@chrischall/office-outlook-mcp 0.3.3 → 0.3.5

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
   },
   "metadata": {
     "description": "MCP server for Outlook / Microsoft 365 — mail, calendar, contacts and tasks via natural language",
-    "version": "0.3.3"
+    "version": "0.3.5"
   },
   "plugins": [
     {
@@ -15,7 +15,7 @@
       "displayName": "Outlook (Microsoft 365)",
       "source": "./",
       "description": "MCP server for Outlook / Microsoft 365 — read mail, folders, calendar, contacts and tasks, and send mail with confirmation",
-      "version": "0.3.3",
+      "version": "0.3.5",
       "author": {
         "name": "Chris Hall"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "office-outlook-mcp",
   "displayName": "Outlook (Microsoft 365)",
-  "version": "0.3.3",
+  "version": "0.3.5",
   "description": "Outlook / Microsoft 365 for Claude — read mail, folders, calendar, contacts and tasks, and send mail with confirmation, using your signed-in browser session",
   "author": {
     "name": "Chris Hall",

package/README.md

@@ -148,7 +148,8 @@ a fresh preview.
 
 | variable | default | |
 |---|---|---|
-| `MCP_CONFIRM_MODE` | `ask-user` | What a write does on a client that cannot show a confirmation prompt (claude.ai, Claude Desktop). `ask-user`: two steps — the first call does nothing and returns a preview plus a token, and the model must get your approval in chat before calling again with it. `auto`: the same two steps, but the model may use the token after reviewing the preview itself. `refuse`: writes are refused on such clients. A client that can show prompts (Claude Code) always gets the real prompt. An unrecognised value is treated as `refuse`. |
+| `MCP_CONFIRM_MODE` | `ask-user` | What a write does on a client that cannot show a confirmation prompt (claude.ai, Claude Desktop). `ask-user`: two steps — the first call does nothing and returns a preview plus a token, and the model must get your approval in chat before calling again with it. `auto`: the same two steps, but the model may use the token after reviewing the preview itself. `refuse`: writes are refused on such clients. A client that can show prompts (Claude Code) always gets the real prompt, unless `MCP_CONFIRM_ELICITATION=off`. An unrecognised value is treated as `refuse`. |
+| `MCP_CONFIRM_ELICITATION` | `on` | `off` never shows a confirmation prompt, so every client gets the `MCP_CONFIRM_MODE` behaviour. Set it for a client that says it can show prompts but never does (the write hangs — opencode 2.0.x). Any other value is treated as `on`, with a warning on stderr. |
 | `MCP_CONFIRM_TTL_SECONDS` | `600` | How long a token stays valid. |
 | `MCP_CONFIRM_SECRET` | random per process | Signing key; set it only if tokens must survive a server restart. On mcp-host the host supplies a stable per-child key (`MCP_HOST_CONFIRM_SECRET`) and spent tokens are recorded under `MCP_DATA_DIR`, so an approval survives an idle restart. |
 

package/dist/bundle.js

@@ -17821,8 +17821,8 @@ function currencyCode2(_params) {
   return _stringFormat(ZodCustomStringFormat, "currency_code", currencyCode, _params);
 }
 function hash(alg, params) {
-  const enc6 = params?.enc ?? "hex";
-  const format = `${alg}_${enc6}`;
+  const enc7 = params?.enc ?? "hex";
+  const format = `${alg}_${enc7}`;
   const regex = regexes_exports[format];
   if (!regex)
     throw new Error(`Unrecognized hash format: ${format}`);
@@ -21496,7 +21496,7 @@ var init_internal = __esm({
   }
 });
 
-// node_modules/@modelcontextprotocol/server/dist/src-BHSMhZ_W.mjs
+// node_modules/@modelcontextprotocol/server/dist/src-Cqbh3MYc.mjs
 function stampErrorBrands(instance, ctor) {
   const brands = /* @__PURE__ */ new Set();
   let current = ctor;
@@ -23476,7 +23476,8 @@ function build() {
     ListResourceTemplatesResultResponseSchema: wireResultResponse(ListResourceTemplatesResultSchema$1),
     ReadResourceResultResponseSchema: wireResultResponse(union([ReadResourceResultSchema$1, InputRequiredResultSchema])),
     CompleteResultResponseSchema: wireResultResponse(CompleteResultSchema$1),
-    DiscoverResultResponseSchema: wireResultResponse(DiscoverResultSchema$1)
+    DiscoverResultResponseSchema: wireResultResponse(DiscoverResultSchema$1),
+    SubscriptionsListenResultResponseSchema: wireResultResponse(SubscriptionsListenResultSchema$1)
   };
 }
 function buildSchemas2026() {
@@ -23695,6 +23696,9 @@ function isSpecRequestMethod(method) {
 function isSpecNotificationMethod(method) {
   return ALL_CODECS.some((codec2) => codec2.hasNotificationMethod(method));
 }
+function isExtensionReusedRequestMethod(method) {
+  return method === "tasks/get" || method === "tasks/cancel";
+}
 function isPlainObject$3(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
@@ -24269,8 +24273,8 @@ function normalizeRawShapeSchema(schema) {
   return schema;
 }
 var BRANDS, OAuthError, SdkErrorCode, SdkError, SdkHttpError, FIRST_MODERN_PROTOCOL_VERSION, SUPPORTED_MODERN_PROTOCOL_VERSIONS, TOOL_RESULT_FOREIGN_FAMILY_KEYS, memo$1, REF_REWRITE_DATA_POSITION_KEYS, REF_REWRITE_NAME_MAP_KEYS, requestMethodKeys$1, notificationMethodKeys$1, resultMethodKeys, maps$1, rev2025RequestMethods, rev2025NotificationMethods, NOT_IN_ERA$1, rev2025Codec, memo2, CACHEABLE_RESULT_METHODS, RESULT_CACHE_HINT_FALLBACK, ProtocolErrorCode, ProtocolError, ResourceNotFoundError, UrlElicitationRequiredError, UnsupportedProtocolVersionError, MissingRequiredClientCapabilityError, DEFAULT_CACHE_TTL_MS, DEFAULT_CACHE_SCOPE, EXTENDED_RESULT_TYPE_METHODS, INPUT_REQUEST_METHODS_2026, maps, requestMethodKeys, notificationMethodKeys, rev2026RequestMethods, rev2026NotificationMethods, NOT_IN_ERA, REQUIRED_ENVELOPE_KEYS, rev2026Codec, wireResultSchemasMemo, MODERN_WIRE_REVISION, ALL_CODECS, schemas_exports3, isJSONRPCRequest, isJSONRPCNotification, isJSONRPCResultResponse, isJSONRPCErrorResponse, isInputRequiredResult, X_MCP_HEADER_KEY, RFC9110_TOKEN, PERMITTED_X_MCP_HEADER_TYPES, NON_REACHABLE_SUBSCHEMA_KEYWORDS, OBJECT_VALUED_SUBSCHEMA_KEYWORDS, HEADER_MISMATCH_ERROR_CODE, INBOUND_VALIDATION_LADDER, LADDER_ERROR_HTTP_STATUS, warnedZodFallback, JSON_SCHEMA_CONVERSION_TARGET, DATETIME_FRACTION_DIGITS, ANNOTATION_ONLY_JSON_SCHEMA_KEYWORDS, ROOT_KEYS, PROPERTY_KEYS_BY_TYPE, SUPPORTED_STRING_FORMATS, inputRequired, REQUEST_STATE_ONLY_LEG_PACING_MS, SPEC_SCHEMA_KEYS, authSchemas, _specTypeSchemas, _isSpecType, specTypeSchemas, isSpecType, DEFAULT_REQUEST_TIMEOUT_MSEC, RESERVED_ENVELOPE_META_KEYS, RETRY_PARAMS_KEYS, NO_REQUEST_STATE, writeNegotiatedProtocolVersion, Protocol, require_content_type, import_content_type, STDIO_DEFAULT_MAX_BUFFER_SIZE, ReadBuffer, TOOL_NAME_REGEX;
-var init_src_BHSMhZ_W = __esm({
-  "node_modules/@modelcontextprotocol/server/dist/src-BHSMhZ_W.mjs"() {
+var init_src_Cqbh3MYc = __esm({
+  "node_modules/@modelcontextprotocol/server/dist/src-Cqbh3MYc.mjs"() {
     init_chunk_Br0eD_fh();
     init_dialects_DoSzNhcb();
     init_internal();
@@ -25370,6 +25374,8 @@ var init_src_BHSMhZ_W = __esm({
       _transport;
       _requestMessageId = 0;
       _requestHandlers = /* @__PURE__ */ new Map();
+      /** Methods registered with an explicit schema; the era gate in `_onrequest` reads it for the Tasks extension names. */
+      _customSchemaRequestMethods = /* @__PURE__ */ new Set();
       _requestHandlerAbortControllers = /* @__PURE__ */ new Map();
       _notificationHandlers = /* @__PURE__ */ new Map();
       _responseHandlers = /* @__PURE__ */ new Map();
@@ -25653,7 +25659,7 @@ var init_src_BHSMhZ_W = __esm({
             return;
           }
         }
-        if (isSpecRequestMethod(request.method) && !codec2.hasRequestMethod(request.method)) {
+        if (isSpecRequestMethod(request.method) && !codec2.hasRequestMethod(request.method) && !(isExtensionReusedRequestMethod(request.method) && this._customSchemaRequestMethods.has(request.method))) {
           sendErrorResponse(ProtocolErrorCode.MethodNotFound, "Method not found");
           return;
         }
@@ -25786,8 +25792,11 @@ var init_src_BHSMhZ_W = __esm({
       }
       request(request, schemaOrOptions, maybeOptions) {
         const codec2 = this._resolveOutboundCodec(request.method);
+        if (isStandardSchema(schemaOrOptions)) {
+          if (!isExtensionReusedRequestMethod(request.method)) this._assertOutboundRequestInEra(codec2, request.method);
+          return this._requestWithSchemaViaCodec(codec2, request, schemaOrOptions, maybeOptions);
+        }
         this._assertOutboundRequestInEra(codec2, request.method);
-        if (isStandardSchema(schemaOrOptions)) return this._requestWithSchemaViaCodec(codec2, request, schemaOrOptions, maybeOptions);
         const validate2 = codecResultValidator(codec2, request.method);
         if (validate2 === void 0) throw new TypeError(`'${request.method}' is not a spec method; pass a result schema as the second argument to request().`);
         return this._requestWithSchemaViaCodec(codec2, request, validate2, schemaOrOptions);
@@ -26031,6 +26040,8 @@ var init_src_BHSMhZ_W = __esm({
           return maybeHandler(parsed.data, ctx);
         };
         else throw new TypeError("setRequestHandler: handler is required");
+        if (typeof schemasOrHandler === "function") this._customSchemaRequestMethods.delete(method);
+        else this._customSchemaRequestMethods.add(method);
         this._requestHandlers.set(method, this._wrapHandler(method, stored));
       }
       /**
@@ -26060,6 +26071,7 @@ var init_src_BHSMhZ_W = __esm({
       */
       removeRequestHandler(method) {
         this._requestHandlers.delete(method);
+        this._customSchemaRequestMethods.delete(method);
       }
       /**
       * Asserts that a request handler has not already been set for the given method, in preparation for a new one being automatically installed.
@@ -33202,7 +33214,7 @@ var init_shimsNode = __esm({
   }
 });
 
-// node_modules/@modelcontextprotocol/server/dist/mcp-DYuW2ZSs.mjs
+// node_modules/@modelcontextprotocol/server/dist/mcp-DIH4cS6P.mjs
 function isCompletable(schema) {
   return !!schema && typeof schema === "object" && COMPLETABLE_SYMBOL in schema;
 }
@@ -33312,6 +33324,30 @@ function serverIdentityOf(server) {
 function discoverAdvertisedCapabilities(capabilities) {
   return { ...capabilities };
 }
+function toolInputElementCount(value, max) {
+  let count = 0;
+  const stack = [value];
+  while (stack.length > 0) {
+    const node2 = stack.pop();
+    if (node2 === null || typeof node2 !== "object") continue;
+    if (Array.isArray(node2)) for (const child of node2) {
+      if (++count > max) return count;
+      if (child !== null && typeof child === "object") stack.push(child);
+    }
+    else for (const key in node2) {
+      if (!Object.prototype.hasOwnProperty.call(node2, key)) continue;
+      if (++count > max) return count;
+      const child = node2[key];
+      if (child !== null && typeof child === "object") stack.push(child);
+    }
+  }
+  return count;
+}
+function resolveMaxToolInputElements(value) {
+  if (value === void 0 || value === Infinity) return void 0;
+  if (typeof value !== "number" || Number.isNaN(value) || value < 1) throw new RangeError(`maxToolInputElements must be a number of at least 1, or Infinity, got ${String(value)}`);
+  return value;
+}
 function createToolExecutor(inputSchema, handler) {
   if (inputSchema) {
     const callback$1 = handler;
@@ -33320,6 +33356,12 @@ function createToolExecutor(inputSchema, handler) {
   const callback = handler;
   return async (_args, ctx) => callback(ctx);
 }
+function convertListedInputSchema(name, inputSchema) {
+  const json2 = standardSchemaToJsonSchema(inputSchema, "input");
+  const scan = scanXMcpHeaderDeclarations(json2);
+  if (!scan.valid) console.warn(`[mcp-sdk] tool '${name}' carries an invalid x-mcp-header declaration and will be excluded by conforming Streamable HTTP clients: ${scan.reason}`);
+  return json2;
+}
 function convertOutputSchemaJson(outputSchema) {
   if (outputSchema === void 0) return void 0;
   try {
@@ -33332,7 +33374,7 @@ function createPromptHandler(name, argsSchema, callback) {
   if (argsSchema) {
     const typedCallback = callback;
     return async (args, ctx) => {
-      const parseResult = await validateStandardSchema(argsSchema, args);
+      const parseResult = await validateStandardSchema(argsSchema, args ?? {});
       if (!parseResult.success) throw new ProtocolError(ProtocolErrorCode.InvalidParams, `Invalid arguments for prompt ${name}: ${parseResult.error}`);
       return typedCallback(parseResult.data, ctx);
     };
@@ -33362,9 +33404,9 @@ function unwrapOptionalSchema(schema) {
   return schema.def?.innerType ?? schema;
 }
 var COMPLETABLE_SYMBOL, MAX_TIMER_DELAY_MS, DEFAULT_MAX_SUBSCRIPTIONS, CHANGE_NOTIFICATION_METHODS, StdioListenRouter, DEFAULT_LEGACY_SHIM_MAX_ROUNDS, DEFAULT_LEGACY_SHIM_ROUND_TIMEOUT_MS, LegacyInputRequiredShim, INPUT_REQUIRED_CAPABLE_METHODS, writeClientIdentity, installDiscoverHandler, readServerIdentity, Server, McpServer, EMPTY_OBJECT_JSON_SCHEMA, EMPTY_COMPLETION_RESULT;
-var init_mcp_DYuW2ZSs = __esm({
-  "node_modules/@modelcontextprotocol/server/dist/mcp-DYuW2ZSs.mjs"() {
-    init_src_BHSMhZ_W();
+var init_mcp_DIH4cS6P = __esm({
+  "node_modules/@modelcontextprotocol/server/dist/mcp-DIH4cS6P.mjs"() {
+    init_src_Cqbh3MYc();
     init_shimsNode();
     COMPLETABLE_SYMBOL = /* @__PURE__ */ Symbol.for("mcp.completable");
     MAX_TIMER_DELAY_MS = 2 ** 31 - 1;
@@ -33387,7 +33429,7 @@ var init_mcp_DYuW2ZSs = __esm({
       _serverCapabilities;
       /**
       * The serving instance's identity, stamped onto the graceful-close
-      * results' `_meta` (the spec's `SubscriptionsListenResultMeta` extends
+      * results' `_meta` (the spec's `SubscriptionsListenResultMetaObject` extends
       * `ResultMetaObject`). Handed over together with the capabilities.
       */
       _serverInfo;
@@ -33653,6 +33695,11 @@ var init_mcp_DYuW2ZSs = __esm({
         if (modernProtocolVersions(this._supportedProtocolVersions).length > 0) this.setRequestHandler("server/discover", () => this._ondiscover());
         if (this._capabilities.logging) this._registerLoggingHandler();
       }
+      /** Attaches to the given transport; rejects while this instance is connected to another one. */
+      async connect(transport) {
+        if (this.transport !== void 0) throw new SdkError(SdkErrorCode.AlreadyConnected, "Use a separate Server instance per connection: this instance is already connected to a transport. To connect it to a new transport, call close() first.");
+        await super.connect(transport);
+      }
       /**
       * Registers the built-in `logging/setLevel` request handler.
       *
@@ -34208,16 +34255,12 @@ var init_mcp_DYuW2ZSs = __esm({
       * The underlying {@linkcode Server} instance, useful for advanced operations like sending notifications.
       */
       server;
+      _maxToolInputElements;
       _registeredResources = {};
       _registeredResourceTemplates = {};
       _registeredTools = {};
       _registeredPrompts = {};
-      /**
-      * Per-tool JSON-converted `inputSchema`, memoized so the SEP-2243
-      * registration-time scan and the pre-dispatch validation step share one
-      * conversion instead of paying it twice per request under the
-      * per-request-factory `createMcpHandler` model.
-      */
+      /** Per-tool JSON-converted `inputSchema`, filled on first use by `toolInputSchemaJson()`. */
       _toolInputSchemaJson = {};
       /**
       * The JSON-serialized `inputSchema` of a registered tool, or `undefined`
@@ -34242,6 +34285,7 @@ var init_mcp_DYuW2ZSs = __esm({
       }
       constructor(serverInfo, options) {
         this.server = new Server(serverInfo, options);
+        this._maxToolInputElements = resolveMaxToolInputElements(options?.maxToolInputElements);
         if (options?.capabilities?.tools) this.setToolRequestHandlers();
         if (options?.capabilities?.resources) this.setResourceRequestHandlers();
         if (options?.capabilities?.prompts) this.setPromptRequestHandlers();
@@ -34314,7 +34358,7 @@ var init_mcp_DYuW2ZSs = __esm({
             name,
             title: tool.title,
             description: tool.description,
-            inputSchema: tool.inputSchema ? standardSchemaToJsonSchema(tool.inputSchema, "input") : EMPTY_OBJECT_JSON_SCHEMA,
+            inputSchema: tool.inputSchema ? convertListedInputSchema(name, tool.inputSchema) : EMPTY_OBJECT_JSON_SCHEMA,
             annotations: tool.annotations,
             icons: tool.icons,
             execution: tool.execution,
@@ -34359,6 +34403,7 @@ var init_mcp_DYuW2ZSs = __esm({
       * Validates tool input arguments against the tool's input schema.
       */
       async validateToolInput(tool, args, toolName) {
+        if (this._maxToolInputElements !== void 0 && toolInputElementCount(args, this._maxToolInputElements) > this._maxToolInputElements) throw new ProtocolError(ProtocolErrorCode.InvalidParams, `Invalid arguments for tool ${toolName}: arguments contain more than the maximum of ${this._maxToolInputElements} elements`);
         if (!tool.inputSchema) return;
         const parseResult = await validateStandardSchema(tool.inputSchema, args ?? {});
         if (!parseResult.success) throw new ProtocolError(ProtocolErrorCode.InvalidParams, `Input validation error: Invalid arguments for tool ${toolName}: ${parseResult.error}`);
@@ -34633,20 +34678,19 @@ var init_mcp_DYuW2ZSs = __esm({
       }
       _createRegisteredTool(name, title, description, inputSchema, outputSchema, annotations, icons, execution, scopeChallenge, _meta, handler) {
         validateAndWarnToolName(name);
-        if (inputSchema !== void 0) try {
-          const json2 = standardSchemaToJsonSchema(inputSchema, "input");
-          this._toolInputSchemaJson[name] = json2;
-          const scan = scanXMcpHeaderDeclarations(json2);
-          if (!scan.valid) console.warn(`[mcp-sdk] tool '${name}' carries an invalid x-mcp-header declaration and will be excluded by conforming Streamable HTTP clients: ${scan.reason}`);
-        } catch {
-        }
         let currentHandler = handler;
+        let outputSchemaJson;
         const registeredTool = {
           title,
           description,
           inputSchema,
           outputSchema,
-          outputSchemaJson: convertOutputSchemaJson(outputSchema),
+          get outputSchemaJson() {
+            return outputSchemaJson ??= convertOutputSchemaJson(registeredTool.outputSchema);
+          },
+          set outputSchemaJson(value) {
+            outputSchemaJson = value;
+          },
           annotations,
           icons,
           execution,
@@ -35090,8 +35134,8 @@ function toError(value) {
 var swallowsErrorsAfterClose, StdioServerTransport, DISCARD_ANSWER_TIMEOUT_MS, StdioConnectionChannel;
 var init_stdio = __esm({
   "node_modules/@modelcontextprotocol/server/dist/stdio.mjs"() {
-    init_mcp_DYuW2ZSs();
-    init_src_BHSMhZ_W();
+    init_mcp_DIH4cS6P();
+    init_src_Cqbh3MYc();
     init_shimsNode();
     swallowsErrorsAfterClose = /* @__PURE__ */ Symbol("swallowsErrorsAfterClose");
     StdioServerTransport = class {
@@ -35282,8 +35326,8 @@ var init_stdio = __esm({
 var DEFAULT_MAX_REQUEST_BODY_SIZE;
 var init_dist = __esm({
   "node_modules/@modelcontextprotocol/server/dist/index.mjs"() {
-    init_mcp_DYuW2ZSs();
-    init_src_BHSMhZ_W();
+    init_mcp_DIH4cS6P();
+    init_src_Cqbh3MYc();
     init_shimsNode();
     DEFAULT_MAX_REQUEST_BODY_SIZE = 4 * 1024 * 1024;
   }
@@ -35619,6 +35663,15 @@ ${JSON.stringify(preview, null, 2)}`,
   };
   const response = inputResponse(ctx.mcpReq.inputResponses, requestKey);
   const accepted = acceptedContent(ctx.mcpReq.inputResponses, requestKey, confirmationSchema);
+  if (options.elicitation === false) {
+    return textResult({
+      confirmed: false,
+      dispatched: false,
+      action: options.action,
+      reason: "confirmation-unsupported",
+      note: options.unsupportedNote ? `${DISABLED_NOTE}. ${options.unsupportedNote}` : `${DISABLED_NOTE}.`
+    });
+  }
   if (response.kind === "missing") {
     if (callerAcceptsFormElicitation(ctx) === false) {
       return textResult({
@@ -35649,7 +35702,7 @@ ${JSON.stringify(preview, null, 2)}`,
     note: "Nothing was changed because the confirmation was declined, cancelled, or left unchecked."
   });
 }
-var DEFAULT_REQUEST_KEY, DEFAULT_CONFIRMATION_LABEL, UNSUPPORTED_NOTE, STATE_PREFIX;
+var DEFAULT_REQUEST_KEY, DEFAULT_CONFIRMATION_LABEL, UNSUPPORTED_NOTE, DISABLED_NOTE, STATE_PREFIX;
 var init_confirmation = __esm({
   "node_modules/@chrischall/mcp-utils/dist/server/confirmation.js"() {
     init_dist();
@@ -35660,6 +35713,7 @@ var init_confirmation = __esm({
     DEFAULT_REQUEST_KEY = "confirmation";
     DEFAULT_CONFIRMATION_LABEL = "Confirm this action should proceed.";
     UNSUPPORTED_NOTE = "Nothing was done because this client cannot show a confirmation prompt (it declares no MCP elicitation capability), and this action is never taken without one";
+    DISABLED_NOTE = "Nothing was done because confirmation prompts are turned off for this server, and this action is never taken without one";
     STATE_PREFIX = "mcpu.confirm.v1.";
   }
 });
@@ -35813,7 +35867,7 @@ async function tokenConfirmation(action, fb) {
 }
 async function requireConfirmationWithFallback(ctx, options) {
   const { tokenFallback, ...confirmation } = options;
-  if (tokenFallback && callerAcceptsFormElicitation(ctx) === false) {
+  if (tokenFallback && (options.elicitation === false || callerAcceptsFormElicitation(ctx) === false)) {
     return tokenConfirmation(options.action, tokenFallback);
   }
   return requireConfirmation(ctx, confirmation);
@@ -36024,6 +36078,20 @@ function readConfirmMode(env = process.env) {
   }
   return "refuse";
 }
+function readConfirmElicitation(env = process.env) {
+  const raw = readEnvVar("MCP_CONFIRM_ELICITATION", { env })?.trim().toLowerCase();
+  if (!raw || raw === "on")
+    return "on";
+  if (raw === "off")
+    return "off";
+  const key = `elicitation:${raw}`;
+  if (!warned.has(key)) {
+    warned.add(key);
+    process.stderr.write(`MCP_CONFIRM_ELICITATION="${raw}" is not one of on, off; treating it as on.
+`);
+  }
+  return "on";
+}
 function readConfirmTtl(env) {
   const raw = readEnvVar("MCP_CONFIRM_TTL_SECONDS", { env })?.trim();
   if (!raw)
@@ -36076,10 +36144,13 @@ function confirmationFromEnv(options) {
   const spent = callerSpent ?? spentTokenStoreFromEnv(env);
   const mode = readConfirmMode(env);
   const ttlSeconds = readConfirmTtl(env);
+  const elicitationOff = readConfirmElicitation(env) === "off";
   const bound = args === void 0 ? void 0 : boundArgs(args);
-  const confirmation = bound === void 0 || rest.binding ? rest : { ...rest, binding: { key: confirmKeyFromEnv(env), args: bound, ttlSeconds: ttlSeconds ?? DEFAULT_TTL_SECONDS2 } };
+  const bindingAdded = bound === void 0 || rest.binding ? rest : { ...rest, binding: { key: confirmKeyFromEnv(env), args: bound, ttlSeconds: ttlSeconds ?? DEFAULT_TTL_SECONDS2 } };
+  const confirmation = elicitationOff ? { ...bindingAdded, elicitation: false } : bindingAdded;
   if (mode === "refuse" || ttlSeconds === void 0) {
-    const hint = mode === "refuse" ? REFUSE_HINT : BAD_TTL_HINT;
+    const reason = mode === "refuse" ? REFUSE_HINT : BAD_TTL_HINT;
+    const hint = elicitationOff ? `${ELICITATION_OFF_HINT} ${reason}` : reason;
     return {
       ...confirmation,
       unsupportedNote: confirmation.unsupportedNote ? `${confirmation.unsupportedNote} ${hint}` : hint
@@ -36105,7 +36176,7 @@ function confirmationFromEnv(options) {
     }
   };
 }
-var MODES, DEFAULT_TTL_SECONDS2, warned, processKey, fileStores, CONFIRM_TOKEN_AUTO_INSTRUCTION, REFUSE_HINT, BAD_TTL_HINT;
+var MODES, DEFAULT_TTL_SECONDS2, warned, processKey, fileStores, CONFIRM_TOKEN_AUTO_INSTRUCTION, REFUSE_HINT, ELICITATION_OFF_HINT, BAD_TTL_HINT;
 var init_confirm_env = __esm({
   "node_modules/@chrischall/mcp-utils/dist/server/confirm-env.js"() {
     init_config();
@@ -36117,6 +36188,7 @@ var init_confirm_env = __esm({
     fileStores = /* @__PURE__ */ new Map();
     CONFIRM_TOKEN_AUTO_INSTRUCTION = "Nothing has been done yet. Review this preview; if it is what was intended, call again with the same arguments plus confirmToken. (This server runs with MCP_CONFIRM_MODE=auto, so the user's approval in chat is not required.)";
     REFUSE_HINT = "Set MCP_CONFIRM_MODE=ask-user on the server to allow two-step confirmation instead.";
+    ELICITATION_OFF_HINT = "MCP_CONFIRM_ELICITATION=off on the server turns confirmation prompts off.";
     BAD_TTL_HINT = "MCP_CONFIRM_TTL_SECONDS on the server is not a positive whole number of seconds; fix it to allow two-step confirmation.";
   }
 });
@@ -36276,7 +36348,10 @@ function surfaceToolHints(server) {
   ));
 }
 async function createMcpServer(opts) {
-  const server = new McpServer({ name: opts.name, version: opts.version }, { supportedProtocolVersions: [...SERVER_PROTOCOL_VERSIONS] });
+  const server = new McpServer({ name: opts.name, version: opts.version }, {
+    supportedProtocolVersions: [...SERVER_PROTOCOL_VERSIONS],
+    ...opts.maxToolInputElements !== void 0 ? { maxToolInputElements: opts.maxToolInputElements } : {}
+  });
   if (opts.surfaceHints !== false)
     surfaceToolHints(server);
   if (opts.banner !== void 0) {
@@ -36458,6 +36533,21 @@ var init_fs = __esm({
   }
 });
 
+// node_modules/@chrischall/mcp-utils/dist/internal/headers.js
+function responseHeader(res, name) {
+  return getHeader(res?.headers, name);
+}
+function getHeader(headers, name) {
+  if (!headers || typeof headers.get !== "function")
+    return null;
+  const value = headers.get.call(headers, name);
+  return typeof value === "string" ? value : null;
+}
+var init_headers = __esm({
+  "node_modules/@chrischall/mcp-utils/dist/internal/headers.js"() {
+  }
+});
+
 // node_modules/@chrischall/mcp-utils/dist/internal/ascii.js
 var init_ascii = __esm({
   "node_modules/@chrischall/mcp-utils/dist/internal/ascii.js"() {
@@ -36708,7 +36798,7 @@ function createApiClient(opts) {
       if (retryStatuses.includes(res.status) && attempt < retry.count) {
         discard(current);
         attempt += 1;
-        const delay = retry.honorRetryAfter ? parseRetryAfterMs(res.headers.get("retry-after"), {
+        const delay = retry.honorRetryAfter ? parseRetryAfterMs(responseHeader(res, "retry-after"), {
           defaultMs: retry.delayMs,
           capMs: retry.maxRetryAfterMs ?? 3e4
         }) : retry.delayMs;
@@ -36721,7 +36811,7 @@ function createApiClient(opts) {
   async function unauthorizedOrEdge(attempt, method, path) {
     const res = attempt.res;
     let text = "";
-    if (/json/i.test(res.headers.get("content-type") ?? "")) {
+    if (/json/i.test(responseHeader(res, "content-type") ?? "")) {
       discard(attempt);
     } else {
       text = await readBody(attempt, (r) => r.text()).catch(() => "");
@@ -36733,14 +36823,14 @@ function createApiClient(opts) {
   }
   async function rateLimitedError(attempt, method, path) {
     const res = attempt.res;
-    const retryAfter = res.headers.get("retry-after");
+    const retryAfter = responseHeader(res, "retry-after");
     const retryAfterMs = retryAfterToMs(retryAfter);
     if (!opts.onRateLimited) {
       discard(attempt);
       return new RateLimitedError(service, retryAfterMs);
     }
     let text = "";
-    if (/json/i.test(res.headers.get("content-type") ?? "")) {
+    if (/json/i.test(responseHeader(res, "content-type") ?? "")) {
       discard(attempt);
     } else {
       text = await readBody(attempt, (r) => r.text()).catch(() => "");
@@ -36800,7 +36890,7 @@ function createApiClient(opts) {
     const bytes = new Uint8Array(await readBody(attempt, (r) => r.arrayBuffer()));
     return {
       status: res.status,
-      contentType: res.headers.get("content-type"),
+      contentType: responseHeader(res, "content-type"),
       headers: res.headers,
       bytes
     };
@@ -36860,6 +36950,7 @@ function decodeJwtExp(token) {
 var DEFAULT_RETRY, defaultSleep, UnauthorizedError, RateLimitedError, RequestTimeoutError, ApiError, EdgeBlockedError, EDGE_BLOCK_SCAN_MAX, EDGE_BLOCK_MARKERS;
 var init_http = __esm({
   "node_modules/@chrischall/mcp-utils/dist/http/index.js"() {
+    init_headers();
     init_cancel();
     init_errors3();
     init_scrape();
@@ -37023,6 +37114,7 @@ var init_es256 = __esm({
 // node_modules/@chrischall/mcp-utils/dist/auth/index.js
 var init_auth = __esm({
   "node_modules/@chrischall/mcp-utils/dist/auth/index.js"() {
+    init_headers();
     init_config();
     init_errors3();
     init_http();
@@ -37056,7 +37148,7 @@ var init_version = __esm({
   "src/version.ts"() {
     "use strict";
     PACKAGE_NAME = "office-outlook-mcp";
-    VERSION = "0.3.3";
+    VERSION = "0.3.5";
   }
 });
 
@@ -37308,7 +37400,7 @@ async function transcriptHash(mcpNonce, extNonce, mcpSessionPub, extSessionPub)
 function frameAad(mcpId, seq, direction) {
   return enc.encode(`fetchproxy/4/frame\0${mcpId}\0${seq}\0${direction}`);
 }
-var PROTOCOL_VERSION, HKDF_SESSION_INFO, enc, ANSWERS_NO_EXT_SESSION, KNOWN_CAPABILITIES;
+var PROTOCOL_VERSION, HKDF_SESSION_INFO, enc, ANSWERS_NO_EXT_SESSION, KNOWN_CAPABILITIES, ACCOUNT_KEY_FRAME, ACCOUNT_ATTEST_FRAME, BRIDGE_ROLE_FRAME, BRIDGE_SERVE_FRAME, ROOM_PING_FRAME, ROOM_PONG_FRAME, BRIDGE_ROLE_LABEL_MAX, ROOM_FRAME_ACCEPTS;
 var init_frames = __esm({
   "node_modules/@fetchproxy/protocol/dist/frames.js"() {
     init_crypto();
@@ -37332,6 +37424,78 @@ var init_frames = __esm({
       "graphql",
       "write_cookies"
     ]);
+    ACCOUNT_KEY_FRAME = "account-key";
+    ACCOUNT_ATTEST_FRAME = "account-attest";
+    BRIDGE_ROLE_FRAME = "bridge-role";
+    BRIDGE_SERVE_FRAME = "bridge-serve";
+    ROOM_PING_FRAME = "room-ping";
+    ROOM_PONG_FRAME = "room-pong";
+    BRIDGE_ROLE_LABEL_MAX = 64;
+    ROOM_FRAME_ACCEPTS = Object.freeze({
+      [BRIDGE_ROLE_FRAME]: BRIDGE_ROLE_FRAME,
+      [BRIDGE_SERVE_FRAME]: BRIDGE_SERVE_FRAME,
+      [ROOM_PING_FRAME]: ROOM_PING_FRAME,
+      [ROOM_PONG_FRAME]: ROOM_PING_FRAME
+    });
+  }
+});
+
+// node_modules/@fetchproxy/protocol/dist/mcp-id.js
+function generateMcpId(serverName, version2) {
+  if (serverName.includes(":")) {
+    throw new Error(`serverName cannot contain ':': ${serverName}`);
+  }
+  if (version2.includes(":")) {
+    throw new Error(`version cannot contain ':': ${version2}`);
+  }
+  const rand = randomHex(8);
+  return `${serverName}:${version2}:${rand}`;
+}
+function isValidMcpId(id) {
+  return typeof id === "string" && ID_RE.test(id);
+}
+function randomHex(bytes) {
+  const arr = new Uint8Array(bytes);
+  globalThis.crypto.getRandomValues(arr);
+  return Array.from(arr, (b) => b.toString(16).padStart(2, "0")).join("");
+}
+var ID_RE;
+var init_mcp_id = __esm({
+  "node_modules/@fetchproxy/protocol/dist/mcp-id.js"() {
+    ID_RE = /^([^:]+):([^:]+):([0-9a-f]{16})$/;
+  }
+});
+
+// node_modules/@fetchproxy/protocol/dist/account-attest.js
+var ACCOUNT_ATTEST_CONSENTS, NO_SCOPE_DIGEST, ACCOUNT_ID_RE, HEX64_RE, ACCOUNT_KID_RE, enc2;
+var init_account_attest = __esm({
+  "node_modules/@fetchproxy/protocol/dist/account-attest.js"() {
+    init_crypto();
+    init_encoding();
+    init_mcp_id();
+    ACCOUNT_ATTEST_CONSENTS = Object.freeze([
+      "silent",
+      "confirm",
+      "confirm-each"
+    ]);
+    NO_SCOPE_DIGEST = "0".repeat(64);
+    ACCOUNT_ID_RE = /^[A-Za-z0-9_.\-]{1,128}$/;
+    HEX64_RE = /^[0-9a-f]{64}$/;
+    ACCOUNT_KID_RE = /^[0-9a-f]{16}$/;
+    enc2 = new TextEncoder();
+  }
+});
+
+// node_modules/@fetchproxy/protocol/dist/awaiting-approval.js
+function parseAwaitingApprovalReason(reason) {
+  if (!reason.startsWith(AWAITING_APPROVAL_REASON_PREFIX))
+    return null;
+  return reason.slice(AWAITING_APPROVAL_REASON_PREFIX.length).trim();
+}
+var AWAITING_APPROVAL_REASON_PREFIX;
+var init_awaiting_approval = __esm({
+  "node_modules/@fetchproxy/protocol/dist/awaiting-approval.js"() {
+    AWAITING_APPROVAL_REASON_PREFIX = "awaiting-approval:";
   }
 });
 
@@ -37364,32 +37528,6 @@ var init_capability_availability = __esm({
   }
 });
 
-// node_modules/@fetchproxy/protocol/dist/mcp-id.js
-function generateMcpId(serverName, version2) {
-  if (serverName.includes(":")) {
-    throw new Error(`serverName cannot contain ':': ${serverName}`);
-  }
-  if (version2.includes(":")) {
-    throw new Error(`version cannot contain ':': ${version2}`);
-  }
-  const rand = randomHex(8);
-  return `${serverName}:${version2}:${rand}`;
-}
-function isValidMcpId(id) {
-  return typeof id === "string" && ID_RE.test(id);
-}
-function randomHex(bytes) {
-  const arr = new Uint8Array(bytes);
-  globalThis.crypto.getRandomValues(arr);
-  return Array.from(arr, (b) => b.toString(16).padStart(2, "0")).join("");
-}
-var ID_RE;
-var init_mcp_id = __esm({
-  "node_modules/@fetchproxy/protocol/dist/mcp-id.js"() {
-    ID_RE = /^([^:]+):([^:]+):([0-9a-f]{16})$/;
-  }
-});
-
 // node_modules/@fetchproxy/protocol/dist/json-pointer.js
 function matchesDeclaredKey(requested, declared) {
   for (const decl of declared) {
@@ -37978,6 +38116,16 @@ function validateFrame(raw) {
     return { type: "extension-disconnected" };
   if (t === "peer-gone")
     return validatePeerGone(raw);
+  if (t === ACCOUNT_KEY_FRAME)
+    return validateAccountKey(raw);
+  if (t === ACCOUNT_ATTEST_FRAME)
+    return validateAccountAttest(raw);
+  if (t === BRIDGE_ROLE_FRAME)
+    return validateBridgeRole(raw);
+  if (t === BRIDGE_SERVE_FRAME || t === ROOM_PING_FRAME || t === ROOM_PONG_FRAME) {
+    assertExactFields(raw, TYPE_ONLY_FIELDS, t);
+    return { type: t };
+  }
   throw new ProtocolError3(`unknown frame type: ${String(t)}`);
 }
 function validateHello(raw) {
@@ -38180,6 +38328,133 @@ function validateHelloRejected(raw) {
   }
   return { type: "hello-rejected", mcpId: raw.mcpId, reason: raw.reason };
 }
+function assertExactFields(raw, allowed, label) {
+  for (const k of Object.keys(raw)) {
+    if (!allowed.includes(k)) {
+      throw new ProtocolError3(`${label}: unexpected field ${JSON.stringify(k)}`);
+    }
+  }
+}
+function assertMatch(x, re, label, what) {
+  assertString(x, label);
+  if (!re.test(x))
+    throw new ProtocolError3(`${label}: must be ${what}`);
+}
+function assertPositiveSafeInt(x, label) {
+  if (typeof x !== "number" || !Number.isSafeInteger(x) || x <= 0) {
+    throw new ProtocolError3(`${label}: expected positive safe integer`);
+  }
+}
+function assertDisplayString(x, label, min, max) {
+  assertString(x, label);
+  if (x.length < min || x.length > max) {
+    throw new ProtocolError3(`${label}: must be ${min}-${max} characters`);
+  }
+  if (DISPLAY_FORBIDDEN_RE.test(x)) {
+    throw new ProtocolError3(`${label}: control or bidi-override character`);
+  }
+}
+function validateAccountKey(raw) {
+  const L = "account-key";
+  assertMatch(raw.accountId, ACCOUNT_ID_RE, `${L}.accountId`, "an account id");
+  assertMatch(raw.slug, ACCOUNT_ID_RE, `${L}.slug`, "a slug");
+  assertDisplayString(raw.displayName, `${L}.displayName`, 0, 128);
+  assertDisplayString(raw.confirmedBy, `${L}.confirmedBy`, 1, 256);
+  assertMatch(raw.tokenId, ACCOUNT_ID_RE, `${L}.tokenId`, "a token id");
+  assertMatch(raw.kid, ACCOUNT_KID_RE, `${L}.kid`, "16 lowercase hex");
+  assertBase64Bytes(raw.publicKey, `${L}.publicKey`, 32);
+  assertPositiveSafeInt(raw.generation, `${L}.generation`);
+  const n = raw.bridgedRegistrations;
+  if (typeof n !== "number" || !Number.isSafeInteger(n) || n < 0) {
+    throw new ProtocolError3(`${L}.bridgedRegistrations: expected non-negative safe integer`);
+  }
+  assertExactFields(raw, ACCOUNT_KEY_FIELDS, L);
+  return {
+    type: ACCOUNT_KEY_FRAME,
+    accountId: raw.accountId,
+    slug: raw.slug,
+    displayName: raw.displayName,
+    confirmedBy: raw.confirmedBy,
+    tokenId: raw.tokenId,
+    kid: raw.kid,
+    publicKey: raw.publicKey,
+    generation: raw.generation,
+    bridgedRegistrations: n
+  };
+}
+function validateAccountAttest(raw) {
+  const L = "account-attest";
+  if (!isValidMcpId(raw.mcpId))
+    throw new ProtocolError3(`${L}.mcpId: invalid format`);
+  assertMatch(raw.accountId, ACCOUNT_ID_RE, `${L}.accountId`, "an account id");
+  assertPositiveSafeInt(raw.generation, `${L}.generation`);
+  assertMatch(raw.tokenId, ACCOUNT_ID_RE, `${L}.tokenId`, "a token id");
+  assertMatch(raw.kid, ACCOUNT_KID_RE, `${L}.kid`, "16 lowercase hex");
+  assertMatch(raw.registrationId, ACCOUNT_ID_RE, `${L}.registrationId`, "a registration id");
+  assertMatch(raw.slug, ACCOUNT_ID_RE, `${L}.slug`, "a slug");
+  assertMatch(raw.identityHash, HEX64_RE, `${L}.identityHash`, "64 lowercase hex");
+  assertBase64Bytes(raw.identityEd25519Pub, `${L}.identityEd25519Pub`, 32);
+  assertMatch(raw.scopeDigest, HEX64_RE, `${L}.scopeDigest`, "64 lowercase hex");
+  assertString(raw.consent, `${L}.consent`);
+  const consent = raw.consent;
+  const known = ACCOUNT_ATTEST_CONSENTS.find((c) => c === consent);
+  if (known === void 0) {
+    throw new ProtocolError3(`${L}.consent: must be one of ${ACCOUNT_ATTEST_CONSENTS.join(", ")}`);
+  }
+  assertPositiveSafeInt(raw.notAfter, `${L}.notAfter`);
+  assertBase64Bytes(raw.sig, `${L}.sig`, 64);
+  assertExactFields(raw, ACCOUNT_ATTEST_FIELDS, L);
+  return {
+    type: ACCOUNT_ATTEST_FRAME,
+    mcpId: raw.mcpId,
+    accountId: raw.accountId,
+    generation: raw.generation,
+    tokenId: raw.tokenId,
+    kid: raw.kid,
+    registrationId: raw.registrationId,
+    slug: raw.slug,
+    identityHash: raw.identityHash,
+    identityEd25519Pub: raw.identityEd25519Pub,
+    scopeDigest: raw.scopeDigest,
+    consent: known,
+    notAfter: raw.notAfter,
+    sig: raw.sig
+  };
+}
+function validateBridgeRole(raw) {
+  const L = BRIDGE_ROLE_FRAME;
+  const role = raw.role;
+  if (role !== "serving" && role !== "standby") {
+    throw new ProtocolError3(`${L}.role: must be one of serving, standby`);
+  }
+  const canServe = raw.canServe;
+  assertBoolean(canServe, `${L}.canServe`);
+  assertExactFields(raw, BRIDGE_ROLE_FIELDS, L);
+  const serving = raw.serving;
+  if (role === "serving") {
+    if (serving !== void 0) {
+      throw new ProtocolError3(`${L}.serving: must be absent when role is serving`);
+    }
+    return { type: BRIDGE_ROLE_FRAME, role, canServe };
+  }
+  if (serving === void 0) {
+    throw new ProtocolError3(`${L}.serving: required when role is standby`);
+  }
+  assertObject(serving, `${L}.serving`);
+  const label = serving.label;
+  assertDisplayString(label, `${L}.serving.label`, 1, BRIDGE_ROLE_LABEL_MAX);
+  const since = serving.since;
+  if (typeof since !== "number" || !Number.isSafeInteger(since) || since < 0) {
+    throw new ProtocolError3(`${L}.serving.since: expected non-negative safe integer (Unix ms)`);
+  }
+  assertExactFields(serving, BRIDGE_ROLE_SERVING_FIELDS, `${L}.serving`);
+  return {
+    type: BRIDGE_ROLE_FRAME,
+    role,
+    canServe,
+    serving: { label, since }
+  };
+}
 function validateInnerFrame(raw) {
   assertObject(raw, "inner");
   const t = raw.type;
@@ -38641,12 +38916,13 @@ function validateInnerResponse(raw) {
   }
   throw new ProtocolError3(`inner.ok: must be boolean, got ${typeof raw.ok}`);
 }
-var ProtocolError3, FORBIDDEN_KEYS, BASE64_RE, SCOPE_KEY_RE, SCOPE_KEY_GLOB_RE, HEADER_NAME_RE, HOSTNAME_RE, CAPTURE_PATH_RE, DOM_SELECTOR_RE, DOM_ATTRIBUTE_RE, GRAPHQL_OP_NAME_RE, PAIR_CODE_RE, KNOWN_RESPONSE_OPS;
+var ProtocolError3, FORBIDDEN_KEYS, BASE64_RE, SCOPE_KEY_RE, SCOPE_KEY_GLOB_RE, HEADER_NAME_RE, HOSTNAME_RE, CAPTURE_PATH_RE, DOM_SELECTOR_RE, DOM_ATTRIBUTE_RE, GRAPHQL_OP_NAME_RE, PAIR_CODE_RE, DISPLAY_FORBIDDEN_RE, ACCOUNT_KEY_FIELDS, ACCOUNT_ATTEST_FIELDS, TYPE_ONLY_FIELDS, BRIDGE_ROLE_FIELDS, BRIDGE_ROLE_SERVING_FIELDS, KNOWN_RESPONSE_OPS;
 var init_validate = __esm({
   "node_modules/@fetchproxy/protocol/dist/validate.js"() {
     init_frames();
     init_capability_availability();
     init_mcp_id();
+    init_account_attest();
     init_json_pointer();
     init_public_suffix();
     ProtocolError3 = class extends Error {
@@ -38666,6 +38942,38 @@ var init_validate = __esm({
     DOM_ATTRIBUTE_RE = /^[A-Za-z_:][A-Za-z0-9_:.\-]{0,127}$/;
     GRAPHQL_OP_NAME_RE = /^[_A-Za-z][_0-9A-Za-z]{0,127}$/;
     PAIR_CODE_RE = /^\d{4}-\d{4}$/;
+    DISPLAY_FORBIDDEN_RE = /[\u0000-\u001f\u007f-\u009f\u200e\u200f\u202a-\u202e\u2066-\u2069]/;
+    ACCOUNT_KEY_FIELDS = [
+      "type",
+      "accountId",
+      "slug",
+      "displayName",
+      "confirmedBy",
+      "tokenId",
+      "kid",
+      "publicKey",
+      "generation",
+      "bridgedRegistrations"
+    ];
+    ACCOUNT_ATTEST_FIELDS = [
+      "type",
+      "mcpId",
+      "accountId",
+      "generation",
+      "tokenId",
+      "kid",
+      "registrationId",
+      "slug",
+      "identityHash",
+      "identityEd25519Pub",
+      "scopeDigest",
+      "consent",
+      "notAfter",
+      "sig"
+    ];
+    TYPE_ONLY_FIELDS = ["type"];
+    BRIDGE_ROLE_FIELDS = ["type", "role", "canServe", "serving"];
+    BRIDGE_ROLE_SERVING_FIELDS = ["label", "since"];
     KNOWN_RESPONSE_OPS = /* @__PURE__ */ new Set([
       ...KNOWN_CAPABILITIES,
       "graphql_query"
@@ -38673,9 +38981,17 @@ var init_validate = __esm({
   }
 });
 
+// node_modules/@fetchproxy/protocol/dist/room-frames.js
+var init_room_frames = __esm({
+  "node_modules/@fetchproxy/protocol/dist/room-frames.js"() {
+    init_frames();
+    init_validate();
+  }
+});
+
 // node_modules/@fetchproxy/protocol/dist/pair-code.js
 async function pairTranscript(mcpIdentityPub, extIdentityPub, mcpNonce, extNonce, mcpSessionPub) {
-  const label = enc2.encode(PAIR_LABEL);
+  const label = enc3.encode(PAIR_LABEL);
   const parts = [mcpIdentityPub, extIdentityPub, mcpNonce, extNonce, mcpSessionPub];
   const out = new Uint8Array(label.length + 1 + parts.reduce((n, p) => n + p.length, 0));
   out.set(label, 0);
@@ -38694,11 +39010,11 @@ function digits(hash2) {
   const s = (n % 100000000n).toString().padStart(8, "0");
   return `${s.slice(0, 4)}-${s.slice(4)}`;
 }
-var enc2, PAIR_LABEL;
+var enc3, PAIR_LABEL;
 var init_pair_code = __esm({
   "node_modules/@fetchproxy/protocol/dist/pair-code.js"() {
     init_crypto();
-    enc2 = new TextEncoder();
+    enc3 = new TextEncoder();
     PAIR_LABEL = "fetchproxy/4/pair";
   }
 });
@@ -38713,14 +39029,14 @@ function base64Length(byteLength) {
   return Math.ceil(byteLength / 3) * 4;
 }
 function encodeInnerFrame(inner) {
-  return enc3.encode(JSON.stringify(inner));
+  return enc4.encode(JSON.stringify(inner));
 }
 function plaintextOf(inner) {
   return inner instanceof Uint8Array ? inner : encodeInnerFrame(inner);
 }
 function sealedFrameWireBytes(mcpId, seq, inner) {
   const plaintext = plaintextOf(inner).length;
-  const envelope = enc3.encode(JSON.stringify({ type: "frame", mcpId, seq, iv: "", ciphertext: "" })).length;
+  const envelope = enc4.encode(JSON.stringify({ type: "frame", mcpId, seq, iv: "", ciphertext: "" })).length;
   return envelope + IV_B64_BYTES + base64Length(plaintext + AES_GCM_TAG_BYTES);
 }
 async function sealInnerFrame(sessionKey, mcpId, seq, inner, direction) {
@@ -38758,14 +39074,14 @@ async function openEncryptedFrameDetailed(sessionKey, frame, direction) {
     return { stage: "validation-failed", error: error62, recoveredId };
   }
 }
-var enc3, dec, AES_GCM_TAG_BYTES, IV_B64_BYTES, MAX_FRAME_BYTES;
+var enc4, dec, AES_GCM_TAG_BYTES, IV_B64_BYTES, MAX_FRAME_BYTES;
 var init_seal = __esm({
   "node_modules/@fetchproxy/protocol/dist/seal.js"() {
     init_crypto();
     init_encoding();
     init_frames();
     init_validate();
-    enc3 = new TextEncoder();
+    enc4 = new TextEncoder();
     dec = new TextDecoder();
     AES_GCM_TAG_BYTES = 16;
     IV_B64_BYTES = 16;
@@ -38777,8 +39093,11 @@ var init_seal = __esm({
 var init_dist3 = __esm({
   "node_modules/@fetchproxy/protocol/dist/index.js"() {
     init_frames();
+    init_account_attest();
+    init_awaiting_approval();
     init_capability_availability();
     init_validate();
+    init_room_frames();
     init_crypto();
     init_mcp_id();
     init_pair_code();
@@ -41177,11 +41496,23 @@ var require_websocket = __commonJS({
           this._isServer = false;
           this._redirects = 0;
           if (protocols === void 0) {
-            protocols = [];
+            if (!options || options.protocols === void 0) {
+              protocols = [];
+            } else if (Array.isArray(options.protocols)) {
+              protocols = options.protocols;
+            } else {
+              protocols = [options.protocols];
+            }
           } else if (!Array.isArray(protocols)) {
             if (typeof protocols === "object" && protocols !== null) {
               options = protocols;
-              protocols = [];
+              if (options.protocols === void 0) {
+                protocols = [];
+              } else if (Array.isArray(options.protocols)) {
+                protocols = options.protocols;
+              } else {
+                protocols = [options.protocols];
+              }
             } else {
               protocols = [protocols];
             }
@@ -41378,7 +41709,6 @@ var require_websocket = __commonJS({
           }
           return;
         }
-        this._readyState = _WebSocket.CLOSING;
         this._sender.close(code2, data, !this._isServer, (err) => {
           if (err) return;
           this._closeFrameSent = true;
@@ -41386,6 +41716,7 @@ var require_websocket = __commonJS({
             this._socket.end();
           }
         });
+        this._readyState = _WebSocket.CLOSING;
         setCloseTimer(this);
       }
       /**
@@ -41610,6 +41941,7 @@ var require_websocket = __commonJS({
         socketPath: void 0,
         hostname: void 0,
         protocol: void 0,
+        protocols: void 0,
         timeout: void 0,
         method: "GET",
         host: void 0,
@@ -42815,14 +43147,23 @@ var init_session_ready = __esm({
       platform;
       /**
        * #418: the remedy, when the reason is one this package knows how to
-       * explain — today only `unsupported-capability`, which blames the browser
-       * rather than the MCP. `null` otherwise.
+       * explain — `unsupported-capability`, which blames the browser rather than
+       * the MCP, and (D12) `awaiting-approval`, which says to approve in the
+       * browser. `null` otherwise.
        */
       hint;
+      /**
+       * D12: `true` only for an `awaiting-approval:` refusal — the extension has
+       * queued an approval card and nobody is at the browser yet, so the same call
+       * succeeds once the person approves. Every other refusal is the extension's
+       * final answer, and retrying unchanged is refused the same way.
+       */
+      retryable;
       constructor(info) {
         const unavailable = parseUnsupportedCapabilityReason(info.reason);
+        const awaiting = parseAwaitingApprovalReason(info.reason);
         const platform = info.platform ?? null;
-        const hint = unavailable !== null ? `${platform ? `this browser (${platform})` : "this browser"} cannot serve any of the capabilities this MCP needs (${unavailable.join(", ")}) \u2014 ContextMint Bridge checked for the browser APIs and they are missing. Nothing is wrong with the MCP or your pairing, and updating will not change it: use this MCP from a browser that provides them (for example Chrome).` : null;
+        const hint = awaiting !== null ? `The extension is waiting for you to approve this MCP` + (awaiting !== "" ? ` (${awaiting})` : "") + ` \u2014 open ContextMint Bridge in your browser, approve it there, then retry. Nothing is wrong with the MCP or your sign-in.` : unavailable !== null ? `${platform ? `this browser (${platform})` : "this browser"} cannot serve any of the capabilities this MCP needs (${unavailable.join(", ")}) \u2014 ContextMint Bridge checked for the browser APIs and they are missing. Nothing is wrong with the MCP or your pairing, and updating will not change it: use this MCP from a browser that provides them (for example Chrome).` : null;
         super(`fetchproxy: the extension refused the connection for "${info.mcpId}": ${info.reason}. ` + (hint !== null ? hint : `This is the extension's own reason \u2014 it is not a timeout, and retrying unchanged will be refused the same way.`));
         this.name = "FetchproxyHelloRejectedError";
         this.mcpId = info.mcpId;
@@ -42830,6 +43171,7 @@ var init_session_ready = __esm({
         this.unavailableCapabilities = unavailable ?? [];
         this.platform = platform;
         this.hint = hint;
+        this.retryable = awaiting !== null;
         Object.setPrototypeOf(this, new.target.prototype);
       }
     };
@@ -43442,10 +43784,20 @@ async function startHost(opts) {
   let resolveOwnSession;
   let rejectOwnSession;
   let ownSessionReady;
+  let ownRetryableRefusal = false;
+  let ownSessionSettled = false;
   function resetSessionPromise() {
+    ownRetryableRefusal = false;
+    ownSessionSettled = false;
     ownSessionReady = new Promise((resolve2, reject) => {
-      resolveOwnSession = resolve2;
-      rejectOwnSession = reject;
+      resolveOwnSession = (st) => {
+        ownSessionSettled = true;
+        resolve2(st);
+      };
+      rejectOwnSession = (e) => {
+        ownSessionSettled = true;
+        reject(e);
+      };
     });
     ownSessionReady.catch(() => {
     });
@@ -43712,13 +44064,15 @@ async function startHost(opts) {
             const extPub = fromB64(frame.extensionSessionPub);
             const shared = await ecdhX25519(held.priv, extPub);
             const salt = await transcriptHash(held.nonce, extNonce, held.pub, extPub);
-            const key = await hkdfSha256(shared, salt, enc4.encode(HKDF_SESSION_INFO), 32);
+            const key = await hkdfSha256(shared, salt, enc5.encode(HKDF_SESSION_INFO), 32);
             if (extensionWs !== ws)
               return;
             ownSession = new SessionState(key);
             ownSessionInfo = sessionInfoFromHello(verifiedHello);
             ownDecryptFailures = 0;
             ownPendingPairCode = null;
+            if (ownRetryableRefusal)
+              resetSessionPromise();
             resolveOwnSession(ownSession);
           } else {
             const slot = peers.get(frame.mcpId);
@@ -43787,11 +44141,17 @@ async function startHost(opts) {
         }
         if (frame.type === "hello-rejected" && identified === "extension") {
           if (frame.mcpId === opts.ownMcpId) {
-            rejectOwnSession(new FetchproxyHelloRejectedError({
+            const refusal = new FetchproxyHelloRejectedError({
               mcpId: frame.mcpId,
               reason: frame.reason,
               platform: extensionHello?.platform ?? null
-            }));
+            });
+            if (ownRetryableRefusal)
+              resetSessionPromise();
+            const settlesPending = !ownSessionSettled;
+            rejectOwnSession(refusal);
+            if (refusal.retryable && settlesPending)
+              ownRetryableRefusal = true;
           } else {
             const slot = peers.get(frame.mcpId);
             if (slot?.helloFrame.accepts?.includes("hello-rejected")) {
@@ -43904,7 +44264,7 @@ async function startHost(opts) {
     sessionInfo: () => ownSession !== null ? ownSessionInfo : null
   };
 }
-var HTTP_ORIGIN_RE, PUBLIC_ORIGIN_RE, EXTENSION_ORIGIN_RE, OPAQUE_ORIGIN, ALLOW_LOCAL_ORIGINS_ENV, HANDSHAKE_TIMEOUT_MS, MAX_PAYLOAD_BYTES, enc4, OWN_DECRYPT_FAILURES_BEFORE_REHANDSHAKE;
+var HTTP_ORIGIN_RE, PUBLIC_ORIGIN_RE, EXTENSION_ORIGIN_RE, OPAQUE_ORIGIN, ALLOW_LOCAL_ORIGINS_ENV, HANDSHAKE_TIMEOUT_MS, MAX_PAYLOAD_BYTES, enc5, OWN_DECRYPT_FAILURES_BEFORE_REHANDSHAKE;
 var init_host = __esm({
   "node_modules/@fetchproxy/server/dist/host.js"() {
     init_wrapper();
@@ -43923,7 +44283,7 @@ var init_host = __esm({
     ALLOW_LOCAL_ORIGINS_ENV = "FETCHPROXY_ALLOW_LOCAL_ORIGINS";
     HANDSHAKE_TIMEOUT_MS = 15e3;
     MAX_PAYLOAD_BYTES = MAX_FRAME_BYTES;
-    enc4 = new TextEncoder();
+    enc5 = new TextEncoder();
     OWN_DECRYPT_FAILURES_BEFORE_REHANDSHAKE = 3;
   }
 });
@@ -44028,7 +44388,9 @@ async function startPeer(opts) {
   let rejectFirstReady;
   let sessionPromise;
   let sessionPromiseSettled = false;
+  let retryableRefusal = false;
   function resetSessionPromise() {
+    retryableRefusal = false;
     sessionPromiseSettled = false;
     sessionPromise = new Promise((resolve2, reject) => {
       resolveFirstReady = (st) => {
@@ -44125,6 +44487,8 @@ async function startPeer(opts) {
       raw = JSON.parse(data.toString());
       const frame = validateFrame(raw);
       if (frame.type === "hello" && frame.role === "extension") {
+        if (retryableRefusal)
+          resetSessionPromise();
         extensionHello = frame;
         const mintedKeypair = await generateSessionKeypair();
         const mintedHello = await buildServerHello({
@@ -44154,6 +44518,8 @@ async function startPeer(opts) {
           session = null;
           if (sessionPromiseSettled)
             resetSessionPromise();
+        } else if (retryableRefusal) {
+          resetSessionPromise();
         }
         extensionDisconnectListeners.forEach((cb) => cb());
         return;
@@ -44175,7 +44541,7 @@ async function startPeer(opts) {
         const extNonce = fromB64(authenticated.sessionNonce);
         const shared = await ecdhX25519(held.priv, extPub);
         const salt = await transcriptHash(held.nonce, extNonce, held.pub, extPub);
-        const sessionKey = await hkdfSha256(shared, salt, enc5.encode(HKDF_SESSION_INFO), 32);
+        const sessionKey = await hkdfSha256(shared, salt, enc6.encode(HKDF_SESSION_INFO), 32);
         if (sessionEphemeral !== held) {
           console.warn(`[fetchproxy] ${opts.serverName}: dropping a session derived against an ephemeral that was superseded while it was being derived`);
           return;
@@ -44188,16 +44554,24 @@ async function startPeer(opts) {
         if (isRenegotiation) {
           renegotiateListeners.forEach((cb) => cb());
         } else {
+          if (retryableRefusal)
+            resetSessionPromise();
           resolveFirstReady(session);
         }
         return;
       }
       if (frame.type === "hello-rejected" && frame.mcpId === opts.mcpId) {
-        rejectFirstReady(new FetchproxyHelloRejectedError({
+        const refusal = new FetchproxyHelloRejectedError({
           mcpId: frame.mcpId,
           reason: frame.reason,
           platform: extensionHello?.platform ?? null
-        }));
+        });
+        if (retryableRefusal)
+          resetSessionPromise();
+        const settlesPending = !sessionPromiseSettled;
+        rejectFirstReady(refusal);
+        if (refusal.retryable && settlesPending)
+          retryableRefusal = true;
       }
       if (frame.type === "pair-pending" && frame.mcpId === opts.mcpId) {
         const hello2 = extensionHello;
@@ -44327,7 +44701,7 @@ async function startPeer(opts) {
   };
   return handle;
 }
-var PEER_DIAL_TIMEOUT_MS, enc5;
+var PEER_DIAL_TIMEOUT_MS, enc6;
 var init_peer = __esm({
   "node_modules/@fetchproxy/server/dist/peer.js"() {
     init_wrapper();
@@ -44341,7 +44715,7 @@ var init_peer = __esm({
     init_extension_trust();
     init_extension_pins();
     PEER_DIAL_TIMEOUT_MS = 5e3;
-    enc5 = new TextEncoder();
+    enc6 = new TextEncoder();
   }
 });
 
@@ -44383,8 +44757,9 @@ var init_error_kind = __esm({
 
 // node_modules/@fetchproxy/server/dist/classify-bridge-error.js
 function classifyBridgeError(err) {
-  if (err instanceof FetchproxyHelloRejectedError)
-    return "hello_rejected";
+  if (err instanceof FetchproxyHelloRejectedError) {
+    return err.retryable ? "awaiting_approval" : "hello_rejected";
+  }
   if (err instanceof FetchproxySessionNotReadyError)
     return "session_not_ready";
   if (err instanceof FetchproxyTimeoutError)
@@ -48796,7 +49171,7 @@ await runMcp({
 });
 /*! Bundled license information:
 
-@modelcontextprotocol/server/dist/src-BHSMhZ_W.mjs:
+@modelcontextprotocol/server/dist/src-Cqbh3MYc.mjs:
   (*!
   * content-type
   * Copyright(c) 2015 Douglas Christopher Wilson

package/dist/version.js

@@ -10,4 +10,4 @@
  * line below and nowhere else — not even in prose.
  */
 export const PACKAGE_NAME = 'office-outlook-mcp';
-export const VERSION = '0.3.3'; // x-release-please-version
+export const VERSION = '0.3.5'; // x-release-please-version

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chrischall/office-outlook-mcp",
-  "version": "0.3.3",
+  "version": "0.3.5",
   "mcpName": "io.github.chrischall/office-outlook-mcp",
   "description": "Outlook / Microsoft 365 MCP server for Claude — developed and maintained by AI (Claude Code)",
   "author": "Claude Code (AI) <https://www.anthropic.com/claude>",
@@ -45,14 +45,14 @@
     "typecheck": "tsc -p tsconfig.check.json"
   },
   "dependencies": {
-    "@chrischall/mcp-utils": "^2.13.0",
-    "@fetchproxy/server": "^3.4.1",
-    "@modelcontextprotocol/server": "^2.2.0",
+    "@chrischall/mcp-utils": "^2.15.0",
+    "@fetchproxy/server": "^3.6.0",
+    "@modelcontextprotocol/server": "^2.3.0",
     "dotenv": "^18.0.1",
     "zod": "^4.6.5"
   },
   "devDependencies": {
-    "@modelcontextprotocol/client": "^2.2.0",
+    "@modelcontextprotocol/client": "^2.3.0",
     "@types/node": "^26.0.0",
     "@vitest/coverage-v8": "^5.0.0",
     "esbuild": "^0.28.1",

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/chrischall/office-outlook-mcp",
     "source": "github"
   },
-  "version": "0.3.3",
+  "version": "0.3.5",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "@chrischall/office-outlook-mcp",
-      "version": "0.3.3",
+      "version": "0.3.5",
       "transport": {
         "type": "stdio"
       },