# Changelog

## 1.1.0

### Added
- Shared/delegated mailbox support via optional `mailbox` (UPN/SMTP) on email, folder, and thread tools
- Graph path routing `me/...` → `users/{upn}/...` with `X-AnchorMailbox` header
- `list-mailboxes` tool: primary + `OUTLOOK_SHARED_MAILBOXES` + cache + `candidates[]`, non-destructive read/folder probes
- Local mailbox probe cache (`${tokenStore}.mailboxes.json` or `OUTLOOK_MAILBOX_CACHE_PATH`)
- `send-email` options: `mailbox`, `from`, `onBehalfOf` (mailbox-rooted send vs me-rooted send-on-behalf)
- `check-auth-status` reports whether `Mail.Read.Shared` / `Mail.ReadWrite.Shared` / `Mail.Send.Shared` are on the token `scp`
- Env: `OUTLOOK_ENABLE_SHARED_MAILBOXES`, `OUTLOOK_SHARED_MAILBOXES`, `OUTLOOK_MAILBOX_CACHE_PATH`, `OUTLOOK_MAILBOX_PROBE_CONCURRENCY`
- Unit tests: `tests/mailbox-path.test.js`, `tests/mailbox-send-path.test.js`

### Changed
- Version bump to 1.1.0
- Default MSAL scopes include shared mailbox delegated permissions when enabled
- `callGraphAPI` accepts optional headers; queryParams copy no longer mutates caller `$filter`
- `read-email` / `read-emails` no longer double-encode message IDs before path encoding
- README: shared mailbox section, Azure shared scopes, env table updates

### Notes / operator actions
- Entra app registration needs new delegated permissions + admin consent
- Existing users must re-run device-code `authenticate` after upgrade
- Graph cannot enumerate all mailboxes a user can access; seed with env or EXO
- Calendar and inbox rules remain primary-mailbox only in this release
- `sendAs` capability is unverified until a successful send

## 1.0.1

Prior release: Graph empty-body write fix, timezone display/filters, search `strict`, folder list fixes, 429/503 retry/backoff.