@chrischall/office-outlook-mcp 0.5.2 → 0.6.1

package/dist/bundle.js

@@ -248,6 +248,7 @@ __export(util_exports, {
   required: () => required,
   safeExtend: () => safeExtend,
   shallowClone: () => shallowClone,
+  sizeCaps: () => sizeCaps,
   slugify: () => slugify,
   stringifyPrimitive: () => stringifyPrimitive,
   toZod: () => toZod,
@@ -671,6 +672,18 @@ function prefixIssues(path, issues) {
 function unwrapMessage(message) {
   return typeof message === "string" ? message : message?.message;
 }
+function sizeCaps(defChecks) {
+  const caps = [];
+  for (const ch of defChecks ?? []) {
+    const d = ch._zod.def;
+    if (!/_(length|size)$|_equals$/.test(d.check))
+      break;
+    const max = d.maximum ?? d.length ?? d.size;
+    if (max >= 0)
+      caps.push([max, ch]);
+  }
+  return caps;
+}
 function attachSchema(issues, start, inst) {
   var _a3;
   for (let i = start; i < issues.length; i++) {
@@ -2234,7 +2247,7 @@ var init_versions = __esm({
     version = {
       major: 4,
       minor: 6,
-      patch: 5
+      patch: 7
     };
   }
 });
@@ -2396,6 +2409,28 @@ function isValidJWT(token, algorithm = null) {
     return false;
   }
 }
+function capSize(inst, size) {
+  const caps = sizeCaps(inst._zod.def.checks);
+  if (!caps.length)
+    return;
+  const cap = Math.min(...caps.map((c) => c[0]));
+  const parse3 = inst._zod.parse;
+  inst._zod.parse = (payload, ctx) => {
+    const n = size(payload.value);
+    if (n > cap && !ctx?.skipChecks && ctx?.direction !== "backward") {
+      for (const [max, ch] of sizeCaps(inst._zod.def.checks)) {
+        if (n > max && ch._zod.def.when(payload)) {
+          const start = payload.issues.length;
+          ch._zod.check(payload);
+          payload.issues[start].continue = false;
+          attachSchema(payload.issues, start, inst);
+          return payload;
+        }
+      }
+    }
+    return parse3(payload, ctx);
+  };
+}
 function handleArrayResult(result, final, index) {
   if (result.issues.length) {
     final.issues.push(...prefixIssues(index, result.issues));
@@ -2896,7 +2931,7 @@ function handleRefineResult(result, payload, input2, inst) {
     payload.issues.push(issue(_iss));
   }
 }
-var $ZodType, toStandardResult, $ZodString, $ZodStringFormat, $ZodGUID, $ZodUUID, $ZodEmail, URL_BAD_FORMAT, URL_UNPARSEABLE, asciiTabOrNewline, $ZodURL, $ZodEmoji, $ZodNanoID, $ZodCUID, $ZodCUID2, $ZodULID, $ZodXID, $ZodKSUID, $ZodISODateTime, $ZodISODate, $ZodISOTime, $ZodISODuration, $ZodIPv4, ipv6Alphabet, $ZodIPv6, $ZodMAC, $ZodCIDRv4, $ZodCIDRv6, base64Charset, $ZodBase64, base64urlCharset, $ZodBase64URL, $ZodE164, CC_SANITIZE, $ZodCreditCard, $ZodIBAN, $ZodJWT, $ZodCustomStringFormat, $ZodNumber, $ZodNumberFormat, $ZodBoolean, $ZodBigInt, $ZodBigIntFormat, $ZodSymbol, $ZodUndefined, $ZodNull, $ZodAny, $ZodUnknown, $ZodNever, $ZodVoid, $ZodDate, $ZodArray, NO_SYMBOL_KEYS, $ZodObject, $ZodObjectJIT, $ZodUnion, $ZodXor, $ZodDiscriminatedUnion, $ZodIntersection, $ZodTuple, $ZodRecord, $ZodMap, $ZodSet, $ZodEnum, $ZodLiteral, $ZodFile, $ZodTransform, $ZodOptional, $ZodExactOptional, $ZodNullable, $ZodDefault, $ZodPrefault, $ZodNonOptional, $ZodSuccess, $ZodCatch, $ZodNaN, $ZodPipe, $ZodCodec, $ZodPreprocess, $ZodReadonly, $ZodTemplateLiteral, $ZodFunction, $ZodPromise, $ZodLazy, $ZodCustom;
+var $ZodType, toStandardResult, $ZodString, $ZodStringFormat, $ZodGUID, $ZodUUID, $ZodEmail, URL_BAD_FORMAT, URL_UNPARSEABLE, asciiTabOrNewline, $ZodURL, $ZodEmoji, $ZodNanoID, $ZodCUID, $ZodCUID2, $ZodULID, $ZodXID, $ZodKSUID, $ZodISODateTime, $ZodISODate, $ZodISOTime, $ZodISODuration, $ZodIPv4, ipv6Alphabet, $ZodIPv6, $ZodMAC, $ZodCIDRv4, $ZodCIDRv6, base64Charset, $ZodBase64, base64urlCharset, $ZodBase64URL, $ZodE164, CC_SANITIZE, $ZodCreditCard, $ZodIBAN, $ZodJWT, $ZodCustomStringFormat, $ZodNumber, $ZodNumberFormat, $ZodBoolean, $ZodBigInt, $ZodBigIntFormat, $ZodSymbol, $ZodUndefined, $ZodNull, $ZodAny, $ZodUnknown, $ZodNever, $ZodVoid, $ZodDate, arraySize, mapSize, setSize, $ZodArray, NO_SYMBOL_KEYS, $ZodObject, $ZodObjectJIT, $ZodUnion, $ZodXor, $ZodDiscriminatedUnion, $ZodIntersection, $ZodTuple, $ZodRecord, $ZodMap, $ZodSet, $ZodEnum, $ZodLiteral, $ZodFile, $ZodTransform, $ZodOptional, $ZodExactOptional, $ZodNullable, $ZodDefault, $ZodPrefault, $ZodNonOptional, $ZodSuccess, $ZodCatch, $ZodNaN, $ZodPipe, $ZodCodec, $ZodPreprocess, $ZodReadonly, $ZodTemplateLiteral, $ZodFunction, $ZodPromise, $ZodLazy, $ZodCustom;
 var init_schemas = __esm({
   "node_modules/zod/v4/core/schemas.js"() {
     init_checks();
@@ -3503,6 +3538,9 @@ var init_schemas = __esm({
         return payload;
       };
     });
+    arraySize = (input2) => Array.isArray(input2) ? input2.length : -1;
+    mapSize = (input2) => input2 instanceof Map ? input2.size : -1;
+    setSize = (input2) => input2 instanceof Set ? input2.size : -1;
     $ZodArray = /* @__PURE__ */ $constructor("$ZodArray", (inst, def) => {
       $ZodType.init(inst, def);
       const memo3 = globalConfig.memoizer;
@@ -3540,6 +3578,7 @@ var init_schemas = __esm({
         }
         return payload;
       };
+      capSize(inst, arraySize);
     });
     NO_SYMBOL_KEYS = [];
     $ZodObject = /* @__PURE__ */ $constructor("$ZodObject", (inst, def) => {
@@ -4178,6 +4217,7 @@ var init_schemas = __esm({
           return Promise.all(proms).then(() => payload);
         return payload;
       };
+      capSize(inst, mapSize);
     });
     $ZodSet = /* @__PURE__ */ $constructor("$ZodSet", (inst, def) => {
       $ZodType.init(inst, def);
@@ -4214,6 +4254,7 @@ var init_schemas = __esm({
           return Promise.all(proms).then(() => payload);
         return payload;
       };
+      capSize(inst, setSize);
     });
     $ZodEnum = /* @__PURE__ */ $constructor("$ZodEnum", (inst, def) => {
       $ZodType.init(inst, def);
@@ -14003,9 +14044,15 @@ function generateNullableCheck(doc, ctx, schema, accessor, buildsValue = true) {
   doc.write(`}`);
   return outputVar;
 }
+function generateSizeGate(doc, schema, size) {
+  for (const [max, check2] of sizeCaps(schema._zod.def.checks)) {
+    doc.write(`if (${size} > ${numericOperand(max, check2._zod.def.check)}) return INVALID;`);
+  }
+}
 function generateArrayCheck(doc, ctx, schema, accessor, buildsValue = true) {
   const def = schema._zod.def;
   doc.write(`if (!Array.isArray(${accessor})) return INVALID;`);
+  generateSizeGate(doc, schema, `${accessor}.length`);
   const outputVar = buildsValue ? newVar(ctx) : null;
   const iVar = newVar(ctx);
   const elemVar = newVar(ctx);
@@ -14405,6 +14452,7 @@ function literalPropertyKey(ctx, key) {
 function generateMapCheck(doc, ctx, schema, accessor) {
   const def = schema._zod.def;
   doc.write(`if (!(${accessor} instanceof Map)) return INVALID;`);
+  generateSizeGate(doc, schema, `${accessor}.size`);
   const outputVar = newVar(ctx);
   const kVar = newVar(ctx);
   const valVar = newVar(ctx);
@@ -14421,6 +14469,7 @@ function generateMapCheck(doc, ctx, schema, accessor) {
 function generateSetCheck(doc, ctx, schema, accessor) {
   const def = schema._zod.def;
   doc.write(`if (!(${accessor} instanceof Set)) return INVALID;`);
+  generateSizeGate(doc, schema, `${accessor}.size`);
   const outputVar = newVar(ctx);
   const valVar = newVar(ctx);
   doc.write(`const ${outputVar} = new Set();`);
@@ -35482,7 +35531,7 @@ var init_errors3 = __esm({
       // webhook signing secret (Stripe-style)
     ].map((p) => `\\b${p}`).join("|"), "g");
     GOOGLE_OAUTH_TOKEN_RE = /(?<![A-Za-z0-9+/])(?:ya29\.|1\/\/)[A-Za-z0-9._-]{8,}/g;
-    QUERY_SECRET_RE = new RegExp(`([?&](?:(?:access|refresh|id|auth|session|csrf|xsrf)[_-]?token|client[_-]?secret|api[_-]?secret|api[_-]?key|password|passwd|signature|token|key|sig|(?:code[_-]?)?verifier|(?:php|j)?sess(?:ion)?[_-]?id|sid|x[-_]${HEADER_NAME_RUN}?(?:api[-_]?key|token|secret|auth)${HEADER_NAME_RUN})=)[^&#\\s"'<>\`]+`, "gi");
+    QUERY_SECRET_RE = new RegExp(`([?&#;](?:(?:access|refresh|id|auth|session|csrf|xsrf|api)[_-]?token|client[_-]?secret|api[_-]?secret|api[_-]?key|password|passwd|signature|secret|token|auth|key|sig|(?:code[_-]?)?verifier|(?:php|j)?sess(?:ion)?[_-]?id|sid|x[-_]${HEADER_NAME_RUN}?(?:api[-_]?key|token|secret|auth)${HEADER_NAME_RUN})=)[^&#\\s"'<>\`]+`, "gi");
     OAUTH_CODE_RE = /([?&]code=)(?=[^&#\s"'<>`]{16,})[^&#\s"'<>`]+/gi;
     FORM_PASSWORD_RE = /((?:^|[\s,;:"'(\[{])(?:password|passwd)=)[^&#\s"'<>`]+/gim;
     HEADER_SECRET_RE = new RegExp(`(\\b(?:x[-_]${HEADER_NAME_RUN}?(?:api[-_]?key|token|secret|auth)${HEADER_NAME_RUN}|api[-_]?key)\\s*:\\s*)[^\\s,;"'<>\`]+`, "gi");
@@ -35493,6 +35542,8 @@ var init_errors3 = __esm({
       "api[_-]?secret",
       "(?:x[_-])?api[_-]?key",
       "private[_-]?key",
+      "aws[_-]?secret[_-]?access[_-]?key",
+      // fleet-audit#1297
       "code[_-]?verifier",
       // PKCE; a bare `verifier` key is too generic for JSON
       `x[_-]${HEADER_NAME_RUN}?(?:api[_-]?key|token|secret|auth)${HEADER_NAME_RUN}`,
@@ -36651,6 +36702,9 @@ var init_headers = __esm({
 });
 
 // node_modules/@chrischall/mcp-utils/dist/internal/ascii.js
+function asciiLower(s) {
+  return s.replace(/[A-Z]+/g, (m) => m.toLowerCase());
+}
 var init_ascii = __esm({
   "node_modules/@chrischall/mcp-utils/dist/internal/ascii.js"() {
   }
@@ -36662,16 +36716,42 @@ var init_code_point = __esm({
   }
 });
 
+// node_modules/@chrischall/mcp-utils/dist/internal/tags.js
+var init_tags = __esm({
+  "node_modules/@chrischall/mcp-utils/dist/internal/tags.js"() {
+  }
+});
+
 // node_modules/@chrischall/mcp-utils/dist/scrape/index.js
 function isCloudflareChallenge(html) {
-  return /_cf_chl_opt/.test(html) || /<title[^>]*>\s*Just a moment/i.test(html);
+  return html.includes("_cf_chl_opt") || hasJustAMomentTitle(html);
+}
+function hasJustAMomentTitle(html) {
+  const lower2 = asciiLower(html);
+  let i = 0;
+  for (; ; ) {
+    const open2 = lower2.indexOf("<title", i);
+    if (open2 < 0)
+      return false;
+    const gt = lower2.indexOf(">", open2 + 6);
+    if (gt < 0)
+      return false;
+    let j = gt + 1;
+    while (j < lower2.length && /\s/.test(lower2[j]))
+      j++;
+    if (lower2.startsWith(JUST_A_MOMENT, j))
+      return true;
+    i = gt + 1;
+  }
 }
-var NEXT_DATA_MAX_CHARS;
+var NEXT_DATA_MAX_CHARS, JUST_A_MOMENT;
 var init_scrape = __esm({
   "node_modules/@chrischall/mcp-utils/dist/scrape/index.js"() {
     init_ascii();
     init_code_point();
+    init_tags();
     NEXT_DATA_MAX_CHARS = 16 * 1024 * 1024;
+    JUST_A_MOMENT = "just a moment";
   }
 });
 
@@ -36707,7 +36787,7 @@ var init_net_atoms = __esm({
 // node_modules/@chrischall/mcp-utils/dist/http/body-limit.js
 async function readBytesCapped(res, maxBytes, service, bounded) {
   if (maxBytes !== void 0) {
-    const declared = Number(res.headers.get("content-length") ?? NaN);
+    const declared = Number(responseHeader(res, "content-length") ?? NaN);
     if (Number.isFinite(declared) && declared > maxBytes) {
       cancelStream(res.body);
       throw new ResponseTooLargeError(service, maxBytes);
@@ -36752,6 +36832,7 @@ var ResponseTooLargeError;
 var init_body_limit = __esm({
   "node_modules/@chrischall/mcp-utils/dist/http/body-limit.js"() {
     init_errors3();
+    init_headers();
     ResponseTooLargeError = class extends McpToolError {
       maxBytes;
       constructor(service, maxBytes) {
@@ -36831,6 +36912,27 @@ var init_retry_after = __esm({
 });
 
 // node_modules/@chrischall/mcp-utils/dist/http/index.js
+function withoutCredentials(headers, tokenHeader) {
+  const drop = new Set(CROSS_ORIGIN_DROPPED_HEADERS);
+  if (tokenHeader !== void 0)
+    drop.add(tokenHeader.toLowerCase());
+  const out = {};
+  for (const [k, v] of Object.entries(headers))
+    if (!drop.has(k.toLowerCase()))
+      out[k] = v;
+  return out;
+}
+function joinQuery(path, query) {
+  if (!query)
+    return path;
+  const hashAt = path.indexOf("#");
+  const head = hashAt < 0 ? path : path.slice(0, hashAt);
+  const fragment = hashAt < 0 ? "" : path.slice(hashAt);
+  if (!head.includes("?"))
+    return `${head}${query}${fragment}`;
+  const sep = head.endsWith("?") || head.endsWith("&") ? "" : "&";
+  return `${head}${sep}${query.slice(1)}${fragment}`;
+}
 function cancelBody(res) {
   try {
     const body = res.body;
@@ -36959,7 +37061,9 @@ function createApiClient(opts) {
   const retryStatuses = retry.statuses ?? [429];
   const timeoutMs = opts.timeout === false ? 0 : opts.timeout ?? DEFAULT_REQUEST_TIMEOUT_MS;
   const redirectMode = opts.redirect;
-  const maxRedirects = opts.maxRedirects ?? DEFAULT_MAX_REDIRECTS;
+  const stripCrossOrigin = redirectMode === void 0 && opts.tokenHeader !== void 0;
+  const manualRedirects = redirectMode === "same-origin" || stripCrossOrigin;
+  const maxRedirects = opts.maxRedirects ?? (stripCrossOrigin ? FETCH_MAX_REDIRECTS : DEFAULT_MAX_REDIRECTS);
   const reportWriteOutcome = opts.writeOutcomeUnknown !== false;
   const defaultMaxBytes = checkMaxBytes("maxResponseBytes", opts.maxResponseBytes);
   if (!Number.isSafeInteger(maxRedirects) || maxRedirects < 0) {
@@ -37061,7 +37165,7 @@ function createApiClient(opts) {
         `Refusing request to ${service}: path ${JSON.stringify(path.split(/[?#]/, 1)[0])} contains a ${hazard}, which URL normalisation would rewrite. Build paths with apiPath\`...\` so each value is one encoded segment.`
       );
     }
-    const url2 = `${base}${path}${query}`;
+    const url2 = `${base}${joinQuery(path, query)}`;
     if (baseOrigin === void 0)
       return url2;
     let parsed;
@@ -37075,14 +37179,21 @@ function createApiClient(opts) {
     }
     return url2;
   }
-  function sameOriginHop(location, from) {
-    let next;
+  function resolveLocation(location, from) {
     try {
-      next = new URL(location, from);
+      return new URL(location, from).href;
     } catch {
       throw new RedirectRefusedError(`Refusing redirect from ${service}: the Location header is not a valid URL.`);
     }
-    if (baseOrigin === void 0 || next.origin !== baseOrigin || next.username !== baseParts?.username || next.password !== baseParts?.password) {
+  }
+  function onBaseOrigin(href) {
+    const next = new URL(href);
+    return baseOrigin !== void 0 && next.origin === baseOrigin && next.username === baseParts?.username && next.password === baseParts?.password;
+  }
+  function sameOriginHop(location, from) {
+    const href = resolveLocation(location, from);
+    const next = new URL(href);
+    if (!onBaseOrigin(href)) {
       throw new RedirectRefusedError(`Refusing redirect from ${service} to ${next.origin}: it leaves the base origin ${baseOrigin ?? "(unparseable)"}, and following it would re-send the credential there.`);
     }
     return next.href;
@@ -37092,20 +37203,21 @@ function createApiClient(opts) {
     const query = opt.query ? buildQueryString(opt.query) : "";
     const url2 = resolveUrl(path, query);
     const bodyInit = reqBody !== void 0 ? { body: reqBody } : {};
-    const fetchHop = (hopUrl, hopMethod, withBody, token, signal) => {
+    const fetchHop = (hopUrl, hopMethod, withBody, token, signal, credentialed = true) => {
       if (!signal?.aborted)
         dispatch.sent = true;
+      const headers = {
+        Accept: "application/json",
+        ...withBody && contentType !== void 0 ? { "Content-Type": contentType } : {},
+        ...opts.baseHeaders,
+        ...authHeader(token || void 0),
+        ...opt.headers
+      };
       return doFetch(hopUrl, {
         method: hopMethod,
-        headers: {
-          Accept: "application/json",
-          ...withBody && contentType !== void 0 ? { "Content-Type": contentType } : {},
-          ...opts.baseHeaders,
-          ...authHeader(token || void 0),
-          ...opt.headers
-        },
+        headers: credentialed ? headers : withoutCredentials(headers, opts.tokenHeader),
         ...signal ? { signal } : {},
-        ...redirectMode !== void 0 ? { redirect: redirectMode === "same-origin" ? "manual" : redirectMode } : {},
+        ...manualRedirects ? { redirect: "manual" } : redirectMode !== void 0 ? { redirect: redirectMode } : {},
         ...withBody ? bodyInit : {}
       }).catch((err) => {
         markTransportFailure(err);
@@ -37113,13 +37225,14 @@ function createApiClient(opts) {
       });
     };
     const fetchWith = async (token, signal) => {
-      if (redirectMode !== "same-origin")
+      if (!manualRedirects)
         return fetchHop(url2, method, true, token, signal);
       let hopUrl = url2;
       let hopMethod = method;
       let withBody = true;
+      let credentialed = true;
       for (let hops = 0; ; hops += 1) {
-        const res = await fetchHop(hopUrl, hopMethod, withBody, token, signal);
+        const res = await fetchHop(hopUrl, hopMethod, withBody, token, signal, credentialed);
         const location = REDIRECT_STATUSES.has(res.status) ? responseHeader(res, "location") : void 0;
         if (location === void 0 || location === null)
           return res;
@@ -37127,7 +37240,13 @@ function createApiClient(opts) {
         if (hops >= maxRedirects) {
           throw new RedirectRefusedError(`Refusing request to ${service}: too many redirects (more than ${maxRedirects}).`);
         }
-        hopUrl = sameOriginHop(location, hopUrl);
+        if (stripCrossOrigin) {
+          hopUrl = resolveLocation(location, hopUrl);
+          if (credentialed && !onBaseOrigin(hopUrl))
+            credentialed = false;
+        } else {
+          hopUrl = sameOriginHop(location, hopUrl);
+        }
         if (res.status === 303 || (res.status === 301 || res.status === 302) && hopMethod === "POST") {
           if (hopMethod !== "HEAD")
             hopMethod = "GET";
@@ -37331,7 +37450,7 @@ function decodeJwtExp(token) {
   }
   return exp;
 }
-var DEFAULT_RETRY, defaultSleep, DEFAULT_REQUEST_TIMEOUT_MS, DEFAULT_MAX_REDIRECTS, REDIRECT_STATUSES, UnauthorizedError, RateLimitedError, RequestTimeoutError, DEFAULT_WRITE_OUTCOME_HINT, WriteOutcomeUnknownError, SAFE_METHODS, ApiError, EdgeBlockedError, EDGE_BLOCK_SCAN_MAX, EDGE_BLOCK_MARKERS;
+var DEFAULT_RETRY, defaultSleep, DEFAULT_REQUEST_TIMEOUT_MS, DEFAULT_MAX_REDIRECTS, FETCH_MAX_REDIRECTS, CROSS_ORIGIN_DROPPED_HEADERS, REDIRECT_STATUSES, UnauthorizedError, RateLimitedError, RequestTimeoutError, DEFAULT_WRITE_OUTCOME_HINT, WriteOutcomeUnknownError, SAFE_METHODS, ApiError, EdgeBlockedError, EDGE_BLOCK_SCAN_MAX, EDGE_BLOCK_MARKERS;
 var init_http = __esm({
   "node_modules/@chrischall/mcp-utils/dist/http/index.js"() {
     init_headers();
@@ -37351,6 +37470,8 @@ var init_http = __esm({
     defaultSleep = (ms) => new Promise((r) => setTimeout(r, ms));
     DEFAULT_REQUEST_TIMEOUT_MS = 3e4;
     DEFAULT_MAX_REDIRECTS = 5;
+    FETCH_MAX_REDIRECTS = 20;
+    CROSS_ORIGIN_DROPPED_HEADERS = ["authorization", "cookie", "proxy-authorization"];
     REDIRECT_STATUSES = /* @__PURE__ */ new Set([301, 302, 303, 307, 308]);
     UnauthorizedError = class extends Error {
       status = 401;
@@ -37588,7 +37709,7 @@ var init_version = __esm({
   "src/version.ts"() {
     "use strict";
     PACKAGE_NAME = "office-outlook-mcp";
-    VERSION = "0.5.2";
+    VERSION = "0.6.1";
   }
 });
 
@@ -38143,6 +38264,21 @@ var init_public_suffix = __esm({
   }
 });
 
+// node_modules/@fetchproxy/protocol/dist/ip-literal.js
+function isIpLiteralHost(host) {
+  if (host.includes(":") || host.startsWith("["))
+    return true;
+  const labels = host.split(".");
+  if (labels.length > 1 && labels[labels.length - 1] === "")
+    labels.pop();
+  const last = labels[labels.length - 1] ?? "";
+  return /^[0-9]+$/.test(last) || /^0x[0-9a-f]*$/i.test(last);
+}
+var init_ip_literal = __esm({
+  "node_modules/@fetchproxy/protocol/dist/ip-literal.js"() {
+  }
+});
+
 // node_modules/@fetchproxy/protocol/dist/validate.js
 function assertObject(x, label) {
   if (typeof x !== "object" || x === null || Array.isArray(x)) {
@@ -38592,6 +38728,9 @@ function validateHello(raw) {
       if (!HOSTNAME_RE.test(d)) {
         throw new ProtocolError3(`hello.domains: invalid hostname ${JSON.stringify(d)}`);
       }
+      if (isIpLiteralHost(d)) {
+        throw new ProtocolError3(`hello.domains: ${JSON.stringify(d)} is an IP address \u2014 declare the site's DNS hostname; IP-literal origins (LAN, loopback, link-local) are not reachable through the bridge`);
+      }
       if (isPublicSuffix(d)) {
         throw new ProtocolError3(`hello.domains: ${JSON.stringify(d)} is a public suffix \u2014 declare a registrable domain (e.g. "example.${d}"), not the suffix every site under it shares`);
       }
@@ -39365,6 +39504,7 @@ var init_validate = __esm({
     init_account_attest();
     init_json_pointer();
     init_public_suffix();
+    init_ip_literal();
     ProtocolError3 = class extends Error {
       constructor(message) {
         super(message);
@@ -39544,6 +39684,7 @@ var init_dist3 = __esm({
     init_seal();
     init_encoding();
     init_public_suffix();
+    init_ip_literal();
     init_json_pointer();
   }
 });
@@ -44514,7 +44655,7 @@ async function startHost(opts) {
             if (ownRetryableRefusal)
               resetSessionPromise();
             resolveOwnSession(ownSession);
-          } else {
+          } else if (identified === "extension" && extensionWs === ws) {
             const slot = peers.get(frame.mcpId);
             if (slot)
               slot.ws.send(JSON.stringify(frame));
@@ -45602,6 +45743,9 @@ var init_ws_server = __esm({
           throw new Error("FetchproxyServer: opts.domains must be a non-empty array of hostnames");
         }
         for (const d of opts.domains) {
+          if (typeof d === "string" && isIpLiteralHost(d)) {
+            throw new Error(`FetchproxyServer: opts.domains entry ${JSON.stringify(d)} is an IP address \u2014 declare the site's DNS hostname; IP-literal origins (LAN, loopback, link-local) are not reachable through the bridge`);
+          }
           if (typeof d === "string" && isPublicSuffix(d)) {
             throw new Error(`FetchproxyServer: opts.domains entry ${JSON.stringify(d)} is a public suffix \u2014 declare a registrable domain (e.g. "example.${d}"), not the suffix every site under it shares`);
           }
@@ -47547,8 +47691,10 @@ var init_bulk = __esm({
 });
 
 // node_modules/@fetchproxy/server/dist/bot-wall.js
+var CLOUDFLARE_TITLE_SCAN_MAX;
 var init_bot_wall = __esm({
   "node_modules/@fetchproxy/server/dist/bot-wall.js"() {
+    CLOUDFLARE_TITLE_SCAN_MAX = 64 * 1024;
   }
 });
 
@@ -49028,6 +49174,7 @@ function isMeetingMessage(m) {
 
 // src/tools/_paging.ts
 init_zod();
+init_dist2();
 var nextLinkParam = external_exports.string().min(1).optional().describe(
   "Continue a previous listing: pass its `nextLink` value unchanged to fetch the next page. When set, the paging/filter arguments are taken from the link and ignored here."
 );
@@ -49043,6 +49190,71 @@ function plainCollection(data) {
   if (next) out.nextLink = next;
   return out;
 }
+var fromParam = external_exports.string().min(1).optional().describe(
+  'Page oldest first from this point: an ISO 8601 UTC time (e.g. "2026-10-01T00:00:00Z"; one with no zone is read as UTC), or a previous result\'s `next_from` passed unchanged. The result always carries `next_from` and `has_more`.'
+);
+var MAX_TOP = 1e3;
+var FROM_HINT = "Pass a previous next_from unchanged, or an ISO 8601 time such as 2026-10-01T00:00:00Z (one with no zone is read as UTC).";
+var ISO_DATE_TIME = /^\d{4}-\d{2}-\d{2}(T\d{2}:\d{2}(:\d{2}(\.\d+)?)?(Z|[+-]\d{2}:?\d{2})?)?$/i;
+function utcLiteral(ms) {
+  return new Date(ms).toISOString().replace(/\.000Z$/, "Z");
+}
+function parseTime(raw) {
+  if (!ISO_DATE_TIME.test(raw)) return void 0;
+  const t = /T[\d:.]+$/.test(raw) ? `${raw}Z` : raw;
+  const ms = Date.parse(t);
+  if (Number.isNaN(ms)) return void 0;
+  if (new Date(ms + offsetMs(t)).toISOString().slice(0, 10) !== t.slice(0, 10)) return void 0;
+  return ms;
+}
+function offsetMs(t) {
+  const m = /([+-])(\d{2}):?(\d{2})$/.exec(t);
+  if (!m || /Z$/i.test(t)) return 0;
+  const mins = Number(m[2]) * 60 + Number(m[3]);
+  return (m[1] === "-" ? -1 : 1) * mins * 6e4;
+}
+function encodeFrom(pos) {
+  return Buffer.from(JSON.stringify({ t: pos.t, ids: pos.ids }), "utf8").toString("base64url");
+}
+function decodeFrom(from) {
+  if (/^\d{4}-/.test(from)) {
+    const ms2 = parseTime(from);
+    if (ms2 === void 0) {
+      throw new McpToolError(`\`from\` is not a valid ISO 8601 UTC date-time: ${from}`, { hint: FROM_HINT });
+    }
+    return { t: utcLiteral(ms2), ids: [] };
+  }
+  let parsed;
+  try {
+    parsed = /^[A-Za-z0-9_-]+$/.test(from) ? JSON.parse(Buffer.from(from, "base64url").toString("utf8")) : void 0;
+  } catch {
+    parsed = void 0;
+  }
+  const p = parsed;
+  const ms = typeof p?.t === "string" ? parseTime(p.t) : void 0;
+  if (ms === void 0 || !Array.isArray(p?.ids) || !p.ids.every((id) => typeof id === "string")) {
+    throw new McpToolError("`from` is neither an ISO 8601 time nor a next_from token.", { hint: FROM_HINT });
+  }
+  return { t: utcLiteral(ms), ids: p.ids };
+}
+function fromQuery(pos, limit) {
+  return { bound: `ReceivedDateTime ge ${pos.t}`, top: Math.min(limit + pos.ids.length, MAX_TOP) };
+}
+function fromPage(rows, pos, limit, apiHasMore) {
+  const seen = new Set(pos.ids);
+  const fresh = rows.filter((r) => r.Id === void 0 || !seen.has(r.Id));
+  const kept = fresh.slice(0, limit);
+  const next = nextPosition(kept, pos);
+  return { rows: kept, next_from: encodeFrom(next), has_more: fresh.length > limit || apiHasMore };
+}
+function nextPosition(rows, pos) {
+  const dated = rows.map((r) => ({ id: r.Id, ms: r.ReceivedDateTime ? Date.parse(r.ReceivedDateTime) : NaN })).filter((r) => r.id !== void 0 && !Number.isNaN(r.ms));
+  if (dated.length === 0) return pos;
+  const newest = Math.max(...dated.map((r) => r.ms));
+  const tied = dated.filter((r) => r.ms === newest).map((r) => r.id);
+  const carried = newest === Date.parse(pos.t) ? pos.ids.filter((id) => !tied.includes(id)) : [];
+  return { t: utcLiteral(newest), ids: [...carried, ...tied] };
+}
 
 // src/tools/_untrusted.ts
 init_dist2();
@@ -49152,6 +49364,37 @@ function utf8Boundary(buf, max) {
 function sinceLiteral(hours) {
   return new Date(Date.now() - hours * 36e5).toISOString().replace(/\.\d{3}Z$/, "Z");
 }
+function fromPosition(from, conflicts) {
+  if (from === void 0) return void 0;
+  for (const [name, value] of Object.entries(conflicts)) {
+    if (value === void 0) continue;
+    throw new McpToolError(`\`from\` and \`${name}\` cannot be combined.`, {
+      hint: name === "nextLink" ? "To continue a `from` listing, pass its `next_from` as `from`; `nextLink` belongs to the newest-first listing." : `\`from\` pages oldest first by time; drop \`${name}\`, or omit \`from\` for the newest-first listing.`
+    });
+  }
+  return decodeFrom(from);
+}
+var FROM_DESCRIPTION = "Pass `from` (an ISO 8601 UTC time, or a previous `next_from`) to page OLDEST first from that time instead: the result carries `next_from` (pass it back unchanged as `from` for the next page; on an empty page it is the same position, so it can be polled for new arrivals) and `has_more` (more already waiting), and no nextLink. Backfill: pass an old `from` and keep passing `next_from` until `has_more` is false; then keep polling with the last `next_from` for new mail.";
+async function listFrom(client2, pos, opts) {
+  const { bound, top } = fromQuery(pos, opts.limit);
+  const data = await client2.get(
+    `/me/mailfolders/${folderSegment(opts.folder ?? "inbox")}/messages`,
+    {
+      query: {
+        $top: top,
+        $select: LIST_SELECT,
+        // The date bound leads: Outlook rejects a $filter that does not start with the $orderby property.
+        $filter: opts.unreadOnly === true ? `${bound} and IsRead eq false` : bound,
+        $orderby: "ReceivedDateTime asc"
+      }
+    }
+  );
+  const listed = Array.isArray(data?.value) ? data.value : [];
+  const page = fromPage(listed, pos, opts.limit, Boolean(data?.["@odata.nextLink"]));
+  const { "@odata.nextLink": _superseded, ...rest } = data ?? {};
+  const body = opts.view === "raw" ? { ...rest, value: page.rows } : projectCollection({ value: page.rows }, opts.view === "full" ? fullMessage : compactMessage, "message");
+  return mailboxUntrusted({ ...body, next_from: page.next_from, has_more: page.has_more });
+}
 function registerMailTools(server, client2) {
   server.registerTool(
     "outlook_list_folders",
@@ -49180,7 +49423,7 @@ function registerMailTools(server, client2) {
   server.registerTool(
     "outlook_list_messages",
     {
-      description: 'List messages in a folder, newest first. Defaults to the inbox. Use `unreadOnly` for a triage view. Bodies are NOT included \u2014 call outlook_get_message for one. Note `search` and `unreadOnly` cannot be combined on a first-page request (the API rejects $search with $filter); pass `search` alone to search the whole mailbox. When following a `nextLink`, both are ignored, so echoing them back is harmless. Each message\'s To list (and Cc, in the full view) holds at most 20 addresses; a longer list adds ToCount/ToTruncated (CcCount/CcTruncated) with the full count \u2014 pass view:"raw" for every address. ' + UNTRUSTED_DESCRIPTION_SUFFIX,
+      description: 'List messages in a folder, newest first. Defaults to the inbox. Use `unreadOnly` for a triage view. Bodies are NOT included \u2014 call outlook_get_message for one. Note `search` and `unreadOnly` cannot be combined on a first-page request (the API rejects $search with $filter); pass `search` alone to search the whole mailbox. When following a `nextLink`, both are ignored, so echoing them back is harmless. Each message\'s To list (and Cc, in the full view) holds at most 20 addresses; a longer list adds ToCount/ToTruncated (CcCount/CcTruncated) with the full count \u2014 pass view:"raw" for every address. ' + FROM_DESCRIPTION + " Cannot combine with `search`, `skip` or `nextLink`. " + UNTRUSTED_DESCRIPTION_SUFFIX,
       annotations: { readOnlyHint: true, openWorldHint: true },
       inputSchema: external_exports.object({
         view: viewParam(VIEWS2),
@@ -49189,10 +49432,15 @@ function registerMailTools(server, client2) {
         skip: external_exports.number().int().min(0).optional().describe("Offset for paging"),
         unreadOnly: external_exports.boolean().optional().describe("Only unread messages"),
         search: external_exports.string().optional().describe("Full-text search across the whole mailbox; cannot combine with unreadOnly on a first page (ignored with nextLink)"),
+        from: fromParam,
         nextLink: nextLinkParam
       })
     },
-    async ({ view, folder, limit, skip, unreadOnly, search, nextLink }) => {
+    async ({ view, folder, limit, skip, unreadOnly, search, from, nextLink }) => {
+      const pos = fromPosition(from, { nextLink, search, skip });
+      if (pos !== void 0) {
+        return listFrom(client2, pos, { view: resolveView(view, VIEWS2), folder, limit: limit ?? 25, unreadOnly });
+      }
       if (nextLink === void 0 && search !== void 0 && unreadOnly === true) {
         throw new McpToolError("`search` and `unreadOnly` cannot be combined.", {
           hint: "Outlook rejects $search together with $filter. Search first, then filter the results."
@@ -49246,19 +49494,24 @@ function registerMailTools(server, client2) {
   server.registerTool(
     "outlook_get_unread",
     {
-      description: 'Triage batch: the unread messages in a folder (default inbox), newest first, each WITH its plain-text body (truncated to `maxBodyChars`) in one call \u2014 no follow-up outlook_get_message needed. Every item has a `kind`: "mail", "meetingRequest", "meetingCancelled" or "meetingResponse" (a reply to an invite you sent). Requests and cancellations also carry `event` (id, time, organizer, your current `responseStatus`) so the invite can be answered by its event id (when the meeting is no longer on your calendar \u2014 already declined, cancelled or deleted \u2014 the item has a `hint` instead and there is nothing to respond to). `to`/`cc` list at most 20 addresses; a longer list adds `toCount`/`ccCount` and `toTruncated`/`ccTruncated`. This does NOT mark anything read. Processing loop: read the batch \u2192 act on each item (reply, respond to the invite, file, flag \u2014 or leave it) \u2192 call outlook_mark_read on the plain mail you handled, so the next call returns only what is still new. An invite you answer with outlook_respond_to_invite needs no mark-read: Outlook moves it to Deleted Items under a new id, so its old id would 404. Follow `nextLink` for more. ' + UNTRUSTED_DESCRIPTION_SUFFIX,
+      description: 'Triage batch: the unread messages in a folder (default inbox), newest first, each WITH its plain-text body (truncated to `maxBodyChars`) in one call \u2014 no follow-up outlook_get_message needed. Every item has a `kind`: "mail", "meetingRequest", "meetingCancelled" or "meetingResponse" (a reply to an invite you sent). Requests and cancellations also carry `event` (id, time, organizer, your current `responseStatus`) so the invite can be answered by its event id (when the meeting is no longer on your calendar \u2014 already declined, cancelled or deleted \u2014 the item has a `hint` instead and there is nothing to respond to). `to`/`cc` list at most 20 addresses; a longer list adds `toCount`/`ccCount` and `toTruncated`/`ccTruncated`. This does NOT mark anything read. Processing loop: read the batch \u2192 act on each item (reply, respond to the invite, file, flag \u2014 or leave it) \u2192 call outlook_mark_read on the plain mail you handled, so the next call returns only what is still new. An invite you answer with outlook_respond_to_invite needs no mark-read: Outlook moves it to Deleted Items under a new id, so its old id would 404. Follow `nextLink` for more. ' + FROM_DESCRIPTION + " Cannot combine with `sinceHours` or `nextLink`. " + UNTRUSTED_DESCRIPTION_SUFFIX,
       annotations: { readOnlyHint: true, openWorldHint: true },
       inputSchema: external_exports.object({
         folder: external_exports.string().min(1).optional().describe('Folder id or well-known name (default "inbox")'),
         limit: external_exports.number().int().min(1).max(50).optional().describe("Max messages (default 25, max 50)"),
-        sinceHours: external_exports.number().positive().max(24 * 365).optional().describe("Only mail received in the last N hours"),
+        sinceHours: external_exports.number().positive().max(24 * 365).optional().describe("Only mail received in the last N hours (not with `from`)"),
         includeBody: external_exports.boolean().optional().describe("Fetch each plain-text body (default true). Invite events are resolved either way."),
         maxBodyChars: external_exports.number().int().min(100).max(1e5).optional().describe("Truncate each body to this many characters (default 4000); `bodyTruncated` marks a cut"),
+        from: fromParam,
         nextLink: nextLinkParam
       })
     },
-    async ({ folder, limit, sinceHours, includeBody, maxBodyChars, nextLink }) => {
+    async ({ folder, limit, sinceHours, includeBody, maxBodyChars, from, nextLink }) => {
+      const pos = fromPosition(from, { nextLink, sinceHours });
+      const max = limit ?? 25;
+      const keyset = pos !== void 0 ? fromQuery(pos, max) : void 0;
       const filter = [
+        keyset?.bound,
         sinceHours !== void 0 ? `ReceivedDateTime ge ${sinceLiteral(sinceHours)}` : void 0,
         "IsRead eq false"
       ].filter((c) => c !== void 0).join(" and ");
@@ -49268,14 +49521,16 @@ function registerMailTools(server, client2) {
         `/me/mailfolders/${folderSegment(folder ?? "inbox")}/messages`,
         {
           query: {
-            $top: limit ?? 25,
+            $top: keyset?.top ?? max,
             $select: UNREAD_SELECT,
             $filter: filter,
-            $orderby: "ReceivedDateTime desc"
+            $orderby: keyset ? "ReceivedDateTime asc" : "ReceivedDateTime desc"
           }
         }
       );
-      const rows = Array.isArray(data?.value) ? data.value : [];
+      const listed = Array.isArray(data?.value) ? data.value : [];
+      const page = pos !== void 0 ? fromPage(listed, pos, max, Boolean(data?.["@odata.nextLink"])) : void 0;
+      const rows = page?.rows ?? listed;
       const wantBody = includeBody !== false;
       const cap = maxBodyChars ?? 4e3;
       const items = await mapWithConcurrency(rows, BODY_CONCURRENCY, async (m) => {
@@ -49323,8 +49578,13 @@ function registerMailTools(server, client2) {
         return item;
       });
       const out = { count: items.length, items };
-      const next = data?.["@odata.nextLink"];
-      if (next) out.nextLink = next;
+      if (page !== void 0) {
+        out.next_from = page.next_from;
+        out.has_more = page.has_more;
+      } else {
+        const next = data?.["@odata.nextLink"];
+        if (next) out.nextLink = next;
+      }
       return mailboxUntrusted(out);
     }
   );
@@ -49814,6 +50074,9 @@ function messageBody(subject, body, html) {
 }
 var TEAMS = { IsOnlineMeeting: true, OnlineMeetingProvider: "TeamsForBusiness" };
 var teamsMeetingParam = external_exports.boolean().optional().describe("Attach a Microsoft Teams meeting (default true). false leaves it off.");
+var addTeamsMeetingParam = external_exports.boolean().optional().describe(
+  "true adds a Microsoft Teams meeting to an event that lacks one (default false: the way people join is left as it is)."
+);
 var EVENT_STATE_SELECT = "Id,Subject,IsOrganizer,Start,End,Location,Attendees,IsOnlineMeeting,OnlineMeetingProvider,OnlineMeeting";
 function attendee(Address, Type) {
   return { Type, EmailAddress: { Address } };
@@ -49963,39 +50226,30 @@ function registerWriteTools(server, client2) {
   server.registerTool(
     "outlook_create_draft",
     {
-      description: "Create a draft message in the Drafts folder without sending it. Returns the created draft, which can be reviewed and sent from Outlook. " + CONFIRM_FLOW_SENTENCE,
-      annotations: { readOnlyHint: false, destructiveHint: true, openWorldHint: true },
+      description: "Create a draft message in the Drafts folder without sending it. Returns the created draft, which can be reviewed and sent from Outlook. It does not ask to confirm: a draft reaches nobody until it is sent from Outlook. Calling it twice leaves two drafts. " + TIMEOUT_SENTENCE,
+      // Self-only and additive, like outlook_reply with draftOnly: nothing is
+      // overwritten or sent. Not idempotent: a repeat creates a second draft.
+      annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true },
       inputSchema: external_exports.object({
         to: recipientList,
         cc: recipientList,
         subject: external_exports.string().describe("Subject line"),
         body: external_exports.string().describe("Message body"),
-        html: external_exports.boolean().optional().describe("Compose the body as HTML (default: plain text)"),
-        confirmToken: confirmTokenParam
+        html: external_exports.boolean().optional().describe("Compose the body as HTML (default: plain text)")
       })
     },
-    async ({ to, cc, subject, body, html, confirmToken }, ctx) => {
+    async ({ to, cc, subject, body, html }) => {
       const payload = {
         ...messageBody(subject, body, html),
         ToRecipients: toRecipients(to),
         ...cc?.length ? { CcRecipients: toRecipients(cc) } : {}
       };
-      const gate = await confirmWrite(ctx, {
-        tool: "outlook_create_draft",
-        action: "mail.create_draft",
-        message: "Review and confirm this draft:",
-        summary: `Create draft "${subject}"`,
-        // One signed-in mailbox per server process.
-        account: void 0,
-        request: { method: "POST", path: "/me/messages", body: payload },
-        confirmToken
-      });
-      if (gate) return gate;
-      const created = await client2.write(
-        "POST",
-        "/me/messages",
-        payload
+      const create = await writeOrUnknown(
+        () => client2.write("POST", "/me/messages", payload),
+        "Drafts"
       );
+      if (!create.ok) return create.result;
+      const created = create.value;
       return minifiedResult({ created: true, Id: created?.Id, WebLink: created?.WebLink });
     }
   );
@@ -50212,7 +50466,7 @@ function registerWriteTools(server, client2) {
   server.registerTool(
     "outlook_update_event",
     {
-      description: "Update a meeting you organize: retitle, move, relocate, edit the description, or add/remove attendees. Moving only `start` keeps the meeting's length. A Microsoft Teams meeting is added if the event lacks one (`teamsMeeting: false` to skip). Attendees are sent an updated invitation. Only the organizer can update a meeting \u2014 an attendee's edit would change their own copy alone, so it is refused. The result is verified by re-reading the event. " + CONFIRM_FLOW_SENTENCE + " " + CONFIRM_INJECTION_RULE,
+      description: "Update a meeting you organize: retitle, move, relocate, edit the description, or add/remove attendees. Moving only `start` keeps the meeting's length. It does not add a Microsoft Teams meeting unless you pass `teamsMeeting: true` (on an event that lacks one). Attendees are sent an updated invitation. Only the organizer can update a meeting \u2014 an attendee's edit would change their own copy alone, so it is refused. The result is verified by re-reading the event. " + CONFIRM_FLOW_SENTENCE + " " + CONFIRM_INJECTION_RULE,
       annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: true },
       inputSchema: external_exports.object({
         id: external_exports.string().min(1).describe("Event Id from outlook_list_events or outlook_get_event"),
@@ -50225,7 +50479,7 @@ function registerWriteTools(server, client2) {
         addAttendees: recipientList.describe("Required attendees to add"),
         addOptionalAttendees: recipientList.describe("Optional attendees to add"),
         removeAttendees: recipientList.describe("Attendees to remove"),
-        teamsMeeting: teamsMeetingParam,
+        teamsMeeting: addTeamsMeetingParam,
         confirmToken: confirmTokenParam
       })
     },
@@ -50278,18 +50532,21 @@ function registerWriteTools(server, client2) {
         }
         payload.Attendees = next;
       }
-      const addTeams = args.teamsMeeting !== false && !(current && isTeams(current));
+      const addTeams = args.teamsMeeting === true && !(current && isTeams(current));
       if (addTeams) Object.assign(payload, TEAMS);
       if (Object.keys(payload).length === 0) {
         throw new McpToolError("Nothing to update.", {
-          hint: "Pass at least one of subject, start, end, location, body, or attendee changes."
+          hint: "Pass at least one of subject, start, end, location, body, attendee changes, or teamsMeeting: true."
         });
       }
       const gate = await confirmWrite(ctx, {
         tool: "outlook_update_event",
         action: "calendar.update_event",
-        message: "Review and confirm this change (attendees are sent an updated invitation):",
-        summary: `Update "${current?.Subject ?? args.id}": ${Object.keys(payload).join(", ")}`,
+        message: addTeams ? "Review and confirm this change (attendees are sent an updated invitation). This will also make it a Microsoft Teams meeting: attendees get a Teams join link." : "Review and confirm this change (attendees are sent an updated invitation):",
+        summary: `Update "${current?.Subject ?? args.id}": ${[
+          Object.keys(payload).filter((k) => !(k in TEAMS)).join(", "),
+          addTeams ? "this will also make it a Microsoft Teams meeting" : ""
+        ].filter((part) => part !== "").join("; ")}`,
         // One signed-in mailbox per server process.
         account: void 0,
         target: args.id,