@jbctechsolutions/mcp-office365 2.5.1 → 3.0.0

package/dist/ids/resolver.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Copyright (c) 2026 JBC Tech Solutions, LLC
+ * Licensed under the MIT License. See LICENSE file in the project root.
+ */
+/**
+ * Universal durable-ID resolver (U5 / D1, D2, D4, D7). Turns any ID a tool
+ * receives — a self-encoding token, an alias-backed token, a raw Graph ID, or a
+ * legacy numeric ID — into a live Graph ID, or a typed error.
+ *
+ * - self-encoding token → decode, zero storage (cold-state durable).
+ * - alias-backed token   → alias table lookup (account-scoped). A cold/foreign
+ *   miss is distinguished: ID_FOREIGN_ACCOUNT vs ID_UNKNOWN.
+ * - numeric (v2 hash)    → NUMERIC_ID_UNSUPPORTED on Graph (lossy, D4).
+ * - raw non-token string → passed through as an opaque Graph ID (a user may
+ *   paste a real Graph ID; Graph IDs are opaque, so rejecting them would be
+ *   hostile). Mutation of state lives in the alias table, not here.
+ */
+import type { StateStore } from '../state/store.js';
+/** A resolved Graph ID plus whether it came from a mutable (drift-prone) alias. */
+export interface ResolvedId {
+    graphId: string;
+    /** True for `$search`-minted mutable alias rows that may need re-resolution. */
+    mutable: boolean;
+}
+/**
+ * Resolves an ID parameter to a Graph ID for the given signed-in account.
+ * Throws a typed {@link import('../utils/errors.js').OutlookMcpError} on failure.
+ */
+export declare function resolveId(id: string | number, accountId: string, store: StateStore): ResolvedId;
+//# sourceMappingURL=resolver.d.ts.map

package/dist/ids/resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolver.d.ts","sourceRoot":"","sources":["../../src/ids/resolver.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAQpD,mFAAmF;AACnF,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,gFAAgF;IAChF,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;;GAGG;AACH,wBAAgB,SAAS,CACvB,EAAE,EAAE,MAAM,GAAG,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,UAAU,GAChB,UAAU,CA6BZ"}

package/dist/ids/resolver.js

@@ -0,0 +1,37 @@
+/**
+ * Copyright (c) 2026 JBC Tech Solutions, LLC
+ * Licensed under the MIT License. See LICENSE file in the project root.
+ */
+import { IdForeignAccountError, IdUnknownError, NumericIdUnsupportedError, } from '../utils/errors.js';
+import { parseToken } from './token.js';
+/**
+ * Resolves an ID parameter to a Graph ID for the given signed-in account.
+ * Throws a typed {@link import('../utils/errors.js').OutlookMcpError} on failure.
+ */
+export function resolveId(id, accountId, store) {
+    if (typeof id === 'number') {
+        throw new NumericIdUnsupportedError(id);
+    }
+    const parsed = parseToken(id);
+    if (parsed === null) {
+        // Not a known token — treat as an opaque Graph ID the caller supplied.
+        return { graphId: id, mutable: false };
+    }
+    if (parsed.kind === 'self') {
+        // graphId is always present for a self-encoding parse.
+        return { graphId: parsed.graphId, mutable: false };
+    }
+    // Alias-backed: resolve against the store, scoped to the account.
+    const row = store.getAlias(id, accountId);
+    if (row !== null) {
+        return { graphId: row.graphId, mutable: row.mutable };
+    }
+    // Miss — distinguish a foreign-account token from a genuinely unknown one so
+    // the agent gets an actionable message (D7).
+    const owner = store.getAliasAccount(id);
+    if (owner !== null && owner !== accountId) {
+        throw new IdForeignAccountError(id);
+    }
+    throw new IdUnknownError(id);
+}
+//# sourceMappingURL=resolver.js.map

package/dist/ids/resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolver.js","sourceRoot":"","sources":["../../src/ids/resolver.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAiBH,OAAO,EACL,qBAAqB,EACrB,cAAc,EACd,yBAAyB,GAC1B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AASxC;;;GAGG;AACH,MAAM,UAAU,SAAS,CACvB,EAAmB,EACnB,SAAiB,EACjB,KAAiB;IAEjB,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;QAC3B,MAAM,IAAI,yBAAyB,CAAC,EAAE,CAAC,CAAC;IAC1C,CAAC;IAED,MAAM,MAAM,GAAG,UAAU,CAAC,EAAE,CAAC,CAAC;IAC9B,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,uEAAuE;QACvE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACzC,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC3B,uDAAuD;QACvD,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC/D,CAAC;IAED,kEAAkE;IAClE,MAAM,GAAG,GAAG,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;IAC1C,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACjB,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;IACxD,CAAC;IAED,6EAA6E;IAC7E,6CAA6C;IAC7C,MAAM,KAAK,GAAG,KAAK,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;IACxC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QAC1C,MAAM,IAAI,qBAAqB,CAAC,EAAE,CAAC,CAAC;IACtC,CAAC;IACD,MAAM,IAAI,cAAc,CAAC,EAAE,CAAC,CAAC;AAC/B,CAAC"}

package/dist/ids/token.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Copyright (c) 2026 JBC Tech Solutions, LLC
+ * Licensed under the MIT License. See LICENSE file in the project root.
+ */
+/** Entity kinds addressable by a durable-ID token. */
+export type EntityType = 'message' | 'event' | 'contact' | 'folder' | 'driveItem' | 'task' | 'plan' | 'plannerTask' | 'chat' | 'team' | 'attachment' | 'channel' | 'chatMessage' | 'checklistItem';
+/** How a token encodes its target. */
+export type TokenKind = 'self' | 'alias';
+/**
+ * Prefix → entity maps are NULL-PROTOTYPE so a caller-supplied prefix like
+ * `constructor` or `toString` (from an arbitrary ID string) can never match an
+ * inherited `Object.prototype` member and get misclassified as a known token —
+ * `parseToken` must return null for those and let the resolver pass them through
+ * as opaque Graph IDs.
+ */
+/** Self-encoding prefixes → entity type (the token carries the Graph ID). */
+export declare const SELF_ENCODING_PREFIXES: Readonly<Record<string, EntityType>>;
+/** Alias-backed prefixes → entity type (the token is a digest; needs the store). */
+export declare const ALIAS_PREFIXES: Readonly<Record<string, EntityType>>;
+/** A parsed durable-ID token. */
+export interface ParsedToken {
+    prefix: string;
+    kind: TokenKind;
+    entityType: EntityType;
+    /** For self-encoding tokens: the decoded Graph ID. Absent for alias tokens. */
+    graphId?: string;
+}
+/** True when a prefix is a known self-encoding or alias prefix. */
+export declare function isKnownPrefix(prefix: string): boolean;
+/**
+ * Mints a self-encoding token carrying the immutable Graph ID (D1). Determin­istic.
+ */
+export declare function mintSelfEncoded(entityType: EntityType, graphId: string): string;
+/**
+ * Mints a short, deterministic alias-backed token from an entity's canonical
+ * key (D1). The caller stores the token → key mapping in the alias table.
+ */
+export declare function mintComposite(entityType: EntityType, canonicalKey: string): string;
+/**
+ * Builds a canonical key for a composite entity from its identifying tuple.
+ * Keys are sorted so field order never changes the digest. Keys and values are
+ * percent-encoded so a value containing the `&`/`=` delimiters (Graph IDs are
+ * base64-ish and can) cannot forge a boundary and make two distinct tuples
+ * produce the same key — which would collide their tokens without a hash
+ * collision.
+ */
+export declare function canonicalKey(entityType: EntityType, parts: Readonly<Record<string, string>>): string;
+/**
+ * Parses a token into its prefix/kind/entity (and decoded Graph ID for
+ * self-encoding tokens). Returns null when the value is not a well-formed known
+ * token — the caller decides whether to treat that as a raw Graph ID or reject.
+ */
+export declare function parseToken(token: string): ParsedToken | null;
+/** True when a string looks like a durable-ID token (known prefix + payload). */
+export declare function isToken(value: string): boolean;
+//# sourceMappingURL=token.d.ts.map

package/dist/ids/token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../../src/ids/token.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAqBH,sDAAsD;AACtD,MAAM,MAAM,UAAU,GAClB,SAAS,GACT,OAAO,GACP,SAAS,GACT,QAAQ,GACR,WAAW,GACX,MAAM,GACN,MAAM,GACN,aAAa,GACb,MAAM,GACN,MAAM,GACN,YAAY,GACZ,SAAS,GACT,aAAa,GACb,eAAe,CAAC;AAEpB,sCAAsC;AACtC,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,OAAO,CAAC;AAEzC;;;;;;GAMG;AAEH,6EAA6E;AAC7E,eAAO,MAAM,sBAAsB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAUvE,CAAC;AAEF,oFAAoF;AACpF,eAAO,MAAM,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAY/D,CAAC;AAoBF,iCAAiC;AACjC,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,SAAS,CAAC;IAChB,UAAU,EAAE,UAAU,CAAC;IACvB,+EAA+E;IAC/E,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,mEAAmE;AACnE,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAErD;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,UAAU,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAW/E;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,UAAU,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAMlF;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,MAAM,CAMpG;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CA0B5D;AAED,iFAAiF;AACjF,wBAAgB,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE9C"}

package/dist/ids/token.js

@@ -0,0 +1,186 @@
+/**
+ * Copyright (c) 2026 JBC Tech Solutions, LLC
+ * Licensed under the MIT License. See LICENSE file in the project root.
+ */
+/**
+ * Durable-ID tokens (U5 / D1). Two shapes:
+ *
+ * - **Self-encoding** (`em_`, `ev_`, `ct_`, `fd_`, `dr_`, `td_`): the token
+ *   carries the immutable Graph ID directly — `<prefix>_<base64url(graphId)>`.
+ *   Resolution is a decode with zero storage, so it survives a cold/lost
+ *   `state.db` and resolves on any machine (the core cold-state fix).
+ *
+ * - **Alias-backed** (`pl_`, `pt_`, `ch_`, `tm_`, `at_`, composite tuples): the
+ *   token is a short deterministic digest of the entity's canonical key —
+ *   `<prefix>_<base32(sha256(canonicalKey))[0..13]>` (70 bits) — backed by the
+ *   alias table (D3). These are machine-scoped: a cold store yields `ID_UNKNOWN`.
+ *
+ * Determinism is a hard requirement: the same Graph ID / canonical key always
+ * mints a byte-identical token.
+ */
+import { createHash } from 'node:crypto';
+/**
+ * Prefix → entity maps are NULL-PROTOTYPE so a caller-supplied prefix like
+ * `constructor` or `toString` (from an arbitrary ID string) can never match an
+ * inherited `Object.prototype` member and get misclassified as a known token —
+ * `parseToken` must return null for those and let the resolver pass them through
+ * as opaque Graph IDs.
+ */
+/** Self-encoding prefixes → entity type (the token carries the Graph ID). */
+export const SELF_ENCODING_PREFIXES = Object.assign(Object.create(null), {
+    em: 'message',
+    ev: 'event',
+    ct: 'contact',
+    fd: 'folder',
+    dr: 'driveItem',
+    td: 'task',
+});
+/** Alias-backed prefixes → entity type (the token is a digest; needs the store). */
+export const ALIAS_PREFIXES = Object.assign(Object.create(null), {
+    pl: 'plan',
+    pt: 'plannerTask',
+    ch: 'chat',
+    tm: 'team',
+    at: 'attachment',
+    cn: 'channel',
+    cm: 'chatMessage',
+    ci: 'checklistItem',
+});
+const ENTITY_TO_PREFIX = buildReverse();
+function buildReverse() {
+    const out = Object.create(null);
+    for (const [prefix, entity] of Object.entries(SELF_ENCODING_PREFIXES)) {
+        out[entity] = prefix;
+    }
+    for (const [prefix, entity] of Object.entries(ALIAS_PREFIXES)) {
+        out[entity] = prefix;
+    }
+    return out;
+}
+/** Crockford-free RFC 4648 base32 alphabet (lowercase for compact tokens). */
+const BASE32_ALPHABET = 'abcdefghijklmnopqrstuvwxyz234567';
+/** 14 base32 chars × 5 bits = 70 bits of the sha256 digest (D1). */
+const COMPOSITE_DIGEST_CHARS = 14;
+/** True when a prefix is a known self-encoding or alias prefix. */
+export function isKnownPrefix(prefix) {
+    return prefix in SELF_ENCODING_PREFIXES || prefix in ALIAS_PREFIXES;
+}
+/**
+ * Mints a self-encoding token carrying the immutable Graph ID (D1). Determin­istic.
+ */
+export function mintSelfEncoded(entityType, graphId) {
+    const prefix = ENTITY_TO_PREFIX[entityType];
+    if (prefix == null || !(prefix in SELF_ENCODING_PREFIXES)) {
+        throw new Error(`Entity type "${entityType}" is not self-encoding.`);
+    }
+    if (graphId.length === 0) {
+        // An empty ID would encode to `<prefix>_` (empty payload), which parseToken
+        // rejects — the token would then be mis-handled as a raw Graph ID. Fail fast.
+        throw new Error('Cannot mint a self-encoding token for an empty Graph ID.');
+    }
+    return `${prefix}_${Buffer.from(graphId, 'utf8').toString('base64url')}`;
+}
+/**
+ * Mints a short, deterministic alias-backed token from an entity's canonical
+ * key (D1). The caller stores the token → key mapping in the alias table.
+ */
+export function mintComposite(entityType, canonicalKey) {
+    const prefix = ENTITY_TO_PREFIX[entityType];
+    if (prefix == null || !(prefix in ALIAS_PREFIXES)) {
+        throw new Error(`Entity type "${entityType}" is not alias-backed.`);
+    }
+    return `${prefix}_${base32Digest(canonicalKey)}`;
+}
+/**
+ * Builds a canonical key for a composite entity from its identifying tuple.
+ * Keys are sorted so field order never changes the digest. Keys and values are
+ * percent-encoded so a value containing the `&`/`=` delimiters (Graph IDs are
+ * base64-ish and can) cannot forge a boundary and make two distinct tuples
+ * produce the same key — which would collide their tokens without a hash
+ * collision.
+ */
+export function canonicalKey(entityType, parts) {
+    const sorted = Object.keys(parts)
+        .sort()
+        .map((k) => `${encodeURIComponent(k)}=${encodeURIComponent(parts[k] ?? '')}`)
+        .join('&');
+    return `${entityType}:${sorted}`;
+}
+/**
+ * Parses a token into its prefix/kind/entity (and decoded Graph ID for
+ * self-encoding tokens). Returns null when the value is not a well-formed known
+ * token — the caller decides whether to treat that as a raw Graph ID or reject.
+ */
+export function parseToken(token) {
+    const underscore = token.indexOf('_');
+    if (underscore <= 0) {
+        return null;
+    }
+    const prefix = token.slice(0, underscore);
+    const payload = token.slice(underscore + 1);
+    if (payload.length === 0) {
+        return null;
+    }
+    const selfEntity = SELF_ENCODING_PREFIXES[prefix];
+    if (selfEntity !== undefined) {
+        const graphId = decodeBase64Url(payload);
+        if (graphId == null) {
+            return null;
+        }
+        return { prefix, kind: 'self', entityType: selfEntity, graphId };
+    }
+    const aliasEntity = ALIAS_PREFIXES[prefix];
+    if (aliasEntity !== undefined) {
+        return { prefix, kind: 'alias', entityType: aliasEntity };
+    }
+    return null;
+}
+/** True when a string looks like a durable-ID token (known prefix + payload). */
+export function isToken(value) {
+    return parseToken(value) !== null;
+}
+function base32Digest(input) {
+    const hash = createHash('sha256').update(input, 'utf8').digest();
+    let bits = 0;
+    let value = 0;
+    let output = '';
+    for (const byte of hash) {
+        value = (value << 8) | byte;
+        bits += 8;
+        while (bits >= 5) {
+            output += BASE32_ALPHABET[(value >>> (bits - 5)) & 0x1f];
+            bits -= 5;
+            if (output.length === COMPOSITE_DIGEST_CHARS) {
+                return output;
+            }
+        }
+    }
+    return output;
+}
+function decodeBase64Url(payload) {
+    // base64url is [A-Za-z0-9_-]; reject anything else so a stray alias-shaped
+    // string isn't silently decoded into garbage.
+    if (!/^[A-Za-z0-9_-]+$/.test(payload)) {
+        return null;
+    }
+    let decoded;
+    try {
+        decoded = Buffer.from(payload, 'base64url').toString('utf8');
+    }
+    catch {
+        return null;
+    }
+    if (decoded.length === 0) {
+        return null;
+    }
+    // Reject NON-CANONICAL encodings: Buffer's base64url decode is lenient (em_QQ,
+    // em_QR, em_QS all decode to "A"), which would give one Graph ID many valid
+    // token strings. Requiring the payload to be the exact canonical encoding of
+    // the decoded bytes means one Graph ID ↔ exactly one token string, so a later
+    // unit keying a control on the token string can't be evaded by a variant.
+    if (Buffer.from(decoded, 'utf8').toString('base64url') !== payload) {
+        return null;
+    }
+    return decoded;
+}
+//# sourceMappingURL=token.js.map

package/dist/ids/token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.js","sourceRoot":"","sources":["../../src/ids/token.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAsBzC;;;;;;GAMG;AAEH,6EAA6E;AAC7E,MAAM,CAAC,MAAM,sBAAsB,GAAyC,MAAM,CAAC,MAAM,CACvF,MAAM,CAAC,MAAM,CAAC,IAAI,CAA+B,EACjD;IACE,EAAE,EAAE,SAAS;IACb,EAAE,EAAE,OAAO;IACX,EAAE,EAAE,SAAS;IACb,EAAE,EAAE,QAAQ;IACZ,EAAE,EAAE,WAAW;IACf,EAAE,EAAE,MAAM;CAC0B,CACvC,CAAC;AAEF,oFAAoF;AACpF,MAAM,CAAC,MAAM,cAAc,GAAyC,MAAM,CAAC,MAAM,CAC/E,MAAM,CAAC,MAAM,CAAC,IAAI,CAA+B,EACjD;IACE,EAAE,EAAE,MAAM;IACV,EAAE,EAAE,aAAa;IACjB,EAAE,EAAE,MAAM;IACV,EAAE,EAAE,MAAM;IACV,EAAE,EAAE,YAAY;IAChB,EAAE,EAAE,SAAS;IACb,EAAE,EAAE,aAAa;IACjB,EAAE,EAAE,eAAe;CACiB,CACvC,CAAC;AAEF,MAAM,gBAAgB,GAAyC,YAAY,EAAE,CAAC;AAE9E,SAAS,YAAY;IACnB,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAA+B,CAAC;IAC9D,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC,EAAE,CAAC;QACtE,GAAG,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;IACvB,CAAC;IACD,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;QAC9D,GAAG,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;IACvB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,8EAA8E;AAC9E,MAAM,eAAe,GAAG,kCAAkC,CAAC;AAC3D,oEAAoE;AACpE,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAWlC,mEAAmE;AACnE,MAAM,UAAU,aAAa,CAAC,MAAc;IAC1C,OAAO,MAAM,IAAI,sBAAsB,IAAI,MAAM,IAAI,cAAc,CAAC;AACtE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,UAAsB,EAAE,OAAe;IACrE,MAAM,MAAM,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAC5C,IAAI,MAAM,IAAI,IAAI,IAAI,CAAC,CAAC,MAAM,IAAI,sBAAsB,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,gBAAgB,UAAU,yBAAyB,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,4EAA4E;QAC5E,8EAA8E;QAC9E,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,GAAG,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;AAC3E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,UAAsB,EAAE,YAAoB;IACxE,MAAM,MAAM,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAC5C,IAAI,MAAM,IAAI,IAAI,IAAI,CAAC,CAAC,MAAM,IAAI,cAAc,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,gBAAgB,UAAU,wBAAwB,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,GAAG,MAAM,IAAI,YAAY,CAAC,YAAY,CAAC,EAAE,CAAC;AACnD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAAC,UAAsB,EAAE,KAAuC;IAC1F,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;SAC9B,IAAI,EAAE;SACN,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,kBAAkB,CAAC,CAAC,CAAC,IAAI,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;SAC5E,IAAI,CAAC,GAAG,CAAC,CAAC;IACb,OAAO,GAAG,UAAU,IAAI,MAAM,EAAE,CAAC;AACnC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,UAAU,IAAI,CAAC,EAAE,CAAC;QACpB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;IAC5C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,UAAU,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAClD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;QACzC,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;YACpB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;IACnE,CAAC;IAED,MAAM,WAAW,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC;IAC5D,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,OAAO,CAAC,KAAa;IACnC,OAAO,UAAU,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC;AACpC,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;IACjE,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QACxB,KAAK,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;QAC5B,IAAI,IAAI,CAAC,CAAC;QACV,OAAO,IAAI,IAAI,CAAC,EAAE,CAAC;YACjB,MAAM,IAAI,eAAe,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YACzD,IAAI,IAAI,CAAC,CAAC;YACV,IAAI,MAAM,CAAC,MAAM,KAAK,sBAAsB,EAAE,CAAC;gBAC7C,OAAO,MAAM,CAAC;YAChB,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,eAAe,CAAC,OAAe;IACtC,2EAA2E;IAC3E,8CAA8C;IAC9C,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACtC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,+EAA+E;IAC/E,4EAA4E;IAC5E,6EAA6E;IAC7E,8EAA8E;IAC9E,0EAA0E;IAC1E,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,OAAO,EAAE,CAAC;QACnE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/index.d.ts

@@ -14,8 +14,14 @@
  * - Set USE_APPLESCRIPT=1 to use legacy AppleScript backend (macOS + classic Outlook only)
  */
 import { Server } from '@modelcontextprotocol/sdk/server/index.js';
+import type { SurfaceOptions } from './registry/index.js';
 /**
  * Creates and configures the MCP server.
  */
-export declare function createServer(): Server;
+/** Options controlling the exposed tool surface (preset / read-only filters). */
+export interface ServerOptions {
+    readonly presets?: SurfaceOptions['presets'];
+    readonly readOnly?: boolean;
+}
+export declare function createServer(options?: ServerOptions): Server;
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA;;;GAGG;AACH;;;;;;;;;GASG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAiiHnE;;GAEG;AACH,wBAAgB,YAAY,IAAI,MAAM,CA6TrC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA;;;GAGG;AACH;;;;;;;;;GASG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAgCnE,OAAO,KAAK,EAAe,cAAc,EAAE,MAAM,qBAAqB,CAAC;AA0FvE;;GAEG;AACH,iFAAiF;AACjF,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,cAAc,CAAC,SAAS,CAAC,CAAC;IAC7C,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED,wBAAgB,YAAY,CAAC,OAAO,GAAE,aAAkB,GAAG,MAAM,CA+ShE"}