@aglyn/plugins-outreach 1.0.0-beta.224 → 1.0.0-beta.225

package/src/lib/transport/gmail-client.js

@@ -17,6 +17,7 @@
 import { GmailTransportError, gmailApiError } from "./gmail-errors.js";
 import { refreshGoogleAccessToken, revokeGoogleToken } from "./google-oauth.js";
 import { fetchWithBackoff, retryAfterMs } from "./http.js";
+import { bareMessageId, gmailSearchQuery } from "./mail-client.js";
 /**
  * THE GMAIL REST TRANSPORT (AGL-2978): one connected mailbox, as the calls
  * Outreach makes against it.
@@ -142,7 +143,29 @@ function metadataQuery(headers) {
             });
         }
     };
+    const listMessages = async (listOptions)=>{
+        const query = new URLSearchParams({
+            q: listOptions.q
+        });
+        if (listOptions.maxResults) query.set('maxResults', String(listOptions.maxResults));
+        if (listOptions.pageToken) query.set('pageToken', listOptions.pageToken);
+        if (listOptions.includeSpamTrash) query.set('includeSpamTrash', 'true');
+        const body = await call(`/messages?${query.toString()}`);
+        const messages = Array.isArray(body['messages']) ? body['messages'] : [];
+        return {
+            messages: messages.map((entry)=>{
+                const record = entry != null ? entry : {};
+                return {
+                    id: text(record['id']),
+                    threadId: text(record['threadId'])
+                };
+            }),
+            nextPageToken: text(body['nextPageToken']) || null,
+            resultSizeEstimate: Number(body['resultSizeEstimate']) || 0
+        };
+    };
     return {
+        provider: 'google',
         getAccessToken,
         async getProfile () {
             const body = await call('/profile');
@@ -199,27 +222,29 @@ function metadataQuery(headers) {
         async getFullMessage (messageId) {
             return readFullMessage(await call(`/messages/${encodeURIComponent(messageId)}?format=full`));
         },
-        async listMessages (listOptions) {
-            const query = new URLSearchParams({
-                q: listOptions.q
+        listMessages,
+        async searchMessages (search, page) {
+            var _ref, _ref1;
+            const list = await listMessages({
+                q: gmailSearchQuery(search),
+                maxResults: (_ref = page == null ? void 0 : page.maxResults) != null ? _ref : 100,
+                pageToken: (_ref1 = page == null ? void 0 : page.pageToken) != null ? _ref1 : null,
+                includeSpamTrash: true
             });
-            if (listOptions.maxResults) query.set('maxResults', String(listOptions.maxResults));
-            if (listOptions.pageToken) query.set('pageToken', listOptions.pageToken);
-            if (listOptions.includeSpamTrash) query.set('includeSpamTrash', 'true');
-            const body = await call(`/messages?${query.toString()}`);
-            const messages = Array.isArray(body['messages']) ? body['messages'] : [];
             return {
-                messages: messages.map((entry)=>{
-                    const record = entry != null ? entry : {};
-                    return {
-                        id: text(record['id']),
-                        threadId: text(record['threadId'])
-                    };
-                }),
-                nextPageToken: text(body['nextPageToken']) || null,
-                resultSizeEstimate: Number(body['resultSizeEstimate']) || 0
+                messages: list.messages.filter((message)=>message.id),
+                nextPageToken: list.nextPageToken
             };
         },
+        async findMessageByMessageId (messageId) {
+            var _found_messages_find;
+            const found = await listMessages({
+                q: `rfc822msgid:${bareMessageId(messageId)}`,
+                maxResults: 1,
+                includeSpamTrash: true
+            });
+            return (_found_messages_find = found.messages.find((message)=>message.id)) != null ? _found_messages_find : null;
+        },
         revoke () {
             return revokeGoogleToken(options.refreshToken, deps);
         }

package/src/lib/transport/gmail-client.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../../libs/plugins/outreach/src/lib/transport/gmail-client.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport type { GmailApiMessage } from '../engine/thread-message'\nimport { GmailTransportError, gmailApiError } from './gmail-errors'\nimport {\n  refreshGoogleAccessToken,\n  revokeGoogleToken,\n} from './google-oauth'\nimport { fetchWithBackoff, retryAfterMs, type TransportDeps } from './http'\n\n/**\n * THE GMAIL REST TRANSPORT (AGL-2978): one connected mailbox, as the calls\n * Outreach makes against it.\n *\n * Built per mailbox, per invocation, from the mailbox's refresh token. The\n * access token is minted on first use and reused until a minute before it\n * expires, so one cron pass over one mailbox — a send, a thread read, a\n * bounce search — refreshes once. Concurrent callers share the one refresh\n * in flight.\n *\n * A 401 from Gmail drops the cached token and retries the call once with a\n * fresh one: an access token can be refused before its stated expiry (a\n * password change, an admin action), and that is not yet a dead grant. If\n * the REFRESH is refused, it is — `invalid_grant`, `reconnectRequired`.\n *\n * Every failure is a `GmailTransportError`; see `gmail-errors.ts` for how a\n * caller decides between reconnecting, retrying later and giving up.\n */\n\nexport const GMAIL_API_BASE = 'https://gmail.googleapis.com/gmail/v1/users/me'\n\nexport interface GmailClientOptions extends TransportDeps {\n  clientId: string\n  clientSecret: string\n  refreshToken: string\n}\n\n/** `users.getProfile`. */\nexport interface GmailProfile {\n  emailAddress: string\n  messagesTotal: number\n  threadsTotal: number\n  historyId: string\n}\n\n/** One entry of `users.settings.sendAs.list`. */\nexport interface GmailSendAs {\n  sendAsEmail: string\n  displayName: string\n  replyToAddress: string | null\n  isPrimary: boolean\n  isDefault: boolean\n  treatAsAlias: boolean\n  /**\n   * `accepted` once Gmail verified the address; absent on the primary\n   * address, which needs no verification.\n   */\n  verificationStatus: string | null\n}\n\nexport interface GmailMessageHeader {\n  name: string\n  value: string\n}\n\n/** A message in `format=metadata`: ids, labels, snippet and the headers asked for. */\nexport interface GmailMessageMetadata {\n  id: string\n  threadId: string\n  labelIds: string[]\n  snippet: string\n  internalDateMs: number | null\n  headers: GmailMessageHeader[]\n}\n\nexport interface GmailThread {\n  id: string\n  historyId: string | null\n  messages: GmailMessageMetadata[]\n}\n\n/**\n * A thread in `format=full`: every message as Gmail returns it — headers,\n * MIME tree and base64url bodies — which is what the engine's\n * `outreachThreadMessageFromGmail` reads replies and bounces from.\n */\nexport interface GmailFullThread {\n  id: string\n  historyId: string | null\n  messages: GmailApiMessage[]\n}\n\nexport interface GmailMessageList {\n  messages: Array<{ id: string; threadId: string }>\n  nextPageToken: string | null\n  resultSizeEstimate: number\n}\n\nexport interface GmailSentMessage {\n  id: string\n  threadId: string\n  labelIds: string[]\n}\n\nexport interface GmailClient {\n  /** A live access token, minted or reused. */\n  getAccessToken(): Promise<string>\n  getProfile(): Promise<GmailProfile>\n  listSendAs(): Promise<GmailSendAs[]>\n  /**\n   * `messages.send`: `raw` is the base64url RFC 5322 message\n   * (`encodeGmailRawMessage`), and `threadId` files a follow-up into the\n   * thread its first step started.\n   */\n  sendMessage(input: { raw: string; threadId?: string | null }): Promise<GmailSentMessage>\n  /** `threads.get` with `format=metadata` and only the headers named. */\n  getThread(threadId: string, options?: { metadataHeaders?: readonly string[] }): Promise<GmailThread>\n  /**\n   * `threads.get` with `format=full`: every message whole, unflattened, for\n   * the engine's classifier — a reply's text, a bounce's delivery report.\n   */\n  getFullThread(threadId: string): Promise<GmailFullThread>\n  /** `messages.get` with `format=metadata` and only the headers named. */\n  getMessage(messageId: string, options?: { metadataHeaders?: readonly string[] }): Promise<GmailMessageMetadata>\n  /** `messages.get` with `format=full` — a message a search found, read whole. */\n  getFullMessage(messageId: string): Promise<GmailApiMessage>\n  /** `messages.list` with a Gmail search `q`. */\n  listMessages(options: {\n    q: string\n    maxResults?: number\n    pageToken?: string | null\n    includeSpamTrash?: boolean\n  }): Promise<GmailMessageList>\n  /** Revokes the grant at Google. `already-invalid` when it was dead. */\n  revoke(): Promise<'revoked' | 'already-invalid'>\n}\n\n/** Refresh this long before the stated expiry, so a slow call cannot cross it. */\nconst EXPIRY_MARGIN_MS = 60_000\n\nconst text = (value: unknown): string => (typeof value === 'string' ? value : '')\n\nfunction readMessage(value: unknown): GmailMessageMetadata {\n  const record = (value ?? {}) as Record<string, unknown>\n  const payload = (record['payload'] ?? {}) as { headers?: unknown }\n  const headers = Array.isArray(payload.headers) ? payload.headers : []\n  const internalDate = Number(record['internalDate'])\n  return {\n    id: text(record['id']),\n    threadId: text(record['threadId']),\n    labelIds: Array.isArray(record['labelIds']) ? record['labelIds'].map(String) : [],\n    snippet: text(record['snippet']),\n    internalDateMs: Number.isFinite(internalDate) ? internalDate : null,\n    headers: headers\n      .map((header) => header as { name?: unknown; value?: unknown })\n      .filter((header) => typeof header.name === 'string')\n      .map((header) => ({ name: String(header.name), value: text(header.value) })),\n  }\n}\n\nfunction readSendAs(value: unknown): GmailSendAs {\n  const record = (value ?? {}) as Record<string, unknown>\n  return {\n    sendAsEmail: text(record['sendAsEmail']).trim().toLowerCase(),\n    displayName: text(record['displayName']),\n    replyToAddress: text(record['replyToAddress']) || null,\n    isPrimary: record['isPrimary'] === true,\n    isDefault: record['isDefault'] === true,\n    treatAsAlias: record['treatAsAlias'] === true,\n    verificationStatus: text(record['verificationStatus']) || null,\n  }\n}\n\n/**\n * A `format=full` message, as Gmail sent it. Only the id is checked here: the\n * engine's reader decodes the rest defensively and never throws.\n */\nfunction readFullMessage(value: unknown): GmailApiMessage {\n  if (!value || typeof value !== 'object' || Array.isArray(value)) {\n    throw new GmailTransportError('unexpected', 'Gmail answered with a message that is not an object.')\n  }\n  const record = value as Record<string, unknown>\n  return { ...(record as unknown as GmailApiMessage), id: text(record['id']) }\n}\n\nfunction metadataQuery(headers: readonly string[] | undefined): string {\n  const query = new URLSearchParams({ format: 'metadata' })\n  for (const header of headers ?? []) query.append('metadataHeaders', header)\n  return query.toString()\n}\n\n/** A Gmail client for one mailbox. See the module comment. */\nexport function createGmailClient(options: GmailClientOptions): GmailClient {\n  const deps: TransportDeps = options\n  const now = options.now ?? Date.now\n  let cached: { token: string; expiresAtMs: number } | null = null\n  let refreshing: Promise<string> | null = null\n\n  const mint = (): Promise<string> => {\n    refreshing ??= refreshGoogleAccessToken(\n      {\n        clientId: options.clientId,\n        clientSecret: options.clientSecret,\n        refreshToken: options.refreshToken,\n      },\n      deps,\n    )\n      .then((minted) => {\n        cached = {\n          token: minted.accessToken,\n          expiresAtMs: now() + minted.expiresInSeconds * 1000,\n        }\n        return minted.accessToken\n      })\n      .finally(() => {\n        refreshing = null\n      })\n    return refreshing\n  }\n\n  const getAccessToken = async (): Promise<string> => {\n    if (cached && cached.expiresAtMs - EXPIRY_MARGIN_MS > now()) return cached.token\n    return mint()\n  }\n\n  /** One Gmail API call: authorized, retried per policy, 401 once refreshed. */\n  const call = async <T>(path: string, init: RequestInit = {}): Promise<T> => {\n    for (let tries = 0; ; tries += 1) {\n      const token = await getAccessToken()\n      const response = await fetchWithBackoff(\n        `${GMAIL_API_BASE}${path}`,\n        {\n          ...init,\n          headers: {\n            Accept: 'application/json',\n            ...(init.body ? { 'Content-Type': 'application/json' } : {}),\n            ...(init.headers as Record<string, string> | undefined),\n            Authorization: `Bearer ${token}`,\n          },\n        },\n        deps,\n      )\n      if (response.status === 401 && tries === 0) {\n        cached = null\n        continue\n      }\n      const body = await response.json().catch(() => null)\n      if (response.ok) {\n        if (body === null) {\n          throw new GmailTransportError('unexpected', 'Gmail answered with a body that is not JSON.', {\n            status: response.status,\n          })\n        }\n        return body as T\n      }\n      throw gmailApiError(response.status, body, { retryAfterMs: retryAfterMs(response, now()) })\n    }\n  }\n\n  return {\n    getAccessToken,\n\n    async getProfile() {\n      const body = await call<Record<string, unknown>>('/profile')\n      return {\n        emailAddress: text(body['emailAddress']).trim().toLowerCase(),\n        messagesTotal: Number(body['messagesTotal']) || 0,\n        threadsTotal: Number(body['threadsTotal']) || 0,\n        historyId: text(body['historyId']),\n      }\n    },\n\n    async listSendAs() {\n      const body = await call<{ sendAs?: unknown }>('/settings/sendAs')\n      return (Array.isArray(body.sendAs) ? body.sendAs : []).map(readSendAs)\n    },\n\n    async sendMessage(input) {\n      if (!input?.raw) {\n        throw new GmailTransportError('invalid_request', 'A message to send needs its raw content.')\n      }\n      const body = await call<Record<string, unknown>>('/messages/send', {\n        method: 'POST',\n        body: JSON.stringify({ raw: input.raw, ...(input.threadId ? { threadId: input.threadId } : {}) }),\n      })\n      return {\n        id: text(body['id']),\n        threadId: text(body['threadId']),\n        labelIds: Array.isArray(body['labelIds']) ? body['labelIds'].map(String) : [],\n      }\n    },\n\n    async getThread(threadId, threadOptions) {\n      const body = await call<Record<string, unknown>>(\n        `/threads/${encodeURIComponent(threadId)}?${metadataQuery(threadOptions?.metadataHeaders)}`,\n      )\n      return {\n        id: text(body['id']),\n        historyId: text(body['historyId']) || null,\n        messages: (Array.isArray(body['messages']) ? body['messages'] : []).map(readMessage),\n      }\n    },\n\n    async getFullThread(threadId) {\n      const body = await call<Record<string, unknown>>(\n        `/threads/${encodeURIComponent(threadId)}?format=full`,\n      )\n      return {\n        id: text(body['id']),\n        historyId: text(body['historyId']) || null,\n        // An entry that is not a message object is not one to classify.\n        messages: (Array.isArray(body['messages']) ? body['messages'] : [])\n          .filter((entry) => Boolean(entry) && typeof entry === 'object' && !Array.isArray(entry))\n          .map(readFullMessage),\n      }\n    },\n\n    async getMessage(messageId, messageOptions) {\n      const body = await call<unknown>(\n        `/messages/${encodeURIComponent(messageId)}?${metadataQuery(messageOptions?.metadataHeaders)}`,\n      )\n      return readMessage(body)\n    },\n\n    async getFullMessage(messageId) {\n      return readFullMessage(await call<unknown>(`/messages/${encodeURIComponent(messageId)}?format=full`))\n    },\n\n    async listMessages(listOptions) {\n      const query = new URLSearchParams({ q: listOptions.q })\n      if (listOptions.maxResults) query.set('maxResults', String(listOptions.maxResults))\n      if (listOptions.pageToken) query.set('pageToken', listOptions.pageToken)\n      if (listOptions.includeSpamTrash) query.set('includeSpamTrash', 'true')\n      const body = await call<Record<string, unknown>>(`/messages?${query.toString()}`)\n      const messages = Array.isArray(body['messages']) ? body['messages'] : []\n      return {\n        messages: messages.map((entry) => {\n          const record = (entry ?? {}) as Record<string, unknown>\n          return { id: text(record['id']), threadId: text(record['threadId']) }\n        }),\n        nextPageToken: text(body['nextPageToken']) || null,\n        resultSizeEstimate: Number(body['resultSizeEstimate']) || 0,\n      }\n    },\n\n    revoke() {\n      return revokeGoogleToken(options.refreshToken, deps)\n    },\n  }\n}\n"],"names":["GmailTransportError","gmailApiError","refreshGoogleAccessToken","revokeGoogleToken","fetchWithBackoff","retryAfterMs","GMAIL_API_BASE","EXPIRY_MARGIN_MS","text","value","readMessage","record","payload","headers","Array","isArray","internalDate","Number","id","threadId","labelIds","map","String","snippet","internalDateMs","isFinite","header","filter","name","readSendAs","sendAsEmail","trim","toLowerCase","displayName","replyToAddress","isPrimary","isDefault","treatAsAlias","verificationStatus","readFullMessage","metadataQuery","query","URLSearchParams","format","append","toString","createGmailClient","options","deps","now","Date","cached","refreshing","mint","clientId","clientSecret","refreshToken","then","minted","token","accessToken","expiresAtMs","expiresInSeconds","finally","getAccessToken","call","path","init","tries","response","Accept","body","Authorization","status","json","catch","ok","getProfile","emailAddress","messagesTotal","threadsTotal","historyId","listSendAs","sendAs","sendMessage","input","raw","method","JSON","stringify","getThread","threadOptions","encodeURIComponent","metadataHeaders","messages","getFullThread","entry","Boolean","getMessage","messageId","messageOptions","getFullMessage","listMessages","listOptions","q","maxResults","set","pageToken","includeSpamTrash","nextPageToken","resultSizeEstimate","revoke"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC;AAGD,SAASA,mBAAmB,EAAEC,aAAa,QAAQ,oBAAgB;AACnE,SACEC,wBAAwB,EACxBC,iBAAiB,QACZ,oBAAgB;AACvB,SAASC,gBAAgB,EAAEC,YAAY,QAA4B,YAAQ;AAE3E;;;;;;;;;;;;;;;;;CAiBC,GAED,OAAO,MAAMC,iBAAiB,iDAAgD;AA4G9E,gFAAgF,GAChF,MAAMC,mBAAmB;AAEzB,MAAMC,OAAO,CAACC,QAA4B,OAAOA,UAAU,WAAWA,QAAQ;AAE9E,SAASC,YAAYD,KAAc;QAEhBE;IADjB,MAAMA,SAAUF,gBAAAA,QAAS,CAAC;IAC1B,MAAMG,WAAWD,kBAAAA,MAAM,CAAC,UAAU,YAAjBA,kBAAqB,CAAC;IACvC,MAAME,UAAUC,MAAMC,OAAO,CAACH,QAAQC,OAAO,IAAID,QAAQC,OAAO,GAAG,EAAE;IACrE,MAAMG,eAAeC,OAAON,MAAM,CAAC,eAAe;IAClD,OAAO;QACLO,IAAIV,KAAKG,MAAM,CAAC,KAAK;QACrBQ,UAAUX,KAAKG,MAAM,CAAC,WAAW;QACjCS,UAAUN,MAAMC,OAAO,CAACJ,MAAM,CAAC,WAAW,IAAIA,MAAM,CAAC,WAAW,CAACU,GAAG,CAACC,UAAU,EAAE;QACjFC,SAASf,KAAKG,MAAM,CAAC,UAAU;QAC/Ba,gBAAgBP,OAAOQ,QAAQ,CAACT,gBAAgBA,eAAe;QAC/DH,SAASA,QACNQ,GAAG,CAAC,CAACK,SAAWA,QAChBC,MAAM,CAAC,CAACD,SAAW,OAAOA,OAAOE,IAAI,KAAK,UAC1CP,GAAG,CAAC,CAACK,SAAY,CAAA;gBAAEE,MAAMN,OAAOI,OAAOE,IAAI;gBAAGnB,OAAOD,KAAKkB,OAAOjB,KAAK;YAAE,CAAA;IAC7E;AACF;AAEA,SAASoB,WAAWpB,KAAc;IAChC,MAAME,SAAUF,gBAAAA,QAAS,CAAC;IAC1B,OAAO;QACLqB,aAAatB,KAAKG,MAAM,CAAC,cAAc,EAAEoB,IAAI,GAAGC,WAAW;QAC3DC,aAAazB,KAAKG,MAAM,CAAC,cAAc;QACvCuB,gBAAgB1B,KAAKG,MAAM,CAAC,iBAAiB,KAAK;QAClDwB,WAAWxB,MAAM,CAAC,YAAY,KAAK;QACnCyB,WAAWzB,MAAM,CAAC,YAAY,KAAK;QACnC0B,cAAc1B,MAAM,CAAC,eAAe,KAAK;QACzC2B,oBAAoB9B,KAAKG,MAAM,CAAC,qBAAqB,KAAK;IAC5D;AACF;AAEA;;;CAGC,GACD,SAAS4B,gBAAgB9B,KAAc;IACrC,IAAI,CAACA,SAAS,OAAOA,UAAU,YAAYK,MAAMC,OAAO,CAACN,QAAQ;QAC/D,MAAM,IAAIT,oBAAoB,cAAc;IAC9C;IACA,MAAMW,SAASF;IACf,OAAO,aAAME;QAAuCO,IAAIV,KAAKG,MAAM,CAAC,KAAK;;AAC3E;AAEA,SAAS6B,cAAc3B,OAAsC;IAC3D,MAAM4B,QAAQ,IAAIC,gBAAgB;QAAEC,QAAQ;IAAW;IACvD,KAAK,MAAMjB,UAAUb,kBAAAA,UAAW,EAAE,CAAE4B,MAAMG,MAAM,CAAC,mBAAmBlB;IACpE,OAAOe,MAAMI,QAAQ;AACvB;AAEA,4DAA4D,GAC5D,OAAO,SAASC,kBAAkBC,OAA2B;QAE/CA;IADZ,MAAMC,OAAsBD;IAC5B,MAAME,OAAMF,eAAAA,QAAQE,GAAG,YAAXF,eAAeG,KAAKD,GAAG;IACnC,IAAIE,SAAwD;IAC5D,IAAIC,aAAqC;IAEzC,MAAMC,OAAO;QACXD,qBAAAA,aAAAA,aAAelD,yBACb;YACEoD,UAAUP,QAAQO,QAAQ;YAC1BC,cAAcR,QAAQQ,YAAY;YAClCC,cAAcT,QAAQS,YAAY;QACpC,GACAR,MAECS,IAAI,CAAC,CAACC;YACLP,SAAS;gBACPQ,OAAOD,OAAOE,WAAW;gBACzBC,aAAaZ,QAAQS,OAAOI,gBAAgB,GAAG;YACjD;YACA,OAAOJ,OAAOE,WAAW;QAC3B,GACCG,OAAO,CAAC;YACPX,aAAa;QACf;QACF,OAAOA;IACT;IAEA,MAAMY,iBAAiB;QACrB,IAAIb,UAAUA,OAAOU,WAAW,GAAGtD,mBAAmB0C,OAAO,OAAOE,OAAOQ,KAAK;QAChF,OAAON;IACT;IAEA,4EAA4E,GAC5E,MAAMY,OAAO,OAAUC,MAAcC,OAAoB,CAAC,CAAC;QACzD,IAAK,IAAIC,QAAQ,IAAKA,SAAS,EAAG;YAChC,MAAMT,QAAQ,MAAMK;YACpB,MAAMK,WAAW,MAAMjE,iBACrB,GAAGE,iBAAiB4D,MAAM,EAC1B,aACKC;gBACHtD,SAAS;oBACPyD,QAAQ;mBACJH,KAAKI,IAAI,GAAG;oBAAE,gBAAgB;gBAAmB,IAAI,CAAC,GACtDJ,KAAKtD,OAAO;oBAChB2D,eAAe,CAAC,OAAO,EAAEb,OAAO;;gBAGpCX;YAEF,IAAIqB,SAASI,MAAM,KAAK,OAAOL,UAAU,GAAG;gBAC1CjB,SAAS;gBACT;YACF;YACA,MAAMoB,OAAO,MAAMF,SAASK,IAAI,GAAGC,KAAK,CAAC,IAAM;YAC/C,IAAIN,SAASO,EAAE,EAAE;gBACf,IAAIL,SAAS,MAAM;oBACjB,MAAM,IAAIvE,oBAAoB,cAAc,gDAAgD;wBAC1FyE,QAAQJ,SAASI,MAAM;oBACzB;gBACF;gBACA,OAAOF;YACT;YACA,MAAMtE,cAAcoE,SAASI,MAAM,EAAEF,MAAM;gBAAElE,cAAcA,aAAagE,UAAUpB;YAAO;QAC3F;IACF;IAEA,OAAO;QACLe;QAEA,MAAMa;YACJ,MAAMN,OAAO,MAAMN,KAA8B;YACjD,OAAO;gBACLa,cAActE,KAAK+D,IAAI,CAAC,eAAe,EAAExC,IAAI,GAAGC,WAAW;gBAC3D+C,eAAe9D,OAAOsD,IAAI,CAAC,gBAAgB,KAAK;gBAChDS,cAAc/D,OAAOsD,IAAI,CAAC,eAAe,KAAK;gBAC9CU,WAAWzE,KAAK+D,IAAI,CAAC,YAAY;YACnC;QACF;QAEA,MAAMW;YACJ,MAAMX,OAAO,MAAMN,KAA2B;YAC9C,OAAO,AAACnD,CAAAA,MAAMC,OAAO,CAACwD,KAAKY,MAAM,IAAIZ,KAAKY,MAAM,GAAG,EAAE,AAAD,EAAG9D,GAAG,CAACQ;QAC7D;QAEA,MAAMuD,aAAYC,KAAK;YACrB,IAAI,EAACA,yBAAAA,MAAOC,GAAG,GAAE;gBACf,MAAM,IAAItF,oBAAoB,mBAAmB;YACnD;YACA,MAAMuE,OAAO,MAAMN,KAA8B,kBAAkB;gBACjEsB,QAAQ;gBACRhB,MAAMiB,KAAKC,SAAS,CAAC;oBAAEH,KAAKD,MAAMC,GAAG;mBAAMD,MAAMlE,QAAQ,GAAG;oBAAEA,UAAUkE,MAAMlE,QAAQ;gBAAC,IAAI,CAAC;YAC9F;YACA,OAAO;gBACLD,IAAIV,KAAK+D,IAAI,CAAC,KAAK;gBACnBpD,UAAUX,KAAK+D,IAAI,CAAC,WAAW;gBAC/BnD,UAAUN,MAAMC,OAAO,CAACwD,IAAI,CAAC,WAAW,IAAIA,IAAI,CAAC,WAAW,CAAClD,GAAG,CAACC,UAAU,EAAE;YAC/E;QACF;QAEA,MAAMoE,WAAUvE,QAAQ,EAAEwE,aAAa;YACrC,MAAMpB,OAAO,MAAMN,KACjB,CAAC,SAAS,EAAE2B,mBAAmBzE,UAAU,CAAC,EAAEqB,cAAcmD,iCAAAA,cAAeE,eAAe,GAAG;YAE7F,OAAO;gBACL3E,IAAIV,KAAK+D,IAAI,CAAC,KAAK;gBACnBU,WAAWzE,KAAK+D,IAAI,CAAC,YAAY,KAAK;gBACtCuB,UAAU,AAAChF,CAAAA,MAAMC,OAAO,CAACwD,IAAI,CAAC,WAAW,IAAIA,IAAI,CAAC,WAAW,GAAG,EAAE,AAAD,EAAGlD,GAAG,CAACX;YAC1E;QACF;QAEA,MAAMqF,eAAc5E,QAAQ;YAC1B,MAAMoD,OAAO,MAAMN,KACjB,CAAC,SAAS,EAAE2B,mBAAmBzE,UAAU,YAAY,CAAC;YAExD,OAAO;gBACLD,IAAIV,KAAK+D,IAAI,CAAC,KAAK;gBACnBU,WAAWzE,KAAK+D,IAAI,CAAC,YAAY,KAAK;gBACtC,gEAAgE;gBAChEuB,UAAU,AAAChF,CAAAA,MAAMC,OAAO,CAACwD,IAAI,CAAC,WAAW,IAAIA,IAAI,CAAC,WAAW,GAAG,EAAE,AAAD,EAC9D5C,MAAM,CAAC,CAACqE,QAAUC,QAAQD,UAAU,OAAOA,UAAU,YAAY,CAAClF,MAAMC,OAAO,CAACiF,QAChF3E,GAAG,CAACkB;YACT;QACF;QAEA,MAAM2D,YAAWC,SAAS,EAAEC,cAAc;YACxC,MAAM7B,OAAO,MAAMN,KACjB,CAAC,UAAU,EAAE2B,mBAAmBO,WAAW,CAAC,EAAE3D,cAAc4D,kCAAAA,eAAgBP,eAAe,GAAG;YAEhG,OAAOnF,YAAY6D;QACrB;QAEA,MAAM8B,gBAAeF,SAAS;YAC5B,OAAO5D,gBAAgB,MAAM0B,KAAc,CAAC,UAAU,EAAE2B,mBAAmBO,WAAW,YAAY,CAAC;QACrG;QAEA,MAAMG,cAAaC,WAAW;YAC5B,MAAM9D,QAAQ,IAAIC,gBAAgB;gBAAE8D,GAAGD,YAAYC,CAAC;YAAC;YACrD,IAAID,YAAYE,UAAU,EAAEhE,MAAMiE,GAAG,CAAC,cAAcpF,OAAOiF,YAAYE,UAAU;YACjF,IAAIF,YAAYI,SAAS,EAAElE,MAAMiE,GAAG,CAAC,aAAaH,YAAYI,SAAS;YACvE,IAAIJ,YAAYK,gBAAgB,EAAEnE,MAAMiE,GAAG,CAAC,oBAAoB;YAChE,MAAMnC,OAAO,MAAMN,KAA8B,CAAC,UAAU,EAAExB,MAAMI,QAAQ,IAAI;YAChF,MAAMiD,WAAWhF,MAAMC,OAAO,CAACwD,IAAI,CAAC,WAAW,IAAIA,IAAI,CAAC,WAAW,GAAG,EAAE;YACxE,OAAO;gBACLuB,UAAUA,SAASzE,GAAG,CAAC,CAAC2E;oBACtB,MAAMrF,SAAUqF,gBAAAA,QAAS,CAAC;oBAC1B,OAAO;wBAAE9E,IAAIV,KAAKG,MAAM,CAAC,KAAK;wBAAGQ,UAAUX,KAAKG,MAAM,CAAC,WAAW;oBAAE;gBACtE;gBACAkG,eAAerG,KAAK+D,IAAI,CAAC,gBAAgB,KAAK;gBAC9CuC,oBAAoB7F,OAAOsD,IAAI,CAAC,qBAAqB,KAAK;YAC5D;QACF;QAEAwC;YACE,OAAO5G,kBAAkB4C,QAAQS,YAAY,EAAER;QACjD;IACF;AACF"}
+{"version":3,"sources":["../../../../../../../libs/plugins/outreach/src/lib/transport/gmail-client.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport type { GmailApiMessage } from '../engine/thread-message'\nimport { GmailTransportError, gmailApiError } from './gmail-errors'\nimport {\n  refreshGoogleAccessToken,\n  revokeGoogleToken,\n} from './google-oauth'\nimport { fetchWithBackoff, retryAfterMs, type TransportDeps } from './http'\nimport {\n  bareMessageId,\n  gmailSearchQuery,\n  type OutreachMailClient,\n  type OutreachMailMetadata,\n} from './mail-client'\n\n/**\n * THE GMAIL REST TRANSPORT (AGL-2978): one connected mailbox, as the calls\n * Outreach makes against it.\n *\n * Built per mailbox, per invocation, from the mailbox's refresh token. The\n * access token is minted on first use and reused until a minute before it\n * expires, so one cron pass over one mailbox — a send, a thread read, a\n * bounce search — refreshes once. Concurrent callers share the one refresh\n * in flight.\n *\n * A 401 from Gmail drops the cached token and retries the call once with a\n * fresh one: an access token can be refused before its stated expiry (a\n * password change, an admin action), and that is not yet a dead grant. If\n * the REFRESH is refused, it is — `invalid_grant`, `reconnectRequired`.\n *\n * Every failure is a `GmailTransportError`; see `gmail-errors.ts` for how a\n * caller decides between reconnecting, retrying later and giving up.\n */\n\nexport const GMAIL_API_BASE = 'https://gmail.googleapis.com/gmail/v1/users/me'\n\nexport interface GmailClientOptions extends TransportDeps {\n  clientId: string\n  clientSecret: string\n  refreshToken: string\n}\n\n/** `users.getProfile`. */\nexport interface GmailProfile {\n  emailAddress: string\n  messagesTotal: number\n  threadsTotal: number\n  historyId: string\n}\n\n/** One entry of `users.settings.sendAs.list`. */\nexport interface GmailSendAs {\n  sendAsEmail: string\n  displayName: string\n  replyToAddress: string | null\n  isPrimary: boolean\n  isDefault: boolean\n  treatAsAlias: boolean\n  /**\n   * `accepted` once Gmail verified the address; absent on the primary\n   * address, which needs no verification.\n   */\n  verificationStatus: string | null\n}\n\nexport interface GmailMessageHeader {\n  name: string\n  value: string\n}\n\n/** A message in `format=metadata`: ids, labels, snippet and the headers asked for. */\nexport type GmailMessageMetadata = OutreachMailMetadata\n\nexport interface GmailThread {\n  id: string\n  historyId: string | null\n  messages: GmailMessageMetadata[]\n}\n\n/**\n * A thread in `format=full`: every message as Gmail returns it — headers,\n * MIME tree and base64url bodies — which is what the engine's\n * `outreachThreadMessageFromGmail` reads replies and bounces from.\n */\nexport interface GmailFullThread {\n  id: string\n  historyId: string | null\n  messages: GmailApiMessage[]\n}\n\nexport interface GmailMessageList {\n  messages: Array<{ id: string; threadId: string }>\n  nextPageToken: string | null\n  resultSizeEstimate: number\n}\n\nexport interface GmailSentMessage {\n  id: string\n  threadId: string\n  labelIds: string[]\n}\n\nexport interface GmailClient extends OutreachMailClient {\n  readonly provider: 'google'\n  getProfile(): Promise<GmailProfile>\n  listSendAs(): Promise<GmailSendAs[]>\n  /**\n   * `messages.send`: `raw` is the base64url RFC 5322 message\n   * (`encodeGmailRawMessage`), and `threadId` files a follow-up into the\n   * thread its first step started.\n   */\n  sendMessage(input: { raw: string; threadId?: string | null }): Promise<GmailSentMessage>\n  /** `threads.get` with `format=metadata` and only the headers named. */\n  getThread(threadId: string, options?: { metadataHeaders?: readonly string[] }): Promise<GmailThread>\n  /**\n   * `threads.get` with `format=full`: every message whole, unflattened, for\n   * the engine's classifier — a reply's text, a bounce's delivery report.\n   */\n  getFullThread(threadId: string): Promise<GmailFullThread>\n  /** `messages.get` with `format=metadata` and only the headers named. */\n  getMessage(messageId: string, options?: { metadataHeaders?: readonly string[] }): Promise<GmailMessageMetadata>\n  /** `messages.get` with `format=full` — a message a search found, read whole. */\n  getFullMessage(messageId: string): Promise<GmailApiMessage>\n  /** `messages.list` with a Gmail search `q`. */\n  listMessages(options: {\n    q: string\n    maxResults?: number\n    pageToken?: string | null\n    includeSpamTrash?: boolean\n  }): Promise<GmailMessageList>\n  /** Revokes the grant at Google. `already-invalid` when it was dead. */\n  revoke(): Promise<'revoked' | 'already-invalid'>\n}\n\n/** Refresh this long before the stated expiry, so a slow call cannot cross it. */\nconst EXPIRY_MARGIN_MS = 60_000\n\nconst text = (value: unknown): string => (typeof value === 'string' ? value : '')\n\nfunction readMessage(value: unknown): GmailMessageMetadata {\n  const record = (value ?? {}) as Record<string, unknown>\n  const payload = (record['payload'] ?? {}) as { headers?: unknown }\n  const headers = Array.isArray(payload.headers) ? payload.headers : []\n  const internalDate = Number(record['internalDate'])\n  return {\n    id: text(record['id']),\n    threadId: text(record['threadId']),\n    labelIds: Array.isArray(record['labelIds']) ? record['labelIds'].map(String) : [],\n    snippet: text(record['snippet']),\n    internalDateMs: Number.isFinite(internalDate) ? internalDate : null,\n    headers: headers\n      .map((header) => header as { name?: unknown; value?: unknown })\n      .filter((header) => typeof header.name === 'string')\n      .map((header) => ({ name: String(header.name), value: text(header.value) })),\n  }\n}\n\nfunction readSendAs(value: unknown): GmailSendAs {\n  const record = (value ?? {}) as Record<string, unknown>\n  return {\n    sendAsEmail: text(record['sendAsEmail']).trim().toLowerCase(),\n    displayName: text(record['displayName']),\n    replyToAddress: text(record['replyToAddress']) || null,\n    isPrimary: record['isPrimary'] === true,\n    isDefault: record['isDefault'] === true,\n    treatAsAlias: record['treatAsAlias'] === true,\n    verificationStatus: text(record['verificationStatus']) || null,\n  }\n}\n\n/**\n * A `format=full` message, as Gmail sent it. Only the id is checked here: the\n * engine's reader decodes the rest defensively and never throws.\n */\nfunction readFullMessage(value: unknown): GmailApiMessage {\n  if (!value || typeof value !== 'object' || Array.isArray(value)) {\n    throw new GmailTransportError('unexpected', 'Gmail answered with a message that is not an object.')\n  }\n  const record = value as Record<string, unknown>\n  return { ...(record as unknown as GmailApiMessage), id: text(record['id']) }\n}\n\nfunction metadataQuery(headers: readonly string[] | undefined): string {\n  const query = new URLSearchParams({ format: 'metadata' })\n  for (const header of headers ?? []) query.append('metadataHeaders', header)\n  return query.toString()\n}\n\n/** A Gmail client for one mailbox. See the module comment. */\nexport function createGmailClient(options: GmailClientOptions): GmailClient {\n  const deps: TransportDeps = options\n  const now = options.now ?? Date.now\n  let cached: { token: string; expiresAtMs: number } | null = null\n  let refreshing: Promise<string> | null = null\n\n  const mint = (): Promise<string> => {\n    refreshing ??= refreshGoogleAccessToken(\n      {\n        clientId: options.clientId,\n        clientSecret: options.clientSecret,\n        refreshToken: options.refreshToken,\n      },\n      deps,\n    )\n      .then((minted) => {\n        cached = {\n          token: minted.accessToken,\n          expiresAtMs: now() + minted.expiresInSeconds * 1000,\n        }\n        return minted.accessToken\n      })\n      .finally(() => {\n        refreshing = null\n      })\n    return refreshing\n  }\n\n  const getAccessToken = async (): Promise<string> => {\n    if (cached && cached.expiresAtMs - EXPIRY_MARGIN_MS > now()) return cached.token\n    return mint()\n  }\n\n  /** One Gmail API call: authorized, retried per policy, 401 once refreshed. */\n  const call = async <T>(path: string, init: RequestInit = {}): Promise<T> => {\n    for (let tries = 0; ; tries += 1) {\n      const token = await getAccessToken()\n      const response = await fetchWithBackoff(\n        `${GMAIL_API_BASE}${path}`,\n        {\n          ...init,\n          headers: {\n            Accept: 'application/json',\n            ...(init.body ? { 'Content-Type': 'application/json' } : {}),\n            ...(init.headers as Record<string, string> | undefined),\n            Authorization: `Bearer ${token}`,\n          },\n        },\n        deps,\n      )\n      if (response.status === 401 && tries === 0) {\n        cached = null\n        continue\n      }\n      const body = await response.json().catch(() => null)\n      if (response.ok) {\n        if (body === null) {\n          throw new GmailTransportError('unexpected', 'Gmail answered with a body that is not JSON.', {\n            status: response.status,\n          })\n        }\n        return body as T\n      }\n      throw gmailApiError(response.status, body, { retryAfterMs: retryAfterMs(response, now()) })\n    }\n  }\n\n  const listMessages: GmailClient['listMessages'] = async (listOptions) => {\n    const query = new URLSearchParams({ q: listOptions.q })\n    if (listOptions.maxResults) query.set('maxResults', String(listOptions.maxResults))\n    if (listOptions.pageToken) query.set('pageToken', listOptions.pageToken)\n    if (listOptions.includeSpamTrash) query.set('includeSpamTrash', 'true')\n    const body = await call<Record<string, unknown>>(`/messages?${query.toString()}`)\n    const messages = Array.isArray(body['messages']) ? body['messages'] : []\n    return {\n      messages: messages.map((entry) => {\n        const record = (entry ?? {}) as Record<string, unknown>\n        return { id: text(record['id']), threadId: text(record['threadId']) }\n      }),\n      nextPageToken: text(body['nextPageToken']) || null,\n      resultSizeEstimate: Number(body['resultSizeEstimate']) || 0,\n    }\n  }\n\n  return {\n    provider: 'google',\n    getAccessToken,\n\n    async getProfile() {\n      const body = await call<Record<string, unknown>>('/profile')\n      return {\n        emailAddress: text(body['emailAddress']).trim().toLowerCase(),\n        messagesTotal: Number(body['messagesTotal']) || 0,\n        threadsTotal: Number(body['threadsTotal']) || 0,\n        historyId: text(body['historyId']),\n      }\n    },\n\n    async listSendAs() {\n      const body = await call<{ sendAs?: unknown }>('/settings/sendAs')\n      return (Array.isArray(body.sendAs) ? body.sendAs : []).map(readSendAs)\n    },\n\n    async sendMessage(input) {\n      if (!input?.raw) {\n        throw new GmailTransportError('invalid_request', 'A message to send needs its raw content.')\n      }\n      const body = await call<Record<string, unknown>>('/messages/send', {\n        method: 'POST',\n        body: JSON.stringify({ raw: input.raw, ...(input.threadId ? { threadId: input.threadId } : {}) }),\n      })\n      return {\n        id: text(body['id']),\n        threadId: text(body['threadId']),\n        labelIds: Array.isArray(body['labelIds']) ? body['labelIds'].map(String) : [],\n      }\n    },\n\n    async getThread(threadId, threadOptions) {\n      const body = await call<Record<string, unknown>>(\n        `/threads/${encodeURIComponent(threadId)}?${metadataQuery(threadOptions?.metadataHeaders)}`,\n      )\n      return {\n        id: text(body['id']),\n        historyId: text(body['historyId']) || null,\n        messages: (Array.isArray(body['messages']) ? body['messages'] : []).map(readMessage),\n      }\n    },\n\n    async getFullThread(threadId) {\n      const body = await call<Record<string, unknown>>(\n        `/threads/${encodeURIComponent(threadId)}?format=full`,\n      )\n      return {\n        id: text(body['id']),\n        historyId: text(body['historyId']) || null,\n        // An entry that is not a message object is not one to classify.\n        messages: (Array.isArray(body['messages']) ? body['messages'] : [])\n          .filter((entry) => Boolean(entry) && typeof entry === 'object' && !Array.isArray(entry))\n          .map(readFullMessage),\n      }\n    },\n\n    async getMessage(messageId, messageOptions) {\n      const body = await call<unknown>(\n        `/messages/${encodeURIComponent(messageId)}?${metadataQuery(messageOptions?.metadataHeaders)}`,\n      )\n      return readMessage(body)\n    },\n\n    async getFullMessage(messageId) {\n      return readFullMessage(await call<unknown>(`/messages/${encodeURIComponent(messageId)}?format=full`))\n    },\n\n    listMessages,\n\n    async searchMessages(search, page) {\n      const list = await listMessages({\n        q: gmailSearchQuery(search),\n        maxResults: page?.maxResults ?? 100,\n        pageToken: page?.pageToken ?? null,\n        includeSpamTrash: true,\n      })\n      return { messages: list.messages.filter((message) => message.id), nextPageToken: list.nextPageToken }\n    },\n\n    async findMessageByMessageId(messageId) {\n      const found = await listMessages({\n        q: `rfc822msgid:${bareMessageId(messageId)}`,\n        maxResults: 1,\n        includeSpamTrash: true,\n      })\n      return found.messages.find((message) => message.id) ?? null\n    },\n\n    revoke() {\n      return revokeGoogleToken(options.refreshToken, deps)\n    },\n  }\n}\n"],"names":["GmailTransportError","gmailApiError","refreshGoogleAccessToken","revokeGoogleToken","fetchWithBackoff","retryAfterMs","bareMessageId","gmailSearchQuery","GMAIL_API_BASE","EXPIRY_MARGIN_MS","text","value","readMessage","record","payload","headers","Array","isArray","internalDate","Number","id","threadId","labelIds","map","String","snippet","internalDateMs","isFinite","header","filter","name","readSendAs","sendAsEmail","trim","toLowerCase","displayName","replyToAddress","isPrimary","isDefault","treatAsAlias","verificationStatus","readFullMessage","metadataQuery","query","URLSearchParams","format","append","toString","createGmailClient","options","deps","now","Date","cached","refreshing","mint","clientId","clientSecret","refreshToken","then","minted","token","accessToken","expiresAtMs","expiresInSeconds","finally","getAccessToken","call","path","init","tries","response","Accept","body","Authorization","status","json","catch","ok","listMessages","listOptions","q","maxResults","set","pageToken","includeSpamTrash","messages","entry","nextPageToken","resultSizeEstimate","provider","getProfile","emailAddress","messagesTotal","threadsTotal","historyId","listSendAs","sendAs","sendMessage","input","raw","method","JSON","stringify","getThread","threadOptions","encodeURIComponent","metadataHeaders","getFullThread","Boolean","getMessage","messageId","messageOptions","getFullMessage","searchMessages","search","page","list","message","findMessageByMessageId","found","find","revoke"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC;AAGD,SAASA,mBAAmB,EAAEC,aAAa,QAAQ,oBAAgB;AACnE,SACEC,wBAAwB,EACxBC,iBAAiB,QACZ,oBAAgB;AACvB,SAASC,gBAAgB,EAAEC,YAAY,QAA4B,YAAQ;AAC3E,SACEC,aAAa,EACbC,gBAAgB,QAGX,mBAAe;AAEtB;;;;;;;;;;;;;;;;;CAiBC,GAED,OAAO,MAAMC,iBAAiB,iDAAgD;AAoG9E,gFAAgF,GAChF,MAAMC,mBAAmB;AAEzB,MAAMC,OAAO,CAACC,QAA4B,OAAOA,UAAU,WAAWA,QAAQ;AAE9E,SAASC,YAAYD,KAAc;QAEhBE;IADjB,MAAMA,SAAUF,gBAAAA,QAAS,CAAC;IAC1B,MAAMG,WAAWD,kBAAAA,MAAM,CAAC,UAAU,YAAjBA,kBAAqB,CAAC;IACvC,MAAME,UAAUC,MAAMC,OAAO,CAACH,QAAQC,OAAO,IAAID,QAAQC,OAAO,GAAG,EAAE;IACrE,MAAMG,eAAeC,OAAON,MAAM,CAAC,eAAe;IAClD,OAAO;QACLO,IAAIV,KAAKG,MAAM,CAAC,KAAK;QACrBQ,UAAUX,KAAKG,MAAM,CAAC,WAAW;QACjCS,UAAUN,MAAMC,OAAO,CAACJ,MAAM,CAAC,WAAW,IAAIA,MAAM,CAAC,WAAW,CAACU,GAAG,CAACC,UAAU,EAAE;QACjFC,SAASf,KAAKG,MAAM,CAAC,UAAU;QAC/Ba,gBAAgBP,OAAOQ,QAAQ,CAACT,gBAAgBA,eAAe;QAC/DH,SAASA,QACNQ,GAAG,CAAC,CAACK,SAAWA,QAChBC,MAAM,CAAC,CAACD,SAAW,OAAOA,OAAOE,IAAI,KAAK,UAC1CP,GAAG,CAAC,CAACK,SAAY,CAAA;gBAAEE,MAAMN,OAAOI,OAAOE,IAAI;gBAAGnB,OAAOD,KAAKkB,OAAOjB,KAAK;YAAE,CAAA;IAC7E;AACF;AAEA,SAASoB,WAAWpB,KAAc;IAChC,MAAME,SAAUF,gBAAAA,QAAS,CAAC;IAC1B,OAAO;QACLqB,aAAatB,KAAKG,MAAM,CAAC,cAAc,EAAEoB,IAAI,GAAGC,WAAW;QAC3DC,aAAazB,KAAKG,MAAM,CAAC,cAAc;QACvCuB,gBAAgB1B,KAAKG,MAAM,CAAC,iBAAiB,KAAK;QAClDwB,WAAWxB,MAAM,CAAC,YAAY,KAAK;QACnCyB,WAAWzB,MAAM,CAAC,YAAY,KAAK;QACnC0B,cAAc1B,MAAM,CAAC,eAAe,KAAK;QACzC2B,oBAAoB9B,KAAKG,MAAM,CAAC,qBAAqB,KAAK;IAC5D;AACF;AAEA;;;CAGC,GACD,SAAS4B,gBAAgB9B,KAAc;IACrC,IAAI,CAACA,SAAS,OAAOA,UAAU,YAAYK,MAAMC,OAAO,CAACN,QAAQ;QAC/D,MAAM,IAAIX,oBAAoB,cAAc;IAC9C;IACA,MAAMa,SAASF;IACf,OAAO,aAAME;QAAuCO,IAAIV,KAAKG,MAAM,CAAC,KAAK;;AAC3E;AAEA,SAAS6B,cAAc3B,OAAsC;IAC3D,MAAM4B,QAAQ,IAAIC,gBAAgB;QAAEC,QAAQ;IAAW;IACvD,KAAK,MAAMjB,UAAUb,kBAAAA,UAAW,EAAE,CAAE4B,MAAMG,MAAM,CAAC,mBAAmBlB;IACpE,OAAOe,MAAMI,QAAQ;AACvB;AAEA,4DAA4D,GAC5D,OAAO,SAASC,kBAAkBC,OAA2B;QAE/CA;IADZ,MAAMC,OAAsBD;IAC5B,MAAME,OAAMF,eAAAA,QAAQE,GAAG,YAAXF,eAAeG,KAAKD,GAAG;IACnC,IAAIE,SAAwD;IAC5D,IAAIC,aAAqC;IAEzC,MAAMC,OAAO;QACXD,qBAAAA,aAAAA,aAAepD,yBACb;YACEsD,UAAUP,QAAQO,QAAQ;YAC1BC,cAAcR,QAAQQ,YAAY;YAClCC,cAAcT,QAAQS,YAAY;QACpC,GACAR,MAECS,IAAI,CAAC,CAACC;YACLP,SAAS;gBACPQ,OAAOD,OAAOE,WAAW;gBACzBC,aAAaZ,QAAQS,OAAOI,gBAAgB,GAAG;YACjD;YACA,OAAOJ,OAAOE,WAAW;QAC3B,GACCG,OAAO,CAAC;YACPX,aAAa;QACf;QACF,OAAOA;IACT;IAEA,MAAMY,iBAAiB;QACrB,IAAIb,UAAUA,OAAOU,WAAW,GAAGtD,mBAAmB0C,OAAO,OAAOE,OAAOQ,KAAK;QAChF,OAAON;IACT;IAEA,4EAA4E,GAC5E,MAAMY,OAAO,OAAUC,MAAcC,OAAoB,CAAC,CAAC;QACzD,IAAK,IAAIC,QAAQ,IAAKA,SAAS,EAAG;YAChC,MAAMT,QAAQ,MAAMK;YACpB,MAAMK,WAAW,MAAMnE,iBACrB,GAAGI,iBAAiB4D,MAAM,EAC1B,aACKC;gBACHtD,SAAS;oBACPyD,QAAQ;mBACJH,KAAKI,IAAI,GAAG;oBAAE,gBAAgB;gBAAmB,IAAI,CAAC,GACtDJ,KAAKtD,OAAO;oBAChB2D,eAAe,CAAC,OAAO,EAAEb,OAAO;;gBAGpCX;YAEF,IAAIqB,SAASI,MAAM,KAAK,OAAOL,UAAU,GAAG;gBAC1CjB,SAAS;gBACT;YACF;YACA,MAAMoB,OAAO,MAAMF,SAASK,IAAI,GAAGC,KAAK,CAAC,IAAM;YAC/C,IAAIN,SAASO,EAAE,EAAE;gBACf,IAAIL,SAAS,MAAM;oBACjB,MAAM,IAAIzE,oBAAoB,cAAc,gDAAgD;wBAC1F2E,QAAQJ,SAASI,MAAM;oBACzB;gBACF;gBACA,OAAOF;YACT;YACA,MAAMxE,cAAcsE,SAASI,MAAM,EAAEF,MAAM;gBAAEpE,cAAcA,aAAakE,UAAUpB;YAAO;QAC3F;IACF;IAEA,MAAM4B,eAA4C,OAAOC;QACvD,MAAMrC,QAAQ,IAAIC,gBAAgB;YAAEqC,GAAGD,YAAYC,CAAC;QAAC;QACrD,IAAID,YAAYE,UAAU,EAAEvC,MAAMwC,GAAG,CAAC,cAAc3D,OAAOwD,YAAYE,UAAU;QACjF,IAAIF,YAAYI,SAAS,EAAEzC,MAAMwC,GAAG,CAAC,aAAaH,YAAYI,SAAS;QACvE,IAAIJ,YAAYK,gBAAgB,EAAE1C,MAAMwC,GAAG,CAAC,oBAAoB;QAChE,MAAMV,OAAO,MAAMN,KAA8B,CAAC,UAAU,EAAExB,MAAMI,QAAQ,IAAI;QAChF,MAAMuC,WAAWtE,MAAMC,OAAO,CAACwD,IAAI,CAAC,WAAW,IAAIA,IAAI,CAAC,WAAW,GAAG,EAAE;QACxE,OAAO;YACLa,UAAUA,SAAS/D,GAAG,CAAC,CAACgE;gBACtB,MAAM1E,SAAU0E,gBAAAA,QAAS,CAAC;gBAC1B,OAAO;oBAAEnE,IAAIV,KAAKG,MAAM,CAAC,KAAK;oBAAGQ,UAAUX,KAAKG,MAAM,CAAC,WAAW;gBAAE;YACtE;YACA2E,eAAe9E,KAAK+D,IAAI,CAAC,gBAAgB,KAAK;YAC9CgB,oBAAoBtE,OAAOsD,IAAI,CAAC,qBAAqB,KAAK;QAC5D;IACF;IAEA,OAAO;QACLiB,UAAU;QACVxB;QAEA,MAAMyB;YACJ,MAAMlB,OAAO,MAAMN,KAA8B;YACjD,OAAO;gBACLyB,cAAclF,KAAK+D,IAAI,CAAC,eAAe,EAAExC,IAAI,GAAGC,WAAW;gBAC3D2D,eAAe1E,OAAOsD,IAAI,CAAC,gBAAgB,KAAK;gBAChDqB,cAAc3E,OAAOsD,IAAI,CAAC,eAAe,KAAK;gBAC9CsB,WAAWrF,KAAK+D,IAAI,CAAC,YAAY;YACnC;QACF;QAEA,MAAMuB;YACJ,MAAMvB,OAAO,MAAMN,KAA2B;YAC9C,OAAO,AAACnD,CAAAA,MAAMC,OAAO,CAACwD,KAAKwB,MAAM,IAAIxB,KAAKwB,MAAM,GAAG,EAAE,AAAD,EAAG1E,GAAG,CAACQ;QAC7D;QAEA,MAAMmE,aAAYC,KAAK;YACrB,IAAI,EAACA,yBAAAA,MAAOC,GAAG,GAAE;gBACf,MAAM,IAAIpG,oBAAoB,mBAAmB;YACnD;YACA,MAAMyE,OAAO,MAAMN,KAA8B,kBAAkB;gBACjEkC,QAAQ;gBACR5B,MAAM6B,KAAKC,SAAS,CAAC;oBAAEH,KAAKD,MAAMC,GAAG;mBAAMD,MAAM9E,QAAQ,GAAG;oBAAEA,UAAU8E,MAAM9E,QAAQ;gBAAC,IAAI,CAAC;YAC9F;YACA,OAAO;gBACLD,IAAIV,KAAK+D,IAAI,CAAC,KAAK;gBACnBpD,UAAUX,KAAK+D,IAAI,CAAC,WAAW;gBAC/BnD,UAAUN,MAAMC,OAAO,CAACwD,IAAI,CAAC,WAAW,IAAIA,IAAI,CAAC,WAAW,CAAClD,GAAG,CAACC,UAAU,EAAE;YAC/E;QACF;QAEA,MAAMgF,WAAUnF,QAAQ,EAAEoF,aAAa;YACrC,MAAMhC,OAAO,MAAMN,KACjB,CAAC,SAAS,EAAEuC,mBAAmBrF,UAAU,CAAC,EAAEqB,cAAc+D,iCAAAA,cAAeE,eAAe,GAAG;YAE7F,OAAO;gBACLvF,IAAIV,KAAK+D,IAAI,CAAC,KAAK;gBACnBsB,WAAWrF,KAAK+D,IAAI,CAAC,YAAY,KAAK;gBACtCa,UAAU,AAACtE,CAAAA,MAAMC,OAAO,CAACwD,IAAI,CAAC,WAAW,IAAIA,IAAI,CAAC,WAAW,GAAG,EAAE,AAAD,EAAGlD,GAAG,CAACX;YAC1E;QACF;QAEA,MAAMgG,eAAcvF,QAAQ;YAC1B,MAAMoD,OAAO,MAAMN,KACjB,CAAC,SAAS,EAAEuC,mBAAmBrF,UAAU,YAAY,CAAC;YAExD,OAAO;gBACLD,IAAIV,KAAK+D,IAAI,CAAC,KAAK;gBACnBsB,WAAWrF,KAAK+D,IAAI,CAAC,YAAY,KAAK;gBACtC,gEAAgE;gBAChEa,UAAU,AAACtE,CAAAA,MAAMC,OAAO,CAACwD,IAAI,CAAC,WAAW,IAAIA,IAAI,CAAC,WAAW,GAAG,EAAE,AAAD,EAC9D5C,MAAM,CAAC,CAAC0D,QAAUsB,QAAQtB,UAAU,OAAOA,UAAU,YAAY,CAACvE,MAAMC,OAAO,CAACsE,QAChFhE,GAAG,CAACkB;YACT;QACF;QAEA,MAAMqE,YAAWC,SAAS,EAAEC,cAAc;YACxC,MAAMvC,OAAO,MAAMN,KACjB,CAAC,UAAU,EAAEuC,mBAAmBK,WAAW,CAAC,EAAErE,cAAcsE,kCAAAA,eAAgBL,eAAe,GAAG;YAEhG,OAAO/F,YAAY6D;QACrB;QAEA,MAAMwC,gBAAeF,SAAS;YAC5B,OAAOtE,gBAAgB,MAAM0B,KAAc,CAAC,UAAU,EAAEuC,mBAAmBK,WAAW,YAAY,CAAC;QACrG;QAEAhC;QAEA,MAAMmC,gBAAeC,MAAM,EAAEC,IAAI;;YAC/B,MAAMC,OAAO,MAAMtC,aAAa;gBAC9BE,GAAG1E,iBAAiB4G;gBACpBjC,UAAU,UAAEkC,wBAAAA,KAAMlC,UAAU,mBAAI;gBAChCE,SAAS,WAAEgC,wBAAAA,KAAMhC,SAAS,oBAAI;gBAC9BC,kBAAkB;YACpB;YACA,OAAO;gBAAEC,UAAU+B,KAAK/B,QAAQ,CAACzD,MAAM,CAAC,CAACyF,UAAYA,QAAQlG,EAAE;gBAAGoE,eAAe6B,KAAK7B,aAAa;YAAC;QACtG;QAEA,MAAM+B,wBAAuBR,SAAS;gBAM7BS;YALP,MAAMA,QAAQ,MAAMzC,aAAa;gBAC/BE,GAAG,CAAC,YAAY,EAAE3E,cAAcyG,YAAY;gBAC5C7B,YAAY;gBACZG,kBAAkB;YACpB;YACA,QAAOmC,uBAAAA,MAAMlC,QAAQ,CAACmC,IAAI,CAAC,CAACH,UAAYA,QAAQlG,EAAE,aAA3CoG,uBAAgD;QACzD;QAEAE;YACE,OAAOvH,kBAAkB8C,QAAQS,YAAY,EAAER;QACjD;IACF;AACF"}

package/src/lib/transport/graph-client.d.ts

@@ -0,0 +1,87 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { type TransportDeps } from './http';
+import type { OutreachMailClient, OutreachMailSearch } from './mail-client';
+/**
+ * THE MICROSOFT GRAPH TRANSPORT (AGL-3489): one connected Microsoft 365
+ * mailbox, behind the same seam as Gmail (`mail-client.ts`).
+ *
+ * ## Sending
+ *
+ * The message is the one the RFC 5322 writer built for Gmail, headers and
+ * all — `List-Unsubscribe`, `In-Reply-To`, `References`, the `Message-ID`
+ * the runtime minted. It is created as a draft from that MIME and the draft
+ * is sent: creating it first is what answers the message's id and
+ * `conversationId` (Graph's `sendMail` answers nothing), and the
+ * conversation id is what a follow-up step and the sync know the thread by.
+ * A follow-up threads by its own `In-Reply-To` and `References`, which is
+ * how Exchange and every receiver group it, so `threadId` is not sent.
+ *
+ * Every call asks for immutable ids (`Prefer: IdType="ImmutableId"`), so the
+ * draft's id is still the message's id once sending has moved it to Sent
+ * Items.
+ *
+ * ## Reading
+ *
+ * A message read whole is its MIME (`/$value`) read into the Gmail API
+ * shape the classifier takes. A search lists the window's messages across
+ * every folder (`/me/messages`, junk and deleted included) with the few
+ * properties a search needs, and filters them here: Graph's `$filter` cannot
+ * combine a received-time range with a sender list or a recipient, and the
+ * window a sync pass reads is short.
+ *
+ * ## Tokens
+ *
+ * As the Gmail client: minted on first use, reused until a minute before
+ * expiry, one refresh in flight, a 401 retried once with a fresh token.
+ * Microsoft rotates refresh tokens, so a refresh that answers a new one
+ * hands it to `onRefreshTokenRotated` for the caller to store, and uses it
+ * from then on.
+ */
+export declare const GRAPH_API_BASE = "https://graph.microsoft.com/v1.0";
+export interface GraphClientOptions extends TransportDeps {
+    clientId: string;
+    clientSecret: string;
+    tenant: string;
+    refreshToken: string;
+    /** The mailbox's own addresses: what a search's `notFromSelf` leaves out. */
+    selfAddresses?: readonly string[];
+    /** An access token already in hand — a connect's own — used until it expires. */
+    accessToken?: {
+        token: string;
+        expiresInSeconds: number;
+    } | null;
+    /** Stores a refresh token Microsoft rotated in. Its failure is logged, not thrown. */
+    onRefreshTokenRotated?: (refreshToken: string) => Promise<void> | void;
+}
+/** `GET /me`: the account a grant is for. */
+export interface GraphProfile {
+    /** The directory object id — the ID token's `oid`. */
+    id: string;
+    /** The mailbox's address: `mail`, or the sign-in name when it has none. */
+    emailAddress: string;
+    displayName: string;
+}
+export interface GraphClient extends OutreachMailClient {
+    readonly provider: 'microsoft';
+    getProfile(): Promise<GraphProfile>;
+    revoke(): Promise<'unsupported'>;
+}
+/** Whether a listed message answers a search. */
+export declare function graphMessageMatches(record: Record<string, unknown>, search: OutreachMailSearch, self: ReadonlySet<string>): boolean;
+/** A Graph client for one mailbox. See the module comment. */
+export declare function createGraphClient(options: GraphClientOptions): GraphClient;

package/src/lib/transport/graph-client.js

@@ -0,0 +1,359 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { _ as _extends } from "@swc/helpers/_/_extends";
+import { GmailTransportError } from "./gmail-errors.js";
+import { fetchWithBackoff, retryAfterMs } from "./http.js";
+import { graphApiError } from "./microsoft-errors.js";
+import { refreshMicrosoftAccessToken } from "./microsoft-oauth.js";
+import { gmailApiMessageFromMime } from "./mime-message.js";
+/**
+ * THE MICROSOFT GRAPH TRANSPORT (AGL-3489): one connected Microsoft 365
+ * mailbox, behind the same seam as Gmail (`mail-client.ts`).
+ *
+ * ## Sending
+ *
+ * The message is the one the RFC 5322 writer built for Gmail, headers and
+ * all — `List-Unsubscribe`, `In-Reply-To`, `References`, the `Message-ID`
+ * the runtime minted. It is created as a draft from that MIME and the draft
+ * is sent: creating it first is what answers the message's id and
+ * `conversationId` (Graph's `sendMail` answers nothing), and the
+ * conversation id is what a follow-up step and the sync know the thread by.
+ * A follow-up threads by its own `In-Reply-To` and `References`, which is
+ * how Exchange and every receiver group it, so `threadId` is not sent.
+ *
+ * Every call asks for immutable ids (`Prefer: IdType="ImmutableId"`), so the
+ * draft's id is still the message's id once sending has moved it to Sent
+ * Items.
+ *
+ * ## Reading
+ *
+ * A message read whole is its MIME (`/$value`) read into the Gmail API
+ * shape the classifier takes. A search lists the window's messages across
+ * every folder (`/me/messages`, junk and deleted included) with the few
+ * properties a search needs, and filters them here: Graph's `$filter` cannot
+ * combine a received-time range with a sender list or a recipient, and the
+ * window a sync pass reads is short.
+ *
+ * ## Tokens
+ *
+ * As the Gmail client: minted on first use, reused until a minute before
+ * expiry, one refresh in flight, a 401 retried once with a fresh token.
+ * Microsoft rotates refresh tokens, so a refresh that answers a new one
+ * hands it to `onRefreshTokenRotated` for the caller to store, and uses it
+ * from then on.
+ */ export const GRAPH_API_BASE = 'https://graph.microsoft.com/v1.0';
+const ME = `${GRAPH_API_BASE}/me`;
+/** Refresh this long before the stated expiry. */ const EXPIRY_MARGIN_MS = 60000;
+/** Messages one search page lists; Graph allows up to 1000. */ const SEARCH_PAGE_SIZE = 250;
+/** Messages of one conversation read whole. */ const THREAD_MAX = 50;
+const text = (value)=>typeof value === 'string' ? value : '';
+/** An OData string literal: single quotes doubled. */ const literal = (value)=>`'${value.replace(/'/g, "''")}'`;
+/** A query string Graph reads: `%20`, never `+`, for a space. */ function query(params) {
+    return Object.entries(params).map(([key, value])=>`${key}=${encodeURIComponent(value)}`).join('&');
+}
+const addressOf = (recipient)=>{
+    var _recipient_emailAddress;
+    return text(recipient == null ? void 0 : (_recipient_emailAddress = recipient.emailAddress) == null ? void 0 : _recipient_emailAddress.address).trim().toLowerCase();
+};
+const addressesOf = (list)=>Array.isArray(list) ? list.map(addressOf).filter(Boolean) : [];
+const receivedMs = (record)=>{
+    const at = Date.parse(text(record['receivedDateTime']));
+    return Number.isFinite(at) ? at : null;
+};
+/** Whether an address answers a `from` term: a whole address, or a local part. */ function fromMatches(address, term) {
+    const wanted = term.trim().toLowerCase();
+    if (!wanted || !address) return false;
+    if (wanted.includes('@')) return address === wanted;
+    return address.slice(0, address.indexOf('@')) === wanted;
+}
+/** Whether a listed message answers a search. */ export function graphMessageMatches(record, search, self) {
+    var _search_from;
+    const at = receivedMs(record);
+    if (at !== null && at < search.afterMs) return false;
+    const from = addressOf(record['from']);
+    if (search.notFromSelf && self.has(from)) return false;
+    if (((_search_from = search.from) == null ? void 0 : _search_from.length) && !search.from.some((term)=>fromMatches(from, term))) return false;
+    if (search.to) {
+        const to = search.to.trim().toLowerCase();
+        const recipients = [
+            ...addressesOf(record['toRecipients']),
+            ...addressesOf(record['ccRecipients'])
+        ];
+        if (!recipients.includes(to)) return false;
+    }
+    return true;
+}
+/** The header list a metadata read answers, the named ones only. */ function metadataHeaders(record, wanted) {
+    var _from_emailAddress, _from_emailAddress1;
+    const listed = (Array.isArray(record['internetMessageHeaders']) ? record['internetMessageHeaders'] : []).map((entry)=>entry).filter((entry)=>typeof entry.name === 'string').map((entry)=>({
+            name: String(entry.name),
+            value: text(entry.value)
+        }));
+    const has = (name)=>listed.some((header)=>header.name.toLowerCase() === name.toLowerCase());
+    const from = record['from'];
+    const fromName = text(from == null ? void 0 : (_from_emailAddress = from.emailAddress) == null ? void 0 : _from_emailAddress.name);
+    const fromAddress = text(from == null ? void 0 : (_from_emailAddress1 = from.emailAddress) == null ? void 0 : _from_emailAddress1.address);
+    // A sent message carries no internet headers in Graph; its properties say the same.
+    const synthesized = [
+        {
+            name: 'Subject',
+            value: text(record['subject'])
+        },
+        {
+            name: 'From',
+            value: fromName && fromAddress ? `${fromName} <${fromAddress}>` : fromAddress
+        },
+        {
+            name: 'To',
+            value: addressesOf(record['toRecipients']).join(', ')
+        },
+        {
+            name: 'Message-ID',
+            value: text(record['internetMessageId'])
+        }
+    ].filter((header)=>header.value && !has(header.name));
+    const all = [
+        ...listed,
+        ...synthesized
+    ];
+    if (!(wanted == null ? void 0 : wanted.length)) return all;
+    const names = new Set(wanted.map((name)=>name.toLowerCase()));
+    return all.filter((header)=>names.has(header.name.toLowerCase()));
+}
+/** A Graph client for one mailbox. See the module comment. */ export function createGraphClient(options) {
+    var _options_now, _options_selfAddresses;
+    var _options_accessToken;
+    const deps = options;
+    const now = (_options_now = options.now) != null ? _options_now : Date.now;
+    const self = new Set(((_options_selfAddresses = options.selfAddresses) != null ? _options_selfAddresses : []).map((address)=>address.trim().toLowerCase()).filter(Boolean));
+    let refreshToken = options.refreshToken;
+    let cached = ((_options_accessToken = options.accessToken) == null ? void 0 : _options_accessToken.token) ? {
+        token: options.accessToken.token,
+        expiresAtMs: now() + options.accessToken.expiresInSeconds * 1000
+    } : null;
+    let refreshing = null;
+    const mint = ()=>{
+        refreshing != null ? refreshing : refreshing = refreshMicrosoftAccessToken({
+            clientId: options.clientId,
+            clientSecret: options.clientSecret,
+            tenant: options.tenant,
+            refreshToken
+        }, deps).then(async (minted)=>{
+            cached = {
+                token: minted.accessToken,
+                expiresAtMs: now() + minted.expiresInSeconds * 1000
+            };
+            if (minted.refreshToken && minted.refreshToken !== refreshToken) {
+                refreshToken = minted.refreshToken;
+                try {
+                    await (options.onRefreshTokenRotated == null ? void 0 : options.onRefreshTokenRotated.call(options, minted.refreshToken));
+                } catch (error) {
+                    console.error('[outreach] storing a rotated Microsoft refresh token failed', error);
+                }
+            }
+            return minted.accessToken;
+        }).finally(()=>{
+            refreshing = null;
+        });
+        return refreshing;
+    };
+    const getAccessToken = async ()=>{
+        if (cached && cached.expiresAtMs - EXPIRY_MARGIN_MS > now()) return cached.token;
+        return mint();
+    };
+    /**
+   * One Graph call: authorized, retried per policy, a 401 once refreshed.
+   * Answers the response, already judged ok.
+   */ const send = async (url, init = {})=>{
+        for(let tries = 0;; tries += 1){
+            const token = await getAccessToken();
+            const response = await fetchWithBackoff(url, _extends({}, init, {
+                headers: _extends({
+                    Accept: 'application/json',
+                    Prefer: 'IdType="ImmutableId"'
+                }, init.headers, {
+                    Authorization: `Bearer ${token}`
+                })
+            }), deps);
+            if (response.status === 401 && tries === 0) {
+                cached = null;
+                continue;
+            }
+            if (response.ok) return response;
+            const body = await response.json().catch(()=>null);
+            throw graphApiError(response.status, body, {
+                retryAfterMs: retryAfterMs(response, now())
+            });
+        }
+    };
+    const json = async (url, init = {})=>{
+        const response = await send(url, init);
+        const body = await response.json().catch(()=>null);
+        if (body === null || typeof body !== 'object') {
+            throw new GmailTransportError('unexpected', 'Microsoft Graph answered with a body that is not JSON.', {
+                status: response.status
+            });
+        }
+        return body;
+    };
+    const messagePath = (id)=>{
+        if (!id) throw new GmailTransportError('invalid_request', 'A message to read needs its id.');
+        return `${ME}/messages/${encodeURIComponent(id)}`;
+    };
+    const getFullMessage = async (messageId)=>{
+        const path = messagePath(messageId);
+        const [record, raw] = await Promise.all([
+            json(`${path}?${query({
+                $select: 'id,conversationId,receivedDateTime'
+            })}`),
+            send(`${path}/$value`, {
+                headers: {
+                    Accept: 'message/rfc822, text/plain, */*'
+                }
+            }).then((response)=>response.arrayBuffer())
+        ]);
+        return gmailApiMessageFromMime(new Uint8Array(raw), {
+            id: text(record['id']) || messageId,
+            threadId: text(record['conversationId']),
+            internalDateMs: receivedMs(record)
+        });
+    };
+    return {
+        provider: 'microsoft',
+        getAccessToken,
+        async getProfile () {
+            const body = await json(`${ME}?${query({
+                $select: 'id,mail,userPrincipalName,displayName'
+            })}`);
+            return {
+                id: text(body['id']).toLowerCase(),
+                emailAddress: (text(body['mail']) || text(body['userPrincipalName'])).trim().toLowerCase(),
+                displayName: text(body['displayName']).trim()
+            };
+        },
+        async sendMessage (input) {
+            if (!(input == null ? void 0 : input.raw)) {
+                throw new GmailTransportError('invalid_request', 'A message to send needs its raw content.');
+            }
+            // Graph takes MIME as standard base64 in a text/plain body.
+            const mime = Buffer.from(input.raw, 'base64url').toString('base64');
+            const draft = await json(`${ME}/messages`, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'text/plain'
+                },
+                body: mime
+            });
+            const id = text(draft['id']);
+            if (!id) throw new GmailTransportError('unexpected', 'Microsoft Graph created the message without an id.');
+            try {
+                await send(`${messagePath(id)}/send`, {
+                    method: 'POST'
+                });
+            } catch (error) {
+                // The draft would otherwise sit in Drafts, unsent, looking like work.
+                await send(messagePath(id), {
+                    method: 'DELETE'
+                }).catch(()=>undefined);
+                throw error;
+            }
+            return {
+                id,
+                threadId: text(draft['conversationId']),
+                internetMessageId: text(draft['internetMessageId']) || null
+            };
+        },
+        async getFullThread (threadId) {
+            const list = await json(`${ME}/messages?${query({
+                $filter: `conversationId eq ${literal(threadId)}`,
+                $select: 'id,conversationId,receivedDateTime',
+                $top: String(THREAD_MAX)
+            })}`);
+            const records = (Array.isArray(list.value) ? list.value : []).map((entry)=>entry != null ? entry : {}).filter((record)=>text(record['id'])).sort((a, b)=>{
+                var _receivedMs, _receivedMs1;
+                return ((_receivedMs = receivedMs(a)) != null ? _receivedMs : 0) - ((_receivedMs1 = receivedMs(b)) != null ? _receivedMs1 : 0);
+            });
+            const messages = [];
+            for (const record of records)messages.push(await getFullMessage(text(record['id'])));
+            return {
+                id: threadId,
+                historyId: null,
+                messages
+            };
+        },
+        getFullMessage,
+        async getMessage (messageId, messageOptions) {
+            const record = await json(`${messagePath(messageId)}?${query({
+                $select: 'id,conversationId,subject,from,toRecipients,receivedDateTime,bodyPreview,internetMessageId,internetMessageHeaders'
+            })}`);
+            return {
+                id: text(record['id']) || messageId,
+                threadId: text(record['conversationId']),
+                labelIds: [],
+                snippet: text(record['bodyPreview']),
+                internalDateMs: receivedMs(record),
+                headers: metadataHeaders(record, messageOptions == null ? void 0 : messageOptions.metadataHeaders)
+            };
+        },
+        async searchMessages (search, page) {
+            let url;
+            if (page == null ? void 0 : page.pageToken) {
+                // A next link is Graph's own address; anything else is not followed
+                // with this mailbox's token.
+                if (!page.pageToken.startsWith(`${ME}/messages?`)) {
+                    throw new GmailTransportError('invalid_request', 'That page token is not a Microsoft Graph page.');
+                }
+                url = page.pageToken;
+            } else {
+                var _ref;
+                url = `${ME}/messages?${query({
+                    $filter: `receivedDateTime ge ${new Date(Math.max(0, search.afterMs)).toISOString()}`,
+                    $select: 'id,conversationId,from,toRecipients,ccRecipients,receivedDateTime',
+                    $top: String(Math.max((_ref = page == null ? void 0 : page.maxResults) != null ? _ref : 0, SEARCH_PAGE_SIZE))
+                })}`;
+            }
+            const body = await json(url);
+            const messages = (Array.isArray(body['value']) ? body['value'] : []).map((entry)=>entry != null ? entry : {}).filter((record)=>text(record['id']) && graphMessageMatches(record, search, self)).map((record)=>({
+                    id: text(record['id']),
+                    threadId: text(record['conversationId'])
+                }));
+            return {
+                messages,
+                nextPageToken: text(body['@odata.nextLink']) || null
+            };
+        },
+        async findMessageByMessageId (messageId) {
+            const wanted = String(messageId != null ? messageId : '').trim();
+            if (!wanted) return null;
+            const id = wanted.startsWith('<') ? wanted : `<${wanted}>`;
+            const body = await json(`${ME}/messages?${query({
+                $filter: `internetMessageId eq ${literal(id)}`,
+                $select: 'id,conversationId',
+                $top: '1'
+            })}`);
+            const record = Array.isArray(body.value) ? body.value[0] : null;
+            return record && text(record['id']) ? {
+                id: text(record['id']),
+                threadId: text(record['conversationId'])
+            } : null;
+        },
+        async revoke () {
+            return 'unsupported';
+        }
+    };
+}
+
+//# sourceMappingURL=graph-client.js.map