ask-marcel-office-cli 2.2.0 → 2.4.0

package/dist/infra/auth.d.ts

@@ -39,7 +39,9 @@ type AuthManager = {
      * `logicalPermissions` allow-list. Falls through cache → re-capture
      * via headless Playwright. Used by the 3 historical-version commands.
      */
-    getElevatedAccessToken: () => Promise<Result<AccessToken, AuthError>>;
+    getElevatedAccessToken: (options?: {
+        readonly awaitSignIn?: boolean;
+    }) => Promise<Result<AccessToken, AuthError>>;
     /**
      * Returns a Graph token issued by a PARTNER tenant's authority, for a user
      * who is a guest there. Without it, every call against that tenant's
@@ -54,7 +56,9 @@ type AuthManager = {
      * through cache → re-capture via headless Playwright. Used by the
      * `list-teams-chats-with-messages` family of commands.
      */
-    getChatsvcaggAccessToken: () => Promise<Result<AccessToken, AuthError>>;
+    getChatsvcaggAccessToken: (options?: {
+        readonly ignoreCache?: boolean;
+    }) => Promise<Result<AccessToken, AuthError>>;
     /**
      * Returns the regional segment used to construct chatsvcagg substrate
      * URLs (`teams.microsoft.com/api/csa/<region>/api/...`). Captured at
@@ -71,7 +75,17 @@ type AuthManager = {
      * via headless Playwright. Used by `list-teams-chat-history` to walk
      * paginated chat-message history beyond the 200-message chatsvcagg cap.
      */
-    getIc3AccessToken: () => Promise<Result<AccessToken, AuthError>>;
+    getIc3AccessToken: (options?: {
+        readonly ignoreCache?: boolean;
+    }) => Promise<Result<AccessToken, AuthError>>;
+    /**
+     * Redeem the shared refresh token for any COLD substrate tier, over HTTP, with
+     * no browser on any path. `login` calls this so a warm-cache sign-in leaves all
+     * four tiers usable; without it the two substrate tiers stay cold until some
+     * Teams-chat command pays for them, and `login` reports them missing while
+     * having done nothing about it.
+     */
+    warmSubstrateTokens?: () => Promise<void>;
     logout: () => Promise<Result<void, AuthError>>;
     /**
      * Inspect the elevated-capture outcome from the most recent
@@ -95,6 +109,16 @@ type AuthManager = {
      * Optional: only the real manager implements it; a minimal fake omits it
      * and callers treat that as unavailable. Never captures or refreshes.
      */
+    /**
+     * The cached BASIC token, decoded by `scopes-check` and never acquired: no
+     * refresh, no browser. The acquiring getter heals a dead session by opening
+     * a browser and, when the persistent profile is already signed in, wiping it
+     * so the grant re-fires (2026-09-02: a diagnostic did exactly that). A stale
+     * token comes back as-is so its expiry can be reported; no cache at all is
+     * `undefined`. Optional: a bring-your-own-token manager omits it and callers
+     * fall back to `getAccessToken`, which is then the caller's own function.
+     */
+    getCachedBasicToken?: () => Promise<AccessToken | undefined>;
     getCachedElevatedInfo?: () => Promise<CachedTierInfo>;
     /**
      * Same decode-only preflight as `getCachedElevatedInfo`, for the chatsvcagg /
@@ -120,7 +144,8 @@ type SecondaryTokenCommands = {
     readonly chatsvcagg: ReadonlyArray<string>;
     readonly ic3: ReadonlyArray<string>;
 };
-declare const createAuthManagerFromApi: (browserAuth: BrowserAuth, cachePath: string, browserProfileDir: string, logger: Logger, fs: FileSystem, recaptureSecondaryViaBrowser?: boolean, secondaryTokenCommands?: SecondaryTokenCommands, acquireBasicViaBrowser?: boolean) => AuthManager;
+type FetchFn = (url: string, init?: RequestInit) => Promise<Response>;
+declare const createAuthManagerFromApi: (browserAuth: BrowserAuth, cachePath: string, browserProfileDir: string, logger: Logger, fs: FileSystem, recaptureSecondaryViaBrowser?: boolean, secondaryTokenCommands?: SecondaryTokenCommands, acquireBasicViaBrowser?: boolean, recaptureElevatedViaBrowser?: boolean, fetchFn?: FetchFn) => AuthManager;
 /**
  * Probe the token cache for a fresh access token. Handed to the browser
  * capture so its poll loop can short-circuit the multi-minute dance
@@ -138,6 +163,7 @@ declare const createAuthManager: (deps: {
     recaptureSecondaryViaBrowser?: boolean;
     secondaryTokenCommands?: SecondaryTokenCommands;
     acquireBasicViaBrowser?: boolean;
+    recaptureElevatedViaBrowser?: boolean;
 }) => AuthManager;
 export { createAuthManager, createAuthManagerFromApi, createFreshCachedTokenProbe, stderrProgress };
 export type { AuthError, AuthManager, CachedTierInfo, ElevatedOutcome, SecondaryTokenCommands };

package/dist/infra/browser-auth.d.ts

@@ -115,8 +115,16 @@ type BrowserAuth = {
      * cached elevated token expires and the Teams session is already in
      * the cache (no fresh sign-in needed). On `login`, use
      * `acquireBothTokens` instead so the user sees only one browser.
+     *
+     * `awaitSignIn` says a human asked for this and is watching, so the capture
+     * gets the interactive `pollDeadlineMs` rather than the short silent cap:
+     * long enough for a slow redirect chain, and long enough to fill in a
+     * sign-in form if one appears. Without it the short cap applies and the
+     * capture fails fast, which is what a background command needs.
      */
-    acquireElevatedToken: () => Promise<ElevatedTokenResult>;
+    acquireElevatedToken: (options?: {
+        readonly awaitSignIn?: boolean;
+    }) => Promise<ElevatedTokenResult>;
     /**
      * Capture a chatsvcagg-audience bearer (Teams basic identity, but the
      * `chatsvcagg.teams.microsoft.com` resource instead of Graph) by
@@ -223,6 +231,12 @@ type BrowserAuthConfig = {
     readonly initialSettleMs?: number;
     readonly postReloginSettleMs?: number;
     readonly pollIntervalMs?: number;
+    /**
+     * How long to keep listening for the PREFERRED elevated identity after an
+     * acceptable-but-weaker one has already been captured. See
+     * `PREFERRED_ELEVATED_APP_ID`.
+     */
+    readonly elevatedPreferenceGraceMs?: number;
     readonly pollDeadlineMs?: number;
     readonly navigationTimeoutMs?: number;
     /**
@@ -234,6 +248,12 @@ type BrowserAuthConfig = {
      * the LLM tool-call window. With a tight cap, the flow either yields
      * a token quickly or fails with `auth_failed: elevated token capture
      * timed out — run `ask-marcel-office login` to refresh.`
+     *
+     * The cap applies only when nobody is waiting. A caller passing
+     * `awaitSignIn` (today just `login`) gets `pollDeadlineMs` instead, because
+     * a silent capture that merely runs SLOW would otherwise fail here and send
+     * `login` into the forced dance, whose cookie wipe costs the 90-day sign-in
+     * session and guarantees the next run prompts.
      */
     readonly elevatedRecaptureTimeoutMs?: number;
     /**

package/dist/presenter/output-text.d.ts

@@ -1,2 +1,2 @@
-declare const renderTextOutput: (data: unknown) => string;
+declare const renderTextOutput: (data: unknown, tenantId?: string) => string;
 export { renderTextOutput };

package/dist/presenter/output.d.ts

@@ -1,7 +1,7 @@
 import type { Logger } from '../use-cases/ports/logger.js';
 import type { ErrorSource } from './error-hints.js';
-import type { OutputFormat } from './render-to-string.js';
-declare const render: (data: unknown, logger: Logger, format: OutputFormat) => void;
+import type { OutputFormat, RenderContext } from './render-to-string.js';
+declare const render: (data: unknown, logger: Logger, format: OutputFormat, context?: RenderContext) => void;
 declare const renderError: (message: string, format: OutputFormat, errorCode?: string, explicitSource?: ErrorSource, retryAfterSeconds?: number) => void;
 export { render, renderError };
 export type { OutputFormat };

package/dist/presenter/render-to-string.d.ts

@@ -1,10 +1,50 @@
 import type { ErrorSource } from './error-hints.js';
 type OutputFormat = 'text' | 'json';
+/**
+ * Which front end the caller is on. It changes what a remedy can even BE: a
+ * terminal caller can redirect stdout to a file, an MCP client cannot (it has
+ * no shell), and the `--output-path` flag reaches MCP as an `outputPath` tool
+ * param rather than a flag.
+ */
+type RenderSurface = 'cli' | 'mcp';
+/**
+ * What the presenter needs in order to name a remedy the caller can actually
+ * use, and to render a follow-up command the caller can actually run. Built in
+ * composition (which owns the command manifest AND the invoked params); omitted
+ * by the renders that have no command behind them at all — the 548 KB
+ * `list-commands` manifest, a login summary, a logout status.
+ *
+ * 2026-07-23: the banner used to call `--output-path` a "universal remedy
+ * (works on every command)". It is not. Plain-JSON commands REFUSE the flag,
+ * and the two commands that trip the banner most often (`search-all-files`,
+ * `microsoft-search-query`) advertise only `--query` — so every remedy the
+ * banner named was a dead end there, and an agentic caller following it burned
+ * a call to find out.
+ */
+type RenderContext = {
+    readonly commandName: string;
+    /** `meta.producesBytes` — the manifest flag that decides whether --output-path is accepted. */
+    readonly producesBytes: boolean;
+    readonly supportsSelect: boolean;
+    readonly supportsTop: boolean;
+    readonly surface: RenderSurface;
+    /**
+     * The `--tenant-id` the call was made with, when it carried one. Unlike every
+     * field above it comes from the INVOCATION, not the manifest: a Graph cursor
+     * carries no tenant, so the footer is the only place the next call can learn
+     * which identity signed this page.
+     */
+    readonly tenantId?: string;
+};
 /**
  * Render a use-case success value to its final string, newline included.
  * `output.ts` writes this to stdout; `mcp.ts` returns it as tool content.
+ *
+ * `context` is what makes the oversized-response banner honest — pass it
+ * whenever a registry command produced the data. Omit it for the renders that
+ * have no command behind them; the banner then claims no flag-level remedy.
  */
-declare const renderToString: (data: unknown, format: OutputFormat) => string;
+declare const renderToString: (data: unknown, format: OutputFormat, context?: RenderContext) => string;
 /**
  * Render an error to its final string, newline included. The `hint` / `source`
  * lookup is shared with the CLI so an MCP consumer sees the same curated
@@ -12,4 +52,4 @@ declare const renderToString: (data: unknown, format: OutputFormat) => string;
  */
 declare const renderErrorToString: (message: string, format: OutputFormat, errorCode?: string, explicitSource?: ErrorSource, retryAfterSeconds?: number) => string;
 export { renderErrorToString, renderToString };
-export type { OutputFormat };
+export type { OutputFormat, RenderContext, RenderSurface };

package/dist/use-cases/commands/command-types.d.ts

@@ -5,10 +5,6 @@ type CommandSchema = z.ZodType;
 type CommandExecute = (graph: GraphClient, params: Record<string, string>) => Promise<Result<unknown, import('../../infra/graph-client.js').GraphError>>;
 type CommandCategory = 'drive' | 'excel' | 'sharepoint' | 'tasks' | 'mail' | 'notes' | 'user' | 'calendar' | 'chats' | 'teams' | 'meta' | 'lifecycle';
 type CommandHttpMethod = 'GET' | 'POST' | 'PATCH' | 'DELETE';
-type CommandOptionAlias = {
-    readonly name: string;
-    readonly key: string;
-};
 /**
  * Structured type-hint for a CLI flag value. Surfaces in `help-json` so an
  * LLM can avoid the trial-and-error of "is this an ID or a name?" prose
@@ -38,13 +34,6 @@ type CommandOptionMeta = {
      * commands accept but do not demand.
      */
     readonly required: boolean;
-    /**
-     * Optional secondary spellings of the same flag. Both the canonical
-     * `name` and every alias name are accepted on the command line; values
-     * passed under an alias are normalized to the canonical `key` before
-     * the schema runs. The canonical name is what `--help` shows first.
-     */
-    readonly aliases?: ReadonlyArray<CommandOptionAlias>;
     /**
      * Structured value-type hint for LLM consumers. Optional.
      */
@@ -80,14 +69,6 @@ type PaginationStrategy =
 type CommandMeta = {
     readonly summary: string;
     readonly category: CommandCategory;
-    /**
-     * Deprecated former command names kept working as commander-level aliases for
-     * back-compat after a rename (e.g. `download-onedrive-file-content` →
-     * `download-drive-item-content`). The canonical registry key is what `--help`
-     * and the manifest list first; each alias here is also accepted on the CLI and
-     * surfaced in the manifest so an LLM that learned the old name still resolves.
-     */
-    readonly commandAliases?: ReadonlyArray<string>;
     readonly graphMethod: CommandHttpMethod;
     readonly graphPathTemplate: string;
     readonly graphDocsUrl: string;
@@ -178,4 +159,4 @@ type Command = {
      */
     readonly executeLocal?: (fs: import('../ports/filesystem.js').FileSystem, params: Record<string, string>) => Promise<Result<unknown, import('../../infra/graph-client.js').GraphError>>;
 };
-export type { ArgumentHint, Command, CommandCategory, CommandExecute, CommandHttpMethod, CommandMeta, CommandOptionAlias, CommandOptionMeta, CommandPositionalArgumentMeta, CommandSchema, PaginationStrategy, };
+export type { ArgumentHint, Command, CommandCategory, CommandExecute, CommandHttpMethod, CommandMeta, CommandOptionMeta, CommandPositionalArgumentMeta, CommandSchema, PaginationStrategy, };

package/dist/use-cases/commands/create-forward-draft.d.ts

@@ -4,7 +4,7 @@ declare const schema: z.ZodObject<{
     forwardMessageId: z.ZodString;
     toRecipients: z.ZodString;
     ccRecipients: z.ZodOptional<z.ZodString>;
-    bodyContent: z.ZodString;
+    comment: z.ZodString;
     subject: z.ZodOptional<z.ZodString>;
     bodyContentType: z.ZodOptional<z.ZodEnum<{
         Text: "Text";

package/dist/use-cases/commands/create-reply-draft.d.ts

@@ -2,7 +2,7 @@ import { z } from 'zod';
 import type { Command, CommandMeta } from './command-types.js';
 declare const schema: z.ZodObject<{
     replyToMessageId: z.ZodString;
-    bodyContent: z.ZodString;
+    comment: z.ZodString;
     subject: z.ZodOptional<z.ZodString>;
     replyAll: z.ZodOptional<z.ZodEnum<{
         true: "true";

package/dist/use-cases/commands/docs-render.d.ts

@@ -3,7 +3,6 @@ export type CommandManifestEntry = {
     readonly name: string;
     readonly summary: string;
     readonly category: CommandCategory;
-    readonly commandAliases?: CommandMeta['commandAliases'];
     readonly graphMethod: CommandMeta['graphMethod'];
     readonly graphPathTemplate: string;
     readonly graphDocsUrl: string;

package/dist/use-cases/commands/docx-metadata.d.ts

@@ -4,7 +4,9 @@ import type { CustomProp, ExternalRel } from './ooxml-metadata.js';
 /**
  * Pulls the side-channel content out of a .docx zip — every text-bearing
  * surface mammoth drops on the floor: core / app / custom doc properties,
- * people registry, external hyperlinks, comments, tracked changes (ins + del),
+ * people registry, external hyperlinks, comments, tracked changes (replacements,
+ * the insertions and deletions that pair with nothing, moves, and run /
+ * paragraph formatting changes),
  * hidden text (w:vanish), text-box / shape text (w:txbxContent), header/footer
  * body prose, field instructions (MERGEFIELD / HYPERLINK / DOCVARIABLE), bookmarks.
  *
@@ -36,6 +38,28 @@ type TrackedChange = {
     readonly date: string;
     readonly text: string;
 };
+type Replacement = {
+    readonly deletionId: string;
+    readonly insertionId: string;
+    readonly author: string;
+    readonly date: string;
+    readonly before: string;
+    readonly after: string;
+};
+type Move = {
+    readonly name: string;
+    readonly author: string;
+    readonly date: string;
+    readonly text: string;
+    readonly halves: 'both' | 'from-only' | 'to-only';
+};
+type FormatChange = {
+    readonly scope: 'run' | 'paragraph';
+    readonly author: string;
+    readonly date: string;
+    readonly text: string;
+    readonly properties: ReadonlyArray<string>;
+};
 type Field = {
     readonly source: string;
     readonly instruction: string;
@@ -57,6 +81,12 @@ type DocxMetadata = {
     readonly comments: ReadonlyArray<Comment>;
     readonly insertions: ReadonlyArray<TrackedChange>;
     readonly deletions: ReadonlyArray<TrackedChange>;
+    /** A deletion and the insertion beside it, reported as the one edit they are. */
+    readonly replacements: ReadonlyArray<Replacement>;
+    /** Text moved elsewhere, joined by the range name that brackets both halves. */
+    readonly moves: ReadonlyArray<Move>;
+    /** Run or paragraph properties changed under revision marking. */
+    readonly formatChanges: ReadonlyArray<FormatChange>;
     readonly hiddenText: ReadonlyArray<string>;
     readonly textBoxes: ReadonlyArray<string>;
     readonly headersFooters: ReadonlyArray<HeaderFooter>;
@@ -66,4 +96,4 @@ type DocxMetadata = {
 };
 declare const extractDocxMetadata: (bytes: Uint8Array) => Promise<Result<DocxMetadata, GraphError>>;
 export { extractDocxMetadata };
-export type { Bookmark, Comment, CustomProp, DocxMetadata, ExternalRel, Field, HeaderFooter, Person, TrackedChange };
+export type { Bookmark, Comment, CustomProp, DocxMetadata, ExternalRel, Field, FormatChange, HeaderFooter, Move, Person, Replacement, TrackedChange };

package/dist/use-cases/commands/draft-comment-splicer.d.ts

@@ -21,9 +21,16 @@ declare const findBodyInsertStart: (html: string) => number;
  * silently dropping the real quoted history below.
  */
 declare const commentCarriesQuoteBoundary: (commentHtml: string) => boolean;
+/**
+ * True when a draft body still carries the quoted history Graph minted with it.
+ * Dispatches on the draft's own contentType: the HTML and plain-text boundary
+ * markers are different things entirely. Used to refuse a whole-body replace
+ * that would drop the quote (2026-07-23 bug report).
+ */
+declare const bodyCarriesQuote: (contentType: string, content: string) => boolean;
 /** The refusal copy for `commentCarriesQuoteBoundary`, named for the flag that carried it. */
 declare const boundaryMarkerRefusal: (flagName: string) => string;
 declare const insertCommentAboveQuote: (html: string, commentHtml: string) => SpliceResult;
 declare const replaceCommentAboveQuote: (html: string, commentHtml: string) => SpliceResult;
 declare const replacePlainTextCommentAboveQuote: (text: string, comment: string) => PlainTextSpliceResult;
-export { boundaryMarkerRefusal, commentCarriesQuoteBoundary, escapeTextAsHtml, findBodyInsertStart, insertCommentAboveQuote, replaceCommentAboveQuote, replacePlainTextCommentAboveQuote, };
+export { bodyCarriesQuote, boundaryMarkerRefusal, commentCarriesQuoteBoundary, escapeTextAsHtml, findBodyInsertStart, insertCommentAboveQuote, replaceCommentAboveQuote, replacePlainTextCommentAboveQuote, };

package/dist/use-cases/commands/include-hidden-folders.d.ts

@@ -0,0 +1,2 @@
+import type { CommandOptionMeta } from './command-types.js';
+export declare const INCLUDE_HIDDEN_FOLDERS_OPTION: CommandOptionMeta;

package/dist/use-cases/commands/list-mail-folder-messages-delta.d.ts

@@ -1,4 +1,12 @@
-import type { CommandMeta } from './command-types.js';
-declare const execute: import("./command-types.js").CommandExecute, schema: import("./command-types.js").CommandSchema;
+import { z } from 'zod';
+import type { Command, CommandMeta } from './command-types.js';
+declare const schema: z.ZodObject<{
+    mailFolderId: z.ZodString;
+    filter: z.ZodOptional<z.ZodString>;
+    select: z.ZodOptional<z.ZodString>;
+    top: z.ZodOptional<z.ZodString>;
+    expand: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+declare const execute: Command['execute'];
 declare const meta: CommandMeta;
 export { execute, meta, schema };

package/dist/use-cases/commands/list-shared-mailbox-child-folders.d.ts

@@ -0,0 +1,4 @@
+import type { CommandMeta } from './command-types.js';
+declare const execute: import("./command-types.js").CommandExecute, schema: import("./command-types.js").CommandSchema;
+declare const meta: CommandMeta;
+export { execute, meta, schema };

package/dist/use-cases/commands/list-shared-mailbox-folders.d.ts

@@ -0,0 +1,4 @@
+import type { CommandMeta } from './command-types.js';
+declare const execute: import("./command-types.js").CommandExecute, schema: import("./command-types.js").CommandSchema;
+declare const meta: CommandMeta;
+export { execute, meta, schema };

package/dist/use-cases/commands/login-status.d.ts

@@ -1,6 +1,8 @@
 type LoginSummary = {
     status: 'authenticated';
     available: ReadonlyArray<string>;
+    unlocked: Readonly<Record<string, string>>;
+    missing: Readonly<Record<string, string>>;
     hint: string;
 };
 type LoginSummaryInput = {

package/dist/use-cases/commands/login.d.ts

@@ -13,15 +13,25 @@ declare const schema: z.ZodObject<{}, z.core.$strict>;
  * loop with no exit: the command that needs elevated says "run login", login
  * says "authenticated", the command fails identically, forever.
  *
- * When elevated is confirmed missing we escalate through the SAME
- * `{ force: true }` rung the `--force` flag uses. That matters: the browser
- * adapter has its own `freshCachedToken` probe that short-circuits the dance
- * when a valid token is on disk, and only the forced path suppresses it — a
- * hand-rolled re-capture here would silently no-op (LESSONS 2026-07-13).
+ * When elevated is confirmed missing we try `getElevatedAccessToken` FIRST. It
+ * drives a silent SSO against the persistent browser profile and leaves cookies
+ * untouched, so the tenant's 90-day ESTSAUTHPERSISTENT session survives and the
+ * user sees a window flash rather than a sign-in page. The `{ force: true }`
+ * dance calls `context.clearCookies()` to make the OAuth grant re-fire for the
+ * BASIC token, and that wipe deletes ESTSAUTHPERSISTENT — which is why routing
+ * every elevated expiry through it produced a credential prompt each time, and
+ * then destroyed the very session the prompt had just established.
  *
- * Supersedes the 2026-07-13 decision that `login` is a slim confirmation and
- * `--force` the only re-capture mechanism: correct about the mechanism, but it
- * left the signpost pointing at a command that could not do the job.
+ * The silent route is not always available (expired profile cookies, a failed
+ * launch, a blocked navigation), so any failure falls back to the forced dance:
+ * it can prompt, but it polls for five minutes and a human can finish it.
+ *
+ * Supersedes the 2026-07-16 decision to escalate straight to `{ force: true }`.
+ * That entry feared a hand-rolled re-capture would no-op against the browser
+ * adapter's `freshCachedToken` probe; the probe lives in `acquireBothTokens`,
+ * not in `acquireElevatedToken`, and elevated freshness is decided upstream by
+ * `freshElevatedToken`. Verified live 2026-08-30: silent capture in 17s with no
+ * prompt, and the same call failing against a profile a forced login had wiped.
  */
 declare const execute: (auth: AuthManager, options?: {
     force?: boolean;

package/dist/use-cases/commands/next-page.d.ts

@@ -1,6 +1,7 @@
 import { z } from 'zod';
 import type { Command, CommandMeta } from './command-types.js';
 declare const schema: z.ZodObject<{
+    tenantId: z.ZodOptional<z.ZodString>;
     url: z.ZodString;
 }, z.core.$strip>;
 declare const execute: Command['execute'];

package/dist/use-cases/commands/ooxml-xml-walker.d.ts

@@ -17,6 +17,7 @@
 type XmlObject = Record<string, unknown>;
 declare const parseXml: (xml: string | undefined) => unknown;
 declare const findAll: (root: unknown, tagName: string) => ReadonlyArray<XmlObject>;
+declare const findAllLocal: (root: unknown, localName: string) => ReadonlyArray<XmlObject>;
 declare const textOf: (node: unknown) => string;
 declare const attrOf: (node: XmlObject, name: string) => string;
 /**
@@ -26,11 +27,35 @@ declare const attrOf: (node: XmlObject, name: string) => string;
  * flattens every match into a single string for "the visible text of this run".
  */
 declare const findAllTexts: (root: unknown, tagName: string) => ReadonlyArray<string>;
+declare const collectText: (node: unknown, tagName: string) => string;
+declare const collectTextLocal: (node: unknown, localName: string) => string;
 /**
- * Concatenate the text content of every element matching `tagName` inside `node`,
- * regardless of nesting depth. Used to flatten a `<w:p>` (or `<w:ins>` / `<w:comment>`)
- * down to its visible text by gathering every `<w:t>` (or `<w:delText>`) descendant.
+ * One element in the `preserveOrder` shape: its tag name, and the node itself
+ * (whose `[tag]` holds the ordered children and whose `:@` holds attributes).
  */
-declare const collectText: (node: unknown, tagName: string) => string;
-export { attrOf, collectText, findAll, findAllTexts, parseXml, textOf };
-export type { XmlObject };
+type OrderedNode = {
+    readonly tag: string;
+    readonly node: XmlObject;
+};
+declare const parseXmlOrdered: (xml: string | undefined) => unknown;
+/**
+ * Every sibling list in the tree, each in document order, elements only.
+ *
+ * Sibling lists rather than one flat stream: adjacency only means anything
+ * WITHIN a parent. A deletion ending one paragraph and an insertion opening the
+ * next are consecutive in a flat walk and unrelated in the document.
+ */
+declare const orderedSiblingGroups: (root: unknown) => ReadonlyArray<ReadonlyArray<OrderedNode>>;
+/**
+ * Every element in true document order, pre-order (an element, then what it
+ * contains). Unlike `orderedSiblingGroups`, which reports a whole sibling level
+ * before descending, this is the order the start tags appear in the file, which
+ * is what reading flat range markers requires: `<w:moveFromRangeStart>` opens a
+ * span that a later element sits inside without being its child.
+ */
+declare const orderedElements: (root: unknown) => ReadonlyArray<OrderedNode>;
+declare const orderedAttrOf: (node: XmlObject, name: string) => string;
+/** The `collectText` of the ordered shape: flatten every `tagName` descendant to one string. */
+declare const collectOrderedText: (node: XmlObject, tagName: string) => string;
+export { attrOf, collectOrderedText, collectText, collectTextLocal, findAll, findAllLocal, findAllTexts, orderedAttrOf, orderedElements, orderedSiblingGroups, parseXml, parseXmlOrdered, textOf, };
+export type { OrderedNode, XmlObject };

package/dist/use-cases/commands/pptx-comments.d.ts

@@ -1,16 +1,19 @@
 import type { OoxmlZip } from '../../infra/ooxml-zip-adapter.js';
 /**
  * PowerPoint comments come in two formats: legacy (`ppt/commentAuthors.xml`
- * authors by integer id + `ppt/comments/comment*.xml` `<p:cm authorId dt>`
- * with `<p:text>` body) and modern (`ppt/authors.xml` authors by GUID +
- * `ppt/comments/*.xml` `<p188:cm authorId created>` with DrawingML `<a:t>`
- * body). Both are scanned; authors are resolved by id in either scheme.
- * Modern-comment support is best-effort against the p188 (2018/8) schema.
+ * authors by integer id + `ppt/comments/comment*.xml` `<cm authorId dt>` with a
+ * `<text>` body) and modern (`ppt/authors.xml` authors by GUID +
+ * `ppt/comments/*.xml` `<cm authorId created>` with a DrawingML `<t>` body).
+ * Elements are matched by local name, so the prefixes a writer happens to bind
+ * (`p:` / `p188:` / `a:` from PowerPoint, anything else from a third-party tool)
+ * never decide whether a comment is found. Both generations share the local name
+ * `cm`, so one pass reads them all; authors are resolved by id in either scheme.
  */
 type CommentAuthor = {
     readonly id: string;
     readonly name: string;
     readonly initials: string;
+    readonly email: string;
 };
 type PptxComment = {
     readonly author: string;

package/dist/use-cases/commands/reject-unknown-params.d.ts

@@ -0,0 +1,16 @@
+import type { Result } from '../../domain/result.js';
+import type { GraphError } from '../../infra/graph-client.js';
+import type { Command } from './command-types.js';
+/**
+ * Returns the rejection for any param key the command does not declare, or
+ * `undefined` when every key is known. Exported for the registry wrapper.
+ */
+declare const rejectUnknownParams: (schema: Command["schema"], params: Record<string, string>) => Result<never, GraphError> | undefined;
+/**
+ * Wraps a command so `execute` / `executeLocal` refuse unknown params before
+ * running. Applied at registry assembly, which is the single choke point every
+ * surface passes through — including a library caller that never touches
+ * composition.
+ */
+declare const withUnknownParamRejection: (command: Command) => Command;
+export { rejectUnknownParams, withUnknownParamRejection };

package/dist/use-cases/commands/resolve-command.d.ts

@@ -1,17 +1,15 @@
 import type { Result } from '../../domain/result.js';
 import type { Command } from './command-types.js';
 /**
- * Name -> command lookup that also honours `meta.commandAliases`.
+ * Name -> command lookup shared by every non-commander front end.
  *
- * The CLI gets alias resolution for free from commander (`commandDef.alias(...)`
- * in `cli.ts`), so nothing needed this until a second front end appeared. The
- * MCP gateway has no commander, and its three command-taking tools
- * (`get-command-docs`, `run-command`, `run-write-command`) each need the same
- * lookup — Rule of Three, so it lives here rather than inline.
+ * The MCP gateway's three command-taking tools (`get-command-docs`,
+ * `run-command`, `run-write-command`) each need the same lookup — Rule of
+ * Three, so it lives here rather than inline.
  *
- * Returns the CANONICAL name alongside the command so every downstream concern
- * (docs rendering, the `mutates` read/write gate, error messages) keys off one
- * spelling regardless of which one the caller used.
+ * 2026-07-24: one name per command. Deprecated-name resolution
+ * (`meta.commandAliases`) was removed with the alias system; an old name gets
+ * the unknown-command rejection with the full list, same as any typo.
  */
 export type ResolveCommandError = {
     readonly type: 'unknown_command';

package/dist/use-cases/commands/search-onenote-pages.d.ts

@@ -1,7 +1,7 @@
 import { z } from 'zod';
 import type { Command, CommandMeta } from './command-types.js';
 declare const schema: z.ZodObject<{
-    titleSubstring: z.ZodString;
+    query: z.ZodString;
     select: z.ZodOptional<z.ZodString>;
     top: z.ZodOptional<z.ZodString>;
     skip: z.ZodOptional<z.ZodString>;

package/dist/use-cases/commands/token-tier-capability.d.ts

@@ -0,0 +1,5 @@
+declare const TIER_CAPABILITY: Readonly<Record<string, string>>;
+declare const OPTIONAL_TIERS: readonly ["elevated", "chatsvcagg", "ic3"];
+type OptionalTier = (typeof OPTIONAL_TIERS)[number];
+export { OPTIONAL_TIERS, TIER_CAPABILITY };
+export type { OptionalTier };

package/dist/use-cases/commands/update-mail-draft.d.ts

@@ -5,6 +5,10 @@ declare const schema: z.ZodObject<{
     subject: z.ZodOptional<z.ZodString>;
     bodyContent: z.ZodOptional<z.ZodString>;
     comment: z.ZodOptional<z.ZodString>;
+    replaceQuotedHistory: z.ZodOptional<z.ZodEnum<{
+        true: "true";
+        false: "false";
+    }>>;
     bodyContentType: z.ZodOptional<z.ZodEnum<{
         Text: "Text";
         HTML: "HTML";