@rubytech/create-sitedesk-code 0.1.340

package/payload/platform/plugins/outlook/mcp/dist/auth/pkce-flow.js

@@ -0,0 +1,261 @@
+/**
+ * OAuth 2.0 Authorization Code + PKCE flow for Microsoft Identity Platform.
+ *
+ * Adapted from nsakki55/outlook-mcp@e49d8e68ac8d69db653c25803127dc3b98626cda
+ * (MIT). Adaptations:
+ *   - Ephemeral loopback port via `server.listen(0)` (upstream uses fixed
+ *     49152). The Entra app is registered with `http://localhost` (no port);
+ *     Microsoft Identity Platform treats native-app loopback redirects with
+ *     port-flexible matching.
+ *   - No `xdg-open` browser auto-launch; the auth URL is logged to stderr
+ *     and returned to the caller for the operator to open in the VNC browser.
+ *   - Tool handler awaits the full PKCE flow synchronously (5-min timeout)
+ *     instead of upstream's background-promise + immediate-error pattern.
+ */
+import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
+import { createServer } from "node:http";
+import { URL } from "node:url";
+import { log, challengePrefix } from "../lib/log.js";
+const FLOW_TIMEOUT_MS = 5 * 60 * 1000; // 5 minutes
+const SCOPES = [
+    "offline_access",
+    "User.Read",
+    "Mail.Read",
+    "Calendars.Read",
+    "Contacts.Read",
+];
+function buildUrls(tenantId) {
+    const tenant = tenantId || "common";
+    return {
+        authorizeUrl: `https://login.microsoftonline.com/${tenant}/oauth2/v2.0/authorize`,
+        tokenUrl: `https://login.microsoftonline.com/${tenant}/oauth2/v2.0/token`,
+    };
+}
+/**
+ * Start the PKCE flow:
+ *   1. Generate code_verifier + code_challenge (S256) + state.
+ *   2. Bind a one-shot HTTP server on an ephemeral loopback port.
+ *   3. Build the authorize URL with the actual port; return it to the caller.
+ *   4. The returned `result` promise resolves when the callback arrives (or
+ *      rejects on state mismatch / OAuth error / timeout) and tokens are
+ *      exchanged.
+ *
+ * The caller (the outlook-account-register tool) prints the auth URL,
+ * returns it in the tool response, and awaits `result`.
+ */
+export async function startPkceFlow(config) {
+    const codeVerifier = randomBytes(32).toString("base64url");
+    const codeChallenge = createHash("sha256").update(codeVerifier).digest("base64url");
+    const state = randomBytes(16).toString("hex");
+    const bound = await bindCallbackServer(state);
+    const redirectUri = `http://localhost:${bound.port}/callback`;
+    const { authorizeUrl, tokenUrl } = buildUrls(config.tenantId);
+    const authUrl = new URL(authorizeUrl);
+    authUrl.searchParams.set("client_id", config.clientId);
+    authUrl.searchParams.set("response_type", "code");
+    authUrl.searchParams.set("redirect_uri", redirectUri);
+    authUrl.searchParams.set("scope", SCOPES.join(" "));
+    authUrl.searchParams.set("state", state);
+    authUrl.searchParams.set("code_challenge", codeChallenge);
+    authUrl.searchParams.set("code_challenge_method", "S256");
+    authUrl.searchParams.set("prompt", "select_account");
+    log({
+        event: "auth-init",
+        account: config.accountId,
+        codeChallenge: challengePrefix(codeChallenge),
+        redirectPath: `/callback (port ${bound.port})`,
+    });
+    const result = (async () => {
+        const startMs = Date.now();
+        try {
+            const code = await bound.codePromise;
+            log({
+                event: "auth-callback",
+                account: config.accountId,
+                elapsedMs: Date.now() - startMs,
+            });
+            const tokenResponse = await exchangeCode({
+                code,
+                codeVerifier,
+                redirectUri,
+                clientId: config.clientId,
+                tokenUrl,
+            });
+            const scopes = (tokenResponse.scope ?? SCOPES.join(" ")).split(/\s+/);
+            return { tokenResponse, scopes };
+        }
+        finally {
+            bound.close();
+        }
+    })();
+    return {
+        authUrl: authUrl.toString(),
+        redirectUri,
+        result,
+    };
+}
+function bindCallbackServer(expectedState) {
+    return new Promise((resolveBind, rejectBind) => {
+        let resolved = false;
+        let codeResolve = null;
+        let codeReject = null;
+        const codePromise = new Promise((resolve, reject) => {
+            codeResolve = resolve;
+            codeReject = reject;
+        });
+        let timer = null;
+        const server = createServer((req, res) => {
+            if (!req.url) {
+                res.writeHead(400);
+                res.end();
+                return;
+            }
+            const parsed = new URL(req.url, "http://localhost");
+            if (parsed.pathname !== "/callback") {
+                res.writeHead(404, { "Content-Type": "text/plain" });
+                res.end("not found");
+                return;
+            }
+            const code = parsed.searchParams.get("code");
+            const returnedState = parsed.searchParams.get("state");
+            const error = parsed.searchParams.get("error");
+            const errorDescription = parsed.searchParams.get("error_description");
+            // Reject Host header rebinding (RFC 6749 native-client guidance).
+            const host = req.headers.host ?? "";
+            if (!/^(localhost|127\.0\.0\.1)(:\d+)?$/.test(host)) {
+                respondHtml(res, 400, "Invalid host", "Loopback callback rejected non-localhost host header.");
+                finish();
+                codeReject?.(new Error(`Loopback callback received unexpected host header: ${host}`));
+                return;
+            }
+            if (error) {
+                respondHtml(res, 400, "Authentication error", `${error}: ${errorDescription ?? ""}`);
+                finish();
+                codeReject?.(new Error(`OAuth error: ${error} - ${errorDescription ?? ""}`));
+                return;
+            }
+            if (!returnedState || !sameLengthEqual(returnedState, expectedState)) {
+                respondHtml(res, 400, "State mismatch", "Authorization state did not match. Possible CSRF; retry register.");
+                finish();
+                codeReject?.(new Error("State mismatch — possible CSRF"));
+                return;
+            }
+            if (!code) {
+                respondHtml(res, 400, "No authorization code", "The authorization callback did not include a code.");
+                finish();
+                codeReject?.(new Error("No authorization code received"));
+                return;
+            }
+            respondHtml(res, 200, "Outlook authorized", "You may close this window. Return to admin chat to continue.");
+            finish();
+            codeResolve?.(code);
+        });
+        server.on("error", (err) => {
+            finish();
+            // If we never resolved bind, fail bind; otherwise fail the code wait.
+            if (!resolvedBind)
+                rejectBind(err);
+            codeReject?.(err);
+        });
+        let resolvedBind = false;
+        server.listen(0, "127.0.0.1", () => {
+            const address = server.address();
+            if (!address || typeof address !== "object") {
+                rejectBind(new Error("Loopback bind failed: address unavailable"));
+                return;
+            }
+            resolvedBind = true;
+            timer = setTimeout(() => {
+                finish();
+                codeReject?.(new Error("Authentication timeout (5 minutes)"));
+            }, FLOW_TIMEOUT_MS);
+            resolveBind({
+                port: address.port,
+                codePromise,
+                close: finish,
+            });
+        });
+        function finish() {
+            if (resolved)
+                return;
+            resolved = true;
+            if (timer)
+                clearTimeout(timer);
+            timer = null;
+            try {
+                server.close();
+            }
+            catch {
+                // best-effort
+            }
+        }
+    });
+}
+async function exchangeCode(args) {
+    const params = new URLSearchParams({
+        client_id: args.clientId,
+        scope: SCOPES.join(" "),
+        code: args.code,
+        redirect_uri: args.redirectUri,
+        grant_type: "authorization_code",
+        code_verifier: args.codeVerifier,
+    });
+    const response = await fetch(args.tokenUrl, {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: params.toString(),
+    });
+    if (!response.ok) {
+        const text = await response.text();
+        throw new Error(`Token exchange failed (${response.status}): ${text}`);
+    }
+    return (await response.json());
+}
+export async function refreshAccessToken(args) {
+    const { tokenUrl } = buildUrls(args.tenantId);
+    const params = new URLSearchParams({
+        client_id: args.clientId,
+        scope: SCOPES.join(" "),
+        refresh_token: args.refreshToken,
+        grant_type: "refresh_token",
+    });
+    const response = await fetch(tokenUrl, {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: params.toString(),
+    });
+    if (!response.ok) {
+        const text = await response.text();
+        throw new Error(`Token refresh failed (${response.status}): ${text}`);
+    }
+    return (await response.json());
+}
+function respondHtml(res, status, title, message) {
+    const color = status === 200 ? "#107c10" : "#d83b01";
+    const body = `<!DOCTYPE html>
+<html lang="en"><head><meta charset="UTF-8"><title>${title}</title>
+<style>
+body{font-family:'Segoe UI',sans-serif;text-align:center;padding:60px;background:#f3f2f1;}
+.card{background:white;border-radius:8px;padding:40px;max-width:480px;margin:0 auto;
+  box-shadow:0 2px 8px rgba(0,0,0,0.1);}
+h1{color:${color};margin:0 0 16px;}
+p{color:#605e5c;margin:0;line-height:1.5;}
+</style></head>
+<body><div class="card"><h1>${title}</h1><p>${message}</p></div></body></html>`;
+    res.writeHead(status, { "Content-Type": "text/html; charset=utf-8" });
+    res.end(body);
+}
+/**
+ * Constant-time equality on equal-length strings. Returns false (not throws)
+ * for length mismatch so the caller can branch without leaking length via
+ * timing. State comparison MUST go through this helper, not `!==`.
+ */
+function sameLengthEqual(a, b) {
+    if (a.length !== b.length)
+        return false;
+    const aBuf = Buffer.from(a, "utf8");
+    const bBuf = Buffer.from(b, "utf8");
+    return timingSafeEqual(aBuf, bBuf);
+}
+export const _internals = { SCOPES, sameLengthEqual };
+//# sourceMappingURL=pkce-flow.js.map

package/payload/platform/plugins/outlook/mcp/dist/auth/pkce-flow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce-flow.js","sourceRoot":"","sources":["../../src/auth/pkce-flow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACvE,OAAO,EAAE,YAAY,EAAe,MAAM,WAAW,CAAC;AAEtD,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAC/B,OAAO,EAAE,GAAG,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAErD,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,YAAY;AACnD,MAAM,MAAM,GAAG;IACb,gBAAgB;IAChB,WAAW;IACX,WAAW;IACX,gBAAgB;IAChB,eAAe;CAChB,CAAC;AAOF,SAAS,SAAS,CAAC,QAAgB;IACjC,MAAM,MAAM,GAAG,QAAQ,IAAI,QAAQ,CAAC;IACpC,OAAO;QACL,YAAY,EAAE,qCAAqC,MAAM,wBAAwB;QACjF,QAAQ,EAAE,qCAAqC,MAAM,oBAAoB;KAC1E,CAAC;AACJ,CAAC;AA2BD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,MAAsB;IACxD,MAAM,YAAY,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC3D,MAAM,aAAa,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACpF,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAE9C,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,WAAW,GAAG,oBAAoB,KAAK,CAAC,IAAI,WAAW,CAAC;IAC9D,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,GAAG,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAE9D,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;IACtC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IACvD,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAClD,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;IACtD,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACpD,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACzC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,aAAa,CAAC,CAAC;IAC1D,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;IAC1D,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;IAErD,GAAG,CAAC;QACF,KAAK,EAAE,WAAW;QAClB,OAAO,EAAE,MAAM,CAAC,SAAS;QACzB,aAAa,EAAE,eAAe,CAAC,aAAa,CAAC;QAC7C,YAAY,EAAE,mBAAmB,KAAK,CAAC,IAAI,GAAG;KAC/C,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,CAAC,KAAK,IAAI,EAAE;QACzB,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC;YACrC,GAAG,CAAC;gBACF,KAAK,EAAE,eAAe;gBACtB,OAAO,EAAE,MAAM,CAAC,SAAS;gBACzB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;aAChC,CAAC,CAAC;YACH,MAAM,aAAa,GAAG,MAAM,YAAY,CAAC;gBACvC,IAAI;gBACJ,YAAY;gBACZ,WAAW;gBACX,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,QAAQ;aACT,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,CAAC,aAAa,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACtE,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC;QACnC,CAAC;gBAAS,CAAC;YACT,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,CAAC;IACH,CAAC,CAAC,EAAE,CAAC;IAEL,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE;QAC3B,WAAW;QACX,MAAM;KACP,CAAC;AACJ,CAAC;AAQD,SAAS,kBAAkB,CAAC,aAAqB;IAC/C,OAAO,IAAI,OAAO,CAAC,CAAC,WAAW,EAAE,UAAU,EAAE,EAAE;QAC7C,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,IAAI,WAAW,GAAqC,IAAI,CAAC;QACzD,IAAI,UAAU,GAAqC,IAAI,CAAC;QACxD,MAAM,WAAW,GAAG,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC1D,WAAW,GAAG,OAAO,CAAC;YACtB,UAAU,GAAG,MAAM,CAAC;QACtB,CAAC,CAAC,CAAC;QAEH,IAAI,KAAK,GAA0B,IAAI,CAAC;QAExC,MAAM,MAAM,GAAW,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YAC/C,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBACnB,GAAG,CAAC,GAAG,EAAE,CAAC;gBACV,OAAO;YACT,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;YACpD,IAAI,MAAM,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;gBACpC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC;gBACrD,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;gBACrB,OAAO;YACT,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC7C,MAAM,aAAa,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACvD,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC/C,MAAM,gBAAgB,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;YAEtE,kEAAkE;YAClE,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC;YACpC,IAAI,CAAC,mCAAmC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACpD,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,cAAc,EAAE,uDAAuD,CAAC,CAAC;gBAC/F,MAAM,EAAE,CAAC;gBACT,UAAU,EAAE,CAAC,IAAI,KAAK,CAAC,sDAAsD,IAAI,EAAE,CAAC,CAAC,CAAC;gBACtF,OAAO;YACT,CAAC;YAED,IAAI,KAAK,EAAE,CAAC;gBACV,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,sBAAsB,EAAE,GAAG,KAAK,KAAK,gBAAgB,IAAI,EAAE,EAAE,CAAC,CAAC;gBACrF,MAAM,EAAE,CAAC;gBACT,UAAU,EAAE,CAAC,IAAI,KAAK,CAAC,gBAAgB,KAAK,MAAM,gBAAgB,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;gBAC7E,OAAO;YACT,CAAC;YAED,IAAI,CAAC,aAAa,IAAI,CAAC,eAAe,CAAC,aAAa,EAAE,aAAa,CAAC,EAAE,CAAC;gBACrE,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,gBAAgB,EAAE,mEAAmE,CAAC,CAAC;gBAC7G,MAAM,EAAE,CAAC;gBACT,UAAU,EAAE,CAAC,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC,CAAC;gBAC1D,OAAO;YACT,CAAC;YAED,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,uBAAuB,EAAE,oDAAoD,CAAC,CAAC;gBACrG,MAAM,EAAE,CAAC;gBACT,UAAU,EAAE,CAAC,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC,CAAC;gBAC1D,OAAO;YACT,CAAC;YAED,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,oBAAoB,EAAE,8DAA8D,CAAC,CAAC;YAC5G,MAAM,EAAE,CAAC;YACT,WAAW,EAAE,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACzB,MAAM,EAAE,CAAC;YACT,sEAAsE;YACtE,IAAI,CAAC,YAAY;gBAAE,UAAU,CAAC,GAAG,CAAC,CAAC;YACnC,UAAU,EAAE,CAAC,GAAG,CAAC,CAAC;QACpB,CAAC,CAAC,CAAC;QAEH,IAAI,YAAY,GAAG,KAAK,CAAC;QACzB,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;YACjC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAwB,CAAC;YACvD,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;gBAC5C,UAAU,CAAC,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC,CAAC;gBACnE,OAAO;YACT,CAAC;YACD,YAAY,GAAG,IAAI,CAAC;YACpB,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBACtB,MAAM,EAAE,CAAC;gBACT,UAAU,EAAE,CAAC,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC,CAAC;YAChE,CAAC,EAAE,eAAe,CAAC,CAAC;YACpB,WAAW,CAAC;gBACV,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,WAAW;gBACX,KAAK,EAAE,MAAM;aACd,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,SAAS,MAAM;YACb,IAAI,QAAQ;gBAAE,OAAO;YACrB,QAAQ,GAAG,IAAI,CAAC;YAChB,IAAI,KAAK;gBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;YAC/B,KAAK,GAAG,IAAI,CAAC;YACb,IAAI,CAAC;gBACH,MAAM,CAAC,KAAK,EAAE,CAAC;YACjB,CAAC;YAAC,MAAM,CAAC;gBACP,cAAc;YAChB,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAUD,KAAK,UAAU,YAAY,CAAC,IAAkB;IAC5C,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QACjC,SAAS,EAAE,IAAI,CAAC,QAAQ;QACxB,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;QACvB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,YAAY,EAAE,IAAI,CAAC,WAAW;QAC9B,UAAU,EAAE,oBAAoB;QAChC,aAAa,EAAE,IAAI,CAAC,YAAY;KACjC,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE;QAC1C,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE;KACxB,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,0BAA0B,QAAQ,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAkB,CAAC;AAClD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAIxC;IACC,MAAM,EAAE,QAAQ,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QACjC,SAAS,EAAE,IAAI,CAAC,QAAQ;QACxB,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;QACvB,aAAa,EAAE,IAAI,CAAC,YAAY;QAChC,UAAU,EAAE,eAAe;KAC5B,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE;QACrC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE;KACxB,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,yBAAyB,QAAQ,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAkB,CAAC;AAClD,CAAC;AAED,SAAS,WAAW,CAClB,GAAuC,EACvC,MAAc,EACd,KAAa,EACb,OAAe;IAEf,MAAM,KAAK,GAAG,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IACrD,MAAM,IAAI,GAAG;qDACsC,KAAK;;;;;WAK/C,KAAK;;;8BAGc,KAAK,WAAW,OAAO,0BAA0B,CAAC;IAC9E,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,CAAC,CAAC;IACtE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAC,CAAS,EAAE,CAAS;IAC3C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACpC,OAAO,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,CAAC,MAAM,UAAU,GAAG,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC"}

package/payload/platform/plugins/outlook/mcp/dist/auth/token-store.d.ts

@@ -0,0 +1,61 @@
+/**
+ * Per-account encrypted token store for Outlook OAuth credentials.
+ *
+ * Adapted from nsakki55/outlook-mcp@e49d8e68ac8d69db653c25803127dc3b98626cda
+ * (MIT). Adaptations:
+ *   - Per-account paths under {ACCOUNTS_DIR}/{accountId}/secrets/outlook/
+ *   - keytar fallback removed (Pi runs headless, no Secret Service)
+ *   - node-persist removed; single JSON blob written atomically (temp + rename)
+ *
+ *   tokens.enc      AES-256-CBC ciphertext "<iv-hex>:<cipher-hex>" of the JSON blob
+ *   .key            32 random bytes, base64, mode 0600 (the AES key)
+ *
+ * The JSON blob shape is {accessToken, refreshToken, accessTokenExpiry,
+ * refreshTokenExpiry, lastRefresh, graphUserId, scopes}.
+ *
+ * Rationale: per CLAUDE.md doctrine, account scope is absolute. Each account
+ * holds its own AES key — compromising account A's keyfile cannot decrypt
+ * account B's tokens.
+ */
+export interface TokenBlob {
+    accessToken: string;
+    refreshToken: string | null;
+    accessTokenExpiry: number;
+    refreshTokenExpiry: number;
+    lastRefresh: number;
+    graphUserId: string | null;
+    scopes: string[];
+}
+export declare class TokenStore {
+    readonly accountId: string;
+    private cachedBlob;
+    private encryptionKey;
+    private readonly secretsDir;
+    private readonly tokensPath;
+    private readonly keyPath;
+    constructor(accountId: string, accountsDir: string);
+    /** Load (or create) the AES key. Idempotent and TOCTOU-safe via wx flag. */
+    private loadKey;
+    private encrypt;
+    private decrypt;
+    /** Atomic write — temp + rename. Either old or new tokens, never partial. */
+    private writeBlob;
+    /** Read and decrypt the blob from disk; cached after first read. */
+    read(): TokenBlob | null;
+    store(accessToken: string, refreshToken: string | null, expiresInSeconds: number, extras?: {
+        graphUserId?: string | null;
+        scopes?: string[];
+    }): TokenBlob;
+    private tryReadSilent;
+    /**
+     * Whether the access token is within the refresh threshold of expiry. Caller
+     * should refresh before next Graph call when this is true.
+     */
+    needsRefresh(): boolean;
+    hasTokens(): boolean;
+    refreshTokenExpired(): boolean;
+    clear(): void;
+}
+/** Exported for tests + the mailbox-info tool. */
+export declare const refreshThresholdMs: number;
+//# sourceMappingURL=token-store.d.ts.map

package/payload/platform/plugins/outlook/mcp/dist/auth/token-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-store.d.ts","sourceRoot":"","sources":["../../src/auth/token-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAkBH,MAAM,WAAW,SAAS;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,qBAAa,UAAU;aAQH,SAAS,EAAE,MAAM;IAPnC,OAAO,CAAC,UAAU,CAA0B;IAC5C,OAAO,CAAC,aAAa,CAAuB;IAC5C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;gBAGf,SAAS,EAAE,MAAM,EACjC,WAAW,EAAE,MAAM;IAOrB,4EAA4E;IAC5E,OAAO,CAAC,OAAO;IAuCf,OAAO,CAAC,OAAO;IASf,OAAO,CAAC,OAAO;IAaf,6EAA6E;IAC7E,OAAO,CAAC,SAAS;IASjB,oEAAoE;IACpE,IAAI,IAAI,SAAS,GAAG,IAAI;IAWxB,KAAK,CACH,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GAAG,IAAI,EAC3B,gBAAgB,EAAE,MAAM,EACxB,MAAM,GAAE;QAAE,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;KAAO,GAC9D,SAAS;IAkBZ,OAAO,CAAC,aAAa;IAQrB;;;OAGG;IACH,YAAY,IAAI,OAAO;IAMvB,SAAS,IAAI,OAAO;IAIpB,mBAAmB,IAAI,OAAO;IAM9B,KAAK,IAAI,IAAI;CAId;AAED,kDAAkD;AAClD,eAAO,MAAM,kBAAkB,QAAuB,CAAC"}

package/payload/platform/plugins/outlook/mcp/dist/auth/token-store.js

@@ -0,0 +1,170 @@
+/**
+ * Per-account encrypted token store for Outlook OAuth credentials.
+ *
+ * Adapted from nsakki55/outlook-mcp@e49d8e68ac8d69db653c25803127dc3b98626cda
+ * (MIT). Adaptations:
+ *   - Per-account paths under {ACCOUNTS_DIR}/{accountId}/secrets/outlook/
+ *   - keytar fallback removed (Pi runs headless, no Secret Service)
+ *   - node-persist removed; single JSON blob written atomically (temp + rename)
+ *
+ *   tokens.enc      AES-256-CBC ciphertext "<iv-hex>:<cipher-hex>" of the JSON blob
+ *   .key            32 random bytes, base64, mode 0600 (the AES key)
+ *
+ * The JSON blob shape is {accessToken, refreshToken, accessTokenExpiry,
+ * refreshTokenExpiry, lastRefresh, graphUserId, scopes}.
+ *
+ * Rationale: per CLAUDE.md doctrine, account scope is absolute. Each account
+ * holds its own AES key — compromising account A's keyfile cannot decrypt
+ * account B's tokens.
+ */
+import { createCipheriv, createDecipheriv, randomBytes } from "node:crypto";
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync, } from "node:fs";
+import { join } from "node:path";
+const REFRESH_THRESHOLD_MS = 5 * 60 * 1000; // 5 minutes
+const REFRESH_TOKEN_LIFETIME_MS = 90 * 24 * 60 * 60 * 1000; // 90 days
+export class TokenStore {
+    accountId;
+    cachedBlob = null;
+    encryptionKey = null;
+    secretsDir;
+    tokensPath;
+    keyPath;
+    constructor(accountId, accountsDir) {
+        this.accountId = accountId;
+        this.secretsDir = join(accountsDir, accountId, "secrets", "outlook");
+        this.tokensPath = join(this.secretsDir, "tokens.enc");
+        this.keyPath = join(this.secretsDir, ".key");
+    }
+    /** Load (or create) the AES key. Idempotent and TOCTOU-safe via wx flag. */
+    loadKey() {
+        if (this.encryptionKey)
+            return this.encryptionKey;
+        mkdirSync(this.secretsDir, { recursive: true, mode: 0o700 });
+        chmodSync(this.secretsDir, 0o700);
+        if (existsSync(this.keyPath)) {
+            const stat = statSync(this.keyPath);
+            if ((stat.mode & 0o777) !== 0o600)
+                chmodSync(this.keyPath, 0o600);
+            const raw = readFileSync(this.keyPath, "utf-8").trim();
+            const key = Buffer.from(raw, "base64");
+            if (key.length !== 32) {
+                throw new Error(`Outlook key for account=${this.accountId} is corrupt (length=${key.length}); delete ${this.keyPath} and re-run outlook-account-register.`);
+            }
+            this.encryptionKey = key;
+            return key;
+        }
+        const newKey = randomBytes(32);
+        try {
+            writeFileSync(this.keyPath, newKey.toString("base64"), {
+                flag: "wx",
+                mode: 0o600,
+            });
+        }
+        catch (err) {
+            // Concurrent flow created the key first — read theirs.
+            if (err.code === "EEXIST") {
+                const raw = readFileSync(this.keyPath, "utf-8").trim();
+                this.encryptionKey = Buffer.from(raw, "base64");
+                return this.encryptionKey;
+            }
+            throw err;
+        }
+        this.encryptionKey = newKey;
+        return newKey;
+    }
+    encrypt(plaintext) {
+        const key = this.loadKey();
+        const iv = randomBytes(16);
+        const cipher = createCipheriv("aes-256-cbc", key, iv);
+        let encrypted = cipher.update(plaintext, "utf8", "hex");
+        encrypted += cipher.final("hex");
+        return `${iv.toString("hex")}:${encrypted}`;
+    }
+    decrypt(payload) {
+        const key = this.loadKey();
+        const [ivHex, ...rest] = payload.split(":");
+        if (!ivHex || rest.length === 0) {
+            throw new Error("token-decrypt-failed: malformed cipher payload");
+        }
+        const iv = Buffer.from(ivHex, "hex");
+        const decipher = createDecipheriv("aes-256-cbc", key, iv);
+        let decrypted = decipher.update(rest.join(":"), "hex", "utf8");
+        decrypted += decipher.final("utf8");
+        return decrypted;
+    }
+    /** Atomic write — temp + rename. Either old or new tokens, never partial. */
+    writeBlob(blob) {
+        const ciphertext = this.encrypt(JSON.stringify(blob));
+        const temp = `${this.tokensPath}.tmp`;
+        writeFileSync(temp, ciphertext, { mode: 0o600 });
+        chmodSync(temp, 0o600);
+        renameSync(temp, this.tokensPath);
+        this.cachedBlob = blob;
+    }
+    /** Read and decrypt the blob from disk; cached after first read. */
+    read() {
+        if (this.cachedBlob)
+            return this.cachedBlob;
+        if (!existsSync(this.tokensPath))
+            return null;
+        const raw = readFileSync(this.tokensPath, "utf-8").trim();
+        if (!raw)
+            return null;
+        const json = this.decrypt(raw);
+        const blob = JSON.parse(json);
+        this.cachedBlob = blob;
+        return blob;
+    }
+    store(accessToken, refreshToken, expiresInSeconds, extras = {}) {
+        const now = Date.now();
+        const previous = this.cachedBlob ?? this.tryReadSilent();
+        const blob = {
+            accessToken,
+            refreshToken: refreshToken ?? previous?.refreshToken ?? null,
+            accessTokenExpiry: now + expiresInSeconds * 1000,
+            refreshTokenExpiry: refreshToken
+                ? now + REFRESH_TOKEN_LIFETIME_MS
+                : (previous?.refreshTokenExpiry ?? now + REFRESH_TOKEN_LIFETIME_MS),
+            lastRefresh: now,
+            graphUserId: extras.graphUserId ?? previous?.graphUserId ?? null,
+            scopes: extras.scopes ?? previous?.scopes ?? [],
+        };
+        this.writeBlob(blob);
+        return blob;
+    }
+    tryReadSilent() {
+        try {
+            return this.read();
+        }
+        catch {
+            return null;
+        }
+    }
+    /**
+     * Whether the access token is within the refresh threshold of expiry. Caller
+     * should refresh before next Graph call when this is true.
+     */
+    needsRefresh() {
+        const blob = this.read();
+        if (!blob)
+            return false;
+        return Date.now() > blob.accessTokenExpiry - REFRESH_THRESHOLD_MS;
+    }
+    hasTokens() {
+        return this.read() !== null;
+    }
+    refreshTokenExpired() {
+        const blob = this.read();
+        if (!blob)
+            return false;
+        return Date.now() > blob.refreshTokenExpiry;
+    }
+    clear() {
+        this.cachedBlob = null;
+        if (existsSync(this.tokensPath))
+            unlinkSync(this.tokensPath);
+    }
+}
+/** Exported for tests + the mailbox-info tool. */
+export const refreshThresholdMs = REFRESH_THRESHOLD_MS;
+//# sourceMappingURL=token-store.js.map

package/payload/platform/plugins/outlook/mcp/dist/auth/token-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-store.js","sourceRoot":"","sources":["../../src/auth/token-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC5E,OAAO,EACL,SAAS,EACT,UAAU,EACV,SAAS,EACT,YAAY,EACZ,UAAU,EACV,QAAQ,EACR,UAAU,EACV,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,MAAM,oBAAoB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,YAAY;AACxD,MAAM,yBAAyB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,UAAU;AAYtE,MAAM,OAAO,UAAU;IAQH;IAPV,UAAU,GAAqB,IAAI,CAAC;IACpC,aAAa,GAAkB,IAAI,CAAC;IAC3B,UAAU,CAAS;IACnB,UAAU,CAAS;IACnB,OAAO,CAAS;IAEjC,YACkB,SAAiB,EACjC,WAAmB;QADH,cAAS,GAAT,SAAS,CAAQ;QAGjC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;QACrE,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QACtD,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC/C,CAAC;IAED,4EAA4E;IACpE,OAAO;QACb,IAAI,IAAI,CAAC,aAAa;YAAE,OAAO,IAAI,CAAC,aAAa,CAAC;QAElD,SAAS,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7D,SAAS,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAElC,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACpC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,KAAK;gBAAE,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAClE,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;YACvD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YACvC,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;gBACtB,MAAM,IAAI,KAAK,CACb,2BAA2B,IAAI,CAAC,SAAS,uBAAuB,GAAG,CAAC,MAAM,aAAa,IAAI,CAAC,OAAO,uCAAuC,CAC3I,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,aAAa,GAAG,GAAG,CAAC;YACzB,OAAO,GAAG,CAAC;QACb,CAAC;QAED,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC/B,IAAI,CAAC;YACH,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE;gBACrD,IAAI,EAAE,IAAI;gBACV,IAAI,EAAE,KAAK;aACZ,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,uDAAuD;YACvD,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACrD,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;gBACvD,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;gBAChD,OAAO,IAAI,CAAC,aAAa,CAAC;YAC5B,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC;QAC5B,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,OAAO,CAAC,SAAiB;QAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QAC3B,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC3B,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QACtD,IAAI,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QACxD,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACjC,OAAO,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,SAAS,EAAE,CAAC;IAC9C,CAAC;IAEO,OAAO,CAAC,OAAe;QAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QAC3B,MAAM,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC5C,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QAC1D,IAAI,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QAC/D,SAAS,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACpC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,6EAA6E;IACrE,SAAS,CAAC,IAAe;QAC/B,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QACtD,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,UAAU,MAAM,CAAC;QACtC,aAAa,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACjD,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACvB,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QAClC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;IACzB,CAAC;IAED,oEAAoE;IACpE,IAAI;QACF,IAAI,IAAI,CAAC,UAAU;YAAE,OAAO,IAAI,CAAC,UAAU,CAAC;QAC5C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;YAAE,OAAO,IAAI,CAAC;QAC9C,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QAC1D,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAc,CAAC;QAC3C,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CACH,WAAmB,EACnB,YAA2B,EAC3B,gBAAwB,EACxB,SAA6D,EAAE;QAE/D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;QACzD,MAAM,IAAI,GAAc;YACtB,WAAW;YACX,YAAY,EAAE,YAAY,IAAI,QAAQ,EAAE,YAAY,IAAI,IAAI;YAC5D,iBAAiB,EAAE,GAAG,GAAG,gBAAgB,GAAG,IAAI;YAChD,kBAAkB,EAAE,YAAY;gBAC9B,CAAC,CAAC,GAAG,GAAG,yBAAyB;gBACjC,CAAC,CAAC,CAAC,QAAQ,EAAE,kBAAkB,IAAI,GAAG,GAAG,yBAAyB,CAAC;YACrE,WAAW,EAAE,GAAG;YAChB,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,QAAQ,EAAE,WAAW,IAAI,IAAI;YAChE,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,QAAQ,EAAE,MAAM,IAAI,EAAE;SAChD,CAAC;QACF,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,aAAa;QACnB,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC;QACrB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,YAAY;QACV,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC;QACxB,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,iBAAiB,GAAG,oBAAoB,CAAC;IACpE,CAAC;IAED,SAAS;QACP,OAAO,IAAI,CAAC,IAAI,EAAE,KAAK,IAAI,CAAC;IAC9B,CAAC;IAED,mBAAmB;QACjB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC;QACxB,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,kBAAkB,CAAC;IAC9C,CAAC;IAED,KAAK;QACH,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QACvB,IAAI,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;YAAE,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC/D,CAAC;CACF;AAED,kDAAkD;AAClD,MAAM,CAAC,MAAM,kBAAkB,GAAG,oBAAoB,CAAC"}

package/payload/platform/plugins/outlook/mcp/dist/index.d.ts

@@ -0,0 +1,18 @@
+#!/usr/bin/env node
+/**
+ * @maxy/outlook MCP server.
+ *
+ * Read-only Microsoft Graph access for Outlook.com / Microsoft 365 mailboxes.
+ * Admin agent only. Public-agent surface is explicitly excluded.
+ *
+ * Auth: per-account OAuth Auth Code + PKCE. Tokens persist encrypted to
+ *   {ACCOUNTS_DIR}/{accountId}/secrets/outlook/{tokens.enc, .key}
+ *
+ * Required environment:
+ *   ACCOUNT_ID            — provided by getMcpServers when spawned per account.
+ *   PLATFORM_ROOT         — repo root; used to derive ACCOUNTS_DIR.
+ *   OUTLOOK_CLIENT_ID     — Azure AD app (client) ID. Operator-set per install.
+ *   OUTLOOK_TENANT_ID     — Azure tenant ("common" for multi-tenant). Default "common".
+ */
+export {};
+//# sourceMappingURL=index.d.ts.map

package/payload/platform/plugins/outlook/mcp/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;GAcG"}