@aglyn/plugins-outreach 1.0.0-beta.224 → 1.0.0-beta.225

package/src/lib/mailboxes/mailbox-revoke.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../../libs/plugins/outreach/src/lib/mailboxes/mailbox-revoke.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { SecretBoxError } from '@aglyn/shared-util-tools/secret-box'\nimport { GmailTransportError } from '../transport/gmail-errors'\nimport { revokeGoogleToken } from '../transport/google-oauth'\nimport type { TransportDeps } from '../transport/http'\nimport type { OutreachMailboxDisconnectResponse } from './mailbox-api'\nimport {\n  countOtherCredentialsForAccount,\n  openMailboxRefreshToken,\n  type OutreachGoogleMailboxCredentials,\n} from './mailbox-credentials'\nimport type { OutreachGoogleConfigResult } from './outreach-config'\n\n/**\n * TELLING GOOGLE A STORED GRANT IS OVER (AGL-2978).\n *\n * A disconnect, a workspace erasure and an account erasure all end a\n * mailbox's grant the same way: open its sealed refresh token with this\n * deployment's key and revoke it at Google — unless another stored\n * credential still uses the same Google account, because Google's\n * revocation ends the whole grant this client holds for the account, and\n * revoking it would silently break that other mailbox.\n *\n * Never throws. A grant that cannot be revoked is still deleted by whoever\n * called this; the outcome says which happened.\n */\n\n/**\n * What became of a grant at Google: `revoked`, `already-invalid`,\n * `kept-for-other-mailbox` while another credential still uses the account,\n * or `failed` when Google could not be told — the token would not open, the\n * deployment is not configured, or Google did not answer.\n */\nexport type OutreachGrantRevocation = OutreachMailboxDisconnectResponse['revocation']\n\nexport interface OutreachRevokeDeps {\n  readConfig(): OutreachGoogleConfigResult\n  /** The network and retry policy the revocation call uses. */\n  transport: TransportDeps\n}\n\nexport interface RevokeMailboxGrantOptions {\n  /**\n   * Credentials of this organization do not count as another use of the\n   * account: the workspace erasure is ending all of them.\n   */\n  excludeOrgId?: string\n  /**\n   * These credentials do not count as another use of the account either:\n   * the account erasure is ending every one of the person's grants.\n   */\n  excludeMailboxIds?: ReadonlySet<string>\n}\n\n/** Revokes one stored grant at Google, unless it is still shared. Never throws. */\nexport async function revokeMailboxGrant(\n  firestore: FirebaseFirestore.Firestore,\n  credential: OutreachGoogleMailboxCredentials,\n  deps: OutreachRevokeDeps,\n  options: RevokeMailboxGrantOptions = {},\n): Promise<OutreachGrantRevocation> {\n  try {\n    const others = await countOtherCredentialsForAccount(firestore, {\n      providerAccountId: credential.providerAccountId,\n      mailboxId: credential.mailboxId,\n      excludeOrgId: options.excludeOrgId,\n      excludeMailboxIds: options.excludeMailboxIds,\n    })\n    if (others > 0) return 'kept-for-other-mailbox'\n    const config = deps.readConfig()\n    if (!config.configured) return 'failed'\n    const { refreshToken } = openMailboxRefreshToken(credential, config.config.keyring)\n    return await revokeGoogleToken(refreshToken, deps.transport)\n  } catch (error) {\n    if (!(error instanceof GmailTransportError) && !(error instanceof SecretBoxError)) {\n      console.error('[outreach] revoking a mailbox grant failed', error)\n    }\n    return 'failed'\n  }\n}\n"],"names":["SecretBoxError","GmailTransportError","revokeGoogleToken","countOtherCredentialsForAccount","openMailboxRefreshToken","revokeMailboxGrant","firestore","credential","deps","options","others","providerAccountId","mailboxId","excludeOrgId","excludeMailboxIds","config","readConfig","configured","refreshToken","keyring","transport","error","console"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,cAAc,QAAQ,sCAAqC;AACpE,SAASC,mBAAmB,QAAQ,+BAA2B;AAC/D,SAASC,iBAAiB,QAAQ,+BAA2B;AAG7D,SACEC,+BAA+B,EAC/BC,uBAAuB,QAElB,2BAAuB;AA4C9B,iFAAiF,GACjF,OAAO,eAAeC,mBACpBC,SAAsC,EACtCC,UAA4C,EAC5CC,IAAwB,EACxBC,UAAqC,CAAC,CAAC;IAEvC,IAAI;QACF,MAAMC,SAAS,MAAMP,gCAAgCG,WAAW;YAC9DK,mBAAmBJ,WAAWI,iBAAiB;YAC/CC,WAAWL,WAAWK,SAAS;YAC/BC,cAAcJ,QAAQI,YAAY;YAClCC,mBAAmBL,QAAQK,iBAAiB;QAC9C;QACA,IAAIJ,SAAS,GAAG,OAAO;QACvB,MAAMK,SAASP,KAAKQ,UAAU;QAC9B,IAAI,CAACD,OAAOE,UAAU,EAAE,OAAO;QAC/B,MAAM,EAAEC,YAAY,EAAE,GAAGd,wBAAwBG,YAAYQ,OAAOA,MAAM,CAACI,OAAO;QAClF,OAAO,MAAMjB,kBAAkBgB,cAAcV,KAAKY,SAAS;IAC7D,EAAE,OAAOC,OAAO;QACd,IAAI,CAAEA,CAAAA,iBAAiBpB,mBAAkB,KAAM,CAAEoB,CAAAA,iBAAiBrB,cAAa,GAAI;YACjFsB,QAAQD,KAAK,CAAC,8CAA8CA;QAC9D;QACA,OAAO;IACT;AACF"}
+{"version":3,"sources":["../../../../../../../libs/plugins/outreach/src/lib/mailboxes/mailbox-revoke.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { SecretBoxError } from '@aglyn/shared-util-tools/secret-box'\nimport { GmailTransportError } from '../transport/gmail-errors'\nimport { revokeGoogleToken } from '../transport/google-oauth'\nimport type { TransportDeps } from '../transport/http'\nimport type { OutreachMailboxDisconnectResponse } from './mailbox-api'\nimport {\n  countOtherCredentialsForAccount,\n  openMailboxRefreshToken,\n  type OutreachStoredMailboxCredentials,\n} from './mailbox-credentials'\nimport type { OutreachGoogleConfigResult } from './outreach-config'\n\n/**\n * TELLING GOOGLE A STORED GRANT IS OVER (AGL-2978).\n *\n * A disconnect, a workspace erasure and an account erasure all end a\n * mailbox's grant the same way: open its sealed refresh token with this\n * deployment's key and revoke it at Google — unless another stored\n * credential still uses the same Google account, because Google's\n * revocation ends the whole grant this client holds for the account, and\n * revoking it would silently break that other mailbox.\n *\n * A Microsoft grant (AGL-3489) has no such endpoint: Microsoft offers no\n * way for an app to revoke one refresh token, so the outcome is\n * `unsupported`, and deleting the stored grant is what ends it here.\n *\n * Never throws. A grant that cannot be revoked is still deleted by whoever\n * called this; the outcome says which happened.\n */\n\n/**\n * What became of a grant at the provider: `revoked`, `already-invalid`,\n * `kept-for-other-mailbox` while another credential still uses the account,\n * `unsupported` for a provider with no revocation, or `failed` when Google\n * could not be told — the token would not open, the deployment is not\n * configured, or Google did not answer.\n */\nexport type OutreachGrantRevocation = OutreachMailboxDisconnectResponse['revocation']\n\nexport interface OutreachRevokeDeps {\n  readConfig(): OutreachGoogleConfigResult\n  /** The network and retry policy the revocation call uses. */\n  transport: TransportDeps\n}\n\nexport interface RevokeMailboxGrantOptions {\n  /**\n   * Credentials of this organization do not count as another use of the\n   * account: the workspace erasure is ending all of them.\n   */\n  excludeOrgId?: string\n  /**\n   * These credentials do not count as another use of the account either:\n   * the account erasure is ending every one of the person's grants.\n   */\n  excludeMailboxIds?: ReadonlySet<string>\n}\n\n/** Revokes one stored grant at Google, unless it is still shared. Never throws. */\nexport async function revokeMailboxGrant(\n  firestore: FirebaseFirestore.Firestore,\n  credential: OutreachStoredMailboxCredentials,\n  deps: OutreachRevokeDeps,\n  options: RevokeMailboxGrantOptions = {},\n): Promise<OutreachGrantRevocation> {\n  if (credential.provider === 'microsoft') return 'unsupported'\n  try {\n    const others = await countOtherCredentialsForAccount(firestore, {\n      providerAccountId: credential.providerAccountId,\n      mailboxId: credential.mailboxId,\n      excludeOrgId: options.excludeOrgId,\n      excludeMailboxIds: options.excludeMailboxIds,\n    })\n    if (others > 0) return 'kept-for-other-mailbox'\n    const config = deps.readConfig()\n    if (!config.configured) return 'failed'\n    const { refreshToken } = openMailboxRefreshToken(credential, config.config.keyring)\n    return await revokeGoogleToken(refreshToken, deps.transport)\n  } catch (error) {\n    if (!(error instanceof GmailTransportError) && !(error instanceof SecretBoxError)) {\n      console.error('[outreach] revoking a mailbox grant failed', error)\n    }\n    return 'failed'\n  }\n}\n"],"names":["SecretBoxError","GmailTransportError","revokeGoogleToken","countOtherCredentialsForAccount","openMailboxRefreshToken","revokeMailboxGrant","firestore","credential","deps","options","provider","others","providerAccountId","mailboxId","excludeOrgId","excludeMailboxIds","config","readConfig","configured","refreshToken","keyring","transport","error","console"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,cAAc,QAAQ,sCAAqC;AACpE,SAASC,mBAAmB,QAAQ,+BAA2B;AAC/D,SAASC,iBAAiB,QAAQ,+BAA2B;AAG7D,SACEC,+BAA+B,EAC/BC,uBAAuB,QAElB,2BAAuB;AAiD9B,iFAAiF,GACjF,OAAO,eAAeC,mBACpBC,SAAsC,EACtCC,UAA4C,EAC5CC,IAAwB,EACxBC,UAAqC,CAAC,CAAC;IAEvC,IAAIF,WAAWG,QAAQ,KAAK,aAAa,OAAO;IAChD,IAAI;QACF,MAAMC,SAAS,MAAMR,gCAAgCG,WAAW;YAC9DM,mBAAmBL,WAAWK,iBAAiB;YAC/CC,WAAWN,WAAWM,SAAS;YAC/BC,cAAcL,QAAQK,YAAY;YAClCC,mBAAmBN,QAAQM,iBAAiB;QAC9C;QACA,IAAIJ,SAAS,GAAG,OAAO;QACvB,MAAMK,SAASR,KAAKS,UAAU;QAC9B,IAAI,CAACD,OAAOE,UAAU,EAAE,OAAO;QAC/B,MAAM,EAAEC,YAAY,EAAE,GAAGf,wBAAwBG,YAAYS,OAAOA,MAAM,CAACI,OAAO;QAClF,OAAO,MAAMlB,kBAAkBiB,cAAcX,KAAKa,SAAS;IAC7D,EAAE,OAAOC,OAAO;QACd,IAAI,CAAEA,CAAAA,iBAAiBrB,mBAAkB,KAAM,CAAEqB,CAAAA,iBAAiBtB,cAAa,GAAI;YACjFuB,QAAQD,KAAK,CAAC,8CAA8CA;QAC9D;QACA,OAAO;IACT;AACF"}

package/src/lib/mailboxes/mailbox-routes.d.ts

@@ -18,10 +18,16 @@ import type { PluginWebApiHandler } from '@aglyn/aglyn/server';
 import { type SenderReadiness, type SenderReadinessExpectation } from '@aglyn/shared-util-email';
 import type { TransportDeps } from '../transport/http';
 import { type OutreachGateDeps } from './mailbox-gate';
-import { type OutreachGoogleConfigResult } from './outreach-config';
+import { type OutreachGoogleConfigResult, type OutreachMicrosoftConfigResult } from './outreach-config';
 /**
- * THE MAILBOX ROUTES (AGL-2978): connect a rep's Google mailbox, keep its
- * settings, pause it, test it, and disconnect it.
+ * THE MAILBOX ROUTES (AGL-2978): connect a rep's Google or Microsoft 365
+ * mailbox, keep its settings, pause it, test it, and disconnect it.
+ *
+ * A connect names its provider (AGL-3489). Both providers' consent screens
+ * return to the one callback; the signed state says which one a connect went
+ * to, and `connect/complete` redeems the code with that provider. Everything
+ * after the provider has named the account — the mailbox limit, the mailbox
+ * and its sealed grant, the activity row — is the same for both.
  *
  * ## The connect, end to end
  *
@@ -73,6 +79,8 @@ export interface OutreachMailboxRouteDeps {
     firestore(): FirebaseFirestore.Firestore;
     gate: OutreachGateDeps;
     readConfig(): OutreachGoogleConfigResult;
+    /** The Microsoft app registration (AGL-3489); the environment's when omitted. */
+    readMicrosoftConfig?(): OutreachMicrosoftConfigResult;
     /** Whether the signing secret the OAuth state needs is configured. */
     stateSigningConfigured(): boolean;
     redirectUri(requestUrl: string): string | null;

package/src/lib/mailboxes/mailbox-routes.js

@@ -15,10 +15,13 @@ import { _ as _extends } from "@swc/helpers/_/_extends";
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */ import { normalizeContactEmail } from "@aglyn/aglyn/app-utils/contacts";
-import { googleMailboxSenderExpectation } from "@aglyn/shared-util-email";
+import { googleMailboxSenderExpectation, microsoftMailboxSenderExpectation } from "@aglyn/shared-util-email";
+import { OUTREACH_MAILBOX_PROVIDERS } from "../model/outreach.types.js";
 import { createGmailClient } from "../transport/gmail-client.js";
+import { createGraphClient } from "../transport/graph-client.js";
 import { GmailTransportError, googleFailureAnswer } from "../transport/gmail-errors.js";
 import { buildGoogleAuthorizationUrl, exchangeGoogleAuthorizationCode, grantedScopesInclude, OUTREACH_REQUIRED_GRANTED_SCOPES, pkceChallenge, readGoogleIdToken } from "../transport/google-oauth.js";
+import { buildMicrosoftAuthorizationUrl, exchangeMicrosoftAuthorizationCode, microsoftScopesInclude, readMicrosoftIdToken } from "../transport/microsoft-oauth.js";
 import { Rfc5322MessageError } from "../transport/rfc5322.js";
 import { sendOutreachMessage } from "../transport/send-message.js";
 import { buildConnectReturnFragment } from "./mailbox-api.js";
@@ -28,7 +31,7 @@ import { outreachMemberGate, refusal } from "./mailbox-gate.js";
 import { defaultSendAs, isValidTimezone, OUTREACH_DEFAULT_DAILY_CAP, OUTREACH_DEFAULT_WINDOW, OUTREACH_MAX_MAILBOXES_PER_MEMBER, validateDailyCap, validateDisplayName, validateSendWindow, verifiedSendAsAddresses } from "./mailbox-settings.js";
 import { markOutreachMailboxReconnectRequired, openOutreachMailboxClient } from "./mailbox-transport.js";
 import { consumeOutreachOAuthState, mintOutreachOAuthState, outreachOidcNonce, outreachPkceVerifier, readOutreachOAuthState, recordOutreachOAuthState } from "./oauth-state.js";
-import { OUTREACH_NOT_CONFIGURED_MESSAGE } from "./outreach-config.js";
+import { outreachNotConfiguredMessage, readOutreachMicrosoftConfig } from "./outreach-config.js";
 /** Test sends one mailbox may make in an hour. */ export const OUTREACH_TEST_SENDS_PER_HOUR = 5;
 /**
  * The org activity target a mailbox's rows are filed under: Outreach's own
@@ -58,9 +61,14 @@ async function readBody(request) {
     const body = await request.json().catch(()=>null);
     return body && typeof body === 'object' && !Array.isArray(body) ? body : {};
 }
-function notConfigured() {
-    return refusal(503, 'not-configured', OUTREACH_NOT_CONFIGURED_MESSAGE);
+function notConfigured(provider = 'google') {
+    return refusal(503, 'not-configured', outreachNotConfiguredMessage(provider));
 }
+/** The provider a request names; Google when it names none, `null` for one that is not a provider. */ function readProvider(value) {
+    if (value === undefined || value === null || value === '') return 'google';
+    return OUTREACH_MAILBOX_PROVIDERS.includes(value) ? value : null;
+}
+const providerName = (provider)=>provider === 'microsoft' ? 'Microsoft' : 'Google';
 /** A mailbox document read defensively into the model shape. */ function readMailbox(id, data) {
     if (!data) return null;
     return _extends({}, data, {
@@ -69,6 +77,11 @@ function notConfigured() {
 }
 const activityName = (mailbox)=>mailbox.email;
 export function createOutreachMailboxRoutes(deps) {
+    const readMicrosoftConfig = ()=>{
+        var _deps_readMicrosoftConfig;
+        return ((_deps_readMicrosoftConfig = deps.readMicrosoftConfig) != null ? _deps_readMicrosoftConfig : readOutreachMicrosoftConfig)();
+    };
+    /** Whether a provider's client and the token key are configured here. */ const providerConfigured = (provider)=>provider === 'microsoft' ? readMicrosoftConfig().configured : deps.readConfig().configured;
     /** The gate, then the mailbox the body names, then who may touch it. */ async function loadManagedMailbox(request, body, who) {
         const gate = await outreachMemberGate(request, body['orgId'], deps.gate);
         if (gate instanceof Response) return gate;
@@ -94,18 +107,30 @@ export function createOutreachMailboxRoutes(deps) {
         // should see the whole list once rather than one variable per redeploy.
         const missing = [];
         const config = deps.readConfig();
+        const microsoft = readMicrosoftConfig();
         if (config.configured === false) missing.push({
             gate: 'google',
             missing: config.missing
         });
+        if (microsoft.configured === false) missing.push({
+            gate: 'microsoft',
+            missing: microsoft.missing
+        });
+        const shared = deps.stateSigningConfigured() && Boolean(deps.redirectUri(request.url));
         if (!deps.stateSigningConfigured()) missing.push({
             gate: 'state'
         });
         if (!deps.redirectUri(request.url)) missing.push({
             gate: 'redirect'
         });
+        const providers = {
+            google: shared && config.configured,
+            microsoft: shared && microsoft.configured
+        };
         return ok(_extends({
-            configured: missing.length === 0,
+            // Google's readiness, as this field has always meant; `providers` says each.
+            configured: providers.google,
+            providers,
             canManageAll: gate.isOrgAdmin
         }, missing.length ? {
             missing
@@ -116,9 +141,40 @@ export function createOutreachMailboxRoutes(deps) {
         const body = await readBody(request);
         const gate = await outreachMemberGate(request, body['orgId'], deps.gate);
         if (gate instanceof Response) return gate;
-        const config = deps.readConfig();
+        const provider = readProvider(body['provider']);
+        if (!provider) return refusal(400, 'invalid-request', 'Choose Google or Microsoft.');
         const redirectUri = deps.redirectUri(request.url);
-        if (!config.configured || !redirectUri || !deps.stateSigningConfigured()) return notConfigured();
+        if (!redirectUri || !deps.stateSigningConfigured()) return notConfigured(provider);
+        if (provider === 'microsoft') {
+            const microsoft = readMicrosoftConfig();
+            if (!microsoft.configured) return notConfigured(provider);
+            const nowMs = deps.now();
+            const { state, claims } = mintOutreachOAuthState({
+                orgId: gate.orgId,
+                uid: gate.uid,
+                nowMs,
+                provider
+            });
+            await recordOutreachOAuthState(deps.firestore(), {
+                claims,
+                redirectUri,
+                nowMs
+            });
+            const url = buildMicrosoftAuthorizationUrl({
+                clientId: microsoft.config.clientId,
+                tenant: microsoft.config.tenant,
+                redirectUri,
+                state,
+                codeChallenge: pkceChallenge(outreachPkceVerifier(claims.nonce)),
+                nonce: outreachOidcNonce(claims.nonce),
+                loginHint: typeof body['loginHint'] === 'string' ? normalizeContactEmail(body['loginHint']) : null
+            });
+            return ok({
+                url
+            });
+        }
+        const config = deps.readConfig();
+        if (!config.configured) return notConfigured();
         const nowMs = deps.now();
         const { state, claims } = mintOutreachOAuthState({
             orgId: gate.orgId,
@@ -162,23 +218,27 @@ export function createOutreachMailboxRoutes(deps) {
         const slug = typeof (org == null ? void 0 : org['slug']) === 'string' ? org['slug'] : '';
         if (!slug) return plain(404, 'That organization could not be found.');
         let fragment;
-        const googleError = params.get('error');
+        const providerError = params.get('error');
         const code = (_params_get = params.get('code')) != null ? _params_get : '';
-        if (googleError) {
-            fragment = {
+        // An error fragment names a Microsoft connect, so the page says whose screen it was.
+        const named = claims.provider === 'microsoft' ? {
+            provider: claims.provider
+        } : {};
+        if (providerError) {
+            fragment = _extends({
                 kind: 'error',
-                reason: googleError === 'access_denied' ? 'access_denied' : 'google_error'
-            };
+                reason: providerError === 'access_denied' ? 'access_denied' : 'google_error'
+            }, named);
         } else if (!read.ok) {
-            fragment = {
+            fragment = _extends({
                 kind: 'error',
                 reason: 'expired'
-            };
+            }, named);
         } else if (!code || code.length > MAX_CODE_CHARS) {
-            fragment = {
+            fragment = _extends({
                 kind: 'error',
                 reason: 'google_error'
-            };
+            }, named);
         } else {
             var _params_get1;
             fragment = {
@@ -198,13 +258,12 @@ export function createOutreachMailboxRoutes(deps) {
         });
     };
     const connectComplete = async (request)=>{
-        var _aliases_confirmed;
         if (request.method !== 'POST') return methodNotAllowed('POST');
         const body = await readBody(request);
         const gate = await outreachMemberGate(request, body['orgId'], deps.gate);
         if (gate instanceof Response) return gate;
-        const config = deps.readConfig();
-        if (!config.configured || !deps.stateSigningConfigured()) return notConfigured();
+        if (!deps.stateSigningConfigured()) return notConfigured();
+        if (!deps.readConfig().configured && !readMicrosoftConfig().configured) return notConfigured();
         const code = typeof body['code'] === 'string' ? body['code'] : '';
         if (!code || code.length > MAX_CODE_CHARS) return refusal(400, 'invalid-request', 'The connection did not return a code.');
         const firestore = deps.firestore();
@@ -221,6 +280,7 @@ export function createOutreachMailboxRoutes(deps) {
             return refusal(400, 'state-org-mismatch', 'This connection was started in another organization.');
         }
         if (!read.ok) return refusal(410, 'state-expired', 'This connection took too long. Connect the mailbox again.');
+        if (!providerConfigured(claims.provider)) return notConfigured(claims.provider);
         const consumed = await consumeOutreachOAuthState(firestore, {
             claims,
             nowMs
@@ -231,13 +291,36 @@ export function createOutreachMailboxRoutes(deps) {
             }
             return refusal(409, consumed.refusal, consumed.refusal === 'state-superseded' ? 'A newer connection was started. Finish that one, or connect the mailbox again.' : 'This connection was already used. Connect the mailbox again.');
         }
+        const account = claims.provider === 'microsoft' ? await redeemMicrosoftCode({
+            code,
+            claims,
+            redirectUri: consumed.redirectUri,
+            nowMs
+        }) : await redeemGoogleCode({
+            code,
+            claims,
+            redirectUri: consumed.redirectUri,
+            nowMs
+        });
+        if (account instanceof Response) return account;
+        return storeConnectedMailbox({
+            gate,
+            body,
+            account,
+            nowMs
+        });
+    };
+    /** Google's half of a connect: the code redeemed, the grant and the account checked. */ async function redeemGoogleCode(input) {
+        const { code, claims, nowMs } = input;
+        const config = deps.readConfig();
+        if (!config.configured) return notConfigured();
         let grant;
         try {
             grant = await exchangeGoogleAuthorizationCode({
                 clientId: config.config.clientId,
                 clientSecret: config.config.clientSecret,
                 code,
-                redirectUri: consumed.redirectUri,
+                redirectUri: input.redirectUri,
                 codeVerifier: outreachPkceVerifier(claims.nonce)
             }, deps.transport);
         } catch (error) {
@@ -300,7 +383,105 @@ export function createOutreachMailboxRoutes(deps) {
                 ...sendAsOptions
             ];
         }
-        const mailboxId = outreachMailboxId(gate.orgId, gate.uid, identity.identity.sub);
+        return {
+            provider: 'google',
+            providerAccountId: identity.identity.sub,
+            email: profileEmail,
+            sendAsOptions,
+            scopes: grant.scope.split(/\s+/).filter(Boolean),
+            refreshToken: grant.refreshToken,
+            keyring: config.config.keyring
+        };
+    }
+    /**
+   * Microsoft's half of a connect (AGL-3489): the code redeemed, the grant's
+   * permissions checked, the ID token read, and the account read back from
+   * Graph — the same account the sign-in named, by its directory id.
+   */ async function redeemMicrosoftCode(input) {
+        const { code, claims, nowMs } = input;
+        const config = readMicrosoftConfig();
+        if (!config.configured) return notConfigured('microsoft');
+        const scopesMissing = ()=>refusal(422, 'scopes-missing', 'Sequences needs permission to send and to read your mail. Connect again and allow both.');
+        let grant;
+        try {
+            grant = await exchangeMicrosoftAuthorizationCode({
+                clientId: config.config.clientId,
+                clientSecret: config.config.clientSecret,
+                tenant: config.config.tenant,
+                code,
+                redirectUri: input.redirectUri,
+                codeVerifier: outreachPkceVerifier(claims.nonce)
+            }, deps.transport);
+        } catch (error) {
+            if (error instanceof GmailTransportError && error.code === 'invalid_grant') {
+                return refusal(400, 'code-rejected', "Microsoft's sign-in expired or was already used. Connect the mailbox again.");
+            }
+            if (error instanceof GmailTransportError && error.code === 'client_misconfigured') {
+                return refusal(503, 'not-configured', "Microsoft refused this deployment's app registration.");
+            }
+            if (error instanceof GmailTransportError && error.code === 'insufficient_scope') return scopesMissing();
+            return googleFailure(error, 'connect/complete Microsoft token exchange');
+        }
+        if (!grant.refreshToken) {
+            return refusal(422, 'refresh-token-missing', 'Microsoft did not grant offline access, so the mailbox could not send later. Connect it again.');
+        }
+        if (!microsoftScopesInclude(grant.scope)) return scopesMissing();
+        const identity = readMicrosoftIdToken(grant.idToken, {
+            clientId: config.config.clientId,
+            nonce: outreachOidcNonce(claims.nonce),
+            nowMs
+        });
+        if (identity.ok === false) {
+            return refusal(422, 'identity-unverified', "Microsoft's answer could not be verified. Connect the mailbox again.");
+        }
+        const client = createGraphClient(_extends({}, deps.transport, {
+            clientId: config.config.clientId,
+            clientSecret: config.config.clientSecret,
+            tenant: config.config.tenant,
+            refreshToken: grant.refreshToken,
+            accessToken: {
+                token: grant.accessToken,
+                expiresInSeconds: grant.expiresInSeconds
+            }
+        }));
+        let profile;
+        try {
+            profile = await client.getProfile();
+        } catch (error) {
+            if (error instanceof GmailTransportError && error.reconnectRequired) return scopesMissing();
+            return googleFailure(error, 'connect/complete Microsoft profile');
+        }
+        if (profile.id !== identity.identity.oid || !profile.emailAddress) {
+            return refusal(422, 'account-mismatch', 'The Microsoft 365 mailbox and the Microsoft sign-in did not match. Connect again.');
+        }
+        return {
+            provider: 'microsoft',
+            providerAccountId: identity.identity.sub,
+            email: profile.emailAddress,
+            sendAsOptions: [
+                {
+                    email: profile.emailAddress,
+                    displayName: profile.displayName,
+                    isPrimary: true,
+                    isDefault: true
+                }
+            ],
+            scopes: grant.scope.split(/\s+/).filter(Boolean),
+            refreshToken: grant.refreshToken,
+            keyring: config.config.keyring
+        };
+    }
+    /**
+   * The connect's end, whichever provider named the account: the member's
+   * mailbox limit, the mailbox (new, or a reconnect that keeps its
+   * settings), its sealed grant, the aliases the provider confirmed, and the
+   * activity row.
+   */ async function storeConnectedMailbox(input) {
+        var _aliases_confirmed;
+        const { gate, body, account, nowMs } = input;
+        const { provider, email: profileEmail, sendAsOptions } = account;
+        const firestore = deps.firestore();
+        const mailboxId = outreachMailboxId(gate.orgId, gate.uid, account.providerAccountId, provider);
         const mailboxDoc = mailboxRef(firestore, gate.orgId, mailboxId);
         const credentialDoc = mailboxCredentialsRef(firestore, mailboxId);
         const [existingMailbox, existingCredential] = await Promise.all([
@@ -321,11 +502,11 @@ export function createOutreachMailboxRoutes(deps) {
             var _ref;
             const keepSendAs = sendAsOptions.some((option)=>option.email === current.sendAs);
             reconnected = {
-                provider: 'google',
+                provider,
                 email: profileEmail,
                 sendAs: keepSendAs ? current.sendAs : (_ref = defaultOption == null ? void 0 : defaultOption.email) != null ? _ref : profileEmail,
                 sendAsOptions,
-                // A reconnect restores a mailbox Google had cut off, and leaves a
+                // A reconnect restores a mailbox the provider had cut off, and leaves a
                 // mailbox its member paused paused.
                 status: current.status === 'paused' ? 'paused' : 'connected',
                 connectedAtMs: nowMs,
@@ -338,7 +519,7 @@ export function createOutreachMailboxRoutes(deps) {
             const displayName = validateDisplayName((defaultOption == null ? void 0 : defaultOption.displayName) || gate.name || '');
             mailbox = {
                 id: mailboxId,
-                provider: 'google',
+                provider,
                 email: profileEmail,
                 sendAs: (_ref1 = defaultOption == null ? void 0 : defaultOption.email) != null ? _ref1 : profileEmail,
                 sendAsOptions,
@@ -372,12 +553,12 @@ export function createOutreachMailboxRoutes(deps) {
             id: mailboxId,
             orgId: gate.orgId,
             mailboxId,
-            provider: 'google',
+            provider,
             connectedByUid: gate.uid,
-            providerAccountId: identity.identity.sub,
+            providerAccountId: account.providerAccountId,
             email: profileEmail,
-            scopes: grant.scope.split(/\s+/).filter(Boolean)
-        }, sealMailboxRefreshToken(grant.refreshToken, mailboxId, config.config.keyring), {
+            scopes: account.scopes
+        }, sealMailboxRefreshToken(account.refreshToken, mailboxId, account.keyring), {
             createdAtMs: Number(existingCredential.exists ? existingCredential.get('createdAtMs') : 0) || nowMs,
             updatedAtMs: nowMs
         });
@@ -416,7 +597,7 @@ export function createOutreachMailboxRoutes(deps) {
             created: !current,
             confirmedAliases: aliases.ok ? (_aliases_confirmed = aliases.confirmed) != null ? _aliases_confirmed : [] : []
         });
-    };
+    }
     const settings = async (request)=>{
         if (request.method !== 'POST') return methodNotAllowed('POST');
         const body = await readBody(request);
@@ -429,7 +610,7 @@ export function createOutreachMailboxRoutes(deps) {
             var _mailbox_sendAsOptions;
             const sendAs = typeof body['sendAs'] === 'string' ? body['sendAs'].trim().toLowerCase() : '';
             if (!((_mailbox_sendAsOptions = mailbox.sendAsOptions) != null ? _mailbox_sendAsOptions : []).some((option)=>option.email === sendAs)) {
-                return invalid('Choose one of the addresses Gmail has verified for this account.');
+                return invalid('Choose one of the addresses the provider has verified for this account.');
             }
             update.sendAs = sendAs;
         }
@@ -527,7 +708,8 @@ export function createOutreachMailboxRoutes(deps) {
         if (mailbox.status === 'reconnect_required' || mailbox.status === 'disconnected') {
             return refusal(409, 'reconnect-required', 'Reconnect this mailbox before sending from it.');
         }
-        if (!deps.readConfig().configured) return notConfigured();
+        const provider = mailbox.provider === 'microsoft' ? 'microsoft' : 'google';
+        if (!providerConfigured(provider)) return notConfigured(provider);
         const limited = await deps.consumeRateLimit(`outreach-mailbox-test:${mailbox.id}`, {
             limit: OUTREACH_TEST_SENDS_PER_HOUR,
             windowMs: 60 * 60 * 1000
@@ -537,7 +719,7 @@ export function createOutreachMailboxRoutes(deps) {
         }
         /*
      * To the member's own address unless they name another (AGL-3228). A
-     * test to oneself never leaves Google, so it arrives with no
+     * test to oneself never leaves the provider, so it arrives with no
      * Authentication-Results at all and cannot show whether the send-as
      * domain's DKIM and DMARC hold; an outside mailbox the member can read
      * is the only place that can be seen. The rate limit above is the
@@ -554,10 +736,11 @@ export function createOutreachMailboxRoutes(deps) {
             mailboxId: mailbox.id
         }, _extends({}, deps.transport, {
             readConfig: deps.readConfig,
+            readMicrosoftConfig,
             now: deps.now
         }));
         if (opened.ok === false) {
-            if (opened.reason === 'not-configured') return notConfigured();
+            if (opened.reason === 'not-configured') return notConfigured(provider);
             await markOutreachMailboxReconnectRequired(firestore, {
                 orgId: gate.orgId,
                 mailboxId: mailbox.id,
@@ -598,7 +781,7 @@ export function createOutreachMailboxRoutes(deps) {
                     errorCode: error.code,
                     nowMs
                 });
-                return refusal(409, 'reconnect-required', 'Google refused this mailbox’s access. Connect it again.');
+                return refusal(409, 'reconnect-required', `${providerName(provider)} refused this mailbox’s access. Connect it again.`);
             }
             if (error instanceof Rfc5322MessageError) {
                 return refusal(400, 'invalid-settings', `The test could not be written: ${error.message}`);
@@ -649,7 +832,7 @@ export function createOutreachMailboxRoutes(deps) {
         const mailbox = readMailbox(mailboxId, snapshot.exists ? snapshot.data() : undefined);
         if (!mailbox) return refusal(404, 'mailbox-not-found', 'That mailbox is not connected to this organization.');
         const sendAs = mailbox.sendAs || mailbox.email;
-        const expectation = googleMailboxSenderExpectation(sendAs);
+        const expectation = mailbox.provider === 'microsoft' ? microsoftMailboxSenderExpectation(sendAs) : googleMailboxSenderExpectation(sendAs);
         const read = expectation ? await deps.readSenderReadiness(expectation, {
             fresh: body['fresh'] === true
         }).catch(()=>null) : null;