wizards 0.1.9

package/apps/runtime/dist/connectors/imap.js

@@ -0,0 +1,217 @@
+import { ImapFlow } from "imapflow";
+import { htmlToMarkdown } from "../render/convert.js";
+import { assertPublicUrl } from "../tools/net-guard.js";
+import { dayAfter, mailActions, snippetOf, } from "./mail.js";
+const KNOWN_HOSTS = {
+    "gmail.com": "imap.gmail.com",
+    "googlemail.com": "imap.gmail.com",
+    "outlook.com": "outlook.office365.com",
+    "hotmail.com": "outlook.office365.com",
+    "live.com": "outlook.office365.com",
+    "icloud.com": "imap.mail.me.com",
+    "me.com": "imap.mail.me.com",
+    "yahoo.com": "imap.mail.yahoo.com",
+    "gmx.at": "imap.gmx.net",
+    "gmx.de": "imap.gmx.net",
+    "gmx.net": "imap.gmx.net",
+    "web.de": "imap.web.de",
+    "a1.net": "securemail.a1.net",
+    "fastmail.com": "imap.fastmail.com",
+};
+const ALLOW_PRIVATE = process.env.ALLOW_PRIVATE_FETCH === "1";
+async function open(credentials) {
+    const email = credentials.email.trim();
+    const domain = email.split("@")[1]?.toLowerCase() ?? "";
+    const host = credentials.host?.trim() || KNOWN_HOSTS[domain] || `imap.${domain}`;
+    const port = Number(credentials.port) || 993;
+    if (!ALLOW_PRIVATE && port !== 993 && port !== 143) {
+        throw new Error("IMAP runs on port 993 (or 143).");
+    }
+    // The host is typed by the person: it must be a public mail server, never this server's network.
+    await assertPublicUrl(`https://${host}`);
+    const client = new ImapFlow({
+        host,
+        port,
+        secure: port === 993,
+        auth: { user: email, pass: credentials.password },
+        logger: false,
+        socketTimeout: 60_000,
+    });
+    // A dropped connection must not take the process down.
+    client.on("error", () => undefined);
+    await client.connect();
+    return client;
+}
+/** Runs `use` on the mailbox that holds everything ("All Mail" where the server has one). */
+async function withMailbox(ctx, use) {
+    const client = await open(JSON.parse(ctx.accessToken));
+    try {
+        const boxes = await client.list();
+        const all = boxes.find((b) => b.specialUse === "\\All");
+        const lock = await client.getMailboxLock(all?.path ?? "INBOX", { readOnly: true });
+        try {
+            return await use(client);
+        }
+        finally {
+            lock.release();
+        }
+    }
+    finally {
+        await client.logout().catch(() => undefined);
+    }
+}
+function parts(node, out) {
+    if (!node) {
+        return out;
+    }
+    const name = node.dispositionParameters?.filename ?? node.parameters?.name;
+    const part = node.part ?? "1";
+    if (node.childNodes?.length) {
+        for (const child of node.childNodes) {
+            parts(child, out);
+        }
+    }
+    else if (node.disposition === "attachment" || (name && !node.type.startsWith("text/"))) {
+        out.attachments.push({
+            id: part,
+            name: name ?? `attachment-${part}`,
+            mime: node.type,
+            size: node.size ?? null,
+        });
+    }
+    else if (node.type === "text/plain" && !out.plain) {
+        out.plain = part;
+    }
+    else if (node.type === "text/html" && !out.html) {
+        out.html = part;
+    }
+    return out;
+}
+const emptyParts = () => ({ attachments: [], plain: null, html: null });
+function sender(from) {
+    const f = from?.[0];
+    return f?.address ? (f.name ? `${f.name} <${f.address}>` : f.address) : null;
+}
+async function bytes(client, uid, part) {
+    const { content } = await client.download(uid, part, { uid: true });
+    if (!content) {
+        throw new Error("The mail is no longer there.");
+    }
+    const chunks = [];
+    for await (const chunk of content) {
+        chunks.push(Buffer.from(chunk));
+    }
+    return Buffer.concat(chunks);
+}
+const backend = {
+    search: (input, ctx) => withMailbox(ctx, async (client) => {
+        const query = {};
+        if (input.since) {
+            query.since = input.since;
+        }
+        if (input.until) {
+            query.before = dayAfter(input.until);
+        }
+        if (input.from) {
+            query.from = input.from;
+        }
+        const terms = input.terms ?? [];
+        if (terms.length === 1) {
+            query.text = terms[0];
+        }
+        else if (terms.length > 1) {
+            query.or = terms.map((text) => ({ text }));
+        }
+        if (!Object.keys(query).length) {
+            query.all = true;
+        }
+        const found = (await client.search(query, { uid: true })) || [];
+        const limit = input.limit ?? 40;
+        // Without the attachment filter the newest `limit` are enough; with it, look further back.
+        const uids = found.slice(-(input.has_attachment ? limit * 4 : limit));
+        if (!uids.length) {
+            return [];
+        }
+        const messages = await client.fetchAll(uids, { envelope: true, bodyStructure: true, internalDate: true }, { uid: true });
+        return messages
+            .map((m) => ({
+            id: String(m.uid),
+            date: m.internalDate ? new Date(m.internalDate).toISOString() : null,
+            from: sender(m.envelope?.from),
+            subject: m.envelope?.subject ?? null,
+            snippet: "",
+            attachments: parts(m.bodyStructure, emptyParts()).attachments,
+        }))
+            .filter((m) => !input.has_attachment || m.attachments.length > 0)
+            .reverse()
+            .slice(0, limit);
+    }),
+    read: (id, ctx) => withMailbox(ctx, async (client) => {
+        const m = await client.fetchOne(id, { envelope: true, bodyStructure: true, internalDate: true }, { uid: true });
+        if (!m) {
+            throw new Error("The mail is no longer there.");
+        }
+        const found = parts(m.bodyStructure, emptyParts());
+        const html = found.html ? (await bytes(client, id, found.html)).toString("utf8") : null;
+        const text = found.plain
+            ? (await bytes(client, id, found.plain)).toString("utf8")
+            : html
+                ? htmlToMarkdown(html)
+                : "";
+        return {
+            id,
+            date: m.internalDate ? new Date(m.internalDate).toISOString() : null,
+            from: sender(m.envelope?.from),
+            to: (m.envelope?.to ?? []).map((t) => t.address ?? "").filter(Boolean),
+            subject: m.envelope?.subject ?? null,
+            snippet: snippetOf(text),
+            attachments: found.attachments,
+            text,
+            html,
+        };
+    }),
+    attachment: (id, attachmentId, ctx) => withMailbox(ctx, async (client) => {
+        const m = await client.fetchOne(id, { bodyStructure: true }, { uid: true });
+        const info = m
+            ? parts(m.bodyStructure, emptyParts()).attachments.find((a) => a.id === attachmentId)
+            : undefined;
+        if (!info) {
+            throw new Error("The mail has no such attachment.");
+        }
+        return {
+            name: info.name,
+            mime: info.mime,
+            data_base64: (await bytes(client, id, attachmentId)).toString("base64"),
+        };
+    }),
+};
+export const imapConnector = {
+    id: "imap",
+    moduleId: "wizards-mail",
+    name: "IMAP",
+    description: "Read mail in any mailbox over IMAP (GMX, iCloud, your own domain …).",
+    icon: "mail",
+    toolPrefix: "mail",
+    auth: {
+        kind: "api_key",
+        apiKey: {
+            fields: [
+                { key: "email", label: "E-Mail-Adresse", placeholder: "name@firma.at" },
+                { key: "password", label: "Passwort oder App-Passwort", secret: true },
+                {
+                    key: "host",
+                    label: "IMAP-Server",
+                    placeholder: "leer lassen bei Gmail, GMX, iCloud …",
+                    required: false,
+                },
+                { key: "port", label: "Port", placeholder: "993", required: false },
+            ],
+            verify: async (credentials) => {
+                const client = await open(credentials);
+                await client.logout().catch(() => undefined);
+                return { label: credentials.email.trim(), externalId: credentials.email.trim() };
+            },
+        },
+    },
+    actions: mailActions(backend, []),
+};

package/apps/runtime/dist/connectors/index.js

@@ -0,0 +1,266 @@
+import { eq } from "drizzle-orm";
+import { db, schema } from "../db/client.js";
+import { buildAuthorizationUrl, createOAuth2Pkce, exchangeAuthorizationCode, refreshAccessToken, } from "../engenty/connections-sdk/oauth2.js";
+import { scopesForGroups, } from "../engenty/connections-sdk/types.js";
+import { env } from "../env.js";
+import { seal, unseal } from "../secrets/crypto.js";
+import { deleteSecret, getSecret, putSecret } from "../store/index.js";
+import { connectorFetch, MAIL_CONNECTORS, resolveEnv, usable } from "./builtin.js";
+import { resolveConnector } from "./external.js";
+/** The connectors a person can pick for each kind of connection. */
+const CONNECTORS = { mail: MAIL_CONNECTORS };
+const HINTS = {
+    imap: "Bei Gmail, iCloud, GMX und web.de brauchst du ein App-Passwort (in den Sicherheitseinstellungen deines Kontos), nicht dein normales Passwort.",
+};
+/**
+ * What a connection asks the provider for: what reading needs, plus what each action the wizard
+ * may use needs. A wizard that only reads never asks for the right to send or delete.
+ */
+function scopesFor(connection, connector) {
+    const scopes = new Set(scopesForGroups(connector, new Set(["read"])));
+    for (const action of connector.actions) {
+        if (connection.actions?.includes(action.id)) {
+            for (const scope of action.providerScopes ?? []) {
+                scopes.add(scope);
+            }
+        }
+    }
+    return [...scopes];
+}
+/** Where the provider sends the person back; must be registered with the OAuth client. */
+export function connectRedirectUri() {
+    return env.connectRedirectUrl || `${env.appUrl}/api/connect/callback`;
+}
+const slot = (connectionId) => `connection:${connectionId}`;
+/** A connector that needs no credential: there is nothing for the person to connect. */
+const open = (connector) => connector.auth.kind === "api_key" && connector.auth.apiKey.fields.length === 0;
+/** The connectors behind a connection: the built-in ones of its kind, or the one it names. */
+async function candidates(connection, projectId) {
+    if (connection.connector) {
+        const found = await resolveConnector(projectId, connection.connector);
+        return found ? [found.connector] : [];
+    }
+    return connection.kind ? CONNECTORS[connection.kind] : [];
+}
+export async function connectorOptions(connection, projectId) {
+    const out = [];
+    for (const c of await candidates(connection, projectId)) {
+        if (!(await usable(c))) {
+            continue;
+        }
+        out.push(c.auth.kind === "api_key"
+            ? {
+                id: c.id,
+                name: c.name,
+                auth: "api_key",
+                fields: c.auth.apiKey.fields,
+                hint: HINTS[c.id],
+            }
+            : { id: c.id, name: c.name, auth: "oauth2" });
+    }
+    return out;
+}
+async function connectorFor(connection, connectorId, projectId) {
+    const connector = (await candidates(connection, projectId)).find((c) => c.id === connectorId);
+    if (!connector) {
+        throw new Error(`Unknown connector "${connectorId}".`);
+    }
+    return connector;
+}
+export async function connectionViews(connections, scope, projectId) {
+    return Promise.all(connections.map(async (c) => {
+        const stored = await getSecret(scope, slot(c.id));
+        const only = c.connector ? (await candidates(c, projectId))[0] : undefined;
+        return {
+            id: c.id,
+            kind: c.kind ?? null,
+            connector: c.connector ?? null,
+            title: c.title ?? only?.name ?? null,
+            description: c.description ?? null,
+            account: stored
+                ? {
+                    connector: stored.provider,
+                    label: stored.label,
+                    connectedAt: stored.createdAt.toISOString(),
+                }
+                : only && open(only)
+                    ? { connector: only.id, label: only.name, connectedAt: new Date(0).toISOString() }
+                    : null,
+            connectors: await connectorOptions(c, projectId),
+        };
+    }));
+}
+export async function startOAuth(scope, projectId, runId, connection, connectorId) {
+    const connector = await connectorFor(connection, connectorId, projectId);
+    if (connector.auth.kind !== "oauth2") {
+        throw new Error(`${connector.name} is not connected by signing in.`);
+    }
+    // Servers that hand out OAuth clients on request (most MCP servers): get one on first use.
+    await connector.auth.oauth2.registerClient?.();
+    const pkce = createOAuth2Pkce();
+    const state = {
+        scope,
+        projectId,
+        runId,
+        connectionId: connection.id,
+        connectorId,
+        verifier: pkce.codeVerifier,
+        exp: Date.now() + 15 * 60_000,
+    };
+    return buildAuthorizationUrl({
+        connector,
+        pkce,
+        redirectUri: connectRedirectUri(),
+        scopes: scopesFor(connection, connector),
+        state: seal(state),
+        resolveEnv,
+    });
+}
+/** The run an OAuth callback belongs to; its tenant is looked up before the state is used. */
+export function oauthStateRun(rawState) {
+    return unseal(rawState)?.runId ?? null;
+}
+export async function finishOAuth(code, rawState) {
+    const state = unseal(rawState);
+    if (!state || state.exp < Date.now()) {
+        throw new Error("Die Anmeldung ist abgelaufen. Bitte noch einmal verbinden.");
+    }
+    const run = await db.query.run.findFirst({ where: eq(schema.run.id, state.runId) });
+    const connection = run?.definition.connections?.find((c) => c.id === state.connectionId);
+    if (!connection) {
+        throw new Error("The run this sign-in belongs to is gone.");
+    }
+    const connector = await connectorFor(connection, state.connectorId, state.projectId);
+    if (connector.auth.kind !== "oauth2") {
+        throw new Error("not an oauth connector");
+    }
+    const tokens = await exchangeAuthorizationCode({
+        code,
+        codeVerifier: state.verifier,
+        config: connector.auth.oauth2,
+        redirectUri: connectRedirectUri(),
+        resolveEnv,
+    });
+    // A provider that will not name the account still connected it.
+    const account = (await connector.auth.oauth2
+        .resolveAccount?.(tokens.accessToken, fetch)
+        .catch(() => null)) ?? { label: connector.name };
+    const stored = {
+        accessToken: tokens.accessToken,
+        refreshToken: tokens.refreshToken,
+        expiresAt: tokens.expiresAt?.toISOString() ?? null,
+        scopes: tokens.grantedScopes,
+    };
+    await putSecret(state.scope, slot(connection.id), connector.id, account.label, stored);
+    return state;
+}
+/** Connects an `api_key` connector with what the person typed; the connector checks it first. */
+export async function connectWithCredentials(scope, projectId, connection, connectorId, values) {
+    const connector = await connectorFor(connection, connectorId, projectId);
+    if (connector.auth.kind !== "api_key") {
+        throw new Error(`${connector.name} is connected by signing in.`);
+    }
+    const credentials = {};
+    for (const field of connector.auth.apiKey.fields) {
+        const value = String(values[field.key] ?? "").trim();
+        if (!value && field.required !== false) {
+            throw new ConnectError(`„${field.label}“ fehlt.`);
+        }
+        if (value) {
+            credentials[field.key] = value.slice(0, 500);
+        }
+    }
+    let account;
+    try {
+        account = await connector.auth.apiKey.verify(credentials, connectorFetch);
+    }
+    catch (err) {
+        throw new ConnectError(connectFailure(err));
+    }
+    const stored = {
+        accessToken: JSON.stringify(credentials),
+        refreshToken: null,
+        expiresAt: null,
+        scopes: [],
+    };
+    await putSecret(scope, slot(connection.id), connector.id, account.label, stored);
+    return account.label;
+}
+/** A connect attempt the person can fix (wrong password, unknown server). */
+export class ConnectError extends Error {
+}
+function connectFailure(err) {
+    const e = err;
+    if (e.authenticationFailed) {
+        return "Anmeldung abgelehnt. Stimmen Adresse und (App-)Passwort?";
+    }
+    if (e.code === "ENOTFOUND" || e.code === "ECONNREFUSED" || e.code === "ETIMEDOUT") {
+        return "Der Mail-Server ist nicht erreichbar. Bitte den IMAP-Server prüfen.";
+    }
+    return `Verbinden hat nicht geklappt: ${String(e.message ?? err).slice(0, 200)}`;
+}
+export function disconnect(scope, connectionId) {
+    return deleteSecret(scope, slot(connectionId));
+}
+// --- using ---------------------------------------------------------------------
+/**
+ * The connector and the context its actions run with, for a connection the person has
+ * connected — with a fresh access token. `null` when nothing is connected.
+ */
+export async function connectionContext(scope, connection, projectId) {
+    const stored = await getSecret(scope, slot(connection.id));
+    if (!stored) {
+        const only = connection.connector ? (await candidates(connection, projectId))[0] : undefined;
+        return only && open(only)
+            ? { connector: only, label: only.name, ctx: actionContext(scope, connection, only, "{}", []) }
+            : null;
+    }
+    const connector = await connectorFor(connection, stored.provider, projectId);
+    let data = stored.data;
+    const expires = data.expiresAt ? Date.parse(data.expiresAt) : null;
+    if (connector.auth.kind === "oauth2" &&
+        data.refreshToken &&
+        expires !== null &&
+        expires - Date.now() < 5 * 60_000) {
+        const tokens = await refreshAccessToken({
+            config: connector.auth.oauth2,
+            refreshToken: data.refreshToken,
+            resolveEnv,
+        });
+        data = {
+            accessToken: tokens.accessToken,
+            refreshToken: tokens.refreshToken ?? data.refreshToken,
+            expiresAt: tokens.expiresAt?.toISOString() ?? null,
+            scopes: tokens.grantedScopes.length ? tokens.grantedScopes : data.scopes,
+        };
+        await putSecret(scope, slot(connection.id), connector.id, stored.label, data);
+    }
+    return {
+        connector,
+        label: stored.label,
+        ctx: actionContext(scope, connection, connector, data.accessToken, data.scopes, stored),
+    };
+}
+function actionContext(scope, connection, connector, accessToken, scopes, stored) {
+    return {
+        accessToken,
+        fetchImpl: connectorFetch,
+        log: () => undefined,
+        connection: {
+            id: connection.id,
+            connector_id: connector.id,
+            auth_kind: connector.auth.kind,
+            autonomous_mode: "read_only",
+            connected_by: null,
+            created_at: (stored?.createdAt ?? new Date()).toISOString(),
+            display_name: stored?.label ?? connector.name,
+            error_message: null,
+            external_account: stored?.label ?? null,
+            granted_scopes: scopes,
+            owner_user_id: null,
+            space_id: null,
+            status: "active",
+            tenant_id: scope.wizardId,
+        },
+    };
+}

package/apps/runtime/dist/connectors/mail.js

@@ -0,0 +1,72 @@
+import { z } from "zod";
+/**
+ * Mail as wizards use it: read-only, and the same three actions whichever provider the person
+ * connected. Every mail connector is an engenty `ConnectorDefinition` whose actions are these.
+ */
+export const mailSearchInput = z.object({
+    terms: z
+        .array(z.string().min(1))
+        .max(12)
+        .optional()
+        .describe("Words to look for in subject and body; a mail matches when ANY of them occurs."),
+    from: z.string().optional().describe("Sender address or domain, e.g. billing@notion.so"),
+    since: z.string().optional().describe("First day, YYYY-MM-DD (inclusive)."),
+    until: z.string().optional().describe("Last day, YYYY-MM-DD (inclusive)."),
+    has_attachment: z.boolean().optional(),
+    limit: z.number().int().min(1).max(100).optional().describe("Newest first; default 40."),
+});
+export const mailReadInput = z.object({ id: z.string() });
+export const mailAttachmentInput = z.object({ id: z.string(), attachment_id: z.string() });
+export function mailActions(backend, providerScopes) {
+    return [
+        {
+            id: "search",
+            group: "read",
+            summary: "Search the mailbox",
+            description: "Search the mailbox, newest first. Returns id, date, sender, subject, a snippet and the attachments of each mail.",
+            inputSchema: mailSearchInput,
+            providerScopes,
+            handler: async (input, ctx) => ({
+                mails: await backend.search(mailSearchInput.parse(input), ctx),
+            }),
+        },
+        {
+            id: "read",
+            group: "read",
+            summary: "Read one mail",
+            description: "Read one mail in full: sender, recipients, text and attachments.",
+            inputSchema: mailReadInput,
+            providerScopes,
+            handler: (input, ctx) => backend.read(mailReadInput.parse(input).id, ctx),
+        },
+        {
+            id: "get_attachment",
+            group: "read",
+            summary: "Fetch an attachment",
+            description: "Fetch one attachment's bytes (base64).",
+            inputSchema: mailAttachmentInput,
+            providerScopes,
+            handler: (input, ctx) => {
+                const { id, attachment_id } = mailAttachmentInput.parse(input);
+                return backend.attachment(id, attachment_id, ctx);
+            },
+        },
+    ];
+}
+/** Calls one of a mail connector's actions. */
+export async function mailAction(connector, actionId, input, ctx) {
+    const action = connector.actions.find((a) => a.id === actionId);
+    if (!action) {
+        throw new Error(`${connector.name} has no action "${actionId}".`);
+    }
+    return (await action.handler(input, ctx));
+}
+export function snippetOf(text, length = 240) {
+    return text.replace(/\s+/g, " ").trim().slice(0, length);
+}
+/** The day after a YYYY-MM-DD date — for providers whose "before" is exclusive. */
+export function dayAfter(day) {
+    const d = new Date(`${day}T00:00:00Z`);
+    d.setUTCDate(d.getUTCDate() + 1);
+    return d.toISOString().slice(0, 10);
+}

package/apps/runtime/dist/connectors/outlook.js

@@ -0,0 +1,90 @@
+import { bodyToText, graphJson, MICROSOFT_OAUTH2 } from "../engenty/connections-microsoft/graph.js";
+import { mailActions, snippetOf, } from "./mail.js";
+const SCOPE_READ = "Mail.Read";
+const address = (a) => {
+    const e = a?.emailAddress;
+    return e?.address ? (e.name ? `${e.name} <${e.address}>` : e.address) : null;
+};
+/** KQL, the language of Graph's `$search` on messages. */
+function kql(input) {
+    const quote = (t) => `"${t.replace(/["\\]/g, "")}"`;
+    const parts = [
+        input.terms?.length ? `(${input.terms.map(quote).join(" OR ")})` : "",
+        input.from ? `from:${quote(input.from)}` : "",
+        input.since || input.until
+            ? `received:${input.since ?? "1990-01-01"}..${input.until ?? "2999-12-31"}`
+            : "",
+        input.has_attachment ? "hasAttachments:true" : "",
+    ].filter(Boolean);
+    return parts.join(" AND ");
+}
+async function attachmentsOf(ctx, id) {
+    const data = await graphJson(ctx, `/me/messages/${encodeURIComponent(id)}/attachments?$select=id,name,contentType,size,isInline`);
+    return (data.value ?? [])
+        .filter((a) => !a.isInline)
+        .map((a) => ({
+        id: a.id,
+        name: a.name ?? "attachment",
+        mime: a.contentType ?? "application/octet-stream",
+        size: a.size ?? null,
+    }));
+}
+const SELECT = "id,subject,bodyPreview,receivedDateTime,hasAttachments,from";
+const backend = {
+    async search(input, ctx) {
+        const params = new URLSearchParams({ $select: SELECT, $top: String(input.limit ?? 40) });
+        const search = kql(input);
+        if (search) {
+            params.set("$search", `"${search.replace(/"/g, '\\"')}"`);
+        }
+        else {
+            params.set("$orderby", "receivedDateTime desc");
+        }
+        const data = await graphJson(ctx, `/me/messages?${params}`);
+        const messages = data.value ?? [];
+        return Promise.all(messages.map(async (m) => ({
+            id: m.id,
+            date: m.receivedDateTime ?? null,
+            from: address(m.from),
+            subject: m.subject ?? null,
+            snippet: snippetOf(m.bodyPreview ?? ""),
+            attachments: m.hasAttachments ? await attachmentsOf(ctx, m.id) : [],
+        })));
+    },
+    async read(id, ctx) {
+        const m = await graphJson(ctx, `/me/messages/${encodeURIComponent(id)}?$select=${SELECT},toRecipients,body`);
+        const text = bodyToText(m.body);
+        return {
+            id: m.id,
+            date: m.receivedDateTime ?? null,
+            from: address(m.from),
+            to: (m.toRecipients ?? []).map(address).filter((a) => Boolean(a)),
+            subject: m.subject ?? null,
+            snippet: snippetOf(m.bodyPreview ?? text),
+            attachments: m.hasAttachments ? await attachmentsOf(ctx, m.id) : [],
+            text,
+            html: m.body?.contentType?.toLowerCase() === "html" ? (m.body.content ?? null) : null,
+        };
+    },
+    async attachment(id, attachmentId, ctx) {
+        const a = await graphJson(ctx, `/me/messages/${encodeURIComponent(id)}/attachments/${encodeURIComponent(attachmentId)}`);
+        if (!a.contentBytes) {
+            throw new Error("This attachment is not a file.");
+        }
+        return {
+            name: a.name ?? "attachment",
+            mime: a.contentType ?? "application/octet-stream",
+            data_base64: a.contentBytes,
+        };
+    },
+};
+export const outlookConnector = {
+    id: "mail-outlook",
+    moduleId: "wizards-mail",
+    name: "Outlook",
+    description: "Read mail in an Outlook or Microsoft 365 account.",
+    icon: "logo:outlook",
+    toolPrefix: "mail",
+    auth: { kind: "oauth2", oauth2: MICROSOFT_OAUTH2 },
+    actions: mailActions(backend, [SCOPE_READ]),
+};