v1.0.9

[1.0.9] - 2026-08-16

• Bug fix — an action whose inputs is an array is no longer stored as an object. typeof [] === "object", and the preprocessor that fixes expression-bearing payloads spreads its argument into an object literal — so a Compose holding a literal list came back as {"0":"a","1":"b"}. create_flow reported success and the flow then failed at runtime with "the result of the evaluation of 'foreach' expression … is of type 'Object'. The result must be a valid array." An array has no body/parameters to rewrite, so it now passes through untouched; update_flow's deep merge already guarded this, which is why only newly created flows were affected.

• Bug fix — a destructive tool called without confirm: true reported SUCCESS while doing nothing. The confirmation prompt was returned as ordinary text, so a refusal was indistinguishable from a completed delete: the MCP result carried no isError, and a script that deleted 59 SharePoint items and checked only that flag reported 59 deletions and performed none. All 36 refusals across 15 tools now raise a ConfirmationRequiredError, rendered verbatim so the prompt keeps the id you must confirm against. The interactive flow is unchanged — read the prompt, call again with confirm: true. delete_flow and delete_custom_connector also had their best-effort name lookup restructured so the prompt names the flow or connector instead of falling back to the id.

• Bug fix — get_flow now tells you which connection a flow is bound to. A flow's connection reference carries three easily-conflated things: the reference key (shared_jira), the connector type, and the actual bound connection id (connectionName). Only the first two were reported, so "which connection is this trigger using?" could not be answered from the tool. connectionName (and source) now appear in both the structured output and the summary, which also makes read → rebind a round trip since it is exactly the field update_flow accepts back.

• Bug fix — the npm page pointed at the wrong repository. homepage, bugs and repository all referenced powerplatform-mcp-docs, which is the other package's public repo — inherited when this package was forked from powerautomate-mcp 0.16.2. Anyone clicking Repository or Issues on the npm listing landed in the wrong project, and bug reports would have arrived on the wrong tracker. They now point at powerplatform-mcp-server. npm only refreshes this metadata on publish, so the listing corrects itself with this release.