ask-marcel-office-cli 2.0.0 → 2.1.0

package/dist/cli.js

@@ -2144,7 +2144,7 @@ import updateNotifier from "update-notifier";
 // package.json
 var package_default = {
   name: "ask-marcel-office-cli",
-  version: "2.0.0",
+  version: "2.1.0",
   description: "Microsoft Graph CLI + library — typed Bun/TypeScript wrapper around 150+ Graph operations (read + on-the-fly PDF/markdown conversion + federated Microsoft Search) reachable from a Teams browser-OAuth token.",
   license: "MIT",
   author: "Vincent Delacourt <vincent.delacourt@adama-development.com>",
@@ -2677,7 +2677,7 @@ var createBrowserAuthFromApi = (api, config) => {
     logger.info("elevated_token_capture_timeout");
     return { ok: false, reason: "sso_timeout" };
   };
-  const acquireBothTokens = async (teamsUrl) => {
+  const acquireBothTokens = async (teamsUrl, options) => {
     const elevatedUrl = M365_CLOUD_URL;
     trace(`[DEBUG] acquireBothTokens: ENTER
 `);
@@ -2860,7 +2860,7 @@ var createBrowserAuthFromApi = (api, config) => {
     const teamsDeadline = Date.now() + pollDeadlineMs;
     let pollCount = 0;
     while (Date.now() < teamsDeadline && !capturedAccess) {
-      const concurrent = await freshCachedToken();
+      const concurrent = options?.skipCacheProbe === true ? null : await freshCachedToken();
       if (concurrent !== null) {
         const validated = accessToken(concurrent);
         if (validated.ok) {
@@ -3189,9 +3189,20 @@ var createAuthManagerFromApi = (browserAuth, cachePath, browserProfileDir, logge
   };
   let lastElevatedOutcome = null;
   let lastChatsvcaggOutcome = null;
-  const acquireViaBrowser = async () => {
+  const redeemMissedSubstrateAtLogin = async (chatsvcaggCaptured, ic3Captured) => {
+    if (chatsvcaggCaptured && ic3Captured)
+      return;
+    const fresh = await readCache();
+    if (!fresh?.refresh_token)
+      return;
+    if (!chatsvcaggCaptured)
+      await refreshSubstrateToken(fresh, CHATSVCAGG_RESOURCE, persistChatsvcagg, "auth.chatsvcagg.login_rt_redeem");
+    if (!ic3Captured)
+      await refreshSubstrateToken(fresh, IC3_RESOURCE, persistIc3, "auth.ic3.login_rt_redeem");
+  };
+  const acquireViaBrowser = async (force = false) => {
     try {
-      const { teams: result, elevated, chatsvcagg, ic3, fromCache } = await browserAuth.acquireBothTokens(TEAMS_URL);
+      const { teams: result, elevated, chatsvcagg, ic3, fromCache } = await browserAuth.acquireBothTokens(TEAMS_URL, { skipCacheProbe: force });
       if (!result)
         return err({ type: "auth_cancelled" });
       if (fromCache === true) {
@@ -3221,6 +3232,8 @@ var createAuthManagerFromApi = (browserAuth, cachePath, browserProfileDir, logge
       } else {
         logger.info("auth.ic3.skipped_at_login", { reason: ic3.reason });
       }
+      if (force)
+        await redeemMissedSubstrateAtLogin(chatsvcagg.ok, ic3.ok);
       logger.info("auth.ladder.rung", { rung: "browser" });
       return ok(result.accessToken);
     } catch (e) {
@@ -3229,32 +3242,34 @@ var createAuthManagerFromApi = (browserAuth, cachePath, browserProfileDir, logge
     }
   };
   let inFlightBrowserAcquire = null;
-  const acquireViaBrowserShared = () => {
+  const acquireViaBrowserShared = (force = false) => {
     if (inFlightBrowserAcquire !== null) {
       logger.info("auth.ladder.rung", { rung: "browser_shared_in_flight" });
       return inFlightBrowserAcquire;
     }
-    const launched = acquireViaBrowser();
+    const launched = acquireViaBrowser(force);
     inFlightBrowserAcquire = launched.finally(() => {
       inFlightBrowserAcquire = null;
     });
     return inFlightBrowserAcquire;
   };
-  const getAccessToken = async () => {
-    const cached = await readCache();
-    if (cached) {
-      const validated = accessToken(cached.access_token);
-      if (validated.ok) {
-        logger.info("auth.ladder.rung", { rung: "cache" });
-        return ok(validated.value);
+  const getAccessToken = async (options) => {
+    if (!options?.force) {
+      const cached = await readCache();
+      if (cached) {
+        const validated = accessToken(cached.access_token);
+        if (validated.ok) {
+          logger.info("auth.ladder.rung", { rung: "cache" });
+          return ok(validated.value);
+        }
+      }
+      if (cached?.refresh_token) {
+        const refreshed = await refreshToken(cached);
+        if (refreshed.ok)
+          return refreshed;
       }
     }
-    if (cached?.refresh_token) {
-      const refreshed = await refreshToken(cached);
-      if (refreshed.ok)
-        return refreshed;
-    }
-    return acquireViaBrowserShared();
+    return acquireViaBrowserShared(options?.force ?? false);
   };
   const ELEVATED_BUFFER_SECONDS = 300;
   const freshElevatedToken = (cached) => {
@@ -3264,6 +3279,12 @@ var createAuthManagerFromApi = (browserAuth, cachePath, browserProfileDir, logge
       return;
     return cached.elevated_access_token;
   };
+  const getCachedElevatedInfo = async () => {
+    const cached = await readCache();
+    const exp = cached?.elevated_expires_on;
+    const expiresInSeconds = typeof exp === "number" ? Math.floor(exp - Date.now() / 1000) : undefined;
+    return { available: freshElevatedToken(cached) !== undefined, expiresInSeconds };
+  };
   const recoverableElevatedFailureMessage = (reason) => {
     if (reason === "launch_timeout") {
       return "elevated browser launch timed out (15s) — likely a corrupt persistent profile or filesystem lock. Run `ask-marcel-office logout && ask-marcel-office login` to wipe the profile and retry. (Commands that need this token: list-chats, get-chat, the historical-version download / convert commands.)";
@@ -3321,6 +3342,12 @@ var createAuthManagerFromApi = (browserAuth, cachePath, browserProfileDir, logge
       return;
     return cached.chatsvcagg_access_token;
   };
+  const getCachedChatsvcaggInfo = async () => {
+    const cached = await readCache();
+    const exp = cached?.chatsvcagg_expires_on;
+    const expiresInSeconds = typeof exp === "number" ? Math.floor(exp - Date.now() / 1000) : undefined;
+    return { available: freshChatsvcaggToken(cached) !== undefined, expiresInSeconds };
+  };
   const recoverableChatsvcaggFailureMessage = (reason) => {
     if (reason === "launch_timeout") {
       return "chatsvcagg browser launch timed out (15s) — likely a corrupt persistent profile or filesystem lock. Run `ask-marcel-office logout && ask-marcel-office login` to wipe the profile and retry. (Commands that need this token: list-teams-chats-with-messages, list-teams-chat-messages, get-teams-chat-message, find-chats-with-user.)";
@@ -3389,6 +3416,12 @@ var createAuthManagerFromApi = (browserAuth, cachePath, browserProfileDir, logge
       return;
     return cached.ic3_access_token;
   };
+  const getCachedIc3Info = async () => {
+    const cached = await readCache();
+    const exp = cached?.ic3_expires_on;
+    const expiresInSeconds = typeof exp === "number" ? Math.floor(exp - Date.now() / 1000) : undefined;
+    return { available: freshIc3Token(cached) !== undefined, expiresInSeconds };
+  };
   const recoverableIc3FailureMessage = (reason) => {
     if (reason === "launch_timeout") {
       return "ic3 browser launch timed out (15s) — likely a corrupt persistent profile or filesystem lock. Run `ask-marcel-office logout && ask-marcel-office login` to wipe the profile and retry. (Commands that need this token: list-teams-chat-history.)";
@@ -3463,7 +3496,10 @@ var createAuthManagerFromApi = (browserAuth, cachePath, browserProfileDir, logge
     getIc3AccessToken,
     logout,
     getLastElevatedOutcome,
-    getLastChatsvcaggOutcome
+    getLastChatsvcaggOutcome,
+    getCachedElevatedInfo,
+    getCachedChatsvcaggInfo,
+    getCachedIc3Info
   };
 };
 var defaultFileSystem2 = () => typeof globalThis.Bun !== "undefined" ? createBunFileSystem() : createNodeFileSystem();
@@ -3877,7 +3913,10 @@ var createGraphClient = (auth, fetchFn = globalThis.fetch) => {
     const expRaw = claims["exp"];
     const expiresAt = typeof expRaw === "number" ? new Date(expRaw * 1000).toISOString() : undefined;
     const expiresInSeconds = typeof expRaw === "number" ? Math.floor(expRaw - Date.now() / 1000) : undefined;
-    return ok({ scopes, audience, expiresAt, expiresInSeconds });
+    const elevated = auth.getCachedElevatedInfo ? await auth.getCachedElevatedInfo() : { available: false, expiresInSeconds: undefined };
+    const chatsvcagg = auth.getCachedChatsvcaggInfo ? await auth.getCachedChatsvcaggInfo() : { available: false, expiresInSeconds: undefined };
+    const ic3 = auth.getCachedIc3Info ? await auth.getCachedIc3Info() : { available: false, expiresInSeconds: undefined };
+    return ok({ scopes, audience, expiresAt, expiresInSeconds, elevated, chatsvcagg, ic3 });
   };
   return {
     get: (path, extraHeaders) => request("GET", path, undefined, extraHeaders),
@@ -4608,6 +4647,7 @@ var GRAPH_SCOPES_BY_COMMAND = {
   "convert-calendar-event-attachment-to-pdf": ["Calendars.Read", "Files.Read"],
   "extract-mail-attachment-images": ["Mail.Read"],
   "extract-sharepoint-links-in-mail": ["Mail.Read"],
+  "create-forward-draft": ["Mail.ReadWrite"],
   "create-mail-draft": ["Mail.ReadWrite"],
   "create-reply-draft": ["Mail.ReadWrite"],
   "update-mail-draft": ["Mail.ReadWrite"],
@@ -4730,14 +4770,21 @@ var toEntry = (name, cmd) => {
 var LIFECYCLE_ENTRIES = [
   {
     name: "login",
-    summary: "Authenticate against Microsoft Graph using the Teams web client (cached token → refresh → browser fallback). Stores tokens at ~/.ask-marcel/token-cache.json (0600). Run before any Graph command.",
+    summary: "Authenticate against Microsoft Graph using the Teams web client (cached token → refresh → browser fallback). Stores tokens at ~/.ask-marcel/token-cache.json (0600). Reports all four cached tokens (basic / elevated / chatsvcagg / ic3) with their time-left and how to refresh each; pass --force to re-capture every token via the browser in one pass. Run before any Graph command.",
     category: "lifecycle",
     graphMethod: "GET",
     graphPathTemplate: "(lifecycle) browser-OAuth via Teams web client; not a Graph endpoint",
     graphDocsUrl: "https://learn.microsoft.com/en-us/graph/auth-v2-user",
-    options: [],
-    example: "ask-marcel-office login",
-    responseShape: '{ status: "authenticated" } on success; envelope error on cancel/failure.'
+    options: [
+      {
+        name: "force",
+        key: "force",
+        required: false,
+        description: "Ignore the cache and re-capture every token via the browser. The only way to refresh the elevated (M365) token while the basic token is still valid; the persistent browser profile is reused, so you are usually not re-prompted for credentials."
+      }
+    ],
+    example: "ask-marcel-office login --force",
+    responseShape: '{ status: "authenticated", tokens: { basic, elevated, chatsvcagg, ic3 }, hint } on success. Each token is { available: boolean, expiresInSeconds?: number, refresh: "automatic" | "interactive", reason? }: basic/chatsvcagg/ic3 refresh automatically from the cached refresh token, the elevated (M365) token is re-captured only on an interactive login. `expiresInSeconds` is omitted when the token is not cached; a failed elevated capture this run adds `reason`. Envelope error on cancel/failure.'
   },
   {
     name: "logout",
@@ -19975,17 +20022,17 @@ var bytesToMarkdown = async (bytes, filename, opts, hints) => {
   if (ext === "doc")
     return docToMarkdown(bytes);
   if (ext === "ppt")
-    return err({ type: "api_error", status: 415, message: hints.legacyPpt });
+    return err({ type: "api_error", status: 415, code: "unsupported_legacy_office", message: hints.legacyPpt });
   if (ext === "msg") {
     const depth = opts.depth ?? 0;
     return msgToMarkdown(bytes, { depth }, (childBytes, childName) => bytesToMarkdown(childBytes, childName, { ...opts, depth: depth + 1 }, NESTED_HINTS));
   }
   if (IMAGE_EXTENSIONS.has(ext))
-    return err({ type: "api_error", status: 415, message: hints.image(ext) });
+    return err({ type: "api_error", status: 415, code: "unsupported_image", message: hints.image(ext) });
   const text = decodeUtf8Text(bytes);
   if (text !== undefined)
     return ok({ contentType: "text/plain", size: bytes.byteLength, text });
-  return err({ type: "api_error", status: 415, message: hints.generic(ext === "" ? "<no-extension>" : ext) });
+  return err({ type: "api_error", status: 415, code: "unsupported_format", message: hints.generic(ext === "" ? "<no-extension>" : ext) });
 };
 
 // src/use-cases/commands/inline-image-embedder.ts
@@ -20259,6 +20306,7 @@ var extractImagesFromBytes = async (bytes, name, fetchHint) => {
     return err({
       type: "api_error",
       status: 415,
+      code: "unsupported_document",
       message: `${ext === "" ? "<no-extension>" : ext} is not a supported document — image extraction supports pdf and docx / xlsx / pptx (and their macro-enabled / template variants). ${fetchHint}`
     });
   }
@@ -24410,19 +24458,27 @@ var openZipEntries = async (bytes) => {
 
 // src/use-cases/commands/zip-archive-to-markdown.ts
 var MAX_ENTRIES = 100;
-var convertEntry = async (entry, includeMetadata) => {
+var entryImages = async (entry) => {
+  const r = await extractImagesFromBytes(entry.bytes, entry.path, "");
+  return r.ok ? r.value.media : [];
+};
+var convertEntry = async (entry, includeMetadata, includeImages) => {
   const r = await bytesToMarkdown(entry.bytes, entry.path, { includeMetadata }, NESTED_HINTS);
   if (!r.ok)
     return { path: entry.path, note: r.error.message };
   const env = r.value;
-  return { path: entry.path, contentType: env.contentType, size: env.size, text: env.text };
+  const base = { path: entry.path, contentType: env.contentType, size: env.size, text: env.text };
+  if (!includeImages)
+    return base;
+  const images = await entryImages(entry);
+  return images.length > 0 ? { ...base, images } : base;
 };
-var convertZipArchive = async (bytes, includeMetadata) => {
+var convertZipArchive = async (bytes, includeMetadata, includeImages = false) => {
   const entries = await openZipEntries(bytes);
   if (!entries.ok)
     return entries;
   const capped = entries.value.slice(0, MAX_ENTRIES);
-  const files = await Promise.all(capped.map((entry) => convertEntry(entry, includeMetadata)));
+  const files = await Promise.all(capped.map((entry) => convertEntry(entry, includeMetadata, includeImages)));
   if (entries.value.length > MAX_ENTRIES) {
     return ok({ count: files.length, totalEntries: entries.value.length, truncated: true, files });
   }
@@ -25088,14 +25144,112 @@ var meta91 = {
   producesBytes: true
 };
 
-// src/use-cases/commands/create-mail-draft.ts
-var exports_create_mail_draft = {};
-__export(exports_create_mail_draft, {
+// src/use-cases/commands/create-forward-draft.ts
+var exports_create_forward_draft = {};
+__export(exports_create_forward_draft, {
   schema: () => schema90,
   meta: () => meta92,
   execute: () => execute90
 });
+
+// src/use-cases/commands/parse-recipients.ts
+var parseRecipients = (csv) => csv.split(",").map((s) => s.trim()).filter((s) => s.length > 0).map((address) => ({ emailAddress: { address } }));
+
+// src/use-cases/commands/create-forward-draft.ts
 var schema90 = exports_external.object({
+  forwardMessageId: exports_external.string().min(1),
+  toRecipients: exports_external.string().min(1),
+  ccRecipients: exports_external.string().optional(),
+  bodyContent: exports_external.string().min(1),
+  subject: exports_external.string().optional()
+});
+var isUnsentDraft = (value) => typeof value === "object" && value !== null && ("id" in value) && typeof value.id === "string" && ("isDraft" in value) && value.isDraft === true;
+var execute90 = async (graph, params) => {
+  const parsed = schema90.safeParse(params);
+  if (!parsed.success)
+    return err({
+      type: "validation_error",
+      message: formatZodError(parsed.error)
+    });
+  const { forwardMessageId, toRecipients, ccRecipients, bodyContent, subject } = parsed.data;
+  const created = await graph.post(`/me/messages/${forwardMessageId}/createForward`, {
+    comment: bodyContent,
+    toRecipients: parseRecipients(toRecipients)
+  });
+  if (!created.ok)
+    return created;
+  if (!isUnsentDraft(created.value)) {
+    return err({
+      type: "api_error",
+      status: 500,
+      code: "not_an_unsent_draft",
+      message: `createForward did not return an unsent draft for message ${forwardMessageId} - refusing to patch. Inspect the message id and retry.`
+    });
+  }
+  const patch = {};
+  if (ccRecipients)
+    patch.ccRecipients = parseRecipients(ccRecipients);
+  if (subject)
+    patch.subject = subject;
+  if (Object.keys(patch).length === 0)
+    return created;
+  return graph.patch(`/me/messages/${created.value.id}`, patch);
+};
+var meta92 = {
+  summary: "Create an UNSENT forward draft of an existing message. POST /me/messages/{id}/createForward mints the draft (FW: subject, quoted original) with your comment placed above the quote and the recipients set, in one call. Redirects a thread to the right owner without leaving the CLI. The draft is saved in Drafts and can be reviewed, edited, and sent from any Outlook client; the CLI still cannot send.",
+  category: "mail",
+  graphMethod: "POST",
+  graphPathTemplate: "/me/messages/{forward-message-id}/createForward (+ optional body-free PATCH for cc / subject)",
+  graphDocsUrl: "https://learn.microsoft.com/en-us/graph/api/message-createforward",
+  options: [
+    {
+      name: "forward-message-id",
+      key: "forwardMessageId",
+      required: true,
+      aliases: [{ name: "id", key: "id" }],
+      description: "The message being forwarded. Source from list-mail-folder-messages or search-mail-messages. Accepts `--id` as an alias.",
+      argumentHint: { kind: "idOrName" }
+    },
+    {
+      name: "to-recipients",
+      key: "toRecipients",
+      required: true,
+      description: 'Comma-separated list of recipient email addresses to forward to (e.g. "alice@example.com,bob@example.com"). Required: a forward without a recipient is not actionable.'
+    },
+    {
+      name: "cc-recipients",
+      key: "ccRecipients",
+      required: false,
+      description: "Comma-separated list of CC recipient email addresses."
+    },
+    {
+      name: "body-content",
+      key: "bodyContent",
+      required: true,
+      description: "The comment text, placed above the quoted forwarded message by Graph."
+    },
+    {
+      name: "subject",
+      key: "subject",
+      required: false,
+      description: 'Optional subject override. Omit to keep the inherited "FW: ..." subject.'
+    }
+  ],
+  example: 'ask-marcel-office create-forward-draft --forward-message-id "AAMkAD..." --to-recipients "bob@example.com" --body-content "Bob owns this now, forwarding for your action."',
+  bodyTemplate: "POST { comment: '{body-content}', toRecipients: '{to-recipients}' } then optional PATCH { ccRecipients?: '{cc-recipients}', subject?: '{subject}' }",
+  mutates: true,
+  scopesRequired: ["Mail.ReadWrite"],
+  responseShape: "The updated draft message object (or `{ ok: true }` when Graph answers 204): `{ id, subject, body, toRecipients, ccRecipients, isDraft: true, … }`. The `id` is the draft - update further with update-mail-draft, or open Outlook Drafts to review and send."
+};
+
+// src/use-cases/commands/create-mail-draft.ts
+var exports_create_mail_draft = {};
+__export(exports_create_mail_draft, {
+  schema: () => schema91,
+  meta: () => meta93,
+  execute: () => execute91
+});
+var schema91 = exports_external.object({
   subject: exports_external.string().min(1),
   bodyContent: exports_external.string().min(1),
   bodyContentType: exports_external.enum(["Text", "HTML"]).optional(),
@@ -25105,9 +25259,8 @@ var schema90 = exports_external.object({
   importance: exports_external.enum(["Low", "Normal", "High"]).optional(),
   mailFolderId: exports_external.string().optional()
 });
-var parseRecipients = (csv) => csv.split(",").map((s) => s.trim()).filter((s) => s.length > 0).map((address) => ({ emailAddress: { address } }));
-var execute90 = async (graph, params) => {
-  const parsed = schema90.safeParse(params);
+var execute91 = async (graph, params) => {
+  const parsed = schema91.safeParse(params);
   if (!parsed.success)
     return err({ type: "validation_error", message: formatZodError(parsed.error) });
   const { subject, bodyContent, bodyContentType, toRecipients, ccRecipients, bccRecipients, importance, mailFolderId } = parsed.data;
@@ -25128,7 +25281,7 @@ var execute90 = async (graph, params) => {
   const path = mailFolderId ? `/me/mailFolders/${mailFolderId}/messages` : "/me/messages";
   return graph.post(path, body);
 };
-var meta92 = {
+var meta93 = {
   summary: "Create a new mail draft. POST /me/messages (or /me/mailFolders/{id}/messages when --mail-folder-id is set). The draft is saved in the Drafts folder (or the specified folder) and can be sent later via the Outlook client or Graph sendMail. Recipients are comma-separated email addresses. Returns the created message object with its id — use this id with update-mail-draft to modify the draft before sending.",
   category: "mail",
   graphMethod: "POST",
@@ -25197,44 +25350,44 @@ var meta92 = {
 // src/use-cases/commands/create-reply-draft.ts
 var exports_create_reply_draft = {};
 __export(exports_create_reply_draft, {
-  schema: () => schema91,
-  meta: () => meta93,
-  execute: () => execute91
+  schema: () => schema92,
+  meta: () => meta94,
+  execute: () => execute92
 });
-var schema91 = exports_external.object({
+var schema92 = exports_external.object({
   replyToMessageId: exports_external.string().min(1),
   bodyContent: exports_external.string().min(1),
-  bodyContentType: exports_external.enum(["Text", "HTML"]).optional(),
   subject: exports_external.string().optional()
 });
-var isUnsentDraft = (value) => typeof value === "object" && value !== null && ("id" in value) && typeof value.id === "string" && ("isDraft" in value) && value.isDraft === true;
-var execute91 = async (graph, params) => {
-  const parsed = schema91.safeParse(params);
+var isUnsentDraft2 = (value) => typeof value === "object" && value !== null && ("id" in value) && typeof value.id === "string" && ("isDraft" in value) && value.isDraft === true;
+var execute92 = async (graph, params) => {
+  const parsed = schema92.safeParse(params);
   if (!parsed.success)
     return err({ type: "validation_error", message: formatZodError(parsed.error) });
-  const { replyToMessageId, bodyContent, bodyContentType, subject } = parsed.data;
-  const created = await graph.post(`/me/messages/${replyToMessageId}/createReplyAll`, {});
+  const { replyToMessageId, bodyContent, subject } = parsed.data;
+  const created = await graph.post(`/me/messages/${replyToMessageId}/createReplyAll`, { comment: bodyContent });
   if (!created.ok)
     return created;
-  if (!isUnsentDraft(created.value)) {
+  if (!isUnsentDraft2(created.value)) {
     return err({
       type: "api_error",
       status: 500,
+      code: "not_an_unsent_draft",
       message: `createReplyAll did not return an unsent draft for message ${replyToMessageId} - refusing to patch. Inspect the message id and retry.`
     });
   }
-  const patch = {
-    body: { contentType: bodyContentType ?? "Text", content: bodyContent }
-  };
+  const patch = {};
   if (subject)
     patch.subject = subject;
+  if (Object.keys(patch).length === 0)
+    return created;
   return graph.patch(`/me/messages/${created.value.id}`, patch);
 };
-var meta93 = {
-  summary: "Create an UNSENT reply-all draft threaded on an existing message. POST /me/messages/{id}/createReplyAll mints the draft (inherited recipients, RE: subject, quoted history), then PATCH places the reply body above the quote. Reply-all by design - dropping recipients is a deliberate act for the human in Outlook, not a default. The draft is saved in Drafts and can be reviewed, edited, and sent from any Outlook client; the CLI still cannot send.",
+var meta94 = {
+  summary: "Create an UNSENT reply-all draft threaded on an existing message. POST /me/messages/{id}/createReplyAll mints the draft (inherited recipients, RE: subject, quoted history) with your reply text placed above the quote, in one call. Reply-all by design - dropping recipients is a deliberate act for the human in Outlook, not a default. The draft is saved in Drafts and can be reviewed, edited, and sent from any Outlook client; the CLI still cannot send.",
   category: "mail",
   graphMethod: "POST",
-  graphPathTemplate: "/me/messages/{reply-to-message-id}/createReplyAll (then PATCH the returned draft)",
+  graphPathTemplate: "/me/messages/{reply-to-message-id}/createReplyAll (+ optional body-free PATCH for subject)",
   graphDocsUrl: "https://learn.microsoft.com/en-us/graph/api/message-createreplyall",
   options: [
     {
@@ -25249,14 +25402,7 @@ var meta93 = {
       name: "body-content",
       key: "bodyContent",
       required: true,
-      description: "The reply text, placed above the quoted history. Plain text by default; pass --body-content-type HTML for rich text."
-    },
-    {
-      name: "body-content-type",
-      key: "bodyContentType",
-      required: false,
-      description: "Reply body format: Text (default) or HTML.",
-      argumentHint: { kind: "magicValue", values: ["Text", "HTML"] }
+      description: "The reply text, placed above the quoted history by Graph."
     },
     {
       name: "subject",
@@ -25266,7 +25412,7 @@ var meta93 = {
     }
   ],
   example: 'ask-marcel-office create-reply-draft --reply-to-message-id "AAMkAD..." --body-content "Confirmed for Concur, aligned with the group choice."',
-  bodyTemplate: "POST {} then PATCH { body: { contentType: '{body-content-type}', content: '{body-content}' }, subject?: '{subject}' }",
+  bodyTemplate: "POST { comment: '{body-content}' } then optional PATCH { subject?: '{subject}' }",
   mutates: true,
   scopesRequired: ["Mail.ReadWrite"],
   responseShape: "The updated draft message object (or `{ ok: true }` when Graph answers 204): `{ id, subject, body, toRecipients, ccRecipients, isDraft: true, … }`. The `id` is the draft - update further with update-mail-draft, or open Outlook Drafts to review and send."
@@ -25275,11 +25421,11 @@ var meta93 = {
 // src/use-cases/commands/update-mail-draft.ts
 var exports_update_mail_draft = {};
 __export(exports_update_mail_draft, {
-  schema: () => schema92,
-  meta: () => meta94,
-  execute: () => execute92
+  schema: () => schema93,
+  meta: () => meta95,
+  execute: () => execute93
 });
-var schema92 = exports_external.object({
+var schema93 = exports_external.object({
   messageId: exports_external.string().min(1),
   subject: exports_external.string().optional(),
   bodyContent: exports_external.string().optional(),
@@ -25289,9 +25435,8 @@ var schema92 = exports_external.object({
   bccRecipients: exports_external.string().optional(),
   importance: exports_external.enum(["Low", "Normal", "High"]).optional()
 });
-var parseRecipients2 = (csv) => csv.split(",").map((s) => s.trim()).filter((s) => s.length > 0).map((address) => ({ emailAddress: { address } }));
-var execute92 = async (graph, params) => {
-  const parsed = schema92.safeParse(params);
+var execute93 = async (graph, params) => {
+  const parsed = schema93.safeParse(params);
   if (!parsed.success)
     return err({ type: "validation_error", message: formatZodError(parsed.error) });
   const { messageId, subject, bodyContent, bodyContentType, toRecipients, ccRecipients, bccRecipients, importance } = parsed.data;
@@ -25307,16 +25452,16 @@ var execute92 = async (graph, params) => {
   if (bodyContent !== undefined)
     body.body = { contentType: bodyContentType ?? "Text", content: bodyContent };
   if (toRecipients)
-    body.toRecipients = parseRecipients2(toRecipients);
+    body.toRecipients = parseRecipients(toRecipients);
   if (ccRecipients)
-    body.ccRecipients = parseRecipients2(ccRecipients);
+    body.ccRecipients = parseRecipients(ccRecipients);
   if (bccRecipients)
-    body.bccRecipients = parseRecipients2(bccRecipients);
+    body.bccRecipients = parseRecipients(bccRecipients);
   if (importance)
     body.importance = importance;
   return graph.patch(`/me/messages/${messageId}`, body);
 };
-var meta94 = {
+var meta95 = {
   summary: "Update an existing mail draft. PATCH /me/messages/{id} — modifies a draft created by create-mail-draft (or any existing draft in the Drafts folder). Only the fields you pass are updated; omitted fields are left unchanged. At least one field must be provided. Returns the updated message object. Use get-mail-message to verify the final state before sending.",
   category: "mail",
   graphMethod: "PATCH",
@@ -25386,17 +25531,17 @@ var meta94 = {
 // src/use-cases/commands/convert-drive-item-zip.ts
 var exports_convert_drive_item_zip = {};
 __export(exports_convert_drive_item_zip, {
-  schema: () => schema93,
-  meta: () => meta95,
-  execute: () => execute93
+  schema: () => schema94,
+  meta: () => meta96,
+  execute: () => execute94
 });
-var schema93 = exports_external.object({
+var schema94 = exports_external.object({
   driveId: exports_external.string().min(1),
   itemId: exports_external.string().min(1),
   includeMetadata: exports_external.enum(["true", "false"]).optional()
 });
-var execute93 = async (graph, params) => {
-  const parsed = schema93.safeParse(params);
+var execute94 = async (graph, params) => {
+  const parsed = schema94.safeParse(params);
   if (!parsed.success)
     return err({ type: "validation_error", message: formatZodError(parsed.error) });
   const { driveId, itemId } = parsed.data;
@@ -25406,7 +25551,7 @@ var execute93 = async (graph, params) => {
     return bytes;
   return convertZipArchive(bytes.value, includeMetadata);
 };
-var meta95 = {
+var meta96 = {
   summary: "Unzip a `.zip` from a OneDrive / SharePoint item and convert every contained file in one call — so \"read the handover archive\" doesn't need a separate unzip + per-file conversion. Office files (docx/xlsx/pptx/odt/ods/odp and their macro-enabled / template variants) are converted to markdown via the local pipelines; plain-text entries (txt/md/csv/json/yaml/…) are decoded inline; legacy OLE .xls (sheetjs) and .doc (word-extractor, text only) are extracted; an Outlook .msg entry is rendered to markdown (headers + body, with its own attachments converted recursively); PDFs have their text layer extracted (text/plain); images, binaries, nested archives, legacy .ppt, and scanned/image-only PDFs (no text layer) are listed with a note (not unpacked) so one unsupported entry never fails the whole archive. Pass `--include-metadata true` to append each Office file's side-channel metadata block. Capped at 100 entries (the archive is buffered in memory); beyond that the response is flagged `truncated`.",
   category: "drive",
   graphMethod: "GET",
@@ -25435,16 +25580,17 @@ var meta95 = {
 // src/use-cases/commands/convert-local-file.ts
 var exports_convert_local_file = {};
 __export(exports_convert_local_file, {
-  schema: () => schema94,
-  meta: () => meta96,
+  schema: () => schema95,
+  meta: () => meta97,
   executeLocal: () => executeLocal,
-  execute: () => execute94
+  execute: () => execute95
 });
 import { basename } from "node:path";
-var schema94 = exports_external.object({
+var schema95 = exports_external.object({
   path: exports_external.string().min(1),
   includeMetadata: exports_external.enum(["true", "false"]).optional(),
   inlineImages: exports_external.enum(["true", "false"]).optional(),
+  includeImages: exports_external.enum(["true", "false"]).optional(),
   maxCells: exports_external.string().regex(/^[1-9]\d*$/, "must be a positive integer").optional()
 });
 var LOCAL_HINTS = {
@@ -25454,12 +25600,13 @@ var LOCAL_HINTS = {
   generic: (ext) => `${ext} is not a convertible Office/text format. For formats Graph can render (rtf, …), upload the file to OneDrive and use \`download-drive-item-as-pdf\`.`
 };
 var executeLocal = async (fs, params) => {
-  const parsed = schema94.safeParse(params);
+  const parsed = schema95.safeParse(params);
   if (!parsed.success)
     return err({ type: "validation_error", message: formatZodError(parsed.error) });
   const { path } = parsed.data;
   const includeMetadata = parsed.data.includeMetadata === "true";
   const inlineImages = parsed.data.inlineImages === "true";
+  const includeImages = parsed.data.includeImages === "true";
   const maxCells = parsed.data.maxCells === undefined ? undefined : Number(parsed.data.maxCells);
   const bytes = await fs.readBytes(path);
   if (!bytes.ok) {
@@ -25469,15 +25616,15 @@ var executeLocal = async (fs, params) => {
   }
   const name = basename(path);
   if (extensionOf(name) === "zip")
-    return convertZipArchive(bytes.value, includeMetadata);
+    return convertZipArchive(bytes.value, includeMetadata, includeImages);
   return bytesToMarkdown(bytes.value, name, { includeMetadata, inlineImages, maxCells }, LOCAL_HINTS);
 };
-var execute94 = async (_graph, _params) => err({
+var execute95 = async (_graph, _params) => err({
   type: "api_error",
   status: 400,
   message: "convert-local-file reads the local filesystem, not Graph — call executeLocal(fs, params) with a FileSystem (the CLI wires this automatically)."
 });
-var meta96 = {
+var meta97 = {
   summary: "Convert a file ON DISK to markdown — the only command that never calls Microsoft Graph (works offline, no login). Runs the same local pipelines as `download-drive-item-as-markdown`: docx (mammoth → turndown), xlsx (sheetjs tables, `--max-cells` OOM cap), pptx (per-slide text), odt/ods/odp, csv, pdf (text layer via unpdf), legacy OLE .xls / .doc, Outlook .msg (headers + body, attachments converted recursively), plain-text passthrough — and a `.zip` is unpacked with every contained file converted in one call (legacy GBK / CP437 entry names decoded, not mojibaked). What it canNOT do locally: convert TO pdf, and Loop/Fluid/Whiteboard sources — both need a Graph server round-trip (upload to OneDrive and use the drive-item siblings). Pass `--include-metadata true` for the Office side-channel metadata blocks; `--inline-images true` to embed docx images as base64 data URIs.",
   category: "meta",
   graphMethod: "GET",
@@ -25504,6 +25651,13 @@ var meta96 = {
       description: "Pass `--inline-images true` to embed a docx's images as base64 `data:` URIs. Default `false` — each image becomes an `[image: <alt>]` placeholder. No-op on non-docx sources.",
       argumentHint: { kind: "magicValue", values: ["true", "false"] }
     },
+    {
+      name: "include-images",
+      key: "includeImages",
+      required: false,
+      description: "Pass `--include-images true` (a `.zip` only) to also extract each archive entry’s embedded images (docx/xlsx/pptx OOXML media parts, pdf page images) — every entry gains an `images: [{ path, contentType, sizeBytes, base64 }]` array (the same shape `extract-*-images` returns). Best-effort: an entry that carries no extractable images has no `images` key. Default `false`. Lets a caller OCR a secret pasted as a screenshot inside a zipped document.",
+      argumentHint: { kind: "magicValue", values: ["true", "false"] }
+    },
     {
       name: "max-cells",
       key: "maxCells",
@@ -25512,23 +25666,23 @@ var meta96 = {
     }
   ],
   example: "ask-marcel-office convert-local-file --path ./report.docx",
-  responseShape: '`{ contentType: "text/markdown" | "text/plain", size, text }` for a single file; `{ count, files: [{ path, contentType, size, text } | { path, note }] }` for a `.zip` (one entry per contained file, unsupported entries noted). A missing file returns api_error 404 with the path. Pair with the global `--output-path` to land the markdown on disk.',
+  responseShape: '`{ contentType: "text/markdown" | "text/plain", size, text }` for a single file; `{ count, files: [{ path, contentType, size, text } | { path, note }] }` for a `.zip` (one entry per contained file, unsupported entries noted). With `--include-images true` each `.zip` entry also carries `images: [{ path, contentType, sizeBytes, base64 }]` when it has extractable embedded images. A missing file returns api_error 404 with the path. Pair with the global `--output-path` to land the markdown on disk.',
   producesBytes: true
 };
 
 // src/use-cases/commands/extract-local-file-images.ts
 var exports_extract_local_file_images = {};
 __export(exports_extract_local_file_images, {
-  schema: () => schema95,
-  meta: () => meta97,
+  schema: () => schema96,
+  meta: () => meta98,
   executeLocal: () => executeLocal2,
-  execute: () => execute95
+  execute: () => execute96
 });
 import { basename as basename2 } from "node:path";
-var schema95 = exports_external.object({ path: exports_external.string().min(1) });
+var schema96 = exports_external.object({ path: exports_external.string().min(1) });
 var FETCH_HINT3 = "The file is already on disk — read it directly with a vision-capable model, or convert its body with `convert-local-file`.";
 var executeLocal2 = async (fs, params) => {
-  const parsed = schema95.safeParse(params);
+  const parsed = schema96.safeParse(params);
   if (!parsed.success)
     return err({ type: "validation_error", message: formatZodError(parsed.error) });
   const { path } = parsed.data;
@@ -25540,12 +25694,12 @@ var executeLocal2 = async (fs, params) => {
   }
   return extractImagesFromBytes(bytes.value, basename2(path), FETCH_HINT3);
 };
-var execute95 = async (_graph, _params) => err({
+var execute96 = async (_graph, _params) => err({
   type: "api_error",
   status: 400,
   message: "extract-local-file-images reads the local filesystem, not Graph — call executeLocal(fs, params) with a FileSystem (the CLI wires this automatically)."
 });
-var meta97 = {
+var meta98 = {
   summary: "Extract the embedded images from a file ON DISK — the local sibling of `extract-drive-item-images`, and like `convert-local-file` it never calls Microsoft Graph (works offline, no login). Same per-extension dispatch: docx / xlsx / pptx (and their macro-enabled / template variants) have their OOXML media parts read directly (png/jpg/gif/bmp/tiff/webp/svg — full-resolution originals, including images on hidden slides); a pdf is walked page by page via unpdf with each painted image re-encoded as PNG. Two flows only this command completes: a Graph-rendered PDF saved locally (legacy `.ppt` → `download-drive-item-as-pdf` with the global output-path flag → this command pulls the slide images for OCR), and Office files unpacked from a local archive. Pair with the global output-dir flag to write every image to a folder; otherwise the bytes ride back base64-encoded. Any other extension returns a 415 naming the local ways out.",
   category: "meta",
   graphMethod: "GET",
@@ -25567,17 +25721,17 @@ var meta97 = {
 // src/use-cases/commands/convert-mail-attachment-zip.ts
 var exports_convert_mail_attachment_zip = {};
 __export(exports_convert_mail_attachment_zip, {
-  schema: () => schema96,
-  meta: () => meta98,
-  execute: () => execute96
+  schema: () => schema97,
+  meta: () => meta99,
+  execute: () => execute97
 });
-var schema96 = exports_external.object({
+var schema97 = exports_external.object({
   messageId: exports_external.string().min(1),
   attachmentId: exports_external.string().min(1),
   includeMetadata: exports_external.enum(["true", "false"]).optional()
 });
-var execute96 = async (graph, params) => {
-  const parsed = schema96.safeParse(params);
+var execute97 = async (graph, params) => {
+  const parsed = schema97.safeParse(params);
   if (!parsed.success)
     return err({ type: "validation_error", message: formatZodError(parsed.error) });
   const { messageId, attachmentId } = parsed.data;
@@ -25600,7 +25754,7 @@ var execute96 = async (graph, params) => {
   }
   return convertZipArchive(base64ToBytes(contentBytes), includeMetadata);
 };
-var meta98 = {
+var meta99 = {
   summary: "Unzip a `.zip` Outlook mail attachment and convert every contained file in one call — the mail-side mirror of `convert-drive-item-zip`, so reading a zipped vendor deck doesn't need `get-mail-attachment` + manual `unzip` + per-file conversion. Pulls the fileAttachment bytes, unzips them (legacy GBK / CP437 entry names — Chinese vendor archives written by WinRAR / Windows Explorer — are decoded correctly, not mojibaked), and runs each file through the local pipelines: Office files (docx/xlsx/pptx/odt/ods/odp and macro-enabled / template variants) → markdown; plain-text entries decoded inline; legacy OLE .xls (sheetjs) and .doc (word-extractor, text only) extracted; an inner Outlook .msg rendered; PDFs have their text layer extracted; images, binaries, nested archives, legacy .ppt, and scanned/image-only PDFs are listed with a note (not unpacked) so one unsupported entry never fails the whole archive. Pass `--include-metadata true` to append each Office file's side-channel metadata block. Capped at 100 entries; beyond that the response is flagged `truncated`. itemAttachment / referenceAttachment are rejected (no inline zip payload).",
   category: "mail",
   graphMethod: "GET",
@@ -25624,13 +25778,13 @@ var meta98 = {
 // src/use-cases/commands/extract-sharepoint-links-in-documents.ts
 var exports_extract_sharepoint_links_in_documents = {};
 __export(exports_extract_sharepoint_links_in_documents, {
-  schema: () => schema97,
-  meta: () => meta99,
-  execute: () => execute97
+  schema: () => schema98,
+  meta: () => meta100,
+  execute: () => execute98
 });
-var schema97 = exports_external.object({ driveId: exports_external.string().min(1), itemId: exports_external.string().min(1) });
-var execute97 = async (graph, params) => {
-  const parsed = schema97.safeParse(params);
+var schema98 = exports_external.object({ driveId: exports_external.string().min(1), itemId: exports_external.string().min(1) });
+var execute98 = async (graph, params) => {
+  const parsed = schema98.safeParse(params);
   if (!parsed.success)
     return err({ type: "validation_error", message: formatZodError(parsed.error) });
   const { driveId, itemId } = parsed.data;
@@ -25652,7 +25806,7 @@ var execute97 = async (graph, params) => {
   const { links, truncated, skippedCount } = await resolveSharepointUrls(graph, extractSharepointUrls(haystack));
   return ok({ driveId, itemId, links, truncated, skippedCount });
 };
-var meta99 = {
+var meta100 = {
   summary: 'Find every `*.sharepoint.com` URL embedded in a Word / Excel / PowerPoint or OpenDocument file on OneDrive or SharePoint and resolve each one to its driveItem (driveId, itemId, name, webUrl) so the agent can feed those into `download-drive-item-as-pdf` / `-as-markdown` etc. The document sibling of `extract-sharepoint-links-in-mail`. For OOXML (.docx/.xlsx/.pptx) it reads external hyperlinks from the package’s relationship parts (`_rels/*.rels`, `TargetMode="External"`); for OpenDocument (.odt/.ods/.odp) it reads the inline `xlink:href` links in content.xml / styles.xml — either way it catches links wherever they live (body text, headers/footers, cell formulas, slide shapes). Read-only — no conversion happens here. Capped at 25 unique URLs per call (returns `truncated: true` and `skippedCount` when there are more); duplicates are deduplicated; per-link errors are captured inside each entry instead of failing the whole call. Non-zip inputs (pdf/images) return an api_error.',
   category: "drive",
   graphMethod: "GET",
@@ -25679,13 +25833,13 @@ var meta99 = {
 // src/use-cases/commands/extract-sharepoint-links-in-mail.ts
 var exports_extract_sharepoint_links_in_mail = {};
 __export(exports_extract_sharepoint_links_in_mail, {
-  schema: () => schema98,
-  meta: () => meta100,
-  execute: () => execute98
+  schema: () => schema99,
+  meta: () => meta101,
+  execute: () => execute99
 });
-var schema98 = exports_external.object({ messageId: exports_external.string().min(1) });
-var execute98 = async (graph, params) => {
-  const parsed = schema98.safeParse(params);
+var schema99 = exports_external.object({ messageId: exports_external.string().min(1) });
+var execute99 = async (graph, params) => {
+  const parsed = schema99.safeParse(params);
   if (!parsed.success)
     return err({ type: "validation_error", message: formatZodError(parsed.error) });
   const { messageId } = parsed.data;
@@ -25703,7 +25857,7 @@ var execute98 = async (graph, params) => {
     skippedCount
   });
 };
-var meta100 = {
+var meta101 = {
   summary: "Find every `*.sharepoint.com` URL in the body of a single Outlook email and resolve each one to its driveItem (driveId, itemId, name, webUrl) so the agent can feed those into `download-drive-item-as-pdf` / `-as-markdown` etc. Read-only — no conversion happens here. Capped at 25 unique URLs per call to bound fan-out (returns `truncated: true` and `skippedCount` when the body has more); duplicate URLs are deduplicated. Per-link errors are captured inside each entry instead of failing the whole call.",
   category: "mail",
   graphMethod: "GET",
@@ -25725,15 +25879,15 @@ var meta100 = {
 // src/use-cases/commands/list-chats.ts
 var exports_list_chats = {};
 __export(exports_list_chats, {
-  schema: () => schema99,
-  meta: () => meta101,
-  execute: () => execute99
+  schema: () => schema100,
+  meta: () => meta102,
+  execute: () => execute100
 });
 var DEFAULT_SELECT7 = "id,topic,chatType,createdDateTime,lastUpdatedDateTime";
 var baseSchema49 = exports_external.object({}).strict();
 var CHATS_ODATA_KEYS = ["top", "skip", "select", "filter"];
-var { execute: execute99, schema: schema99 } = buildElevatedPickODataListCommand(() => "/me/chats", baseSchema49, CHATS_ODATA_KEYS, { defaultSelect: DEFAULT_SELECT7 });
-var meta101 = {
+var { execute: execute100, schema: schema100 } = buildElevatedPickODataListCommand(() => "/me/chats", baseSchema49, CHATS_ODATA_KEYS, { defaultSelect: DEFAULT_SELECT7 });
+var meta102 = {
   summary: "List the signed-in user's Microsoft Teams chats (1:1, group, and meeting chats). The CLI ships a slim default `--select=id,topic,chatType,createdDateTime,lastUpdatedDateTime`; pass `--select id,topic,webUrl,...` to widen. Returns chat metadata only — reading chat *messages* needs `Chat.Read*` which neither token grants. Requires the M365ChatClient elevated token captured at login (the basic Teams web client token lacks `Chat.ReadBasic`). Graph rejects `$orderby` and hangs on `$expand` for this endpoint, so the CLI advertises only the subset Graph honours (`--top`, `--skip`, `--select`, `--filter`).",
   category: "chats",
   graphMethod: "GET",
@@ -25749,14 +25903,14 @@ var meta101 = {
 // src/use-cases/commands/get-chat.ts
 var exports_get_chat = {};
 __export(exports_get_chat, {
-  schema: () => schema100,
-  meta: () => meta102,
-  execute: () => execute100
+  schema: () => schema101,
+  meta: () => meta103,
+  execute: () => execute101
 });
 var DEFAULT_SELECT8 = "id,topic,chatType,createdDateTime,lastUpdatedDateTime";
 var baseSchema50 = exports_external.object({ chatId: exports_external.string().min(1) });
-var { execute: execute100, schema: schema100 } = buildElevatedSelectableCommand((p) => `/chats/${p.chatId}`, baseSchema50, { defaultSelect: DEFAULT_SELECT8 });
-var meta102 = {
+var { execute: execute101, schema: schema101 } = buildElevatedSelectableCommand((p) => `/chats/${p.chatId}`, baseSchema50, { defaultSelect: DEFAULT_SELECT8 });
+var meta103 = {
   summary: "Return metadata for a single Microsoft Teams chat (1:1, group, or meeting). The CLI ships a slim default `--select=id,topic,chatType,createdDateTime,lastUpdatedDateTime`; pass `--select id,topic,webUrl,onlineMeetingInfo` (or any other comma-separated field list) to widen. Pass `--expand members` to inline membership. Returns metadata only — not the messages (which need `Chat.Read*`). Requires the M365ChatClient elevated token captured at login (the basic Teams web client token lacks `Chat.ReadBasic`).",
   category: "chats",
   graphMethod: "GET",
@@ -25780,17 +25934,17 @@ var meta102 = {
 // src/use-cases/commands/list-teams-chats-with-messages.ts
 var exports_list_teams_chats_with_messages = {};
 __export(exports_list_teams_chats_with_messages, {
-  schema: () => schema101,
-  meta: () => meta103,
-  execute: () => execute101
+  schema: () => schema102,
+  meta: () => meta104,
+  execute: () => execute102
 });
-var schema101 = exports_external.object({
+var schema102 = exports_external.object({
   pageSize: exports_external.string().regex(/^[1-9]\d*$/, "must be a positive integer").optional(),
   continuationToken: exports_external.string().min(1).optional()
 });
 var QUERY_BASE = "enableMembershipSummary=true&supportsAdditionalSystemGeneratedFolders=true&supportsSliceItems=true&enableEngageCommunities=false";
-var execute101 = async (graph, params) => {
-  const parsed = schema101.safeParse(params);
+var execute102 = async (graph, params) => {
+  const parsed = schema102.safeParse(params);
   if (!parsed.success)
     return err({ type: "validation_error", message: formatZodError(parsed.error) });
   const pageSize = parsed.data.pageSize ?? "100";
@@ -25799,7 +25953,7 @@ var execute101 = async (graph, params) => {
     qs.set("continuationToken", parsed.data.continuationToken);
   return graph.teamsChat(`/api/v3/teams/users/me/chats?${qs.toString()}&${QUERY_BASE}`);
 };
-var meta103 = {
+var meta104 = {
   summary: "List the signed-in user's Microsoft Teams chats with the last message body inlined per chat. Uses the chatsvcagg-audience bearer captured at login. Paginated via `continuationToken` (default page size 100; pass the response's `continuationToken` back as `--continuation-token` while `hasMoreData: true`). **Best-effort, may break on Microsoft client updates**: the chat substrate is not part of the public Microsoft Graph API; Microsoft can change route shapes without notice. Caller Graph scopes do NOT matter here; the substrate server gates access on the appid + identity, not on Graph scopes.",
   category: "chats",
   needsSubstrateToken: true,
@@ -25828,21 +25982,21 @@ var meta103 = {
 // src/use-cases/commands/list-teams-chat-messages.ts
 var exports_list_teams_chat_messages = {};
 __export(exports_list_teams_chat_messages, {
-  schema: () => schema102,
-  meta: () => meta104,
-  execute: () => execute102
+  schema: () => schema103,
+  meta: () => meta105,
+  execute: () => execute103
 });
-var schema102 = exports_external.object({
+var schema103 = exports_external.object({
   chatId: exports_external.string().min(1)
 });
-var execute102 = async (graph, params) => {
-  const parsed = schema102.safeParse(params);
+var execute103 = async (graph, params) => {
+  const parsed = schema103.safeParse(params);
   if (!parsed.success)
     return err({ type: "validation_error", message: formatZodError(parsed.error) });
   const { chatId } = parsed.data;
   return graph.teamsChat(`/api/v1/chats/${encodeURIComponent(chatId)}/messages`);
 };
-var meta104 = {
+var meta105 = {
   summary: "List the most recent messages in a single Microsoft Teams chat via the chat substrate. Companion to `list-teams-chats-with-messages` when the inlined `lastMessage` isn't deep enough. Uses the chatsvcagg-audience bearer captured at login. **Best-effort, may break on Microsoft client updates** — the chat substrate is not in the public Microsoft Graph API. **No pagination**: the route caps at the 200 most recent messages per chat and the CLI cannot reach older history (Teams web itself uses WebSockets for scrollback, and the official `Chat.Read` Graph scope that would enable paginated reads is outside the appid's scope ceiling).",
   category: "chats",
   needsSubstrateToken: true,
@@ -25866,11 +26020,11 @@ var meta104 = {
 // src/use-cases/commands/list-teams-chat-history.ts
 var exports_list_teams_chat_history = {};
 __export(exports_list_teams_chat_history, {
-  schema: () => schema103,
-  meta: () => meta105,
-  execute: () => execute103
+  schema: () => schema104,
+  meta: () => meta106,
+  execute: () => execute104
 });
-var schema103 = exports_external.object({
+var schema104 = exports_external.object({
   chatId: exports_external.string().min(1),
   syncState: exports_external.url().optional(),
   pageSize: exports_external.string().regex(/^[1-9]\d*$/, "must be a positive integer").optional(),
@@ -25902,8 +26056,8 @@ var toRelativePath = (absoluteUrl) => {
     throw new Error(`unexpected syncState URL shape: ${absoluteUrl}`);
   return m[1];
 };
-var execute103 = async (graph, params) => {
-  const parsed = schema103.safeParse(params);
+var execute104 = async (graph, params) => {
+  const parsed = schema104.safeParse(params);
   if (!parsed.success)
     return err({ type: "validation_error", message: formatZodError(parsed.error) });
   const { chatId } = parsed.data;
@@ -25940,7 +26094,7 @@ var execute103 = async (graph, params) => {
     projection: fullMode ? "full" : "slim"
   });
 };
-var meta105 = {
+var meta106 = {
   summary: "Deep read of a Microsoft Teams chat's message history via the IC3 substrate (`teams.microsoft.com/api/chatsvc/<region>/v1/...`). Unlike `list-teams-chat-messages` (which caps at the 200 most recent messages with no working pagination cursor), this command follows the server-provided `_metadata.syncState` URL backward through history, fetching up to `--page-size` * `--max-pages` messages per invocation (default 200 * 20 = 4000). Uses the IC3-audience bearer captured at login (same Teams web client identity as the basic Teams token). The CLI ships a slim default projection — each message is reduced to `id, sequenceId, composetime, originalarrivaltime, messagetype, from, imdisplayname, content` and `content` is truncated to 4096 chars (with `truncated: true` and `originalContentChars` set on the affected entries). Pass `--full true` to opt out of projection and truncation; pass `--max-content-chars N` to override the truncation cap. **Best-effort, may break on Microsoft client updates** — the IC3 substrate is not in the public Microsoft Graph API. To page beyond `--max-pages`, take the response's `nextSyncState` and pass it back as `--sync-state` on the next call.",
   category: "chats",
   needsSubstrateToken: true,
@@ -25994,22 +26148,22 @@ var meta105 = {
 // src/use-cases/commands/get-teams-chat-message.ts
 var exports_get_teams_chat_message = {};
 __export(exports_get_teams_chat_message, {
-  schema: () => schema104,
-  meta: () => meta106,
-  execute: () => execute104
+  schema: () => schema105,
+  meta: () => meta107,
+  execute: () => execute105
 });
-var schema104 = exports_external.object({
+var schema105 = exports_external.object({
   chatId: exports_external.string().min(1),
   messageId: exports_external.string().min(1)
 });
-var execute104 = async (graph, params) => {
-  const parsed = schema104.safeParse(params);
+var execute105 = async (graph, params) => {
+  const parsed = schema105.safeParse(params);
   if (!parsed.success)
     return err({ type: "validation_error", message: formatZodError(parsed.error) });
   const { chatId, messageId } = parsed.data;
   return graph.teamsChat(`/api/v1/chats/${encodeURIComponent(chatId)}/messages/${encodeURIComponent(messageId)}`);
 };
-var meta106 = {
+var meta107 = {
   summary: "Return a single Microsoft Teams chat message by its id via the chat substrate. Uses the chatsvcagg-audience bearer captured at login (same identity as the basic Teams token, different audience). **Best-effort, may break on Microsoft client updates** — the chat substrate is not in the public Microsoft Graph API. Source the chat-id + message-id via `list-teams-chats-with-messages` or `list-teams-chat-messages`.",
   category: "chats",
   needsSubstrateToken: true,
@@ -26028,9 +26182,9 @@ var meta106 = {
 // src/use-cases/commands/resolve-teams-link.ts
 var exports_resolve_teams_link = {};
 __export(exports_resolve_teams_link, {
-  schema: () => schema105,
-  meta: () => meta107,
-  execute: () => execute105
+  schema: () => schema106,
+  meta: () => meta108,
+  execute: () => execute106
 });
 
 // src/use-cases/commands/link-shape.ts
@@ -26057,7 +26211,7 @@ var detectSiblingResolver = (raw) => {
 };
 
 // src/use-cases/commands/resolve-teams-link.ts
-var schema105 = exports_external.object({
+var schema106 = exports_external.object({
   url: exports_external.url()
 });
 var PREFIX2 = "https://teams.microsoft.com/l/message/";
@@ -26093,8 +26247,8 @@ var parse5 = (raw) => {
     ...optional2
   };
 };
-var execute105 = async (_graph, params) => {
-  const parsed = schema105.safeParse(params);
+var execute106 = async (_graph, params) => {
+  const parsed = schema106.safeParse(params);
   if (!parsed.success)
     return err({ type: "validation_error", message: formatZodError(parsed.error) });
   const sibling = detectSiblingResolver(parsed.data.url);
@@ -26128,7 +26282,7 @@ var execute105 = async (_graph, params) => {
   }
   return ok(resolved);
 };
-var meta107 = {
+var meta108 = {
   summary: "Parse a Microsoft Teams `Copy link` URL (the share link emitted by the message context menu in Teams) into its `chatId` + `messageId` components. Pure transformation — no Graph call. Pipe the result into `get-teams-chat-message` to fetch the message body, or into `list-teams-chat-history` to read the chat that contains it.",
   category: "chats",
   graphMethod: "GET",
@@ -26149,11 +26303,11 @@ var meta107 = {
 // src/use-cases/commands/resolve-mail-link.ts
 var exports_resolve_mail_link = {};
 __export(exports_resolve_mail_link, {
-  schema: () => schema106,
-  meta: () => meta108,
-  execute: () => execute106
+  schema: () => schema107,
+  meta: () => meta109,
+  execute: () => execute107
 });
-var schema106 = exports_external.object({
+var schema107 = exports_external.object({
   url: exports_external.url()
 });
 var OUTLOOK_HOSTS2 = ["outlook.office.com", "outlook.office365.com", "outlook.live.com"];
@@ -26199,8 +26353,8 @@ var parse6 = (raw) => {
     return { kind: "ok", value: { messageId: decodeURIComponent(pathId) } };
   return { kind: "unknown" };
 };
-var execute106 = async (_graph, params) => {
-  const parsed = schema106.safeParse(params);
+var execute107 = async (_graph, params) => {
+  const parsed = schema107.safeParse(params);
   if (!parsed.success)
     return err({ type: "validation_error", message: formatZodError(parsed.error) });
   const outcome = parse6(parsed.data.url);
@@ -26225,7 +26379,7 @@ var execute106 = async (_graph, params) => {
     message: `--url: not an Outlook mail link. Expected shapes: \`https://outlook.office.com/owa/?itemid=AAMkA...\`, \`https://outlook.office.com/mail/inbox/id/AAMkA...\`, or \`https://outlook.office.com/mail/AAMkA...\`. Hosts accepted: ${OUTLOOK_HOSTS2.join(", ")}.`
   });
 };
-var meta108 = {
+var meta109 = {
   summary: 'Parse a Microsoft Outlook web mail link (the URL emitted by the "Copy link" / address-bar share of an email) into its `messageId`. Pure transformation — no Graph call. Pipe the result into `get-mail-message` to fetch the body, or `convert-mail-to-markdown` to render it. For Outlook calendar links use `resolve-calendar-link` instead — this command rejects them with a pointer.',
   category: "mail",
   graphMethod: "GET",
@@ -26246,11 +26400,11 @@ var meta108 = {
 // src/use-cases/commands/resolve-drive-share-link.ts
 var exports_resolve_drive_share_link = {};
 __export(exports_resolve_drive_share_link, {
-  schema: () => schema107,
-  meta: () => meta109,
-  execute: () => execute107
+  schema: () => schema108,
+  meta: () => meta110,
+  execute: () => execute108
 });
-var schema107 = exports_external.object({
+var schema108 = exports_external.object({
   url: exports_external.url()
 });
 var ACCEPTED_HOST_PATTERNS = [
@@ -26269,8 +26423,8 @@ var parse7 = (raw) => {
     originalUrl: raw
   };
 };
-var execute107 = async (_graph, params) => {
-  const parsed = schema107.safeParse(params);
+var execute108 = async (_graph, params) => {
+  const parsed = schema108.safeParse(params);
   if (!parsed.success)
     return err({ type: "validation_error", message: formatZodError(parsed.error) });
   const sibling = detectSiblingResolver(parsed.data.url);
@@ -26304,7 +26458,7 @@ var execute107 = async (_graph, params) => {
   }
   return ok(resolved);
 };
-var meta109 = {
+var meta110 = {
   summary: "Encode a OneDrive / SharePoint sharing URL into the Graph `/shares/{token}` share token (`u!<base64url>` per [shares-get](https://learn.microsoft.com/en-us/graph/api/shares-get)). Pure transformation — no Graph call. Pipe the returned `graphPath` (`/shares/{token}/driveItem`) into a sibling lookup (`get-drive-item`, `download-drive-item-content`, `convert-mail-attachment-to-pdf`, etc.) once the file has been resolved to a `driveItem`. Accepts any `*.sharepoint.com` URL (tenant + `*-my.sharepoint.com` personal OneDrive) and Microsoft's short-link host `1drv.ms`.",
   category: "drive",
   graphMethod: "GET",
@@ -26325,11 +26479,11 @@ var meta109 = {
 // src/use-cases/commands/resolve-calendar-link.ts
 var exports_resolve_calendar_link = {};
 __export(exports_resolve_calendar_link, {
-  schema: () => schema108,
-  meta: () => meta110,
-  execute: () => execute108
+  schema: () => schema109,
+  meta: () => meta111,
+  execute: () => execute109
 });
-var schema108 = exports_external.object({
+var schema109 = exports_external.object({
   url: exports_external.url()
 });
 var OUTLOOK_HOSTS3 = ["outlook.office.com", "outlook.office365.com", "outlook.live.com"];
@@ -26371,8 +26525,8 @@ var parse8 = (raw) => {
     return { kind: "mail" };
   return { kind: "unknown" };
 };
-var execute108 = async (_graph, params) => {
-  const parsed = schema108.safeParse(params);
+var execute109 = async (_graph, params) => {
+  const parsed = schema109.safeParse(params);
   if (!parsed.success)
     return err({ type: "validation_error", message: formatZodError(parsed.error) });
   const outcome = parse8(parsed.data.url);
@@ -26390,7 +26544,7 @@ var execute108 = async (_graph, params) => {
     message: `--url: not an Outlook calendar item link. Expected shapes: \`https://outlook.office.com/calendar/item/AAMkA...\` (path-style), or \`https://outlook.office.com/owa/?itemid=AAMkA...&path=/calendar/item\` (OWA query). Hosts accepted: ${OUTLOOK_HOSTS3.join(", ")}.`
   });
 };
-var meta110 = {
+var meta111 = {
   summary: 'Parse a Microsoft Outlook calendar item link (the URL emitted by the "Copy link" / share action on a calendar event) into its `eventId`. Pure transformation — no Graph call. Pipe the result into `get-calendar-event` to fetch the event body. For Outlook mail message links use `resolve-mail-link` instead — this command rejects them with a pointer.',
   category: "calendar",
   graphMethod: "GET",
@@ -26411,11 +26565,11 @@ var meta110 = {
 // src/use-cases/commands/find-chats-with-user.ts
 var exports_find_chats_with_user = {};
 __export(exports_find_chats_with_user, {
-  schema: () => schema109,
-  meta: () => meta111,
-  execute: () => execute109
+  schema: () => schema110,
+  meta: () => meta112,
+  execute: () => execute110
 });
-var schema109 = exports_external.object({
+var schema110 = exports_external.object({
   name: exports_external.string().min(1),
   maxPages: exports_external.string().regex(/^[1-9]\d*$/, "must be a positive integer").optional(),
   pageSize: exports_external.string().regex(/^[1-9]\d*$/, "must be a positive integer").optional()
@@ -26532,8 +26686,8 @@ var hydrateBareDirect = async (graph, queryFolded, bareUnmatched, matched) => {
   return { chatsHydrated: direct.length, unresolvedMemberCount };
 };
 var HINT2 = "No chat member matched by name, but at least one chat has a cross-tenant member the Teams roster left unresolved — an externally-homed counterpart often appears only as a bare object-id. Direct 1:1 chats were deep-probed; members in group/meeting chats were not. Retry searching by their object-id (pass it as `--name <object-id>`), or, if you have the chat URL, read it directly with `get-chat` / `list-teams-chat-messages --chat-id 19:<their-oid>_<your-oid>@unq.gbl.spaces`.";
-var execute109 = async (graph, params) => {
-  const parsed = schema109.safeParse(params);
+var execute110 = async (graph, params) => {
+  const parsed = schema110.safeParse(params);
   if (!parsed.success)
     return err({ type: "validation_error", message: formatZodError(parsed.error) });
   const queryFolded = fold(parsed.data.name);
@@ -26557,7 +26711,7 @@ var execute109 = async (graph, params) => {
     ...matched.length === 0 && unresolvedMemberCount > 0 ? { hint: HINT2 } : {}
   });
 };
-var meta111 = {
+var meta112 = {
   summary: 'Find every Microsoft Teams chat that includes a member matching `--name` (substring search across display-name, email, given-name, surname, MRI, and object-id). Both sides are Unicode-folded (NFD + combining-mark strip) and lowercased before comparison, so `--name Alex` matches `Alex Kim` AND `alex.kim@example.com` AND `ALEX` — important because a dual-identity user often carries the accented display-name on one identity and the un-accented email on the other. Walks the paginated chat-list substrate up to `--max-pages` and returns matching chats with their `matchedMembers[]`. Collapses the canonical "all conversations with person X" workflow into a single call AND surfaces dual-identity people (e.g. someone with both an org MRI and a guest-tenant MRI). Cross-tenant resolution: the summary roster returns externally-homed counterparts as a bare object-id (no name/email), which a name search cannot match; for every bare DIRECT (1:1) chat the command hydrates the roster via the per-chat members endpoint and re-matches — so an external counterpart who is bare in your 1:1 is still found, even when they were already resolved in some meeting (the dual-identity case). Bare members in group/meeting chats are not deep-probed; when nothing matches and such members exist it returns a `hint` plus `unresolvedMemberCount` rather than a confident empty result. **Best-effort, may break on Microsoft client updates** — the chat substrate is not in the public Microsoft Graph API.',
   category: "chats",
   needsSubstrateToken: true,
@@ -26592,20 +26746,20 @@ var meta111 = {
 // src/use-cases/commands/list-my-direct-reports.ts
 var exports_list_my_direct_reports = {};
 __export(exports_list_my_direct_reports, {
-  schema: () => schema110,
-  meta: () => meta112,
-  execute: () => execute110
+  schema: () => schema111,
+  meta: () => meta113,
+  execute: () => execute111
 });
-var schema110 = exports_external.object({}).strict().extend(odataQuerySchema.shape);
-var execute110 = async (graph, params) => {
-  const parsed = schema110.safeParse(params);
+var schema111 = exports_external.object({}).strict().extend(odataQuerySchema.shape);
+var execute111 = async (graph, params) => {
+  const parsed = schema111.safeParse(params);
   if (!parsed.success)
     return err({ type: "validation_error", message: formatZodError(parsed.error) });
   const headers = parsed.data.orderby !== undefined ? { ConsistencyLevel: "eventual" } : {};
   const path = appendOData("/me/directReports", parsed.data);
   return graph.get(path, headers);
 };
-var meta112 = {
+var meta113 = {
   summary: "List the signed-in user's direct reports (employees who report to them in the directory). When `--orderby` is supplied the CLI auto-injects the `ConsistencyLevel: eventual` header Graph requires on directory endpoints — otherwise Graph rejects the sort with `Request_UnsupportedQuery`.",
   category: "user",
   graphMethod: "GET",
@@ -26620,13 +26774,13 @@ var meta112 = {
 // src/use-cases/commands/list-user-direct-reports.ts
 var exports_list_user_direct_reports = {};
 __export(exports_list_user_direct_reports, {
-  schema: () => schema111,
-  meta: () => meta113,
-  execute: () => execute111
+  schema: () => schema112,
+  meta: () => meta114,
+  execute: () => execute112
 });
 var baseSchema51 = exports_external.object({ userId: exports_external.string().min(1) });
-var { execute: execute111, schema: schema111 } = buildListCommand((p) => `/users/${p.userId}/directReports`, baseSchema51);
-var meta113 = {
+var { execute: execute112, schema: schema112 } = buildListCommand((p) => `/users/${p.userId}/directReports`, baseSchema51);
+var meta114 = {
   summary: "List a specific user's direct reports.",
   category: "user",
   graphMethod: "GET",
@@ -26650,13 +26804,13 @@ var meta113 = {
 // src/use-cases/commands/list-recent-files.ts
 var exports_list_recent_files = {};
 __export(exports_list_recent_files, {
-  schema: () => schema112,
-  meta: () => meta114,
-  execute: () => execute112
+  schema: () => schema113,
+  meta: () => meta115,
+  execute: () => execute113
 });
 var baseSchema52 = exports_external.object({}).strict();
-var { execute: execute112, schema: schema112 } = buildNoSkipListCommand(() => "/me/drive/recent", baseSchema52);
-var meta114 = {
+var { execute: execute113, schema: schema113 } = buildNoSkipListCommand(() => "/me/drive/recent", baseSchema52);
+var meta115 = {
   summary: "List the signed-in user's most recently used / opened OneDrive and SharePoint files, ranked by Microsoft's recency signal. The strongest single answer to \"what is this user working on right now?\". Note: Graph's recent-files feed is signal-driven and can lag the underlying drive by 24-48 hours — `lastModifiedDateTime` here may be older than the file's true mtime. For \"what is the actual latest version?\" call `list-drive-item-versions` on a specific item.",
   category: "drive",
   graphMethod: "GET",
@@ -26672,13 +26826,13 @@ var meta114 = {
 // src/use-cases/commands/list-shared-with-me.ts
 var exports_list_shared_with_me = {};
 __export(exports_list_shared_with_me, {
-  schema: () => schema113,
-  meta: () => meta115,
-  execute: () => execute113
+  schema: () => schema114,
+  meta: () => meta116,
+  execute: () => execute114
 });
-var schema113 = exports_external.object({}).strict();
-var { execute: execute113 } = buildCommand(() => "/me/drive/sharedWithMe", schema113);
-var meta115 = {
+var schema114 = exports_external.object({}).strict();
+var { execute: execute114 } = buildCommand(() => "/me/drive/sharedWithMe", schema114);
+var meta116 = {
   summary: "List driveItems shared with the signed-in user (typically by colleagues). Each entry includes the original drive + item ID under `remoteItem` so you can chain into `get-drive-item`, `download-drive-item-content`, etc. Note: Graph does NOT honor any OData query parameters on this endpoint (top/select/filter/etc. are all silently ignored), so the CLI does not advertise them. The full collection (~500 items in a typical tenant) is always returned; slice client-side or pair with the global output-path flag to land the raw JSON on disk.",
   category: "drive",
   graphMethod: "GET",
@@ -26692,13 +26846,13 @@ var meta115 = {
 // src/use-cases/commands/list-recently-used-insights.ts
 var exports_list_recently_used_insights = {};
 __export(exports_list_recently_used_insights, {
-  schema: () => schema114,
-  meta: () => meta116,
-  execute: () => execute114
+  schema: () => schema115,
+  meta: () => meta117,
+  execute: () => execute115
 });
 var baseSchema53 = exports_external.object({}).strict();
-var { execute: execute114, schema: schema114 } = buildListCommand(() => "/me/insights/used", baseSchema53);
-var meta116 = {
+var { execute: execute115, schema: schema115 } = buildListCommand(() => "/me/insights/used", baseSchema53);
+var meta117 = {
   summary: "List documents the signed-in user has *personally* used recently (Microsoft's machine-learning recency signal — distinct from `list-recent-files` which is the OneDrive recency feed). Each item carries a `lastUsed` (a `usageDetails` object) with `lastAccessedDateTime` + `lastModifiedDateTime`.",
   category: "drive",
   graphMethod: "GET",
@@ -26713,13 +26867,13 @@ var meta116 = {
 // src/use-cases/commands/list-shared-insights.ts
 var exports_list_shared_insights = {};
 __export(exports_list_shared_insights, {
-  schema: () => schema115,
-  meta: () => meta117,
-  execute: () => execute115
+  schema: () => schema116,
+  meta: () => meta118,
+  execute: () => execute116
 });
 var baseSchema54 = exports_external.object({}).strict();
-var { execute: execute115, schema: schema115 } = buildListCommand(() => "/me/insights/shared", baseSchema54);
-var meta117 = {
+var { execute: execute116, schema: schema116 } = buildListCommand(() => "/me/insights/shared", baseSchema54);
+var meta118 = {
   summary: "List documents *shared with* the signed-in user, scored by Microsoft's relevance ranking — sibling to `list-shared-with-me` but with sharing-context details (`sharingHistory[]`, `lastShared.sharedBy`, `lastShared.sharingReference`).",
   category: "drive",
   graphMethod: "GET",
@@ -26734,13 +26888,13 @@ var meta117 = {
 // src/use-cases/commands/get-organization.ts
 var exports_get_organization = {};
 __export(exports_get_organization, {
-  schema: () => schema116,
-  meta: () => meta118,
-  execute: () => execute116
+  schema: () => schema117,
+  meta: () => meta119,
+  execute: () => execute117
 });
 var baseSchema55 = exports_external.object({});
-var { execute: execute116, schema: schema116 } = buildSelectableCommand(() => "/organization", baseSchema55);
-var meta118 = {
+var { execute: execute117, schema: schema117 } = buildSelectableCommand(() => "/organization", baseSchema55);
+var meta119 = {
   summary: "Return the tenant's organization metadata — display name, country, verified domains, business phones, technical / security notification contacts, assigned Microsoft 365 SKUs / licensing. Graph wraps the single organization resource under `value[]` (— even though only one tenant exists, the endpoint returns a collection). The full resource is ~57 KB; use `--select` to slim it (e.g. `--select id,displayName,verifiedDomains`).",
   category: "user",
   graphMethod: "GET",
@@ -26754,13 +26908,13 @@ var meta118 = {
 // src/use-cases/commands/list-mail-folders-delta.ts
 var exports_list_mail_folders_delta = {};
 __export(exports_list_mail_folders_delta, {
-  schema: () => schema117,
-  meta: () => meta119,
-  execute: () => execute117
+  schema: () => schema118,
+  meta: () => meta120,
+  execute: () => execute118
 });
-var schema117 = exports_external.object({}).strict();
-var { execute: execute117 } = buildCommand(() => "/me/mailFolders/delta()", schema117);
-var meta119 = {
+var schema118 = exports_external.object({}).strict();
+var { execute: execute118 } = buildCommand(() => "/me/mailFolders/delta()", schema118);
+var meta120 = {
   summary: "Track incremental changes to the mail-folder tree itself (folders added / renamed / deleted). The first call returns the current snapshot plus a `@odata.deltaLink`; subsequent calls with that link return only what has changed. Companion to `list-mail-folder-messages-delta` which tracks message changes inside one folder. Note: Graph explicitly rejects `$top`, `$filter`, `$orderby`, and `$search` on this delta endpoint (`ErrorInvalidUrlQuery: not supported with change tracking over the 'Folders' resource`), so the OData passthrough is intentionally NOT exposed here.",
   category: "mail",
   graphMethod: "GET",
@@ -26776,13 +26930,13 @@ var meta119 = {
 // src/use-cases/commands/get-channel-files-folder.ts
 var exports_get_channel_files_folder = {};
 __export(exports_get_channel_files_folder, {
-  schema: () => schema118,
-  meta: () => meta120,
-  execute: () => execute118
+  schema: () => schema119,
+  meta: () => meta121,
+  execute: () => execute119
 });
 var baseSchema56 = exports_external.object({ teamId: exports_external.string().min(1), channelId: exports_external.string().min(1) });
-var { execute: execute118, schema: schema118 } = buildSelectableCommand((p) => `/teams/${p.teamId}/channels/${p.channelId}/filesFolder`, baseSchema56);
-var meta120 = {
+var { execute: execute119, schema: schema119 } = buildSelectableCommand((p) => `/teams/${p.teamId}/channels/${p.channelId}/filesFolder`, baseSchema56);
+var meta121 = {
   summary: "Return the SharePoint folder that backs a Teams channel's Files tab. Returned `driveItem` includes `parentReference.driveId` and `id` so you can pivot into `list-folder-files`, `download-drive-item-content`, etc., and treat the channel like any other OneDrive folder. Requires that the signed-in user is a member of the channel — restricted channels return `AccessDenied`.",
   category: "teams",
   graphMethod: "GET",
@@ -26810,13 +26964,13 @@ var meta120 = {
 // src/use-cases/commands/get-drive-item-list-item.ts
 var exports_get_drive_item_list_item = {};
 __export(exports_get_drive_item_list_item, {
-  schema: () => schema119,
-  meta: () => meta121,
-  execute: () => execute119
+  schema: () => schema120,
+  meta: () => meta122,
+  execute: () => execute120
 });
 var baseSchema57 = exports_external.object({ driveId: exports_external.string().min(1), itemId: exports_external.string().min(1) });
-var { execute: execute119, schema: schema119 } = buildSelectableCommand((p) => `/drives/${p.driveId}/items/${p.itemId}/listItem`, baseSchema57);
-var meta121 = {
+var { execute: execute120, schema: schema120 } = buildSelectableCommand((p) => `/drives/${p.driveId}/items/${p.itemId}/listItem`, baseSchema57);
+var meta122 = {
   summary: "Return the SharePoint listItem projection of a OneDrive / SharePoint file — exposes the file's library-defined column values (custom metadata: status, due-date, classification, taxonomy tags, etc.) which are NOT present on the plain `driveItem`. Combine with `list-sharepoint-list-columns` to interpret the column schema.",
   category: "sharepoint",
   graphMethod: "GET",
@@ -26844,13 +26998,13 @@ var meta121 = {
 // src/use-cases/commands/get-drive-item-analytics.ts
 var exports_get_drive_item_analytics = {};
 __export(exports_get_drive_item_analytics, {
-  schema: () => schema120,
-  meta: () => meta122,
-  execute: () => execute120
+  schema: () => schema121,
+  meta: () => meta123,
+  execute: () => execute121
 });
-var schema120 = exports_external.object({ driveId: exports_external.string().min(1), itemId: exports_external.string().min(1) });
-var { execute: execute120 } = buildCommand((p) => `/drives/${p.driveId}/items/${p.itemId}/analytics`, schema120);
-var meta122 = {
+var schema121 = exports_external.object({ driveId: exports_external.string().min(1), itemId: exports_external.string().min(1) });
+var { execute: execute121 } = buildCommand((p) => `/drives/${p.driveId}/items/${p.itemId}/analytics`, schema121);
+var meta123 = {
   summary: 'Return view / activity analytics for a OneDrive / SharePoint file — `allTime` totals (views, viewers) and `lastSevenDays` rollup. Useful for ranking files by attention or detecting stale content. **Known empty case**: returns `{ allTime: null, lastSevenDays: null }` on low-traffic items, or when the calling identity (the Teams web client basic token) lacks the analytics scope on the tenant. Do not interpret nulls as "no views" — interpret as "not available for this caller". For active files where you expect data and see nulls, escalate to a token with `Reports.Read.All`.',
   category: "drive",
   graphMethod: "GET",
@@ -26877,13 +27031,13 @@ var meta122 = {
 // src/use-cases/commands/list-team-installed-apps.ts
 var exports_list_team_installed_apps = {};
 __export(exports_list_team_installed_apps, {
-  schema: () => schema121,
-  meta: () => meta123,
-  execute: () => execute121
+  schema: () => schema122,
+  meta: () => meta124,
+  execute: () => execute122
 });
-var schema121 = exports_external.object({ teamId: exports_external.string().min(1) });
-var { execute: execute121 } = buildCommand((p) => `/teams/${p.teamId}/installedApps?$expand=teamsAppDefinition`, schema121);
-var meta123 = {
+var schema122 = exports_external.object({ teamId: exports_external.string().min(1) });
+var { execute: execute122 } = buildCommand((p) => `/teams/${p.teamId}/installedApps?$expand=teamsAppDefinition`, schema122);
+var meta124 = {
   summary: "List the Teams apps installed in a team. The CLI hard-pins `$expand=teamsAppDefinition` so every entry includes `displayName`, `version`, and `distributionMethod` (the bare endpoint returns only opaque IDs). Useful for surfacing which integrations are wired into a given team. Graph rejects user-supplied OData query parameters on this endpoint (`Query option 'Top' is not allowed`) — so the standard OData flags are intentionally NOT exposed here. The response itself is still server-paginated via `@odata.nextLink` when the team has many installed apps; chain with `next-page` to walk subsequent pages.",
   category: "teams",
   graphMethod: "GET",
@@ -26906,13 +27060,13 @@ var meta123 = {
 // src/use-cases/commands/list-calendar-groups.ts
 var exports_list_calendar_groups = {};
 __export(exports_list_calendar_groups, {
-  schema: () => schema122,
-  meta: () => meta124,
-  execute: () => execute122
+  schema: () => schema123,
+  meta: () => meta125,
+  execute: () => execute123
 });
 var baseSchema58 = exports_external.object({}).strict();
-var { execute: execute122, schema: schema122 } = buildListCommand(() => "/me/calendarGroups", baseSchema58);
-var meta124 = {
+var { execute: execute123, schema: schema123 } = buildListCommand(() => "/me/calendarGroups", baseSchema58);
+var meta125 = {
   summary: 'List the signed-in user\'s calendar groups — Outlook\'s organizational layer above individual calendars (e.g. "My Calendars", "Other Calendars", "Birthdays"). Use the returned `id` with `list-calendar-group-calendars` to drill in.',
   category: "calendar",
   graphMethod: "GET",
@@ -26927,13 +27081,13 @@ var meta124 = {
 // src/use-cases/commands/list-calendar-group-calendars.ts
 var exports_list_calendar_group_calendars = {};
 __export(exports_list_calendar_group_calendars, {
-  schema: () => schema123,
-  meta: () => meta125,
-  execute: () => execute123
+  schema: () => schema124,
+  meta: () => meta126,
+  execute: () => execute124
 });
 var baseSchema59 = exports_external.object({ calendarGroupId: exports_external.string().min(1) });
-var { execute: execute123, schema: schema123 } = buildListCommand((p) => `/me/calendarGroups/${p.calendarGroupId}/calendars`, baseSchema59);
-var meta125 = {
+var { execute: execute124, schema: schema124 } = buildListCommand((p) => `/me/calendarGroups/${p.calendarGroupId}/calendars`, baseSchema59);
+var meta126 = {
   summary: "List the calendars inside one calendar group.",
   category: "calendar",
   graphMethod: "GET",
@@ -26957,13 +27111,13 @@ var meta125 = {
 // src/use-cases/commands/get-my-calendar.ts
 var exports_get_my_calendar = {};
 __export(exports_get_my_calendar, {
-  schema: () => schema124,
-  meta: () => meta126,
-  execute: () => execute124
+  schema: () => schema125,
+  meta: () => meta127,
+  execute: () => execute125
 });
 var baseSchema60 = exports_external.object({});
-var { execute: execute124, schema: schema124 } = buildSelectableCommand(() => "/me/calendar", baseSchema60);
-var meta126 = {
+var { execute: execute125, schema: schema125 } = buildSelectableCommand(() => "/me/calendar", baseSchema60);
+var meta127 = {
   summary: "Return metadata for the signed-in user's *primary* calendar — `id`, `name`, `color`, `owner`, `canShare`, `canViewPrivateItems`, `canEdit`, `defaultOnlineMeetingProvider`. Sibling to `list-calendars` which returns every calendar (incl. shared / subscribed). Use `--select` to fetch only the fields you need.",
   category: "calendar",
   graphMethod: "GET",
@@ -26977,13 +27131,13 @@ var meta126 = {
 // src/use-cases/commands/list-site-columns.ts
 var exports_list_site_columns = {};
 __export(exports_list_site_columns, {
-  schema: () => schema125,
-  meta: () => meta127,
-  execute: () => execute125
+  schema: () => schema126,
+  meta: () => meta128,
+  execute: () => execute126
 });
 var baseSchema61 = exports_external.object({ siteId: exports_external.string().min(1) });
-var { execute: execute125, schema: schema125 } = buildSelectableCommand((p) => `/sites/${p.siteId}/columns`, baseSchema61);
-var meta127 = {
+var { execute: execute126, schema: schema126 } = buildSelectableCommand((p) => `/sites/${p.siteId}/columns`, baseSchema61);
+var meta128 = {
   summary: "List the *site-level* column definitions — columns reusable across multiple lists in the site. Distinct from `list-sharepoint-list-columns` which returns one specific list's schema. Note: Graph silently ignores `$top` and `$skip` on this endpoint (verified live — passing them returns the full collection regardless), so the CLI exposes only `--select` and `--expand`.",
   category: "sharepoint",
   graphMethod: "GET",
@@ -27006,13 +27160,13 @@ var meta127 = {
 // src/use-cases/commands/list-site-content-types.ts
 var exports_list_site_content_types = {};
 __export(exports_list_site_content_types, {
-  schema: () => schema126,
-  meta: () => meta128,
-  execute: () => execute126
+  schema: () => schema127,
+  meta: () => meta129,
+  execute: () => execute127
 });
 var baseSchema62 = exports_external.object({ siteId: exports_external.string().min(1) });
-var { execute: execute126, schema: schema126 } = buildNoSkipListCommand((p) => `/sites/${p.siteId}/contentTypes`, baseSchema62);
-var meta128 = {
+var { execute: execute127, schema: schema127 } = buildNoSkipListCommand((p) => `/sites/${p.siteId}/contentTypes`, baseSchema62);
+var meta129 = {
   summary: "List the content type definitions of a SharePoint site — typed schemas (Document, Page, Item, custom-defined) describing which columns + behaviors apply to items of each type. Useful for understanding a site's information architecture.",
   category: "sharepoint",
   graphMethod: "GET",
@@ -27037,13 +27191,13 @@ var meta128 = {
 // src/use-cases/commands/list-sharepoint-site-pages.ts
 var exports_list_sharepoint_site_pages = {};
 __export(exports_list_sharepoint_site_pages, {
-  schema: () => schema127,
-  meta: () => meta129,
-  execute: () => execute127
+  schema: () => schema128,
+  meta: () => meta130,
+  execute: () => execute128
 });
 var baseSchema63 = exports_external.object({ siteId: exports_external.string().min(1) });
-var { execute: execute127, schema: schema127 } = buildNoSkipListCommand((p) => `/sites/${p.siteId}/pages`, baseSchema63);
-var meta129 = {
+var { execute: execute128, schema: schema128 } = buildNoSkipListCommand((p) => `/sites/${p.siteId}/pages`, baseSchema63);
+var meta130 = {
   summary: "List modern SharePoint pages on a site (news posts, dashboards, landing pages). Each `sitePage` has `title`, `description`, `webUrl`, `publishingState`, `lastPublishedDateTime`. Returned items are the read-only listing — fetch the page body via the SharePoint REST API or by opening the `webUrl`.",
   category: "sharepoint",
   graphMethod: "GET",
@@ -27068,15 +27222,15 @@ var meta129 = {
 // src/use-cases/commands/list-excel-defined-names.ts
 var exports_list_excel_defined_names = {};
 __export(exports_list_excel_defined_names, {
-  schema: () => schema128,
-  meta: () => meta130,
-  execute: () => execute128
+  schema: () => schema129,
+  meta: () => meta131,
+  execute: () => execute129
 });
 var baseSchema64 = exports_external.object({ driveId: exports_external.string().min(1), itemId: exports_external.string().min(1) });
 var inner10 = buildListCommand((p) => `/drives/${p.driveId}/items/${p.itemId}/workbook/names`, baseSchema64);
-var execute128 = wrapExcelExecute(inner10.execute);
-var { schema: schema128 } = inner10;
-var meta130 = {
+var execute129 = wrapExcelExecute(inner10.execute);
+var { schema: schema129 } = inner10;
+var meta131 = {
   summary: "List the workbook's defined names (named ranges, named formulas, named constants). Each `workbookNamedItem` has `name`, `value` (the formula or address), `comment`, and `scope` (workbook or worksheet). Useful for understanding workbook structure before reading ranges.",
   category: "excel",
   graphMethod: "GET",
@@ -27105,15 +27259,15 @@ var meta130 = {
 // src/use-cases/commands/list-excel-worksheet-charts.ts
 var exports_list_excel_worksheet_charts = {};
 __export(exports_list_excel_worksheet_charts, {
-  schema: () => schema129,
-  meta: () => meta131,
-  execute: () => execute129
+  schema: () => schema130,
+  meta: () => meta132,
+  execute: () => execute130
 });
 var baseSchema65 = exports_external.object({ driveId: exports_external.string().min(1), itemId: exports_external.string().min(1), worksheetId: exports_external.string().min(1) });
 var inner11 = buildListCommand((p) => `/drives/${p.driveId}/items/${p.itemId}/workbook/worksheets/${p.worksheetId}/charts`, baseSchema65);
-var execute129 = wrapExcelExecute(inner11.execute);
-var { schema: schema129 } = inner11;
-var meta131 = {
+var execute130 = wrapExcelExecute(inner11.execute);
+var { schema: schema130 } = inner11;
+var meta132 = {
   summary: "List the charts on a worksheet. Each `workbookChart` has `id`, `name`, `height`, `width`, `top`, `left`. Use the chart's image endpoint (`.../charts/{id}/image()`) to render the chart as a base64 PNG.",
   category: "excel",
   graphMethod: "GET",
@@ -27149,15 +27303,15 @@ var meta131 = {
 // src/use-cases/commands/microsoft-search-query.ts
 var exports_microsoft_search_query = {};
 __export(exports_microsoft_search_query, {
-  schema: () => schema130,
-  meta: () => meta132,
-  execute: () => execute130
+  schema: () => schema131,
+  meta: () => meta133,
+  execute: () => execute131
 });
 var ALL_ENTITY_TYPES = ["driveItem", "listItem", "site", "message", "event", "person"];
 var PAGE_SIZE2 = 25;
-var schema130 = exports_external.object({ query: exports_external.string().min(1) });
-var execute130 = async (graph, params) => {
-  const parsed = schema130.safeParse(params);
+var schema131 = exports_external.object({ query: exports_external.string().min(1) });
+var execute131 = async (graph, params) => {
+  const parsed = schema131.safeParse(params);
   if (!parsed.success)
     return err({ type: "validation_error", message: formatZodError(parsed.error) });
   const queryString = parsed.data.query;
@@ -27179,7 +27333,7 @@ var execute130 = async (graph, params) => {
     return err(partialErrors[0]?.error ?? { type: "api_error", status: 500, message: "all entity-type sub-requests failed" });
   return ok({ value: merged, ...partialErrors.length > 0 ? { partialErrors } : {} });
 };
-var meta132 = {
+var meta133 = {
   summary: "Run a federated KQL search across the signed-in user's mail, files, list items, sites, calendar events, and people. Microsoft Graph v1.0 rejects multi-entity search bodies on most tenants (`Multiple entity search is not supported in v1.0`), so this command issues SIX parallel POSTs — one per entityType — and merges the per-entity `searchHits` containers into a single `value[]`. Each container is identifiable by the resource type inside `hits[].resource`. If a sub-request fails (e.g. tenant lacks the scope for one entity), the others still return; failures show up in `partialErrors[]`. Page size is fixed at 25 per sub-request and `top` is NOT exposed (Graph rejects $top in /search/query bodies). `chatMessage` is excluded since `Chat.Read*` is unavailable. To find Microsoft Loop pages (`.loop`) for markdown conversion, query `filetype:loop`: each `driveItem` hit carries `resource.id` plus `resource.parentReference.driveId`, the exact pair `download-drive-item-as-markdown` needs to render the page via Graph `?format=html`. (`filetype:fluid` returns nothing on this corpus; Loop pages index as `.loop`.)",
   category: "meta",
   graphMethod: "POST",
@@ -27201,14 +27355,14 @@ var meta132 = {
 // src/use-cases/commands/my-quick-context.ts
 var exports_my_quick_context = {};
 __export(exports_my_quick_context, {
-  schema: () => schema131,
-  meta: () => meta133,
-  execute: () => execute131
+  schema: () => schema132,
+  meta: () => meta134,
+  execute: () => execute132
 });
-var schema131 = exports_external.object({}).strict();
+var schema132 = exports_external.object({}).strict();
 var valueOrUndefined = (r) => r.ok ? r.value : undefined;
-var execute131 = async (graph, params) => {
-  const parsed = schema131.safeParse(params);
+var execute132 = async (graph, params) => {
+  const parsed = schema132.safeParse(params);
   if (!parsed.success)
     return err({ type: "validation_error", message: formatZodError(parsed.error) });
   const [meRes, driveRes, inboxRes, calendarRes, plannerRes, notebooksRes, teamsRes, recentRes, mailboxRes] = await Promise.all([
@@ -27247,7 +27401,7 @@ var execute131 = async (graph, params) => {
     tenantWorkingHours: mailbox?.workingHours?.startTime !== undefined && mailbox.workingHours.endTime !== undefined ? { start: mailbox.workingHours.startTime, end: mailbox.workingHours.endTime, timeZone: mailbox.workingHours.timeZone?.name } : undefined
   });
 };
-var meta133 = {
+var meta134 = {
   summary: "One-shot discovery for the IDs every other command needs, plus the user's job title and tenant timezone / locale / working-hours. Issues 9 Graph calls in parallel and returns what each succeeded for. Partial-result mode: only `/me` is load-bearing — if any other sub-call fails (missing license, scope, or tenant policy) the corresponding field is `undefined` but the rest are still returned. Replaces the audit's 5-call discovery chain — feed the IDs straight into `list-mail-folder-messages`, `list-folder-files`, `list-planner-tasks`, `list-onenote-notebook-sections`, etc. For Microsoft To Do lists call `list-todo-task-lists` on demand (intentionally dropped from this command's fan-out — the array of {id, displayName, wellknownListName} entries crowded the envelope with IDs an LLM rarely needs on first contact). `tenantTimeZone` lets an LLM stop treating every datetime as UTC on first contact.",
   category: "meta",
   graphMethod: "GET",
@@ -27261,38 +27415,38 @@ var meta133 = {
 // src/use-cases/commands/scopes-check.ts
 var exports_scopes_check = {};
 __export(exports_scopes_check, {
-  schema: () => schema132,
-  meta: () => meta134,
-  execute: () => execute132
+  schema: () => schema133,
+  meta: () => meta135,
+  execute: () => execute133
 });
-var schema132 = exports_external.object({}).strict();
-var execute132 = async (graph, params) => {
-  const parsed = schema132.safeParse(params);
+var schema133 = exports_external.object({}).strict();
+var execute133 = async (graph, params) => {
+  const parsed = schema133.safeParse(params);
   if (!parsed.success)
     return err({ type: "validation_error", message: formatZodError(parsed.error) });
   return graph.getCachedTokenInfo();
 };
-var meta134 = {
-  summary: "Decode the cached Teams web client access token and return its scopes, audience, and expiry without making a Graph call. Use this as a self-test before running a command an LLM expects to fail with `accessDenied` — if the required scope isn't in the returned list, the call will reject regardless of tenant config. Each command's `scopesRequired` field in `help-json` lists the scopes that command needs; intersect with the array returned here for a pre-flight check (pipe both through `jq` and diff). The `expiresInSeconds` field (added ) lets an LLM decide pre-emptively to `login` again — typically worth doing under ~5 minutes (300 s) so a long-running session doesn't hit the wall mid-command.",
+var meta135 = {
+  summary: "Decode the cached Teams web client access token and return its scopes, audience, and expiry without making a Graph call. Use this as a self-test before running a command an LLM expects to fail with `accessDenied` — if the required scope isn't in the returned list, the call will reject regardless of tenant config. Each command's `scopesRequired` field in `help-json` lists the scopes that command needs; intersect with the array returned here for a pre-flight check (pipe both through `jq` and diff). The `expiresInSeconds` field lets an LLM decide pre-emptively to `login` again — typically worth doing under ~5 minutes (300 s) so a long-running session doesn't hit the wall mid-command. The `elevated` block reports whether the *separate* M365ChatClient-elevated token (needed by the historical-version download / convert commands) is cached and still usable — so a fresh process can pre-flight `deep-scan`-style workloads instead of discovering a 403 mid-run; `available:false` when it is absent, expired, or within the same 5-minute buffer the download path applies. The `chatsvcagg` and `ic3` blocks report the two Teams-chat substrate tokens (used by `list-teams-chat*` / `find-chats-with-user`) the same way; both self-heal from the shared refresh token, so they are informational rather than a preflight gate.",
   category: "meta",
   graphMethod: "GET",
   graphPathTemplate: "(meta) cached-token introspection — no Graph endpoint",
   graphDocsUrl: "https://learn.microsoft.com/en-us/graph/permissions-reference",
   options: [],
   example: "ask-marcel-office scopes-check",
-  responseShape: "`{ scopes: string[], audience: string, expiresAt: string (ISO 8601), expiresInSeconds: number }`. `expiresInSeconds` is negative when the cached token has already expired (run `login`); `audience` is the JWT `aud` claim (typically `https://graph.microsoft.com`)."
+  responseShape: "`{ scopes: string[], audience: string, expiresAt: string (ISO 8601), expiresInSeconds: number, elevated: { available: boolean, expiresInSeconds?: number }, chatsvcagg: { available: boolean, expiresInSeconds?: number }, ic3: { available: boolean, expiresInSeconds?: number } }`. `expiresInSeconds` is negative when the cached token has already expired (run `login`); `audience` is the JWT `aud` claim (typically `https://graph.microsoft.com`). `elevated.available` is `true` only when the cached M365ChatClient-elevated token (used by the historical-version commands) is present and beyond the 5-minute buffer; `elevated.expiresInSeconds` is its raw remaining seconds and is omitted (the key is absent) when no elevated token is cached. `chatsvcagg` and `ic3` are the two Teams-chat substrate tokens, same shape as `elevated`; both self-heal from the shared refresh token, so they are informational rather than a preflight gate."
 };
 
 // src/use-cases/commands/get-drive-special-folder.ts
 var exports_get_drive_special_folder = {};
 __export(exports_get_drive_special_folder, {
-  schema: () => schema133,
-  meta: () => meta135,
-  execute: () => execute133
+  schema: () => schema134,
+  meta: () => meta136,
+  execute: () => execute134
 });
 var baseSchema66 = exports_external.object({ folderName: exports_external.enum(["documents", "photos", "cameraroll", "approot", "music", "attachments"]) });
-var { execute: execute133, schema: schema133 } = buildSelectableCommand((p) => `/me/drive/special/${p.folderName}`, baseSchema66);
-var meta135 = {
+var { execute: execute134, schema: schema134 } = buildSelectableCommand((p) => `/me/drive/special/${p.folderName}`, baseSchema66);
+var meta136 = {
   summary: "Resolve a OneDrive well-known folder via `--folder-name` (one of `documents`, `photos`, `cameraroll`, `approot`, `music`, `attachments`) without having to navigate from the root. Returns the folder's driveItem (id, name, parentReference, etc.) ready to feed into `list-folder-files` or `download-drive-item-content`.",
   category: "drive",
   graphMethod: "GET",
@@ -27314,13 +27468,13 @@ var meta135 = {
 // src/use-cases/commands/get-drive-root-delta.ts
 var exports_get_drive_root_delta = {};
 __export(exports_get_drive_root_delta, {
-  schema: () => schema134,
-  meta: () => meta136,
-  execute: () => execute134
+  schema: () => schema135,
+  meta: () => meta137,
+  execute: () => execute135
 });
 var baseSchema67 = exports_external.object({}).strict();
-var { execute: execute134, schema: schema134 } = buildNoSkipListCommand(() => "/me/drive/root/delta()", baseSchema67);
-var meta136 = {
+var { execute: execute135, schema: schema135 } = buildNoSkipListCommand(() => "/me/drive/root/delta()", baseSchema67);
+var meta137 = {
   summary: "Track incremental changes (added / modified / deleted items) anywhere under the signed-in user's OneDrive root. **Takes zero required arguments** — acts implicitly on the signed-in user's primary OneDrive; use `get-drive-delta` to target a specific drive by ID. The first call returns a snapshot plus `@odata.deltaLink`; subsequent calls with that link return only what has changed since. Cross-folder companion to `get-drive-delta` (which scopes to one specific folder).",
   category: "drive",
   graphMethod: "GET",
@@ -27336,13 +27490,13 @@ var meta136 = {
 // src/use-cases/commands/list-followed-drive-items.ts
 var exports_list_followed_drive_items = {};
 __export(exports_list_followed_drive_items, {
-  schema: () => schema135,
-  meta: () => meta137,
-  execute: () => execute135
+  schema: () => schema136,
+  meta: () => meta138,
+  execute: () => execute136
 });
 var baseSchema68 = exports_external.object({}).strict();
-var { execute: execute135, schema: schema135 } = buildNoSkipListCommand(() => "/me/drive/following", baseSchema68);
-var meta137 = {
+var { execute: execute136, schema: schema136 } = buildNoSkipListCommand(() => "/me/drive/following", baseSchema68);
+var meta138 = {
   summary: "List driveItems the signed-in user has explicitly followed (the OneDrive star). A small, hand-curated set of frequently-revisited files, distinct from the algorithmic `list-recent-files` and `list-recently-used-insights`.",
   category: "drive",
   graphMethod: "GET",
@@ -27358,13 +27512,13 @@ var meta137 = {
 // src/use-cases/commands/get-drive-item-created-by-user.ts
 var exports_get_drive_item_created_by_user = {};
 __export(exports_get_drive_item_created_by_user, {
-  schema: () => schema136,
-  meta: () => meta138,
-  execute: () => execute136
+  schema: () => schema137,
+  meta: () => meta139,
+  execute: () => execute137
 });
 var baseSchema69 = exports_external.object({ driveId: exports_external.string().min(1), itemId: exports_external.string().min(1) });
-var { execute: execute136, schema: schema136 } = buildSelectableCommand((p) => `/drives/${p.driveId}/items/${p.itemId}/createdByUser`, baseSchema69);
-var meta138 = {
+var { execute: execute137, schema: schema137 } = buildSelectableCommand((p) => `/drives/${p.driveId}/items/${p.itemId}/createdByUser`, baseSchema69);
+var meta139 = {
   summary: "Return the `user` resource for whoever created a OneDrive / SharePoint file — full profile, not just the truncated `createdBy.user` summary embedded in the parent driveItem. Useful when you need title / department / mail of the author. Use `--select` to fetch only the fields you care about (e.g. `--select id,displayName,jobTitle,department,mail`).",
   category: "drive",
   graphMethod: "GET",
@@ -27392,13 +27546,13 @@ var meta138 = {
 // src/use-cases/commands/get-drive-item-last-modified-by-user.ts
 var exports_get_drive_item_last_modified_by_user = {};
 __export(exports_get_drive_item_last_modified_by_user, {
-  schema: () => schema137,
-  meta: () => meta139,
-  execute: () => execute137
+  schema: () => schema138,
+  meta: () => meta140,
+  execute: () => execute138
 });
 var baseSchema70 = exports_external.object({ driveId: exports_external.string().min(1), itemId: exports_external.string().min(1) });
-var { execute: execute137, schema: schema137 } = buildSelectableCommand((p) => `/drives/${p.driveId}/items/${p.itemId}/lastModifiedByUser`, baseSchema70);
-var meta139 = {
+var { execute: execute138, schema: schema138 } = buildSelectableCommand((p) => `/drives/${p.driveId}/items/${p.itemId}/lastModifiedByUser`, baseSchema70);
+var meta140 = {
   summary: "Return the full `user` resource for whoever last modified a OneDrive / SharePoint file — sibling to `get-drive-item-created-by-user`. Use `--select` to fetch only specific fields.",
   category: "drive",
   graphMethod: "GET",
@@ -27426,13 +27580,13 @@ var meta139 = {
 // src/use-cases/commands/get-site-analytics.ts
 var exports_get_site_analytics = {};
 __export(exports_get_site_analytics, {
-  schema: () => schema138,
-  meta: () => meta140,
-  execute: () => execute138
+  schema: () => schema139,
+  meta: () => meta141,
+  execute: () => execute139
 });
-var schema138 = exports_external.object({ siteId: exports_external.string().min(1) });
-var { execute: execute138 } = buildCommand((p) => `/sites/${p.siteId}/analytics`, schema138);
-var meta140 = {
+var schema139 = exports_external.object({ siteId: exports_external.string().min(1) });
+var { execute: execute139 } = buildCommand((p) => `/sites/${p.siteId}/analytics`, schema139);
+var meta141 = {
   summary: 'Return view / activity analytics for a SharePoint site — `allTime` totals (visits, viewers) and `lastSevenDays` rollup. Site-level parallel to `get-drive-item-analytics`. Useful for ranking sites by attention or detecting stale workspaces. **Known empty case**: returns `{ allTime: null, lastSevenDays: null }` even on active sites when the calling identity (the Teams web client basic token) lacks the analytics scope. Do not interpret nulls as "no activity" — interpret as "not available for this caller".',
   category: "sharepoint",
   graphMethod: "GET",
@@ -27454,13 +27608,13 @@ var meta140 = {
 // src/use-cases/commands/list-sharepoint-list-item-versions.ts
 var exports_list_sharepoint_list_item_versions = {};
 __export(exports_list_sharepoint_list_item_versions, {
-  schema: () => schema139,
-  meta: () => meta141,
-  execute: () => execute139
+  schema: () => schema140,
+  meta: () => meta142,
+  execute: () => execute140
 });
 var baseSchema71 = exports_external.object({ siteId: exports_external.string().min(1), listId: exports_external.string().min(1), listItemId: exports_external.string().min(1) });
-var { execute: execute139, schema: schema139 } = buildNoSkipListCommand((p) => `/sites/${p.siteId}/lists/${p.listId}/items/${p.listItemId}/versions`, baseSchema71);
-var meta141 = {
+var { execute: execute140, schema: schema140 } = buildNoSkipListCommand((p) => `/sites/${p.siteId}/lists/${p.listId}/items/${p.listItemId}/versions`, baseSchema71);
+var meta142 = {
   summary: "List the version history of a SharePoint list item — every change (column edits, status flips, custom-field changes) tracked as a `listItemVersion`. Distinct from `list-drive-item-versions`, which tracks file content versions.",
   category: "sharepoint",
   graphMethod: "GET",
@@ -27497,13 +27651,13 @@ var meta141 = {
 // src/use-cases/commands/get-mail-rule.ts
 var exports_get_mail_rule = {};
 __export(exports_get_mail_rule, {
-  schema: () => schema140,
-  meta: () => meta142,
-  execute: () => execute140
+  schema: () => schema141,
+  meta: () => meta143,
+  execute: () => execute141
 });
-var schema140 = exports_external.object({ mailFolderId: exports_external.string().min(1).default("inbox"), messageRuleId: exports_external.string().min(1) });
-var { execute: execute140 } = buildCommand((p) => `/me/mailFolders/${p.mailFolderId}/messageRules/${p.messageRuleId}`, schema140);
-var meta142 = {
+var schema141 = exports_external.object({ mailFolderId: exports_external.string().min(1).default("inbox"), messageRuleId: exports_external.string().min(1) });
+var { execute: execute141 } = buildCommand((p) => `/me/mailFolders/${p.mailFolderId}/messageRules/${p.messageRuleId}`, schema141);
+var meta143 = {
   summary: "Return a single Outlook message rule by ID, including its conditions and actions. Sibling to `list-mail-rules`. `--mail-folder-id` defaults to `inbox` (the only folder where rules actually live in Graph); the flag is preserved for callers that want to pass a resolved Inbox ID explicitly.",
   category: "mail",
   graphMethod: "GET",
@@ -27534,15 +27688,15 @@ var meta142 = {
 // src/use-cases/commands/list-excel-comments.ts
 var exports_list_excel_comments = {};
 __export(exports_list_excel_comments, {
-  schema: () => schema141,
-  meta: () => meta143,
-  execute: () => execute141
+  schema: () => schema142,
+  meta: () => meta144,
+  execute: () => execute142
 });
 var baseSchema72 = exports_external.object({ driveId: exports_external.string().min(1), itemId: exports_external.string().min(1) });
 var inner12 = buildListCommand((p) => `/drives/${p.driveId}/items/${p.itemId}/workbook/comments`, baseSchema72);
-var execute141 = wrapExcelExecute(inner12.execute);
-var { schema: schema141 } = inner12;
-var meta143 = {
+var execute142 = wrapExcelExecute(inner12.execute);
+var { schema: schema142 } = inner12;
+var meta144 = {
   summary: "List the modern threaded comments anchored to cells in an Excel workbook (the New Comments feature, distinct from legacy notes). Each `workbookComment` has `content`, `contentType`, `task` state, plus replies via the comment's `replies` navigation.",
   category: "excel",
   graphMethod: "GET",
@@ -27571,15 +27725,15 @@ var meta143 = {
 // src/use-cases/commands/list-excel-worksheet-pivot-tables.ts
 var exports_list_excel_worksheet_pivot_tables = {};
 __export(exports_list_excel_worksheet_pivot_tables, {
-  schema: () => schema142,
-  meta: () => meta144,
-  execute: () => execute142
+  schema: () => schema143,
+  meta: () => meta145,
+  execute: () => execute143
 });
 var baseSchema73 = exports_external.object({ driveId: exports_external.string().min(1), itemId: exports_external.string().min(1), worksheetId: exports_external.string().min(1) });
 var inner13 = buildListCommand((p) => `/drives/${p.driveId}/items/${p.itemId}/workbook/worksheets/${p.worksheetId}/pivotTables`, baseSchema73);
-var execute142 = wrapExcelExecute(inner13.execute);
-var { schema: schema142 } = inner13;
-var meta144 = {
+var execute143 = wrapExcelExecute(inner13.execute);
+var { schema: schema143 } = inner13;
+var meta145 = {
   summary: "List the pivot tables on a worksheet. Each `workbookPivotTable` has `name` and a navigation to its source `workbookWorksheet`. Useful for understanding analytical structure inside a workbook.",
   category: "excel",
   graphMethod: "GET",
@@ -27615,13 +27769,13 @@ var meta144 = {
 // src/use-cases/commands/list-sensitivity-labels.ts
 var exports_list_sensitivity_labels = {};
 __export(exports_list_sensitivity_labels, {
-  schema: () => schema143,
-  meta: () => meta145,
-  execute: () => execute143
+  schema: () => schema144,
+  meta: () => meta146,
+  execute: () => execute144
 });
 var baseSchema74 = exports_external.object({}).strict();
-var { execute: execute143, schema: schema143 } = buildListCommand(() => "/me/informationProtection/sensitivityLabels", baseSchema74);
-var meta145 = {
+var { execute: execute144, schema: schema144 } = buildListCommand(() => "/me/informationProtection/sensitivityLabels", baseSchema74);
+var meta146 = {
   summary: 'List the Microsoft Information Protection sensitivity labels available to the signed-in user — the labels Outlook / Word / SharePoint surfaces in the "Sensitivity" picker (e.g. Public / Internal / Confidential / Highly Confidential). Each label has `id`, `displayName`, `priority`, `isAppliable`, `tooltip`.',
   category: "user",
   graphMethod: "GET",
@@ -27636,13 +27790,13 @@ var meta145 = {
 // src/use-cases/commands/list-my-transitive-memberships.ts
 var exports_list_my_transitive_memberships = {};
 __export(exports_list_my_transitive_memberships, {
-  schema: () => schema144,
-  meta: () => meta146,
-  execute: () => execute144
+  schema: () => schema145,
+  meta: () => meta147,
+  execute: () => execute145
 });
 var baseSchema75 = exports_external.object({}).strict();
-var { execute: execute144, schema: schema144 } = buildListCommand(() => "/me/transitiveMemberOf", baseSchema75);
-var meta146 = {
+var { execute: execute145, schema: schema145 } = buildListCommand(() => "/me/transitiveMemberOf", baseSchema75);
+var meta147 = {
   summary: "List all groups, directory roles, and administrative units the signed-in user is a member of *transitively* — including memberships inherited via nested groups. Sibling to `list-my-memberships` (`/me/memberOf`) which only returns direct memberships.",
   category: "user",
   graphMethod: "GET",
@@ -27657,13 +27811,13 @@ var meta146 = {
 // src/use-cases/commands/get-team-primary-channel.ts
 var exports_get_team_primary_channel = {};
 __export(exports_get_team_primary_channel, {
-  schema: () => schema145,
-  meta: () => meta147,
-  execute: () => execute145
+  schema: () => schema146,
+  meta: () => meta148,
+  execute: () => execute146
 });
 var baseSchema76 = exports_external.object({ teamId: exports_external.string().min(1) });
-var { execute: execute145, schema: schema145 } = buildSelectableCommand((p) => `/teams/${p.teamId}/primaryChannel`, baseSchema76);
-var meta147 = {
+var { execute: execute146, schema: schema146 } = buildSelectableCommand((p) => `/teams/${p.teamId}/primaryChannel`, baseSchema76);
+var meta148 = {
   summary: "Return the team's primary (General) channel directly without having to list-then-pick. The returned `channel` has `id`, `displayName`, `webUrl`, `email` — feed `id` into `list-team-channels` siblings or `get-channel-files-folder`.",
   category: "teams",
   graphMethod: "GET",
@@ -27686,13 +27840,13 @@ var meta147 = {
 // src/use-cases/commands/list-todo-tasks-delta.ts
 var exports_list_todo_tasks_delta = {};
 __export(exports_list_todo_tasks_delta, {
-  schema: () => schema146,
-  meta: () => meta148,
-  execute: () => execute146
+  schema: () => schema147,
+  meta: () => meta149,
+  execute: () => execute147
 });
-var schema146 = exports_external.object({ todoTaskListId: exports_external.string().min(1) });
-var { execute: execute146 } = buildCommand((p) => `/me/todo/lists/${p.todoTaskListId}/tasks/delta()`, schema146);
-var meta148 = {
+var schema147 = exports_external.object({ todoTaskListId: exports_external.string().min(1) });
+var { execute: execute147 } = buildCommand((p) => `/me/todo/lists/${p.todoTaskListId}/tasks/delta()`, schema147);
+var meta149 = {
   summary: "Track incremental task changes (added / updated / completed / deleted) within a single Microsoft To Do list. The first call returns the current snapshot plus `@odata.deltaLink`; subsequent calls with that link return only what has changed since. Note: Graph rejects standard OData query parameters on this delta endpoint (the page-cap flag throws `Skip token is not provided`), so the OData passthrough is intentionally NOT exposed here. Use `next-page` with the returned `@odata.nextLink` to walk pages.",
   category: "tasks",
   graphMethod: "GET",
@@ -27720,13 +27874,13 @@ var meta148 = {
 // src/use-cases/commands/list-my-memberships.ts
 var exports_list_my_memberships = {};
 __export(exports_list_my_memberships, {
-  schema: () => schema147,
-  meta: () => meta149,
-  execute: () => execute147
+  schema: () => schema148,
+  meta: () => meta150,
+  execute: () => execute148
 });
 var baseSchema77 = exports_external.object({}).strict();
-var { execute: execute147, schema: schema147 } = buildListCommand(() => "/me/memberOf", baseSchema77);
-var meta149 = {
+var { execute: execute148, schema: schema148 } = buildListCommand(() => "/me/memberOf", baseSchema77);
+var meta150 = {
   summary: "List the groups, directory roles, and administrative units the signed-in user is a member of. Each entry's `@odata.type` distinguishes #microsoft.graph.group from #microsoft.graph.directoryRole, etc.",
   category: "user",
   graphMethod: "GET",
@@ -27741,13 +27895,13 @@ var meta149 = {
 // src/use-cases/commands/get-my-manager.ts
 var exports_get_my_manager = {};
 __export(exports_get_my_manager, {
-  schema: () => schema148,
-  meta: () => meta150,
-  execute: () => execute148
+  schema: () => schema149,
+  meta: () => meta151,
+  execute: () => execute149
 });
-var schema148 = exports_external.object({}).extend(selectExpandSchema.shape);
-var execute148 = async (graph, params) => {
-  const parsed = schema148.safeParse(params);
+var schema149 = exports_external.object({}).extend(selectExpandSchema.shape);
+var execute149 = async (graph, params) => {
+  const parsed = schema149.safeParse(params);
   if (!parsed.success)
     return err({ type: "validation_error", message: formatZodError(parsed.error) });
   const path = appendOData("/me/manager", parsed.data);
@@ -27759,7 +27913,7 @@ var execute148 = async (graph, params) => {
   }
   return result;
 };
-var meta150 = {
+var meta151 = {
   summary: "Return the signed-in user's manager (a single `user` resource). When no manager is set in the directory, Graph returns 404 `Request_ResourceNotFound`; this command maps that one specific 404 to `{ ok: true, data: { manager: null, note: '...' } }` so an LLM can distinguish 'no manager' from a permission failure without parsing prose. Use `--select` to slim the response (e.g. `--select id,displayName,mail`).",
   category: "user",
   graphMethod: "GET",
@@ -27771,15 +27925,15 @@ var meta150 = {
 };
 
 // src/use-cases/commands/get-user-manager.ts
-var exports_get_user_manager = {};
-__export(exports_get_user_manager, {
-  schema: () => schema149,
-  meta: () => meta151,
-  execute: () => execute149
+var exports_get_user_manager = {};
+__export(exports_get_user_manager, {
+  schema: () => schema150,
+  meta: () => meta152,
+  execute: () => execute150
 });
-var schema149 = exports_external.object({ userId: exports_external.string().min(1) }).extend(selectExpandSchema.shape);
-var execute149 = async (graph, params) => {
-  const parsed = schema149.safeParse(params);
+var schema150 = exports_external.object({ userId: exports_external.string().min(1) }).extend(selectExpandSchema.shape);
+var execute150 = async (graph, params) => {
+  const parsed = schema150.safeParse(params);
   if (!parsed.success)
     return err({ type: "validation_error", message: formatZodError(parsed.error) });
   const path = appendOData(`/users/${parsed.data.userId}/manager`, parsed.data);
@@ -27791,7 +27945,7 @@ var execute149 = async (graph, params) => {
   }
   return result;
 };
-var meta151 = {
+var meta152 = {
   summary: "Return a specific user's manager (a single `user` resource). When the user has no manager set in the directory, Graph returns 404 `Request_ResourceNotFound`; this command maps that one specific 404 to `{ ok: true, data: { manager: null, note: '...' } }` (same shape as `get-my-manager`) so an LLM can distinguish 'no manager' from 'unknown user' with a single discriminator across both commands. Use `--select` to slim the response.",
   category: "user",
   graphMethod: "GET",
@@ -27814,13 +27968,13 @@ var meta151 = {
 // src/use-cases/commands/list-relevant-people.ts
 var exports_list_relevant_people = {};
 __export(exports_list_relevant_people, {
-  schema: () => schema150,
-  meta: () => meta152,
-  execute: () => execute150
+  schema: () => schema151,
+  meta: () => meta153,
+  execute: () => execute151
 });
 var baseSchema78 = exports_external.object({}).strict();
-var { execute: execute150, schema: schema150 } = buildListCommand(() => "/me/people", baseSchema78);
-var meta152 = {
+var { execute: execute151, schema: schema151 } = buildListCommand(() => "/me/people", baseSchema78);
+var meta153 = {
   summary: "List people relevant to the signed-in user — colleagues they email and meet with most. Microsoft's relevance ranking, not the full directory. Returns `displayName`, `emailAddresses`, `jobTitle`, `companyName`, etc.",
   category: "user",
   graphMethod: "GET",
@@ -27835,13 +27989,13 @@ var meta152 = {
 // src/use-cases/commands/list-groups.ts
 var exports_list_groups = {};
 __export(exports_list_groups, {
-  schema: () => schema151,
-  meta: () => meta153,
-  execute: () => execute151
+  schema: () => schema152,
+  meta: () => meta154,
+  execute: () => execute152
 });
 var baseSchema79 = exports_external.object({}).strict();
-var { execute: execute151, schema: schema151 } = buildNoSkipListCommand(() => "/groups", baseSchema79);
-var meta153 = {
+var { execute: execute152, schema: schema152 } = buildNoSkipListCommand(() => "/groups", baseSchema79);
+var meta154 = {
   summary: "List Microsoft 365 groups, security groups, and distribution groups in the tenant directory. Use `--top` and `next-page` to paginate over very large directories.",
   category: "user",
   graphMethod: "GET",
@@ -27857,13 +28011,13 @@ var meta153 = {
 // src/use-cases/commands/get-group.ts
 var exports_get_group = {};
 __export(exports_get_group, {
-  schema: () => schema152,
-  meta: () => meta154,
-  execute: () => execute152
+  schema: () => schema153,
+  meta: () => meta155,
+  execute: () => execute153
 });
 var baseSchema80 = exports_external.object({ groupId: exports_external.string().min(1) });
-var { execute: execute152, schema: schema152 } = buildSelectableCommand((p) => `/groups/${p.groupId}`, baseSchema80);
-var meta154 = {
+var { execute: execute153, schema: schema153 } = buildSelectableCommand((p) => `/groups/${p.groupId}`, baseSchema80);
+var meta155 = {
   summary: "Return metadata for a single Azure AD / Microsoft 365 group. Use `--select` to slim large group payloads (the full group resource includes 30+ fields).",
   category: "user",
   graphMethod: "GET",
@@ -27886,13 +28040,13 @@ var meta154 = {
 // src/use-cases/commands/list-group-members.ts
 var exports_list_group_members = {};
 __export(exports_list_group_members, {
-  schema: () => schema153,
-  meta: () => meta155,
-  execute: () => execute153
+  schema: () => schema154,
+  meta: () => meta156,
+  execute: () => execute154
 });
 var baseSchema81 = exports_external.object({ groupId: exports_external.string().min(1) });
-var { execute: execute153, schema: schema153 } = buildListCommand((p) => `/groups/${p.groupId}/members`, baseSchema81);
-var meta155 = {
+var { execute: execute154, schema: schema154 } = buildListCommand((p) => `/groups/${p.groupId}/members`, baseSchema81);
+var meta156 = {
   summary: "List members of an Azure AD / Microsoft 365 group. Returns users, groups, and other directoryObjects depending on the group's membership.",
   category: "user",
   graphMethod: "GET",
@@ -27916,13 +28070,13 @@ var meta155 = {
 // src/use-cases/commands/list-group-owners.ts
 var exports_list_group_owners = {};
 __export(exports_list_group_owners, {
-  schema: () => schema154,
-  meta: () => meta156,
-  execute: () => execute154
+  schema: () => schema155,
+  meta: () => meta157,
+  execute: () => execute155
 });
 var baseSchema82 = exports_external.object({ groupId: exports_external.string().min(1) });
-var { execute: execute154, schema: schema154 } = buildListCommand((p) => `/groups/${p.groupId}/owners`, baseSchema82);
-var meta156 = {
+var { execute: execute155, schema: schema155 } = buildListCommand((p) => `/groups/${p.groupId}/owners`, baseSchema82);
+var meta157 = {
   summary: "List the owners of an Azure AD / Microsoft 365 group.",
   category: "user",
   graphMethod: "GET",
@@ -27946,13 +28100,13 @@ var meta156 = {
 // src/use-cases/commands/list-group-events.ts
 var exports_list_group_events = {};
 __export(exports_list_group_events, {
-  schema: () => schema155,
-  meta: () => meta157,
-  execute: () => execute155
+  schema: () => schema156,
+  meta: () => meta158,
+  execute: () => execute156
 });
 var baseSchema83 = exports_external.object({ groupId: exports_external.string().min(1) });
-var { execute: execute155, schema: schema155 } = buildListCommand((p) => `/groups/${p.groupId}/events`, baseSchema83);
-var meta157 = {
+var { execute: execute156, schema: schema156 } = buildListCommand((p) => `/groups/${p.groupId}/events`, baseSchema83);
+var meta158 = {
   summary: "List events from a unified (Microsoft 365) group's calendar. Only Microsoft 365 groups have a calendar — security and distribution groups return an empty `value[]` or 404.",
   category: "calendar",
   graphMethod: "GET",
@@ -27976,13 +28130,13 @@ var meta157 = {
 // src/use-cases/commands/get-group-calendar-view.ts
 var exports_get_group_calendar_view = {};
 __export(exports_get_group_calendar_view, {
-  schema: () => schema156,
-  meta: () => meta158,
-  execute: () => execute156
+  schema: () => schema157,
+  meta: () => meta159,
+  execute: () => execute157
 });
 var baseSchema84 = exports_external.object({ groupId: exports_external.string().min(1), startDateTime: isoDateTimeField, endDateTime: isoDateTimeField });
-var { execute: execute156, schema: schema156 } = buildListCommand((p) => `/groups/${p.groupId}/calendarView?startDateTime=${encodeURIComponent(p.startDateTime)}&endDateTime=${encodeURIComponent(p.endDateTime)}`, baseSchema84);
-var meta158 = {
+var { execute: execute157, schema: schema157 } = buildListCommand((p) => `/groups/${p.groupId}/calendarView?startDateTime=${encodeURIComponent(p.startDateTime)}&endDateTime=${encodeURIComponent(p.endDateTime)}`, baseSchema84);
+var meta159 = {
   summary: "Return a date-windowed calendar view from a unified (Microsoft 365) group's calendar. Recurring events are expanded into individual occurrences across the window. Only Microsoft 365 groups have a calendar — security and distribution groups return `MailboxNotEnabledForRESTAPI`.",
   category: "calendar",
   graphMethod: "GET",
@@ -28014,13 +28168,13 @@ var meta158 = {
 // src/use-cases/commands/list-group-conversations.ts
 var exports_list_group_conversations = {};
 __export(exports_list_group_conversations, {
-  schema: () => schema157,
-  meta: () => meta159,
-  execute: () => execute157
+  schema: () => schema158,
+  meta: () => meta160,
+  execute: () => execute158
 });
 var baseSchema85 = exports_external.object({ groupId: exports_external.string().min(1) });
-var { execute: execute157, schema: schema157 } = buildListCommand((p) => `/groups/${p.groupId}/conversations`, baseSchema85);
-var meta159 = {
+var { execute: execute158, schema: schema158 } = buildListCommand((p) => `/groups/${p.groupId}/conversations`, baseSchema85);
+var meta160 = {
   summary: "List conversations in a unified (Microsoft 365) group inbox. Each conversation aggregates one or more threads. Only Microsoft 365 groups have a mailbox — security and distribution groups return `MailboxNotEnabledForRESTAPI`. Verify the group is unified before calling.",
   category: "mail",
   graphMethod: "GET",
@@ -28044,13 +28198,13 @@ var meta159 = {
 // src/use-cases/commands/list-group-threads.ts
 var exports_list_group_threads = {};
 __export(exports_list_group_threads, {
-  schema: () => schema158,
-  meta: () => meta160,
-  execute: () => execute158
+  schema: () => schema159,
+  meta: () => meta161,
+  execute: () => execute159
 });
 var baseSchema86 = exports_external.object({ groupId: exports_external.string().min(1) });
-var { execute: execute158, schema: schema158 } = buildListCommand((p) => `/groups/${p.groupId}/threads`, baseSchema86);
-var meta160 = {
+var { execute: execute159, schema: schema159 } = buildListCommand((p) => `/groups/${p.groupId}/threads`, baseSchema86);
+var meta161 = {
   summary: "List threads in a unified (Microsoft 365) group inbox. Threads are flatter than conversations — one per topic, useful when conversation-level grouping isn't needed. Only Microsoft 365 groups have a mailbox — security and distribution groups return `MailboxNotEnabledForRESTAPI`.",
   category: "mail",
   graphMethod: "GET",
@@ -28074,18 +28228,18 @@ var meta160 = {
 // src/use-cases/commands/get-mail-message-mime.ts
 var exports_get_mail_message_mime = {};
 __export(exports_get_mail_message_mime, {
-  schema: () => schema159,
-  meta: () => meta161,
-  execute: () => execute159
+  schema: () => schema160,
+  meta: () => meta162,
+  execute: () => execute160
 });
-var schema159 = exports_external.object({ messageId: exports_external.string().min(1) });
-var execute159 = async (graph, params) => {
-  const parsed = schema159.safeParse(params);
+var schema160 = exports_external.object({ messageId: exports_external.string().min(1) });
+var execute160 = async (graph, params) => {
+  const parsed = schema160.safeParse(params);
   if (!parsed.success)
     return err({ type: "validation_error", message: formatZodError(parsed.error) });
   return inlineBinary(graph, `/me/messages/${parsed.data.messageId}/$value`);
 };
-var meta161 = {
+var meta162 = {
   summary: "Return the raw RFC 5322 MIME source of a single Outlook message — full headers, every attachment encoded inline. Useful for archiving, full-fidelity forensic inspection, or feeding into a tool that reads MIME directly. For human-readable content prefer `get-mail-message` or `convert-mail-to-markdown`.",
   category: "mail",
   graphMethod: "GET",
@@ -28108,13 +28262,13 @@ var meta161 = {
 // src/use-cases/commands/list-mail-folder-messages-delta.ts
 var exports_list_mail_folder_messages_delta = {};
 __export(exports_list_mail_folder_messages_delta, {
-  schema: () => schema160,
-  meta: () => meta162,
-  execute: () => execute160
+  schema: () => schema161,
+  meta: () => meta163,
+  execute: () => execute161
 });
 var baseSchema87 = exports_external.object({ mailFolderId: exports_external.string().min(1) });
-var { execute: execute160, schema: schema160 } = buildListCommand((p) => `/me/mailFolders/${p.mailFolderId}/messages/delta()`, baseSchema87);
-var meta162 = {
+var { execute: execute161, schema: schema161 } = buildListCommand((p) => `/me/mailFolders/${p.mailFolderId}/messages/delta()`, baseSchema87);
+var meta163 = {
   summary: "Track incremental changes (added / updated / deleted messages) within a single mail folder using Microsoft Graph delta tokens. The first call returns the current snapshot plus a `@odata.deltaLink`; subsequent calls with that link return only what has changed since.",
   category: "mail",
   graphMethod: "GET",
@@ -28139,13 +28293,13 @@ var meta162 = {
 // src/use-cases/commands/list-shared-mailbox-messages.ts
 var exports_list_shared_mailbox_messages = {};
 __export(exports_list_shared_mailbox_messages, {
-  schema: () => schema161,
-  meta: () => meta163,
-  execute: () => execute161
+  schema: () => schema162,
+  meta: () => meta164,
+  execute: () => execute162
 });
 var baseSchema88 = exports_external.object({ userId: exports_external.string().min(1) });
-var { execute: execute161, schema: schema161 } = buildListCommand((p) => `/users/${p.userId}/messages`, baseSchema88);
-var meta163 = {
+var { execute: execute162, schema: schema162 } = buildListCommand((p) => `/users/${p.userId}/messages`, baseSchema88);
+var meta164 = {
   summary: "List messages from a shared or delegated mailbox the signed-in user has read access to. Same shape as `list-mail-messages` but scoped to a specific mailbox owner. 403 if the signed-in user does not have shared access to that mailbox.",
   category: "mail",
   graphMethod: "GET",
@@ -28169,13 +28323,13 @@ var meta163 = {
 // src/use-cases/commands/list-shared-mailbox-folder-messages.ts
 var exports_list_shared_mailbox_folder_messages = {};
 __export(exports_list_shared_mailbox_folder_messages, {
-  schema: () => schema162,
-  meta: () => meta164,
-  execute: () => execute162
+  schema: () => schema163,
+  meta: () => meta165,
+  execute: () => execute163
 });
 var baseSchema89 = exports_external.object({ userId: exports_external.string().min(1), mailFolderId: exports_external.string().min(1) });
-var { execute: execute162, schema: schema162 } = buildListCommand((p) => `/users/${p.userId}/mailFolders/${p.mailFolderId}/messages`, baseSchema89);
-var meta164 = {
+var { execute: execute163, schema: schema163 } = buildListCommand((p) => `/users/${p.userId}/mailFolders/${p.mailFolderId}/messages`, baseSchema89);
+var meta165 = {
   summary: "List messages in a single folder of a shared / delegated mailbox.",
   category: "mail",
   graphMethod: "GET",
@@ -28204,13 +28358,13 @@ var meta164 = {
 // src/use-cases/commands/get-shared-mailbox-message.ts
 var exports_get_shared_mailbox_message = {};
 __export(exports_get_shared_mailbox_message, {
-  schema: () => schema163,
-  meta: () => meta165,
-  execute: () => execute163
+  schema: () => schema164,
+  meta: () => meta166,
+  execute: () => execute164
 });
 var baseSchema90 = exports_external.object({ userId: exports_external.string().min(1), messageId: exports_external.string().min(1) });
-var { execute: execute163, schema: schema163 } = buildSelectableCommand((p) => `/users/${p.userId}/messages/${p.messageId}`, baseSchema90);
-var meta165 = {
+var { execute: execute164, schema: schema164 } = buildSelectableCommand((p) => `/users/${p.userId}/messages/${p.messageId}`, baseSchema90);
+var meta166 = {
   summary: "Return a single message from a shared / delegated mailbox. Use `--select` to fetch only specific fields (e.g. `--select id,subject,from,receivedDateTime`) — sibling to `get-mail-message` for /me.",
   category: "mail",
   graphMethod: "GET",
@@ -28238,22 +28392,22 @@ var meta165 = {
 // src/use-cases/commands/list-conversation-messages.ts
 var exports_list_conversation_messages = {};
 __export(exports_list_conversation_messages, {
-  schema: () => schema164,
-  meta: () => meta166,
-  execute: () => execute164
+  schema: () => schema165,
+  meta: () => meta167,
+  execute: () => execute165
 });
 var allowedShape = Object.fromEntries(Object.entries(odataQuerySchema.shape).filter(([key]) => key !== "filter" && key !== "orderby"));
 var allowedOptions = odataQueryOptions.filter((o) => o.name !== "filter" && o.name !== "orderby");
-var schema164 = exports_external.object({ conversationId: exports_external.string().min(1) }).extend(allowedShape);
-var execute164 = async (graph, params) => {
-  const parsed = schema164.safeParse(params);
+var schema165 = exports_external.object({ conversationId: exports_external.string().min(1) }).extend(allowedShape);
+var execute165 = async (graph, params) => {
+  const parsed = schema165.safeParse(params);
   if (!parsed.success)
     return err({ type: "validation_error", message: formatZodError(parsed.error) });
   const escaped = parsed.data.conversationId.replace(/'/g, "''");
   const path = appendOData(`/me/messages?$filter=conversationId eq '${escaped}'`, parsed.data);
   return graph.get(path);
 };
-var meta166 = {
+var meta167 = {
   summary: "List every message in a single Outlook conversation (thread) using `$filter=conversationId eq '...'`. Reconstructs a complete thread regardless of which subject lines or folders the replies landed in. Accepts the OData passthrough flags top/skip/select/expand — the filter and orderby passthroughs are intentionally omitted (the path already pins a `$filter`, and Graph rejects this filter combined with `$orderby` as `InefficientFilter` since `conversationId` is not a sortable index). The caller can sort by `receivedDateTime` client-side. KQL `$search` does not index `conversationId`, so `$filter` is the only documented Graph idiom for whole-thread retrieval.",
   category: "mail",
   graphMethod: "GET",
@@ -28277,13 +28431,13 @@ var meta166 = {
 // src/use-cases/commands/list-focused-inbox-overrides.ts
 var exports_list_focused_inbox_overrides = {};
 __export(exports_list_focused_inbox_overrides, {
-  schema: () => schema165,
-  meta: () => meta167,
-  execute: () => execute165
+  schema: () => schema166,
+  meta: () => meta168,
+  execute: () => execute166
 });
 var baseSchema91 = exports_external.object({}).strict();
-var { execute: execute165, schema: schema165 } = buildListCommand(() => "/me/inferenceClassification/overrides", baseSchema91);
-var meta167 = {
+var { execute: execute166, schema: schema166 } = buildListCommand(() => "/me/inferenceClassification/overrides", baseSchema91);
+var meta168 = {
   summary: "List the signed-in user's Focused Inbox classification overrides — sender addresses they've manually moved to Focused or Other, which override Microsoft's automatic classifier.",
   category: "mail",
   graphMethod: "GET",
@@ -28298,13 +28452,13 @@ var meta167 = {
 // src/use-cases/commands/list-outlook-categories.ts
 var exports_list_outlook_categories = {};
 __export(exports_list_outlook_categories, {
-  schema: () => schema166,
-  meta: () => meta168,
-  execute: () => execute166
+  schema: () => schema167,
+  meta: () => meta169,
+  execute: () => execute167
 });
-var schema166 = exports_external.object({}).strict();
-var { execute: execute166 } = buildCommand(() => "/me/outlook/masterCategories", schema166);
-var meta168 = {
+var schema167 = exports_external.object({}).strict();
+var { execute: execute167 } = buildCommand(() => "/me/outlook/masterCategories", schema167);
+var meta169 = {
   summary: "List the signed-in user's Outlook color categories — the named tags that can be applied to mail, calendar items, and contacts. Each entry has `displayName` and a `color` from Outlook's preset palette. Note: Graph silently ignores every OData passthrough on this endpoint (`$top`, `$skip`, `$select`, `$filter`, `$orderby`, `$expand`), so the CLI does not expose any of those flags — the full collection is always returned. Slice client-side.",
   category: "mail",
   graphMethod: "GET",
@@ -28318,13 +28472,13 @@ var meta168 = {
 // src/use-cases/commands/list-shared-calendar-events.ts
 var exports_list_shared_calendar_events = {};
 __export(exports_list_shared_calendar_events, {
-  schema: () => schema167,
-  meta: () => meta169,
-  execute: () => execute167
+  schema: () => schema168,
+  meta: () => meta170,
+  execute: () => execute168
 });
 var baseSchema92 = exports_external.object({ userId: exports_external.string().min(1) });
-var { execute: execute167, schema: schema167 } = buildListCommand((p) => `/users/${p.userId}/calendar/events`, baseSchema92);
-var meta169 = {
+var { execute: execute168, schema: schema168 } = buildListCommand((p) => `/users/${p.userId}/calendar/events`, baseSchema92);
+var meta170 = {
   summary: "List events from another user's primary calendar (shared / delegated access). 403 without `Calendars.Read.Shared`.",
   category: "calendar",
   graphMethod: "GET",
@@ -28348,13 +28502,13 @@ var meta169 = {
 // src/use-cases/commands/get-shared-calendar-view.ts
 var exports_get_shared_calendar_view = {};
 __export(exports_get_shared_calendar_view, {
-  schema: () => schema168,
-  meta: () => meta170,
-  execute: () => execute168
+  schema: () => schema169,
+  meta: () => meta171,
+  execute: () => execute169
 });
 var baseSchema93 = exports_external.object({ userId: exports_external.string().min(1), startDateTime: isoDateTimeField, endDateTime: isoDateTimeField });
-var { execute: execute168, schema: schema168 } = buildListCommand((p) => `/users/${p.userId}/calendarView?startDateTime=${encodeURIComponent(p.startDateTime)}&endDateTime=${encodeURIComponent(p.endDateTime)}`, baseSchema93);
-var meta170 = {
+var { execute: execute169, schema: schema169 } = buildListCommand((p) => `/users/${p.userId}/calendarView?startDateTime=${encodeURIComponent(p.startDateTime)}&endDateTime=${encodeURIComponent(p.endDateTime)}`, baseSchema93);
+var meta171 = {
   summary: "Return a date-windowed calendar view from another user's primary calendar (shared / delegated access). Recurrences expanded into individual occurrences.",
   category: "calendar",
   graphMethod: "GET",
@@ -28380,13 +28534,13 @@ var meta170 = {
 // src/use-cases/commands/list-sharepoint-list-columns.ts
 var exports_list_sharepoint_list_columns = {};
 __export(exports_list_sharepoint_list_columns, {
-  schema: () => schema169,
-  meta: () => meta171,
-  execute: () => execute169
+  schema: () => schema170,
+  meta: () => meta172,
+  execute: () => execute170
 });
 var baseSchema94 = exports_external.object({ siteId: exports_external.string().min(1), listId: exports_external.string().min(1) });
-var { execute: execute169, schema: schema169 } = buildSelectableCommand((p) => `/sites/${p.siteId}/lists/${p.listId}/columns`, baseSchema94);
-var meta171 = {
+var { execute: execute170, schema: schema170 } = buildSelectableCommand((p) => `/sites/${p.siteId}/lists/${p.listId}/columns`, baseSchema94);
+var meta172 = {
   summary: "List the column definitions (schema) of a SharePoint list. Useful before reading list items so you know which fields exist and their types. Note: Graph silently ignores `$top` and `$skip` on this endpoint, so the CLI exposes only `--select` and `--expand`.",
   category: "sharepoint",
   graphMethod: "GET",
@@ -28414,13 +28568,13 @@ var meta171 = {
 // src/use-cases/commands/get-sharepoint-list-column.ts
 var exports_get_sharepoint_list_column = {};
 __export(exports_get_sharepoint_list_column, {
-  schema: () => schema170,
-  meta: () => meta172,
-  execute: () => execute170
+  schema: () => schema171,
+  meta: () => meta173,
+  execute: () => execute171
 });
 var baseSchema95 = exports_external.object({ siteId: exports_external.string().min(1), listId: exports_external.string().min(1), columnId: exports_external.string().min(1) });
-var { execute: execute170, schema: schema170 } = buildSelectableCommand((p) => `/sites/${p.siteId}/lists/${p.listId}/columns/${p.columnId}`, baseSchema95);
-var meta172 = {
+var { execute: execute171, schema: schema171 } = buildSelectableCommand((p) => `/sites/${p.siteId}/lists/${p.listId}/columns/${p.columnId}`, baseSchema95);
+var meta173 = {
   summary: "Return a single column definition from a SharePoint list.",
   category: "sharepoint",
   graphMethod: "GET",
@@ -28455,9 +28609,9 @@ var meta172 = {
 // src/use-cases/commands/list-sharepoint-site-onenote-notebooks.ts
 var exports_list_sharepoint_site_onenote_notebooks = {};
 __export(exports_list_sharepoint_site_onenote_notebooks, {
-  schema: () => schema171,
-  meta: () => meta173,
-  execute: () => execute171
+  schema: () => schema172,
+  meta: () => meta174,
+  execute: () => execute172
 });
 
 // src/use-cases/commands/onenote-5k-limit.ts
@@ -28480,9 +28634,9 @@ var wrapOnenote5kLimit = (inner14) => async (graph, params) => {
 // src/use-cases/commands/list-sharepoint-site-onenote-notebooks.ts
 var baseSchema96 = exports_external.object({ siteId: exports_external.string().min(1) });
 var inner14 = buildListCommand((p) => `/sites/${p.siteId}/onenote/notebooks`, baseSchema96);
-var execute171 = wrapOnenote5kLimit(inner14.execute);
-var { schema: schema171 } = inner14;
-var meta173 = {
+var execute172 = wrapOnenote5kLimit(inner14.execute);
+var { schema: schema172 } = inner14;
+var meta174 = {
   summary: "List OneNote notebooks attached to a SharePoint site (separate from the personal `list-onenote-notebooks` which targets `/me`).",
   category: "notes",
   graphMethod: "GET",
@@ -28506,15 +28660,15 @@ var meta173 = {
 // src/use-cases/commands/list-sharepoint-site-onenote-notebook-sections.ts
 var exports_list_sharepoint_site_onenote_notebook_sections = {};
 __export(exports_list_sharepoint_site_onenote_notebook_sections, {
-  schema: () => schema172,
-  meta: () => meta174,
-  execute: () => execute172
+  schema: () => schema173,
+  meta: () => meta175,
+  execute: () => execute173
 });
 var baseSchema97 = exports_external.object({ siteId: exports_external.string().min(1), notebookId: exports_external.string().min(1) });
 var inner15 = buildListCommand((p) => `/sites/${p.siteId}/onenote/notebooks/${p.notebookId}/sections`, baseSchema97);
-var execute172 = wrapOnenote5kLimit(inner15.execute);
-var { schema: schema172 } = inner15;
-var meta174 = {
+var execute173 = wrapOnenote5kLimit(inner15.execute);
+var { schema: schema173 } = inner15;
+var meta175 = {
   summary: "List sections inside one OneNote notebook attached to a SharePoint site.",
   category: "notes",
   graphMethod: "GET",
@@ -28543,15 +28697,15 @@ var meta174 = {
 // src/use-cases/commands/list-sharepoint-site-onenote-section-pages.ts
 var exports_list_sharepoint_site_onenote_section_pages = {};
 __export(exports_list_sharepoint_site_onenote_section_pages, {
-  schema: () => schema173,
-  meta: () => meta175,
-  execute: () => execute173
+  schema: () => schema174,
+  meta: () => meta176,
+  execute: () => execute174
 });
 var baseSchema98 = exports_external.object({ siteId: exports_external.string().min(1), onenoteSectionId: exports_external.string().min(1) });
 var inner16 = buildListCommand((p) => `/sites/${p.siteId}/onenote/sections/${p.onenoteSectionId}/pages`, baseSchema98);
-var execute173 = wrapOnenote5kLimit(inner16.execute);
-var { schema: schema173 } = inner16;
-var meta175 = {
+var execute174 = wrapOnenote5kLimit(inner16.execute);
+var { schema: schema174 } = inner16;
+var meta176 = {
   summary: "List pages inside one section of a SharePoint-site OneNote notebook.",
   category: "notes",
   graphMethod: "GET",
@@ -28581,19 +28735,19 @@ var meta175 = {
 // src/use-cases/commands/get-sharepoint-site-onenote-page-content.ts
 var exports_get_sharepoint_site_onenote_page_content = {};
 __export(exports_get_sharepoint_site_onenote_page_content, {
-  schema: () => schema174,
-  meta: () => meta176,
-  execute: () => execute174
+  schema: () => schema175,
+  meta: () => meta177,
+  execute: () => execute175
 });
-var schema174 = exports_external.object({ siteId: exports_external.string().min(1), onenotePageId: exports_external.string().min(1) });
+var schema175 = exports_external.object({ siteId: exports_external.string().min(1), onenotePageId: exports_external.string().min(1) });
 var innerExecute = async (graph, params) => {
-  const parsed = schema174.safeParse(params);
+  const parsed = schema175.safeParse(params);
   if (!parsed.success)
     return err({ type: "validation_error", message: formatZodError(parsed.error) });
   return graph.getBinary(`/sites/${parsed.data.siteId}/onenote/pages/${parsed.data.onenotePageId}/content`);
 };
-var execute174 = wrapOnenote5kLimit(innerExecute);
-var meta176 = {
+var execute175 = wrapOnenote5kLimit(innerExecute);
+var meta177 = {
   summary: "Return the HTML content of a single OneNote page from a SharePoint site (parallel to `get-onenote-page-content` for `/me`). The response carries the standard `{contentType: text/html, size, text}` shape so the HTML body is available verbatim under either output format.",
   category: "notes",
   graphMethod: "GET",
@@ -28622,13 +28776,13 @@ var meta176 = {
 // src/use-cases/commands/list-drive-item-thumbnails.ts
 var exports_list_drive_item_thumbnails = {};
 __export(exports_list_drive_item_thumbnails, {
-  schema: () => schema175,
-  meta: () => meta177,
-  execute: () => execute175
+  schema: () => schema176,
+  meta: () => meta178,
+  execute: () => execute176
 });
 var baseSchema99 = exports_external.object({ driveId: exports_external.string().min(1), itemId: exports_external.string().min(1) });
-var { execute: execute175, schema: schema175 } = buildNoSkipListCommand((p) => `/drives/${p.driveId}/items/${p.itemId}/thumbnails`, baseSchema99);
-var meta177 = {
+var { execute: execute176, schema: schema176 } = buildNoSkipListCommand((p) => `/drives/${p.driveId}/items/${p.itemId}/thumbnails`, baseSchema99);
+var meta178 = {
   summary: "List thumbnail URLs (small / medium / large) for a OneDrive / SharePoint file. Each thumbnail set has pre-signed CDN URLs you can render in a UI without further auth.",
   category: "drive",
   graphMethod: "GET",
@@ -28658,20 +28812,20 @@ var meta177 = {
 // src/use-cases/commands/get-excel-used-range.ts
 var exports_get_excel_used_range = {};
 __export(exports_get_excel_used_range, {
-  schema: () => schema176,
-  meta: () => meta178,
-  execute: () => execute176
+  schema: () => schema177,
+  meta: () => meta179,
+  execute: () => execute177
 });
 var DEFAULT_MAX_CELLS2 = 50000;
-var schema176 = exports_external.object({
+var schema177 = exports_external.object({
   driveId: exports_external.string().min(1),
   itemId: exports_external.string().min(1),
   worksheetId: exports_external.string().min(1),
   full: exports_external.enum(["true", "false"]).optional(),
   maxCells: exports_external.string().regex(/^[1-9]\d*$/, "must be a positive integer").optional()
 });
-var execute176 = async (graph, params) => {
-  const parsed = schema176.safeParse(params);
+var execute177 = async (graph, params) => {
+  const parsed = schema177.safeParse(params);
   if (!parsed.success)
     return err({ type: "validation_error", message: formatZodError(parsed.error) });
   const { driveId, itemId, worksheetId } = parsed.data;
@@ -28706,7 +28860,7 @@ var execute176 = async (graph, params) => {
     projection: "slim"
   });
 };
-var meta178 = {
+var meta179 = {
   summary: 'Return the worksheet\'s used range — the bounding box of every non-empty cell — as a single Excel range. The CLI ships a slim default that strips the redundant `text` / `numberFormat` / `formulas` 2D arrays Graph returns (mostly `"General"` repeated cell-by-cell), keeping `address` / `rowCount` / `columnCount` / `values`. Pass `--full true` to return the raw four-array Graph shape. `--max-cells` (default 50 000) caps the size of the projected `values[]`; oversize ranges drop `values` and surface a hint pointing at `get-excel-range` for band-by-band reads. Avoids fetching the entire 1M × 16K-cell sheet when only a small data island is populated.',
   category: "excel",
   graphMethod: "GET",
@@ -28752,13 +28906,13 @@ var meta178 = {
 // src/use-cases/commands/list-rooms.ts
 var exports_list_rooms = {};
 __export(exports_list_rooms, {
-  schema: () => schema177,
-  meta: () => meta179,
-  execute: () => execute177
+  schema: () => schema178,
+  meta: () => meta180,
+  execute: () => execute178
 });
 var baseSchema100 = exports_external.object({}).strict();
-var { execute: execute177, schema: schema177 } = buildListCommand(() => "/places/microsoft.graph.room", baseSchema100);
-var meta179 = {
+var { execute: execute178, schema: schema178 } = buildListCommand(() => "/places/microsoft.graph.room", baseSchema100);
+var meta180 = {
   summary: "List bookable meeting rooms in the tenant. Each `room` has `displayName`, `emailAddress`, `capacity`, `building`, `floorNumber`, and `isWheelChairAccessible`. Use the `emailAddress` as a meeting `attendee` for room booking. Pass `--top 5` to limit the response — large tenants return tens of KB by default.",
   category: "calendar",
   graphMethod: "GET",
@@ -28773,13 +28927,13 @@ var meta179 = {
 // src/use-cases/commands/list-room-lists.ts
 var exports_list_room_lists = {};
 __export(exports_list_room_lists, {
-  schema: () => schema178,
-  meta: () => meta180,
-  execute: () => execute178
+  schema: () => schema179,
+  meta: () => meta181,
+  execute: () => execute179
 });
 var baseSchema101 = exports_external.object({}).strict();
-var { execute: execute178, schema: schema178 } = buildListCommand(() => "/places/microsoft.graph.roomList", baseSchema101);
-var meta180 = {
+var { execute: execute179, schema: schema179 } = buildListCommand(() => "/places/microsoft.graph.roomList", baseSchema101);
+var meta181 = {
   summary: "List room lists — usually one per building. Use these to scope a room search by location: a roomList groups the rooms in one office, then `/places/{roomList}/rooms` lists just those rooms. Pass `--top N` to limit the response on large tenants.",
   category: "calendar",
   graphMethod: "GET",
@@ -28794,13 +28948,13 @@ var meta180 = {
 // src/use-cases/commands/list-trending-insights.ts
 var exports_list_trending_insights = {};
 __export(exports_list_trending_insights, {
-  schema: () => schema179,
-  meta: () => meta181,
-  execute: () => execute179
+  schema: () => schema180,
+  meta: () => meta182,
+  execute: () => execute180
 });
 var baseSchema102 = exports_external.object({}).strict();
-var { execute: execute179, schema: schema179 } = buildListCommand(() => "/me/insights/trending", baseSchema102);
-var meta181 = {
+var { execute: execute180, schema: schema180 } = buildListCommand(() => "/me/insights/trending", baseSchema102);
+var meta182 = {
   summary: "List documents trending around the signed-in user — files popular in their working network (colleagues' recent edits, shares, opens). Microsoft's relevance ranking, useful for surfacing unfamiliar but related work.",
   category: "drive",
   graphMethod: "GET",
@@ -28872,6 +29026,7 @@ var commands = {
   "extract-sharepoint-links-in-mail": exports_extract_sharepoint_links_in_mail,
   "extract-sharepoint-links-in-documents": exports_extract_sharepoint_links_in_documents,
   "convert-mail-to-markdown": exports_convert_mail_to_markdown,
+  "create-forward-draft": exports_create_forward_draft,
   "create-mail-draft": exports_create_mail_draft,
   "create-reply-draft": exports_create_reply_draft,
   "update-mail-draft": exports_update_mail_draft,
@@ -28996,12 +29151,33 @@ var commands = {
 };
 
 // src/use-cases/commands/login.ts
-var schema180 = exports_external.object({}).strict();
-var execute180 = async (auth) => auth.getAccessToken();
+var schema181 = exports_external.object({}).strict();
+var execute181 = async (auth, options) => auth.getAccessToken(options);
+
+// src/use-cases/commands/login-status.ts
+var HINT3 = "basic/chatsvcagg/ic3 refresh automatically from the cached refresh token; the elevated (M365) token is re-captured only on an interactive login. Run `ask-marcel-office login --force` to refresh all four now.";
+var toView = (tier, refresh, reason) => {
+  const view = { available: tier.available, refresh };
+  if (tier.expiresInSeconds !== undefined)
+    view.expiresInSeconds = tier.expiresInSeconds;
+  if (reason !== undefined)
+    view.reason = reason;
+  return view;
+};
+var buildLoginStatus = (input) => ({
+  status: "authenticated",
+  tokens: {
+    basic: toView({ available: true, expiresInSeconds: input.basicExpiresInSeconds }, "automatic"),
+    elevated: toView(input.elevated, "interactive", input.elevatedFailureReason),
+    chatsvcagg: toView(input.chatsvcagg, "automatic"),
+    ic3: toView(input.ic3, "automatic")
+  },
+  hint: HINT3
+});
 
 // src/use-cases/commands/logout.ts
-var schema181 = exports_external.object({}).strict();
-var execute181 = async (auth) => auth.logout();
+var schema182 = exports_external.object({}).strict();
+var execute182 = async (auth) => auth.logout();
 
 // src/use-cases/commands/output-path.ts
 import { posix as posix3 } from "node:path";
@@ -29082,8 +29258,8 @@ var persistMediaIfRequested = async (fs, outputDir, data) => {
 // src/use-cases/commands/update.ts
 var PACKAGE = "ask-marcel-office-cli";
 var argsFor = (manager) => manager === "bun" ? ["add", "-g", `${PACKAGE}@latest`] : ["i", "-g", `${PACKAGE}@latest`];
-var schema182 = exports_external.object({}).strict();
-var execute182 = async (runner, manager) => {
+var schema183 = exports_external.object({}).strict();
+var execute183 = async (runner, manager) => {
   const result = await runner.runInherit(manager, argsFor(manager));
   if (!result.ok)
     return err({ type: "spawn_failed", message: result.error.message });
@@ -29243,28 +29419,33 @@ var buildCli = (deps) => {
     await writeOrPrintText(JSON.stringify(fullOrTerse), "application/json", "help-json");
   });
   program2.commandsGroup("Lifecycle:");
-  const loginCmd = program2.command("login").description("Authenticate against Microsoft Graph using the Teams web client (cached token → refresh → Playwright browser fallback).").action(async () => {
+  const loginCmd = program2.command("login").description("Authenticate against Microsoft Graph via the Teams web client (cached token → refresh → browser). Already signed in? Reports all four cached tokens (basic / elevated / chatsvcagg / ic3) with their time-left and refresh route; --force re-captures every token via the browser.").option("--force", "Ignore the cache and re-capture every token via the browser. The only way to refresh the elevated (M365) token while the basic token is still valid; the persistent browser profile is reused, so you are usually not re-prompted for credentials.").action(async () => {
+    const force = loginCmd.opts().force ?? false;
     const loginAuth = deps.makeLoginAuth ? deps.makeLoginAuth() : auth;
-    const result = await execute180(loginAuth);
+    const result = await execute181(loginAuth, { force });
     if (!result.ok) {
       fail(result.error.type === "auth_cancelled" ? "Authentication cancelled" : result.error.message);
       return;
     }
-    const outcome = loginAuth.getLastElevatedOutcome();
-    const envelope = { status: "authenticated" };
-    if (outcome !== null) {
-      if (outcome.captured) {
-        envelope.elevated = "captured";
-      } else {
-        envelope.elevated = "failed";
-        envelope.elevatedReason = outcome.reason;
-      }
+    const info = await graph.getCachedTokenInfo();
+    if (!info.ok) {
+      fail(info.error.message);
+      return;
     }
-    renderOut(envelope);
+    const outcome = loginAuth.getLastElevatedOutcome();
+    const elevatedFailureReason = outcome && !outcome.captured ? outcome.reason : undefined;
+    renderOut(buildLoginStatus({
+      basicExpiresInSeconds: info.value.expiresInSeconds,
+      elevated: info.value.elevated,
+      chatsvcagg: info.value.chatsvcagg,
+      ic3: info.value.ic3,
+      elevatedFailureReason
+    }));
   });
   loginCmd.addHelpText("after", [
     "",
-    "Example:       ask-marcel-office login   (opens a Playwright-driven Edge/Chrome window)",
+    "Examples:      ask-marcel-office login          (sign in the first time, or show all four token statuses if already signed in)",
+    "               ask-marcel-office login --force  (re-capture every token via the browser, ignoring the cache)",
     "Token cache:   ~/.ask-marcel/token-cache.json (access + refresh tokens, JSON, 0600).",
     "Browser data:  ~/.ask-marcel/browser-profile/ (Playwright persistent context).",
     "Scopes:        granted by Microsoft to the Teams web client (CLIENT_ID 5e3ce6c0-...);",
@@ -29274,7 +29455,7 @@ var buildCli = (deps) => {
   ].join(`
   `));
   const logoutCmd = program2.command("logout").description("Clear the cached Microsoft Graph token so the next command forces a fresh sign-in.").action(async () => {
-    const result = await execute181(auth);
+    const result = await execute182(auth);
     if (result.ok)
       renderOut({ status: "logged_out" });
     else
@@ -29290,7 +29471,7 @@ var buildCli = (deps) => {
   `));
   const updateCmd = program2.command("update").description("Re-install the latest published ask-marcel-office from npm, in place. Auto-detects whether you originally installed via npm or bun.").action(async () => {
     const manager = deps.packageManager ?? detectPackageManager(process.argv[1] ?? "");
-    const result = await execute182(processRunner, manager);
+    const result = await execute183(processRunner, manager);
     if (result.ok)
       renderOut({ status: "updated", via: manager });
     else if (result.error.type === "spawn_failed")