@chrischall/office-outlook-mcp 0.9.0 → 0.10.1

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
   },
   "metadata": {
     "description": "MCP server for Outlook / Microsoft 365 — mail, calendar, contacts and tasks via natural language",
-    "version": "0.9.0"
+    "version": "0.10.1"
   },
   "plugins": [
     {
@@ -15,7 +15,7 @@
       "displayName": "Outlook (Microsoft 365)",
       "source": "./",
       "description": "MCP server for Outlook / Microsoft 365 — triage unread mail, reply, answer meeting invites and schedule meetings, plus folders, calendar, contacts and tasks, with confirmation before anything is sent",
-      "version": "0.9.0",
+      "version": "0.10.1",
       "author": {
         "name": "Chris Hall"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "office-outlook-mcp",
   "displayName": "Outlook (Microsoft 365)",
-  "version": "0.9.0",
+  "version": "0.10.1",
   "description": "Outlook / Microsoft 365 for Claude — triage unread mail, reply, answer meeting invites and schedule meetings, plus folders, calendar, contacts and tasks, with confirmation before anything is sent, using your signed-in browser session",
   "author": {
     "name": "Chris Hall",

package/dist/bundle.js

@@ -39293,7 +39293,7 @@ var init_version = __esm({
   "src/version.ts"() {
     "use strict";
     PACKAGE_NAME = "office-outlook-mcp";
-    VERSION = "0.9.0";
+    VERSION = "0.10.1";
   }
 });
 
@@ -39673,6 +39673,38 @@ var init_capability_availability = __esm({
   }
 });
 
+// node_modules/@fetchproxy/protocol/dist/binary-fetch.js
+function parseResponseTooLarge(error62) {
+  const declared = TOO_LARGE_DECLARED_RE.exec(error62);
+  if (declared)
+    return { limitBytes: Number(declared[2]), declaredBytes: Number(declared[1]) };
+  const streamed = TOO_LARGE_STREAMED_RE.exec(error62);
+  if (streamed)
+    return { limitBytes: Number(streamed[1]), declaredBytes: null };
+  return null;
+}
+function isBase64Body(s) {
+  return s.length % 4 === 0 && BASE64_RE.test(s);
+}
+var FETCH_RESPONSE_TYPE_BASE64, EXTENSION_FEATURE_FETCH_BASE64, KNOWN_EXTENSION_FEATURES, MAX_EXTENSION_FEATURES, MAX_EXTENSION_FEATURE_LENGTH, HOSTED_RELAY_MESSAGE_BYTES, MAX_BINARY_RESPONSE_BYTES, RESPONSE_TOO_LARGE_CODE, TOO_LARGE_DECLARED_RE, TOO_LARGE_STREAMED_RE, BASE64_RE;
+var init_binary_fetch = __esm({
+  "node_modules/@fetchproxy/protocol/dist/binary-fetch.js"() {
+    FETCH_RESPONSE_TYPE_BASE64 = "base64";
+    EXTENSION_FEATURE_FETCH_BASE64 = "fetch_base64";
+    KNOWN_EXTENSION_FEATURES = /* @__PURE__ */ new Set([
+      EXTENSION_FEATURE_FETCH_BASE64
+    ]);
+    MAX_EXTENSION_FEATURES = 32;
+    MAX_EXTENSION_FEATURE_LENGTH = 64;
+    HOSTED_RELAY_MESSAGE_BYTES = 32 * 1024 * 1024;
+    MAX_BINARY_RESPONSE_BYTES = 16 * 1024 * 1024;
+    RESPONSE_TOO_LARGE_CODE = "response_too_large";
+    TOO_LARGE_DECLARED_RE = /^response body too large: content-length (\d{1,16}) exceeds the (\d{1,16})-byte binary cap/;
+    TOO_LARGE_STREAMED_RE = /^response body too large: more than the (\d{1,16})-byte binary cap was received/;
+    BASE64_RE = /^[A-Za-z0-9+/]*={0,2}$/;
+  }
+});
+
 // node_modules/@fetchproxy/protocol/dist/json-pointer.js
 function matchesDeclaredKey(requested, declared) {
   for (const decl of declared) {
@@ -39884,7 +39916,7 @@ function assertString(x, label) {
 }
 function assertBase64(x, label) {
   assertString(x, label);
-  if (!BASE64_RE.test(x))
+  if (!BASE64_RE2.test(x))
     throw new ProtocolError3(`${label}: invalid base64`);
 }
 function base64ByteLength(s) {
@@ -40288,6 +40320,17 @@ function validateFrame(raw) {
   }
   throw new ProtocolError3(`unknown frame type: ${String(t)}`);
 }
+function assertTabDomains(value, domains, label) {
+  if (!Array.isArray(value))
+    throw new ProtocolError3(`${label}: expected array`);
+  if (value.length === 0)
+    throw new ProtocolError3(`${label}: must be non-empty`);
+  for (const d of value) {
+    if (typeof d !== "string" || !domains.includes(d)) {
+      throw new ProtocolError3(`${label}: ${JSON.stringify(d)} is not one of the declared domains [${domains.join(", ")}]`);
+    }
+  }
+}
 function validateHello(raw) {
   if (raw.protocolVersion !== PROTOCOL_VERSION) {
     throw new ProtocolError3(`hello.protocolVersion: must be ${PROTOCOL_VERSION}`);
@@ -40364,6 +40407,9 @@ function validateHello(raw) {
     }
     if (raw.accepts !== void 0)
       assertAcceptsList(raw.accepts);
+    if (raw.tabDomains !== void 0) {
+      assertTabDomains(raw.tabDomains, raw.domains, "hello.tabDomains");
+    }
     if (raw.graphqlOps !== void 0) {
       assertGraphqlOpsArray(raw.graphqlOps, "hello.graphqlOps");
     }
@@ -40390,6 +40436,8 @@ function validateHello(raw) {
     if (raw.unavailableCapabilities !== void 0) {
       assertUnavailableCapabilities(raw.unavailableCapabilities);
     }
+    if (raw.features !== void 0)
+      assertExtensionFeatures(raw.features);
     return raw;
   }
   throw new ProtocolError3(`hello.role: must be 'server' or 'extension', got ${String(role)}`);
@@ -40454,6 +40502,22 @@ function assertAcceptsList(accepts) {
     }
   }
 }
+function assertExtensionFeatures(list) {
+  const label = "hello.features";
+  if (!Array.isArray(list))
+    throw new ProtocolError3(`${label}: expected array`);
+  if (list.length > MAX_EXTENSION_FEATURES) {
+    throw new ProtocolError3(`${label}: at most ${MAX_EXTENSION_FEATURES} entries, got ${list.length}`);
+  }
+  for (const f of list) {
+    if (typeof f !== "string") {
+      throw new ProtocolError3(`${label}: entry must be string, got ${typeof f}`);
+    }
+    if (f.length < 1 || f.length > MAX_EXTENSION_FEATURE_LENGTH) {
+      throw new ProtocolError3(`${label}: entry must be 1-${MAX_EXTENSION_FEATURE_LENGTH} characters, got ${f.length}`);
+    }
+  }
+}
 function assertUnavailableCapabilities(list) {
   const label = "hello.unavailableCapabilities";
   if (!Array.isArray(list))
@@ -40657,6 +40721,11 @@ function validateInnerRequest(raw) {
         throw new ProtocolError3("inner.init.credentials: must be 'include' or 'omit'");
       }
     }
+    if (raw.init.responseType !== void 0) {
+      if (raw.init.responseType !== FETCH_RESPONSE_TYPE_BASE64) {
+        throw new ProtocolError3("inner.init.responseType: must be 'base64' when present");
+      }
+    }
     return raw;
   }
   if (raw.op === "read_cookies") {
@@ -40961,6 +41030,16 @@ function validateInnerResponse(raw) {
       assertPositiveInt(raw.status, "inner.status");
       assertString(raw.url, "inner.url");
       assertString(raw.body, "inner.body");
+      if (raw.bodyEncoding !== void 0) {
+        if (raw.bodyEncoding !== "base64") {
+          throw new ProtocolError3("inner.bodyEncoding: must be 'base64' when present");
+        }
+        if (!isBase64Body(raw.body)) {
+          throw new ProtocolError3("inner.body: not standard padded base64 under bodyEncoding base64");
+        }
+      }
+      if (raw.headers !== void 0)
+        assertStringMap(raw.headers, "inner.headers");
       return raw;
     }
     if (op === "read_cookies") {
@@ -41079,11 +41158,12 @@ function validateInnerResponse(raw) {
   }
   throw new ProtocolError3(`inner.ok: must be boolean, got ${typeof raw.ok}`);
 }
-var ProtocolError3, FORBIDDEN_KEYS, BASE64_RE, SCOPE_KEY_RE, SCOPE_KEY_GLOB_RE, HEADER_NAME_RE, HOSTNAME_RE, CAPTURE_PATH_RE, DOM_SELECTOR_RE, DOM_ATTRIBUTE_RE, GRAPHQL_OP_NAME_RE, PAIR_CODE_RE, DISPLAY_FORBIDDEN_RE, ACCOUNT_KEY_FIELDS, ACCOUNT_ATTEST_FIELDS, TYPE_ONLY_FIELDS, BRIDGE_ROLE_FIELDS, BRIDGE_ROLE_SERVING_FIELDS, KNOWN_RESPONSE_OPS;
+var ProtocolError3, FORBIDDEN_KEYS, BASE64_RE2, SCOPE_KEY_RE, SCOPE_KEY_GLOB_RE, HEADER_NAME_RE, HOSTNAME_RE, CAPTURE_PATH_RE, DOM_SELECTOR_RE, DOM_ATTRIBUTE_RE, GRAPHQL_OP_NAME_RE, PAIR_CODE_RE, DISPLAY_FORBIDDEN_RE, ACCOUNT_KEY_FIELDS, ACCOUNT_ATTEST_FIELDS, TYPE_ONLY_FIELDS, BRIDGE_ROLE_FIELDS, BRIDGE_ROLE_SERVING_FIELDS, KNOWN_RESPONSE_OPS;
 var init_validate = __esm({
   "node_modules/@fetchproxy/protocol/dist/validate.js"() {
     init_frames();
     init_capability_availability();
+    init_binary_fetch();
     init_mcp_id();
     init_account_attest();
     init_json_pointer();
@@ -41096,7 +41176,7 @@ var init_validate = __esm({
       }
     };
     FORBIDDEN_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
-    BASE64_RE = /^[A-Za-z0-9+/]*={0,2}$/;
+    BASE64_RE2 = /^[A-Za-z0-9+/]*={0,2}$/;
     SCOPE_KEY_RE = /^[A-Za-z0-9_.\-]{1,256}$/;
     SCOPE_KEY_GLOB_RE = /^[A-Za-z0-9_.\-]{1,256}\*?$/;
     HEADER_NAME_RE = /^[A-Za-z0-9_\-]{1,128}$/;
@@ -41260,6 +41340,7 @@ var init_dist3 = __esm({
     init_account_attest();
     init_awaiting_approval();
     init_capability_availability();
+    init_binary_fetch();
     init_validate();
     init_room_frames();
     init_crypto();
@@ -41283,7 +41364,30 @@ function sessionInfoFromHello(hello) {
         known.add(c);
     }
   }
-  return { platform: hello.platform, unavailableCapabilities: [...known].sort() };
+  const features = /* @__PURE__ */ new Set();
+  const rawFeatures = hello.features;
+  if (Array.isArray(rawFeatures)) {
+    for (const f of rawFeatures) {
+      if (typeof f === "string" && KNOWN_EXTENSION_FEATURES.has(f))
+        features.add(f);
+    }
+  }
+  return {
+    platform: hello.platform,
+    unavailableCapabilities: [...known].sort(),
+    features: [...features].sort()
+  };
+}
+function featureForRequest(inner) {
+  if (inner.type !== "request" || inner.op !== "fetch")
+    return null;
+  return inner.init.responseType === "base64" ? EXTENSION_FEATURE_FETCH_BASE64 : null;
+}
+function missingFeatureFor(inner, info) {
+  const feature = featureForRequest(inner);
+  if (feature === null || info === null)
+    return null;
+  return info.features.includes(feature) ? null : feature;
 }
 function capabilitiesForRequest(inner) {
   if (inner.type !== "request")
@@ -45113,6 +45217,8 @@ async function buildServerHello(opts) {
   };
   if (opts.accepts && opts.accepts.length > 0)
     hello.accepts = [...opts.accepts];
+  if (opts.tabDomains && opts.tabDomains.length > 0)
+    hello.tabDomains = [...opts.tabDomains];
   if (opts.cookieKeys && opts.cookieKeys.length > 0) {
     hello.cookieKeys = [...opts.cookieKeys];
   }
@@ -45950,7 +46056,8 @@ async function startHost(opts) {
     sessionStoragePointers: opts.ownSessionStoragePointers,
     domSelectors: opts.ownDomSelectors,
     domListSelectors: opts.ownDomListSelectors,
-    graphqlOps: opts.ownGraphqlOps
+    graphqlOps: opts.ownGraphqlOps,
+    tabDomains: opts.ownTabDomains
   };
   const generateSessionKeypair = opts.generateSessionKeypair ?? generateX25519;
   let extensionWs = null;
@@ -46536,6 +46643,7 @@ async function startPeer(opts) {
     localStoragePointers: opts.localStoragePointers,
     sessionStoragePointers: opts.sessionStoragePointers,
     graphqlOps: opts.graphqlOps,
+    tabDomains: opts.tabDomains,
     // 2.5.0: let a host ≥2.5.0 tell us when the extension leaves, so
     // `extensionConnected()` / `sessionLinked()` can go back to false.
     // 2.6.0: `hello-rejected` for the same reason, from the extension.
@@ -46914,6 +47022,8 @@ var init_peer = __esm({
 function classifyFetchError(error62, code2) {
   if (code2 === CAPABILITY_UNAVAILABLE_CODE)
     return "capability_unavailable";
+  if (code2 === RESPONSE_TOO_LARGE_CODE)
+    return "body_too_large";
   if (/^(in-page )?fetch threw:/.test(error62)) {
     return "tab_fetch_failed";
   }
@@ -47013,6 +47123,13 @@ function protocolErrorFrom(error62, op, response) {
       platform: unavailable?.platform ?? null
     });
   }
+  const tooLarge = parseResponseTooLarge(error62);
+  if (tooLarge !== null || response?.code === RESPONSE_TOO_LARGE_CODE) {
+    return new FetchproxyResponseTooLargeError(error62, {
+      limitBytes: tooLarge?.limitBytes ?? null,
+      declaredBytes: tooLarge?.declaredBytes ?? null
+    });
+  }
   if (error62 === "timeout")
     return new FetchproxyWaitedError(error62, op);
   if (SCOPE_REJECTION.test(error62))
@@ -47047,6 +47164,13 @@ function assertSubdomainLabel(label) {
     throw new Error(`FetchproxyServer: subdomain must be a DNS label like "www" or "api" (or dot-separated like "auth.api"), got ${JSON.stringify(label)}`);
   }
 }
+function assertExpectedStatus(response, expected, asHttp = () => response) {
+  if (expected === void 0)
+    return;
+  const matched = Array.isArray(expected) ? expected.includes(response.status) : response.status === expected;
+  if (!matched)
+    throw new FetchproxyHttpError(asHttp());
+}
 function assertUrlInDomains(field, url2, domains) {
   let parsed;
   try {
@@ -47091,7 +47215,7 @@ function isResendableRequest(inner) {
       return true;
   }
 }
-var FetchproxyProtocolError, FetchproxyHttpError, FetchproxyBridgeDownError, FetchproxyHintedError, FetchproxyScopeError, FetchproxyNoTabError, FetchproxyTabOpeningError, FetchproxyWaitedError, FetchproxyCapabilityUnavailableError, SCOPE_REJECTION, NO_TAB_REJECTION, TAB_OPENING_REJECTION, VERB_DEADLINE_GRACE_MS, FetchproxyTimeoutError, TIMEOUT_NOT_RESENT_NOTE, SUBDOMAIN_LABEL_RE, DEFAULT_JSON_OK_STATUSES, TIMEOUT_RETRY_SAFE_METHODS, FetchproxyServer;
+var FetchproxyProtocolError, FetchproxyHttpError, FetchproxyBridgeDownError, FetchproxyHintedError, FetchproxyScopeError, FetchproxyNoTabError, FetchproxyTabOpeningError, FetchproxyWaitedError, FetchproxyCapabilityUnavailableError, FetchproxyExtensionUpdateRequiredError, FetchproxyResponseTooLargeError, SCOPE_REJECTION, NO_TAB_REJECTION, TAB_OPENING_REJECTION, VERB_DEADLINE_GRACE_MS, FetchproxyTimeoutError, TIMEOUT_NOT_RESENT_NOTE, SUBDOMAIN_LABEL_RE, DEFAULT_JSON_OK_STATUSES, TIMEOUT_RETRY_SAFE_METHODS, FetchproxyServer;
 var init_ws_server = __esm({
   "node_modules/@fetchproxy/server/dist/ws-server.js"() {
     init_dist3();
@@ -47194,6 +47318,28 @@ var init_ws_server = __esm({
         this.platform = info.platform;
       }
     };
+    FetchproxyExtensionUpdateRequiredError = class extends FetchproxyHintedError {
+      /** The feature the extension lacks (`'fetch_base64'`). */
+      feature;
+      constructor(originalError, info) {
+        super(originalError, `this MCP needs the browser extension to support "${info.feature}" (binary downloads through the bridge), and the ContextMint Bridge build it is paired with does not. Update ContextMint Bridge (Chrome Web Store / App Store, or rebuild a sideloaded copy and reload it), then retry. Nothing is wrong with the MCP or your pairing, and re-pairing will not change it.`);
+        this.name = "FetchproxyExtensionUpdateRequiredError";
+        this.feature = info.feature;
+      }
+    };
+    FetchproxyResponseTooLargeError = class extends FetchproxyHintedError {
+      /** The cap the extension enforced, in bytes, when it said; else `null`. */
+      limitBytes;
+      /** The response's `content-length`, when the refusal came from it; else `null`. */
+      declaredBytes;
+      constructor(originalError, info) {
+        const cap = info.limitBytes ?? MAX_BINARY_RESPONSE_BYTES;
+        super(originalError, `the file is larger than the ${cap}-byte cap one bridge response can carry, so the extension refused it rather than send a frame the bridge cannot deliver. This is not a version or pairing problem: fetch a smaller rendition if the site offers one, or download it directly in the browser.`);
+        this.name = "FetchproxyResponseTooLargeError";
+        this.limitBytes = info.limitBytes;
+        this.declaredBytes = info.declaredBytes;
+      }
+    };
     SCOPE_REJECTION = /not in declared/;
     NO_TAB_REJECTION = /no tab matching (?!.*(content script loaded|one is still opening))/;
     TAB_OPENING_REJECTION = /no tab matching .*one is still opening/;
@@ -47360,6 +47506,9 @@ var init_ws_server = __esm({
             throw new Error(`FetchproxyServer: opts.domains entry ${JSON.stringify(d)} is a public suffix \u2014 declare a registrable domain (e.g. "example.${d}"), not the suffix every site under it shares`);
           }
         }
+        if (opts.tabDomains !== void 0) {
+          assertTabDomains(opts.tabDomains, opts.domains, "FetchproxyServer: opts.tabDomains");
+        }
         let capabilities;
         if (opts.capabilities === void 0) {
           capabilities = ["fetch"];
@@ -47430,6 +47579,7 @@ var init_ws_server = __esm({
             name: d.name,
             operationName: d.operationName
           })),
+          ...opts.tabDomains !== void 0 ? { tabDomains: [...opts.tabDomains] } : {},
           // 0.8.0+: timer + lazy-revive default to ON. Every realty MCP
           // adapter was about to set these to the same numbers anyway; the
           // back-door is `0` (explicit opt-out) if a caller genuinely wants
@@ -47559,6 +47709,7 @@ var init_ws_server = __esm({
             ownDomSelectors: this.opts.domSelectors,
             ownDomListSelectors: this.opts.domListSelectors,
             ownGraphqlOps: this.opts.graphqlOps,
+            ownTabDomains: this.opts.tabDomains,
             onPairCode: this.opts.onPairCode,
             extensionTrust: this.extensionTrust()
           });
@@ -47592,6 +47743,7 @@ var init_ws_server = __esm({
             domSelectors: this.opts.domSelectors,
             domListSelectors: this.opts.domListSelectors,
             graphqlOps: this.opts.graphqlOps,
+            tabDomains: this.opts.tabDomains,
             extensionTrust: this.extensionTrust(),
             requireExtensionIdentity: this.opts.requireExtensionIdentity
           });
@@ -47876,6 +48028,15 @@ var init_ws_server = __esm({
               cause: err
             };
           }
+          if (err instanceof FetchproxyExtensionUpdateRequiredError) {
+            return {
+              ok: false,
+              error: err.originalError,
+              kind: "extension_update_required",
+              retryAttempted: false,
+              cause: err
+            };
+          }
           return {
             ok: false,
             error: err instanceof Error ? err.message : String(err),
@@ -48022,7 +48183,10 @@ var init_ws_server = __esm({
         if (result.kind === "capability_unavailable") {
           return protocolErrorFrom(result.error, void 0, { code: CAPABILITY_UNAVAILABLE_CODE, op });
         }
-        return protocolErrorFrom(result.error);
+        if (result.kind === "extension_update_required" && result.cause instanceof FetchproxyExtensionUpdateRequiredError) {
+          return result.cause;
+        }
+        return protocolErrorFrom(result.error, void 0, result.code !== void 0 ? { code: result.code, op } : void 0);
       }
       /**
        * Convenience wrapper around `fetch()`. Builds the URL from a path
@@ -48042,6 +48206,88 @@ var init_ws_server = __esm({
        *    the declared domains exactly.
        */
       async request(method, path2, opts = {}) {
+        const init = this.resolveRequestInit("request", method, path2, opts);
+        const result = await this.fetch(init, opts.retryOnTimeout !== void 0 ? { retryOnTimeout: opts.retryOnTimeout } : {});
+        if (!result.ok)
+          this.throwFetchFailure(result, init.url, method, opts.retryOnTimeout);
+        const response = {
+          status: result.status,
+          body: result.body,
+          url: result.url
+        };
+        assertExpectedStatus(response, opts.expectStatus);
+        return response;
+      }
+      /**
+       * #460: like `request()`, but the response body comes back as BYTES,
+       * intact — a PDF, an office file, an image — together with the relayed
+       * `content-type` / `content-length` / `content-disposition` headers and the
+       * final URL after redirects.
+       *
+       * The extension runs it from its background worker rather than a tab, so a
+       * file host that sends no CORS headers is still readable, and it follows
+       * redirects. Both the request URL and the FINAL URL must be inside the
+       * declared `domains` — the extension enforces that, and so does this method
+       * on the answer. To read a signed file host, declare it.
+       *
+       * Bodies are capped at `MAX_BINARY_RESPONSE_BYTES` (16 MiB): over it the
+       * extension refuses with `FetchproxyResponseTooLargeError`. An extension
+       * that predates binary fetch is refused with
+       * `FetchproxyExtensionUpdateRequiredError` — locally when its hello says so,
+       * and on the answer when it replied in text anyway.
+       */
+      async requestBytes(method, path2, opts = {}) {
+        const init = {
+          ...this.resolveRequestInit("requestBytes", method, path2, opts),
+          responseType: "base64"
+        };
+        const result = await this.fetch(init, opts.retryOnTimeout !== void 0 ? { retryOnTimeout: opts.retryOnTimeout } : {});
+        if (!result.ok)
+          this.throwFetchFailure(result, init.url, method, opts.retryOnTimeout);
+        if (result.bodyEncoding !== "base64") {
+          throw new FetchproxyExtensionUpdateRequiredError("the paired ContextMint Bridge extension answered a binary request as text", { feature: EXTENSION_FEATURE_FETCH_BASE64 });
+        }
+        try {
+          assertUrlInDomains("requestBytes final url", result.url, this.opts.domains);
+        } catch (err) {
+          throw new FetchproxyProtocolError(err.message);
+        }
+        if (!isBase64Body(result.body)) {
+          throw new FetchproxyProtocolError("requestBytes: the extension sent a body that is not base64");
+        }
+        const decoded = Buffer.from(result.body, "base64");
+        const response = {
+          status: result.status,
+          url: result.url,
+          headers: { ...result.headers ?? {} },
+          bytes: new Uint8Array(decoded.buffer, decoded.byteOffset, decoded.byteLength)
+        };
+        assertExpectedStatus(response, opts.expectStatus, () => ({
+          status: response.status,
+          url: response.url,
+          // FetchproxyHttpError carries an HttpResponse; a binary body has no
+          // honest text form, so the bytes stay on the BinaryResponse.
+          body: ""
+        }));
+        return response;
+      }
+      /** #460: `requestBytes('GET', path, opts)`. */
+      getBytes(path2, opts = {}) {
+        return this.requestBytes("GET", path2, opts);
+      }
+      /**
+       * Resolve `path` + options into the wire `FetchInit` — URL building, the
+       * declared-domain guard, the relay tab. Shared by `request()` and
+       * `requestBytes()` so the two can never disagree about which URLs are
+       * reachable.
+       *
+       * Path resolution:
+       *  - Absolute URL (`https://...`) → used as-is (still guarded against
+       *    leaving the declared domain set).
+       *  - Relative path → joined with `https://${subdomain}.${baseDomain}`
+       *    (or `https://${baseDomain}` if no subdomain is given).
+       */
+      resolveRequestInit(caller, method, path2, opts) {
         if (opts.subdomain !== void 0)
           assertSubdomainLabel(opts.subdomain);
         const baseDomain = this.resolveBaseDomain(opts.domain);
@@ -48051,24 +48297,24 @@ var init_ws_server = __esm({
           try {
             host = new URL(path2).host;
           } catch {
-            throw new Error(`FetchproxyServer.request: absolute path is not a valid URL: ${JSON.stringify(path2)}`);
+            throw new Error(`FetchproxyServer.${caller}: absolute path is not a valid URL: ${JSON.stringify(path2)}`);
           }
         } else {
           host = opts.subdomain ? `${opts.subdomain}.${baseDomain}` : baseDomain;
         }
         const url2 = isAbsolute6 ? path2 : `https://${host}${path2}`;
-        assertUrlInDomains("request url", url2, this.opts.domains);
+        assertUrlInDomains(`${caller} url`, url2, this.opts.domains);
         let tabUrl = `https://${host}/`;
         if (opts.viaTab !== void 0) {
           try {
             new URL(opts.viaTab);
           } catch {
-            throw new Error(`FetchproxyServer.request: viaTab is not a valid URL: ${JSON.stringify(opts.viaTab)}`);
+            throw new Error(`FetchproxyServer.${caller}: viaTab is not a valid URL: ${JSON.stringify(opts.viaTab)}`);
           }
           assertUrlInDomains("viaTab", opts.viaTab, this.opts.domains);
           tabUrl = opts.viaTab;
         }
-        const init = {
+        return {
           url: url2,
           method,
           tabUrl,
@@ -48083,29 +48329,16 @@ var init_ws_server = __esm({
           // every version before this option existed.
           ...opts.credentials === "omit" ? { credentials: "omit" } : {}
         };
-        const result = await this.fetch(init, opts.retryOnTimeout !== void 0 ? { retryOnTimeout: opts.retryOnTimeout } : {});
-        if (!result.ok) {
-          if (result.kind === "session_not_ready" && result.cause instanceof Error) {
-            throw result.cause;
-          }
-          if (result.kind === "capability_unavailable" && result.cause instanceof FetchproxyCapabilityUnavailableError) {
-            throw result.cause;
-          }
-          throw this._typedErrorFor(result, init.url, "fetch", result.retryAttempted ?? false, isRetrySafeOnTimeout(method, opts.retryOnTimeout));
+      }
+      /** Turn a failed `fetch()` envelope into the throw `request()` has always made. */
+      throwFetchFailure(result, url2, method, retryOnTimeout) {
+        if (result.kind === "session_not_ready" && result.cause instanceof Error) {
+          throw result.cause;
         }
-        const response = {
-          status: result.status,
-          body: result.body,
-          url: result.url
-        };
-        if (opts.expectStatus !== void 0) {
-          const expected = opts.expectStatus;
-          const matched = Array.isArray(expected) ? expected.includes(response.status) : response.status === expected;
-          if (!matched) {
-            throw new FetchproxyHttpError(response);
-          }
+        if (result.kind === "capability_unavailable" && result.cause instanceof FetchproxyCapabilityUnavailableError) {
+          throw result.cause;
         }
-        return response;
+        throw this._typedErrorFor(result, url2, "fetch", result.retryAttempted ?? false, isRetrySafeOnTimeout(method, retryOnTimeout));
       }
       /** Issue a GET against `path` (resolved via `request()` rules). */
       get(path2, opts = {}) {
@@ -48906,6 +49139,10 @@ var init_ws_server = __esm({
                 status: inner.status,
                 url: inner.url,
                 body: inner.body,
+                // #460: carried only when present, so a text answer's envelope
+                // has exactly the keys it always had.
+                ...inner.bodyEncoding !== void 0 ? { bodyEncoding: inner.bodyEncoding } : {},
+                ...inner.headers !== void 0 ? { headers: { ...inner.headers } } : {},
                 retryAttempted: false
               });
             } else {
@@ -48922,7 +49159,8 @@ var init_ws_server = __esm({
               ok: false,
               error: inner.error,
               kind: classifyFetchError(inner.error, inner.code),
-              retryAttempted: false
+              retryAttempted: false,
+              ...inner.code !== void 0 ? { code: inner.code } : {}
             });
           }
           return;
@@ -49226,6 +49464,7 @@ var init_ws_server = __esm({
             pairCode,
             extensionConnected: false,
             unavailableCapabilities: [],
+            features: [],
             platform: null
           };
         }
@@ -49237,6 +49476,7 @@ var init_ws_server = __esm({
           pairCode,
           extensionConnected,
           unavailableCapabilities: info ? [...info.unavailableCapabilities] : [],
+          features: info ? [...info.features] : [],
           platform: info?.platform ?? null
         };
       }
@@ -49250,9 +49490,13 @@ var init_ws_server = __esm({
        */
       refuseIfUnavailable(inner, info) {
         const cap = unavailableCapabilityFor(inner, info);
-        if (cap === null || info === null)
-          return;
-        throw new FetchproxyCapabilityUnavailableError(capabilityUnavailableMessage(cap, info.platform), { capability: cap, platform: info.platform });
+        if (cap !== null && info !== null) {
+          throw new FetchproxyCapabilityUnavailableError(capabilityUnavailableMessage(cap, info.platform), { capability: cap, platform: info.platform });
+        }
+        const feature = missingFeatureFor(inner, info);
+        if (feature !== null) {
+          throw new FetchproxyExtensionUpdateRequiredError(`the paired ContextMint Bridge extension does not support "${feature}"`, { feature });
+        }
       }
       /**
        * 0.5.2+: throw `FetchproxyProtocolError` with the actionable pair-code
@@ -49353,6 +49597,7 @@ var init_dist4 = __esm({
     init_deadline();
     init_parse_html();
     init_batch();
+    init_dist3();
     init_extension_trust();
     init_extension_pins();
     init_identity();
@@ -68470,13 +68715,17 @@ function compactEvent(e) {
     ShowAs: e.ShowAs
   });
 }
+function eventAttendees(e) {
+  return e.Attendees?.map((a) => pruned({ Who: addr(a), Response: a.Status?.Response }));
+}
+function detailedEvent(e) {
+  return pruned({ ...compactEvent(e), Attendees: eventAttendees(e) });
+}
 function fullEvent(e) {
   return pruned({
     ...compactEvent(e),
     SeriesMasterId: e.SeriesMasterId,
-    Attendees: e.Attendees?.map(
-      (a) => pruned({ Who: addr(a), Response: a.Status?.Response })
-    ),
+    Attendees: eventAttendees(e),
     // The Teams link lives under OnlineMeeting; OnlineMeetingUrl is empty on
     // every live Teams meeting checked.
     JoinUrl: e.OnlineMeeting?.JoinUrl || e.OnlineMeetingUrl || void 0,
@@ -69199,7 +69448,7 @@ function registerCalendarTools(server, client2) {
   server.registerTool(
     "outlook_get_event",
     {
-      description: `Get one calendar event in full, including attendees and their responses. Attendees appear in view:"full", every one of them \u2014 there is no 20-address cap as on a message's To/Cc; view:"raw" returns Outlook's untouched record, uncapped, Attendees included. ` + UNTRUSTED_DESCRIPTION_SUFFIX,
+      description: 'Get one calendar event with its attendees and their responses. Attendees come back in EVERY view, including the default compact one \u2014 all of them, uncapped (no 20-address cap as on a message\'s To/Cc). The event\'s time is labelled with its zone in the `TimeZone` field (the mailbox zone unless you pass `timeZone`); the same instant read in another zone shows a different clock time, so read `TimeZone`, not just the clock. view:"full" adds the Teams join link, body preview and web link; view:"raw" returns Outlook\'s untouched record. ' + UNTRUSTED_DESCRIPTION_SUFFIX,
       annotations: { readOnlyHint: true, openWorldHint: true },
       _meta: workMeta("lookup"),
       inputSchema: external_exports.object({
@@ -69216,7 +69465,7 @@ function registerCalendarTools(server, client2) {
       );
       const v = resolveView(view, VIEWS2);
       if (v === "raw") return mailboxUntrusted(data);
-      return mailboxUntrusted(v === "compact" ? compactEvent(data) : fullEvent(data));
+      return mailboxUntrusted(v === "full" ? fullEvent(data) : detailedEvent(data));
     }
   );
   server.registerTool(
@@ -71631,7 +71880,7 @@ function decodeJwt(token) {
   return { oid: claims.oid, tid: claims.tid };
 }
 function cleanAnswer(text) {
-  return text.replace(/[\u{E000}-\u{F8FF}\u{F0000}-\u{FFFFD}\u{100000}-\u{10FFFD}]/gu, "").replace(/cite(?:turn\d+[a-z]+\d+)+/gi, "").replace(/【[^】]{1,60}】/g, "").replace(/[ \t]+\n/g, "\n").replace(/[ \t]{2,}/g, " ").trim();
+  return text.replace(/[\u{E000}-\u{F8FF}\u{F0000}-\u{FFFFD}\u{100000}-\u{10FFFD}]/gu, "").replace(/cite(?:turn\d+[a-z]+\d+)+/gi, "").replace(/【[^】]{1,60}】/g, "").replace(/[ \t]+\n/g, "\n").replace(/(\S)[ \t]{2,}/g, "$1 ").trim();
 }
 var DisengagedError = class extends Error {
   disengaged = true;
@@ -71898,6 +72147,12 @@ function abortError() {
 }
 
 // src/tools/copilot.ts
+async function timeContext(outlook) {
+  const today = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
+  const zone = await mailboxTimeZone(outlook);
+  return zone ? `(Context: today is ${today}. The user's mailbox time zone is ${zone}, and mailbox times are stored in UTC. When you state any date or time, convert it to ${zone} and label the zone.)` : `(Context: today is ${today}. Mailbox times are stored in UTC \u2014 when you state a time, label its time zone.)`;
+}
+var VERBATIM_DIRECTIVE = "(Reproduce any content I ask you to quote or return IN FULL and verbatim \u2014 do not summarise, paraphrase, shorten, or omit any part of it, even if it is long.)";
 var TURN_TIMEOUT_MS = 12e4;
 function turnSignal(hostSignal) {
   const controller = new AbortController();
@@ -71916,23 +72171,27 @@ function turnSignal(hostSignal) {
     }
   };
 }
-function registerCopilotTools(server, copilot2) {
+function registerCopilotTools(server, copilot2, outlook) {
   server.registerTool(
     "outlook_ask_copilot",
     {
-      description: 'Ask Microsoft 365 Copilot a question answered from the signed-in mailbox (Copilot searches your own mail, calendar and files server-side and writes a reply). Use it for synthesis across many messages \u2014 "what needs my attention first", "summarise the thread with X", "did anyone ask me for anything this week". Follow-up calls continue the same conversation; pass newConversation:true to start fresh. The prompt is sent to Microsoft\'s Copilot service on your tenant; put your own question in it, not text copied from an email. Each call uses one of a per-conversation quota, reported back. First use needs a one-time sign-in: run `opencode-m365 login` (from the opencode-m365-copilot package) so an MSAL cache exists.' + UNTRUSTED_DESCRIPTION_SUFFIX,
+      description: 'Ask Microsoft 365 Copilot a question answered from the signed-in mailbox (Copilot searches your own mail, calendar and files server-side and writes a reply). Use it for synthesis across many messages \u2014 "what needs my attention first", "summarise the thread with X", "did anyone ask me for anything this week". Follow-up calls continue the same conversation; pass newConversation:true to start fresh. Pass verbatim:true when you need content quoted back in full (Copilot otherwise answers concisely and summarises long material; for a single item a focused "quote X in full" also works). Times are converted to the mailbox time zone and labelled. The prompt is sent to Microsoft\'s Copilot service on your tenant; put your own question in it, not text copied from an email. Each call uses one of a per-conversation quota, reported back. First use needs a one-time sign-in: run `opencode-m365 login` (from the opencode-m365-copilot package) so an MSAL cache exists.' + UNTRUSTED_DESCRIPTION_SUFFIX,
       annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true },
       _meta: workMeta("lookup", { aliases: ["copilot", "ask copilot", "m365 copilot"] }),
       inputSchema: external_exports.object({
         prompt: external_exports.string().min(1).describe("The question for Copilot, in your own words"),
-        newConversation: external_exports.boolean().optional().describe("Start a fresh conversation with no prior context (default false: continue the current one)")
+        newConversation: external_exports.boolean().optional().describe("Start a fresh conversation with no prior context (default false: continue the current one)"),
+        verbatim: external_exports.boolean().optional().describe("Ask Copilot to quote requested content in full rather than summarising (default false). Use for retrieving a saved note, a full message, etc.")
       })
     },
-    async ({ prompt, newConversation }, ctx) => {
+    async ({ prompt, newConversation, verbatim }, ctx) => {
       if (newConversation) copilot2.reset();
       const { signal, dispose } = turnSignal(ctx?.signal);
       try {
-        const result = await copilot2.ask(prompt, { signal });
+        const preamble = [await timeContext(outlook), verbatim ? VERBATIM_DIRECTIVE : ""].filter(Boolean).join(" ");
+        const result = await copilot2.ask(`${preamble}
+
+${prompt}`, { signal });
         return mailboxUntrusted({
           answer: result.text,
           conversationId: copilot2.conversationId,
@@ -72090,7 +72349,7 @@ await runMcp({
     registerWriteTools,
     registerExportTools,
     registerRuleTools,
-    (server) => registerCopilotTools(server, copilot),
+    (server) => registerCopilotTools(server, copilot, client),
     registerHealthcheckTool
   ]
 });

package/dist/copilot/session.js

@@ -98,7 +98,10 @@ export function cleanAnswer(text) {
         .replace(/cite(?:turn\d+[a-z]+\d+)+/gi, '')
         .replace(/【[^】]{1,60}】/g, '')
         .replace(/[ \t]+\n/g, '\n')
-        .replace(/[ \t]{2,}/g, ' ')
+        // Collapse only runs that FOLLOW a non-space character (the double spaces a
+        // removed token leaves mid-line), never leading indentation — a Copilot
+        // answer can quote an indented code block from a mail or note.
+        .replace(/(\S)[ \t]{2,}/g, '$1 ')
         .trim();
 }
 /** M365 refused to engage with the prompt. Not a rate limit — do not retry into it. */

package/dist/index.js

@@ -45,7 +45,7 @@ await runMcp({
         registerWriteTools,
         registerExportTools,
         registerRuleTools,
-        (server) => registerCopilotTools(server, copilot),
+        (server) => registerCopilotTools(server, copilot, client),
         registerHealthcheckTool,
     ],
 });

package/dist/tools/calendar.js

@@ -2,7 +2,7 @@ import { z } from 'zod';
 import { McpToolError, minifiedResult, resolveView, viewParam } from '@chrischall/mcp-utils';
 import { mailboxUntrusted, UNTRUSTED_DESCRIPTION_SUFFIX } from './_untrusted.js';
 import { briefDate, briefLine, briefResult, briefViewParam, spaced, workMeta } from './_hints.js';
-import { compactEvent, fullEvent, projectCollection, VIEWS, } from '../view.js';
+import { compactEvent, detailedEvent, fullEvent, projectCollection, VIEWS, } from '../view.js';
 import { fetchPage, nextLinkParam, plainCollection } from './_paging.js';
 import { mailboxTimeZone } from '../timezone.js';
 const EVENT_SELECT = 'Id,Subject,Start,End,Location,Organizer,IsAllDay,IsCancelled,ShowAs,OnlineMeetingUrl,OnlineMeeting,BodyPreview,' +
@@ -89,7 +89,7 @@ export function registerCalendarTools(server, client) {
         return mailboxUntrusted(projectCollection(data, v === 'full' ? fullEvent : compactEvent, 'event'));
     });
     server.registerTool('outlook_get_event', {
-        description: 'Get one calendar event in full, including attendees and their responses. Attendees appear in view:"full", every one of them — there is no 20-address cap as on a message\'s To/Cc; view:"raw" returns Outlook\'s untouched record, uncapped, Attendees included.' +
+        description: 'Get one calendar event with its attendees and their responses. Attendees come back in EVERY view, including the default compact one — all of them, uncapped (no 20-address cap as on a message\'s To/Cc). The event\'s time is labelled with its zone in the `TimeZone` field (the mailbox zone unless you pass `timeZone`); the same instant read in another zone shows a different clock time, so read `TimeZone`, not just the clock. view:"full" adds the Teams join link, body preview and web link; view:"raw" returns Outlook\'s untouched record.' +
             ' ' + UNTRUSTED_DESCRIPTION_SUFFIX,
         annotations: { readOnlyHint: true, openWorldHint: true },
         _meta: workMeta('lookup'),
@@ -104,7 +104,7 @@ export function registerCalendarTools(server, client) {
         const v = resolveView(view, VIEWS);
         if (v === 'raw')
             return mailboxUntrusted(data);
-        return mailboxUntrusted(v === 'compact' ? compactEvent(data) : fullEvent(data));
+        return mailboxUntrusted(v === 'full' ? fullEvent(data) : detailedEvent(data));
     });
     server.registerTool('outlook_list_calendars', {
         description: 'List the calendars in the mailbox, for picking one to read or write against.',

package/dist/tools/copilot.js

@@ -14,8 +14,28 @@
 import { z } from 'zod';
 import { minifiedResult } from '@chrischall/mcp-utils';
 import { DisengagedError } from '../copilot/session.js';
+import { mailboxTimeZone } from '../timezone.js';
 import { workMeta } from './_hints.js';
 import { mailboxUntrusted, UNTRUSTED_DESCRIPTION_SUFFIX } from './_untrusted.js';
+/**
+ * A short context preamble prepended to every Copilot prompt.
+ *
+ * Copilot renders a stored UTC time as a bare clock with no zone — a 2026-11-09
+ * UTC time came back as "11:41 AM", which reads as local but is not. Telling it
+ * today's date and the mailbox zone, and to convert and label, fixes the
+ * labelling at the source. The mailbox zone is read once (cached per client); if
+ * it cannot be read — a server set up for Copilot but not the Outlook mail
+ * token — the instruction degrades to "label the zone" with no date-math hint.
+ */
+async function timeContext(outlook) {
+    const today = new Date().toISOString().slice(0, 10);
+    const zone = await mailboxTimeZone(outlook);
+    return zone
+        ? `(Context: today is ${today}. The user's mailbox time zone is ${zone}, and mailbox times are stored in UTC. When you state any date or time, convert it to ${zone} and label the zone.)`
+        : `(Context: today is ${today}. Mailbox times are stored in UTC — when you state a time, label its time zone.)`;
+}
+/** The extra instruction a verbatim request prepends. */
+const VERBATIM_DIRECTIVE = "(Reproduce any content I ask you to quote or return IN FULL and verbatim — do not summarise, paraphrase, shorten, or omit any part of it, even if it is long.)";
 /** Stop a turn that outlives this, so a wedged connection cannot hang the call. */
 const TURN_TIMEOUT_MS = 120_000;
 /**
@@ -41,9 +61,9 @@ function turnSignal(hostSignal) {
         },
     };
 }
-export function registerCopilotTools(server, copilot) {
+export function registerCopilotTools(server, copilot, outlook) {
     server.registerTool('outlook_ask_copilot', {
-        description: 'Ask Microsoft 365 Copilot a question answered from the signed-in mailbox (Copilot searches your own mail, calendar and files server-side and writes a reply). Use it for synthesis across many messages — "what needs my attention first", "summarise the thread with X", "did anyone ask me for anything this week". Follow-up calls continue the same conversation; pass newConversation:true to start fresh. The prompt is sent to Microsoft\'s Copilot service on your tenant; put your own question in it, not text copied from an email. Each call uses one of a per-conversation quota, reported back. First use needs a one-time sign-in: run `opencode-m365 login` (from the opencode-m365-copilot package) so an MSAL cache exists.' +
+        description: 'Ask Microsoft 365 Copilot a question answered from the signed-in mailbox (Copilot searches your own mail, calendar and files server-side and writes a reply). Use it for synthesis across many messages — "what needs my attention first", "summarise the thread with X", "did anyone ask me for anything this week". Follow-up calls continue the same conversation; pass newConversation:true to start fresh. Pass verbatim:true when you need content quoted back in full (Copilot otherwise answers concisely and summarises long material; for a single item a focused "quote X in full" also works). Times are converted to the mailbox time zone and labelled. The prompt is sent to Microsoft\'s Copilot service on your tenant; put your own question in it, not text copied from an email. Each call uses one of a per-conversation quota, reported back. First use needs a one-time sign-in: run `opencode-m365 login` (from the opencode-m365-copilot package) so an MSAL cache exists.' +
             UNTRUSTED_DESCRIPTION_SUFFIX,
         annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true },
         _meta: workMeta('lookup', { aliases: ['copilot', 'ask copilot', 'm365 copilot'] }),
@@ -53,13 +73,20 @@ export function registerCopilotTools(server, copilot) {
                 .boolean()
                 .optional()
                 .describe('Start a fresh conversation with no prior context (default false: continue the current one)'),
+            verbatim: z
+                .boolean()
+                .optional()
+                .describe('Ask Copilot to quote requested content in full rather than summarising (default false). Use for retrieving a saved note, a full message, etc.'),
         }),
-    }, async ({ prompt, newConversation }, ctx) => {
+    }, async ({ prompt, newConversation, verbatim }, ctx) => {
         if (newConversation)
             copilot.reset();
         const { signal, dispose } = turnSignal(ctx?.signal);
         try {
-            const result = await copilot.ask(prompt, { signal });
+            const preamble = [await timeContext(outlook), verbatim ? VERBATIM_DIRECTIVE : '']
+                .filter(Boolean)
+                .join(' ');
+            const result = await copilot.ask(`${preamble}\n\n${prompt}`, { signal });
             return mailboxUntrusted({
                 answer: result.text,
                 conversationId: copilot.conversationId,

package/dist/version.js

@@ -10,4 +10,4 @@
  * line below and nowhere else — not even in prose.
  */
 export const PACKAGE_NAME = 'office-outlook-mcp';
-export const VERSION = '0.9.0'; // x-release-please-version
+export const VERSION = '0.10.1'; // x-release-please-version

package/dist/view.js

@@ -100,11 +100,28 @@ export function compactEvent(e) {
         ShowAs: e.ShowAs,
     });
 }
+/** Attendees projected as `{ Who, Response }`, or undefined when there are none. */
+export function eventAttendees(e) {
+    return e.Attendees?.map((a) => pruned({ Who: addr(a), Response: a.Status?.Response }));
+}
+/**
+ * A single event's compact view WITH its attendees — what outlook_get_event
+ * returns by default.
+ *
+ * A single event is not a list, so the per-item cap that keeps attendees off
+ * list_events (one `calendarview` page can hold dozens of events) does not
+ * apply, and the attendees are the point of looking one event up. list_events
+ * still uses the attendee-free {@link compactEvent}; only get_event carries them
+ * in its compact view, as its description promises.
+ */
+export function detailedEvent(e) {
+    return pruned({ ...compactEvent(e), Attendees: eventAttendees(e) });
+}
 export function fullEvent(e) {
     return pruned({
         ...compactEvent(e),
         SeriesMasterId: e.SeriesMasterId,
-        Attendees: e.Attendees?.map((a) => pruned({ Who: addr(a), Response: a.Status?.Response })),
+        Attendees: eventAttendees(e),
         // The Teams link lives under OnlineMeeting; OnlineMeetingUrl is empty on
         // every live Teams meeting checked.
         JoinUrl: e.OnlineMeeting?.JoinUrl || e.OnlineMeetingUrl || undefined,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chrischall/office-outlook-mcp",
-  "version": "0.9.0",
+  "version": "0.10.1",
   "mcpName": "io.github.chrischall/office-outlook-mcp",
   "description": "Outlook / Microsoft 365 MCP server for Claude — developed and maintained by AI (Claude Code)",
   "author": "Claude Code (AI) <https://www.anthropic.com/claude>",
@@ -47,20 +47,20 @@
   "dependencies": {
     "@azure/msal-node": "^7.2.1",
     "@chrischall/mcp-utils": "^3.7.2",
-    "@fetchproxy/server": "^3.6.2",
-    "@modelcontextprotocol/server": "^2.3.0",
-    "dotenv": "^18.0.1",
+    "@fetchproxy/server": "^3.8.0",
+    "@modelcontextprotocol/server": "^2.4.0",
+    "dotenv": "^18.0.10",
     "ws": "^8.22.2",
-    "zod": "^4.6.5"
+    "zod": "^4.6.7"
   },
   "devDependencies": {
-    "@modelcontextprotocol/client": "^2.3.0",
-    "@types/node": "^26.0.0",
+    "@modelcontextprotocol/client": "^2.4.0",
+    "@types/node": "^26.6.6",
     "@types/ws": "^8.18.2",
-    "@vitest/coverage-v8": "^5.0.0",
-    "esbuild": "^0.28.1",
+    "@vitest/coverage-v8": "^5.1.0",
+    "esbuild": "^0.28.2",
     "typescript": "^7.0.2",
-    "vitest": "^5.0.0"
+    "vitest": "^5.1.0"
   },
   "allowScripts": {
     "esbuild": false,

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/chrischall/office-outlook-mcp",
     "source": "github"
   },
-  "version": "0.9.0",
+  "version": "0.10.1",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "@chrischall/office-outlook-mcp",
-      "version": "0.9.0",
+      "version": "0.10.1",
       "transport": {
         "type": "stdio"
       },