@rubytech/create-siteoffice-code 0.1.256

package/payload/platform/plugins/outlook/mcp/dist/auth/token-store.js

@@ -0,0 +1,170 @@
+/**
+ * Per-account encrypted token store for Outlook OAuth credentials.
+ *
+ * Adapted from nsakki55/outlook-mcp@e49d8e68ac8d69db653c25803127dc3b98626cda
+ * (MIT). Adaptations:
+ *   - Per-account paths under {ACCOUNTS_DIR}/{accountId}/secrets/outlook/
+ *   - keytar fallback removed (Pi runs headless, no Secret Service)
+ *   - node-persist removed; single JSON blob written atomically (temp + rename)
+ *
+ *   tokens.enc      AES-256-CBC ciphertext "<iv-hex>:<cipher-hex>" of the JSON blob
+ *   .key            32 random bytes, base64, mode 0600 (the AES key)
+ *
+ * The JSON blob shape is {accessToken, refreshToken, accessTokenExpiry,
+ * refreshTokenExpiry, lastRefresh, graphUserId, scopes}.
+ *
+ * Rationale: per CLAUDE.md doctrine, account scope is absolute. Each account
+ * holds its own AES key — compromising account A's keyfile cannot decrypt
+ * account B's tokens.
+ */
+import { createCipheriv, createDecipheriv, randomBytes } from "node:crypto";
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync, } from "node:fs";
+import { join } from "node:path";
+const REFRESH_THRESHOLD_MS = 5 * 60 * 1000; // 5 minutes
+const REFRESH_TOKEN_LIFETIME_MS = 90 * 24 * 60 * 60 * 1000; // 90 days
+export class TokenStore {
+    accountId;
+    cachedBlob = null;
+    encryptionKey = null;
+    secretsDir;
+    tokensPath;
+    keyPath;
+    constructor(accountId, accountsDir) {
+        this.accountId = accountId;
+        this.secretsDir = join(accountsDir, accountId, "secrets", "outlook");
+        this.tokensPath = join(this.secretsDir, "tokens.enc");
+        this.keyPath = join(this.secretsDir, ".key");
+    }
+    /** Load (or create) the AES key. Idempotent and TOCTOU-safe via wx flag. */
+    loadKey() {
+        if (this.encryptionKey)
+            return this.encryptionKey;
+        mkdirSync(this.secretsDir, { recursive: true, mode: 0o700 });
+        chmodSync(this.secretsDir, 0o700);
+        if (existsSync(this.keyPath)) {
+            const stat = statSync(this.keyPath);
+            if ((stat.mode & 0o777) !== 0o600)
+                chmodSync(this.keyPath, 0o600);
+            const raw = readFileSync(this.keyPath, "utf-8").trim();
+            const key = Buffer.from(raw, "base64");
+            if (key.length !== 32) {
+                throw new Error(`Outlook key for account=${this.accountId} is corrupt (length=${key.length}); delete ${this.keyPath} and re-run outlook-account-register.`);
+            }
+            this.encryptionKey = key;
+            return key;
+        }
+        const newKey = randomBytes(32);
+        try {
+            writeFileSync(this.keyPath, newKey.toString("base64"), {
+                flag: "wx",
+                mode: 0o600,
+            });
+        }
+        catch (err) {
+            // Concurrent flow created the key first — read theirs.
+            if (err.code === "EEXIST") {
+                const raw = readFileSync(this.keyPath, "utf-8").trim();
+                this.encryptionKey = Buffer.from(raw, "base64");
+                return this.encryptionKey;
+            }
+            throw err;
+        }
+        this.encryptionKey = newKey;
+        return newKey;
+    }
+    encrypt(plaintext) {
+        const key = this.loadKey();
+        const iv = randomBytes(16);
+        const cipher = createCipheriv("aes-256-cbc", key, iv);
+        let encrypted = cipher.update(plaintext, "utf8", "hex");
+        encrypted += cipher.final("hex");
+        return `${iv.toString("hex")}:${encrypted}`;
+    }
+    decrypt(payload) {
+        const key = this.loadKey();
+        const [ivHex, ...rest] = payload.split(":");
+        if (!ivHex || rest.length === 0) {
+            throw new Error("token-decrypt-failed: malformed cipher payload");
+        }
+        const iv = Buffer.from(ivHex, "hex");
+        const decipher = createDecipheriv("aes-256-cbc", key, iv);
+        let decrypted = decipher.update(rest.join(":"), "hex", "utf8");
+        decrypted += decipher.final("utf8");
+        return decrypted;
+    }
+    /** Atomic write — temp + rename. Either old or new tokens, never partial. */
+    writeBlob(blob) {
+        const ciphertext = this.encrypt(JSON.stringify(blob));
+        const temp = `${this.tokensPath}.tmp`;
+        writeFileSync(temp, ciphertext, { mode: 0o600 });
+        chmodSync(temp, 0o600);
+        renameSync(temp, this.tokensPath);
+        this.cachedBlob = blob;
+    }
+    /** Read and decrypt the blob from disk; cached after first read. */
+    read() {
+        if (this.cachedBlob)
+            return this.cachedBlob;
+        if (!existsSync(this.tokensPath))
+            return null;
+        const raw = readFileSync(this.tokensPath, "utf-8").trim();
+        if (!raw)
+            return null;
+        const json = this.decrypt(raw);
+        const blob = JSON.parse(json);
+        this.cachedBlob = blob;
+        return blob;
+    }
+    store(accessToken, refreshToken, expiresInSeconds, extras = {}) {
+        const now = Date.now();
+        const previous = this.cachedBlob ?? this.tryReadSilent();
+        const blob = {
+            accessToken,
+            refreshToken: refreshToken ?? previous?.refreshToken ?? null,
+            accessTokenExpiry: now + expiresInSeconds * 1000,
+            refreshTokenExpiry: refreshToken
+                ? now + REFRESH_TOKEN_LIFETIME_MS
+                : (previous?.refreshTokenExpiry ?? now + REFRESH_TOKEN_LIFETIME_MS),
+            lastRefresh: now,
+            graphUserId: extras.graphUserId ?? previous?.graphUserId ?? null,
+            scopes: extras.scopes ?? previous?.scopes ?? [],
+        };
+        this.writeBlob(blob);
+        return blob;
+    }
+    tryReadSilent() {
+        try {
+            return this.read();
+        }
+        catch {
+            return null;
+        }
+    }
+    /**
+     * Whether the access token is within the refresh threshold of expiry. Caller
+     * should refresh before next Graph call when this is true.
+     */
+    needsRefresh() {
+        const blob = this.read();
+        if (!blob)
+            return false;
+        return Date.now() > blob.accessTokenExpiry - REFRESH_THRESHOLD_MS;
+    }
+    hasTokens() {
+        return this.read() !== null;
+    }
+    refreshTokenExpired() {
+        const blob = this.read();
+        if (!blob)
+            return false;
+        return Date.now() > blob.refreshTokenExpiry;
+    }
+    clear() {
+        this.cachedBlob = null;
+        if (existsSync(this.tokensPath))
+            unlinkSync(this.tokensPath);
+    }
+}
+/** Exported for tests + the mailbox-info tool. */
+export const refreshThresholdMs = REFRESH_THRESHOLD_MS;
+//# sourceMappingURL=token-store.js.map

package/payload/platform/plugins/outlook/mcp/dist/auth/token-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-store.js","sourceRoot":"","sources":["../../src/auth/token-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC5E,OAAO,EACL,SAAS,EACT,UAAU,EACV,SAAS,EACT,YAAY,EACZ,UAAU,EACV,QAAQ,EACR,UAAU,EACV,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,MAAM,oBAAoB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,YAAY;AACxD,MAAM,yBAAyB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,UAAU;AAYtE,MAAM,OAAO,UAAU;IAQH;IAPV,UAAU,GAAqB,IAAI,CAAC;IACpC,aAAa,GAAkB,IAAI,CAAC;IAC3B,UAAU,CAAS;IACnB,UAAU,CAAS;IACnB,OAAO,CAAS;IAEjC,YACkB,SAAiB,EACjC,WAAmB;QADH,cAAS,GAAT,SAAS,CAAQ;QAGjC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;QACrE,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QACtD,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC/C,CAAC;IAED,4EAA4E;IACpE,OAAO;QACb,IAAI,IAAI,CAAC,aAAa;YAAE,OAAO,IAAI,CAAC,aAAa,CAAC;QAElD,SAAS,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7D,SAAS,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAElC,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACpC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,KAAK;gBAAE,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAClE,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;YACvD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YACvC,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;gBACtB,MAAM,IAAI,KAAK,CACb,2BAA2B,IAAI,CAAC,SAAS,uBAAuB,GAAG,CAAC,MAAM,aAAa,IAAI,CAAC,OAAO,uCAAuC,CAC3I,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,aAAa,GAAG,GAAG,CAAC;YACzB,OAAO,GAAG,CAAC;QACb,CAAC;QAED,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC/B,IAAI,CAAC;YACH,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE;gBACrD,IAAI,EAAE,IAAI;gBACV,IAAI,EAAE,KAAK;aACZ,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,uDAAuD;YACvD,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACrD,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;gBACvD,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;gBAChD,OAAO,IAAI,CAAC,aAAa,CAAC;YAC5B,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC;QAC5B,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,OAAO,CAAC,SAAiB;QAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QAC3B,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC3B,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QACtD,IAAI,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QACxD,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACjC,OAAO,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,SAAS,EAAE,CAAC;IAC9C,CAAC;IAEO,OAAO,CAAC,OAAe;QAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QAC3B,MAAM,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC5C,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QAC1D,IAAI,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QAC/D,SAAS,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACpC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,6EAA6E;IACrE,SAAS,CAAC,IAAe;QAC/B,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QACtD,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,UAAU,MAAM,CAAC;QACtC,aAAa,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACjD,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACvB,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QAClC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;IACzB,CAAC;IAED,oEAAoE;IACpE,IAAI;QACF,IAAI,IAAI,CAAC,UAAU;YAAE,OAAO,IAAI,CAAC,UAAU,CAAC;QAC5C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;YAAE,OAAO,IAAI,CAAC;QAC9C,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QAC1D,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAc,CAAC;QAC3C,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CACH,WAAmB,EACnB,YAA2B,EAC3B,gBAAwB,EACxB,SAA6D,EAAE;QAE/D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;QACzD,MAAM,IAAI,GAAc;YACtB,WAAW;YACX,YAAY,EAAE,YAAY,IAAI,QAAQ,EAAE,YAAY,IAAI,IAAI;YAC5D,iBAAiB,EAAE,GAAG,GAAG,gBAAgB,GAAG,IAAI;YAChD,kBAAkB,EAAE,YAAY;gBAC9B,CAAC,CAAC,GAAG,GAAG,yBAAyB;gBACjC,CAAC,CAAC,CAAC,QAAQ,EAAE,kBAAkB,IAAI,GAAG,GAAG,yBAAyB,CAAC;YACrE,WAAW,EAAE,GAAG;YAChB,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,QAAQ,EAAE,WAAW,IAAI,IAAI;YAChE,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,QAAQ,EAAE,MAAM,IAAI,EAAE;SAChD,CAAC;QACF,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,aAAa;QACnB,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC;QACrB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,YAAY;QACV,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC;QACxB,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,iBAAiB,GAAG,oBAAoB,CAAC;IACpE,CAAC;IAED,SAAS;QACP,OAAO,IAAI,CAAC,IAAI,EAAE,KAAK,IAAI,CAAC;IAC9B,CAAC;IAED,mBAAmB;QACjB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC;QACxB,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,kBAAkB,CAAC;IAC9C,CAAC;IAED,KAAK;QACH,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QACvB,IAAI,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;YAAE,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC/D,CAAC;CACF;AAED,kDAAkD;AAClD,MAAM,CAAC,MAAM,kBAAkB,GAAG,oBAAoB,CAAC"}

package/payload/platform/plugins/outlook/mcp/dist/index.d.ts

@@ -0,0 +1,18 @@
+#!/usr/bin/env node
+/**
+ * @maxy/outlook MCP server.
+ *
+ * Read-only Microsoft Graph access for Outlook.com / Microsoft 365 mailboxes.
+ * Admin agent only. Public-agent surface is explicitly excluded.
+ *
+ * Auth: per-account OAuth Auth Code + PKCE. Tokens persist encrypted to
+ *   {ACCOUNTS_DIR}/{accountId}/secrets/outlook/{tokens.enc, .key}
+ *
+ * Required environment:
+ *   ACCOUNT_ID            — provided by getMcpServers when spawned per account.
+ *   PLATFORM_ROOT         — repo root; used to derive ACCOUNTS_DIR.
+ *   OUTLOOK_CLIENT_ID     — Azure AD app (client) ID. Operator-set per install.
+ *   OUTLOOK_TENANT_ID     — Azure tenant ("common" for multi-tenant). Default "common".
+ */
+export {};
+//# sourceMappingURL=index.d.ts.map

package/payload/platform/plugins/outlook/mcp/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;GAcG"}

package/payload/platform/plugins/outlook/mcp/dist/index.js

@@ -0,0 +1,183 @@
+#!/usr/bin/env node
+/**
+ * @maxy/outlook MCP server.
+ *
+ * Read-only Microsoft Graph access for Outlook.com / Microsoft 365 mailboxes.
+ * Admin agent only. Public-agent surface is explicitly excluded.
+ *
+ * Auth: per-account OAuth Auth Code + PKCE. Tokens persist encrypted to
+ *   {ACCOUNTS_DIR}/{accountId}/secrets/outlook/{tokens.enc, .key}
+ *
+ * Required environment:
+ *   ACCOUNT_ID            — provided by getMcpServers when spawned per account.
+ *   PLATFORM_ROOT         — repo root; used to derive ACCOUNTS_DIR.
+ *   OUTLOOK_CLIENT_ID     — Azure AD app (client) ID. Operator-set per install.
+ *   OUTLOOK_TENANT_ID     — Azure tenant ("common" for multi-tenant). Default "common".
+ */
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { resolve } from "node:path";
+import { z } from "zod";
+import { TokenStore } from "./auth/token-store.js";
+import { runAccountRegister } from "./tools/account-register.js";
+import { runMailList } from "./tools/mail-list.js";
+import { runMailSearch } from "./tools/mail-search.js";
+import { runCalendarList } from "./tools/calendar-list.js";
+import { runCalendarEvent } from "./tools/calendar-event.js";
+import { runContactsList } from "./tools/contacts-list.js";
+import { runMailboxInfo } from "./tools/mailbox-info.js";
+// Plugin-system boot tolerance — see Task 202.
+// Module-init must never exit; the plugin-system spawn enumerates tools/list
+// before any per-account env is set. Per-call refusal preserves isolation.
+const ACCOUNT_ID = process.env.ACCOUNT_ID ?? null;
+const PLATFORM_ROOT = process.env.PLATFORM_ROOT ?? process.cwd();
+const ACCOUNTS_DIR = resolve(PLATFORM_ROOT, "..", "data/accounts");
+const OUTLOOK_CLIENT_ID = process.env.OUTLOOK_CLIENT_ID ?? "";
+const OUTLOOK_TENANT_ID = process.env.OUTLOOK_TENANT_ID ?? "common";
+process.stderr.write(`[outlook-mcp] boot accountId=${ACCOUNT_ID ?? "null"}\n`);
+function refuseNoAccount(toolName) {
+    process.stderr.write(`[outlook-mcp] tool=${toolName} refuse reason=no-account-context\n`);
+    return {
+        content: [
+            {
+                type: "text",
+                text: `${toolName} cannot execute: this MCP instance was launched without ACCOUNT_ID (plugin-system metadata-only mode). Per-account access requires ACCOUNT_ID at spawn.`,
+            },
+        ],
+        isError: true,
+    };
+}
+function getStore() {
+    if (!ACCOUNT_ID) {
+        throw new Error("getStore() called without ACCOUNT_ID — handler guard missing");
+    }
+    return new TokenStore(ACCOUNT_ID, ACCOUNTS_DIR);
+}
+function getConfig() {
+    if (!ACCOUNT_ID) {
+        throw new Error("getConfig() called without ACCOUNT_ID — handler guard missing");
+    }
+    if (!OUTLOOK_CLIENT_ID) {
+        throw new Error("OUTLOOK_CLIENT_ID is not configured. Set it in the operator's Maxy install before using outlook tools.");
+    }
+    return {
+        clientId: OUTLOOK_CLIENT_ID,
+        tenantId: OUTLOOK_TENANT_ID,
+        accountId: ACCOUNT_ID,
+        tokenStore: getStore(),
+    };
+}
+function ok(payload) {
+    return {
+        content: [
+            { type: "text", text: typeof payload === "string" ? payload : JSON.stringify(payload, null, 2) },
+        ],
+    };
+}
+function fail(message) {
+    return { content: [{ type: "text", text: message }], isError: true };
+}
+const server = new McpServer({
+    name: "outlook",
+    version: "0.1.0",
+});
+server.tool("outlook-account-register", "Initiate the OAuth Auth Code + PKCE flow for this account. Returns an authorization URL the operator opens in the VNC browser. Tool blocks until the operator completes consent (5-minute timeout) or fails loudly.", {}, async () => {
+    if (!ACCOUNT_ID)
+        return refuseNoAccount("outlook-account-register");
+    try {
+        const config = getConfig();
+        const result = await runAccountRegister({
+            accountId: ACCOUNT_ID,
+            clientId: config.clientId,
+            tenantId: config.tenantId,
+            tokenStore: config.tokenStore,
+        });
+        return ok(result);
+    }
+    catch (err) {
+        return fail(`outlook-account-register failed: ${err.message}`);
+    }
+});
+server.tool("outlook-mail-list", "List recent messages in the mailbox. Defaults to top=25 ordered by receivedDateTime DESC. Folder defaults to Inbox; pass a folder displayName or id for other folders. Returns id, subject, from, receivedDateTime, bodyPreview, isRead.", {
+    top: z.number().int().min(1).max(250).optional(),
+    folder: z.string().optional(),
+}, async ({ top, folder }) => {
+    if (!ACCOUNT_ID)
+        return refuseNoAccount("outlook-mail-list");
+    try {
+        const items = await runMailList(getConfig(), { top, folder });
+        return ok(items);
+    }
+    catch (err) {
+        return fail(`outlook-mail-list failed: ${err.message}`);
+    }
+});
+server.tool("outlook-mail-search", "Search mail with Microsoft Graph $search. The query is enclosed in quotes and applied with ConsistencyLevel=eventual. Returns the same shape as outlook-mail-list.", {
+    query: z.string().min(1),
+    top: z.number().int().min(1).max(250).optional(),
+}, async ({ query, top }) => {
+    if (!ACCOUNT_ID)
+        return refuseNoAccount("outlook-mail-search");
+    try {
+        const items = await runMailSearch(getConfig(), { query, top });
+        return ok(items);
+    }
+    catch (err) {
+        return fail(`outlook-mail-search failed: ${err.message}`);
+    }
+});
+server.tool("outlook-calendar-list", "List calendar events in the next rangeDays days (default 7, max 365). Returns id, subject, start, end, location, attendees, isAllDay, organizer.", {
+    rangeDays: z.number().int().min(1).max(365).optional(),
+    top: z.number().int().min(1).max(500).optional(),
+}, async ({ rangeDays, top }) => {
+    if (!ACCOUNT_ID)
+        return refuseNoAccount("outlook-calendar-list");
+    try {
+        const events = await runCalendarList(getConfig(), { rangeDays, top });
+        return ok(events);
+    }
+    catch (err) {
+        return fail(`outlook-calendar-list failed: ${err.message}`);
+    }
+});
+server.tool("outlook-calendar-event", "Fetch a single calendar event by id, including the full body, attendees, and webLink.", {
+    eventId: z.string().min(1),
+}, async ({ eventId }) => {
+    if (!ACCOUNT_ID)
+        return refuseNoAccount("outlook-calendar-event");
+    try {
+        const detail = await runCalendarEvent(getConfig(), { eventId });
+        return ok(detail);
+    }
+    catch (err) {
+        return fail(`outlook-calendar-event failed: ${err.message}`);
+    }
+});
+server.tool("outlook-contacts-list", "List contacts. Defaults to top=50, max 250. Returns id, displayName, emailAddresses, phones, jobTitle, companyName.", {
+    top: z.number().int().min(1).max(250).optional(),
+}, async ({ top }) => {
+    if (!ACCOUNT_ID)
+        return refuseNoAccount("outlook-contacts-list");
+    try {
+        const items = await runContactsList(getConfig(), { top });
+        return ok(items);
+    }
+    catch (err) {
+        return fail(`outlook-contacts-list failed: ${err.message}`);
+    }
+});
+server.tool("outlook-mailbox-info", "Health probe — reports auth state, refresh-window status, and top-level folder count for this account. Useful for answering 'did account X auth?' without grepping logs.", {}, async () => {
+    if (!ACCOUNT_ID)
+        return refuseNoAccount("outlook-mailbox-info");
+    try {
+        const info = await runMailboxInfo(getConfig());
+        return ok(info);
+    }
+    catch (err) {
+        return fail(`outlook-mailbox-info failed: ${err.message}`);
+    }
+});
+const transport = new StdioServerTransport();
+await server.connect(transport);
+process.stderr.write(`[outlook-mcp] ready account=${ACCOUNT_ID ?? "null"}\n`);
+//# sourceMappingURL=index.js.map

package/payload/platform/plugins/outlook/mcp/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAGnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAEzD,+CAA+C;AAC/C,6EAA6E;AAC7E,2EAA2E;AAC3E,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC;AAClD,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;AACjE,MAAM,YAAY,GAAG,OAAO,CAAC,aAAa,EAAE,IAAI,EAAE,eAAe,CAAC,CAAC;AACnE,MAAM,iBAAiB,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAC;AAC9D,MAAM,iBAAiB,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,QAAQ,CAAC;AAEpE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gCAAgC,UAAU,IAAI,MAAM,IAAI,CAAC,CAAC;AAE/E,SAAS,eAAe,CAAC,QAAgB;IACvC,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,sBAAsB,QAAQ,qCAAqC,CACpE,CAAC;IACF,OAAO;QACL,OAAO,EAAE;YACP;gBACE,IAAI,EAAE,MAAe;gBACrB,IAAI,EAAE,GAAG,QAAQ,yJAAyJ;aAC3K;SACF;QACD,OAAO,EAAE,IAAI;KACd,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ;IACf,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,IAAI,UAAU,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,SAAS;IAChB,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,wGAAwG,CACzG,CAAC;IACJ,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,iBAAiB;QAC3B,QAAQ,EAAE,iBAAiB;QAC3B,SAAS,EAAE,UAAU;QACrB,UAAU,EAAE,QAAQ,EAAE;KACvB,CAAC;AACJ,CAAC;AAED,SAAS,EAAE,CAAC,OAAgB;IAC1B,OAAO;QACL,OAAO,EAAE;YACP,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;SACjG;KACF,CAAC;AACJ,CAAC;AAED,SAAS,IAAI,CAAC,OAAe;IAI3B,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AACvE,CAAC;AAED,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;IAC3B,IAAI,EAAE,SAAS;IACf,OAAO,EAAE,OAAO;CACjB,CAAC,CAAC;AAEH,MAAM,CAAC,IAAI,CACT,0BAA0B,EAC1B,qNAAqN,EACrN,EAAE,EACF,KAAK,IAAI,EAAE;IACT,IAAI,CAAC,UAAU;QAAE,OAAO,eAAe,CAAC,0BAA0B,CAAC,CAAC;IACpE,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC;YACtC,SAAS,EAAE,UAAU;YACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,UAAU,EAAE,MAAM,CAAC,UAAU;SAC9B,CAAC,CAAC;QACH,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;IACpB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,IAAI,CAAC,oCAAqC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5E,CAAC;AACH,CAAC,CACF,CAAC;AAEF,MAAM,CAAC,IAAI,CACT,mBAAmB,EACnB,0OAA0O,EAC1O;IACE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAChD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC9B,EACD,KAAK,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE;IACxB,IAAI,CAAC,UAAU;QAAE,OAAO,eAAe,CAAC,mBAAmB,CAAC,CAAC;IAC7D,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,SAAS,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;QAC9D,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC;IACnB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,IAAI,CAAC,6BAA8B,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IACrE,CAAC;AACH,CAAC,CACF,CAAC;AAEF,MAAM,CAAC,IAAI,CACT,qBAAqB,EACrB,oKAAoK,EACpK;IACE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CACjD,EACD,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE;IACvB,IAAI,CAAC,UAAU;QAAE,OAAO,eAAe,CAAC,qBAAqB,CAAC,CAAC;IAC/D,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QAC/D,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC;IACnB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,IAAI,CAAC,+BAAgC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IACvE,CAAC;AACH,CAAC,CACF,CAAC;AAEF,MAAM,CAAC,IAAI,CACT,uBAAuB,EACvB,kJAAkJ,EAClJ;IACE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACtD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CACjD,EACD,KAAK,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,EAAE;IAC3B,IAAI,CAAC,UAAU;QAAE,OAAO,eAAe,CAAC,uBAAuB,CAAC,CAAC;IACjE,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;QACtE,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;IACpB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,IAAI,CAAC,iCAAkC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IACzE,CAAC;AACH,CAAC,CACF,CAAC;AAEF,MAAM,CAAC,IAAI,CACT,wBAAwB,EACxB,uFAAuF,EACvF;IACE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC3B,EACD,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE;IACpB,IAAI,CAAC,UAAU;QAAE,OAAO,eAAe,CAAC,wBAAwB,CAAC,CAAC;IAClE,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QAChE,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;IACpB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,IAAI,CAAC,kCAAmC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC,CACF,CAAC;AAEF,MAAM,CAAC,IAAI,CACT,uBAAuB,EACvB,qHAAqH,EACrH;IACE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CACjD,EACD,KAAK,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE;IAChB,IAAI,CAAC,UAAU;QAAE,OAAO,eAAe,CAAC,uBAAuB,CAAC,CAAC;IACjE,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,SAAS,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QAC1D,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC;IACnB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,IAAI,CAAC,iCAAkC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IACzE,CAAC;AACH,CAAC,CACF,CAAC;AAEF,MAAM,CAAC,IAAI,CACT,sBAAsB,EACtB,0KAA0K,EAC1K,EAAE,EACF,KAAK,IAAI,EAAE;IACT,IAAI,CAAC,UAAU;QAAE,OAAO,eAAe,CAAC,sBAAsB,CAAC,CAAC;IAChE,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,SAAS,EAAE,CAAC,CAAC;QAC/C,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;IAClB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,IAAI,CAAC,gCAAiC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IACxE,CAAC;AACH,CAAC,CACF,CAAC;AAEF,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;AAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;AAChC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,+BAA+B,UAAU,IAAI,MAAM,IAAI,CAAC,CAAC"}

package/payload/platform/plugins/outlook/mcp/dist/lib/graph-client.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Microsoft Graph client wrapper.
+ *
+ * Builds a `Client` from `@microsoft/microsoft-graph-client` whose auth provider
+ * pulls from the per-account TokenStore, with auto-refresh when the access
+ * token is within the refresh threshold of expiry.
+ *
+ * Centralises error classification — every Graph error decision keys off the
+ * status code and the structured `error.code` field, never the prose body.
+ * Aligns with `feedback_no_stdout_parsing_for_control_flow.md`.
+ */
+import { Client } from "@microsoft/microsoft-graph-client";
+import type { TokenStore } from "../auth/token-store.js";
+export interface GraphClientConfig {
+    clientId: string;
+    tenantId: string;
+    accountId: string;
+    tokenStore: TokenStore;
+}
+export type GraphErrorClass = {
+    kind: "auth";
+    statusCode: number;
+    code: string;
+} | {
+    kind: "rate-limit-recoverable";
+    statusCode: number;
+    retryAfterMs: number;
+} | {
+    kind: "rate-limit-terminal";
+    statusCode: number;
+} | {
+    kind: "on-prem";
+    statusCode: number;
+    mailServer?: string;
+} | {
+    kind: "5xx";
+    statusCode: number;
+    code: string;
+} | {
+    kind: "other";
+    statusCode: number;
+    code: string;
+};
+export declare function classifyGraphError(err: unknown): GraphErrorClass;
+/**
+ * Factory wrapping `Client.init`. Exported as a named function so tests can
+ * `vi.spyOn(graphClient, "createGraphClient")` reliably (avoids the
+ * destructured-ESM mock no-op pitfall).
+ */
+export declare function createGraphClient(config: GraphClientConfig): Client;
+export declare function getOrRefreshAccessToken(config: GraphClientConfig): Promise<string>;
+/**
+ * Run a Graph call with classification, single retry on `auth` (refresh +
+ * retry once), and respect for 429 Retry-After. All terminal classes throw
+ * with operator-readable messages.
+ */
+export declare function callGraph<T>(config: GraphClientConfig, invoke: (client: Client) => Promise<T>, opts?: {
+    tool: string;
+}): Promise<T>;
+//# sourceMappingURL=graph-client.d.ts.map

package/payload/platform/plugins/outlook/mcp/dist/lib/graph-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"graph-client.d.ts","sourceRoot":"","sources":["../../src/lib/graph-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,mCAAmC,CAAC;AAE3D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAGzD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,UAAU,CAAC;CACxB;AAED,MAAM,MAAM,eAAe,GACvB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAClD;IAAE,IAAI,EAAE,wBAAwB,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAC5E;IAAE,IAAI,EAAE,qBAAqB,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GACnD;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAC5D;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACjD;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAqDxD,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,GAAG,eAAe,CA2BhE;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,iBAAiB,GAAG,MAAM,CAWnE;AAED,wBAAsB,uBAAuB,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,CAgDxF;AAED;;;;GAIG;AACH,wBAAsB,SAAS,CAAC,CAAC,EAC/B,MAAM,EAAE,iBAAiB,EACzB,MAAM,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,EACtC,IAAI,GAAE;IAAE,IAAI,EAAE,MAAM,CAAA;CAAsB,GACzC,OAAO,CAAC,CAAC,CAAC,CAsDZ"}

package/payload/platform/plugins/outlook/mcp/dist/lib/graph-client.js

@@ -0,0 +1,189 @@
+/**
+ * Microsoft Graph client wrapper.
+ *
+ * Builds a `Client` from `@microsoft/microsoft-graph-client` whose auth provider
+ * pulls from the per-account TokenStore, with auto-refresh when the access
+ * token is within the refresh threshold of expiry.
+ *
+ * Centralises error classification — every Graph error decision keys off the
+ * status code and the structured `error.code` field, never the prose body.
+ * Aligns with `feedback_no_stdout_parsing_for_control_flow.md`.
+ */
+import { Client } from "@microsoft/microsoft-graph-client";
+import { refreshAccessToken } from "../auth/pkce-flow.js";
+import { log } from "./log.js";
+/** Pull (statusCode, code, headers) from whatever shape the SDK threw. */
+function normalizeGraphError(err) {
+    const e = err;
+    const statusCode = e.statusCode ?? e.status ?? 0;
+    let code = e.code ?? "";
+    if (!code && typeof e.body === "string") {
+        try {
+            const parsed = JSON.parse(e.body);
+            code = parsed.error?.code ?? "";
+        }
+        catch {
+            // body wasn't JSON; leave code empty
+        }
+    }
+    else if (!code && e.body && typeof e.body === "object") {
+        code = e.body.error?.code ?? "";
+    }
+    let retryAfterHeader = null;
+    let mailServerHeader = null;
+    const fetchHeaders = e.response?.headers;
+    if (fetchHeaders && typeof fetchHeaders.get === "function") {
+        retryAfterHeader = fetchHeaders.get("retry-after") ?? null;
+        mailServerHeader = fetchHeaders.get("x-mailbox-server") ?? null;
+    }
+    else if (e.headers instanceof Map) {
+        retryAfterHeader = e.headers.get("retry-after") ?? e.headers.get("Retry-After") ?? null;
+        mailServerHeader = e.headers.get("x-mailbox-server") ?? null;
+    }
+    else if (e.headers && typeof e.headers === "object") {
+        const h = e.headers;
+        retryAfterHeader =
+            h["retry-after"] ?? h["Retry-After"] ?? h["RETRY-AFTER"] ?? null;
+        mailServerHeader = h["x-mailbox-server"] ?? h["X-MailboxServer"] ?? null;
+    }
+    return { statusCode, code, retryAfterHeader, mailServerHeader };
+}
+export function classifyGraphError(err) {
+    const norm = normalizeGraphError(err);
+    const { statusCode, code, retryAfterHeader, mailServerHeader } = norm;
+    if (statusCode === 401) {
+        return { kind: "auth", statusCode, code: code || "Unauthenticated" };
+    }
+    if (statusCode === 429) {
+        if (retryAfterHeader) {
+            const seconds = Number(retryAfterHeader);
+            if (Number.isFinite(seconds) && seconds >= 0) {
+                return {
+                    kind: "rate-limit-recoverable",
+                    statusCode,
+                    retryAfterMs: seconds * 1000,
+                };
+            }
+        }
+        return { kind: "rate-limit-terminal", statusCode };
+    }
+    if (statusCode === 503 && code === "MailboxNotEnabledForRESTAPI") {
+        return { kind: "on-prem", statusCode, mailServer: mailServerHeader ?? undefined };
+    }
+    if (statusCode >= 500 && statusCode < 600) {
+        return { kind: "5xx", statusCode, code: code || "ServerError" };
+    }
+    return { kind: "other", statusCode, code: code || "Unknown" };
+}
+/**
+ * Factory wrapping `Client.init`. Exported as a named function so tests can
+ * `vi.spyOn(graphClient, "createGraphClient")` reliably (avoids the
+ * destructured-ESM mock no-op pitfall).
+ */
+export function createGraphClient(config) {
+    return Client.init({
+        authProvider: async (done) => {
+            try {
+                const token = await getOrRefreshAccessToken(config);
+                done(null, token);
+            }
+            catch (err) {
+                done(err, null);
+            }
+        },
+    });
+}
+export async function getOrRefreshAccessToken(config) {
+    const { tokenStore, clientId, tenantId, accountId } = config;
+    const blob = tokenStore.read();
+    if (!blob) {
+        throw new Error(`auth-required: Outlook not connected for account=${accountId}; run outlook-account-register.`);
+    }
+    if (tokenStore.refreshTokenExpired() || !blob.refreshToken) {
+        throw new Error(`auth-required: Outlook refresh token expired for account=${accountId}; run outlook-account-register.`);
+    }
+    if (!tokenStore.needsRefresh()) {
+        return blob.accessToken;
+    }
+    const oldExpSec = Math.floor(blob.accessTokenExpiry / 1000);
+    try {
+        const refreshed = await refreshAccessToken({
+            clientId,
+            tenantId,
+            refreshToken: blob.refreshToken,
+        });
+        const updated = tokenStore.store(refreshed.access_token, refreshed.refresh_token ?? blob.refreshToken, refreshed.expires_in, { graphUserId: blob.graphUserId, scopes: blob.scopes });
+        log({
+            event: "token-refreshed",
+            account: accountId,
+            oldExpSec,
+            newExpSec: Math.floor(updated.accessTokenExpiry / 1000),
+        });
+        return updated.accessToken;
+    }
+    catch (err) {
+        log({
+            event: "token-refresh-failed",
+            account: accountId,
+            reason: err.message,
+        });
+        tokenStore.clear();
+        throw new Error(`Outlook token refresh failed for account=${accountId}; re-auth required.`);
+    }
+}
+/**
+ * Run a Graph call with classification, single retry on `auth` (refresh +
+ * retry once), and respect for 429 Retry-After. All terminal classes throw
+ * with operator-readable messages.
+ */
+export async function callGraph(config, invoke, opts = { tool: "graph" }) {
+    let attempts = 0;
+    // Up to 3 attempts: original, one for auth-refresh, one for 429-recoverable.
+    while (true) {
+        attempts += 1;
+        const client = createGraphClient(config);
+        try {
+            return await invoke(client);
+        }
+        catch (err) {
+            const cls = classifyGraphError(err);
+            log({
+                event: "graph-error",
+                account: config.accountId,
+                status: cls.statusCode,
+                code: "code" in cls ? cls.code : "",
+                retryAfterMs: cls.kind === "rate-limit-recoverable" ? cls.retryAfterMs : null,
+            });
+            if (cls.kind === "on-prem") {
+                log({
+                    event: "on-prem-rejected",
+                    account: config.accountId,
+                    mailServer: cls.mailServer ?? "unknown",
+                });
+                throw new Error("Microsoft Graph does not support on-premises Exchange. Use IMAP.");
+            }
+            if (cls.kind === "rate-limit-terminal") {
+                throw new Error(`Outlook rate-limited without Retry-After hint (account=${config.accountId}, tool=${opts.tool}).`);
+            }
+            if (cls.kind === "auth" && attempts === 1) {
+                // Force a refresh on the next iteration by clearing the local cache
+                // and explicitly refreshing, then retry.
+                await getOrRefreshAccessToken({ ...config });
+                continue;
+            }
+            if (cls.kind === "auth") {
+                throw new Error(`Outlook auth expired for account=${config.accountId}; run outlook-account-register.`);
+            }
+            if (cls.kind === "rate-limit-recoverable" && attempts === 1) {
+                await new Promise((resolve) => setTimeout(resolve, cls.retryAfterMs));
+                continue;
+            }
+            if (cls.kind === "5xx" && attempts === 1) {
+                await new Promise((resolve) => setTimeout(resolve, 500));
+                continue;
+            }
+            throw err;
+        }
+    }
+}
+//# sourceMappingURL=graph-client.js.map