@chrischall/office-outlook-mcp 0.7.0 → 0.7.1

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
   },
   "metadata": {
     "description": "MCP server for Outlook / Microsoft 365 — mail, calendar, contacts and tasks via natural language",
-    "version": "0.7.0"
+    "version": "0.7.1"
   },
   "plugins": [
     {
@@ -15,7 +15,7 @@
       "displayName": "Outlook (Microsoft 365)",
       "source": "./",
       "description": "MCP server for Outlook / Microsoft 365 — triage unread mail, reply, answer meeting invites and schedule meetings, plus folders, calendar, contacts and tasks, with confirmation before anything is sent",
-      "version": "0.7.0",
+      "version": "0.7.1",
       "author": {
         "name": "Chris Hall"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "office-outlook-mcp",
   "displayName": "Outlook (Microsoft 365)",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "description": "Outlook / Microsoft 365 for Claude — triage unread mail, reply, answer meeting invites and schedule meetings, plus folders, calendar, contacts and tasks, with confirmation before anything is sent, using your signed-in browser session",
   "author": {
     "name": "Chris Hall",

package/dist/bundle.js

@@ -35575,7 +35575,8 @@ var init_errors3 = __esm({
     HEADER_SECRET_RE = new RegExp(`(\\b(?:x[-_]${HEADER_NAME_RUN}?(?:api[-_]?key|token|secret|auth)${HEADER_NAME_RUN}|api[-_]?key)\\s*:\\s*)[^\\s,;"'<>\`]+`, "gi");
     AWS_SIGV4_RE = /([?&]X-Amz-(?:Signature|Security-Token|Credential)=)[^&#\s"'<>`]+/gi;
     JSON_SECRET_KEYS = [
-      "(?:access|refresh|id|auth|session|bearer|csrf|xsrf)[_-]?token",
+      "(?:access|refresh|id|auth|session|bearer|csrf|xsrf|api)[_-]?token",
+      // api: fleet-audit#1444 (Pipedrive/Todoist-style, as in QUERY_SECRET_RE)
       "client[_-]?secret",
       "api[_-]?secret",
       "(?:x[_-])?api[_-]?key",
@@ -37347,6 +37348,154 @@ var init_transport_failure = __esm({
   }
 });
 
+// node_modules/@chrischall/mcp-utils/dist/netguard/address.js
+function isPublicAddress(ip) {
+  const v4 = parseIPv4(ip);
+  if (v4)
+    return isPublicIPv4(v4);
+  const v6 = parseIPv6(ip);
+  if (v6)
+    return isPublicIPv6(v6);
+  return false;
+}
+function parseIPv4(text) {
+  if (!/^(?:0|[1-9]\d{0,2})(?:\.(?:0|[1-9]\d{0,2})){3}$/.test(text))
+    return void 0;
+  const octets = text.split(".").map(Number);
+  return octets.every((o) => o <= 255) ? octets : void 0;
+}
+function parseIPv6(text) {
+  if (!/^[0-9a-fA-F:.]+$/.test(text) || !text.includes(":"))
+    return void 0;
+  const halves = text.split("::");
+  if (halves.length > 2)
+    return void 0;
+  const groups = (part) => {
+    if (part === "")
+      return [];
+    const out = [];
+    const pieces = part.split(":");
+    for (const [i, piece] of pieces.entries()) {
+      if (i === pieces.length - 1 && piece.includes(".")) {
+        const v4 = parseIPv4(piece);
+        if (!v4)
+          return void 0;
+        const [a = 0, b = 0, c = 0, d = 0] = v4;
+        out.push(a << 8 | b, c << 8 | d);
+        continue;
+      }
+      if (!/^[0-9a-fA-F]{1,4}$/.test(piece))
+        return void 0;
+      out.push(parseInt(piece, 16));
+    }
+    return out;
+  };
+  const head = groups(halves[0] ?? "");
+  const tail = halves.length === 2 ? groups(halves[1] ?? "") : [];
+  if (!head || !tail)
+    return void 0;
+  const fill = 8 - head.length - tail.length;
+  if (halves.length === 2 ? fill < 1 : fill !== 0)
+    return void 0;
+  const words = [...head, ...new Array(fill).fill(0), ...tail];
+  const bytes = [];
+  for (const w of words)
+    bytes.push(w >> 8, w & 255);
+  return bytes;
+}
+function inRange(bytes, prefix, bits) {
+  for (let i = 0; i < bits; i += 1) {
+    const byte = i >> 3;
+    const mask = 128 >> (i & 7);
+    if (((bytes[byte] ?? 0) & mask) !== ((prefix[byte] ?? 0) & mask))
+      return false;
+  }
+  return true;
+}
+function isPublicIPv4(octets) {
+  return !BLOCKED_V4.some(([prefix, bits]) => inRange(octets, prefix, bits));
+}
+function isPublicIPv6(bytes) {
+  if (inRange(bytes, MAPPED_V4, 96) || inRange(bytes, SIIT_V4, 96) || inRange(bytes, NAT64, 96)) {
+    return isPublicIPv4(bytes.slice(12, 16));
+  }
+  if (inRange(bytes, SIX_TO_FOUR, 16))
+    return isPublicIPv4(bytes.slice(2, 6));
+  return !BLOCKED_V6.some(([prefix, bits]) => inRange(bytes, prefix, bits));
+}
+var BLOCKED_V4, V6, BLOCKED_V6, MAPPED_V4, SIIT_V4, NAT64, SIX_TO_FOUR;
+var init_address = __esm({
+  "node_modules/@chrischall/mcp-utils/dist/netguard/address.js"() {
+    BLOCKED_V4 = [
+      [[0, 0, 0, 0], 8],
+      // this network
+      [[10, 0, 0, 0], 8],
+      // RFC 1918
+      [[100, 64, 0, 0], 10],
+      // CGNAT
+      [[127, 0, 0, 0], 8],
+      // loopback
+      [[169, 254, 0, 0], 16],
+      // link-local, incl. cloud metadata
+      [[172, 16, 0, 0], 12],
+      // RFC 1918
+      [[192, 0, 0, 0], 24],
+      // IETF protocol assignments
+      [[192, 0, 2, 0], 24],
+      // TEST-NET-1
+      [[192, 88, 99, 0], 24],
+      // 6to4 relay anycast (deprecated)
+      [[192, 168, 0, 0], 16],
+      // RFC 1918
+      [[198, 18, 0, 0], 15],
+      // benchmarking
+      [[198, 51, 100, 0], 24],
+      // TEST-NET-2
+      [[203, 0, 113, 0], 24],
+      // TEST-NET-3
+      [[224, 0, 0, 0], 4],
+      // multicast
+      [[240, 0, 0, 0], 4]
+      // reserved + broadcast
+    ];
+    V6 = (hex3) => parseIPv6(hex3);
+    BLOCKED_V6 = [
+      [V6("::"), 96],
+      // ::, ::1 and the deprecated IPv4-compatible form, refused whole
+      [V6("64:ff9b:1::"), 48],
+      // local-use NAT64 (RFC 8215)
+      [V6("100::"), 64],
+      // discard-only
+      [V6("2001::"), 32],
+      // Teredo
+      [V6("2001:2::"), 48],
+      // benchmarking
+      [V6("2001:10::"), 28],
+      // ORCHID (deprecated)
+      [V6("2001:20::"), 28],
+      // ORCHIDv2
+      [V6("2001:db8::"), 32],
+      // documentation
+      [V6("3fff::"), 20],
+      // documentation (RFC 9637)
+      [V6("5f00::"), 16],
+      // SRv6 SIDs
+      [V6("fc00::"), 7],
+      // unique local
+      [V6("fe80::"), 10],
+      // link-local
+      [V6("fec0::"), 10],
+      // site-local (deprecated)
+      [V6("ff00::"), 8]
+      // multicast
+    ];
+    MAPPED_V4 = V6("::ffff:0:0");
+    SIIT_V4 = V6("::ffff:0:0:0");
+    NAT64 = V6("64:ff9b::");
+    SIX_TO_FOUR = V6("2002::");
+  }
+});
+
 // node_modules/@chrischall/mcp-utils/dist/internal/retry-after.js
 function retryAfterToMs(header, now = Date.now()) {
   if (header == null)
@@ -37366,6 +37515,44 @@ var init_retry_after = __esm({
   }
 });
 
+// node_modules/@chrischall/mcp-utils/dist/internal/sleep.js
+function abortReason(signal) {
+  return signal.reason ?? new DOMException("This operation was aborted", "AbortError");
+}
+function cancellableSleep(ms, sleep3) {
+  const signal = currentCallSignal();
+  if (signal?.aborted)
+    return Promise.reject(abortReason(signal));
+  if (!signal)
+    return sleep3 ? sleep3(ms) : new Promise((resolve5) => setTimeout(resolve5, ms));
+  return new Promise((resolve5, reject) => {
+    let timer;
+    const onAbort = () => {
+      if (timer !== void 0)
+        clearTimeout(timer);
+      reject(abortReason(signal));
+    };
+    const done = () => {
+      signal.removeEventListener("abort", onAbort);
+      resolve5();
+    };
+    signal.addEventListener("abort", onAbort, { once: true });
+    if (sleep3) {
+      sleep3(ms).then(done, (err) => {
+        signal.removeEventListener("abort", onAbort);
+        reject(err);
+      });
+    } else {
+      timer = setTimeout(done, ms);
+    }
+  });
+}
+var init_sleep = __esm({
+  "node_modules/@chrischall/mcp-utils/dist/internal/sleep.js"() {
+    init_cancel();
+  }
+});
+
 // node_modules/@chrischall/mcp-utils/dist/http/index.js
 function withoutCredentials(headers, tokenHeader) {
   const drop = new Set(CROSS_ORIGIN_DROPPED_HEADERS);
@@ -37417,6 +37604,9 @@ async function writeOrUnknown(run, onUnknown) {
     return { ok: false, result: await onUnknown(err, unknownOutcomeReason(err)) };
   }
 }
+function isOutcomeUnknownStatus(status) {
+  return status >= 500 && status <= 599 && status !== 501 && status !== 505;
+}
 function headerOf(headers, name) {
   if (headers === void 0)
     return void 0;
@@ -37532,7 +37722,7 @@ function createApiClient(opts) {
   const retry = opts.retry ?? DEFAULT_RETRY;
   const service = opts.serviceName ?? hostOf(opts.baseUrl);
   const doFetch = opts.fetchImpl ?? fetch;
-  const sleep3 = opts.sleep ?? defaultSleep;
+  const sleep3 = (ms) => cancellableSleep(ms, opts.sleep);
   const unauthorized = () => opts.onUnauthorized ? opts.onUnauthorized() : new UnauthorizedError(service);
   const retryStatuses = retry.statuses ?? [429];
   const timeoutMs = opts.timeout === false ? 0 : opts.timeout ?? DEFAULT_REQUEST_TIMEOUT_MS;
@@ -37547,6 +37737,7 @@ function createApiClient(opts) {
   }
   const authHeader = (token) => !token ? {} : opts.tokenHeader ? { [opts.tokenHeader]: token } : { Authorization: `Bearer ${token}` };
   const transportFailures = /* @__PURE__ */ new WeakSet();
+  const answered5xx = /* @__PURE__ */ new WeakSet();
   const markTransportFailure = (err) => {
     if (typeof err === "object" && err !== null && err.name !== "AbortError") {
       transportFailures.add(err);
@@ -37626,7 +37817,7 @@ function createApiClient(opts) {
   const baseParts = (() => {
     try {
       const u = new URL(base);
-      return { origin: u.origin, username: u.username, password: u.password };
+      return { origin: u.origin, hostname: u.hostname, username: u.username, password: u.password };
     } catch {
       return void 0;
     }
@@ -37666,6 +37857,15 @@ function createApiClient(opts) {
     const next = new URL(href);
     return baseOrigin !== void 0 && next.origin === baseOrigin && next.username === baseParts?.username && next.password === baseParts?.password;
   }
+  function isNonPublicLiteralHost(hostname3) {
+    const host = hostname3.toLowerCase().replace(/^\[|\]$/g, "").replace(/\.$/, "");
+    if (host === "localhost" || host.endsWith(".localhost"))
+      return true;
+    if (/^[\d.]+$/.test(host) || host.includes(":"))
+      return !isPublicAddress(host);
+    return false;
+  }
+  const baseIsPublic = baseParts !== void 0 && !isNonPublicLiteralHost(baseParts.hostname);
   function sameOriginHop(location, from) {
     const href = resolveLocation(location, from);
     const next = new URL(href);
@@ -37718,7 +37918,11 @@ function createApiClient(opts) {
         }
         if (stripCrossOrigin) {
           hopUrl = resolveLocation(location, hopUrl);
-          if (credentialed && !onBaseOrigin(hopUrl))
+          const offOrigin = !onBaseOrigin(hopUrl);
+          if (offOrigin && baseIsPublic && isNonPublicLiteralHost(new URL(hopUrl).hostname)) {
+            throw new RedirectRefusedError(`Refusing redirect from ${service} to ${new URL(hopUrl).origin}: it is not a public address (loopback, link-local or a private network), so nothing is sent there.`);
+          }
+          if (credentialed && offOrigin)
             credentialed = false;
         } else {
           hopUrl = sameOriginHop(location, hopUrl);
@@ -37793,19 +37997,22 @@ function createApiClient(opts) {
           hint: opts.writeOutcomeHint
         });
       }
-      if (typeof err === "object" && err !== null && transportFailures.has(err)) {
+      if (typeof err === "object" && err !== null && (transportFailures.has(err) || answered5xx.has(err))) {
         throw new WriteOutcomeUnknownError(service, method, { cause: err, hint: opts.writeOutcomeHint });
       }
       throw err;
     }
   }
-  function withIdempotency(opt) {
+  function withIdempotency(method, opt) {
     const name = opts.idempotencyHeader;
     if (name === void 0 || name === "")
       return opt;
     const lower2 = name.toLowerCase();
     if (opt.headers && Object.keys(opt.headers).some((k) => k.toLowerCase() === lower2))
       return opt;
+    const repeatable = opt.idempotent === true || SAFE_METHODS.has(method.toUpperCase());
+    if (opt.idempotencyKey === void 0 && repeatable)
+      return opt;
     const key = opt.idempotencyKey ?? globalThis.crypto.randomUUID();
     return { ...opt, headers: { ...opt.headers, [name]: key } };
   }
@@ -37820,18 +38027,21 @@ function createApiClient(opts) {
       if (decision === "retry" && !retried)
         return "retry";
     }
-    return httpError(res, text, method, path, service);
+    const err = httpError(res, text, method, path, service);
+    if (isOutcomeUnknownStatus(res.status) && !(err instanceof EdgeBlockedError))
+      answered5xx.add(err);
+    return err;
   }
   const fetchJson = (method, path, opt = {}) => {
-    const o = withIdempotency(opt);
+    const o = withIdempotency(method, opt);
     return guardWrite(method, o, (dispatch) => fetchJsonOnce(method, path, o, dispatch));
   };
   const fetchHtml = (method, path, opt = {}) => {
-    const o = withIdempotency(opt);
+    const o = withIdempotency(method, opt);
     return guardWrite(method, o, (dispatch) => fetchHtmlOnce(method, path, o, dispatch));
   };
   const fetchRaw = (method, path, opt = {}) => {
-    const o = withIdempotency(opt);
+    const o = withIdempotency(method, opt);
     return guardWrite(method, o, (dispatch) => fetchRawOnce(method, path, o, dispatch));
   };
   async function fetchJsonOnce(method, path, opt, dispatch) {
@@ -37973,7 +38183,7 @@ function decodeJwtExp(token) {
   }
   return exp;
 }
-var DEFAULT_RETRY, defaultSleep, DEFAULT_REQUEST_TIMEOUT_MS, DEFAULT_MAX_REDIRECTS, FETCH_MAX_REDIRECTS, CROSS_ORIGIN_DROPPED_HEADERS, REDIRECT_STATUSES, UnauthorizedError, RateLimitedError, RequestTimeoutError, DEFAULT_WRITE_OUTCOME_HINT, WriteOutcomeUnknownError, SAFE_METHODS, ApiError, EdgeBlockedError, EDGE_BLOCK_SCAN_MAX, EDGE_BLOCK_MARKERS;
+var DEFAULT_RETRY, DEFAULT_REQUEST_TIMEOUT_MS, DEFAULT_MAX_REDIRECTS, FETCH_MAX_REDIRECTS, CROSS_ORIGIN_DROPPED_HEADERS, REDIRECT_STATUSES, UnauthorizedError, RateLimitedError, RequestTimeoutError, DEFAULT_WRITE_OUTCOME_HINT, WriteOutcomeUnknownError, SAFE_METHODS, ApiError, EdgeBlockedError, EDGE_BLOCK_SCAN_MAX, EDGE_BLOCK_MARKERS;
 var init_http = __esm({
   "node_modules/@chrischall/mcp-utils/dist/http/index.js"() {
     init_headers();
@@ -37989,9 +38199,10 @@ var init_http = __esm({
     init_body_limit();
     init_net_atoms();
     init_url_safety();
+    init_address();
     init_retry_after();
+    init_sleep();
     DEFAULT_RETRY = { count: 1, delayMs: 2e3 };
-    defaultSleep = (ms) => new Promise((r) => setTimeout(r, ms));
     DEFAULT_REQUEST_TIMEOUT_MS = 3e4;
     DEFAULT_MAX_REDIRECTS = 5;
     FETCH_MAX_REDIRECTS = 20;
@@ -38233,7 +38444,7 @@ var init_version = __esm({
   "src/version.ts"() {
     "use strict";
     PACKAGE_NAME = "office-outlook-mcp";
-    VERSION = "0.7.0";
+    VERSION = "0.7.1";
   }
 });
 
@@ -50614,7 +50825,7 @@ function dateTimeTimeZone2(value, zone) {
   }
   return { DateTime: value, TimeZone: zone };
 }
-var TIMEOUT_SENTENCE = 'If Outlook does not answer in time (or the connection drops) the result has status "unknown": the write may well have gone through, so check before retrying \u2014 never resend blindly.';
+var TIMEOUT_SENTENCE = 'If Outlook does not answer in time, the connection drops, or a server error (5xx) comes back after the request was sent, the result has status "unknown": the write may well have gone through, so check before retrying \u2014 never resend blindly.';
 function writeOrUnknown2(run, checkWhere) {
   return writeOrUnknown(
     run,
@@ -51491,6 +51702,9 @@ function expiry(opts) {
   return Math.floor((opts?.now ?? Date.now()) + ttl);
 }
 function toArrayBuffer(view) {
+  const buf = view.buffer;
+  if (buf instanceof ArrayBuffer && view.byteOffset === 0 && view.byteLength === buf.byteLength)
+    return buf;
   return view.slice().buffer;
 }
 function createBlobStore(opts) {
@@ -51704,6 +51918,7 @@ function buildZip(entries, modifiedAt = new Date(Date.UTC(1980, 0, 1))) {
 // node_modules/@chrischall/mcp-utils/dist/export/sink.js
 var EXPORT_MARKER = ".mcp-export";
 var EXPORT_DIR_NAME = /-\d{8}-\d{6}(?:-\d+)?$/;
+var EXPORT_BLOB_MAX_BYTES = 256 * 1024 * 1024;
 var EXPORT_ID = /^[A-Za-z0-9_-]{8,64}$/;
 var MAX_PART = 9999;
 var MAX_REL_PATH = 1024;
@@ -51781,14 +51996,17 @@ async function openExportSink(opts) {
   const part = checkPart(opts.part ?? 1);
   const exportId = checkExportId(opts.exportId);
   const now = opts.now;
+  if (opts.maxBytes !== void 0 && !(Number.isSafeInteger(opts.maxBytes) && opts.maxBytes > 0)) {
+    throw new TypeError(`openExportSink: maxBytes must be a positive whole number, got ${opts.maxBytes}.`);
+  }
   const store = blobStoreFromEnv(env);
   if (store)
     return openBlobSink(store, exportId, part, opts, now);
   if (opts.existingDir !== void 0) {
-    return openDiskSink(resumeDir(opts.existingDir, opts.envVar, env, exportId), exportId, part);
+    return openDiskSink(resumeDir(opts.existingDir, opts.envVar, env, exportId, opts.name), exportId, part);
   }
   const dir = freshDir(opts, env, now);
-  await writeFileSafe(join10(dir, EXPORT_MARKER), new TextEncoder().encode(JSON.stringify({ exportId })), {
+  await writeFileSafe(join10(dir, EXPORT_MARKER), new TextEncoder().encode(JSON.stringify({ exportId, name: opts.name })), {
     allowedRoots: [dir],
     mode: 384
   });
@@ -51831,6 +52049,7 @@ function freshDir(opts, env, now) {
 function notThisExport() {
   return badInput2("The export directory to resume was not created by this export.", "Pass the cursor exactly as returned, or start a new export without one.");
 }
+var MAX_MARKER = 4096;
 function readMarker(dir) {
   let fd;
   try {
@@ -51839,18 +52058,21 @@ function readMarker(dir) {
     return void 0;
   }
   try {
-    const buf = Buffer.alloc(256);
+    const buf = Buffer.alloc(MAX_MARKER);
     const n = readSync(fd, buf, 0, buf.length, 0);
     const parsed = JSON.parse(buf.subarray(0, n).toString("utf8"));
     const id = parsed?.exportId;
-    return typeof id === "string" ? id : void 0;
+    const name = parsed?.name;
+    if (typeof id !== "string")
+      return void 0;
+    return { exportId: id, name: typeof name === "string" ? name : void 0 };
   } catch {
     return void 0;
   } finally {
     closeSync4(fd);
   }
 }
-function resumeDir(existingDir, envVar, env, exportId) {
+function resumeDir(existingDir, envVar, env, exportId, name) {
   if (typeof existingDir !== "string" || existingDir.length === 0)
     throw outsideRoots("export directory", envVar);
   const roots = exportAllowedRoots(envVar, env);
@@ -51876,7 +52098,10 @@ function resumeDir(existingDir, envVar, env, exportId) {
   } catch {
     markerIsFile = false;
   }
-  if (!markerIsFile || readMarker(real) !== exportId)
+  if (!markerIsFile)
+    throw notThisExport();
+  const marker = readMarker(real);
+  if (!marker || marker.exportId !== exportId || marker.name !== name)
     throw notThisExport();
   return real;
 }
@@ -51930,6 +52155,8 @@ function openBlobSink(store, exportId, part, opts, now) {
   const signOpts = { ...opts.ttlMs !== void 0 ? { ttlMs: opts.ttlMs } : {} };
   store.signGetUrl(key, { ...signOpts, now: now ?? Date.now() });
   const entries = /* @__PURE__ */ new Map();
+  const maxBytes = opts.maxBytes ?? EXPORT_BLOB_MAX_BYTES;
+  let held = 0;
   let finished = false;
   return {
     mode: "blob",
@@ -51942,6 +52169,20 @@ function openBlobSink(store, exportId, part, opts, now) {
       if (entries.has(relPath) && !o.overwrite)
         throw badInput2(`Export file ${relPath} was already written.`);
       const bytes = toBytes(data);
+      const replaced = entries.get(relPath)?.bytes.byteLength ?? 0;
+      if (bytes.byteLength > maxBytes) {
+        throw new McpToolError(`Export file ${relPath} alone is ${bytes.byteLength} bytes, over the ${maxBytes}-byte part limit.`, {
+          kind: "too_large",
+          hint: "No export part can hold this file: skip it, or raise the part limit (maxBytes)."
+        });
+      }
+      if (held - replaced + bytes.byteLength > maxBytes) {
+        throw new McpToolError(`This export part would exceed its ${maxBytes}-byte limit with ${relPath}.`, {
+          kind: "too_large",
+          hint: "Finish this part and continue the export in the next one (return the resume cursor)."
+        });
+      }
+      held += bytes.byteLength - replaced;
       entries.delete(relPath);
       entries.set(relPath, { bytes, compress: shouldCompress(relPath, contentType) });
       return { name: relPath, bytes: bytes.byteLength };
@@ -52138,7 +52379,7 @@ function isoBound(name, raw) {
   }
   return decodeFrom(raw).t;
 }
-var defaultSleep2 = (ms) => new Promise((r) => setTimeout(r, ms));
+var defaultSleep = (ms) => new Promise((r) => setTimeout(r, ms));
 async function with429Retry(fn, sleep3) {
   for (let attempt = 0; ; attempt++) {
     try {
@@ -52278,7 +52519,7 @@ function extendSpan(totals, t) {
   if (!totals.oldest || ms < timeOf(totals.oldest)) totals.oldest = t;
   if (!totals.newest || ms > timeOf(totals.newest)) totals.newest = t;
 }
-function inRange(received, since, until) {
+function inRange2(received, since, until) {
   if (!since && !until) return true;
   const t = timeOf(received);
   if (Number.isNaN(t)) return false;
@@ -52658,7 +52899,7 @@ function registerExportTools(server, client2, opts = {}) {
   const run = {
     ...opts,
     env: opts.env ?? process.env,
-    sleep: opts.sleep ?? defaultSleep2,
+    sleep: opts.sleep ?? defaultSleep,
     clock: opts.clock ?? Date.now
   };
   const pageSize = Math.min(Math.max(1, opts.pageSize ?? MAX_TOP2), MAX_TOP2);
@@ -52745,7 +52986,7 @@ function registerExportTools(server, client2, opts = {}) {
             sleep3
           ),
           (link2) => with429Retry(() => client2.getAbsolute(link2, { text: true }), sleep3),
-          (m) => inRange(m.ReceivedDateTime, since, until)
+          (m) => inRange2(m.ReceivedDateTime, since, until)
         );
       };
       return runExport(client2, run, input2, {

package/dist/tools/writes.js

@@ -68,7 +68,7 @@ function dateTimeTimeZone(value, zone) {
  * Tool-description sentence for a write whose timeout leaves the outcome
  * unknown. Kept next to {@link unknownOutcome} so the two cannot drift.
  */
-const TIMEOUT_SENTENCE = 'If Outlook does not answer in time (or the connection drops) the result has status "unknown": the write may well have gone through, so check before retrying — never resend blindly.';
+const TIMEOUT_SENTENCE = 'If Outlook does not answer in time, the connection drops, or a server error (5xx) comes back after the request was sent, the result has status "unknown": the write may well have gone through, so check before retrying — never resend blindly.';
 /**
  * Run a non-idempotent write; a timeout or dropped connection after the
  * request was sent (mcp-utils' WriteOutcomeUnknownError) becomes a non-error

package/dist/version.js

@@ -10,4 +10,4 @@
  * line below and nowhere else — not even in prose.
  */
 export const PACKAGE_NAME = 'office-outlook-mcp';
-export const VERSION = '0.7.0'; // x-release-please-version
+export const VERSION = '0.7.1'; // x-release-please-version

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chrischall/office-outlook-mcp",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "mcpName": "io.github.chrischall/office-outlook-mcp",
   "description": "Outlook / Microsoft 365 MCP server for Claude — developed and maintained by AI (Claude Code)",
   "author": "Claude Code (AI) <https://www.anthropic.com/claude>",
@@ -45,7 +45,7 @@
     "typecheck": "tsc -p tsconfig.check.json"
   },
   "dependencies": {
-    "@chrischall/mcp-utils": "^3.3.0",
+    "@chrischall/mcp-utils": "^3.3.1",
     "@fetchproxy/server": "^3.6.2",
     "@modelcontextprotocol/server": "^2.3.0",
     "dotenv": "^18.0.1",

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/chrischall/office-outlook-mcp",
     "source": "github"
   },
-  "version": "0.7.0",
+  "version": "0.7.1",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "@chrischall/office-outlook-mcp",
-      "version": "0.7.0",
+      "version": "0.7.1",
       "transport": {
         "type": "stdio"
       },