_control_flow.md`.
  */
 import { Client, ResponseType } from "@microsoft/microsoft-graph-client";
-import { refreshAccessToken } from "../auth/device-flow.js";
+import { refreshAccessToken, TokenRefreshError } from "../auth/device-flow.js";
 import { log } from "./log.js";
 /** Pull (statusCode, code, headers) from whatever shape the SDK threw. */
 function normalizeGraphError(err) {
@@ -123,6 +123,10 @@ export function createGraphClient(config) {
         },
     });
 }
+/** How long a process waits for a peer's in-flight refresh before giving up.
+ * Bounded because the caller is a live tool call, not a background job. */
+const REFRESH_LOCK_WAIT_MS = 10 * 1000;
+const REFRESH_LOCK_POLL_MS = 100;
 /**
  * Return a usable access token, refreshing via the stored refresh token when
  * needed. With `forceRefresh`, skip the local `needsRefresh()` fast-path and
@@ -143,31 +147,130 @@ export async function getOrRefreshAccessToken(config, forceRefresh = false) {
     if (!forceRefresh && !tokenStore.needsRefresh()) {
         return blob.accessToken;
     }
-    const oldExpSec = Math.floor(blob.accessTokenExpiry / 1000);
+    // One refresh per mailbox at a time, across processes. Two winners would each
+    // receive their own token pair from Microsoft and the later write would
+    // silently displace the earlier one.
+    if (!tokenStore.tryAcquireRefreshLock()) {
+        log({ event: "token-refresh-deferred", account: accountId });
+        return waitForPeerRefresh(config, blob.accessToken, REFRESH_LOCK_WAIT_MS, REFRESH_LOCK_POLL_MS);
+    }
+    // The outer try exists only to release the lock. Terminal guards below sit in
+    // it but OUTSIDE the inner catch on purpose: handleRefreshFailure classifies
+    // refresh failures, and routing an auth-required guard through it would
+    // relabel a mailbox that needs re-registering as "retry shortly".
     try {
-        const refreshed = await refreshAccessToken({
-            clientId,
-            tenantId,
-            refreshToken: blob.refreshToken,
-        });
-        const updated = tokenStore.store(refreshed.access_token, refreshed.refresh_token ?? blob.refreshToken, refreshed.expires_in, { graphUserId: blob.graphUserId, mail: blob.mail, scopes: blob.scopes });
-        log({
-            event: "token-refreshed",
-            account: accountId,
-            oldExpSec,
-            newExpSec: Math.floor(updated.accessTokenExpiry / 1000),
-        });
-        return updated.accessToken;
+        // A peer may have refreshed between our needsRefresh() check above and our
+        // acquire just now. Re-read before spending a network call, so we neither
+        // refresh redundantly nor send a refresh token that peer has superseded.
+        const current = tokenStore.reload() ?? blob;
+        if (!current.refreshToken) {
+            throw new Error(`auth-required: Outlook refresh token expired for account=${accountId}; run outlook-account-register.`);
+        }
+        if (!forceRefresh && !tokenStore.needsRefresh()) {
+            log({ event: "token-refresh-superseded", account: accountId });
+            return current.accessToken;
+        }
+        const oldExpSec = Math.floor(current.accessTokenExpiry / 1000);
+        try {
+            const refreshed = await refreshAccessToken({
+                clientId,
+                tenantId,
+                refreshToken: current.refreshToken,
+            });
+            const updated = tokenStore.store(refreshed.access_token, refreshed.refresh_token ?? current.refreshToken, refreshed.expires_in, { graphUserId: current.graphUserId, mail: current.mail, scopes: current.scopes });
+            log({
+                event: "token-refreshed",
+                account: accountId,
+                oldExpSec,
+                newExpSec: Math.floor(updated.accessTokenExpiry / 1000),
+            });
+            return updated.accessToken;
+        }
+        catch (err) {
+            throw handleRefreshFailure(err, tokenStore, accountId);
+        }
+    }
+    finally {
+        tokenStore.releaseRefreshLock();
     }
-    catch (err) {
+}
+/** The one retryable-refresh error. Single source so the three sites that
+ * surface it cannot drift apart. */
+function retryableRefreshError(accountId) {
+    return new Error(`Outlook token refresh temporarily unavailable for account=${accountId}; credentials kept, retry shortly.`);
+}
+/**
+ * Wait for the peer holding the refresh lock to publish a new access token.
+ *
+ * Keys on the access token *changing*, not on `needsRefresh()` going false.
+ * Under `forceRefresh` — the 401 retry after a server-side revocation — the
+ * stored token is locally un-expired, so a freshness check would hand back the
+ * very token Graph just rejected. Task 1480 exists because that short-circuit
+ * burned the 401 retry once already.
+ *
+ * Never refreshes on its own. Issuing a second refresh is the exact race the
+ * lock exists to remove.
+ */
+async function waitForPeerRefresh(config, previousAccessToken, waitMs, pollMs) {
+    const { tokenStore, accountId } = config;
+    const deadline = Date.now() + waitMs;
+    while (Date.now() < deadline) {
+        await new Promise((resolve) => setTimeout(resolve, pollMs));
+        const fresh = tokenStore.reload();
+        if (fresh && fresh.accessToken !== previousAccessToken) {
+            log({ event: "token-refresh-peer-observed", account: accountId });
+            return fresh.accessToken;
+        }
+        if (!tokenStore.refreshLockHeld()) {
+            // The lock is free. Re-read once more before calling it a failure: the
+            // peer can store its token and release in the gap between the reload
+            // above and this check, and reporting "unavailable" while a valid fresh
+            // token sits on disk would fail the caller for no reason.
+            const settled = tokenStore.reload();
+            if (settled && settled.accessToken !== previousAccessToken) {
+                log({ event: "token-refresh-peer-observed", account: accountId });
+                return settled.accessToken;
+            }
+            log({ event: "token-refresh-peer-failed", account: accountId });
+            throw retryableRefreshError(accountId);
+        }
+    }
+    log({ event: "token-refresh-peer-timeout", account: accountId, waitMs });
+    throw retryableRefreshError(accountId);
+}
+/**
+ * Decide whether a failed refresh means the credentials are dead or merely that
+ * this attempt did not land, and return the error to throw.
+ *
+ * Only `invalid_grant` — a refresh token that is revoked, expired, or already
+ * consumed — clears the store. Every other failure (network down, Microsoft
+ * 5xx, a local write error) leaves the tokens alone. Clearing on all of them
+ * was destroying healthy mailboxes over transient faults and forcing an
+ * operator to re-register a mailbox that was fine a moment earlier.
+ */
+function handleRefreshFailure(err, tokenStore, accountId) {
+    const azure = err instanceof TokenRefreshError ? err.azure : null;
+    if (azure && azure.error === "invalid_grant") {
         log({
-            event: "token-refresh-failed",
+            event: "token-refresh-revoked",
             account: accountId,
+            oauthError: azure.error,
+            suberror: azure.suberror,
+            aadsts: azure.aadsts,
+            correlationId: azure.correlationId,
             reason: err.message,
         });
         tokenStore.clear();
-        throw new Error(`Outlook token refresh failed for account=${accountId}; re-auth required.`);
+        return new Error(`Outlook token refresh failed for account=${accountId}; re-auth required.`);
     }
+    log({
+        event: "token-refresh-retryable",
+        account: accountId,
+        oauthError: azure?.error ?? null,
+        httpStatus: azure?.httpStatus ?? null,
+        reason: err.message,
+    });
+    return retryableRefreshError(accountId);
 }
 /**
  * Run a Graph call with classification, single retry on `auth` (refresh +
@@ -320,4 +423,6 @@ export async function patchGraph(config, path, body, opts = { tool: "graph" }) {
 export async function deleteGraph(config, path, opts = { tool: "graph" }) {
     return writeGraph(config, "delete", path, undefined, opts);
 }
+/** Exported for tests only. */
+export const _internals = { waitForPeerRefresh };
 //# sourceMappingURL=graph-client.js.map

package/payload/platform/plugins/outlook/mcp/dist/lib/graph-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"graph-client.js","sourceRoot":"","sources":["../../src/lib/graph-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAE5D,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAwC/B,0EAA0E;AAC1E,SAAS,mBAAmB,CAAC,GAAY;IACvC,MAAM,CAAC,GAAG,GAOT,CAAC;IAEF,MAAM,UAAU,GAAG,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC;IAEjD,IAAI,IAAI,GAAG,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;IACxB,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACxC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAkC,CAAC;YACnE,IAAI,GAAG,MAAM,CAAC,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,qCAAqC;QACvC,CAAC;IACH,CAAC;SAAM,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACzD,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC;IAClC,CAAC;IAED,IAAI,gBAAgB,GAAkB,IAAI,CAAC;IAC3C,IAAI,gBAAgB,GAAkB,IAAI,CAAC;IAC3C,MAAM,YAAY,GAAG,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC;IACzC,IAAI,YAAY,IAAI,OAAO,YAAY,CAAC,GAAG,KAAK,UAAU,EAAE,CAAC;QAC3D,gBAAgB,GAAG,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC;QAC3D,gBAAgB,GAAG,YAAY,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,IAAI,CAAC;IAClE,CAAC;SAAM,IAAI,CAAC,CAAC,OAAO,YAAY,GAAG,EAAE,CAAC;QACpC,gBAAgB,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC;QACxF,gBAAgB,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,IAAI,CAAC;IAC/D,CAAC;SAAM,IAAI,CAAC,CAAC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QACtD,MAAM,CAAC,GAAG,CAAC,CAAC,OAAiC,CAAC;QAC9C,gBAAgB;YACd,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC;QACnE,gBAAgB,GAAG,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,iBAAiB,CAAC,IAAI,IAAI,CAAC;IAC3E,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,GAAY;IAC7C,MAAM,IAAI,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,GAAG,IAAI,CAAC;IAEtE,IAAI,UAAU,KAAK,GAAG,EAAE,CAAC;QACvB,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,IAAI,iBAAiB,EAAE,CAAC;IACvE,CAAC;IACD,IAAI,UAAU,KAAK,GAAG,EAAE,CAAC;QACvB,IAAI,gBAAgB,EAAE,CAAC;YACrB,MAAM,OAAO,GAAG,MAAM,CAAC,gBAAgB,CAAC,CAAC;YACzC,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC;gBAC7C,OAAO;oBACL,IAAI,EAAE,wBAAwB;oBAC9B,UAAU;oBACV,YAAY,EAAE,OAAO,GAAG,IAAI;iBAC7B,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,qBAAqB,EAAE,UAAU,EAAE,CAAC;IACrD,CAAC;IACD,IAAI,UAAU,KAAK,GAAG,IAAI,IAAI,KAAK,6BAA6B,EAAE,CAAC;QACjE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,gBAAgB,IAAI,SAAS,EAAE,CAAC;IACpF,CAAC;IACD,IAAI,UAAU,KAAK,GAAG,EAAE,CAAC;QACvB,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,IAAI,mBAAmB,EAAE,CAAC;IACvF,CAAC;IACD,IAAI,UAAU,IAAI,GAAG,IAAI,UAAU,GAAG,GAAG,EAAE,CAAC;QAC1C,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,IAAI,aAAa,EAAE,CAAC;IAClE,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,IAAI,SAAS,EAAE,CAAC;AAChE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,sBAAsB,CAAC;AAE1D;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAyB;IACzD,OAAO,MAAM,CAAC,IAAI,CAAC;QACjB,sEAAsE;QACtE,4EAA4E;QAC5E,6EAA6E;QAC7E,YAAY,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,mBAAmB,EAAE,EAAE;QAC1D,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YAC3B,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,uBAAuB,CAAC,MAAM,CAAC,CAAC;gBACpD,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACpB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,GAAY,EAAE,IAAI,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,MAAyB,EACzB,YAAY,GAAG,KAAK;IAEpB,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC;IAC7D,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC;IAC/B,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CACb,oDAAoD,SAAS,iCAAiC,CAC/F,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,CAAC,mBAAmB,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CACb,4DAA4D,SAAS,iCAAiC,CACvG,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,YAAY,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,EAAE,CAAC;QAChD,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAC;IAC5D,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC;YACzC,QAAQ;YACR,QAAQ;YACR,YAAY,EAAE,IAAI,CAAC,YAAY;SAChC,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAC9B,SAAS,CAAC,YAAY,EACtB,SAAS,CAAC,aAAa,IAAI,IAAI,CAAC,YAAY,EAC5C,SAAS,CAAC,UAAU,EACpB,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CACxE,CAAC;QACF,GAAG,CAAC;YACF,KAAK,EAAE,iBAAiB;YACxB,OAAO,EAAE,SAAS;YAClB,SAAS;YACT,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;SACxD,CAAC,CAAC;QACH,OAAO,OAAO,CAAC,WAAW,CAAC;IAC7B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC;YACF,KAAK,EAAE,sBAAsB;YAC7B,OAAO,EAAE,SAAS;YAClB,MAAM,EAAG,GAAa,CAAC,OAAO;SAC/B,CAAC,CAAC;QACH,UAAU,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CACb,4CAA4C,SAAS,qBAAqB,CAC3E,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,MAAyB,EACzB,MAAsC,EACtC,OAAsB,EAAE,IAAI,EAAE,OAAO,EAAE;IAEvC,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,6EAA6E;IAC7E,OAAO,IAAI,EAAE,CAAC;QACZ,QAAQ,IAAI,CAAC,CAAC;QACd,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC;YACH,OAAO,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC;QAC9B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;YACpC,GAAG,CAAC;gBACF,KAAK,EAAE,aAAa;gBACpB,OAAO,EAAE,MAAM,CAAC,SAAS;gBACzB,MAAM,EAAE,GAAG,CAAC,UAAU;gBACtB,IAAI,EAAE,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;gBACnC,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,EAAE;gBACzB,YAAY,EAAE,GAAG,CAAC,IAAI,KAAK,wBAAwB,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI;aAC9E,CAAC,CAAC;YACH,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC3B,GAAG,CAAC;oBACF,KAAK,EAAE,kBAAkB;oBACzB,OAAO,EAAE,MAAM,CAAC,SAAS;oBACzB,UAAU,EAAE,GAAG,CAAC,UAAU,IAAI,SAAS;iBACxC,CAAC,CAAC;gBACH,MAAM,IAAI,KAAK,CACb,kEAAkE,CACnE,CAAC;YACJ,CAAC;YACD,IAAI,GAAG,CAAC,IAAI,KAAK,qBAAqB,EAAE,CAAC;gBACvC,MAAM,IAAI,KAAK,CACb,0DAA0D,MAAM,CAAC,SAAS,UAAU,IAAI,CAAC,IAAI,IAAI,CAClG,CAAC;YACJ,CAAC;YACD,IAAI,GAAG,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;gBACtC,kEAAkE;gBAClE,kEAAkE;gBAClE,kEAAkE;gBAClE,uEAAuE;gBACvE,kBAAkB;gBAClB,MAAM,OAAO,GACX,IAAI,CAAC,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY;oBACrD,CAAC,CAAC,WAAW;oBACb,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,OAAO;wBACrB,CAAC,CAAC,gBAAgB;wBAClB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;4BACjC,CAAC,CAAC,qBAAqB;4BACvB,CAAC,CAAC,IAAI,CAAC;gBACf,GAAG,CAAC;oBACF,KAAK,EAAE,oBAAoB;oBAC3B,OAAO,EAAE,MAAM,CAAC,SAAS;oBACzB,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,OAAO,EAAE,OAAO,IAAI,SAAS;iBAC9B,CAAC,CAAC;gBACH,IAAI,OAAO,EAAE,CAAC;oBACZ,MAAM,IAAI,KAAK,CACb,WAAW,OAAO,kCAAkC,MAAM,CAAC,SAAS,UAAU,IAAI,CAAC,IAAI,yDAAyD,OAAO,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,SAAS,CACzM,CAAC;gBACJ,CAAC;gBACD,MAAM,IAAI,KAAK,CACb,2CAA2C,MAAM,CAAC,SAAS,UAAU,IAAI,CAAC,IAAI,uFAAuF,CACtK,CAAC;YACJ,CAAC;YACD,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;gBAC1C,mEAAmE;gBACnE,iEAAiE;gBACjE,oEAAoE;gBACpE,wEAAwE;gBACxE,MAAM,uBAAuB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;gBAC5C,SAAS;YACX,CAAC;YACD,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBACxB,MAAM,IAAI,KAAK,CACb,oCAAoC,MAAM,CAAC,SAAS,iCAAiC,CACtF,CAAC;YACJ,CAAC;YACD,IAAI,GAAG,CAAC,IAAI,KAAK,wBAAwB,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;gBAC5D,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC;gBACtE,SAAS;YACX,CAAC;YACD,IAAI,GAAG,CAAC,IAAI,KAAK,KAAK,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;gBACzC,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;gBACzD,SAAS;YACX,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;AACH,CAAC;AASD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,MAAyB,EACzB,YAA6D,EAC7D,OAAsB,EAAE,IAAI,EAAE,OAAO,EAAE;IAEvC,OAAO,SAAS,CACd,MAAM,EACN,KAAK,EAAE,MAAM,EAAE,EAAE;QACf,MAAM,GAAG,GAAG,CAAC,MAAM,YAAY,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAG5C,CAAC;QACF,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,IAAI,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,iBAAiB,CAAC,IAAI,IAAI,EAAE,CAAC;IAC9E,CAAC,EACD,IAAI,CACL,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,KAAK,UAAU,UAAU,CACvB,MAAyB,EACzB,MAAmC,EACnC,IAAY,EACZ,IAAwB,EACxB,IAAmB;IAEnB,OAAO,SAAS,CACd,MAAM,EACN,KAAK,EAAE,MAAM,EAAE,EAAE;QACf,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QAC5D,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,QAAQ;YACrC,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE;YACd,CAAC,CAAC,MAAM,KAAK,OAAO;gBAClB,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;gBACjB,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAa,CAAC;QACnC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAC9C,wEAAwE;YACxE,uEAAuE;YACvE,mEAAmE;YACnE,MAAM,GAAG,GAAG,IAAI,KAAK,CACnB,SAAS,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,IAAI,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,kBAAkB,EAAE,CACF,CAAC;YAClF,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC;YAC5B,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;YAChB,GAAG,CAAC,QAAQ,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;YACxC,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,IAAI,IAAI,GAAY,IAAI,CAAC;QACzB,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC7C,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;IACtC,CAAC;IACD,0EAA0E;IAC1E,4CAA4C;IAC5C,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI,EAAE,CACjD,CAAC;AACJ,CAAC;AAED,uCAAuC;AACvC,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,MAAyB,EACzB,IAAY,EACZ,IAAwB,EACxB,OAAsB,EAAE,IAAI,EAAE,OAAO,EAAE;IAEvC,OAAO,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AACtD,CAAC;AAED,wCAAwC;AACxC,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,MAAyB,EACzB,IAAY,EACZ,IAAwB,EACxB,OAAsB,EAAE,IAAI,EAAE,OAAO,EAAE;IAEvC,OAAO,UAAU,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AACvD,CAAC;AAED,yCAAyC;AACzC,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,MAAyB,EACzB,IAAY,EACZ,OAAsB,EAAE,IAAI,EAAE,OAAO,EAAE;IAEvC,OAAO,UAAU,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;AAC7D,CAAC"}
+{"version":3,"file":"graph-client.js","sourceRoot":"","sources":["../../src/lib/graph-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAE/E,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAwC/B,0EAA0E;AAC1E,SAAS,mBAAmB,CAAC,GAAY;IACvC,MAAM,CAAC,GAAG,GAOT,CAAC;IAEF,MAAM,UAAU,GAAG,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC;IAEjD,IAAI,IAAI,GAAG,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;IACxB,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACxC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAkC,CAAC;YACnE,IAAI,GAAG,MAAM,CAAC,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,qCAAqC;QACvC,CAAC;IACH,CAAC;SAAM,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACzD,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC;IAClC,CAAC;IAED,IAAI,gBAAgB,GAAkB,IAAI,CAAC;IAC3C,IAAI,gBAAgB,GAAkB,IAAI,CAAC;IAC3C,MAAM,YAAY,GAAG,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC;IACzC,IAAI,YAAY,IAAI,OAAO,YAAY,CAAC,GAAG,KAAK,UAAU,EAAE,CAAC;QAC3D,gBAAgB,GAAG,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC;QAC3D,gBAAgB,GAAG,YAAY,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,IAAI,CAAC;IAClE,CAAC;SAAM,IAAI,CAAC,CAAC,OAAO,YAAY,GAAG,EAAE,CAAC;QACpC,gBAAgB,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC;QACxF,gBAAgB,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,IAAI,CAAC;IAC/D,CAAC;SAAM,IAAI,CAAC,CAAC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QACtD,MAAM,CAAC,GAAG,CAAC,CAAC,OAAiC,CAAC;QAC9C,gBAAgB;YACd,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC;QACnE,gBAAgB,GAAG,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,iBAAiB,CAAC,IAAI,IAAI,CAAC;IAC3E,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,GAAY;IAC7C,MAAM,IAAI,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,GAAG,IAAI,CAAC;IAEtE,IAAI,UAAU,KAAK,GAAG,EAAE,CAAC;QACvB,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,IAAI,iBAAiB,EAAE,CAAC;IACvE,CAAC;IACD,IAAI,UAAU,KAAK,GAAG,EAAE,CAAC;QACvB,IAAI,gBAAgB,EAAE,CAAC;YACrB,MAAM,OAAO,GAAG,MAAM,CAAC,gBAAgB,CAAC,CAAC;YACzC,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC;gBAC7C,OAAO;oBACL,IAAI,EAAE,wBAAwB;oBAC9B,UAAU;oBACV,YAAY,EAAE,OAAO,GAAG,IAAI;iBAC7B,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,qBAAqB,EAAE,UAAU,EAAE,CAAC;IACrD,CAAC;IACD,IAAI,UAAU,KAAK,GAAG,IAAI,IAAI,KAAK,6BAA6B,EAAE,CAAC;QACjE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,gBAAgB,IAAI,SAAS,EAAE,CAAC;IACpF,CAAC;IACD,IAAI,UAAU,KAAK,GAAG,EAAE,CAAC;QACvB,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,IAAI,mBAAmB,EAAE,CAAC;IACvF,CAAC;IACD,IAAI,UAAU,IAAI,GAAG,IAAI,UAAU,GAAG,GAAG,EAAE,CAAC;QAC1C,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,IAAI,aAAa,EAAE,CAAC;IAClE,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,IAAI,SAAS,EAAE,CAAC;AAChE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,sBAAsB,CAAC;AAE1D;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAyB;IACzD,OAAO,MAAM,CAAC,IAAI,CAAC;QACjB,sEAAsE;QACtE,4EAA4E;QAC5E,6EAA6E;QAC7E,YAAY,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,mBAAmB,EAAE,EAAE;QAC1D,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YAC3B,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,uBAAuB,CAAC,MAAM,CAAC,CAAC;gBACpD,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACpB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,GAAY,EAAE,IAAI,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED;2EAC2E;AAC3E,MAAM,oBAAoB,GAAG,EAAE,GAAG,IAAI,CAAC;AACvC,MAAM,oBAAoB,GAAG,GAAG,CAAC;AAEjC;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,MAAyB,EACzB,YAAY,GAAG,KAAK;IAEpB,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC;IAC7D,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC;IAC/B,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CACb,oDAAoD,SAAS,iCAAiC,CAC/F,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,CAAC,mBAAmB,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CACb,4DAA4D,SAAS,iCAAiC,CACvG,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,YAAY,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,EAAE,CAAC;QAChD,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED,8EAA8E;IAC9E,wEAAwE;IACxE,qCAAqC;IACrC,IAAI,CAAC,UAAU,CAAC,qBAAqB,EAAE,EAAE,CAAC;QACxC,GAAG,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;QAC7D,OAAO,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,oBAAoB,EAAE,oBAAoB,CAAC,CAAC;IAClG,CAAC;IAED,8EAA8E;IAC9E,6EAA6E;IAC7E,wEAAwE;IACxE,kEAAkE;IAClE,IAAI,CAAC;QACH,2EAA2E;QAC3E,0EAA0E;QAC1E,yEAAyE;QACzE,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC;QAC5C,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CACb,4DAA4D,SAAS,iCAAiC,CACvG,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,YAAY,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,EAAE,CAAC;YAChD,GAAG,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;YAC/D,OAAO,OAAO,CAAC,WAAW,CAAC;QAC7B,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAC;QAC/D,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC;gBACzC,QAAQ;gBACR,QAAQ;gBACR,YAAY,EAAE,OAAO,CAAC,YAAY;aACnC,CAAC,CAAC;YACH,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAC9B,SAAS,CAAC,YAAY,EACtB,SAAS,CAAC,aAAa,IAAI,OAAO,CAAC,YAAY,EAC/C,SAAS,CAAC,UAAU,EACpB,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CACjF,CAAC;YACF,GAAG,CAAC;gBACF,KAAK,EAAE,iBAAiB;gBACxB,OAAO,EAAE,SAAS;gBAClB,SAAS;gBACT,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;aACxD,CAAC,CAAC;YACH,OAAO,OAAO,CAAC,WAAW,CAAC;QAC7B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,oBAAoB,CAAC,GAAG,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;YAAS,CAAC;QACT,UAAU,CAAC,kBAAkB,EAAE,CAAC;IAClC,CAAC;AACH,CAAC;AAED;oCACoC;AACpC,SAAS,qBAAqB,CAAC,SAAiB;IAC9C,OAAO,IAAI,KAAK,CACd,6DAA6D,SAAS,oCAAoC,CAC3G,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,KAAK,UAAU,kBAAkB,CAC/B,MAAyB,EACzB,mBAA2B,EAC3B,MAAc,EACd,MAAc;IAEd,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC;IACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC;IACrC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;QAC5D,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC;QAClC,IAAI,KAAK,IAAI,KAAK,CAAC,WAAW,KAAK,mBAAmB,EAAE,CAAC;YACvD,GAAG,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;YAClE,OAAO,KAAK,CAAC,WAAW,CAAC;QAC3B,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,eAAe,EAAE,EAAE,CAAC;YAClC,uEAAuE;YACvE,qEAAqE;YACrE,wEAAwE;YACxE,0DAA0D;YAC1D,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC;YACpC,IAAI,OAAO,IAAI,OAAO,CAAC,WAAW,KAAK,mBAAmB,EAAE,CAAC;gBAC3D,GAAG,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;gBAClE,OAAO,OAAO,CAAC,WAAW,CAAC;YAC7B,CAAC;YACD,GAAG,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;YAChE,MAAM,qBAAqB,CAAC,SAAS,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IACD,GAAG,CAAC,EAAE,KAAK,EAAE,4BAA4B,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;IACzE,MAAM,qBAAqB,CAAC,SAAS,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,oBAAoB,CAAC,GAAY,EAAE,UAAsB,EAAE,SAAiB;IACnF,MAAM,KAAK,GAAG,GAAG,YAAY,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IAClE,IAAI,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,eAAe,EAAE,CAAC;QAC7C,GAAG,CAAC;YACF,KAAK,EAAE,uBAAuB;YAC9B,OAAO,EAAE,SAAS;YAClB,UAAU,EAAE,KAAK,CAAC,KAAK;YACvB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,MAAM,EAAG,GAAa,CAAC,OAAO;SAC/B,CAAC,CAAC;QACH,UAAU,CAAC,KAAK,EAAE,CAAC;QACnB,OAAO,IAAI,KAAK,CACd,4CAA4C,SAAS,qBAAqB,CAC3E,CAAC;IACJ,CAAC;IACD,GAAG,CAAC;QACF,KAAK,EAAE,yBAAyB;QAChC,OAAO,EAAE,SAAS;QAClB,UAAU,EAAE,KAAK,EAAE,KAAK,IAAI,IAAI;QAChC,UAAU,EAAE,KAAK,EAAE,UAAU,IAAI,IAAI;QACrC,MAAM,EAAG,GAAa,CAAC,OAAO;KAC/B,CAAC,CAAC;IACH,OAAO,qBAAqB,CAAC,SAAS,CAAC,CAAC;AAC1C,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,MAAyB,EACzB,MAAsC,EACtC,OAAsB,EAAE,IAAI,EAAE,OAAO,EAAE;IAEvC,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,6EAA6E;IAC7E,OAAO,IAAI,EAAE,CAAC;QACZ,QAAQ,IAAI,CAAC,CAAC;QACd,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC;YACH,OAAO,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC;QAC9B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;YACpC,GAAG,CAAC;gBACF,KAAK,EAAE,aAAa;gBACpB,OAAO,EAAE,MAAM,CAAC,SAAS;gBACzB,MAAM,EAAE,GAAG,CAAC,UAAU;gBACtB,IAAI,EAAE,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;gBACnC,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,EAAE;gBACzB,YAAY,EAAE,GAAG,CAAC,IAAI,KAAK,wBAAwB,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI;aAC9E,CAAC,CAAC;YACH,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC3B,GAAG,CAAC;oBACF,KAAK,EAAE,kBAAkB;oBACzB,OAAO,EAAE,MAAM,CAAC,SAAS;oBACzB,UAAU,EAAE,GAAG,CAAC,UAAU,IAAI,SAAS;iBACxC,CAAC,CAAC;gBACH,MAAM,IAAI,KAAK,CACb,kEAAkE,CACnE,CAAC;YACJ,CAAC;YACD,IAAI,GAAG,CAAC,IAAI,KAAK,qBAAqB,EAAE,CAAC;gBACvC,MAAM,IAAI,KAAK,CACb,0DAA0D,MAAM,CAAC,SAAS,UAAU,IAAI,CAAC,IAAI,IAAI,CAClG,CAAC;YACJ,CAAC;YACD,IAAI,GAAG,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;gBACtC,kEAAkE;gBAClE,kEAAkE;gBAClE,kEAAkE;gBAClE,uEAAuE;gBACvE,kBAAkB;gBAClB,MAAM,OAAO,GACX,IAAI,CAAC,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY;oBACrD,CAAC,CAAC,WAAW;oBACb,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,OAAO;wBACrB,CAAC,CAAC,gBAAgB;wBAClB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;4BACjC,CAAC,CAAC,qBAAqB;4BACvB,CAAC,CAAC,IAAI,CAAC;gBACf,GAAG,CAAC;oBACF,KAAK,EAAE,oBAAoB;oBAC3B,OAAO,EAAE,MAAM,CAAC,SAAS;oBACzB,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,OAAO,EAAE,OAAO,IAAI,SAAS;iBAC9B,CAAC,CAAC;gBACH,IAAI,OAAO,EAAE,CAAC;oBACZ,MAAM,IAAI,KAAK,CACb,WAAW,OAAO,kCAAkC,MAAM,CAAC,SAAS,UAAU,IAAI,CAAC,IAAI,yDAAyD,OAAO,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,SAAS,CACzM,CAAC;gBACJ,CAAC;gBACD,MAAM,IAAI,KAAK,CACb,2CAA2C,MAAM,CAAC,SAAS,UAAU,IAAI,CAAC,IAAI,uFAAuF,CACtK,CAAC;YACJ,CAAC;YACD,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;gBAC1C,mEAAmE;gBACnE,iEAAiE;gBACjE,oEAAoE;gBACpE,wEAAwE;gBACxE,MAAM,uBAAuB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;gBAC5C,SAAS;YACX,CAAC;YACD,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBACxB,MAAM,IAAI,KAAK,CACb,oCAAoC,MAAM,CAAC,SAAS,iCAAiC,CACtF,CAAC;YACJ,CAAC;YACD,IAAI,GAAG,CAAC,IAAI,KAAK,wBAAwB,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;gBAC5D,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC;gBACtE,SAAS;YACX,CAAC;YACD,IAAI,GAAG,CAAC,IAAI,KAAK,KAAK,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;gBACzC,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;gBACzD,SAAS;YACX,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;AACH,CAAC;AASD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,MAAyB,EACzB,YAA6D,EAC7D,OAAsB,EAAE,IAAI,EAAE,OAAO,EAAE;IAEvC,OAAO,SAAS,CACd,MAAM,EACN,KAAK,EAAE,MAAM,EAAE,EAAE;QACf,MAAM,GAAG,GAAG,CAAC,MAAM,YAAY,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAG5C,CAAC;QACF,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,IAAI,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,iBAAiB,CAAC,IAAI,IAAI,EAAE,CAAC;IAC9E,CAAC,EACD,IAAI,CACL,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,KAAK,UAAU,UAAU,CACvB,MAAyB,EACzB,MAAmC,EACnC,IAAY,EACZ,IAAwB,EACxB,IAAmB;IAEnB,OAAO,SAAS,CACd,MAAM,EACN,KAAK,EAAE,MAAM,EAAE,EAAE;QACf,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QAC5D,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,QAAQ;YACrC,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE;YACd,CAAC,CAAC,MAAM,KAAK,OAAO;gBAClB,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;gBACjB,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAa,CAAC;QACnC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAC9C,wEAAwE;YACxE,uEAAuE;YACvE,mEAAmE;YACnE,MAAM,GAAG,GAAG,IAAI,KAAK,CACnB,SAAS,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,IAAI,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,kBAAkB,EAAE,CACF,CAAC;YAClF,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC;YAC5B,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;YAChB,GAAG,CAAC,QAAQ,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;YACxC,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,IAAI,IAAI,GAAY,IAAI,CAAC;QACzB,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC7C,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;IACtC,CAAC;IACD,0EAA0E;IAC1E,4CAA4C;IAC5C,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI,EAAE,CACjD,CAAC;AACJ,CAAC;AAED,uCAAuC;AACvC,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,MAAyB,EACzB,IAAY,EACZ,IAAwB,EACxB,OAAsB,EAAE,IAAI,EAAE,OAAO,EAAE;IAEvC,OAAO,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AACtD,CAAC;AAED,wCAAwC;AACxC,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,MAAyB,EACzB,IAAY,EACZ,IAAwB,EACxB,OAAsB,EAAE,IAAI,EAAE,OAAO,EAAE;IAEvC,OAAO,UAAU,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AACvD,CAAC;AAED,yCAAyC;AACzC,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,MAAyB,EACzB,IAAY,EACZ,OAAsB,EAAE,IAAI,EAAE,OAAO,EAAE;IAEvC,OAAO,UAAU,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;AAC7D,CAAC;AAED,+BAA+B;AAC/B,MAAM,CAAC,MAAM,UAAU,GAAG,EAAE,kBAAkB,EAAE,CAAC"}

package/payload/platform/plugins/outlook/references/auth.md

@@ -136,7 +136,10 @@ The JSON blob shape:
 }
 ```
 
-Atomic write: temp + rename. Either old or new tokens, never partial.
+Atomic write: temp + rename. Either old or new tokens, never partial. The temp
+name embeds the writer's pid, so two processes writing the same mailbox never
+share a temp path. A shared name meant one writer renamed the temp away and the
+other's rename then failed with `ENOENT`.
 
 ## Mailbox selection
 
@@ -150,4 +153,44 @@ local stores (no network) and flags any whose blob cannot be read.
 
 ## Refresh
 
-Triggered automatically when the access token is within `5 minutes` of expiry (`refreshThresholdMs`). Failure → terminal `token-refresh-failed`, tokens cleared, operator must re-register. Refresh tokens last 90 days.
+Triggered automatically when the access token is within `5 minutes` of expiry
+(`refreshThresholdMs`). Refresh tokens last 90 days.
+
+**Only a revoked grant clears the tokens.** A refresh failure whose Azure body
+carries `error=invalid_grant` — the refresh token revoked, expired, or already
+consumed — logs `token-refresh-revoked`, clears the mailbox, and requires
+`outlook-account-register`. Every other failure (network down, Microsoft 5xx, a
+local write error) logs `token-refresh-retryable`, keeps the tokens, and
+surfaces as retryable. Clearing on all of them used to destroy healthy mailboxes
+over transient faults.
+
+**One refresh per mailbox at a time, across processes.** Two Outlook MCP
+processes on one account — the admin PTY conversation and a passive-channel
+spawn, say — can decide the same mailbox needs refreshing at the same moment. A
+lockfile at `<tokens.enc>.lock` admits one. The other waits up to 10 seconds for
+the winner's token and never issues a refresh of its own, so whether Azure
+invalidates a rotated refresh token never becomes load-bearing. A lock whose
+holder process is dead, or which is older than 60 seconds, is stolen; that bound
+sits well inside the 5-minute refresh window, so a stolen lock still leaves time
+to refresh before the token actually expires.
+
+The waiter keys on the access token *changing*, not on it merely being
+un-expired. Under the 401 retry the stored token is locally fresh but Graph has
+already rejected it, so a freshness check would hand back the bad token — the
+failure this design exists to prevent.
+
+Log events, for grepping a refresh incident:
+
+| Event | Meaning |
+|---|---|
+| `token-refreshed` | This process refreshed successfully. |
+| `token-refresh-revoked` | `invalid_grant`. Tokens cleared, re-registration required. |
+| `token-refresh-retryable` | Transient failure. Tokens kept. |
+| `token-refresh-deferred` | A peer held the lock; this process is waiting. |
+| `token-refresh-superseded` | A peer refreshed first; this process adopted its token without a network call. |
+| `token-refresh-peer-observed` | The waiter got the peer's new token. |
+| `token-refresh-peer-failed` | The peer released the lock without publishing a token. |
+| `token-refresh-peer-timeout` | The waiter gave up after 10 seconds. |
+
+"Credentials wiped" and "transient write race" are separate events by design.
+Only `token-refresh-revoked` means a mailbox actually needs re-registering.

package/payload/platform/plugins/scheduling/mcp/dist/__tests__/portal-index-audit.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=portal-index-audit.test.d.ts.map

package/payload/platform/plugins/scheduling/mcp/dist/__tests__/portal-index-audit.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"portal-index-audit.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/portal-index-audit.test.ts"],"names":[],"mappings":""}

package/payload/platform/plugins/scheduling/mcp/dist/__tests__/portal-index-audit.test.js

@@ -0,0 +1,66 @@
+import { describe, it, expect } from "vitest";
+import { auditPortalIndex, formatPortalIndexAudit, STALE_AFTER_INTERVALS, } from "../lib/portal-index-audit.js";
+const HOUR = 3_600_000;
+const NOW = 1_800_000_000_000;
+const fresh = (ms) => ({
+    "acc-a": { lastPushMs: NOW - ms, rows: 41, exposed: ["output", "quotes"] },
+});
+describe("auditPortalIndex", () => {
+    it("reports a recently pushed account as healthy", () => {
+        const r = auditPortalIndex(["acc-a"], fresh(HOUR - 1), NOW, HOUR);
+        expect(r.stale).toBe(0);
+        expect(r.neverRan).toBe(0);
+        expect(r.accounts[0].ageMin).toBe(59);
+        expect(r.accounts[0].rows).toBe(41);
+    });
+    it("tolerates one missed cycle, flags two", () => {
+        // One miss is ordinary (a slow push, a device asleep at the tick). The
+        // threshold has to be loose enough that firing means something.
+        expect(auditPortalIndex(["acc-a"], fresh(HOUR * 1.5), NOW, HOUR).stale).toBe(0);
+        expect(auditPortalIndex(["acc-a"], fresh(HOUR * STALE_AFTER_INTERVALS + 1), NOW, HOUR).stale).toBe(1);
+    });
+    // The signature of the failure this module exists for: the spawn never fires,
+    // so no state is ever written and no other line is ever emitted.
+    it("reports an enrolled account with no state as never-ran, not as stale", () => {
+        const r = auditPortalIndex(["acc-a"], {}, NOW, HOUR);
+        expect(r.neverRan).toBe(1);
+        expect(r.stale).toBe(0);
+        expect(r.accounts[0].ageMin).toBeNull();
+    });
+    it("ignores accounts that have no portal", () => {
+        const r = auditPortalIndex([], fresh(HOUR * 99), NOW, HOUR);
+        expect(r.accounts).toEqual([]);
+        expect(r.stale).toBe(0);
+    });
+    it("survives a malformed state entry rather than throwing", () => {
+        const bad = { "acc-a": { rows: 1, exposed: [] } };
+        expect(auditPortalIndex(["acc-a"], bad, NOW, HOUR).neverRan).toBe(1);
+    });
+    it("never reports a negative age when a clock moves backwards", () => {
+        const r = auditPortalIndex(["acc-a"], fresh(-HOUR), NOW, HOUR);
+        expect(r.accounts[0].ageMin).toBe(0);
+        expect(r.accounts[0].stale).toBe(false);
+    });
+});
+describe("formatPortalIndexAudit", () => {
+    it("emits a summary line even when everything is healthy", () => {
+        // An audit that goes quiet on success is indistinguishable from an audit
+        // that stopped running — the exact defect this module closes.
+        const lines = formatPortalIndexAudit(auditPortalIndex(["acc-a"], fresh(60_000), NOW, HOUR));
+        expect(lines).toHaveLength(1);
+        expect(lines[0]).toBe("[portal-index] op=audit accounts=1 stale=0 never-ran=0");
+    });
+    it("names a stale account with its age and exposed set", () => {
+        const lines = formatPortalIndexAudit(auditPortalIndex(["acc-a"], fresh(HOUR * 3), NOW, HOUR));
+        expect(lines[0]).toContain("account=acc-a");
+        expect(lines[0]).toContain("ageMin=180");
+        expect(lines[0]).toContain("exposed=output,quotes");
+        expect(lines[0]).toContain("result=stale");
+    });
+    it("distinguishes never-ran from stale in the line itself", () => {
+        const lines = formatPortalIndexAudit(auditPortalIndex(["acc-a"], {}, NOW, HOUR));
+        expect(lines[0]).toContain("result=never-ran");
+        expect(lines[0]).toContain("rows=0");
+    });
+});
+//# sourceMappingURL=portal-index-audit.test.js.map

package/payload/platform/plugins/scheduling/mcp/dist/__tests__/portal-index-audit.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"portal-index-audit.test.js","sourceRoot":"","sources":["../../src/__tests__/portal-index-audit.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,qBAAqB,GAEtB,MAAM,8BAA8B,CAAC;AAEtC,MAAM,IAAI,GAAG,SAAS,CAAC;AACvB,MAAM,GAAG,GAAG,iBAAiB,CAAC;AAE9B,MAAM,KAAK,GAAG,CAAC,EAAU,EAAoB,EAAE,CAAC,CAAC;IAC/C,OAAO,EAAE,EAAE,UAAU,EAAE,GAAG,GAAG,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE;CAC3E,CAAC,CAAC;AAEH,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,CAAC,GAAG,gBAAgB,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QAClE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACxB,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3B,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACtC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,uEAAuE;QACvE,gEAAgE;QAChE,MAAM,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,IAAI,GAAG,GAAG,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChF,MAAM,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,IAAI,GAAG,qBAAqB,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxG,CAAC,CAAC,CAAC;IAEH,8EAA8E;IAC9E,iEAAiE;IACjE,EAAE,CAAC,sEAAsE,EAAE,GAAG,EAAE;QAC9E,MAAM,CAAC,GAAG,gBAAgB,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QACrD,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3B,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACxB,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC9C,MAAM,CAAC,GAAG,gBAAgB,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QAC5D,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC/B,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,MAAM,GAAG,GAAG,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,EAAiC,CAAC;QACjF,MAAM,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACnE,MAAM,CAAC,GAAG,gBAAgB,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QAC/D,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACrC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;IACtC,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,yEAAyE;QACzE,8DAA8D;QAC9D,MAAM,KAAK,GAAG,sBAAsB,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QAC5F,MAAM,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAC;IAClF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,MAAM,KAAK,GAAG,sBAAsB,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QAC9F,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;QAC5C,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QACzC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAC;QACpD,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,MAAM,KAAK,GAAG,sBAAsB,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QACjF,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;QAC/C,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/payload/platform/plugins/scheduling/mcp/dist/lib/portal-index-audit.d.ts

@@ -0,0 +1,41 @@
+export interface PortalIndexEntry {
+    lastPushMs: number;
+    rows: number;
+    exposed: string[];
+}
+export type PortalIndexState = Record<string, PortalIndexEntry>;
+export interface PortalAccountAudit {
+    accountId: string;
+    /** No state entry at all: enrolled for a portal, never successfully pushed. */
+    neverRan: boolean;
+    /** Whole minutes since the last verified push; null when it never ran. */
+    ageMin: number | null;
+    rows: number | null;
+    exposed: string[];
+    stale: boolean;
+}
+export interface PortalIndexAuditResult {
+    accounts: PortalAccountAudit[];
+    stale: number;
+    neverRan: number;
+}
+/**
+ * Two intervals, not one: a single missed cycle is ordinary (a slow push, a
+ * device asleep at the tick). Two consecutive misses is a pattern, and the
+ * threshold has to be loose enough that the line means something when it fires.
+ */
+export declare const STALE_AFTER_INTERVALS = 2;
+/**
+ * @param portalAccountIds accounts carrying a data-portal.json — the enrolment
+ *   signal. An account absent from this list has no portal and is not audited.
+ * @param state the push's own success record, keyed by accountId.
+ * @param nowMs
+ * @param intervalMs the push's cadence.
+ */
+export declare function auditPortalIndex(portalAccountIds: string[], state: PortalIndexState, nowMs: number, intervalMs: number): PortalIndexAuditResult;
+/** One line per account needing attention, plus one summary line that fires
+ *  even when everything is healthy — an audit that goes quiet when it finds
+ *  nothing is indistinguishable from an audit that stopped running, which is
+ *  the exact defect this whole module exists to close. */
+export declare function formatPortalIndexAudit(result: PortalIndexAuditResult): string[];
+//# sourceMappingURL=portal-index-audit.d.ts.map

package/payload/platform/plugins/scheduling/mcp/dist/lib/portal-index-audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"portal-index-audit.d.ts","sourceRoot":"","sources":["../../src/lib/portal-index-audit.ts"],"names":[],"mappings":"AAkBA,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,MAAM,CAAA;IAClB,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,EAAE,CAAA;CAClB;AAED,MAAM,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAA;AAE/D,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAA;IACjB,+EAA+E;IAC/E,QAAQ,EAAE,OAAO,CAAA;IACjB,0EAA0E;IAC1E,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,KAAK,EAAE,OAAO,CAAA;CACf;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,kBAAkB,EAAE,CAAA;IAC9B,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,IAAI,CAAA;AAEtC;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,gBAAgB,EAAE,MAAM,EAAE,EAC1B,KAAK,EAAE,gBAAgB,EACvB,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,GACjB,sBAAsB,CA0BxB;AAED;;;0DAG0D;AAC1D,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,sBAAsB,GAAG,MAAM,EAAE,CAgB/E"}

package/payload/platform/plugins/scheduling/mcp/dist/lib/portal-index-audit.js

@@ -0,0 +1,75 @@
+// Standing check: is each portal-serving account's folder index still being
+// refreshed?
+//
+// Every other signal in the index push is event-driven — the script logs when
+// it runs. So the one failure it cannot report is its own absence: if the
+// hourly spawn never fires, there is no line at all, the client's folder tree
+// silently freezes at whatever it last held, and silence is indistinguishable
+// from a clean run.
+//
+// This audit therefore must NOT depend on the thing it audits. It runs
+// in-process inside the heartbeat rather than as a spawned child, and it reads
+// only local files — the state the push writes on success, and the presence of
+// a data-portal.json. No D1, no Cloudflare credential, no second spawn that
+// could fail the same way.
+//
+// The push writes state ONLY after a verified write, so a stale entry means the
+// push stopped succeeding, not merely that it stopped logging.
+/**
+ * Two intervals, not one: a single missed cycle is ordinary (a slow push, a
+ * device asleep at the tick). Two consecutive misses is a pattern, and the
+ * threshold has to be loose enough that the line means something when it fires.
+ */
+export const STALE_AFTER_INTERVALS = 2;
+/**
+ * @param portalAccountIds accounts carrying a data-portal.json — the enrolment
+ *   signal. An account absent from this list has no portal and is not audited.
+ * @param state the push's own success record, keyed by accountId.
+ * @param nowMs
+ * @param intervalMs the push's cadence.
+ */
+export function auditPortalIndex(portalAccountIds, state, nowMs, intervalMs) {
+    const threshold = intervalMs * STALE_AFTER_INTERVALS;
+    const accounts = portalAccountIds.map((accountId) => {
+        const entry = state[accountId];
+        if (!entry || typeof entry.lastPushMs !== "number") {
+            // Never-ran is reported as its own condition rather than as infinite
+            // staleness: the remedies differ (a first run vs a broken cycle), and a
+            // brand-new portal must not look like a regression on its first tick.
+            return { accountId, neverRan: true, ageMin: null, rows: null, exposed: [], stale: false };
+        }
+        const ageMs = Math.max(0, nowMs - entry.lastPushMs);
+        return {
+            accountId,
+            neverRan: false,
+            ageMin: Math.floor(ageMs / 60_000),
+            rows: typeof entry.rows === "number" ? entry.rows : null,
+            exposed: Array.isArray(entry.exposed) ? entry.exposed : [],
+            stale: ageMs > threshold,
+        };
+    });
+    return {
+        accounts,
+        stale: accounts.filter((a) => a.stale).length,
+        neverRan: accounts.filter((a) => a.neverRan).length,
+    };
+}
+/** One line per account needing attention, plus one summary line that fires
+ *  even when everything is healthy — an audit that goes quiet when it finds
+ *  nothing is indistinguishable from an audit that stopped running, which is
+ *  the exact defect this whole module exists to close. */
+export function formatPortalIndexAudit(result) {
+    const lines = [];
+    for (const a of result.accounts) {
+        if (a.neverRan) {
+            lines.push(`[portal-index] op=audit account=${a.accountId} rows=0 result=never-ran`);
+        }
+        else if (a.stale) {
+            lines.push(`[portal-index] op=audit account=${a.accountId} rows=${a.rows} ageMin=${a.ageMin} ` +
+                `exposed=${a.exposed.join(",") || "none"} result=stale`);
+        }
+    }
+    lines.push(`[portal-index] op=audit accounts=${result.accounts.length} stale=${result.stale} never-ran=${result.neverRan}`);
+    return lines;
+}
+//# sourceMappingURL=portal-index-audit.js.map

package/payload/platform/plugins/scheduling/mcp/dist/lib/portal-index-audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"portal-index-audit.js","sourceRoot":"","sources":["../../src/lib/portal-index-audit.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,aAAa;AACb,EAAE;AACF,8EAA8E;AAC9E,0EAA0E;AAC1E,8EAA8E;AAC9E,8EAA8E;AAC9E,oBAAoB;AACpB,EAAE;AACF,uEAAuE;AACvE,+EAA+E;AAC/E,+EAA+E;AAC/E,4EAA4E;AAC5E,2BAA2B;AAC3B,EAAE;AACF,gFAAgF;AAChF,+DAA+D;AA2B/D;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAA;AAEtC;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAC9B,gBAA0B,EAC1B,KAAuB,EACvB,KAAa,EACb,UAAkB;IAElB,MAAM,SAAS,GAAG,UAAU,GAAG,qBAAqB,CAAA;IACpD,MAAM,QAAQ,GAAyB,gBAAgB,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE;QACxE,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,CAAC,CAAA;QAC9B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;YACnD,qEAAqE;YACrE,wEAAwE;YACxE,sEAAsE;YACtE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QAC5F,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC;QACpD,OAAO;YACL,SAAS;YACT,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,MAAM,CAAC;YAClC,IAAI,EAAE,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;YACxD,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE;YAC1D,KAAK,EAAE,KAAK,GAAG,SAAS;SACzB,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,QAAQ;QACR,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM;QAC7C,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,MAAM;KACpD,CAAC;AACJ,CAAC;AAED;;;0DAG0D;AAC1D,MAAM,UAAU,sBAAsB,CAAC,MAA8B;IACnE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QAChC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;YACf,KAAK,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC,SAAS,0BAA0B,CAAC,CAAC;QACvF,CAAC;aAAM,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;YACnB,KAAK,CAAC,IAAI,CACR,mCAAmC,CAAC,CAAC,SAAS,SAAS,CAAC,CAAC,IAAI,WAAW,CAAC,CAAC,MAAM,GAAG;gBACjF,WAAW,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,MAAM,eAAe,CAC1D,CAAC;QACJ,CAAC;IACH,CAAC;IACD,KAAK,CAAC,IAAI,CACR,oCAAoC,MAAM,CAAC,QAAQ,CAAC,MAAM,UAAU,MAAM,CAAC,KAAK,cAAc,MAAM,CAAC,QAAQ,EAAE,CAChH,CAAC;IACF,OAAO,KAAK,CAAC;AACf,CAAC"}

package/payload/platform/plugins/scheduling/mcp/dist/scripts/check-due-events.js

@@ -28,6 +28,7 @@ import cronParser from "cron-parser";
 const { parseExpression } = cronParser;
 import { chooseDispatchMode, dispatchAgentTurn, runStandingAudit, auditSelfCancels } from "./agent-turn-dispatch.js";
 import { spawn } from "node:child_process";
+import { auditPortalIndex, formatPortalIndexAudit, } from "../lib/portal-index-audit.js";
 import { shouldRunSentSweep, SENT_SWEEP_INTERVAL_MS, } from "../lib/sent-sweep-throttle.js";
 // ---------------------------------------------------------------------------
 // Brand-aware config directory — reads configDir from brand.json stamped at install time.
@@ -492,6 +493,110 @@ function maybeRunSentSweep(platformRoot) {
     });
     child.unref();
 }
+const PORTAL_INDEX_STATE_FILE = resolve(CONFIG_DIR, "portal-index-push-state.json");
+const PORTAL_INDEX_INTERVAL_MS = 60 * 60 * 1000;
+/**
+ * Publish each portal-serving account's deliverable folder index, at most hourly.
+ *
+ * Spawned rather than imported, for the same reason as the sent-copy sweep: the
+ * script lives in the cloudflare plugin and talks to Cloudflare's API, which does
+ * not belong inside the scheduling build.
+ *
+ * The script decides WHICH accounts have portals (a `data-portal.json` is the
+ * signal) and which folders each one exposes. Nothing about that is configured
+ * here, so this stays a spawn on a timer.
+ *
+ * State is written before the spawn, not after it completes: a push that hangs
+ * must not cause a fresh one to start behind it every minute.
+ */
+function maybeRunPortalIndexPush(platformRoot) {
+    let prev;
+    try {
+        prev = JSON.parse(readFileSync(PORTAL_INDEX_STATE_FILE, "utf8"));
+    }
+    catch {
+        prev = undefined;
+    }
+    const now = Date.now();
+    if (prev?.lastRunMs && now - prev.lastRunMs < PORTAL_INDEX_INTERVAL_MS)
+        return;
+    const script = resolve(platformRoot, "plugins/cloudflare/bin/portal-index-push.mjs");
+    if (!existsSync(script)) {
+        console.error(`[portal-index] skipped: ${script} not found`);
+        return;
+    }
+    try {
+        writeFileSync(PORTAL_INDEX_STATE_FILE, JSON.stringify({ lastRunMs: now }));
+    }
+    catch (err) {
+        console.error(`[portal-index] state write failed: ${err instanceof Error ? err.message : String(err)}`);
+        return;
+    }
+    const child = spawn(process.execPath, [script, "--all-accounts"], {
+        env: { ...process.env, PLATFORM_ROOT: platformRoot },
+        stdio: ["ignore", "inherit", "inherit"],
+        detached: true,
+    });
+    child.unref();
+}
+const PORTAL_AUDIT_STATE_FILE = resolve(CONFIG_DIR, "portal-index-audit-state.json");
+/**
+ * Standing check: is each portal-serving account's index still being refreshed?
+ *
+ * Runs IN-PROCESS, not as a spawn, and reads only local files. That is the
+ * whole point — every other signal in the push is event-driven, so the one
+ * failure none of them can report is the push not running at all. An audit that
+ * went through the same spawn, or needed the same Cloudflare credential, would
+ * be blind to exactly the case it exists for.
+ *
+ * Throttled to the push's own cadence so the summary line stays readable in a
+ * log that already carries a line a minute.
+ */
+function auditPortalIndexPush(platformRoot) {
+    let prev;
+    try {
+        prev = JSON.parse(readFileSync(PORTAL_AUDIT_STATE_FILE, "utf8"));
+    }
+    catch {
+        prev = undefined;
+    }
+    const now = Date.now();
+    if (prev?.lastRunMs && now - prev.lastRunMs < PORTAL_INDEX_INTERVAL_MS)
+        return;
+    const dataRoot = resolve(platformRoot, "..", "data");
+    const accountsDir = join(dataRoot, "accounts");
+    if (!existsSync(accountsDir))
+        return;
+    // A data-portal.json is the enrolment signal — the same one the push uses, so
+    // the two cannot disagree about which accounts are in scope.
+    let portalAccountIds = [];
+    try {
+        portalAccountIds = readdirSync(accountsDir).filter((d) => existsSync(join(accountsDir, d, "data-portal.json")));
+    }
+    catch {
+        return;
+    }
+    if (portalAccountIds.length === 0)
+        return;
+    let state = {};
+    try {
+        state = JSON.parse(readFileSync(join(dataRoot, "portal-index-state.json"), "utf8"));
+    }
+    catch {
+        // Absent state with portals enrolled is itself the never-ran signal, so an
+        // empty object is the correct input here rather than a reason to bail.
+        state = {};
+    }
+    for (const line of formatPortalIndexAudit(auditPortalIndex(portalAccountIds, state, now, PORTAL_INDEX_INTERVAL_MS))) {
+        console.error(line);
+    }
+    try {
+        writeFileSync(PORTAL_AUDIT_STATE_FILE, JSON.stringify({ lastRunMs: now }));
+    }
+    catch (err) {
+        console.error(`[portal-index] op=audit-state-write-failed err="${err instanceof Error ? err.message : String(err)}"`);
+    }
+}
 async function main() {
     if (!acquireLock()) {
         console.error("[check-due] another instance running, exiting");
@@ -672,6 +777,23 @@ async function main() {
         catch (err) {
             console.error(`[email-sent-sweep] spawn failed: ${err instanceof Error ? err.message : String(err)}`);
         }
+        // --- Data-portal folder index (hourly) ---
+        // Guarded on the same principle: an optional hourly publish must not cost
+        // the every-minute dispatcher its completion line.
+        try {
+            maybeRunPortalIndexPush(process.env.PLATFORM_ROOT);
+        }
+        catch (err) {
+            console.error(`[portal-index] spawn failed: ${err instanceof Error ? err.message : String(err)}`);
+        }
+        // Deliberately AFTER the spawn and independent of whether it succeeded:
+        // this is the check that speaks when the push does not.
+        try {
+            auditPortalIndexPush(process.env.PLATFORM_ROOT);
+        }
+        catch (err) {
+            console.error(`[portal-index] op=audit-failed err="${err instanceof Error ? err.message : String(err)}"`);
+        }
         console.error(`[check-due] done: ${processed} processed, ${dispatched} dispatched, ${errors} errors`);
     }
     finally {