@zaclinley/dsh-mailharbor 0.15.0 → 0.16.1

package/lib/index.js

@@ -120,7 +120,7 @@ function transportOptions(settings, credentials, security = {}) {
     secure,
     // Plain submission ports must upgrade; never send credentials in the clear.
     requireTLS: !secure,
-    auth: credentials.accessToken !== void 0 ? { type: "OAuth2", user: credentials.user, accessToken: credentials.accessToken } : { user: credentials.user, pass: credentials.pass ?? "" },
+    auth: { user: credentials.user, pass: credentials.pass ?? "" },
     tls: { rejectUnauthorized: security.allowSelfSigned !== true, servername: settings.host },
     connectionTimeout: 2e4,
     greetingTimeout: 2e4,
@@ -287,7 +287,7 @@ var init_imap = __esm({
             host: this.settings.host,
             port: Number(this.settings.port),
             secure: this.settings.secure !== false,
-            auth: this.credentials.accessToken !== void 0 ? { user: this.credentials.user, accessToken: this.credentials.accessToken } : { user: this.credentials.user, pass: this.credentials.pass ?? "" },
+            auth: { user: this.credentials.user, pass: this.credentials.pass ?? "" },
             logger: false,
             tls: { rejectUnauthorized: true },
             connectionTimeout: this.options.connectionTimeoutMs ?? 15e3,
@@ -710,23 +710,7 @@ var DEFAULTS = {
   },
   read: { markOnOpen: true, pollSeconds: 60 },
   render: { listLimit: 40 },
-  projects: { root: join2(homedir2(), "work", "projects") },
-  oauth: {
-    google: {
-      clientId: "",
-      clientSecret: "",
-      redirectPort: 8765,
-      scopes: ["https://mail.google.com/"]
-    },
-    microsoft: {
-      clientId: "",
-      scopes: [
-        "offline_access",
-        "https://outlook.office.com/IMAP.AccessAsUser.All",
-        "https://outlook.office.com/SMTP.Send"
-      ]
-    }
-  }
+  projects: { root: join2(homedir2(), "work", "projects") }
 };
 var ACCOUNT_ID = /^[A-Za-z0-9_-]{1,64}$/;
 var EMAIL = /^[^@\s]+@[^@\s]+$/;
@@ -776,7 +760,7 @@ function normalizeAccount(input, index = 0, existing = []) {
     },
     keychainService: stringOr(input.keychainService, `dsh-mailharbor:${id}`),
     dataDir: stringOr(input.dataDir, `accounts/${id}`),
-    auth: input.auth?.type === "oauth2" ? { type: "oauth2", provider: input.auth.provider } : { type: "password" },
+    auth: { type: "password" },
     caldav: normalizeCaldav(input.caldav),
     signature: stringOr(input.signature, "").slice(0, 5e3),
     enabled: input.enabled !== false,
@@ -831,9 +815,6 @@ function loadConfig() {
   const readRaw = file.read ?? {};
   const renderRaw = file.render ?? {};
   const projectsRaw = file.projects ?? {};
-  const oauthRaw = file.oauth ?? {};
-  const googleRaw = oauthRaw.google ?? {};
-  const microsoftRaw = oauthRaw.microsoft ?? {};
   return {
     dataDir: DATA_ROOT,
     configFile: CONFIG_PATH,
@@ -858,18 +839,6 @@ function loadConfig() {
     projects: {
       root: stringOr(projectsRaw.root, DEFAULTS.projects.root)
     },
-    oauth: {
-      google: {
-        clientId: stringOr(googleRaw.clientId, DEFAULTS.oauth.google.clientId),
-        clientSecret: stringOr(googleRaw.clientSecret, DEFAULTS.oauth.google.clientSecret),
-        redirectPort: intOr(googleRaw.redirectPort, DEFAULTS.oauth.google.redirectPort, 1024, 65535),
-        scopes: Array.isArray(googleRaw.scopes) ? googleRaw.scopes.filter((item) => typeof item === "string") : DEFAULTS.oauth.google.scopes
-      },
-      microsoft: {
-        clientId: stringOr(microsoftRaw.clientId, DEFAULTS.oauth.microsoft.clientId),
-        scopes: Array.isArray(microsoftRaw.scopes) ? microsoftRaw.scopes.filter((item) => typeof item === "string") : DEFAULTS.oauth.microsoft.scopes
-      }
-    },
     revision: Date.now()
   };
 }
@@ -907,7 +876,7 @@ function buildAccount(input, existing) {
       username: input.username,
       imap: input.imap,
       smtp: input.smtp,
-      auth: input.auth ?? { type: "password" },
+      auth: { type: "password" },
       caldav: null,
       enabled: true,
       createdAt: (/* @__PURE__ */ new Date()).toISOString()
@@ -1018,26 +987,6 @@ async function openPath(path) {
   }
   await run("xdg-open", [path]);
 }
-async function openExternal(url) {
-  try {
-    const require2 = createRequire(import.meta.url);
-    const electron = require2("electron");
-    if (electron.shell !== void 0) {
-      await electron.shell.openExternal(url);
-      return;
-    }
-  } catch {
-  }
-  if (process.platform === "darwin") {
-    await run("open", [url]);
-    return;
-  }
-  if (process.platform === "win32") {
-    await run("cmd", ["/c", "start", "", url]);
-    return;
-  }
-  await run("xdg-open", [url]);
-}
 
 // src/host/api.ts
 import { existsSync as existsSync6, rmSync } from "node:fs";
@@ -1078,134 +1027,6 @@ async function draftMime(account, draft) {
   return Buffer.from(info.message);
 }
 
-// src/host/api.ts
-import { createHash as createHash3, randomBytes } from "node:crypto";
-import { createServer } from "node:http";
-
-// src/host/oauth.ts
-var TOKEN_ENDPOINTS = {
-  google: "https://oauth2.googleapis.com/token",
-  microsoft: "https://login.microsoftonline.com/common/oauth2/v2.0/token"
-};
-var DEVICE_ENDPOINTS = {
-  google: "https://oauth2.googleapis.com/device/code",
-  microsoft: "https://login.microsoftonline.com/common/oauth2/v2.0/devicecode"
-};
-function form(values) {
-  return new URLSearchParams(values).toString();
-}
-function tokensFrom(payload, previousRefresh = "") {
-  const accessToken = typeof payload.access_token === "string" ? payload.access_token : "";
-  if (accessToken === "") throw new Error("OAuth \u54CD\u5E94\u7F3A\u5C11 access_token");
-  const refreshToken = typeof payload.refresh_token === "string" && payload.refresh_token !== "" ? payload.refresh_token : previousRefresh;
-  const expiresIn = Number(payload.expires_in ?? 3600);
-  return {
-    accessToken,
-    refreshToken,
-    expiresAt: Date.now() + Math.max(60, expiresIn) * 1e3,
-    ...typeof payload.scope === "string" ? { scope: payload.scope } : {},
-    ...typeof payload.token_type === "string" ? { tokenType: payload.token_type } : {}
-  };
-}
-async function refreshTokens(app, refreshToken) {
-  if (refreshToken === "") throw new Error("OAuth \u5237\u65B0\u4EE4\u724C\u4E3A\u7A7A");
-  const body = {
-    grant_type: "refresh_token",
-    client_id: app.clientId,
-    refresh_token: refreshToken
-  };
-  if (app.provider === "google") body.client_secret = app.clientSecret;
-  const response = await fetch(TOKEN_ENDPOINTS[app.provider], {
-    method: "POST",
-    headers: { "content-type": "application/x-www-form-urlencoded" },
-    body: form(body)
-  });
-  const payload = await response.json().catch(() => ({}));
-  if (!response.ok) {
-    const reason = typeof payload.error_description === "string" ? payload.error_description : typeof payload.error === "string" ? payload.error : `HTTP ${String(response.status)}`;
-    throw new Error(`OAuth \u5237\u65B0\u5931\u8D25\uFF1A${reason}`);
-  }
-  return tokensFrom(payload, refreshToken);
-}
-function googleAuthUrl(app, state, challenge, redirectUri) {
-  const params = new URLSearchParams({
-    client_id: app.clientId,
-    redirect_uri: redirectUri,
-    response_type: "code",
-    scope: app.scopes.join(" "),
-    access_type: "offline",
-    prompt: "consent",
-    state,
-    code_challenge: challenge,
-    code_challenge_method: "S256"
-  });
-  return `https://accounts.google.com/o/oauth2/v2/auth?${params.toString()}`;
-}
-async function exchangeGoogleCode(app, code, verifier, redirectUri) {
-  const response = await fetch(TOKEN_ENDPOINTS.google, {
-    method: "POST",
-    headers: { "content-type": "application/x-www-form-urlencoded" },
-    body: form({
-      code,
-      client_id: app.clientId,
-      client_secret: app.clientSecret,
-      redirect_uri: redirectUri,
-      grant_type: "authorization_code",
-      code_verifier: verifier
-    })
-  });
-  const payload = await response.json().catch(() => ({}));
-  if (!response.ok) {
-    throw new Error(
-      `OAuth \u6388\u6743\u5931\u8D25\uFF1A${typeof payload.error_description === "string" ? payload.error_description : `HTTP ${String(response.status)}`}`
-    );
-  }
-  return tokensFrom(payload);
-}
-async function startDeviceFlow(app) {
-  const body = {
-    client_id: app.clientId,
-    scope: app.scopes.join(" ")
-  };
-  if (app.provider === "microsoft") body.scope = [...app.scopes, "offline_access"].join(" ");
-  const response = await fetch(DEVICE_ENDPOINTS[app.provider], {
-    method: "POST",
-    headers: { "content-type": "application/x-www-form-urlencoded" },
-    body: form(body)
-  });
-  const payload = await response.json().catch(() => ({}));
-  if (!response.ok) {
-    throw new Error(
-      `OAuth \u8BBE\u5907\u7801\u8BF7\u6C42\u5931\u8D25\uFF1A${typeof payload.error_description === "string" ? payload.error_description : `HTTP ${String(response.status)}`}`
-    );
-  }
-  return {
-    deviceCode: String(payload.device_code ?? ""),
-    userCode: String(payload.user_code ?? ""),
-    verificationUri: String(payload.verification_uri ?? payload.verification_url ?? ""),
-    interval: Math.max(2, Number(payload.interval ?? 5)),
-    expiresAt: Date.now() + Math.max(60, Number(payload.expires_in ?? 900)) * 1e3
-  };
-}
-async function pollDeviceFlow(app, deviceCode) {
-  const response = await fetch(TOKEN_ENDPOINTS[app.provider], {
-    method: "POST",
-    headers: { "content-type": "application/x-www-form-urlencoded" },
-    body: form({
-      grant_type: "urn:ietf:params:oauth:grant-type:device_code",
-      client_id: app.clientId,
-      device_code: deviceCode
-    })
-  });
-  const payload = await response.json().catch(() => ({}));
-  if (response.ok) return { status: "ready", tokens: tokensFrom(payload) };
-  const error = String(payload.error ?? "");
-  if (error === "authorization_pending" || error === "slow_down") return { status: "pending" };
-  throw new Error(
-    `OAuth \u8BBE\u5907\u7801\u767B\u5F55\u5931\u8D25\uFF1A${typeof payload.error_description === "string" ? payload.error_description : error}`
-  );
-}
-
 // src/host/backup.ts
 init_address();
 import { createHash as createHash2 } from "node:crypto";
@@ -1914,7 +1735,7 @@ var BackupEngine = class {
       host: this.runtime.imap.host,
       port: Number(this.runtime.imap.port),
       secure: this.runtime.imap.secure !== false,
-      auth: this.credentials.accessToken !== void 0 ? { user: this.credentials.user, accessToken: this.credentials.accessToken } : { user: this.credentials.user, pass: this.credentials.pass ?? "" },
+      auth: { user: this.credentials.user, pass: this.credentials.pass ?? "" },
       logger: false,
       tls: { rejectUnauthorized: true },
       connectionTimeout: 2e4,
@@ -2947,7 +2768,7 @@ ${conversation.trim()}
 }
 
 // src/host/version.ts
-var VERSION = "0.15.0";
+var VERSION = "0.16.1";
 
 // src/host/api.ts
 init_smtp();
@@ -2998,7 +2819,6 @@ function createApiHandler(runtime) {
     }
   };
 }
-var pendingOAuth = /* @__PURE__ */ new Map();
 function buildRouter(runtime) {
   const router = new Router();
   router.get("/health", () => ({ ok: true, version: VERSION }));
@@ -3177,13 +2997,6 @@ function buildRouter(runtime) {
           provider: config.ai.provider,
           model: config.ai.model,
           summaryLength: config.ai.summaryLength
-        },
-        oauth: {
-          google: {
-            clientId: config.oauth.google.clientId,
-            redirectPort: config.oauth.google.redirectPort
-          },
-          microsoft: { clientId: config.oauth.microsoft.clientId }
         }
       },
       accounts: config.accounts.map((account) => ({
@@ -3238,155 +3051,9 @@ function buildRouter(runtime) {
     const ai = asObject(settings.ai);
     if (ai.summaryLength !== void 0) patch.ai = { summaryLength: ai.summaryLength };
     if (Object.keys(patch).length > 0) saveSettings(patch);
-    const oauth = asObject(settings.oauth);
-    const google = asObject(oauth.google);
-    const microsoft = asObject(oauth.microsoft);
-    if (typeof google.clientId === "string" || typeof microsoft.clientId === "string") {
-      saveSettings({
-        oauth: {
-          google: {
-            clientId: typeof google.clientId === "string" ? google.clientId : config.oauth.google.clientId,
-            clientSecret: config.oauth.google.clientSecret,
-            redirectPort: typeof google.redirectPort === "number" ? google.redirectPort : config.oauth.google.redirectPort,
-            scopes: config.oauth.google.scopes
-          },
-          microsoft: {
-            clientId: typeof microsoft.clientId === "string" ? microsoft.clientId : config.oauth.microsoft.clientId,
-            scopes: config.oauth.microsoft.scopes
-          }
-        }
-      });
-    }
     runtime.refresh();
     return { ok: true, addedAccounts: added, state: appState(runtime) };
   });
-  router.get("/oauth/status", ({ url }) => {
-    const { account } = accountFrom(runtime, url);
-    const tokens = runtime.oauthTokens(account);
-    let appConfigured = false;
-    try {
-      runtime.oauthApp(account);
-      appConfigured = true;
-    } catch {
-      appConfigured = false;
-    }
-    return {
-      authorized: tokens !== void 0,
-      expiresAt: tokens?.expiresAt ?? null,
-      provider: account.auth.type === "oauth2" ? account.auth.provider : null,
-      appConfigured
-    };
-  });
-  router.post("/oauth/start", async ({ body }) => {
-    const payload = await body();
-    const account = accountFromPayload(runtime, payload);
-    const app = runtime.oauthApp(account);
-    const state = randomBytes(16).toString("hex");
-    const expiresAt = Date.now() + 10 * 6e4;
-    if (app.provider === "microsoft") {
-      const device = await startDeviceFlow(app);
-      pendingOAuth.set(state, {
-        accountId: account.id,
-        provider: "microsoft",
-        status: "pending",
-        deviceCode: device.deviceCode,
-        interval: device.interval,
-        expiresAt
-      });
-      return {
-        state,
-        flow: "microsoft",
-        userCode: device.userCode,
-        verificationUri: device.verificationUri,
-        authUrl: device.verificationUri,
-        interval: device.interval
-      };
-    }
-    const verifier = randomBytes(32).toString("base64url");
-    const challenge = createHash3("sha256").update(verifier).digest("base64url");
-    const redirectUri = `http://127.0.0.1:${String(app.redirectPort)}/oauth/callback`;
-    const authUrl = googleAuthUrl(app, state, challenge, redirectUri);
-    const entry = {
-      accountId: account.id,
-      provider: "google",
-      status: "pending",
-      expiresAt
-    };
-    pendingOAuth.set(state, entry);
-    const server = createServer((request, response) => {
-      const target = new URL(request.url ?? "/", "http://127.0.0.1");
-      if (target.pathname !== "/oauth/callback") {
-        response.writeHead(404).end();
-        return;
-      }
-      const code = target.searchParams.get("code");
-      const error = target.searchParams.get("error");
-      void (async () => {
-        try {
-          if (error !== null) throw new Error(error);
-          if (code === null) throw new Error("\u7F3A\u5C11\u6388\u6743\u7801");
-          const tokens = await exchangeGoogleCode(app, code, verifier, redirectUri);
-          runtime.saveOAuthTokens(account, tokens);
-          entry.status = "ready";
-          response.writeHead(200, { "content-type": "text/html; charset=utf-8" });
-          response.end("<p>MailHarbor \u6388\u6743\u6210\u529F\uFF0C\u53EF\u4EE5\u5173\u95ED\u6B64\u9875\u9762\u3002</p>");
-        } catch (caught) {
-          entry.status = "error";
-          entry.message = caught instanceof Error ? caught.message : String(caught);
-          response.writeHead(500, { "content-type": "text/html; charset=utf-8" });
-          response.end(`<p>\u6388\u6743\u5931\u8D25\uFF1A${entry.message}</p>`);
-        } finally {
-          setTimeout(() => {
-            server.close();
-          }, 500);
-        }
-      })();
-    });
-    await new Promise((resolve, reject) => {
-      server.once("error", reject);
-      server.listen(app.redirectPort, "127.0.0.1", () => resolve());
-    });
-    setTimeout(() => {
-      server.close();
-      if (entry.status === "pending") {
-        entry.status = "error";
-        entry.message = "\u6388\u6743\u8D85\u65F6\uFF0C\u8BF7\u91CD\u8BD5";
-      }
-    }, 10 * 6e4).unref();
-    await openExternal(authUrl).catch(() => void 0);
-    return { state, flow: "google", authUrl, expiresAt };
-  });
-  router.post("/oauth/poll", async ({ body }) => {
-    const payload = await body();
-    const state = String(payload.state ?? "");
-    const entry = pendingOAuth.get(state);
-    if (entry === void 0) throw new HttpError(404, "\u6388\u6743\u4F1A\u8BDD\u4E0D\u5B58\u5728\u6216\u5DF2\u8FC7\u671F");
-    if (Date.now() > entry.expiresAt) {
-      entry.status = "error";
-      entry.message = "\u6388\u6743\u8D85\u65F6\uFF0C\u8BF7\u91CD\u8BD5";
-    }
-    if (entry.status !== "pending") {
-      if (entry.status === "ready") pendingOAuth.delete(state);
-      return { status: entry.status, message: entry.message };
-    }
-    if (entry.provider === "microsoft" && entry.deviceCode !== void 0) {
-      const account = runtime.account(entry.accountId);
-      const result = await pollDeviceFlow(runtime.oauthApp(account), entry.deviceCode);
-      if (result.status === "ready") {
-        runtime.saveOAuthTokens(account, result.tokens);
-        pendingOAuth.delete(state);
-        return { status: "ready" };
-      }
-    }
-    return { status: "pending" };
-  });
-  router.post("/oauth/revoke", async ({ body }) => {
-    const payload = await body();
-    const account = accountFromPayload(runtime, payload);
-    runtime.credentials.forgetOAuth(account);
-    runtime.invalidate(account.id);
-    return { ok: true };
-  });
   router.get("/messages/thread", ({ url }) => {
     const { account } = accountFrom(runtime, url);
     const subject = url.searchParams.get("subject") ?? "";
@@ -3440,14 +3107,26 @@ function buildRouter(runtime) {
       const part = Number(url.searchParams.get("part") ?? 0);
       const provider = runtime.provider(account);
       const file2 = await provider.attachment(mailbox, uid, part);
-      writeAttachment(res, file2.filename, file2.contentType, Buffer.from(file2.dataBase64, "base64"));
+      writeAttachment(
+        res,
+        file2.filename,
+        file2.contentType,
+        Buffer.from(file2.dataBase64, "base64"),
+        canPreviewInline(file2.contentType) && url.searchParams.get("inline") === "1"
+      );
       return void 0;
     }
     const emailId = Number(url.searchParams.get("emailId") ?? 0);
     const attachmentId = Number(url.searchParams.get("attachmentId") ?? 0);
     const file = runtime.database(account).attachment(emailId, attachmentId);
     if (file === void 0) throw new HttpError(404, "\u9644\u4EF6\u4E0D\u5B58\u5728");
-    writeAttachment(res, file.filename, file.contentType, Buffer.from(file.data));
+    writeAttachment(
+      res,
+      file.filename,
+      file.contentType,
+      Buffer.from(file.data),
+      canPreviewInline(file.contentType) && url.searchParams.get("inline") === "1"
+    );
     return void 0;
   });
   router.get("/drafts", ({ url }) => {
@@ -3519,9 +3198,8 @@ function buildRouter(runtime) {
     const password = typeof input.password === "string" ? input.password : "";
     const config = runtime.current;
     const account = buildAccount(input, config.accounts);
-    const oauth = account.auth.type === "oauth2";
-    if (!oauth && password === "") throw new HttpError(400, "\u8BF7\u8F93\u5165\u5BC6\u7801\u6216\u5E94\u7528\u4E13\u7528\u5BC6\u7801");
-    if (!oauth && input.connect !== false) {
+    if (password === "") throw new HttpError(400, "\u8BF7\u8F93\u5165\u5BC6\u7801\u6216\u5E94\u7528\u4E13\u7528\u5BC6\u7801");
+    if (input.connect !== false) {
       const provider = await verifyImap(account, password);
       await provider.dispose();
       try {
@@ -3529,7 +3207,7 @@ function buildRouter(runtime) {
       } catch {
       }
     }
-    if (!oauth) runtime.credentials.remember(account, password, input.remember !== false);
+    runtime.credentials.remember(account, password, input.remember !== false);
     const accounts = [...config.accounts, account];
     saveAccounts(accounts, account.id);
     runtime.refresh();
@@ -4050,23 +3728,6 @@ function buildRouter(runtime) {
     if (payload.ai !== void 0) patch.ai = asObject(payload.ai);
     if (payload.read !== void 0) patch.read = asObject(payload.read);
     if (payload.render !== void 0) patch.render = asObject(payload.render);
-    if (payload.oauth !== void 0) {
-      const oauth = asObject(payload.oauth);
-      const google = asObject(oauth.google);
-      const microsoft = asObject(oauth.microsoft);
-      patch.oauth = {
-        google: {
-          clientId: typeof google.clientId === "string" ? google.clientId.trim() : runtime.current.oauth.google.clientId,
-          clientSecret: typeof google.clientSecret === "string" ? google.clientSecret.trim() : runtime.current.oauth.google.clientSecret,
-          redirectPort: typeof google.redirectPort === "number" ? google.redirectPort : runtime.current.oauth.google.redirectPort,
-          scopes: runtime.current.oauth.google.scopes
-        },
-        microsoft: {
-          clientId: typeof microsoft.clientId === "string" ? microsoft.clientId.trim() : runtime.current.oauth.microsoft.clientId,
-          scopes: runtime.current.oauth.microsoft.scopes
-        }
-      };
-    }
     if (payload.projects !== void 0) {
       const root = String(asObject(payload.projects).root ?? "").trim();
       if (root === "") throw new HttpError(400, "\u9879\u76EE\u76EE\u5F55\u4E0D\u80FD\u4E3A\u7A7A");
@@ -4215,8 +3876,7 @@ function settingsView(config) {
     },
     read: { markOnOpen: config.read.markOnOpen, pollSeconds: config.read.pollSeconds },
     render: { listLimit: config.render.listLimit },
-    projects: { root: config.projects.root },
-    oauth: config.oauth
+    projects: { root: config.projects.root }
   };
 }
 function taskView(task) {
@@ -4350,13 +4010,24 @@ async function listServer(runtime, account, mailbox, query, limit, offset = 0) {
   );
   return { items, total: result.total };
 }
-function writeAttachment(res, filename, contentType, data) {
+function canPreviewInline(contentType) {
+  const type = contentType.toLowerCase();
+  return type.startsWith("image/") && type !== "image/svg+xml" || type === "application/pdf" || type === "text/plain" || type === "text/csv" || type === "text/markdown" || type === "application/json";
+}
+function writeAttachment(res, filename, contentType, data, inline = false) {
   res.statusCode = 200;
   res.setHeader("content-type", contentType);
   res.setHeader("content-length", String(data.length));
-  res.setHeader("content-disposition", `attachment; filename*=UTF-8''${encodeURIComponent(filename)}`);
+  res.setHeader(
+    "content-disposition",
+    `${inline ? "inline" : "attachment"}; filename*=UTF-8''${encodeURIComponent(filename)}`
+  );
   res.setHeader("cache-control", "no-store");
   res.setHeader("x-content-type-options", "nosniff");
+  res.setHeader(
+    "content-security-policy",
+    "sandbox; default-src 'none'; img-src 'self' data:; style-src 'unsafe-inline'"
+  );
   res.end(data);
 }
 function asObject(value) {
@@ -4593,32 +4264,6 @@ var CredentialManager = class {
     this.session.delete(account.id);
     this.secrets.delete(account.keychainService, account.email);
   }
-  oauthService(account) {
-    return `${account.keychainService}:oauth`;
-  }
-  readOAuth(account) {
-    const raw = this.secrets.read(this.oauthService(account), account.email);
-    if (raw === void 0 || raw.trim() === "") return void 0;
-    try {
-      const parsed = JSON.parse(raw);
-      if (typeof parsed.accessToken !== "string" || typeof parsed.refreshToken !== "string") return void 0;
-      return {
-        accessToken: parsed.accessToken,
-        refreshToken: parsed.refreshToken,
-        expiresAt: Number(parsed.expiresAt ?? 0),
-        ...typeof parsed.scope === "string" ? { scope: parsed.scope } : {},
-        ...typeof parsed.tokenType === "string" ? { tokenType: parsed.tokenType } : {}
-      };
-    } catch {
-      return void 0;
-    }
-  }
-  writeOAuth(account, tokens) {
-    return this.secrets.write(this.oauthService(account), account.email, JSON.stringify(tokens));
-  }
-  forgetOAuth(account) {
-    this.secrets.delete(this.oauthService(account), account.email);
-  }
   /** Read an arbitrary secret (for example a CalDAV app password). */
   readSecret(service, account) {
     return this.secrets.read(service, account);
@@ -5409,69 +5054,13 @@ var MailHarborRuntime = class {
   paths(account) {
     return accountRuntime(account);
   }
-  /** OAuth app configuration for one account's provider. */
-  oauthApp(account) {
-    if (account.auth.type !== "oauth2") throw new Error("\u8FD9\u4E2A\u8D26\u53F7\u4E0D\u662F OAuth2 \u8D26\u53F7");
-    const provider = account.auth.provider;
-    const settings = this.current.oauth;
-    if (provider === "google") {
-      if (settings.google.clientId === "") throw new Error("\u8BF7\u5148\u5728\u8BBE\u7F6E\u91CC\u586B\u5199 Google OAuth Client ID");
-      return {
-        provider,
-        clientId: settings.google.clientId,
-        clientSecret: settings.google.clientSecret,
-        redirectPort: settings.google.redirectPort,
-        scopes: settings.google.scopes.length > 0 ? settings.google.scopes : ["https://mail.google.com/"]
-      };
-    }
-    if (settings.microsoft.clientId === "") throw new Error("\u8BF7\u5148\u5728\u8BBE\u7F6E\u91CC\u586B\u5199 Microsoft OAuth Client ID");
-    return {
-      provider,
-      clientId: settings.microsoft.clientId,
-      clientSecret: "",
-      redirectPort: 0,
-      scopes: settings.microsoft.scopes.length > 0 ? settings.microsoft.scopes : [
-        "offline_access",
-        "https://outlook.office.com/IMAP.AccessAsUser.All",
-        "https://outlook.office.com/SMTP.Send"
-      ]
-    };
-  }
-  oauthTokens(account) {
-    return this.credentials.readOAuth(account);
-  }
-  saveOAuthTokens(account, tokens) {
-    this.credentials.writeOAuth(account, tokens);
-    this.invalidate(account.id);
-  }
-  /** Refresh when the access token is close to expiring; safe to call often. */
-  async refreshOAuth(account) {
-    if (account.auth.type !== "oauth2") return void 0;
-    const tokens = this.credentials.readOAuth(account);
-    if (tokens === void 0) return void 0;
-    if (tokens.expiresAt - Date.now() > 10 * 6e4) return tokens;
-    const refreshed = await refreshTokens(this.oauthApp(account), tokens.refreshToken);
-    this.saveOAuthTokens(account, refreshed);
-    return refreshed;
-  }
   /** Credentials for an account, with a clear message when the user must log in. */
   credentialsFor(account) {
-    if (account.auth.type === "oauth2") {
-      const tokens = this.credentials.readOAuth(account);
-      if (tokens === void 0) throw new Error("\u8BF7\u5148\u5B8C\u6210 OAuth \u6388\u6743");
-      if (tokens.expiresAt !== 0 && tokens.expiresAt <= Date.now()) {
-        throw new Error("OAuth \u767B\u5F55\u5DF2\u8FC7\u671F\uFF0C\u8BF7\u91CD\u65B0\u6388\u6743");
-      }
-      return { user: account.username || account.email, accessToken: tokens.accessToken };
-    }
     const resolved = this.credentials.resolve(account);
     if (resolved === void 0) throw new Error("\u8BF7\u5148\u767B\u5F55\u90AE\u7BB1\u8D26\u53F7");
     return { user: account.username || account.email, pass: resolved.password };
   }
   hasCredentials(account) {
-    if (account.auth.type === "oauth2") {
-      return this.credentials.readOAuth(account) !== void 0;
-    }
     return this.credentials.resolve(account) !== void 0;
   }
   imapSettings(account) {
@@ -6034,15 +5623,6 @@ function apply(ctx) {
   }
   const handler = createApiHandler(runtime);
   const disposers = [];
-  const refreshOAuth = () => {
-    for (const account of runtime.current.accounts) {
-      if (account.auth.type !== "oauth2" || !runtime.hasCredentials(account)) continue;
-      void runtime.refreshOAuth(account).catch(() => void 0);
-    }
-  };
-  refreshOAuth();
-  const oauthTimer = setInterval(refreshOAuth, 15 * 6e4);
-  disposers.push(() => clearInterval(oauthTimer));
   const start = () => {
     disposers.push(ctx.webServer.register({ kind: "prefix", path: ROUTE, handler }));
     if (ctx.tools !== void 0) disposers.push(...registerMailTools(ctx.tools, runtime));