@mcp-z/mcp-outlook 2.1.0 → 2.2.1

package/README.md

@@ -2,6 +2,8 @@
 
 MCP server for Outlook integration with OAuth authentication, message search, and batch operations
 
+Requires Node.js >=20. The examples use `npx`, included with npm, to run this server and `@mcp-z/cli`.
+
 ## Common uses
 
 - Search and read messages
@@ -12,6 +14,11 @@ MCP server for Outlook integration with OAuth authentication, message search, an
 
 MCP supports stdio and HTTP.
 
+Both the 2025 and 2026-07-28 protocol revisions are served, over either transport, from the same
+server. Your client negotiates whichever it speaks. A 2025 client keeps working with no change,
+and support for it is not being dropped. The 2026-07-28 revision is stateless, so a client speaking
+it sends no `initialize` handshake and carries no session id.
+
 **Stdio**
 ```json
 {
@@ -40,7 +47,7 @@ MCP supports stdio and HTTP.
 }
 ```
 
-`start` is an extension used by `npx @mcp-z/cli up` to launch HTTP servers for you.
+`start` is an extension used by `npx @mcp-z/cli up` to launch HTTP servers for you. The HTTP endpoint is `/mcp`.
 
 ## Create a Microsoft app
 
@@ -49,10 +56,10 @@ MCP supports stdio and HTTP.
 3. Click New registration.
 4. Choose a name and select a supported account type.
 5. Copy the Application (client) ID and Directory (tenant) ID.
-6. Select your MCP transport (stdio for local and http for remote) and platform
-- For stdio, choose "Authentication", + Add Redirect URI, "Mobile and desktop applications" platform 
-- For http, choose "Authentication", + Add Redirect URI, "Web" platform, add your URL (default is http://localhost:3000/oauth/callback based on the --port or PORT)
-- For local hosting, add "http://localhost" for [Ephemeral redirect URL](https://en.wikipedia.org/wiki/Ephemeral_port)
+6. Select the credential platform that matches your transport:
+   - For stdio, choose "Mobile and desktop applications" under Authentication and add the loopback redirect URI.
+   - For HTTP, choose "Web" and add your public `/oauth/callback` URL. Local HTTP uses the port configured with `--port` or `PORT`.
+   - For local hosting, add `http://localhost` for the [ephemeral redirect URL](https://en.wikipedia.org/wiki/Ephemeral_port).
 7. Enable OAuth2 scopes in API Permissions: openid profile offline_access https://graph.microsoft.com/User.Read https://graph.microsoft.com/Mail.ReadWrite https://graph.microsoft.com/Mail.Send https://graph.microsoft.com/MailboxSettings.ReadWrite
 
 ## OAuth modes
@@ -91,7 +98,7 @@ Example (http) - Create .mcp.json:
   "mcpServers": {
     "outlook": {
       "type": "http",
-      "url": "http://localhost:3000",
+      "url": "http://localhost:3000/mcp",
       "start": {
         "command": "npx",
         "args": ["-y", "@mcp-z/mcp-outlook", "--port=3000"],
@@ -107,7 +114,7 @@ Example (http) - Create .mcp.json:
 
 Local (default): omit REDIRECT_URI → ephemeral loopback. Cloud: set REDIRECT_URI to your public /oauth/callback and expose the service publicly.
 
-Note: start block is a helper in "npx @mcp-z/cli up" for starting an http server from your .mpc.json. See [@mcp-z/cli](https://github.com/mcp-z/cli) for details.
+Note: the `start` block is a helper in `npx @mcp-z/cli up` for starting an HTTP server from your `.mcp.json`. See [@mcp-z/cli](https://github.com/mcp-z/cli) for details.
 
 ### Device code
 
@@ -158,10 +165,10 @@ HTTP only. Requires a public base URL. CSV export and `/files` are disabled in D
 
 ```bash
 # List tools
-mcp-z inspect --servers outlook --tools
+npx -y @mcp-z/cli inspect --servers outlook --tools
 
 # Call a tool
-mcp-z call outlook message-search '{"query":"from:alice@example.com"}'
+npx -y @mcp-z/cli call-tool outlook message-search '{"query":"from:alice@example.com"}'
 ```
 
 ## Tools
@@ -189,7 +196,7 @@ mcp-z call outlook message-search '{"query":"from:alice@example.com"}'
 
 ## Configuration reference
 
-See `server.json` for all supported environment variables, CLI arguments, and defaults.
+See [`server.json`](https://github.com/mcp-z/mcp-outlook/blob/master/server.json) for all supported environment variables, CLI arguments, and defaults.
 
 ## Storage backends
 
@@ -207,6 +214,6 @@ TOKEN_STORE_URI=redis://localhost:6379 mcp-outlook
 
 A protocol whose adapter is missing fails at startup naming the package to install.
 
-### Documentation
+## Documentation
 
 [API Docs](https://mcp-z.github.io/mcp-outlook)

package/dist/cjs/mcp/resources/email.d.cts

@@ -1,11 +1,9 @@
-import type { ReadResourceResult, ServerContext } from '@mcp-z/server';
+import type { ReadResourceResult, ResourceConfig, ServerContext } from '@mcp-z/server';
 import { ResourceTemplate } from '@mcp-z/server';
 export default function createResource(): {
     name: string;
     template: ResourceTemplate;
-    config: import("@modelcontextprotocol/server").ResourceMetadata & {
-        cacheHint?: import("@modelcontextprotocol/server").CacheHint;
-    };
+    config: ResourceConfig;
     handler: (uri: URL, variables: {
         id: string;
     }, extra: ServerContext) => Promise<ReadResourceResult>;

package/dist/cjs/mcp/resources/email.d.ts

@@ -1,11 +1,9 @@
-import type { ReadResourceResult, ServerContext } from '@mcp-z/server';
+import type { ReadResourceResult, ResourceConfig, ServerContext } from '@mcp-z/server';
 import { ResourceTemplate } from '@mcp-z/server';
 export default function createResource(): {
     name: string;
     template: ResourceTemplate;
-    config: import("@modelcontextprotocol/server").ResourceMetadata & {
-        cacheHint?: import("@modelcontextprotocol/server").CacheHint;
-    };
+    config: ResourceConfig;
     handler: (uri: URL, variables: {
         id: string;
     }, extra: ServerContext) => Promise<ReadResourceResult>;

package/dist/cjs/setup/http.js

@@ -203,6 +203,8 @@ function createHTTPServer(config, overrides) {
                         var mcpServer = new _server.McpServer({
                             name: config.name,
                             version: config.version
+                        }, {
+                            cacheHints: _server.defaultCacheHints
                         });
                         (0, _server.registerTools)(mcpServer, filteredTools);
                         (0, _server.registerResources)(mcpServer, composed.resources);

package/dist/cjs/setup/http.js.map

@@ -1 +1 @@
-{"version":3,"sources":["/Users/kevin/Dev/OpenSource/ai/mcp-z/mcp-outlook/src/setup/http.ts"],"sourcesContent":["import { composeMiddleware, connectHttp, createFileServingRouter, McpServer, registerPrompts, registerResources, registerTools } from '@mcp-z/server';\nimport cors from 'cors';\nimport express from 'express';\nimport type { RuntimeOverrides, ServerConfig } from '../types.ts';\nimport { createDefaultRuntime } from './runtime.ts';\n\nexport async function createHTTPServer(config: ServerConfig, overrides?: RuntimeOverrides) {\n  const runtime = await createDefaultRuntime(config, overrides);\n  const modules = runtime.createDomainModules();\n  const layers = runtime.middlewareFactories.map((factory) => factory(runtime.deps));\n  const composed = composeMiddleware(modules, layers);\n  const logger = runtime.deps.logger;\n  const port = config.transport.port;\n  if (!port) throw new Error('Port is required for HTTP transport');\n\n  const tools = [...composed.tools, ...runtime.deps.oauthAdapters.accountTools];\n  const filteredTools =\n    config.auth === 'dcr'\n      ? tools.filter((tool) => tool.name !== 'messages-export-csv') // No file storage in DCR (public cloud responsibility)\n      : tools;\n  const prompts = [...composed.prompts, ...runtime.deps.oauthAdapters.accountPrompts];\n\n  // Built per request (HTTP) and per connection (stdio), not shared. The SDK caches the\n  // negotiated protocol revision on the McpServer instance - its own docs say a negotiated\n  // session never re-routes a method onto the other era - so one shared instance pins itself\n  // to whichever revision reaches it first and answers the other with -32601.\n  const buildServer = () => {\n    const mcpServer = new McpServer({ name: config.name, version: config.version });\n    registerTools(mcpServer, filteredTools);\n    registerResources(mcpServer, composed.resources);\n    registerPrompts(mcpServer, prompts);\n    return mcpServer;\n  };\n\n  const app = express();\n  app.use(express.json({ limit: '10mb' }));\n\n  // Must mount '/mcp' before any permissive app-level cors(), or that layer answers its\n  // preflight first; pass baseUrl's origin/host below or a public deployment 403s itself.\n  const publicUrl = config.baseUrl ? new URL(config.baseUrl) : undefined;\n  logger.info(`Starting ${config.name} MCP server (http)`);\n  const { close, httpServer } = await connectHttp(buildServer, {\n    logger,\n    app,\n    port,\n    allowedOrigins: publicUrl ? [publicUrl.origin] : undefined,\n    allowedHosts: publicUrl ? [publicUrl.host] : undefined,\n  });\n\n  // The loopback OAuth callback, the file-export download, and the DCR discovery/\n  // registration endpoints are all meant to be reached from a browser on another\n  // origin. Keep cors() for them, scoped to their own routes - never in front of '/mcp'.\n  if (runtime.deps.oauthAdapters.loopbackRouter) {\n    app.use('/', cors(), runtime.deps.oauthAdapters.loopbackRouter);\n    logger.info('Mounted loopback OAuth callback router');\n  }\n\n  if (config.auth !== 'dcr') {\n    const fileRouter = createFileServingRouter({ resourceStoreUri: config.resourceStoreUri }, { contentType: 'text/csv', contentDisposition: 'attachment' });\n    app.use('/files', cors(), fileRouter);\n  }\n\n  if (runtime.deps.oauthAdapters.dcrRouter) {\n    app.use('/', cors(), runtime.deps.oauthAdapters.dcrRouter);\n    logger.info('Mounted DCR router with OAuth endpoints');\n  }\n\n  logger.info('http transport ready');\n\n  return {\n    httpServer,\n    logger,\n    close: async () => {\n      await close();\n      await runtime.close();\n    },\n  };\n}\n"],"names":["createHTTPServer","config","overrides","runtime","modules","layers","composed","logger","port","tools","filteredTools","prompts","buildServer","app","publicUrl","close","httpServer","fileRouter","createDefaultRuntime","createDomainModules","middlewareFactories","map","factory","deps","composeMiddleware","transport","Error","oauthAdapters","accountTools","auth","filter","tool","name","accountPrompts","mcpServer","McpServer","version","registerTools","registerResources","resources","registerPrompts","express","use","json","limit","baseUrl","URL","undefined","info","connectHttp","allowedOrigins","origin","allowedHosts","host","loopbackRouter","cors","createFileServingRouter","resourceStoreUri","contentType","contentDisposition","dcrRouter"],"mappings":";;;;+BAMsBA;;;eAAAA;;;sBANgH;2DACrH;8DACG;yBAEiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAE9B,SAAeA,iBAAiBC,MAAoB,EAAEC,SAA4B;;YACjFC,SACAC,SACAC,QACAC,UACAC,QACAC,MAGAC,OACAC,eAIAC,SAMAC,aAQAC,KAKAC,WAEwB,MAAtBC,OAAOC,YAiBPC;;;;oBAnDQ;;wBAAMC,IAAAA,+BAAoB,EAACjB,QAAQC;;;oBAA7CC,UAAU;oBACVC,UAAUD,QAAQgB,mBAAmB;oBACrCd,SAASF,QAAQiB,mBAAmB,CAACC,GAAG,CAAC,SAACC;+BAAYA,QAAQnB,QAAQoB,IAAI;;oBAC1EjB,WAAWkB,IAAAA,yBAAiB,EAACpB,SAASC;oBACtCE,SAASJ,QAAQoB,IAAI,CAAChB,MAAM;oBAC5BC,OAAOP,OAAOwB,SAAS,CAACjB,IAAI;oBAClC,IAAI,CAACA,MAAM,MAAM,IAAIkB,MAAM;oBAErBjB,QAAQ,AAAC,qBAAGH,SAASG,KAAK,SAAE,qBAAGN,QAAQoB,IAAI,CAACI,aAAa,CAACC,YAAY;oBACtElB,gBACJT,OAAO4B,IAAI,KAAK,QACZpB,MAAMqB,MAAM,CAAC,SAACC;+BAASA,KAAKC,IAAI,KAAK;uBAAuB,uDAAuD;uBACnHvB;oBACAE,UAAU,AAAC,qBAAGL,SAASK,OAAO,SAAE,qBAAGR,QAAQoB,IAAI,CAACI,aAAa,CAACM,cAAc;oBAElF,sFAAsF;oBACtF,yFAAyF;oBACzF,2FAA2F;oBAC3F,4EAA4E;oBACtErB,cAAc;wBAClB,IAAMsB,YAAY,IAAIC,iBAAS,CAAC;4BAAEH,MAAM/B,OAAO+B,IAAI;4BAAEI,SAASnC,OAAOmC,OAAO;wBAAC;wBAC7EC,IAAAA,qBAAa,EAACH,WAAWxB;wBACzB4B,IAAAA,yBAAiB,EAACJ,WAAW5B,SAASiC,SAAS;wBAC/CC,IAAAA,uBAAe,EAACN,WAAWvB;wBAC3B,OAAOuB;oBACT;oBAEMrB,MAAM4B,IAAAA,gBAAO;oBACnB5B,IAAI6B,GAAG,CAACD,gBAAO,CAACE,IAAI,CAAC;wBAAEC,OAAO;oBAAO;oBAErC,sFAAsF;oBACtF,wFAAwF;oBAClF9B,YAAYb,OAAO4C,OAAO,GAAG,IAAIC,IAAI7C,OAAO4C,OAAO,IAAIE;oBAC7DxC,OAAOyC,IAAI,CAAC,AAAC,YAAuB,OAAZ/C,OAAO+B,IAAI,EAAC;oBACN;;wBAAMiB,IAAAA,mBAAW,EAACrC,aAAa;4BAC3DL,QAAAA;4BACAM,KAAAA;4BACAL,MAAAA;4BACA0C,gBAAgBpC;gCAAaA,UAAUqC,MAAM;gCAAIJ;4BACjDK,cAActC;gCAAaA,UAAUuC,IAAI;gCAAIN;wBAC/C;;;oBAN8B,OAAA,eAAtBhC,QAAsB,KAAtBA,OAAOC,aAAe,KAAfA;oBAQf,gFAAgF;oBAChF,+EAA+E;oBAC/E,uFAAuF;oBACvF,IAAIb,QAAQoB,IAAI,CAACI,aAAa,CAAC2B,cAAc,EAAE;wBAC7CzC,IAAI6B,GAAG,CAAC,KAAKa,IAAAA,aAAI,KAAIpD,QAAQoB,IAAI,CAACI,aAAa,CAAC2B,cAAc;wBAC9D/C,OAAOyC,IAAI,CAAC;oBACd;oBAEA,IAAI/C,OAAO4B,IAAI,KAAK,OAAO;wBACnBZ,aAAauC,IAAAA,+BAAuB,EAAC;4BAAEC,kBAAkBxD,OAAOwD,gBAAgB;wBAAC,GAAG;4BAAEC,aAAa;4BAAYC,oBAAoB;wBAAa;wBACtJ9C,IAAI6B,GAAG,CAAC,UAAUa,IAAAA,aAAI,KAAItC;oBAC5B;oBAEA,IAAId,QAAQoB,IAAI,CAACI,aAAa,CAACiC,SAAS,EAAE;wBACxC/C,IAAI6B,GAAG,CAAC,KAAKa,IAAAA,aAAI,KAAIpD,QAAQoB,IAAI,CAACI,aAAa,CAACiC,SAAS;wBACzDrD,OAAOyC,IAAI,CAAC;oBACd;oBAEAzC,OAAOyC,IAAI,CAAC;oBAEZ;;wBAAO;4BACLhC,YAAAA;4BACAT,QAAAA;4BACAQ,OAAO,SAAPA;;;;;gDACE;;oDAAMA;;;gDAAN;gDACA;;oDAAMZ,QAAQY,KAAK;;;gDAAnB;;;;;;gCACF;;wBACF;;;;IACF"}
+{"version":3,"sources":["/Users/kevin/Dev/OpenSource/ai/mcp-z/mcp-outlook/src/setup/http.ts"],"sourcesContent":["import { composeMiddleware, connectHttp, createFileServingRouter, defaultCacheHints, McpServer, registerPrompts, registerResources, registerTools } from '@mcp-z/server';\nimport cors from 'cors';\nimport express from 'express';\nimport type { RuntimeOverrides, ServerConfig } from '../types.ts';\nimport { createDefaultRuntime } from './runtime.ts';\n\nexport async function createHTTPServer(config: ServerConfig, overrides?: RuntimeOverrides) {\n  const runtime = await createDefaultRuntime(config, overrides);\n  const modules = runtime.createDomainModules();\n  const layers = runtime.middlewareFactories.map((factory) => factory(runtime.deps));\n  const composed = composeMiddleware(modules, layers);\n  const logger = runtime.deps.logger;\n  const port = config.transport.port;\n  if (!port) throw new Error('Port is required for HTTP transport');\n\n  const tools = [...composed.tools, ...runtime.deps.oauthAdapters.accountTools];\n  const filteredTools =\n    config.auth === 'dcr'\n      ? tools.filter((tool) => tool.name !== 'messages-export-csv') // No file storage in DCR (public cloud responsibility)\n      : tools;\n  const prompts = [...composed.prompts, ...runtime.deps.oauthAdapters.accountPrompts];\n\n  // Built per request (HTTP) and per connection (stdio), not shared. The SDK caches the\n  // negotiated protocol revision on the McpServer instance - its own docs say a negotiated\n  // session never re-routes a method onto the other era - so one shared instance pins itself\n  // to whichever revision reaches it first and answers the other with -32601.\n  const buildServer = () => {\n    const mcpServer = new McpServer({ name: config.name, version: config.version }, { cacheHints: defaultCacheHints });\n    registerTools(mcpServer, filteredTools);\n    registerResources(mcpServer, composed.resources);\n    registerPrompts(mcpServer, prompts);\n    return mcpServer;\n  };\n\n  const app = express();\n  app.use(express.json({ limit: '10mb' }));\n\n  // Must mount '/mcp' before any permissive app-level cors(), or that layer answers its\n  // preflight first; pass baseUrl's origin/host below or a public deployment 403s itself.\n  const publicUrl = config.baseUrl ? new URL(config.baseUrl) : undefined;\n  logger.info(`Starting ${config.name} MCP server (http)`);\n  const { close, httpServer } = await connectHttp(buildServer, {\n    logger,\n    app,\n    port,\n    allowedOrigins: publicUrl ? [publicUrl.origin] : undefined,\n    allowedHosts: publicUrl ? [publicUrl.host] : undefined,\n  });\n\n  // The loopback OAuth callback, the file-export download, and the DCR discovery/\n  // registration endpoints are all meant to be reached from a browser on another\n  // origin. Keep cors() for them, scoped to their own routes - never in front of '/mcp'.\n  if (runtime.deps.oauthAdapters.loopbackRouter) {\n    app.use('/', cors(), runtime.deps.oauthAdapters.loopbackRouter);\n    logger.info('Mounted loopback OAuth callback router');\n  }\n\n  if (config.auth !== 'dcr') {\n    const fileRouter = createFileServingRouter({ resourceStoreUri: config.resourceStoreUri }, { contentType: 'text/csv', contentDisposition: 'attachment' });\n    app.use('/files', cors(), fileRouter);\n  }\n\n  if (runtime.deps.oauthAdapters.dcrRouter) {\n    app.use('/', cors(), runtime.deps.oauthAdapters.dcrRouter);\n    logger.info('Mounted DCR router with OAuth endpoints');\n  }\n\n  logger.info('http transport ready');\n\n  return {\n    httpServer,\n    logger,\n    close: async () => {\n      await close();\n      await runtime.close();\n    },\n  };\n}\n"],"names":["createHTTPServer","config","overrides","runtime","modules","layers","composed","logger","port","tools","filteredTools","prompts","buildServer","app","publicUrl","close","httpServer","fileRouter","createDefaultRuntime","createDomainModules","middlewareFactories","map","factory","deps","composeMiddleware","transport","Error","oauthAdapters","accountTools","auth","filter","tool","name","accountPrompts","mcpServer","McpServer","version","cacheHints","defaultCacheHints","registerTools","registerResources","resources","registerPrompts","express","use","json","limit","baseUrl","URL","undefined","info","connectHttp","allowedOrigins","origin","allowedHosts","host","loopbackRouter","cors","createFileServingRouter","resourceStoreUri","contentType","contentDisposition","dcrRouter"],"mappings":";;;;+BAMsBA;;;eAAAA;;;sBANmI;2DACxI;8DACG;yBAEiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAE9B,SAAeA,iBAAiBC,MAAoB,EAAEC,SAA4B;;YACjFC,SACAC,SACAC,QACAC,UACAC,QACAC,MAGAC,OACAC,eAIAC,SAMAC,aAQAC,KAKAC,WAEwB,MAAtBC,OAAOC,YAiBPC;;;;oBAnDQ;;wBAAMC,IAAAA,+BAAoB,EAACjB,QAAQC;;;oBAA7CC,UAAU;oBACVC,UAAUD,QAAQgB,mBAAmB;oBACrCd,SAASF,QAAQiB,mBAAmB,CAACC,GAAG,CAAC,SAACC;+BAAYA,QAAQnB,QAAQoB,IAAI;;oBAC1EjB,WAAWkB,IAAAA,yBAAiB,EAACpB,SAASC;oBACtCE,SAASJ,QAAQoB,IAAI,CAAChB,MAAM;oBAC5BC,OAAOP,OAAOwB,SAAS,CAACjB,IAAI;oBAClC,IAAI,CAACA,MAAM,MAAM,IAAIkB,MAAM;oBAErBjB,QAAQ,AAAC,qBAAGH,SAASG,KAAK,SAAE,qBAAGN,QAAQoB,IAAI,CAACI,aAAa,CAACC,YAAY;oBACtElB,gBACJT,OAAO4B,IAAI,KAAK,QACZpB,MAAMqB,MAAM,CAAC,SAACC;+BAASA,KAAKC,IAAI,KAAK;uBAAuB,uDAAuD;uBACnHvB;oBACAE,UAAU,AAAC,qBAAGL,SAASK,OAAO,SAAE,qBAAGR,QAAQoB,IAAI,CAACI,aAAa,CAACM,cAAc;oBAElF,sFAAsF;oBACtF,yFAAyF;oBACzF,2FAA2F;oBAC3F,4EAA4E;oBACtErB,cAAc;wBAClB,IAAMsB,YAAY,IAAIC,iBAAS,CAAC;4BAAEH,MAAM/B,OAAO+B,IAAI;4BAAEI,SAASnC,OAAOmC,OAAO;wBAAC,GAAG;4BAAEC,YAAYC,yBAAiB;wBAAC;wBAChHC,IAAAA,qBAAa,EAACL,WAAWxB;wBACzB8B,IAAAA,yBAAiB,EAACN,WAAW5B,SAASmC,SAAS;wBAC/CC,IAAAA,uBAAe,EAACR,WAAWvB;wBAC3B,OAAOuB;oBACT;oBAEMrB,MAAM8B,IAAAA,gBAAO;oBACnB9B,IAAI+B,GAAG,CAACD,gBAAO,CAACE,IAAI,CAAC;wBAAEC,OAAO;oBAAO;oBAErC,sFAAsF;oBACtF,wFAAwF;oBAClFhC,YAAYb,OAAO8C,OAAO,GAAG,IAAIC,IAAI/C,OAAO8C,OAAO,IAAIE;oBAC7D1C,OAAO2C,IAAI,CAAC,AAAC,YAAuB,OAAZjD,OAAO+B,IAAI,EAAC;oBACN;;wBAAMmB,IAAAA,mBAAW,EAACvC,aAAa;4BAC3DL,QAAAA;4BACAM,KAAAA;4BACAL,MAAAA;4BACA4C,gBAAgBtC;gCAAaA,UAAUuC,MAAM;gCAAIJ;4BACjDK,cAAcxC;gCAAaA,UAAUyC,IAAI;gCAAIN;wBAC/C;;;oBAN8B,OAAA,eAAtBlC,QAAsB,KAAtBA,OAAOC,aAAe,KAAfA;oBAQf,gFAAgF;oBAChF,+EAA+E;oBAC/E,uFAAuF;oBACvF,IAAIb,QAAQoB,IAAI,CAACI,aAAa,CAAC6B,cAAc,EAAE;wBAC7C3C,IAAI+B,GAAG,CAAC,KAAKa,IAAAA,aAAI,KAAItD,QAAQoB,IAAI,CAACI,aAAa,CAAC6B,cAAc;wBAC9DjD,OAAO2C,IAAI,CAAC;oBACd;oBAEA,IAAIjD,OAAO4B,IAAI,KAAK,OAAO;wBACnBZ,aAAayC,IAAAA,+BAAuB,EAAC;4BAAEC,kBAAkB1D,OAAO0D,gBAAgB;wBAAC,GAAG;4BAAEC,aAAa;4BAAYC,oBAAoB;wBAAa;wBACtJhD,IAAI+B,GAAG,CAAC,UAAUa,IAAAA,aAAI,KAAIxC;oBAC5B;oBAEA,IAAId,QAAQoB,IAAI,CAACI,aAAa,CAACmC,SAAS,EAAE;wBACxCjD,IAAI+B,GAAG,CAAC,KAAKa,IAAAA,aAAI,KAAItD,QAAQoB,IAAI,CAACI,aAAa,CAACmC,SAAS;wBACzDvD,OAAO2C,IAAI,CAAC;oBACd;oBAEA3C,OAAO2C,IAAI,CAAC;oBAEZ;;wBAAO;4BACLlC,YAAAA;4BACAT,QAAAA;4BACAQ,OAAO,SAAPA;;;;;gDACE;;oDAAMA;;;gDAAN;gDACA;;oDAAMZ,QAAQY,KAAK;;;gDAAnB;;;;;;gCACF;;wBACF;;;;IACF"}

package/dist/cjs/setup/stdio.js

@@ -194,6 +194,8 @@ function createStdioServer(config, overrides) {
                         var mcpServer = new _server.McpServer({
                             name: config.name,
                             version: config.version
+                        }, {
+                            cacheHints: _server.defaultCacheHints
                         });
                         (0, _server.registerTools)(mcpServer, filteredTools);
                         (0, _server.registerResources)(mcpServer, composed.resources);

package/dist/cjs/setup/stdio.js.map

@@ -1 +1 @@
-{"version":3,"sources":["/Users/kevin/Dev/OpenSource/ai/mcp-z/mcp-outlook/src/setup/stdio.ts"],"sourcesContent":["import { composeMiddleware, connectStdio, McpServer, registerPrompts, registerResources, registerTools } from '@mcp-z/server';\nimport type { RuntimeOverrides, ServerConfig } from '../types.ts';\nimport { createDefaultRuntime } from './runtime.ts';\n\nexport async function createStdioServer(config: ServerConfig, overrides?: RuntimeOverrides) {\n  const runtime = await createDefaultRuntime(config, overrides);\n  const modules = runtime.createDomainModules();\n  const layers = runtime.middlewareFactories.map((factory) => factory(runtime.deps));\n  const composed = composeMiddleware(modules, layers);\n  const logger = runtime.deps.logger;\n\n  const tools = [...composed.tools, ...runtime.deps.oauthAdapters.accountTools];\n  const filteredTools =\n    config.auth === 'dcr'\n      ? tools.filter((tool) => tool.name !== 'messages-export-csv') // No file storage in DCR (public cloud responsibility)\n      : tools;\n  const prompts = [...composed.prompts, ...runtime.deps.oauthAdapters.accountPrompts];\n\n  // Built per request (HTTP) and per connection (stdio), not shared. The SDK caches the\n  // negotiated protocol revision on the McpServer instance - its own docs say a negotiated\n  // session never re-routes a method onto the other era - so one shared instance pins itself\n  // to whichever revision reaches it first and answers the other with -32601.\n  const buildServer = () => {\n    const mcpServer = new McpServer({ name: config.name, version: config.version });\n    registerTools(mcpServer, filteredTools);\n    registerResources(mcpServer, composed.resources);\n    registerPrompts(mcpServer, prompts);\n    return mcpServer;\n  };\n\n  logger.info(`Starting ${config.name} MCP server (stdio)`);\n  const { close } = await connectStdio(buildServer, { logger });\n  logger.info('stdio transport ready');\n\n  return {\n    logger,\n    close: async () => {\n      await close();\n      await runtime.close();\n    },\n  };\n}\n"],"names":["createStdioServer","config","overrides","runtime","modules","layers","composed","logger","tools","filteredTools","prompts","buildServer","close","createDefaultRuntime","createDomainModules","middlewareFactories","map","factory","deps","composeMiddleware","oauthAdapters","accountTools","auth","filter","tool","name","accountPrompts","mcpServer","McpServer","version","registerTools","registerResources","resources","registerPrompts","info","connectStdio"],"mappings":";;;;+BAIsBA;;;eAAAA;;;sBAJwF;yBAEzE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAE9B,SAAeA,kBAAkBC,MAAoB,EAAEC,SAA4B;;YAClFC,SACAC,SACAC,QACAC,UACAC,QAEAC,OACAC,eAIAC,SAMAC,aASEC;;;;oBA1BQ;;wBAAMC,IAAAA,+BAAoB,EAACZ,QAAQC;;;oBAA7CC,UAAU;oBACVC,UAAUD,QAAQW,mBAAmB;oBACrCT,SAASF,QAAQY,mBAAmB,CAACC,GAAG,CAAC,SAACC;+BAAYA,QAAQd,QAAQe,IAAI;;oBAC1EZ,WAAWa,IAAAA,yBAAiB,EAACf,SAASC;oBACtCE,SAASJ,QAAQe,IAAI,CAACX,MAAM;oBAE5BC,QAAQ,AAAC,qBAAGF,SAASE,KAAK,SAAE,qBAAGL,QAAQe,IAAI,CAACE,aAAa,CAACC,YAAY;oBACtEZ,gBACJR,OAAOqB,IAAI,KAAK,QACZd,MAAMe,MAAM,CAAC,SAACC;+BAASA,KAAKC,IAAI,KAAK;uBAAuB,uDAAuD;uBACnHjB;oBACAE,UAAU,AAAC,qBAAGJ,SAASI,OAAO,SAAE,qBAAGP,QAAQe,IAAI,CAACE,aAAa,CAACM,cAAc;oBAElF,sFAAsF;oBACtF,yFAAyF;oBACzF,2FAA2F;oBAC3F,4EAA4E;oBACtEf,cAAc;wBAClB,IAAMgB,YAAY,IAAIC,iBAAS,CAAC;4BAAEH,MAAMxB,OAAOwB,IAAI;4BAAEI,SAAS5B,OAAO4B,OAAO;wBAAC;wBAC7EC,IAAAA,qBAAa,EAACH,WAAWlB;wBACzBsB,IAAAA,yBAAiB,EAACJ,WAAWrB,SAAS0B,SAAS;wBAC/CC,IAAAA,uBAAe,EAACN,WAAWjB;wBAC3B,OAAOiB;oBACT;oBAEApB,OAAO2B,IAAI,CAAC,AAAC,YAAuB,OAAZjC,OAAOwB,IAAI,EAAC;oBAClB;;wBAAMU,IAAAA,oBAAY,EAACxB,aAAa;4BAAEJ,QAAAA;wBAAO;;;oBAAnDK,QAAU,cAAVA;oBACRL,OAAO2B,IAAI,CAAC;oBAEZ;;wBAAO;4BACL3B,QAAAA;4BACAK,OAAO,SAAPA;;;;;gDACE;;oDAAMA;;;gDAAN;gDACA;;oDAAMT,QAAQS,KAAK;;;gDAAnB;;;;;;gCACF;;wBACF;;;;IACF"}
+{"version":3,"sources":["/Users/kevin/Dev/OpenSource/ai/mcp-z/mcp-outlook/src/setup/stdio.ts"],"sourcesContent":["import { composeMiddleware, connectStdio, defaultCacheHints, McpServer, registerPrompts, registerResources, registerTools } from '@mcp-z/server';\nimport type { RuntimeOverrides, ServerConfig } from '../types.ts';\nimport { createDefaultRuntime } from './runtime.ts';\n\nexport async function createStdioServer(config: ServerConfig, overrides?: RuntimeOverrides) {\n  const runtime = await createDefaultRuntime(config, overrides);\n  const modules = runtime.createDomainModules();\n  const layers = runtime.middlewareFactories.map((factory) => factory(runtime.deps));\n  const composed = composeMiddleware(modules, layers);\n  const logger = runtime.deps.logger;\n\n  const tools = [...composed.tools, ...runtime.deps.oauthAdapters.accountTools];\n  const filteredTools =\n    config.auth === 'dcr'\n      ? tools.filter((tool) => tool.name !== 'messages-export-csv') // No file storage in DCR (public cloud responsibility)\n      : tools;\n  const prompts = [...composed.prompts, ...runtime.deps.oauthAdapters.accountPrompts];\n\n  // Built per request (HTTP) and per connection (stdio), not shared. The SDK caches the\n  // negotiated protocol revision on the McpServer instance - its own docs say a negotiated\n  // session never re-routes a method onto the other era - so one shared instance pins itself\n  // to whichever revision reaches it first and answers the other with -32601.\n  const buildServer = () => {\n    const mcpServer = new McpServer({ name: config.name, version: config.version }, { cacheHints: defaultCacheHints });\n    registerTools(mcpServer, filteredTools);\n    registerResources(mcpServer, composed.resources);\n    registerPrompts(mcpServer, prompts);\n    return mcpServer;\n  };\n\n  logger.info(`Starting ${config.name} MCP server (stdio)`);\n  const { close } = await connectStdio(buildServer, { logger });\n  logger.info('stdio transport ready');\n\n  return {\n    logger,\n    close: async () => {\n      await close();\n      await runtime.close();\n    },\n  };\n}\n"],"names":["createStdioServer","config","overrides","runtime","modules","layers","composed","logger","tools","filteredTools","prompts","buildServer","close","createDefaultRuntime","createDomainModules","middlewareFactories","map","factory","deps","composeMiddleware","oauthAdapters","accountTools","auth","filter","tool","name","accountPrompts","mcpServer","McpServer","version","cacheHints","defaultCacheHints","registerTools","registerResources","resources","registerPrompts","info","connectStdio"],"mappings":";;;;+BAIsBA;;;eAAAA;;;sBAJ2G;yBAE5F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAE9B,SAAeA,kBAAkBC,MAAoB,EAAEC,SAA4B;;YAClFC,SACAC,SACAC,QACAC,UACAC,QAEAC,OACAC,eAIAC,SAMAC,aASEC;;;;oBA1BQ;;wBAAMC,IAAAA,+BAAoB,EAACZ,QAAQC;;;oBAA7CC,UAAU;oBACVC,UAAUD,QAAQW,mBAAmB;oBACrCT,SAASF,QAAQY,mBAAmB,CAACC,GAAG,CAAC,SAACC;+BAAYA,QAAQd,QAAQe,IAAI;;oBAC1EZ,WAAWa,IAAAA,yBAAiB,EAACf,SAASC;oBACtCE,SAASJ,QAAQe,IAAI,CAACX,MAAM;oBAE5BC,QAAQ,AAAC,qBAAGF,SAASE,KAAK,SAAE,qBAAGL,QAAQe,IAAI,CAACE,aAAa,CAACC,YAAY;oBACtEZ,gBACJR,OAAOqB,IAAI,KAAK,QACZd,MAAMe,MAAM,CAAC,SAACC;+BAASA,KAAKC,IAAI,KAAK;uBAAuB,uDAAuD;uBACnHjB;oBACAE,UAAU,AAAC,qBAAGJ,SAASI,OAAO,SAAE,qBAAGP,QAAQe,IAAI,CAACE,aAAa,CAACM,cAAc;oBAElF,sFAAsF;oBACtF,yFAAyF;oBACzF,2FAA2F;oBAC3F,4EAA4E;oBACtEf,cAAc;wBAClB,IAAMgB,YAAY,IAAIC,iBAAS,CAAC;4BAAEH,MAAMxB,OAAOwB,IAAI;4BAAEI,SAAS5B,OAAO4B,OAAO;wBAAC,GAAG;4BAAEC,YAAYC,yBAAiB;wBAAC;wBAChHC,IAAAA,qBAAa,EAACL,WAAWlB;wBACzBwB,IAAAA,yBAAiB,EAACN,WAAWrB,SAAS4B,SAAS;wBAC/CC,IAAAA,uBAAe,EAACR,WAAWjB;wBAC3B,OAAOiB;oBACT;oBAEApB,OAAO6B,IAAI,CAAC,AAAC,YAAuB,OAAZnC,OAAOwB,IAAI,EAAC;oBAClB;;wBAAMY,IAAAA,oBAAY,EAAC1B,aAAa;4BAAEJ,QAAAA;wBAAO;;;oBAAnDK,QAAU,cAAVA;oBACRL,OAAO6B,IAAI,CAAC;oBAEZ;;wBAAO;4BACL7B,QAAAA;4BACAK,OAAO,SAAPA;;;;;gDACE;;oDAAMA;;;gDAAN;gDACA;;oDAAMT,QAAQS,KAAK;;;gDAAnB;;;;;;gCACF;;wBACF;;;;IACF"}

package/dist/esm/mcp/resources/email.d.ts

@@ -1,11 +1,9 @@
-import type { ReadResourceResult, ServerContext } from '@mcp-z/server';
+import type { ReadResourceResult, ResourceConfig, ServerContext } from '@mcp-z/server';
 import { ResourceTemplate } from '@mcp-z/server';
 export default function createResource(): {
     name: string;
     template: ResourceTemplate;
-    config: import("@modelcontextprotocol/server").ResourceMetadata & {
-        cacheHint?: import("@modelcontextprotocol/server").CacheHint;
-    };
+    config: ResourceConfig;
     handler: (uri: URL, variables: {
         id: string;
     }, extra: ServerContext) => Promise<ReadResourceResult>;

package/dist/esm/setup/http.js

@@ -1,4 +1,4 @@
-import { composeMiddleware, connectHttp, createFileServingRouter, McpServer, registerPrompts, registerResources, registerTools } from '@mcp-z/server';
+import { composeMiddleware, connectHttp, createFileServingRouter, defaultCacheHints, McpServer, registerPrompts, registerResources, registerTools } from '@mcp-z/server';
 import cors from 'cors';
 import express from 'express';
 import { createDefaultRuntime } from './runtime.js';
@@ -28,6 +28,8 @@ export async function createHTTPServer(config, overrides) {
         const mcpServer = new McpServer({
             name: config.name,
             version: config.version
+        }, {
+            cacheHints: defaultCacheHints
         });
         registerTools(mcpServer, filteredTools);
         registerResources(mcpServer, composed.resources);

package/dist/esm/setup/http.js.map

@@ -1 +1 @@
-{"version":3,"sources":["/Users/kevin/Dev/OpenSource/ai/mcp-z/mcp-outlook/src/setup/http.ts"],"sourcesContent":["import { composeMiddleware, connectHttp, createFileServingRouter, McpServer, registerPrompts, registerResources, registerTools } from '@mcp-z/server';\nimport cors from 'cors';\nimport express from 'express';\nimport type { RuntimeOverrides, ServerConfig } from '../types.ts';\nimport { createDefaultRuntime } from './runtime.ts';\n\nexport async function createHTTPServer(config: ServerConfig, overrides?: RuntimeOverrides) {\n  const runtime = await createDefaultRuntime(config, overrides);\n  const modules = runtime.createDomainModules();\n  const layers = runtime.middlewareFactories.map((factory) => factory(runtime.deps));\n  const composed = composeMiddleware(modules, layers);\n  const logger = runtime.deps.logger;\n  const port = config.transport.port;\n  if (!port) throw new Error('Port is required for HTTP transport');\n\n  const tools = [...composed.tools, ...runtime.deps.oauthAdapters.accountTools];\n  const filteredTools =\n    config.auth === 'dcr'\n      ? tools.filter((tool) => tool.name !== 'messages-export-csv') // No file storage in DCR (public cloud responsibility)\n      : tools;\n  const prompts = [...composed.prompts, ...runtime.deps.oauthAdapters.accountPrompts];\n\n  // Built per request (HTTP) and per connection (stdio), not shared. The SDK caches the\n  // negotiated protocol revision on the McpServer instance - its own docs say a negotiated\n  // session never re-routes a method onto the other era - so one shared instance pins itself\n  // to whichever revision reaches it first and answers the other with -32601.\n  const buildServer = () => {\n    const mcpServer = new McpServer({ name: config.name, version: config.version });\n    registerTools(mcpServer, filteredTools);\n    registerResources(mcpServer, composed.resources);\n    registerPrompts(mcpServer, prompts);\n    return mcpServer;\n  };\n\n  const app = express();\n  app.use(express.json({ limit: '10mb' }));\n\n  // Must mount '/mcp' before any permissive app-level cors(), or that layer answers its\n  // preflight first; pass baseUrl's origin/host below or a public deployment 403s itself.\n  const publicUrl = config.baseUrl ? new URL(config.baseUrl) : undefined;\n  logger.info(`Starting ${config.name} MCP server (http)`);\n  const { close, httpServer } = await connectHttp(buildServer, {\n    logger,\n    app,\n    port,\n    allowedOrigins: publicUrl ? [publicUrl.origin] : undefined,\n    allowedHosts: publicUrl ? [publicUrl.host] : undefined,\n  });\n\n  // The loopback OAuth callback, the file-export download, and the DCR discovery/\n  // registration endpoints are all meant to be reached from a browser on another\n  // origin. Keep cors() for them, scoped to their own routes - never in front of '/mcp'.\n  if (runtime.deps.oauthAdapters.loopbackRouter) {\n    app.use('/', cors(), runtime.deps.oauthAdapters.loopbackRouter);\n    logger.info('Mounted loopback OAuth callback router');\n  }\n\n  if (config.auth !== 'dcr') {\n    const fileRouter = createFileServingRouter({ resourceStoreUri: config.resourceStoreUri }, { contentType: 'text/csv', contentDisposition: 'attachment' });\n    app.use('/files', cors(), fileRouter);\n  }\n\n  if (runtime.deps.oauthAdapters.dcrRouter) {\n    app.use('/', cors(), runtime.deps.oauthAdapters.dcrRouter);\n    logger.info('Mounted DCR router with OAuth endpoints');\n  }\n\n  logger.info('http transport ready');\n\n  return {\n    httpServer,\n    logger,\n    close: async () => {\n      await close();\n      await runtime.close();\n    },\n  };\n}\n"],"names":["composeMiddleware","connectHttp","createFileServingRouter","McpServer","registerPrompts","registerResources","registerTools","cors","express","createDefaultRuntime","createHTTPServer","config","overrides","runtime","modules","createDomainModules","layers","middlewareFactories","map","factory","deps","composed","logger","port","transport","Error","tools","oauthAdapters","accountTools","filteredTools","auth","filter","tool","name","prompts","accountPrompts","buildServer","mcpServer","version","resources","app","use","json","limit","publicUrl","baseUrl","URL","undefined","info","close","httpServer","allowedOrigins","origin","allowedHosts","host","loopbackRouter","fileRouter","resourceStoreUri","contentType","contentDisposition","dcrRouter"],"mappings":"AAAA,SAASA,iBAAiB,EAAEC,WAAW,EAAEC,uBAAuB,EAAEC,SAAS,EAAEC,eAAe,EAAEC,iBAAiB,EAAEC,aAAa,QAAQ,gBAAgB;AACtJ,OAAOC,UAAU,OAAO;AACxB,OAAOC,aAAa,UAAU;AAE9B,SAASC,oBAAoB,QAAQ,eAAe;AAEpD,OAAO,eAAeC,iBAAiBC,MAAoB,EAAEC,SAA4B;IACvF,MAAMC,UAAU,MAAMJ,qBAAqBE,QAAQC;IACnD,MAAME,UAAUD,QAAQE,mBAAmB;IAC3C,MAAMC,SAASH,QAAQI,mBAAmB,CAACC,GAAG,CAAC,CAACC,UAAYA,QAAQN,QAAQO,IAAI;IAChF,MAAMC,WAAWrB,kBAAkBc,SAASE;IAC5C,MAAMM,SAAST,QAAQO,IAAI,CAACE,MAAM;IAClC,MAAMC,OAAOZ,OAAOa,SAAS,CAACD,IAAI;IAClC,IAAI,CAACA,MAAM,MAAM,IAAIE,MAAM;IAE3B,MAAMC,QAAQ;WAAIL,SAASK,KAAK;WAAKb,QAAQO,IAAI,CAACO,aAAa,CAACC,YAAY;KAAC;IAC7E,MAAMC,gBACJlB,OAAOmB,IAAI,KAAK,QACZJ,MAAMK,MAAM,CAAC,CAACC,OAASA,KAAKC,IAAI,KAAK,uBAAuB,uDAAuD;OACnHP;IACN,MAAMQ,UAAU;WAAIb,SAASa,OAAO;WAAKrB,QAAQO,IAAI,CAACO,aAAa,CAACQ,cAAc;KAAC;IAEnF,sFAAsF;IACtF,yFAAyF;IACzF,2FAA2F;IAC3F,4EAA4E;IAC5E,MAAMC,cAAc;QAClB,MAAMC,YAAY,IAAIlC,UAAU;YAAE8B,MAAMtB,OAAOsB,IAAI;YAAEK,SAAS3B,OAAO2B,OAAO;QAAC;QAC7EhC,cAAc+B,WAAWR;QACzBxB,kBAAkBgC,WAAWhB,SAASkB,SAAS;QAC/CnC,gBAAgBiC,WAAWH;QAC3B,OAAOG;IACT;IAEA,MAAMG,MAAMhC;IACZgC,IAAIC,GAAG,CAACjC,QAAQkC,IAAI,CAAC;QAAEC,OAAO;IAAO;IAErC,sFAAsF;IACtF,wFAAwF;IACxF,MAAMC,YAAYjC,OAAOkC,OAAO,GAAG,IAAIC,IAAInC,OAAOkC,OAAO,IAAIE;IAC7DzB,OAAO0B,IAAI,CAAC,CAAC,SAAS,EAAErC,OAAOsB,IAAI,CAAC,kBAAkB,CAAC;IACvD,MAAM,EAAEgB,KAAK,EAAEC,UAAU,EAAE,GAAG,MAAMjD,YAAYmC,aAAa;QAC3Dd;QACAkB;QACAjB;QACA4B,gBAAgBP,YAAY;YAACA,UAAUQ,MAAM;SAAC,GAAGL;QACjDM,cAAcT,YAAY;YAACA,UAAUU,IAAI;SAAC,GAAGP;IAC/C;IAEA,gFAAgF;IAChF,+EAA+E;IAC/E,uFAAuF;IACvF,IAAIlC,QAAQO,IAAI,CAACO,aAAa,CAAC4B,cAAc,EAAE;QAC7Cf,IAAIC,GAAG,CAAC,KAAKlC,QAAQM,QAAQO,IAAI,CAACO,aAAa,CAAC4B,cAAc;QAC9DjC,OAAO0B,IAAI,CAAC;IACd;IAEA,IAAIrC,OAAOmB,IAAI,KAAK,OAAO;QACzB,MAAM0B,aAAatD,wBAAwB;YAAEuD,kBAAkB9C,OAAO8C,gBAAgB;QAAC,GAAG;YAAEC,aAAa;YAAYC,oBAAoB;QAAa;QACtJnB,IAAIC,GAAG,CAAC,UAAUlC,QAAQiD;IAC5B;IAEA,IAAI3C,QAAQO,IAAI,CAACO,aAAa,CAACiC,SAAS,EAAE;QACxCpB,IAAIC,GAAG,CAAC,KAAKlC,QAAQM,QAAQO,IAAI,CAACO,aAAa,CAACiC,SAAS;QACzDtC,OAAO0B,IAAI,CAAC;IACd;IAEA1B,OAAO0B,IAAI,CAAC;IAEZ,OAAO;QACLE;QACA5B;QACA2B,OAAO;YACL,MAAMA;YACN,MAAMpC,QAAQoC,KAAK;QACrB;IACF;AACF"}
+{"version":3,"sources":["/Users/kevin/Dev/OpenSource/ai/mcp-z/mcp-outlook/src/setup/http.ts"],"sourcesContent":["import { composeMiddleware, connectHttp, createFileServingRouter, defaultCacheHints, McpServer, registerPrompts, registerResources, registerTools } from '@mcp-z/server';\nimport cors from 'cors';\nimport express from 'express';\nimport type { RuntimeOverrides, ServerConfig } from '../types.ts';\nimport { createDefaultRuntime } from './runtime.ts';\n\nexport async function createHTTPServer(config: ServerConfig, overrides?: RuntimeOverrides) {\n  const runtime = await createDefaultRuntime(config, overrides);\n  const modules = runtime.createDomainModules();\n  const layers = runtime.middlewareFactories.map((factory) => factory(runtime.deps));\n  const composed = composeMiddleware(modules, layers);\n  const logger = runtime.deps.logger;\n  const port = config.transport.port;\n  if (!port) throw new Error('Port is required for HTTP transport');\n\n  const tools = [...composed.tools, ...runtime.deps.oauthAdapters.accountTools];\n  const filteredTools =\n    config.auth === 'dcr'\n      ? tools.filter((tool) => tool.name !== 'messages-export-csv') // No file storage in DCR (public cloud responsibility)\n      : tools;\n  const prompts = [...composed.prompts, ...runtime.deps.oauthAdapters.accountPrompts];\n\n  // Built per request (HTTP) and per connection (stdio), not shared. The SDK caches the\n  // negotiated protocol revision on the McpServer instance - its own docs say a negotiated\n  // session never re-routes a method onto the other era - so one shared instance pins itself\n  // to whichever revision reaches it first and answers the other with -32601.\n  const buildServer = () => {\n    const mcpServer = new McpServer({ name: config.name, version: config.version }, { cacheHints: defaultCacheHints });\n    registerTools(mcpServer, filteredTools);\n    registerResources(mcpServer, composed.resources);\n    registerPrompts(mcpServer, prompts);\n    return mcpServer;\n  };\n\n  const app = express();\n  app.use(express.json({ limit: '10mb' }));\n\n  // Must mount '/mcp' before any permissive app-level cors(), or that layer answers its\n  // preflight first; pass baseUrl's origin/host below or a public deployment 403s itself.\n  const publicUrl = config.baseUrl ? new URL(config.baseUrl) : undefined;\n  logger.info(`Starting ${config.name} MCP server (http)`);\n  const { close, httpServer } = await connectHttp(buildServer, {\n    logger,\n    app,\n    port,\n    allowedOrigins: publicUrl ? [publicUrl.origin] : undefined,\n    allowedHosts: publicUrl ? [publicUrl.host] : undefined,\n  });\n\n  // The loopback OAuth callback, the file-export download, and the DCR discovery/\n  // registration endpoints are all meant to be reached from a browser on another\n  // origin. Keep cors() for them, scoped to their own routes - never in front of '/mcp'.\n  if (runtime.deps.oauthAdapters.loopbackRouter) {\n    app.use('/', cors(), runtime.deps.oauthAdapters.loopbackRouter);\n    logger.info('Mounted loopback OAuth callback router');\n  }\n\n  if (config.auth !== 'dcr') {\n    const fileRouter = createFileServingRouter({ resourceStoreUri: config.resourceStoreUri }, { contentType: 'text/csv', contentDisposition: 'attachment' });\n    app.use('/files', cors(), fileRouter);\n  }\n\n  if (runtime.deps.oauthAdapters.dcrRouter) {\n    app.use('/', cors(), runtime.deps.oauthAdapters.dcrRouter);\n    logger.info('Mounted DCR router with OAuth endpoints');\n  }\n\n  logger.info('http transport ready');\n\n  return {\n    httpServer,\n    logger,\n    close: async () => {\n      await close();\n      await runtime.close();\n    },\n  };\n}\n"],"names":["composeMiddleware","connectHttp","createFileServingRouter","defaultCacheHints","McpServer","registerPrompts","registerResources","registerTools","cors","express","createDefaultRuntime","createHTTPServer","config","overrides","runtime","modules","createDomainModules","layers","middlewareFactories","map","factory","deps","composed","logger","port","transport","Error","tools","oauthAdapters","accountTools","filteredTools","auth","filter","tool","name","prompts","accountPrompts","buildServer","mcpServer","version","cacheHints","resources","app","use","json","limit","publicUrl","baseUrl","URL","undefined","info","close","httpServer","allowedOrigins","origin","allowedHosts","host","loopbackRouter","fileRouter","resourceStoreUri","contentType","contentDisposition","dcrRouter"],"mappings":"AAAA,SAASA,iBAAiB,EAAEC,WAAW,EAAEC,uBAAuB,EAAEC,iBAAiB,EAAEC,SAAS,EAAEC,eAAe,EAAEC,iBAAiB,EAAEC,aAAa,QAAQ,gBAAgB;AACzK,OAAOC,UAAU,OAAO;AACxB,OAAOC,aAAa,UAAU;AAE9B,SAASC,oBAAoB,QAAQ,eAAe;AAEpD,OAAO,eAAeC,iBAAiBC,MAAoB,EAAEC,SAA4B;IACvF,MAAMC,UAAU,MAAMJ,qBAAqBE,QAAQC;IACnD,MAAME,UAAUD,QAAQE,mBAAmB;IAC3C,MAAMC,SAASH,QAAQI,mBAAmB,CAACC,GAAG,CAAC,CAACC,UAAYA,QAAQN,QAAQO,IAAI;IAChF,MAAMC,WAAWtB,kBAAkBe,SAASE;IAC5C,MAAMM,SAAST,QAAQO,IAAI,CAACE,MAAM;IAClC,MAAMC,OAAOZ,OAAOa,SAAS,CAACD,IAAI;IAClC,IAAI,CAACA,MAAM,MAAM,IAAIE,MAAM;IAE3B,MAAMC,QAAQ;WAAIL,SAASK,KAAK;WAAKb,QAAQO,IAAI,CAACO,aAAa,CAACC,YAAY;KAAC;IAC7E,MAAMC,gBACJlB,OAAOmB,IAAI,KAAK,QACZJ,MAAMK,MAAM,CAAC,CAACC,OAASA,KAAKC,IAAI,KAAK,uBAAuB,uDAAuD;OACnHP;IACN,MAAMQ,UAAU;WAAIb,SAASa,OAAO;WAAKrB,QAAQO,IAAI,CAACO,aAAa,CAACQ,cAAc;KAAC;IAEnF,sFAAsF;IACtF,yFAAyF;IACzF,2FAA2F;IAC3F,4EAA4E;IAC5E,MAAMC,cAAc;QAClB,MAAMC,YAAY,IAAIlC,UAAU;YAAE8B,MAAMtB,OAAOsB,IAAI;YAAEK,SAAS3B,OAAO2B,OAAO;QAAC,GAAG;YAAEC,YAAYrC;QAAkB;QAChHI,cAAc+B,WAAWR;QACzBxB,kBAAkBgC,WAAWhB,SAASmB,SAAS;QAC/CpC,gBAAgBiC,WAAWH;QAC3B,OAAOG;IACT;IAEA,MAAMI,MAAMjC;IACZiC,IAAIC,GAAG,CAAClC,QAAQmC,IAAI,CAAC;QAAEC,OAAO;IAAO;IAErC,sFAAsF;IACtF,wFAAwF;IACxF,MAAMC,YAAYlC,OAAOmC,OAAO,GAAG,IAAIC,IAAIpC,OAAOmC,OAAO,IAAIE;IAC7D1B,OAAO2B,IAAI,CAAC,CAAC,SAAS,EAAEtC,OAAOsB,IAAI,CAAC,kBAAkB,CAAC;IACvD,MAAM,EAAEiB,KAAK,EAAEC,UAAU,EAAE,GAAG,MAAMnD,YAAYoC,aAAa;QAC3Dd;QACAmB;QACAlB;QACA6B,gBAAgBP,YAAY;YAACA,UAAUQ,MAAM;SAAC,GAAGL;QACjDM,cAAcT,YAAY;YAACA,UAAUU,IAAI;SAAC,GAAGP;IAC/C;IAEA,gFAAgF;IAChF,+EAA+E;IAC/E,uFAAuF;IACvF,IAAInC,QAAQO,IAAI,CAACO,aAAa,CAAC6B,cAAc,EAAE;QAC7Cf,IAAIC,GAAG,CAAC,KAAKnC,QAAQM,QAAQO,IAAI,CAACO,aAAa,CAAC6B,cAAc;QAC9DlC,OAAO2B,IAAI,CAAC;IACd;IAEA,IAAItC,OAAOmB,IAAI,KAAK,OAAO;QACzB,MAAM2B,aAAaxD,wBAAwB;YAAEyD,kBAAkB/C,OAAO+C,gBAAgB;QAAC,GAAG;YAAEC,aAAa;YAAYC,oBAAoB;QAAa;QACtJnB,IAAIC,GAAG,CAAC,UAAUnC,QAAQkD;IAC5B;IAEA,IAAI5C,QAAQO,IAAI,CAACO,aAAa,CAACkC,SAAS,EAAE;QACxCpB,IAAIC,GAAG,CAAC,KAAKnC,QAAQM,QAAQO,IAAI,CAACO,aAAa,CAACkC,SAAS;QACzDvC,OAAO2B,IAAI,CAAC;IACd;IAEA3B,OAAO2B,IAAI,CAAC;IAEZ,OAAO;QACLE;QACA7B;QACA4B,OAAO;YACL,MAAMA;YACN,MAAMrC,QAAQqC,KAAK;QACrB;IACF;AACF"}

package/dist/esm/setup/stdio.js

@@ -1,4 +1,4 @@
-import { composeMiddleware, connectStdio, McpServer, registerPrompts, registerResources, registerTools } from '@mcp-z/server';
+import { composeMiddleware, connectStdio, defaultCacheHints, McpServer, registerPrompts, registerResources, registerTools } from '@mcp-z/server';
 import { createDefaultRuntime } from './runtime.js';
 export async function createStdioServer(config, overrides) {
     const runtime = await createDefaultRuntime(config, overrides);
@@ -24,6 +24,8 @@ export async function createStdioServer(config, overrides) {
         const mcpServer = new McpServer({
             name: config.name,
             version: config.version
+        }, {
+            cacheHints: defaultCacheHints
         });
         registerTools(mcpServer, filteredTools);
         registerResources(mcpServer, composed.resources);

package/dist/esm/setup/stdio.js.map

@@ -1 +1 @@
-{"version":3,"sources":["/Users/kevin/Dev/OpenSource/ai/mcp-z/mcp-outlook/src/setup/stdio.ts"],"sourcesContent":["import { composeMiddleware, connectStdio, McpServer, registerPrompts, registerResources, registerTools } from '@mcp-z/server';\nimport type { RuntimeOverrides, ServerConfig } from '../types.ts';\nimport { createDefaultRuntime } from './runtime.ts';\n\nexport async function createStdioServer(config: ServerConfig, overrides?: RuntimeOverrides) {\n  const runtime = await createDefaultRuntime(config, overrides);\n  const modules = runtime.createDomainModules();\n  const layers = runtime.middlewareFactories.map((factory) => factory(runtime.deps));\n  const composed = composeMiddleware(modules, layers);\n  const logger = runtime.deps.logger;\n\n  const tools = [...composed.tools, ...runtime.deps.oauthAdapters.accountTools];\n  const filteredTools =\n    config.auth === 'dcr'\n      ? tools.filter((tool) => tool.name !== 'messages-export-csv') // No file storage in DCR (public cloud responsibility)\n      : tools;\n  const prompts = [...composed.prompts, ...runtime.deps.oauthAdapters.accountPrompts];\n\n  // Built per request (HTTP) and per connection (stdio), not shared. The SDK caches the\n  // negotiated protocol revision on the McpServer instance - its own docs say a negotiated\n  // session never re-routes a method onto the other era - so one shared instance pins itself\n  // to whichever revision reaches it first and answers the other with -32601.\n  const buildServer = () => {\n    const mcpServer = new McpServer({ name: config.name, version: config.version });\n    registerTools(mcpServer, filteredTools);\n    registerResources(mcpServer, composed.resources);\n    registerPrompts(mcpServer, prompts);\n    return mcpServer;\n  };\n\n  logger.info(`Starting ${config.name} MCP server (stdio)`);\n  const { close } = await connectStdio(buildServer, { logger });\n  logger.info('stdio transport ready');\n\n  return {\n    logger,\n    close: async () => {\n      await close();\n      await runtime.close();\n    },\n  };\n}\n"],"names":["composeMiddleware","connectStdio","McpServer","registerPrompts","registerResources","registerTools","createDefaultRuntime","createStdioServer","config","overrides","runtime","modules","createDomainModules","layers","middlewareFactories","map","factory","deps","composed","logger","tools","oauthAdapters","accountTools","filteredTools","auth","filter","tool","name","prompts","accountPrompts","buildServer","mcpServer","version","resources","info","close"],"mappings":"AAAA,SAASA,iBAAiB,EAAEC,YAAY,EAAEC,SAAS,EAAEC,eAAe,EAAEC,iBAAiB,EAAEC,aAAa,QAAQ,gBAAgB;AAE9H,SAASC,oBAAoB,QAAQ,eAAe;AAEpD,OAAO,eAAeC,kBAAkBC,MAAoB,EAAEC,SAA4B;IACxF,MAAMC,UAAU,MAAMJ,qBAAqBE,QAAQC;IACnD,MAAME,UAAUD,QAAQE,mBAAmB;IAC3C,MAAMC,SAASH,QAAQI,mBAAmB,CAACC,GAAG,CAAC,CAACC,UAAYA,QAAQN,QAAQO,IAAI;IAChF,MAAMC,WAAWlB,kBAAkBW,SAASE;IAC5C,MAAMM,SAAST,QAAQO,IAAI,CAACE,MAAM;IAElC,MAAMC,QAAQ;WAAIF,SAASE,KAAK;WAAKV,QAAQO,IAAI,CAACI,aAAa,CAACC,YAAY;KAAC;IAC7E,MAAMC,gBACJf,OAAOgB,IAAI,KAAK,QACZJ,MAAMK,MAAM,CAAC,CAACC,OAASA,KAAKC,IAAI,KAAK,uBAAuB,uDAAuD;OACnHP;IACN,MAAMQ,UAAU;WAAIV,SAASU,OAAO;WAAKlB,QAAQO,IAAI,CAACI,aAAa,CAACQ,cAAc;KAAC;IAEnF,sFAAsF;IACtF,yFAAyF;IACzF,2FAA2F;IAC3F,4EAA4E;IAC5E,MAAMC,cAAc;QAClB,MAAMC,YAAY,IAAI7B,UAAU;YAAEyB,MAAMnB,OAAOmB,IAAI;YAAEK,SAASxB,OAAOwB,OAAO;QAAC;QAC7E3B,cAAc0B,WAAWR;QACzBnB,kBAAkB2B,WAAWb,SAASe,SAAS;QAC/C9B,gBAAgB4B,WAAWH;QAC3B,OAAOG;IACT;IAEAZ,OAAOe,IAAI,CAAC,CAAC,SAAS,EAAE1B,OAAOmB,IAAI,CAAC,mBAAmB,CAAC;IACxD,MAAM,EAAEQ,KAAK,EAAE,GAAG,MAAMlC,aAAa6B,aAAa;QAAEX;IAAO;IAC3DA,OAAOe,IAAI,CAAC;IAEZ,OAAO;QACLf;QACAgB,OAAO;YACL,MAAMA;YACN,MAAMzB,QAAQyB,KAAK;QACrB;IACF;AACF"}
+{"version":3,"sources":["/Users/kevin/Dev/OpenSource/ai/mcp-z/mcp-outlook/src/setup/stdio.ts"],"sourcesContent":["import { composeMiddleware, connectStdio, defaultCacheHints, McpServer, registerPrompts, registerResources, registerTools } from '@mcp-z/server';\nimport type { RuntimeOverrides, ServerConfig } from '../types.ts';\nimport { createDefaultRuntime } from './runtime.ts';\n\nexport async function createStdioServer(config: ServerConfig, overrides?: RuntimeOverrides) {\n  const runtime = await createDefaultRuntime(config, overrides);\n  const modules = runtime.createDomainModules();\n  const layers = runtime.middlewareFactories.map((factory) => factory(runtime.deps));\n  const composed = composeMiddleware(modules, layers);\n  const logger = runtime.deps.logger;\n\n  const tools = [...composed.tools, ...runtime.deps.oauthAdapters.accountTools];\n  const filteredTools =\n    config.auth === 'dcr'\n      ? tools.filter((tool) => tool.name !== 'messages-export-csv') // No file storage in DCR (public cloud responsibility)\n      : tools;\n  const prompts = [...composed.prompts, ...runtime.deps.oauthAdapters.accountPrompts];\n\n  // Built per request (HTTP) and per connection (stdio), not shared. The SDK caches the\n  // negotiated protocol revision on the McpServer instance - its own docs say a negotiated\n  // session never re-routes a method onto the other era - so one shared instance pins itself\n  // to whichever revision reaches it first and answers the other with -32601.\n  const buildServer = () => {\n    const mcpServer = new McpServer({ name: config.name, version: config.version }, { cacheHints: defaultCacheHints });\n    registerTools(mcpServer, filteredTools);\n    registerResources(mcpServer, composed.resources);\n    registerPrompts(mcpServer, prompts);\n    return mcpServer;\n  };\n\n  logger.info(`Starting ${config.name} MCP server (stdio)`);\n  const { close } = await connectStdio(buildServer, { logger });\n  logger.info('stdio transport ready');\n\n  return {\n    logger,\n    close: async () => {\n      await close();\n      await runtime.close();\n    },\n  };\n}\n"],"names":["composeMiddleware","connectStdio","defaultCacheHints","McpServer","registerPrompts","registerResources","registerTools","createDefaultRuntime","createStdioServer","config","overrides","runtime","modules","createDomainModules","layers","middlewareFactories","map","factory","deps","composed","logger","tools","oauthAdapters","accountTools","filteredTools","auth","filter","tool","name","prompts","accountPrompts","buildServer","mcpServer","version","cacheHints","resources","info","close"],"mappings":"AAAA,SAASA,iBAAiB,EAAEC,YAAY,EAAEC,iBAAiB,EAAEC,SAAS,EAAEC,eAAe,EAAEC,iBAAiB,EAAEC,aAAa,QAAQ,gBAAgB;AAEjJ,SAASC,oBAAoB,QAAQ,eAAe;AAEpD,OAAO,eAAeC,kBAAkBC,MAAoB,EAAEC,SAA4B;IACxF,MAAMC,UAAU,MAAMJ,qBAAqBE,QAAQC;IACnD,MAAME,UAAUD,QAAQE,mBAAmB;IAC3C,MAAMC,SAASH,QAAQI,mBAAmB,CAACC,GAAG,CAAC,CAACC,UAAYA,QAAQN,QAAQO,IAAI;IAChF,MAAMC,WAAWnB,kBAAkBY,SAASE;IAC5C,MAAMM,SAAST,QAAQO,IAAI,CAACE,MAAM;IAElC,MAAMC,QAAQ;WAAIF,SAASE,KAAK;WAAKV,QAAQO,IAAI,CAACI,aAAa,CAACC,YAAY;KAAC;IAC7E,MAAMC,gBACJf,OAAOgB,IAAI,KAAK,QACZJ,MAAMK,MAAM,CAAC,CAACC,OAASA,KAAKC,IAAI,KAAK,uBAAuB,uDAAuD;OACnHP;IACN,MAAMQ,UAAU;WAAIV,SAASU,OAAO;WAAKlB,QAAQO,IAAI,CAACI,aAAa,CAACQ,cAAc;KAAC;IAEnF,sFAAsF;IACtF,yFAAyF;IACzF,2FAA2F;IAC3F,4EAA4E;IAC5E,MAAMC,cAAc;QAClB,MAAMC,YAAY,IAAI7B,UAAU;YAAEyB,MAAMnB,OAAOmB,IAAI;YAAEK,SAASxB,OAAOwB,OAAO;QAAC,GAAG;YAAEC,YAAYhC;QAAkB;QAChHI,cAAc0B,WAAWR;QACzBnB,kBAAkB2B,WAAWb,SAASgB,SAAS;QAC/C/B,gBAAgB4B,WAAWH;QAC3B,OAAOG;IACT;IAEAZ,OAAOgB,IAAI,CAAC,CAAC,SAAS,EAAE3B,OAAOmB,IAAI,CAAC,mBAAmB,CAAC;IACxD,MAAM,EAAES,KAAK,EAAE,GAAG,MAAMpC,aAAa8B,aAAa;QAAEX;IAAO;IAC3DA,OAAOgB,IAAI,CAAC;IAEZ,OAAO;QACLhB;QACAiB,OAAO;YACL,MAAMA;YACN,MAAM1B,QAAQ0B,KAAK;QACrB;IACF;AACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mcp-z/mcp-outlook",
-  "version": "2.1.0",
+  "version": "2.2.1",
   "description": "MCP server for Outlook integration with OAuth authentication, message search, and batch operations",
   "keywords": [
     "outlook",
@@ -71,7 +71,7 @@
     "@mcp-z/email": "^1.0.0",
     "@mcp-z/oauth": "^2.0.0",
     "@mcp-z/oauth-microsoft": "^2.0.0",
-    "@mcp-z/server": "^2.1.0",
+    "@mcp-z/server": "^2.2.0",
     "@microsoft/microsoft-graph-client": "^3.0.0",
     "@microsoft/microsoft-graph-types": "^2.0.0",
     "cors": "^2.0.0",
@@ -90,7 +90,6 @@
     "@types/express": "^5.0.6",
     "@types/mocha": "^10.0.10",
     "@types/node": "^26.2.0",
-    "dotenv": "^17.2.3",
     "fs-remove-compat": "^1.0.4",
     "get-port": "5.1.1",
     "keyv": "^5.0.0",