@rubytech/create-sitedesk-code 0.1.521 → 0.1.522

package/payload/platform/plugins/outlook/mcp/dist/auth/device-flow.d.ts

@@ -99,10 +99,22 @@ export declare class TokenRefreshError extends Error {
     get oauthError(): string | null;
     get statusCode(): number;
 }
+/**
+ * Mint a new access token from a stored refresh token.
+ *
+ * `grantedScopes` is what THIS mailbox actually consented to, read from its
+ * stored blob — never the `SCOPES` constant. A refresh must ask for what was
+ * granted: widening `SCOPES` (Task 2122 added the two `.Shared` scopes) would
+ * otherwise make every already-connected mailbox request consent it never gave,
+ * and an `invalid_grant` answer to that is treated as a revoked grant, which
+ * clears the mailbox's credentials. An empty list omits `scope` entirely, which
+ * is how the token endpoint is told to return the original grant unchanged.
+ */
 export declare function refreshAccessToken(args: {
     clientId: string;
     tenantId: string;
     refreshToken: string;
+    grantedScopes: string[];
 }): Promise<TokenResponse>;
 export declare const _internals: {
     SCOPES: string[];

package/payload/platform/plugins/outlook/mcp/dist/auth/device-flow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"device-flow.d.ts","sourceRoot":"","sources":["../../src/auth/device-flow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAwBH,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAMD,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,MAAM,CAAC;IACxB,uBAAuB,EAAE,MAAM,CAAC;IAChC,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAWD;;;;;GAKG;AACH,wBAAsB,eAAe,CAAC,MAAM,EAAE;IAC5C,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;CAClB,GAAG,OAAO,CAAC,eAAe,CAAC,CA6B3B;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,OAAO,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,EAAE,MAAM,CAAC;IACzB,oFAAoF;IACpF,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB;iFAC6E;IAC7E,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,qFAAqF;IACrF,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,MAAM,WAAW,GACnB;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,GACnB;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,GACrB;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,GACnB;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAClB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,aAAa,EAAE,aAAa,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,GACnE,eAAe,CAAC;AAEpB;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,eAAe,CA6CtF;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,CACnC,MAAM,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,EAC9C,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,WAAW,CAAC,CA+BtB;AAMD;;;;;;;;GAQG;AACH,qBAAa,iBAAkB,SAAQ,KAAK;IAGxC,QAAQ,CAAC,KAAK,EAAE,eAAe;gBAD/B,OAAO,EAAE,MAAM,EACN,KAAK,EAAE,eAAe;IAMjC;6CACyC;IACzC,IAAI,UAAU,IAAI,MAAM,GAAG,IAAI,CAE9B;IAED,IAAI,UAAU,IAAI,MAAM,CAEvB;CACF;AAED,wBAAsB,kBAAkB,CAAC,IAAI,EAAE;IAC7C,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;CACtB,GAAG,OAAO,CAAC,aAAa,CAAC,CAsBzB;AAED,eAAO,MAAM,UAAU;;CAAa,CAAC"}
+{"version":3,"file":"device-flow.d.ts","sourceRoot":"","sources":["../../src/auth/device-flow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AA+BH,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAMD,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,MAAM,CAAC;IACxB,uBAAuB,EAAE,MAAM,CAAC;IAChC,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAWD;;;;;GAKG;AACH,wBAAsB,eAAe,CAAC,MAAM,EAAE;IAC5C,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;CAClB,GAAG,OAAO,CAAC,eAAe,CAAC,CA6B3B;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,OAAO,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,EAAE,MAAM,CAAC;IACzB,oFAAoF;IACpF,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB;iFAC6E;IAC7E,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,qFAAqF;IACrF,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,MAAM,WAAW,GACnB;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,GACnB;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,GACrB;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,GACnB;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAClB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,aAAa,EAAE,aAAa,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,GACnE,eAAe,CAAC;AAEpB;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,eAAe,CA6CtF;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,CACnC,MAAM,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,EAC9C,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,WAAW,CAAC,CA+BtB;AAMD;;;;;;;;GAQG;AACH,qBAAa,iBAAkB,SAAQ,KAAK;IAGxC,QAAQ,CAAC,KAAK,EAAE,eAAe;gBAD/B,OAAO,EAAE,MAAM,EACN,KAAK,EAAE,eAAe;IAMjC;6CACyC;IACzC,IAAI,UAAU,IAAI,MAAM,GAAG,IAAI,CAE9B;IAED,IAAI,UAAU,IAAI,MAAM,CAEvB;CACF;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,kBAAkB,CAAC,IAAI,EAAE;IAC7C,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,EAAE,CAAC;CACzB,GAAG,OAAO,CAAC,aAAa,CAAC,CAwBzB;AAED,eAAO,MAAM,UAAU;;CAAa,CAAC"}

package/payload/platform/plugins/outlook/mcp/dist/auth/device-flow.js

@@ -10,11 +10,18 @@
  * `refreshAccessToken` (used by the read path in graph-client.ts) and the SCOPES
  * set are unchanged from the prior Auth-Code implementation.
  */
+// The two `.Shared` scopes are what make a shared or delegated mailbox
+// reachable at /users/<address>; without them Graph returns 403 even when the
+// signed-in user holds Full Access. They widen only what THIS registration
+// consents to — a mailbox already connected keeps the grant it was given and
+// must be re-registered before it can reach a shared mailbox (Task 2122).
 const SCOPES = [
     "offline_access",
     "User.Read",
     "Mail.ReadWrite",
     "Mail.Send",
+    "Mail.ReadWrite.Shared",
+    "Mail.Send.Shared",
     "Calendars.ReadWrite",
     "Contacts.Read",
 ];
@@ -172,14 +179,27 @@ export class TokenRefreshError extends Error {
         return this.azure.httpStatus;
     }
 }
+/**
+ * Mint a new access token from a stored refresh token.
+ *
+ * `grantedScopes` is what THIS mailbox actually consented to, read from its
+ * stored blob — never the `SCOPES` constant. A refresh must ask for what was
+ * granted: widening `SCOPES` (Task 2122 added the two `.Shared` scopes) would
+ * otherwise make every already-connected mailbox request consent it never gave,
+ * and an `invalid_grant` answer to that is treated as a revoked grant, which
+ * clears the mailbox's credentials. An empty list omits `scope` entirely, which
+ * is how the token endpoint is told to return the original grant unchanged.
+ */
 export async function refreshAccessToken(args) {
     const { tokenUrl } = buildUrls(args.tenantId);
     const params = new URLSearchParams({
         client_id: args.clientId,
-        scope: SCOPES.join(" "),
         refresh_token: args.refreshToken,
         grant_type: "refresh_token",
     });
+    if (args.grantedScopes.length > 0) {
+        params.set("scope", args.grantedScopes.join(" "));
+    }
     const response = await fetch(tokenUrl, {
         method: "POST",
         headers: { "Content-Type": "application/x-www-form-urlencoded" },

package/payload/platform/plugins/outlook/mcp/dist/auth/device-flow.js.map

@@ -1 +1 @@
-{"version":3,"file":"device-flow.js","sourceRoot":"","sources":["../../src/auth/device-flow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,MAAM,MAAM,GAAG;IACb,gBAAgB;IAChB,WAAW;IACX,gBAAgB;IAChB,WAAW;IACX,qBAAqB;IACrB,eAAe;CAChB,CAAC;AAOF,SAAS,SAAS,CAAC,QAAgB;IACjC,MAAM,MAAM,GAAG,QAAQ,IAAI,QAAQ,CAAC;IACpC,OAAO;QACL,YAAY,EAAE,qCAAqC,MAAM,wBAAwB;QACjF,QAAQ,EAAE,qCAAqC,MAAM,oBAAoB;KAC1E,CAAC;AACJ,CAAC;AAiCD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,MAGrC;IACC,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,IAAI,QAAQ,CAAC;IAC3C,MAAM,GAAG,GAAG,qCAAqC,MAAM,yBAAyB,CAAC;IACjF,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QACjC,SAAS,EAAE,MAAM,CAAC,QAAQ;QAC1B,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;KACxB,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAChC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE;KACxB,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,+BAA+B,QAAQ,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAuB,CAAC;IAC3D,MAAM,uBAAuB,GAC3B,IAAI,CAAC,yBAAyB;QAC9B,GAAG,IAAI,CAAC,gBAAgB,QAAQ,IAAI,CAAC,SAAS,EAAE,CAAC;IACnD,OAAO;QACL,UAAU,EAAE,IAAI,CAAC,WAAW;QAC5B,QAAQ,EAAE,IAAI,CAAC,SAAS;QACxB,eAAe,EAAE,IAAI,CAAC,gBAAgB;QACtC,uBAAuB;QACvB,YAAY,EAAE,IAAI,CAAC,UAAU;QAC7B,WAAW,EAAE,IAAI,CAAC,QAAQ;QAC1B,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC;KACpB,CAAC;AACJ,CAAC;AA2BD;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,UAAkB,EAAE,IAAY;IACnE,IAAI,KAAK,GAAG,EAAE,CAAC;IACf,IAAI,gBAAgB,GAAG,EAAE,CAAC;IAC1B,IAAI,QAAQ,GAAkB,IAAI,CAAC;IACnC,IAAI,aAAa,GAAkB,IAAI,CAAC;IACxC,IAAI,OAAO,GAAkB,IAAI,CAAC;IAClC,IAAI,SAAS,GAAkB,IAAI,CAAC;IACpC,IAAI,MAAM,GAAkB,IAAI,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAQxB,CAAC;QACF,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACtB,gBAAgB,GAAG,CAAC,CAAC,iBAAiB,IAAI,EAAE,CAAC;QAC7C,QAAQ,GAAG,CAAC,CAAC,QAAQ,IAAI,IAAI,CAAC;QAC9B,aAAa,GAAG,CAAC,CAAC,cAAc,IAAI,IAAI,CAAC;QACzC,OAAO,GAAG,CAAC,CAAC,QAAQ,IAAI,IAAI,CAAC;QAC7B,SAAS,GAAG,CAAC,CAAC,SAAS,IAAI,IAAI,CAAC;QAChC,IAAI,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,GAAG,SAAS,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;IACtF,CAAC;IAAC,MAAM,CAAC;QACP,+EAA+E;QAC/E,+DAA+D;IACjE,CAAC;IACD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,gBAAgB,IAAI,IAAI,CAAC,CAAC;QACrD,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3B,CAAC;IACD,OAAO;QACL,IAAI,EAAE,OAAO;QACb,UAAU;QACV,KAAK;QACL,gBAAgB;QAChB,MAAM;QACN,QAAQ;QACR,aAAa;QACb,OAAO;QACP,SAAS;QACT,GAAG,EAAE,IAAI;KACV,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAA8C,EAC9C,UAAkB;IAElB,MAAM,EAAE,QAAQ,EAAE,GAAG,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QACjC,SAAS,EAAE,MAAM,CAAC,QAAQ;QAC1B,UAAU,EAAE,8CAA8C;QAC1D,WAAW,EAAE,UAAU;KACxB,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE;QACrC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE;KACxB,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;QAChB,MAAM,aAAa,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAkB,CAAC;QAC/D,MAAM,MAAM,GAAG,CAAC,aAAa,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACtE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC;IACpD,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,MAAM,MAAM,GAAG,oBAAoB,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC3D,QAAQ,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,KAAK,uBAAuB;YAC1B,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAC7B,KAAK,WAAW;YACd,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;QAC/B,KAAK,eAAe;YAClB,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAC7B,KAAK,eAAe;YAClB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QAC5B;YACE,OAAO,MAAM,CAAC;IAClB,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,uEAAuE;AACvE,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAG/B;IAFX,YACE,OAAe,EACN,KAAsB;QAE/B,KAAK,CAAC,OAAO,CAAC,CAAC;QAFN,UAAK,GAAL,KAAK,CAAiB;QAG/B,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;IAED;6CACyC;IACzC,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC;IAClC,CAAC;IAED,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;IAC/B,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAIxC;IACC,MAAM,EAAE,QAAQ,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QACjC,SAAS,EAAE,IAAI,CAAC,QAAQ;QACxB,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;QACvB,aAAa,EAAE,IAAI,CAAC,YAAY;QAChC,UAAU,EAAE,eAAe;KAC5B,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE;QACrC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE;KACxB,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,IAAI,iBAAiB,CACzB,yBAAyB,QAAQ,CAAC,MAAM,MAAM,IAAI,EAAE,EACpD,oBAAoB,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAC5C,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAkB,CAAC;AAClD,CAAC;AAED,MAAM,CAAC,MAAM,UAAU,GAAG,EAAE,MAAM,EAAE,CAAC"}
+{"version":3,"file":"device-flow.js","sourceRoot":"","sources":["../../src/auth/device-flow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,uEAAuE;AACvE,8EAA8E;AAC9E,2EAA2E;AAC3E,6EAA6E;AAC7E,0EAA0E;AAC1E,MAAM,MAAM,GAAG;IACb,gBAAgB;IAChB,WAAW;IACX,gBAAgB;IAChB,WAAW;IACX,uBAAuB;IACvB,kBAAkB;IAClB,qBAAqB;IACrB,eAAe;CAChB,CAAC;AAOF,SAAS,SAAS,CAAC,QAAgB;IACjC,MAAM,MAAM,GAAG,QAAQ,IAAI,QAAQ,CAAC;IACpC,OAAO;QACL,YAAY,EAAE,qCAAqC,MAAM,wBAAwB;QACjF,QAAQ,EAAE,qCAAqC,MAAM,oBAAoB;KAC1E,CAAC;AACJ,CAAC;AAiCD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,MAGrC;IACC,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,IAAI,QAAQ,CAAC;IAC3C,MAAM,GAAG,GAAG,qCAAqC,MAAM,yBAAyB,CAAC;IACjF,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QACjC,SAAS,EAAE,MAAM,CAAC,QAAQ;QAC1B,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;KACxB,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAChC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE;KACxB,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,+BAA+B,QAAQ,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAuB,CAAC;IAC3D,MAAM,uBAAuB,GAC3B,IAAI,CAAC,yBAAyB;QAC9B,GAAG,IAAI,CAAC,gBAAgB,QAAQ,IAAI,CAAC,SAAS,EAAE,CAAC;IACnD,OAAO;QACL,UAAU,EAAE,IAAI,CAAC,WAAW;QAC5B,QAAQ,EAAE,IAAI,CAAC,SAAS;QACxB,eAAe,EAAE,IAAI,CAAC,gBAAgB;QACtC,uBAAuB;QACvB,YAAY,EAAE,IAAI,CAAC,UAAU;QAC7B,WAAW,EAAE,IAAI,CAAC,QAAQ;QAC1B,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC;KACpB,CAAC;AACJ,CAAC;AA2BD;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,UAAkB,EAAE,IAAY;IACnE,IAAI,KAAK,GAAG,EAAE,CAAC;IACf,IAAI,gBAAgB,GAAG,EAAE,CAAC;IAC1B,IAAI,QAAQ,GAAkB,IAAI,CAAC;IACnC,IAAI,aAAa,GAAkB,IAAI,CAAC;IACxC,IAAI,OAAO,GAAkB,IAAI,CAAC;IAClC,IAAI,SAAS,GAAkB,IAAI,CAAC;IACpC,IAAI,MAAM,GAAkB,IAAI,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAQxB,CAAC;QACF,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACtB,gBAAgB,GAAG,CAAC,CAAC,iBAAiB,IAAI,EAAE,CAAC;QAC7C,QAAQ,GAAG,CAAC,CAAC,QAAQ,IAAI,IAAI,CAAC;QAC9B,aAAa,GAAG,CAAC,CAAC,cAAc,IAAI,IAAI,CAAC;QACzC,OAAO,GAAG,CAAC,CAAC,QAAQ,IAAI,IAAI,CAAC;QAC7B,SAAS,GAAG,CAAC,CAAC,SAAS,IAAI,IAAI,CAAC;QAChC,IAAI,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,GAAG,SAAS,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;IACtF,CAAC;IAAC,MAAM,CAAC;QACP,+EAA+E;QAC/E,+DAA+D;IACjE,CAAC;IACD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,gBAAgB,IAAI,IAAI,CAAC,CAAC;QACrD,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3B,CAAC;IACD,OAAO;QACL,IAAI,EAAE,OAAO;QACb,UAAU;QACV,KAAK;QACL,gBAAgB;QAChB,MAAM;QACN,QAAQ;QACR,aAAa;QACb,OAAO;QACP,SAAS;QACT,GAAG,EAAE,IAAI;KACV,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAA8C,EAC9C,UAAkB;IAElB,MAAM,EAAE,QAAQ,EAAE,GAAG,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QACjC,SAAS,EAAE,MAAM,CAAC,QAAQ;QAC1B,UAAU,EAAE,8CAA8C;QAC1D,WAAW,EAAE,UAAU;KACxB,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE;QACrC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE;KACxB,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;QAChB,MAAM,aAAa,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAkB,CAAC;QAC/D,MAAM,MAAM,GAAG,CAAC,aAAa,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACtE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC;IACpD,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,MAAM,MAAM,GAAG,oBAAoB,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC3D,QAAQ,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,KAAK,uBAAuB;YAC1B,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAC7B,KAAK,WAAW;YACd,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;QAC/B,KAAK,eAAe;YAClB,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAC7B,KAAK,eAAe;YAClB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QAC5B;YACE,OAAO,MAAM,CAAC;IAClB,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,uEAAuE;AACvE,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAG/B;IAFX,YACE,OAAe,EACN,KAAsB;QAE/B,KAAK,CAAC,OAAO,CAAC,CAAC;QAFN,UAAK,GAAL,KAAK,CAAiB;QAG/B,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;IAED;6CACyC;IACzC,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC;IAClC,CAAC;IAED,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;IAC/B,CAAC;CACF;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAKxC;IACC,MAAM,EAAE,QAAQ,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QACjC,SAAS,EAAE,IAAI,CAAC,QAAQ;QACxB,aAAa,EAAE,IAAI,CAAC,YAAY;QAChC,UAAU,EAAE,eAAe;KAC5B,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE;QACrC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE;KACxB,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,IAAI,iBAAiB,CACzB,yBAAyB,QAAQ,CAAC,MAAM,MAAM,IAAI,EAAE,EACpD,oBAAoB,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAC5C,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAkB,CAAC;AAClD,CAAC;AAED,MAAM,CAAC,MAAM,UAAU,GAAG,EAAE,MAAM,EAAE,CAAC"}

package/payload/platform/plugins/outlook/mcp/dist/auth/mailbox-registry.d.ts

@@ -53,6 +53,12 @@ export type ResolveResult = {
     kind: "ok";
     store: TokenStore;
     descriptor: MailboxDescriptor;
+    /** "/me" for a signed-in mailbox, "/users/<encoded address>" for a delegated one. */
+    pathPrefix: string;
+    /** The delegator's identity when this is a delegated mailbox, else null. */
+    via: string | null;
+    /** The delegated address when this is a delegated mailbox, else null. */
+    delegatedAddress: string | null;
 } | {
     kind: "none";
 } | {
@@ -62,12 +68,27 @@ export type ResolveResult = {
     kind: "notfound";
     selector: string;
     identities: string[];
+}
+/** A shared mailbox is attached, but the mailbox that delegates for it is no
+ * longer connected. Distinct from `notfound` because the record exists and
+ * the remedy is different: re-register the delegator, or drop the record. */
+ | {
+    kind: "delegator-missing";
+    selector: string;
+    via: string;
 };
 export interface CredResolveEvent {
     event: "cred-resolve";
     account: string;
     mailbox: string;
     source: "arg" | "sole" | "none" | "refused";
+    /** Whether the call runs against the operator's own mailbox or through a
+     * delegation. Without it, a delegated call is indistinguishable in the log
+     * from a signed-in one, which is exactly the difference that matters when a
+     * shared mailbox stops answering. */
+    kind: "signed-in" | "delegated";
+    /** The delegator's identity on a delegated resolution, else "". */
+    via: string;
 }
 /**
  * The observability line for a resolution: names the *resolved* mailbox and how
@@ -82,6 +103,7 @@ export declare class MailboxRegistry {
     private readonly secretsDir;
     private readonly mailboxesDir;
     private readonly legacyTokensPath;
+    private readonly delegatedStore;
     constructor(accountId: string, accountsDir: string);
     /**
      * Move a pre-migration `secrets/outlook/tokens.enc` into
@@ -94,12 +116,21 @@ export declare class MailboxRegistry {
     list(): MailboxDescriptor[];
     private describe;
     /**
-     * Resolve a mailbox selector to a TokenStore. Order: explicit selector
-     * (matched against graphUserId or mail, case-insensitive) → the sole readable
-     * mailbox → ambiguous (≥2 readable, none named) → none (zero readable).
-     * Unreadable mailboxes are never addressable.
+     * Resolve a mailbox selector to a TokenStore and the Graph path prefix that
+     * addresses it. Order: an explicit selector against the signed-in mailboxes
+     * (graphUserId or mail, case-insensitive) → the same selector against the
+     * delegated records → the sole readable signed-in mailbox → ambiguous (≥2
+     * attached, none named) → none. Unreadable mailboxes are never addressable.
+     *
+     * Delegated records deliberately take part in NEITHER the sole-mailbox
+     * default nor the ambiguity count. Attaching a shared mailbox must not change
+     * what a bare call means, or every existing tool call on a single-mailbox
+     * account would start refusing the moment a shared mailbox was added.
      */
     resolve(selector?: string): ResolveResult;
+    /** Every selectable identity on this account, signed-in and delegated, so a
+     * refusal is honest about what IS attached rather than listing half of it. */
+    private identities;
     /** A TokenStore for a specific mailbox key (a graphUserId at register time, or
      * a descriptor's mailboxKey). Overwrites that mailbox in place on store(). */
     storeFor(mailboxKey: string): TokenStore;

package/payload/platform/plugins/outlook/mcp/dist/auth/mailbox-registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mailbox-registry.d.ts","sourceRoot":"","sources":["../../src/auth/mailbox-registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,OAAO,EAAE,UAAU,EAAsB,MAAM,kBAAkB,CAAC;AAElE;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,aAAa,GAAG,YAAY,GAAG,aAAa,GAAG,iBAAiB,GAAG,IAAI,CAAC;AAEpF,MAAM,WAAW,iBAAiB;IAChC,sEAAsE;IACtE,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,cAAc,EAAE,OAAO,CAAC;IACxB,6EAA6E;IAC7E,QAAQ,EAAE,OAAO,CAAC;IAClB,2EAA2E;IAC3E,MAAM,EAAE,aAAa,CAAC;CACvB;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE;IAC/B,QAAQ,EAAE,OAAO,CAAC;IAClB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,cAAc,EAAE,OAAO,CAAC;CACzB,GAAG,aAAa,CAKhB;AAED,MAAM,MAAM,aAAa,GACrB;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,UAAU,CAAC;IAAC,UAAU,EAAE,iBAAiB,CAAA;CAAE,GAChE;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAChB;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,UAAU,EAAE,MAAM,EAAE,CAAA;CAAE,GAC3C;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAUjE,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,cAAc,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;CAC7C;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,aAAa,EACvB,OAAO,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,MAAM,GAChB,gBAAgB,CAalB;AAED,qBAAa,eAAe;aAMR,SAAS,EAAE,MAAM;IACjC,OAAO,CAAC,QAAQ,CAAC,WAAW;IAN9B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAS;gBAGxB,SAAS,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM;IAOtC;;;;;OAKG;IACH,OAAO,CAAC,aAAa;IA4BrB,8EAA8E;IAC9E,IAAI,IAAI,iBAAiB,EAAE;IAa3B,OAAO,CAAC,QAAQ;IAuBhB;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,aAAa;IA8BzC;kFAC8E;IAC9E,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,UAAU;CAGzC"}
+{"version":3,"file":"mailbox-registry.d.ts","sourceRoot":"","sources":["../../src/auth/mailbox-registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,OAAO,EAAE,UAAU,EAAsB,MAAM,kBAAkB,CAAC;AAIlE;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,aAAa,GAAG,YAAY,GAAG,aAAa,GAAG,iBAAiB,GAAG,IAAI,CAAC;AAEpF,MAAM,WAAW,iBAAiB;IAChC,sEAAsE;IACtE,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,cAAc,EAAE,OAAO,CAAC;IACxB,6EAA6E;IAC7E,QAAQ,EAAE,OAAO,CAAC;IAClB,2EAA2E;IAC3E,MAAM,EAAE,aAAa,CAAC;CACvB;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE;IAC/B,QAAQ,EAAE,OAAO,CAAC;IAClB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,cAAc,EAAE,OAAO,CAAC;CACzB,GAAG,aAAa,CAKhB;AAED,MAAM,MAAM,aAAa,GACrB;IACE,IAAI,EAAE,IAAI,CAAC;IACX,KAAK,EAAE,UAAU,CAAC;IAClB,UAAU,EAAE,iBAAiB,CAAC;IAC9B,qFAAqF;IACrF,UAAU,EAAE,MAAM,CAAC;IACnB,4EAA4E;IAC5E,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,yEAAyE;IACzE,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC,GACD;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAChB;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,UAAU,EAAE,MAAM,EAAE,CAAA;CAAE,GAC3C;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,EAAE,CAAA;CAAE;AAC9D;;6EAE6E;GAC3E;IAAE,IAAI,EAAE,mBAAmB,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC;AAUjE,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,cAAc,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;IAC5C;;;yCAGqC;IACrC,IAAI,EAAE,WAAW,GAAG,WAAW,CAAC;IAChC,mEAAmE;IACnE,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,aAAa,EACvB,OAAO,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,MAAM,GAChB,gBAAgB,CA0ClB;AAED,qBAAa,eAAe;aAOR,SAAS,EAAE,MAAM;IACjC,OAAO,CAAC,QAAQ,CAAC,WAAW;IAP9B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAS;IAC1C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAiB;gBAG9B,SAAS,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM;IAQtC;;;;;OAKG;IACH,OAAO,CAAC,aAAa;IA4BrB,8EAA8E;IAC9E,IAAI,IAAI,iBAAiB,EAAE;IAa3B,OAAO,CAAC,QAAQ;IAuBhB;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,aAAa;IAiEzC;kFAC8E;IAC9E,OAAO,CAAC,UAAU;IAOlB;kFAC8E;IAC9E,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,UAAU;CAGzC"}

package/payload/platform/plugins/outlook/mcp/dist/auth/mailbox-registry.js

@@ -14,6 +14,8 @@
 import { existsSync, mkdirSync, readdirSync, renameSync, unlinkSync } from "node:fs";
 import { join } from "node:path";
 import { TokenStore, sanitizeMailboxKey } from "./token-store.js";
+import { DelegatedStore, normalizeAddress } from "./delegated-store.js";
+import { OWN_MAILBOX_PREFIX, sharedMailboxPrefix } from "../lib/graph-client.js";
 /**
  * Classify a mailbox's usability from its readable/mail/refresh facts. Pure and
  * total, evaluated in precedence order so the most blocking condition wins:
@@ -48,14 +50,43 @@ export function credResolveEvent(resolved, account, selector) {
         return {
             event: "cred-resolve",
             account,
-            mailbox: identityOf(resolved.descriptor),
+            mailbox: resolved.delegatedAddress ?? identityOf(resolved.descriptor),
             source: selector ? "arg" : "sole",
+            kind: resolved.delegatedAddress ? "delegated" : "signed-in",
+            via: resolved.via ?? "",
         };
     }
     if (resolved.kind === "none") {
-        return { event: "cred-resolve", account, mailbox: "", source: "none" };
+        return {
+            event: "cred-resolve",
+            account,
+            mailbox: "",
+            source: "none",
+            kind: "signed-in",
+            via: "",
+        };
     }
-    return { event: "cred-resolve", account, mailbox: selector ?? "", source: "refused" };
+    if (resolved.kind === "delegator-missing") {
+        // The one refusal these two fields exist to diagnose. Labelling it
+        // signed-in with no delegator would hide exactly the fact the operator
+        // needs: which mailbox was supposed to reach this shared one.
+        return {
+            event: "cred-resolve",
+            account,
+            mailbox: resolved.selector,
+            source: "refused",
+            kind: "delegated",
+            via: resolved.via,
+        };
+    }
+    return {
+        event: "cred-resolve",
+        account,
+        mailbox: selector ?? "",
+        source: "refused",
+        kind: "signed-in",
+        via: "",
+    };
 }
 export class MailboxRegistry {
     accountId;
@@ -63,12 +94,14 @@ export class MailboxRegistry {
     secretsDir;
     mailboxesDir;
     legacyTokensPath;
+    delegatedStore;
     constructor(accountId, accountsDir) {
         this.accountId = accountId;
         this.accountsDir = accountsDir;
         this.secretsDir = join(accountsDir, accountId, "secrets", "outlook");
         this.mailboxesDir = join(this.secretsDir, "mailboxes");
         this.legacyTokensPath = join(this.secretsDir, "tokens.enc");
+        this.delegatedStore = new DelegatedStore(accountId, accountsDir);
     }
     /**
      * Move a pre-migration `secrets/outlook/tokens.enc` into
@@ -149,22 +182,56 @@ export class MailboxRegistry {
         }
     }
     /**
-     * Resolve a mailbox selector to a TokenStore. Order: explicit selector
-     * (matched against graphUserId or mail, case-insensitive) → the sole readable
-     * mailbox → ambiguous (≥2 readable, none named) → none (zero readable).
-     * Unreadable mailboxes are never addressable.
+     * Resolve a mailbox selector to a TokenStore and the Graph path prefix that
+     * addresses it. Order: an explicit selector against the signed-in mailboxes
+     * (graphUserId or mail, case-insensitive) → the same selector against the
+     * delegated records → the sole readable signed-in mailbox → ambiguous (≥2
+     * attached, none named) → none. Unreadable mailboxes are never addressable.
+     *
+     * Delegated records deliberately take part in NEITHER the sole-mailbox
+     * default nor the ambiguity count. Attaching a shared mailbox must not change
+     * what a bare call means, or every existing tool call on a single-mailbox
+     * account would start refusing the moment a shared mailbox was added.
      */
     resolve(selector) {
         const all = this.list();
         const addressable = all.filter((d) => d.readable);
+        const delegated = this.delegatedStore.read();
         if (selector) {
             const needle = selector.toLowerCase();
             const match = addressable.find((d) => d.graphUserId?.toLowerCase() === needle ||
                 d.mail?.toLowerCase() === needle);
             if (match) {
-                return { kind: "ok", store: this.storeFor(match.mailboxKey), descriptor: match };
+                return {
+                    kind: "ok",
+                    store: this.storeFor(match.mailboxKey),
+                    descriptor: match,
+                    pathPrefix: OWN_MAILBOX_PREFIX,
+                    via: null,
+                    delegatedAddress: null,
+                };
             }
-            return { kind: "notfound", selector, identities: all.map(identityOf) };
+            const address = normalizeAddress(selector);
+            // Own-property check, not a bare index: a plain object answers
+            // "constructor" or "toString" with an inherited function, which would
+            // read as an attached delegated record and refuse with a confabulated
+            // "attached through a mailbox that is no longer connected".
+            const entry = Object.hasOwn(delegated, address) ? delegated[address] : undefined;
+            if (entry) {
+                const delegator = addressable.find((d) => d.mailboxKey === entry.viaMailboxKey);
+                if (!delegator) {
+                    return { kind: "delegator-missing", selector: address, via: entry.viaMailboxKey };
+                }
+                return {
+                    kind: "ok",
+                    store: this.storeFor(delegator.mailboxKey),
+                    descriptor: delegator,
+                    pathPrefix: sharedMailboxPrefix(address),
+                    via: identityOf(delegator),
+                    delegatedAddress: address,
+                };
+            }
+            return { kind: "notfound", selector, identities: this.identities(all, delegated) };
         }
         // Ambiguity is decided by the number of mailboxes *attached* (readable or
         // not), never the readable subset. If a second mailbox is transiently
@@ -174,11 +241,26 @@ export class MailboxRegistry {
             return { kind: "none" };
         if (all.length === 1) {
             return addressable.length === 1
-                ? { kind: "ok", store: this.storeFor(addressable[0].mailboxKey), descriptor: addressable[0] }
+                ? {
+                    kind: "ok",
+                    store: this.storeFor(addressable[0].mailboxKey),
+                    descriptor: addressable[0],
+                    pathPrefix: OWN_MAILBOX_PREFIX,
+                    via: null,
+                    delegatedAddress: null,
+                }
                 : { kind: "none" };
         }
         return { kind: "ambiguous", identities: all.map(identityOf) };
     }
+    /** Every selectable identity on this account, signed-in and delegated, so a
+     * refusal is honest about what IS attached rather than listing half of it. */
+    identities(all, delegated) {
+        return [
+            ...all.map(identityOf),
+            ...Object.keys(delegated).map((address) => `${address} (delegated)`),
+        ];
+    }
     /** A TokenStore for a specific mailbox key (a graphUserId at register time, or
      * a descriptor's mailboxKey). Overwrites that mailbox in place on store(). */
     storeFor(mailboxKey) {

package/payload/platform/plugins/outlook/mcp/dist/auth/mailbox-registry.js.map

@@ -1 +1 @@
-{"version":3,"file":"mailbox-registry.js","sourceRoot":"","sources":["../../src/auth/mailbox-registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrF,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AA8BlE;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,CAI7B;IACC,IAAI,CAAC,CAAC,CAAC,QAAQ;QAAE,OAAO,YAAY,CAAC;IACrC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,aAAa,CAAC;IAC1D,IAAI,CAAC,CAAC,cAAc;QAAE,OAAO,iBAAiB,CAAC;IAC/C,OAAO,IAAI,CAAC;AACd,CAAC;AAQD;;wEAEwE;AACxE,SAAS,UAAU,CAAC,CAAoB;IACtC,IAAI,CAAC,CAAC,CAAC,QAAQ;QAAE,OAAO,GAAG,CAAC,CAAC,UAAU,eAAe,CAAC;IACvD,OAAO,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,UAAU,CAAC;AACjD,CAAC;AASD;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAC9B,QAAuB,EACvB,OAAe,EACf,QAAiB;IAEjB,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QAC3B,OAAO;YACL,KAAK,EAAE,cAAc;YACrB,OAAO;YACP,OAAO,EAAE,UAAU,CAAC,QAAQ,CAAC,UAAU,CAAC;YACxC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM;SAClC,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC7B,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACzE,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AACxF,CAAC;AAED,MAAM,OAAO,eAAe;IAMR;IACC;IANF,UAAU,CAAS;IACnB,YAAY,CAAS;IACrB,gBAAgB,CAAS;IAE1C,YACkB,SAAiB,EAChB,WAAmB;QADpB,cAAS,GAAT,SAAS,CAAQ;QAChB,gBAAW,GAAX,WAAW,CAAQ;QAEpC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;QACrE,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;QACvD,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAC9D,CAAC;IAED;;;;;OAKG;IACK,aAAa;QACnB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,gBAAgB,CAAC;YAAE,OAAO;QAC/C,IAAI,GAAG,GAAG,SAAS,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,CAAC;YACrE,IAAI,IAAI,EAAE,WAAW;gBAAE,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC;QAChD,CAAC;QAAC,MAAM,CAAC;YACP,uEAAuE;YACvE,4EAA4E;YAC5E,GAAG,GAAG,mBAAmB,CAAC;QAC5B,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC;QACjE,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QAC7C,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACrD,IAAI,CAAC;YACH,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACzB,yEAAyE;gBACzE,UAAU,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;YACpC,CAAC;iBAAM,CAAC;gBACN,UAAU,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,sEAAsE;YACtE,4EAA4E;YAC5E,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,GAAG,CAAC;QAClE,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,IAAI;QACF,IAAI,CAAC,aAAa,EAAE,CAAC;QACrB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC;YAAE,OAAO,EAAE,CAAC;QAC9C,MAAM,GAAG,GAAwB,EAAE,CAAC;QACpC,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YAC5E,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE;gBAAE,SAAS;YACnC,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC;YAC9B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC;gBAAE,SAAS;YAC7E,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;QACtC,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAEO,QAAQ,CAAC,UAAkB;QACjC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;QAC3E,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;YAC1B,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;YACpJ,CAAC;YACD,MAAM,cAAc,GAAG,KAAK,CAAC,mBAAmB,EAAE,CAAC;YACnD,OAAO;gBACL,UAAU;gBACV,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;gBACtD,cAAc;gBACd,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,aAAa,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,cAAc,EAAE,CAAC;aAC3E,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;QACpJ,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,OAAO,CAAC,QAAiB;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACxB,MAAM,WAAW,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAElD,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;YACtC,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAC5B,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,MAAM;gBACvC,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,MAAM,CACnC,CAAC;YACF,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;YACnF,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;QACzE,CAAC;QAED,0EAA0E;QAC1E,sEAAsE;QACtE,2EAA2E;QAC3E,yEAAyE;QACzE,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAC9C,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrB,OAAO,WAAW,CAAC,MAAM,KAAK,CAAC;gBAC7B,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE;gBAC7F,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QACvB,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;IAChE,CAAC;IAED;kFAC8E;IAC9E,QAAQ,CAAC,UAAkB;QACzB,OAAO,IAAI,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;IACtE,CAAC;CACF"}
+{"version":3,"file":"mailbox-registry.js","sourceRoot":"","sources":["../../src/auth/mailbox-registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrF,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAqB,MAAM,sBAAsB,CAAC;AAC3F,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AA8BjF;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,CAI7B;IACC,IAAI,CAAC,CAAC,CAAC,QAAQ;QAAE,OAAO,YAAY,CAAC;IACrC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,aAAa,CAAC;IAC1D,IAAI,CAAC,CAAC,cAAc;QAAE,OAAO,iBAAiB,CAAC;IAC/C,OAAO,IAAI,CAAC;AACd,CAAC;AAsBD;;wEAEwE;AACxE,SAAS,UAAU,CAAC,CAAoB;IACtC,IAAI,CAAC,CAAC,CAAC,QAAQ;QAAE,OAAO,GAAG,CAAC,CAAC,UAAU,eAAe,CAAC;IACvD,OAAO,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,UAAU,CAAC;AACjD,CAAC;AAgBD;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAC9B,QAAuB,EACvB,OAAe,EACf,QAAiB;IAEjB,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QAC3B,OAAO;YACL,KAAK,EAAE,cAAc;YACrB,OAAO;YACP,OAAO,EAAE,QAAQ,CAAC,gBAAgB,IAAI,UAAU,CAAC,QAAQ,CAAC,UAAU,CAAC;YACrE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM;YACjC,IAAI,EAAE,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW;YAC3D,GAAG,EAAE,QAAQ,CAAC,GAAG,IAAI,EAAE;SACxB,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC7B,OAAO;YACL,KAAK,EAAE,cAAc;YACrB,OAAO;YACP,OAAO,EAAE,EAAE;YACX,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,WAAW;YACjB,GAAG,EAAE,EAAE;SACR,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;QAC1C,mEAAmE;QACnE,uEAAuE;QACvE,8DAA8D;QAC9D,OAAO;YACL,KAAK,EAAE,cAAc;YACrB,OAAO;YACP,OAAO,EAAE,QAAQ,CAAC,QAAQ;YAC1B,MAAM,EAAE,SAAS;YACjB,IAAI,EAAE,WAAW;YACjB,GAAG,EAAE,QAAQ,CAAC,GAAG;SAClB,CAAC;IACJ,CAAC;IACD,OAAO;QACL,KAAK,EAAE,cAAc;QACrB,OAAO;QACP,OAAO,EAAE,QAAQ,IAAI,EAAE;QACvB,MAAM,EAAE,SAAS;QACjB,IAAI,EAAE,WAAW;QACjB,GAAG,EAAE,EAAE;KACR,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,eAAe;IAOR;IACC;IAPF,UAAU,CAAS;IACnB,YAAY,CAAS;IACrB,gBAAgB,CAAS;IACzB,cAAc,CAAiB;IAEhD,YACkB,SAAiB,EAChB,WAAmB;QADpB,cAAS,GAAT,SAAS,CAAQ;QAChB,gBAAW,GAAX,WAAW,CAAQ;QAEpC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;QACrE,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;QACvD,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QAC5D,IAAI,CAAC,cAAc,GAAG,IAAI,cAAc,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IACnE,CAAC;IAED;;;;;OAKG;IACK,aAAa;QACnB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,gBAAgB,CAAC;YAAE,OAAO;QAC/C,IAAI,GAAG,GAAG,SAAS,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,CAAC;YACrE,IAAI,IAAI,EAAE,WAAW;gBAAE,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC;QAChD,CAAC;QAAC,MAAM,CAAC;YACP,uEAAuE;YACvE,4EAA4E;YAC5E,GAAG,GAAG,mBAAmB,CAAC;QAC5B,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC;QACjE,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QAC7C,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACrD,IAAI,CAAC;YACH,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACzB,yEAAyE;gBACzE,UAAU,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;YACpC,CAAC;iBAAM,CAAC;gBACN,UAAU,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,sEAAsE;YACtE,4EAA4E;YAC5E,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,GAAG,CAAC;QAClE,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,IAAI;QACF,IAAI,CAAC,aAAa,EAAE,CAAC;QACrB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC;YAAE,OAAO,EAAE,CAAC;QAC9C,MAAM,GAAG,GAAwB,EAAE,CAAC;QACpC,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YAC5E,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE;gBAAE,SAAS;YACnC,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC;YAC9B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC;gBAAE,SAAS;YAC7E,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;QACtC,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAEO,QAAQ,CAAC,UAAkB;QACjC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;QAC3E,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;YAC1B,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;YACpJ,CAAC;YACD,MAAM,cAAc,GAAG,KAAK,CAAC,mBAAmB,EAAE,CAAC;YACnD,OAAO;gBACL,UAAU;gBACV,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;gBACtD,cAAc;gBACd,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,aAAa,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,cAAc,EAAE,CAAC;aAC3E,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;QACpJ,CAAC;IACH,CAAC;IAED;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,QAAiB;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACxB,MAAM,WAAW,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAClD,MAAM,SAAS,GAAiB,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QAE3D,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;YACtC,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAC5B,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,MAAM;gBACvC,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,MAAM,CACnC,CAAC;YACF,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO;oBACL,IAAI,EAAE,IAAI;oBACV,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC;oBACtC,UAAU,EAAE,KAAK;oBACjB,UAAU,EAAE,kBAAkB;oBAC9B,GAAG,EAAE,IAAI;oBACT,gBAAgB,EAAE,IAAI;iBACvB,CAAC;YACJ,CAAC;YACD,MAAM,OAAO,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;YAC3C,+DAA+D;YAC/D,sEAAsE;YACtE,sEAAsE;YACtE,4DAA4D;YAC5D,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACjF,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,KAAK,CAAC,aAAa,CAAC,CAAC;gBAChF,IAAI,CAAC,SAAS,EAAE,CAAC;oBACf,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC;gBACpF,CAAC;gBACD,OAAO;oBACL,IAAI,EAAE,IAAI;oBACV,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,UAAU,CAAC;oBAC1C,UAAU,EAAE,SAAS;oBACrB,UAAU,EAAE,mBAAmB,CAAC,OAAO,CAAC;oBACxC,GAAG,EAAE,UAAU,CAAC,SAAS,CAAC;oBAC1B,gBAAgB,EAAE,OAAO;iBAC1B,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,CAAC;QACrF,CAAC;QAED,0EAA0E;QAC1E,sEAAsE;QACtE,2EAA2E;QAC3E,yEAAyE;QACzE,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAC9C,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrB,OAAO,WAAW,CAAC,MAAM,KAAK,CAAC;gBAC7B,CAAC,CAAC;oBACE,IAAI,EAAE,IAAI;oBACV,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;oBAC/C,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC;oBAC1B,UAAU,EAAE,kBAAkB;oBAC9B,GAAG,EAAE,IAAI;oBACT,gBAAgB,EAAE,IAAI;iBACvB;gBACH,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QACvB,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;IAChE,CAAC;IAED;kFAC8E;IACtE,UAAU,CAAC,GAAwB,EAAE,SAAuB;QAClE,OAAO;YACL,GAAG,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC;YACtB,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,OAAO,cAAc,CAAC;SACrE,CAAC;IACJ,CAAC;IAED;kFAC8E;IAC9E,QAAQ,CAAC,UAAkB;QACzB,OAAO,IAAI,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;IACtE,CAAC;CACF"}

package/payload/platform/plugins/outlook/mcp/dist/index.js

@@ -21,6 +21,9 @@ import { z } from "zod";
 import { TokenStore } from "./auth/token-store.js";
 import { PendingStore } from "./auth/pending-store.js";
 import { MailboxRegistry, credResolveEvent } from "./auth/mailbox-registry.js";
+import { callGraph, OWN_MAILBOX_PREFIX } from "./lib/graph-client.js";
+import { graphInboxProbe, runSharedMailboxAdd } from "./tools/shared-mailbox-add.js";
+import { runSharedMailboxRemove } from "./tools/shared-mailbox-remove.js";
 import { runAccountRegisterStart, runAccountRegisterPoll } from "./tools/account-register.js";
 import { runMailList } from "./tools/mail-list.js";
 import { runMailSearch } from "./tools/mail-search.js";
@@ -99,6 +102,46 @@ function getClientCreds() {
     }
     return { clientId: OUTLOOK_CLIENT_ID, tenantId: OUTLOOK_TENANT_ID };
 }
+/**
+ * Resolve the SIGNED-IN mailbox that will delegate for a shared one.
+ *
+ * Distinct from getConfig because a delegation cannot itself be delegated: the
+ * caller must name a mailbox that actually signed in, and resolving to a
+ * delegated record here would silently build a pointer to a pointer.
+ */
+function getDelegator(via) {
+    if (!ACCOUNT_ID) {
+        throw new Error("getDelegator() called without ACCOUNT_ID — handler guard missing");
+    }
+    const { clientId, tenantId } = getClientCreds();
+    const resolved = getRegistry().resolve(via);
+    log({ ...credResolveEvent(resolved, ACCOUNT_ID, via) });
+    if (resolved.kind === "ambiguous") {
+        throw new Error(`This account has ${resolved.identities.length} Outlook mailboxes (${resolved.identities.join(", ")}). Pass via=<email or id> to say which one has Full Access to the shared mailbox.`);
+    }
+    // Each refusal names what is actually true. Collapsing these into "nothing is
+    // connected" asserts the opposite of the resolver's own result whenever the
+    // caller merely mistyped `via`, and sends the operator to re-register a
+    // mailbox that is working.
+    if (resolved.kind === "notfound") {
+        throw new Error(`No connected Outlook mailbox matches via="${resolved.selector}". Connected: ${resolved.identities.join(", ") || "none"}. Pass via=<one of those> — it must be a mailbox that signed in, not the shared mailbox you are attaching.`);
+    }
+    if (resolved.kind === "delegator-missing") {
+        throw new Error(`via="${resolved.selector}" is itself a shared mailbox, and the mailbox that reaches it (${resolved.via}) is no longer connected. Pass via=<a signed-in mailbox>.`);
+    }
+    if (resolved.kind !== "ok") {
+        throw new Error("No Outlook mailbox is connected for this account, so there is nothing to delegate through. Run outlook-account-register first.");
+    }
+    if (resolved.delegatedAddress) {
+        throw new Error(`${resolved.delegatedAddress} is itself a shared mailbox reached through ${resolved.via}. Pass via=<the signed-in mailbox> instead.`);
+    }
+    return {
+        config: { clientId, tenantId, accountId: ACCOUNT_ID, tokenStore: resolved.store },
+        mailboxKey: resolved.descriptor.mailboxKey,
+        identity: resolved.descriptor.mail ?? resolved.descriptor.graphUserId ?? resolved.descriptor.mailboxKey,
+        scopes: resolved.descriptor.scopes,
+    };
+}
 /**
  * Build a GraphClientConfig for the mailbox the caller named, or the sole
  * configured mailbox when none is named. Resolution order: explicit `mailbox`
@@ -116,8 +159,10 @@ function getConfig(mailbox) {
     const resolved = getRegistry().resolve(mailbox);
     log({ ...credResolveEvent(resolved, ACCOUNT_ID, mailbox) });
     let tokenStore;
+    let mailboxPathPrefix = OWN_MAILBOX_PREFIX;
     if (resolved.kind === "ok") {
         tokenStore = resolved.store;
+        mailboxPathPrefix = resolved.pathPrefix;
     }
     else if (resolved.kind === "none") {
         tokenStore = new TokenStore(ACCOUNT_ID, ACCOUNTS_DIR, UNCONFIGURED_MAILBOX);
@@ -125,10 +170,13 @@ function getConfig(mailbox) {
     else if (resolved.kind === "ambiguous") {
         throw new Error(`This account has ${resolved.identities.length} Outlook mailboxes (${resolved.identities.join(", ")}). Pass mailbox=<email or id> to choose one.`);
     }
+    else if (resolved.kind === "delegator-missing") {
+        throw new Error(`The shared mailbox "${resolved.selector}" is attached through a mailbox that is no longer connected (${resolved.via}). Re-run outlook-account-register for that mailbox, or drop the shared mailbox with outlook-shared-mailbox-remove.`);
+    }
     else {
         throw new Error(`No Outlook mailbox "${resolved.selector}" is connected for this account. Connected: ${resolved.identities.join(", ") || "none"}.`);
     }
-    return { clientId, tenantId, accountId: ACCOUNT_ID, tokenStore };
+    return { clientId, tenantId, accountId: ACCOUNT_ID, tokenStore, mailboxPathPrefix };
 }
 function ok(payload) {
     return {
@@ -478,17 +526,72 @@ lifelineTool(server, "outlook-mailbox-info", "Health probe — reports auth stat
         return fail(`outlook-mailbox-info failed: ${err.message}`);
     }
 });
-lifelineTool(server, "outlook-mailbox-list", "List every Outlook mailbox attached to this account, with each mailbox's email, graphUserId, granted scopes, token expiry, and a `status`. `count` is how many records are attached; `addressable` is how many are usable by their email right now (`status:ok`). Do NOT read a bare `count` of 1 as 'connected' — a record can be attached but not addressable: `status:blank-email` (readable but no stored email, so it cannot be resolved by address), `status:refresh-expired` (needs re-auth), or `status:unreadable` (stored credentials will not decrypt). Local only — reads the stored credentials, never the network. Call this before addressing a specific mailbox; pass the email or graphUserId of an `ok` mailbox as the `mailbox` argument on the other tools.", {}, async () => {
+lifelineTool(server, "outlook-mailbox-list", "List every Outlook mailbox attached to this account, with each mailbox's email, graphUserId, granted scopes, token expiry, and a `status`. `count` is how many records are attached; `addressable` is how many SIGNED-IN mailboxes are usable by their email right now (`status:ok`); `delegated` is how many are shared mailboxes reached through another. Each entry carries `kind` (`signed-in` or `delegated`) and, when delegated, `via` (the mailbox whose Full Access reaches it). Do NOT read a bare `count` of 1 as 'connected' — a record can be attached but not addressable: `status:blank-email` (readable but no stored email, so it cannot be resolved by address), `status:refresh-expired` (needs re-auth), `status:unreadable` (stored credentials will not decrypt), or `status:delegator-missing` (a shared mailbox whose delegating mailbox is no longer connected). Local only by default — reads the stored credentials, never the network. Pass verify:true to probe each attached shared mailbox and report `reachable`. `reachable:false` means the probe did not succeed just now — a revoked Full Access grant is the usual cause, but so is a network or Graph outage, so read the `graph-error` log line for the reason rather than treating false as proof the delegation is gone. Call this before addressing a specific mailbox; pass the email of an `ok` or `delegated` mailbox as the `mailbox` argument on the other tools.", {
+    verify: z
+        .boolean()
+        .optional()
+        .describe("Probe each attached shared mailbox against Graph and report `reachable`. Off by default; the listing is otherwise local-only and works when Graph is unreachable. A false answer means the probe failed now, not specifically that Full Access was revoked."),
+}, async ({ verify }) => {
     if (!ACCOUNT_ID)
         return refuseNoAccount("outlook-mailbox-list");
     try {
-        const result = runMailboxList(ACCOUNT_ID, ACCOUNTS_DIR);
+        const result = await runMailboxList(ACCOUNT_ID, ACCOUNTS_DIR, {
+            verify,
+            probe: async (address) => {
+                try {
+                    await callGraph(getConfig(address), async (client) => client.api("/me/mailFolders/Inbox").select("id").get(), { tool: "mailbox-list", target: address });
+                    return true;
+                }
+                catch {
+                    // Any failure means "cannot reach it right now". The reason is
+                    // already on the graph-error line; this flag answers only whether
+                    // the mailbox still answers.
+                    return false;
+                }
+            },
+        });
         return ok(result);
     }
     catch (err) {
         return fail(`outlook-mailbox-list failed: ${err.message}`);
     }
 });
+lifelineTool(server, "outlook-shared-mailbox-add", "Attach a Microsoft 365 SHARED mailbox (one with no sign-in of its own, e.g. team@company.com) so the mail tools can read, draft, reply and send from it. This is the correct answer whenever an operator asks for a shared, team or delegated mailbox — it does NOT need a licence and must never be given a sign-in. It works through the signed-in mailbox's Full Access delegation: pass address=<the shared mailbox>, plus via=<the signed-in mailbox> when this account has more than one connected. Access is proved before anything is stored, so a refusal here is the real answer: 'does not have Full Access' means the delegation is missing and is granted in the Microsoft 365 admin centre, and 'no mailbox with this address' means the address is wrong or is a distribution list. Once attached, pass the shared address as the `mailbox` argument to any mail tool, and see it in outlook-mailbox-list. Calendar and contacts tools are refused on a shared mailbox. Requires the delegating mailbox to hold the Mail.ReadWrite.Shared scope; a mailbox connected before that scope existed must be re-registered with outlook-account-register first.", {
+    address: z.string().min(3),
+    via: z
+        .string()
+        .optional()
+        .describe("The signed-in mailbox that has Full Access to the shared one. Required only when two or more mailboxes are connected."),
+}, async ({ address, via }) => {
+    if (!ACCOUNT_ID)
+        return refuseNoAccount("outlook-shared-mailbox-add");
+    try {
+        const delegator = getDelegator(via);
+        const result = await runSharedMailboxAdd({
+            config: delegator.config,
+            accountsDir: ACCOUNTS_DIR,
+            viaMailboxKey: delegator.mailboxKey,
+            viaIdentity: delegator.identity,
+            viaScopes: delegator.scopes,
+            nowMs: Date.now(),
+            probe: graphInboxProbe,
+        }, { address });
+        return ok(result);
+    }
+    catch (err) {
+        return fail(`outlook-shared-mailbox-add failed: ${err.message}`);
+    }
+});
+lifelineTool(server, "outlook-shared-mailbox-remove", "Detach a shared mailbox attached by outlook-shared-mailbox-add. Drops the pointer only — no credential is touched, and the mailbox that delegates for it keeps working. `removed:false` means the address was not attached in the first place.", { address: z.string().min(3) }, async ({ address }) => {
+    if (!ACCOUNT_ID)
+        return refuseNoAccount("outlook-shared-mailbox-remove");
+    try {
+        return ok(runSharedMailboxRemove(ACCOUNT_ID, ACCOUNTS_DIR, address));
+    }
+    catch (err) {
+        return fail(`outlook-shared-mailbox-remove failed: ${err.message}`);
+    }
+});
 lifelineTool(server, "outlook-mail-send", "Send a message via Microsoft Graph. Recipients are string arrays (to required, cc/bcc optional). The body is HTML when isHtml=true, otherwise plain text. attachments is an array of file paths inside the account directory (up to 25 MB per file) — with no attachments the message goes via POST /me/sendMail; with attachments it is composed as a draft, the files are attached, and the draft is sent, because /me/sendMail cannot carry a large file. Saves a copy to Sent Items. Success is asserted on Graph's 202; the message is not returned with an id on either route. Requires the Mail.Send scope (plus Mail.ReadWrite when attaching) — a mailbox registered under the old read-only consent returns an actionable 're-register to grant send' error.", {
     to: z.array(z.string().min(3)).min(1),
     cc: z.array(z.string()).optional(),