powerautomate-mcp 0.5.3 → 0.6.0

package/dist/index.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { existsSync, mkdirSync, writeFileSync, lstatSync, statSync, readFileSync, unlinkSync, chmodSync, readdirSync } from 'fs';
+import { existsSync, readFileSync, mkdirSync, writeFileSync, lstatSync, statSync, unlinkSync, chmodSync, readdirSync } from 'fs';
 import { dirname, join } from 'path';
 import { platform, env } from 'process';
 import { homedir } from 'os';
@@ -381,20 +381,7 @@ Create the file with your Microsoft Entra app client ID and Power Automate envir
       err
     );
   }
-  const envClientId = env["PA_MCP_CLIENT_ID"];
-  if (envClientId) {
-    const UUID_RE3 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-    if (!UUID_RE3.test(envClientId)) {
-      throw new ConfigurationError(
-        `PA_MCP_CLIENT_ID is not a valid UUID: ${envClientId.substring(0, 50)}`
-      );
-    }
-    parsed.auth = {
-      ...parsed.auth ?? {},
-      clientId: envClientId
-    };
-    logger.info("Using client ID from PA_MCP_CLIENT_ID environment variable");
-  }
+  parsed = interpolateEnvVars(parsed);
   try {
     const config = validateConfig(parsed);
     logger.info(
@@ -423,12 +410,34 @@ function resolveEnvironment(config, envNameOrId) {
       displayName: envConfig.displayName
     };
   }
-  return {
-    name: "unknown",
-    id: "",
-    region: "unitedstates",
-    displayName: void 0
-  };
+  {
+    throw new ConfigurationError(
+      `Environment "${envKey}" not found in configuration. Available environments: ${Object.keys(config.environments).filter((k) => k !== "default").join(", ") || "(none)"}`
+    );
+  }
+}
+function interpolateEnvVars(value) {
+  if (typeof value === "string") {
+    return value.replace(/\$\{([^}]+)\}/g, (_match, varName) => {
+      const envValue = env[varName];
+      if (envValue === void 0) {
+        logger.warn({ varName }, "Environment variable referenced in config is not set");
+        return "";
+      }
+      return envValue;
+    });
+  }
+  if (Array.isArray(value)) {
+    return value.map(interpolateEnvVars);
+  }
+  if (value !== null && typeof value === "object") {
+    const result = {};
+    for (const [key, val] of Object.entries(value)) {
+      result[key] = interpolateEnvVars(val);
+    }
+    return result;
+  }
+  return value;
 }
 
 // src/utils/security.ts
@@ -1126,12 +1135,12 @@ var FlowManagementApi = class {
       throw new ApiError(`${context}: API error`, statusCode, errorDetails);
     }
     if (!responseText) {
-      return {};
+      return { value: [] };
     }
     return JSON.parse(responseText);
   }
   /**
-   * List flows in an environment
+   * List flows in an environment with optional pagination support
    */
   async listFlows(options = {}) {
     const envId = options.environment ?? this.defaultEnvironmentId;
@@ -1154,8 +1163,8 @@ var FlowManagementApi = class {
         response,
         "List flows"
       );
-      apiLogger.info({ count: data.value.length }, "Listed flows");
-      return data.value;
+      apiLogger.info({ count: data.value.length, hasMore: !!data.nextLink }, "Listed flows");
+      return { flows: data.value, nextLink: data.nextLink };
     }, "List flows");
   }
   /**
@@ -1448,9 +1457,13 @@ var FlowManagementApi = class {
     const safeFlowId = validateRowId(flowId);
     const safeRunId = validateRowId(runId);
     apiLogger.info({ flowId: safeFlowId, runId: safeRunId, envId }, "Resubmitting flow run");
+    const flow = await this.getFlow(safeFlowId, envId);
+    const triggers = flow.properties.definition?.triggers ?? {};
+    const triggerName = Object.keys(triggers)[0] ?? "manual";
+    apiLogger.debug({ flowId: safeFlowId, triggerName }, "Using trigger name for resubmit");
     const url = this.buildUrl(
       envId,
-      `/flows/${safeFlowId}/triggers/manual/histories/${safeRunId}/resubmit`
+      `/flows/${safeFlowId}/triggers/${triggerName}/histories/${safeRunId}/resubmit`
     );
     const headers = await this.getAuthHeaders();
     return wrapApiCall(async () => {
@@ -1549,7 +1562,7 @@ var FlowManagementApi = class {
    */
   async listApprovals(environmentId, top) {
     const envId = environmentId ?? this.defaultEnvironmentId;
-    const limit = top ?? 25;
+    const limit = Math.min(top ?? 25, MAX_PAGE_SIZE);
     apiLogger.debug({ envId, limit }, "Listing approvals");
     const url = this.buildUrl(envId, "/approvals", { $top: limit });
     const headers = await this.getAuthHeaders();
@@ -1631,6 +1644,12 @@ var ConnectorMetadataApi = class {
    */
   async handleResponse(response, context) {
     const { statusCode, body } = response;
+    if (statusCode === 429) {
+      await body.text();
+      const retryAfter = response.headers["retry-after"];
+      const retryMs = retryAfter ? parseInt(String(retryAfter), 10) * 1e3 : void 0;
+      throw new RateLimitError(retryMs);
+    }
     const MAX_RESPONSE_SIZE = 50 * 1024 * 1024;
     const chunks = [];
     let totalSize = 0;
@@ -1965,6 +1984,12 @@ var GraphApi = class {
    */
   async handleBinaryResponse(response, context) {
     const { statusCode, body, headers } = response;
+    if (statusCode === 429) {
+      await body.text();
+      const retryAfter = response.headers["retry-after"];
+      const retryMs = retryAfter ? parseInt(String(retryAfter), 10) * 1e3 : void 0;
+      throw new RateLimitError(retryMs);
+    }
     if (statusCode >= 400) {
       const responseText = await body.text();
       graphLogger.error({ statusCode, context }, "Graph API binary response error");
@@ -1993,6 +2018,12 @@ var GraphApi = class {
   }
   async handleResponse(response, context) {
     const { statusCode, body } = response;
+    if (statusCode === 429) {
+      await body.text();
+      const retryAfter = response.headers["retry-after"];
+      const retryMs = retryAfter ? parseInt(String(retryAfter), 10) * 1e3 : void 0;
+      throw new RateLimitError(retryMs);
+    }
     const MAX_RESPONSE_SIZE = 50 * 1024 * 1024;
     const chunks = [];
     let totalSize = 0;
@@ -2015,7 +2046,7 @@ var GraphApi = class {
       throw new ApiError(`${context}: Graph API error`, statusCode, errorDetails);
     }
     if (!responseText) {
-      return {};
+      return { value: [] };
     }
     return JSON.parse(responseText);
   }
@@ -3262,6 +3293,12 @@ var DataverseApi = class {
    */
   async handleResponse(response, context) {
     const { statusCode, body } = response;
+    if (statusCode === 429) {
+      await body.text();
+      const retryAfter = response.headers["retry-after"];
+      const retryMs = retryAfter ? parseInt(String(retryAfter), 10) * 1e3 : void 0;
+      throw new RateLimitError(retryMs);
+    }
     const MAX_RESPONSE_SIZE = 50 * 1024 * 1024;
     const chunks = [];
     let totalSize = 0;
@@ -3287,7 +3324,7 @@ var DataverseApi = class {
       throw new ApiError(`${context}: API error`, statusCode, errorDetails);
     }
     if (!responseText) {
-      return {};
+      return { value: [] };
     }
     return JSON.parse(responseText);
   }
@@ -4080,6 +4117,7 @@ var SchemaCache = class {
 };
 var listFlowsInputSchema = z.object({
   environment: z.string().optional().describe("Environment name or GUID. Uses default if omitted."),
+  search: z.string().optional().describe("Search flows by display name (case-insensitive substring match). Applied client-side after fetching."),
   filter: z.string().optional().describe(`OData filter expression (e.g., "properties/state eq 'Started'")`),
   top: z.number().min(1).max(250).optional().describe("Maximum number of results to return (default 50, max 250)")
 });
@@ -4093,6 +4131,10 @@ var listFlowsTool = {
         type: "string",
         description: "Environment name or GUID. Uses default if omitted."
       },
+      search: {
+        type: "string",
+        description: "Search flows by display name (case-insensitive substring match)."
+      },
       filter: {
         type: "string",
         description: `OData filter expression (e.g., "properties/state eq 'Started'")`
@@ -4117,11 +4159,16 @@ async function handleListFlows(api, input) {
       return `Invalid filter: ${err instanceof Error ? err.message : "Filter contains disallowed patterns"}`;
     }
   }
-  const flows = await api.listFlows({
+  const result = await api.listFlows({
     environment: parsed.environment,
     filter: safeFilter,
     top: parsed.top ?? 50
   });
+  let flows = result.flows;
+  if (parsed.search) {
+    const needle = parsed.search.toLowerCase();
+    flows = flows.filter((f) => f.properties.displayName.toLowerCase().includes(needle));
+  }
   if (flows.length === 0) {
     return "No flows found";
   }
@@ -4131,6 +4178,10 @@ async function handleListFlows(api, input) {
     const modified = new Date(flow.properties.lastModifiedTime).toLocaleDateString();
     lines.push(`  ${state} ${flow.properties.displayName} (${flow.name}) - ${modified}`);
   }
+  if (result.nextLink) {
+    lines.push(`
+(More flows available \u2014 use skipToken for next page)`);
+  }
   return lines.join("\n");
 }
 var getFlowInputSchema = z.object({
@@ -4659,37 +4710,7 @@ function validateActions(actions, result) {
   for (const [name, action] of Object.entries(actions)) {
     validateAction(action, `actions.${name}`, actionNames, result);
   }
-  const visited = /* @__PURE__ */ new Set();
-  const visiting = /* @__PURE__ */ new Set();
-  const detectCycle = (actionName, stack = []) => {
-    if (visiting.has(actionName)) {
-      return [...stack, actionName];
-    }
-    if (visited.has(actionName)) {
-      return null;
-    }
-    visiting.add(actionName);
-    stack.push(actionName);
-    const action = actions[actionName];
-    if (action?.runAfter) {
-      for (const depName of Object.keys(action.runAfter)) {
-        if (actionNames.has(depName)) {
-          const cycle = detectCycle(depName, stack);
-          if (cycle) return cycle;
-        }
-      }
-    }
-    visiting.delete(actionName);
-    visited.add(actionName);
-    return null;
-  };
-  for (const actionName of actionNames) {
-    const cycle = detectCycle(actionName);
-    if (cycle) {
-      addError(result, "actions", `Circular dependency detected: ${cycle.join(" -> ")}`);
-      break;
-    }
-  }
+  detectCircularDependencies(actions, actionNames, "actions", result);
 }
 function validateAction(action, path, allActions, result) {
   if (!action.type) {
@@ -4761,36 +4782,70 @@ function validateConnectorAction(action, path, result) {
     addError(result, `${path}.inputs.host.operationId`, "Missing operation ID");
   }
 }
-function validateConditionAction(action, path, allActions, result) {
+function validateNestedActions(actions, path, result) {
+  const localScope = new Set(Object.keys(actions));
+  for (const [name, subAction] of Object.entries(actions)) {
+    validateAction(subAction, `${path}.${name}`, localScope, result);
+  }
+  detectCircularDependencies(actions, localScope, path, result);
+}
+function detectCircularDependencies(actions, actionNames, path, result) {
+  const visited = /* @__PURE__ */ new Set();
+  const visiting = /* @__PURE__ */ new Set();
+  const detectCycle = (actionName, stack = []) => {
+    if (visiting.has(actionName)) {
+      return [...stack, actionName];
+    }
+    if (visited.has(actionName)) {
+      return null;
+    }
+    visiting.add(actionName);
+    stack.push(actionName);
+    const action = actions[actionName];
+    if (action?.runAfter) {
+      for (const depName of Object.keys(action.runAfter)) {
+        if (actionNames.has(depName)) {
+          const cycle = detectCycle(depName, stack);
+          if (cycle) return cycle;
+        }
+      }
+    }
+    visiting.delete(actionName);
+    visited.add(actionName);
+    return null;
+  };
+  for (const actionName of actionNames) {
+    const cycle = detectCycle(actionName);
+    if (cycle) {
+      addError(result, path, `Circular dependency detected: ${cycle.join(" -> ")}`);
+      break;
+    }
+  }
+}
+function validateConditionAction(action, path, _allActions, result) {
   if (!action.expression) {
     addError(result, `${path}.expression`, "Condition action must have an expression");
   }
   if (!action.actions || Object.keys(action.actions).length === 0) {
     addWarning(result, `${path}.actions`, "Condition 'if true' branch has no actions");
   } else {
-    for (const [name, subAction] of Object.entries(action.actions)) {
-      validateAction(subAction, `${path}.actions.${name}`, allActions, result);
-    }
+    validateNestedActions(action.actions, `${path}.actions`, result);
   }
   if (action.else?.actions) {
-    for (const [name, subAction] of Object.entries(action.else.actions)) {
-      validateAction(subAction, `${path}.else.actions.${name}`, allActions, result);
-    }
+    validateNestedActions(action.else.actions, `${path}.else.actions`, result);
   }
 }
-function validateForeachAction(action, path, allActions, result) {
+function validateForeachAction(action, path, _allActions, result) {
   if (!action.foreach) {
     addError(result, `${path}.foreach`, "Foreach action must have a foreach expression");
   }
   if (!action.actions || Object.keys(action.actions).length === 0) {
     addWarning(result, `${path}.actions`, "Foreach loop has no actions");
   } else {
-    for (const [name, subAction] of Object.entries(action.actions)) {
-      validateAction(subAction, `${path}.actions.${name}`, allActions, result);
-    }
+    validateNestedActions(action.actions, `${path}.actions`, result);
   }
 }
-function validateSwitchAction(action, path, allActions, result) {
+function validateSwitchAction(action, path, _allActions, result) {
   if (!action.expression) {
     addError(result, `${path}.expression`, "Switch action must have an expression");
   }
@@ -4799,37 +4854,29 @@ function validateSwitchAction(action, path, allActions, result) {
   } else {
     for (const [caseName, caseData] of Object.entries(action.cases)) {
       if (caseData.actions) {
-        for (const [name, subAction] of Object.entries(caseData.actions)) {
-          validateAction(subAction, `${path}.cases.${caseName}.actions.${name}`, allActions, result);
-        }
+        validateNestedActions(caseData.actions, `${path}.cases.${caseName}.actions`, result);
       }
     }
   }
   if (action.default?.actions) {
-    for (const [name, subAction] of Object.entries(action.default.actions)) {
-      validateAction(subAction, `${path}.default.actions.${name}`, allActions, result);
-    }
+    validateNestedActions(action.default.actions, `${path}.default.actions`, result);
   }
 }
-function validateScopeAction(action, path, allActions, result) {
+function validateScopeAction(action, path, _allActions, result) {
   if (!action.actions || Object.keys(action.actions).length === 0) {
     addWarning(result, `${path}.actions`, "Scope has no actions");
   } else {
-    for (const [name, subAction] of Object.entries(action.actions)) {
-      validateAction(subAction, `${path}.actions.${name}`, allActions, result);
-    }
+    validateNestedActions(action.actions, `${path}.actions`, result);
   }
 }
-function validateUntilAction(action, path, allActions, result) {
+function validateUntilAction(action, path, _allActions, result) {
   if (!action.expression) {
     addError(result, `${path}.expression`, "Until action must have an expression");
   }
   if (!action.actions || Object.keys(action.actions).length === 0) {
     addWarning(result, `${path}.actions`, "Until loop has no actions");
   } else {
-    for (const [name, subAction] of Object.entries(action.actions)) {
-      validateAction(subAction, `${path}.actions.${name}`, allActions, result);
-    }
+    validateNestedActions(action.actions, `${path}.actions`, result);
   }
 }
 
@@ -4963,6 +5010,7 @@ var KNOWN_FUNCTIONS = /* @__PURE__ */ new Set([
   "uriScheme"
 ]);
 var EXPRESSION_REGEX = /@\{([^}]+)\}/g;
+var BARE_EXPRESSION_REGEX = /@((?:triggerBody|triggerOutputs|outputs|body|items|variables|parameters|workflow|result|actionOutputs|actionBody|trigger|actions|concat|toLower|toUpper|trim|substring|replace|split|length|contains|startsWith|endsWith|indexOf|lastIndexOf|first|last|take|skip|join|createArray|union|intersection|empty|if|and|or|not|equals|greater|greaterOrEquals|less|lessOrEquals|coalesce|int|float|string|bool|json|xml|array|add|sub|mul|div|mod|max|min|utcNow|addDays|addHours|addMinutes|addSeconds|formatDateTime|guid|base64|encodeUriComponent|decodeUriComponent)\s*\(.*\))/g;
 function extractExpressions(text) {
   const expressions = [];
   let match;
@@ -4970,6 +5018,10 @@ function extractExpressions(text) {
     if (match[1]) expressions.push(match[1]);
   }
   EXPRESSION_REGEX.lastIndex = 0;
+  while ((match = BARE_EXPRESSION_REGEX.exec(text)) !== null) {
+    if (match[1]) expressions.push(match[1]);
+  }
+  BARE_EXPRESSION_REGEX.lastIndex = 0;
   return expressions;
 }
 function validateExpression(expression, path) {
@@ -5255,7 +5307,7 @@ function checkBestPractices(definition) {
     const type = actionObj.type;
     if (type === "Http" || type === "ApiConnection") {
       const inputs = actionObj.inputs;
-      const retryPolicy = actionObj.retryPolicy;
+      const retryPolicy = inputs?.retryPolicy ?? actionObj.retryPolicy;
       if (!retryPolicy || retryPolicy.type === "none") {
         issues.push({
           severity: "suggestion",
@@ -5452,12 +5504,12 @@ var triggerSchema = z.object({
     startTime: z.string().optional(),
     timeZone: z.string().optional()
   }).optional().describe("Recurrence settings for scheduled triggers")
-});
+}).passthrough();
 var actionSchema = z.object({
   type: z.string().describe("Action type"),
   inputs: z.unknown().optional().describe("Action inputs - can be object, string, array, or any value"),
   runAfter: z.record(z.array(z.enum(["Succeeded", "Failed", "Skipped", "TimedOut"]))).optional().describe("Dependencies")
-});
+}).passthrough();
 var connectionRefSchema = z.object({
   connectionName: z.string().describe("Connection name in the environment"),
   id: z.string().describe("Connection resource ID"),
@@ -5656,12 +5708,12 @@ var triggerSchema2 = z.object({
     startTime: z.string().optional(),
     timeZone: z.string().optional()
   }).optional()
-});
+}).passthrough();
 var actionSchema2 = z.object({
   type: z.string(),
   inputs: z.unknown().optional(),
   runAfter: z.record(z.array(z.enum(["Succeeded", "Failed", "Skipped", "TimedOut"]))).optional()
-});
+}).passthrough();
 var connectionRefSchema2 = z.object({
   connectionName: z.string(),
   id: z.string(),
@@ -13525,7 +13577,8 @@ function formatEnvironmentDetails(env2) {
   };
 }
 async function getEnvironmentSummary(context, environmentId) {
-  const flows = await context.api.listFlows({ environment: environmentId });
+  const result = await context.api.listFlows({ environment: environmentId });
+  const flows = result.flows;
   const flowStats = {
     total: flows.length,
     started: flows.filter((f) => f.properties.state === "Started").length,
@@ -14097,6 +14150,122 @@ function getPrompt(name, args) {
       return null;
   }
 }
+var PACKAGE_NAME = "powerautomate-mcp";
+var REGISTRY_URL = `https://registry.npmjs.org/${PACKAGE_NAME}/latest`;
+var CHECK_TIMEOUT_MS = 5e3;
+function getInstalledVersion() {
+  try {
+    let dir = dirname(fileURLToPath(import.meta.url));
+    for (let i = 0; i < 5; i++) {
+      const candidate = join(dir, "package.json");
+      if (existsSync(candidate)) {
+        const pkg = JSON.parse(readFileSync(candidate, "utf-8"));
+        if (pkg.name === PACKAGE_NAME && pkg.version) {
+          return pkg.version;
+        }
+      }
+      const parent = dirname(dir);
+      if (parent === dir) break;
+      dir = parent;
+    }
+    return "0.0.0";
+  } catch {
+    return "0.0.0";
+  }
+}
+async function checkForUpdate() {
+  const currentVersion = getInstalledVersion();
+  try {
+    const { statusCode, body } = await request(REGISTRY_URL, {
+      method: "GET",
+      headers: { accept: "application/json" },
+      signal: AbortSignal.timeout(CHECK_TIMEOUT_MS)
+    });
+    if (statusCode !== 200) {
+      await body.text();
+      return null;
+    }
+    const data = await body.json();
+    const latestVersion = data.version;
+    if (!latestVersion) return null;
+    return {
+      currentVersion,
+      latestVersion,
+      updateAvailable: compareVersions(latestVersion, currentVersion) > 0
+    };
+  } catch (err) {
+    logger.debug({ err }, "Update check failed (non-fatal)");
+    return null;
+  }
+}
+function compareVersions(a, b) {
+  const pa = a.split(".").map(Number);
+  const pb = b.split(".").map(Number);
+  for (let i = 0; i < 3; i++) {
+    const diff = (pa[i] ?? 0) - (pb[i] ?? 0);
+    if (diff !== 0) return diff;
+  }
+  return 0;
+}
+function getUpdateCommand() {
+  const npmExecPath = process.env["npm_execpath"] ?? "";
+  const npmCommand = process.env["npm_command"] ?? "";
+  if (npmExecPath.includes("npx") || npmCommand === "exec") {
+    return { cmd: "npx", args: [`${PACKAGE_NAME}@latest`] };
+  }
+  if (npmExecPath.includes("yarn")) {
+    return { cmd: "yarn", args: ["global", "add", PACKAGE_NAME] };
+  }
+  if (npmExecPath.includes("pnpm")) {
+    return { cmd: "pnpm", args: ["add", "-g", PACKAGE_NAME] };
+  }
+  return { cmd: "npm", args: ["install", "-g", PACKAGE_NAME] };
+}
+async function runSelfUpdate() {
+  const info = await checkForUpdate();
+  if (info === null) {
+    console.error("Could not reach npm registry. Check your internet connection.");
+    process.exit(1);
+  }
+  if (!info.updateAvailable) {
+    console.error(`Already up to date (v${info.currentVersion}).`);
+    process.exit(0);
+  }
+  console.error(`Updating ${PACKAGE_NAME}: v${info.currentVersion} \u2192 v${info.latestVersion}`);
+  const { cmd, args } = getUpdateCommand();
+  console.error(`Running: ${cmd} ${args.join(" ")}`);
+  return new Promise((_resolve) => {
+    const child = execFile(cmd, args, { timeout: 12e4 }, (error, stdout, stderr) => {
+      if (error) {
+        console.error(`
+Update failed: ${error.message}`);
+        if (stderr) console.error(stderr);
+        console.error(`
+You can update manually: npm install -g ${PACKAGE_NAME}`);
+        process.exit(1);
+      }
+      if (stdout) console.error(stdout.trim());
+      console.error(`
+Updated to v${info.latestVersion} successfully.`);
+      process.exit(0);
+    });
+    child.stdout?.pipe(process.stderr);
+    child.stderr?.pipe(process.stderr);
+  });
+}
+function backgroundUpdateCheck() {
+  checkForUpdate().then((info) => {
+    if (info?.updateAvailable) {
+      console.error(
+        `
+  Update available: v${info.currentVersion} \u2192 v${info.latestVersion}
+  Run: powerautomate-mcp --update
+`
+      );
+    }
+  }).catch(() => {
+  });
+}
 
 // src/server.ts
 async function createMcpServer(serverConfig) {
@@ -14176,7 +14345,7 @@ async function createMcpServer(serverConfig) {
   const server = new Server(
     {
       name: "powerautomate-mcp",
-      version: "0.5.3"
+      version: getInstalledVersion()
     },
     {
       capabilities: {
@@ -14190,8 +14359,8 @@ async function createMcpServer(serverConfig) {
     logger.debug("Listing tools");
     return { tools };
   });
-  server.setRequestHandler(CallToolRequestSchema, async (request7) => {
-    const { name, arguments: args } = request7.params;
+  server.setRequestHandler(CallToolRequestSchema, async (request8) => {
+    const { name, arguments: args } = request8.params;
     logger.info({ tool: name }, "Tool called");
     if (args && !checkObjectDepth(args, 20)) {
       return {
@@ -14219,8 +14388,8 @@ async function createMcpServer(serverConfig) {
     const resources = await listAllResources(resourceContext);
     return { resources };
   });
-  server.setRequestHandler(ReadResourceRequestSchema, async (request7) => {
-    const { uri } = request7.params;
+  server.setRequestHandler(ReadResourceRequestSchema, async (request8) => {
+    const { uri } = request8.params;
     logger.info({ uri }, "Reading resource");
     const result = await readResource(resourceContext, uri);
     if (!result) {
@@ -14232,8 +14401,8 @@ async function createMcpServer(serverConfig) {
     logger.debug("Listing prompts");
     return { prompts };
   });
-  server.setRequestHandler(GetPromptRequestSchema, async (request7) => {
-    const { name, arguments: args } = request7.params;
+  server.setRequestHandler(GetPromptRequestSchema, async (request8) => {
+    const { name, arguments: args } = request8.params;
     logger.info({ prompt: name }, "Getting prompt");
     const result = getPrompt(name, args ?? {});
     if (!result) {
@@ -14335,8 +14504,9 @@ function checkObjectDepth(obj, maxDepth, current = 0) {
   return true;
 }
 async function createDeviceCodeAuthProvider(config, silentOnly = false) {
-  const { clientId, cachePath } = config;
-  const authority = DEFAULT_AUTHORITY;
+  const { clientId, tenantId, cachePath } = config;
+  const validatedTenantId = tenantId ? validateTenantId(tenantId) : null;
+  const authority = validatedTenantId ? `https://login.microsoftonline.com/${validatedTenantId}` : DEFAULT_AUTHORITY;
   const cachePlugin = await createPersistentCachePlugin(cachePath);
   const msalConfig = {
     auth: {
@@ -14481,7 +14651,9 @@ async function createDeviceCodeAuthProvider(config, silentOnly = false) {
 }
 async function createAuthProviderFromConfig2(clientId, tenantId, cachePath, silentOnly = false) {
   const config = {
-    clientId};
+    clientId,
+    tenantId: tenantId ?? null
+  };
   return createDeviceCodeAuthProvider(config, silentOnly);
 }
 
@@ -14533,6 +14705,7 @@ function getDefaultEnvironment(environments) {
 }
 
 // src/setup/published-app.ts
+var PUBLISHED_APP_CLIENT_ID = "20ae33ee-6743-4786-9b00-8eb7bfebfd11";
 var APP_DISPLAY_NAME = "Power Automate MCP";
 var REDIRECT_URI = "https://login.microsoftonline.com/common/oauth2/nativeclient";
 var REQUIRED_RESOURCE_ACCESS = [
@@ -14547,10 +14720,8 @@ var REQUIRED_RESOURCE_ACCESS = [
   {
     resourceAppId: "7df0a125-d3be-4c96-aa54-591f83ff541c",
     resourceAccess: [
-      { id: "e45c5562-459d-4d1b-8148-83eb1b6dcf83", type: "Scope" },
-      { id: "30b2d850-00c3-4802-b7ae-ece9af9de5c6", type: "Scope" },
-      { id: "822a9cde-503a-472d-a530-d1dc9cd0d52b", type: "Scope" },
-      { id: "d05743e4-fb24-4dff-8a33-0f6c73c964bd", type: "Scope" }
+      { id: "e07c4438-06fe-4349-9077-b8ab4e888e21", type: "Scope" },
+      { id: "f3a53f5e-1975-4e99-8c6e-c6a0dfac61f6", type: "Scope" }
     ]
   },
   {
@@ -14638,8 +14809,6 @@ async function createAppRegistration(displayName) {
     "false",
     "--enable-id-token-issuance",
     "false",
-    "--is-fallback-public-client",
-    "true",
     "--public-client-redirect-uris",
     REDIRECT_URI,
     "--required-resource-accesses",
@@ -14737,82 +14906,75 @@ function clearTokenCache() {
   return { cleared: files.length > 0, files };
 }
 var UUID_RE2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-function readExistingClientId() {
+function readExistingAuthConfig() {
   try {
     const configPath = getConfigPath();
-    if (!existsSync(configPath)) return null;
+    if (!existsSync(configPath)) return { clientId: null, tenantId: null };
     const raw = readFileSync(configPath, "utf-8");
     const parsed = JSON.parse(raw);
-    const id = parsed?.auth?.clientId;
-    if (id && UUID_RE2.test(id)) return id;
-    return null;
+    const clientId = parsed?.auth?.clientId;
+    const tenantId = parsed?.auth?.tenantId;
+    return {
+      clientId: clientId && UUID_RE2.test(clientId) ? clientId : null,
+      tenantId: tenantId && UUID_RE2.test(tenantId) ? tenantId : null
+    };
   } catch {
-    return null;
+    return { clientId: null, tenantId: null };
   }
 }
-async function promptForClientId(askUser) {
-  print("");
-  print(`  ${c.yellow}You need a Microsoft Entra app registration for your tenant.${c.reset}`);
-  print(`  ${c.dim}Create one in the Azure portal with these delegated permissions:${c.reset}`);
-  print(`    ${c.dim}\u2022 Microsoft Graph: User.Read, Sites.ReadWrite.All, Files.ReadWrite.All${c.reset}`);
-  print(`    ${c.dim}\u2022 Power Automate: Flows.Read.All, Flows.Manage.All, Activity.Read.All, Approvals.Manage.All${c.reset}`);
-  print(`    ${c.dim}\u2022 Dynamics CRM: user_impersonation${c.reset}`);
-  print(`  ${c.dim}Enable "Allow public client flows" for device code auth.${c.reset}`);
-  print("");
-  while (true) {
-    const input = await askUser(`  ${c.cyan}?${c.reset} Paste your app's ${c.bold}Client ID${c.reset}: `);
-    if (input && UUID_RE2.test(input)) {
-      return input;
-    }
-    print(`  ${c.red}Invalid format \u2014 must be a UUID (e.g., 12345678-abcd-1234-abcd-123456789abc)${c.reset}`);
-  }
+function readExistingClientId() {
+  return readExistingAuthConfig().clientId;
 }
-async function resolveAppRegistration(askUser) {
-  const envClientId = process.env["PA_MCP_CLIENT_ID"];
-  if (envClientId && UUID_RE2.test(envClientId)) {
-    print(`  ${icons.check} Using client ID from PA_MCP_CLIENT_ID: ${c.dim}${envClientId}${c.reset}`);
-    return { clientId: envClientId, created: false };
-  }
+async function resolveAppRegistration() {
   const existingId = readExistingClientId();
   if (existingId) {
     print(`  ${icons.check} Reusing app from existing config: ${c.dim}${existingId}${c.reset}`);
     return { clientId: existingId, created: false };
   }
   const hasAzCli = await checkAzureCli();
-  if (hasAzCli) {
-    print(`  ${c.dim}Azure CLI detected${c.reset}`);
+  if (!hasAzCli) {
+    print(`  ${c.dim}Azure CLI not found \u2014 using shared app${c.reset}`);
+    print(`  ${icons.check} Client ID: ${c.dim}${PUBLISHED_APP_CLIENT_ID}${c.reset}`);
+    return { clientId: PUBLISHED_APP_CLIENT_ID, created: false };
+  }
+  print(`  ${c.dim}Azure CLI detected${c.reset}`);
+  try {
+    const azUser = await ensureAzureCliLogin();
+    print(`  ${icons.check} Azure CLI signed in as ${c.bold}${azUser}${c.reset}`);
+  } catch (error) {
+    const msg = error instanceof Error ? error.message : String(error);
+    print(`  ${c.yellow}Azure CLI login failed: ${msg}${c.reset}`);
+    print(`  ${c.dim}Falling back to shared app${c.reset}`);
+    print(`  ${icons.check} Client ID: ${c.dim}${PUBLISHED_APP_CLIENT_ID}${c.reset}`);
+    return { clientId: PUBLISHED_APP_CLIENT_ID, created: false };
+  }
+  const existingAppId = await findExistingApp(APP_DISPLAY_NAME);
+  if (existingAppId) {
+    print(`  ${icons.check} Found existing app: ${c.dim}${existingAppId}${c.reset}`);
     try {
-      const azUser = await ensureAzureCliLogin();
-      print(`  ${icons.check} Azure CLI signed in as ${c.bold}${azUser}${c.reset}`);
-      const existingAppId = await findExistingApp(APP_DISPLAY_NAME);
-      if (existingAppId) {
-        print(`  ${icons.check} Found existing app: ${c.dim}${existingAppId}${c.reset}`);
-        try {
-          await addWamRedirectUri(existingAppId);
-        } catch {
-        }
-        return { clientId: existingAppId, created: false };
-      }
-      print(`  ${c.dim}Creating app registration...${c.reset}`);
-      const newId = await createAppRegistration(APP_DISPLAY_NAME);
-      print(`  ${icons.check} App created: ${c.dim}${newId}${c.reset}`);
-      try {
-        await addWamRedirectUri(newId);
-        print(`  ${icons.check} WAM redirect URI configured`);
-      } catch {
-        print(`  ${c.dim}WAM redirect URI skipped (non-critical)${c.reset}`);
-      }
-      return { clientId: newId, created: true };
-    } catch (error) {
-      const msg = error instanceof Error ? error.message : String(error);
-      print(`  ${c.yellow}Azure CLI failed: ${msg}${c.reset}`);
+      await addWamRedirectUri(existingAppId);
+    } catch {
     }
-  } else {
-    print(`  ${c.dim}Azure CLI not found \u2014 skipping automatic app creation${c.reset}`);
+    return { clientId: existingAppId, created: false };
+  }
+  print(`  ${c.dim}Creating app registration...${c.reset}`);
+  try {
+    const newId = await createAppRegistration(APP_DISPLAY_NAME);
+    print(`  ${icons.check} App created: ${c.dim}${newId}${c.reset}`);
+    try {
+      await addWamRedirectUri(newId);
+      print(`  ${icons.check} WAM redirect URI configured`);
+    } catch {
+      print(`  ${c.dim}WAM redirect URI skipped (non-critical)${c.reset}`);
+    }
+    return { clientId: newId, created: true };
+  } catch (error) {
+    const msg = error instanceof Error ? error.message : String(error);
+    print(`  ${c.yellow}App creation failed: ${msg}${c.reset}`);
+    print(`  ${c.dim}Falling back to shared app${c.reset}`);
+    print(`  ${icons.check} Client ID: ${c.dim}${PUBLISHED_APP_CLIENT_ID}${c.reset}`);
+    return { clientId: PUBLISHED_APP_CLIENT_ID, created: false };
   }
-  const manualId = await promptForClientId(askUser);
-  print(`  ${icons.check} Client ID: ${c.dim}${manualId}${c.reset}`);
-  return { clientId: manualId, created: false };
 }
 async function runSetupWizard() {
   const rl = createInterface({
@@ -14830,7 +14992,7 @@ async function runSetupWizard() {
     printHeader();
     const totalSteps = 5;
     printStep(1, totalSteps, "App Registration");
-    const appResult = await resolveAppRegistration(prompt);
+    const appResult = await resolveAppRegistration();
     const clientId = appResult.clientId;
     printStep(2, totalSteps, "Sign In");
     const cacheResult = clearTokenCache();
@@ -14840,8 +15002,9 @@ async function runSetupWizard() {
     print(`  ${c.dim}Sign in with your Microsoft work account.${c.reset}`);
     print(`  ${c.dim}A device code will be shown \u2014 follow the instructions to authenticate.${c.reset}`);
     print("");
-    const authProvider = await createAuthProviderFromConfig2(clientId, null);
-    let tenantId = null;
+    const existingAuth = readExistingAuthConfig();
+    let tenantId = existingAuth.tenantId;
+    const authProvider = await createAuthProviderFromConfig2(clientId, tenantId);
     try {
       await authProvider.getToken();
       const account = authProvider.getCurrentAccount();
@@ -14997,6 +15160,71 @@ function isSetupNeeded() {
   return !existsSync(configPath);
 }
 
+// src/cli/validate.ts
+async function runValidate() {
+  console.error("Validating Power Automate MCP configuration...\n");
+  let config;
+  try {
+    const configPath = getConfigPath();
+    console.error(`  [1/3] Config file: ${configPath}`);
+    config = loadConfig();
+    const envNames = Object.keys(config.environments).filter((k) => k !== "default");
+    console.error(`        Client ID: ${config.auth.clientId}`);
+    console.error(`        Tenant: ${config.auth.tenantId ?? "common"}`);
+    console.error(`        Environments: ${envNames.join(", ") || "(none)"}`);
+    console.error(`        Default: ${config.environments.default}`);
+    console.error("        \u2713 Config valid\n");
+  } catch (err) {
+    const msg = err instanceof ConfigurationError ? err.message : String(err);
+    console.error(`        \u2717 Config error: ${msg}
+`);
+    process.exit(1);
+  }
+  let authProvider;
+  try {
+    console.error("  [2/3] Authenticating...");
+    authProvider = await createAuthProviderFromConfig(
+      config.auth.clientId,
+      config.auth.tenantId,
+      void 0,
+      true
+      // silentOnly
+    );
+    const token = await authProvider.getToken();
+    console.error(`        Token acquired (${token.length} chars)`);
+    const account = authProvider.getCurrentAccount();
+    if (account) {
+      console.error(`        Account: ${account.username ?? account.name ?? "unknown"}`);
+    }
+    console.error("        \u2713 Auth valid\n");
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    console.error(`        \u2717 Auth error: ${msg}`);
+    console.error("        Run: powerautomate-mcp --setup\n");
+    process.exit(1);
+  }
+  try {
+    console.error("  [3/3] Testing API connectivity...");
+    const defaultEnv = resolveEnvironment(config);
+    const flowApi = new FlowManagementApi({
+      authProvider,
+      defaultEnvironmentId: defaultEnv.id
+    });
+    const result = await flowApi.listFlows({ environment: defaultEnv.id, top: 1 });
+    const count = result.flows.length;
+    console.error(`        Environment: ${defaultEnv.name} (${defaultEnv.id})`);
+    console.error(`        Flow API reachable (${count >= 1 ? "flows found" : "connected"})`);
+    console.error("        \u2713 Connectivity valid\n");
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    console.error(`        \u2717 Connectivity error: ${msg}
+`);
+    process.exit(1);
+  }
+  console.error("All checks passed. Server is ready to run.\n");
+  process.exit(0);
+}
+
 // src/index.ts
 function parseArgs() {
   const args = process.argv.slice(2);
@@ -15008,11 +15236,27 @@ function parseArgs() {
       port = parsed;
     }
   }
+  let env2;
+  const envIdx = args.indexOf("--env");
+  if (envIdx !== -1 && args[envIdx + 1] && !args[envIdx + 1].startsWith("-")) {
+    env2 = args[envIdx + 1];
+  }
+  let config;
+  const configIdx = args.indexOf("--config");
+  if (configIdx !== -1 && args[configIdx + 1] && !args[configIdx + 1].startsWith("-")) {
+    config = args[configIdx + 1];
+  }
   return {
     setup: args.includes("--setup") || args.includes("-s"),
     help: args.includes("--help") || args.includes("-h"),
+    version: args.includes("--version") || args.includes("-v"),
+    validate: args.includes("--validate"),
+    update: args.includes("--update"),
     http: args.includes("--http"),
-    port
+    port,
+    env: env2,
+    config,
+    debug: args.includes("--debug")
   };
 }
 function getConfigPathHint() {
@@ -15026,28 +15270,28 @@ function getConfigPathHint() {
 }
 function printHelp() {
   const configPath = getConfigPathHint();
+  const version = getInstalledVersion();
   console.log(`
-Power Automate MCP Server
+Power Automate MCP Server v${version}
 
 Usage: powerautomate-mcp [options]
 
 Options:
-  --setup, -s    Run the interactive setup wizard
-  --http         Start with Streamable HTTP transport (for ChatGPT / remote clients)
-  --port <N>     Port for HTTP transport (default: 3000)
-  --help, -h     Show this help message
-
-Environment Variables:
-  PA_MCP_CLIENT_ID   Microsoft Entra app client ID (overrides config file)
-  PA_CONFIG_PATH     Custom path to config.json
+  --setup, -s      Run the interactive setup wizard
+  --validate       Verify config, auth, and API connectivity then exit
+  --update         Check for updates and install the latest version
+  --version, -v    Print version and exit
+  --http           Start with Streamable HTTP transport (for ChatGPT / remote clients)
+  --port <N>       Port for HTTP transport (default: 3000)
+  --env <name>     Override the default environment (alias or GUID)
+  --config <path>  Use an alternate config file
+  --debug          Enable debug-level logging
+  --help, -h       Show this help message
 
 First Run:
   If no configuration exists, the setup wizard will run automatically.
   You can also run it manually with --setup.
 
-  Each tenant needs its own Microsoft Entra app registration.
-  The wizard can create one via Azure CLI, or you can provide one manually.
-
 Configuration:
   Config file: ${configPath}
 
@@ -15056,10 +15300,30 @@ For more information, see the README.md file.
 }
 async function main() {
   const args = parseArgs();
+  if (args.version) {
+    console.log(getInstalledVersion());
+    process.exit(0);
+  }
   if (args.help) {
     printHelp();
     process.exit(0);
   }
+  if (args.update) {
+    await runSelfUpdate();
+    return;
+  }
+  if (args.debug) {
+    logger.level = "debug";
+    logger.debug("Debug logging enabled via --debug");
+  }
+  if (args.config) {
+    process.env["PA_CONFIG_PATH"] = args.config;
+    logger.debug({ configPath: args.config }, "Using custom config path");
+  }
+  if (args.validate) {
+    await runValidate();
+    return;
+  }
   if (args.setup || isSetupNeeded()) {
     const result = await runSetupWizard();
     if (!result.success) {
@@ -15072,7 +15336,11 @@ Setup failed: ${result.error}`);
       process.exit(0);
     }
   }
-  logger.info({ platform: process.platform, nodeVersion: process.version }, "Starting Power Automate MCP");
+  logger.info(
+    { platform: process.platform, nodeVersion: process.version, version: getInstalledVersion() },
+    "Starting Power Automate MCP"
+  );
+  backgroundUpdateCheck();
   let config;
   try {
     config = loadConfig();
@@ -15089,6 +15357,10 @@ Configuration Error: ${error.message}
     }
     throw error;
   }
+  if (args.env) {
+    config.environments.default = args.env;
+    logger.info({ env: args.env }, "Default environment overridden via --env");
+  }
   try {
     const { start } = await createMcpServer({
       config,