hypermail-mcp 0.4.1 → 0.4.3

package/dist/cli.js

@@ -4,7 +4,7 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
-import { randomUUID as randomUUID2 } from "crypto";
+import { randomUUID as randomUUID6 } from "crypto";
 import { createServer as createHttpServer } from "http";
 
 // src/store/account-store.ts
@@ -159,12 +159,31 @@ async function tryKeytarSet(key) {
 }
 
 // src/providers/outlook/index.ts
-import { randomUUID } from "crypto";
+import { randomUUID as randomUUID2 } from "crypto";
 import { writeFileSync } from "fs";
 import { tmpdir } from "os";
 import { join as pathJoin } from "path";
 import { ResponseType } from "@microsoft/microsoft-graph-client";
 
+// src/providers/shared/inline-images.ts
+import { randomUUID } from "crypto";
+function parseInlineImages(html) {
+  const images = [];
+  const re = /src="data:image\/([\w+]+);base64,([^"]+)"/gi;
+  const transformed = html.replace(re, (_fullMatch, mimeSubtype, b64) => {
+    const contentId = `sig-img-${randomUUID()}`;
+    const ext = mimeSubtype.toLowerCase().replace(/\+/g, "-") === "svg-xml" ? "svg" : mimeSubtype.toLowerCase().replace(/\+/g, "-");
+    images.push({
+      cid: contentId,
+      contentBytes: b64,
+      contentType: `image/${mimeSubtype}`,
+      filename: `signature-image.${ext}`
+    });
+    return `src="cid:${contentId}"`;
+  });
+  return { body: transformed, images };
+}
+
 // src/providers/outlook/client.ts
 import "isomorphic-fetch";
 import {
@@ -182,6 +201,11 @@ var DEFAULT_SCOPES = [
   "Mail.ReadWrite",
   "Mail.Send"
 ];
+function isSerializedTokens(obj) {
+  if (typeof obj !== "object" || obj === null) return false;
+  const o = obj;
+  return typeof o.msalCache === "string" && typeof o.homeAccountId === "string" && typeof o.tenantId === "string" && typeof o.username === "string" && Array.isArray(o.scopes);
+}
 function makeConfig(prevCacheJson, clientIdOverride, tenantOverride) {
   const clientId = clientIdOverride || process.env.MS_CLIENT_ID || DEFAULT_CLIENT_ID;
   const tenant = tenantOverride || process.env.MS_TENANT_ID || "common";
@@ -322,6 +346,11 @@ var OutlookClientFactory = class {
     const provider = {
       getAccessToken: async () => {
         const fresh = store.getAccount(account.email) ?? account;
+        if (!isSerializedTokens(fresh.tokens)) {
+          throw new Error(
+            "Outlook account tokens are missing or corrupted \u2014 re-run add_account"
+          );
+        }
         const tokens = fresh.tokens;
         const { accessToken, tokens: nextTokens } = await acquireAccessToken(
           tokens,
@@ -351,21 +380,15 @@ var OutlookClientFactory = class {
 
 // src/providers/outlook/index.ts
 function convertInlineImages(body) {
-  const attachments = [];
-  const re = /src="data:image\/([\w+]+);base64,([^"]+)"/gi;
-  const transformed = body.replace(re, (_fullMatch, mimeSubtype, b64) => {
-    const contentId = `sig-img-${randomUUID()}`;
-    const ext = mimeSubtype.toLowerCase().replace(/\+/g, "-") === "svg-xml" ? "svg" : mimeSubtype.toLowerCase().replace(/\+/g, "-");
-    attachments.push({
-      "@odata.type": "#microsoft.graph.fileAttachment",
-      name: `signature-image.${ext}`,
-      contentType: `image/${mimeSubtype}`,
-      contentId,
-      contentBytes: b64,
-      isInline: true
-    });
-    return `src="cid:${contentId}"`;
-  });
+  const { body: transformed, images } = parseInlineImages(body);
+  const attachments = images.map((img) => ({
+    "@odata.type": "#microsoft.graph.fileAttachment",
+    name: img.filename,
+    contentType: img.contentType,
+    contentId: img.cid,
+    contentBytes: img.contentBytes,
+    isInline: true
+  }));
   return { body: transformed, attachments };
 }
 var OutlookProvider = class {
@@ -385,7 +408,7 @@ var OutlookProvider = class {
   async addAccount(input) {
     const begin = beginDeviceCode(void 0, this.clientId, this.tenantId);
     await awaitDeviceCodeReady(begin);
-    const handle = randomUUID();
+    const handle = randomUUID2();
     const flow = {
       begin,
       emailHint: input.email,
@@ -559,83 +582,25 @@ var OutlookProvider = class {
     }
     return draft.id;
   }
-  async sendEmail(account, msg) {
+  // Shared backend for sendEmail and saveDraft — handles forward, reply, and
+  // new-message paths. The `mode` controls whether the message is sent
+  // immediately or saved as a draft.
+  async sendOrSave(account, msg, mode) {
     const client = this.clients.get(account);
-    if (msg.inReplyTo && msg.forwardMessageId) {
-      throw new Error(
-        "inReplyTo and forwardMessageId are mutually exclusive \u2014 use one or the other"
-      );
-    }
     const converted = convertInlineImages(msg.body);
+    const toRecipients = msg.to.map(toRecipient);
+    const ccRecipients = (msg.cc ?? []).map(toRecipient);
+    const bccRecipients = (msg.bcc ?? []).map(toRecipient);
     if (msg.forwardMessageId) {
       const draftId = await this.buildDraftFromReference(
         client,
         `/me/messages/${encodeURIComponent(msg.forwardMessageId)}/createForward`,
-        {
-          message: {
-            toRecipients: msg.to.map(toRecipient),
-            ccRecipients: (msg.cc ?? []).map(toRecipient),
-            bccRecipients: (msg.bcc ?? []).map(toRecipient)
-          },
-          comment: ""
-        },
-        converted
-      );
-      await client.api(`/me/messages/${draftId}/send`).post({});
-      return { id: draftId };
-    }
-    if (msg.inReplyTo) {
-      const createEndpoint = msg.replyAll ? `/me/messages/${encodeURIComponent(msg.inReplyTo)}/createReplyAll` : `/me/messages/${encodeURIComponent(msg.inReplyTo)}/createReply`;
-      const draftId = await this.buildDraftFromReference(
-        client,
-        createEndpoint,
-        {},
-        converted
-      );
-      await client.api(`/me/messages/${draftId}/send`).post({});
-      return { id: draftId };
-    }
-    const payload = {
-      message: {
-        subject: msg.subject,
-        body: {
-          contentType: msg.isHtml ? "HTML" : "Text",
-          content: converted.body
-        },
-        toRecipients: msg.to.map(toRecipient),
-        ccRecipients: (msg.cc ?? []).map(toRecipient),
-        bccRecipients: (msg.bcc ?? []).map(toRecipient)
-      },
-      saveToSentItems: true
-    };
-    if (converted.attachments.length > 0) {
-      payload.message.attachments = converted.attachments;
-    }
-    await client.api("/me/sendMail").post(payload);
-    return { id: "" };
-  }
-  async saveDraft(account, msg) {
-    const client = this.clients.get(account);
-    if (msg.inReplyTo && msg.forwardMessageId) {
-      throw new Error(
-        "inReplyTo and forwardMessageId are mutually exclusive \u2014 use one or the other"
-      );
-    }
-    const converted = convertInlineImages(msg.body);
-    if (msg.forwardMessageId) {
-      const draftId = await this.buildDraftFromReference(
-        client,
-        `/me/messages/${encodeURIComponent(msg.forwardMessageId)}/createForward`,
-        {
-          message: {
-            toRecipients: msg.to.map(toRecipient),
-            ccRecipients: (msg.cc ?? []).map(toRecipient),
-            bccRecipients: (msg.bcc ?? []).map(toRecipient)
-          },
-          comment: ""
-        },
+        { message: { toRecipients, ccRecipients, bccRecipients }, comment: "" },
         converted
       );
+      if (mode === "send") {
+        await client.api(`/me/messages/${draftId}/send`).post({});
+      }
       return { id: draftId };
     }
     if (msg.inReplyTo) {
@@ -646,24 +611,40 @@ var OutlookProvider = class {
         {},
         converted
       );
+      if (mode === "send") {
+        await client.api(`/me/messages/${draftId}/send`).post({});
+      }
       return { id: draftId };
     }
-    const draftPayload = {
+    const messagePayload = {
       subject: msg.subject,
       body: {
         contentType: msg.isHtml ? "HTML" : "Text",
         content: converted.body
       },
-      toRecipients: msg.to.map(toRecipient),
-      ccRecipients: (msg.cc ?? []).map(toRecipient),
-      bccRecipients: (msg.bcc ?? []).map(toRecipient)
+      toRecipients,
+      ccRecipients,
+      bccRecipients
     };
     if (converted.attachments.length > 0) {
-      draftPayload.attachments = converted.attachments;
+      messagePayload.attachments = converted.attachments;
+    }
+    if (mode === "send") {
+      await client.api("/me/sendMail").post({
+        message: messagePayload,
+        saveToSentItems: true
+      });
+      return { id: "" };
     }
-    const draft = await client.api("/me/messages").post(draftPayload);
+    const draft = await client.api("/me/messages").post(messagePayload);
     return { id: draft.id };
   }
+  async sendEmail(account, msg) {
+    return this.sendOrSave(account, msg, "send");
+  }
+  async saveDraft(account, msg) {
+    return this.sendOrSave(account, msg, "draft");
+  }
   async updateDraft(account, id, update) {
     const client = this.clients.get(account);
     const payload = {};
@@ -757,91 +738,1685 @@ function mapFolder(f) {
     unreadItemCount: f.unreadItemCount
   };
 }
-function mapRecipient(r) {
+function mapRecipient(r) {
+  return {
+    name: r.emailAddress?.name,
+    address: r.emailAddress?.address ?? ""
+  };
+}
+function mapSummary(m, folder) {
+  return {
+    id: m.id,
+    subject: m.subject ?? "",
+    from: m.from ? mapRecipient(m.from) : void 0,
+    to: (m.toRecipients ?? []).map(mapRecipient),
+    receivedAt: m.receivedDateTime,
+    preview: m.bodyPreview,
+    isRead: m.isRead,
+    hasAttachments: m.hasAttachments,
+    folder
+  };
+}
+function toRecipient(a) {
+  return { emailAddress: { name: a.name, address: a.address } };
+}
+function clampLimit(v, dflt, max) {
+  if (!v || v <= 0) return dflt;
+  return Math.min(v, max);
+}
+
+// src/providers/imap/client.ts
+import { ImapFlow } from "imapflow";
+import nodemailer from "nodemailer";
+function isImapTokens(obj) {
+  if (typeof obj !== "object" || obj === null) return false;
+  const o = obj;
+  return typeof o.host === "string" && typeof o.port === "number" && typeof o.user === "string" && typeof o.password === "string" && typeof o.smtpHost === "string" && typeof o.smtpPort === "number";
+}
+function extractTokens(account) {
+  if (!isImapTokens(account.tokens)) {
+    throw new Error(
+      "IMAP account tokens are missing or corrupted \u2014 re-run add_account"
+    );
+  }
+  return account.tokens;
+}
+var ImapClient = class {
+  constructor(tokens) {
+    this.tokens = tokens;
+  }
+  tokens;
+  imap = null;
+  transporter = null;
+  connecting = null;
+  /** Get (or create) the ImapFlow instance. */
+  async getImap() {
+    if (this.imap) return this.imap;
+    this.imap = new ImapFlow({
+      host: this.tokens.host,
+      port: this.tokens.port,
+      secure: this.tokens.secure,
+      auth: {
+        user: this.tokens.user,
+        pass: this.tokens.password
+      },
+      logger: false
+    });
+    if (!this.connecting) {
+      this.connecting = this.imap.connect().catch((err) => {
+        this.imap = null;
+        this.connecting = null;
+        throw err;
+      });
+    }
+    await this.connecting;
+    return this.imap;
+  }
+  /** Get (or create) a nodemailer SMTP transporter. */
+  getTransporter() {
+    if (this.transporter) return this.transporter;
+    this.transporter = nodemailer.createTransport({
+      host: this.tokens.smtpHost,
+      port: this.tokens.smtpPort,
+      secure: this.tokens.smtpSecure,
+      auth: {
+        user: this.tokens.user,
+        pass: this.tokens.password
+      }
+    });
+    return this.transporter;
+  }
+  /**
+   * Acquire a mailbox lock and run `fn` with the mailbox selected.
+   * Releases the lock automatically after `fn` completes.
+   */
+  async withMailbox(mailbox, fn) {
+    const imap = await this.getImap();
+    const lock = await imap.getMailboxLock(mailbox);
+    try {
+      return await fn(imap);
+    } finally {
+      lock.release();
+    }
+  }
+  /** Disconnect IMAP and close the SMTP pool. */
+  async disconnect() {
+    if (this.imap) {
+      try {
+        await this.imap.logout();
+      } catch {
+      }
+      this.imap = null;
+      this.connecting = null;
+    }
+    if (this.transporter) {
+      this.transporter.close();
+      this.transporter = null;
+    }
+  }
+};
+var ImapClientFactory = class {
+  cache = /* @__PURE__ */ new Map();
+  get(account) {
+    const key = account.email.toLowerCase();
+    const existing = this.cache.get(key);
+    if (existing) return existing;
+    const tokens = extractTokens(account);
+    const client = new ImapClient(tokens);
+    this.cache.set(key, client);
+    return client;
+  }
+  /** Drop a cached client (e.g. after removeAccount). */
+  invalidate(email) {
+    const key = email.toLowerCase();
+    const existing = this.cache.get(key);
+    if (existing) {
+      existing.disconnect().catch(() => {
+      });
+      this.cache.delete(key);
+    }
+  }
+};
+
+// src/providers/imap/read-ops.ts
+import { createWriteStream } from "fs";
+import { tmpdir as tmpdir2 } from "os";
+import { join as pathJoin2 } from "path";
+import { pipeline } from "stream/promises";
+
+// src/providers/imap/helpers.ts
+var WELL_KNOWN_TO_IMAP = {
+  archive: "Archive",
+  deleteditems: "Trash",
+  inbox: "INBOX",
+  drafts: "Drafts",
+  sentitems: "Sent",
+  junkemail: "Junk",
+  outbox: "Outbox"
+};
+function resolveFolder(wellKnownOrPath) {
+  return WELL_KNOWN_TO_IMAP[wellKnownOrPath.toLowerCase()] ?? wellKnownOrPath;
+}
+function clampLimit2(v, dflt, max) {
+  if (!v || v <= 0) return dflt;
+  return Math.min(v, max);
+}
+function encodeId(folder, uid) {
+  return `${folder}/${uid}`;
+}
+function decodeId(id) {
+  const idx = id.lastIndexOf("/");
+  if (idx === -1) throw new Error(`invalid message ID: ${id}`);
+  const folder = id.slice(0, idx);
+  const uid = Number(id.slice(idx + 1));
+  if (!Number.isFinite(uid) || uid <= 0) {
+    throw new Error(`invalid message UID in ID: ${id}`);
+  }
+  return { folder, uid };
+}
+function findAttachments(node) {
+  const attachments = [];
+  const topType = (node.type ?? "").split("/")[0];
+  const isAttachment = node.disposition === "attachment" || !!node.type && topType !== "text" && topType !== "multipart" && !node.disposition;
+  if (isAttachment) {
+    attachments.push({
+      part: node.part ?? "1",
+      name: node.dispositionParameters?.filename ?? node.parameters?.name ?? "attachment",
+      contentType: node.type,
+      size: node.size
+    });
+  }
+  if (node.childNodes) {
+    for (const child of node.childNodes) {
+      attachments.push(...findAttachments(child));
+    }
+  }
+  return attachments;
+}
+function findPartByType(node, contentType) {
+  if (node.type === contentType) return node.part ?? "1";
+  if (node.childNodes) {
+    for (const child of node.childNodes) {
+      const found = findPartByType(child, contentType);
+      if (found) return found;
+    }
+  }
+  return void 0;
+}
+function mapEnvelopeAddr(a) {
+  return { name: a.name, address: a.address ?? "" };
+}
+function mapSummary2(uid, folder, envelope, flags = /* @__PURE__ */ new Set()) {
+  const fromAddr = envelope.from && envelope.from.length > 0 && envelope.from[0] ? mapEnvelopeAddr(envelope.from[0]) : void 0;
+  return {
+    id: encodeId(folder, uid),
+    subject: envelope.subject ?? "",
+    from: fromAddr,
+    to: (envelope.to ?? []).map(mapEnvelopeAddr),
+    receivedAt: envelope.date ? envelope.date.toISOString() : void 0,
+    isRead: flags.has("\\Seen"),
+    folder
+  };
+}
+function mapMailboxToListEntry(m) {
+  const lastSep = m.path.lastIndexOf("/");
+  const parentFolderId = lastSep === -1 ? void 0 : m.path.slice(0, lastSep);
+  return {
+    id: m.path,
+    displayName: m.path,
+    parentFolderId,
+    childFolderCount: 0,
+    totalItemCount: m.status?.messages ?? 0,
+    unreadItemCount: m.status?.unseen ?? 0
+  };
+}
+
+// src/providers/imap/read-ops.ts
+async function listEmails(clients, account, opts) {
+  const client = clients.get(account);
+  const folder = resolveFolder(opts.folder ?? "INBOX");
+  const limit = clampLimit2(opts.limit, 25, 100);
+  const skip = opts.skip ?? 0;
+  return client.withMailbox(folder, async (imap) => {
+    const searchCriteria = {};
+    if (opts.unreadOnly) searchCriteria.seen = false;
+    const allUids = Object.keys(searchCriteria).length > 0 ? await imap.search(searchCriteria, { uid: true }) : await imap.search({ all: true }, { uid: true });
+    allUids.sort((a, b) => b - a);
+    const pageUids = allUids.slice(skip, skip + limit);
+    const hasMore = skip + limit < allUids.length;
+    if (pageUids.length === 0) {
+      return { items: [], hasMore };
+    }
+    const messages = await imap.fetchAll(
+      pageUids,
+      { envelope: true, flags: true },
+      { uid: true }
+    );
+    const items = [];
+    for (const msg of messages) {
+      items.push(
+        mapSummary2(
+          msg.uid,
+          folder,
+          msg.envelope,
+          msg.flags
+        )
+      );
+    }
+    return { items, hasMore };
+  });
+}
+async function searchEmails(clients, account, query, opts) {
+  const client = clients.get(account);
+  const limit = clampLimit2(opts.limit, 25, 100);
+  return client.withMailbox("INBOX", async (imap) => {
+    const uids = await imap.search({ text: query }, { uid: true });
+    uids.sort((a, b) => b - a);
+    const pageUids = uids.slice(0, limit);
+    if (pageUids.length === 0) return [];
+    const messages = await imap.fetchAll(
+      pageUids,
+      { envelope: true, flags: true },
+      { uid: true }
+    );
+    return messages.map(
+      (msg) => mapSummary2(
+        msg.uid,
+        "INBOX",
+        msg.envelope,
+        msg.flags
+      )
+    );
+  });
+}
+async function readEmail(clients, account, id) {
+  const client = clients.get(account);
+  const { folder, uid } = decodeId(id);
+  return client.withMailbox(folder, async (imap) => {
+    const msg = await imap.fetchOne(
+      uid,
+      { bodyStructure: true, envelope: true, flags: true },
+      { uid: true }
+    );
+    if (!msg || !msg.envelope) {
+      throw new Error(`message not found: ${id}`);
+    }
+    const envelope = msg.envelope;
+    const structure = msg.bodyStructure;
+    const flags = msg.flags ?? /* @__PURE__ */ new Set();
+    let bodyText;
+    let bodyHtml;
+    const textPart = findPartByType(structure, "text/plain");
+    const htmlPart = findPartByType(structure, "text/html");
+    if (textPart) {
+      const { content } = await imap.download(uid, textPart, { uid: true });
+      const chunks = [];
+      for await (const chunk of content) {
+        chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+      }
+      bodyText = Buffer.concat(chunks).toString("utf-8");
+    }
+    if (htmlPart) {
+      const { content } = await imap.download(uid, htmlPart, { uid: true });
+      const chunks = [];
+      for await (const chunk of content) {
+        chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+      }
+      bodyHtml = Buffer.concat(chunks).toString("utf-8");
+    }
+    const attachments = findAttachments(
+      structure
+    ).map((a) => ({
+      id: a.part,
+      name: a.name,
+      contentType: a.contentType,
+      size: a.size
+    }));
+    const summary = mapSummary2(uid, folder, envelope, flags);
+    return {
+      ...summary,
+      cc: (envelope.cc ?? []).map(mapEnvelopeAddr),
+      bcc: (envelope.bcc ?? []).map(mapEnvelopeAddr),
+      bodyText,
+      bodyHtml,
+      attachments: attachments.length > 0 ? attachments : void 0,
+      hasAttachments: attachments.length > 0
+    };
+  });
+}
+async function readAttachment(clients, account, messageId, attachmentId) {
+  const client = clients.get(account);
+  const { folder, uid } = decodeId(messageId);
+  return client.withMailbox(folder, async (imap) => {
+    const msg = await imap.fetchOne(
+      uid,
+      { bodyStructure: true },
+      { uid: true }
+    );
+    let name = "attachment";
+    let contentType;
+    if (msg && msg.bodyStructure) {
+      const attachments = findAttachments(msg.bodyStructure);
+      const match = attachments.find((a) => a.part === attachmentId);
+      if (match) {
+        name = match.name;
+        contentType = match.contentType;
+      }
+    }
+    const { meta, content } = await imap.download(uid, attachmentId, {
+      uid: true
+    });
+    const outPath = pathJoin2(tmpdir2(), name);
+    await pipeline(
+      content,
+      createWriteStream(outPath)
+    );
+    return {
+      name,
+      contentType: contentType ?? meta.contentType,
+      path: outPath
+    };
+  });
+}
+async function listFolders(clients, account, opts) {
+  const client = clients.get(account);
+  const imap = await client.getImap();
+  const mailboxes = await imap.list({
+    statusQuery: { messages: true, unseen: true, uidNext: true }
+  });
+  let results = mailboxes.map(mapMailboxToListEntry);
+  if (opts.parentFolderId) {
+    const parentPath = opts.parentFolderId;
+    results = results.filter(
+      (f) => f.parentFolderId === parentPath || parentPath === "INBOX" && f.displayName === "INBOX"
+    );
+  } else {
+    const allPaths = new Set(results.map((f) => f.displayName));
+    results = results.filter((f) => {
+      const lastSep = f.displayName.lastIndexOf("/");
+      if (lastSep === -1) return true;
+      const parent = f.displayName.slice(0, lastSep);
+      return !allPaths.has(parent);
+    });
+  }
+  return results;
+}
+
+// src/providers/imap/write-ops.ts
+import { randomUUID as randomUUID3 } from "crypto";
+import MailComposer from "nodemailer/lib/mail-composer/index.js";
+async function addAccount(clients, store, input) {
+  const cfg = input.config ?? {};
+  const host = String(cfg.host ?? "");
+  const port = Number(cfg.port ?? 993);
+  const secure = cfg.secure !== false;
+  const user = String(cfg.user ?? input.email ?? "");
+  const password = String(cfg.password ?? "");
+  const smtpHost = String(cfg.smtpHost ?? host);
+  const smtpPort = Number(cfg.smtpPort ?? 587);
+  const smtpSecure = cfg.smtpSecure === true;
+  if (!host || !user || !password) {
+    throw new Error(
+      "IMAP requires config: { host, port?, secure?, user, password, smtpHost?, smtpPort?, smtpSecure? }"
+    );
+  }
+  const tokens = {
+    host,
+    port,
+    secure,
+    user,
+    password,
+    smtpHost: smtpHost || host,
+    smtpPort: smtpPort || 587,
+    smtpSecure
+  };
+  const client = clients.get({
+    email: user.toLowerCase(),
+    provider: "imap",
+    tokens,
+    addedAt: (/* @__PURE__ */ new Date()).toISOString()
+  });
+  try {
+    await client.getImap();
+  } finally {
+    clients.invalidate(user.toLowerCase());
+  }
+  try {
+    const t = client.getTransporter();
+    await t.verify();
+  } catch {
+  }
+  const email = user.toLowerCase();
+  const rec = {
+    email,
+    provider: "imap",
+    displayName: input.email ?? user,
+    tokens,
+    addedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  const saved = await store.upsertAccount(rec);
+  return { status: "ready", account: saved };
+}
+function completeAddAccount() {
+  return {
+    status: "error",
+    error: "IMAP accounts are set up synchronously \u2014 no polling needed. Call add_account with IMAP config to create the account directly."
+  };
+}
+async function sendEmail(clients, account, msg) {
+  const client = clients.get(account);
+  const transporter = client.getTransporter();
+  const mailOptions = {
+    from: `${account.displayName ?? ""} <${account.email}>`,
+    to: msg.to.map((a) => a.name ? `"${a.name}" <${a.address}>` : a.address).join(", "),
+    subject: msg.subject
+  };
+  if (msg.isHtml) {
+    mailOptions.html = msg.body;
+  } else {
+    mailOptions.text = msg.body;
+  }
+  mailOptions.attachDataUrls = true;
+  if (msg.cc && msg.cc.length > 0) {
+    mailOptions.cc = msg.cc.map((a) => a.name ? `"${a.name}" <${a.address}>` : a.address).join(", ");
+  }
+  if (msg.bcc && msg.bcc.length > 0) {
+    mailOptions.bcc = msg.bcc.map((a) => a.name ? `"${a.name}" <${a.address}>` : a.address).join(", ");
+  }
+  if (msg.inReplyTo || msg.forwardMessageId) {
+    const refId = msg.inReplyTo ?? msg.forwardMessageId;
+    if (refId) {
+      try {
+        const { folder: refFolder, uid: refUid } = decodeId(refId);
+        const refMsg = await client.withMailbox(refFolder, async (imap) => {
+          return imap.fetchOne(
+            refUid,
+            { envelope: true, source: true },
+            { uid: true }
+          );
+        });
+        if (refMsg?.envelope) {
+          const env = refMsg.envelope;
+          if (msg.inReplyTo && env.messageId && !msg.forwardMessageId) {
+            mailOptions.inReplyTo = env.messageId;
+            mailOptions.references = env.messageId;
+          }
+        }
+        if (msg.forwardMessageId && refMsg?.source) {
+          const sourceStr = typeof refMsg.source === "string" ? refMsg.source : Buffer.from(refMsg.source).toString("utf-8");
+          const divider = '\n\n<div style="line-height:12px"><br></div>\n\n<div style="border-left:2px solid #ccc; padding-left:8px; margin-left:0; color:#666">\n---------- Forwarded message ---------<br>' + sourceStr + "\n</div>";
+          if (mailOptions.html) {
+            mailOptions.html += divider;
+          } else if (mailOptions.text) {
+            mailOptions.text += "\n\n---------- Forwarded message ---------\n" + sourceStr;
+          }
+        }
+      } catch {
+      }
+    }
+  }
+  const info = await transporter.sendMail(mailOptions);
+  try {
+    const rawMsg = await buildRawMessage(account, msg, info.messageId);
+    await client.withMailbox("Sent", async (imap) => {
+      await imap.append("Sent", rawMsg, ["\\Seen"]);
+    });
+  } catch {
+  }
+  return { id: info.messageId };
+}
+async function saveDraft(clients, account, msg) {
+  const client = clients.get(account);
+  const rawMsg = await buildRawMessage(account, msg);
+  return client.withMailbox("Drafts", async (imap) => {
+    const result = await imap.append("Drafts", rawMsg, ["\\Draft"]);
+    return { id: encodeId("Drafts", result.uid) };
+  });
+}
+async function updateDraft(clients, account, id, update) {
+  const client = clients.get(account);
+  const { folder, uid } = decodeId(id);
+  return client.withMailbox(folder, async (imap) => {
+    const existing = await imap.fetchOne(
+      uid,
+      { source: true, envelope: true },
+      { uid: true }
+    );
+    if (!existing?.source) {
+      throw new Error(`draft not found: ${id}`);
+    }
+    const origSubject = existing.envelope ? existing.envelope.subject ?? "" : "";
+    const updatedMsg = {
+      from: `${account.displayName ?? ""} <${account.email}>`,
+      subject: update.subject ?? origSubject,
+      attachDataUrls: true
+    };
+    if (update.body !== void 0) {
+      if (update.isHtml) {
+        updatedMsg.html = update.body;
+      } else {
+        updatedMsg.text = update.body;
+      }
+    }
+    const raw = await new Promise((resolve, reject) => {
+      const mc = new MailComposer(updatedMsg);
+      mc.compile().build((err, buf) => {
+        if (err) reject(err);
+        else resolve(buf);
+      });
+    });
+    await imap.messageDelete(uid, { uid: true });
+    const result = await imap.append(folder, raw, ["\\Draft"]);
+    return { id: encodeId(folder, result.uid) };
+  });
+}
+async function moveEmail(clients, account, id, destinationId) {
+  const client = clients.get(account);
+  const { folder, uid } = decodeId(id);
+  const dest = resolveFolder(destinationId);
+  return client.withMailbox(folder, async (imap) => {
+    await imap.messageMove(uid, dest, { uid: true });
+  });
+}
+async function sendDraft(clients, account, id) {
+  const client = clients.get(account);
+  const { folder, uid } = decodeId(id);
+  return client.withMailbox(folder, async (imap) => {
+    const draft = await imap.fetchOne(
+      uid,
+      { source: true },
+      { uid: true }
+    );
+    if (!draft?.source) {
+      throw new Error(`draft not found: ${id}`);
+    }
+    const sourceStr = typeof draft.source === "string" ? draft.source : Buffer.from(draft.source).toString("utf-8");
+    const transporter = client.getTransporter();
+    const info = await transporter.sendMail({ raw: sourceStr });
+    try {
+      await imap.messageMove(uid, "Sent", { uid: true });
+    } catch {
+    }
+    return { id: info.messageId };
+  });
+}
+async function addAttachmentToDraft(clients, account, draftId, name, contentBytes, contentType) {
+  const client = clients.get(account);
+  const { folder, uid } = decodeId(draftId);
+  return client.withMailbox(folder, async (imap) => {
+    const existing = await imap.fetchOne(
+      uid,
+      { source: true },
+      { uid: true }
+    );
+    if (!existing?.source) {
+      throw new Error(`draft not found: ${draftId}`);
+    }
+    const sourceStr = typeof existing.source === "string" ? existing.source : Buffer.from(existing.source).toString("utf-8");
+    const built = await new Promise((resolve, reject) => {
+      const mc = new MailComposer({
+        raw: sourceStr,
+        attachments: [
+          {
+            filename: name,
+            content: Buffer.from(contentBytes, "base64"),
+            contentType: contentType ?? "application/octet-stream"
+          }
+        ]
+      });
+      mc.compile().build((err, buf) => {
+        if (err) reject(err);
+        else resolve(buf);
+      });
+    });
+    await imap.messageDelete(uid, { uid: true });
+    const result = await imap.append(folder, built, ["\\Draft"]);
+    return {
+      id: encodeId(folder, result.uid),
+      attachment: {
+        id: randomUUID3(),
+        name,
+        contentType: contentType ?? "application/octet-stream"
+      }
+    };
+  });
+}
+async function markRead(clients, account, id, isRead) {
+  const client = clients.get(account);
+  const { folder, uid } = decodeId(id);
+  return client.withMailbox(folder, async (imap) => {
+    if (isRead) {
+      await imap.messageFlagsAdd(uid, ["\\Seen"], { uid: true });
+    } else {
+      await imap.messageFlagsRemove(uid, ["\\Seen"], { uid: true });
+    }
+  });
+}
+async function createFolder(clients, account, input) {
+  const client = clients.get(account);
+  const imap = await client.getImap();
+  const path2 = input.parentFolderId ? `${input.parentFolderId}/${input.displayName}` : input.displayName;
+  const result = await imap.mailboxCreate(path2);
+  return {
+    id: result.path,
+    displayName: result.path,
+    parentFolderId: input.parentFolderId,
+    childFolderCount: 0,
+    totalItemCount: 0,
+    unreadItemCount: 0
+  };
+}
+async function renameFolder(clients, account, folderId, newName) {
+  const client = clients.get(account);
+  const imap = await client.getImap();
+  const lastSep = folderId.lastIndexOf("/");
+  const newPath = lastSep === -1 ? newName : folderId.slice(0, lastSep + 1) + newName;
+  const result = await imap.mailboxRename(folderId, newPath);
+  return {
+    id: result.path,
+    displayName: result.path,
+    parentFolderId: lastSep === -1 ? void 0 : folderId.slice(0, lastSep),
+    childFolderCount: 0,
+    totalItemCount: 0,
+    unreadItemCount: 0
+  };
+}
+async function deleteFolder(clients, account, folderId) {
+  const client = clients.get(account);
+  const imap = await client.getImap();
+  await imap.mailboxDelete(folderId);
+}
+async function buildRawMessage(account, msg, messageId) {
+  const mailOptions = {
+    from: `${account.displayName ?? ""} <${account.email}>`,
+    to: msg.to.map((a) => a.name ? `"${a.name}" <${a.address}>` : a.address).join(", "),
+    subject: msg.subject,
+    attachDataUrls: true
+  };
+  if (msg.isHtml) {
+    mailOptions.html = msg.body;
+  } else {
+    mailOptions.text = msg.body;
+  }
+  if (msg.cc && msg.cc.length > 0) {
+    mailOptions.cc = msg.cc.map((a) => a.name ? `"${a.name}" <${a.address}>` : a.address).join(", ");
+  }
+  if (msg.bcc && msg.bcc.length > 0) {
+    mailOptions.bcc = msg.bcc.map((a) => a.name ? `"${a.name}" <${a.address}>` : a.address).join(", ");
+  }
+  if (messageId) {
+    mailOptions.messageId = messageId;
+  }
+  return new Promise((resolve, reject) => {
+    const mc = new MailComposer(mailOptions);
+    mc.compile().build((err, buf) => {
+      if (err) reject(err);
+      else resolve(buf.toString("utf-8"));
+    });
+  });
+}
+
+// src/providers/imap/index.ts
+var ImapProvider = class {
+  constructor(store) {
+    this.store = store;
+  }
+  store;
+  id = "imap";
+  clients = new ImapClientFactory();
+  // ---------- account lifecycle ----------
+  async addAccount(input) {
+    if (!this.store) throw new Error("IMAP provider requires an AccountStore");
+    return addAccount(this.clients, this.store, input);
+  }
+  async completeAddAccount(_handle) {
+    return completeAddAccount();
+  }
+  // ---------- browse ----------
+  async listEmails(account, opts) {
+    return listEmails(this.clients, account, opts);
+  }
+  async searchEmails(account, query, opts) {
+    return searchEmails(this.clients, account, query, opts);
+  }
+  async readEmail(account, id) {
+    return readEmail(this.clients, account, id);
+  }
+  async readAttachment(account, messageId, attachmentId) {
+    return readAttachment(this.clients, account, messageId, attachmentId);
+  }
+  // ---------- compose ----------
+  async sendEmail(account, msg) {
+    return sendEmail(this.clients, account, msg);
+  }
+  async saveDraft(account, msg) {
+    return saveDraft(this.clients, account, msg);
+  }
+  async updateDraft(account, id, update) {
+    return updateDraft(this.clients, account, id, update);
+  }
+  async moveEmail(account, id, destinationId) {
+    return moveEmail(this.clients, account, id, destinationId);
+  }
+  async sendDraft(account, id) {
+    return sendDraft(this.clients, account, id);
+  }
+  async addAttachmentToDraft(account, draftId, name, contentBytes, contentType) {
+    return addAttachmentToDraft(this.clients, account, draftId, name, contentBytes, contentType);
+  }
+  // ---------- organize ----------
+  async markRead(account, id, isRead) {
+    return markRead(this.clients, account, id, isRead);
+  }
+  // ---------- folders ----------
+  async listFolders(account, opts) {
+    return listFolders(this.clients, account, opts);
+  }
+  async createFolder(account, input) {
+    return createFolder(this.clients, account, input);
+  }
+  async renameFolder(account, folderId, newName) {
+    return renameFolder(this.clients, account, folderId, newName);
+  }
+  async deleteFolder(account, folderId) {
+    return deleteFolder(this.clients, account, folderId);
+  }
+};
+
+// src/providers/gmail/index.ts
+import { randomUUID as randomUUID5 } from "crypto";
+
+// src/providers/gmail/auth.ts
+import { OAuth2Client } from "google-auth-library";
+var GOOGLE_DEVICE_CODE_URL = "https://oauth2.googleapis.com/device/code";
+var GOOGLE_TOKEN_URL = "https://oauth2.googleapis.com/token";
+var DEFAULT_SCOPES2 = [
+  "https://www.googleapis.com/auth/gmail.modify"
+];
+function isSerializedGmailTokens(obj) {
+  if (typeof obj !== "object" || obj === null) return false;
+  const o = obj;
+  return typeof o.clientId === "string" && (o.clientSecret === void 0 || typeof o.clientSecret === "string") && typeof o.accessToken === "string" && typeof o.refreshToken === "string" && typeof o.expiryDate === "number" && Array.isArray(o.scopes) && typeof o.email === "string";
+}
+function buildOAuth2Client(tokens) {
+  const client = new OAuth2Client({
+    clientId: tokens?.clientId,
+    clientSecret: tokens?.clientSecret
+  });
+  if (tokens) {
+    client.setCredentials({
+      access_token: tokens.accessToken,
+      refresh_token: tokens.refreshToken,
+      expiry_date: tokens.expiryDate,
+      scope: tokens.scopes.join(" ")
+    });
+  }
+  return client;
+}
+async function getEmailFromToken(accessToken) {
+  const res = await fetch(
+    "https://gmail.googleapis.com/gmail/v1/users/me/profile",
+    {
+      headers: {
+        Authorization: `Bearer ${accessToken}`
+      }
+    }
+  );
+  if (!res.ok) {
+    const body = await res.text().catch(() => "");
+    throw new Error(
+      `Failed to get Gmail profile (${res.status}): ${body}`
+    );
+  }
+  const data = await res.json();
+  return data.emailAddress;
+}
+function beginDeviceCode2(scopes = DEFAULT_SCOPES2, clientIdOverride, clientSecretOverride) {
+  const clientId = clientIdOverride || process.env.GOOGLE_CLIENT_ID;
+  if (!clientId) {
+    throw new Error(
+      "GOOGLE_CLIENT_ID is required for Gmail OAuth \u2014 set it in env or provider config"
+    );
+  }
+  const clientSecret = clientSecretOverride || process.env.GOOGLE_CLIENT_SECRET || void 0;
+  let resolve;
+  let reject;
+  const result = new Promise(
+    (res, rej) => {
+      resolve = res;
+      reject = rej;
+    }
+  );
+  let userCode = "";
+  let verificationUri = "";
+  let message = "";
+  let expiresAt = new Date(Date.now() + 15 * 6e4).toISOString();
+  let aborted = false;
+  const ready = (async () => {
+    try {
+      const dcParams = new URLSearchParams();
+      dcParams.set("client_id", clientId);
+      if (clientSecret) dcParams.set("client_secret", clientSecret);
+      dcParams.set("scope", scopes.join(" "));
+      const dcRes = await fetch(GOOGLE_DEVICE_CODE_URL, {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: dcParams.toString()
+      });
+      if (!dcRes.ok) {
+        const errBody = await dcRes.json().catch(() => ({}));
+        throw new Error(
+          `Google device-code request failed: ${errBody.error_description ?? errBody.error ?? dcRes.statusText}`
+        );
+      }
+      const dcData = await dcRes.json();
+      userCode = dcData.user_code;
+      verificationUri = dcData.verification_url;
+      const deviceCode = dcData.device_code;
+      let interval = dcData.interval ?? 5;
+      if (dcData.expires_in) {
+        expiresAt = new Date(
+          Date.now() + dcData.expires_in * 1e3
+        ).toISOString();
+      }
+      message = `Go to ${verificationUri} and enter code: ${userCode}`;
+      const tokenParams = new URLSearchParams();
+      tokenParams.set("client_id", clientId);
+      if (clientSecret) tokenParams.set("client_secret", clientSecret);
+      tokenParams.set("device_code", deviceCode);
+      tokenParams.set(
+        "grant_type",
+        "urn:ietf:params:oauth:grant-type:device_code"
+      );
+      const deadline = Date.now() + dcData.expires_in * 1e3;
+      while (Date.now() < deadline && !aborted) {
+        await new Promise((r) => setTimeout(r, interval * 1e3));
+        if (aborted) return;
+        const tokenRes = await fetch(GOOGLE_TOKEN_URL, {
+          method: "POST",
+          headers: { "Content-Type": "application/x-www-form-urlencoded" },
+          body: tokenParams.toString()
+        });
+        const tokenData = await tokenRes.json();
+        if (tokenData.access_token) {
+          const email = await getEmailFromToken(tokenData.access_token);
+          const tokens = {
+            clientId,
+            clientSecret,
+            accessToken: tokenData.access_token,
+            refreshToken: tokenData.refresh_token ?? "",
+            expiryDate: tokenData.expires_in ? Date.now() + tokenData.expires_in * 1e3 : Date.now() + 36e5,
+            scopes: tokenData.scope ? tokenData.scope.split(" ") : scopes,
+            email
+          };
+          resolve({ tokens, email });
+          return;
+        }
+        switch (tokenData.error) {
+          case "authorization_pending":
+            break;
+          // keep polling
+          case "slow_down":
+            interval += 1;
+            break;
+          case "expired_token":
+            throw new Error("Device code expired \u2014 please try again");
+          case "access_denied":
+            throw new Error("User denied access");
+          default:
+            throw new Error(
+              `Token request failed: ${tokenData.error ?? "unknown error"}`
+            );
+        }
+      }
+      if (!aborted) {
+        throw new Error("Device code expired \u2014 please try again");
+      }
+    } catch (err) {
+      if (!aborted) reject(err);
+    }
+  })();
+  return {
+    get userCode() {
+      return userCode;
+    },
+    get verificationUri() {
+      return verificationUri;
+    },
+    get message() {
+      return message;
+    },
+    get expiresAt() {
+      return expiresAt;
+    },
+    result,
+    cancel() {
+      aborted = true;
+    },
+    ...{ _ready: ready }
+  };
+}
+async function awaitDeviceCodeReady2(b) {
+  const r = b._ready;
+  await r;
+}
+
+// src/providers/gmail/client.ts
+import { google } from "googleapis";
+var GmailClientFactory = class {
+  constructor(store, clientId, clientSecret) {
+    this.store = store;
+    this.clientId = clientId;
+    this.clientSecret = clientSecret;
+  }
+  store;
+  clientId;
+  clientSecret;
+  cache = /* @__PURE__ */ new Map();
+  get(account) {
+    const key = account.email.toLowerCase();
+    const existing = this.cache.get(key);
+    if (existing) return existing;
+    if (!isSerializedGmailTokens(account.tokens)) {
+      throw new Error(
+        "Gmail account tokens are missing or corrupted \u2014 re-run add_account"
+      );
+    }
+    const tokens = account.tokens;
+    const resolvedClientId = tokens.clientId || this.clientId;
+    const resolvedSecret = tokens.clientSecret || this.clientSecret;
+    const auth = buildOAuth2Client({
+      ...tokens,
+      clientId: resolvedClientId ?? tokens.clientId,
+      clientSecret: resolvedSecret
+    });
+    const store = this.store;
+    auth.on("tokens", (updated) => {
+      if (!updated.refresh_token && !updated.access_token) return;
+      const fresh = store.getAccount(account.email) ?? account;
+      const currentTokens = isSerializedGmailTokens(fresh.tokens) ? fresh.tokens : tokens;
+      const nextTokens = {
+        ...currentTokens,
+        accessToken: updated.access_token ?? currentTokens.accessToken,
+        refreshToken: updated.refresh_token ?? currentTokens.refreshToken,
+        expiryDate: updated.expiry_date ?? currentTokens.expiryDate,
+        scopes: updated.scope ? updated.scope.split(" ") : currentTokens.scopes
+      };
+      store.upsertAccount({
+        ...fresh,
+        tokens: nextTokens
+      }).catch(() => {
+      });
+    });
+    const gmail = google.gmail({ version: "v1", auth });
+    const entry = { auth, gmail };
+    this.cache.set(key, entry);
+    return entry;
+  }
+  /** Drop a cached client (e.g. after removeAccount). */
+  invalidate(email) {
+    this.cache.delete(email.toLowerCase());
+  }
+};
+
+// src/providers/gmail/read-ops.ts
+import { writeFileSync as writeFileSync2 } from "fs";
+import { tmpdir as tmpdir3 } from "os";
+import { join as pathJoin3 } from "path";
+
+// src/providers/gmail/helpers.ts
+import MailComposer2 from "nodemailer/lib/mail-composer/index.js";
+var WELL_KNOWN_TO_LABEL = {
+  inbox: "INBOX",
+  sentitems: "SENT",
+  drafts: "DRAFT",
+  deleteditems: "TRASH",
+  junkemail: "SPAM",
+  outbox: ""
+  // Gmail has no outbox; sendEmail handles this.
+};
+function resolveLabel(wellKnownOrId) {
+  const lower = wellKnownOrId.toLowerCase();
+  return WELL_KNOWN_TO_LABEL[lower] ?? wellKnownOrId;
+}
+function resolveLabelsForMove(destinationId) {
+  if (destinationId.toLowerCase() === "archive") {
+    return { addLabelIds: [], removeLabelIds: ["INBOX"] };
+  }
+  return { addLabelIds: [resolveLabel(destinationId)], removeLabelIds: [] };
+}
+function mapHeaderAddr(raw) {
+  if (!raw) return [];
+  const addrs = raw.split(",");
+  return addrs.map((a) => {
+    const trimmed = a.trim();
+    const match = trimmed.match(/^(.+?)\s*<(.+@.+)>$/);
+    if (match) return { name: match[1].trim(), address: match[2] };
+    return { address: trimmed };
+  });
+}
+function findHeader(headers, name) {
+  if (!headers) return void 0;
+  const h = headers.find(
+    (h2) => h2.name?.toLowerCase() === name.toLowerCase()
+  );
+  return h?.value ?? void 0;
+}
+function decodeBody(body) {
+  if (!body?.data) return "";
+  return Buffer.from(
+    body.data.replace(/-/g, "+").replace(/_/g, "/"),
+    "base64"
+  ).toString("utf-8");
+}
+function parsePayload(payload, prefix = "") {
+  let bodyText;
+  let bodyHtml;
+  const attachments = [];
+  function walk(part, partPrefix) {
+    const mime = part.mimeType ?? "";
+    if (mime === "text/plain" && bodyText === void 0) {
+      bodyText = decodeBody(part.body ?? {});
+      return;
+    }
+    if (mime === "text/html" && bodyHtml === void 0) {
+      bodyHtml = decodeBody(part.body ?? {});
+      return;
+    }
+    if (part.parts) {
+      for (let i = 0; i < part.parts.length; i++) {
+        walk(part.parts[i], (partPrefix ? `${partPrefix}.` : "") + String(i));
+      }
+      return;
+    }
+    const topType = mime.split("/")[0] ?? "";
+    const hasFilename = !!part.filename || !!part.body?.attachmentId;
+    const isAttachment = hasFilename || !!mime && topType !== "text" && topType !== "multipart";
+    if (isAttachment && part.body?.attachmentId) {
+      attachments.push({
+        id: part.body.attachmentId,
+        name: part.filename ?? part.partId ?? "attachment",
+        contentType: mime || void 0,
+        size: part.body.size != null ? Number(part.body.size) : void 0
+      });
+    }
+  }
+  walk(payload, prefix);
+  return { bodyText, bodyHtml, attachments };
+}
+function mapSummary3(id, headers, flags) {
+  return {
+    id,
+    subject: findHeader(headers, "Subject") ?? "",
+    from: mapHeaderAddr(findHeader(headers, "From"))[0],
+    to: mapHeaderAddr(findHeader(headers, "To")),
+    receivedAt: flags.internalDate ? new Date(Number(flags.internalDate)).toISOString() : void 0,
+    preview: void 0,
+    isRead: !(flags.labelIds?.includes("UNREAD") ?? false),
+    hasAttachments: false
+  };
+}
+function mapFolder2(label) {
+  return {
+    id: label.id ?? "",
+    displayName: label.name ?? "",
+    parentFolderId: void 0,
+    childFolderCount: 0,
+    totalItemCount: label.messagesTotal ?? 0,
+    unreadItemCount: label.messagesUnread ?? 0
+  };
+}
+function clampLimit3(v, dflt, max) {
+  if (!v || v <= 0) return dflt;
+  return Math.min(v, max);
+}
+async function pool(items, concurrency, fn) {
+  const results = new Array(items.length);
+  let idx = 0;
+  async function worker() {
+    while (idx < items.length) {
+      const i = idx++;
+      results[i] = await fn(items[i]);
+    }
+  }
+  const workers = Array.from(
+    { length: Math.min(concurrency, items.length) },
+    () => worker()
+  );
+  await Promise.all(workers);
+  return results;
+}
+function base64urlEncode(buf) {
+  return buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+async function buildRawMessage2(account, msg, messageId) {
+  const { body: transformed, images } = parseInlineImages(msg.body);
+  const mailOptions = {
+    from: `${account.displayName ?? ""} <${account.email}>`,
+    to: msg.to.map((a) => a.name ? `"${a.name}" <${a.address}>` : a.address).join(", "),
+    subject: msg.subject,
+    attachDataUrls: true
+  };
+  if (msg.isHtml) {
+    mailOptions.html = transformed;
+  } else {
+    mailOptions.text = transformed;
+  }
+  if (msg.cc && msg.cc.length > 0) {
+    mailOptions.cc = msg.cc.map((a) => a.name ? `"${a.name}" <${a.address}>` : a.address).join(", ");
+  }
+  if (msg.bcc && msg.bcc.length > 0) {
+    mailOptions.bcc = msg.bcc.map((a) => a.name ? `"${a.name}" <${a.address}>` : a.address).join(", ");
+  }
+  if (images.length > 0) {
+    mailOptions.attachments = images.map((img) => ({
+      filename: img.filename,
+      content: Buffer.from(img.contentBytes, "base64"),
+      contentType: img.contentType,
+      cid: img.cid
+    }));
+  }
+  if (messageId) {
+    mailOptions.messageId = messageId;
+  }
+  const rawStr = await new Promise((resolve, reject) => {
+    const mc = new MailComposer2(mailOptions);
+    mc.compile().build((err, buf) => {
+      if (err) reject(err);
+      else resolve(buf.toString("utf-8"));
+    });
+  });
+  return { raw: base64urlEncode(Buffer.from(rawStr, "utf-8")) };
+}
+
+// src/providers/gmail/read-ops.ts
+async function listEmails2(clients, account, opts) {
+  const { gmail } = clients.get(account);
+  const limit = clampLimit3(opts.limit, 25, 100);
+  const label = resolveLabel(opts.folder ?? "inbox");
+  const params = {
+    userId: "me",
+    labelIds: [label],
+    maxResults: limit
+  };
+  if (opts.unreadOnly) {
+    params.q = "is:unread";
+  }
+  const allIds = [];
+  let pageToken;
+  do {
+    const res = await gmail.users.messages.list({ ...params, pageToken });
+    if (res.data.messages) allIds.push(...res.data.messages);
+    pageToken = res.data.nextPageToken ?? void 0;
+  } while (pageToken && allIds.length < (opts.skip ?? 0) + limit);
+  const skip = opts.skip ?? 0;
+  const pageIds = allIds.slice(skip, skip + limit);
+  const hasMore = skip + limit < allIds.length;
+  if (pageIds.length === 0) {
+    return { items: [], hasMore };
+  }
+  const items = await pool(pageIds, 10, async (entry) => {
+    const msgId = entry.id ?? "";
+    const msgRes = await gmail.users.messages.get({
+      userId: "me",
+      id: msgId,
+      format: "metadata",
+      metadataHeaders: ["From", "Subject", "To", "Date"]
+    });
+    const msg = msgRes.data;
+    return mapSummary3(msgId, msg.payload?.headers ?? [], {
+      labelIds: msg.labelIds,
+      internalDate: msg.internalDate
+    });
+  });
+  return { items, hasMore };
+}
+async function searchEmails2(clients, account, query, opts) {
+  const { gmail } = clients.get(account);
+  const limit = clampLimit3(opts.limit, 25, 100);
+  const res = await gmail.users.messages.list({
+    userId: "me",
+    q: query,
+    maxResults: limit
+  });
+  const ids = res.data.messages ?? [];
+  if (ids.length === 0) return [];
+  const items = await pool(ids, 10, async (entry) => {
+    const msgId = entry.id ?? "";
+    const msgRes = await gmail.users.messages.get({
+      userId: "me",
+      id: msgId,
+      format: "metadata",
+      metadataHeaders: ["From", "Subject", "To", "Date"]
+    });
+    const msg = msgRes.data;
+    return mapSummary3(msgId, msg.payload?.headers ?? [], {
+      labelIds: msg.labelIds,
+      internalDate: msg.internalDate
+    });
+  });
+  return items;
+}
+async function readEmail2(clients, account, id) {
+  const { gmail } = clients.get(account);
+  const res = await gmail.users.messages.get({
+    userId: "me",
+    id,
+    format: "full"
+  });
+  const msg = res.data;
+  if (!msg) throw new Error(`message not found: ${id}`);
+  const headers = msg.payload?.headers ?? [];
+  const { bodyText, bodyHtml, attachments } = parsePayload(msg.payload ?? {});
+  const summary = mapSummary3(id, headers, {
+    labelIds: msg.labelIds,
+    internalDate: msg.internalDate
+  });
   return {
-    name: r.emailAddress?.name,
-    address: r.emailAddress?.address ?? ""
+    ...summary,
+    cc: mapHeaderAddr(findHeader(headers, "Cc")),
+    bcc: mapHeaderAddr(findHeader(headers, "Bcc")),
+    bodyText,
+    bodyHtml,
+    attachments: attachments.length > 0 ? attachments : void 0,
+    hasAttachments: attachments.length > 0
   };
 }
-function mapSummary(m, folder) {
+async function readAttachment2(clients, account, messageId, attachmentId) {
+  const { gmail } = clients.get(account);
+  const msgRes = await gmail.users.messages.get({
+    userId: "me",
+    id: messageId,
+    format: "full"
+  });
+  const { attachments } = parsePayload(msgRes.data.payload ?? {});
+  const match = attachments.find((a) => a.id === attachmentId);
+  const name = match?.name ?? "attachment";
+  const contentType = match?.contentType;
+  const attRes = await gmail.users.messages.attachments.get({
+    userId: "me",
+    messageId,
+    id: attachmentId
+  });
+  const data = attRes.data.data;
+  if (!data) throw new Error("attachment data is empty");
+  const buf = Buffer.from(
+    data.replace(/-/g, "+").replace(/_/g, "/"),
+    "base64"
+  );
+  const outPath = pathJoin3(tmpdir3(), name);
+  writeFileSync2(outPath, buf);
+  return { name, contentType, path: outPath };
+}
+async function listFolders2(clients, account, _opts) {
+  const { gmail } = clients.get(account);
+  const res = await gmail.users.labels.list({ userId: "me" });
+  const labels = res.data.labels ?? [];
+  return labels.map(mapFolder2);
+}
+
+// src/providers/gmail/write-ops.ts
+import { randomUUID as randomUUID4 } from "crypto";
+import { Buffer as Buffer2 } from "buffer";
+import MailComposer3 from "nodemailer/lib/mail-composer/index.js";
+async function sendEmail2(clients, account, msg) {
+  const { gmail } = clients.get(account);
+  let threadId;
+  let rawBody;
+  if (msg.forwardMessageId) {
+    const fwdRes = await gmail.users.messages.get({
+      userId: "me",
+      id: msg.forwardMessageId,
+      format: "raw"
+    });
+    threadId = fwdRes.data.threadId ?? void 0;
+    const fwdRaw = fwdRes.data.raw;
+    if (fwdRaw) {
+      const fwdStr = Buffer2.from(
+        fwdRaw.replace(/-/g, "+").replace(/_/g, "/"),
+        "base64"
+      ).toString("utf-8");
+      const divider = '\n\n<div style="line-height:12px"><br></div>\n\n<div style="border-left:2px solid #ccc; padding-left:8px; margin-left:0; color:#666">\n---------- Forwarded message ---------<br>' + fwdStr + "\n</div>";
+      const combinedMsg = { ...msg, body: msg.body + divider };
+      rawBody = await buildRawMessage2(account, combinedMsg);
+    } else {
+      rawBody = await buildRawMessage2(account, msg);
+    }
+  } else {
+    rawBody = await buildRawMessage2(account, msg);
+    if (msg.inReplyTo) {
+      try {
+        const refRes = await gmail.users.messages.get({
+          userId: "me",
+          id: msg.inReplyTo,
+          format: "minimal"
+        });
+        threadId = refRes.data.threadId ?? void 0;
+      } catch {
+      }
+    }
+  }
+  const sendRes = await gmail.users.messages.send({
+    userId: "me",
+    requestBody: {
+      raw: rawBody.raw,
+      threadId
+    }
+  });
+  return { id: sendRes.data.id ?? "" };
+}
+async function saveDraft2(clients, account, msg) {
+  const { gmail } = clients.get(account);
+  const { raw } = await buildRawMessage2(account, msg);
+  let threadId;
+  if (msg.inReplyTo) {
+    try {
+      const refRes = await gmail.users.messages.get({
+        userId: "me",
+        id: msg.inReplyTo,
+        format: "minimal"
+      });
+      threadId = refRes.data.threadId ?? void 0;
+    } catch {
+    }
+  }
+  const draftRes = await gmail.users.drafts.create({
+    userId: "me",
+    requestBody: {
+      message: { raw, threadId }
+    }
+  });
+  return { id: draftRes.data.message?.id ?? draftRes.data.id ?? "" };
+}
+async function updateDraft2(clients, account, id, update) {
+  const { gmail } = clients.get(account);
+  const draftRes = await gmail.users.drafts.get({
+    userId: "me",
+    id,
+    format: "raw"
+  });
+  const existingMessage = draftRes.data.message;
+  if (!existingMessage?.raw) {
+    throw new Error(`draft not found: ${id}`);
+  }
+  const existingHeaders = existingMessage.payload?.headers ?? [];
+  const origSubject = findHeader(existingHeaders, "Subject") ?? "";
+  const rawStr = Buffer2.from(
+    existingMessage.raw.replace(/-/g, "+").replace(/_/g, "/"),
+    "base64"
+  ).toString("utf-8");
+  const existingTo = update.to ?? mapHeaderAddr(findHeader(existingHeaders, "To"));
+  const existingCc = update.cc ?? mapHeaderAddr(findHeader(existingHeaders, "Cc"));
+  const existingBcc = update.bcc ?? mapHeaderAddr(findHeader(existingHeaders, "Bcc"));
+  const { raw } = await buildRawMessage2(account, {
+    to: existingTo,
+    subject: update.subject ?? origSubject,
+    body: update.body ?? "",
+    isHtml: update.isHtml,
+    cc: existingCc.length > 0 ? existingCc : void 0,
+    bcc: existingBcc.length > 0 ? existingBcc : void 0
+  });
+  const updated = await gmail.users.drafts.update({
+    userId: "me",
+    id,
+    requestBody: {
+      message: {
+        raw,
+        threadId: existingMessage.threadId ?? void 0
+      }
+    }
+  });
+  return { id: updated.data.message?.id ?? updated.data.id ?? id };
+}
+async function moveEmail2(clients, account, id, destinationId) {
+  const { gmail } = clients.get(account);
+  const { addLabelIds, removeLabelIds } = resolveLabelsForMove(destinationId);
+  await gmail.users.messages.modify({
+    userId: "me",
+    id,
+    requestBody: { addLabelIds, removeLabelIds }
+  });
+}
+async function sendDraft2(clients, account, id) {
+  const { gmail } = clients.get(account);
+  const res = await gmail.users.drafts.send({
+    userId: "me",
+    requestBody: { id }
+  });
+  return { id: res.data.id ?? id };
+}
+async function addAttachmentToDraft2(clients, account, draftId, name, contentBytes, contentType) {
+  const { gmail } = clients.get(account);
+  const draftRes = await gmail.users.drafts.get({
+    userId: "me",
+    id: draftId,
+    format: "raw"
+  });
+  const existingMessage = draftRes.data.message;
+  if (!existingMessage?.raw) {
+    throw new Error(`draft not found: ${draftId}`);
+  }
+  const rawStr = Buffer2.from(
+    existingMessage.raw.replace(/-/g, "+").replace(/_/g, "/"),
+    "base64"
+  ).toString("utf-8");
+  const newRawStr = await new Promise((resolve, reject) => {
+    const mc = new MailComposer3({
+      raw: rawStr,
+      attachments: [
+        {
+          filename: name,
+          content: Buffer2.from(contentBytes, "base64"),
+          contentType: contentType ?? "application/octet-stream"
+        }
+      ]
+    });
+    mc.compile().build((err, buf) => {
+      if (err) reject(err);
+      else resolve(buf.toString("utf-8"));
+    });
+  });
+  const updated = await gmail.users.drafts.update({
+    userId: "me",
+    id: draftId,
+    requestBody: {
+      message: {
+        raw: base64urlEncode(Buffer2.from(newRawStr, "utf-8")),
+        threadId: existingMessage.threadId ?? void 0
+      }
+    }
+  });
   return {
-    id: m.id,
-    subject: m.subject ?? "",
-    from: m.from ? mapRecipient(m.from) : void 0,
-    to: (m.toRecipients ?? []).map(mapRecipient),
-    receivedAt: m.receivedDateTime,
-    preview: m.bodyPreview,
-    isRead: m.isRead,
-    hasAttachments: m.hasAttachments,
-    folder
+    id: updated.data.message?.id ?? updated.data.id ?? draftId,
+    attachment: {
+      id: randomUUID4(),
+      name,
+      contentType: contentType ?? "application/octet-stream"
+    }
   };
 }
-function toRecipient(a) {
-  return { emailAddress: { name: a.name, address: a.address } };
+async function markRead2(clients, account, id, isRead) {
+  const { gmail } = clients.get(account);
+  await gmail.users.messages.modify({
+    userId: "me",
+    id,
+    requestBody: {
+      removeLabelIds: isRead ? ["UNREAD"] : void 0,
+      addLabelIds: isRead ? void 0 : ["UNREAD"]
+    }
+  });
 }
-function clampLimit(v, dflt, max) {
-  if (!v || v <= 0) return dflt;
-  return Math.min(v, max);
+async function createFolder2(clients, account, input) {
+  const { gmail } = clients.get(account);
+  const created = await gmail.users.labels.create({
+    userId: "me",
+    requestBody: {
+      name: input.displayName,
+      messageListVisibility: "show",
+      labelListVisibility: "labelShow"
+    }
+  });
+  return mapFolder2(created.data);
+}
+async function renameFolder2(clients, account, folderId, newName) {
+  const { gmail } = clients.get(account);
+  const updated = await gmail.users.labels.patch({
+    userId: "me",
+    id: folderId,
+    requestBody: { name: newName }
+  });
+  return mapFolder2(updated.data);
+}
+async function deleteFolder2(clients, account, folderId) {
+  const { gmail } = clients.get(account);
+  await gmail.users.labels.delete({
+    userId: "me",
+    id: folderId
+  });
 }
 
-// src/providers/imap/index.ts
-var NOT_IMPLEMENTED = "IMAP provider is not yet implemented in v1. Tracked at src/providers/imap/index.ts \u2014 see src/providers/types.ts for the contract.";
-var ImapProvider = class {
-  id = "imap";
-  // eslint-disable-next-line @typescript-eslint/no-unused-vars
-  async addAccount(_input) {
-    throw new Error(NOT_IMPLEMENTED);
+// src/providers/gmail/index.ts
+var GmailProvider = class {
+  constructor(opts) {
+    this.opts = opts;
+    this.clientId = opts.clientId;
+    this.clientSecret = opts.clientSecret;
+    this.clients = new GmailClientFactory(
+      opts.store,
+      opts.clientId,
+      opts.clientSecret
+    );
   }
-  // eslint-disable-next-line @typescript-eslint/no-unused-vars
-  async completeAddAccount(_handle) {
-    return { status: "error", error: NOT_IMPLEMENTED };
+  opts;
+  id = "gmail";
+  clients;
+  pending = /* @__PURE__ */ new Map();
+  clientId;
+  clientSecret;
+  // ── account lifecycle ──
+  async addAccount(input) {
+    const begin = beginDeviceCode2(
+      void 0,
+      this.clientId,
+      this.clientSecret
+    );
+    await awaitDeviceCodeReady2(begin);
+    const handle = randomUUID5();
+    const flow = {
+      begin,
+      emailHint: input.email,
+      startedAt: Date.now(),
+      settled: "pending"
+    };
+    this.pending.set(handle, flow);
+    begin.result.then(async ({ tokens, email }) => {
+      const resolvedEmail = (email || input.email || "").toLowerCase();
+      if (!resolvedEmail) {
+        flow.settled = "error";
+        flow.error = "no email returned from Google account";
+        return;
+      }
+      const rec = {
+        email: resolvedEmail,
+        provider: "gmail",
+        displayName: resolvedEmail,
+        tokens,
+        addedAt: (/* @__PURE__ */ new Date()).toISOString()
+      };
+      const saved = await this.opts.store.upsertAccount(rec);
+      flow.account = saved;
+      flow.settled = "ready";
+    }).catch((err) => {
+      flow.settled = "error";
+      flow.error = err instanceof Error ? err.message : String(err);
+    });
+    return {
+      status: "pending",
+      handle,
+      verification: {
+        userCode: begin.userCode,
+        verificationUri: begin.verificationUri,
+        expiresAt: begin.expiresAt,
+        message: begin.message
+      }
+    };
+  }
+  async completeAddAccount(handle) {
+    const flow = this.pending.get(handle);
+    if (!flow) return { status: "error", error: "unknown handle" };
+    if (Date.now() - flow.startedAt > 20 * 6e4 && flow.settled === "pending") {
+      flow.settled = "expired";
+      flow.begin.cancel();
+    }
+    if (flow.settled === "ready" && flow.account) {
+      this.pending.delete(handle);
+      return { status: "ready", account: flow.account };
+    }
+    if (flow.settled === "error") {
+      this.pending.delete(handle);
+      return { status: "error", error: flow.error ?? "unknown error" };
+    }
+    if (flow.settled === "expired") {
+      this.pending.delete(handle);
+      return { status: "expired" };
+    }
+    return { status: "pending" };
   }
-  async listEmails(_account, _opts) {
-    throw new Error(NOT_IMPLEMENTED);
+  // ── browse ──
+  async listEmails(account, opts) {
+    return listEmails2(this.clients, account, opts);
   }
-  async searchEmails(_account, _query, _opts) {
-    throw new Error(NOT_IMPLEMENTED);
+  async searchEmails(account, query, opts) {
+    return searchEmails2(this.clients, account, query, opts);
   }
-  async readEmail(_account, _id) {
-    throw new Error(NOT_IMPLEMENTED);
+  async readEmail(account, id) {
+    return readEmail2(this.clients, account, id);
   }
-  async readAttachment(_account, _messageId, _attachmentId) {
-    throw new Error(NOT_IMPLEMENTED);
+  async readAttachment(account, messageId, attachmentId) {
+    return readAttachment2(this.clients, account, messageId, attachmentId);
   }
-  async sendEmail(_account, _msg) {
-    throw new Error(NOT_IMPLEMENTED);
+  // ── compose ──
+  async sendEmail(account, msg) {
+    return sendEmail2(this.clients, account, msg);
   }
-  async saveDraft(_account, _msg) {
-    throw new Error(NOT_IMPLEMENTED);
+  async saveDraft(account, msg) {
+    return saveDraft2(this.clients, account, msg);
   }
-  async updateDraft(_account, _id, _update) {
-    throw new Error(NOT_IMPLEMENTED);
+  async updateDraft(account, id, update) {
+    return updateDraft2(this.clients, account, id, update);
   }
-  async moveEmail(_account, _id, _destinationId) {
-    throw new Error(NOT_IMPLEMENTED);
+  async moveEmail(account, id, destinationId) {
+    return moveEmail2(this.clients, account, id, destinationId);
   }
-  // eslint-disable-next-line @typescript-eslint/no-unused-vars
-  async sendDraft(_account, _id) {
-    throw new Error(NOT_IMPLEMENTED);
+  async sendDraft(account, id) {
+    return sendDraft2(this.clients, account, id);
   }
-  // eslint-disable-next-line @typescript-eslint/no-unused-vars
-  async addAttachmentToDraft(_account, _draftId, _name, _contentBytes, _contentType) {
-    throw new Error(NOT_IMPLEMENTED);
+  async addAttachmentToDraft(account, draftId, name, contentBytes, contentType) {
+    return addAttachmentToDraft2(
+      this.clients,
+      account,
+      draftId,
+      name,
+      contentBytes,
+      contentType
+    );
   }
-  async markRead(_account, _id, _isRead) {
-    throw new Error(NOT_IMPLEMENTED);
+  // ── organize ──
+  async markRead(account, id, isRead) {
+    return markRead2(this.clients, account, id, isRead);
   }
-  async listFolders(_account, _opts) {
-    throw new Error(NOT_IMPLEMENTED);
+  // ── folders ──
+  async listFolders(account, opts) {
+    return listFolders2(this.clients, account, opts);
   }
-  async createFolder(_account, _input) {
-    throw new Error(NOT_IMPLEMENTED);
+  async createFolder(account, input) {
+    return createFolder2(this.clients, account, input);
   }
-  async renameFolder(_account, _folderId, _newName) {
-    throw new Error(NOT_IMPLEMENTED);
+  async renameFolder(account, folderId, newName) {
+    return renameFolder2(this.clients, account, folderId, newName);
   }
-  async deleteFolder(_account, _folderId) {
-    throw new Error(NOT_IMPLEMENTED);
+  async deleteFolder(account, folderId) {
+    return deleteFolder2(this.clients, account, folderId);
   }
 };
 
@@ -854,7 +2429,13 @@ function buildRegistry(opts) {
     clientId: outlookCfg?.clientId,
     tenantId: outlookCfg?.tenantId
   }));
-  providers.set("imap", new ImapProvider());
+  providers.set("imap", new ImapProvider(opts.store));
+  const gmailCfg = opts.providers?.gmail;
+  providers.set("gmail", new GmailProvider({
+    store: opts.store,
+    clientId: gmailCfg?.clientId,
+    clientSecret: gmailCfg?.clientSecret
+  }));
   function get(id) {
     const p = providers.get(id);
     if (!p) throw new Error(`unknown provider: ${id}`);
@@ -897,6 +2478,7 @@ function errMsg(err) {
   if (err instanceof Error) return err.message;
   return String(err);
 }
+var providerIdEnum = z.enum(["outlook", "imap", "gmail"]);
 var emailAddrSchema = z.object({
   address: z.string().email(),
   name: z.string().optional()
@@ -907,12 +2489,26 @@ var emailAddrOutputSchema = z.object({
 });
 var accountSummaryOutputSchema = z.object({
   email: z.string(),
-  provider: z.enum(["outlook", "imap", "gmail"]),
+  provider: providerIdEnum,
   displayName: z.string().optional(),
   addedAt: z.string(),
   hasSignature: z.boolean(),
   hasStyle: z.boolean()
 });
+var styleOutputSchema = z.object({
+  fontFamily: z.string().optional(),
+  fontSize: z.string().optional(),
+  fontColor: z.string().optional()
+});
+var accountFullOutputSchema = z.object({
+  email: z.string(),
+  provider: providerIdEnum,
+  displayName: z.string().optional(),
+  tokens: z.record(z.string(), z.unknown()),
+  addedAt: z.string(),
+  signature: z.string().optional(),
+  style: styleOutputSchema.optional()
+});
 var emailSummaryOutputSchema = z.object({
   id: z.string(),
   subject: z.string(),
@@ -930,11 +2526,6 @@ var attachmentMetaOutputSchema = z.object({
   contentType: z.string().optional(),
   size: z.number().optional()
 });
-var styleOutputSchema = z.object({
-  fontFamily: z.string().optional(),
-  fontSize: z.string().optional(),
-  fontColor: z.string().optional()
-});
 var folderInfoOutputSchema = z.object({
   id: z.string(),
   displayName: z.string(),
@@ -987,15 +2578,15 @@ function shouldRegister(name, tools) {
 import { z as z2 } from "zod";
 function registerAccountTools(server, ctx) {
   const { store, registry, tools } = ctx;
-  const listAccountsOutputSchema = {
+  const listAccountsOutputSchema = z2.object({
     accounts: z2.array(accountSummaryOutputSchema)
-  };
+  });
   if (shouldRegister("list_accounts", tools)) {
     server.registerTool(
       "list_accounts",
       {
         description: "List all email accounts known to this server (no secrets). Use the returned `email` value as the `account` argument to other tools.",
-        inputSchema: {},
+        inputSchema: z2.object({}),
         outputSchema: listAccountsOutputSchema
       },
       async () => {
@@ -1012,44 +2603,31 @@ function registerAccountTools(server, ctx) {
       }
     );
   }
-  const addAccountOutputSchema = z2.discriminatedUnion("status", [
-    z2.object({
-      status: z2.literal("pending"),
-      handle: z2.string(),
-      verification: z2.object({
-        userCode: z2.string(),
-        verificationUri: z2.string(),
-        expiresAt: z2.string(),
-        message: z2.string()
-      })
-    }),
-    z2.object({
-      status: z2.literal("ready"),
-      account: z2.object({
-        email: z2.string(),
-        provider: z2.enum(["outlook", "imap", "gmail"]),
-        displayName: z2.string().optional(),
-        tokens: z2.record(z2.unknown()),
-        addedAt: z2.string(),
-        signature: z2.string().optional(),
-        style: styleOutputSchema.optional()
-      })
-    })
-  ]);
+  const addAccountOutputSchema = z2.object({
+    status: z2.enum(["pending", "ready"]),
+    handle: z2.string().optional(),
+    verification: z2.object({
+      userCode: z2.string(),
+      verificationUri: z2.string(),
+      expiresAt: z2.string(),
+      message: z2.string()
+    }).optional(),
+    account: accountFullOutputSchema.optional()
+  });
   if (shouldRegister("add_account", tools)) {
     server.registerTool(
       "add_account",
       {
         description: "Start adding an email account. For Outlook this returns a device code the user must enter at the verification URL; then call `complete_add_account` with the returned `handle` to finalize. Disabled in --read-only mode.",
-        inputSchema: {
-          provider: z2.enum(["outlook", "imap", "gmail"]).describe("Email backend. v1 only fully implements 'outlook'."),
+        inputSchema: z2.object({
+          provider: providerIdEnum.describe("Email backend. 'outlook' (Microsoft Graph) and 'imap' are fully implemented."),
           email: z2.string().email().optional().describe(
             "Optional hint \u2014 the provider will verify it against the auth result."
           ),
-          config: z2.record(z2.unknown()).optional().describe(
+          config: z2.record(z2.string(), z2.unknown()).optional().describe(
             "Provider-specific config (e.g. IMAP host/port). Unused for Outlook."
           )
-        },
+        }),
         outputSchema: addAccountOutputSchema
       },
       async (args) => {
@@ -1068,15 +2646,7 @@ function registerAccountTools(server, ctx) {
   }
   const completeAddAccountOutputSchema = z2.object({
     status: z2.enum(["pending", "ready", "expired", "error"]),
-    account: z2.object({
-      email: z2.string(),
-      provider: z2.enum(["outlook", "imap", "gmail"]),
-      displayName: z2.string().optional(),
-      tokens: z2.record(z2.unknown()),
-      addedAt: z2.string(),
-      signature: z2.string().optional(),
-      style: styleOutputSchema.optional()
-    }).optional(),
+    account: accountFullOutputSchema.optional(),
     error: z2.string().optional()
   });
   if (shouldRegister("complete_add_account", tools)) {
@@ -1084,10 +2654,10 @@ function registerAccountTools(server, ctx) {
       "complete_add_account",
       {
         description: "Poll/finalize a pending add_account flow. Returns `pending` until the user completes the device-code step, then `ready` with the persisted account.",
-        inputSchema: {
-          provider: z2.enum(["outlook", "imap", "gmail"]),
+        inputSchema: z2.object({
+          provider: providerIdEnum,
           handle: z2.string().min(1)
-        },
+        }),
         outputSchema: completeAddAccountOutputSchema
       },
       async (args) => {
@@ -1106,16 +2676,16 @@ function registerAccountTools(server, ctx) {
       }
     );
   }
-  const accountSettingsOutputSchema = {
+  const accountSettingsOutputSchema = z2.object({
     signature: z2.string().nullable(),
     style: styleOutputSchema.nullable()
-  };
+  });
   if (shouldRegister("get_account_settings", tools)) {
     server.registerTool(
       "get_account_settings",
       {
         description: "Get signature (HTML) and style preferences for an account.",
-        inputSchema: { account: z2.string().email() },
+        inputSchema: z2.object({ account: z2.string().email() }),
         outputSchema: accountSettingsOutputSchema
       },
       async (args) => {
@@ -1139,7 +2709,7 @@ function registerAccountTools(server, ctx) {
       "set_account_settings",
       {
         description: "Set signature (HTML snippet) and/or style preferences for an account. Disabled in --read-only mode.",
-        inputSchema: {
+        inputSchema: z2.object({
           account: z2.string().email(),
           signature: z2.string().optional().describe(
             "HTML snippet \u2014 may contain formatting, images, links. Pass null to clear."
@@ -1151,7 +2721,7 @@ function registerAccountTools(server, ctx) {
           }).optional().describe(
             "Font preferences applied to outgoing HTML emails. Pass null to clear."
           )
-        },
+        }),
         outputSchema: accountSettingsOutputSchema
       },
       async (args) => {
@@ -1175,16 +2745,16 @@ function registerAccountTools(server, ctx) {
       }
     );
   }
-  const removeAccountOutputSchema = {
+  const removeAccountOutputSchema = z2.object({
     removed: z2.boolean(),
     email: z2.string()
-  };
+  });
   if (shouldRegister("remove_account", tools)) {
     server.registerTool(
       "remove_account",
       {
         description: "Forget an account and delete its stored tokens. Disabled in --read-only mode.",
-        inputSchema: { email: z2.string().email() },
+        inputSchema: z2.object({ email: z2.string().email() }),
         outputSchema: removeAccountOutputSchema
       },
       async (args) => {
@@ -1228,25 +2798,30 @@ function selectBody(msg, format) {
 // src/tools/browse.ts
 function registerBrowseTools(server, ctx) {
   const { registry, tools } = ctx;
-  const emailListOutputSchema = {
+  const emailListOutputSchema = z3.object({
     account: z3.string(),
     count: z3.number(),
     items: z3.array(emailSummaryOutputSchema),
     skip: z3.number(),
     hasMore: z3.boolean()
-  };
+  });
+  const searchEmailsOutputSchema = z3.object({
+    account: z3.string(),
+    count: z3.number(),
+    items: z3.array(emailSummaryOutputSchema)
+  });
   if (shouldRegister("list_emails", tools)) {
     server.registerTool(
       "list_emails",
       {
         description: "List recent emails in a folder of the given account. Pass the user's email address as `account`; the server routes to the correct backend automatically.",
-        inputSchema: {
+        inputSchema: z3.object({
           account: z3.string().email(),
           folder: z3.string().default("inbox").optional(),
           limit: z3.number().int().positive().max(100).optional(),
           unreadOnly: z3.boolean().optional(),
           skip: z3.number().int().min(0).optional()
-        },
+        }),
         outputSchema: emailListOutputSchema
       },
       async (args) => {
@@ -1277,12 +2852,12 @@ function registerBrowseTools(server, ctx) {
       "search_emails",
       {
         description: "Search emails by free-text query (KQL on Outlook). Returns lightweight summaries.",
-        inputSchema: {
+        inputSchema: z3.object({
           account: z3.string().email(),
           query: z3.string().min(1),
           limit: z3.number().int().positive().max(100).optional()
-        },
-        outputSchema: emailListOutputSchema
+        }),
+        outputSchema: searchEmailsOutputSchema
       },
       async (args) => {
         try {
@@ -1302,7 +2877,7 @@ function registerBrowseTools(server, ctx) {
       }
     );
   }
-  const readEmailOutputSchema = {
+  const readEmailOutputSchema = z3.object({
     id: z3.string(),
     subject: z3.string(),
     from: emailAddrOutputSchema.optional(),
@@ -1317,19 +2892,19 @@ function registerBrowseTools(server, ctx) {
     attachments: z3.array(attachmentMetaOutputSchema).optional(),
     body: z3.string(),
     bodyFormat: z3.enum(["markdown", "html", "text"])
-  };
+  });
   if (shouldRegister("read_email", tools)) {
     server.registerTool(
       "read_email",
       {
         description: "Fetch a single email with full body and recipients by id. Body is returned as `body` with `bodyFormat` indicating the format. Default format is 'markdown' \u2014 HTML is automatically converted to save context tokens.",
-        inputSchema: {
+        inputSchema: z3.object({
           account: z3.string().email(),
           id: z3.string().min(1),
           format: z3.enum(["markdown", "html", "text"]).default("markdown").optional().describe(
             "Output body format. 'markdown' converts HTML to Markdown (default), 'html' returns the raw HTML, 'text' returns plain text."
           )
-        },
+        }),
         outputSchema: readEmailOutputSchema
       },
       async (args) => {
@@ -1361,21 +2936,21 @@ function registerBrowseTools(server, ctx) {
       }
     );
   }
-  const readAttachmentOutputSchema = {
+  const readAttachmentOutputSchema = z3.object({
     name: z3.string(),
     contentType: z3.string().optional(),
     path: z3.string()
-  };
+  });
   if (shouldRegister("read_attachment", tools)) {
     server.registerTool(
       "read_attachment",
       {
         description: "Download an email attachment to a temporary file and return its path. Use messageId and attachmentId from a prior read_email call.",
-        inputSchema: {
+        inputSchema: z3.object({
           account: z3.string().email(),
           messageId: z3.string().min(1),
           attachmentId: z3.string().min(1)
-        },
+        }),
         outputSchema: readAttachmentOutputSchema
       },
       async (args) => {
@@ -1399,22 +2974,22 @@ function registerBrowseTools(server, ctx) {
 import { z as z4 } from "zod";
 function registerFolderTools(server, ctx) {
   const { registry, tools } = ctx;
-  const listFoldersOutputSchema = {
+  const listFoldersOutputSchema = z4.object({
     account: z4.string(),
     count: z4.number(),
     items: z4.array(folderInfoOutputSchema)
-  };
+  });
   if (shouldRegister("list_folders", tools)) {
     server.registerTool(
       "list_folders",
       {
         description: "List available mail folders. Returns top-level folders by default, or child folders of the given parent when `parentFolderId` is provided.",
-        inputSchema: {
+        inputSchema: z4.object({
           account: z4.string().email(),
           parentFolderId: z4.string().optional().describe(
             "When provided, lists child folders of this folder. When omitted, lists top-level folders (children of the root)."
           )
-        },
+        }),
         outputSchema: listFoldersOutputSchema
       },
       async (args) => {
@@ -1435,22 +3010,22 @@ function registerFolderTools(server, ctx) {
       }
     );
   }
-  const createFolderOutputSchema = {
+  const createFolderOutputSchema = z4.object({
     created: z4.literal(true),
     folder: folderInfoOutputSchema
-  };
+  });
   if (shouldRegister("create_folder", tools)) {
     server.registerTool(
       "create_folder",
       {
         description: "Create a new mail folder. Creates under the root folder by default, or under the specified parent when `parentFolderId` is provided. Disabled in --read-only mode.",
-        inputSchema: {
+        inputSchema: z4.object({
           account: z4.string().email(),
           displayName: z4.string().min(1).describe("Name of the new folder"),
           parentFolderId: z4.string().optional().describe(
             "When provided, creates the folder as a child of this folder. When omitted, creates under the root folder."
           )
-        },
+        }),
         outputSchema: createFolderOutputSchema
       },
       async (args) => {
@@ -1468,19 +3043,19 @@ function registerFolderTools(server, ctx) {
       }
     );
   }
-  const deleteFolderOutputSchema = {
+  const deleteFolderOutputSchema = z4.object({
     deleted: z4.literal(true),
     id: z4.string()
-  };
+  });
   if (shouldRegister("delete_folder", tools)) {
     server.registerTool(
       "delete_folder",
       {
         description: "Delete a mail folder by ID. Disabled in --read-only mode.",
-        inputSchema: {
+        inputSchema: z4.object({
           account: z4.string().email(),
           folderId: z4.string().min(1).describe("ID of the folder to delete")
-        },
+        }),
         outputSchema: deleteFolderOutputSchema
       },
       async (args) => {
@@ -1495,20 +3070,20 @@ function registerFolderTools(server, ctx) {
       }
     );
   }
-  const renameFolderOutputSchema = {
+  const renameFolderOutputSchema = z4.object({
     renamed: z4.literal(true),
     folder: folderInfoOutputSchema
-  };
+  });
   if (shouldRegister("rename_folder", tools)) {
     server.registerTool(
       "rename_folder",
       {
         description: "Rename an existing mail folder. Disabled in --read-only mode.",
-        inputSchema: {
+        inputSchema: z4.object({
           account: z4.string().email(),
           folderId: z4.string().min(1).describe("ID of the folder to rename"),
           newName: z4.string().min(1).describe("New display name for the folder")
-        },
+        }),
         outputSchema: renameFolderOutputSchema
       },
       async (args) => {
@@ -1533,14 +3108,27 @@ function registerFolderTools(server, ctx) {
 import { z as z5 } from "zod";
 function registerOrganizeTools(server, ctx) {
   const { registry, tools } = ctx;
-  const archiveMoveSchema = {
+  async function moveToWellKnown(args, destination, resultKey) {
+    const { provider, account } = registry.resolveByEmail(args.account);
+    await provider.moveEmail(account, args.id, destination);
+    const data = { id: args.id };
+    data[resultKey] = true;
+    return ok(data, data);
+  }
+  async function markReadState(args, isRead) {
+    const { provider, account } = registry.resolveByEmail(args.account);
+    await provider.markRead(account, args.id, isRead);
+    const data = { marked: true, id: args.id, isRead };
+    return ok(data, data);
+  }
+  const archiveMoveSchema = z5.object({
     account: z5.string().email(),
     id: z5.string().min(1).describe("Message ID to move")
-  };
-  const archiveOutputSchema = {
+  });
+  const archiveOutputSchema = z5.object({
     archived: z5.literal(true),
     id: z5.string()
-  };
+  });
   if (shouldRegister("archive_email", tools)) {
     server.registerTool(
       "archive_email",
@@ -1551,20 +3139,17 @@ function registerOrganizeTools(server, ctx) {
       },
       async (args) => {
         try {
-          const { provider, account } = registry.resolveByEmail(args.account);
-          await provider.moveEmail(account, args.id, "archive");
-          const data = { archived: true, id: args.id };
-          return ok(data, data);
+          return await moveToWellKnown(args, "archive", "archived");
         } catch (err) {
           return fail(errMsg(err));
         }
       }
     );
   }
-  const trashOutputSchema = {
+  const trashOutputSchema = z5.object({
     trashed: z5.literal(true),
     id: z5.string()
-  };
+  });
   if (shouldRegister("trash_email", tools)) {
     server.registerTool(
       "trash_email",
@@ -1575,33 +3160,30 @@ function registerOrganizeTools(server, ctx) {
       },
       async (args) => {
         try {
-          const { provider, account } = registry.resolveByEmail(args.account);
-          await provider.moveEmail(account, args.id, "deleteditems");
-          const data = { trashed: true, id: args.id };
-          return ok(data, data);
+          return await moveToWellKnown(args, "deleteditems", "trashed");
         } catch (err) {
           return fail(errMsg(err));
         }
       }
     );
   }
-  const moveEmailOutputSchema = {
+  const moveEmailOutputSchema = z5.object({
     moved: z5.literal(true),
     id: z5.string(),
     destination: z5.string()
-  };
+  });
   if (shouldRegister("move_email", tools)) {
     server.registerTool(
       "move_email",
       {
         description: "Move a message to any folder by well-known name (e.g. 'inbox', 'drafts', 'junkemail', 'sentitems', 'outbox') or custom folder ID. Disabled in --read-only mode.",
-        inputSchema: {
+        inputSchema: z5.object({
           account: z5.string().email(),
           id: z5.string().min(1).describe("Message ID to move"),
           destination: z5.string().min(1).describe(
             "Destination folder \u2014 a well-known folder name ('archive', 'deleteditems', 'inbox', 'drafts', 'junkemail', 'sentitems', 'outbox') or a raw folder ID."
           )
-        },
+        }),
         outputSchema: moveEmailOutputSchema
       },
       async (args) => {
@@ -1620,15 +3202,15 @@ function registerOrganizeTools(server, ctx) {
       }
     );
   }
-  const markReadInputSchema = {
+  const markReadInputSchema = z5.object({
     account: z5.string().email(),
     id: z5.string().min(1).describe("Message ID to mark as read")
-  };
-  const markReadOutputSchema = {
+  });
+  const markReadOutputSchema = z5.object({
     marked: z5.literal(true),
     id: z5.string(),
     isRead: z5.boolean()
-  };
+  });
   if (shouldRegister("mark_read", tools)) {
     server.registerTool(
       "mark_read",
@@ -1639,14 +3221,7 @@ function registerOrganizeTools(server, ctx) {
       },
       async (args) => {
         try {
-          const { provider, account } = registry.resolveByEmail(args.account);
-          await provider.markRead(account, args.id, true);
-          const data = {
-            marked: true,
-            id: args.id,
-            isRead: true
-          };
-          return ok(data, data);
+          return await markReadState(args, true);
         } catch (err) {
           return fail(errMsg(err));
         }
@@ -1663,14 +3238,7 @@ function registerOrganizeTools(server, ctx) {
       },
       async (args) => {
         try {
-          const { provider, account } = registry.resolveByEmail(args.account);
-          await provider.markRead(account, args.id, false);
-          const data = {
-            marked: true,
-            id: args.id,
-            isRead: false
-          };
-          return ok(data, data);
+          return await markReadState(args, false);
         } catch (err) {
           return fail(errMsg(err));
         }
@@ -1933,14 +3501,14 @@ function registerComposeTools(server, ctx) {
 function registerTools(server, opts) {
   const { store, registry, tools } = opts;
   registerAccountTools(server, { store, registry, tools });
-  registerBrowseTools(server, { store, registry, tools });
+  registerBrowseTools(server, { registry, tools });
   registerFolderTools(server, { registry, tools });
   registerOrganizeTools(server, { registry, tools });
   registerComposeTools(server, { store, registry, tools });
 }
 
 // src/version.ts
-var VERSION = "0.3.0";
+var VERSION = "0.4.1";
 
 // src/config.ts
 import { readFileSync } from "fs";
@@ -1958,8 +3526,13 @@ var outlookProviderSchema = z7.object({
   clientId: z7.string().optional(),
   tenantId: z7.string().optional()
 });
+var gmailProviderSchema = z7.object({
+  clientId: z7.string().optional(),
+  clientSecret: z7.string().optional()
+});
 var providersConfigSchema = z7.object({
-  outlook: outlookProviderSchema.optional()
+  outlook: outlookProviderSchema.optional(),
+  gmail: gmailProviderSchema.optional()
 });
 var rawConfigSchema = z7.object({
   dataDir: z7.string().optional(),
@@ -2101,7 +3674,7 @@ async function startHttp(server, host, port) {
       let transport = sessionId ? sessions.get(sessionId) : void 0;
       if (!transport) {
         transport = new StreamableHTTPServerTransport({
-          sessionIdGenerator: () => randomUUID2(),
+          sessionIdGenerator: () => randomUUID6(),
           onsessioninitialized: (sid) => {
             sessions.set(sid, transport);
           }
@@ -2193,7 +3766,8 @@ Example hypermail-config.json:
     "http": { "enabled": false },
     "tools": { "disabled": ["send_email"] },
     "providers": {
-      "outlook": { "clientId": "\${MS_CLIENT_ID}", "tenantId": "\${MS_TENANT_ID}" }
+      "outlook": { "clientId": "\${MS_CLIENT_ID}", "tenantId": "\${MS_TENANT_ID}" },
+      "gmail": { "clientId": "\${GOOGLE_CLIENT_ID}", "clientSecret": "\${GOOGLE_CLIENT_SECRET}" }
     }
   }
 `;