@softeria/ms-365-mcp-server 0.136.0 → 0.138.0

package/.env.example

@@ -1,5 +1,10 @@
 # Microsoft 365 OAuth Configuration
 # Create an Azure AD app registration and get these values:
+#
+# NOTE: .env is read from the directory the server is started in, which the MCP
+# client picks. Only the four variables below are read from it. Everything else
+# (token cache paths, the auth-cache command, Key Vault, logging, HTTP settings)
+# must be set in your shell or MCP client config.
 
 # Your Azure AD App Registration Client ID
 MS365_MCP_CLIENT_ID=your-azure-ad-app-client-id-here
@@ -38,7 +43,8 @@ MS365_MCP_TENANT_ID=common
 # When set, secrets are fetched from Azure Key Vault instead of environment variables.
 # This is useful for production deployments, especially with Azure Container Apps.
 #
-# MS365_MCP_KEYVAULT_URL=https://your-keyvault-name.vault.azure.net
+# Not read from .env - export MS365_MCP_KEYVAULT_URL in the environment instead:
+#   export MS365_MCP_KEYVAULT_URL=https://your-keyvault-name.vault.azure.net
 #
 # Key Vault secret names (store these in your Key Vault):
 #   - ms365-mcp-client-id     (required)
@@ -58,8 +64,10 @@ MS365_MCP_TENANT_ID=common
 # -------------------------------------------------------------------
 # Headless local-MSAL deployments can store token-cache and selected-account
 # metadata with a provider-neutral executable wrapper. The value is a real
-# executable path, not a shell command string; put any provider-specific args
-# inside the wrapper script.
+# executable path (absolute), not a shell command string; put any
+# provider-specific args inside the wrapper script.
 #
-# MS365_MCP_AUTH_CACHE_COMMAND=/path/to/ms365-auth-cache-store
-# MS365_MCP_AUTH_CACHE_COMMAND_TIMEOUT_MS=10000
+# This one starts a process, so it is deliberately NOT read from .env. Export it
+# in the environment that launches the server:
+#   export MS365_MCP_AUTH_CACHE_COMMAND=/path/to/ms365-auth-cache-store
+#   export MS365_MCP_AUTH_CACHE_COMMAND_TIMEOUT_MS=10000

package/README.md

@@ -440,6 +440,11 @@ registration:
 
 With these configured, the server will use your custom Azure app instead of the built-in one.
 
+> **Note**: `.env` is read from the directory the server is started in, and the MCP client decides what
+> that is. Only `MS365_MCP_CLIENT_ID`, `MS365_MCP_CLIENT_SECRET`, `MS365_MCP_TENANT_ID` and
+> `MS365_MCP_CLOUD_TYPE` are read from it. Every other variable listed above must be set in your shell
+> or MCP client config; anything else found in a `.env` is ignored with a warning on stderr.
+
 #### 3. Bring Your Own Token (BYOT)
 
 If you are running ms-365-mcp-server as part of a larger system that manages Microsoft OAuth tokens externally, you can
@@ -625,11 +630,23 @@ Environment variables:
 
 ## Token Storage
 
-Authentication tokens are stored using the OS credential store (via keytar) when available. If keytar is not installed or fails (common on headless Linux), the server falls back to file-based storage.
+Authentication tokens are stored in an encrypted file (AES-256-GCM). Only the 32-byte encryption key goes to the OS credential store via keytar.
+
+The cache itself is too big for some credential stores to hold - a Windows Credential Manager blob caps out at 2560 bytes and a real token cache is several times that, so on Windows the write could never succeed. A key is 32 bytes regardless of how many accounts are signed in, so this works the same way on every platform.
+
+**Default paths** are in the per-user config directory:
+
+| Platform | Location                                                                  |
+| -------- | ------------------------------------------------------------------------- |
+| Windows  | `%APPDATA%\ms-365-mcp-server\`                                            |
+| macOS    | `~/Library/Application Support/ms-365-mcp-server/`                        |
+| Linux    | `$XDG_CONFIG_HOME/ms-365-mcp-server/` (or `~/.config/ms-365-mcp-server/`) |
 
-**Default fallback paths** are relative to the installed package directory. This means tokens can be lost when the package is reinstalled or updated via npm.
+Earlier versions defaulted to a path inside the installed package, which under `npx` resolves to a content-hashed cache directory that `npm cache clean` or a version bump throws away. A cache still sitting in the package directory is moved to the new location on first run.
 
-To persist tokens across updates, set custom paths outside the package directory:
+That covers global and local installs, and `npx` when the hash has not changed. It cannot reach a cache left behind in a _previous_ `npx` hash directory, so upgrading an `npx` install one last time means signing in again. Adopting a cache from another directory would mean trusting a directory this package cannot prove it wrote, which is not worth one saved sign-in.
+
+Override the paths if you need to:
 
 ```bash
 export MS365_MCP_TOKEN_CACHE_PATH="$HOME/.config/ms365-mcp/.token-cache.json"
@@ -638,7 +655,11 @@ export MS365_MCP_SELECTED_ACCOUNT_PATH="$HOME/.config/ms365-mcp/.selected-accoun
 
 Parent directories are created automatically. Files are written with `0600` permissions.
 
-> **Security note**: File-based token storage writes sensitive credentials to disk. Ensure the chosen directory has appropriate access controls. The OS credential store (keytar) is preferred when available.
+**Without a credential store** (headless Linux, most containers) the key is written to `.cache-key` next to the cache file, with `0600` permissions. That stops the tokens showing up in a stray `cat`, a backup or an accidental commit. It does not protect against anyone who can already read the directory - the key is right there. Use `MS365_MCP_AUTH_CACHE_COMMAND` below if you need the cache in a real secret store.
+
+If the cache cannot be decrypted - key lost, keychain locked, file modified - you are asked to sign in again rather than the server failing to start. The cache file is left exactly as it was: not deleted, and not overwritten by that new sign-in either. A keychain that is merely locked usually reads fine on the next start, and the cache is still there when it does.
+
+The cost is that the new session is not saved while this lasts, so each start asks you to sign in again. If the key is genuinely gone and the cache will never open, delete `.token-cache.json` to start over - the log says so, and names the path.
 
 > **Hosted/sandboxed environments** (e.g. Anthropic Cowork): Set `MS365_MCP_TOKEN_CACHE_PATH` and `MS365_MCP_SELECTED_ACCOUNT_PATH` to a persistent mount so tokens survive between sessions.
 

package/dist/generated/client.js

@@ -844,8 +844,8 @@ const microsoft_graph_driveItem = z.object({
   webUrl: z.string().describe(
     "URL that either displays the resource in the browser (for Office file formats), or is a direct link to the file (for other formats). Read-only."
   ).nullish(),
-  createdByUser: microsoft_graph_user.describe("[Note: Simplified from 136 properties to 25 most common ones]").optional(),
-  lastModifiedByUser: microsoft_graph_user.describe("[Note: Simplified from 136 properties to 25 most common ones]").optional(),
+  createdByUser: microsoft_graph_user.describe("[Note: Simplified from 137 properties to 25 most common ones]").optional(),
+  lastModifiedByUser: microsoft_graph_user.describe("[Note: Simplified from 137 properties to 25 most common ones]").optional(),
   audio: microsoft_graph_audio.optional(),
   bundle: microsoft_graph_bundle.optional(),
   cTag: z.string().describe(
@@ -2584,8 +2584,8 @@ const microsoft_graph_listItem = z.object({
   webUrl: z.string().describe(
     "URL that either displays the resource in the browser (for Office file formats), or is a direct link to the file (for other formats). Read-only."
   ).nullish(),
-  createdByUser: microsoft_graph_user.describe("[Note: Simplified from 136 properties to 25 most common ones]").optional(),
-  lastModifiedByUser: microsoft_graph_user.describe("[Note: Simplified from 136 properties to 25 most common ones]").optional(),
+  createdByUser: microsoft_graph_user.describe("[Note: Simplified from 137 properties to 25 most common ones]").optional(),
+  lastModifiedByUser: microsoft_graph_user.describe("[Note: Simplified from 137 properties to 25 most common ones]").optional(),
   contentType: microsoft_graph_contentTypeInfo.optional(),
   deleted: microsoft_graph_deleted.optional(),
   sharepointIds: microsoft_graph_sharepointIds.optional(),
@@ -2593,7 +2593,7 @@ const microsoft_graph_listItem = z.object({
   documentSetVersions: z.array(microsoft_graph_documentSetVersion).describe("Version information for a document set version created by a user.").optional(),
   driveItem: microsoft_graph_driveItem.describe("[Note: Simplified from 45 properties to 25 most common ones]").optional(),
   fields: microsoft_graph_fieldValueSet.optional(),
-  permissions: z.array(microsoft_graph_permission).optional(),
+  permissions: z.array(microsoft_graph_permission).describe("The set of permissions for the item. Read-only. Nullable.").optional(),
   versions: z.array(microsoft_graph_listItemVersion).describe("The list of previous versions of the list item.").optional()
 }).passthrough();
 const microsoft_graph_longRunningOperationStatus = z.enum([
@@ -2706,8 +2706,8 @@ const microsoft_graph_list = z.lazy(
     webUrl: z.string().describe(
       "URL that either displays the resource in the browser (for Office file formats), or is a direct link to the file (for other formats). Read-only."
     ).nullish(),
-    createdByUser: microsoft_graph_user.describe("[Note: Simplified from 136 properties to 25 most common ones]").optional(),
-    lastModifiedByUser: microsoft_graph_user.describe("[Note: Simplified from 136 properties to 25 most common ones]").optional(),
+    createdByUser: microsoft_graph_user.describe("[Note: Simplified from 137 properties to 25 most common ones]").optional(),
+    lastModifiedByUser: microsoft_graph_user.describe("[Note: Simplified from 137 properties to 25 most common ones]").optional(),
     displayName: z.string().describe("The displayable title of the list.").nullish(),
     list: microsoft_graph_listInfo.optional(),
     sharepointIds: microsoft_graph_sharepointIds.optional(),
@@ -2717,7 +2717,7 @@ const microsoft_graph_list = z.lazy(
     drive: microsoft_graph_drive.optional(),
     items: z.array(microsoft_graph_listItem).describe("All items contained in the list.").optional(),
     operations: z.array(microsoft_graph_richLongRunningOperation).describe("The collection of long-running operations on the list.").optional(),
-    permissions: z.array(microsoft_graph_permission).optional(),
+    permissions: z.array(microsoft_graph_permission).describe("The set of permissions for the item. Read-only. Nullable.").optional(),
     subscriptions: z.array(microsoft_graph_subscription).describe("The set of subscriptions on the list.").optional()
   }).passthrough()
 );
@@ -2739,8 +2739,8 @@ const microsoft_graph_drive = z.lazy(
     webUrl: z.string().describe(
       "URL that either displays the resource in the browser (for Office file formats), or is a direct link to the file (for other formats). Read-only."
     ).nullish(),
-    createdByUser: microsoft_graph_user.describe("[Note: Simplified from 136 properties to 25 most common ones]").optional(),
-    lastModifiedByUser: microsoft_graph_user.describe("[Note: Simplified from 136 properties to 25 most common ones]").optional(),
+    createdByUser: microsoft_graph_user.describe("[Note: Simplified from 137 properties to 25 most common ones]").optional(),
+    lastModifiedByUser: microsoft_graph_user.describe("[Note: Simplified from 137 properties to 25 most common ones]").optional(),
     driveType: z.string().describe(
       "Describes the type of drive represented by this resource. OneDrive personal drives return personal. OneDrive for Business returns business. SharePoint document libraries return documentLibrary. Read-only."
     ).nullish(),
@@ -3014,7 +3014,7 @@ const microsoft_graph_team = z.lazy(
     ).nullish(),
     allChannels: z.array(microsoft_graph_channel).describe("List of channels either hosted in or shared with the team (incoming channels).").optional(),
     channels: z.array(microsoft_graph_channel).describe("The collection of channels and messages associated with the team.").optional(),
-    group: microsoft_graph_group.describe("[Note: Simplified from 80 properties to 25 most common ones]").optional(),
+    group: microsoft_graph_group.describe("[Note: Simplified from 81 properties to 25 most common ones]").optional(),
     incomingChannels: z.array(microsoft_graph_channel).describe("List of channels shared with the team.").optional(),
     installedApps: z.array(microsoft_graph_teamsAppInstallation).describe("The apps installed in this team.").optional(),
     members: z.array(microsoft_graph_conversationMember).describe("Members and owners of the team.").optional(),
@@ -3586,6 +3586,13 @@ const microsoft_graph_chatInfo = z.object({
 const microsoft_graph_chatRestrictions = z.object({
   allowTextOnly: z.boolean().describe("Indicates whether only text is allowed in the meeting chat. Optional.").nullish()
 }).passthrough();
+const microsoft_graph_cloudVideoInteropInfo = z.object({
+  moreInfoWebUrl: z.string().describe("Provides other video teleconferencing (VTC) dial-in options. Read-only.").nullish(),
+  tenantKey: z.string().describe(
+    "The tenant key that is used to dial into the interactive voice response (IVR) of the partner CVI service."
+  ).nullish(),
+  videoTeleconferenceId: z.string().describe("The video teleconferencing ID. Read-only.").nullish()
+}).passthrough();
 const microsoft_graph_joinMeetingIdSettings = z.object({
   isPasscodeRequired: z.boolean().describe(
     "Indicates whether a passcode is required to join a meeting when using joinMeetingId. Optional."
@@ -3617,6 +3624,7 @@ const microsoft_graph_onlineMeeting = z.object({
   audioConferencing: microsoft_graph_audioConferencing.optional(),
   chatInfo: microsoft_graph_chatInfo.optional(),
   chatRestrictions: microsoft_graph_chatRestrictions.optional(),
+  cloudVideoInteropInfo: microsoft_graph_cloudVideoInteropInfo.optional(),
   expiryDateTime: z.string().regex(
     /^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$/
   ).datetime({ offset: true }).describe(
@@ -3625,8 +3633,7 @@ const microsoft_graph_onlineMeeting = z.object({
   isEndToEndEncryptionEnabled: z.boolean().describe("Indicates whether end-to-end encryption (E2EE) is enabled for the online meeting.").nullish(),
   isEntryExitAnnounced: z.boolean().describe("Indicates whether to announce when callers join or leave.").nullish(),
   joinInformation: microsoft_graph_itemBody.optional(),
-  joinMeetingIdSettings: microsoft_graph_joinMeetingIdSettings.optional(),
-  joinWebUrl: z.string().describe("The join URL of the online meeting. Read-only.").nullish()
+  joinMeetingIdSettings: microsoft_graph_joinMeetingIdSettings.optional()
 }).passthrough().passthrough();
 const microsoft_graph_onlineMeetingCollectionResponse = z.object({
   "@odata.count": z.number().int().nullable(),
@@ -4549,8 +4556,8 @@ const microsoft_graph_baseItem = z.object({
   webUrl: z.string().describe(
     "URL that either displays the resource in the browser (for Office file formats), or is a direct link to the file (for other formats). Read-only."
   ).nullish(),
-  createdByUser: microsoft_graph_user.describe("[Note: Simplified from 136 properties to 25 most common ones]").optional(),
-  lastModifiedByUser: microsoft_graph_user.describe("[Note: Simplified from 136 properties to 25 most common ones]").optional()
+  createdByUser: microsoft_graph_user.describe("[Note: Simplified from 137 properties to 25 most common ones]").optional(),
+  lastModifiedByUser: microsoft_graph_user.describe("[Note: Simplified from 137 properties to 25 most common ones]").optional()
 }).passthrough();
 const microsoft_graph_site = z.object({
   id: z.string().describe("The unique identifier for an entity. Read-only.").optional(),
@@ -4571,8 +4578,8 @@ const microsoft_graph_site = z.object({
   webUrl: z.string().describe(
     "URL that either displays the resource in the browser (for Office file formats), or is a direct link to the file (for other formats). Read-only."
   ).nullish(),
-  createdByUser: microsoft_graph_user.describe("[Note: Simplified from 136 properties to 25 most common ones]").optional(),
-  lastModifiedByUser: microsoft_graph_user.describe("[Note: Simplified from 136 properties to 25 most common ones]").optional(),
+  createdByUser: microsoft_graph_user.describe("[Note: Simplified from 137 properties to 25 most common ones]").optional(),
+  lastModifiedByUser: microsoft_graph_user.describe("[Note: Simplified from 137 properties to 25 most common ones]").optional(),
   isPersonalSite: z.boolean().describe("Identifies whether the site is personal or not. Read-only.").nullish(),
   root: microsoft_graph_root.optional(),
   sharepointIds: microsoft_graph_sharepointIds.optional(),
@@ -4692,6 +4699,7 @@ const microsoft_graph_virtualEventSession = z.object({
   audioConferencing: microsoft_graph_audioConferencing.optional(),
   chatInfo: microsoft_graph_chatInfo.optional(),
   chatRestrictions: microsoft_graph_chatRestrictions.optional(),
+  cloudVideoInteropInfo: microsoft_graph_cloudVideoInteropInfo.optional(),
   expiryDateTime: z.string().regex(
     /^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$/
   ).datetime({ offset: true }).describe(
@@ -4700,8 +4708,7 @@ const microsoft_graph_virtualEventSession = z.object({
   isEndToEndEncryptionEnabled: z.boolean().describe("Indicates whether end-to-end encryption (E2EE) is enabled for the online meeting.").nullish(),
   isEntryExitAnnounced: z.boolean().describe("Indicates whether to announce when callers join or leave.").nullish(),
   joinInformation: microsoft_graph_itemBody.optional(),
-  joinMeetingIdSettings: microsoft_graph_joinMeetingIdSettings.optional(),
-  joinWebUrl: z.string().describe("The join URL of the online meeting. Read-only.").nullish()
+  joinMeetingIdSettings: microsoft_graph_joinMeetingIdSettings.optional()
 }).passthrough().passthrough();
 const microsoft_graph_meetingAudience = z.enum(["everyone", "organization", "unknownFutureValue"]);
 const microsoft_graph_communicationsUserIdentity = z.object({
@@ -4723,10 +4730,14 @@ const microsoft_graph_virtualEventRegistrationQuestionBase = z.object({
 const microsoft_graph_virtualEventWebinarRegistrationConfiguration = z.object({
   id: z.string().describe("The unique identifier for an entity. Read-only.").optional(),
   capacity: z.number().gte(-2147483648).lte(2147483647).describe("Total capacity of the virtual event.").nullish(),
+  isManualApprovalEnabled: z.boolean().describe(
+    "Indicates whether registrations require organizer approval before a participant is confirmed."
+  ).nullish(),
+  isWaitlistEnabled: z.boolean().describe(
+    "Indicates whether more registrants are automatically placed on a waitlist when capacity is reached."
+  ).nullish(),
   registrationWebUrl: z.string().describe("Registration URL of the virtual event.").nullish(),
-  questions: z.array(microsoft_graph_virtualEventRegistrationQuestionBase).describe("Registration questions.").optional(),
-  isManualApprovalEnabled: z.boolean().nullish(),
-  isWaitlistEnabled: z.boolean().nullish()
+  questions: z.array(microsoft_graph_virtualEventRegistrationQuestionBase).describe("Registration questions.").optional()
 }).passthrough();
 const microsoft_graph_virtualEventRegistrationQuestionAnswer = z.object({
   booleanValue: z.boolean().describe(
@@ -4783,6 +4794,7 @@ const microsoft_graph_virtualEventWebinar = z.object({
   externalEventInformation: z.array(microsoft_graph_virtualEventExternalInformation).describe(
     "The external information of a virtual event. Returned only for event organizers or coorganizers; otherwise, null."
   ).optional(),
+  isRegistrationRequired: z.boolean().describe("Indicates whether attendee registration is enabled for the virtual event.").nullish(),
   settings: microsoft_graph_virtualEventSettings.optional(),
   startDateTime: microsoft_graph_dateTimeTimeZone.optional(),
   status: microsoft_graph_virtualEventStatus.optional(),
@@ -5212,6 +5224,7 @@ const schemas = {
   microsoft_graph_audioConferencing,
   microsoft_graph_chatInfo,
   microsoft_graph_chatRestrictions,
+  microsoft_graph_cloudVideoInteropInfo,
   microsoft_graph_joinMeetingIdSettings,
   microsoft_graph_onlineMeeting,
   microsoft_graph_onlineMeetingCollectionResponse,
@@ -5865,8 +5878,8 @@ const endpoints = makeApi([
           webUrl: z.string().describe(
             "URL that either displays the resource in the browser (for Office file formats), or is a direct link to the file (for other formats). Read-only."
           ).nullish(),
-          createdByUser: microsoft_graph_user.describe("[Note: Simplified from 136 properties to 25 most common ones]").optional(),
-          lastModifiedByUser: microsoft_graph_user.describe("[Note: Simplified from 136 properties to 25 most common ones]").optional(),
+          createdByUser: microsoft_graph_user.describe("[Note: Simplified from 137 properties to 25 most common ones]").optional(),
+          lastModifiedByUser: microsoft_graph_user.describe("[Note: Simplified from 137 properties to 25 most common ones]").optional(),
           audio: microsoft_graph_audio.optional(),
           bundle: microsoft_graph_bundle.optional(),
           cTag: z.string().describe(
@@ -5980,8 +5993,8 @@ const endpoints = makeApi([
           webUrl: z.string().describe(
             "URL that either displays the resource in the browser (for Office file formats), or is a direct link to the file (for other formats). Read-only."
           ).nullish(),
-          createdByUser: microsoft_graph_user.describe("[Note: Simplified from 136 properties to 25 most common ones]").optional(),
-          lastModifiedByUser: microsoft_graph_user.describe("[Note: Simplified from 136 properties to 25 most common ones]").optional(),
+          createdByUser: microsoft_graph_user.describe("[Note: Simplified from 137 properties to 25 most common ones]").optional(),
+          lastModifiedByUser: microsoft_graph_user.describe("[Note: Simplified from 137 properties to 25 most common ones]").optional(),
           audio: microsoft_graph_audio.optional(),
           bundle: microsoft_graph_bundle.optional(),
           cTag: z.string().describe(
@@ -11185,6 +11198,7 @@ resource.`,
           audioConferencing: microsoft_graph_audioConferencing.optional(),
           chatInfo: microsoft_graph_chatInfo.optional(),
           chatRestrictions: microsoft_graph_chatRestrictions.optional(),
+          cloudVideoInteropInfo: microsoft_graph_cloudVideoInteropInfo.optional(),
           expiryDateTime: z.string().regex(
             /^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$/
           ).datetime({ offset: true }).describe(
@@ -11195,8 +11209,7 @@ resource.`,
           ).nullish(),
           isEntryExitAnnounced: z.boolean().describe("Indicates whether to announce when callers join or leave.").nullish(),
           joinInformation: microsoft_graph_itemBody.optional(),
-          joinMeetingIdSettings: microsoft_graph_joinMeetingIdSettings.optional(),
-          joinWebUrl: z.string().describe("The join URL of the online meeting. Read-only.").nullish()
+          joinMeetingIdSettings: microsoft_graph_joinMeetingIdSettings.optional()
         }).passthrough().passthrough()
       }
     ],
@@ -11257,6 +11270,7 @@ resource.`,
           audioConferencing: microsoft_graph_audioConferencing.optional(),
           chatInfo: microsoft_graph_chatInfo.optional(),
           chatRestrictions: microsoft_graph_chatRestrictions.optional(),
+          cloudVideoInteropInfo: microsoft_graph_cloudVideoInteropInfo.optional(),
           expiryDateTime: z.string().regex(
             /^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$/
           ).datetime({ offset: true }).describe(
@@ -11267,8 +11281,7 @@ resource.`,
           ).nullish(),
           isEntryExitAnnounced: z.boolean().describe("Indicates whether to announce when callers join or leave.").nullish(),
           joinInformation: microsoft_graph_itemBody.optional(),
-          joinMeetingIdSettings: microsoft_graph_joinMeetingIdSettings.optional(),
-          joinWebUrl: z.string().describe("The join URL of the online meeting. Read-only.").nullish()
+          joinMeetingIdSettings: microsoft_graph_joinMeetingIdSettings.optional()
         }).passthrough().passthrough()
       }
     ],

package/dist/index.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import "dotenv/config";
+import { loadEnvFile } from "./load-env.js";
 import { parseArgs } from "./cli.js";
 import logger from "./logger.js";
 import AuthManager, { buildAllowedScopeDiagnostics, resolveAuthScopes } from "./auth.js";
@@ -33,6 +33,7 @@ process.on("uncaughtException", (err, origin) => {
 });
 async function main() {
   try {
+    loadEnvFile();
     const args = parseArgs();
     const includeWorkScopes = args.orgMode || false;
     if (includeWorkScopes) {

package/dist/lib/cache-encryption.js

@@ -0,0 +1,89 @@
+import { createCipheriv, createDecipheriv, randomBytes } from "node:crypto";
+const ALGORITHM = "aes-256-gcm";
+const ALGORITHM_LABEL = "A256GCM";
+const ENVELOPE_VERSION = 2;
+const IV_BYTES = 12;
+const TAG_BYTES = 16;
+const CACHE_KEY_BYTES = 32;
+function generateCacheKey() {
+  return randomBytes(CACHE_KEY_BYTES);
+}
+function parseCacheKey(encoded) {
+  const key = Buffer.from(encoded.trim(), "base64");
+  if (key.length !== CACHE_KEY_BYTES) {
+    throw new Error(`Auth cache key must be ${CACHE_KEY_BYTES} bytes, got ${key.length}`);
+  }
+  return key;
+}
+function encodeCacheKey(key) {
+  return key.toString("base64");
+}
+function additionalData(purpose) {
+  return Buffer.from(`ms365:v${ENVELOPE_VERSION}:${ALGORITHM_LABEL}:${purpose}`, "utf8");
+}
+function encryptCache(plaintext, key, purpose) {
+  const iv = randomBytes(IV_BYTES);
+  const cipher = createCipheriv(ALGORITHM, key, iv);
+  cipher.setAAD(additionalData(purpose));
+  const ciphertext = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
+  const envelope = {
+    _cacheEnvelope: true,
+    v: ENVELOPE_VERSION,
+    alg: ALGORITHM_LABEL,
+    iv: iv.toString("base64"),
+    tag: cipher.getAuthTag().toString("base64"),
+    data: ciphertext.toString("base64")
+  };
+  return JSON.stringify(envelope);
+}
+function isEncryptedCache(raw) {
+  return readEnvelope(raw) !== void 0;
+}
+function decryptCache(raw, key, purpose) {
+  const envelope = readEnvelope(raw);
+  if (!envelope) {
+    throw new Error("Auth cache is not an encrypted envelope");
+  }
+  if (envelope.v !== ENVELOPE_VERSION) {
+    throw new Error(`Unsupported auth cache envelope version: ${envelope.v}`);
+  }
+  if (envelope.alg !== ALGORITHM_LABEL) {
+    throw new Error(`Unsupported auth cache algorithm: ${envelope.alg}`);
+  }
+  if (typeof envelope.iv !== "string" || typeof envelope.tag !== "string" || typeof envelope.data !== "string") {
+    throw new Error("Auth cache envelope is missing iv, tag or data");
+  }
+  const iv = Buffer.from(envelope.iv, "base64");
+  const tag = Buffer.from(envelope.tag, "base64");
+  if (iv.length !== IV_BYTES || tag.length !== TAG_BYTES) {
+    throw new Error("Auth cache envelope has a malformed iv or tag");
+  }
+  const decipher = createDecipheriv(ALGORITHM, key, iv);
+  decipher.setAAD(additionalData(purpose));
+  decipher.setAuthTag(tag);
+  return Buffer.concat([
+    decipher.update(Buffer.from(envelope.data, "base64")),
+    decipher.final()
+  ]).toString("utf8");
+}
+function readEnvelope(raw) {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return void 0;
+  }
+  if (!parsed || typeof parsed !== "object") return void 0;
+  const candidate = parsed;
+  if (candidate._cacheEnvelope !== true || typeof candidate.v !== "number") return void 0;
+  return candidate;
+}
+export {
+  CACHE_KEY_BYTES,
+  decryptCache,
+  encodeCacheKey,
+  encryptCache,
+  generateCacheKey,
+  isEncryptedCache,
+  parseCacheKey
+};

package/dist/lib/config-paths.js

@@ -0,0 +1,20 @@
+import os from "node:os";
+import path from "node:path";
+const APP_DIR_NAME = "ms-365-mcp-server";
+function getConfigDir() {
+  if (process.platform === "win32") {
+    const appData = process.env.APPDATA?.trim();
+    return path.join(appData || path.join(os.homedir(), "AppData", "Roaming"), APP_DIR_NAME);
+  }
+  if (process.platform === "darwin") {
+    return path.join(os.homedir(), "Library", "Application Support", APP_DIR_NAME);
+  }
+  const xdg = process.env.XDG_CONFIG_HOME?.trim();
+  if (xdg && path.isAbsolute(xdg)) {
+    return path.join(xdg, APP_DIR_NAME);
+  }
+  return path.join(os.homedir(), ".config", APP_DIR_NAME);
+}
+export {
+  getConfigDir
+};

package/dist/load-env.js

@@ -0,0 +1,41 @@
+import { parse } from "dotenv";
+import fs from "node:fs";
+import path from "node:path";
+const ENV_FILE_ALLOWLIST = [
+  "MS365_MCP_CLIENT_ID",
+  "MS365_MCP_CLIENT_SECRET",
+  "MS365_MCP_TENANT_ID",
+  "MS365_MCP_CLOUD_TYPE"
+];
+function loadEnvFile(options = {}) {
+  const file = options.path ?? path.resolve(process.cwd(), ".env");
+  let fromFile = {};
+  try {
+    fromFile = parse(fs.readFileSync(file, "utf8"));
+  } catch {
+  }
+  const applied = [];
+  const ignored = [];
+  for (const [key, value] of Object.entries(fromFile)) {
+    if (!ENV_FILE_ALLOWLIST.includes(key)) {
+      ignored.push(key);
+      continue;
+    }
+    if (process.env[key] !== void 0) {
+      continue;
+    }
+    process.env[key] = value;
+    applied.push(key);
+  }
+  const ignoredOwn = ignored.filter((key) => key.startsWith("MS365_MCP_"));
+  if (ignoredOwn.length > 0) {
+    console.error(
+      `[ms365-mcp] Ignored ${ignoredOwn.length} variable(s) from .env: ${[...ignoredOwn].sort().join(", ")}. Only ${ENV_FILE_ALLOWLIST.join(", ")} are read from .env - set anything else in your shell or MCP client config.`
+    );
+  }
+  return { applied, ignored };
+}
+export {
+  ENV_FILE_ALLOWLIST,
+  loadEnvFile
+};

package/dist/server.js

@@ -479,48 +479,16 @@ class MicrosoftGraphServer {
         allowUnauthenticatedDiscovery: this.options.allowUnauthenticatedDiscovery,
         publicUrl: publicBase
       });
-      app.get(
-        "/mcp",
-        mcpAuth,
-        async (req, res) => {
-          const handler = async () => {
-            const server = this.createMcpServer();
-            const transport = new StreamableHTTPServerTransport({
-              sessionIdGenerator: void 0
-              // Stateless mode
-            });
-            res.on("close", () => {
-              transport.close();
-              server.close();
-            });
-            await server.connect(transport);
-            await transport.handleRequest(req, res, void 0);
-          };
-          try {
-            if (req.microsoftAuth) {
-              let accessToken = req.microsoftAuth.accessToken;
-              if (this.oboClient) {
-                accessToken = await this.oboClient.exchangeToken(accessToken);
-              }
-              await requestContext.run({ accessToken }, handler);
-            } else {
-              await handler();
-            }
-          } catch (error) {
-            logger.error("Error handling MCP GET request:", error);
-            if (!res.headersSent) {
-              res.status(500).json({
-                jsonrpc: "2.0",
-                error: {
-                  code: -32603,
-                  message: "Internal server error"
-                },
-                id: null
-              });
-            }
-          }
-        }
-      );
+      app.get("/mcp", (req, res) => {
+        res.status(405).json({
+          jsonrpc: "2.0",
+          error: {
+            code: -32e3,
+            message: "Method not allowed."
+          },
+          id: null
+        });
+      });
       app.post(
         "/mcp",
         mcpAuth,
@@ -528,8 +496,10 @@ class MicrosoftGraphServer {
           const handler = async () => {
             const server = this.createMcpServer();
             const transport = new StreamableHTTPServerTransport({
-              sessionIdGenerator: void 0
+              sessionIdGenerator: void 0,
               // Stateless mode
+              enableJsonResponse: true
+              // Reply to POSTs with plain JSON, not one-shot SSE
             });
             res.on("close", () => {
               transport.close();

package/dist/token-cache-storage.js

@@ -1,7 +1,17 @@
 import { spawn } from "node:child_process";
+import { randomBytes } from "node:crypto";
 import fs, { existsSync, readFileSync } from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
+import {
+  decryptCache,
+  encodeCacheKey,
+  encryptCache,
+  generateCacheKey,
+  isEncryptedCache,
+  parseCacheKey
+} from "./lib/cache-encryption.js";
+import { getConfigDir } from "./lib/config-paths.js";
 import logger from "./logger.js";
 const SERVICE_NAME = "ms-365-mcp-server";
 const TOKEN_CACHE_ACCOUNT = "msal-token-cache";
@@ -11,11 +21,12 @@ const AUTH_CACHE_COMMAND_TIMEOUT_ENV = "MS365_MCP_AUTH_CACHE_COMMAND_TIMEOUT_MS"
 const DEFAULT_AUTH_CACHE_COMMAND_TIMEOUT_MS = 1e4;
 const STDERR_LIMIT = 2048;
 const COMMAND_KILL_GRACE_MS = 1e3;
+const CACHE_KEY_ACCOUNT = "cache-key";
+const TOKEN_CACHE_FILE = ".token-cache.json";
+const SELECTED_ACCOUNT_FILE = ".selected-account.json";
+const CACHE_KEY_FILE = ".cache-key";
 const __filename = fileURLToPath(import.meta.url);
-const __dirname = path.dirname(__filename);
-const FALLBACK_DIR = __dirname;
-const DEFAULT_TOKEN_CACHE_PATH = path.join(FALLBACK_DIR, "..", ".token-cache.json");
-const DEFAULT_SELECTED_ACCOUNT_PATH = path.join(FALLBACK_DIR, "..", ".selected-account.json");
+const LEGACY_DIR = path.join(path.dirname(__filename), "..");
 let keytar = null;
 async function getKeytar() {
   if (keytar === void 0) {
@@ -64,11 +75,68 @@ function pickNewestRaw(keytarRaw, fileRaw) {
 }
 function getTokenCachePath() {
   const envPath = process.env.MS365_MCP_TOKEN_CACHE_PATH?.trim();
-  return envPath || DEFAULT_TOKEN_CACHE_PATH;
+  return envPath || path.join(getConfigDir(), TOKEN_CACHE_FILE);
 }
 function getSelectedAccountPath() {
   const envPath = process.env.MS365_MCP_SELECTED_ACCOUNT_PATH?.trim();
-  return envPath || DEFAULT_SELECTED_ACCOUNT_PATH;
+  return envPath || path.join(getConfigDir(), SELECTED_ACCOUNT_FILE);
+}
+function getCacheKeyPath() {
+  return path.join(path.dirname(getTokenCachePath()), CACHE_KEY_FILE);
+}
+let legacyPathsMigrated = false;
+function migrateLegacyPaths() {
+  if (legacyPathsMigrated) return;
+  legacyPathsMigrated = true;
+  migrateLegacyPathsFrom(LEGACY_DIR);
+}
+function migrateLegacyPathsFrom(legacyDir) {
+  const moves = [
+    [TOKEN_CACHE_FILE, getTokenCachePath(), process.env.MS365_MCP_TOKEN_CACHE_PATH?.trim()],
+    [
+      SELECTED_ACCOUNT_FILE,
+      getSelectedAccountPath(),
+      process.env.MS365_MCP_SELECTED_ACCOUNT_PATH?.trim()
+    ]
+  ];
+  for (const [fileName, target, envOverride] of moves) {
+    if (envOverride || existsSync(target)) continue;
+    const legacyPath = path.join(legacyDir, fileName);
+    if (!existsSync(legacyPath) || existsSync(`${legacyPath}.migrated`)) continue;
+    let moved = false;
+    try {
+      ensureParentDir(target);
+      fs.renameSync(legacyPath, target);
+      moved = true;
+    } catch {
+      try {
+        ensureParentDir(target);
+        fs.copyFileSync(legacyPath, target);
+        moved = true;
+        try {
+          fs.unlinkSync(legacyPath);
+        } catch {
+          logger.warn(`Copied auth cache to ${target} but could not remove ${legacyPath}`);
+          try {
+            fs.writeFileSync(`${legacyPath}.migrated`, "", { mode: 384 });
+          } catch {
+          }
+        }
+      } catch (copyError) {
+        logger.warn(
+          `Could not migrate auth cache ${fileName} to ${target}: ${copyError.message}`
+        );
+      }
+    }
+    if (!moved) continue;
+    if (tightenPermissions(target)) {
+      logger.info(`Moved auth cache ${fileName} out of the package directory to ${target}`);
+    } else {
+      logger.error(
+        `Moved auth cache ${fileName} to ${target}, but could not make it owner-only. It holds credentials in plaintext until the next save re-encrypts it - restrict it by hand, or delete it and sign in again.`
+      );
+    }
+  }
 }
 function storageAccountForKey(key) {
   assertValidKey(key);
@@ -83,56 +151,268 @@ function assertValidKey(key) {
     throw new Error(`Unknown auth cache storage key: ${String(key)}`);
   }
 }
+function tightenPermissions(filePath) {
+  try {
+    fs.chmodSync(filePath, 384);
+    return true;
+  } catch (error) {
+    logger.warn(`Could not restrict permissions on ${filePath}: ${error.message}`);
+    return process.platform === "win32";
+  }
+}
 function ensureParentDir(filePath) {
   const dir = path.dirname(filePath);
   fs.mkdirSync(dir, { recursive: true, mode: 448 });
 }
 function writeFileAtomically(filePath, value) {
   ensureParentDir(filePath);
-  const tempPath = path.join(
-    path.dirname(filePath),
-    `.${path.basename(filePath)}.${process.pid}.${Date.now()}.tmp`
-  );
+  const tempPath = tempPathFor(filePath);
   fs.writeFileSync(tempPath, value, { mode: 384 });
   fs.renameSync(tempPath, filePath);
 }
+let keyStatePromise;
+let encryptionKeyPromise;
+const legacyKeytarEntries = /* @__PURE__ */ new Set();
+const warnedUndecryptable = /* @__PURE__ */ new Set();
+function resetCacheKeyForTests() {
+  keyStatePromise = void 0;
+  encryptionKeyPromise = void 0;
+  legacyKeytarEntries.clear();
+  warnedUndecryptable.clear();
+  legacyPathsMigrated = false;
+}
+async function clearLegacyKeytarEntry(key) {
+  if (!legacyKeytarEntries.delete(key)) return;
+  try {
+    const kt = await getKeytar();
+    if (kt) {
+      await kt.deletePassword(SERVICE_NAME, storageAccountForKey(key));
+      logger.info(`Removed the pre-encryption keychain entry for ${key}`);
+    }
+  } catch (error) {
+    logger.warn(
+      `Could not remove the legacy keychain entry for ${key}: ${error.message}`
+    );
+  }
+}
+function loadKeyState() {
+  if (!keyStatePromise) keyStatePromise = readCacheKeys();
+  return keyStatePromise;
+}
+async function readCacheKeys() {
+  const keys = [];
+  let canUseKeychain = false;
+  const kt = await getKeytar();
+  if (kt) {
+    let stored = null;
+    try {
+      stored = await kt.getPassword(SERVICE_NAME, CACHE_KEY_ACCOUNT);
+      canUseKeychain = true;
+    } catch (error) {
+      logger.warn(`Keychain access failed for the auth cache key: ${error.message}`);
+    }
+    if (stored) {
+      try {
+        keys.push(parseCacheKey(stored));
+      } catch (error) {
+        logger.warn(
+          `Ignoring unusable auth cache key in the keychain: ${error.message}`
+        );
+      }
+    }
+  }
+  let fileKeyIndex;
+  const keyPath = getCacheKeyPath();
+  if (existsSync(keyPath)) {
+    try {
+      keys.push(parseCacheKey(readFileSync(keyPath, "utf8")));
+      fileKeyIndex = keys.length - 1;
+    } catch (error) {
+      logger.warn(`Ignoring unusable auth cache key file: ${error.message}`);
+    }
+  }
+  return { keys, fileKeyIndex, canUseKeychain };
+}
+function getEncryptionKey() {
+  if (!encryptionKeyPromise) {
+    encryptionKeyPromise = resolveEncryptionKey().catch((error) => {
+      encryptionKeyPromise = void 0;
+      keyStatePromise = void 0;
+      throw error;
+    });
+  }
+  return encryptionKeyPromise;
+}
+async function resolveEncryptionKey() {
+  const state = await loadKeyState();
+  const preferred = state.keys[state.fileKeyIndex ?? 0];
+  if (preferred) return preferred;
+  const minted = await persistCacheKey(generateCacheKey(), state.canUseKeychain);
+  state.keys.unshift(minted);
+  if (state.fileKeyIndex !== void 0) state.fileKeyIndex += 1;
+  return minted;
+}
+async function persistCacheKey(key, canUseKeychain) {
+  const encoded = encodeCacheKey(key);
+  if (canUseKeychain) {
+    const kt = await getKeytar();
+    if (kt) {
+      try {
+        await kt.setPassword(SERVICE_NAME, CACHE_KEY_ACCOUNT, encoded);
+        const winner = await kt.getPassword(SERVICE_NAME, CACHE_KEY_ACCOUNT);
+        if (winner && winner !== encoded) {
+          logger.info("Another process stored an auth cache key first, adopting it");
+          return parseCacheKey(winner);
+        }
+        logger.info("Stored a new auth cache key in the system keychain");
+        return key;
+      } catch (error) {
+        logger.warn(`Keychain save failed for the auth cache key: ${error.message}`);
+      }
+    }
+  }
+  const keyPath = getCacheKeyPath();
+  if (createFileExclusively(keyPath, encoded)) {
+    logger.info(
+      `No usable system keychain; auth cache key written to ${keyPath}. Encryption guards against casual disclosure only when the key sits beside the cache.`
+    );
+    return key;
+  }
+  try {
+    const existing = parseCacheKey(readFileSync(keyPath, "utf8"));
+    logger.info("Another process created the auth cache key file first, adopting it");
+    return existing;
+  } catch (parseError) {
+    logger.warn(
+      `Replacing an unusable auth cache key file at ${keyPath}: ${parseError.message}`
+    );
+    try {
+      fs.unlinkSync(keyPath);
+    } catch {
+    }
+    if (createFileExclusively(keyPath, encoded)) return key;
+    return parseCacheKey(readFileSync(keyPath, "utf8"));
+  }
+}
+function createFileExclusively(filePath, contents) {
+  ensureParentDir(filePath);
+  const tempPath = tempPathFor(filePath);
+  try {
+    fs.writeFileSync(tempPath, contents, { mode: 384 });
+    fs.linkSync(tempPath, filePath);
+    return true;
+  } catch (error) {
+    if (error.code === "EEXIST") return false;
+    try {
+      fs.writeFileSync(filePath, contents, { mode: 384, flag: "wx" });
+      return fs.readFileSync(filePath, "utf8") === contents;
+    } catch (fallbackError) {
+      if (fallbackError.code === "EEXIST") return false;
+      throw fallbackError;
+    }
+  } finally {
+    try {
+      fs.unlinkSync(tempPath);
+    } catch {
+    }
+  }
+}
+function tempPathFor(filePath) {
+  return path.join(
+    path.dirname(filePath),
+    `.${path.basename(filePath)}.${randomBytes(8).toString("hex")}.tmp`
+  );
+}
+async function readCacheFile(key, cachePath) {
+  let onDisk;
+  try {
+    onDisk = readFileSync(cachePath, "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT") return { status: "absent" };
+    return { status: "unreadable", reason: error.message };
+  }
+  if (onDisk === "") return { status: "absent" };
+  if (isEncryptedCache(onDisk)) {
+    const { keys } = await loadKeyState();
+    const decrypted = decryptWithAnyKey(onDisk, keys, key);
+    if (decrypted !== void 0) return { status: "decrypted", raw: decrypted };
+    keyStatePromise = void 0;
+    encryptionKeyPromise = void 0;
+    return { status: "unreadable", reason: "no known key opens it" };
+  }
+  if (isPlainCacheJson(onDisk)) return { status: "plaintext", raw: onDisk };
+  return { status: "unreadable", reason: "not a recognisable auth cache" };
+}
+function isPlainCacheJson(raw) {
+  try {
+    const parsed = JSON.parse(raw);
+    return parsed !== null && typeof parsed === "object";
+  } catch {
+    return false;
+  }
+}
+function decryptWithAnyKey(raw, keys, purpose) {
+  for (const key of keys) {
+    try {
+      return decryptCache(raw, key, purpose);
+    } catch {
+    }
+  }
+  return void 0;
+}
+async function assertOverwritable(key, cachePath) {
+  const state = await readCacheFile(key, cachePath);
+  if (state.status !== "unreadable") {
+    warnedUndecryptable.delete(key);
+    return;
+  }
+  if (!warnedUndecryptable.has(key)) {
+    warnedUndecryptable.add(key);
+    logger.warn(
+      `Not persisting ${key}: ${cachePath} cannot be read back (${state.reason}), and overwriting it would discard whatever it holds. A locked keychain usually reads fine on the next start. If it never does, delete ${cachePath} to start over.`
+    );
+  }
+  throw new Error(`Refusing to overwrite the unreadable auth cache at ${cachePath}`);
+}
 class DefaultTokenCacheStorage {
   constructor() {
-    this.description = "default (keytar+file)";
+    this.description = "default (encrypted file)";
     this.failClosed = false;
   }
   async load(key) {
     assertValidKey(key);
+    migrateLegacyPaths();
     let keytarRaw;
     try {
       const kt = await getKeytar();
       if (kt) {
         keytarRaw = await kt.getPassword(SERVICE_NAME, storageAccountForKey(key)) ?? void 0;
+        if (keytarRaw) legacyKeytarEntries.add(key);
       }
     } catch (error) {
       logger.warn(`Keychain access failed for ${key}: ${error.message}`);
     }
-    let fileRaw;
     const cachePath = filePathForKey(key);
-    if (existsSync(cachePath)) {
-      fileRaw = readFileSync(cachePath, "utf8");
+    const state = await readCacheFile(key, cachePath);
+    let fileRaw;
+    if (state.status === "decrypted" || state.status === "plaintext") {
+      fileRaw = state.raw;
+    } else if (state.status === "unreadable") {
+      logger.warn(
+        `Could not read ${key} back (${state.reason}); leaving it in place and re-authenticating`
+      );
     }
     return pickNewestRaw(keytarRaw, fileRaw);
   }
   async save(key, value) {
     assertValidKey(key);
-    try {
-      const kt = await getKeytar();
-      if (kt) {
-        await kt.setPassword(SERVICE_NAME, storageAccountForKey(key), value);
-        return;
-      }
-    } catch (error) {
-      logger.warn(
-        `Keychain save failed for ${key}, falling back to file storage: ${error.message}`
-      );
-    }
-    writeFileAtomically(filePathForKey(key), value);
+    migrateLegacyPaths();
+    const cachePath = filePathForKey(key);
+    await assertOverwritable(key, cachePath);
+    const encryptionKey = await getEncryptionKey();
+    await assertOverwritable(key, cachePath);
+    writeFileAtomically(cachePath, encryptCache(value, encryptionKey, key));
+    await clearLegacyKeytarEntry(key);
   }
   async delete(key) {
     assertValidKey(key);
@@ -289,6 +569,9 @@ function parseTimeoutMs(value) {
   return parsed;
 }
 async function assertCommandUsable(commandPath) {
+  if (!path.isAbsolute(commandPath)) {
+    throw new Error(`${AUTH_CACHE_COMMAND_ENV} must be an absolute path.`);
+  }
   let stats;
   try {
     stats = await fs.promises.stat(commandPath);
@@ -328,9 +611,12 @@ export {
   CommandTokenCacheStorage,
   DefaultTokenCacheStorage,
   createTokenCacheStorage,
+  getCacheKeyPath,
   getSelectedAccountPath,
   getTokenCachePath,
+  migrateLegacyPathsFrom,
   pickNewest,
+  resetCacheKeyForTests,
   unwrapCache,
   wrapCache
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@softeria/ms-365-mcp-server",
-  "version": "0.136.0",
+  "version": "0.138.0",
   "description": " A Model Context Protocol (MCP) server for interacting with Microsoft 365 and Office services through the Graph API",
   "type": "module",
   "main": "dist/index.js",