@sam2kb/m365-mcp 1.0.0

package/.env.example

@@ -0,0 +1,11 @@
+# Account name configured with: npm run auth -- add <name> <tenant-id> <client-id>
+M365_ACCOUNT=work
+
+# IANA timezone used for Microsoft Graph calendar operations
+M365_TIMEZONE=America/New_York
+
+# Optional auth storage override (default: ~/.m365-mcp/auth)
+# Use an absolute path; variable expansion is not supported by every .env loader.
+# M365_MCP_AUTH_DIR=/absolute/path/to/m365-mcp-auth
+
+# This project does not load .env files automatically; source it or pass these variables through your MCP client.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 Alex Kay
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,257 @@
+# m365-mcp
+
+**Production-grade Microsoft 365 MCP server** — Email, Calendar, Contacts, OneDrive, Teams, Tasks, and Users via delegated OAuth.
+
+Built from the best of both `office365-connector` (delegated OAuth, multi-account) and `mcp-microsoft365` (MCP protocol, full scope), with all the gaps fixed: pagination, rate limiting, retry logic, proper timezone handling, and TypeScript throughout.
+
+## Why this exists
+
+| Feature | mcp-microsoft365 | office365-connector | **m365-mcp** |
+|---|---|---|---|
+| Auth model | Client credentials (tenant-wide) | Delegated (device code) | **Delegated (device code)** ✅ |
+| MCP server | ✅ | ❌ (CLI scripts) | ✅ |
+| Multi-account | ❌ | ✅ | ✅ |
+| Pagination | ❌ | ❌ | ✅ |
+| Rate limit handling | ❌ | Partial | ✅ |
+| Email | ✅ | ✅ | ✅ |
+| Calendar | ✅ | ✅ | ✅ |
+| Contacts | ❌ | ✅ | ✅ |
+| OneDrive | ✅ | ❌ | ✅ |
+| Teams | ✅ | ❌ | ✅ |
+| Tasks | ✅ | ❌ | ✅ |
+| Users | ✅ | ❌ | ✅ |
+| TypeScript | ✅ | ❌ (JS) | ✅ |
+| **Total tools** | 19 | ~12 (CLI) | **38** |
+
+## Scope
+
+**Delegated permissions** — the app acts AS YOU, not as the tenant. It can only access YOUR data:
+
+- `Mail.Read` / `Mail.ReadWrite` / `Mail.Send`
+- `Calendars.Read` / `Calendars.ReadWrite`
+- `Contacts.Read` / `Contacts.ReadWrite`
+- `Files.Read.All` (your OneDrive)
+- `Tasks.ReadWrite` (To Do)
+- `Chat.Read` / `Chat.ReadWrite` (Teams)
+- `User.Read` + `offline_access`
+
+No tenant-wide `Mail.Read.All` or `Files.Read.All` needed.
+
+## Setup
+
+### 1. Create Azure Entra ID App Registration
+
+1. Go to [Azure Portal → App registrations](https://portal.azure.com/#view/Microsoft_AAD_RegisteredApps/ApplicationsListBlade)
+2. **New registration**
+   - Name: `m365-mcp`
+   - Supported account types: **Single tenant** (or multi-tenant if you manage your own tenant)
+   - Redirect URI: `http://localhost` (not used for device code, but required)
+3. Click **Register**
+4. Go to **Authentication** → **Advanced settings** → set **"Allow public client flows"** to **Yes** → **Save**
+   > This is required for device-code OAuth to work without a client secret.
+
+### 2. Add API Permissions
+
+Under **API Permissions** → **Add a permission** → **Microsoft Graph** → **Delegated permissions**:
+
+```
+offline_access
+User.Read
+Mail.Read
+Mail.ReadWrite
+Mail.Send
+Calendars.Read
+Calendars.ReadWrite
+Contacts.Read
+Contacts.ReadWrite
+Files.Read.All
+Tasks.ReadWrite
+Chat.Read
+Chat.ReadWrite
+```
+
+Click **Grant admin consent** (or each user will consent individually during login).
+
+> Organization-wide user listing and lookup additionally requires delegated `User.Read.All` with admin consent. This broader scope is not requested by default.
+
+### 3. Install
+
+Install the published command-line tools:
+
+```bash
+npm install --global @sam2kb/m365-mcp
+```
+
+Or build from source:
+
+```bash
+# Clone
+git clone https://github.com/sam2kb/m365-mcp.git
+cd m365-mcp
+
+# Install dependencies
+npm install
+
+# Build
+npm run build
+```
+
+### 4. Add Your Account & Authenticate
+
+```bash
+m365-mcp-auth add work <tenant-id> <client-id> you@company.com "Work account"
+m365-mcp-auth login --account=work
+```
+
+When running from a source checkout, use `node dist/auth-cli.js` instead of
+`m365-mcp-auth`.
+
+Follow the on-screen URL + code to sign in. Tokens are stored securely in `~/.m365-mcp/auth/` by default. Set `M365_MCP_AUTH_DIR` to use another location.
+
+### 5. Configure an MCP Client
+
+The server uses standard MCP over stdio and works with any MCP client (Claude Desktop, Cursor, Continue, etc.).
+
+#### OpenClaw
+
+For the global npm installation, add this to your mcporter config at `~/.openclaw/mcporter.json`:
+
+```json
+{
+  "mcpServers": {
+    "m365": {
+      "command": "m365-mcp",
+      "args": [],
+      "env": {
+        "M365_ACCOUNT": "work",
+        "M365_TIMEZONE": "America/Chicago"
+      }
+    }
+  }
+}
+```
+
+Or via mcporter CLI:
+
+```bash
+mcporter config add m365 --stdio "m365-mcp" \
+  --env M365_ACCOUNT=work \
+  --env M365_TIMEZONE=America/Chicago
+```
+
+For a source checkout, use `"command": "node"` with
+`"args": ["/absolute/path/to/m365-mcp/dist/index.js"]`.
+
+Then restart OpenClaw for the server to load.
+
+#### Other MCP Clients
+
+Use the same JSON config in your client's MCP server configuration — `m365-mcp` is a standard stdio MCP server with no client-specific requirements.
+
+## Multi-Account
+
+```bash
+# Add more accounts
+node dist/auth-cli.js add personal <tenant2> <client2> you@outlook.com "Personal"
+node dist/auth-cli.js add client <tenant3> <client3> you@client.com "Consulting"
+
+# Authenticate each
+node dist/auth-cli.js login --account=personal
+node dist/auth-cli.js login --account=client
+
+# Set default
+node dist/auth-cli.js default work
+
+# List
+node dist/auth-cli.js list
+```
+
+Each account needs its own App Registration in its respective tenant. Tokens are isolated per account.
+
+## Available Tools (38)
+
+### 📧 Mail (9 tools)
+| Tool | Description |
+|---|---|
+| `m365_mail_list` | List emails (folder, filter, search, paginated) |
+| `m365_mail_read` | Read full email by ID |
+| `m365_mail_send` | Send email (to/cc/bcc, HTML or plain) |
+| `m365_mail_reply` | Reply / reply-all to an email |
+| `m365_mail_search` | Search emails across folders |
+| `m365_mail_move` | Move email to another folder |
+| `m365_mail_delete` | Delete email |
+| `m365_mail_mark_read` | Mark as read/unread |
+| `m365_mail_folders` | List all mail folders with counts |
+
+### 📅 Calendar (7 tools)
+| Tool | Description |
+|---|---|
+| `m365_calendar_list` | Events in a date range (paginated) |
+| `m365_calendar_today` | Today's events, nicely formatted |
+| `m365_calendar_week` | Week view grouped by day |
+| `m365_calendar_create` | Create event (optional Teams meeting) |
+| `m365_calendar_update` | Update event |
+| `m365_calendar_delete` | Cancel event with message |
+| `m365_calendar_availability` | Free/busy lookup |
+
+### 👤 Contacts (6 tools)
+| Tool | Description |
+|---|---|
+| `m365_contacts_list` | List contacts |
+| `m365_contacts_search` | Search by name/email/company |
+| `m365_contacts_read` | Full contact details |
+| `m365_contacts_create` | Create contact |
+| `m365_contacts_update` | Update contact |
+| `m365_contacts_delete` | Delete contact |
+
+### 📁 OneDrive (5 tools)
+| Tool | Description |
+|---|---|
+| `m365_files_list` | List files/folders (paginated) |
+| `m365_files_search` | Search files |
+| `m365_files_read` | Read text file content |
+| `m365_files_info` | File/folder metadata |
+| `m365_files_create_folder` | Create folder |
+
+### 💬 Teams (3 tools)
+| Tool | Description |
+|---|---|
+| `m365_teams_chats` | List your chats |
+| `m365_teams_messages` | Get chat messages |
+| `m365_teams_send` | Send chat message |
+
+### ✅ Tasks (5 tools)
+| Tool | Description |
+|---|---|
+| `m365_tasks_lists` | List To Do lists |
+| `m365_tasks_list` | List tasks in a list |
+| `m365_tasks_create` | Create task |
+| `m365_tasks_update` | Update task |
+| `m365_tasks_delete` | Delete task |
+
+### 👥 Users (3 tools)
+| Tool | Description |
+|---|---|
+| `m365_users_list` | List org users |
+| `m365_users_profile` | Get user profile |
+| `m365_users_manager` | Get user's manager |
+
+## Development
+
+```bash
+npm install
+npm run dev    # tsx watch mode
+npm run build  # compile TypeScript
+```
+
+## Security
+
+- **Delegated OAuth** — app acts as the authenticated user. No tenant-wide access.
+- **Device code flow** — you never type your password into anything but Microsoft's login page.
+- **Tokens stored with 0600 permissions** in `~/.m365-mcp/auth/` by default, configurable with `M365_MCP_AUTH_DIR`.
+- **Auto-refresh** — tokens refreshed before expiry, expired refresh tokens trigger re-auth.
+- **No telemetry, no analytics, no third-party calls** besides `login.microsoftonline.com` and `graph.microsoft.com`.
+
+## License
+
+MIT

package/SKILL.md

@@ -0,0 +1,59 @@
+---
+name: m365-mcp
+description: Production-grade Microsoft 365 MCP server with delegated OAuth, multi-account support, pagination, rate limiting, and 38 tools covering email, calendar, contacts, OneDrive, Teams, tasks, and users.
+---
+
+# m365-mcp
+
+Production-grade Microsoft 365 MCP server combining the best of office365-connector (delegated OAuth, multi-account) and mcp-microsoft365 (MCP protocol, full scope), with production-ready features: pagination, rate limiting, retry logic, and full TypeScript.
+
+## Requirements
+
+- Node.js 18+
+- Azure Entra ID App Registration with delegated Microsoft Graph permissions
+- Device code OAuth (no client-credentials, no tenant-wide access)
+
+## Capabilities
+
+### Email (9 tools)
+- List, read, send, reply, search, move, delete, mark read/unread, list folders
+
+### Calendar (7 tools)
+- List events, today view, week view, create (with Teams meeting), update, delete, free/busy
+
+### Contacts (6 tools)
+- List, search, read, create, update, delete
+
+### OneDrive (5 tools)
+- List files, search, read content, metadata, create folders
+
+### Teams (3 tools)
+- List chats, read messages, send messages
+
+### Tasks (5 tools)
+- List lists, list tasks, create, update, delete
+
+### Users (3 tools)
+- List org users, profile lookup, manager lookup
+
+## Setup
+
+```bash
+cd m365-mcp
+npm install
+npm run build
+
+# Add account
+node dist/auth-cli.js add work <tenantId> <clientId> you@company.com
+
+# Authenticate
+node dist/auth-cli.js login --account=work
+```
+
+Then configure as an MCP server in your mcporter config.
+
+See [README.md](README.md) for full Azure setup guide.
+
+## License
+
+MIT

package/dist/auth-cli.d.ts

@@ -0,0 +1,13 @@
+#!/usr/bin/env node
+/**
+ * m365-mcp-auth CLI — manage accounts and authenticate outside the MCP server
+ *
+ * Usage:
+ *   npx tsx src/auth-cli.ts add     <name> <tenantId> <clientId> [email] [desc]
+ *   npx tsx src/auth-cli.ts remove  <name>
+ *   npx tsx src/auth-cli.ts default <name>
+ *   npx tsx src/auth-cli.ts list
+ *   npx tsx src/auth-cli.ts login   [--account=name]
+ *   npx tsx src/auth-cli.ts status  [--account=name]
+ */
+export {};

package/dist/auth-cli.js

@@ -0,0 +1,127 @@
+#!/usr/bin/env node
+/**
+ * m365-mcp-auth CLI — manage accounts and authenticate outside the MCP server
+ *
+ * Usage:
+ *   npx tsx src/auth-cli.ts add     <name> <tenantId> <clientId> [email] [desc]
+ *   npx tsx src/auth-cli.ts remove  <name>
+ *   npx tsx src/auth-cli.ts default <name>
+ *   npx tsx src/auth-cli.ts list
+ *   npx tsx src/auth-cli.ts login   [--account=name]
+ *   npx tsx src/auth-cli.ts status  [--account=name]
+ */
+import { addAccount, removeAccount, setDefaultAccount, listAccounts, authenticate, getTokenStatus, } from "./auth.js";
+async function main() {
+    const args = process.argv.slice(2);
+    const cmd = args[0];
+    const rest = args.slice(1);
+    const accountArg = rest.find((a) => a.startsWith("--account="));
+    const accountName = accountArg ? accountArg.split("=")[1] : undefined;
+    const positional = rest.filter((a) => !a.startsWith("--"));
+    try {
+        switch (cmd) {
+            case "add": {
+                if (positional.length < 3) {
+                    console.log("Usage: m365-mcp-auth add <name> <tenantId> <clientId> [email] [description]");
+                    process.exit(1);
+                }
+                const [name, tenantId, clientId, email, desc] = positional;
+                addAccount(name, tenantId, clientId, email, desc);
+                console.log(`✅ Account "${name}" added.`);
+                break;
+            }
+            case "remove": {
+                if (positional.length < 1) {
+                    console.log("Usage: m365-mcp-auth remove <name>");
+                    process.exit(1);
+                }
+                removeAccount(positional[0]);
+                console.log(`✅ Account "${positional[0]}" removed.`);
+                break;
+            }
+            case "default": {
+                if (positional.length < 1) {
+                    console.log("Usage: m365-mcp-auth default <name>");
+                    process.exit(1);
+                }
+                setDefaultAccount(positional[0]);
+                console.log(`✅ Default account set to "${positional[0]}".`);
+                break;
+            }
+            case "list": {
+                const { default: def, accounts } = listAccounts();
+                if (accounts.length === 0) {
+                    console.log("No accounts configured.\n");
+                    console.log("Add one: m365-mcp-auth add <name> <tenantId> <clientId>");
+                    break;
+                }
+                console.log("📧 M365 Accounts:\n");
+                for (const acc of accounts) {
+                    const marker = acc.isDefault ? " [DEFAULT]" : "";
+                    console.log(`  ${acc.name}${marker}`);
+                    if (acc.email)
+                        console.log(`    Email: ${acc.email}`);
+                    if (acc.description)
+                        console.log(`    Desc:  ${acc.description}`);
+                    console.log(`    Tenant: ${acc.tenantId}`);
+                    console.log();
+                }
+                break;
+            }
+            case "login": {
+                await authenticate(accountName, (url, code) => {
+                    console.log("\n" + "=".repeat(60));
+                    console.log("🔐 Sign in to Microsoft");
+                    console.log("=".repeat(60));
+                    console.log(`\n1. Open: ${url}`);
+                    console.log(`2. Enter code: ${code}`);
+                    console.log(`3. Sign in and approve permissions\n`);
+                });
+                console.log("✅ Authenticated successfully.");
+                break;
+            }
+            case "status": {
+                const status = await getTokenStatus(accountName);
+                if (status.valid) {
+                    console.log(`✅ ${status.account}: Authenticated (expires ${status.expires})`);
+                }
+                else {
+                    console.log(`❌ ${status.account}: Not authenticated`);
+                    process.exit(1);
+                }
+                break;
+            }
+            case "env": {
+                // Dump environment variables for MCP client setup instructions
+                const { accounts } = listAccounts();
+                if (accounts.length === 0) {
+                    console.log("# No accounts configured.");
+                    break;
+                }
+                const acc = accounts.find((a) => a.isDefault) || accounts[0];
+                console.log(`M365_ACCOUNT=${acc.name}`);
+                console.log(`# M365_TIMEZONE=UTC  (optional, default: UTC)`);
+                console.log(`# Run 'm365-mcp-auth login --account=${acc.name}' to authenticate`);
+                break;
+            }
+            default:
+                console.log("m365-mcp-auth — Account Management CLI\n");
+                console.log("Commands:");
+                console.log("  add     <name> <tenantId> <clientId> [email] [desc]");
+                console.log("  remove  <name>");
+                console.log("  default <name>");
+                console.log("  list");
+                console.log("  login   [--account=name]");
+                console.log("  status  [--account=name]");
+                console.log("  env");
+                console.log("\nSetup guide: https://github.com/sam2kb/m365-mcp#readme");
+                process.exit(1);
+        }
+    }
+    catch (err) {
+        console.error(`❌ ${err.message}`);
+        process.exit(1);
+    }
+}
+main();
+//# sourceMappingURL=auth-cli.js.map

package/dist/auth-cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-cli.js","sourceRoot":"","sources":["../src/auth-cli.ts"],"names":[],"mappings":";AACA;;;;;;;;;;GAUG;AAEH,OAAO,EACL,UAAU,EACV,aAAa,EACb,iBAAiB,EACjB,YAAY,EACZ,YAAY,EACZ,cAAc,GACf,MAAM,WAAW,CAAC;AAEnB,KAAK,UAAU,IAAI;IACjB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACnC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC;IAChE,MAAM,WAAW,GAAG,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACtE,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IAE3D,IAAI,CAAC;QACH,QAAQ,GAAG,EAAE,CAAC;YACZ,KAAK,KAAK,CAAC,CAAC,CAAC;gBACX,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC1B,OAAO,CAAC,GAAG,CAAC,6EAA6E,CAAC,CAAC;oBAC3F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAClB,CAAC;gBACD,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,UAAU,CAAC;gBAC3D,UAAU,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;gBAClD,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,UAAU,CAAC,CAAC;gBAC1C,MAAM;YACR,CAAC;YAED,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACd,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC1B,OAAO,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC;oBAClD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAClB,CAAC;gBACD,aAAa,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC7B,OAAO,CAAC,GAAG,CAAC,cAAc,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;gBACrD,MAAM;YACR,CAAC;YAED,KAAK,SAAS,CAAC,CAAC,CAAC;gBACf,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC1B,OAAO,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAC;oBACnD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAClB,CAAC;gBACD,iBAAiB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;gBACjC,OAAO,CAAC,GAAG,CAAC,6BAA6B,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBAC5D,MAAM;YACR,CAAC;YAED,KAAK,MAAM,CAAC,CAAC,CAAC;gBACZ,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,YAAY,EAAE,CAAC;gBAClD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAC1B,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;oBACzC,OAAO,CAAC,GAAG,CAAC,yDAAyD,CAAC,CAAC;oBACvE,MAAM;gBACR,CAAC;gBACD,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;gBACnC,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;oBAC3B,MAAM,MAAM,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;oBACjD,OAAO,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,IAAI,GAAG,MAAM,EAAE,CAAC,CAAC;oBACtC,IAAI,GAAG,CAAC,KAAK;wBAAE,OAAO,CAAC,GAAG,CAAC,cAAc,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;oBACtD,IAAI,GAAG,CAAC,WAAW;wBAAE,OAAO,CAAC,GAAG,CAAC,cAAc,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;oBAClE,OAAO,CAAC,GAAG,CAAC,eAAe,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;oBAC3C,OAAO,CAAC,GAAG,EAAE,CAAC;gBAChB,CAAC;gBACD,MAAM;YACR,CAAC;YAED,KAAK,OAAO,CAAC,CAAC,CAAC;gBACb,MAAM,YAAY,CAAC,WAAW,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE;oBAC5C,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;oBACnC,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;oBACvC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;oBAC5B,OAAO,CAAC,GAAG,CAAC,cAAc,GAAG,EAAE,CAAC,CAAC;oBACjC,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC;oBACtC,OAAO,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC;gBACtD,CAAC,CAAC,CAAC;gBACH,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC;gBAC7C,MAAM;YACR,CAAC;YAED,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACd,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,WAAW,CAAC,CAAC;gBACjD,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;oBACjB,OAAO,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,OAAO,4BAA4B,MAAM,CAAC,OAAO,GAAG,CAAC,CAAC;gBAChF,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,OAAO,qBAAqB,CAAC,CAAC;oBACtD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAClB,CAAC;gBACD,MAAM;YACR,CAAC;YAED,KAAK,KAAK,CAAC,CAAC,CAAC;gBACX,+DAA+D;gBAC/D,MAAM,EAAE,QAAQ,EAAE,GAAG,YAAY,EAAE,CAAC;gBACpC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAC1B,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;oBACzC,MAAM;gBACR,CAAC;gBACD,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC;gBAC7D,OAAO,CAAC,GAAG,CAAC,gBAAgB,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;gBACxC,OAAO,CAAC,GAAG,CAAC,+CAA+C,CAAC,CAAC;gBAC7D,OAAO,CAAC,GAAG,CAAC,wCAAwC,GAAG,CAAC,IAAI,mBAAmB,CAAC,CAAC;gBACjF,MAAM;YACR,CAAC;YAED;gBACE,OAAO,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAC;gBACxD,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;gBACzB,OAAO,CAAC,GAAG,CAAC,uDAAuD,CAAC,CAAC;gBACrE,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;gBAChC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;gBAChC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBACtB,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;gBAC1C,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;gBAC1C,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBACrB,OAAO,CAAC,GAAG,CAAC,0DAA0D,CAAC,CAAC;gBACxE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,CAAC;IACH,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAClC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC"}

package/dist/auth.d.ts

@@ -0,0 +1,44 @@
+/**
+ * OAuth 2.0 Device Code Flow + Multi-Account Token Management
+ *
+ * Uses delegated permissions — the app acts AS YOU, not as the tenant.
+ * Tokens stored in ~/.m365-mcp/auth/ by default with 0600 permissions.
+ */
+import type { AccountConfig, AccountsStore, TokenData } from "./types.js";
+export declare function resolveAuthDir(env?: NodeJS.ProcessEnv, homeDir?: string): string;
+export declare function ensureDirs(): void;
+export declare function getTokenPath(accountName: string): string;
+export declare function loadAccounts(): AccountsStore;
+export declare function addAccount(name: string, tenantId: string, clientId: string, email?: string, description?: string): void;
+export declare function removeAccount(name: string): void;
+export declare function setDefaultAccount(name: string): void;
+export declare function resolveAccount(accountName?: string): AccountConfig;
+export declare function listAccounts(): {
+    default: string | null;
+    accounts: (AccountConfig & {
+        isDefault: boolean;
+    })[];
+};
+export declare function loadTokens(config: AccountConfig): TokenData | null;
+export declare function requestDeviceCode(config: AccountConfig): Promise<{
+    device_code: string;
+    user_code: string;
+    verification_uri: string;
+    expires_in: number;
+    interval: number;
+}>;
+/**
+ * Get a valid access token (auto-refresh if expired or within 5 min of expiry).
+ * Uses a mutex to avoid concurrent refresh races.
+ */
+export declare function getAccessToken(accountName?: string): Promise<string>;
+/**
+ * Full device-code authentication flow.
+ * Calls onPrompt(verificationUrl, userCode) so the caller can display instructions.
+ */
+export declare function authenticate(accountName: string | undefined, onPrompt: (verificationUrl: string, userCode: string) => void): Promise<TokenData>;
+export declare function getTokenStatus(accountName?: string): Promise<{
+    account: string;
+    valid: boolean;
+    expires: string | null;
+}>;