@stage-labs/metro 0.1.0-beta.21 → 0.1.0-beta.210

package/runtime/node_modules/@metro-labs/outlook/src/auth.ts

@@ -0,0 +1,150 @@
+import { clientId, loginBase, NOT_SET_UP, SCOPES } from './config.js';
+
+export class OutlookAuthError extends Error {}
+
+export type FetchLike = (input: string, init?: RequestInit) => Promise<Response>;
+
+export interface Tokens {
+  accessToken: string;
+  refreshToken: string;
+  expiresAt: number;
+}
+
+export interface DeviceCode {
+  deviceCode: string;
+  userCode: string;
+  verificationUri: string;
+  message: string;
+  expiresAt: number;
+  intervalMs: number;
+}
+
+export type Poll =
+  | { kind: 'pending' }
+  | { kind: 'slow_down' }
+  | { kind: 'done'; tokens: Tokens; tenantId: string | null }
+  | { kind: 'failed'; message: string };
+
+type Body = Record<string, unknown>;
+
+const DEVICE_GRANT = 'urn:ietf:params:oauth:grant-type:device_code';
+const CONSENT_CODES = new Set([65001, 90094, 90095]);
+const POLICY_CODES = new Set([530035, 53003]);
+
+const text = (v: unknown): string => (typeof v === 'string' ? v : '');
+const seconds = (v: unknown, fallback: number): number =>
+  typeof v === 'number' && Number.isFinite(v) && v >= 0 ? v : fallback;
+
+export function requireClientId(id = clientId()): string {
+  if (id === '') throw new OutlookAuthError(NOT_SET_UP);
+  return id;
+}
+
+export async function postForm(path: string, fields: Record<string, string>, fetchImpl: FetchLike): Promise<{ status: number; body: Body }> {
+  let res: Response;
+  try {
+    res = await fetchImpl(`${loginBase()}/oauth2/v2.0/${path}`, {
+      method: 'POST',
+      headers: { 'content-type': 'application/x-www-form-urlencoded', accept: 'application/json' },
+      body: new URLSearchParams(fields).toString(),
+    });
+  } catch (err) {
+    throw new OutlookAuthError(`Metro could not reach Microsoft: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  const raw: unknown = await res.json().catch(() => ({}));
+  return { status: res.status, body: typeof raw === 'object' && raw !== null ? (raw as Body) : {} };
+}
+
+function codesOf(body: Body): number[] {
+  const listed = Array.isArray(body.error_codes) ? body.error_codes.filter((c): c is number => typeof c === 'number') : [];
+  const named = [...text(body.error_description).matchAll(/AADSTS(\d+)/g)].map((m) => Number(m[1]));
+  return [...listed, ...named];
+}
+
+const needsConsent = (error: string, codes: number[]): boolean =>
+  error === 'consent_required' || codes.some((c) => CONSENT_CODES.has(c));
+
+function knownFailure(error: string, codes: number[], id: string): string | null {
+  if (needsConsent(error, codes))
+    return `An administrator of this Microsoft 365 organization must approve Metro once before it can read this mailbox. They can do it at https://login.microsoftonline.com/organizations/adminconsent?client_id=${id} and then you can start again.`;
+  if (codes.some((c) => POLICY_CODES.has(c)))
+    return 'Your company blocks this kind of sign-in. Ask your Microsoft 365 administrator, or use the Microsoft sign-in page instead of a code.';
+  if (error === 'expired_token' || codes.includes(70020)) return 'The sign-in code expired before it was used. Start again.';
+  if (error === 'access_denied' || codes.includes(65004)) return 'The sign-in was declined, so nothing was connected.';
+  return null;
+}
+
+export function failureOf(body: Body, id = clientId()): string {
+  const error = text(body.error);
+  const known = knownFailure(error, codesOf(body), id);
+  if (known !== null) return known;
+  const detail = text(body.error_description).split(/\r?\n/)[0] ?? '';
+  return detail === '' ? `Microsoft refused the sign-in (${error === '' ? 'no reason given' : error}).` : `Microsoft refused the sign-in: ${detail}`;
+}
+
+function decodeClaims(jwt: string): Body | null {
+  const part = jwt.split('.')[1];
+  if (part === undefined) return null;
+  try {
+    const raw: unknown = JSON.parse(Buffer.from(part, 'base64url').toString('utf8'));
+    return typeof raw === 'object' && raw !== null ? (raw as Body) : null;
+  } catch {
+    return null;
+  }
+}
+
+export function tenantOf(...jwts: string[]): string | null {
+  for (const jwt of jwts) {
+    const tid = decodeClaims(jwt)?.tid;
+    if (typeof tid === 'string' && tid !== '') return tid;
+  }
+  return null;
+}
+
+export function tokensOf(body: Body, now: number, previous?: string): Tokens {
+  const accessToken = text(body.access_token);
+  const refreshToken = text(body.refresh_token) || (previous ?? '');
+  if (accessToken === '' || refreshToken === '') throw new OutlookAuthError('Microsoft answered without the tokens Metro needs.');
+  return { accessToken, refreshToken, expiresAt: now + seconds(body.expires_in, 3600) * 1000 };
+}
+
+export async function requestDeviceCode(fetchImpl: FetchLike = fetch, now = Date.now()): Promise<DeviceCode> {
+  const { status, body } = await postForm('devicecode', { client_id: requireClientId(), scope: SCOPES }, fetchImpl);
+  const userCode = text(body.user_code);
+  const deviceCode = text(body.device_code);
+  if (status !== 200 || userCode === '' || deviceCode === '') throw new OutlookAuthError(failureOf(body));
+  return {
+    deviceCode,
+    userCode,
+    verificationUri: text(body.verification_uri) || 'https://microsoft.com/devicelogin',
+    message: text(body.message),
+    expiresAt: now + seconds(body.expires_in, 900) * 1000,
+    intervalMs: seconds(body.interval, 5) * 1000,
+  };
+}
+
+export async function pollDeviceCode(code: DeviceCode, fetchImpl: FetchLike = fetch, now = Date.now()): Promise<Poll> {
+  const { status, body } = await postForm(
+    'token',
+    { grant_type: DEVICE_GRANT, client_id: requireClientId(), device_code: code.deviceCode },
+    fetchImpl,
+  );
+  if (status === 200) {
+    const tokens = tokensOf(body, now);
+    return { kind: 'done', tokens, tenantId: tenantOf(text(body.id_token), tokens.accessToken) };
+  }
+  const error = text(body.error);
+  if (error === 'authorization_pending') return { kind: 'pending' };
+  if (error === 'slow_down') return { kind: 'slow_down' };
+  return { kind: 'failed', message: failureOf(body) };
+}
+
+export async function refreshTokens(refreshToken: string, fetchImpl: FetchLike = fetch, now = Date.now()): Promise<Tokens> {
+  const { status, body } = await postForm(
+    'token',
+    { grant_type: 'refresh_token', client_id: requireClientId(), refresh_token: refreshToken, scope: SCOPES },
+    fetchImpl,
+  );
+  if (status !== 200) throw new OutlookAuthError(`Microsoft refused to renew this mailbox's sign-in, so connect Outlook again. ${failureOf(body)}`);
+  return tokensOf(body, now, refreshToken);
+}

package/runtime/node_modules/@metro-labs/outlook/src/browser.ts

@@ -0,0 +1,53 @@
+import { createHash, randomBytes } from 'node:crypto';
+import { failureOf, OutlookAuthError, postForm, requireClientId, tenantOf, tokensOf, type FetchLike, type Tokens } from './auth.js';
+import { loginBase, redirectUri, SCOPES } from './config.js';
+
+export interface Pkce {
+  verifier: string;
+  challenge: string;
+}
+
+export function pkcePair(verifier = randomBytes(32).toString('base64url')): Pkce {
+  return { verifier, challenge: createHash('sha256').update(verifier).digest('base64url') };
+}
+
+export const newState = (): string => randomBytes(24).toString('base64url');
+
+export function authorizeUrl(challenge: string, state: string, loginHint: string | null = null): string {
+  const query = new URLSearchParams({
+    ...(loginHint === null ? {} : { login_hint: loginHint }),
+    client_id: requireClientId(),
+    response_type: 'code',
+    redirect_uri: redirectUri(),
+    response_mode: 'query',
+    scope: SCOPES,
+    state,
+    code_challenge: challenge,
+    code_challenge_method: 'S256',
+    prompt: 'select_account',
+  });
+  return `${loginBase()}/oauth2/v2.0/authorize?${query.toString()}`;
+}
+
+export interface Redeemed {
+  tokens: Tokens;
+  tenantId: string | null;
+}
+
+export async function redeemCode(code: string, verifier: string, fetchImpl: FetchLike, now = Date.now()): Promise<Redeemed> {
+  const { status, body } = await postForm(
+    'token',
+    {
+      grant_type: 'authorization_code',
+      client_id: requireClientId(),
+      code,
+      code_verifier: verifier,
+      redirect_uri: redirectUri(),
+      scope: SCOPES,
+    },
+    fetchImpl,
+  );
+  if (status !== 200) throw new OutlookAuthError(failureOf(body));
+  const tokens = tokensOf(body, now);
+  return { tokens, tenantId: tenantOf(typeof body.id_token === 'string' ? body.id_token : '', tokens.accessToken) };
+}

package/runtime/node_modules/@metro-labs/outlook/src/config.ts

@@ -0,0 +1,36 @@
+export const OUTLOOK_CLIENT_ID = 'a2fbd978-97ee-4cc9-92bb-9d9567a7bf40';
+
+export const SCOPES = [
+  'https://graph.microsoft.com/Mail.ReadWrite',
+  'https://graph.microsoft.com/Mail.Send',
+  'https://graph.microsoft.com/User.Read',
+  'offline_access',
+  'openid',
+].join(' ');
+
+export const NOT_SET_UP = 'Outlook is not set up on this Metro yet.';
+
+export const MAILBOX_URL = 'https://outlook.office.com/mail/';
+
+const trimmed = (raw: string | undefined): string => (raw ?? '').trim();
+
+export function clientId(): string {
+  const fromEnv = trimmed(process.env.METRO_OUTLOOK_CLIENT_ID);
+  return fromEnv === '' ? OUTLOOK_CLIENT_ID : fromEnv;
+}
+
+const base = (raw: string | undefined, fallback: string): string => {
+  const value = trimmed(raw);
+  return (value === '' ? fallback : value).replace(/\/+$/, '');
+};
+
+export const loginBase = (): string =>
+  base(process.env.METRO_OUTLOOK_LOGIN_URL, 'https://login.microsoftonline.com/common');
+
+export const redirectUri = (): string => {
+  const value = trimmed(process.env.METRO_OUTLOOK_REDIRECT);
+  return value === '' ? 'https://metro.box/' : value;
+};
+
+export const graphBase = (): string =>
+  base(process.env.METRO_OUTLOOK_GRAPH_URL, 'https://graph.microsoft.com/v1.0');

package/runtime/node_modules/@metro-labs/outlook/src/format.ts

@@ -0,0 +1,140 @@
+import { Line } from '@metro-labs/core/lines';
+import { mintId } from '@metro-labs/core/stations/station-runtime';
+import { bodyText, capText } from './html.js';
+
+export interface Address {
+  emailAddress?: { name?: string; address?: string };
+}
+
+export interface GraphMessage {
+  id: string;
+  conversationId?: string;
+  subject?: string | null;
+  from?: Address | null;
+  toRecipients?: Address[];
+  ccRecipients?: Address[];
+  receivedDateTime?: string;
+  bodyPreview?: string;
+  body?: { contentType?: string; content?: string };
+  hasAttachments?: boolean;
+  isRead?: boolean;
+  internetMessageId?: string;
+  '@removed'?: unknown;
+}
+
+export const MESSAGE_FIELDS = [
+  'id',
+  'conversationId',
+  'subject',
+  'from',
+  'toRecipients',
+  'ccRecipients',
+  'receivedDateTime',
+  'bodyPreview',
+  'body',
+  'hasAttachments',
+  'isRead',
+  'internetMessageId',
+].join(',');
+
+export const LIST_FIELDS = MESSAGE_FIELDS.replace(',body,', ',');
+
+const encodeResource = (id: string): string => id.replace(/%/g, '%25').replace(/\//g, '%2F').replace(/\+/g, '%2B');
+
+export const lineOf = (accountId: string, conversationId: string): string =>
+  `metro://outlook/${accountId}/${encodeResource(conversationId)}`;
+
+export const userOf = (accountId: string, address: string): string =>
+  `metro://outlook/${accountId}/user/${address.toLowerCase()}`;
+
+export function conversationOfLine(line: string): { accountId: string; conversationId: string } | null {
+  const parsed = Line.parseOutlook(line);
+  if (parsed === null) return null;
+  try {
+    return { accountId: parsed.accountId, conversationId: decodeURIComponent(parsed.resource) };
+  } catch {
+    return null;
+  }
+}
+
+export const addressOf = (a: Address | null | undefined): string => (a?.emailAddress?.address ?? '').toLowerCase();
+export const nameOf = (a: Address | null | undefined): string => a?.emailAddress?.name ?? '';
+
+const addresses = (list: Address[] | undefined): string[] => (list ?? []).map(addressOf).filter((s) => s !== '');
+
+export const titleOf = (m: GraphMessage): string => (m.subject ?? '').trim();
+
+export function messageText(m: GraphMessage): string {
+  const title = titleOf(m);
+  const body = capText(bodyText(m.body));
+  return title === '' ? body : `Subject: ${title}\n\n${body}`;
+}
+
+export function isPrivateTo(m: GraphMessage, self: string): boolean {
+  const to = addresses(m.toRecipients);
+  return to.length === 1 && to[0] === self && addresses(m.ccRecipients).length === 0;
+}
+
+export interface AttachmentMeta {
+  kind: string;
+  name: string;
+  mime: string;
+  size?: number;
+}
+
+export function inboundEnvelope(accountId: string, self: string, m: GraphMessage, attachments: AttachmentMeta[], verified: boolean): Record<string, unknown> {
+  const from = addressOf(m.from);
+  const title = titleOf(m);
+  return {
+    id: mintId(),
+    ts: m.receivedDateTime ?? new Date().toISOString(),
+    station: 'outlook',
+    line: lineOf(accountId, m.conversationId ?? m.id),
+    line_name: title === '' ? '(no subject)' : title,
+    from: userOf(accountId, from === '' ? 'unknown' : from),
+    from_name: nameOf(m.from) || from,
+    from_display_name: nameOf(m.from) || undefined,
+    message_id: m.id,
+    text: messageText(m),
+    is_private: isPrivateTo(m, self),
+    sender_verified: verified,
+    payload: {
+      from,
+      to: addresses(m.toRecipients),
+      cc: addresses(m.ccRecipients),
+      subject: title,
+      internetMessageId: m.internetMessageId ?? null,
+      ...(attachments.length === 0 ? {} : { attachments }),
+    },
+  };
+}
+
+export function summaryOf(accountId: string, m: GraphMessage): Record<string, unknown> {
+  return {
+    message_id: m.id,
+    line: lineOf(accountId, m.conversationId ?? m.id),
+    from: addressOf(m.from),
+    from_name: nameOf(m.from),
+    date: m.receivedDateTime ?? null,
+    title: titleOf(m),
+    text_preview: (m.bodyPreview ?? '').trim(),
+    has_attachments: m.hasAttachments === true,
+    is_read: m.isRead === true,
+  };
+}
+
+export function fullOf(accountId: string, m: GraphMessage): Record<string, unknown> {
+  return {
+    message_id: m.id,
+    line: lineOf(accountId, m.conversationId ?? m.id),
+    from: addressOf(m.from),
+    from_name: nameOf(m.from),
+    date: m.receivedDateTime ?? null,
+    title: titleOf(m),
+    has_attachments: m.hasAttachments === true,
+    is_read: m.isRead === true,
+    to: addresses(m.toRecipients),
+    cc: addresses(m.ccRecipients),
+    text: capText(bodyText(m.body)),
+  };
+}

package/runtime/node_modules/@metro-labs/outlook/src/graph.ts

@@ -0,0 +1,60 @@
+import { TrainError } from '@metro-labs/core/train-error';
+import type { Account } from './accounts.js';
+import { graphBase } from './config.js';
+
+type Json = Record<string, unknown>;
+
+const urlOf = (path: string): string => (/^https?:\/\//.test(path) ? path : `${graphBase()}${path}`);
+
+async function graphMessage(res: Response): Promise<string> {
+  const body = (await res.json().catch(() => ({}))) as { error?: { code?: unknown; message?: unknown } };
+  const message = typeof body.error?.message === 'string' ? body.error.message : '';
+  const code = typeof body.error?.code === 'string' ? body.error.code : '';
+  return [code, message].filter((s) => s !== '').join(': ') || `HTTP ${String(res.status)}`;
+}
+
+export class GraphGone extends Error {}
+
+async function refusal(res: Response): Promise<Error> {
+  const detail = await graphMessage(res);
+  const status = res.status;
+  if (status === 410) return new GraphGone(detail);
+  if (status === 401) return new TrainError('outlook_signed_out', `Microsoft refused this mailbox's sign-in (${detail}); connect Outlook again from the page`, { retryable: false });
+  if (status === 403) return new TrainError('outlook_forbidden', `Microsoft does not let Metro do that on this mailbox (${detail})`, { retryable: false });
+  if (status === 404) return new TrainError('outlook_not_found', `Outlook has no such message or conversation (${detail})`, { retryable: false });
+  if (status === 413) return new TrainError('outlook_too_large', `Outlook refused the size of that request (${detail})`, { retryable: false });
+  if (status === 429) return new TrainError('outlook_throttled', `Microsoft asked Metro to slow down (${detail}); try again in a minute`, { retryable: true });
+  return new TrainError('outlook_graph_error', `Microsoft Graph answered ${String(status)} (${detail})`, { retryable: status >= 500 });
+}
+
+async function send(acct: Account, path: string, init: RequestInit, force: boolean): Promise<Response> {
+  const headers = new Headers(init.headers);
+  headers.set('authorization', `Bearer ${await acct.token(force)}`);
+  headers.set('accept', 'application/json');
+  return acct.fetch(urlOf(path), { ...init, headers });
+}
+
+export async function graph(acct: Account, path: string, init: RequestInit = {}): Promise<Response> {
+  let res = await send(acct, path, init, false);
+  if (res.status === 401) res = await send(acct, path, init, true);
+  if (!res.ok) throw await refusal(res);
+  return res;
+}
+
+export async function graphJson<T = Json>(acct: Account, path: string, init: RequestInit = {}): Promise<T> {
+  const res = await graph(acct, path, init);
+  return (await res.json()) as T;
+}
+
+export function jsonInit(method: string, body: unknown): RequestInit {
+  return { method, headers: { 'content-type': 'application/json' }, body: JSON.stringify(body) };
+}
+
+export const odataQuote = (value: string): string => `'${value.replace(/'/g, "''")}'`;
+
+export const queryOf = (params: Record<string, string>): string =>
+  Object.entries(params)
+    .map(([key, value]) => `${key}=${encodeURIComponent(value)}`)
+    .join('&');
+
+export const messagePath = (messageId: string): string => `/me/messages/${encodeURIComponent(messageId)}`;

package/runtime/node_modules/@metro-labs/outlook/src/html.ts

@@ -0,0 +1,72 @@
+export const MAX_TEXT_CHARS = 20_000;
+
+const ENTITIES: Record<string, string> = {
+  amp: '&',
+  lt: '<',
+  gt: '>',
+  quot: '"',
+  apos: "'",
+  nbsp: ' ',
+  ndash: '-',
+  mdash: '-',
+  hellip: '...',
+  rsquo: "'",
+  lsquo: "'",
+  rdquo: '"',
+  ldquo: '"',
+};
+
+function codePoint(n: number): string {
+  return Number.isInteger(n) && n > 0 && n <= 0x10ffff ? String.fromCodePoint(n) : '';
+}
+
+export function decodeEntities(text: string): string {
+  return text.replace(/&(#x[0-9a-f]+|#\d+|[a-z]+);/gi, (whole, name: string) => {
+    if (name.startsWith('#x') || name.startsWith('#X')) return codePoint(parseInt(name.slice(2), 16));
+    if (name.startsWith('#')) return codePoint(Number(name.slice(1)));
+    return ENTITIES[name.toLowerCase()] ?? whole;
+  });
+}
+
+export function htmlToText(html: string): string {
+  const text = html
+    .replace(/<!--[\s\S]*?-->/g, '')
+    .replace(/<(head|style|script|title)\b[\s\S]*?<\/\1\s*>/gi, '')
+    .replace(/<br\s*\/?>/gi, '\n')
+    .replace(/<li\b[^>]*>/gi, '\n- ')
+    .replace(/<\/(p|div|tr|h[1-6]|blockquote|table|ul|ol)\s*>/gi, '\n')
+    .replace(/<(p|div|tr|h[1-6]|blockquote|table)\b[^>]*>/gi, '\n')
+    .replace(/<\/t[dh]\s*>/gi, ' ')
+    .replace(/<[^>]*>/g, '');
+  return tidy(decodeEntities(text));
+}
+
+export function tidy(text: string): string {
+  return text
+    .replace(/\r\n?/g, '\n')
+    .replace(/[ \t ]+/g, ' ')
+    .split('\n')
+    .map((l) => l.trim())
+    .join('\n')
+    .replace(/\n{3,}/g, '\n\n')
+    .trim();
+}
+
+export function capText(text: string, max = MAX_TEXT_CHARS): string {
+  if (text.length <= max) return text;
+  return `${text.slice(0, max)}\n[... ${String(text.length - max)} more characters]`;
+}
+
+export function bodyText(body: { contentType?: unknown; content?: unknown } | undefined): string {
+  const content = typeof body?.content === 'string' ? body.content : '';
+  return String(body?.contentType).toLowerCase() === 'html' ? htmlToText(content) : tidy(content);
+}
+
+export function escapeHtml(text: string): string {
+  return text
+    .replace(/&/g, '&amp;')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;')
+    .replace(/\r?\n/g, '<br>');
+}

package/runtime/node_modules/@metro-labs/outlook/src/inbound.ts

@@ -0,0 +1,104 @@
+import { log } from '@metro-labs/core/log';
+import { emitInbound, reportAttachment } from '@metro-labs/core/stations/train-events';
+import type { Account } from './accounts.js';
+import { listFiles, metaOf, saveFile, type MailFile } from './attachments.js';
+import { addressOf, inboundEnvelope, MESSAGE_FIELDS, type GraphMessage } from './format.js';
+import { graphJson, GraphGone } from './graph.js';
+import { noteSeen } from './state.js';
+import { screen, type Screened } from './trust.js';
+
+export const POLL_MS = Number(process.env.METRO_OUTLOOK_POLL_MS) || 30_000;
+
+const FIRST_PAGE = `/me/mailFolders/inbox/messages/delta?$select=${MESSAGE_FIELDS}`;
+const PAGE_SIZE = { prefer: 'odata.maxpagesize=50' };
+
+interface DeltaPage {
+  value?: GraphMessage[];
+  '@odata.nextLink'?: string;
+  '@odata.deltaLink'?: string;
+}
+
+function fresh(acct: Account, m: GraphMessage, since: string): boolean {
+  if (m['@removed'] !== undefined) return false;
+  if (acct.state.seen.includes(m.id)) return false;
+  if (addressOf(m.from) === acct.email) return false;
+  return Date.parse(m.receivedDateTime ?? '') >= Date.parse(since);
+}
+
+const reasonOf = (err: unknown): string => (err instanceof Error ? err.message : String(err));
+
+async function screened(acct: Account, m: GraphMessage): Promise<Screened> {
+  return screen(acct, m).catch((err: unknown) => {
+    process.stderr.write(`outlook[${acct.id}] could not read the headers of a message, so it counts as unverified: ${reasonOf(err)}\n`);
+    return { verified: false };
+  });
+}
+
+async function deliver(acct: Account, m: GraphMessage): Promise<boolean> {
+  const verdict = await screened(acct, m);
+  if ('skip' in verdict) {
+    log.debug({ account: acct.id, reason: verdict.skip }, 'outlook: skipped an automated mail');
+    return false;
+  }
+  const files: MailFile[] =
+    m.hasAttachments === true
+      ? await listFiles(acct, m.id).catch((err: unknown) => {
+          process.stderr.write(`outlook[${acct.id}] could not list the files of a message: ${reasonOf(err)}\n`);
+          return [];
+        })
+      : [];
+  const env = inboundEnvelope(acct.id, acct.email, m, files.map(metaOf), verdict.verified);
+  emitInbound(acct.id, env);
+  const at = { station: 'outlook', account: acct.id, line: String(env.line), forId: String(env.id) };
+  for (const [index, file] of files.entries())
+    reportAttachment(saveFile(acct, m.id, file, index), { ...at, index }, { saved: { kind: file.kind, size: file.size }, failed: { kind: file.kind } });
+  return true;
+}
+
+async function walk(acct: Account, start: string, onMessage: (m: GraphMessage) => Promise<void>): Promise<string | null> {
+  let next: string | undefined = start;
+  while (next !== undefined) {
+    const page: DeltaPage = await graphJson<DeltaPage>(acct, next, { headers: PAGE_SIZE });
+    for (const m of page.value ?? []) await onMessage(m);
+    if (page['@odata.deltaLink'] !== undefined) return page['@odata.deltaLink'];
+    next = page['@odata.nextLink'];
+  }
+  return null;
+}
+
+export async function syncOnce(acct: Account): Promise<number> {
+  const state = acct.state;
+  const since = state.syncedAt;
+  if (state.deltaLink === null || since === null) {
+    state.syncedAt = since ?? new Date().toISOString();
+    state.deltaLink = await walk(acct, FIRST_PAGE, () => Promise.resolve());
+    acct.save();
+    return 0;
+  }
+  let count = 0;
+  try {
+    state.deltaLink = await walk(acct, state.deltaLink, async (m) => {
+      if (!fresh(acct, m, since)) return;
+      if (await deliver(acct, m)) count += 1;
+      noteSeen(state, m.id);
+    });
+  } catch (err) {
+    if (!(err instanceof GraphGone)) throw err;
+    state.deltaLink = null;
+  }
+  acct.save();
+  return count;
+}
+
+export function startPolling(acct: Account, intervalMs = POLL_MS): void {
+  const tick = (): void => {
+    syncOnce(acct)
+      .catch((err: unknown) => {
+        process.stderr.write(`outlook[${acct.id}] mail check failed: ${err instanceof Error ? err.message : String(err)}\n`);
+      })
+      .finally(() => {
+        setTimeout(tick, intervalMs);
+      });
+  };
+  tick();
+}

package/runtime/node_modules/@metro-labs/outlook/src/index.ts

@@ -0,0 +1,12 @@
+import { readCalls } from '@metro-labs/core/trains/protocol';
+import { announceAccounts } from '@metro-labs/core/stations/train-boot';
+import { Account, accounts, loadAccounts } from './accounts.js';
+import { handleCall } from './actions.js';
+import { startPolling } from './inbound.js';
+
+readCalls('outlook', handleCall);
+
+for (const cfg of loadAccounts()) accounts.set(cfg.id, new Account(cfg));
+announceAccounts('outlook', accounts.keys());
+
+for (const acct of accounts.values()) startPolling(acct);