@aglyn/plugins-outreach 1.0.0-beta.143

package/src/lib/mailboxes/mailbox-routes.js

@@ -0,0 +1,605 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { _ as _extends } from "@swc/helpers/_/_extends";
+import { createGmailClient } from "../transport/gmail-client.js";
+import { GmailTransportError } from "../transport/gmail-errors.js";
+import { buildGoogleAuthorizationUrl, exchangeGoogleAuthorizationCode, grantedScopesInclude, OUTREACH_REQUIRED_GRANTED_SCOPES, pkceChallenge, readGoogleIdToken } from "../transport/google-oauth.js";
+import { Rfc5322MessageError } from "../transport/rfc5322.js";
+import { sendOutreachMessage } from "../transport/send-message.js";
+import { buildConnectReturnFragment } from "./mailbox-api.js";
+import { mailboxCredentialsRef, mailboxRef, outreachMailboxId, readMailboxCredentials, sealMailboxRefreshToken } from "./mailbox-credentials.js";
+import { revokeMailboxGrant } from "./mailbox-revoke.js";
+import { outreachMemberGate, refusal } from "./mailbox-gate.js";
+import { defaultSendAs, isValidTimezone, OUTREACH_DEFAULT_DAILY_CAP, OUTREACH_DEFAULT_WINDOW, OUTREACH_MAX_MAILBOXES_PER_MEMBER, validateDailyCap, validateDisplayName, validateSendWindow, verifiedSendAsAddresses } from "./mailbox-settings.js";
+import { markOutreachMailboxReconnectRequired, openOutreachMailboxClient } from "./mailbox-transport.js";
+import { consumeOutreachOAuthState, mintOutreachOAuthState, outreachOidcNonce, outreachPkceVerifier, readOutreachOAuthState, recordOutreachOAuthState } from "./oauth-state.js";
+import { OUTREACH_NOT_CONFIGURED_MESSAGE } from "./outreach-config.js";
+/** Test sends one mailbox may make in an hour. */ export const OUTREACH_TEST_SENDS_PER_HOUR = 5;
+/**
+ * The org activity target a mailbox's rows are filed under: Outreach's own
+ * namespaced resource, which the feed reads as "Mailbox".
+ */ export const OUTREACH_MAILBOX_ACTIVITY_TARGET = 'outreach:mailbox';
+const MAILBOX_ID = /^[A-Za-z0-9_-]{1,128}$/;
+const MAX_CODE_CHARS = 2048;
+const noStore = {
+    'Cache-Control': 'no-store'
+};
+const ok = (body)=>Response.json(body, {
+        status: 200,
+        headers: noStore
+    });
+function methodNotAllowed(allow) {
+    return Response.json({
+        error: 'Method not allowed',
+        reason: 'method-not-allowed'
+    }, {
+        status: 405,
+        headers: _extends({}, noStore, {
+            Allow: allow
+        })
+    });
+}
+async function readBody(request) {
+    const body = await request.json().catch(()=>null);
+    return body && typeof body === 'object' && !Array.isArray(body) ? body : {};
+}
+function notConfigured() {
+    return refusal(503, 'not-configured', OUTREACH_NOT_CONFIGURED_MESSAGE);
+}
+/** A mailbox document read defensively into the model shape. */ function readMailbox(id, data) {
+    if (!data) return null;
+    return _extends({}, data, {
+        id
+    });
+}
+const activityName = (mailbox)=>mailbox.email;
+export function createOutreachMailboxRoutes(deps) {
+    /** The gate, then the mailbox the body names, then who may touch it. */ async function loadManagedMailbox(request, body, who) {
+        const gate = await outreachMemberGate(request, body['orgId'], deps.gate);
+        if (gate instanceof Response) return gate;
+        const mailboxId = typeof body['mailboxId'] === 'string' ? body['mailboxId'] : '';
+        if (!MAILBOX_ID.test(mailboxId)) return refusal(400, 'invalid-request', 'Name the mailbox.');
+        const snapshot = await mailboxRef(deps.firestore(), gate.orgId, mailboxId).get();
+        const mailbox = readMailbox(mailboxId, snapshot.exists ? snapshot.data() : undefined);
+        if (!mailbox) return refusal(404, 'mailbox-not-found', 'That mailbox is not connected to this organization.');
+        const own = mailbox.connectedByUid === gate.uid;
+        if (!own && !(who === 'member-or-admin' && gate.isOrgAdmin)) {
+            return refusal(403, 'not-your-mailbox', who === 'member' ? 'Only the member who connected this mailbox can do that.' : 'Only the member who connected this mailbox, or an organization owner or admin, can change it.');
+        }
+        return {
+            gate,
+            mailbox
+        };
+    }
+    const availability = async (request)=>{
+        if (request.method !== 'GET') return methodNotAllowed('GET');
+        const gate = await outreachMemberGate(request, new URL(request.url).searchParams.get('orgId'), deps.gate);
+        if (gate instanceof Response) return gate;
+        const configured = deps.readConfig().configured && deps.stateSigningConfigured() && Boolean(deps.redirectUri(request.url));
+        return ok({
+            configured,
+            canManageAll: gate.isOrgAdmin
+        });
+    };
+    const connect = async (request)=>{
+        if (request.method !== 'POST') return methodNotAllowed('POST');
+        const body = await readBody(request);
+        const gate = await outreachMemberGate(request, body['orgId'], deps.gate);
+        if (gate instanceof Response) return gate;
+        const config = deps.readConfig();
+        const redirectUri = deps.redirectUri(request.url);
+        if (!config.configured || !redirectUri || !deps.stateSigningConfigured()) return notConfigured();
+        const nowMs = deps.now();
+        const { state, claims } = mintOutreachOAuthState({
+            orgId: gate.orgId,
+            uid: gate.uid,
+            nowMs
+        });
+        await recordOutreachOAuthState(deps.firestore(), {
+            claims,
+            redirectUri,
+            nowMs
+        });
+        const url = buildGoogleAuthorizationUrl({
+            clientId: config.config.clientId,
+            redirectUri,
+            state,
+            codeChallenge: pkceChallenge(outreachPkceVerifier(claims.nonce)),
+            nonce: outreachOidcNonce(claims.nonce),
+            loginHint: gate.email
+        });
+        return ok({
+            url
+        });
+    };
+    const oauthCallback = async (request)=>{
+        var _params_get;
+        if (request.method !== 'GET') return methodNotAllowed('GET');
+        const params = new URL(request.url).searchParams;
+        const read = readOutreachOAuthState(params.get('state'), deps.now());
+        const plain = (status, text)=>new Response(text, {
+                status,
+                headers: _extends({}, noStore, {
+                    'Content-Type': 'text/plain; charset=utf-8',
+                    'Referrer-Policy': 'no-referrer'
+                })
+            });
+        if (read.ok === false && read.refusal === 'state-invalid') {
+            return plain(400, 'This connection link is not valid. Return to the console and connect the mailbox again.');
+        }
+        const claims = read.ok ? read.claims : read.claims;
+        const org = await deps.gate.readOrg(claims.orgId);
+        const slug = typeof (org == null ? void 0 : org['slug']) === 'string' ? org['slug'] : '';
+        if (!slug) return plain(404, 'That organization could not be found.');
+        let fragment;
+        const googleError = params.get('error');
+        const code = (_params_get = params.get('code')) != null ? _params_get : '';
+        if (googleError) {
+            fragment = {
+                kind: 'error',
+                reason: googleError === 'access_denied' ? 'access_denied' : 'google_error'
+            };
+        } else if (!read.ok) {
+            fragment = {
+                kind: 'error',
+                reason: 'expired'
+            };
+        } else if (!code || code.length > MAX_CODE_CHARS) {
+            fragment = {
+                kind: 'error',
+                reason: 'google_error'
+            };
+        } else {
+            var _params_get1;
+            fragment = {
+                kind: 'code',
+                code,
+                state: (_params_get1 = params.get('state')) != null ? _params_get1 : ''
+            };
+        }
+        // A RELATIVE location on the callback's own origin: the path is built from
+        // the organization's slug, never from anything the request supplied.
+        return new Response(null, {
+            status: 303,
+            headers: _extends({}, noStore, {
+                'Referrer-Policy': 'no-referrer',
+                Location: `/${encodeURIComponent(slug)}/outreach/mailboxes#${buildConnectReturnFragment(fragment)}`
+            })
+        });
+    };
+    const connectComplete = async (request)=>{
+        var _aliases_confirmed;
+        if (request.method !== 'POST') return methodNotAllowed('POST');
+        const body = await readBody(request);
+        const gate = await outreachMemberGate(request, body['orgId'], deps.gate);
+        if (gate instanceof Response) return gate;
+        const config = deps.readConfig();
+        if (!config.configured || !deps.stateSigningConfigured()) return notConfigured();
+        const code = typeof body['code'] === 'string' ? body['code'] : '';
+        if (!code || code.length > MAX_CODE_CHARS) return refusal(400, 'invalid-request', 'The connection did not return a code.');
+        const firestore = deps.firestore();
+        const nowMs = deps.now();
+        const read = readOutreachOAuthState(body['state'], nowMs);
+        if (read.ok === false && read.refusal === 'state-invalid') {
+            return refusal(400, 'state-invalid', 'This connection could not be verified. Connect the mailbox again.');
+        }
+        const claims = read.ok ? read.claims : read.claims;
+        if (claims.uid !== gate.uid) {
+            return refusal(403, 'state-user-mismatch', 'This connection was started by another member. Sign in as that member, or connect the mailbox again.');
+        }
+        if (claims.orgId !== gate.orgId) {
+            return refusal(400, 'state-org-mismatch', 'This connection was started in another organization.');
+        }
+        if (!read.ok) return refusal(410, 'state-expired', 'This connection took too long. Connect the mailbox again.');
+        const consumed = await consumeOutreachOAuthState(firestore, {
+            claims,
+            nowMs
+        });
+        if (consumed.ok === false) {
+            if (consumed.refusal === 'state-expired') {
+                return refusal(410, 'state-expired', 'This connection took too long. Connect the mailbox again.');
+            }
+            return refusal(409, consumed.refusal, consumed.refusal === 'state-superseded' ? 'A newer connection was started. Finish that one, or connect the mailbox again.' : 'This connection was already used. Connect the mailbox again.');
+        }
+        let grant;
+        try {
+            grant = await exchangeGoogleAuthorizationCode({
+                clientId: config.config.clientId,
+                clientSecret: config.config.clientSecret,
+                code,
+                redirectUri: consumed.redirectUri,
+                codeVerifier: outreachPkceVerifier(claims.nonce)
+            }, deps.transport);
+        } catch (error) {
+            if (error instanceof GmailTransportError && error.code === 'invalid_grant') {
+                return refusal(400, 'code-rejected', "Google's sign-in expired or was already used. Connect the mailbox again.");
+            }
+            if (error instanceof GmailTransportError && error.code === 'client_misconfigured') {
+                return refusal(503, 'not-configured', "Google refused this deployment's OAuth client.");
+            }
+            return googleUnavailable(error);
+        }
+        if (!grant.refreshToken) {
+            return refusal(422, 'refresh-token-missing', 'Google did not grant offline access, so the mailbox could not send later. Connect it again.');
+        }
+        if (!grantedScopesInclude(grant.scope, OUTREACH_REQUIRED_GRANTED_SCOPES)) {
+            return refusal(422, 'scopes-missing', 'Sequences needs permission to send and to read your mail. Connect again and allow both.');
+        }
+        const identity = readGoogleIdToken(grant.idToken, {
+            clientId: config.config.clientId,
+            nonce: outreachOidcNonce(claims.nonce),
+            nowMs
+        });
+        if (identity.ok === false) {
+            return refusal(422, 'identity-unverified', identity.refusal === 'email-unverified' ? "Google has not verified this account's email address." : "Google's answer could not be verified. Connect the mailbox again.");
+        }
+        const client = createGmailClient(_extends({}, deps.transport, {
+            clientId: config.config.clientId,
+            clientSecret: config.config.clientSecret,
+            refreshToken: grant.refreshToken
+        }));
+        let profileEmail;
+        let sendAsOptions;
+        try {
+            const [profile, sendAs] = await Promise.all([
+                client.getProfile(),
+                client.listSendAs()
+            ]);
+            profileEmail = profile.emailAddress;
+            sendAsOptions = verifiedSendAsAddresses(sendAs);
+        } catch (error) {
+            if (error instanceof GmailTransportError && error.reconnectRequired) {
+                return refusal(422, 'scopes-missing', 'Sequences needs permission to send and to read your mail. Connect again and allow both.');
+            }
+            return googleUnavailable(error);
+        }
+        if (profileEmail !== identity.identity.email) {
+            return refusal(422, 'account-mismatch', 'The Gmail account and the Google sign-in did not match. Connect again.');
+        }
+        if (!sendAsOptions.some((option)=>option.email === profileEmail)) {
+            sendAsOptions = [
+                {
+                    email: profileEmail,
+                    displayName: '',
+                    isPrimary: true,
+                    isDefault: !sendAsOptions.some((o)=>o.isDefault)
+                },
+                ...sendAsOptions
+            ];
+        }
+        const mailboxId = outreachMailboxId(gate.orgId, gate.uid, identity.identity.sub);
+        const mailboxDoc = mailboxRef(firestore, gate.orgId, mailboxId);
+        const credentialDoc = mailboxCredentialsRef(firestore, mailboxId);
+        const [existingMailbox, existingCredential] = await Promise.all([
+            mailboxDoc.get(),
+            credentialDoc.get()
+        ]);
+        const current = readMailbox(mailboxId, existingMailbox.exists ? existingMailbox.data() : undefined);
+        if (!current) {
+            const mine = await firestore.collection('orgs').doc(gate.orgId).collection('outreachMailboxes').where('connectedByUid', '==', gate.uid).limit(OUTREACH_MAX_MAILBOXES_PER_MEMBER).get();
+            if (mine.size >= OUTREACH_MAX_MAILBOXES_PER_MEMBER) {
+                return refusal(409, 'mailbox-limit', `You can connect up to ${OUTREACH_MAX_MAILBOXES_PER_MEMBER} mailboxes. Disconnect one before connecting another.`);
+            }
+        }
+        const defaultOption = sendAsOptions.find((option)=>option.email === defaultSendAs(sendAsOptions, profileEmail));
+        let mailbox;
+        /** On a reconnect, only the fields a connect decides — see the write below. */ let reconnected = null;
+        if (current) {
+            var _ref;
+            const keepSendAs = sendAsOptions.some((option)=>option.email === current.sendAs);
+            reconnected = {
+                provider: 'google',
+                email: profileEmail,
+                sendAs: keepSendAs ? current.sendAs : (_ref = defaultOption == null ? void 0 : defaultOption.email) != null ? _ref : profileEmail,
+                sendAsOptions,
+                // A reconnect restores a mailbox Google had cut off, and leaves a
+                // mailbox its member paused paused.
+                status: current.status === 'paused' ? 'paused' : 'connected',
+                connectedAtMs: nowMs,
+                updatedAtMs: nowMs
+            };
+            mailbox = _extends({}, current, reconnected);
+        } else {
+            var _ref1;
+            const timezone = isValidTimezone(body['timezone']) ? String(body['timezone']) : 'UTC';
+            const displayName = validateDisplayName((defaultOption == null ? void 0 : defaultOption.displayName) || gate.name || '');
+            mailbox = {
+                id: mailboxId,
+                provider: 'google',
+                email: profileEmail,
+                sendAs: (_ref1 = defaultOption == null ? void 0 : defaultOption.email) != null ? _ref1 : profileEmail,
+                sendAsOptions,
+                displayName: typeof displayName === 'string' ? displayName : '',
+                status: 'connected',
+                dailyCap: OUTREACH_DEFAULT_DAILY_CAP,
+                window: _extends({}, OUTREACH_DEFAULT_WINDOW, {
+                    days: [
+                        ...OUTREACH_DEFAULT_WINDOW.days
+                    ]
+                }),
+                timezone,
+                rampStartedAtMs: nowMs,
+                health: {
+                    sentToday: 0,
+                    sentOnDay: null,
+                    bounces: 0,
+                    replies: 0,
+                    lastSentAtMs: null,
+                    lastErrorAtMs: null,
+                    lastErrorCode: null,
+                    daily: {}
+                },
+                connectedByUid: gate.uid,
+                connectedAtMs: nowMs,
+                createdAtMs: nowMs,
+                updatedAtMs: nowMs
+            };
+        }
+        const credential = _extends({
+            id: mailboxId,
+            orgId: gate.orgId,
+            mailboxId,
+            provider: 'google',
+            connectedByUid: gate.uid,
+            providerAccountId: identity.identity.sub,
+            email: profileEmail,
+            scopes: grant.scope.split(/\s+/).filter(Boolean)
+        }, sealMailboxRefreshToken(grant.refreshToken, mailboxId, config.config.keyring), {
+            createdAtMs: Number(existingCredential.exists ? existingCredential.get('createdAtMs') : 0) || nowMs,
+            updatedAtMs: nowMs
+        });
+        const batch = firestore.batch();
+        // A reconnect MERGES only what a connect decides, so the settings a member
+        // chose and the health counters the sending runtime increments are never
+        // written back from a read that may already be stale.
+        if (reconnected) batch.set(mailboxDoc, reconnected, {
+            merge: true
+        });
+        else batch.set(mailboxDoc, mailbox);
+        batch.set(credentialDoc, credential);
+        await batch.commit();
+        const aliases = await deps.confirmAliasesByProvider(firestore, {
+            orgId: gate.orgId,
+            uid: gate.uid,
+            addresses: sendAsOptions.map((option)=>option.email),
+            nowMs
+        }).catch((error)=>{
+            console.error('[outreach] confirming member aliases from send-as failed', error);
+            return {
+                ok: false
+            };
+        });
+        await deps.logOrgActivity(gate.orgId, {
+            uid: gate.uid,
+            email: gate.email
+        }, current ? 'Reconnected a mailbox in Sequences' : 'Connected a mailbox in Sequences', {
+            type: OUTREACH_MAILBOX_ACTIVITY_TARGET,
+            id: mailboxId,
+            name: activityName(mailbox)
+        });
+        return ok({
+            ok: true,
+            mailbox,
+            created: !current,
+            confirmedAliases: aliases.ok ? (_aliases_confirmed = aliases.confirmed) != null ? _aliases_confirmed : [] : []
+        });
+    };
+    const settings = async (request)=>{
+        if (request.method !== 'POST') return methodNotAllowed('POST');
+        const body = await readBody(request);
+        const loaded = await loadManagedMailbox(request, body, 'member-or-admin');
+        if (loaded instanceof Response) return loaded;
+        const { gate, mailbox } = loaded;
+        const update = {};
+        const invalid = (message)=>refusal(400, 'invalid-settings', message);
+        if (body['sendAs'] !== undefined) {
+            var _mailbox_sendAsOptions;
+            const sendAs = typeof body['sendAs'] === 'string' ? body['sendAs'].trim().toLowerCase() : '';
+            if (!((_mailbox_sendAsOptions = mailbox.sendAsOptions) != null ? _mailbox_sendAsOptions : []).some((option)=>option.email === sendAs)) {
+                return invalid('Choose one of the addresses Gmail has verified for this account.');
+            }
+            update.sendAs = sendAs;
+        }
+        if (body['displayName'] !== undefined) {
+            const name = validateDisplayName(body['displayName']);
+            if (typeof name !== 'string') return invalid(name.message);
+            update.displayName = name;
+        }
+        if (body['dailyCap'] !== undefined) {
+            const cap = validateDailyCap(body['dailyCap']);
+            if (typeof cap !== 'number') return invalid(cap.message);
+            update.dailyCap = cap;
+        }
+        if (body['window'] !== undefined) {
+            const window = validateSendWindow(body['window']);
+            if (!('days' in window)) return invalid(window.message);
+            update.window = window;
+        }
+        if (body['timezone'] !== undefined) {
+            if (!isValidTimezone(body['timezone'])) return invalid('Choose a timezone from the list.');
+            update.timezone = body['timezone'];
+        }
+        if (!Object.keys(update).length) return ok({
+            ok: true,
+            mailbox
+        });
+        const nowMs = deps.now();
+        await mailboxRef(deps.firestore(), gate.orgId, mailbox.id).update(_extends({}, update, {
+            updatedAtMs: nowMs
+        }));
+        return ok({
+            ok: true,
+            mailbox: _extends({}, mailbox, update, {
+                updatedAtMs: nowMs
+            })
+        });
+    };
+    const status = async (request)=>{
+        if (request.method !== 'POST') return methodNotAllowed('POST');
+        const body = await readBody(request);
+        if (typeof body['paused'] !== 'boolean') return refusal(400, 'invalid-request', 'Say whether to pause the mailbox.');
+        const loaded = await loadManagedMailbox(request, body, 'member-or-admin');
+        if (loaded instanceof Response) return loaded;
+        const { gate, mailbox } = loaded;
+        if (mailbox.status === 'reconnect_required' || mailbox.status === 'disconnected') {
+            return refusal(409, 'reconnect-required', 'Reconnect this mailbox before pausing or resuming it.');
+        }
+        const next = body['paused'] ? 'paused' : 'connected';
+        if (mailbox.status === next) return ok({
+            ok: true,
+            mailbox
+        });
+        const nowMs = deps.now();
+        // A member's pause or resume answers an automatic pause (AGL-2981): its
+        // reason goes, and the next bounce is judged as new evidence.
+        await mailboxRef(deps.firestore(), gate.orgId, mailbox.id).update({
+            status: next,
+            autoPause: null,
+            updatedAtMs: nowMs
+        });
+        await deps.logOrgActivity(gate.orgId, {
+            uid: gate.uid,
+            email: gate.email
+        }, next === 'paused' ? 'Paused a mailbox in Sequences' : 'Resumed a mailbox in Sequences', {
+            type: OUTREACH_MAILBOX_ACTIVITY_TARGET,
+            id: mailbox.id,
+            name: activityName(mailbox)
+        });
+        return ok({
+            ok: true,
+            mailbox: _extends({}, mailbox, {
+                status: next,
+                autoPause: null,
+                updatedAtMs: nowMs
+            })
+        });
+    };
+    const test = async (request)=>{
+        if (request.method !== 'POST') return methodNotAllowed('POST');
+        const body = await readBody(request);
+        const loaded = await loadManagedMailbox(request, body, 'member');
+        if (loaded instanceof Response) return loaded;
+        const { gate, mailbox } = loaded;
+        if (mailbox.status === 'reconnect_required' || mailbox.status === 'disconnected') {
+            return refusal(409, 'reconnect-required', 'Reconnect this mailbox before sending from it.');
+        }
+        if (!deps.readConfig().configured) return notConfigured();
+        const limited = await deps.consumeRateLimit(`outreach-mailbox-test:${mailbox.id}`, {
+            limit: OUTREACH_TEST_SENDS_PER_HOUR,
+            windowMs: 60 * 60 * 1000
+        });
+        if (!limited.allowed) {
+            return refusal(429, 'rate-limited', `A mailbox can send ${OUTREACH_TEST_SENDS_PER_HOUR} tests an hour. Try again later.`);
+        }
+        const firestore = deps.firestore();
+        const nowMs = deps.now();
+        const opened = await openOutreachMailboxClient(firestore, {
+            mailboxId: mailbox.id
+        }, _extends({}, deps.transport, {
+            readConfig: deps.readConfig,
+            now: deps.now
+        }));
+        if (opened.ok === false) {
+            if (opened.reason === 'not-configured') return notConfigured();
+            await markOutreachMailboxReconnectRequired(firestore, {
+                orgId: gate.orgId,
+                mailboxId: mailbox.id,
+                errorCode: opened.reason,
+                nowMs
+            });
+            return refusal(409, 'reconnect-required', 'This mailbox needs to be connected again before it can send.');
+        }
+        try {
+            const sent = await sendOutreachMessage(opened.client, {
+                from: {
+                    address: mailbox.sendAs,
+                    name: mailbox.displayName
+                },
+                to: mailbox.email,
+                subject: 'Sequences test message',
+                text: [
+                    'This is a test message from Sequences.',
+                    '',
+                    `It was sent through your connected mailbox as ${mailbox.sendAs}. ` + 'If it reached your inbox, this mailbox can send.'
+                ].join('\n')
+            });
+            return ok({
+                ok: true,
+                sentTo: mailbox.email,
+                gmailMessageId: sent.gmailMessageId,
+                sentAtMs: nowMs
+            });
+        } catch (error) {
+            if (error instanceof GmailTransportError && error.reconnectRequired) {
+                await markOutreachMailboxReconnectRequired(firestore, {
+                    orgId: gate.orgId,
+                    mailboxId: mailbox.id,
+                    errorCode: error.code,
+                    nowMs
+                });
+                return refusal(409, 'reconnect-required', 'Google refused this mailbox’s access. Connect it again.');
+            }
+            if (error instanceof Rfc5322MessageError) {
+                return refusal(400, 'invalid-settings', `The test could not be written: ${error.message}`);
+            }
+            return googleUnavailable(error);
+        }
+    };
+    const disconnect = async (request)=>{
+        if (request.method !== 'POST') return methodNotAllowed('POST');
+        const body = await readBody(request);
+        const loaded = await loadManagedMailbox(request, body, 'member-or-admin');
+        if (loaded instanceof Response) return loaded;
+        const { gate, mailbox } = loaded;
+        const firestore = deps.firestore();
+        const credentialDoc = mailboxCredentialsRef(firestore, mailbox.id);
+        const snapshot = await credentialDoc.get();
+        const credential = readMailboxCredentials(snapshot.exists ? snapshot.data() : null);
+        const revocation = credential ? await revokeMailboxGrant(firestore, credential, deps) : 'already-invalid';
+        const batch = firestore.batch();
+        batch.delete(credentialDoc);
+        batch.delete(mailboxRef(firestore, gate.orgId, mailbox.id));
+        await batch.commit();
+        await deps.logOrgActivity(gate.orgId, {
+            uid: gate.uid,
+            email: gate.email
+        }, 'Disconnected a mailbox in Sequences', {
+            type: OUTREACH_MAILBOX_ACTIVITY_TARGET,
+            id: mailbox.id,
+            name: activityName(mailbox)
+        });
+        return ok({
+            ok: true,
+            revocation
+        });
+    };
+    return {
+        availability,
+        connect,
+        oauthCallback,
+        connectComplete,
+        settings,
+        status,
+        test,
+        disconnect
+    };
+}
+function googleUnavailable(error) {
+    if (!(error instanceof GmailTransportError)) throw error;
+    return refusal(502, 'google-unavailable', error.retryable ? 'Google did not answer. Try again in a moment.' : `Google refused the request: ${error.message}`);
+}
+
+//# sourceMappingURL=mailbox-routes.js.map