@marlinjai/email-mcp 1.7.2 → 1.8.1

package/dist/setup/wizard.js

@@ -202,6 +202,14 @@ function decrypt(ciphertext, seeds) {
   }
   throw lastError ?? new Error("Unable to decrypt credentials");
 }
+function encryptWithMachineKey(plaintext) {
+  return encrypt(plaintext, getSeedCandidates()[0]);
+}
+function decryptWithMachineKey(ciphertext) {
+  const seeds = getSeedCandidates();
+  const { plaintext, seedUsed } = decrypt(ciphertext, seeds);
+  return { plaintext, usedLegacyKey: seedUsed !== seeds[0] };
+}
 var CredentialStore = class {
   filePath;
   constructor(dir) {
@@ -216,10 +224,9 @@ var CredentialStore = class {
       return { accounts: {} };
     }
     const raw = fs.readFileSync(this.filePath, "utf-8");
-    const seeds = getSeedCandidates();
-    const { plaintext, seedUsed } = decrypt(raw, seeds);
+    const { plaintext, usedLegacyKey } = decryptWithMachineKey(raw);
     const data = JSON.parse(plaintext);
-    if (seedUsed !== seeds[0]) {
+    if (usedLegacyKey) {
       try {
         this.write(data);
       } catch {
@@ -229,7 +236,7 @@ var CredentialStore = class {
   }
   write(data) {
     const json = JSON.stringify(data);
-    const encrypted = encrypt(json, getSeedCandidates()[0]);
+    const encrypted = encryptWithMachineKey(json);
     fs.writeFileSync(this.filePath, encrypted, { mode: 384 });
   }
   async save(creds) {
@@ -282,53 +289,95 @@ var ERROR_HTML = `<!DOCTYPE html>
   <p>An error occurred during authorization. Please try again.</p>
 </body>
 </html>`;
-var OAuthCallbackServer = class {
-  server = null;
+var OAuthCallbackServer = class _OAuthCallbackServer {
+  servers = [];
   resolveCode = null;
   rejectCode = null;
   timeoutMs;
   timeoutHandle = null;
   expectedState = null;
+  static IPV4_LOOPBACK = "127.0.0.1";
+  static IPV6_LOOPBACK = "::1";
+  /** Attempts at finding a port that is free on both loopback addresses. */
+  static MAX_PORT_ATTEMPTS = 5;
   constructor(timeoutMs = 12e4) {
     this.timeoutMs = timeoutMs;
   }
-  start() {
+  handleRequest = (req, res) => {
+    const url = new URL(req.url || "/", `http://localhost`);
+    if (url.pathname === "/callback" || url.pathname === "/") {
+      const code = url.searchParams.get("code");
+      const error = url.searchParams.get("error");
+      const state = url.searchParams.get("state");
+      if (code && this.expectedState !== null && state !== this.expectedState) {
+        res.writeHead(400, { "Content-Type": "text/html" });
+        res.end(ERROR_HTML);
+        this.rejectCode?.(new Error("OAuth error: state mismatch, callback did not come from the authorization request we started"));
+      } else if (code) {
+        res.writeHead(200, { "Content-Type": "text/html" });
+        res.end(SUCCESS_HTML);
+        this.resolveCode?.(code);
+      } else {
+        res.writeHead(400, { "Content-Type": "text/html" });
+        res.end(ERROR_HTML);
+        this.rejectCode?.(new Error(`OAuth error: ${error || "no code received"}`));
+      }
+    } else {
+      res.writeHead(404);
+      res.end("Not Found");
+    }
+  };
+  listenOn(host, port) {
     return new Promise((resolve, reject) => {
-      this.server = http.createServer((req, res) => {
-        const url = new URL(req.url || "/", `http://localhost`);
-        if (url.pathname === "/callback" || url.pathname === "/") {
-          const code = url.searchParams.get("code");
-          const error = url.searchParams.get("error");
-          const state = url.searchParams.get("state");
-          if (code && this.expectedState !== null && state !== this.expectedState) {
-            res.writeHead(400, { "Content-Type": "text/html" });
-            res.end(ERROR_HTML);
-            this.rejectCode?.(new Error("OAuth error: state mismatch, callback did not come from the authorization request we started"));
-          } else if (code) {
-            res.writeHead(200, { "Content-Type": "text/html" });
-            res.end(SUCCESS_HTML);
-            this.resolveCode?.(code);
-          } else {
-            res.writeHead(400, { "Content-Type": "text/html" });
-            res.end(ERROR_HTML);
-            this.rejectCode?.(new Error(`OAuth error: ${error || "no code received"}`));
-          }
-        } else {
-          res.writeHead(404);
-          res.end("Not Found");
-        }
-      });
-      this.server.listen(0, () => {
-        const addr = this.server.address();
-        if (addr && typeof addr === "object") {
-          resolve(addr.port);
-        } else {
-          reject(new Error("Failed to get server port"));
-        }
+      const server = http.createServer(this.handleRequest);
+      const onError = (err) => {
+        server.close();
+        reject(err);
+      };
+      server.once("error", onError);
+      server.listen(port, host, () => {
+        server.off("error", onError);
+        server.on("error", (err) => this.rejectCode?.(err));
+        resolve(server);
       });
-      this.server.on("error", reject);
     });
   }
+  /**
+   * Starts listening on an OS-assigned port on 127.0.0.1 and, when available,
+   * the same port on ::1. Resolves with the port.
+   */
+  async start() {
+    let lastError;
+    for (let attempt = 0; attempt < _OAuthCallbackServer.MAX_PORT_ATTEMPTS; attempt++) {
+      const v4 = await this.listenOn(_OAuthCallbackServer.IPV4_LOOPBACK, 0);
+      const addr = v4.address();
+      if (!addr || typeof addr !== "object") {
+        v4.close();
+        throw new Error("Failed to get server port");
+      }
+      const port = addr.port;
+      try {
+        const v6 = await this.listenOn(_OAuthCallbackServer.IPV6_LOOPBACK, port);
+        this.servers = [v4, v6];
+        return port;
+      } catch (err) {
+        if (err?.code === "EADDRINUSE") {
+          v4.close();
+          lastError = err;
+          continue;
+        }
+        this.servers = [v4];
+        return port;
+      }
+    }
+    throw new Error(
+      `Could not find a port free on both loopback addresses: ${lastError?.message ?? "unknown error"}`
+    );
+  }
+  /** The addresses the callback server is listening on (for diagnostics and tests). */
+  boundAddresses() {
+    return this.servers.map((s) => s.address()).filter((a) => !!a && typeof a === "object").map((a) => a.address);
+  }
   /**
    * Resolve with the authorization code once the browser is redirected back.
    * Pass the `state` that was put into the authorization URL: callbacks whose
@@ -356,10 +405,10 @@ var OAuthCallbackServer = class {
       clearTimeout(this.timeoutHandle);
       this.timeoutHandle = null;
     }
-    if (this.server) {
-      this.server.close();
-      this.server = null;
+    for (const server of this.servers) {
+      server.close();
     }
+    this.servers = [];
   }
 };
 
@@ -393,6 +442,43 @@ function resolveScopeMode(explicit) {
   if (explicit) return explicit;
   return process.env.EMAIL_MCP_GMAIL_SCOPE?.toLowerCase() === "restricted" ? "restricted" : "full";
 }
+var GOOGLE_REVOKE_ENDPOINT = "https://oauth2.googleapis.com/revoke";
+var GOOGLE_PERMISSIONS_URL = "https://myaccount.google.com/permissions";
+var REVOKE_TIMEOUT_MS = 1e4;
+async function revokeGoogleGrant(token) {
+  if (!token) {
+    return {
+      ok: false,
+      detail: `No Google token was stored for this account, so nothing could be revoked. Remove email-mcp manually at ${GOOGLE_PERMISSIONS_URL}.`
+    };
+  }
+  try {
+    const res = await fetch(GOOGLE_REVOKE_ENDPOINT, {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({ token }).toString(),
+      signal: AbortSignal.timeout(REVOKE_TIMEOUT_MS)
+    });
+    if (res.ok) {
+      return { ok: true, detail: "Google revoked the grant: email-mcp no longer has access to this Gmail account." };
+    }
+    let reason = "";
+    try {
+      const body = await res.json();
+      reason = [body.error, body.error_description].filter(Boolean).join(": ");
+    } catch {
+    }
+    return {
+      ok: false,
+      detail: `Google refused the revocation (HTTP ${res.status}${reason ? `, ${reason}` : ""}). The grant may already be revoked or expired. Check and remove email-mcp manually at ${GOOGLE_PERMISSIONS_URL}.`
+    };
+  } catch (err) {
+    return {
+      ok: false,
+      detail: `Could not reach Google's revocation endpoint (${err?.message ?? String(err)}). Remove email-mcp manually at ${GOOGLE_PERMISSIONS_URL}.`
+    };
+  }
+}
 var GmailAuth = class {
   clientId;
   clientSecret;
@@ -456,23 +542,73 @@ import {
   CryptoProvider
 } from "@azure/msal-node";
 var DEFAULT_CACHE_DIR = path2.join(os2.homedir(), ".email-mcp");
-var DEFAULT_CACHE_FILE = path2.join(DEFAULT_CACHE_DIR, "msal-cache.json");
-function createFileCachePlugin(cacheFilePath) {
+var DEFAULT_CACHE_FILE = path2.join(DEFAULT_CACHE_DIR, "msal-cache.enc");
+var LEGACY_PLAINTEXT_CACHE_NAME = "msal-cache.json";
+var MsalCacheDecryptError = class extends Error {
+  constructor(cacheFilePath) {
+    super(
+      `The Outlook token cache ${cacheFilePath} could not be decrypted: it was modified, is corrupt, or was written with a different key (EMAIL_MCP_KEY or another machine). Delete that file and re-run email-mcp-setup to sign in to Outlook again.`
+    );
+    this.name = "MsalCacheDecryptError";
+  }
+};
+function writeEncryptedCache(cacheFilePath, serialized) {
+  const dir = path2.dirname(cacheFilePath);
+  if (!fs2.existsSync(dir)) {
+    fs2.mkdirSync(dir, { recursive: true, mode: 448 });
+  }
+  const tmpPath = `${cacheFilePath}.${process.pid}.tmp`;
+  fs2.writeFileSync(tmpPath, encryptWithMachineKey(serialized), { mode: 384 });
+  fs2.chmodSync(tmpPath, 384);
+  fs2.renameSync(tmpPath, cacheFilePath);
+}
+function loadSerializedCache(cacheFilePath, legacyPlaintextPath) {
+  const hasEncrypted = fs2.existsSync(cacheFilePath);
+  if (fs2.existsSync(legacyPlaintextPath)) {
+    const plaintextIsNewer = !hasEncrypted || fs2.statSync(legacyPlaintextPath).mtimeMs > fs2.statSync(cacheFilePath).mtimeMs;
+    if (plaintextIsNewer) {
+      const serialized = fs2.readFileSync(legacyPlaintextPath, "utf-8");
+      writeEncryptedCache(cacheFilePath, serialized);
+      fs2.unlinkSync(legacyPlaintextPath);
+      return serialized;
+    }
+    fs2.unlinkSync(legacyPlaintextPath);
+  }
+  if (!hasEncrypted) return null;
+  const raw = fs2.readFileSync(cacheFilePath, "utf-8");
+  let plaintext;
+  let usedLegacyKey;
+  try {
+    ({ plaintext, usedLegacyKey } = decryptWithMachineKey(raw));
+  } catch {
+    throw new MsalCacheDecryptError(cacheFilePath);
+  }
+  if (usedLegacyKey) {
+    try {
+      writeEncryptedCache(cacheFilePath, plaintext);
+    } catch {
+    }
+  }
+  return plaintext;
+}
+function createEncryptedFileCachePlugin(cacheFilePath, legacyPlaintextPath = path2.join(path2.dirname(cacheFilePath), LEGACY_PLAINTEXT_CACHE_NAME)) {
+  let loadFailed = false;
   return {
     async beforeCacheAccess(context) {
-      if (fs2.existsSync(cacheFilePath)) {
-        const data = fs2.readFileSync(cacheFilePath, "utf-8");
-        context.tokenCache.deserialize(data);
+      loadFailed = false;
+      try {
+        const serialized = loadSerializedCache(cacheFilePath, legacyPlaintextPath);
+        if (serialized !== null) {
+          context.tokenCache.deserialize(serialized);
+        }
+      } catch (err) {
+        loadFailed = true;
+        throw err;
       }
     },
     async afterCacheAccess(context) {
-      if (context.cacheHasChanged) {
-        const dir = path2.dirname(cacheFilePath);
-        if (!fs2.existsSync(dir)) {
-          fs2.mkdirSync(dir, { recursive: true, mode: 448 });
-        }
-        fs2.writeFileSync(cacheFilePath, context.tokenCache.serialize(), { mode: 384 });
-      }
+      if (loadFailed || !context.cacheHasChanged) return;
+      writeEncryptedCache(cacheFilePath, context.tokenCache.serialize());
     }
   };
 }
@@ -491,7 +627,7 @@ var OutlookAuth = class _OutlookAuth {
         authority: _OutlookAuth.AUTHORITY
       },
       cache: {
-        cachePlugin: createFileCachePlugin(cacheFilePath ?? DEFAULT_CACHE_FILE)
+        cachePlugin: createEncryptedFileCachePlugin(cacheFilePath ?? DEFAULT_CACHE_FILE)
       }
     });
     this.cryptoProvider = new CryptoProvider();
@@ -545,6 +681,27 @@ var OutlookAuth = class _OutlookAuth {
       homeAccountId: result.account?.homeAccountId ?? homeAccountId
     };
   }
+  /**
+   * Removes one account (its refresh, access and ID tokens) from the MSAL
+   * cache. Matches by home account id, or by username for credentials saved
+   * before the home account id was recorded. Returns whether an entry was
+   * found and removed.
+   */
+  async removeCachedAccount(match) {
+    const cache = this.pca.getTokenCache();
+    let account = null;
+    if (match.homeAccountId) {
+      account = await cache.getAccountByHomeId(match.homeAccountId);
+    }
+    if (!account && match.username) {
+      const wanted = match.username.trim().toLowerCase();
+      const all = await cache.getAllAccounts();
+      account = all.find((a) => (a.username ?? "").trim().toLowerCase() === wanted) ?? null;
+    }
+    if (!account) return false;
+    await cache.removeAccount(account);
+    return true;
+  }
   /**
    * @deprecated Use refreshTokenSilent() instead.
    * Kept for backward compatibility with credentials that have a stored refresh token.
@@ -735,6 +892,53 @@ function buildGmailQuery(query) {
   return parts.join(" ");
 }
 
+// src/providers/mime.ts
+import MailComposer from "nodemailer/lib/mail-composer/index.js";
+import { convert } from "html-to-text";
+function htmlToText(html) {
+  return convert(html, {
+    wordwrap: false,
+    selectors: [
+      { selector: "img", format: "skip" },
+      { selector: "a", options: { hideLinkHrefIfSameAsText: true } }
+    ]
+  }).trim();
+}
+function normalizeBody(body) {
+  const html = body.html ? body.html : void 0;
+  if (body.text) return { text: body.text, html };
+  if (html) return { text: htmlToText(html), html };
+  return { text: "" };
+}
+function toAddress(contact) {
+  return contact.name ? { name: contact.name, address: contact.email } : contact.email;
+}
+function toAddressList(contacts) {
+  return contacts?.length ? contacts.map(toAddress) : void 0;
+}
+async function buildMimeMessage(from, params) {
+  const { text, html } = normalizeBody(params.body);
+  const mail = {
+    from,
+    to: toAddressList(params.to),
+    cc: toAddressList(params.cc),
+    bcc: toAddressList(params.bcc),
+    subject: params.subject,
+    text,
+    html,
+    inReplyTo: params.inReplyTo,
+    references: params.references?.length ? params.references : void 0,
+    attachments: params.attachments?.map((a) => ({
+      filename: a.filename,
+      content: a.content,
+      contentType: a.contentType
+    }))
+  };
+  const node = new MailComposer(mail).compile();
+  node.keepBcc = true;
+  return node.build();
+}
+
 // src/providers/gmail/adapter.ts
 var GmailAdapter = class {
   providerType = ProviderType.Gmail;
@@ -877,7 +1081,7 @@ var GmailAdapter = class {
   }
   async sendEmail(params) {
     const gmail = this.ensureConnected();
-    const raw = this.buildRfc2822(params);
+    const raw = await this.buildRaw(params);
     const res = await gmail.users.messages.send({
       userId: "me",
       requestBody: { raw }
@@ -889,7 +1093,7 @@ var GmailAdapter = class {
   }
   async createDraft(params) {
     const gmail = this.ensureConnected();
-    const raw = this.buildRfc2822(params);
+    const raw = await this.buildRaw(params);
     const res = await gmail.users.drafts.create({
       userId: "me",
       requestBody: {
@@ -900,7 +1104,7 @@ var GmailAdapter = class {
   }
   async updateDraft(draftId, params) {
     const gmail = this.ensureConnected();
-    const raw = this.buildRfc2822(params);
+    const raw = await this.buildRaw(params);
     const res = await gmail.users.drafts.update({
       userId: "me",
       id: draftId,
@@ -1229,30 +1433,15 @@ var GmailAdapter = class {
     const gmail = this.ensureConnected();
     await gmail.users.settings.filters.delete({ userId: "me", id: ruleId });
   }
-  buildRfc2822(params) {
-    const lines = [];
-    lines.push(`From: ${this.email}`);
-    lines.push(
-      `To: ${params.to.map((c) => c.name ? `"${c.name}" <${c.email}>` : c.email).join(", ")}`
-    );
-    if (params.cc?.length) {
-      lines.push(`Cc: ${params.cc.map((c) => c.email).join(", ")}`);
-    }
-    if (params.bcc?.length) {
-      lines.push(`Bcc: ${params.bcc.map((c) => c.email).join(", ")}`);
-    }
-    lines.push(`Subject: ${params.subject}`);
-    if (params.inReplyTo) {
-      lines.push(`In-Reply-To: ${params.inReplyTo}`);
-    }
-    if (params.references?.length) {
-      lines.push(`References: ${params.references.join(" ")}`);
-    }
-    lines.push("MIME-Version: 1.0");
-    lines.push("Content-Type: text/plain; charset=UTF-8");
-    lines.push("");
-    lines.push(params.body.text || params.body.html || "");
-    return Buffer.from(lines.join("\r\n")).toString("base64url");
+  /**
+   * Builds the base64url `raw` payload Gmail expects for send, draft create and
+   * draft update: a full MIME message with a text part, an HTML part when one
+   * was given (or a text part derived from HTML-only input), encoded headers
+   * and any attachments. See `buildMimeMessage`.
+   */
+  async buildRaw(params) {
+    const message = await buildMimeMessage(this.email, params);
+    return message.toString("base64url");
   }
 };
 
@@ -1937,14 +2126,15 @@ function createSmtpTransport(email, creds) {
   });
 }
 async function sendViaSmtp(transport, from, params) {
+  const { text, html } = normalizeBody(params.body);
   const result = await transport.sendMail({
     from,
-    to: params.to.map((c) => c.name ? `"${c.name}" <${c.email}>` : c.email).join(", "),
-    cc: params.cc?.map((c) => c.email).join(", "),
-    bcc: params.bcc?.map((c) => c.email).join(", "),
+    to: params.to.map(toAddress),
+    cc: params.cc?.length ? params.cc.map(toAddress) : void 0,
+    bcc: params.bcc?.length ? params.bcc.map(toAddress) : void 0,
     subject: params.subject,
-    text: params.body.text,
-    html: params.body.html,
+    text,
+    html,
     inReplyTo: params.inReplyTo,
     references: params.references?.join(" "),
     attachments: params.attachments?.map((a) => ({
@@ -2091,7 +2281,7 @@ var ImapAdapter = class {
     const result = await client.mailboxCreate(fullPath);
     return {
       id: result.path,
-      name: result.name || name,
+      name,
       path: result.path,
       type: FolderType.Other
     };
@@ -2329,6 +2519,7 @@ var ImapAdapter = class {
       const uid = parseInt(id, 10);
       const msg = await client.fetchOne(String(uid), { source: true, uid: true, flags: true }, { uid: true });
       if (!msg) throw new Error(`Email ${id} not found`);
+      if (!msg.source) throw new Error(`Email ${id} has no source`);
       const parsed = await simpleParser(msg.source);
       parsed.flags = msg.flags;
       return mapParsedEmail(parsed, targetFolder, this.accountId, msg.uid);
@@ -2353,6 +2544,7 @@ var ImapAdapter = class {
       if (uids.length === 0) throw new Error(`Thread ${threadId} not found`);
       const messages = [];
       for await (const msg of client.fetch(uids, { source: true, uid: true, flags: true })) {
+        if (!msg.source) continue;
         const parsed = await simpleParser(msg.source);
         parsed.flags = msg.flags;
         messages.push(mapParsedEmail(parsed, "INBOX", this.accountId, msg.uid));
@@ -2388,6 +2580,7 @@ var ImapAdapter = class {
     try {
       const msg = await client.fetchOne(String(emailId), { source: true, uid: true }, { uid: true });
       if (!msg) throw new Error(`Email ${emailId} not found`);
+      if (!msg.source) throw new Error(`Email ${emailId} has no source`);
       const parsed = await simpleParser(msg.source);
       const attachment = (parsed.attachments || []).find(
         (att) => att.contentId === attachmentId || att.filename === attachmentId
@@ -2412,26 +2605,17 @@ var ImapAdapter = class {
     const messageId = await sendViaSmtp(transport, this.email, params);
     return { id: messageId };
   }
-  buildDraftRfc2822(params) {
-    const lines = [];
-    lines.push(`From: ${this.email}`);
-    lines.push(`To: ${params.to.map((c) => c.name ? `"${c.name}" <${c.email}>` : c.email).join(", ")}`);
-    if (params.cc?.length) {
-      lines.push(`Cc: ${params.cc.map((c) => c.email).join(", ")}`);
-    }
-    lines.push(`Subject: ${params.subject}`);
-    lines.push(`Date: ${(/* @__PURE__ */ new Date()).toUTCString()}`);
-    if (params.inReplyTo) lines.push(`In-Reply-To: ${params.inReplyTo}`);
-    if (params.references?.length) lines.push(`References: ${params.references.join(" ")}`);
-    lines.push("MIME-Version: 1.0");
-    lines.push("Content-Type: text/plain; charset=utf-8");
-    lines.push("");
-    lines.push(params.body.text || "");
-    return lines.join("\r\n");
+  /**
+   * Builds the full MIME message a draft is stored as: text and HTML parts,
+   * Bcc kept so the draft remembers its recipients, encoded headers and any
+   * attachments. See `buildMimeMessage`.
+   */
+  buildDraftMessage(params) {
+    return buildMimeMessage(this.email, params);
   }
   async createDraft(params) {
     const client = await this.ensureConnected();
-    const rawMessage = this.buildDraftRfc2822(params);
+    const rawMessage = await this.buildDraftMessage(params);
     const draftsFolder = await this.resolveFolder("Drafts");
     const result = await client.append(draftsFolder, rawMessage, ["\\Draft", "\\Seen"]);
     if (!result) throw new Error("Failed to append draft");
@@ -2446,6 +2630,7 @@ var ImapAdapter = class {
   async updateDraft(draftId, params, sourceFolder) {
     const client = await this.ensureConnected();
     const draftsFolder = sourceFolder ? await this.resolveFolder(sourceFolder) : await this.resolveFolder("Drafts");
+    const rawMessage = await this.buildDraftMessage(params);
     let lock;
     try {
       lock = await client.getMailboxLock(draftsFolder);
@@ -2457,7 +2642,6 @@ var ImapAdapter = class {
     } finally {
       lock.release();
     }
-    const rawMessage = this.buildDraftRfc2822(params);
     const result = await client.append(draftsFolder, rawMessage, ["\\Draft", "\\Seen"]);
     if (!result) throw new Error("Failed to append updated draft");
     return { id: String(result.uid || result) };
@@ -2687,16 +2871,16 @@ var ImapAdapter = class {
 var ICloudAdapter = class extends ImapAdapter {
   providerType = ProviderType.ICloud;
   async connect(credentials) {
+    const passwordDefaults = {
+      host: "imap.mail.me.com",
+      port: 993,
+      tls: true,
+      smtpHost: "smtp.mail.me.com",
+      smtpPort: 587
+    };
     const withDefaults = {
       ...credentials,
-      password: {
-        host: "imap.mail.me.com",
-        port: 993,
-        tls: true,
-        smtpHost: "smtp.mail.me.com",
-        smtpPort: 587,
-        ...credentials.password
-      }
+      password: { ...passwordDefaults, ...credentials.password }
     };
     return super.connect(withDefaults);
   }
@@ -2722,6 +2906,7 @@ function createProvider(provider) {
       throw new Error(`Unknown provider: ${provider}`);
   }
 }
+var MICROSOFT_CONSENT_URL = "https://account.live.com/consent/Manage";
 var AccountManager = class {
   store;
   providers = /* @__PURE__ */ new Map();
@@ -2776,9 +2961,55 @@ var AccountManager = class {
     await this.store.save(creds);
     await this.connectAccount(creds.id);
   }
+  /**
+   * Removes an account locally, then cleans up at the provider as far as the
+   * provider allows. Local removal always happens first and never depends on
+   * the network; a failed provider step is reported in the result, not thrown.
+   */
   async removeAccount(accountId) {
+    const creds = await this.store.get(accountId);
+    if (!creds) throw new Error(`Account ${accountId} not found`);
     await this.disconnectAccount(accountId);
     await this.store.remove(accountId);
+    const result = {
+      success: true,
+      accountId,
+      provider: creds.provider,
+      email: creds.email,
+      revocation: { status: "not_applicable", detail: "" }
+    };
+    if (creds.provider === ProviderType.Gmail) {
+      const token = creds.oauth?.refresh_token || creds.oauth?.access_token || "";
+      const { ok, detail } = await revokeGoogleGrant(token);
+      result.revocation = { status: ok ? "revoked" : "failed", detail };
+    } else if (creds.provider === ProviderType.Outlook) {
+      result.tokenCache = await this.removeFromMsalCache(creds);
+      result.revocation = {
+        status: "local_only",
+        detail: `Microsoft offers no endpoint to revoke a refresh token for a personal Microsoft account, so the grant still exists at Microsoft until it expires. To cancel it now, remove email-mcp at ${MICROSOFT_CONSENT_URL}.`
+      };
+    } else {
+      result.revocation = {
+        status: "not_applicable",
+        detail: "This account used a password, not an OAuth grant, so there is nothing to revoke. The password itself stays valid at your provider; if it was an app-specific password (for example from Apple), delete it there if you no longer need it."
+      };
+    }
+    return result;
+  }
+  async removeFromMsalCache(creds) {
+    try {
+      const outlookAuth = new OutlookAuth(OUTLOOK_CLIENT_ID);
+      const removed = await outlookAuth.removeCachedAccount({
+        homeAccountId: creds.oauth?.msal_home_account_id,
+        username: creds.email
+      });
+      return removed ? { status: "removed", detail: "The account's refresh and access tokens were removed from the local Outlook token cache." } : { status: "not_found", detail: "The local Outlook token cache held no tokens for this account." };
+    } catch (err) {
+      return {
+        status: "failed",
+        detail: `The account's tokens could not be removed from the local Outlook token cache: ${err?.message ?? String(err)}`
+      };
+    }
   }
   async disconnectAccount(accountId) {
     const provider = this.providers.get(accountId);