@vibesdotdev/integrations-microsoft 0.0.0-stage → 1.0.0-rc.1

package/LICENSE

@@ -0,0 +1,126 @@
+Business Source License 1.1
+
+Parameters
+
+Licensor:             VIBES DEV LLC
+Licensed Work:        @vibesdotdev/integrations-microsoft
+                      The Licensed Work is (c) 2026 VIBES DEV LLC.
+Additional Use Grant: In this grant, "Vibes Platform" means the hosted services VIBES DEV LLC
+                      operates at vibes.dev and its subdomains.
+
+                      You may make production use of the Licensed Work, including commercial
+                      use, subject to the limits below. Permitted production use includes:
+                      building, operating and selling your own applications, agents and services
+                      on or with the Vibes Platform; self-hosting the Licensed Work for use inside
+                      your own organization; and providing consulting, integration or development
+                      services to clients who build on the Vibes Platform.
+
+                      The production use permitted above does not include use that:
+
+                      (a) offers third parties a hosted, managed or embedded service that
+                          substitutes for the Vibes Platform or a material part of it (including
+                          agent hosting; fleet, sandbox or container provisioning; package
+                          registry; source hosting and continuous integration; and managed AI,
+                          storage, secrets or messaging), where the Licensed Work provides a
+                          material part of that service's value and that service earns more than
+                          US$1,000,000 in gross revenue in any twelve-month period;
+                      (b) sells, rents, sublicenses or white-labels the Licensed Work, or access
+                          to Vibes Platform functionality, as a product in its own right;
+                      (c) removes, disables or works around entitlement checks, usage metering,
+                          quotas or plan limits, or reaches Vibes Platform features the user's
+                          account is not entitled to;
+                      (d) scrapes, bulk-exports or harvests data or content from the Vibes
+                          Platform or its users other than through documented interfaces and
+                          within their terms, or uses outputs or data obtained from the Vibes
+                          Platform to train or improve a product that competes with it;
+                      (e) violates applicable law, infringes anyone's rights, commits fraud or
+                          deception, conducts unlawful surveillance or harassment, distributes
+                          malware, or accesses systems without authorization; or
+                      (f) violates applicable antitrust or competition law.
+
+                      A written permission from the Licensor extends this grant.
+Change Date:          Four years from the date the Licensed Work is published.
+Change License:       MIT
+
+For information about alternative licensing arrangements for the Licensed Work,
+contact VIBES DEV LLC through https://vibes.dev.
+
+Notice
+
+The Business Source License (this document, or the "License") is not an Open
+Source license. However, the Licensed Work will eventually be made available
+under an Open Source License, as stated in this License.
+
+-----------------------------------------------------------------------------
+
+Business Source License 1.1
+
+License text copyright © 2017 MariaDB Corporation Ab, All Rights Reserved.
+"Business Source License" is a trademark of MariaDB Corporation Ab.
+
+Terms
+
+The Licensor hereby grants you the right to copy, modify, create derivative
+works, redistribute, and make non-production use of the Licensed Work. The
+Licensor may make an Additional Use Grant, above, permitting limited
+production use.
+
+Effective on the Change Date, or the fourth anniversary of the first publicly
+available distribution of a specific version of the Licensed Work under this
+License, whichever comes first, the Licensor hereby grants you rights under
+the terms of the Change License, and the rights granted in the paragraph
+above terminate.
+
+If your use of the Licensed Work does not comply with the requirements
+currently in effect as described in this License, you must purchase a
+commercial license from the Licensor, its affiliated entities, or authorized
+resellers, or you must refrain from using the Licensed Work.
+
+All copies of the original and modified Licensed Work, and derivative works
+of the Licensed Work, are subject to this License. This License applies
+separately for each version of the Licensed Work and the Change Date may vary
+for each version of the Licensed Work released by Licensor.
+
+You must conspicuously display this License on each original or modified copy
+of the Licensed Work. If you receive the Licensed Work in original or
+modified form from a third party, the terms and conditions set forth in this
+License apply to your use of that work.
+
+Any use of the Licensed Work in violation of this License will automatically
+terminate your rights under this License for the current and all other
+versions of the Licensed Work.
+
+This License does not grant you any right in any trademark or logo of
+Licensor or its affiliates (provided that you may use a trademark or logo of
+Licensor as expressly required by this License).
+
+TO THE EXTENT PERMITTED BY APPLICABLE LAW, THE LICENSED WORK IS PROVIDED ON
+AN “AS IS” BASIS. LICENSOR HEREBY DISCLAIMS ALL WARRANTIES AND CONDITIONS,
+EXPRESS OR IMPLIED, INCLUDING (WITHOUT LIMITATION) WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, AND
+TITLE.
+
+MariaDB hereby grants you permission to use this License’s text to license
+your works, and to refer to it using the trademark “Business Source License”,
+as long as you comply with the Covenants of Licensor below.
+
+Covenants of Licensor
+
+In consideration of the right to use this License’s text and the “Business
+Source License” name and trademark, Licensor covenants to MariaDB, and to all
+other recipients of the licensed work to be provided by Licensor:
+
+1. To specify as the Change License the GPL Version 2.0 or any later version,
+   or a license that is compatible with GPL Version 2.0 or a later version,
+   where “compatible” means that software provided under the Change License can
+   be included in a program with software provided under GPL Version 2.0 or a
+   later version. Licensor may specify additional Change Licenses without
+   limitation.
+
+2. To either: (a) specify an additional grant of rights to use that does not
+   impose any additional restriction on the right granted in this License, as
+   the Additional Use Grant; or (b) insert the text “None”.
+
+3. To specify a Change Date.
+
+4. Not to modify this License in any other way.

package/README.md

@@ -1,3 +1,121 @@
-# Temporary Holding Version
+# @vibesdotdev/integrations-microsoft
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Microsoft Graph, SharePoint, OneDrive and Outlook through the Vibes runtime.
+
+Compose `@vibesdotdev/integrations-microsoft/api-client-plugin` in consumers,
+then use the runtime-owned client:
+
+```ts
+import { getVibesMicrosoftClient } from '@vibesdotdev/integrations-microsoft/client';
+
+const microsoft = await getVibesMicrosoftClient(runtime);
+const sites = await microsoft.sites.list();
+const children = await microsoft.drives.children(sites[0].id);
+```
+
+The client defaults to delegated access and dispatches through Platform's internal
+API. Request identity is read on each call. App-only mode uses tenant-wide
+Microsoft credentials and still requires Platform actor authorization.
+
+Hosts compose `./cloud.plugin` for fetch-only Graph providers and the
+SharePoint adapter, `./consumer.plugin` for app-only execution, and
+`./email/plugin` for Outlook. The broad `./plugin` combines the Graph slices for
+Node hosts; browser and Worker bundles use narrow slices. SharePoint's descriptor
+currently admits consumer hardware.
+
+Delegated hosts inject the identity owner's authInternalClient.
+The provider passes an OAuth-account reference to Secrets, which applies the
+current token to each Graph request. Sign-in, refresh and disconnect stay with
+the identity owner. App-only hosts inject the integration store and declare
+clientId, clientSecret and tenantId references. Secrets performs the client
+credentials exchange and sends the Graph request; tokens do not enter provider
+code. The tenant host reference is restricted to the configured home org or an
+invocation without an org.
+
+SharePoint supports browsing, recursive search, document and object storage.
+Document listings validate against the supplied schema; they are not persisted
+configuration. Object URLs prefer Graph's temporary signed download URL and fall back to proxy serving when Graph supplies no URL. Repository, record, key-value,
+transactions, bulk document save/delete and SQL are unsupported.
+
+Outlook selected-account operations use an authorized saved connection and pass
+its credential reference to Secrets. Sender mismatches refuse; sending requires
+a real Graph message receipt. Portable OAuth exchange and credential replacement helpers live at
+`./server/oauth`; omitted refresh tokens preserve existing credentials.
+
+See [SPEC.md](SPEC.md) for exports, operations, typed refusal codes and hosting
+contracts. Run `bun run check`, `bun run test`, and `bun run build` from this
+package. The owning workspace rules and oxlint ratchet complete verification.
+
+## Credential-owner composition
+
+The delegated provider uses `oauthDefaultAccountCredentialReference` from Auth;
+explicit saved Outlook connections use the Core store's authorized
+`loadConnectionReferences` port. Integration connection ids are never treated as
+Auth provider account ids. Auth's API client plugin must be composed by the host,
+along with Secrets and the current verified request principal. Anonymous and
+unsupported delegated principals cannot borrow a human account. Auth owns refresh;
+the connector supplies no feature-readable refresh-token reference.
+
+App-only operations forward declared client/secret/tenant references through the
+existing Secrets authenticated-request binding. Secrets sends the form-auth
+`client_credentials` grant and applies the Bearer token. The Microsoft module is
+a pure transport adapter; it holds no token cache and resolves no credentials.
+Direct callers of the legacy low-level Graph client retain their explicit token
+acquirer. Hosted calls leave Authorization to Secrets and preserve explicit
+redirect refusal, string request bodies and replayable Blob uploads.
+
+The composed proof uses real Auth, Secrets, Core persistence and provider owners
+with far managed-vault JSON and vendor/Auth HTTP fixtures. It does not establish
+production encryption, deployed authentication or remote provider acceptance.
+
+## Credential API migration
+
+Provider `acquireToken()` and `getMsalConfiguration()` are replaced by declared
+`invokeOperation(operationId, args)` calls. Custom Graph requests use
+`getCredentialUseConfiguration()` and Core's
+`sendIntegrationAuthenticatedRequest`; app-only callers supply its existing
+`oauth-client-credentials` binding with the returned client/secret/tenant
+candidates, Microsoft token endpoint and declared scopes. Nonempty admitted
+config.tenantId takes precedence as an encoded public endpoint segment; only a
+blank config tenant falls back to the tenant credential reference. No provider
+token-value replacement is exposed.
+
+Delegated `getCredentials()` now returns an empty object and
+`getCredential(key)` returns undefined. `getResolvedConfiguration()` contains
+empty `credentials` and reference-only `credentialReferences`. Migrate value
+reads to owner-bound use, inside the authenticated invocation:
+
+```ts
+import { sendIntegrationAuthenticatedRequest } from '@vibesdotdev/integrations/server/secrets';
+import type { IntegrationProviderDescriptor, IntegrationProviderImplementation } from '@vibesdotdev/integrations/schemas/integration-descriptor';
+
+const provider = await runtime.query<IntegrationProviderDescriptor, IntegrationProviderImplementation>('integration/provider')
+  .withId('integration.microsoft.delegated').resolve();
+if (!provider.getCredentialUseConfiguration) throw new Error('Reference delivery unavailable');
+const configuration = await provider.getCredentialUseConfiguration();
+const candidates = configuration.credentialReferences.accessToken ?? [];
+const response = await sendIntegrationAuthenticatedRequest(runtime, {
+  url: 'https://graph.microsoft.com/v1.0/me/drive',
+  options: {
+    method: 'GET',
+    credentialBindings: [{ kind: 'header', header: 'authorization', prefix: 'Bearer ', candidates }]
+  }
+});
+// Consume or cancel response.body before leaving the operation.
+const drive = await response.json();
+```
+
+Low-level `GraphSharePointClient({ integration: customTokenAcquirer, fetchFn })`
+remains supported for explicit direct callers. Hosted Graph clients use the
+reference-owned transport. Binary reads first request Graph item metadata and
+then fetch its preauthenticated download URL without Authorization, through the
+same request owner for cancellation and body lifetime. Secrets' cross-origin
+credential redirect refusal remains unchanged. Missing file metadata can yield
+absence; failed reads or body cleanup remain failures.
+
+When Graph omits the metadata download annotation, object-store proxy reads
+request `/content` with explicit manual redirect handling. The Graph response
+is closed before the preauthenticated Location is requested separately without
+credentials. A direct 200 body remains supported. This preserves `url()` proxy
+results through `get()`; failed Graph body cleanup never becomes absence or a
+second request. Automatic credential redirects remain restricted by Secrets.

package/dist/api-client-plugin.d.ts

@@ -0,0 +1,3 @@
+export declare const microsoftClientPlugin: import("@vibesdotdev/kernel").RuntimePlugin;
+export default microsoftClientPlugin;
+//# sourceMappingURL=api-client-plugin.d.ts.map

package/dist/api-client-plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-client-plugin.d.ts","sourceRoot":"","sources":["../src/api-client-plugin.ts"],"names":[],"mappings":"AACA,eAAO,MAAM,qBAAqB,6CAOhC,CAAC;AACH,eAAe,qBAAqB,CAAC"}

package/dist/api-client-plugin.js

@@ -0,0 +1,11 @@
+import { createRuntimePlugin, loader } from '@vibesdotdev/kernel/factory';
+export const microsoftClientPlugin = createRuntimePlugin({
+    id: 'integrations-microsoft/client', name: 'Microsoft runtime client',
+    descriptors: [{ id: 'microsoft', kind: 'runtime/client', description: 'Microsoft 365 operation dispatch client' }],
+    loaders: [loader('microsoft', { kind: 'runtime/client' }, async () => {
+            const { MicrosoftClient } = await import("./client/runtime-client.js");
+            return { impl: MicrosoftClient };
+        })]
+});
+export default microsoftClientPlugin;
+//# sourceMappingURL=api-client-plugin.js.map

package/dist/api-client-plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-client-plugin.js","sourceRoot":"","sources":["../src/api-client-plugin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAC,MAAM,EAAE,MAAM,6BAA6B,CAAC;AACzE,MAAM,CAAC,MAAM,qBAAqB,GAAC,mBAAmB,CAAC;IACtD,EAAE,EAAE,+BAA+B,EAAC,IAAI,EAAE,0BAA0B;IACpE,WAAW,EAAE,CAAC,EAAE,EAAE,EAAE,WAAW,EAAC,IAAI,EAAE,gBAAgB,EAAC,WAAW,EAAE,yCAAyC,EAAE,CAAC;IAChH,OAAO,EAAE,CAAC,MAAM,CAAC,WAAW,EAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAC,KAAK,IAAI,EAAE;YAClE,MAAM,EAAE,eAAe,EAAE,GAAC,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC;YACrE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;QAClC,CAAC,CAAC,CAAC;CACH,CAAC,CAAC;AACH,eAAe,qBAAqB,CAAC"}

package/dist/client/helper.d.ts

@@ -0,0 +1,17 @@
+import type { VibesRuntime } from '@vibesdotdev/kernel';
+import type { MicrosoftClient } from './runtime-client.ts';
+/**
+ * Resolve the canonical `MicrosoftClient`.
+ *
+ * Equivalent to `runtime.query('runtime/client').withId('microsoft').resolve()`.
+ * Requires the integrations-microsoft plugin to be composed into the runtime.
+ *
+ * ```ts
+ * import { getVibesMicrosoftClient } from '@vibesdotdev/integrations-microsoft/client';
+ * const ms = await getVibesMicrosoftClient(runtime);
+ * const sites = await ms.sites.list();
+ * const items = await ms.drives.children(sites[0].id, 'Drawings');
+ * ```
+ */
+export declare function getVibesMicrosoftClient(runtime: VibesRuntime): Promise<MicrosoftClient>;
+//# sourceMappingURL=helper.d.ts.map

package/dist/client/helper.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"helper.d.ts","sourceRoot":"","sources":["../../src/client/helper.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAExD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAE3D;;;;;;;;;;;;GAYG;AACH,wBAAsB,uBAAuB,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,eAAe,CAAC,CAE7F"}

package/dist/client/helper.js

@@ -0,0 +1,18 @@
+import { getVibesClient } from '@vibesdotdev/kernel/client';
+/**
+ * Resolve the canonical `MicrosoftClient`.
+ *
+ * Equivalent to `runtime.query('runtime/client').withId('microsoft').resolve()`.
+ * Requires the integrations-microsoft plugin to be composed into the runtime.
+ *
+ * ```ts
+ * import { getVibesMicrosoftClient } from '@vibesdotdev/integrations-microsoft/client';
+ * const ms = await getVibesMicrosoftClient(runtime);
+ * const sites = await ms.sites.list();
+ * const items = await ms.drives.children(sites[0].id, 'Drawings');
+ * ```
+ */
+export async function getVibesMicrosoftClient(runtime) {
+    return getVibesClient('microsoft', runtime);
+}
+//# sourceMappingURL=helper.js.map

package/dist/client/helper.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"helper.js","sourceRoot":"","sources":["../../src/client/helper.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAG5D;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,OAAqB;IAClE,OAAO,cAAc,CAAkB,WAAW,EAAE,OAAO,CAAC,CAAC;AAC9D,CAAC"}

package/dist/client/index.d.ts

@@ -0,0 +1,3 @@
+export { MicrosoftClient } from './runtime-client.ts';
+export { getVibesMicrosoftClient } from './helper.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/client/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/client/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC"}

package/dist/client/index.js

@@ -0,0 +1,3 @@
+export { MicrosoftClient } from "./runtime-client.js";
+export { getVibesMicrosoftClient } from "./helper.js";
+//# sourceMappingURL=index.js.map

package/dist/client/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/client/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC"}

package/dist/client/runtime-client.d.ts

@@ -0,0 +1,87 @@
+import type { KindContext, VibesRuntime } from '@vibesdotdev/kernel';
+import { BaseRuntimeClient, type RuntimeClientDescriptor } from '@vibesdotdev/kernel/client';
+import { type PlatformInternalIntegrationInvokeInput } from '@vibesdotdev/platform/internal-api';
+import * as z from 'zod/v4';
+import { type MicrosoftClientMode } from '../schemas/operations.ts';
+export type { MicrosoftClientMode } from '../schemas/operations.ts';
+/** Runtime-owned Microsoft client. App-only changes Graph credentials; Platform still authorizes the actor. */
+export declare class MicrosoftClient extends BaseRuntimeClient {
+    private mode;
+    readonly sites: {
+        list: () => Promise<{
+            id: string;
+            name: string;
+            webUrl: string;
+        }[]>;
+    };
+    readonly drives: {
+        children: (siteId: string, folderPath?: string) => Promise<{
+            id: string;
+            name: string;
+            size: number;
+            lastModified: string;
+            mimeType: string;
+            isFolder: boolean;
+            webUrl?: string | undefined;
+        }[]>;
+        childrenById: (siteId: string, itemId: string) => Promise<{
+            id: string;
+            name: string;
+            size: number;
+            lastModified: string;
+            mimeType: string;
+            isFolder: boolean;
+            webUrl?: string | undefined;
+        }[]>;
+        getDownloadUrl: (siteId: string, itemId: string) => Promise<{
+            url: string;
+            expiresAt: string | null;
+        }>;
+    };
+    constructor(descriptor?: RuntimeClientDescriptor, context?: KindContext, runtime?: VibesRuntime);
+    getMode(): MicrosoftClientMode;
+    setMode(mode: MicrosoftClientMode): void;
+    get integrationId(): string;
+    /** Dispatch all supported operations, validating the operation-specific result. */
+    invoke(operationId: string, args?: PlatformInternalIntegrationInvokeInput['args'], authority?: Omit<PlatformInternalIntegrationInvokeInput, 'integrationId' | 'operationId' | 'args'>): Promise<{
+        id: string;
+        name: string;
+        size: number;
+        lastModified: string;
+        mimeType: string;
+        isFolder: boolean;
+        webUrl?: string | undefined;
+    } | {
+        url: string;
+        expiresAt: string | null;
+    } | {
+        ok: true;
+        itemId: string;
+    } | {
+        id: string;
+        name: string;
+        webUrl: string;
+    }[] | {
+        id: string;
+        name: string;
+        size: number;
+        lastModified: string;
+        mimeType: string;
+        isFolder: boolean;
+        webUrl?: string | undefined;
+    }[] | {
+        id: string;
+        name: string;
+        size: number;
+        lastModified: string;
+        mimeType: string;
+        isFolder: boolean;
+        parentPath: string;
+        parentId: string;
+        siteId: string;
+        webUrl?: string | undefined;
+    }[]>;
+    /** Extension operations require their owning result schema rather than a caller's arbitrary T assertion. */
+    invokeValidated<T>(operationId: string, args: PlatformInternalIntegrationInvokeInput['args'], schema: z.ZodType<T>, authority?: Omit<PlatformInternalIntegrationInvokeInput, 'integrationId' | 'operationId' | 'args'>): Promise<T>;
+}
+//# sourceMappingURL=runtime-client.d.ts.map

package/dist/client/runtime-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-client.d.ts","sourceRoot":"","sources":["../../src/client/runtime-client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAC,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEpE,OAAO,EAAE,iBAAiB,EAAC,KAAK,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AAC5F,OAAO,EAAiC,KAAK,sCAAsC,EAAE,MAAM,oCAAoC,CAAC;AAChI,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,OAAO,EAAuJ,KAAK,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AACzN,YAAY,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAEpE,+GAA+G;AAC/G,qBAAa,eAAgB,SAAQ,iBAAiB;IACrD,OAAO,CAAC,IAAI,CAAkC;IAC9C,QAAQ,CAAC,KAAK;;;;;;MAAwH;IACtI,QAAQ,CAAC,MAAM;2BACK,MAAM,eAAc,MAAM;;;;;;;;;+BACtB,MAAM,UAAS,MAAM;;;;;;;;;iCACnB,MAAM,UAAS,MAAM;;;;MAC7C;gBACU,UAAU,GAAE,uBAAkE,EAAC,OAAO,CAAC,EAAE,WAAW,EAAC,OAAO,CAAC,EAAE,YAAY;IAGvI,OAAO,IAAI,mBAAmB;IAC9B,OAAO,CAAC,IAAI,EAAE,mBAAmB,GAAG,IAAI;IACxC,IAAI,aAAa,IAAI,MAAM,CAA+F;IAE1H,mFAAmF;IAC7E,MAAM,CAAC,WAAW,EAAE,MAAM,EAAC,IAAI,CAAC,EAAE,sCAAsC,CAAC,MAAM,CAAC,EAAC,SAAS,CAAC,EAAE,IAAI,CAAC,sCAAsC,EAAC,eAAe,GAAC,aAAa,GAAC,MAAM,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAQpL,4GAA4G;IACtG,eAAe,CAAC,CAAC,EACtB,WAAW,EAAE,MAAM,EAAC,IAAI,EAAE,sCAAsC,CAAC,MAAM,CAAC,EAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAC7F,SAAS,CAAC,EAAE,IAAI,CAAC,sCAAsC,EAAC,eAAe,GAAC,aAAa,GAAC,MAAM,CAAC,GAC3F,OAAO,CAAC,CAAC,CAAC;CAcb"}

package/dist/client/runtime-client.js

@@ -0,0 +1,47 @@
+import { CapabilityError } from '@vibesdotdev/kernel';
+import { BaseRuntimeClient } from '@vibesdotdev/kernel/client';
+import { getVibesPlatformInternalClient } from '@vibesdotdev/platform/internal-api';
+import * as z from 'zod/v4';
+import { admitMicrosoft, IdentitySchema, OptionalIdentitySchema, optionalMicrosoftContext } from "../schemas/boundary.js";
+import { MicrosoftClientModeSchema, MicrosoftOperationSchemas, MicrosoftSharePointOperationIdSchema, MicrosoftOperationInputSchema } from "../schemas/operations.js";
+/** Runtime-owned Microsoft client. App-only changes Graph credentials; Platform still authorizes the actor. */
+export class MicrosoftClient extends BaseRuntimeClient {
+    mode = 'delegated';
+    sites = { list: () => this.invoke('listSites').then(data => admitMicrosoft(MicrosoftOperationSchemas.listSites.output, data)) };
+    drives = {
+        children: (siteId, folderPath) => this.invoke('browseDrive', { siteId, folderPath }).then(data => admitMicrosoft(MicrosoftOperationSchemas.browseDrive.output, data)),
+        childrenById: (siteId, itemId) => this.invoke('browseDriveItem', { siteId, itemId }).then(data => admitMicrosoft(MicrosoftOperationSchemas.browseDriveItem.output, data)),
+        getDownloadUrl: (siteId, itemId) => this.invoke('getDownloadUrl', { siteId, itemId }).then(data => admitMicrosoft(MicrosoftOperationSchemas.getDownloadUrl.output, data))
+    };
+    constructor(descriptor = { id: 'microsoft', kind: 'runtime/client' }, context, runtime) {
+        super(descriptor, context, runtime);
+    }
+    getMode() { return this.mode; }
+    setMode(mode) { this.mode = admitMicrosoft(MicrosoftClientModeSchema, mode); }
+    get integrationId() { return this.mode === 'delegated' ? 'integration.microsoft.delegated' : 'integration.microsoft'; }
+    /** Dispatch all supported operations, validating the operation-specific result. */
+    async invoke(operationId, args, authority) {
+        const id = admitMicrosoft(MicrosoftSharePointOperationIdSchema, operationId);
+        const contract = MicrosoftOperationSchemas[id];
+        const input = admitMicrosoft(contract.input, args);
+        const result = await this.invokeValidated(operationId, input, contract.output, authority);
+        return result;
+    }
+    /** Extension operations require their owning result schema rather than a caller's arbitrary T assertion. */
+    async invokeValidated(operationId, args, schema, authority) {
+        // Delegated identity always comes from the current request, including on a cached client.
+        const userId = admitMicrosoft(IdentitySchema, this.mode === 'delegated' || !authority
+            ? await this.runtime.context('userId') : authority.userId);
+        const organizationId = authority?.organizationId ?? admitMicrosoft(OptionalIdentitySchema, await optionalMicrosoftContext(this.runtime, 'orgId'));
+        const client = await getVibesPlatformInternalClient(this.runtime);
+        const result = await client.integrations.invoke({
+            ...authority, userId, organizationId, integrationId: this.integrationId, operationId, args
+        }, schema);
+        if (!result.ok)
+            throw new CapabilityError('Microsoft operation was refused.', 'UNAVAILABLE', {
+                reason: 'microsoft-operation-refused', details: { errorCount: result.errors.length }
+            });
+        return admitMicrosoft(schema, result.data);
+    }
+}
+//# sourceMappingURL=runtime-client.js.map

package/dist/client/runtime-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-client.js","sourceRoot":"","sources":["../../src/client/runtime-client.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAA+B,MAAM,4BAA4B,CAAC;AAC5F,OAAO,EAAE,8BAA8B,EAA8C,MAAM,oCAAoC,CAAC;AAChI,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,cAAc,EAAC,cAAc,EAAC,sBAAsB,EAAC,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AACvH,OAAO,EAAE,yBAAyB,EAAC,yBAAyB,EAAC,oCAAoC,EAA+B,6BAA6B,EAA2B,MAAM,0BAA0B,CAAC;AAGzN,+GAA+G;AAC/G,MAAM,OAAO,eAAgB,SAAQ,iBAAiB;IAC7C,IAAI,GAAsB,WAAW,CAAC;IACrC,KAAK,GAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,cAAc,CAAC,yBAAyB,CAAC,SAAS,CAAC,MAAM,EAAC,IAAI,CAAC,CAAC,EAAE,CAAC;IAC7H,MAAM,GAAC;QACf,QAAQ,EAAE,CAAC,MAAc,EAAC,UAAmB,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,EAAC,EAAE,MAAM,EAAC,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,cAAc,CAAC,yBAAyB,CAAC,WAAW,CAAC,MAAM,EAAC,IAAI,CAAC,CAAC;QAClL,YAAY,EAAE,CAAC,MAAc,EAAC,MAAc,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAAC,EAAE,MAAM,EAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,cAAc,CAAC,yBAAyB,CAAC,eAAe,CAAC,MAAM,EAAC,IAAI,CAAC,CAAC;QACrL,cAAc,EAAE,CAAC,MAAc,EAAC,MAAc,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAC,EAAE,MAAM,EAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,cAAc,CAAC,yBAAyB,CAAC,cAAc,CAAC,MAAM,EAAC,IAAI,CAAC,CAAC;KACrL,CAAC;IACF,YAAY,aAAoC,EAAE,EAAE,EAAE,WAAW,EAAC,IAAI,EAAE,gBAAgB,EAAE,EAAC,OAAqB,EAAC,OAAsB;QACtI,KAAK,CAAC,UAAU,EAAC,OAAO,EAAC,OAAO,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,KAA0B,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACpD,OAAO,CAAC,IAAyB,IAAU,IAAI,CAAC,IAAI,GAAC,cAAc,CAAC,yBAAyB,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACtG,IAAI,aAAa,KAAa,OAAO,IAAI,CAAC,IAAI,KAAG,WAAW,CAAA,CAAC,CAAC,iCAAiC,CAAA,CAAC,CAAA,uBAAuB,CAAC,CAAC,CAAC;IAE1H,mFAAmF;IACnF,KAAK,CAAC,MAAM,CAAC,WAAmB,EAAC,IAAqD,EAAC,SAA6F;QACnL,MAAM,EAAE,GAAC,cAAc,CAAC,oCAAoC,EAAC,WAAW,CAAC,CAAC;QAC1E,MAAM,QAAQ,GAAC,yBAAyB,CAAC,EAAE,CAAC,CAAC;QAC7C,MAAM,KAAK,GAAC,cAAc,CAAgD,QAAQ,CAAC,KAAK,EAAC,IAAI,CAAC,CAAC;QAC/F,MAAM,MAAM,GAAC,MAAM,IAAI,CAAC,eAAe,CAA2B,WAAW,EAAC,KAAK,EAAC,QAAQ,CAAC,MAAM,EAAC,SAAS,CAAC,CAAC;QAC/G,OAAO,MAAM,CAAC;IACf,CAAC;IAED,4GAA4G;IAC5G,KAAK,CAAC,eAAe,CACpB,WAAmB,EAAC,IAAoD,EAAC,MAAoB,EAC7F,SAA6F;QAE7F,0FAA0F;QAC1F,MAAM,MAAM,GAAC,cAAc,CAAC,cAAc,EAAC,IAAI,CAAC,IAAI,KAAG,WAAW,IAAE,CAAC,SAAS;YAC7E,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA,CAAC,CAAA,SAAS,CAAC,MAAM,CAAC,CAAC;QAC1D,MAAM,cAAc,GAAC,SAAS,EAAE,cAAc,IAAE,cAAc,CAAC,sBAAsB,EAAC,MAAM,wBAAwB,CAAC,IAAI,CAAC,OAAO,EAAC,OAAO,CAAC,CAAC,CAAC;QAC5I,MAAM,MAAM,GAAC,MAAM,8BAA8B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAChE,MAAM,MAAM,GAAC,MAAM,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC;YAC7C,GAAG,SAAS,EAAC,MAAM,EAAC,cAAc,EAAC,aAAa,EAAE,IAAI,CAAC,aAAa,EAAC,WAAW,EAAC,IAAI;SACrF,EAAC,MAAM,CAAC,CAAC;QACV,IAAG,CAAC,MAAM,CAAC,EAAE;YAAE,MAAM,IAAI,eAAe,CAAC,kCAAkC,EAAC,aAAa,EAAC;gBACzF,MAAM,EAAE,6BAA6B,EAAC,OAAO,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE;aACnF,CAAC,CAAC;QACH,OAAO,cAAc,CAAC,MAAM,EAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC3C,CAAC;CACD"}

package/dist/cloud.plugin.d.ts

@@ -0,0 +1,3 @@
+export declare const microsoftCloudPlugin: import("@vibesdotdev/kernel").RuntimePlugin;
+export default microsoftCloudPlugin;
+//# sourceMappingURL=cloud.plugin.d.ts.map

package/dist/cloud.plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud.plugin.d.ts","sourceRoot":"","sources":["../src/cloud.plugin.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,oBAAoB,6CAa/B,CAAC;AACH,eAAe,oBAAoB,CAAC"}

package/dist/cloud.plugin.js

@@ -0,0 +1,19 @@
+import { createRuntimePlugin, loader } from '@vibesdotdev/kernel/factory';
+import microsoftDelegatedDescriptor from "./microsoft/system.integration.microsoft.delegated.descriptor.js";
+import sharepointAdapterDescriptor from "./sharepoint/sharepoint.adapter.descriptor.js";
+export const microsoftCloudPlugin = createRuntimePlugin({
+    id: 'integrations-microsoft/cloud', name: 'Microsoft Graph providers',
+    descriptors: [microsoftDelegatedDescriptor, sharepointAdapterDescriptor],
+    loaders: [
+        loader(microsoftDelegatedDescriptor.id, { kind: 'integration/provider' }, async () => {
+            const { MicrosoftDelegatedIntegration } = await import("./microsoft/microsoft-delegated-implementation.js");
+            return { default: MicrosoftDelegatedIntegration };
+        }),
+        loader(sharepointAdapterDescriptor.id, { kind: 'storage/adapter' }, async () => {
+            const { createSharePointAdapterImplementation } = await import("./sharepoint/sharepoint.adapter.impl.js");
+            return createSharePointAdapterImplementation();
+        })
+    ]
+});
+export default microsoftCloudPlugin;
+//# sourceMappingURL=cloud.plugin.js.map

package/dist/cloud.plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud.plugin.js","sourceRoot":"","sources":["../src/cloud.plugin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAC,MAAM,EAAE,MAAM,6BAA6B,CAAC;AACzE,OAAO,4BAA4B,MAAM,kEAAkE,CAAC;AAC5G,OAAO,2BAA2B,MAAM,+CAA+C,CAAC;AACxF,MAAM,CAAC,MAAM,oBAAoB,GAAC,mBAAmB,CAAC;IACrD,EAAE,EAAE,8BAA8B,EAAC,IAAI,EAAE,2BAA2B;IACpE,WAAW,EAAE,CAAC,4BAA4B,EAAC,2BAA2B,CAAC;IACvE,OAAO,EAAE;QACR,MAAM,CAAC,4BAA4B,CAAC,EAAE,EAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,EAAC,KAAK,IAAI,EAAE;YAClF,MAAM,EAAE,6BAA6B,EAAE,GAAC,MAAM,MAAM,CAAC,mDAAmD,CAAC,CAAC;YAC1G,OAAO,EAAE,OAAO,EAAE,6BAA6B,EAAE,CAAC;QACnD,CAAC,CAAC;QACF,MAAM,CAAC,2BAA2B,CAAC,EAAE,EAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,EAAC,KAAK,IAAI,EAAE;YAC5E,MAAM,EAAE,qCAAqC,EAAE,GAAC,MAAM,MAAM,CAAC,yCAAyC,CAAC,CAAC;YACxG,OAAO,qCAAqC,EAAE,CAAC;QAChD,CAAC,CAAC;KACF;CACD,CAAC,CAAC;AACH,eAAe,oBAAoB,CAAC"}

package/dist/email/index.d.ts

@@ -0,0 +1,13 @@
+/**
+ * @vibesdotdev/integrations-microsoft/email
+ *
+ * Outlook feature pack. Registers an `integration/provider`
+ * (`integration.email.microsoft`, `category: 'email'`) that talks to Microsoft
+ * Graph mail with the existing Microsoft OAuth access token. Picked up by
+ * `packages/email`'s `EmailClient` at dispatch time. Not a host and not a
+ * separate SKU.
+ */
+export { default as microsoftEmailPlugin } from './microsoft-email.plugin.ts';
+export { default } from './microsoft-email.plugin.ts';
+export { outlookMailDescriptor, OutlookMailIntegration } from './microsoft/index.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/email/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/email/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,OAAO,IAAI,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAC9E,OAAO,EAAE,OAAO,EAAE,MAAM,6BAA6B,CAAC;AACtD,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC"}

package/dist/email/index.js

@@ -0,0 +1,13 @@
+/**
+ * @vibesdotdev/integrations-microsoft/email
+ *
+ * Outlook feature pack. Registers an `integration/provider`
+ * (`integration.email.microsoft`, `category: 'email'`) that talks to Microsoft
+ * Graph mail with the existing Microsoft OAuth access token. Picked up by
+ * `packages/email`'s `EmailClient` at dispatch time. Not a host and not a
+ * separate SKU.
+ */
+export { default as microsoftEmailPlugin } from "./microsoft-email.plugin.js";
+export { default } from "./microsoft-email.plugin.js";
+export { outlookMailDescriptor, OutlookMailIntegration } from "./microsoft/index.js";
+//# sourceMappingURL=index.js.map

package/dist/email/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/email/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,OAAO,IAAI,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAC9E,OAAO,EAAE,OAAO,EAAE,MAAM,6BAA6B,CAAC;AACtD,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC"}

package/dist/email/microsoft/index.d.ts

@@ -0,0 +1,4 @@
+export { default as outlookMailDescriptor } from './microsoft.descriptor.ts';
+export { OutlookMailIntegration } from './microsoft.impl.ts';
+export { default as outlookMailImpl } from './microsoft.impl.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/email/microsoft/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/email/microsoft/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,IAAI,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAC7E,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EAAE,OAAO,IAAI,eAAe,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/email/microsoft/index.js

@@ -0,0 +1,4 @@
+export { default as outlookMailDescriptor } from "./microsoft.descriptor.js";
+export { OutlookMailIntegration } from "./microsoft.impl.js";
+export { default as outlookMailImpl } from "./microsoft.impl.js";
+//# sourceMappingURL=index.js.map

package/dist/email/microsoft/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/email/microsoft/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,IAAI,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAC7E,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EAAE,OAAO,IAAI,eAAe,EAAE,MAAM,qBAAqB,CAAC"}