@jbctechsolutions/mcp-office365 2.5.1 → 4.0.0

package/README.md

@@ -6,7 +6,7 @@
 
 MCP server for Microsoft 365 -- mail, calendar, contacts, tasks, teams, people, and planner.
 
-A [Model Context Protocol (MCP)](https://modelcontextprotocol.io/) server that provides **181 tools** for full read/write access to Microsoft 365. Manage your emails, calendar events, contacts, tasks, notes, Teams channels and chats, people directory, and Planner boards directly through MCP.
+A [Model Context Protocol (MCP)](https://modelcontextprotocol.io/) server that provides **229 tools** for full read/write access to Microsoft 365 via the Microsoft Graph API. Manage your emails, calendar events, contacts, tasks, OneNote notes, Teams channels and chats, people directory, and Planner boards directly through MCP.
 
 ## Features Overview
 
@@ -31,15 +31,15 @@ A [Model Context Protocol (MCP)](https://modelcontextprotocol.io/) server that p
 | Checklist Items | 5 | Subtasks on To Do tasks |
 | Linked Resources | 4 | Linked resources on To Do tasks |
 | Task Attachments | 4 | File attachments on To Do tasks |
-| Notes (AppleScript only) | 3 | List, read, and search Outlook notes |
+| OneNote | 6 | Browse notebooks/sections/pages, search, and create pages |
 | Scheduling | 2 | Free/busy availability, meeting time suggestions |
 | Teams -- Channels | 8 | Channel CRUD, team members |
 | Teams -- Channel Messages | 6 | Read and send channel messages with replies |
 | Teams -- Chats | 6 | 1:1 and group chats, send messages |
 | People & Presence | 8 | People search, org chart, presence status |
-| Planner | 17 | Plans, buckets, tasks, task details with ETag |
-| Accounts | 1 | List configured Exchange accounts |
-| **Total** | **181** | |
+| Planner | 18 | Plans, buckets, tasks, task details with ETag |
+| Shared Mailbox | 8 | Read another user's mailbox, calendar, and OneDrive via delegate/shared access |
+| **Total** | **229** | |
 
 ## Quick Start
 
@@ -49,13 +49,7 @@ A [Model Context Protocol (MCP)](https://modelcontextprotocol.io/) server that p
 npx -y @jbctechsolutions/mcp-office365
 ```
 
-By default the server uses the **Microsoft Graph API** backend (cross-platform, full read/write access).
-
-To use the **AppleScript backend** (classic Outlook for Mac only, limited features), set the environment variable:
-
-```bash
-USE_APPLESCRIPT=1
-```
+The server connects to Microsoft 365 via the **Microsoft Graph API** (cross-platform, full read/write access).
 
 ### Pre-authenticate (optional)
 
@@ -65,32 +59,49 @@ npx @jbctechsolutions/mcp-office365 auth --status
 npx @jbctechsolutions/mcp-office365 auth --logout
 ```
 
-### Claude Desktop configuration
+### Server flags
 
-Add to `~/Library/Application Support/Claude/claude_desktop_config.json`:
+Pass these when launching the server (after any subcommand) to scope the exposed
+tool surface:
+
+| Flag | Effect |
+| --- | --- |
+| `--preset <names>` | Expose only the listed domains (comma-separated). Repeatable. Default (or `all`) exposes the full surface. |
+| `--read-only` | Expose only read tools (`readOnlyHint: true`). All writes, `prepare_*`/`confirm_*`, and destructive tools are hidden; calling one returns a `READ_ONLY_MODE` error. Note: `download_*` and `get_*_photo` tools are excluded too — they write fetched bytes to local disk and so are not read-only. |
+| `--confirm <mode>` | How a destructive `prepare_*` seeks confirmation. `token` (default) returns an approval token to pass to the matching `confirm_*` tool. `elicit` asks the user inline (MCP elicitation, ~60s) and, on approval, executes immediately; if the client can't elicit, the user cancels, or it times out, it falls back to the token flow. An explicit decline cancels and invalidates the token. |
+
+Valid presets: `mail`, `calendar`, `contacts`, `tasks`, `notes`, `teams`,
+`planner`, `files`, `sharepoint`, `excel`, `people`, `meetings`, `shared` (plus `all`).
+An unknown preset name fails startup with the valid list.
+
+```bash
+# Mail + calendar only, read-only
+npx @jbctechsolutions/mcp-office365 --preset mail,calendar --read-only
+```
+
+In a client config, add them to `args`:
 
-**Graph API backend (default):**
 ```json
 {
   "mcpServers": {
     "office365": {
       "command": "npx",
-      "args": ["-y", "@jbctechsolutions/mcp-office365"]
+      "args": ["-y", "@jbctechsolutions/mcp-office365", "--preset", "mail,calendar", "--read-only"]
     }
   }
 }
 ```
 
-**AppleScript backend** (macOS + classic Outlook only):
+### Claude Desktop configuration
+
+Add to `~/Library/Application Support/Claude/claude_desktop_config.json`:
+
 ```json
 {
   "mcpServers": {
     "office365": {
       "command": "npx",
-      "args": ["-y", "@jbctechsolutions/mcp-office365"],
-      "env": {
-        "USE_APPLESCRIPT": "1"
-      }
+      "args": ["-y", "@jbctechsolutions/mcp-office365"]
     }
   }
 }
@@ -171,16 +182,7 @@ For production, work accounts with conditional access, or full control over the
 
 ## Tool Reference
 
-All 181 tools listed below. Tools marked *(Graph API)* require `USE_GRAPH_API=1`. Tools marked *(AppleScript only)* are not available with Graph API.
-
-<details>
-<summary><strong>Accounts (1)</strong></summary>
-
-| Tool | Description |
-|------|-------------|
-| `list_accounts` | List all Exchange accounts configured in Outlook |
-
-</details>
+All 229 tools listed below.
 
 <details>
 <summary><strong>Mail -- Reading (9)</strong></summary>
@@ -455,15 +457,16 @@ All 181 tools listed below. Tools marked *(Graph API)* require `USE_GRAPH_API=1`
 </details>
 
 <details>
-<summary><strong>Notes (3)</strong> <em>(AppleScript only)</em></summary>
+<summary><strong>OneNote (6)</strong> <em>(Graph API)</em></summary>
 
 | Tool | Description |
 |------|-------------|
-| `list_notes` | List notes with pagination |
-| `get_note` | Get note details |
-| `search_notes` | Search notes by content |
-
-> Notes are only available with the AppleScript backend. Microsoft Graph API does not provide access to Outlook Notes.
+| `list_notebooks` | List OneNote notebooks for the current user |
+| `list_note_sections` | List OneNote sections, optionally scoped to a notebook |
+| `list_note_pages` | List OneNote pages, optionally scoped to a section |
+| `get_note_page` | Get a OneNote page's metadata and HTML content |
+| `search_note_pages` | Search OneNote pages by keyword |
+| `create_note_page` | Create a new OneNote page in a section |
 
 </details>
 
@@ -548,7 +551,7 @@ All 181 tools listed below. Tools marked *(Graph API)* require `USE_GRAPH_API=1`
 </details>
 
 <details>
-<summary><strong>Planner (17)</strong> <em>(Graph API)</em></summary>
+<summary><strong>Planner (18)</strong> <em>(Graph API)</em></summary>
 
 | Tool | Description |
 |------|-------------|
@@ -562,6 +565,7 @@ All 181 tools listed below. Tools marked *(Graph API)* require `USE_GRAPH_API=1`
 | `prepare_delete_bucket` | Prepare to delete a Planner bucket (two-phase) |
 | `confirm_delete_bucket` | Confirm Planner bucket deletion |
 | `list_planner_tasks` | List all tasks in a Planner plan |
+| `list_my_planner_tasks` | List all Planner tasks assigned to the signed-in user across every plan |
 | `get_planner_task` | Get details for a specific Planner task |
 | `create_planner_task` | Create a new task in a Planner plan |
 | `update_planner_task` | Update a Planner task |
@@ -572,14 +576,27 @@ All 181 tools listed below. Tools marked *(Graph API)* require `USE_GRAPH_API=1`
 
 </details>
 
-## Architecture
+<details>
+<summary><strong>Shared Mailbox (8)</strong> <em>(Graph API)</em></summary>
 
-### Dual Backend
+Read another user's mailbox, calendar, or OneDrive via `/users/{upn}/...`, relying on the signed-in user having delegate/shared access (`Mail.Read.Shared` / `Calendars.Read.Shared` / `Files.Read.All`). Read-only. These return **raw Graph ids** (not durable tokens, which are scoped to your own `/me` mailbox); pass the `mailbox` plus the raw id back to the matching `get_*` tool.
 
-The server supports two backends:
+| Tool | Description |
+| --- | --- |
+| `list_shared_mailbox_folders` | List mail folders in a shared/delegated mailbox |
+| `list_shared_mailbox_emails` | List emails in a shared/delegated mailbox (optionally by folder) |
+| `get_shared_mailbox_email` | Get a single email from a shared/delegated mailbox by raw Graph id |
+| `search_shared_mailbox_emails` | Full-text search a shared/delegated mailbox |
+| `list_shared_calendar_events` | List events from another user's calendar (optionally within a window) |
+| `get_shared_calendar_event` | Get a single event from another user's calendar by raw Graph id |
+| `list_shared_user_drive_items` | List items in another user's OneDrive (root or a folder) |
+| `search_shared_user_drive_items` | Search another user's OneDrive |
 
-- **Microsoft Graph API (default)** -- connects to Microsoft 365 cloud services. Full read/write across all 181 tools. No Outlook installation required. Works on macOS, Windows, and Linux.
-- **AppleScript** (`USE_APPLESCRIPT=1`) -- communicates with classic Outlook for Mac via `osascript`. Works offline, no Microsoft account needed. Limited to reading mail, calendar, contacts, tasks, and notes, plus calendar write operations and email sending.
+</details>
+
+## Architecture
+
+The server connects to Microsoft 365 cloud services via the **Microsoft Graph API**. Full read/write access across all 229 tools. No Outlook installation required. Works on macOS, Windows, and Linux.
 
 ### Two-Phase Approval
 
@@ -587,7 +604,7 @@ Destructive operations (delete, send, move, forward, etc.) use a prepare/confirm
 
 ### ID Caching
 
-The server maintains an internal ID mapping layer. AppleScript and Graph API use different ID formats; the caching layer assigns stable numeric IDs so tool callers do not need to track backend-specific identifiers.
+The server maintains an internal ID mapping layer that assigns stable, durable identifier tokens for Graph API resources so tool callers do not need to track raw Graph object IDs.
 
 ### ETag Caching
 
@@ -597,8 +614,7 @@ Planner resources use ETag-based concurrency control. The server caches ETags fr
 
 ```
 src/
-  applescript/       AppleScript integration (legacy backend)
-  graph/             Microsoft Graph API integration (default)
+  graph/             Microsoft Graph API integration
     auth/            MSAL authentication, device code flow, token cache
     client/          Graph client wrapper with response caching
     mappers/         Graph-to-internal type mappers
@@ -609,7 +625,7 @@ src/
 
 ## Required Graph API Permissions
 
-These delegated permissions are requested when using the Graph API backend:
+These delegated permissions are requested via Microsoft Graph:
 
 | Permission | Purpose |
 |------------|---------|
@@ -629,24 +645,17 @@ These delegated permissions are requested when using the Graph API backend:
 | `User.ReadBasic.All` | Read basic user profiles and photos |
 | `Presence.Read.All` | Read user presence/availability |
 | `Group.Read.All` | Read Microsoft 365 groups (for Planner) |
+| `Mail.Read.Shared` | Read mail in shared/delegated mailboxes |
+| `Calendars.Read.Shared` | Read shared/delegated calendars |
+| `Files.Read.All` | Read another user's OneDrive files (shared/delegate access) |
 
 ## Environment Variables
 
 | Variable | Description | Default |
 |----------|-------------|---------|
-| `USE_APPLESCRIPT` | Set to `1` or `true` for legacy AppleScript backend | (unset -- uses Graph API) |
 | `OUTLOOK_MCP_CLIENT_ID` | Override the embedded Azure AD client ID | (embedded) |
 | `OUTLOOK_MCP_TENANT_ID` | Azure AD tenant ID | `common` |
 
-## Known Limitations
-
-**AppleScript backend:**
-- Google accounts in Outlook are not accessible (macOS/Outlook limitation). Use IMAP configuration or the Graph API backend instead.
-- Write operations limited to calendar events and email sending. All other writes require Graph API.
-
-**Graph API backend:**
-- Outlook Notes are not available (Graph API does not expose them). Use AppleScript backend for notes.
-
 ## Contributing
 
 We welcome contributions. Please see our [Contributing Guide](CONTRIBUTING.md) for details.

package/dist/approval/hash.d.ts

@@ -7,9 +7,9 @@
  * Used to detect if the email changed between prepare and confirm.
  */
 export declare function hashEmailForApproval(email: {
-    id: number;
+    id: string;
     subject: string | null;
-    folderId: number;
+    folderId: string;
     timeReceived: number | null;
 }): string;
 /**
@@ -17,7 +17,7 @@ export declare function hashEmailForApproval(email: {
  * Used to detect if the folder changed between prepare and confirm.
  */
 export declare function hashFolderForApproval(folder: {
-    id: number;
+    id: string;
     name: string | null;
     messageCount: number;
 }): string;
@@ -26,7 +26,7 @@ export declare function hashFolderForApproval(folder: {
  * Used to detect if the draft changed between prepare and confirm.
  */
 export declare function hashDraftForSend(draft: {
-    id: number;
+    id: string;
     subject: string | null;
     recipientCount: number;
 }): string;
@@ -45,7 +45,7 @@ export declare function hashDirectSendForApproval(params: {
  * Captures the original message ID, comment length, and reply-all flag.
  */
 export declare function hashReplyForApproval(params: {
-    originalId: number;
+    originalId: string;
     commentLength: number;
     replyAll: boolean;
 }): string;
@@ -54,7 +54,7 @@ export declare function hashReplyForApproval(params: {
  * Captures the original message ID and the number of forward recipients.
  */
 export declare function hashForwardForApproval(params: {
-    originalId: number;
+    originalId: string;
     recipientCount: number;
 }): string;
 /**
@@ -62,7 +62,7 @@ export declare function hashForwardForApproval(params: {
  * Used to detect if the event changed between prepare and confirm.
  */
 export declare function hashEventForApproval(event: {
-    id: number;
+    id: string;
     subject: string | null;
     startDateTime: string | null;
 }): string;
@@ -71,7 +71,7 @@ export declare function hashEventForApproval(event: {
  * Used to detect if the contact changed between prepare and confirm.
  */
 export declare function hashContactForApproval(contact: {
-    id: number;
+    id: string;
     displayName: string | null;
     emailAddress: string | null;
 }): string;

package/dist/approval/token-manager.d.ts

@@ -2,49 +2,67 @@
  * Copyright (c) 2026 JBC Tech Solutions, LLC
  * Licensed under the MIT License. See LICENSE file in the project root.
  */
+import type { StateStore } from '../state/store.js';
 import type { OperationType, TargetType, ApprovalToken, ValidationResult } from './types.js';
-/**
- * Manages approval tokens for destructive operations.
- *
- * Tokens are stored in memory and are single-use. They expire
- * after a configurable TTL (default 5 minutes).
- */
+/** Options for {@link ApprovalTokenManager}. */
+export interface ApprovalTokenManagerOptions {
+    /** Token lifetime (default 24h). */
+    ttlMs?: number;
+    /** Durable store; omit for in-memory (tests / degraded mode). */
+    store?: StateStore;
+    /**
+     * Account stamp for stored tokens (D7). May be a function, since the signed-in
+     * account (MSAL `homeAccountId`) is only known after auth — later than when
+     * this manager is constructed — and is resolved lazily at each token op.
+     */
+    accountId?: string | (() => string);
+    /** Clock, for deterministic tests. */
+    now?: () => number;
+}
 export declare class ApprovalTokenManager {
     private readonly tokens;
     private readonly ttlMs;
-    constructor(ttlMs?: number);
+    private readonly store;
+    private readonly resolveAccountId;
+    private readonly now;
+    constructor(options?: ApprovalTokenManagerOptions | number);
+    /** The account scope for store ops, resolved fresh each call (D7). */
+    private get accountId();
     /**
      * Generates a new approval token for a destructive operation.
      */
     generateToken(params: {
         operation: OperationType;
         targetType: TargetType;
-        targetId: number;
+        targetId: string;
         targetHash: string;
         metadata?: Record<string, unknown>;
     }): ApprovalToken;
     /**
-     * Looks up a token by ID without consuming or validating it.
-     * Returns undefined if the token does not exist.
+     * Looks up a token by ID without consuming or validating it. Returns undefined
+     * if the token does not exist (or belongs to another account, when durable).
      */
     lookupToken(tokenId: string): ApprovalToken | undefined;
     /**
-     * Validates a token without consuming it or modifying state.
-     * Checks existence, expiry, operation match, and target match.
+     * Validates a token without consuming it. Checks existence, prior redemption,
+     * expiry, operation match, and target match.
      */
-    validateToken(tokenId: string, operation: OperationType, targetId: number): ValidationResult;
+    validateToken(tokenId: string, operation: OperationType, targetId: string): ValidationResult;
+    private check;
     /**
-     * Validates and consumes a token (one-time use).
-     * On success, the token is removed from the store.
+     * Validates and consumes a token (one-time use). Durable stores use an atomic
+     * guarded consume so only one caller — across processes sharing the db — can
+     * redeem it; a losing/repeat caller gets `ALREADY_CONSUMED` (D8).
      */
-    consumeToken(tokenId: string, operation: OperationType, targetId: number): ValidationResult;
+    consumeToken(tokenId: string, operation: OperationType, targetId: string): ValidationResult;
     /**
-     * Removes all expired tokens from the store.
+     * Removes expired tokens from the in-memory store. Durable stores purge on
+     * boot (90-day retention), so this is a no-op there.
      */
     cleanupExpiredTokens(): void;
     /**
-     * Returns the number of active (non-expired) tokens.
-     * Useful for testing and monitoring.
+     * Number of active in-memory tokens (testing/monitoring). Durable tokens are
+     * not counted here — they live in the store.
      */
     get size(): number;
 }

package/dist/approval/token-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"token-manager.d.ts","sourceRoot":"","sources":["../../src/approval/token-manager.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAUH,OAAO,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAa7F;;;;;GAKG;AACH,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAoC;IAC3D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;gBAEnB,KAAK,GAAE,MAAuB;IAI1C;;OAEG;IACH,aAAa,CAAC,MAAM,EAAE;QACpB,SAAS,EAAE,aAAa,CAAC;QACzB,UAAU,EAAE,UAAU,CAAC;QACvB,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,EAAE,MAAM,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACpC,GAAG,aAAa;IAsBjB;;;OAGG;IACH,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS;IAIvD;;;OAGG;IACH,aAAa,CACX,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,aAAa,EACxB,QAAQ,EAAE,MAAM,GACf,gBAAgB;IAsBnB;;;OAGG;IACH,YAAY,CACV,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,aAAa,EACxB,QAAQ,EAAE,MAAM,GACf,gBAAgB;IAUnB;;OAEG;IACH,oBAAoB,IAAI,IAAI;IAS5B;;;OAGG;IACH,IAAI,IAAI,IAAI,MAAM,CAEjB;CACF"}
+{"version":3,"file":"token-manager.d.ts","sourceRoot":"","sources":["../../src/approval/token-manager.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAeH,OAAO,KAAK,EAAE,UAAU,EAAoB,MAAM,mBAAmB,CAAC;AACtE,OAAO,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAa7F,gDAAgD;AAChD,MAAM,WAAW,2BAA2B;IAC1C,oCAAoC;IACpC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iEAAiE;IACjE,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;IACpC,sCAAsC;IACtC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAoC;IAC3D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAyB;IAC/C,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAe;IAChD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;gBAEvB,OAAO,GAAE,2BAA2B,GAAG,MAAW;IAU9D,sEAAsE;IACtE,OAAO,KAAK,SAAS,GAEpB;IAED;;OAEG;IACH,aAAa,CAAC,MAAM,EAAE;QACpB,SAAS,EAAE,aAAa,CAAC;QACzB,UAAU,EAAE,UAAU,CAAC;QACvB,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,EAAE,MAAM,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACpC,GAAG,aAAa;IAsCjB;;;OAGG;IACH,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS;IAQvD;;;OAGG;IACH,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,GAAG,gBAAgB;IAyB5F,OAAO,CAAC,KAAK;IAeb;;;;OAIG;IACH,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,GAAG,gBAAgB;IA4B3F;;;OAGG;IACH,oBAAoB,IAAI,IAAI;IAY5B;;;OAGG;IACH,IAAI,IAAI,IAAI,MAAM,CAEjB;CACF"}

package/dist/approval/token-manager.js

@@ -3,41 +3,43 @@
  * Licensed under the MIT License. See LICENSE file in the project root.
  */
 /**
- * Approval token manager.
+ * Approval token manager (U9). Manages the lifecycle of two-phase approval
+ * tokens: generation, validation, and atomic single-use consumption.
  *
- * Manages the lifecycle of approval tokens: generation, validation,
- * consumption (one-time use), and expiry cleanup.
+ * When a durable {@link StateStore} is supplied (production), tokens persist to
+ * SQLite with a 24h TTL and are consumed via an atomic guarded write (D8), so an
+ * approval prepared in one process/session survives a restart and can be
+ * redeemed exactly once — even across concurrent Claude Code windows. Without a
+ * store (tests / degraded mode) it falls back to an in-memory map, preserving
+ * the original behavior and public surface.
  */
 import { randomUUID } from 'node:crypto';
-// =============================================================================
-// Constants
-// =============================================================================
-const DEFAULT_TTL_MS = 5 * 60 * 1000; // 5 minutes
+const DEFAULT_TTL_MS = 24 * 60 * 60 * 1000; // 24h (D8, up from 5 minutes)
 const CLEANUP_THRESHOLD = 100;
-// =============================================================================
-// Token Manager
-// =============================================================================
-/**
- * Manages approval tokens for destructive operations.
- *
- * Tokens are stored in memory and are single-use. They expire
- * after a configurable TTL (default 5 minutes).
- */
 export class ApprovalTokenManager {
     tokens = new Map();
     ttlMs;
-    constructor(ttlMs = DEFAULT_TTL_MS) {
-        this.ttlMs = ttlMs;
+    store;
+    resolveAccountId;
+    now;
+    constructor(options = {}) {
+        // Back-compat: some call sites/tests pass a bare ttlMs number.
+        const opts = typeof options === 'number' ? { ttlMs: options } : options;
+        this.ttlMs = opts.ttlMs ?? DEFAULT_TTL_MS;
+        this.store = opts.store;
+        const account = opts.accountId ?? 'default';
+        this.resolveAccountId = typeof account === 'function' ? account : (() => account);
+        this.now = opts.now ?? (() => Date.now());
+    }
+    /** The account scope for store ops, resolved fresh each call (D7). */
+    get accountId() {
+        return this.resolveAccountId();
     }
     /**
      * Generates a new approval token for a destructive operation.
      */
     generateToken(params) {
-        // Clean up expired tokens if the map is getting large
-        if (this.tokens.size > CLEANUP_THRESHOLD) {
-            this.cleanupExpiredTokens();
-        }
-        const now = Date.now();
+        const now = this.now();
         const token = {
             tokenId: randomUUID(),
             operation: params.operation,
@@ -48,26 +50,73 @@ export class ApprovalTokenManager {
             expiresAt: now + this.ttlMs,
             metadata: Object.freeze({ ...params.metadata }),
         };
-        this.tokens.set(token.tokenId, token);
+        if (this.store != null) {
+            const target = {
+                targetType: token.targetType,
+                targetId: token.targetId,
+                targetHash: token.targetHash,
+                metadata: { ...token.metadata },
+            };
+            this.store.putApprovalToken({
+                token: token.tokenId,
+                action: token.operation,
+                targetJson: JSON.stringify(target),
+                contentHash: token.targetHash,
+                accountId: this.accountId,
+                expiresAt: token.expiresAt,
+                createdAt: token.createdAt,
+            });
+        }
+        else {
+            if (this.tokens.size > CLEANUP_THRESHOLD) {
+                this.cleanupExpiredTokens();
+            }
+            this.tokens.set(token.tokenId, token);
+        }
         return token;
     }
     /**
-     * Looks up a token by ID without consuming or validating it.
-     * Returns undefined if the token does not exist.
+     * Looks up a token by ID without consuming or validating it. Returns undefined
+     * if the token does not exist (or belongs to another account, when durable).
      */
     lookupToken(tokenId) {
+        if (this.store != null) {
+            const row = this.store.getApprovalToken(tokenId, this.accountId);
+            return row != null ? (rowToToken(row) ?? undefined) : undefined;
+        }
         return this.tokens.get(tokenId);
     }
     /**
-     * Validates a token without consuming it or modifying state.
-     * Checks existence, expiry, operation match, and target match.
+     * Validates a token without consuming it. Checks existence, prior redemption,
+     * expiry, operation match, and target match.
      */
     validateToken(tokenId, operation, targetId) {
+        if (this.store != null) {
+            const row = this.store.getApprovalToken(tokenId, this.accountId);
+            if (row == null) {
+                return { valid: false, error: 'NOT_FOUND' };
+            }
+            if (row.redeemedAt != null) {
+                return { valid: false, error: 'ALREADY_CONSUMED' };
+            }
+            const token = rowToToken(row);
+            // A corrupt/tampered target_json fails closed as NOT_FOUND rather than
+            // throwing out of validate — the token simply can't be redeemed.
+            if (token == null) {
+                return { valid: false, error: 'NOT_FOUND' };
+            }
+            return this.check(token, operation, targetId);
+        }
         const token = this.tokens.get(tokenId);
         if (token == null) {
             return { valid: false, error: 'NOT_FOUND' };
         }
-        if (Date.now() > token.expiresAt) {
+        return this.check(token, operation, targetId);
+    }
+    check(token, operation, targetId) {
+        // `>=` so validate agrees with the store's consume guard (expires_at > now):
+        // a token is expired at the exact expiry instant, on both paths.
+        if (this.now() >= token.expiresAt) {
             return { valid: false, error: 'EXPIRED' };
         }
         if (token.operation !== operation) {
@@ -79,21 +128,44 @@ export class ApprovalTokenManager {
         return { valid: true, token };
     }
     /**
-     * Validates and consumes a token (one-time use).
-     * On success, the token is removed from the store.
+     * Validates and consumes a token (one-time use). Durable stores use an atomic
+     * guarded consume so only one caller — across processes sharing the db — can
+     * redeem it; a losing/repeat caller gets `ALREADY_CONSUMED` (D8).
      */
     consumeToken(tokenId, operation, targetId) {
         const result = this.validateToken(tokenId, operation, targetId);
-        if (result.valid) {
-            this.tokens.delete(tokenId);
+        if (!result.valid) {
+            return result;
+        }
+        if (this.store != null) {
+            const consumed = this.store.consumeApprovalToken({
+                token: tokenId,
+                accountId: this.accountId,
+                now: this.now(),
+            });
+            switch (consumed.status) {
+                case 'consumed':
+                    return result;
+                case 'already_redeemed':
+                    return { valid: false, error: 'ALREADY_CONSUMED' };
+                case 'expired':
+                    return { valid: false, error: 'EXPIRED' };
+                default:
+                    return { valid: false, error: 'NOT_FOUND' };
+            }
         }
+        this.tokens.delete(tokenId);
         return result;
     }
     /**
-     * Removes all expired tokens from the store.
+     * Removes expired tokens from the in-memory store. Durable stores purge on
+     * boot (90-day retention), so this is a no-op there.
      */
     cleanupExpiredTokens() {
-        const now = Date.now();
+        if (this.store != null) {
+            return;
+        }
+        const now = this.now();
         for (const [tokenId, token] of this.tokens) {
             if (now > token.expiresAt) {
                 this.tokens.delete(tokenId);
@@ -101,11 +173,35 @@ export class ApprovalTokenManager {
         }
     }
     /**
-     * Returns the number of active (non-expired) tokens.
-     * Useful for testing and monitoring.
+     * Number of active in-memory tokens (testing/monitoring). Durable tokens are
+     * not counted here — they live in the store.
      */
     get size() {
         return this.tokens.size;
     }
 }
+/** Reconstructs an {@link ApprovalToken} from a stored row, or null if the
+ * persisted target JSON is corrupt/unparseable (fail closed). */
+function rowToToken(row) {
+    let target;
+    try {
+        target = JSON.parse(row.targetJson);
+    }
+    catch {
+        return null;
+    }
+    return {
+        tokenId: row.token,
+        operation: row.action,
+        targetType: target.targetType,
+        // Coerce to string: a token persisted by a pre-v4 build may carry a numeric
+        // targetId (e.g. the send_email/upload_file sentinel `0`), which would else
+        // fail the strict `!==` target check against v4's string ids within the TTL.
+        targetId: String(target.targetId),
+        targetHash: target.targetHash ?? row.contentHash ?? '',
+        createdAt: row.createdAt,
+        expiresAt: row.expiresAt,
+        metadata: Object.freeze({ ...target.metadata }),
+    };
+}
 //# sourceMappingURL=token-manager.js.map