<?xml version="1.0" encoding="UTF-8"?>
<!--
  Recipient Guard — ACORN-2026-04 corrective action A-09 (Linear SEC-993).
  Add-in only manifest. NOT the unified manifest: the unified manifest is not
  supported on Outlook for Mac, which is in scope per the spec's client list.

  Replace REPLACE-WITH-HOST with the CloudFront domain serving these assets.
  Every URL must be absolute and HTTPS.
-->
<OfficeApp
  xmlns="http://schemas.microsoft.com/office/appforoffice/1.1"
  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xmlns:bt="http://schemas.microsoft.com/office/officeappbasictypes/1.0"
  xmlns:mailappor="http://schemas.microsoft.com/office/mailappversionoverrides/1.0"
  xsi:type="MailApp">

  <Id>25C487EB-E1B8-4621-991F-B97258D85D67</Id>
  <Version>1.4.1.0</Version>
  <ProviderName>Acorn</ProviderName>
  <DefaultLocale>en-AU</DefaultLocale>
  <DisplayName DefaultValue="Recipient Guard"/>
  <Description DefaultValue="Warns before sending attachments to more than one external organisation, and encrypts attachments into a password-protected archive."/>
  <IconUrl DefaultValue="https://recipient-guard.internaltools.acorn.works/assets/icon-64.png"/>
  <HighResolutionIconUrl DefaultValue="https://recipient-guard.internaltools.acorn.works/assets/icon-128.png"/>
  <SupportUrl DefaultValue="https://recipient-guard.internaltools.acorn.works/src/support.html"/>

  <AppDomains>
    <AppDomain>https://recipient-guard.internaltools.acorn.works</AppDomain>
  </AppDomains>

  <Hosts>
    <Host Name="Mailbox"/>
  </Hosts>

  <Requirements>
    <Sets>
      <Set Name="Mailbox" MinVersion="1.1"/>
    </Sets>
  </Requirements>

  <!-- BOTH forms are required. This add-in runs at SEND time, which is a
       compose context: an ItemRead-only declaration leaves it unactivated
       during compose, and the OnMessageSend handler then never runs while
       Outlook still waits for it. That presents as "Recipient Guard add-in is
       taking longer than expected" on every send. Mac 16.113, 2026-09-18. -->
  <FormSettings>
    <Form xsi:type="ItemRead">
      <DesktopSettings>
        <SourceLocation DefaultValue="https://recipient-guard.internaltools.acorn.works/src/commands.247ab7c5.html"/>
        <RequestedHeight>250</RequestedHeight>
      </DesktopSettings>
    </Form>
    <Form xsi:type="ItemEdit">
      <DesktopSettings>
        <SourceLocation DefaultValue="https://recipient-guard.internaltools.acorn.works/src/commands.247ab7c5.html"/>
      </DesktopSettings>
    </Form>
  </FormSettings>

  <Permissions>ReadWriteItem</Permissions>

  <!-- Required by the MailApp schema between <Permissions> and <VersionOverrides>.
       Activation rules for the base manifest only; the OnMessageSend handler is
       driven by the LaunchEvent extension point below, not by this rule. -->
  <Rule xsi:type="RuleCollection" Mode="Or">
    <Rule xsi:type="ItemIs" ItemType="Message" FormType="ReadOrEdit"/>
  </Rule>
  <DisableEntityHighlighting>false</DisableEntityHighlighting>

  <VersionOverrides xmlns="http://schemas.microsoft.com/office/mailappversionoverrides" xsi:type="VersionOverridesV1_0">
    <VersionOverrides xmlns="http://schemas.microsoft.com/office/mailappversionoverrides/1.1" xsi:type="VersionOverridesV1_1">

      <Requirements>
        <bt:Sets DefaultMinVersion="1.12">
          <bt:Set Name="Mailbox"/>
        </bt:Sets>
      </Requirements>

      <Hosts>
        <Host xsi:type="MailHost">

          <Runtimes>
            <!-- WebView runtime: Outlook on the web, new Outlook, Mac.
                 Override: the JavaScript-only runtime on classic Outlook for
                 Windows, which loads ONLY this one file and supports no imports. -->
            <Runtime resid="WebViewRuntime.Url">
              <Override type="javascript" resid="JSRuntime.Url"/>
            </Runtime>
          </Runtimes>

          <DesktopFormFactor>
            <FunctionFile resid="WebViewRuntime.Url"/>

            <ExtensionPoint xsi:type="MessageComposeCommandSurface">
              <OfficeTab id="TabDefault">
                <Group id="rgGroup">
                  <Label resid="GroupLabel"/>
                  <Control xsi:type="Button" id="rgProtectButton">
                    <Label resid="ProtectButton.Label"/>
                    <Supertip>
                      <Title resid="ProtectButton.Label"/>
                      <Description resid="ProtectButton.Tooltip"/>
                    </Supertip>
                    <Icon>
                      <bt:Image size="16" resid="Icon.16x16"/>
                      <bt:Image size="32" resid="Icon.32x32"/>
                      <bt:Image size="80" resid="Icon.80x80"/>
                    </Icon>
                    <Action xsi:type="ShowTaskpane">
                      <SourceLocation resid="Taskpane.Url"/>
                    </Action>
                  </Control>
                </Group>
              </OfficeTab>
            </ExtensionPoint>

            <ExtensionPoint xsi:type="LaunchEvent">
              <LaunchEvents>
                <!-- SendMode PromptUser: the user always keeps a Send Anyway
                     path, and an add-in that fails to load never blocks mail.
                     This is FR-205 expressed in the manifest, not in code. -->
                <LaunchEvent Type="OnMessageSend" FunctionName="onMessageSendHandler" SendMode="PromptUser"/>
              </LaunchEvents>
              <SourceLocation resid="WebViewRuntime.Url"/>
            </ExtensionPoint>
          </DesktopFormFactor>

        </Host>
      </Hosts>

      <Resources>
        <bt:Images>
          <bt:Image id="Icon.16x16" DefaultValue="https://recipient-guard.internaltools.acorn.works/assets/icon-16.png"/>
          <bt:Image id="Icon.32x32" DefaultValue="https://recipient-guard.internaltools.acorn.works/assets/icon-32.png"/>
          <bt:Image id="Icon.80x80" DefaultValue="https://recipient-guard.internaltools.acorn.works/assets/icon-80.png"/>
        </bt:Images>
        <bt:Urls>
          <bt:Url id="WebViewRuntime.Url" DefaultValue="https://recipient-guard.internaltools.acorn.works/src/commands.247ab7c5.html"/>
          <bt:Url id="JSRuntime.Url" DefaultValue="https://recipient-guard.internaltools.acorn.works/src/recipient-guard.32cbbba1.js"/>
          <bt:Url id="Taskpane.Url" DefaultValue="https://recipient-guard.internaltools.acorn.works/src/taskpane.8d5f3b94.html"/>
        </bt:Urls>
        <bt:ShortStrings>
          <bt:String id="GroupLabel" DefaultValue="Recipient Guard"/>
          <bt:String id="ProtectButton.Label" DefaultValue="Protect attachments"/>
        </bt:ShortStrings>
        <bt:LongStrings>
          <bt:String id="ProtectButton.Tooltip" DefaultValue="Replace the attachments with one AES-256 encrypted zip and show a passphrase to send separately."/>
        </bt:LongStrings>
      </Resources>

    </VersionOverrides>
  </VersionOverrides>
</OfficeApp>
