@alfe.ai/microsoft-mcp 0.1.7 → 0.1.9

package/dist/server.js

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import { createRequire } from "node:module";
 import { realpathSync } from "node:fs";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
@@ -6,283 +7,486 @@ import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js"
 import { z } from "zod";
 import { resolveConfig } from "@alfe.ai/config";
 import { AgentApiClient } from "@alfe.ai/agent-api-client";
-//#region src/server.ts
-/**
-* @alfe.ai/microsoft-mcp — self-contained Microsoft 365 MCP server
-*
-* A runtime-agnostic stdio MCP server (works on OpenClaw AND Hermes) that gives
-* an agent multi-account Microsoft 365 access. Declared via the manifest's
-* top-level `mcp_servers:` block (`command: npx, args: [-y, @alfe.ai/microsoft-mcp@x]`,
-* `requires_credentials: microsoft`), like every other OAuth provider
-* (Notion / Xero / GitHub / Atlassian / MYOB).
-*
-* Tools (multi-account by design — every credential-touching tool requires an
-* explicit `email` so the LLM picks the target account per call):
-*   - microsoft_list_accounts        — list connected Microsoft 365 accounts
-*   - microsoft_run_command          — run a Microsoft Graph request (requires email)
-*   - microsoft_disconnect_account   — disconnect an account (requires email)
-*
-* ── Why self-contained (not a proxy around an upstream MCP) ────────────────
-* Notion/Xero/etc. WRAP an official upstream MCP server that accepts an
-* injected credential. Microsoft has NO suitable upstream MCP that accepts an
-* injected DELEGATED access token — the community M365 MCP servers do their
-* own device/browser OAuth. So this server exposes its own tools and calls
-* `graph.microsoft.com` REST directly.
-*
-* ── Why direct Graph REST, not the `mgc` CLI ───────────────────────────────
-* The Google Workspace sibling shells out to `gws` because `gws` accepts a
-* hand-written `authorized_user` refresh-token file and self-refreshes
-* non-interactively. `mgc` (Microsoft Graph CLI) does NOT: its auth strategies
-* are DeviceCode / InteractiveBrowser (both need a human at a browser —
-* impossible on a headless agent VM) and ClientCertificate / Environment /
-* ManagedIdentity (all APP-ONLY client-credentials, which need admin-consented
-* *application* permissions, not the DELEGATED authorization-code refresh token
-* our connect flow produces). mgc persists tokens in a proprietary MSAL binary
-* cache (needs a keyring on headless Linux) with no hand-writable credentials
-* file and no config-dir override env var — so per-account isolation via config
-* dirs (the gws pattern) is impossible.
-*
-* Token refresh is server-mediated: the connect backend owns token refresh
-* (`refreshMicrosoftAccountToken`) so the client secret never leaves the server
-* and per-(tenant,user) refresh-token rotation stays server-side.
-*/
+//#region src/boundary.ts
 const GRAPH_BASE = "https://graph.microsoft.com/v1.0";
+const MAX_ACCOUNTS = 128;
+const MAX_IDENTIFIER_CHARS = 512;
+const MAX_EMAIL_CHARS = 320;
+const MAX_DISPLAY_NAME_CHARS = 512;
+const MAX_ACCESS_TOKEN_CHARS = 64 * 1024;
+const MAX_COMMAND_CHARS = 256 * 1024;
+const MAX_GRAPH_PATH_CHARS = 16 * 1024;
+const MAX_REQUEST_BODY_BYTES = 1024 * 1024;
+const MAX_RESPONSE_BYTES = 5 * 1024 * 1024;
+const MAX_ERROR_RESPONSE_BYTES = 256 * 1024;
+const MAX_JSON_DEPTH = 64;
+const MAX_JSON_NODES = 5e4;
 const TOKEN_SKEW_MS = 120 * 1e3;
-let client = null;
-let cachedAccounts = [];
-function log(msg) {
-	process.stderr.write(`[microsoft-mcp] ${msg}\n`);
-}
-function getClient() {
-	if (!client) {
-		const config = resolveConfig();
-		client = new AgentApiClient({
-			apiKey: config.apiKey,
-			apiUrl: config.apiUrl
-		});
-	}
-	return client;
-}
-async function refreshAccountCache() {
-	cachedAccounts = (await getClient().getMicrosoftAccounts()).accounts.map((a) => ({
-		connectionId: a.connectionId,
-		accountIdentifier: a.accountIdentifier,
-		email: a.email,
-		displayName: a.displayName ?? void 0,
-		connectedAt: a.connectedAt,
-		microsoftTenantId: a.microsoftTenantId || void 0,
-		accessToken: a.accessToken,
-		accessTokenExpiresAt: a.accessTokenExpiresAt
-	}));
-	return cachedAccounts;
-}
-function findAccount(email) {
-	const account = cachedAccounts.find((a) => a.email === email || a.accountIdentifier === email);
-	if (!account) throw new Error(`Microsoft account "${email}" not found. Available: ${cachedAccounts.map((a) => a.email).join(", ")}`);
-	return account;
-}
-/**
-* Resolve an account by email (or accountIdentifier), refreshing the cache once
-* if it's not already there. This server is long-lived, so an account connected
-* AFTER the last cache fill would otherwise be invisible until a
-* microsoft_list_accounts call — this closes that stale window. Throws
-* findAccount's descriptive error if the account still isn't found after a refresh.
-*/
-async function resolveAccount(email) {
-	const hit = cachedAccounts.find((a) => a.email === email || a.accountIdentifier === email);
-	if (hit) return hit;
-	await refreshAccountCache();
-	return findAccount(email);
-}
-function tokenIsExpired(account) {
-	if (!account.accessToken) return true;
-	if (!account.accessTokenExpiresAt) return false;
-	const expiresAt = Date.parse(account.accessTokenExpiresAt);
-	if (Number.isNaN(expiresAt)) return false;
-	return expiresAt - Date.now() <= TOKEN_SKEW_MS;
-}
-/**
-* Returns a currently-valid access token for the account, refreshing it via the
-* connect service (which owns the client secret + refresh-token rotation) when
-* the cached token is missing or near expiry. Setting `force` bypasses the
-* expiry check — used to recover from a 401 on a token we believed was valid.
-*/
-async function ensureAccessToken(account, force = false) {
-	if (!force && !tokenIsExpired(account)) return account.accessToken;
-	const refreshed = await getClient().refreshMicrosoftAccountToken(account.accountIdentifier);
-	account.accessToken = refreshed.accessToken;
-	account.accessTokenExpiresAt = refreshed.accessTokenExpiresAt;
-	return account.accessToken;
-}
-/**
-* Parse the `command` string into a Graph request. Accepts a compact
-* "METHOD /path" line (optionally followed by a JSON body), so the LLM can
-* express any Graph operation the way it would a curl call:
-*   - "GET /me/messages?$top=5"
-*   - "GET /me"
-*   - "POST /me/sendMail {\"message\":{...}}"
-* A bare "/path" (or "me/messages") is treated as a GET.
-*/
+const SUPPORTED_METHODS = new Set([
+	"GET",
+	"POST",
+	"PATCH",
+	"PUT",
+	"DELETE"
+]);
+const UNSAFE_KEYS = new Set([
+	"__proto__",
+	"prototype",
+	"constructor"
+]);
 function parseCommand(command) {
-	const trimmed = command.trim();
+	const trimmed = requireBoundedString(command, "command", MAX_COMMAND_CHARS).trim();
 	if (!trimmed) throw new Error("Command cannot be empty");
-	const methodMatch = /^(GET|POST|PATCH|PUT|DELETE)\s+(.*)$/is.exec(trimmed);
 	let method = "GET";
 	let rest = trimmed;
-	if (methodMatch) {
-		method = methodMatch[1].toUpperCase();
-		rest = methodMatch[2].trim();
+	const firstToken = /^(\S+)\s+([\s\S]+)$/u.exec(trimmed);
+	if (firstToken && /^[A-Za-z]+$/u.test(firstToken[1])) {
+		const candidate = firstToken[1].toUpperCase();
+		if (!SUPPORTED_METHODS.has(candidate)) throw new Error(`Unsupported Graph method: ${candidate.slice(0, 32)}`);
+		method = candidate;
+		rest = firstToken[2].trim();
 	}
 	let path = rest;
 	let body;
-	const bodyStart = rest.search(/[{[]/);
-	if (bodyStart > 0) {
-		path = rest.slice(0, bodyStart).trim();
-		const rawBody = rest.slice(bodyStart).trim();
+	const bodyDelimiter = /\s+(\{|\[)/u.exec(rest);
+	if (bodyDelimiter) {
+		path = rest.slice(0, bodyDelimiter.index).trim();
+		const rawBody = rest.slice(bodyDelimiter.index).trim();
+		if (Buffer.byteLength(rawBody, "utf8") > 1048576) throw new Error(`Graph request body exceeds ${String(MAX_REQUEST_BODY_BYTES)} bytes`);
 		try {
 			body = JSON.parse(rawBody);
 		} catch {
-			throw new Error(`Invalid JSON body in command: ${rawBody.slice(0, 120)}`);
+			throw new Error("Invalid JSON body in command");
 		}
-	}
-	path = path.trim();
-	if (!path) throw new Error("Command must include a Graph path (e.g. 'GET /me/messages')");
-	if (/^[a-z][a-z0-9+.-]*:/i.test(path) || path.startsWith("//")) throw new Error("Graph path must be a relative path (e.g. '/me/messages'), not an absolute or protocol-relative URL");
-	if (!path.startsWith("/")) path = `/${path}`;
+		assertJsonBudget(body, "Graph request body");
+	} else if (/\s/u.test(rest)) throw new Error("Graph paths cannot contain unescaped whitespace");
+	if (method === "GET" && body !== void 0) throw new Error("GET Graph requests cannot include a body");
+	path = validateGraphPath(path);
 	return {
 		method,
 		path,
 		body
 	};
 }
-/**
-* Resolve a relative Graph path to an absolute graph.microsoft.com URL and
-* assert the host cannot have been escaped. Defense-in-depth alongside
-* parseCommand's absolute/protocol-relative rejection — the bearer token must
-* never be sent anywhere but graph.microsoft.com.
-*/
 function resolveGraphUrl(path) {
-	const url = `${GRAPH_BASE}${path.startsWith("/") ? path : `/${path}`}`;
-	let hostname;
+	const checkedPath = validateGraphPath(path);
+	const url = new URL(checkedPath.slice(1), `${GRAPH_BASE}/`);
+	const pathname = url.pathname;
+	if (url.protocol !== "https:" || url.hostname.toLowerCase() !== "graph.microsoft.com" || url.username || url.password || url.hash || pathname !== "/v1.0" && !pathname.startsWith("/v1.0/")) throw new Error("Refusing to send a Microsoft token outside the Graph v1.0 authority");
+	return url.toString();
+}
+function tokenIsExpired(account, now = Date.now()) {
+	if (!account.accessToken) return true;
+	if (!account.accessTokenExpiresAt) return false;
+	const expiresAt = Date.parse(account.accessTokenExpiresAt);
+	if (Number.isNaN(expiresAt)) return true;
+	return expiresAt - now <= TOKEN_SKEW_MS;
+}
+function normalizeMicrosoftAccounts(value) {
+	const root = requireRecord(value, "Microsoft accounts response");
+	if (!Array.isArray(root.accounts) || root.accounts.length > MAX_ACCOUNTS) throw new Error(`Microsoft accounts response must contain at most ${String(MAX_ACCOUNTS)} accounts`);
+	const selectorOwners = /* @__PURE__ */ new Map();
+	const connectionIds = /* @__PURE__ */ new Set();
+	return root.accounts.map((raw, index) => {
+		const record = requireRecord(raw, `Microsoft account ${String(index)}`);
+		const connectionId = requireIdentifier(record.connectionId, "Microsoft account connectionId", MAX_IDENTIFIER_CHARS);
+		if (connectionIds.has(connectionId)) throw new Error(`Duplicate Microsoft connection: ${connectionId}`);
+		connectionIds.add(connectionId);
+		const accountIdentifier = requireIdentifier(record.accountIdentifier, "Microsoft account accountIdentifier", MAX_IDENTIFIER_CHARS);
+		const email = requireIdentifier(typeof record.email === "string" && record.email.length > 0 ? record.email : accountIdentifier, "Microsoft account email", MAX_EMAIL_CHARS);
+		const account = {
+			connectionId,
+			accountIdentifier,
+			email,
+			displayName: optionalBoundedString(record.displayName, "Microsoft account displayName", MAX_DISPLAY_NAME_CHARS),
+			connectedAt: optionalBoundedString(record.connectedAt, "Microsoft account connectedAt", 128),
+			microsoftTenantId: optionalBoundedString(record.microsoftTenantId, "Microsoft account microsoftTenantId", MAX_IDENTIFIER_CHARS),
+			accessToken: validateAccessToken(record.accessToken ?? "", true),
+			accessTokenExpiresAt: validateExpiry(record.accessTokenExpiresAt ?? "")
+		};
+		for (const selector of [email, accountIdentifier]) {
+			const normalized = normalizeAccountSelector(selector);
+			const owner = selectorOwners.get(normalized);
+			if (owner !== void 0 && owner !== connectionId) throw new Error(`Microsoft account selector is ambiguous: ${selector.slice(0, 128)}`);
+			selectorOwners.set(normalized, connectionId);
+		}
+		return account;
+	});
+}
+function normalizeAccountSelector(value) {
+	const normalized = requireBoundedString(value, "Microsoft account selector", MAX_IDENTIFIER_CHARS).trim().toLowerCase();
+	if (!normalized) throw new Error("Microsoft account selector cannot be empty");
+	return normalized;
+}
+function validateRefreshResult(value) {
+	const record = requireRecord(value, "Microsoft token refresh response");
+	return {
+		accessToken: validateAccessToken(record.accessToken, false),
+		accessTokenExpiresAt: validateExpiry(record.accessTokenExpiresAt ?? "")
+	};
+}
+function validateRequestTimeout(value) {
+	if (!Number.isInteger(value) || value < 1e3 || value > 12e4) throw new Error("Microsoft Graph request timeout must be between 1000 and 120000 milliseconds");
+	return value;
+}
+async function readResponseText(response, maxBytes) {
+	const declaredLength = response.headers.get("content-length");
+	if (declaredLength !== null) {
+		const length = Number(declaredLength);
+		if (!Number.isSafeInteger(length) || length < 0 || length > maxBytes) {
+			await response.body?.cancel().catch(() => void 0);
+			throw new Error(`Microsoft Graph response exceeds ${String(maxBytes)} bytes`);
+		}
+	}
+	if (!response.body) return "";
+	const reader = response.body.getReader();
+	const chunks = [];
+	let total = 0;
 	try {
-		hostname = new URL(url).hostname;
-	} catch {
-		throw new Error(`Invalid Graph path: ${path.slice(0, 120)}`);
+		for (;;) {
+			const chunk = await reader.read();
+			if (chunk.done) break;
+			if (chunk.value === void 0) throw new Error("Microsoft Graph returned an invalid response chunk");
+			total += chunk.value.byteLength;
+			if (total > maxBytes) {
+				await reader.cancel("response exceeds limit");
+				throw new Error(`Microsoft Graph response exceeds ${String(maxBytes)} bytes`);
+			}
+			chunks.push(chunk.value);
+		}
+	} finally {
+		reader.releaseLock();
 	}
-	if (hostname.toLowerCase() !== "graph.microsoft.com") throw new Error(`Refusing to send a Microsoft token to non-Graph host: ${hostname}`);
-	return url;
+	return Buffer.concat(chunks.map((chunk) => Buffer.from(chunk)), total).toString("utf8");
+}
+function assertJsonBudget(value, label) {
+	const stack = [{
+		value,
+		depth: 0
+	}];
+	let nodes = 0;
+	while (stack.length > 0) {
+		const current = stack.pop();
+		if (!current) break;
+		nodes += 1;
+		if (nodes > MAX_JSON_NODES || current.depth > MAX_JSON_DEPTH) throw new Error(`${label} is too deeply or broadly nested`);
+		if (current.value === null || typeof current.value !== "object") continue;
+		if (Array.isArray(current.value)) {
+			for (const child of current.value) stack.push({
+				value: child,
+				depth: current.depth + 1
+			});
+			continue;
+		}
+		for (const [key, child] of Object.entries(current.value)) {
+			if (UNSAFE_KEYS.has(key)) throw new Error(`${label} contains an unsafe object key`);
+			stack.push({
+				value: child,
+				depth: current.depth + 1
+			});
+		}
+	}
+}
+function safeErrorMessage(error, secrets = []) {
+	let output = (error instanceof Error ? error.message : String(error)).slice(0, 4096).replace(/\b(Bearer|Basic)\s+[A-Za-z0-9._~+/=-]+/giu, "$1 [REDACTED]").replace(/\b(api[_-]?key|access[_-]?token|refresh[_-]?token|secret|password)\s*[=:]\s*[^\s,;]+/giu, "$1=[REDACTED]").replace(/https?:\/\/[^\s/@:]+:[^\s/@]+@/giu, "https://[REDACTED]@").replace(/\balfe_[A-Za-z0-9_-]{8,}/gu, "[REDACTED]");
+	for (const secret of secrets) if (secret.length >= 4) output = output.split(secret).join("[REDACTED]");
+	return flattenControls(output);
+}
+function validateGraphPath(value) {
+	let path = requireBoundedString(value, "Graph path", MAX_GRAPH_PATH_CHARS).trim();
+	if (!path) throw new Error("Command must include a Graph path (e.g. 'GET /me/messages')");
+	if (hasControlCharacters(path) || /\s/u.test(path)) throw new Error("Graph paths cannot contain unescaped whitespace or control characters");
+	if (/^[a-z][a-z0-9+.-]*:/iu.test(path) || path.startsWith("//")) throw new Error("Graph path must be a relative path, not an absolute or protocol-relative URL");
+	if (!path.startsWith("/")) path = `/${path}`;
+	return path;
+}
+function validateAccessToken(value, allowEmpty) {
+	if (allowEmpty && value === "") return "";
+	const token = requireBoundedString(value, "Microsoft access token", MAX_ACCESS_TOKEN_CHARS);
+	if (token !== token.trim() || /\s/u.test(token)) throw new Error("Microsoft access token is invalid");
+	return token;
+}
+function validateExpiry(value) {
+	if (value === "") return "";
+	const expiry = requireBoundedString(value, "Microsoft access-token expiry", 128);
+	if (Number.isNaN(Date.parse(expiry))) throw new Error("Microsoft access-token expiry is invalid");
+	return expiry;
 }
-async function graphRequest(account, spec) {
-	const url = resolveGraphUrl(spec.path);
-	const doFetch = async (token) => fetch(url, {
-		method: spec.method,
-		headers: {
-			Authorization: `Bearer ${token}`,
-			...spec.body !== void 0 ? { "Content-Type": "application/json" } : {}
-		},
-		...spec.body !== void 0 ? { body: JSON.stringify(spec.body) } : {}
+function requireRecord(value, label) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) throw new Error(`${label} must be an object`);
+	return value;
+}
+function requireBoundedString(value, label, maxChars) {
+	if (typeof value !== "string" || value.length < 1 || value.length > maxChars || hasControlCharacters(value)) throw new Error(`${label} must contain 1 to ${String(maxChars)} non-control characters`);
+	return value;
+}
+function requireIdentifier(value, label, maxChars) {
+	const checked = requireBoundedString(value, label, maxChars);
+	if (checked !== checked.trim()) throw new Error(`${label} cannot have leading or trailing whitespace`);
+	return checked;
+}
+function optionalBoundedString(value, label, maxChars) {
+	if (value === void 0 || value === null || value === "") return void 0;
+	return requireBoundedString(value, label, maxChars);
+}
+function hasControlCharacters(value) {
+	return Array.from(value).some((character) => {
+		const codePoint = character.codePointAt(0) ?? 0;
+		return codePoint < 32 || codePoint === 127;
 	});
-	let token = await ensureAccessToken(account);
-	let response = await doFetch(token);
-	if (response.status === 401) {
-		token = await ensureAccessToken(account, true);
-		response = await doFetch(token);
+}
+function flattenControls(value) {
+	let output = "";
+	let previousWasControl = false;
+	for (const character of value) {
+		const codePoint = character.codePointAt(0) ?? 0;
+		const isControl = codePoint < 32 || codePoint === 127;
+		if (isControl) {
+			if (!previousWasControl) output += " ";
+		} else output += character;
+		previousWasControl = isControl;
+	}
+	return output;
+}
+const SERVER_VERSION = validatePackageVersion(createRequire(import.meta.url)("../package.json").version);
+const DEFAULT_REQUEST_TIMEOUT_MS = 2e4;
+var MicrosoftRuntime = class {
+	client;
+	accounts = [];
+	cacheRefreshPromise;
+	tokenRefreshes = /* @__PURE__ */ new Map();
+	tokenVersions = /* @__PURE__ */ new Map();
+	fetchImpl;
+	now;
+	requestTimeoutMs;
+	constructor(options) {
+		this.client = options.client;
+		this.fetchImpl = options.fetchImpl ?? fetch;
+		this.now = options.now ?? Date.now;
+		this.requestTimeoutMs = validateRequestTimeout(options.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS);
+	}
+	async listAccounts() {
+		return this.refreshAccountCache();
+	}
+	async runCommand(email, command) {
+		const account = await this.resolveAccount(email);
+		const spec = parseCommand(command);
+		return {
+			account: account.email,
+			request: `${spec.method} ${spec.path}`,
+			result: await this.graphRequest(account, spec)
+		};
+	}
+	async disconnectAccount(email) {
+		const account = await this.resolveAccount(email);
+		await this.getClient().disconnectMicrosoftAccount(account.accountIdentifier);
+		return {
+			account,
+			remainingAccounts: await this.refreshAccountCache(true)
+		};
+	}
+	getClient() {
+		if (!this.client) {
+			const config = resolveConfig();
+			this.client = new AgentApiClient({
+				apiKey: config.apiKey,
+				apiUrl: config.apiUrl
+			});
+		}
+		return this.client;
+	}
+	async refreshAccountCache(force = false) {
+		if (this.cacheRefreshPromise) {
+			if (!force) return this.cacheRefreshPromise;
+			await this.cacheRefreshPromise;
+		}
+		const versionsAtStart = new Map(this.tokenVersions);
+		const operation = (async () => {
+			const next = normalizeMicrosoftAccounts(await this.getClient().getMicrosoftAccounts());
+			for (const account of next) {
+				const versionBefore = versionsAtStart.get(account.connectionId) ?? 0;
+				if ((this.tokenVersions.get(account.connectionId) ?? 0) !== versionBefore) {
+					const current = this.accounts.find((item) => item.connectionId === account.connectionId);
+					if (current) {
+						account.accessToken = current.accessToken;
+						account.accessTokenExpiresAt = current.accessTokenExpiresAt;
+					}
+				}
+			}
+			this.accounts = next;
+			return next;
+		})();
+		this.cacheRefreshPromise = operation;
+		try {
+			return await operation;
+		} finally {
+			if (this.cacheRefreshPromise === operation) this.cacheRefreshPromise = void 0;
+		}
+	}
+	async resolveAccount(selector) {
+		const normalized = normalizeAccountSelector(selector);
+		const find = () => this.accounts.find((account) => normalizeAccountSelector(account.email) === normalized || normalizeAccountSelector(account.accountIdentifier) === normalized);
+		const hit = find();
+		if (hit) return hit;
+		await this.refreshAccountCache();
+		const refreshed = find();
+		if (refreshed) return refreshed;
+		throw new Error(`Microsoft account "${selector.slice(0, 128)}" not found. Available: ${this.accounts.map((account) => account.email).join(", ")}`);
+	}
+	ensureAccessToken(account, force = false) {
+		if (!force && !tokenIsExpired(account, this.now())) return Promise.resolve(account.accessToken);
+		const existing = this.tokenRefreshes.get(account.connectionId);
+		if (existing) return existing;
+		const refresh = (async () => {
+			const next = validateRefreshResult(await this.getClient().refreshMicrosoftAccountToken(account.accountIdentifier));
+			this.updateAccountToken(account.connectionId, next.accessToken, next.accessTokenExpiresAt);
+			account.accessToken = next.accessToken;
+			account.accessTokenExpiresAt = next.accessTokenExpiresAt;
+			return next.accessToken;
+		})();
+		this.tokenRefreshes.set(account.connectionId, refresh);
+		const cleanup = () => {
+			if (this.tokenRefreshes.get(account.connectionId) === refresh) this.tokenRefreshes.delete(account.connectionId);
+		};
+		refresh.then(cleanup, cleanup);
+		return refresh;
 	}
-	const text = await response.text();
-	let data = text;
-	if (text) try {
-		data = JSON.parse(text);
-	} catch {}
-	else data = null;
+	updateAccountToken(connectionId, accessToken, expiresAt) {
+		const current = this.accounts.find((account) => account.connectionId === connectionId);
+		if (current) {
+			current.accessToken = accessToken;
+			current.accessTokenExpiresAt = expiresAt;
+		}
+		this.tokenVersions.set(connectionId, (this.tokenVersions.get(connectionId) ?? 0) + 1);
+	}
+	async graphRequest(account, spec) {
+		const url = resolveGraphUrl(spec.path);
+		const encodedBody = encodeRequestBody(spec.body);
+		const doFetch = async (accessToken) => {
+			try {
+				return await this.fetchImpl(url, {
+					method: spec.method,
+					headers: {
+						Authorization: `Bearer ${accessToken}`,
+						...encodedBody === void 0 ? {} : { "Content-Type": "application/json" }
+					},
+					body: encodedBody,
+					redirect: "error",
+					signal: AbortSignal.timeout(this.requestTimeoutMs)
+				});
+			} catch (error) {
+				throw new Error(`Microsoft Graph ${spec.method} ${new URL(url).pathname} request failed`, { cause: error });
+			}
+		};
+		let accessToken = await this.ensureAccessToken(account);
+		let response = await doFetch(accessToken);
+		if (response.status === 401) {
+			await response.body?.cancel().catch(() => void 0);
+			accessToken = await this.ensureAccessToken(account, true);
+			response = await doFetch(accessToken);
+		}
+		const text = await readResponseText(response, response.ok ? MAX_RESPONSE_BYTES : MAX_ERROR_RESPONSE_BYTES);
+		let data = null;
+		if (text) try {
+			data = JSON.parse(text);
+			assertJsonBudget(data, "Microsoft Graph response");
+		} catch (error) {
+			if (!response.ok && error instanceof SyntaxError) data = { message: "Microsoft Graph returned a non-JSON error response" };
+			else if (error instanceof SyntaxError) throw new Error("Microsoft Graph returned invalid JSON", { cause: error });
+			else throw error;
+		}
+		return {
+			status: response.status,
+			ok: response.ok,
+			data
+		};
+	}
+};
+function jsonResult(data, isError = false) {
 	return {
-		status: response.status,
-		ok: response.ok,
-		data
+		content: [{
+			type: "text",
+			text: JSON.stringify(data)
+		}],
+		...isError ? { isError: true } : {}
 	};
 }
-function jsonResult(data) {
-	return { content: [{
-		type: "text",
-		text: JSON.stringify(data)
-	}] };
-}
-function createServer() {
+function createRuntimeServer(options = {}) {
+	const runtime = new MicrosoftRuntime(options);
 	const server = new McpServer({
 		name: "microsoft-mcp",
-		version: "0.0.1"
+		version: SERVER_VERSION
 	});
 	const registerTool = server.registerTool.bind(server);
 	registerTool("microsoft_list_accounts", {
-		description: "List all connected Microsoft 365 accounts. Shows email, display name, and when each account was connected. Use this to resolve which account to target (e.g., 'Kevin's mail' → kevin@contoso.com) before calling microsoft_run_command.",
+		description: "List all connected Microsoft 365 accounts. Use this before a credential-touching tool to select the account explicitly.",
 		inputSchema: {}
 	}, async () => {
-		const accounts = await refreshAccountCache();
+		const accounts = await runtime.listAccounts();
 		return jsonResult({
-			accounts: accounts.map((a) => ({
-				email: a.email,
-				displayName: a.displayName,
-				connectedAt: a.connectedAt
+			accounts: accounts.map((account) => ({
+				email: account.email,
+				displayName: account.displayName,
+				connectedAt: account.connectedAt
 			})),
 			count: accounts.length
 		});
 	});
 	registerTool("microsoft_run_command", {
-		description: "Call the Microsoft Graph API for a specific Microsoft 365 account. The `command` is a Graph REST request line — an optional HTTP method, a Graph path (relative to https://graph.microsoft.com/v1.0), and an optional JSON body. Email is required — call microsoft_list_accounts first if you don't know which account to use. Examples: microsoft_run_command({ command: 'GET /me/messages?$top=5&$select=subject,from,receivedDateTime', email: 'kevin@contoso.com' }); microsoft_run_command({ command: 'GET /me/calendarView?startDateTime=2026-07-08T00:00:00Z&endDateTime=2026-07-09T00:00:00Z', email: 'kevin@contoso.com' }); microsoft_run_command({ command: 'POST /me/sendMail {\"message\":{\"subject\":\"Hi\",\"body\":{\"contentType\":\"Text\",\"content\":\"Hello\"},\"toRecipients\":[{\"emailAddress\":{\"address\":\"a@b.com\"}}]}}', email: 'kevin@contoso.com' }). A bare path with no method is treated as GET.",
+		description: "Call Microsoft Graph v1.0 for one explicit Microsoft 365 account. Command format: '[METHOD] /path [json-body]'; method defaults to GET.",
 		inputSchema: {
-			command: z.string().describe("The Graph request: '[METHOD] /path [json-body]'. Method defaults to GET. Path is relative to https://graph.microsoft.com/v1.0 (e.g. '/me/messages')."),
-			email: z.string().describe("Email of the Microsoft 365 account to use. Required — there is no implicit default.")
+			command: z.string().trim().min(1).max(MAX_COMMAND_CHARS),
+			email: z.string().trim().min(1).max(512)
 		}
 	}, async ({ command, email }) => {
-		const account = await resolveAccount(email);
-		const spec = parseCommand(command);
-		const result = await graphRequest(account, spec);
+		const call = await runtime.runCommand(email, command);
 		return jsonResult({
-			account: account.email,
-			request: `${spec.method} ${spec.path}`,
-			status: result.status,
-			ok: result.ok,
-			data: result.data
-		});
+			account: call.account,
+			request: call.request,
+			status: call.result.status,
+			ok: call.result.ok,
+			data: call.result.data
+		}, !call.result.ok);
 	});
 	registerTool("microsoft_disconnect_account", {
-		description: "Disconnect a specific Microsoft 365 account from this agent. Revokes the connection and removes the account.",
-		inputSchema: { email: z.string().describe("Email of the Microsoft 365 account to disconnect") }
+		description: "Disconnect one explicit Microsoft 365 account from this agent.",
+		inputSchema: { email: z.string().trim().min(1).max(512) }
 	}, async ({ email }) => {
-		const account = await resolveAccount(email);
-		const result = await getClient().disconnectMicrosoftAccount(account.accountIdentifier);
-		await refreshAccountCache();
+		const result = await runtime.disconnectAccount(email);
 		return jsonResult({
-			message: `${account.email} has been disconnected`,
-			remainingAccounts: result.accounts
+			message: `${result.account.email} has been disconnected`,
+			remainingAccounts: result.remainingAccounts.map((account) => ({
+				email: account.email,
+				displayName: account.displayName,
+				connectedAt: account.connectedAt
+			}))
 		});
 	});
-	return server;
+	return {
+		server,
+		runtime
+	};
+}
+function createServer(options = {}) {
+	return createRuntimeServer(options).server;
 }
 async function main() {
-	const server = createServer();
+	const { server, runtime } = createRuntimeServer();
 	try {
-		const accounts = await refreshAccountCache();
-		log(`Cached ${String(accounts.length)} Microsoft account(s): ${accounts.map((a) => a.email).join(", ")}`);
-	} catch (err) {
-		log(`Failed to pre-cache Microsoft accounts (will fetch on demand): ${err instanceof Error ? err.message : String(err)}`);
+		const accounts = await runtime.listAccounts();
+		log(`Cached ${String(accounts.length)} Microsoft account(s)`);
+	} catch (error) {
+		log(`Failed to pre-cache Microsoft accounts (will fetch on demand): ${safeErrorMessage(error)}`);
+	}
+	try {
+		await server.connect(new StdioServerTransport());
+		log("Microsoft 365 MCP server running (multi-account, direct Graph REST)");
+		return server;
+	} catch (error) {
+		await server.close().catch(() => void 0);
+		throw error;
 	}
-	const transport = new StdioServerTransport();
-	await server.connect(transport);
-	log("Microsoft 365 MCP server running (multi-account, direct Graph REST)");
 }
-/**
-* True when this module is the process entrypoint — i.e. `process.argv[1]`
-* resolves to the same real file as `import.meta.url`. Used to start the stdio
-* server only when spawned via `npx -y @alfe.ai/microsoft-mcp` / the `bin`, and
-* to stay quiet (importable) under a test runner.
-*
-* CRITICAL: both sides MUST be realpath-resolved before comparing. npm/pnpm/npx
-* install a package `bin` as a SYMLINK in a `.bin` dir, so when spawned via
-* `npx`, `process.argv[1]` is that symlink (…/.bin/microsoft-mcp-proxy) while
-* `import.meta.url` is the realpath target (…/dist/server.js). A plain `===` /
-* `endsWith` check fails on that mismatch → main() never runs → the server
-* starts and exits without connecting its transport (green-but-dead).
-*/
 function isProcessEntrypoint(argvPath, metaUrl) {
 	try {
 		if (!argvPath) return false;
@@ -291,9 +495,37 @@ function isProcessEntrypoint(argvPath, metaUrl) {
 		return false;
 	}
 }
-if (isProcessEntrypoint(process.argv[1], import.meta.url)) main().catch((err) => {
-	log(`Fatal: ${err instanceof Error ? err.message : String(err)}`);
-	process.exit(1);
+function encodeRequestBody(body) {
+	if (body === void 0) return void 0;
+	let encoded;
+	try {
+		encoded = JSON.stringify(body);
+	} catch (error) {
+		throw new Error("Microsoft Graph request body is not valid JSON", { cause: error });
+	}
+	if (Buffer.byteLength(encoded, "utf8") > 1048576) throw new Error(`Graph request body exceeds ${String(MAX_REQUEST_BODY_BYTES)} bytes`);
+	return encoded;
+}
+function validatePackageVersion(value) {
+	if (typeof value !== "string" || !/^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/u.test(value)) throw new Error("microsoft-mcp package version is invalid");
+	return value;
+}
+function log(message) {
+	process.stderr.write(`[microsoft-mcp] ${message}\n`);
+}
+if (isProcessEntrypoint(process.argv[1], import.meta.url)) main().then((server) => {
+	let shutdownPromise;
+	const shutdown = () => {
+		if (shutdownPromise) return;
+		shutdownPromise = server.close().catch((error) => {
+			log(`Failed to close cleanly: ${safeErrorMessage(error)}`);
+		}).then(() => process.exit(0));
+	};
+	process.once("SIGTERM", shutdown);
+	process.once("SIGINT", shutdown);
+}).catch((error) => {
+	log(`Fatal: ${safeErrorMessage(error)}`);
+	process.exitCode = 1;
 });
 //#endregion
-export { createServer, isProcessEntrypoint, parseCommand, resolveGraphUrl, tokenIsExpired };
+export { SERVER_VERSION, createServer, isProcessEntrypoint, parseCommand, resolveGraphUrl, safeErrorMessage, tokenIsExpired };