@alfe.ai/microsoft-mcp 0.1.6 → 0.1.8

package/README.md

@@ -1,6 +1,7 @@
 # @alfe.ai/microsoft-mcp
 
-Microsoft 365 MCP server — multi-account Microsoft Graph access using Alfe OAuth credentials with server-mediated token refresh
+Microsoft 365 MCP server — bounded, multi-account Microsoft Graph access using
+Alfe OAuth credentials with server-mediated token refresh.
 
 Part of [**Alfe**](https://alfe.ai) — the operating system for AI agents: build, deploy, and run agents with persistent memory, identity, integrations, and channels. See the [documentation](https://docs.alfe.ai) to get started.
 
@@ -10,6 +11,28 @@ Part of [**Alfe**](https://alfe.ai) — the operating system for AI agents: buil
 npm install @alfe.ai/microsoft-mcp
 ```
 
+The Alfe integration launches the server over stdio. It exposes three tools:
+
+- `microsoft_list_accounts` lists safe account metadata.
+- `microsoft_run_command` sends `[METHOD] /v1.0-relative-path [json-body]` for
+  one explicitly selected email/account.
+- `microsoft_disconnect_account` removes one explicitly selected connection.
+
+There is no implicit default account. Graph calls are locked to HTTPS
+`graph.microsoft.com/v1.0`, reject redirects, use a deadline, and bound command,
+request, and response sizes. Refresh tokens and Microsoft OAuth client
+credentials stay in the Alfe connect service; the MCP receives short-lived
+access tokens and uses the server-mediated per-account refresh endpoint.
+
+## Development
+
+```bash
+pnpm --filter @alfe.ai/microsoft-mcp lint
+pnpm --filter @alfe.ai/microsoft-mcp typecheck
+pnpm --filter @alfe.ai/microsoft-mcp test
+pnpm --filter @alfe.ai/microsoft-mcp build
+```
+
 ## Links
 
 - 🌐 Website: <https://alfe.ai>

package/dist/server.cjs

@@ -0,0 +1,538 @@
+#!/usr/bin/env node
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+let node_module = require("node:module");
+let node_fs = require("node:fs");
+let node_url = require("node:url");
+let _modelcontextprotocol_sdk_server_mcp_js = require("@modelcontextprotocol/sdk/server/mcp.js");
+let _modelcontextprotocol_sdk_server_stdio_js = require("@modelcontextprotocol/sdk/server/stdio.js");
+let zod = require("zod");
+let _alfe_ai_config = require("@alfe.ai/config");
+let _alfe_ai_agent_api_client = require("@alfe.ai/agent-api-client");
+//#region src/boundary.ts
+const GRAPH_BASE = "https://graph.microsoft.com/v1.0";
+const MAX_ACCOUNTS = 128;
+const MAX_IDENTIFIER_CHARS = 512;
+const MAX_EMAIL_CHARS = 320;
+const MAX_DISPLAY_NAME_CHARS = 512;
+const MAX_ACCESS_TOKEN_CHARS = 64 * 1024;
+const MAX_COMMAND_CHARS = 256 * 1024;
+const MAX_GRAPH_PATH_CHARS = 16 * 1024;
+const MAX_REQUEST_BODY_BYTES = 1024 * 1024;
+const MAX_RESPONSE_BYTES = 5 * 1024 * 1024;
+const MAX_ERROR_RESPONSE_BYTES = 256 * 1024;
+const MAX_JSON_DEPTH = 64;
+const MAX_JSON_NODES = 5e4;
+const TOKEN_SKEW_MS = 120 * 1e3;
+const SUPPORTED_METHODS = new Set([
+	"GET",
+	"POST",
+	"PATCH",
+	"PUT",
+	"DELETE"
+]);
+const UNSAFE_KEYS = new Set([
+	"__proto__",
+	"prototype",
+	"constructor"
+]);
+function parseCommand(command) {
+	const trimmed = requireBoundedString(command, "command", MAX_COMMAND_CHARS).trim();
+	if (!trimmed) throw new Error("Command cannot be empty");
+	let method = "GET";
+	let rest = trimmed;
+	const firstToken = /^(\S+)\s+([\s\S]+)$/u.exec(trimmed);
+	if (firstToken && /^[A-Za-z]+$/u.test(firstToken[1])) {
+		const candidate = firstToken[1].toUpperCase();
+		if (!SUPPORTED_METHODS.has(candidate)) throw new Error(`Unsupported Graph method: ${candidate.slice(0, 32)}`);
+		method = candidate;
+		rest = firstToken[2].trim();
+	}
+	let path = rest;
+	let body;
+	const bodyDelimiter = /\s+(\{|\[)/u.exec(rest);
+	if (bodyDelimiter) {
+		path = rest.slice(0, bodyDelimiter.index).trim();
+		const rawBody = rest.slice(bodyDelimiter.index).trim();
+		if (Buffer.byteLength(rawBody, "utf8") > 1048576) throw new Error(`Graph request body exceeds ${String(MAX_REQUEST_BODY_BYTES)} bytes`);
+		try {
+			body = JSON.parse(rawBody);
+		} catch {
+			throw new Error("Invalid JSON body in command");
+		}
+		assertJsonBudget(body, "Graph request body");
+	} else if (/\s/u.test(rest)) throw new Error("Graph paths cannot contain unescaped whitespace");
+	if (method === "GET" && body !== void 0) throw new Error("GET Graph requests cannot include a body");
+	path = validateGraphPath(path);
+	return {
+		method,
+		path,
+		body
+	};
+}
+function resolveGraphUrl(path) {
+	const checkedPath = validateGraphPath(path);
+	const url = new URL(checkedPath.slice(1), `${GRAPH_BASE}/`);
+	const pathname = url.pathname;
+	if (url.protocol !== "https:" || url.hostname.toLowerCase() !== "graph.microsoft.com" || url.username || url.password || url.hash || pathname !== "/v1.0" && !pathname.startsWith("/v1.0/")) throw new Error("Refusing to send a Microsoft token outside the Graph v1.0 authority");
+	return url.toString();
+}
+function tokenIsExpired(account, now = Date.now()) {
+	if (!account.accessToken) return true;
+	if (!account.accessTokenExpiresAt) return false;
+	const expiresAt = Date.parse(account.accessTokenExpiresAt);
+	if (Number.isNaN(expiresAt)) return true;
+	return expiresAt - now <= TOKEN_SKEW_MS;
+}
+function normalizeMicrosoftAccounts(value) {
+	const root = requireRecord(value, "Microsoft accounts response");
+	if (!Array.isArray(root.accounts) || root.accounts.length > MAX_ACCOUNTS) throw new Error(`Microsoft accounts response must contain at most ${String(MAX_ACCOUNTS)} accounts`);
+	const selectorOwners = /* @__PURE__ */ new Map();
+	const connectionIds = /* @__PURE__ */ new Set();
+	return root.accounts.map((raw, index) => {
+		const record = requireRecord(raw, `Microsoft account ${String(index)}`);
+		const connectionId = requireIdentifier(record.connectionId, "Microsoft account connectionId", MAX_IDENTIFIER_CHARS);
+		if (connectionIds.has(connectionId)) throw new Error(`Duplicate Microsoft connection: ${connectionId}`);
+		connectionIds.add(connectionId);
+		const accountIdentifier = requireIdentifier(record.accountIdentifier, "Microsoft account accountIdentifier", MAX_IDENTIFIER_CHARS);
+		const email = requireIdentifier(typeof record.email === "string" && record.email.length > 0 ? record.email : accountIdentifier, "Microsoft account email", MAX_EMAIL_CHARS);
+		const account = {
+			connectionId,
+			accountIdentifier,
+			email,
+			displayName: optionalBoundedString(record.displayName, "Microsoft account displayName", MAX_DISPLAY_NAME_CHARS),
+			connectedAt: optionalBoundedString(record.connectedAt, "Microsoft account connectedAt", 128),
+			microsoftTenantId: optionalBoundedString(record.microsoftTenantId, "Microsoft account microsoftTenantId", MAX_IDENTIFIER_CHARS),
+			accessToken: validateAccessToken(record.accessToken ?? "", true),
+			accessTokenExpiresAt: validateExpiry(record.accessTokenExpiresAt ?? "")
+		};
+		for (const selector of [email, accountIdentifier]) {
+			const normalized = normalizeAccountSelector(selector);
+			const owner = selectorOwners.get(normalized);
+			if (owner !== void 0 && owner !== connectionId) throw new Error(`Microsoft account selector is ambiguous: ${selector.slice(0, 128)}`);
+			selectorOwners.set(normalized, connectionId);
+		}
+		return account;
+	});
+}
+function normalizeAccountSelector(value) {
+	const normalized = requireBoundedString(value, "Microsoft account selector", MAX_IDENTIFIER_CHARS).trim().toLowerCase();
+	if (!normalized) throw new Error("Microsoft account selector cannot be empty");
+	return normalized;
+}
+function validateRefreshResult(value) {
+	const record = requireRecord(value, "Microsoft token refresh response");
+	return {
+		accessToken: validateAccessToken(record.accessToken, false),
+		accessTokenExpiresAt: validateExpiry(record.accessTokenExpiresAt ?? "")
+	};
+}
+function validateRequestTimeout(value) {
+	if (!Number.isInteger(value) || value < 1e3 || value > 12e4) throw new Error("Microsoft Graph request timeout must be between 1000 and 120000 milliseconds");
+	return value;
+}
+async function readResponseText(response, maxBytes) {
+	const declaredLength = response.headers.get("content-length");
+	if (declaredLength !== null) {
+		const length = Number(declaredLength);
+		if (!Number.isSafeInteger(length) || length < 0 || length > maxBytes) {
+			await response.body?.cancel().catch(() => void 0);
+			throw new Error(`Microsoft Graph response exceeds ${String(maxBytes)} bytes`);
+		}
+	}
+	if (!response.body) return "";
+	const reader = response.body.getReader();
+	const chunks = [];
+	let total = 0;
+	try {
+		for (;;) {
+			const chunk = await reader.read();
+			if (chunk.done) break;
+			if (chunk.value === void 0) throw new Error("Microsoft Graph returned an invalid response chunk");
+			total += chunk.value.byteLength;
+			if (total > maxBytes) {
+				await reader.cancel("response exceeds limit");
+				throw new Error(`Microsoft Graph response exceeds ${String(maxBytes)} bytes`);
+			}
+			chunks.push(chunk.value);
+		}
+	} finally {
+		reader.releaseLock();
+	}
+	return Buffer.concat(chunks.map((chunk) => Buffer.from(chunk)), total).toString("utf8");
+}
+function assertJsonBudget(value, label) {
+	const stack = [{
+		value,
+		depth: 0
+	}];
+	let nodes = 0;
+	while (stack.length > 0) {
+		const current = stack.pop();
+		if (!current) break;
+		nodes += 1;
+		if (nodes > MAX_JSON_NODES || current.depth > MAX_JSON_DEPTH) throw new Error(`${label} is too deeply or broadly nested`);
+		if (current.value === null || typeof current.value !== "object") continue;
+		if (Array.isArray(current.value)) {
+			for (const child of current.value) stack.push({
+				value: child,
+				depth: current.depth + 1
+			});
+			continue;
+		}
+		for (const [key, child] of Object.entries(current.value)) {
+			if (UNSAFE_KEYS.has(key)) throw new Error(`${label} contains an unsafe object key`);
+			stack.push({
+				value: child,
+				depth: current.depth + 1
+			});
+		}
+	}
+}
+function safeErrorMessage(error, secrets = []) {
+	let output = (error instanceof Error ? error.message : String(error)).slice(0, 4096).replace(/\b(Bearer|Basic)\s+[A-Za-z0-9._~+/=-]+/giu, "$1 [REDACTED]").replace(/\b(api[_-]?key|access[_-]?token|refresh[_-]?token|secret|password)\s*[=:]\s*[^\s,;]+/giu, "$1=[REDACTED]").replace(/https?:\/\/[^\s/@:]+:[^\s/@]+@/giu, "https://[REDACTED]@").replace(/\balfe_[A-Za-z0-9_-]{8,}/gu, "[REDACTED]");
+	for (const secret of secrets) if (secret.length >= 4) output = output.split(secret).join("[REDACTED]");
+	return flattenControls(output);
+}
+function validateGraphPath(value) {
+	let path = requireBoundedString(value, "Graph path", MAX_GRAPH_PATH_CHARS).trim();
+	if (!path) throw new Error("Command must include a Graph path (e.g. 'GET /me/messages')");
+	if (hasControlCharacters(path) || /\s/u.test(path)) throw new Error("Graph paths cannot contain unescaped whitespace or control characters");
+	if (/^[a-z][a-z0-9+.-]*:/iu.test(path) || path.startsWith("//")) throw new Error("Graph path must be a relative path, not an absolute or protocol-relative URL");
+	if (!path.startsWith("/")) path = `/${path}`;
+	return path;
+}
+function validateAccessToken(value, allowEmpty) {
+	if (allowEmpty && value === "") return "";
+	const token = requireBoundedString(value, "Microsoft access token", MAX_ACCESS_TOKEN_CHARS);
+	if (token !== token.trim() || /\s/u.test(token)) throw new Error("Microsoft access token is invalid");
+	return token;
+}
+function validateExpiry(value) {
+	if (value === "") return "";
+	const expiry = requireBoundedString(value, "Microsoft access-token expiry", 128);
+	if (Number.isNaN(Date.parse(expiry))) throw new Error("Microsoft access-token expiry is invalid");
+	return expiry;
+}
+function requireRecord(value, label) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) throw new Error(`${label} must be an object`);
+	return value;
+}
+function requireBoundedString(value, label, maxChars) {
+	if (typeof value !== "string" || value.length < 1 || value.length > maxChars || hasControlCharacters(value)) throw new Error(`${label} must contain 1 to ${String(maxChars)} non-control characters`);
+	return value;
+}
+function requireIdentifier(value, label, maxChars) {
+	const checked = requireBoundedString(value, label, maxChars);
+	if (checked !== checked.trim()) throw new Error(`${label} cannot have leading or trailing whitespace`);
+	return checked;
+}
+function optionalBoundedString(value, label, maxChars) {
+	if (value === void 0 || value === null || value === "") return void 0;
+	return requireBoundedString(value, label, maxChars);
+}
+function hasControlCharacters(value) {
+	return Array.from(value).some((character) => {
+		const codePoint = character.codePointAt(0) ?? 0;
+		return codePoint < 32 || codePoint === 127;
+	});
+}
+function flattenControls(value) {
+	let output = "";
+	let previousWasControl = false;
+	for (const character of value) {
+		const codePoint = character.codePointAt(0) ?? 0;
+		const isControl = codePoint < 32 || codePoint === 127;
+		if (isControl) {
+			if (!previousWasControl) output += " ";
+		} else output += character;
+		previousWasControl = isControl;
+	}
+	return output;
+}
+const SERVER_VERSION = validatePackageVersion((0, node_module.createRequire)(require("url").pathToFileURL(__filename).href)("../package.json").version);
+const DEFAULT_REQUEST_TIMEOUT_MS = 2e4;
+var MicrosoftRuntime = class {
+	client;
+	accounts = [];
+	cacheRefreshPromise;
+	tokenRefreshes = /* @__PURE__ */ new Map();
+	tokenVersions = /* @__PURE__ */ new Map();
+	fetchImpl;
+	now;
+	requestTimeoutMs;
+	constructor(options) {
+		this.client = options.client;
+		this.fetchImpl = options.fetchImpl ?? fetch;
+		this.now = options.now ?? Date.now;
+		this.requestTimeoutMs = validateRequestTimeout(options.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS);
+	}
+	async listAccounts() {
+		return this.refreshAccountCache();
+	}
+	async runCommand(email, command) {
+		const account = await this.resolveAccount(email);
+		const spec = parseCommand(command);
+		return {
+			account: account.email,
+			request: `${spec.method} ${spec.path}`,
+			result: await this.graphRequest(account, spec)
+		};
+	}
+	async disconnectAccount(email) {
+		const account = await this.resolveAccount(email);
+		await this.getClient().disconnectMicrosoftAccount(account.accountIdentifier);
+		return {
+			account,
+			remainingAccounts: await this.refreshAccountCache(true)
+		};
+	}
+	getClient() {
+		if (!this.client) {
+			const config = (0, _alfe_ai_config.resolveConfig)();
+			this.client = new _alfe_ai_agent_api_client.AgentApiClient({
+				apiKey: config.apiKey,
+				apiUrl: config.apiUrl
+			});
+		}
+		return this.client;
+	}
+	async refreshAccountCache(force = false) {
+		if (this.cacheRefreshPromise) {
+			if (!force) return this.cacheRefreshPromise;
+			await this.cacheRefreshPromise;
+		}
+		const versionsAtStart = new Map(this.tokenVersions);
+		const operation = (async () => {
+			const next = normalizeMicrosoftAccounts(await this.getClient().getMicrosoftAccounts());
+			for (const account of next) {
+				const versionBefore = versionsAtStart.get(account.connectionId) ?? 0;
+				if ((this.tokenVersions.get(account.connectionId) ?? 0) !== versionBefore) {
+					const current = this.accounts.find((item) => item.connectionId === account.connectionId);
+					if (current) {
+						account.accessToken = current.accessToken;
+						account.accessTokenExpiresAt = current.accessTokenExpiresAt;
+					}
+				}
+			}
+			this.accounts = next;
+			return next;
+		})();
+		this.cacheRefreshPromise = operation;
+		try {
+			return await operation;
+		} finally {
+			if (this.cacheRefreshPromise === operation) this.cacheRefreshPromise = void 0;
+		}
+	}
+	async resolveAccount(selector) {
+		const normalized = normalizeAccountSelector(selector);
+		const find = () => this.accounts.find((account) => normalizeAccountSelector(account.email) === normalized || normalizeAccountSelector(account.accountIdentifier) === normalized);
+		const hit = find();
+		if (hit) return hit;
+		await this.refreshAccountCache();
+		const refreshed = find();
+		if (refreshed) return refreshed;
+		throw new Error(`Microsoft account "${selector.slice(0, 128)}" not found. Available: ${this.accounts.map((account) => account.email).join(", ")}`);
+	}
+	ensureAccessToken(account, force = false) {
+		if (!force && !tokenIsExpired(account, this.now())) return Promise.resolve(account.accessToken);
+		const existing = this.tokenRefreshes.get(account.connectionId);
+		if (existing) return existing;
+		const refresh = (async () => {
+			const next = validateRefreshResult(await this.getClient().refreshMicrosoftAccountToken(account.accountIdentifier));
+			this.updateAccountToken(account.connectionId, next.accessToken, next.accessTokenExpiresAt);
+			account.accessToken = next.accessToken;
+			account.accessTokenExpiresAt = next.accessTokenExpiresAt;
+			return next.accessToken;
+		})();
+		this.tokenRefreshes.set(account.connectionId, refresh);
+		const cleanup = () => {
+			if (this.tokenRefreshes.get(account.connectionId) === refresh) this.tokenRefreshes.delete(account.connectionId);
+		};
+		refresh.then(cleanup, cleanup);
+		return refresh;
+	}
+	updateAccountToken(connectionId, accessToken, expiresAt) {
+		const current = this.accounts.find((account) => account.connectionId === connectionId);
+		if (current) {
+			current.accessToken = accessToken;
+			current.accessTokenExpiresAt = expiresAt;
+		}
+		this.tokenVersions.set(connectionId, (this.tokenVersions.get(connectionId) ?? 0) + 1);
+	}
+	async graphRequest(account, spec) {
+		const url = resolveGraphUrl(spec.path);
+		const encodedBody = encodeRequestBody(spec.body);
+		const doFetch = async (accessToken) => {
+			try {
+				return await this.fetchImpl(url, {
+					method: spec.method,
+					headers: {
+						Authorization: `Bearer ${accessToken}`,
+						...encodedBody === void 0 ? {} : { "Content-Type": "application/json" }
+					},
+					body: encodedBody,
+					redirect: "error",
+					signal: AbortSignal.timeout(this.requestTimeoutMs)
+				});
+			} catch (error) {
+				throw new Error(`Microsoft Graph ${spec.method} ${new URL(url).pathname} request failed`, { cause: error });
+			}
+		};
+		let accessToken = await this.ensureAccessToken(account);
+		let response = await doFetch(accessToken);
+		if (response.status === 401) {
+			await response.body?.cancel().catch(() => void 0);
+			accessToken = await this.ensureAccessToken(account, true);
+			response = await doFetch(accessToken);
+		}
+		const text = await readResponseText(response, response.ok ? MAX_RESPONSE_BYTES : MAX_ERROR_RESPONSE_BYTES);
+		let data = null;
+		if (text) try {
+			data = JSON.parse(text);
+			assertJsonBudget(data, "Microsoft Graph response");
+		} catch (error) {
+			if (!response.ok && error instanceof SyntaxError) data = { message: "Microsoft Graph returned a non-JSON error response" };
+			else if (error instanceof SyntaxError) throw new Error("Microsoft Graph returned invalid JSON", { cause: error });
+			else throw error;
+		}
+		return {
+			status: response.status,
+			ok: response.ok,
+			data
+		};
+	}
+};
+function jsonResult(data, isError = false) {
+	return {
+		content: [{
+			type: "text",
+			text: JSON.stringify(data)
+		}],
+		...isError ? { isError: true } : {}
+	};
+}
+function createRuntimeServer(options = {}) {
+	const runtime = new MicrosoftRuntime(options);
+	const server = new _modelcontextprotocol_sdk_server_mcp_js.McpServer({
+		name: "microsoft-mcp",
+		version: SERVER_VERSION
+	});
+	const registerTool = server.registerTool.bind(server);
+	registerTool("microsoft_list_accounts", {
+		description: "List all connected Microsoft 365 accounts. Use this before a credential-touching tool to select the account explicitly.",
+		inputSchema: {}
+	}, async () => {
+		const accounts = await runtime.listAccounts();
+		return jsonResult({
+			accounts: accounts.map((account) => ({
+				email: account.email,
+				displayName: account.displayName,
+				connectedAt: account.connectedAt
+			})),
+			count: accounts.length
+		});
+	});
+	registerTool("microsoft_run_command", {
+		description: "Call Microsoft Graph v1.0 for one explicit Microsoft 365 account. Command format: '[METHOD] /path [json-body]'; method defaults to GET.",
+		inputSchema: {
+			command: zod.z.string().trim().min(1).max(MAX_COMMAND_CHARS),
+			email: zod.z.string().trim().min(1).max(512)
+		}
+	}, async ({ command, email }) => {
+		const call = await runtime.runCommand(email, command);
+		return jsonResult({
+			account: call.account,
+			request: call.request,
+			status: call.result.status,
+			ok: call.result.ok,
+			data: call.result.data
+		}, !call.result.ok);
+	});
+	registerTool("microsoft_disconnect_account", {
+		description: "Disconnect one explicit Microsoft 365 account from this agent.",
+		inputSchema: { email: zod.z.string().trim().min(1).max(512) }
+	}, async ({ email }) => {
+		const result = await runtime.disconnectAccount(email);
+		return jsonResult({
+			message: `${result.account.email} has been disconnected`,
+			remainingAccounts: result.remainingAccounts.map((account) => ({
+				email: account.email,
+				displayName: account.displayName,
+				connectedAt: account.connectedAt
+			}))
+		});
+	});
+	return {
+		server,
+		runtime
+	};
+}
+function createServer(options = {}) {
+	return createRuntimeServer(options).server;
+}
+async function main() {
+	const { server, runtime } = createRuntimeServer();
+	try {
+		const accounts = await runtime.listAccounts();
+		log(`Cached ${String(accounts.length)} Microsoft account(s)`);
+	} catch (error) {
+		log(`Failed to pre-cache Microsoft accounts (will fetch on demand): ${safeErrorMessage(error)}`);
+	}
+	try {
+		await server.connect(new _modelcontextprotocol_sdk_server_stdio_js.StdioServerTransport());
+		log("Microsoft 365 MCP server running (multi-account, direct Graph REST)");
+		return server;
+	} catch (error) {
+		await server.close().catch(() => void 0);
+		throw error;
+	}
+}
+function isProcessEntrypoint(argvPath, metaUrl) {
+	try {
+		if (!argvPath) return false;
+		return (0, node_url.pathToFileURL)((0, node_fs.realpathSync)(argvPath)).href === (0, node_url.pathToFileURL)((0, node_fs.realpathSync)((0, node_url.fileURLToPath)(metaUrl))).href;
+	} catch {
+		return false;
+	}
+}
+function encodeRequestBody(body) {
+	if (body === void 0) return void 0;
+	let encoded;
+	try {
+		encoded = JSON.stringify(body);
+	} catch (error) {
+		throw new Error("Microsoft Graph request body is not valid JSON", { cause: error });
+	}
+	if (Buffer.byteLength(encoded, "utf8") > 1048576) throw new Error(`Graph request body exceeds ${String(MAX_REQUEST_BODY_BYTES)} bytes`);
+	return encoded;
+}
+function validatePackageVersion(value) {
+	if (typeof value !== "string" || !/^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/u.test(value)) throw new Error("microsoft-mcp package version is invalid");
+	return value;
+}
+function log(message) {
+	process.stderr.write(`[microsoft-mcp] ${message}\n`);
+}
+if (isProcessEntrypoint(process.argv[1], require("url").pathToFileURL(__filename).href)) main().then((server) => {
+	let shutdownPromise;
+	const shutdown = () => {
+		if (shutdownPromise) return;
+		shutdownPromise = server.close().catch((error) => {
+			log(`Failed to close cleanly: ${safeErrorMessage(error)}`);
+		}).then(() => process.exit(0));
+	};
+	process.once("SIGTERM", shutdown);
+	process.once("SIGINT", shutdown);
+}).catch((error) => {
+	log(`Fatal: ${safeErrorMessage(error)}`);
+	process.exitCode = 1;
+});
+//#endregion
+exports.SERVER_VERSION = SERVER_VERSION;
+exports.createServer = createServer;
+exports.isProcessEntrypoint = isProcessEntrypoint;
+exports.parseCommand = parseCommand;
+exports.resolveGraphUrl = resolveGraphUrl;
+exports.safeErrorMessage = safeErrorMessage;
+exports.tokenIsExpired = tokenIsExpired;