@griffinwork40/outlook-cli 0.0.0-stage → 1.0.0

package/dist/cli.js

@@ -0,0 +1,3286 @@
+#!/usr/bin/env node
+
+// src/cli.ts
+import { createRequire } from "module";
+
+// src/env.ts
+import { readFileSync } from "fs";
+import { homedir } from "os";
+import { join } from "path";
+var ENV_PATH = join(homedir(), ".afk", "config", "afk.env");
+function parseEnvLines(content) {
+  const pairs = [];
+  for (const raw of content.split("\n")) {
+    const line = raw.trim();
+    if (line === "" || line.startsWith("#")) continue;
+    const eqIdx = line.indexOf("=");
+    if (eqIdx === -1) continue;
+    const key = line.slice(0, eqIdx).trim();
+    if (key === "") continue;
+    let value = line.slice(eqIdx + 1).trim();
+    if (value.length >= 2 && (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'"))) {
+      value = value.slice(1, -1);
+    }
+    pairs.push([key, value]);
+  }
+  return pairs;
+}
+function loadEnvFile(envPath = ENV_PATH) {
+  let content;
+  try {
+    content = readFileSync(envPath, "utf-8");
+  } catch {
+    return;
+  }
+  for (const [key, value] of parseEnvLines(content)) {
+    if (process.env[key] === void 0) {
+      process.env[key] = value;
+    }
+  }
+}
+
+// src/errors.ts
+var OutlookCliError = class extends Error {
+  exitCode;
+  constructor(message, exitCode = 1) {
+    super(message);
+    this.name = "OutlookCliError";
+    this.exitCode = exitCode;
+  }
+};
+var MissingCredentialsError = class extends OutlookCliError {
+  missing;
+  constructor(missing) {
+    const list = missing.join(", ");
+    super(
+      `Missing required environment variable(s): ${list}
+
+GRAPH_CLIENT_ID comes from a one-time Azure app registration.
+See SETUP.md for the 5-step click-path, then export it:
+  export GRAPH_CLIENT_ID=<application-client-id>`,
+      3
+    );
+    this.name = "MissingCredentialsError";
+    this.missing = missing;
+  }
+};
+var NotAuthenticatedError = class extends OutlookCliError {
+  constructor(detail) {
+    super(
+      `Not signed in${detail ? `: ${detail}` : "."}
+
+Run:  outlook auth login`,
+      3
+    );
+    this.name = "NotAuthenticatedError";
+  }
+};
+var InsufficientScopeError = class extends OutlookCliError {
+  constructor(action) {
+    super(
+      `This session was signed in with --readonly, so it cannot ${action}.
+
+Re-authorize with full access:  outlook auth login`,
+      3
+    );
+    this.name = "InsufficientScopeError";
+  }
+};
+var PolicyRefusedError = class extends OutlookCliError {
+  rule;
+  constructor(rule, reason) {
+    super(`Refused by mutation policy (${rule}): ${reason}`, 4);
+    this.name = "PolicyRefusedError";
+    this.rule = rule;
+  }
+};
+var UsageError = class extends OutlookCliError {
+  constructor(message) {
+    super(message, 2);
+    this.name = "UsageError";
+  }
+};
+var GraphError = class extends OutlookCliError {
+  status;
+  code;
+  graphMessage;
+  requestId;
+  retryAfter;
+  constructor(params) {
+    const hint = GRAPH_ERROR_HINTS[params.code];
+    super(
+      `Graph API error ${params.status} (${params.code}): ${params.message}` + (hint ? `
+  \u2192 ${hint}` : "") + (params.requestId ? `
+  request-id: ${params.requestId}` : ""),
+      1
+    );
+    this.name = "GraphError";
+    this.status = params.status;
+    this.code = params.code;
+    this.graphMessage = params.message;
+    this.requestId = params.requestId;
+    this.retryAfter = params.retryAfter;
+  }
+};
+var GRAPH_ERROR_HINTS = {
+  InvalidAuthenticationToken: "Access token expired or malformed. Run: outlook auth login",
+  ErrorAccessDenied: "The signed-in account lacks permission. Confirm the Mail.ReadWrite / Mail.Send scopes were consented at login.",
+  ErrorItemNotFound: "No message with that id. Note: message ids change when a message moves between folders unless immutable ids are used.",
+  ErrorInvalidUser: "The mailbox does not exist or is not licensed for mail.",
+  ErrorInvalidRecipients: "One or more recipient addresses were rejected. Check for typos and that each is a routable address.",
+  ErrorMessageSizeExceeded: "Message plus attachments exceeded the mailbox send limit. Use fewer or smaller attachments.",
+  ErrorAttachmentSizeExceeded: "Inline attachments must be under 3 MB. Larger files need an upload session (not supported in v1).",
+  ErrorMailboxStoreUnavailable: "The mailbox is temporarily unavailable. Retry shortly.",
+  ErrorQuotaExceeded: "Mailbox is over quota.",
+  ErrorFolderNotFound: "No folder with that name or id. Run: outlook folders list",
+  ErrorInvalidIdMalformed: "That id is not a valid Graph id. Ids are opaque \u2014 copy them verbatim from a list/get.",
+  InefficientFilter: "The $filter/$orderby combination is too complex. Properties in $orderby must also appear in $filter, in the same order.",
+  activityLimitReached: "Throttled by Outlook (429). The client backs off automatically; if this persists, reduce request volume.",
+  TooManyRequests: "Throttled by Outlook (429). Back off and retry.",
+  ErrorTooManyObjectsOpened: "Too many concurrent mailbox operations. Reduce concurrency to 4 or fewer.",
+  ErrorSendAsDenied: "The account may not send as that address. Check Send As permissions.",
+  MailboxNotEnabledForRESTAPI: "This mailbox cannot be accessed via the REST API (often an on-prem or unlicensed mailbox)."
+};
+function parseGraphError(status, bodyText, retryAfter) {
+  let code = `HTTP${status}`;
+  let message = bodyText.slice(0, 500) || "no response body";
+  let requestId;
+  try {
+    const parsed = JSON.parse(bodyText);
+    const root = parsed;
+    if (typeof root.error === "string") {
+      code = root.error;
+      if (typeof root.error_description === "string") {
+        message = root.error_description;
+      }
+    } else if (root.error && typeof root.error === "object") {
+      const err = root.error;
+      if (typeof err.code === "string") code = err.code;
+      if (typeof err.message === "string") message = err.message;
+      const inner = err.innerError ?? err.innererror;
+      const rid = inner?.["request-id"] ?? inner?.["client-request-id"];
+      if (typeof rid === "string") requestId = rid;
+    }
+  } catch {
+  }
+  return new GraphError({ status, code, message, requestId, retryAfter });
+}
+
+// src/args.ts
+var TRUE_VALUES = /* @__PURE__ */ new Set(["true", "1", "yes", "on"]);
+var FALSE_VALUES = /* @__PURE__ */ new Set(["false", "0", "no", "off", ""]);
+function looksLikeOption(tok) {
+  if (tok === void 0) return false;
+  if (tok === "-") return false;
+  return tok.startsWith("-") && tok.length > 1;
+}
+function parseArgs(argv) {
+  const positionals = [];
+  const store = /* @__PURE__ */ new Map();
+  function record(name, value) {
+    const existing = store.get(name);
+    if (existing) existing.push(value);
+    else store.set(name, [value]);
+  }
+  let i = 0;
+  let terminated = false;
+  while (i < argv.length) {
+    const tok = argv[i];
+    if (tok === void 0) break;
+    if (!terminated && tok === "--") {
+      terminated = true;
+      i++;
+      continue;
+    }
+    if (terminated) {
+      positionals.push(tok);
+      i++;
+      continue;
+    }
+    if (tok.startsWith("--") && tok.length > 2) {
+      const body = tok.slice(2);
+      const eq = body.indexOf("=");
+      if (eq !== -1) {
+        record(body.slice(0, eq), body.slice(eq + 1));
+        i++;
+        continue;
+      }
+      if (body.startsWith("no-") && body.length > 3) {
+        record(body.slice(3), false);
+        i++;
+        continue;
+      }
+      const next = argv[i + 1];
+      if (next !== void 0 && !looksLikeOption(next)) {
+        record(body, next);
+        i += 2;
+        continue;
+      }
+      record(body, true);
+      i++;
+      continue;
+    }
+    if (tok.startsWith("-") && tok.length > 1) {
+      const body = tok.slice(1);
+      const eq = body.indexOf("=");
+      if (eq !== -1) {
+        record(body.slice(0, eq), body.slice(eq + 1));
+        i++;
+        continue;
+      }
+      const next = argv[i + 1];
+      if (next !== void 0 && !looksLikeOption(next)) {
+        record(body, next);
+        i += 2;
+        continue;
+      }
+      record(body, true);
+      i++;
+      continue;
+    }
+    positionals.push(tok);
+    i++;
+  }
+  function lastValue(name) {
+    const list = store.get(name);
+    if (!list || list.length === 0) return void 0;
+    return list[list.length - 1];
+  }
+  const api = {
+    positionals,
+    raw: [...argv],
+    has(name) {
+      return store.has(name);
+    },
+    str(name, fallback) {
+      const v = lastValue(name);
+      return typeof v === "string" ? v : fallback;
+    },
+    strAll(name) {
+      const list = store.get(name);
+      if (!list) return [];
+      return list.filter((v) => typeof v === "string");
+    },
+    num(name) {
+      const v = lastValue(name);
+      if (v === void 0) return void 0;
+      if (typeof v === "boolean") {
+        throw new UsageError(`--${name} requires a numeric value`);
+      }
+      if (v.trim() === "") {
+        throw new UsageError(`--${name} expects a numeric value, got ""`);
+      }
+      const n = Number(v);
+      if (Number.isNaN(n)) {
+        throw new UsageError(`--${name} expects a numeric value, got "${v}"`);
+      }
+      return n;
+    },
+    /**
+     * Presence-based, but NEVER value-blind.
+     *
+     * The old implementation returned `last !== false`, which meant any string
+     * value was truthy — so `--yes=false` (a user trying to DECLINE an
+     * irreversible purge) read as `true` and the deletion proceeded. Explicit
+     * false spellings must win, and anything ambiguous must be a loud error
+     * rather than a guess, because the guess that gets this wrong deletes
+     * mail. A bare `--flag` is still `true`; `--no-flag` is still `false`.
+     */
+    bool(name) {
+      const v = lastValue(name);
+      if (v === void 0) return false;
+      if (typeof v === "boolean") return v;
+      const normalized = v.trim().toLowerCase();
+      if (TRUE_VALUES.has(normalized)) return true;
+      if (FALSE_VALUES.has(normalized)) return false;
+      throw new UsageError(
+        `--${name} does not take a value (got "${v}").
+If "${v}" is a positional argument, put it before the flag: \`... ${v} --${name}\`.`
+      );
+    },
+    require(name) {
+      const v = lastValue(name);
+      if (typeof v === "string") return v;
+      throw new UsageError(`Missing required flag: --${name}`);
+    },
+    requirePositional(index, label) {
+      const v = positionals[index];
+      if (v === void 0) {
+        throw new UsageError(`Missing required argument: ${label}`);
+      }
+      return v;
+    },
+    names() {
+      return [...store.keys()];
+    }
+  };
+  return api;
+}
+
+// src/config.ts
+import { homedir as homedir2 } from "os";
+import { join as join2 } from "path";
+function defaultTokenCachePath(env = {}) {
+  const override = trimmed(env["GRAPH_TOKEN_CACHE"]);
+  if (override) return override;
+  const afkHome = trimmed(env["AFK_HOME"]) ?? join2(homedir2(), ".afk");
+  return join2(afkHome, "state", "outlook", "token.json");
+}
+function resolveConfig(env, needs = ["clientId"]) {
+  const missing = [];
+  const clientId = trimmed(env["GRAPH_CLIENT_ID"]);
+  if (needs.includes("clientId") && !clientId) {
+    missing.push("GRAPH_CLIENT_ID");
+  }
+  const clientSecret = trimmed(env["GRAPH_CLIENT_SECRET"]);
+  if (needs.includes("clientSecret") && !clientSecret) {
+    missing.push("GRAPH_CLIENT_SECRET");
+  }
+  if (missing.length > 0) {
+    throw new MissingCredentialsError(missing);
+  }
+  return {
+    clientId: clientId ?? "",
+    tenantId: trimmed(env["GRAPH_TENANT_ID"]) ?? "common",
+    ...clientSecret ? { clientSecret } : {},
+    tokenCachePath: defaultTokenCachePath(env)
+  };
+}
+function authorityBase(tenantId) {
+  return `https://login.microsoftonline.com/${encodeURIComponent(tenantId)}/oauth2/v2.0`;
+}
+function trimmed(value) {
+  if (typeof value !== "string") return void 0;
+  const t = value.trim();
+  return t.length > 0 ? t : void 0;
+}
+
+// src/types.ts
+var WELL_KNOWN_FOLDERS = [
+  "archive",
+  "clutter",
+  "conflicts",
+  "conversationhistory",
+  "deleteditems",
+  "drafts",
+  "inbox",
+  "junkemail",
+  "localfailures",
+  "msgfolderroot",
+  "outbox",
+  "recoverableitemsdeletions",
+  "scheduled",
+  "searchfolders",
+  "sentitems",
+  "serverfailures",
+  "syncissues"
+];
+function isWellKnownFolder(name) {
+  return WELL_KNOWN_FOLDERS.includes(name.toLowerCase());
+}
+var GRAPH_BASE = "https://graph.microsoft.com/v1.0";
+var REQUEST_TIMEOUT_MS = 6e4;
+var DEFAULT_SCOPES = [
+  "offline_access",
+  "User.Read",
+  "Mail.ReadWrite",
+  "Mail.Send",
+  "MailboxSettings.ReadWrite",
+  "Contacts.Read",
+  "Calendars.Read",
+  "Files.Read.All",
+  "Sites.Read.All"
+];
+var READONLY_SCOPES = [
+  "offline_access",
+  "User.Read",
+  "Mail.Read",
+  "MailboxSettings.Read"
+];
+function scopesForMode(mode) {
+  return mode === "readonly" ? READONLY_SCOPES : DEFAULT_SCOPES;
+}
+
+// src/identityFetch.ts
+var FORM_HEADERS = { "Content-Type": "application/x-www-form-urlencoded" };
+function postForm(url, params, fetchImpl) {
+  return fetchImpl(url, {
+    method: "POST",
+    headers: FORM_HEADERS,
+    body: params.toString(),
+    redirect: "error",
+    // Per ATTEMPT, deliberately not per operation: the device-code poll
+    // legitimately runs for the lifetime of the code, so each request inside
+    // that loop gets a fresh timeout rather than sharing one deadline.
+    signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)
+  });
+}
+
+// src/deviceCode.ts
+var DEVICE_CODE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
+var DEFAULT_EXPIRES_IN_SEC = 900;
+var DEFAULT_POLL_INTERVAL_SEC = 5;
+var SLOW_DOWN_INCREMENT_MS = 5e3;
+async function requestDeviceCode(cfg, scopes, fetchImpl = fetch) {
+  const url = `${authorityBase(cfg.tenantId)}/devicecode`;
+  const params = new URLSearchParams({
+    client_id: cfg.clientId,
+    scope: scopes.join(" ")
+  });
+  const res = await postForm(url, params, fetchImpl);
+  const bodyText = await res.text().catch(() => "");
+  if (!res.ok) {
+    throw parseGraphError(res.status, bodyText);
+  }
+  const parsed = parseJsonSafe(bodyText);
+  if (!isDeviceCodeResponse(parsed)) {
+    throw new OutlookCliError(
+      "The devicecode endpoint returned a 200 response with an unrecognized body shape."
+    );
+  }
+  return parsed;
+}
+async function pollForToken(cfg, deviceCode, opts = {}) {
+  const fetchImpl = opts.fetchImpl ?? fetch;
+  const sleep = opts.sleep ?? defaultSleep;
+  const deadlineMs = (opts.expiresInSec ?? DEFAULT_EXPIRES_IN_SEC) * 1e3;
+  let intervalMs = (opts.intervalSec ?? DEFAULT_POLL_INTERVAL_SEC) * 1e3;
+  const url = `${authorityBase(cfg.tenantId)}/token`;
+  const params = new URLSearchParams({
+    grant_type: DEVICE_CODE_GRANT_TYPE,
+    client_id: cfg.clientId,
+    device_code: deviceCode
+  });
+  let elapsedMs = 0;
+  for (; ; ) {
+    const res = await postForm(url, params, fetchImpl);
+    const bodyText = await res.text().catch(() => "");
+    if (res.ok) {
+      const parsed = parseJsonSafe(bodyText);
+      if (!isTokenResponse(parsed)) {
+        throw new OutlookCliError(
+          "The token endpoint returned a 200 response with an unrecognized body shape."
+        );
+      }
+      return parsed;
+    }
+    const code = extractErrorCode(bodyText);
+    switch (code) {
+      case "authorization_pending":
+        break;
+      case "slow_down":
+        intervalMs += SLOW_DOWN_INCREMENT_MS;
+        break;
+      case "expired_token":
+        throw new OutlookCliError(
+          "The device code expired before sign-in was completed. Run login again."
+        );
+      case "authorization_declined":
+        throw new OutlookCliError("Sign-in was declined.");
+      case "bad_verification_code":
+        throw new OutlookCliError(
+          "The device code was not recognized by the server. This should not happen in normal operation \u2014 it indicates a bug in the polling loop, not a transient condition."
+        );
+      default:
+        throw parseGraphError(res.status, bodyText);
+    }
+    if (elapsedMs + intervalMs >= deadlineMs) {
+      throw new OutlookCliError(
+        "The device code expired before sign-in was completed (local deadline reached). Run login again."
+      );
+    }
+    await sleep(intervalMs);
+    elapsedMs += intervalMs;
+  }
+}
+function parseJsonSafe(text) {
+  try {
+    return JSON.parse(text);
+  } catch {
+    return void 0;
+  }
+}
+function extractErrorCode(bodyText) {
+  const parsed = parseJsonSafe(bodyText);
+  if (parsed !== null && typeof parsed === "object" && "error" in parsed) {
+    const value = parsed["error"];
+    if (typeof value === "string") return value;
+  }
+  return void 0;
+}
+function isDeviceCodeResponse(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const v = value;
+  return typeof v["device_code"] === "string" && typeof v["user_code"] === "string" && typeof v["verification_uri"] === "string" && typeof v["expires_in"] === "number" && typeof v["interval"] === "number" && (v["message"] === void 0 || typeof v["message"] === "string");
+}
+function isTokenResponse(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const v = value;
+  return typeof v["access_token"] === "string" && typeof v["expires_in"] === "number" && (v["refresh_token"] === void 0 || typeof v["refresh_token"] === "string") && (v["scope"] === void 0 || typeof v["scope"] === "string") && (v["token_type"] === void 0 || typeof v["token_type"] === "string") && (v["id_token"] === void 0 || typeof v["id_token"] === "string");
+}
+function defaultSleep(ms) {
+  return new Promise((resolve3) => setTimeout(resolve3, ms));
+}
+
+// src/auth.ts
+var REFRESH_SKEW_MS = 6e4;
+function createAuthenticator(cfg, store, deps = {}) {
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  const sleep = deps.sleep ?? defaultSleep2;
+  const now = deps.now ?? Date.now;
+  async function refresh() {
+    const cached = await store.load();
+    if (!cached) throw new NotAuthenticatedError();
+    if (!cached.refreshToken) {
+      throw new NotAuthenticatedError("cached session has no refresh token; run login again");
+    }
+    const mode = cached.mode ?? "full";
+    const scopes = cached.grantScopes ?? scopesForMode(mode);
+    const tokenResponse = await exchangeRefreshToken(
+      cfg,
+      cached.refreshToken,
+      scopes,
+      fetchImpl
+    );
+    const nextTokens = toTokenSet(tokenResponse, now(), cached);
+    await store.save(nextTokens);
+    return nextTokens;
+  }
+  return {
+    async getAccessToken() {
+      const cached = await store.load();
+      if (!cached) throw new NotAuthenticatedError();
+      if (cached.expiresAt - now() < REFRESH_SKEW_MS) {
+        const refreshed = await refresh();
+        return refreshed.accessToken;
+      }
+      return cached.accessToken;
+    },
+    async login(onPrompt, opts = {}) {
+      const mode = opts.readOnly ? "readonly" : "full";
+      const custom = opts.scopes !== void 0 ? [...opts.scopes] : void 0;
+      const deviceCode = await requestDeviceCode(
+        cfg,
+        custom ?? scopesForMode(mode),
+        fetchImpl
+      );
+      onPrompt(deviceCode);
+      const tokenResponse = await pollForToken(cfg, deviceCode.device_code, {
+        intervalSec: deviceCode.interval,
+        expiresInSec: deviceCode.expires_in,
+        fetchImpl,
+        sleep
+      });
+      const tokens = {
+        ...toTokenSet(tokenResponse, now()),
+        mode,
+        ...custom !== void 0 ? { grantScopes: custom } : {}
+      };
+      await store.save(tokens);
+      return tokens;
+    },
+    async logout() {
+      await store.clear();
+    },
+    refresh,
+    async status() {
+      const cached = await store.load();
+      if (!cached) return { signedIn: false, expired: false };
+      return {
+        signedIn: true,
+        expired: now() >= cached.expiresAt,
+        expiresAt: cached.expiresAt,
+        ...cached.account !== void 0 ? { account: cached.account } : {},
+        ...cached.scope !== void 0 ? { scopes: cached.scope } : {},
+        ...cached.mode !== void 0 ? { mode: cached.mode } : {},
+        ...cached.grantScopes !== void 0 ? { grantScopes: cached.grantScopes } : {}
+      };
+    }
+  };
+}
+async function exchangeRefreshToken(cfg, refreshToken, scopes, fetchImpl) {
+  const url = `${authorityBase(cfg.tenantId)}/token`;
+  const params = new URLSearchParams({
+    grant_type: "refresh_token",
+    client_id: cfg.clientId,
+    refresh_token: refreshToken,
+    scope: scopes.join(" ")
+  });
+  const res = await postForm(url, params, fetchImpl);
+  const bodyText = await res.text().catch(() => "");
+  if (!res.ok) {
+    throw parseGraphError(res.status, bodyText);
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(bodyText);
+  } catch {
+    throw new OutlookCliError(
+      "The token endpoint returned a 200 response with an unparseable body during refresh."
+    );
+  }
+  if (!isTokenResponse2(parsed)) {
+    throw new OutlookCliError(
+      "The token endpoint returned a 200 response with an unrecognized body shape during refresh."
+    );
+  }
+  return parsed;
+}
+function toTokenSet(tokenResponse, nowMs, previous) {
+  const account = tokenResponse.id_token ? decodeIdTokenAccount(tokenResponse.id_token) ?? previous?.account : previous?.account;
+  const refreshToken = tokenResponse.refresh_token ?? previous?.refreshToken;
+  const scope = tokenResponse.scope ?? previous?.scope;
+  const tokenType = tokenResponse.token_type ?? previous?.tokenType;
+  const mode = previous?.mode;
+  const grantScopes = previous?.grantScopes;
+  return {
+    accessToken: tokenResponse.access_token,
+    expiresAt: nowMs + tokenResponse.expires_in * 1e3,
+    ...refreshToken !== void 0 ? { refreshToken } : {},
+    ...scope !== void 0 ? { scope } : {},
+    ...tokenType !== void 0 ? { tokenType } : {},
+    ...account !== void 0 ? { account } : {},
+    ...mode !== void 0 ? { mode } : {},
+    ...grantScopes !== void 0 ? { grantScopes } : {}
+  };
+}
+function decodeIdTokenAccount(idToken) {
+  try {
+    const parts = idToken.split(".");
+    if (parts.length !== 3) return void 0;
+    const payloadSegment = parts[1];
+    if (!payloadSegment) return void 0;
+    const json = Buffer.from(payloadSegment, "base64url").toString("utf8");
+    const claims = JSON.parse(json);
+    if (typeof claims !== "object" || claims === null) return void 0;
+    const c = claims;
+    const candidates = [c["preferred_username"], c["email"], c["upn"], c["name"]];
+    for (const candidate of candidates) {
+      if (typeof candidate === "string" && candidate.length > 0) return candidate;
+    }
+    return void 0;
+  } catch {
+    return void 0;
+  }
+}
+function isTokenResponse2(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const v = value;
+  return typeof v["access_token"] === "string" && typeof v["expires_in"] === "number";
+}
+function defaultSleep2(ms) {
+  return new Promise((resolve3) => setTimeout(resolve3, ms));
+}
+
+// src/client.ts
+var UntrustedUrlError = class extends OutlookCliError {
+  constructor(message) {
+    super(message, 1);
+    this.name = "UntrustedUrlError";
+  }
+};
+var RETRYABLE_METHODS = /* @__PURE__ */ new Set(["GET", "DELETE", "PATCH"]);
+var RETRYABLE_STATUSES = /* @__PURE__ */ new Set([429, 503, 504]);
+var DEFAULT_MAX_RETRIES = 4;
+var BASE_BACKOFF_MS = 500;
+var MAX_BACKOFF_MS = 3e4;
+var ABSOLUTE_URL_RE = /^https?:\/\//i;
+var GraphClient = class {
+  getToken;
+  fetchImpl;
+  sleep;
+  baseUrl;
+  maxRetries;
+  /** Derived from baseUrl, so a national-cloud endpoint stays configurable. */
+  allowedHost;
+  constructor(deps) {
+    this.getToken = deps.getToken;
+    this.fetchImpl = deps.fetchImpl ?? fetch;
+    this.sleep = deps.sleep ?? defaultSleep3;
+    this.baseUrl = deps.baseUrl ?? GRAPH_BASE;
+    this.maxRetries = deps.maxRetries ?? DEFAULT_MAX_RETRIES;
+    this.allowedHost = new URL(this.baseUrl).host;
+  }
+  /**
+   * Pure request-spec builder — no `getToken()` call, no network. This is
+   * what `--dry-run` renders. Authorization is attached later, only inside
+   * the actual send path.
+   */
+  buildSpec(method, path, body, query) {
+    const upperMethod = method.toUpperCase();
+    const url = this.buildUrl(path, query);
+    const headers = {};
+    if (upperMethod === "GET") {
+      headers["Prefer"] = 'IdType="ImmutableId"';
+    }
+    if (body !== void 0) {
+      headers["Content-Type"] = "application/json";
+    }
+    const spec = { method: upperMethod, url, headers };
+    if (body !== void 0) spec.body = body;
+    return spec;
+  }
+  async request(spec) {
+    const res = await this.executeWithRetry(spec);
+    return parseSuccessBody(res);
+  }
+  /** Raw Response, for binary reads (e.g. attachment/$value download). */
+  async raw(spec) {
+    return this.executeWithRetry(spec);
+  }
+  async get(path, query) {
+    return this.request(this.buildSpec("GET", path, void 0, query));
+  }
+  async post(path, body) {
+    return this.request(this.buildSpec("POST", path, body));
+  }
+  async patch(path, body) {
+    return this.request(this.buildSpec("PATCH", path, body));
+  }
+  async del(path) {
+    await this.request(this.buildSpec("DELETE", path));
+  }
+  /**
+   * The single place a bearer token is attached to an outbound request — and
+   * therefore the only correct place to decide whether this URL is allowed to
+   * receive one.
+   *
+   * `buildUrl` passes an absolute `path` straight through so a server-issued
+   * `@odata.nextLink` can be followed verbatim. That link is response data: a
+   * spoofed, MITM'd, or malformed one pointing at `http://attacker.example`
+   * previously received the live mailbox token, in cleartext, and a stolen
+   * Graph token replays against real Graph regardless of who presents it.
+   * Validating here rather than in `buildUrl` means no future caller can
+   * reintroduce the hole by constructing a spec some other way.
+   */
+  assertTokenMayBeSent(url) {
+    let parsed;
+    try {
+      parsed = new URL(url);
+    } catch {
+      throw new UntrustedUrlError(`Refusing to send credentials to a malformed URL: ${url}`);
+    }
+    if (parsed.protocol !== "https:") {
+      throw new UntrustedUrlError(
+        `Refusing to send credentials over ${parsed.protocol}// \u2014 HTTPS is required (${url})`
+      );
+    }
+    if (parsed.host !== this.allowedHost) {
+      throw new UntrustedUrlError(
+        `Refusing to send credentials to '${parsed.host}' \u2014 only '${this.allowedHost}' is authorized for this client.`
+      );
+    }
+  }
+  async send(spec) {
+    this.assertTokenMayBeSent(spec.url);
+    const token = await this.getToken();
+    const headers = {
+      ...spec.headers ?? {},
+      Authorization: `Bearer ${token}`
+    };
+    const init = {
+      method: spec.method,
+      headers,
+      // A 3xx to another origin would otherwise replay the Authorization
+      // header there. Graph does not redirect its API responses; treat one as
+      // hostile rather than following it.
+      redirect: "error",
+      signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)
+    };
+    if (spec.body !== void 0) {
+      init.body = JSON.stringify(spec.body);
+    }
+    return this.fetchImpl(spec.url, init);
+  }
+  async executeWithRetry(spec) {
+    const method = spec.method.toUpperCase();
+    const retryEligible = RETRYABLE_METHODS.has(method);
+    let attempt = 0;
+    for (; ; ) {
+      const res = await this.send(spec);
+      if (res.ok) return res;
+      const willRetry = retryEligible && RETRYABLE_STATUSES.has(res.status) && attempt < this.maxRetries;
+      if (!willRetry) {
+        const bodyText = await res.text().catch(() => "");
+        const retryAfter = parseRetryAfterSeconds(res.headers.get("retry-after"));
+        throw parseGraphError(res.status, bodyText, retryAfter);
+      }
+      const delayMs = computeDelayMs(res.headers.get("retry-after"), attempt);
+      await this.sleep(delayMs);
+      attempt += 1;
+    }
+  }
+  buildUrl(path, query) {
+    const isAbsolute2 = ABSOLUTE_URL_RE.test(path);
+    const base = isAbsolute2 ? path : joinUrl(this.baseUrl, path);
+    if (isAbsolute2 || !query) return base;
+    const qs = buildQueryString(query);
+    if (!qs) return base;
+    return `${base}${base.includes("?") ? "&" : "?"}${qs}`;
+  }
+};
+function joinUrl(base, path) {
+  const trimmedBase = base.endsWith("/") ? base.slice(0, -1) : base;
+  const normalizedPath = path.startsWith("/") ? path : `/${path}`;
+  return `${trimmedBase}${normalizedPath}`;
+}
+function buildQueryString(query) {
+  const parts = [];
+  for (const [key, rawValue] of Object.entries(query)) {
+    if (rawValue === void 0 || rawValue === null) continue;
+    parts.push(`${encodeQueryKey(key)}=${encodeURIComponent(String(rawValue))}`);
+  }
+  return parts.join("&");
+}
+function encodeQueryKey(key) {
+  return key.startsWith("$") ? `$${encodeURIComponent(key.slice(1))}` : encodeURIComponent(key);
+}
+function parseRetryAfterSeconds(header) {
+  if (header == null) return void 0;
+  const trimmed3 = header.trim();
+  if (trimmed3.length === 0) return void 0;
+  const asNumber = Number(trimmed3);
+  if (Number.isFinite(asNumber) && asNumber >= 0) return asNumber;
+  const asDate = Date.parse(trimmed3);
+  if (!Number.isNaN(asDate)) {
+    return Math.max(0, (asDate - Date.now()) / 1e3);
+  }
+  return void 0;
+}
+function computeDelayMs(retryAfterHeader, attempt) {
+  const seconds = parseRetryAfterSeconds(retryAfterHeader);
+  if (seconds !== void 0) return seconds * 1e3;
+  return fullJitterBackoffMs(attempt);
+}
+function fullJitterBackoffMs(attempt) {
+  const cap = Math.min(MAX_BACKOFF_MS, BASE_BACKOFF_MS * 2 ** attempt);
+  return Math.random() * cap;
+}
+function defaultSleep3(ms) {
+  return new Promise((resolve3) => setTimeout(resolve3, ms));
+}
+async function parseSuccessBody(res) {
+  if (res.status === 204) return void 0;
+  const text = await res.text();
+  if (!text) return void 0;
+  try {
+    return JSON.parse(text);
+  } catch {
+    return void 0;
+  }
+}
+
+// src/flagSpec.ts
+var GLOBAL_FLAGS = ["json", "dry-run", "help", "h"];
+var COMPOSE_FLAGS = [
+  "to",
+  "cc",
+  "bcc",
+  "subject",
+  "body",
+  "body-file",
+  "html",
+  "attach",
+  "signature"
+];
+var COMMAND_FLAGS = {
+  auth: ["readonly", "scopes"],
+  me: [],
+  list: ["folder", "limit", "all", "unread"],
+  get: ["html"],
+  search: ["limit", "all", "folder"],
+  folders: ["parent", "all", "name"],
+  attachments: ["all", "out", "force"],
+  contacts: ["top", "all", "limit", "select", "filter"],
+  send: [...COMPOSE_FLAGS, "save-sent"],
+  reply: ["body", "signature"],
+  "reply-all": ["body", "signature"],
+  forward: ["body", "to", "signature"],
+  draft: [...COMPOSE_FLAGS, "limit", "all"],
+  move: ["folder"],
+  delete: [],
+  purge: ["yes"],
+  "mark-read": [],
+  "mark-unread": [],
+  flag: [],
+  unflag: [],
+  rules: ["name", "folder", "from", "sender-contains", "mark-read", "stop-processing", "enabled", "sequence"]
+};
+function editDistance(a, b) {
+  const rows = a.length + 1;
+  const cols = b.length + 1;
+  let prev = Array.from({ length: cols }, (_, j) => j);
+  for (let i = 1; i < rows; i++) {
+    const curr = [i];
+    for (let j = 1; j < cols; j++) {
+      const substitution = (prev[j - 1] ?? 0) + (a[i - 1] === b[j - 1] ? 0 : 1);
+      const insertion = (curr[j - 1] ?? 0) + 1;
+      const deletion = (prev[j] ?? 0) + 1;
+      curr[j] = Math.min(substitution, insertion, deletion);
+    }
+    prev = curr;
+  }
+  return prev[cols - 1] ?? Math.max(a.length, b.length);
+}
+function suggest(unknown, allowed) {
+  let best;
+  let bestScore = Number.POSITIVE_INFINITY;
+  for (const candidate of allowed) {
+    const score = editDistance(unknown.toLowerCase(), candidate.toLowerCase());
+    if (score < bestScore) {
+      bestScore = score;
+      best = candidate;
+    }
+  }
+  const ceiling = Math.min(3, Math.max(1, Math.floor(unknown.length / 2)));
+  return best !== void 0 && bestScore <= ceiling ? best : void 0;
+}
+function assertKnownFlags(commandName, used) {
+  const own = COMMAND_FLAGS[commandName];
+  if (own === void 0) {
+    throw new UsageError(
+      `Internal: no flag specification registered for command '${commandName}'.`
+    );
+  }
+  const allowed = [...GLOBAL_FLAGS, ...own];
+  const allowedSet = new Set(allowed);
+  const unknown = used.filter((name) => !allowedSet.has(name));
+  if (unknown.length === 0) return;
+  const first = unknown[0] ?? "";
+  const hint = suggest(first, allowed);
+  const lines = [
+    `Unknown flag for '${commandName}': --${unknown.map((u) => u).join(", --")}`
+  ];
+  if (hint !== void 0) lines.push(`Did you mean --${hint}?`);
+  lines.push(
+    "",
+    `Accepted: ${allowed.map((f) => `--${f}`).join(" ")}`,
+    `Run 'outlook ${commandName} --help' for usage.`
+  );
+  throw new UsageError(lines.join("\n"));
+}
+
+// src/redact.ts
+var SECRET_KEYS = /* @__PURE__ */ new Set([
+  "access_token",
+  "refresh_token",
+  "id_token",
+  "device_code",
+  "client_secret",
+  "accesstoken",
+  "refreshtoken",
+  "authorization",
+  "code_verifier"
+]);
+var JWT_RE = /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/g;
+var BEARER_RE = /\b(Bearer\s+)[A-Za-z0-9._~+/-]{20,}=*/gi;
+var OPAQUE_TOKEN_RE = /\b[0-9A-Za-z]\.[A-Za-z0-9_-]{40,}/g;
+var MASK = "[REDACTED]";
+function maskSecret(value) {
+  if (!value) return MASK;
+  if (value.length <= 8) return MASK;
+  return `${MASK}(****${value.slice(-4)})`;
+}
+function redactText(text) {
+  if (!text) return text;
+  return text.replace(JWT_RE, MASK).replace(BEARER_RE, (_m, p1) => `${p1}${MASK}`).replace(OPAQUE_TOKEN_RE, MASK);
+}
+function redactObject(input) {
+  return walk(input, 0);
+}
+function walk(value, depth) {
+  if (depth > 12) return MASK;
+  if (typeof value === "string") return redactText(value);
+  if (value === null || typeof value !== "object") return value;
+  if (Array.isArray(value)) {
+    return value.map((item) => walk(item, depth + 1));
+  }
+  const out = {};
+  for (const [key, val] of Object.entries(value)) {
+    if (SECRET_KEYS.has(key.toLowerCase())) {
+      out[key] = typeof val === "string" ? maskSecret(val) : MASK;
+    } else {
+      out[key] = walk(val, depth + 1);
+    }
+  }
+  return out;
+}
+function redactHeaders(headers) {
+  const out = {};
+  for (const [key, val] of Object.entries(headers)) {
+    out[key] = SECRET_KEYS.has(key.toLowerCase()) ? MASK : redactText(val);
+  }
+  return out;
+}
+
+// src/tokenStore.ts
+import { randomBytes } from "crypto";
+import { chmod, mkdir, readFile, rename, rm, writeFile } from "fs/promises";
+import { dirname, join as join3 } from "path";
+
+// src/scopes.ts
+var SCOPE_RE = /^[A-Za-z0-9._:/-]+$/;
+var OFFLINE_ACCESS = "offline_access";
+function parseScopeList(raw) {
+  const tokens = raw.split(/[\s,]+/).map((s) => s.trim()).filter((s) => s.length > 0);
+  if (tokens.length === 0) {
+    throw new UsageError("--scopes needs at least one scope, e.g. --scopes Mail.ReadWrite");
+  }
+  const seen = /* @__PURE__ */ new Set();
+  const scopes = [];
+  for (const token of tokens) {
+    if (!SCOPE_RE.test(token)) {
+      throw new UsageError(`--scopes: "${token}" is not a valid scope name.`);
+    }
+    const key = token.toLowerCase();
+    if (seen.has(key)) continue;
+    seen.add(key);
+    scopes.push(token);
+  }
+  if (!seen.has(OFFLINE_ACCESS)) scopes.unshift(OFFLINE_ACCESS);
+  return scopes;
+}
+function isScopeArray(value) {
+  return Array.isArray(value) && value.length > 0 && value.every((s) => typeof s === "string" && SCOPE_RE.test(s));
+}
+
+// src/tokenStore.ts
+var FILE_MODE = 384;
+var DIR_MODE = 448;
+var FILE_MODE_IS_ENFORCED = process.platform !== "win32";
+function createTokenStore(path) {
+  return {
+    path,
+    async load() {
+      try {
+        const raw = await readFile(path, "utf8");
+        const parsed = JSON.parse(raw);
+        return isTokenSet(parsed) ? parsed : null;
+      } catch {
+        return null;
+      }
+    },
+    /**
+     * Atomic: write a fresh temp file, lock it down, then rename over the
+     * target. rename(2) is atomic within a directory, so a reader either sees
+     * the whole old token set or the whole new one — never a half-written
+     * file. The previous in-place writeFile could leave a truncated cache
+     * behind if the process died mid-write, or interleave two concurrent
+     * refreshes into corrupt JSON, either of which forces a re-login.
+     *
+     * The temp file carries the restrictive mode from creation, so the secret
+     * is never briefly world-readable in the window before chmod lands.
+     *
+     * The temp NAME is random and the open is exclusive. The previous
+     * `.${pid}-${Date.now()}.token.tmp` was guessable, and writeFile's default
+     * O_CREAT|O_TRUNC follows a symlink — so a link pre-planted at that path
+     * would have received the token at whatever destination it pointed to.
+     * 'wx' (O_CREAT|O_EXCL) refuses to open anything that already exists.
+     */
+    async save(tokens) {
+      const dir = dirname(path);
+      await mkdir(dir, { recursive: true, mode: DIR_MODE });
+      const tmp = join3(dir, `.${randomBytes(8).toString("hex")}.token.tmp`);
+      try {
+        await writeFile(tmp, JSON.stringify(tokens, null, 2), {
+          mode: FILE_MODE,
+          flag: "wx"
+        });
+        await chmod(tmp, FILE_MODE);
+        await rename(tmp, path);
+      } catch (error) {
+        if (error.code !== "EEXIST") {
+          await rm(tmp, { force: true }).catch(() => void 0);
+        }
+        throw error;
+      }
+    },
+    async clear() {
+      await rm(path, { force: true });
+    }
+  };
+}
+function isTokenSet(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const v = value;
+  if (typeof v["accessToken"] !== "string" || v["accessToken"].length === 0) return false;
+  if (typeof v["expiresAt"] !== "number" || !Number.isFinite(v["expiresAt"])) return false;
+  if (v["refreshToken"] !== void 0 && typeof v["refreshToken"] !== "string") return false;
+  if (v["scope"] !== void 0 && typeof v["scope"] !== "string") return false;
+  if (v["tokenType"] !== void 0 && typeof v["tokenType"] !== "string") return false;
+  if (v["account"] !== void 0 && typeof v["account"] !== "string") return false;
+  if (v["mode"] !== void 0 && v["mode"] !== "readonly" && v["mode"] !== "full") {
+    return false;
+  }
+  if (v["grantScopes"] !== void 0 && !isScopeArray(v["grantScopes"])) return false;
+  return true;
+}
+
+// src/commands/attachments.ts
+import { access, mkdir as mkdir2, writeFile as writeFile2 } from "fs/promises";
+import { basename as basename2, dirname as dirname3, isAbsolute, join as join4, relative, resolve as resolve2, sep } from "path";
+
+// src/dryRun.ts
+function renderRequest(spec) {
+  const lines = [];
+  lines.push(`${spec.method} ${spec.url}`);
+  const headers = redactHeaders(spec.headers ?? {});
+  for (const [key, value] of Object.entries(headers)) {
+    lines.push(`${key}: ${value}`);
+  }
+  if (spec.body !== void 0) {
+    lines.push("");
+    lines.push(JSON.stringify(redactObject(spec.body), null, 2));
+  }
+  return lines.join("\n");
+}
+
+// src/policyGuard.ts
+import { dirname as dirname2, resolve } from "path";
+
+// src/policy.ts
+import { readFile as readFile2, stat } from "fs/promises";
+var POLICY_ENV = "OUTLOOK_POLICY";
+var TOP_KEYS = /* @__PURE__ */ new Set(["allowCommands", "move"]);
+var MOVE_KEYS = /* @__PURE__ */ new Set(["allowedDestinations", "denySenders"]);
+var DENY_KEYS = /* @__PURE__ */ new Set(["file", "maxAgeHours", "destinations"]);
+function stripBom(text) {
+  return text.charCodeAt(0) === 65279 ? text.slice(1) : text;
+}
+function isRecord(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function isStringList(v, allowEmpty) {
+  return Array.isArray(v) && (allowEmpty || v.length > 0) && v.every((s) => typeof s === "string" && s.trim().length > 0);
+}
+function unknownKey(obj, known) {
+  return Object.keys(obj).find((k) => !known.has(k) && !k.startsWith("$"));
+}
+function validatePolicy(v) {
+  if (!isRecord(v)) return "top level must be a JSON object";
+  const extra = unknownKey(v, TOP_KEYS);
+  if (extra !== void 0) return `unknown key "${extra}"`;
+  if (!isStringList(v["allowCommands"], true)) {
+    return '"allowCommands" must be an array of command names (it may be empty)';
+  }
+  const move = v["move"];
+  if (move === void 0) return void 0;
+  if (!isRecord(move)) return '"move" must be an object';
+  const extraMove = unknownKey(move, MOVE_KEYS);
+  if (extraMove !== void 0) return `unknown key "move.${extraMove}"`;
+  const allowed = move["allowedDestinations"];
+  if (allowed !== void 0 && !isStringList(allowed, true)) {
+    return '"move.allowedDestinations" must be an array of folder ids or well-known names';
+  }
+  const deny = move["denySenders"];
+  if (deny === void 0) return void 0;
+  if (!isRecord(deny)) return '"move.denySenders" must be an object';
+  const extraDeny = unknownKey(deny, DENY_KEYS);
+  if (extraDeny !== void 0) return `unknown key "move.denySenders.${extraDeny}"`;
+  if (typeof deny["file"] !== "string" || deny["file"].trim() === "") {
+    return '"move.denySenders.file" must be a path';
+  }
+  const denyFile = deny["file"];
+  if (denyFile.startsWith("/") || denyFile.includes("\\") || denyFile.split("/").some((seg) => seg === "..")) {
+    return `"move.denySenders.file" must be a relative path with no '..' segments or backslashes`;
+  }
+  const maxAge = deny["maxAgeHours"];
+  if (typeof maxAge !== "number" || !Number.isFinite(maxAge) || maxAge <= 0) {
+    return '"move.denySenders.maxAgeHours" must be a positive number';
+  }
+  if (!isStringList(deny["destinations"], false)) {
+    return '"move.denySenders.destinations" must be a non-empty array of folder ids';
+  }
+  return void 0;
+}
+async function loadPolicy(path) {
+  let raw;
+  try {
+    raw = await readFile2(path, "utf8");
+  } catch (error) {
+    const code = error.code ?? "read error";
+    return { ok: false, reason: `cannot read policy file ${path} (${code})` };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(stripBom(raw));
+  } catch {
+    return { ok: false, reason: `policy file ${path} is not valid JSON` };
+  }
+  const problem = validatePolicy(parsed);
+  if (problem !== void 0) {
+    return { ok: false, reason: `policy file ${path} is invalid: ${problem}` };
+  }
+  return { ok: true, value: parsed };
+}
+async function loadDenyList(file, maxAgeHours, nowMs) {
+  let raw;
+  try {
+    raw = await readFile2(file, "utf8");
+  } catch (error) {
+    const code = error.code ?? "read error";
+    return { ok: false, reason: `cannot read deny list ${file} (${code})` };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(stripBom(raw));
+  } catch {
+    return { ok: false, reason: `deny list ${file} is not valid JSON` };
+  }
+  let addresses;
+  let builtAt;
+  if (Array.isArray(parsed)) {
+    addresses = parsed;
+  } else if (isRecord(parsed)) {
+    addresses = parsed["addresses"];
+    builtAt = parsed["built_at"];
+  }
+  if (!isStringList(addresses, true)) {
+    return {
+      ok: false,
+      reason: `deny list ${file} must be an array of addresses or an object with an "addresses" array`
+    };
+  }
+  let stampMs;
+  if (builtAt !== void 0) {
+    stampMs = typeof builtAt === "string" ? Date.parse(builtAt) : Number.NaN;
+    if (Number.isNaN(stampMs)) {
+      return { ok: false, reason: `deny list ${file} has an unparseable built_at` };
+    }
+  } else {
+    try {
+      stampMs = (await stat(file)).mtimeMs;
+    } catch {
+      return { ok: false, reason: `cannot stat deny list ${file}` };
+    }
+  }
+  const ageHours = (nowMs - stampMs) / 36e5;
+  if (ageHours > maxAgeHours) {
+    return {
+      ok: false,
+      reason: `deny list ${file} is ${ageHours.toFixed(1)}h old (maxAgeHours ${maxAgeHours}); rebuild it`
+    };
+  }
+  return { ok: true, value: new Set(addresses.map((a) => a.trim().toLowerCase())) };
+}
+function sameFolder(a, b) {
+  if (a === b) return true;
+  return isWellKnownFolder(a) && isWellKnownFolder(b) && a.toLowerCase() === b.toLowerCase();
+}
+
+// src/policyGuard.ts
+function policyPath(env) {
+  const value = env?.[POLICY_ENV]?.trim();
+  return value ? value : void 0;
+}
+function normalizeCommand(name) {
+  return name.trim().toLowerCase().replace(/\s+/g, " ");
+}
+function commandAllowed(policy, command, sub) {
+  const allowed = new Set(policy.allowCommands.map(normalizeCommand));
+  const base = normalizeCommand(command);
+  if (allowed.has(base)) return true;
+  return sub !== void 0 && allowed.has(normalizeCommand(`${base} ${sub}`));
+}
+function rawPath(url) {
+  return url.replace(/^https?:\/\/[^/]*/i, "").split(/[?#]/)[0] ?? "";
+}
+function unsafePathReason(url) {
+  for (const segment of rawPath(url).split("/")) {
+    let decoded;
+    try {
+      decoded = decodeURIComponent(segment);
+    } catch {
+      return "request path contains a malformed percent-encoding";
+    }
+    if (decoded === "." || decoded === ".." || decoded.includes("\\") || decoded.includes("/")) {
+      return "request path contains a dot segment, backslash or encoded slash";
+    }
+    if (decoded.includes("%")) {
+      return "request path contains a double-encoded percent sequence";
+    }
+  }
+  return void 0;
+}
+function purgeTarget(spec) {
+  if (spec.method.toUpperCase() !== "DELETE") return void 0;
+  const path = rawPath(spec.url);
+  const match = /\/me\/messages\/([^/]+)$/.exec(path);
+  if (!match) return void 0;
+  return { destination: "deleteditems", messageId: match[1] };
+}
+function moveTarget(spec) {
+  if (spec.method.toUpperCase() !== "POST") return void 0;
+  const path = rawPath(spec.url);
+  if (!path.endsWith("/move")) return void 0;
+  const body = spec.body;
+  const destination = typeof body?.destinationId === "string" ? body.destinationId : "";
+  const match = /\/me\/messages\/([^/]+)\/move$/.exec(path);
+  return { destination, messageId: match?.[1] };
+}
+async function evaluatePolicy(input) {
+  const path = policyPath(input.env);
+  if (path === void 0) return void 0;
+  const refuse = (rule, reason) => ({
+    policyPath: path,
+    allowed: false,
+    rule,
+    reason
+  });
+  const loaded = await loadPolicy(path);
+  if (!loaded.ok) return refuse("policy-file", loaded.reason);
+  const policy = loaded.value;
+  if (input.command === void 0) {
+    return refuse("allowCommands", "cannot determine which command issued this request");
+  }
+  if (!commandAllowed(policy, input.command, input.subcommand)) {
+    const label = input.subcommand ? `${input.command} ${input.subcommand}` : input.command;
+    return refuse("allowCommands", `'${label}' is not in allowCommands`);
+  }
+  const pathProblem = unsafePathReason(input.spec.url);
+  if (pathProblem !== void 0) return refuse("request-path", pathProblem);
+  const move = moveTarget(input.spec) ?? purgeTarget(input.spec);
+  if (move === void 0) return { policyPath: path, allowed: true };
+  const { destination, messageId } = move;
+  if (destination === "") return refuse("purge", "purge request could not determine destination");
+  const allowedDestinations = policy.move?.allowedDestinations;
+  if (allowedDestinations !== void 0 && !allowedDestinations.some((d) => sameFolder(d, destination))) {
+    return refuse(
+      "move.allowedDestinations",
+      `destination '${destination}' is not in move.allowedDestinations`
+    );
+  }
+  const deny = policy.move?.denySenders;
+  if (deny === void 0 || !deny.destinations.some((d) => sameFolder(d, destination))) {
+    return { policyPath: path, allowed: true };
+  }
+  const now = input.now ?? Date.now;
+  const listFile = resolve(dirname2(path), deny.file);
+  const list = await loadDenyList(listFile, deny.maxAgeHours, now());
+  if (!list.ok) return refuse("move.denySenders", `${list.reason}; moves to '${destination}' are refused`);
+  if (messageId === void 0) {
+    return refuse("move.denySenders", "cannot identify the message, so its sender cannot be checked");
+  }
+  if (input.dryRun) return { policyPath: path, allowed: true, senderCheck: "skipped-dry-run" };
+  const sender = (await input.lookupSender(messageId))?.trim().toLowerCase();
+  if (!sender) return refuse("move.denySenders", "the message has no sender address to check");
+  if (list.value.has(sender)) {
+    return refuse("move.denySenders", `sender ${sender} is on the deny list for '${destination}'`);
+  }
+  return { policyPath: path, allowed: true, senderCheck: "passed" };
+}
+async function verdictFor(ctx, spec) {
+  return evaluatePolicy({
+    env: ctx.env,
+    command: ctx.command,
+    subcommand: ctx.args.positionals[0],
+    spec,
+    dryRun: ctx.dryRun,
+    lookupSender: async (messageId) => {
+      const message = await ctx.client.get(
+        `/me/messages/${messageId}`,
+        { $select: "from" }
+      );
+      return message?.from?.emailAddress?.address;
+    }
+  });
+}
+async function enforcePolicy(ctx, spec) {
+  const verdict = await verdictFor(ctx, spec);
+  if (verdict === void 0 || verdict.allowed) return;
+  const rule = verdict.rule ?? "policy";
+  const reason = verdict.reason ?? "refused";
+  if (ctx.json) {
+    ctx.out(
+      JSON.stringify(
+        { error: { code: "PolicyRefused", rule, message: reason, policy: verdict.policyPath } },
+        null,
+        2
+      )
+    );
+  }
+  throw new PolicyRefusedError(rule, reason);
+}
+async function dryRunVerdict(ctx, spec) {
+  return verdictFor({ ...ctx, dryRun: true }, spec);
+}
+function renderVerdict(verdict) {
+  const head = `Policy (${verdict.policyPath}):`;
+  if (!verdict.allowed) return `${head} would REFUSE (${verdict.rule}): ${verdict.reason}`;
+  if (verdict.senderCheck === "skipped-dry-run") {
+    return `${head} would ALLOW unless the message's sender is on the deny list (the sender lookup is a network call, so --dry-run skipped it).`;
+  }
+  return `${head} would ALLOW this request.`;
+}
+
+// src/command.ts
+async function guardMutation(ctx, spec, exec) {
+  if (ctx.dryRun) {
+    const verdict = await dryRunVerdict(ctx, spec);
+    if (ctx.json) {
+      ctx.out(
+        JSON.stringify(
+          {
+            dryRun: true,
+            request: redactSpecForJson(spec),
+            ...verdict === void 0 ? {} : { policy: verdictJson(verdict) }
+          },
+          null,
+          2
+        )
+      );
+    } else {
+      ctx.out("DRY RUN \u2014 nothing was sent. The request below is what would go out:");
+      ctx.out("");
+      ctx.out(renderRequest(spec));
+      if (verdict !== void 0) {
+        ctx.out("");
+        ctx.out(renderVerdict(verdict));
+      }
+    }
+    return void 0;
+  }
+  await assertWriteScope(ctx, spec);
+  await enforcePolicy(ctx, spec);
+  return exec();
+}
+function verdictJson(verdict) {
+  return {
+    path: verdict.policyPath,
+    allowed: verdict.allowed,
+    ...verdict.rule === void 0 ? {} : { rule: verdict.rule },
+    ...verdict.reason === void 0 ? {} : { reason: verdict.reason },
+    ...verdict.senderCheck === void 0 ? {} : { senderCheck: verdict.senderCheck }
+  };
+}
+async function assertWriteScope(ctx, spec) {
+  const status = await ctx.auth.status();
+  if (!status.signedIn || status.mode !== "readonly") return;
+  throw new InsufficientScopeError(`${spec.method} ${spec.url}`);
+}
+function redactSpecForJson(spec) {
+  const { method, url, body } = spec;
+  return {
+    method,
+    url,
+    ...body === void 0 ? {} : { body: redactObject(body) }
+  };
+}
+function emit(ctx, data, human) {
+  ctx.out(ctx.json ? JSON.stringify(data, null, 2) : human());
+}
+
+// src/mime.ts
+import { readFile as readFile3, stat as stat2 } from "fs/promises";
+import { basename, extname } from "path";
+var MAX_INLINE_ATTACHMENT_BYTES = 3 * 1024 * 1024;
+var CONTENT_TYPES = {
+  ".pdf": "application/pdf",
+  ".png": "image/png",
+  ".jpg": "image/jpeg",
+  ".jpeg": "image/jpeg",
+  ".gif": "image/gif",
+  ".txt": "text/plain",
+  ".md": "text/markdown",
+  ".csv": "text/csv",
+  ".json": "application/json",
+  ".zip": "application/zip",
+  ".docx": "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+  ".xlsx": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+  ".pptx": "application/vnd.openxmlformats-officedocument.presentationml.presentation",
+  ".html": "text/html",
+  ".htm": "text/html"
+};
+var DEFAULT_CONTENT_TYPE = "application/octet-stream";
+function guessContentType(filename) {
+  const ext = extname(filename).toLowerCase();
+  return CONTENT_TYPES[ext] ?? DEFAULT_CONTENT_TYPE;
+}
+function formatBytes(n) {
+  const mb = n / (1024 * 1024);
+  return `${mb.toFixed(2)} MB (${n} bytes)`;
+}
+async function readFileAttachment(path) {
+  const stats = await stat2(path);
+  if (stats.size > MAX_INLINE_ATTACHMENT_BYTES) {
+    throw new OutlookCliError(
+      `Attachment "${path}" is ${formatBytes(stats.size)}, which exceeds the 3 MB inline-attachment limit. Files between 3 MB and 150 MB require a Graph upload session (createUploadSession), which this CLI does not yet support. Choose a smaller file or split the content.`
+    );
+  }
+  const buf = await readFile3(path);
+  const name = basename(path);
+  return {
+    "@odata.type": "#microsoft.graph.fileAttachment",
+    name,
+    contentType: guessContentType(name),
+    contentBytes: buf.toString("base64")
+  };
+}
+var HTML_ENTITIES = {
+  "&amp;": "&",
+  "&lt;": "<",
+  "&gt;": ">",
+  "&quot;": '"',
+  "&#39;": "'",
+  "&nbsp;": " "
+};
+var ENTITY_RE = /&(?:amp|lt|gt|quot|#39|nbsp);/g;
+function htmlToText(html) {
+  if (!html) return "";
+  let text = html.replace(/<script[^>]*>[\s\S]*?<\/script>/gi, "").replace(/<style[^>]*>[\s\S]*?<\/style>/gi, "");
+  text = text.replace(/<br\s*\/?>/gi, "\n").replace(/<\/p\s*>/gi, "\n\n").replace(/<\/(div|tr|li|h[1-6])\s*>/gi, "\n").replace(/<[^>]+>/g, "");
+  text = text.replace(ENTITY_RE, (m) => HTML_ENTITIES[m] ?? m);
+  text = text.split("\n").map((line) => line.replace(/[ \t]+$/, "")).join("\n").replace(/\n{3,}/g, "\n\n").trim();
+  return text;
+}
+
+// src/output.ts
+var DATE_WIDTH = 20;
+var FROM_WIDTH = 24;
+var SUBJECT_WIDTH = 40;
+function recipientLabel(recipient) {
+  const address = recipient?.emailAddress?.address;
+  if (!address) return void 0;
+  const name = recipient.emailAddress.name;
+  return name ? `${name} <${address}>` : address;
+}
+function formatRecipients(recipients) {
+  if (!recipients || recipients.length === 0) return "(none)";
+  return recipients.map((r) => recipientLabel(r) ?? "(unknown)").join(", ");
+}
+function pad2(n) {
+  return n.toString().padStart(2, "0");
+}
+function formatDate(iso) {
+  if (!iso) return "(no date)";
+  const d = new Date(iso);
+  if (Number.isNaN(d.getTime())) return "(no date)";
+  const y = d.getUTCFullYear();
+  const mo = pad2(d.getUTCMonth() + 1);
+  const day = pad2(d.getUTCDate());
+  const h = pad2(d.getUTCHours());
+  const mi = pad2(d.getUTCMinutes());
+  return `${y}-${mo}-${day} ${h}:${mi} UTC`;
+}
+function truncate(text, max) {
+  if (max <= 0) return "";
+  if (text.length <= max) return text;
+  if (max === 1) return text.slice(0, 1);
+  return `${text.slice(0, max - 1)}\u2026`;
+}
+function subjectOf(message) {
+  return message.subject && message.subject.trim().length > 0 ? message.subject : "(no subject)";
+}
+function fromOf(message) {
+  return recipientLabel(message.from ?? message.sender) ?? "(unknown sender)";
+}
+function renderMessageList(messages) {
+  if (messages.length === 0) return "(no messages)";
+  const header = [
+    " ".padEnd(1),
+    "DATE".padEnd(DATE_WIDTH),
+    "FROM".padEnd(FROM_WIDTH),
+    "SUBJECT".padEnd(SUBJECT_WIDTH),
+    " ".padEnd(1),
+    "ID"
+  ].join(" ");
+  const rows = messages.map((m) => {
+    const unread = m.isRead === false ? "*" : " ";
+    const attach = m.hasAttachments ? "@" : " ";
+    const date = formatDate(m.receivedDateTime ?? m.sentDateTime);
+    const from = truncate(fromOf(m), FROM_WIDTH);
+    const subject = truncate(subjectOf(m), SUBJECT_WIDTH);
+    return [
+      unread,
+      date.padEnd(DATE_WIDTH),
+      from.padEnd(FROM_WIDTH),
+      subject.padEnd(SUBJECT_WIDTH),
+      attach,
+      m.id
+    ].join(" ");
+  });
+  return [header, ...rows].join("\n");
+}
+function readState(message) {
+  if (message.isRead === false) return "no";
+  if (message.isRead === true) return "yes";
+  return "unknown";
+}
+function renderBody(message, opts) {
+  const body = message.body;
+  if (!body || !body.content) {
+    return message.bodyPreview && message.bodyPreview.trim().length > 0 ? message.bodyPreview : "(no body)";
+  }
+  if (body.contentType === "html") {
+    return opts?.html ? body.content : htmlToText(body.content);
+  }
+  return body.content;
+}
+function renderMessage(message, opts) {
+  const lines = [
+    `Subject: ${subjectOf(message)}`,
+    `From: ${fromOf(message)}`,
+    `To: ${formatRecipients(message.toRecipients)}`
+  ];
+  if (message.ccRecipients && message.ccRecipients.length > 0) {
+    lines.push(`Cc: ${formatRecipients(message.ccRecipients)}`);
+  }
+  lines.push(
+    `Date: ${formatDate(message.receivedDateTime ?? message.sentDateTime)}`,
+    `Importance: ${message.importance ?? "normal"}`,
+    `Read: ${readState(message)}`,
+    `Attachments: ${message.hasAttachments ? "yes" : "no"}`,
+    `Id: ${message.id}`,
+    "",
+    renderBody(message, opts)
+  );
+  return lines.join("\n");
+}
+function renderFolders(folders) {
+  if (folders.length === 0) return "(no folders)";
+  return folders.map((f) => {
+    const name = f.displayName && f.displayName.trim() ? f.displayName : "(unnamed folder)";
+    const counts = [];
+    if (f.unreadItemCount !== void 0) counts.push(`${f.unreadItemCount} unread`);
+    if (f.totalItemCount !== void 0) counts.push(`${f.totalItemCount} total`);
+    const suffix = counts.length > 0 ? ` (${counts.join(", ")})` : "";
+    return `${name}${suffix} \u2014 ${f.id}`;
+  }).join("\n");
+}
+function attachmentKind(odataType) {
+  if (!odataType) return "unknown";
+  const normalized = odataType.replace(/^#/, "");
+  switch (normalized) {
+    case "microsoft.graph.fileAttachment":
+      return "file";
+    case "microsoft.graph.itemAttachment":
+      return "item";
+    case "microsoft.graph.referenceAttachment":
+      return "reference";
+    default:
+      return normalized;
+  }
+}
+function formatSize(bytes) {
+  if (bytes < 1024) return `${bytes} B`;
+  if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)} KB`;
+  return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
+}
+function renderAttachments(attachments) {
+  if (attachments.length === 0) return "(no attachments)";
+  return attachments.map((a) => {
+    const name = a.name && a.name.trim() ? a.name : "(unnamed attachment)";
+    const kind = attachmentKind(a["@odata.type"]);
+    const size = a.size !== void 0 ? formatSize(a.size) : "(unknown size)";
+    const inline = a.isInline ? " [inline]" : "";
+    return `${name} \u2014 ${kind}, ${size}${inline} \u2014 ${a.id}`;
+  }).join("\n");
+}
+function renderProfile(profile) {
+  const lines = [
+    `Name: ${profile.displayName ?? "(unknown)"}`,
+    `Mail: ${profile.mail ?? profile.userPrincipalName ?? "(none)"}`
+  ];
+  if (profile.jobTitle) lines.push(`Job title: ${profile.jobTitle}`);
+  lines.push(`Id: ${profile.id}`);
+  return lines.join("\n");
+}
+var NAME_WIDTH = 24;
+var PHONE_WIDTH = 18;
+var EMAIL_WIDTH = 28;
+var COMPANY_WIDTH = 20;
+function primaryPhone(contact) {
+  if (contact.mobilePhone) return contact.mobilePhone;
+  if (contact.businessPhones && contact.businessPhones.length > 0) return contact.businessPhones[0];
+  if (contact.homePhones && contact.homePhones.length > 0) return contact.homePhones[0];
+  return "";
+}
+function primaryEmail(contact) {
+  if (contact.emailAddresses && contact.emailAddresses.length > 0) {
+    return contact.emailAddresses[0].address ?? "";
+  }
+  return "";
+}
+function renderContactList(contacts) {
+  if (contacts.length === 0) return "(no contacts)";
+  const header = [
+    "NAME".padEnd(NAME_WIDTH),
+    "PHONE".padEnd(PHONE_WIDTH),
+    "EMAIL".padEnd(EMAIL_WIDTH),
+    "COMPANY".padEnd(COMPANY_WIDTH),
+    "ID"
+  ].join(" ");
+  const rows = contacts.map((c) => {
+    const name = truncate(c.displayName ?? "(unnamed)", NAME_WIDTH);
+    const phone = truncate(primaryPhone(c), PHONE_WIDTH);
+    const email = truncate(primaryEmail(c), EMAIL_WIDTH);
+    const company = truncate(c.companyName ?? "", COMPANY_WIDTH);
+    return [
+      name.padEnd(NAME_WIDTH),
+      phone.padEnd(PHONE_WIDTH),
+      email.padEnd(EMAIL_WIDTH),
+      company.padEnd(COMPANY_WIDTH),
+      c.id
+    ].join(" ");
+  });
+  return [header, ...rows].join("\n");
+}
+function allPhones(contact) {
+  const parts = [];
+  if (contact.mobilePhone) parts.push(`${contact.mobilePhone} (mobile)`);
+  if (contact.businessPhones) {
+    for (const p of contact.businessPhones) parts.push(`${p} (business)`);
+  }
+  if (contact.homePhones) {
+    for (const p of contact.homePhones) parts.push(`${p} (home)`);
+  }
+  return parts.length > 0 ? parts.join(", ") : "(none)";
+}
+function allEmails(contact) {
+  if (!contact.emailAddresses || contact.emailAddresses.length === 0) return "(none)";
+  return contact.emailAddresses.map((e) => {
+    const addr = e.address ?? "(unknown)";
+    return e.name ? `${e.name} <${addr}>` : addr;
+  }).join(", ");
+}
+function renderContact(contact) {
+  const lines = [
+    `Name: ${contact.displayName ?? "(unnamed)"}`,
+    `Email: ${allEmails(contact)}`,
+    `Phone: ${allPhones(contact)}`
+  ];
+  if (contact.companyName) lines.push(`Company: ${contact.companyName}`);
+  if (contact.jobTitle) lines.push(`Job title: ${contact.jobTitle}`);
+  if (contact.department) lines.push(`Department: ${contact.department}`);
+  if (contact.personalNotes) lines.push(`Notes: ${contact.personalNotes}`);
+  lines.push(`Id: ${contact.id}`);
+  return lines.join("\n");
+}
+
+// src/paginate.ts
+async function* pageItems(client, path, query) {
+  const seen = /* @__PURE__ */ new Set();
+  let url = path;
+  let urlQuery = query;
+  while (url !== void 0) {
+    if (seen.has(url)) {
+      return;
+    }
+    seen.add(url);
+    const spec = client.buildSpec("GET", url, void 0, urlQuery);
+    const page = await client.request(spec);
+    for (const item of page.value) {
+      yield item;
+    }
+    url = page["@odata.nextLink"];
+    urlQuery = void 0;
+  }
+}
+async function collectItems(client, path, opts) {
+  const { query, limit, all } = opts ?? {};
+  if (limit === void 0 && !all) {
+    const spec = client.buildSpec("GET", path, void 0, query);
+    const page = await client.request(spec);
+    return [...page.value];
+  }
+  const results = [];
+  for await (const item of pageItems(client, path, query)) {
+    results.push(item);
+    if (limit !== void 0 && results.length >= limit) break;
+  }
+  return results;
+}
+
+// src/safeFilename.ts
+var ILLEGAL_CHARS_RE = /[<>:"|?*\u0000-\u001f]/g;
+var RESERVED_NAMES = /* @__PURE__ */ new Set([
+  "con",
+  "prn",
+  "aux",
+  "nul",
+  ...Array.from({ length: 9 }, (_, i) => `com${i + 1}`),
+  ...Array.from({ length: 9 }, (_, i) => `lpt${i + 1}`)
+]);
+var MAX_COMPONENT_LENGTH = 180;
+function stem(name) {
+  const dot = name.indexOf(".");
+  return dot === -1 ? name : name.slice(0, dot);
+}
+function sanitizeFilename(name, fallback) {
+  let out = name.replace(ILLEGAL_CHARS_RE, "_");
+  out = out.replace(/[. ]+$/, "");
+  out = out.trim();
+  if (out === "" || out === "." || out === "..") return fallback;
+  if (RESERVED_NAMES.has(stem(out).toLowerCase())) {
+    out = `_${out}`;
+  }
+  if (out.length > MAX_COMPONENT_LENGTH) {
+    const lastDot = out.lastIndexOf(".");
+    const ext = lastDot > 0 ? out.slice(lastDot, lastDot + 16) : "";
+    out = out.slice(0, MAX_COMPONENT_LENGTH - ext.length) + ext;
+  }
+  out = out.replace(/[. ]+$/, "");
+  return out === "" ? fallback : out;
+}
+
+// src/commands/attachments.ts
+function withoutContent(a) {
+  const { contentBytes: _omitted, ...rest } = a;
+  return rest;
+}
+var FILE_TYPE = "microsoft.graph.fileAttachment";
+function normalizedType(a) {
+  return (a["@odata.type"] ?? "").replace(/^#/, "");
+}
+function isFileAttachment(a) {
+  return normalizedType(a) === FILE_TYPE;
+}
+function kindLabel(a) {
+  const t = normalizedType(a);
+  return t.startsWith("microsoft.graph.") ? t.slice("microsoft.graph.".length) : t || "unknown";
+}
+async function fetchAttachments(ctx, messageId) {
+  const path = `/me/messages/${encodeURIComponent(messageId)}/attachments`;
+  return collectItems(ctx.client, path, { all: true });
+}
+async function listHandler(ctx, idIndex) {
+  const messageId = ctx.args.requirePositional(idIndex, "<messageId>");
+  const attachments = await fetchAttachments(ctx, messageId);
+  emit(ctx, attachments.map(withoutContent), () => renderAttachments(attachments));
+}
+function safeDestination(outDir, attachment) {
+  const fallback = `attachment-${attachment.id}`;
+  const raw = attachment.name && attachment.name.trim() ? attachment.name : fallback;
+  const base = basename2(raw.replace(/\\/g, "/"));
+  const name = sanitizeFilename(base, fallback);
+  const dest = resolve2(outDir, name);
+  const rel = relative(outDir, dest);
+  if (rel === ".." || rel.startsWith(`..${sep}`) || isAbsolute(rel)) {
+    throw new UsageError(`Refusing to write outside --out directory: "${attachment.name}"`);
+  }
+  return dest;
+}
+function allocateDestinations(outDir, attachments) {
+  const claimed = /* @__PURE__ */ new Set();
+  return attachments.map((attachment) => claim(safeDestination(outDir, attachment), claimed));
+}
+function claim(dest, claimed) {
+  const key = (p) => p.toLowerCase();
+  if (!claimed.has(key(dest))) {
+    claimed.add(key(dest));
+    return dest;
+  }
+  const dir = dirname3(dest);
+  const base = basename2(dest);
+  const dot = base.lastIndexOf(".");
+  const stem2 = dot > 0 ? base.slice(0, dot) : base;
+  const ext = dot > 0 ? base.slice(dot) : "";
+  for (let n = 2; ; n++) {
+    const candidate = join4(dir, `${stem2} (${n})${ext}`);
+    if (!claimed.has(key(candidate))) {
+      claimed.add(key(candidate));
+      return candidate;
+    }
+  }
+}
+async function exists(p) {
+  try {
+    await access(p);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function downloadOne(dest, attachment, force) {
+  if (!isFileAttachment(attachment)) {
+    throw new UsageError(
+      `Cannot download "${attachment.name}" \u2014 ${kindLabel(attachment)} has no downloadable bytes (docs/01 \xA77.4)`
+    );
+  }
+  if (!force && await exists(dest)) {
+    throw new UsageError(`Refusing to overwrite existing file: ${dest} (pass --force)`);
+  }
+  const buf = Buffer.from(attachment.contentBytes ?? "", "base64");
+  await writeFile2(dest, buf);
+  return { id: attachment.id, name: attachment.name, path: dest, size: buf.length };
+}
+async function downloadHandler(ctx) {
+  const messageId = ctx.args.requirePositional(1, "<messageId>");
+  const attachmentId = ctx.args.positionals[2];
+  const all = ctx.args.bool("all");
+  const force = ctx.args.bool("force");
+  const outDir = resolve2(ctx.args.str("out", process.cwd()) ?? process.cwd());
+  if (!all && !attachmentId) {
+    throw new UsageError("outlook attachments download requires [attachmentId] or --all");
+  }
+  const attachments = await fetchAttachments(ctx, messageId);
+  const targets = all ? attachments : attachments.filter((a) => a.id === attachmentId);
+  if (!all && targets.length === 0) {
+    throw new UsageError(`No attachment with id "${attachmentId}" on message ${messageId}`);
+  }
+  const destinations = allocateDestinations(outDir, targets);
+  if (ctx.dryRun) {
+    const planned = targets.map((a, i) => ({
+      id: a.id,
+      name: a.name,
+      path: destinations[i]
+    }));
+    emit(
+      ctx,
+      { dryRun: true, wouldWrite: planned },
+      () => [
+        "DRY RUN \u2014 nothing was written. These files would be created:",
+        "",
+        ...planned.length === 0 ? ["(nothing to download)"] : planned.map((p) => `  ${p.path}`)
+      ].join("\n")
+    );
+    return;
+  }
+  await mkdir2(outDir, { recursive: true });
+  const results = [];
+  for (const [i, attachment] of targets.entries()) {
+    results.push(await downloadOne(destinations[i], attachment, force));
+  }
+  emit(
+    ctx,
+    results,
+    () => results.length === 0 ? "(nothing to download)" : results.map((r) => `${r.name} -> ${r.path} (${r.size} bytes)`).join("\n")
+  );
+}
+async function attachmentsHandler(ctx) {
+  const sub = ctx.args.positionals[0];
+  if (sub === "download") return downloadHandler(ctx);
+  if (sub === "list") return listHandler(ctx, 1);
+  return listHandler(ctx, 0);
+}
+var attachmentsCommand = {
+  name: "attachments",
+  summary: "List or download the attachments on a message",
+  usage: "outlook attachments [list|download] <messageId> [attachmentId] [--all] [--out dir] [--force] [--dry-run] [--json]",
+  mutating: true,
+  handler: attachmentsHandler
+};
+
+// src/commands/auth.ts
+var SUBCOMMANDS = ["login", "status", "logout", "refresh"];
+function renderFacts(facts) {
+  const lines = [`Signed in: ${facts.signedIn ? "yes" : "no"}`];
+  if (facts.expired !== void 0) lines.push(`Expired: ${facts.expired ? "yes" : "no"}`);
+  if (facts.account) lines.push(`Account: ${facts.account}`);
+  if (facts.expiresAt !== void 0) lines.push(`Expires: ${new Date(facts.expiresAt).toISOString()}`);
+  if (facts.scopes) lines.push(`Scopes: ${facts.scopes}`);
+  if (facts.grantScopes) lines.push(`Requested scopes (--scopes): ${facts.grantScopes.join(" ")}`);
+  if (facts.mode) {
+    lines.push(
+      `Access: ${facts.mode === "readonly" ? "read-only (cannot send or delete)" : "full read/write"}`
+    );
+  }
+  return lines.join("\n");
+}
+function factsFromTokenSet(tokens) {
+  return {
+    signedIn: true,
+    ...tokens.account !== void 0 ? { account: tokens.account } : {},
+    expiresAt: tokens.expiresAt,
+    ...tokens.scope !== void 0 ? { scopes: tokens.scope } : {},
+    ...tokens.mode !== void 0 ? { mode: tokens.mode } : {},
+    ...tokens.grantScopes !== void 0 ? { grantScopes: tokens.grantScopes } : {}
+  };
+}
+function printDevicePrompt(ctx, device) {
+  ctx.out(
+    device.message ?? `To sign in, open ${device.verification_uri} and enter the code: ${device.user_code}`
+  );
+}
+async function loginHandler(ctx) {
+  const readOnly = ctx.args.bool("readonly");
+  const scopes = scopesFlag(ctx);
+  if (readOnly && scopes !== void 0) {
+    throw new UsageError("--readonly and --scopes cannot be combined; list the read scopes you want in --scopes.");
+  }
+  const tokens = await ctx.auth.login(
+    (device) => printDevicePrompt(ctx, device),
+    { readOnly, ...scopes !== void 0 ? { scopes } : {} }
+  );
+  if (!FILE_MODE_IS_ENFORCED) {
+    ctx.err(
+      "warning: on Windows the token cache cannot be restricted to your user account by file mode alone. Restrict the containing directory with an ACL, or sign in with --readonly to limit what a stolen token can do."
+    );
+  }
+  const facts = factsFromTokenSet(tokens);
+  emit(ctx, facts, () => `Signed in.
+${renderFacts(facts)}`);
+}
+async function statusHandler(ctx) {
+  const status = await ctx.auth.status();
+  emit(ctx, status, () => renderFacts(status));
+}
+async function logoutHandler(ctx) {
+  await ctx.auth.logout();
+  emit(ctx, { signedIn: false }, () => "Signed out.");
+}
+async function refreshHandler(ctx) {
+  const tokens = await ctx.auth.refresh();
+  const facts = factsFromTokenSet(tokens);
+  emit(ctx, facts, () => `Token refreshed.
+${renderFacts(facts)}`);
+}
+function scopesFlag(ctx) {
+  if (!ctx.args.has("scopes")) return void 0;
+  const raw = ctx.args.str("scopes");
+  if (raw === void 0) {
+    throw new UsageError("--scopes requires a comma-separated list, e.g. --scopes Mail.ReadWrite");
+  }
+  return parseScopeList(raw);
+}
+async function authHandler(ctx) {
+  const subcommand = ctx.args.positionals[0] ?? "status";
+  if (subcommand !== "login" && ctx.args.has("scopes")) {
+    throw new UsageError(
+      '--scopes applies only to "outlook auth login"; refresh reuses the scope set recorded at login.'
+    );
+  }
+  switch (subcommand) {
+    case "login":
+      return loginHandler(ctx);
+    case "status":
+      return statusHandler(ctx);
+    case "logout":
+      return logoutHandler(ctx);
+    case "refresh":
+      return refreshHandler(ctx);
+    default:
+      throw new UsageError(
+        `Unknown "outlook auth" subcommand: "${subcommand}". Valid subcommands: ${SUBCOMMANDS.join(", ")}.`
+      );
+  }
+}
+var authCommand = {
+  name: "auth",
+  summary: "Manage local sign-in: login, status, logout, refresh",
+  usage: "outlook auth [login|status|logout|refresh] [--readonly | --scopes <list>] [--json]\n\n  --readonly  On login: request Mail.Read instead of Mail.ReadWrite and\n              drop Mail.Send, so the stored token cannot send, delete, or\n              modify mail. Recommended for unattended/agent use.\n  --scopes    On login: request exactly these comma-separated scopes\n              (offline_access is added if missing). The set is stored\n              with the token and reused by refresh. Pair with\n              GRAPH_TOKEN_CACHE to keep a narrow token in its own file.",
+  mutating: false,
+  handler: authHandler
+};
+
+// src/commands/contacts.ts
+var SUBCOMMANDS2 = ["list", "get", "search"];
+var DEFAULT_SELECT = "id,displayName,emailAddresses,mobilePhone,businessPhones,homePhones,companyName,jobTitle";
+var DEFAULT_ORDERBY = "displayName asc";
+var MAX_TOP = 1e3;
+function readTop(ctx) {
+  if (!ctx.args.has("top")) return 25;
+  const top = ctx.args.num("top");
+  if (top === void 0 || !Number.isInteger(top) || top < 1 || top > MAX_TOP) {
+    throw new UsageError(`--top must be an integer between 1 and ${MAX_TOP}`);
+  }
+  return top;
+}
+function readLimit(ctx, fallback) {
+  if (!ctx.args.has("limit")) return fallback;
+  const limit = ctx.args.num("limit");
+  if (limit === void 0 || !Number.isInteger(limit) || limit < 1 || limit > MAX_TOP) {
+    throw new UsageError(`--limit must be an integer between 1 and ${MAX_TOP}`);
+  }
+  return limit;
+}
+async function listHandler2(ctx) {
+  const top = readTop(ctx);
+  const all = ctx.args.bool("all");
+  const limit = readLimit(ctx, top);
+  const select = ctx.args.str("select") ?? DEFAULT_SELECT;
+  const query = {
+    $select: select,
+    $orderby: DEFAULT_ORDERBY,
+    $top: top
+  };
+  const filter = ctx.args.str("filter");
+  if (filter) query.$filter = filter;
+  const contacts = await collectItems(ctx.client, "/me/contacts", {
+    query,
+    limit: all ? void 0 : limit,
+    all
+  });
+  emit(ctx, contacts, () => renderContactList(contacts));
+}
+async function getHandler(ctx) {
+  const id = ctx.args.requirePositional(1, "<contactId>");
+  const path = `/me/contacts/${encodeURIComponent(id)}`;
+  const contact = await ctx.client.get(path);
+  emit(ctx, contact, () => renderContact(contact));
+}
+async function searchHandler(ctx) {
+  const query = ctx.args.requirePositional(1, "<query>");
+  const top = readTop(ctx);
+  const escaped = query.replace(/'/g, "''");
+  const filterExpr = `startswith(displayName,'${escaped}')`;
+  const contacts = await collectItems(ctx.client, "/me/contacts", {
+    query: {
+      $select: DEFAULT_SELECT,
+      $filter: filterExpr,
+      $top: top
+    },
+    limit: top
+  });
+  emit(ctx, contacts, () => renderContactList(contacts));
+}
+async function contactsHandler(ctx) {
+  const subcommand = ctx.args.positionals[0] ?? "list";
+  switch (subcommand) {
+    case "list":
+      return listHandler2(ctx);
+    case "get":
+      return getHandler(ctx);
+    case "search":
+      return searchHandler(ctx);
+    default:
+      throw new UsageError(
+        `Unknown "outlook contacts" subcommand: "${subcommand}". Valid subcommands: ${SUBCOMMANDS2.join(", ")}.`
+      );
+  }
+}
+var contactsCommand = {
+  name: "contacts",
+  summary: "List, get, or search contacts (read-only)",
+  usage: "outlook contacts [list|get|search] [<id|query>] [--top <n>] [--all] [--limit <n>] [--select <fields>] [--filter <expr>] [--json]",
+  mutating: false,
+  handler: contactsHandler
+};
+
+// src/signature.ts
+import { readFile as readFile4 } from "fs/promises";
+var SIGNATURE_TEXT_ENV = "OUTLOOK_SIGNATURE_FILE";
+var SIGNATURE_HTML_ENV = "OUTLOOK_SIGNATURE_HTML_FILE";
+var TEXT_DELIMITER = "-- ";
+function trimmed2(value) {
+  const t = value?.trim();
+  return t ? t : void 0;
+}
+function isHtmlPath(path) {
+  return /\.html?$/i.test(path);
+}
+async function readSignatureFile(path, origin) {
+  try {
+    const content = await readFile4(path, "utf8");
+    if (content.trim() === "") {
+      throw new UsageError(
+        `Signature file ${path} (from ${origin}) is empty. Add content, or pass --no-signature to send without one.`
+      );
+    }
+    return content;
+  } catch (e) {
+    if (e instanceof UsageError) throw e;
+    const reason = e instanceof Error ? e.message : String(e);
+    throw new UsageError(
+      `Could not read signature file ${path} (from ${origin}): ${reason}
+Fix the path, or pass --no-signature to send without one.`
+    );
+  }
+}
+async function resolveSignature(args, env = {}) {
+  if (args.has("signature")) {
+    const path = args.str("signature");
+    if (path === void 0) {
+      if (!args.bool("signature")) return void 0;
+      throw new UsageError(
+        "--signature needs a file path (e.g. --signature ~/sig.txt). Use --no-signature to send without one."
+      );
+    }
+    if (path.trim() === "" || /^(false|0|no|off)$/i.test(path.trim())) {
+      return void 0;
+    }
+    const content = await readSignatureFile(path, "--signature");
+    return isHtmlPath(path) ? { html: content } : { text: content };
+  }
+  const textPath = trimmed2(env[SIGNATURE_TEXT_ENV]);
+  const htmlPath = trimmed2(env[SIGNATURE_HTML_ENV]);
+  if (textPath === void 0 && htmlPath === void 0) return void 0;
+  const sig = {};
+  if (textPath !== void 0) {
+    sig.text = await readSignatureFile(textPath, SIGNATURE_TEXT_ENV);
+  }
+  if (htmlPath !== void 0) {
+    sig.html = await readSignatureFile(htmlPath, SIGNATURE_HTML_ENV);
+  }
+  return sig;
+}
+function signatureFlagRequested(args) {
+  if (!args.has("signature")) return false;
+  const v = args.str("signature");
+  if (v === void 0) return args.bool("signature");
+  return !(v.trim() === "" || /^(false|0|no|off)$/i.test(v.trim()));
+}
+function escapeHtml(s) {
+  return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+}
+function appendTextSignature(content, sig) {
+  if (sig.text === void 0) {
+    throw new UsageError(
+      `Only an HTML signature is configured, but this message body is plain text. Set ${SIGNATURE_TEXT_ENV}, pass --html (send/draft), or pass --no-signature.`
+    );
+  }
+  const head = content.trimEnd();
+  const tail = `${TEXT_DELIMITER}
+${sig.text.trimEnd()}`;
+  return head === "" ? tail : `${head}
+
+${tail}`;
+}
+function appendHtmlSignature(content, sig) {
+  const html = sig.html?.trim() ?? escapeHtml((sig.text ?? "").trimEnd()).replace(/\r?\n/g, "<br>");
+  const block = `<br><div class="outlook-cli-signature">${html}</div>`;
+  const matches = [...content.matchAll(/<\/body>/gi)];
+  const last = matches[matches.length - 1];
+  if (last?.index === void 0) return `${content}${block}`;
+  return `${content.slice(0, last.index)}${block}${content.slice(last.index)}`;
+}
+function applySignature(body, sig) {
+  const content = body.contentType.toLowerCase() === "html" ? appendHtmlSignature(body.content, sig) : appendTextSignature(body.content, sig);
+  return { contentType: body.contentType, content };
+}
+
+// src/commands/compose.ts
+import { readFile as readFile5 } from "fs/promises";
+function parseRecipients(values, flag) {
+  const out = [];
+  for (const value of values) {
+    for (const part of value.split(",")) {
+      const address = part.trim();
+      if (address.length === 0) continue;
+      if (!address.includes("@")) {
+        throw new UsageError(
+          `--${flag} received "${address}", which is not an email address.`
+        );
+      }
+      out.push({ emailAddress: { address } });
+    }
+  }
+  return out;
+}
+function recipientsFromArgs(args, flag) {
+  return parseRecipients(args.strAll(flag), flag);
+}
+async function buildBody(args) {
+  const inline = args.str("body");
+  const file = args.str("body-file");
+  if (inline !== void 0 && file !== void 0) {
+    throw new UsageError("Use either --body or --body-file, not both.");
+  }
+  const content = file !== void 0 ? await readFile5(file, "utf8") : inline;
+  if (content === void 0) return void 0;
+  const contentType = args.bool("html") ? "html" : "text";
+  return { contentType, content };
+}
+async function loadAttachments(args) {
+  const out = [];
+  for (const path of args.strAll("attach")) {
+    out.push(await readFileAttachment(path));
+  }
+  return out;
+}
+async function composeMessage(args) {
+  const message = {};
+  const subject = args.str("subject");
+  if (subject !== void 0) message.subject = subject;
+  const body = await buildBody(args);
+  if (body !== void 0) message.body = body;
+  const to = recipientsFromArgs(args, "to");
+  if (to.length > 0) message.toRecipients = to;
+  const cc = recipientsFromArgs(args, "cc");
+  if (cc.length > 0) message.ccRecipients = cc;
+  const bcc = recipientsFromArgs(args, "bcc");
+  if (bcc.length > 0) message.bccRecipients = bcc;
+  const attachments = await loadAttachments(args);
+  if (attachments.length > 0) message.attachments = attachments;
+  return message;
+}
+function signMessage(message, signature, args) {
+  if (signature === void 0 || Object.keys(message).length === 0) return;
+  const base = message.body ?? {
+    contentType: args.bool("html") ? "html" : "text",
+    content: ""
+  };
+  message.body = applySignature(base, signature);
+}
+function saveToSentItems(args) {
+  return args.has("save-sent") ? args.bool("save-sent") : true;
+}
+function describeRecipients(recipients) {
+  if (!recipients || recipients.length === 0) return "(none)";
+  return recipients.map((r) => r.emailAddress.address).join(", ");
+}
+
+// src/commands/draft.ts
+var DRAFTS_PATH = "/me/mailFolders/drafts/messages";
+var SUBCOMMANDS3 = ["list", "create", "update", "send"];
+async function listDrafts(ctx) {
+  const limit = ctx.args.num("limit");
+  const messages = await collectItems(ctx.client, DRAFTS_PATH, {
+    query: {
+      $select: "id,subject,toRecipients,lastModifiedDateTime,isDraft",
+      $orderby: "lastModifiedDateTime desc"
+    },
+    ...limit === void 0 ? {} : { limit },
+    ...ctx.args.bool("all") ? { all: true } : {}
+  });
+  emit(ctx, messages, () => renderMessageList(messages));
+}
+async function createDraft(ctx) {
+  const message = await composeMessage(ctx.args);
+  if (Object.keys(message).length === 0) {
+    throw new UsageError(
+      "Nothing to create. Provide at least --subject, --body or --to."
+    );
+  }
+  const signature = await resolveSignature(ctx.args, ctx.env);
+  signMessage(message, signature, ctx.args);
+  const spec = ctx.client.buildSpec("POST", "/me/messages", message);
+  const created = await guardMutation(
+    ctx,
+    spec,
+    () => ctx.client.post("/me/messages", message)
+  );
+  if (created === void 0) return;
+  emit(
+    ctx,
+    { ...created, signatureApplied: signature !== void 0 },
+    () => `Draft created: ${created.id}
+Send it with:  outlook draft send ${created.id}`
+  );
+}
+async function updateDraft(ctx) {
+  const id = ctx.args.requirePositional(1, "<draftId>");
+  if (signatureFlagRequested(ctx.args)) {
+    throw new UsageError(
+      "draft update never adds a signature (it would duplicate the one added at create time). Include it in --body yourself if you need it."
+    );
+  }
+  const message = await composeMessage(ctx.args);
+  if (Object.keys(message).length === 0) {
+    throw new UsageError(
+      "Nothing to update. Provide at least one of --subject, --body, --to, --cc, --bcc."
+    );
+  }
+  const path = `/me/messages/${encodeURIComponent(id)}`;
+  const spec = ctx.client.buildSpec("PATCH", path, message);
+  const updated = await guardMutation(
+    ctx,
+    spec,
+    () => ctx.client.patch(path, message)
+  );
+  if (updated === void 0) return;
+  emit(ctx, updated, () => `Draft ${id} updated.`);
+}
+async function sendDraft(ctx) {
+  const id = ctx.args.requirePositional(1, "<draftId>");
+  const path = `/me/messages/${encodeURIComponent(id)}/send`;
+  const spec = ctx.client.buildSpec("POST", path, void 0);
+  const sent = await guardMutation(ctx, spec, async () => {
+    await ctx.client.post(path);
+    return true;
+  });
+  if (sent === void 0) return;
+  emit(ctx, { sent: true, draftId: id }, () => `Draft ${id} sent.`);
+}
+var draftCommand = {
+  name: "draft",
+  summary: "Create, update, list and send drafts",
+  usage: "outlook draft list [--limit N] [--all] [--json]\n  outlook draft create --subject <s> [--to <addr>...] [--body <text>] [--html] [--attach <path>...] [--dry-run]\n  outlook draft update <draftId> [--subject <s>] [--body <text>] [--to <addr>...] [--dry-run]\n  outlook draft send <draftId> [--dry-run]",
+  mutating: true,
+  async handler(ctx) {
+    const sub = ctx.args.positionals[0];
+    switch (sub) {
+      case "list":
+        return listDrafts(ctx);
+      case "create":
+        return createDraft(ctx);
+      case "update":
+        return updateDraft(ctx);
+      case "send":
+        return sendDraft(ctx);
+      default:
+        throw new UsageError(
+          `Unknown draft subcommand${sub ? ` "${sub}"` : ""}. Valid subcommands: ${SUBCOMMANDS3.join(", ")}.`
+        );
+    }
+  }
+};
+
+// src/commands/flags.ts
+function messagePath(id) {
+  return `/me/messages/${encodeURIComponent(id)}`;
+}
+async function patchMessage(ctx, id, body, describe) {
+  const path = messagePath(id);
+  const spec = ctx.client.buildSpec("PATCH", path, body);
+  await guardMutation(ctx, spec, async () => {
+    const updated = await ctx.client.patch(path, body);
+    emit(ctx, { id, message: updated }, () => describe(updated));
+  });
+}
+async function setRead(ctx, isRead) {
+  const id = ctx.args.requirePositional(0, "<id>");
+  await patchMessage(ctx, id, { isRead }, () => `Marked ${id} as ${isRead ? "read" : "unread"}.`);
+}
+var markReadCommand = {
+  name: "mark-read",
+  summary: "Mark a message as read.",
+  usage: "outlook mark-read <id> [--dry-run] [--json]",
+  mutating: true,
+  handler: (ctx) => setRead(ctx, true)
+};
+var markUnreadCommand = {
+  name: "mark-unread",
+  summary: "Mark a message as unread.",
+  usage: "outlook mark-unread <id> [--dry-run] [--json]",
+  mutating: true,
+  handler: (ctx) => setRead(ctx, false)
+};
+async function setFlag(ctx, flagStatus) {
+  const id = ctx.args.requirePositional(0, "<id>");
+  await patchMessage(
+    ctx,
+    id,
+    { flag: { flagStatus } },
+    () => `Set flag on ${id} to "${flagStatus}".`
+  );
+}
+var flagCommand = {
+  name: "flag",
+  summary: "Flag a message for follow-up.",
+  usage: "outlook flag <id> [--dry-run] [--json]",
+  mutating: true,
+  handler: (ctx) => setFlag(ctx, "flagged")
+};
+var unflagCommand = {
+  name: "unflag",
+  summary: "Clear a message's follow-up flag.",
+  usage: "outlook unflag <id> [--dry-run] [--json]",
+  mutating: true,
+  handler: (ctx) => setFlag(ctx, "notFlagged")
+};
+
+// src/commands/folders.ts
+function resolveFolderId(folder) {
+  return isWellKnownFolder(folder) ? folder.toLowerCase() : folder;
+}
+function foldersListPath(parent) {
+  if (parent === void 0) return "/me/mailFolders";
+  return `/me/mailFolders/${encodeURIComponent(resolveFolderId(parent))}/childFolders`;
+}
+async function listHandler3(ctx) {
+  const parent = ctx.args.str("parent");
+  const path = foldersListPath(parent);
+  const opts = ctx.args.bool("all") ? { all: true } : {};
+  const folders = await collectItems(ctx.client, path, opts);
+  emit(ctx, folders, () => renderFolders(folders));
+}
+async function createHandler(ctx) {
+  if (ctx.args.has("parent")) {
+    throw new UsageError(
+      'outlook folders create does not accept --parent: Microsoft Graph only creates mail folders at the mailbox root (docs/02-write-endpoints.md \xA77 \u2014 "folders are always created at root"; parentFolderId is not an accepted request parameter on POST /me/mailFolders).'
+    );
+  }
+  const name = ctx.args.require("name");
+  const body = { displayName: name };
+  const path = "/me/mailFolders";
+  const spec = ctx.client.buildSpec("POST", path, body);
+  const created = await guardMutation(ctx, spec, async () => ctx.client.post(path, body));
+  if (created === void 0) return;
+  emit(ctx, created, () => `Created folder "${created.displayName}" (id: ${created.id})`);
+}
+async function foldersHandler(ctx) {
+  const sub = ctx.args.positionals[0] ?? "list";
+  switch (sub) {
+    case "list":
+      return listHandler3(ctx);
+    case "create":
+      return createHandler(ctx);
+    default:
+      throw new UsageError(`Unknown folders subcommand "${sub}". Expected "list" or "create".`);
+  }
+}
+var foldersCommand = {
+  name: "folders",
+  summary: "List or create mail folders",
+  usage: "outlook folders [list] [--parent <name|id>] [--all] [--json]\n       outlook folders create --name <text> [--dry-run] [--json]",
+  mutating: true,
+  handler: foldersHandler
+};
+
+// src/commands/get.ts
+async function getHandler2(ctx) {
+  const id = ctx.args.requirePositional(0, "<messageId>");
+  const path = `/me/messages/${encodeURIComponent(id)}`;
+  const message = await ctx.client.get(path);
+  emit(ctx, message, () => renderMessage(message, { html: ctx.args.bool("html") }));
+}
+var getCommand = {
+  name: "get",
+  summary: "Fetch and display a single message",
+  usage: "outlook get <messageId> [--html] [--json]",
+  mutating: false,
+  handler: getHandler2
+};
+
+// src/commands/list.ts
+var SELECT = "subject,from,receivedDateTime,isRead,hasAttachments,bodyPreview";
+var ORDERBY = "receivedDateTime desc";
+var MAX_TOP2 = 1e3;
+function folderPath(folder) {
+  const segment = isWellKnownFolder(folder) ? folder.toLowerCase() : encodeURIComponent(folder);
+  return `/me/mailFolders/${segment}/messages`;
+}
+function readLimit2(ctx) {
+  if (!ctx.args.has("limit")) return 25;
+  const limit = ctx.args.num("limit");
+  if (limit === void 0 || !Number.isInteger(limit) || limit < 1 || limit > MAX_TOP2) {
+    throw new UsageError(`--limit must be an integer between 1 and ${MAX_TOP2}`);
+  }
+  return limit;
+}
+async function listHandler4(ctx) {
+  const folder = ctx.args.str("folder", "inbox") ?? "inbox";
+  const limit = readLimit2(ctx);
+  const all = ctx.args.bool("all");
+  const unread = ctx.args.bool("unread");
+  const query = {
+    $select: SELECT,
+    $orderby: ORDERBY,
+    $top: limit
+  };
+  if (unread) query.$filter = "isRead eq false";
+  const messages = await collectItems(ctx.client, folderPath(folder), {
+    query,
+    limit,
+    all
+  });
+  emit(ctx, messages, () => renderMessageList(messages));
+}
+var listCommand = {
+  name: "list",
+  summary: "List messages in a folder, newest first",
+  usage: "outlook list [--folder <name|id>] [--limit <n>] [--all] [--unread] [--json]",
+  mutating: false,
+  handler: listHandler4
+};
+
+// src/commands/me.ts
+var SELECT_FIELDS = "id,displayName,mail,userPrincipalName,jobTitle";
+async function meHandler(ctx) {
+  const profile = await ctx.client.get("/me", { $select: SELECT_FIELDS });
+  emit(ctx, profile, () => renderProfile(profile));
+}
+var meCommand = {
+  name: "me",
+  summary: "Show the signed-in user's profile \u2014 also a quick auth smoke-test",
+  usage: "outlook me [--json]",
+  mutating: false,
+  handler: meHandler
+};
+
+// src/commands/move.ts
+var DELETED_ITEMS = "deleteditems";
+function messagePath2(id) {
+  return `/me/messages/${encodeURIComponent(id)}`;
+}
+function resolveDestinationId(folder) {
+  return isWellKnownFolder(folder) ? folder.toLowerCase() : folder;
+}
+async function moveMessage(ctx, id, destinationId) {
+  const path = `${messagePath2(id)}/move`;
+  const body = { destinationId };
+  const spec = ctx.client.buildSpec("POST", path, body);
+  await guardMutation(ctx, spec, async () => {
+    const moved = await ctx.client.post(path, body);
+    emit(
+      ctx,
+      { movedFrom: id, destinationId, message: moved },
+      () => `Moved message ${id} -> ${destinationId}. New id: ${moved.id} (the old id no longer resolves \u2014 use the new id for anything further).`
+    );
+  });
+}
+async function deleteHandler(ctx) {
+  const id = ctx.args.requirePositional(0, "<id>");
+  await moveMessage(ctx, id, DELETED_ITEMS);
+}
+var deleteCommand = {
+  name: "delete",
+  summary: 'Move a message to Deleted Items (recoverable). The safe default "delete".',
+  usage: "outlook delete <id> [--dry-run] [--json]",
+  mutating: true,
+  handler: deleteHandler
+};
+async function moveHandler(ctx) {
+  const id = ctx.args.requirePositional(0, "<id>");
+  const folder = ctx.args.require("folder");
+  await moveMessage(ctx, id, resolveDestinationId(folder));
+}
+var moveCommand = {
+  name: "move",
+  summary: "Move a message to another folder (well-known name or folder id).",
+  usage: "outlook move <id> --folder <name|id> [--dry-run] [--json]",
+  mutating: true,
+  handler: moveHandler
+};
+async function purgeHandler(ctx) {
+  const id = ctx.args.requirePositional(0, "<id>");
+  if (!ctx.args.bool("yes")) {
+    throw new UsageError(
+      `outlook purge issues a raw DELETE /me/messages/${id}. Microsoft's docs never state whether this is recoverable \u2014 it is treated as permanent. Pass --yes to confirm you understand this, or run \`outlook delete ${id}\` instead, which moves the message to Deleted Items and IS recoverable.`
+    );
+  }
+  const path = messagePath2(id);
+  const spec = ctx.client.buildSpec("DELETE", path);
+  await guardMutation(ctx, spec, async () => {
+    await ctx.client.del(path);
+    emit(
+      ctx,
+      { purged: true, id },
+      () => `Purged message ${id} via raw DELETE. Recoverability is not documented by Microsoft \u2014 treat this as permanent.`
+    );
+  });
+}
+var purgeCommand = {
+  name: "purge",
+  summary: "Permanently delete a message via raw DELETE. Requires --yes.",
+  usage: "outlook purge <id> --yes [--dry-run] [--json]",
+  mutating: true,
+  handler: purgeHandler
+};
+
+// src/commands/replyDraft.ts
+function buildReplyDraftSpecs(client, opts) {
+  const basePath = `/me/messages/${encodeURIComponent(opts.messageId)}`;
+  const createBody = {};
+  if (opts.toRecipients) createBody["toRecipients"] = opts.toRecipients;
+  const createSpec = client.buildSpec("POST", `${basePath}/${opts.action}`, createBody);
+  const patchPreview = buildPatchBody(
+    { contentType: "html", content: "<html><body><!-- Exchange quoted body --></body></html>" },
+    opts.userText,
+    opts.signature
+  );
+  const patchSpec = client.buildSpec("PATCH", "/me/messages/{draftId}", patchPreview);
+  const sendSpec = client.buildSpec("POST", "/me/messages/{draftId}/send", void 0);
+  return { createSpec, patchSpec, sendSpec };
+}
+async function executeReplyDraft(client, opts) {
+  const basePath = `/me/messages/${encodeURIComponent(opts.messageId)}`;
+  const createBody = {};
+  if (opts.toRecipients) createBody["toRecipients"] = opts.toRecipients;
+  const draft = await client.post(
+    `${basePath}/${opts.action}`,
+    createBody
+  );
+  const draftId = draft?.id;
+  if (!draftId) {
+    throw new OutlookCliError(
+      `${opts.action} did not return a draft id. The message may not have been sent.`
+    );
+  }
+  try {
+    const draftFull = await client.get(
+      `/me/messages/${encodeURIComponent(draftId)}`,
+      { $select: "id,body" }
+    );
+    if (!draftFull?.body) {
+      throw new OutlookCliError(
+        "Exchange returned a draft with no body. Cannot patch reply."
+      );
+    }
+    const draftBody = draftFull.body;
+    const patchBody = buildPatchBody(draftBody, opts.userText, opts.signature);
+    await client.patch(
+      `/me/messages/${encodeURIComponent(draftId)}`,
+      patchBody
+    );
+    await client.post(
+      `/me/messages/${encodeURIComponent(draftId)}/send`,
+      void 0
+    );
+  } catch (stepErr) {
+    let cleanupErr;
+    try {
+      await client.del(`/me/messages/${encodeURIComponent(draftId)}`);
+    } catch (e) {
+      cleanupErr = e;
+    }
+    const base = stepErr instanceof Error ? stepErr.message : String(stepErr);
+    if (cleanupErr !== void 0) {
+      const cleanMsg = cleanupErr instanceof Error ? cleanupErr.message : String(cleanupErr);
+      throw new OutlookCliError(
+        `Failed to send reply (${base}). Cleanup also failed (${cleanMsg}). A draft was left behind (ORPHAN) \u2014 run \`outlook draft list\` to find and delete it.`
+      );
+    }
+    throw new OutlookCliError(
+      `Failed to send reply (${base}). The draft was deleted. No message was sent.`
+    );
+  }
+  return draftId;
+}
+function buildPatchBody(draftBody, userText, sig) {
+  const isHtml = draftBody.contentType.toLowerCase() === "html";
+  const newBody = isHtml ? insertHtml(draftBody.content, userText, sig) : insertText(draftBody.content, userText, sig);
+  return { body: { contentType: draftBody.contentType, content: newBody } };
+}
+function insertHtml(draftContent, userText, sig) {
+  const textHtml = escapeHtml2(userText.trimEnd()).replace(/\r?\n/g, "<br>");
+  const sigHtml = sig.html?.trim() ?? escapeHtml2((sig.text ?? "").trimEnd()).replace(/\r?\n/g, "<br>");
+  const insertion = `<div>${textHtml}</div><br><div class="outlook-cli-signature">${sigHtml}</div><br>`;
+  const quoteMatch = draftContent.match(/<div\s+id=["']divRplyFwdMsg["']/i);
+  if (quoteMatch?.index !== void 0) {
+    return draftContent.slice(0, quoteMatch.index) + insertion + draftContent.slice(quoteMatch.index);
+  }
+  const bodyMatch = [...draftContent.matchAll(/<body[^>]*>/gi)];
+  const lastBody = bodyMatch[bodyMatch.length - 1];
+  if (lastBody?.index !== void 0) {
+    const afterBody = lastBody.index + lastBody[0].length;
+    return draftContent.slice(0, afterBody) + insertion + draftContent.slice(afterBody);
+  }
+  return insertion + draftContent;
+}
+function insertText(draftContent, userText, sig) {
+  if (sig.text === void 0) {
+    const stripped = (sig.html ?? "").replace(/<[^>]*>/g, "").trim();
+    return buildTextInsertion(draftContent, userText, stripped);
+  }
+  return buildTextInsertion(draftContent, userText, sig.text.trimEnd());
+}
+function buildTextInsertion(draftContent, userText, sigText) {
+  const head = userText.trimEnd();
+  const sigBlock = `${TEXT_DELIMITER}
+${sigText}`;
+  const newContent = head === "" ? sigBlock : `${head}
+
+${sigBlock}`;
+  const sepMatch = draftContent.match(/^-{3,}[^-\r\n][^\r\n]*-{3,}/im);
+  if (sepMatch?.index !== void 0) {
+    return `${newContent}
+
+${draftContent.slice(sepMatch.index)}`;
+  }
+  if (draftContent.trim() === "") return newContent;
+  return `${newContent}
+
+${draftContent}`;
+}
+function escapeHtml2(s) {
+  return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+}
+
+// src/commands/reply.ts
+var ACTION_PATH = {
+  reply: "reply",
+  replyAll: "replyAll",
+  forward: "forward"
+};
+var CREATE_ACTION = {
+  reply: "createReply",
+  replyAll: "createReplyAll",
+  forward: "createForward"
+};
+async function runReplyAction(ctx, kind, label) {
+  const messageId = ctx.args.requirePositional(0, "<messageId>");
+  const userText = ctx.args.str("body") ?? "";
+  const signature = await resolveSignature(ctx.args, ctx.env);
+  const toRecipients = kind === "forward" ? recipientsFromArgs(ctx.args, "to") : void 0;
+  if (kind === "forward" && (!toRecipients || toRecipients.length === 0)) {
+    throw new UsageError(
+      "forward requires at least one recipient. Use --to <address>."
+    );
+  }
+  const useHtmlFlow = signature !== void 0 && signature.html !== void 0;
+  if (useHtmlFlow) {
+    await runHtmlFlow(ctx, kind, label, messageId, userText, signature, toRecipients);
+    return;
+  }
+  const comment = signature === void 0 ? userText : appendTextSignature(userText, signature);
+  const payload = { comment };
+  if (toRecipients) payload["toRecipients"] = toRecipients;
+  const path = `/me/messages/${encodeURIComponent(messageId)}/${ACTION_PATH[kind]}`;
+  const spec = ctx.client.buildSpec("POST", path, payload);
+  const done = await guardMutation(ctx, spec, async () => {
+    await ctx.client.post(path, payload);
+    return true;
+  });
+  if (done === void 0) return;
+  emit(
+    ctx,
+    {
+      action: kind,
+      messageId,
+      sent: true,
+      signatureApplied: signature !== void 0,
+      htmlSignature: false
+    },
+    () => `${label} sent for message ${messageId}` + (toRecipients ? ` to ${describeRecipients(toRecipients)}` : "")
+  );
+}
+async function runHtmlFlow(ctx, kind, label, messageId, userText, signature, toRecipients) {
+  const specs = buildReplyDraftSpecs(ctx.client, {
+    messageId,
+    action: CREATE_ACTION[kind],
+    userText,
+    signature,
+    toRecipients
+  });
+  if (ctx.dryRun) {
+    ctx.out("DRY RUN \u2014 nothing was sent. The three requests below are what would go out:");
+    ctx.out("");
+    ctx.out("--- Step 1: create draft ---");
+    ctx.out(renderRequest(specs.createSpec));
+    ctx.out("");
+    ctx.out("--- Step 2: patch body (representative; actual body depends on Exchange draft) ---");
+    ctx.out(renderRequest(specs.patchSpec));
+    ctx.out("");
+    ctx.out("--- Step 3: send draft ---");
+    ctx.out(renderRequest(specs.sendSpec));
+    const verdict = await dryRunVerdict(ctx, specs.sendSpec);
+    if (verdict !== void 0) {
+      ctx.out("");
+      ctx.out(renderVerdict(verdict));
+    }
+    return;
+  }
+  await enforcePolicy(ctx, specs.createSpec);
+  await enforcePolicy(ctx, specs.patchSpec);
+  await enforcePolicy(ctx, specs.sendSpec);
+  const draftId = await executeReplyDraft(ctx.client, {
+    messageId,
+    action: CREATE_ACTION[kind],
+    userText,
+    signature,
+    toRecipients
+  });
+  emit(
+    ctx,
+    {
+      action: kind,
+      messageId,
+      sent: true,
+      signatureApplied: true,
+      htmlSignature: true,
+      draftId
+    },
+    () => `${label} sent for message ${messageId}` + (toRecipients ? ` to ${describeRecipients(toRecipients)}` : "")
+  );
+}
+var replyCommand = {
+  name: "reply",
+  summary: "Reply to the sender of a message",
+  usage: "outlook reply <messageId> [--body <text>] [--signature <path> | --no-signature] [--dry-run] [--json]",
+  mutating: true,
+  handler: (ctx) => runReplyAction(ctx, "reply", "Reply")
+};
+var replyAllCommand = {
+  name: "reply-all",
+  summary: "Reply to all recipients of a message",
+  usage: "outlook reply-all <messageId> [--body <text>] [--signature <path> | --no-signature] [--dry-run] [--json]",
+  mutating: true,
+  handler: (ctx) => runReplyAction(ctx, "replyAll", "Reply-all")
+};
+var forwardCommand = {
+  name: "forward",
+  summary: "Forward a message to other recipients",
+  usage: "outlook forward <messageId> --to <addr> [--to <addr>...] [--body <text>] [--signature <path> | --no-signature] [--dry-run] [--json]",
+  mutating: true,
+  handler: (ctx) => runReplyAction(ctx, "forward", "Forward")
+};
+
+// src/commands/rules.ts
+function addrList(addrs) {
+  if (!addrs || addrs.length === 0) return "";
+  return addrs.map((a) => a.emailAddress?.address ?? a.emailAddress?.name ?? "?").join(", ");
+}
+function summariseConditions(c) {
+  if (!c) return "(any)";
+  const parts = [];
+  const from = addrList(c.fromAddresses);
+  if (from) parts.push(`from: ${from}`);
+  const to = addrList(c.sentToAddresses);
+  if (to) parts.push(`to: ${to}`);
+  if (c.subjectContains?.length) parts.push(`subject contains: ${c.subjectContains.join(", ")}`);
+  if (c.bodyContains?.length) parts.push(`body contains: ${c.bodyContains.join(", ")}`);
+  if (c.senderContains?.length) parts.push(`sender contains: ${c.senderContains.join(", ")}`);
+  if (c.hasAttachments) parts.push("has attachments");
+  if (c.importance) parts.push(`importance: ${c.importance}`);
+  return parts.length > 0 ? parts.join("; ") : "(any)";
+}
+function summariseActions(a) {
+  if (!a) return "(none)";
+  const parts = [];
+  if (a.moveToFolder) parts.push(`move to [${a.moveToFolder}]`);
+  if (a.copyToFolder) parts.push(`copy to [${a.copyToFolder}]`);
+  if (a.delete) parts.push("delete");
+  if (a.permanentDelete) parts.push("permanent delete");
+  if (a.markAsRead) parts.push("mark read");
+  if (a.markImportance) parts.push(`mark ${a.markImportance}`);
+  const fwd = addrList(a.forwardTo);
+  if (fwd) parts.push(`forward to: ${fwd}`);
+  const redir = addrList(a.redirectTo);
+  if (redir) parts.push(`redirect to: ${redir}`);
+  if (a.stopProcessingRules) parts.push("stop processing");
+  return parts.length > 0 ? parts.join("; ") : "(none)";
+}
+function renderRules(rules) {
+  if (rules.length === 0) return "(no rules)";
+  const header = [
+    "#".padEnd(3),
+    "ENABLED".padEnd(8),
+    "NAME".padEnd(28),
+    "CONDITIONS".padEnd(36),
+    "ACTIONS"
+  ].join(" ");
+  const rows = rules.map((r) => [
+    String(r.sequence ?? "-").padEnd(3),
+    (r.isEnabled ? "yes" : "no").padEnd(8),
+    (r.displayName ?? "(unnamed)").slice(0, 28).padEnd(28),
+    summariseConditions(r.conditions).slice(0, 36).padEnd(36),
+    summariseActions(r.actions)
+  ].join(" "));
+  return [header, ...rows].join("\n");
+}
+function buildRuleBody(ctx) {
+  const name = ctx.args.require("name");
+  const folderId = ctx.args.require("folder");
+  const fromAddrs = ctx.args.strAll("from");
+  const senderContains = ctx.args.strAll("sender-contains");
+  if (fromAddrs.length === 0 && senderContains.length === 0) {
+    throw new UsageError(
+      "At least one condition is required: --from <address> and/or --sender-contains <domain>. A rule with no condition would match every message."
+    );
+  }
+  const conditions = {};
+  if (fromAddrs.length > 0) {
+    conditions.fromAddresses = fromAddrs.map((addr) => ({
+      emailAddress: { address: addr }
+    }));
+  }
+  if (senderContains.length > 0) {
+    conditions.senderContains = senderContains;
+  }
+  const actions = {
+    moveToFolder: folderId
+  };
+  if (ctx.args.bool("mark-read")) {
+    actions.markAsRead = true;
+  }
+  if (!ctx.args.has("stop-processing") || ctx.args.bool("stop-processing")) {
+    actions.stopProcessingRules = true;
+  }
+  const body = {
+    displayName: name,
+    conditions,
+    actions,
+    isEnabled: !ctx.args.has("enabled") || ctx.args.bool("enabled")
+  };
+  const seq = ctx.args.num("sequence");
+  if (seq !== void 0) body.sequence = seq;
+  return body;
+}
+async function createHandler2(ctx) {
+  const body = buildRuleBody(ctx);
+  const spec = ctx.client.buildSpec("POST", RULES_PATH, body);
+  const created = await guardMutation(
+    ctx,
+    spec,
+    async () => ctx.client.post(RULES_PATH, body)
+  );
+  if (created === void 0) return;
+  emit(ctx, created, () => {
+    const name = created.displayName ?? "(unnamed)";
+    const seq = created.sequence ?? "?";
+    const cond = summariseConditions(created.conditions);
+    const acts = summariseActions(created.actions);
+    return `Created rule #${seq} "${name}"
+  Conditions: ${cond}
+  Actions: ${acts}`;
+  });
+}
+var RULES_PATH = "/me/mailFolders/inbox/messageRules";
+async function rulesHandler(ctx) {
+  const sub = ctx.args.positionals[0] ?? "list";
+  switch (sub) {
+    case "list": {
+      const response = await ctx.client.get(RULES_PATH);
+      const rules = response.value;
+      emit(ctx, rules, () => renderRules(rules));
+      return;
+    }
+    case "create":
+      return createHandler2(ctx);
+    default: {
+      throw new UsageError(
+        `Unknown rules subcommand "${sub}". Expected "list" or "create".`
+      );
+    }
+  }
+}
+var rulesCommand = {
+  name: "rules",
+  summary: "List or create inbox message rules",
+  usage: "outlook rules [list] [--json]\n       outlook rules create --name <text> --folder <id>\n           [--from <addr>...] [--sender-contains <domain>...]\n           [--mark-read] [--stop-processing] [--enabled]\n           (--stop-processing defaults to on; use --no-stop-processing to disable)\n           [--dry-run] [--json]",
+  mutating: true,
+  handler: rulesHandler
+};
+
+// src/commands/search.ts
+var MAX_RESULTS = 1e3;
+var SELECT2 = "subject,from,receivedDateTime,isRead,hasAttachments,bodyPreview";
+function folderSegment(folder) {
+  return isWellKnownFolder(folder) ? folder.toLowerCase() : encodeURIComponent(folder);
+}
+function searchPath(folder) {
+  if (folder === void 0) return "/me/messages";
+  return `/me/mailFolders/${folderSegment(folder)}/messages`;
+}
+function quoteSearch(query) {
+  const escaped = query.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
+  return `"${escaped}"`;
+}
+function readLimit3(ctx) {
+  if (!ctx.args.has("limit")) return 25;
+  const limit = ctx.args.num("limit");
+  if (limit === void 0 || !Number.isInteger(limit) || limit < 1 || limit > MAX_RESULTS) {
+    throw new UsageError(
+      `--limit must be an integer between 1 and ${MAX_RESULTS} \u2014 docs/01 \xA74a documents $search on messages as returning "up to 1,000 results"`
+    );
+  }
+  return limit;
+}
+async function searchHandler2(ctx) {
+  const query = ctx.args.requirePositional(0, "<query>");
+  const limit = readLimit3(ctx);
+  const all = ctx.args.bool("all");
+  const folder = ctx.args.str("folder");
+  const messages = await collectItems(ctx.client, searchPath(folder), {
+    query: { $search: quoteSearch(query), $select: SELECT2, $top: limit },
+    limit,
+    all
+  });
+  emit(ctx, messages, () => renderMessageList(messages));
+}
+var searchCommand = {
+  name: "search",
+  summary: "Search messages with KQL/$search",
+  usage: "outlook search <query> [--limit <n>] [--all] [--folder <name|id>] [--json]",
+  mutating: false,
+  handler: searchHandler2
+};
+
+// src/commands/send.ts
+var sendCommand = {
+  name: "send",
+  summary: "Send an email",
+  usage: "outlook send --to <addr> [--to <addr>...] --subject <text> [--cc <addr>] [--bcc <addr>] [--body <text> | --body-file <path>] [--html] [--attach <path>...] [--signature <path> | --no-signature] [--no-save-sent] [--dry-run] [--json]",
+  mutating: true,
+  async handler(ctx) {
+    const message = await composeMessage(ctx.args);
+    if (!message.toRecipients || message.toRecipients.length === 0) {
+      throw new UsageError(
+        "At least one recipient is required. Use --to <address> (repeatable, or comma-separated)."
+      );
+    }
+    if (message.subject === void 0 || message.subject.trim() === "") {
+      throw new UsageError("--subject is required.");
+    }
+    const signature = await resolveSignature(ctx.args, ctx.env);
+    signMessage(message, signature, ctx.args);
+    const payload = {
+      message,
+      saveToSentItems: saveToSentItems(ctx.args)
+    };
+    const spec = ctx.client.buildSpec("POST", "/me/sendMail", payload);
+    const sent = await guardMutation(ctx, spec, async () => {
+      await ctx.client.post("/me/sendMail", payload);
+      return true;
+    });
+    if (sent === void 0) return;
+    const to = describeRecipients(message.toRecipients);
+    emit(
+      ctx,
+      {
+        sent: true,
+        subject: message.subject,
+        to: message.toRecipients.map((r) => r.emailAddress.address),
+        attachments: message.attachments?.length ?? 0,
+        savedToSentItems: payload.saveToSentItems,
+        signatureApplied: signature !== void 0
+      },
+      () => `Sent "${message.subject}" to ${to}`
+    );
+  }
+};
+
+// src/cli.ts
+loadEnvFile();
+var COMMANDS = [
+  authCommand,
+  meCommand,
+  listCommand,
+  getCommand,
+  searchCommand,
+  foldersCommand,
+  attachmentsCommand,
+  contactsCommand,
+  sendCommand,
+  replyCommand,
+  replyAllCommand,
+  forwardCommand,
+  draftCommand,
+  moveCommand,
+  deleteCommand,
+  purgeCommand,
+  markReadCommand,
+  markUnreadCommand,
+  flagCommand,
+  unflagCommand,
+  rulesCommand
+];
+var REGISTRY = new Map(
+  COMMANDS.map((command) => [command.name, command])
+);
+var GROUPS = [
+  { title: "Auth & identity", names: ["auth", "me"] },
+  {
+    title: "Read",
+    names: ["list", "get", "search", "folders", "attachments"]
+  },
+  {
+    title: "People",
+    names: ["contacts"]
+  },
+  {
+    title: "Send",
+    names: ["send", "reply", "reply-all", "forward", "draft"]
+  },
+  {
+    title: "Organize",
+    names: [
+      "move",
+      "delete",
+      "purge",
+      "mark-read",
+      "mark-unread",
+      "flag",
+      "unflag",
+      "rules"
+    ]
+  }
+];
+function packageVersion() {
+  try {
+    const pkg = createRequire(import.meta.url)("../package.json");
+    return pkg.version ?? "0.0.0";
+  } catch {
+    return "0.0.0";
+  }
+}
+function helpText() {
+  const lines = [
+    "outlook \u2014 Microsoft Graph Outlook Mail from the command line",
+    "",
+    "Usage: outlook <command> [options]",
+    ""
+  ];
+  for (const group of GROUPS) {
+    lines.push(`${group.title}:`);
+    for (const name of group.names) {
+      const command = REGISTRY.get(name);
+      if (command === void 0) continue;
+      const flag = command.mutating ? " [--dry-run]" : "";
+      lines.push(`  ${name.padEnd(13)} ${command.summary}${flag}`);
+    }
+    lines.push("");
+  }
+  lines.push(
+    "Global options:",
+    "  --json         Machine-readable output",
+    "  --dry-run      On a mutating command: print the request, send nothing",
+    "  -h, --help     This help, or `outlook <command> --help`",
+    "  -V, --version  Print the version",
+    "",
+    "Environment:",
+    "  OUTLOOK_POLICY=<file>  Restrict mutations to a JSON policy (README: Restricted agent mode)",
+    "",
+    "First run: export GRAPH_CLIENT_ID=<azure-app-id> && outlook auth login",
+    "Setup walkthrough: SETUP.md",
+    ""
+  );
+  return lines.join("\n");
+}
+function buildContext(args, commandName) {
+  const config = resolveConfig(process.env);
+  const store = createTokenStore(config.tokenCachePath);
+  const auth = createAuthenticator(config, store);
+  const client = new GraphClient({
+    getToken: () => auth.getAccessToken()
+  });
+  return {
+    args,
+    json: args.bool("json"),
+    dryRun: args.bool("dry-run"),
+    command: commandName,
+    client,
+    auth,
+    env: process.env,
+    out: (line) => {
+      process.stdout.write(`${line}
+`);
+    },
+    err: (line) => {
+      process.stderr.write(`${line}
+`);
+    }
+  };
+}
+async function run(argv) {
+  const first = argv[0];
+  if (first === void 0 || first === "help" || first === "--help" || first === "-h") {
+    process.stdout.write(helpText());
+    return 0;
+  }
+  if (first === "version" || first === "--version" || first === "-V") {
+    process.stdout.write(`${packageVersion()}
+`);
+    return 0;
+  }
+  const command = REGISTRY.get(first);
+  if (command === void 0) {
+    throw new UsageError(
+      `Unknown command: ${first}
+
+Run 'outlook help' for the command list.`
+    );
+  }
+  const rest = argv.slice(1);
+  const args = parseArgs(rest);
+  if (args.bool("help") || args.bool("h")) {
+    process.stdout.write(`${command.summary}
+
+${command.usage}
+`);
+    return 0;
+  }
+  assertKnownFlags(command.name, args.names());
+  const ctx = buildContext(args, command.name);
+  if (ctx.dryRun && !command.mutating) {
+    ctx.err(
+      `note: '${command.name}' does not change anything, so --dry-run has no effect.`
+    );
+  }
+  await command.handler(ctx);
+  return 0;
+}
+function reportFailure(error) {
+  const message = error instanceof Error ? error.message : String(error);
+  process.stderr.write(`${redactText(message)}
+`);
+  return error instanceof OutlookCliError ? error.exitCode : 1;
+}
+try {
+  process.exitCode = await run(process.argv.slice(2));
+} catch (error) {
+  process.exitCode = reportFailure(error);
+}
+//# sourceMappingURL=cli.js.map