@vibesdotdev/integrations-microsoft 0.0.0-stage → 1.0.0-rc.1

package/dist/microsoft/graph-sharepoint-client.js

@@ -0,0 +1,644 @@
+import { GraphJsonSchema, GraphJsonCollectionSchema, GraphDownloadSchema, GraphUploadSessionSchema } from "../schemas/graph.js";
+import { settle, settleNow } from '@vibesdotdev/kernel';
+import * as z from 'zod/v4';
+import { CapabilityError } from '@vibesdotdev/kernel';
+import { admitMicrosoft, MicrosoftGraphError, graphFailure, microsoftFailure, closeMicrosoftResponse } from "../schemas/boundary.js";
+import { GraphSiteSchema, SharePointSiteSchema, GraphDriveSchema, GraphDriveItemSchema, DriveItemEntrySchema, DriveItemSearchResultSchema } from "./graph-schemas.js";
+const GRAPH_API_BASE = 'https://graph.microsoft.com/v1.0';
+/**
+ * Sentinel "site id" that targets the signed-in user's personal OneDrive
+ * (`/me/drive`) instead of a SharePoint site. Delegated only — app-only tokens
+ * have no `/me`. Used as a drive id by the explorer for the "OneDrive" entry.
+ */
+export const ONEDRIVE_SITE_ID = 'me';
+/** Graph recommends a resumable upload session above ~4 MiB. */
+const SIMPLE_UPLOAD_MAX = 4 * 1024 * 1024;
+/** Upload-session chunk size: 5 MiB, a multiple of 320 KiB (a Graph requirement). */
+const UPLOAD_CHUNK = 327680 * 16;
+const GRAPH_GUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/** Percent-encode each path segment while preserving `/` separators. */
+function encodeDrivePath(path) {
+    return path
+        .split('/')
+        .filter((seg) => seg.length > 0)
+        .map(encodeURIComponent)
+        .join('/');
+}
+/** Normalize an upload body to bytes (buffering a stream when needed). */
+async function toUint8Array(body) {
+    if (body instanceof ArrayBuffer)
+        return new Uint8Array(body);
+    if (body instanceof Blob) {
+        return new Uint8Array(await body.arrayBuffer());
+    }
+    const reader = body.getReader();
+    const chunks = [];
+    let total = 0;
+    for (;;) {
+        const { done, value } = await reader.read();
+        if (done)
+            break;
+        if (value) {
+            chunks.push(value);
+            total += value.byteLength;
+        }
+    }
+    const out = new Uint8Array(total);
+    let offset = 0;
+    for (const c of chunks) {
+        out.set(c, offset);
+        offset += c.byteLength;
+    }
+    return out;
+}
+function looksLikeGraphDriveId(id) {
+    return GRAPH_GUID_RE.test(id) || id.startsWith('b!') || id.startsWith('u!');
+}
+/**
+ * Microsoft Graph API client for SharePoint operations.
+ *
+ * Provides listSites(), browseDrive(), and downloadFile() methods.
+ * Uses the runtime-supplied authenticated transport for registered
+ * providers. App-only access requires the Sites.Read.All (read) /
+ * Sites.ReadWrite.All (write) + Files.Read.All/Files.ReadWrite.All APPLICATION
+ * permissions, admin-consented into the org's tenant — Sites.Selected does NOT
+ * satisfy the `GET /sites?search=*` site enumeration listSites() relies on.
+ */
+export class GraphSharePointClient {
+    integration;
+    authenticatedFetch;
+    fetchFn;
+    constructor(config) {
+        if (!config.integration && !config.authenticatedFetch) {
+            throw new CapabilityError('Microsoft Graph requires an authenticated transport.', 'UNAVAILABLE', { reason: 'microsoft-graph-auth-transport-required' });
+        }
+        this.integration = config.integration;
+        this.authenticatedFetch = config.authenticatedFetch;
+        // Bind the default global fetch to globalThis: it's invoked as `this.fetchFn(...)`,
+        // which would otherwise call native fetch with `this` = this client instance →
+        // workerd throws "Illegal invocation". An injected fetchFn is used as-is; tests
+        // and pre-authenticated upload-session requests retain ownership of that boundary.
+        this.fetchFn = config.fetchFn ?? fetch.bind(globalThis);
+    }
+    /**
+     * Build a download URL operation result without streaming binary
+     * content through the dispatch path. Calls
+     * `/sites/{site-id}/drive/items/{item-id}` with `?$select=id,@microsoft.graph.downloadUrl`
+     * and returns the temporary URL Graph mints (~1h validity). Consumers
+     * fetch bytes directly; this keeps the JSON-only operations dispatch
+     * binary-free.
+     */
+    async getDownloadUrl(siteId, itemId) {
+        // Do NOT use $select here: `@microsoft.graph.downloadUrl` is a default-returned
+        // instance annotation that Graph OMITS under $select (the same trap documented
+        // on getDownloadUrlByPath below). $select silently dropped the URL, so every
+        // item-id download — and thus every drawing OCR byte-fetch — 500'd with
+        // "Graph did not return @microsoft.graph.downloadUrl". Fetch the full item.
+        const url = `${this.driveRoot(siteId)}/items/${itemId}`;
+        const response = await this.executeRequest(url, GraphDownloadSchema);
+        const downloadUrl = response['@microsoft.graph.downloadUrl'];
+        if (!downloadUrl) {
+            throw new Error(`Graph did not return @microsoft.graph.downloadUrl for site '${siteId}' item '${itemId}'.`);
+        }
+        // Graph's downloadUrl is a pre-signed Azure Blob SAS URL; expiry is
+        // embedded in the SAS but not surfaced as an ISO string. Return null
+        // for now and let callers refresh on 403/expired errors.
+        return { url: downloadUrl, expiresAt: null };
+    }
+    /**
+     * Pre-authenticated download URL for a drive item addressed by its PATH (vs
+     * item id). Returns Graph's `@microsoft.graph.downloadUrl` — a short-lived
+     * Azure Blob SAS URL that needs no auth header, so it works directly in a
+     * browser `<img>`/`<iframe>`/download across origins (the object store has no
+     * stable anonymous URL otherwise). `null` if the item is missing.
+     */
+    async getDownloadUrlByPath(siteId, path) {
+        // GET the full driveItem (no $select): `@microsoft.graph.downloadUrl` is a
+        // default-returned instance annotation for files but is unreliable under
+        // $select (the `@`-annotation is often omitted), which silently dropped the
+        // URL and forced the proxy fallback.
+        const url = `${this.driveRoot(siteId)}/root:/${encodeDrivePath(path)}`;
+        const attempt = await settle(() => this.executeRequest(url, GraphDownloadSchema));
+        if (attempt.ok)
+            return attempt.value['@microsoft.graph.downloadUrl'] ?? null;
+        if (attempt.cause instanceof MicrosoftGraphError && attempt.cause.status === 404)
+            return null;
+        throw attempt.cause;
+    }
+    /**
+     * List SharePoint sites the app has access to.
+     *
+     * Returns normalized site objects with id, name, and webUrl.
+     * App-only requires the Sites.Read.All application permission so the
+     * `GET /sites?search=*` enumeration returns the tenant's sites.
+     *
+     * GET /sites?search=*&$select=id,name,webUrl,displayName
+     *
+     * @returns Array of SharePoint sites
+     */
+    async listSites() {
+        // `search=*` lists all sites the caller can reach — required for app-only
+        // (client-credentials) tokens, which otherwise get no sites from a bare
+        // GET /sites; harmless for delegated (returns the user's accessible sites).
+        const url = `${GRAPH_API_BASE}/sites?search=*&$select=id,name,webUrl,displayName`;
+        const response = await this.executeRequest(url, GraphJsonCollectionSchema);
+        const allItems = await this.fetchAllPages(response.value, response['@odata.nextLink']);
+        return allItems
+            .map((item) => {
+            const parsed = GraphSiteSchema.safeParse(item);
+            if (!parsed.success)
+                throw new CapabilityError('Microsoft Graph returned a malformed resource.', 'UNAVAILABLE', { reason: 'microsoft-graph-response-invalid', cause: parsed.error });
+            const site = parsed.data;
+            return SharePointSiteSchema.parse({
+                id: site.id,
+                name: site.displayName || site.name,
+                webUrl: site.webUrl
+            });
+        })
+            .filter((site) => site !== null);
+    }
+    /**
+     * Return a site's default document library as a real Graph drive.
+     *
+     * Storage consumers pass a `driveId`, not a site id. SharePoint site ids are
+     * often composite strings (`host,siteCollectionId,webId`) that are brittle in
+     * agent/tool contexts, while Graph drive ids are the stable primitive accepted
+     * by `/drives/{id}` across browse/search/download operations.
+     */
+    async getDefaultDrive(siteId) {
+        const raw = await this.executeRequest(`${GRAPH_API_BASE}/sites/${siteId}/drive?$select=id,name,webUrl,driveType`, GraphDriveSchema);
+        const parsed = GraphDriveSchema.safeParse(raw);
+        if (!parsed.success) {
+            throw new Error(`Graph default drive for site '${siteId}' was not a valid drive.`);
+        }
+        return parsed.data;
+    }
+    /**
+     * Browse folder contents within a SharePoint site's default drive.
+     *
+     * GET /sites/{site-id}/drive/root/children
+     *
+     * When folderPath is provided:
+     * GET /sites/{site-id}/drive/root:/{folderPath}:/children
+     *
+     * @param siteId - SharePoint site ID
+     * @param folderPath - Optional path relative to drive root (e.g. "Documents/Reports")
+     * @returns Array of drive item entries (files and folders)
+     */
+    async browseDrive(siteId, folderPath) {
+        let url;
+        if (folderPath && folderPath.length > 0) {
+            // Encode per path segment (preserve literal `/` separators) like every
+            // other path method here — a flat encodeURIComponent flattens nested
+            // folder paths and breaks browseDrive for subfolders.
+            const encoded = encodeDrivePath(folderPath);
+            url = `${this.driveRoot(siteId)}/root:/${encoded}:/children`;
+        }
+        else {
+            url = `${this.driveRoot(siteId)}/root/children`;
+        }
+        const attempt = await settle(() => this.executeRequest(url, GraphJsonCollectionSchema));
+        if (!attempt.ok) {
+            const failure = attempt.cause;
+            if (siteId === ONEDRIVE_SITE_ID && !folderPath && failure instanceof MicrosoftGraphError && failure.status === 404)
+                return [];
+            throw failure;
+        }
+        const response = attempt.value;
+        const allItems = await this.fetchAllPages(response.value, response['@odata.nextLink']);
+        return allItems
+            .map((item) => this.normalizeDriveItem(item))
+            .filter((entry) => entry !== null);
+    }
+    /**
+     * Browse folder contents by stable DriveItem id.
+     *
+     * Use this when a caller already has an item id from search/list, or when
+     * Graph path addressing rejects an otherwise valid folder path.
+     */
+    async browseDriveItem(siteId, itemId) {
+        const response = await this.executeRequest(`${this.driveRoot(siteId)}/items/${itemId}/children`, GraphJsonCollectionSchema);
+        const allItems = await this.fetchAllPages(response.value, response['@odata.nextLink']);
+        return allItems
+            .map((item) => this.normalizeDriveItem(item))
+            .filter((entry) => entry !== null);
+    }
+    /**
+     * RECURSIVELY search a site/OneDrive drive for items matching `query`,
+     * at ANY depth, in a single Graph call.
+     *
+     * Uses Graph's server-side drive search:
+     *   GET /sites/{site-id}/drive/root/search(q='{query}')
+     *   GET /me/drive/root/search(q='{query}')           (OneDrive sentinel)
+     *
+     * Graph indexes the whole drive server-side and matches on file/folder
+     * NAME and (for supported types) CONTENT — so a partial job number or
+     * filename matches files buried several folders deep (e.g. a PDF under
+     * "Projects to Bid/2026/Acme/Drawings") that the one-level {@link browseDrive}
+     * can never reach. `$select` includes `parentReference` so each hit carries
+     * its folder path for breadcrumbs / relinking.
+     *
+     * `scopePath` (optional, drive-root-relative) narrows the search to a
+     * subtree by addressing the folder before `:/search` — e.g.
+     *   GET /sites/{id}/drive/root:/Projects to Bid:/search(q='...')
+     * Use it to keep results inside the org's bid folder.
+     *
+     * @param siteId    SharePoint site id, or {@link ONEDRIVE_SITE_ID} for OneDrive
+     * @param query     free-text query (job number, partial filename, content)
+     * @param opts.scopePath  optional folder subtree to search within
+     * @param opts.limit      cap on hits returned (default 25); paging stops early
+     * @returns Array of search hits with folder path metadata
+     */
+    async searchDrive(siteId, query, opts) {
+        const trimmed = query.trim();
+        if (trimmed.length === 0)
+            return [];
+        const limit = Math.max(1, Math.min(opts?.limit ?? 25, 200));
+        // Graph's search(q='...') is a function call: the q value is
+        // single-quoted in the URL; escape embedded single quotes by doubling.
+        const q = encodeURIComponent(trimmed.replace(/'/g, "''"));
+        const base = this.driveRoot(siteId);
+        const root = opts?.scopePath && opts.scopePath.length > 0
+            ? `${base}/root:/${encodeDrivePath(opts.scopePath)}:`
+            : `${base}/root`;
+        const select = '$select=id,name,size,file,folder,webUrl,lastModifiedDateTime,parentReference';
+        const url = `${root}/search(q='${q}')?${select}&$top=${Math.min(limit, 100)}`;
+        const attempt = await settle(() => this.executeRequest(url, GraphJsonCollectionSchema));
+        if (!attempt.ok) {
+            const failure = attempt.cause;
+            if (siteId === ONEDRIVE_SITE_ID && !opts?.scopePath && failure instanceof MicrosoftGraphError && failure.status === 404)
+                return [];
+            throw failure;
+        }
+        const response = attempt.value;
+        // Page until we have `limit` hits or run out — but never crawl forever.
+        const raw = [...response.value];
+        let link = response['@odata.nextLink'];
+        while (link && raw.length < limit) {
+            const page = await this.executeRequest(link, GraphJsonCollectionSchema);
+            raw.push(...page.value);
+            link = page['@odata.nextLink'];
+        }
+        return raw
+            .slice(0, limit)
+            .map((item) => this.normalizeSearchResult(item, siteId))
+            .filter((entry) => entry !== null);
+    }
+    /**
+     * Download file content from a SharePoint drive.
+     *
+     * Read Graph's item metadata, then fetch its preauthenticated download URL
+     * without forwarding Graph authorization across origins.
+     *
+     * Returns the raw binary content as a Blob.
+     * Callers can convert to ArrayBuffer, ReadableStream, or base64
+     * depending on their needs.
+     *
+     * @param siteId - SharePoint site ID
+     * @param itemId - Drive item ID (file)
+     * @returns Blob with file content
+     */
+    async downloadFile(siteId, itemId) {
+        const root = `${this.driveRoot(siteId)}/items/${itemId}`;
+        const metadata = await this.executeRequest(root, GraphDownloadSchema);
+        const response = await this.downloadResponse(metadata, `${root}/content`);
+        const content = await settle(() => response.blob());
+        if (!content.ok)
+            throw microsoftFailure(content.cause);
+        return content.value;
+    }
+    // Write operations (object protocol — used by SharePointStorageAdapter.objectStore)
+    /**
+     * Upload bytes to `path` (relative to the site drive root), creating or
+     * overwriting the file. Simple PUT below ~4 MiB; resumable upload session
+     * (chunked) at or above it.
+     */
+    async uploadFile(siteId, path, body, opts) {
+        const bytes = await toUint8Array(body);
+        const raw = bytes.byteLength < SIMPLE_UPLOAD_MAX
+            ? await this.simpleUpload(siteId, path, bytes, opts?.contentType)
+            : await this.resumableUpload(siteId, path, bytes, opts?.conflictBehavior);
+        const normalized = this.normalizeDriveItem(raw);
+        if (!normalized) {
+            throw new Error(`Graph upload to '${path}' returned an unparseable drive item.`);
+        }
+        return normalized;
+    }
+    async simpleUpload(siteId, path, bytes, contentType) {
+        const url = `${this.driveRoot(siteId)}/root:/${encodeDrivePath(path)}:/content`;
+        const accessToken = await this.acquireAccessToken();
+        const response = await this.fetchResponse(url, {
+            method: 'PUT',
+            headers: {
+                Authorization: `Bearer ${accessToken}`,
+                'Content-Type': contentType ?? 'application/octet-stream'
+            },
+            body: new Blob([bytes])
+        });
+        if (!response.ok) {
+            throw await graphFailure(response);
+        }
+        return this.readGraphResponse(response, GraphJsonSchema);
+    }
+    async resumableUpload(siteId, path, bytes, conflictBehavior) {
+        const sessionUrl = `${this.driveRoot(siteId)}/root:/${encodeDrivePath(path)}:/createUploadSession`;
+        const session = await this.executeWriteJson(sessionUrl, 'POST', {
+            item: { '@microsoft.graph.conflictBehavior': conflictBehavior ?? 'replace' }
+        });
+        const uploadUrl = this.admitGraphResponse(GraphUploadSessionSchema, session).uploadUrl;
+        if (!uploadUrl) {
+            throw new Error('Graph createUploadSession returned no uploadUrl.');
+        }
+        const total = bytes.byteLength;
+        let offset = 0;
+        let last = null;
+        while (offset < total) {
+            const end = Math.min(offset + UPLOAD_CHUNK, total);
+            const chunk = bytes.subarray(offset, end);
+            // The upload-session URL is pre-authenticated — no Authorization header.
+            last = await this.fetchResponse(uploadUrl, {
+                method: 'PUT',
+                // Content-Length is set by fetch from the body (setting it manually
+                // throws on workerd). Content-Range is the required upload-session header.
+                headers: { 'Content-Range': `bytes ${offset}-${end - 1}/${total}` },
+                body: new Blob([chunk])
+            }, false);
+            if (!last.ok && last.status !== 202) {
+                throw await graphFailure(last);
+            }
+            offset = end;
+            if (offset < total)
+                await closeMicrosoftResponse(last);
+        }
+        if (!last) {
+            throw new Error('Graph resumable upload produced no response.');
+        }
+        // The final chunk's 200/201 response carries the completed DriveItem.
+        return this.readGraphResponse(last, GraphJsonSchema);
+    }
+    /**
+     * Create a folder named `name` under `parentPath` (drive-root-relative; empty
+     * for the root). `conflictBehavior` defaults to `fail` so existing folders
+     * are not clobbered.
+     */
+    async createFolder(siteId, parentPath, name, conflictBehavior = 'fail') {
+        const url = parentPath && parentPath.length > 0
+            ? `${this.driveRoot(siteId)}/root:/${encodeDrivePath(parentPath)}:/children`
+            : `${this.driveRoot(siteId)}/root/children`;
+        const raw = await this.executeWriteJson(url, 'POST', {
+            name,
+            folder: {},
+            '@microsoft.graph.conflictBehavior': conflictBehavior
+        });
+        const normalized = this.normalizeDriveItem(raw);
+        if (!normalized) {
+            throw new Error(`Graph createFolder '${name}' returned an unparseable drive item.`);
+        }
+        return normalized;
+    }
+    /** Delete a drive item by its id. */
+    async deleteItem(siteId, itemId) {
+        await this.executeDelete(`${this.driveRoot(siteId)}/items/${itemId}`);
+    }
+    /** Delete a drive item by its drive-root-relative path. */
+    async deletePath(siteId, path) {
+        await this.executeDelete(`${this.driveRoot(siteId)}/root:/${encodeDrivePath(path)}`);
+    }
+    /** Fetch metadata for the item at `path`, or `null` if it does not exist. */
+    async headPath(siteId, path) {
+        const url = `${this.driveRoot(siteId)}/root:/${encodeDrivePath(path)}?$select=id,name,size,file,lastModifiedDateTime,webUrl`;
+        const accessToken = await this.acquireAccessToken();
+        const response = await this.fetchResponse(url, {
+            method: 'GET',
+            headers: { Authorization: `Bearer ${accessToken}`, Accept: 'application/json' }
+        });
+        if (response.status === 404) {
+            await closeMicrosoftResponse(response);
+            return null;
+        }
+        if (!response.ok) {
+            throw await graphFailure(response);
+        }
+        const item = await this.readGraphResponse(response, GraphDriveItemSchema);
+        return {
+            id: item.id, size: item.size, mimeType: item.file?.mimeType ?? '',
+            lastModified: item.lastModifiedDateTime ?? '', webUrl: item.webUrl
+        };
+    }
+    /** Stream the bytes of the item at `path`, or `null` if it does not exist. */
+    async getStream(siteId, path) {
+        const root = `${this.driveRoot(siteId)}/root:/${encodeDrivePath(path)}`;
+        const metadata = await settle(() => this.executeRequest(root, GraphDownloadSchema));
+        if (!metadata.ok) {
+            if (metadata.cause instanceof MicrosoftGraphError && metadata.cause.status === 404)
+                return null;
+            throw metadata.cause;
+        }
+        const response = await this.downloadResponse(metadata.value, `${root}:/content`);
+        return response.body;
+    }
+    /** Metadata URLs and Graph's proxy fallback both leave credentials at Graph. */
+    async downloadResponse(metadata, contentUrl) {
+        let downloadUrl = metadata['@microsoft.graph.downloadUrl'];
+        let response;
+        if (downloadUrl) {
+            response = await this.fetchResponse(this.downloadTarget(downloadUrl, contentUrl), {
+                method: 'GET', headers: { Accept: 'application/octet-stream' }
+            }, false);
+        }
+        else {
+            const accessToken = await this.acquireAccessToken();
+            response = await this.fetchResponse(contentUrl, {
+                method: 'GET', redirect: 'manual',
+                headers: { Authorization: `Bearer ${accessToken}`, Accept: 'application/octet-stream' }
+            });
+            const location = response.headers.get('location');
+            if ([301, 302, 303, 307, 308].includes(response.status) && location !== null) {
+                // Release Graph's body before allocating the separate credential-free request.
+                await closeMicrosoftResponse(response);
+                downloadUrl = this.downloadTarget(location, contentUrl);
+                response = await this.fetchResponse(downloadUrl, {
+                    method: 'GET', headers: { Accept: 'application/octet-stream' }
+                }, false);
+            }
+        }
+        if (!response.ok)
+            throw await graphFailure(response);
+        return response;
+    }
+    downloadTarget(location, base) {
+        const target = settleNow(() => new URL(location, base));
+        if (!target.ok || target.value.protocol !== 'https:' || target.value.username || target.value.password) {
+            throw new CapabilityError('Microsoft Graph returned an invalid download URL.', 'INVALID_INPUT', {
+                reason: 'microsoft-graph-download-url-invalid'
+            });
+        }
+        return target.value.href;
+    }
+    // Shared write helpers
+    async executeWriteJson(url, method, jsonBody) {
+        const accessToken = await this.acquireAccessToken();
+        const response = await this.fetchResponse(url, {
+            method,
+            headers: {
+                Authorization: `Bearer ${accessToken}`,
+                'Content-Type': 'application/json',
+                Accept: 'application/json'
+            },
+            body: JSON.stringify(jsonBody)
+        });
+        if (!response.ok) {
+            throw await graphFailure(response);
+        }
+        return this.readGraphResponse(response, GraphJsonSchema);
+    }
+    async executeDelete(url) {
+        const accessToken = await this.acquireAccessToken();
+        const response = await this.fetchResponse(url, {
+            method: 'DELETE',
+            headers: { Authorization: `Bearer ${accessToken}` }
+        });
+        if (!response.ok && response.status !== 204) {
+            throw await graphFailure(response);
+        }
+        await closeMicrosoftResponse(response);
+    }
+    /** Retrieve a token only for legacy direct callers; registered providers use Secrets. */
+    async acquireAccessToken() {
+        if (this.authenticatedFetch)
+            return '';
+        const integration = this.integration;
+        if (!integration) {
+            throw new CapabilityError('Microsoft Graph has no token acquirer.', 'UNAVAILABLE', { reason: 'microsoft-graph-auth-transport-required' });
+        }
+        const scopes = ['https://graph.microsoft.com/.default'];
+        const result = await integration.acquireToken(scopes);
+        return result.accessToken;
+    }
+    /**
+     * Graph drive base for the storage drive identifier. The sentinel
+     * {@link ONEDRIVE_SITE_ID} (`'me'`) targets the signed-in user's personal
+     * OneDrive (`/me/drive`, delegated only). Composite SharePoint site ids keep
+     * using `/sites/{id}/drive` for backwards compatibility; real Graph drive ids
+     * use `/drives/{id}`.
+     */
+    driveRoot(siteOrDriveId) {
+        if (siteOrDriveId === ONEDRIVE_SITE_ID)
+            return `${GRAPH_API_BASE}/me/drive`;
+        if (looksLikeGraphDriveId(siteOrDriveId)) {
+            return `${GRAPH_API_BASE}/drives/${siteOrDriveId}`;
+        }
+        return `${GRAPH_API_BASE}/sites/${siteOrDriveId}/drive`;
+    }
+    /**
+     * Execute a JSON-bearing Graph API request with auth header.
+     */
+    async executeRequest(url, schema) {
+        // Pagination URLs carry our bearer: only the owning Graph origin is admitted.
+        const target = new URL(url);
+        if (target.origin !== 'https://graph.microsoft.com')
+            throw new CapabilityError('Invalid Microsoft Graph continuation origin.', 'INVALID_INPUT', { reason: 'microsoft-graph-origin-invalid' });
+        const accessToken = await this.acquireAccessToken();
+        const response = await this.fetchResponse(target.href, {
+            method: 'GET', redirect: 'error',
+            headers: { Authorization: `Bearer ${accessToken}`, Accept: 'application/json' }
+        });
+        if (!response.ok)
+            throw await graphFailure(response);
+        return this.readGraphResponse(response, schema);
+    }
+    /** All Graph transports preserve typed, value-safe failures. */
+    async fetchResponse(url, init, authenticated = true) {
+        const fetcher = authenticated ? this.authenticatedFetch ?? this.fetchFn : this.fetchFn;
+        const headers = new Headers(init.headers);
+        if (authenticated && this.authenticatedFetch)
+            headers.delete('authorization');
+        const response = await settle(() => fetcher(url, { ...init, headers }));
+        if (!response.ok)
+            throw microsoftFailure(response.cause);
+        return response.value;
+    }
+    admitGraphResponse(schema, value) {
+        const parsed = schema.safeParse(value);
+        if (parsed.success)
+            return parsed.data;
+        throw new CapabilityError('Microsoft Graph returned an invalid response.', 'UNAVAILABLE', {
+            reason: 'microsoft-graph-response-invalid', cause: parsed.error
+        });
+    }
+    async readGraphResponse(response, schema) {
+        const decoded = await settle(() => response.json());
+        if (!decoded.ok && decoded.cause instanceof CapabilityError)
+            throw decoded.cause;
+        if (!decoded.ok)
+            throw new CapabilityError('Microsoft Graph returned invalid JSON.', 'UNAVAILABLE', {
+                reason: 'microsoft-graph-response-invalid', cause: microsoftFailure(decoded.cause)
+            });
+        return this.admitGraphResponse(schema, decoded.value);
+    }
+    /**
+     * Follow @odata.nextLink for paginated responses.
+     */
+    async fetchAllPages(initialItems, nextLink) {
+        const allItems = [...initialItems];
+        let link = nextLink;
+        while (link) {
+            const response = await this.executeRequest(link, GraphJsonCollectionSchema);
+            allItems.push(...response.value);
+            link = response['@odata.nextLink'];
+        }
+        return allItems;
+    }
+    /**
+     * Normalize a raw Graph DriveItem into our simplified DriveItemEntry.
+     */
+    normalizeDriveItem(item) {
+        const parsed = GraphDriveItemSchema.safeParse(item);
+        if (!parsed.success)
+            throw new CapabilityError('Microsoft Graph returned a malformed resource.', 'UNAVAILABLE', { reason: 'microsoft-graph-response-invalid', cause: parsed.error });
+        const driveItem = parsed.data;
+        return DriveItemEntrySchema.parse({
+            id: driveItem.id,
+            name: driveItem.name,
+            size: driveItem.size,
+            lastModified: driveItem.lastModifiedDateTime ?? '',
+            mimeType: driveItem.file?.mimeType ?? '',
+            isFolder: driveItem.folder !== undefined,
+            webUrl: driveItem.webUrl
+        });
+    }
+    /**
+     * Normalize a raw Graph search-hit DriveItem into a DriveItemSearchResult,
+     * deriving the drive-root-relative `parentPath` from `parentReference.path`.
+     *
+     * Graph's `parentReference.path` looks like `/drive/root:/Projects to Bid/2026`
+     * (URL-encoded segments). We strip the `/drive/root:` (or `/drives/{id}/root:`)
+     * prefix and decode each segment so consumers get `Projects to Bid/2026`.
+     */
+    normalizeSearchResult(item, siteId) {
+        const base = this.normalizeDriveItem(item);
+        if (!base)
+            return null;
+        const resource = admitMicrosoft(GraphDriveItemSchema, item);
+        const rawPath = resource.parentReference?.path ?? '';
+        const parentId = resource.parentReference?.id ?? '';
+        // `/drive/root:/A/B` or `/drives/{id}/root:/A/B` → `A/B`. No `root:` → ''.
+        const afterRoot = rawPath.includes('root:') ? rawPath.split('root:')[1] ?? '' : '';
+        const parentPath = afterRoot
+            .split('/')
+            .filter((seg) => seg.length > 0)
+            .map((seg) => {
+            try {
+                return decodeURIComponent(seg);
+            }
+            catch (error) {
+                throw new CapabilityError('Microsoft Graph returned an invalid encoded path.', 'UNAVAILABLE', {
+                    reason: 'microsoft-graph-response-invalid', cause: microsoftFailure(error)
+                });
+            }
+        })
+            .join('/');
+        return DriveItemSearchResultSchema.parse({ ...base, parentPath, parentId, siteId });
+    }
+}
+//# sourceMappingURL=graph-sharepoint-client.js.map