powerautomate-mcp 0.6.0 → 0.7.1

package/dist/index.js

@@ -259,7 +259,7 @@ function createChildLogger(bindings) {
 }
 
 // src/utils/constants.ts
-var POWER_PLATFORM_API_BASE = "https://api.powerplatform.com";
+var POWER_PLATFORM_API_BASE = "https://api.bap.microsoft.com";
 var FLOW_API_BASE = "https://api.flow.microsoft.com";
 var POWERAPPS_API_BASE = "https://api.powerapps.com";
 var POWER_PLATFORM_API_VERSION = "2022-03-01-preview";
@@ -283,7 +283,9 @@ var ALLOWED_TOKEN_DOMAINS = [
   "sharepoint.com",
   "office.com",
   "azure.com",
-  "windows.net"
+  "windows.net",
+  "powerplatform.com",
+  "powerapps.com"
 ];
 function isAllowedTokenDomain(hostname) {
   const lower = hostname.toLowerCase().replace(/\.+$/, "");
@@ -382,6 +384,20 @@ Create the file with your Microsoft Entra app client ID and Power Automate envir
     );
   }
   parsed = interpolateEnvVars(parsed);
+  const envClientId = env["PA_MCP_CLIENT_ID"];
+  if (envClientId) {
+    const UUID_RE3 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+    if (!UUID_RE3.test(envClientId)) {
+      throw new ConfigurationError(
+        `PA_MCP_CLIENT_ID is not a valid UUID: ${envClientId.substring(0, 50)}`
+      );
+    }
+    parsed.auth = {
+      ...parsed.auth ?? {},
+      clientId: envClientId
+    };
+    logger.info("Using client ID from PA_MCP_CLIENT_ID environment variable");
+  }
   try {
     const config = validateConfig(parsed);
     logger.info(
@@ -1960,7 +1976,7 @@ var ConnectorMetadataApi = class {
 var RESOURCES = {
   FLOW_SERVICE: "https://service.flow.microsoft.com",
   POWERAPPS_SERVICE: "https://service.powerapps.com",
-  POWER_PLATFORM: "https://api.powerplatform.com",
+  POWER_PLATFORM: "https://api.bap.microsoft.com",
   GRAPH: "https://graph.microsoft.com"
 };
 
@@ -2735,7 +2751,14 @@ var PowerPlatformAdminApi = class {
     };
   }
   buildUrl(path, queryParams) {
-    const base = `${POWER_PLATFORM_API_BASE}${path}`;
+    let resolvedPath = path;
+    if (path.startsWith("/providers/") && !path.includes("/scopes/admin/")) {
+      resolvedPath = path.replace(
+        "/providers/Microsoft.BusinessAppPlatform/",
+        "/providers/Microsoft.BusinessAppPlatform/scopes/admin/"
+      );
+    }
+    const base = `${POWER_PLATFORM_API_BASE}${resolvedPath}`;
     const params = new URLSearchParams();
     params.set("api-version", POWER_PLATFORM_API_VERSION);
     if (queryParams) {
@@ -5009,15 +5032,52 @@ var KNOWN_FUNCTIONS = /* @__PURE__ */ new Set([
   "uriQuery",
   "uriScheme"
 ]);
-var EXPRESSION_REGEX = /@\{([^}]+)\}/g;
+function extractWrappedExpressions(text) {
+  const expressions = [];
+  for (let i = 0; i < text.length - 1; i++) {
+    if (text[i] !== "@") continue;
+    if (text[i + 1] !== "{") continue;
+    if (i > 0 && text[i - 1] === "@") continue;
+    let depth = 0;
+    let inString = false;
+    let stringChar = "";
+    let end = -1;
+    for (let j = i + 2; j < text.length; j++) {
+      const char = text[j];
+      const prevChar = j > i + 2 ? text[j - 1] : "";
+      if ((char === "'" || char === '"') && prevChar !== "\\") {
+        if (!inString) {
+          inString = true;
+          stringChar = char;
+        } else if (char === stringChar) {
+          inString = false;
+        }
+        continue;
+      }
+      if (inString) continue;
+      if (char === "{") {
+        depth++;
+        continue;
+      }
+      if (char === "}") {
+        if (depth === 0) {
+          end = j;
+          break;
+        }
+        depth--;
+      }
+    }
+    if (end !== -1) {
+      expressions.push(text.slice(i + 2, end));
+      i = end;
+    }
+  }
+  return expressions;
+}
 var BARE_EXPRESSION_REGEX = /@((?:triggerBody|triggerOutputs|outputs|body|items|variables|parameters|workflow|result|actionOutputs|actionBody|trigger|actions|concat|toLower|toUpper|trim|substring|replace|split|length|contains|startsWith|endsWith|indexOf|lastIndexOf|first|last|take|skip|join|createArray|union|intersection|empty|if|and|or|not|equals|greater|greaterOrEquals|less|lessOrEquals|coalesce|int|float|string|bool|json|xml|array|add|sub|mul|div|mod|max|min|utcNow|addDays|addHours|addMinutes|addSeconds|formatDateTime|guid|base64|encodeUriComponent|decodeUriComponent)\s*\(.*\))/g;
 function extractExpressions(text) {
-  const expressions = [];
+  const expressions = extractWrappedExpressions(text);
   let match;
-  while ((match = EXPRESSION_REGEX.exec(text)) !== null) {
-    if (match[1]) expressions.push(match[1]);
-  }
-  EXPRESSION_REGEX.lastIndex = 0;
   while ((match = BARE_EXPRESSION_REGEX.exec(text)) !== null) {
     if (match[1]) expressions.push(match[1]);
   }
@@ -5493,6 +5553,160 @@ function getAllValidationWarnings(result) {
   return warnings;
 }
 
+// src/utils/expression-escape.ts
+var logger3 = createChildLogger({ module: "expression-escape" });
+function containsExpressions(value) {
+  if (typeof value === "string") {
+    return value.includes("@{") || value.startsWith("@") && !value.startsWith("@@");
+  }
+  if (Array.isArray(value)) {
+    return value.some(containsExpressions);
+  }
+  if (value && typeof value === "object") {
+    return Object.values(value).some(containsExpressions);
+  }
+  return false;
+}
+function objectToStringExpression(obj) {
+  const jsonStr = JSON.stringify(obj);
+  const segments = [];
+  let pos = 0;
+  while (pos < jsonStr.length) {
+    const exprStart = jsonStr.indexOf("@{", pos);
+    if (exprStart === -1) {
+      segments.push("'" + escapeForConcat(jsonStr.slice(pos)) + "'");
+      break;
+    }
+    const isJsonStringValue = exprStart > 0 && jsonStr[exprStart - 1] === '"';
+    if (exprStart > pos) {
+      let literal = jsonStr.slice(pos, exprStart);
+      if (isJsonStringValue) {
+        literal = literal.slice(0, -1);
+      }
+      if (literal.length > 0) {
+        segments.push("'" + escapeForConcat(literal) + "'");
+      }
+    }
+    let depth = 0;
+    let exprEnd = -1;
+    for (let i = exprStart + 2; i < jsonStr.length; i++) {
+      if (jsonStr[i] === "{") depth++;
+      else if (jsonStr[i] === "}") {
+        if (depth === 0) {
+          exprEnd = i;
+          break;
+        }
+        depth--;
+      }
+    }
+    if (exprEnd === -1) {
+      segments.push("'" + escapeForConcat(jsonStr.slice(exprStart)) + "'");
+      break;
+    }
+    const expr = jsonStr.slice(exprStart + 2, exprEnd);
+    if (isJsonStringValue) {
+      segments.push(`'"'`);
+      segments.push(expr);
+      segments.push(`'"'`);
+    } else {
+      segments.push(expr);
+    }
+    pos = exprEnd + 1;
+    if (isJsonStringValue && pos < jsonStr.length && jsonStr[pos] === '"') {
+      pos++;
+    }
+  }
+  const filtered = segments.filter((s) => s !== "''" && s !== "");
+  if (filtered.length === 0) return jsonStr;
+  if (filtered.length === 1 && !filtered[0].startsWith("'")) {
+    return `@{${filtered[0]}}`;
+  }
+  return `@{json(concat(${filtered.join(",")}))}`;
+}
+function escapeForConcat(s) {
+  return s.replace(/'/g, "''");
+}
+function preprocessActionInputs(inputs, actionName) {
+  const processedInputs = { ...inputs };
+  if (processedInputs.body && typeof processedInputs.body === "object") {
+    const bodyStr = JSON.stringify(processedInputs.body);
+    const hasAtKeys = /"@[a-zA-Z]/.test(bodyStr);
+    if (hasAtKeys || containsExpressions(processedInputs.body)) {
+      logger3.info({ action: actionName, field: "body", hasAtKeys }, "Converting action payload object to string expression");
+      processedInputs.body = objectToStringExpression(processedInputs.body);
+    }
+  }
+  if (processedInputs.parameters && typeof processedInputs.parameters === "object" && !Array.isArray(processedInputs.parameters)) {
+    const parameters = processedInputs.parameters;
+    let changed = false;
+    const processedParameters = { ...parameters };
+    for (const [key, value] of Object.entries(parameters)) {
+      if (value && typeof value === "object" && containsExpressions(value)) {
+        logger3.info({ action: actionName, field: `parameters.${key}` }, "Converting connector parameter object to string expression");
+        processedParameters[key] = objectToStringExpression(value);
+        changed = true;
+      }
+    }
+    if (changed) {
+      processedInputs.parameters = processedParameters;
+    }
+  }
+  return processedInputs;
+}
+function preprocessFlowActions(actions) {
+  const processed = {};
+  for (const [name, action] of Object.entries(actions)) {
+    if (!action || typeof action !== "object") {
+      processed[name] = action;
+      continue;
+    }
+    const actionObj = action;
+    processed[name] = { ...actionObj };
+    const processedAction = processed[name];
+    if (actionObj.inputs && typeof actionObj.inputs === "object") {
+      processedAction.inputs = preprocessActionInputs(
+        actionObj.inputs,
+        name
+      );
+    }
+    if (actionObj.actions && typeof actionObj.actions === "object") {
+      processedAction.actions = preprocessFlowActions(
+        actionObj.actions
+      );
+    }
+    if (actionObj.else && typeof actionObj.else === "object") {
+      const elseBranch = actionObj.else;
+      if (elseBranch.actions && typeof elseBranch.actions === "object") {
+        processedAction.else = {
+          ...elseBranch,
+          actions: preprocessFlowActions(elseBranch.actions)
+        };
+      }
+    }
+    if (actionObj.cases && typeof actionObj.cases === "object") {
+      const cases = actionObj.cases;
+      const processedCases = {};
+      for (const [caseName, caseVal] of Object.entries(cases)) {
+        if (caseVal && typeof caseVal === "object") {
+          const cv = caseVal;
+          if (cv.actions && typeof cv.actions === "object") {
+            processedCases[caseName] = {
+              ...cv,
+              actions: preprocessFlowActions(cv.actions)
+            };
+          } else {
+            processedCases[caseName] = caseVal;
+          }
+        } else {
+          processedCases[caseName] = caseVal;
+        }
+      }
+      processedAction.cases = processedCases;
+    }
+  }
+  return processed;
+}
+
 // src/tools/create-flow.ts
 var triggerSchema = z.object({
   type: z.string().describe("Trigger type (e.g., 'Request', 'Recurrence', 'OpenApiConnection')"),
@@ -5601,13 +5815,14 @@ var createFlowTool = {
 async function handleCreateFlow(api, input) {
   const parsed = createFlowInputSchema.parse(input);
   logger.info({ displayName: parsed.displayName }, "Executing create_flow");
+  const processedActions = preprocessFlowActions(parsed.actions);
   const definition = {
     $schema: "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#",
     contentVersion: "1.0.0.0",
     triggers: {
       [parsed.triggerName ?? "manual"]: parsed.trigger
     },
-    actions: parsed.actions
+    actions: processedActions
   };
   if (parsed.connectionReferences && Object.keys(parsed.connectionReferences).length > 0) {
     definition.parameters = {
@@ -5782,11 +5997,12 @@ async function handleUpdateFlow(api, input) {
   let newDefinition;
   if (parsed.trigger || parsed.actions) {
     const triggerName = parsed.triggerName ?? Object.keys(currentDef.triggers)[0] ?? "manual";
+    const processedActions = parsed.actions ? preprocessFlowActions(parsed.actions) : currentDef.actions;
     newDefinition = {
       $schema: currentDef.$schema,
       contentVersion: currentDef.contentVersion,
       triggers: parsed.trigger ? { [triggerName]: parsed.trigger } : currentDef.triggers,
-      actions: parsed.actions ? parsed.actions : currentDef.actions
+      actions: processedActions
     };
     if (currentDef.parameters) {
       newDefinition.parameters = currentDef.parameters;
@@ -14705,7 +14921,6 @@ function getDefaultEnvironment(environments) {
 }
 
 // src/setup/published-app.ts
-var PUBLISHED_APP_CLIENT_ID = "20ae33ee-6743-4786-9b00-8eb7bfebfd11";
 var APP_DISPLAY_NAME = "Power Automate MCP";
 var REDIRECT_URI = "https://login.microsoftonline.com/common/oauth2/nativeclient";
 var REQUIRED_RESOURCE_ACCESS = [
@@ -14720,8 +14935,10 @@ var REQUIRED_RESOURCE_ACCESS = [
   {
     resourceAppId: "7df0a125-d3be-4c96-aa54-591f83ff541c",
     resourceAccess: [
-      { id: "e07c4438-06fe-4349-9077-b8ab4e888e21", type: "Scope" },
-      { id: "f3a53f5e-1975-4e99-8c6e-c6a0dfac61f6", type: "Scope" }
+      { id: "e45c5562-459d-4d1b-8148-83eb1b6dcf83", type: "Scope" },
+      { id: "30b2d850-00c3-4802-b7ae-ece9af9de5c6", type: "Scope" },
+      { id: "822a9cde-503a-472d-a530-d1dc9cd0d52b", type: "Scope" },
+      { id: "d05743e4-fb24-4dff-8a33-0f6c73c964bd", type: "Scope" }
     ]
   },
   {
@@ -14809,6 +15026,8 @@ async function createAppRegistration(displayName) {
     "false",
     "--enable-id-token-issuance",
     "false",
+    "--is-fallback-public-client",
+    "true",
     "--public-client-redirect-uris",
     REDIRECT_URI,
     "--required-resource-accesses",
@@ -14925,56 +15144,69 @@ function readExistingAuthConfig() {
 function readExistingClientId() {
   return readExistingAuthConfig().clientId;
 }
-async function resolveAppRegistration() {
+async function promptForClientId(askUser) {
+  print("");
+  print(`  ${c.yellow}You need a Microsoft Entra app registration for your tenant.${c.reset}`);
+  print(`  ${c.dim}Create one in the Azure portal with these delegated permissions:${c.reset}`);
+  print(`    ${c.dim}\u2022 Microsoft Graph: User.Read, Sites.ReadWrite.All, Files.ReadWrite.All${c.reset}`);
+  print(`    ${c.dim}\u2022 Power Automate: Flows.Read.All, Flows.Manage.All, Activity.Read.All, Approvals.Manage.All${c.reset}`);
+  print(`    ${c.dim}\u2022 Dynamics CRM: user_impersonation${c.reset}`);
+  print(`  ${c.dim}Enable "Allow public client flows" for device code auth.${c.reset}`);
+  print("");
+  while (true) {
+    const input = await askUser(`  ${c.cyan}?${c.reset} Paste your app's ${c.bold}Client ID${c.reset}: `);
+    if (input && UUID_RE2.test(input)) {
+      return input;
+    }
+    print(`  ${c.red}Invalid format \u2014 must be a UUID (e.g., 12345678-abcd-1234-abcd-123456789abc)${c.reset}`);
+  }
+}
+async function resolveAppRegistration(askUser) {
+  const envClientId = process.env["PA_MCP_CLIENT_ID"];
+  if (envClientId && UUID_RE2.test(envClientId)) {
+    print(`  ${icons.check} Using client ID from PA_MCP_CLIENT_ID: ${c.dim}${envClientId}${c.reset}`);
+    return { clientId: envClientId, created: false };
+  }
   const existingId = readExistingClientId();
   if (existingId) {
     print(`  ${icons.check} Reusing app from existing config: ${c.dim}${existingId}${c.reset}`);
     return { clientId: existingId, created: false };
   }
   const hasAzCli = await checkAzureCli();
-  if (!hasAzCli) {
-    print(`  ${c.dim}Azure CLI not found \u2014 using shared app${c.reset}`);
-    print(`  ${icons.check} Client ID: ${c.dim}${PUBLISHED_APP_CLIENT_ID}${c.reset}`);
-    return { clientId: PUBLISHED_APP_CLIENT_ID, created: false };
-  }
-  print(`  ${c.dim}Azure CLI detected${c.reset}`);
-  try {
-    const azUser = await ensureAzureCliLogin();
-    print(`  ${icons.check} Azure CLI signed in as ${c.bold}${azUser}${c.reset}`);
-  } catch (error) {
-    const msg = error instanceof Error ? error.message : String(error);
-    print(`  ${c.yellow}Azure CLI login failed: ${msg}${c.reset}`);
-    print(`  ${c.dim}Falling back to shared app${c.reset}`);
-    print(`  ${icons.check} Client ID: ${c.dim}${PUBLISHED_APP_CLIENT_ID}${c.reset}`);
-    return { clientId: PUBLISHED_APP_CLIENT_ID, created: false };
-  }
-  const existingAppId = await findExistingApp(APP_DISPLAY_NAME);
-  if (existingAppId) {
-    print(`  ${icons.check} Found existing app: ${c.dim}${existingAppId}${c.reset}`);
+  if (hasAzCli) {
+    print(`  ${c.dim}Azure CLI detected${c.reset}`);
     try {
-      await addWamRedirectUri(existingAppId);
-    } catch {
-    }
-    return { clientId: existingAppId, created: false };
-  }
-  print(`  ${c.dim}Creating app registration...${c.reset}`);
-  try {
-    const newId = await createAppRegistration(APP_DISPLAY_NAME);
-    print(`  ${icons.check} App created: ${c.dim}${newId}${c.reset}`);
-    try {
-      await addWamRedirectUri(newId);
-      print(`  ${icons.check} WAM redirect URI configured`);
-    } catch {
-      print(`  ${c.dim}WAM redirect URI skipped (non-critical)${c.reset}`);
+      const azUser = await ensureAzureCliLogin();
+      print(`  ${icons.check} Azure CLI signed in as ${c.bold}${azUser}${c.reset}`);
+      const existingAppId = await findExistingApp(APP_DISPLAY_NAME);
+      if (existingAppId) {
+        print(`  ${icons.check} Found existing app: ${c.dim}${existingAppId}${c.reset}`);
+        try {
+          await addWamRedirectUri(existingAppId);
+        } catch {
+        }
+        return { clientId: existingAppId, created: false };
+      }
+      print(`  ${c.dim}Creating app registration...${c.reset}`);
+      const newId = await createAppRegistration(APP_DISPLAY_NAME);
+      print(`  ${icons.check} App created: ${c.dim}${newId}${c.reset}`);
+      try {
+        await addWamRedirectUri(newId);
+        print(`  ${icons.check} WAM redirect URI configured`);
+      } catch {
+        print(`  ${c.dim}WAM redirect URI skipped (non-critical)${c.reset}`);
+      }
+      return { clientId: newId, created: true };
+    } catch (error) {
+      const msg = error instanceof Error ? error.message : String(error);
+      print(`  ${c.yellow}Azure CLI failed: ${msg}${c.reset}`);
     }
-    return { clientId: newId, created: true };
-  } catch (error) {
-    const msg = error instanceof Error ? error.message : String(error);
-    print(`  ${c.yellow}App creation failed: ${msg}${c.reset}`);
-    print(`  ${c.dim}Falling back to shared app${c.reset}`);
-    print(`  ${icons.check} Client ID: ${c.dim}${PUBLISHED_APP_CLIENT_ID}${c.reset}`);
-    return { clientId: PUBLISHED_APP_CLIENT_ID, created: false };
+  } else {
+    print(`  ${c.dim}Azure CLI not found \u2014 skipping automatic app creation${c.reset}`);
   }
+  const manualId = await promptForClientId(askUser);
+  print(`  ${icons.check} Client ID: ${c.dim}${manualId}${c.reset}`);
+  return { clientId: manualId, created: false };
 }
 async function runSetupWizard() {
   const rl = createInterface({
@@ -14992,7 +15224,7 @@ async function runSetupWizard() {
     printHeader();
     const totalSteps = 5;
     printStep(1, totalSteps, "App Registration");
-    const appResult = await resolveAppRegistration();
+    const appResult = await resolveAppRegistration(prompt);
     const clientId = appResult.clientId;
     printStep(2, totalSteps, "Sign In");
     const cacheResult = clearTokenCache();
@@ -15014,6 +15246,18 @@ async function runSetupWizard() {
       } else {
         print(`  ${icons.check} ${c.green}Signed in${c.reset}`);
       }
+      const additionalResources = [
+        "https://api.bap.microsoft.com",
+        "https://service.powerapps.com"
+      ];
+      for (const resource of additionalResources) {
+        try {
+          await authProvider.getTokenForResource(resource);
+          print(`  ${icons.check} ${c.dim}Authorized ${resource.replace("https://", "")}${c.reset}`);
+        } catch {
+          print(`  ${c.dim}${icons.warn} Could not authorize ${resource.replace("https://", "")} (admin tools may be limited)${c.reset}`);
+        }
+      }
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
       print(`  ${icons.cross} ${c.red}Sign-in failed:${c.reset} ${message}`);
@@ -15288,10 +15532,17 @@ Options:
   --debug          Enable debug-level logging
   --help, -h       Show this help message
 
+Environment Variables:
+  PA_MCP_CLIENT_ID   Microsoft Entra app client ID (overrides config file)
+  PA_CONFIG_PATH     Custom path to config.json
+
 First Run:
   If no configuration exists, the setup wizard will run automatically.
   You can also run it manually with --setup.
 
+  Each tenant needs its own Microsoft Entra app registration.
+  The wizard can create one via Azure CLI, or you can provide one manually.
+
 Configuration:
   Config file: ${configPath}