@chrischall/office-outlook-mcp 0.8.2 → 0.8.3

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
   },
   "metadata": {
     "description": "MCP server for Outlook / Microsoft 365 — mail, calendar, contacts and tasks via natural language",
-    "version": "0.8.2"
+    "version": "0.8.3"
   },
   "plugins": [
     {
@@ -15,7 +15,7 @@
       "displayName": "Outlook (Microsoft 365)",
       "source": "./",
       "description": "MCP server for Outlook / Microsoft 365 — triage unread mail, reply, answer meeting invites and schedule meetings, plus folders, calendar, contacts and tasks, with confirmation before anything is sent",
-      "version": "0.8.2",
+      "version": "0.8.3",
       "author": {
         "name": "Chris Hall"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "office-outlook-mcp",
   "displayName": "Outlook (Microsoft 365)",
-  "version": "0.8.2",
+  "version": "0.8.3",
   "description": "Outlook / Microsoft 365 for Claude — triage unread mail, reply, answer meeting invites and schedule meetings, plus folders, calendar, contacts and tasks, with confirmation before anything is sent, using your signed-in browser session",
   "author": {
     "name": "Chris Hall",

package/dist/bundle.js

@@ -39086,7 +39086,7 @@ var init_version = __esm({
   "src/version.ts"() {
     "use strict";
     PACKAGE_NAME = "office-outlook-mcp";
-    VERSION = "0.8.2";
+    VERSION = "0.8.3";
   }
 });
 
@@ -43398,7 +43398,7 @@ var require_websocket = __commonJS({
     var http = __require("http");
     var net = __require("net");
     var tls = __require("tls");
-    var { randomBytes: randomBytes8, createHash: createHash5 } = __require("crypto");
+    var { randomBytes: randomBytes8, createHash: createHash6 } = __require("crypto");
     var { Duplex, Readable } = __require("stream");
     var { URL: URL2 } = __require("url");
     var PerMessageDeflate2 = require_permessage_deflate();
@@ -44079,7 +44079,7 @@ var require_websocket = __commonJS({
           abortHandshake(websocket, socket, "Invalid Upgrade header");
           return;
         }
-        const digest = createHash5("sha1").update(key + GUID).digest("base64");
+        const digest = createHash6("sha1").update(key + GUID).digest("base64");
         if (res.headers["sec-websocket-accept"] !== digest) {
           abortHandshake(websocket, socket, "Invalid Sec-WebSocket-Accept header");
           return;
@@ -44448,7 +44448,7 @@ var require_websocket_server = __commonJS({
     var EventEmitter = __require("events");
     var http = __require("http");
     var { Duplex } = __require("stream");
-    var { createHash: createHash5 } = __require("crypto");
+    var { createHash: createHash6 } = __require("crypto");
     var extension2 = require_extension();
     var PerMessageDeflate2 = require_permessage_deflate();
     var subprotocol2 = require_subprotocol();
@@ -44755,7 +44755,7 @@ var require_websocket_server = __commonJS({
           );
         }
         if (this._state > RUNNING) return abortHandshake(socket, 503);
-        const digest = createHash5("sha1").update(key + GUID).digest("base64");
+        const digest = createHash6("sha1").update(key + GUID).digest("base64");
         const headers = [
           "HTTP/1.1 101 Switching Protocols",
           "Upgrade: websocket",
@@ -50603,6 +50603,7 @@ function isMeetingMessage(m) {
 // src/tools/_paging.ts
 init_zod();
 init_dist2();
+import { createHash as createHash4 } from "node:crypto";
 var nextLinkParam = external_exports.string().min(1).optional().describe(
   "Continue a previous listing: pass its `nextLink` value unchanged to fetch the next page. When set, the paging/filter arguments are taken from the link and ignored here."
 );
@@ -50618,6 +50619,10 @@ function plainCollection(data) {
   if (next) out.nextLink = next;
   return out;
 }
+var MAX_KEY_LENGTH = 16;
+function idKey(id) {
+  return id.length <= MAX_KEY_LENGTH ? id : createHash4("sha256").update(id).digest("base64url").slice(0, 12);
+}
 var fromParam = external_exports.string().min(1).optional().describe(
   'Page oldest first from this point: an ISO 8601 UTC time (e.g. "2026-10-01T00:00:00Z"; one with no zone is read as UTC), or a previous result\'s `next_from` passed unchanged. The result always carries `next_from` and `has_more`.'
 );
@@ -50663,24 +50668,24 @@ function decodeFrom(from) {
   if (ms === void 0 || !Array.isArray(p?.ids) || !p.ids.every((id) => typeof id === "string")) {
     throw new McpToolError("`from` is neither an ISO 8601 time nor a next_from token.", { hint: FROM_HINT });
   }
-  return { t: utcLiteral(ms), ids: p.ids };
+  return { t: utcLiteral(ms), ids: [...new Set(p.ids.map(idKey))] };
 }
 function fromQuery(pos, limit) {
   return { bound: `ReceivedDateTime ge ${pos.t}`, top: Math.min(limit + pos.ids.length, MAX_TOP) };
 }
 function fromPage(rows, pos, limit, apiHasMore) {
-  const seen = new Set(pos.ids);
-  const fresh = rows.filter((r) => r.Id === void 0 || !seen.has(r.Id));
+  const seen = new Set(pos.ids.map(idKey));
+  const fresh = rows.filter((r) => r.Id === void 0 || !seen.has(idKey(r.Id)));
   const kept = fresh.slice(0, limit);
   const next = nextPosition(kept, pos);
   return { rows: kept, next_from: encodeFrom(next), has_more: fresh.length > limit || apiHasMore };
 }
 function nextPosition(rows, pos) {
-  const dated = rows.map((r) => ({ id: r.Id, ms: r.ReceivedDateTime ? Date.parse(r.ReceivedDateTime) : NaN })).filter((r) => r.id !== void 0 && !Number.isNaN(r.ms));
+  const dated = rows.map((r) => ({ id: r.Id === void 0 ? void 0 : idKey(r.Id), ms: r.ReceivedDateTime ? Date.parse(r.ReceivedDateTime) : NaN })).filter((r) => r.id !== void 0 && !Number.isNaN(r.ms));
   if (dated.length === 0) return pos;
   const newest = Math.max(...dated.map((r) => r.ms));
   const tied = dated.filter((r) => r.ms === newest).map((r) => r.id);
-  const carried = newest === Date.parse(pos.t) ? pos.ids.filter((id) => !tied.includes(id)) : [];
+  const carried = newest === Date.parse(pos.t) ? pos.ids.map(idKey).filter((id) => !tied.includes(id)) : [];
   return { t: utcLiteral(newest), ids: [...carried, ...tied] };
 }
 
@@ -52381,7 +52386,7 @@ function registerHealthcheckTool(server, client2) {
 // src/tools/export.ts
 init_zod();
 init_dist2();
-import { createHash as createHash4 } from "node:crypto";
+import { createHash as createHash5 } from "node:crypto";
 import { readdirSync as readdirSync2, readFileSync as readFileSync4, rmdirSync, unlinkSync as unlinkSync5 } from "node:fs";
 import { join as join11 } from "node:path";
 
@@ -52391,7 +52396,7 @@ init_errors3();
 import { createHmac as createHmac4 } from "node:crypto";
 var BLOB_DEFAULT_TTL_MS = 60 * 60 * 1e3;
 var BLOB_MAX_TTL_MS = 24 * 60 * 60 * 1e3;
-var MAX_KEY_LENGTH = 1024;
+var MAX_KEY_LENGTH2 = 1024;
 var SAFE_SEGMENT = /^[A-Za-z0-9._~-]+$/;
 function configError(reason) {
   return new McpToolError(`MCP_BLOB_BASE_URL is not usable: ${reason}.`, {
@@ -52424,8 +52429,8 @@ function badInput(message) {
 function encodeKey(key) {
   if (typeof key !== "string" || key.length === 0)
     throw badInput("Blob key must be a non-empty string.");
-  if (key.length > MAX_KEY_LENGTH)
-    throw badInput(`Blob key is longer than ${MAX_KEY_LENGTH} characters.`);
+  if (key.length > MAX_KEY_LENGTH2)
+    throw badInput(`Blob key is longer than ${MAX_KEY_LENGTH2} characters.`);
   const segments = key.split("/");
   for (const seg of segments) {
     if (seg === "" || seg === "." || seg === ".." || !SAFE_SEGMENT.test(seg)) {
@@ -53082,6 +53087,7 @@ var eventArgsSchema = external_exports.object({
   attachments: external_exports.boolean().optional()
 });
 var positionSchema = external_exports.union([
+  external_exports.object({ at: external_exports.object({ t: external_exports.string().min(1), ids: external_exports.array(external_exports.string()) }) }),
   external_exports.object({ from: external_exports.string().min(1) }),
   external_exports.object({ link: external_exports.string().min(1).optional(), offset: external_exports.number().int().min(0).max(MAX_TOP2) })
 ]);
@@ -53292,7 +53298,7 @@ async function linkBatch(pos, limit, first, follow, keep = () => true) {
   return end;
 }
 function shortId(id) {
-  return createHash4("sha256").update(id).digest("hex").slice(0, 16);
+  return createHash5("sha256").update(id).digest("hex").slice(0, 16);
 }
 function uniqueName(name, used) {
   let candidate = name;
@@ -53683,11 +53689,11 @@ function registerExportTools(server, client2, opts = {}) {
       const folder = args.search !== void 0 ? "all" : args.folder ?? "inbox";
       const path = folder === "all" ? "/me/messages" : `/me/mailfolders/${encodeURIComponent(folder)}/messages`;
       const perPage = args.attachments === true ? Math.min(pageSize, ATTACHMENT_PAGE_SIZE) : pageSize;
-      const pos = resumed?.pos ?? (args.search !== void 0 ? { offset: 0 } : { from: encodeFrom({ t: since ?? EPOCH, ids: [] }) });
-      if ("from" in pos) decodeFrom(pos.from);
+      const stored = resumed?.pos;
+      const pos = stored === void 0 ? args.search !== void 0 ? { offset: 0 } : { at: { t: since ?? EPOCH, ids: [] } } : "from" in stored ? { at: decodeFrom(stored.from) } : "at" in stored ? { at: decodeFrom(encodeFrom(stored.at)) } : stored;
       const fetch2 = async (p, remaining) => {
-        if ("from" in p) {
-          const at = decodeFrom(p.from);
+        if ("at" in p) {
+          const { at } = p;
           const limit = Math.min(remaining, perPage);
           const { bound, top } = fromQuery(at, limit);
           const filter = until ? `${bound} and ReceivedDateTime lt ${until}` : bound;
@@ -53704,7 +53710,7 @@ function registerExportTools(server, client2, opts = {}) {
               posAfter: () => p
             };
           }
-          if (page.has_more && page.next_from === p.from) {
+          if (page.has_more && page.next_from === encodeFrom(at)) {
             return {
               rows: page.rows,
               pos: p,
@@ -53715,10 +53721,10 @@ function registerExportTools(server, client2, opts = {}) {
           }
           return {
             rows: page.rows,
-            pos: { from: page.next_from },
+            pos: { at: decodeFrom(page.next_from) },
             hasMore: page.has_more,
             // The first n rows are fresh and ascending, so the keyset position after them is computed the same way.
-            posAfter: (n) => n >= page.rows.length ? { from: page.next_from } : { from: fromPage(page.rows.slice(0, n), at, n, true).next_from }
+            posAfter: (n) => n >= page.rows.length ? { at: decodeFrom(page.next_from) } : { at: decodeFrom(fromPage(page.rows.slice(0, n), at, n, true).next_from) }
           };
         }
         return linkBatch(
@@ -53806,8 +53812,9 @@ function registerExportTools(server, client2, opts = {}) {
       }
       const prefer = args.time_zone ? `outlook.timezone="${args.time_zone}"` : void 0;
       const path = args.calendar !== void 0 ? `/me/calendars/${encodeURIComponent(args.calendar)}/calendarview` : "/me/calendarview";
-      const pos = resumed?.pos ?? { offset: 0 };
-      if ("from" in pos) throw new McpToolError("`cursor` is not a valid export cursor for this tool.");
+      const stored = resumed?.pos ?? { offset: 0 };
+      if (!("offset" in stored)) throw new McpToolError("`cursor` is not a valid export cursor for this tool.");
+      const pos = stored;
       const fetch2 = (p, remaining) => linkBatch(
         p,
         remaining,

package/dist/tools/_paging.js

@@ -1,3 +1,4 @@
+import { createHash } from 'node:crypto';
 import { z } from 'zod';
 import { McpToolError } from '@chrischall/mcp-utils';
 import { stripOData } from '../view.js';
@@ -38,6 +39,19 @@ export function plainCollection(data) {
         out.nextLink = next;
     return out;
 }
+/** An Id this short is kept as is (a key, or a test fixture); a real Outlook Id is ~150 characters. */
+const MAX_KEY_LENGTH = 16;
+/**
+ * The key a position keeps for a message Id: the Id itself when short, else
+ * 12 base64url characters (72 bits) of its SHA-256. Keys only tell apart the
+ * messages tied at ONE instant, so a collision is not a practical concern,
+ * and a burst of messages in one second costs ~15 characters each in the token
+ * rather than a whole Id. A token from an earlier release, carrying whole Ids,
+ * is re-keyed on read.
+ */
+export function idKey(id) {
+    return id.length <= MAX_KEY_LENGTH ? id : createHash('sha256').update(id).digest('base64url').slice(0, 12);
+}
 export const fromParam = z
     .string()
     .min(1)
@@ -104,7 +118,7 @@ export function decodeFrom(from) {
         !p.ids.every((id) => typeof id === 'string')) {
         throw new McpToolError('`from` is neither an ISO 8601 time nor a next_from token.', { hint: FROM_HINT });
     }
-    return { t: utcLiteral(ms), ids: p.ids };
+    return { t: utcLiteral(ms), ids: [...new Set(p.ids.map(idKey))] };
 }
 /**
  * The `$filter` date bound and `$top` for a page from `pos`. The bound is
@@ -121,21 +135,21 @@ export function fromQuery(pos, limit) {
  * or the API has another page.
  */
 export function fromPage(rows, pos, limit, apiHasMore) {
-    const seen = new Set(pos.ids);
-    const fresh = rows.filter((r) => r.Id === undefined || !seen.has(r.Id));
+    const seen = new Set(pos.ids.map(idKey));
+    const fresh = rows.filter((r) => r.Id === undefined || !seen.has(idKey(r.Id)));
     const kept = fresh.slice(0, limit);
     const next = nextPosition(kept, pos);
     return { rows: kept, next_from: encodeFrom(next), has_more: fresh.length > limit || apiHasMore };
 }
 function nextPosition(rows, pos) {
     const dated = rows
-        .map((r) => ({ id: r.Id, ms: r.ReceivedDateTime ? Date.parse(r.ReceivedDateTime) : NaN }))
+        .map((r) => ({ id: r.Id === undefined ? undefined : idKey(r.Id), ms: r.ReceivedDateTime ? Date.parse(r.ReceivedDateTime) : NaN }))
         .filter((r) => r.id !== undefined && !Number.isNaN(r.ms));
     if (dated.length === 0)
         return pos;
     const newest = Math.max(...dated.map((r) => r.ms));
     const tied = dated.filter((r) => r.ms === newest).map((r) => r.id);
     // The position did not move: earlier ties at this instant stay excluded.
-    const carried = newest === Date.parse(pos.t) ? pos.ids.filter((id) => !tied.includes(id)) : [];
+    const carried = newest === Date.parse(pos.t) ? pos.ids.map(idKey).filter((id) => !tied.includes(id)) : [];
     return { t: utcLiteral(newest), ids: [...carried, ...tied] };
 }

package/dist/tools/export.js

@@ -158,8 +158,15 @@ const eventArgsSchema = z.object({
     format: z.enum(['jsonl', 'markdown']),
     attachments: z.boolean().optional(),
 });
-/** Where the next part starts: a keyset position, or a nextLink page + rows consumed from it. */
+/**
+ * Where the next part starts: a keyset position, or a nextLink page + rows
+ * consumed from it. The keyset position is kept as plain `{ t, ids }` (`at`):
+ * the cursor is base64'd as a whole, so a nested `next_from` token would be
+ * encoded twice. `from` (that nested token) is still read from cursors an
+ * earlier release handed out.
+ */
 const positionSchema = z.union([
+    z.object({ at: z.object({ t: z.string().min(1), ids: z.array(z.string()) }) }),
     z.object({ from: z.string().min(1) }),
     z.object({ link: z.string().min(1).optional(), offset: z.number().int().min(0).max(MAX_TOP) }),
 ]);
@@ -877,12 +884,20 @@ export function registerExportTools(server, client, opts = {}) {
         const folder = args.search !== undefined ? 'all' : (args.folder ?? 'inbox');
         const path = folder === 'all' ? '/me/messages' : `/me/mailfolders/${encodeURIComponent(folder)}/messages`;
         const perPage = args.attachments === true ? Math.min(pageSize, ATTACHMENT_PAGE_SIZE) : pageSize;
-        const pos = resumed?.pos ?? (args.search !== undefined ? { offset: 0 } : { from: encodeFrom({ t: since ?? EPOCH, ids: [] }) });
-        if ('from' in pos)
-            decodeFrom(pos.from); // validate a cursor's position before any work
+        const stored = resumed?.pos;
+        // Validate (and normalise) a cursor's keyset position before any work; read an older cursor's nested token.
+        const pos = stored === undefined
+            ? args.search !== undefined
+                ? { offset: 0 }
+                : { at: { t: since ?? EPOCH, ids: [] } }
+            : 'from' in stored
+                ? { at: decodeFrom(stored.from) }
+                : 'at' in stored
+                    ? { at: decodeFrom(encodeFrom(stored.at)) }
+                    : stored;
         const fetch = async (p, remaining) => {
-            if ('from' in p) {
-                const at = decodeFrom(p.from);
+            if ('at' in p) {
+                const { at } = p;
                 const limit = Math.min(remaining, perPage);
                 const { bound, top } = fromQuery(at, limit);
                 const filter = until ? `${bound} and ReceivedDateTime lt ${until}` : bound;
@@ -900,7 +915,7 @@ export function registerExportTools(server, client, opts = {}) {
                         posAfter: () => p,
                     };
                 }
-                if (page.has_more && page.next_from === p.from) {
+                if (page.has_more && page.next_from === encodeFrom(at)) {
                     // No row carried a usable ReceivedDateTime, so the position did not
                     // move; asking again would return (and duplicate) the same page forever.
                     return {
@@ -913,10 +928,12 @@ export function registerExportTools(server, client, opts = {}) {
                 }
                 return {
                     rows: page.rows,
-                    pos: { from: page.next_from },
+                    pos: { at: decodeFrom(page.next_from) },
                     hasMore: page.has_more,
                     // The first n rows are fresh and ascending, so the keyset position after them is computed the same way.
-                    posAfter: (n) => n >= page.rows.length ? { from: page.next_from } : { from: fromPage(page.rows.slice(0, n), at, n, true).next_from },
+                    posAfter: (n) => n >= page.rows.length
+                        ? { at: decodeFrom(page.next_from) }
+                        : { at: decodeFrom(fromPage(page.rows.slice(0, n), at, n, true).next_from) },
                 };
             }
             return linkBatch(p, remaining, () => with429Retry(() => client.get(path, {
@@ -1010,9 +1027,10 @@ export function registerExportTools(server, client, opts = {}) {
         }
         const prefer = args.time_zone ? `outlook.timezone="${args.time_zone}"` : undefined;
         const path = args.calendar !== undefined ? `/me/calendars/${encodeURIComponent(args.calendar)}/calendarview` : '/me/calendarview';
-        const pos = resumed?.pos ?? { offset: 0 };
-        if ('from' in pos)
+        const stored = resumed?.pos ?? { offset: 0 };
+        if (!('offset' in stored))
             throw new McpToolError('`cursor` is not a valid export cursor for this tool.');
+        const pos = stored;
         const fetch = (p, remaining) => linkBatch(p, remaining, () => with429Retry(() => client.get(path, {
             text: true,
             ...(prefer ? { prefer } : {}),

package/dist/version.js

@@ -10,4 +10,4 @@
  * line below and nowhere else — not even in prose.
  */
 export const PACKAGE_NAME = 'office-outlook-mcp';
-export const VERSION = '0.8.2'; // x-release-please-version
+export const VERSION = '0.8.3'; // x-release-please-version

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chrischall/office-outlook-mcp",
-  "version": "0.8.2",
+  "version": "0.8.3",
   "mcpName": "io.github.chrischall/office-outlook-mcp",
   "description": "Outlook / Microsoft 365 MCP server for Claude — developed and maintained by AI (Claude Code)",
   "author": "Claude Code (AI) <https://www.anthropic.com/claude>",

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/chrischall/office-outlook-mcp",
     "source": "github"
   },
-  "version": "0.8.2",
+  "version": "0.8.3",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "@chrischall/office-outlook-mcp",
-      "version": "0.8.2",
+      "version": "0.8.3",
       "transport": {
         "type": "stdio"
       },