@chrischall/office-outlook-mcp 0.0.0

package/dist/client.js

@@ -0,0 +1,247 @@
+/**
+ * The Outlook REST v2.0 client.
+ *
+ * Auth is a bearer token whose only source is the user's browser (see
+ * `auth-fetchproxy.ts`), or an `OUTLOOK_ACCESS_TOKEN` supplied directly. Once
+ * held, every request is a plain Node `fetch` — the bridge is never on the hot
+ * path.
+ */
+import { createApiClient, decodeJwtExp, McpToolError, parseBoolEnv, readEnvVar, } from '@chrischall/mcp-utils';
+import { TokenManager } from '@chrischall/mcp-utils/session';
+import { createTokenCache, reportCacheWriteFailure } from './token-cache.js';
+/**
+ * Load the bridge bootstrap lazily.
+ *
+ * `auth-fetchproxy.ts` pulls in `@chrischall/mcp-utils/fetchproxy`, which
+ * imports the OPTIONAL `@fetchproxy/server` peer. That package is
+ * esbuild-`--external`, and the `.mcpb` bundle ships no `node_modules` — so a
+ * top-level import here would throw `ERR_MODULE_NOT_FOUND` the moment a host
+ * spawns the bundled server, before it can answer `initialize`. The host then
+ * reports only "Server transport closed unexpectedly".
+ *
+ * Deferring it means the default path never touches the package, and a user who
+ * supplies `OUTLOOK_ACCESS_TOKEN` never needs it installed at all.
+ */
+async function captureTokenLazily() {
+    const mod = await import('./auth-fetchproxy.js');
+    return mod.captureTokenViaFetchproxy();
+}
+/**
+ * The API the captured token is minted for.
+ *
+ * Note this is `outlook.office.com` even when the signed-in tab is on
+ * `outlook.cloud.microsoft` — the token's `aud` claim names this host, and it
+ * is the host that answers. Verified live 2026-09-20.
+ */
+export const DEFAULT_API_BASE = 'https://outlook.office.com/api/v2.0';
+/**
+ * Fallback lifetime for a token whose `exp` we cannot read.
+ *
+ * Real Outlook tokens are JWTs carrying `exp` (~25h out), so this is only
+ * reached for a hand-supplied opaque `OUTLOOK_ACCESS_TOKEN`. Deliberately
+ * short: being wrong in this direction costs one extra 401-and-replay, while
+ * being wrong the other way makes every call fail until a restart.
+ */
+const UNKNOWN_TOKEN_TTL_MS = 10 * 60 * 1000;
+/**
+ * Sentinel standing in for a refresh token this flow does not have.
+ *
+ * Outlook Web's token comes from MSAL's hidden-iframe flow; there is no refresh
+ * grant we can drive. "Refreshing" therefore means capturing a new one. The
+ * sentinel exists because `TokenManager` only calls `refresh` when a refresh
+ * token is present, and without it an expired token would have no path back
+ * short of restarting the process.
+ */
+const RECAPTURE_SENTINEL = 'fetchproxy:recapture';
+function toBearerTokens(accessToken) {
+    let expiresAt;
+    try {
+        // decodeJwtExp returns seconds; a non-JWT throws.
+        expiresAt = decodeJwtExp(accessToken) * 1000;
+    }
+    catch {
+        expiresAt = Date.now() + UNKNOWN_TOKEN_TTL_MS;
+    }
+    return { accessToken, refreshToken: RECAPTURE_SENTINEL, expiresAt };
+}
+export class OutlookClient {
+    #baseUrl;
+    /**
+     * Deferred configuration error.
+     *
+     * The constructor never throws, so the server still boots (and answers a
+     * host's install-time `tools/list` probe) with no credential present; the
+     * error surfaces on the first tool call instead.
+     */
+    #configError = null;
+    #api = null;
+    #env;
+    #capture;
+    #fetchImpl;
+    #tokens = null;
+    #tokenSource = 'unconfigured';
+    constructor(opts = {}) {
+        this.#env = opts.env ?? process.env;
+        this.#capture = opts.captureToken ?? captureTokenLazily;
+        // A receiver-safe wrapper, never the bare global. Storing `fetch` itself
+        // and calling it as `this.#fetchImpl(...)` binds `this` to the client, and
+        // older undici (Node 18-20, which several MCP hosts still bundle) throws
+        // `Illegal invocation` for any receiver that is not `globalThis`.
+        this.#fetchImpl = opts.fetchImpl ?? ((input, init) => fetch(input, init));
+        this.#baseUrl = readEnvVar('OUTLOOK_API_BASE', { env: this.#env }) ?? DEFAULT_API_BASE;
+        const direct = readEnvVar('OUTLOOK_ACCESS_TOKEN', { env: this.#env });
+        const bridgeOff = parseBoolEnv('OUTLOOK_DISABLE_FETCHPROXY', { env: this.#env });
+        if (direct === undefined && bridgeOff) {
+            this.#configError = new McpToolError('No Outlook credential is configured.', {
+                hint: 'Set OUTLOOK_ACCESS_TOKEN, or unset OUTLOOK_DISABLE_FETCHPROXY so the ' +
+                    'token can be captured from a signed-in Outlook browser tab.',
+            });
+        }
+        this.#tokenSource = direct !== undefined ? 'OUTLOOK_ACCESS_TOKEN' : 'browser capture';
+    }
+    /** Non-secret description of where the credential comes from. */
+    get tokenSource() {
+        return this.#tokenSource;
+    }
+    #requireConfigured() {
+        if (this.#configError)
+            throw this.#configError;
+    }
+    #tokenManager() {
+        if (this.#tokens)
+            return this.#tokens;
+        const direct = readEnvVar('OUTLOOK_ACCESS_TOKEN', { env: this.#env });
+        const persistence = direct === undefined ? createTokenCache(this.#env) : null;
+        const mint = async () => toBearerTokens(direct ?? (await this.#capture()));
+        this.#tokens = new TokenManager({
+            initial: mint,
+            // There is no refresh grant — re-capture instead. The sentinel argument
+            // is ignored by design.
+            //
+            // But a token supplied as OUTLOOK_ACCESS_TOKEN must NOT be "refreshed" by
+            // reaching for the browser: that silently swaps the credential the
+            // operator chose for whichever account a tab happens to be signed into,
+            // and on a machine with no bridge it just hangs for the capture window on
+            // every 401. Say what is wrong instead.
+            refresh: async () => {
+                if (direct !== undefined) {
+                    throw new McpToolError('OUTLOOK_ACCESS_TOKEN was rejected by Outlook.', {
+                        hint: 'A directly-supplied token cannot be refreshed automatically. Replace ' +
+                            'OUTLOOK_ACCESS_TOKEN with a current one, or unset it to capture from a ' +
+                            'signed-in Outlook browser tab instead.',
+                    });
+                }
+                return toBearerTokens(await this.#capture());
+            },
+            // A failed cache write must not fail the call that triggered it: the
+            // token is in hand and re-capturable, so a read-only data dir should cost
+            // the next cold start a capture, not this request.
+            ...(persistence
+                ? {
+                    persistence: {
+                        load: () => persistence.load(),
+                        save: (t) => {
+                            try {
+                                persistence.save(t);
+                            }
+                            catch (e) {
+                                reportCacheWriteFailure(e);
+                            }
+                        },
+                        clear: () => {
+                            try {
+                                persistence.clear();
+                            }
+                            catch {
+                                /* nothing useful to do; the next capture overwrites it */
+                            }
+                        },
+                    },
+                }
+                : {}),
+        });
+        return this.#tokens;
+    }
+    #client() {
+        if (this.#api)
+            return this.#api;
+        this.#api = createApiClient({
+            baseUrl: this.#baseUrl,
+            tokenManager: this.#tokenManager(),
+            serviceName: 'Outlook',
+            fetchImpl: this.#fetchImpl,
+            timeout: 60_000,
+            baseHeaders: { Accept: 'application/json' },
+            onUnauthorized: () => new McpToolError('Outlook rejected the access token (401).', {
+                hint: 'The token has expired or been revoked. Open a signed-in Outlook tab ' +
+                    'and retry — the next call re-captures automatically.',
+            }),
+        });
+        return this.#api;
+    }
+    /**
+     * GET a path relative to the API base.
+     *
+     * `text` asks Outlook to render message bodies as plain text instead of HTML
+     * — measured 9.4x smaller on a real message, and it also normalises a mixed
+     * HTML/Text collection to one type. `prefer` sets the `Prefer` header
+     * directly, for anything else the API takes there (notably
+     * `outlook.timezone="…"`).
+     */
+    async get(path, opts = {}) {
+        this.#requireConfigured();
+        const prefer = [
+            opts.text ? 'outlook.body-content-type="text"' : undefined,
+            opts.prefer,
+        ].filter((p) => p !== undefined);
+        return this.#client().fetchJson('GET', path, {
+            headers: prefer.length ? { Prefer: prefer.join(', ') } : undefined,
+        });
+    }
+    /** GET an absolute URL — used only to follow `@odata.nextLink`. */
+    async getAbsolute(url) {
+        this.#requireConfigured();
+        const base = new URL(this.#baseUrl);
+        const target = new URL(url);
+        if (target.origin !== base.origin) {
+            throw new McpToolError(`Refusing to follow a link to ${target.origin}.`, {
+                hint: 'Pagination links must stay on the Outlook API host.',
+            });
+        }
+        return this.#client().fetchJson('GET', target.pathname + target.search);
+    }
+    /**
+     * The single write path. Everything mutating goes through here so auth and
+     * error shaping stay in one place.
+     */
+    async write(method, path, body) {
+        this.#requireConfigured();
+        return this.#client().fetchJson(method, path, {
+            body: body === undefined ? undefined : body,
+        });
+    }
+    /** The API base this client talks to. Non-secret; safe for healthcheck output. */
+    get apiBase() {
+        return this.#baseUrl;
+    }
+    /**
+     * Ensure a usable token is held, capturing or refreshing only if needed.
+     *
+     * `getAccessToken` is the same call every request makes, so this exercises
+     * the real resolution path rather than a re-derivation of it — the thing that
+     * makes a passing healthcheck mean real tools work.
+     */
+    async refreshTokenIfNeeded() {
+        this.#requireConfigured();
+        await this.#tokenManager().getAccessToken();
+    }
+    /** Force a fresh capture, ignoring the cached token. */
+    async refreshToken() {
+        this.#requireConfigured();
+        await this.#tokenManager().refreshNow();
+    }
+    /** Epoch ms at which the current token expires, or `null` if none is held. */
+    tokenExpiresAt() {
+        return this.#tokens ? this.#tokens.getExpiresAt() : null;
+    }
+}

package/dist/index.js

@@ -0,0 +1,36 @@
+#!/usr/bin/env node
+import { runMcp, loadDotenvSafely } from '@chrischall/mcp-utils';
+import { VERSION } from './version.js';
+import { OutlookClient } from './client.js';
+import { registerMailTools } from './tools/mail.js';
+import { registerCalendarTools } from './tools/calendar.js';
+import { registerDirectoryTools } from './tools/directory.js';
+import { registerWriteTools } from './tools/writes.js';
+import { registerHealthcheckTool } from './tools/healthcheck.js';
+loadDotenvSafely();
+/**
+ * Built HERE, in the caller, not inside a registrar.
+ *
+ * `runMcp` constructs a server instance per served connection — and one more
+ * for a `server/discover` probe that the client then discards — so the
+ * registrars run more than once. Anything built inside one would be rebuilt,
+ * which for this client would mean a second TokenManager and a second browser
+ * capture. Registrars register; state lives in `deps`.
+ *
+ * The constructor also never throws on missing config, so the server boots and
+ * answers an install-time `tools/list` with no credential present.
+ */
+const client = new OutlookClient();
+await runMcp({
+    name: 'office-outlook-mcp',
+    version: VERSION,
+    banner: '[office-outlook-mcp] This project was developed and is maintained by AI. Use at your own discretion.',
+    deps: client,
+    tools: [
+        registerMailTools,
+        registerCalendarTools,
+        registerDirectoryTools,
+        registerWriteTools,
+        registerHealthcheckTool,
+    ],
+});

package/dist/token-cache.js

@@ -0,0 +1,68 @@
+import { createFileStatePersistence, resolveStateFile, } from '@chrischall/mcp-utils/session';
+import { readEnvVar, parseBoolEnv } from '@chrischall/mcp-utils';
+/**
+ * Where the captured Outlook access token is cached between runs.
+ *
+ * Deliberately its OWN directory. The `outlook-fpx` access skill keeps a token
+ * in `~/.outlook-fpx/curlrc` in a different format; writing there would corrupt
+ * whichever of the two ran second.
+ */
+export function tokenCachePath(env = process.env) {
+    return resolveStateFile({
+        env,
+        envVar: 'OUTLOOK_TOKEN_FILE',
+        subdir: '.office-outlook-mcp',
+        fileName: 'token.json',
+    });
+}
+function isToken(raw) {
+    if (raw === null || typeof raw !== 'object')
+        return false;
+    const t = raw;
+    return (typeof t.accessToken === 'string' &&
+        t.accessToken !== '' &&
+        typeof t.expiresAt === 'number' &&
+        (t.refreshToken === undefined || typeof t.refreshToken === 'string'));
+}
+/**
+ * What a cached token is bound to, or `null` when there is nothing worth
+ * caching.
+ *
+ * An `OUTLOOK_ACCESS_TOKEN` IS the environment variable — there is no capture
+ * to skip, so caching it would only copy a credential onto disk. A captured
+ * token is worth caching most of all: it lets a cold start proceed with no
+ * browser present, which on a host that has none is the difference between
+ * working and not.
+ */
+function bindingFor(env) {
+    if (readEnvVar('OUTLOOK_ACCESS_TOKEN', { env }) !== undefined)
+        return null;
+    if (parseBoolEnv('OUTLOOK_DISABLE_FETCHPROXY', { env }))
+        return null;
+    return 'fetchproxy';
+}
+/** The token cache, or `null` when it is off or there is nothing to cache. */
+export function createTokenCache(env = process.env) {
+    if (!parseBoolEnv('OUTLOOK_TOKEN_CACHE', { env, default: true }))
+        return null;
+    const boundTo = bindingFor(env);
+    if (boundTo === null)
+        return null;
+    return createFileStatePersistence({
+        filePath: tokenCachePath(env),
+        boundTo,
+        validate: (raw) => (isToken(raw) ? raw : null),
+    });
+}
+/**
+ * Report a cache write that failed. Not fatal — the token is re-capturable —
+ * but worth saying, because a read-only data dir otherwise looks exactly like a
+ * server that simply never caches.
+ *
+ * stderr only; stdout is the JSON-RPC channel.
+ */
+export function reportCacheWriteFailure(err) {
+    const detail = err instanceof Error ? err.message : String(err);
+    console.error(`[office-outlook-mcp] could not cache the access token (${detail}); continuing ` +
+        'without the cache — every restart will re-capture from the browser.');
+}

package/dist/tools/_confirm.js

@@ -0,0 +1,27 @@
+import { schemaConfirm, minifiedResult } from '@chrischall/mcp-utils';
+export { schemaConfirm };
+/**
+ * Confirm-gate for a mutating tool (the fleet convention). Without
+ * `confirm: true` the tool makes NO network call and returns a dry-run preview
+ * of exactly what would be sent.
+ *
+ * This matters more here than in most repos: these writes send mail from the
+ * user's real work address and move items in a live mailbox. A single
+ * hallucinated call must not fire silently.
+ *
+ * Note this is a parameter, not an MCP elicitation. claude.ai declares no
+ * elicitation capability and answers `-32021`, so a write that tried to ask
+ * would simply fail there.
+ */
+export function previewUnlessConfirmed(confirm, action, method, path, body) {
+    if (confirm === true)
+        return null;
+    return minifiedResult({
+        dryRun: true,
+        action,
+        method,
+        path,
+        ...(body !== undefined ? { willSend: body } : {}),
+        note: 'Re-run with confirm: true to execute.',
+    });
+}

package/dist/tools/calendar.js

@@ -0,0 +1,72 @@
+import { z } from 'zod';
+import { minifiedResult, resolveView, viewParam } from '@chrischall/mcp-utils';
+import { compactEvent, fullEvent, projectCollection } from '../view.js';
+import { VIEWS } from './mail.js';
+const EVENT_SELECT = 'Id,Subject,Start,End,Location,Organizer,IsAllDay,IsCancelled,ShowAs,OnlineMeetingUrl,BodyPreview';
+function qs(params) {
+    const parts = [];
+    for (const [k, v] of Object.entries(params)) {
+        if (v === undefined || v === '')
+            continue;
+        parts.push(`${k}=${encodeURIComponent(String(v))}`);
+    }
+    return parts.length ? `?${parts.join('&')}` : '';
+}
+export function registerCalendarTools(server, client) {
+    server.registerTool('outlook_list_events', {
+        description: 'List calendar events in a date window. This uses the calendar VIEW, which expands recurring series into their individual occurrences — the right tool for "what is on my schedule". Times are returned in `timeZone` when given.',
+        annotations: { readOnlyHint: true },
+        inputSchema: z.object({
+            view: viewParam(VIEWS),
+            start: z
+                .string()
+                .min(1)
+                .describe('Window start, ISO 8601 (e.g. 2026-09-20T00:00:00Z)'),
+            end: z.string().min(1).describe('Window end, ISO 8601'),
+            timeZone: z
+                .string()
+                .optional()
+                .describe('Windows time-zone name for the returned times, e.g. "Eastern Standard Time". NOT an IANA name like America/New_York.'),
+            limit: z.number().int().min(1).max(200).optional().describe('Max events (default 50)'),
+        }),
+    }, async ({ view, start, end, timeZone, limit }) => {
+        const data = await client.get(`/me/calendarview${qs({
+            startDateTime: start,
+            endDateTime: end,
+            $select: EVENT_SELECT,
+            $orderby: 'Start/DateTime',
+            $top: limit ?? 50,
+        })}`, timeZone ? { prefer: `outlook.timezone="${timeZone}"` } : {});
+        const v = resolveView(view, VIEWS);
+        if (v === 'raw')
+            return minifiedResult(data);
+        return minifiedResult(projectCollection(data, v === 'full' ? fullEvent : compactEvent, 'event'));
+    });
+    server.registerTool('outlook_get_event', {
+        description: 'Get one calendar event in full, including attendees and their responses.',
+        annotations: { readOnlyHint: true },
+        inputSchema: z.object({
+            view: viewParam(VIEWS),
+            id: z.string().min(1).describe('Event Id from outlook_list_events'),
+            timeZone: z.string().optional().describe('Windows time-zone name for returned times'),
+        }),
+    }, async ({ view, id, timeZone }) => {
+        const data = await client.get(`/me/events/${encodeURIComponent(id)}`, timeZone ? { prefer: `outlook.timezone="${timeZone}"` } : {});
+        const v = resolveView(view, VIEWS);
+        if (v === 'raw')
+            return minifiedResult(data);
+        return minifiedResult(v === 'compact' ? compactEvent(data) : fullEvent(data));
+    });
+    server.registerTool('outlook_list_calendars', {
+        description: 'List the calendars in the mailbox, for picking one to read or write against.',
+        annotations: { readOnlyHint: true },
+        inputSchema: z.object({
+            view: viewParam(VIEWS),
+        }),
+    }, async ({ view }) => {
+        const data = await client.get(`/me/calendars${qs({ $select: 'Id,Name,Color,CanEdit,Owner' })}`);
+        if (resolveView(view, VIEWS) === 'raw')
+            return minifiedResult(data);
+        return minifiedResult({ count: data.value?.length ?? 0, items: data.value ?? [] });
+    });
+}

package/dist/tools/directory.js

@@ -0,0 +1,73 @@
+import { z } from 'zod';
+import { minifiedResult, resolveView, viewParam } from '@chrischall/mcp-utils';
+import { VIEWS } from './mail.js';
+function qs(params) {
+    const parts = [];
+    for (const [k, v] of Object.entries(params)) {
+        if (v === undefined || v === '')
+            continue;
+        parts.push(`${k}=${encodeURIComponent(String(v))}`);
+    }
+    return parts.length ? `?${parts.join('&')}` : '';
+}
+function collection(data, raw) {
+    if (raw)
+        return data;
+    return { count: data.value?.length ?? 0, items: data.value ?? [] };
+}
+export function registerDirectoryTools(server, client) {
+    server.registerTool('outlook_get_profile', {
+        description: "Get the signed-in mailbox's identity (email address, display name, alias). The cheapest call that proves the credential works.",
+        annotations: { readOnlyHint: true },
+        inputSchema: z.object({}),
+    }, async () => minifiedResult(await client.get('/me')));
+    server.registerTool('outlook_get_mailbox_settings', {
+        description: 'Get mailbox settings: time zone, working hours, language, and automatic-replies (out-of-office) configuration.',
+        annotations: { readOnlyHint: true },
+        inputSchema: z.object({}),
+    }, async () => minifiedResult(await client.get('/me/MailboxSettings')));
+    server.registerTool('outlook_list_contacts', {
+        description: 'List saved contacts from the mailbox address book.',
+        annotations: { readOnlyHint: true },
+        inputSchema: z.object({
+            view: viewParam(VIEWS),
+            limit: z.number().int().min(1).max(200).optional().describe('Max contacts (default 50)'),
+            skip: z.number().int().min(0).optional().describe('Offset for paging'),
+        }),
+    }, async ({ view, limit, skip }) => {
+        const data = await client.get(`/me/contacts${qs({
+            $top: limit ?? 50,
+            $skip: skip,
+            $select: 'Id,DisplayName,EmailAddresses,CompanyName,JobTitle,MobilePhone',
+        })}`);
+        return minifiedResult(collection(data, resolveView(view, VIEWS) === 'raw'));
+    });
+    server.registerTool('outlook_list_people', {
+        description: 'List people ranked by relevance to the user — colleagues and frequent correspondents, drawn from mail traffic rather than the saved address book. Better than outlook_list_contacts for resolving "who is X" in a work mailbox.',
+        annotations: { readOnlyHint: true },
+        inputSchema: z.object({
+            view: viewParam(VIEWS),
+            limit: z.number().int().min(1).max(100).optional().describe('Max people (default 25)'),
+        }),
+    }, async ({ view, limit }) => {
+        const data = await client.get(`/me/people${qs({
+            $top: limit ?? 25,
+            $select: 'Id,DisplayName,ScoredEmailAddresses,JobTitle,CompanyName',
+        })}`);
+        return minifiedResult(collection(data, resolveView(view, VIEWS) === 'raw'));
+    });
+    server.registerTool('outlook_list_tasks', {
+        description: 'List Outlook tasks with status and due dates.',
+        annotations: { readOnlyHint: true },
+        inputSchema: z.object({
+            view: viewParam(VIEWS),
+            limit: z.number().int().min(1).max(200).optional().describe('Max tasks (default 50)'),
+        }),
+    }, async ({ view, limit }) => {
+        const data = await client.get(`/me/tasks${qs({
+            $top: limit ?? 50,
+            $select: 'Id,Subject,Status,Importance,DueDateTime,CompletedDateTime',
+        })}`);
+        return minifiedResult(collection(data, resolveView(view, VIEWS) === 'raw'));
+    });
+}

package/dist/tools/healthcheck.js

@@ -0,0 +1,45 @@
+import { registerCredentialHealthcheckTool } from '@chrischall/mcp-utils/healthcheck';
+/**
+ * The CREDENTIAL healthcheck, not the bridge one.
+ *
+ * Classify by where the transport is HELD, not by what is imported: this repo
+ * constructs a fetchproxy transport ephemerally inside the token capture and
+ * closes it immediately, then talks to `outlook.office.com` over plain fetch.
+ * The bridge is not on the request path, so bridge role/port would be the wrong
+ * thing to report — what a broken install needs to know is whether a token
+ * resolved and whether Outlook accepted it.
+ *
+ * Imported from `/healthcheck`, deliberately NOT from `/fetchproxy`: that
+ * module pulls in the optional `@fetchproxy/server` peer, which is absent in
+ * the `.mcpb` bundle.
+ */
+export function registerHealthcheckTool(server, client) {
+    registerCredentialHealthcheckTool({
+        server,
+        prefix: 'outlook',
+        hostLabel: 'outlook.office.com',
+        probePath: '/api/v2.0/me',
+        /**
+         * Resolve the credential the way the real tools do — same TokenManager,
+         * same cache, same capture — so a passing healthcheck means real tools
+         * work. Returns a SOURCE LABEL and non-secret detail, never the token:
+         * this result is what people paste into a chat when something is broken.
+         */
+        resolveCredential: async () => {
+            await client.refreshTokenIfNeeded();
+            const expiresAt = client.tokenExpiresAt();
+            return {
+                source: client.tokenSource,
+                detail: {
+                    expiresAt: expiresAt === null ? null : new Date(expiresAt).toISOString(),
+                    minutesRemaining: expiresAt === null ? null : Math.round((expiresAt - Date.now()) / 60_000),
+                    apiBase: client.apiBase,
+                },
+            };
+        },
+        probeFn: async () => {
+            const me = await client.get('/me');
+            return `authenticated as ${me?.EmailAddress ?? 'unknown'}`;
+        },
+    });
+}