@jait/gateway 0.1.498 → 0.1.500

package/dist/services/email/oauth.d.ts

@@ -0,0 +1,32 @@
+import type { EmailProvider, EmailTokens } from "./types.js";
+export interface OAuthClientCredentials {
+    clientId: string;
+    clientSecret: string;
+}
+export type ClientCredentialResolver = (provider: EmailProvider) => OAuthClientCredentials | null;
+export declare function envClientCredentials(provider: EmailProvider): OAuthClientCredentials | null;
+/** PKCE verifier/challenge pair (S256). */
+export declare function createPkce(): {
+    verifier: string;
+    challenge: string;
+};
+export declare function buildAuthorizeUrl(params: {
+    provider: EmailProvider;
+    credentials: OAuthClientCredentials;
+    redirectUri: string;
+    state: string;
+    codeChallenge: string;
+}): string;
+export declare function exchangeCode(params: {
+    provider: EmailProvider;
+    credentials: OAuthClientCredentials;
+    redirectUri: string;
+    code: string;
+    codeVerifier: string;
+}): Promise<EmailTokens>;
+export declare function refreshTokens(params: {
+    provider: EmailProvider;
+    credentials: OAuthClientCredentials;
+    refreshToken: string;
+}): Promise<EmailTokens>;
+//# sourceMappingURL=oauth.d.ts.map

package/dist/services/email/oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../../src/services/email/oauth.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAkC7D,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,MAAM,wBAAwB,GAAG,CACrC,QAAQ,EAAE,aAAa,KACpB,sBAAsB,GAAG,IAAI,CAAC;AAEnC,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,aAAa,GAAG,sBAAsB,GAAG,IAAI,CAM3F;AAED,2CAA2C;AAC3C,wBAAgB,UAAU,IAAI;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAIpE;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE;IACxC,QAAQ,EAAE,aAAa,CAAC;IACxB,WAAW,EAAE,sBAAsB,CAAC;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;CACvB,GAAG,MAAM,CAcT;AA6BD,wBAAsB,YAAY,CAAC,MAAM,EAAE;IACzC,QAAQ,EAAE,aAAa,CAAC;IACxB,WAAW,EAAE,sBAAsB,CAAC;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;CACtB,GAAG,OAAO,CAAC,WAAW,CAAC,CAUvB;AAED,wBAAsB,aAAa,CAAC,MAAM,EAAE;IAC1C,QAAQ,EAAE,aAAa,CAAC;IACxB,WAAW,EAAE,sBAAsB,CAAC;IACpC,YAAY,EAAE,MAAM,CAAC;CACtB,GAAG,OAAO,CAAC,WAAW,CAAC,CAQvB"}

package/dist/services/email/oauth.js

@@ -0,0 +1,105 @@
+// OAuth2 (authorization-code) helpers for Gmail and Outlook.
+//
+// Client credentials are resolved (in priority order) from:
+//   1. Per-user secrets (type "email-oauth-app", keys "<provider>-client-id" /
+//      "<provider>-client-secret") — lets the user configure apps from the UI.
+//   2. Gateway environment variables.
+//
+//   Gmail:   GMAIL_OAUTH_CLIENT_ID    / GMAIL_OAUTH_CLIENT_SECRET
+//   Outlook: OUTLOOK_OAUTH_CLIENT_ID  / OUTLOOK_OAUTH_CLIENT_SECRET
+import { createHash, randomBytes } from "node:crypto";
+const PROVIDERS = {
+    gmail: {
+        authorizeUrl: "https://accounts.google.com/o/oauth2/v2/auth",
+        tokenUrl: "https://oauth2.googleapis.com/token",
+        scopes: [
+            "https://www.googleapis.com/auth/gmail.modify",
+            "https://www.googleapis.com/auth/gmail.send",
+        ],
+        // offline + consent are required to reliably receive a refresh token.
+        authorizeParams: { access_type: "offline", prompt: "consent" },
+    },
+    outlook: {
+        authorizeUrl: "https://login.microsoftonline.com/common/oauth2/v2.0/authorize",
+        tokenUrl: "https://login.microsoftonline.com/common/oauth2/v2.0/token",
+        scopes: [
+            "offline_access",
+            "https://graph.microsoft.com/Mail.ReadWrite",
+            "https://graph.microsoft.com/Mail.Send",
+            "https://graph.microsoft.com/User.Read",
+        ],
+        authorizeParams: { response_mode: "query" },
+    },
+};
+export function envClientCredentials(provider) {
+    const prefix = provider === "gmail" ? "GMAIL" : "OUTLOOK";
+    const clientId = process.env[`${prefix}_OAUTH_CLIENT_ID`]?.trim();
+    const clientSecret = process.env[`${prefix}_OAUTH_CLIENT_SECRET`]?.trim();
+    if (!clientId || !clientSecret)
+        return null;
+    return { clientId, clientSecret };
+}
+/** PKCE verifier/challenge pair (S256). */
+export function createPkce() {
+    const verifier = randomBytes(32).toString("base64url");
+    const challenge = createHash("sha256").update(verifier).digest("base64url");
+    return { verifier, challenge };
+}
+export function buildAuthorizeUrl(params) {
+    const cfg = PROVIDERS[params.provider];
+    const url = new URL(cfg.authorizeUrl);
+    url.searchParams.set("client_id", params.credentials.clientId);
+    url.searchParams.set("redirect_uri", params.redirectUri);
+    url.searchParams.set("response_type", "code");
+    url.searchParams.set("scope", cfg.scopes.join(" "));
+    url.searchParams.set("state", params.state);
+    url.searchParams.set("code_challenge", params.codeChallenge);
+    url.searchParams.set("code_challenge_method", "S256");
+    for (const [k, v] of Object.entries(cfg.authorizeParams)) {
+        url.searchParams.set(k, v);
+    }
+    return url.toString();
+}
+function tokensFromResponse(data, fallbackRefresh) {
+    const expiresIn = typeof data["expires_in"] === "number" ? data["expires_in"] : 3600;
+    return {
+        accessToken: String(data["access_token"] ?? ""),
+        refreshToken: data["refresh_token"] ?? fallbackRefresh ?? null,
+        expiresAt: Date.now() + expiresIn * 1000,
+        scope: data["scope"],
+    };
+}
+async function postToken(provider, body) {
+    const res = await fetch(PROVIDERS[provider].tokenUrl, {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams(body).toString(),
+    });
+    const data = (await res.json().catch(() => ({})));
+    if (!res.ok) {
+        const detail = data["error_description"] ?? data["error"] ?? `HTTP ${res.status}`;
+        throw new Error(`OAuth token request failed: ${detail}`);
+    }
+    return data;
+}
+export async function exchangeCode(params) {
+    const data = await postToken(params.provider, {
+        client_id: params.credentials.clientId,
+        client_secret: params.credentials.clientSecret,
+        code: params.code,
+        redirect_uri: params.redirectUri,
+        grant_type: "authorization_code",
+        code_verifier: params.codeVerifier,
+    });
+    return tokensFromResponse(data);
+}
+export async function refreshTokens(params) {
+    const data = await postToken(params.provider, {
+        client_id: params.credentials.clientId,
+        client_secret: params.credentials.clientSecret,
+        refresh_token: params.refreshToken,
+        grant_type: "refresh_token",
+    });
+    return tokensFromResponse(data, params.refreshToken);
+}
+//# sourceMappingURL=oauth.js.map

package/dist/services/email/oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../../src/services/email/oauth.ts"],"names":[],"mappings":"AAAA,6DAA6D;AAC7D,EAAE;AACF,4DAA4D;AAC5D,+EAA+E;AAC/E,+EAA+E;AAC/E,sCAAsC;AACtC,EAAE;AACF,kEAAkE;AAClE,oEAAoE;AAEpE,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAWtD,MAAM,SAAS,GAA+C;IAC5D,KAAK,EAAE;QACL,YAAY,EAAE,8CAA8C;QAC5D,QAAQ,EAAE,qCAAqC;QAC/C,MAAM,EAAE;YACN,8CAA8C;YAC9C,4CAA4C;SAC7C;QACD,sEAAsE;QACtE,eAAe,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE;KAC/D;IACD,OAAO,EAAE;QACP,YAAY,EAAE,gEAAgE;QAC9E,QAAQ,EAAE,4DAA4D;QACtE,MAAM,EAAE;YACN,gBAAgB;YAChB,4CAA4C;YAC5C,uCAAuC;YACvC,uCAAuC;SACxC;QACD,eAAe,EAAE,EAAE,aAAa,EAAE,OAAO,EAAE;KAC5C;CACF,CAAC;AAWF,MAAM,UAAU,oBAAoB,CAAC,QAAuB;IAC1D,MAAM,MAAM,GAAG,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1D,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,kBAAkB,CAAC,EAAE,IAAI,EAAE,CAAC;IAClE,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,sBAAsB,CAAC,EAAE,IAAI,EAAE,CAAC;IAC1E,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC;IAC5C,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;AACpC,CAAC;AAED,2CAA2C;AAC3C,MAAM,UAAU,UAAU;IACxB,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACvD,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC5E,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,MAMjC;IACC,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACtC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IAC/D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;IACzD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACpD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;IAC7D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;IACtD,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;QACzD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED,SAAS,kBAAkB,CAAC,IAA6B,EAAE,eAA+B;IACxF,MAAM,SAAS,GAAG,OAAO,IAAI,CAAC,YAAY,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACrF,OAAO;QACL,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QAC/C,YAAY,EAAG,IAAI,CAAC,eAAe,CAAwB,IAAI,eAAe,IAAI,IAAI;QACtF,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,IAAI;QACxC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAuB;KAC3C,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,SAAS,CACtB,QAAuB,EACvB,IAA4B;IAE5B,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,QAAQ,EAAE;QACpD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;KAC3C,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAA4B,CAAC;IAC7E,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,MAAM,GAAG,IAAI,CAAC,mBAAmB,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC;QAClF,MAAM,IAAI,KAAK,CAAC,+BAA+B,MAAM,EAAE,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,MAMlC;IACC,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,QAAQ,EAAE;QAC5C,SAAS,EAAE,MAAM,CAAC,WAAW,CAAC,QAAQ;QACtC,aAAa,EAAE,MAAM,CAAC,WAAW,CAAC,YAAY;QAC9C,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,YAAY,EAAE,MAAM,CAAC,WAAW;QAChC,UAAU,EAAE,oBAAoB;QAChC,aAAa,EAAE,MAAM,CAAC,YAAY;KACnC,CAAC,CAAC;IACH,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC;AAClC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,MAInC;IACC,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,QAAQ,EAAE;QAC5C,SAAS,EAAE,MAAM,CAAC,WAAW,CAAC,QAAQ;QACtC,aAAa,EAAE,MAAM,CAAC,WAAW,CAAC,YAAY;QAC9C,aAAa,EAAE,MAAM,CAAC,YAAY;QAClC,UAAU,EAAE,eAAe;KAC5B,CAAC,CAAC;IACH,OAAO,kBAAkB,CAAC,IAAI,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;AACvD,CAAC"}

package/dist/services/email/outlook.d.ts

@@ -0,0 +1,15 @@
+import type { EmailFolder, EmailMessageFull, EmailMessageSummary, ListMessagesOptions, MailboxClient, SendMessageInput } from "./types.js";
+export declare class OutlookClient implements MailboxClient {
+    private gfetch;
+    private summarize;
+    listMessages(accessToken: string, opts: ListMessagesOptions): Promise<EmailMessageSummary[]>;
+    getMessage(accessToken: string, id: string): Promise<EmailMessageFull>;
+    sendMessage(accessToken: string, input: SendMessageInput): Promise<{
+        id: string;
+    }>;
+    tagMessage(accessToken: string, id: string, add: string[], remove: string[]): Promise<void>;
+    deleteMessage(accessToken: string, id: string): Promise<void>;
+    listFolders(accessToken: string): Promise<EmailFolder[]>;
+    getProfileEmail(accessToken: string): Promise<string>;
+}
+//# sourceMappingURL=outlook.d.ts.map

package/dist/services/email/outlook.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"outlook.d.ts","sourceRoot":"","sources":["../../../src/services/email/outlook.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,WAAW,EACX,gBAAgB,EAChB,mBAAmB,EACnB,mBAAmB,EACnB,aAAa,EACb,gBAAgB,EACjB,MAAM,YAAY,CAAC;AAuCpB,qBAAa,aAAc,YAAW,aAAa;YACnC,MAAM;IAmBpB,OAAO,CAAC,SAAS;IAeX,YAAY,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,EAAE,CAAC;IAsB5F,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAYtE,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IA8BlF,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAW3F,aAAa,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAK7D,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAOxD,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;CAO5D"}

package/dist/services/email/outlook.js

@@ -0,0 +1,142 @@
+// Outlook mailbox client (Microsoft Graph v1.0).
+const BASE = "https://graph.microsoft.com/v1.0";
+function fmtRecipient(r) {
+    const ea = r?.emailAddress;
+    if (!ea)
+        return "";
+    return ea.name ? `${ea.name} <${ea.address ?? ""}>` : ea.address ?? "";
+}
+function fmtRecipients(list) {
+    return (list ?? []).map(fmtRecipient).filter(Boolean).join(", ");
+}
+function toGraphRecipients(value) {
+    if (!value)
+        return [];
+    return value
+        .split(/[,;]/)
+        .map((s) => s.trim())
+        .filter(Boolean)
+        .map((address) => ({ emailAddress: { address } }));
+}
+export class OutlookClient {
+    async gfetch(accessToken, path, init) {
+        const res = await fetch(`${BASE}${path}`, {
+            ...init,
+            headers: {
+                Authorization: `Bearer ${accessToken}`,
+                ...(init?.body ? { "Content-Type": "application/json" } : {}),
+                ...(init?.headers ?? {}),
+            },
+        });
+        if (res.status === 204)
+            return {};
+        const text = await res.text();
+        const data = text ? JSON.parse(text) : {};
+        if (!res.ok) {
+            const msg = data?.error?.message ?? `HTTP ${res.status}`;
+            throw new Error(`Microsoft Graph error: ${msg}`);
+        }
+        return data;
+    }
+    summarize(m) {
+        return {
+            id: m.id,
+            threadId: m.conversationId,
+            from: fmtRecipient(m.from),
+            to: fmtRecipients(m.toRecipients),
+            subject: m.subject ?? "",
+            snippet: m.bodyPreview ?? "",
+            date: m.receivedDateTime ?? "",
+            unread: m.isRead === false,
+            labels: m.categories ?? [],
+            hasAttachments: m.hasAttachments ?? false,
+        };
+    }
+    async listMessages(accessToken, opts) {
+        const limit = Math.min(Math.max(opts.limit ?? 25, 1), 50);
+        const folder = opts.folder && opts.folder.toLowerCase() !== "all" ? opts.folder : "inbox";
+        const params = new URLSearchParams({
+            $top: String(limit),
+            $select: "id,conversationId,subject,bodyPreview,receivedDateTime,isRead,hasAttachments,categories,from,toRecipients",
+        });
+        let path;
+        if (opts.query) {
+            // $search cannot be combined with $orderby.
+            params.set("$search", `"${opts.query.replace(/"/g, "")}"`);
+            path = `/me/mailFolders/${folder}/messages?${params.toString()}`;
+        }
+        else {
+            params.set("$orderby", "receivedDateTime desc");
+            path = `/me/mailFolders/${folder}/messages?${params.toString()}`;
+        }
+        const data = (await this.gfetch(accessToken, path, {
+            headers: { ConsistencyLevel: "eventual" },
+        }));
+        return (data.value ?? []).map((m) => this.summarize(m));
+    }
+    async getMessage(accessToken, id) {
+        const m = (await this.gfetch(accessToken, `/me/messages/${id}`));
+        const summary = this.summarize(m);
+        const isHtml = (m.body?.contentType ?? "").toLowerCase() === "html";
+        return {
+            ...summary,
+            cc: fmtRecipients(m.ccRecipients),
+            bodyText: isHtml ? "" : m.body?.content ?? "",
+            bodyHtml: isHtml ? m.body?.content ?? "" : "",
+        };
+    }
+    async sendMessage(accessToken, input) {
+        if (input.replyToMessageId) {
+            await this.gfetch(accessToken, `/me/messages/${input.replyToMessageId}/reply`, {
+                method: "POST",
+                body: JSON.stringify({
+                    message: {
+                        toRecipients: input.to ? toGraphRecipients(input.to) : undefined,
+                        ccRecipients: toGraphRecipients(input.cc),
+                    },
+                    comment: input.body,
+                }),
+            });
+            return { id: input.replyToMessageId };
+        }
+        await this.gfetch(accessToken, "/me/sendMail", {
+            method: "POST",
+            body: JSON.stringify({
+                message: {
+                    subject: input.subject,
+                    body: { contentType: input.html ? "HTML" : "Text", content: input.body },
+                    toRecipients: toGraphRecipients(input.to),
+                    ccRecipients: toGraphRecipients(input.cc),
+                    bccRecipients: toGraphRecipients(input.bcc),
+                },
+                saveToSentItems: true,
+            }),
+        });
+        return { id: "" };
+    }
+    async tagMessage(accessToken, id, add, remove) {
+        const m = (await this.gfetch(accessToken, `/me/messages/${id}?$select=categories`));
+        const current = new Set(m.categories ?? []);
+        for (const c of add)
+            current.add(c);
+        for (const c of remove)
+            current.delete(c);
+        await this.gfetch(accessToken, `/me/messages/${id}`, {
+            method: "PATCH",
+            body: JSON.stringify({ categories: [...current] }),
+        });
+    }
+    async deleteMessage(accessToken, id) {
+        // DELETE moves the message to Deleted Items.
+        await this.gfetch(accessToken, `/me/messages/${id}`, { method: "DELETE" });
+    }
+    async listFolders(accessToken) {
+        const data = (await this.gfetch(accessToken, "/me/mailFolders?$top=50&$select=id,displayName,unreadItemCount"));
+        return (data.value ?? []).map((f) => ({ id: f.id, name: f.displayName, unreadCount: f.unreadItemCount }));
+    }
+    async getProfileEmail(accessToken) {
+        const data = (await this.gfetch(accessToken, "/me?$select=mail,userPrincipalName"));
+        return data.mail ?? data.userPrincipalName ?? "";
+    }
+}
+//# sourceMappingURL=outlook.js.map

package/dist/services/email/outlook.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"outlook.js","sourceRoot":"","sources":["../../../src/services/email/outlook.ts"],"names":[],"mappings":"AAAA,iDAAiD;AAWjD,MAAM,IAAI,GAAG,kCAAkC,CAAC;AAkBhD,SAAS,YAAY,CAAC,CAA6B;IACjD,MAAM,EAAE,GAAG,CAAC,EAAE,YAAY,CAAC;IAC3B,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,CAAC;IACnB,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,OAAO,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,IAAI,EAAE,CAAC;AACzE,CAAC;AAED,SAAS,aAAa,CAAC,IAAkC;IACvD,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAyB;IAClD,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,OAAO,KAAK;SACT,KAAK,CAAC,MAAM,CAAC;SACb,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC;SACf,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,YAAY,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,OAAO,aAAa;IAChB,KAAK,CAAC,MAAM,CAAC,WAAmB,EAAE,IAAY,EAAE,IAAkB;QACxE,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,EAAE;YACxC,GAAG,IAAI;YACP,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,WAAW,EAAE;gBACtC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7D,GAAG,CAAC,IAAI,EAAE,OAAO,IAAI,EAAE,CAAC;aACzB;SACF,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1C,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,GAAG,GAAG,IAAI,EAAE,KAAK,EAAE,OAAO,IAAI,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC;YACzD,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,EAAE,CAAC,CAAC;QACnD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,SAAS,CAAC,CAAe;QAC/B,OAAO;YACL,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,QAAQ,EAAE,CAAC,CAAC,cAAc;YAC1B,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC;YAC1B,EAAE,EAAE,aAAa,CAAC,CAAC,CAAC,YAAY,CAAC;YACjC,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,EAAE;YACxB,OAAO,EAAE,CAAC,CAAC,WAAW,IAAI,EAAE;YAC5B,IAAI,EAAE,CAAC,CAAC,gBAAgB,IAAI,EAAE;YAC9B,MAAM,EAAE,CAAC,CAAC,MAAM,KAAK,KAAK;YAC1B,MAAM,EAAE,CAAC,CAAC,UAAU,IAAI,EAAE;YAC1B,cAAc,EAAE,CAAC,CAAC,cAAc,IAAI,KAAK;SAC1C,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,WAAmB,EAAE,IAAyB;QAC/D,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;QAC1F,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC;YACnB,OAAO,EAAE,2GAA2G;SACrH,CAAC,CAAC;QACH,IAAI,IAAY,CAAC;QACjB,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,4CAA4C;YAC5C,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;YAC3D,IAAI,GAAG,mBAAmB,MAAM,aAAa,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;QACnE,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,uBAAuB,CAAC,CAAC;YAChD,IAAI,GAAG,mBAAmB,MAAM,aAAa,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;QACnE,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,EAAE;YACjD,OAAO,EAAE,EAAE,gBAAgB,EAAE,UAAU,EAAE;SAC1C,CAAC,CAA+B,CAAC;QAClC,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1D,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,WAAmB,EAAE,EAAU;QAC9C,MAAM,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,gBAAgB,EAAE,EAAE,CAAC,CAAiB,CAAC;QACjF,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAClC,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,WAAW,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC;QACpE,OAAO;YACL,GAAG,OAAO;YACV,EAAE,EAAE,aAAa,CAAC,CAAC,CAAC,YAAY,CAAC;YACjC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,IAAI,EAAE;YAC7C,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE;SAC9C,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,WAAmB,EAAE,KAAuB;QAC5D,IAAI,KAAK,CAAC,gBAAgB,EAAE,CAAC;YAC3B,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,gBAAgB,KAAK,CAAC,gBAAgB,QAAQ,EAAE;gBAC7E,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,OAAO,EAAE;wBACP,YAAY,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS;wBAChE,YAAY,EAAE,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;qBAC1C;oBACD,OAAO,EAAE,KAAK,CAAC,IAAI;iBACpB,CAAC;aACH,CAAC,CAAC;YACH,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,gBAAgB,EAAE,CAAC;QACxC,CAAC;QACD,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,cAAc,EAAE;YAC7C,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,OAAO,EAAE;oBACP,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,IAAI,EAAE,EAAE,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,IAAI,EAAE;oBACxE,YAAY,EAAE,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;oBACzC,YAAY,EAAE,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;oBACzC,aAAa,EAAE,iBAAiB,CAAC,KAAK,CAAC,GAAG,CAAC;iBAC5C;gBACD,eAAe,EAAE,IAAI;aACtB,CAAC;SACH,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,WAAmB,EAAE,EAAU,EAAE,GAAa,EAAE,MAAgB;QAC/E,MAAM,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,gBAAgB,EAAE,qBAAqB,CAAC,CAAiB,CAAC;QACpG,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;QAC5C,KAAK,MAAM,CAAC,IAAI,GAAG;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACpC,KAAK,MAAM,CAAC,IAAI,MAAM;YAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC1C,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,gBAAgB,EAAE,EAAE,EAAE;YACnD,MAAM,EAAE,OAAO;YACf,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,CAAC,GAAG,OAAO,CAAC,EAAE,CAAC;SACnD,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,WAAmB,EAAE,EAAU;QACjD,6CAA6C;QAC7C,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,gBAAgB,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,WAAmB;QACnC,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,gEAAgE,CAAC,CAE7G,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC;IAC5G,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,WAAmB;QACvC,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,oCAAoC,CAAC,CAGjF,CAAC;QACF,OAAO,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,iBAAiB,IAAI,EAAE,CAAC;IACnD,CAAC;CACF"}

package/dist/services/email/service.d.ts

@@ -0,0 +1,50 @@
+import type { JaitDB } from "../../db/connection.js";
+import type { UserSecretService } from "../user-secrets.js";
+import { type OAuthClientCredentials } from "./oauth.js";
+import type { EmailAccount, EmailFolder, EmailMessageFull, EmailMessageSummary, EmailProvider, ListMessagesOptions, SendMessageInput } from "./types.js";
+export declare class EmailService {
+    private readonly db;
+    private readonly secrets;
+    private readonly clients;
+    private readonly pending;
+    constructor(db: JaitDB, secrets: UserSecretService);
+    /** Resolve OAuth app credentials: per-user secret first, then env. */
+    resolveCredentials(provider: EmailProvider, userId: string | null): OAuthClientCredentials | null;
+    /** Which providers are ready to connect (have OAuth app credentials). */
+    configuredProviders(userId: string | null): Record<EmailProvider, boolean>;
+    saveAppCredentials(userId: string | null, provider: EmailProvider, creds: OAuthClientCredentials): void;
+    startConnect(params: {
+        userId: string | null;
+        provider: EmailProvider;
+        redirectUri: string;
+    }): {
+        authUrl: string;
+    };
+    completeConnect(params: {
+        code: string;
+        state: string;
+    }): Promise<EmailAccount>;
+    listAccounts(userId: string | null): EmailAccount[];
+    getAccount(userId: string | null, accountId: string): EmailAccount | null;
+    /** Resolve an account by id, or fall back to the user's first account. */
+    resolveAccount(userId: string | null, accountId?: string): EmailAccount;
+    disconnect(userId: string | null, accountId: string): boolean;
+    private upsertAccount;
+    private storeTokens;
+    private loadTokens;
+    private findTokenSecretId;
+    private validAccessToken;
+    listMessages(userId: string | null, accountId: string | undefined, opts: ListMessagesOptions): Promise<{
+        account: EmailAccount;
+        messages: EmailMessageSummary[];
+    }>;
+    getMessage(userId: string | null, accountId: string | undefined, id: string): Promise<EmailMessageFull>;
+    sendMessage(userId: string | null, accountId: string | undefined, input: SendMessageInput): Promise<{
+        id: string;
+    }>;
+    tagMessage(userId: string | null, accountId: string | undefined, id: string, add: string[], remove: string[]): Promise<void>;
+    deleteMessage(userId: string | null, accountId: string | undefined, id: string): Promise<void>;
+    listFolders(userId: string | null, accountId: string | undefined): Promise<EmailFolder[]>;
+    private gcPending;
+}
+//# sourceMappingURL=service.d.ts.map

package/dist/services/email/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../src/services/email/service.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAGrD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAG5D,OAAO,EAML,KAAK,sBAAsB,EAC5B,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EACV,YAAY,EACZ,WAAW,EACX,gBAAgB,EAChB,mBAAmB,EACnB,aAAa,EAEb,mBAAmB,EAEnB,gBAAgB,EACjB,MAAM,YAAY,CAAC;AAcpB,qBAAa,YAAY;IAQrB,OAAO,CAAC,QAAQ,CAAC,EAAE;IACnB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAR1B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAGtB;IACF,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqC;gBAG1C,EAAE,EAAE,MAAM,EACV,OAAO,EAAE,iBAAiB;IAK7C,sEAAsE;IACtE,kBAAkB,CAAC,QAAQ,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,sBAAsB,GAAG,IAAI;IAOjG,yEAAyE;IACzE,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAAC,aAAa,EAAE,OAAO,CAAC;IAO1E,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,EAAE,QAAQ,EAAE,aAAa,EAAE,KAAK,EAAE,sBAAsB,GAAG,IAAI;IAmBvG,YAAY,CAAC,MAAM,EAAE;QACnB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QACtB,QAAQ,EAAE,aAAa,CAAC;QACxB,WAAW,EAAE,MAAM,CAAC;KACrB,GAAG;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE;IA+BjB,eAAe,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,YAAY,CAAC;IAyBrF,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,YAAY,EAAE;IAUnD,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,EAAE,SAAS,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI;IAczE,0EAA0E;IAC1E,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,YAAY;IAYvE,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO;IAS7D,OAAO,CAAC,aAAa;IAuCrB,OAAO,CAAC,WAAW;IAUnB,OAAO,CAAC,UAAU;IAUlB,OAAO,CAAC,iBAAiB;YAKX,gBAAgB;IAkBxB,YAAY,CAChB,MAAM,EAAE,MAAM,GAAG,IAAI,EACrB,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC;QAAE,OAAO,EAAE,YAAY,CAAC;QAAC,QAAQ,EAAE,mBAAmB,EAAE,CAAA;KAAE,CAAC;IAOhE,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,EAAE,SAAS,EAAE,MAAM,GAAG,SAAS,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAMvG,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,EAAE,SAAS,EAAE,MAAM,GAAG,SAAS,EAAE,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IAMnH,UAAU,CACd,MAAM,EAAE,MAAM,GAAG,IAAI,EACrB,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,EAAE,EAAE,MAAM,EACV,GAAG,EAAE,MAAM,EAAE,EACb,MAAM,EAAE,MAAM,EAAE,GACf,OAAO,CAAC,IAAI,CAAC;IAMV,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,EAAE,SAAS,EAAE,MAAM,GAAG,SAAS,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAM9F,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,EAAE,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAM/F,OAAO,CAAC,SAAS;CAMlB"}

package/dist/services/email/service.js

@@ -0,0 +1,277 @@
+// EmailService — orchestrates connected mailboxes: OAuth connect flow,
+// account persistence, token storage/refresh, and provider-agnostic ops.
+import { randomBytes } from "node:crypto";
+import { and, desc, eq, isNull } from "drizzle-orm";
+import { emailAccounts } from "../../db/schema.js";
+import { uuidv7 } from "../../db/uuidv7.js";
+import { GmailClient } from "./gmail.js";
+import { OutlookClient } from "./outlook.js";
+import { buildAuthorizeUrl, createPkce, envClientCredentials, exchangeCode, refreshTokens, } from "./oauth.js";
+const TOKEN_SECRET_TYPE = "email-account";
+const APP_SECRET_TYPE = "email-oauth-app";
+const PROVIDERS = ["gmail", "outlook"];
+export class EmailService {
+    db;
+    secrets;
+    clients = {
+        gmail: new GmailClient(),
+        outlook: new OutlookClient(),
+    };
+    pending = new Map();
+    constructor(db, secrets) {
+        this.db = db;
+        this.secrets = secrets;
+    }
+    // ── OAuth client credentials ───────────────────────────────────────
+    /** Resolve OAuth app credentials: per-user secret first, then env. */
+    resolveCredentials(provider, userId) {
+        const clientId = this.secrets.getValue(userId, APP_SECRET_TYPE, `${provider}-client-id`);
+        const clientSecret = this.secrets.getValue(userId, APP_SECRET_TYPE, `${provider}-client-secret`);
+        if (clientId && clientSecret)
+            return { clientId, clientSecret };
+        return envClientCredentials(provider);
+    }
+    /** Which providers are ready to connect (have OAuth app credentials). */
+    configuredProviders(userId) {
+        return {
+            gmail: !!this.resolveCredentials("gmail", userId),
+            outlook: !!this.resolveCredentials("outlook", userId),
+        };
+    }
+    saveAppCredentials(userId, provider, creds) {
+        this.secrets.save({
+            userId,
+            type: APP_SECRET_TYPE,
+            key: `${provider}-client-id`,
+            label: `${provider} OAuth client id`,
+            value: creds.clientId,
+        });
+        this.secrets.save({
+            userId,
+            type: APP_SECRET_TYPE,
+            key: `${provider}-client-secret`,
+            label: `${provider} OAuth client secret`,
+            value: creds.clientSecret,
+        });
+    }
+    // ── Connect flow ───────────────────────────────────────────────────
+    startConnect(params) {
+        if (!PROVIDERS.includes(params.provider)) {
+            throw new Error(`Unsupported email provider: ${params.provider}`);
+        }
+        const credentials = this.resolveCredentials(params.provider, params.userId);
+        if (!credentials) {
+            throw new Error(`${params.provider} is not configured. Add its OAuth client id/secret (env ` +
+                `${params.provider === "gmail" ? "GMAIL" : "OUTLOOK"}_OAUTH_CLIENT_ID/SECRET or in Email settings).`);
+        }
+        const state = randomBytes(24).toString("base64url");
+        const { verifier, challenge } = createPkce();
+        this.pending.set(state, {
+            userId: params.userId,
+            provider: params.provider,
+            codeVerifier: verifier,
+            redirectUri: params.redirectUri,
+            createdAt: Date.now(),
+        });
+        this.gcPending();
+        const authUrl = buildAuthorizeUrl({
+            provider: params.provider,
+            credentials,
+            redirectUri: params.redirectUri,
+            state,
+            codeChallenge: challenge,
+        });
+        return { authUrl };
+    }
+    async completeConnect(params) {
+        const pending = this.pending.get(params.state);
+        if (!pending)
+            throw new Error("OAuth state is invalid or expired. Please retry connecting.");
+        this.pending.delete(params.state);
+        const credentials = this.resolveCredentials(pending.provider, pending.userId);
+        if (!credentials)
+            throw new Error(`${pending.provider} OAuth credentials are no longer configured.`);
+        const tokens = await exchangeCode({
+            provider: pending.provider,
+            credentials,
+            redirectUri: pending.redirectUri,
+            code: params.code,
+            codeVerifier: pending.codeVerifier,
+        });
+        const email = await this.clients[pending.provider].getProfileEmail(tokens.accessToken);
+        if (!email)
+            throw new Error("Could not read the account email address from the provider.");
+        const account = this.upsertAccount(pending.userId, pending.provider, email);
+        this.storeTokens(account.id, pending.userId, tokens);
+        return account;
+    }
+    // ── Account persistence ────────────────────────────────────────────
+    listAccounts(userId) {
+        return this.db
+            .select()
+            .from(emailAccounts)
+            .where(userId ? eq(emailAccounts.userId, userId) : isNull(emailAccounts.userId))
+            .orderBy(desc(emailAccounts.updatedAt))
+            .all()
+            .map(rowToAccount);
+    }
+    getAccount(userId, accountId) {
+        const row = this.db
+            .select()
+            .from(emailAccounts)
+            .where(and(eq(emailAccounts.id, accountId), userId ? eq(emailAccounts.userId, userId) : isNull(emailAccounts.userId)))
+            .get();
+        return row ? rowToAccount(row) : null;
+    }
+    /** Resolve an account by id, or fall back to the user's first account. */
+    resolveAccount(userId, accountId) {
+        if (accountId) {
+            const acct = this.getAccount(userId, accountId);
+            if (!acct)
+                throw new Error(`Email account ${accountId} not found.`);
+            return acct;
+        }
+        const accounts = this.listAccounts(userId);
+        const first = accounts[0];
+        if (!first)
+            throw new Error("No email account connected. Connect Gmail or Outlook first.");
+        return first;
+    }
+    disconnect(userId, accountId) {
+        const acct = this.getAccount(userId, accountId);
+        if (!acct)
+            return false;
+        this.db.delete(emailAccounts).where(eq(emailAccounts.id, accountId)).run();
+        const secretId = this.findTokenSecretId(userId, accountId);
+        if (secretId)
+            this.secrets.delete(secretId, userId);
+        return true;
+    }
+    upsertAccount(userId, provider, email) {
+        const now = new Date().toISOString();
+        const existing = this.db
+            .select()
+            .from(emailAccounts)
+            .where(and(userId ? eq(emailAccounts.userId, userId) : isNull(emailAccounts.userId), eq(emailAccounts.provider, provider), eq(emailAccounts.email, email)))
+            .get();
+        if (existing) {
+            this.db
+                .update(emailAccounts)
+                .set({ status: "connected", error: null, updatedAt: now })
+                .where(eq(emailAccounts.id, existing.id))
+                .run();
+            return rowToAccount({ ...existing, status: "connected", error: null, updatedAt: now });
+        }
+        const id = uuidv7();
+        const row = {
+            id,
+            userId: userId ?? null,
+            provider,
+            email,
+            displayName: email,
+            status: "connected",
+            error: null,
+            createdAt: now,
+            updatedAt: now,
+        };
+        this.db.insert(emailAccounts).values(row).run();
+        return rowToAccount(row);
+    }
+    // ── Token storage / refresh ────────────────────────────────────────
+    storeTokens(accountId, userId, tokens) {
+        this.secrets.save({
+            userId,
+            type: TOKEN_SECRET_TYPE,
+            key: accountId,
+            label: `Email tokens (${accountId})`,
+            value: JSON.stringify(tokens),
+        });
+    }
+    loadTokens(accountId, userId) {
+        const raw = this.secrets.getValue(userId, TOKEN_SECRET_TYPE, accountId);
+        if (!raw)
+            return null;
+        try {
+            return JSON.parse(raw);
+        }
+        catch {
+            return null;
+        }
+    }
+    findTokenSecretId(userId, accountId) {
+        const list = this.secrets.list(userId, TOKEN_SECRET_TYPE);
+        return list.find((s) => s.key === accountId)?.id ?? null;
+    }
+    async validAccessToken(account) {
+        const tokens = this.loadTokens(account.id, account.userId);
+        if (!tokens)
+            throw new Error("No stored credentials for this account. Reconnect it.");
+        if (tokens.expiresAt - Date.now() > 60_000)
+            return tokens.accessToken;
+        if (!tokens.refreshToken)
+            throw new Error("Access token expired and no refresh token is available. Reconnect.");
+        const credentials = this.resolveCredentials(account.provider, account.userId);
+        if (!credentials)
+            throw new Error(`${account.provider} OAuth credentials are not configured.`);
+        const refreshed = await refreshTokens({
+            provider: account.provider,
+            credentials,
+            refreshToken: tokens.refreshToken,
+        });
+        this.storeTokens(account.id, account.userId, refreshed);
+        return refreshed.accessToken;
+    }
+    // ── Provider-agnostic operations ───────────────────────────────────
+    async listMessages(userId, accountId, opts) {
+        const account = this.resolveAccount(userId, accountId);
+        const token = await this.validAccessToken(account);
+        const messages = await this.clients[account.provider].listMessages(token, opts);
+        return { account, messages };
+    }
+    async getMessage(userId, accountId, id) {
+        const account = this.resolveAccount(userId, accountId);
+        const token = await this.validAccessToken(account);
+        return this.clients[account.provider].getMessage(token, id);
+    }
+    async sendMessage(userId, accountId, input) {
+        const account = this.resolveAccount(userId, accountId);
+        const token = await this.validAccessToken(account);
+        return this.clients[account.provider].sendMessage(token, input);
+    }
+    async tagMessage(userId, accountId, id, add, remove) {
+        const account = this.resolveAccount(userId, accountId);
+        const token = await this.validAccessToken(account);
+        await this.clients[account.provider].tagMessage(token, id, add, remove);
+    }
+    async deleteMessage(userId, accountId, id) {
+        const account = this.resolveAccount(userId, accountId);
+        const token = await this.validAccessToken(account);
+        await this.clients[account.provider].deleteMessage(token, id);
+    }
+    async listFolders(userId, accountId) {
+        const account = this.resolveAccount(userId, accountId);
+        const token = await this.validAccessToken(account);
+        return this.clients[account.provider].listFolders(token);
+    }
+    gcPending() {
+        const cutoff = Date.now() - 10 * 60_000;
+        for (const [state, p] of this.pending) {
+            if (p.createdAt < cutoff)
+                this.pending.delete(state);
+        }
+    }
+}
+function rowToAccount(row) {
+    return {
+        id: row.id,
+        userId: row.userId,
+        provider: row.provider,
+        email: row.email,
+        displayName: row.displayName,
+        status: row.status,
+        error: row.error,
+        createdAt: row.createdAt,
+        updatedAt: row.updatedAt,
+    };
+}
+//# sourceMappingURL=service.js.map