Read any mailbox: Microsoft 365, and IMAP with CalDAV, behind one reader

[byw1]

Mail and calendar were Google-only. Now a person can connect Google, Microsoft 365 / Outlook.com, or any provider that speaks IMAP and CalDAV — and more than one, since a work Outlook and a personal Gmail are both where recruiters write. Slack and Discord sit on the account picker as coming soon.

What changed

• GoogleAccount → LinkedAccount. A provider column (GOOGLE, MICROSOFT, IMAP), provider-neutral features ("mail", "calendar") replacing Google's scope URLs, IMAP and CalDAV fields on the same row, and unique on (userId, provider, email) so several accounts fit. The migration renames rather than recreates, so a Google connection from the previous release survives with its scopes rewritten.
• One interface, three protocols. src/lib/accounts/types.ts defines MailReader and CalendarReader. google.ts (moved from google-api.ts), microsoft.ts (Graph), imap.ts (imapflow + mailparser) and caldav.ts (tsdav + ical.js) implement them; nothing else in the app knows which answered. There is no write in the interface, so no provider can grow one.
• Merged reads. src/lib/data/accounts.ts replaces data/google.ts: every thread and event says which account it came from, thread ids are scoped to their account, one account failing is a line in warnings rather than an empty result, and Microsoft's rotated refresh tokens are kept.
• Microsoft 365 connects through an Entra app registration set under Admin → Configuration → Accounts (new settings group, with the redirect URI and steps shown on the screen). New OAuth start and callback routes, signed state cookie like Google's.
• IMAP + CalDAV connects from a form with presets for Fastmail, iCloud and Yahoo, using an app password. Both servers are logged in to before anything is saved. Hosts are checked: loopback, link-local (cloud metadata) and multicast targets are refused after resolving the name; a server on a home LAN is allowed on purpose.
• Tools made provider-neutral: list_linked_accounts, connect_imap_account, test_linked_account, disconnect_account, plus list_correspondence / search_email / get_email_thread / search_calendar with an optional accountId. Admin: admin_get_microsoft_config, admin_set_microsoft_config. get_google_connection and disconnect_google are gone; the briefing and every description say "Settings → Connections".
• Connections tab gets account tiles per connected account, an account slide-over (test each half, rename, reconnect, disconnect), an add-account picker, and the IMAP form.
• The schedule merge moved to src/lib/data/schedule.ts so pipeline.ts, which client components import for constants, no longer reaches the Node-only mail libraries; those are server externals in next.config.ts.

Deliberately not

No SMTP. The app never sends on anyone's behalf; read-only is what makes handing over an inbox safe, and sending is a product decision to make on purpose rather than a side effect of "support IMAP".

Verification

npm run typecheck and npm run build pass; node tools/gen-tool-docs.mjs --check is current (106 tools for a member, 138 for an admin). The migration matches prisma migrate diff output for the schema. A tenant-isolation audit of the data layer, providers, tools, actions and OAuth routes found no violations. The ical.js calls in the CalDAV reader were exercised against a sample calendar with a weekly recurrence. Not exercised end to end here: no database or provider credentials in the build container, so the first real connect of each kind on an instance is the test.

Docs

docs/tools/accounts.mdx replaces google.mdx; new docs/self-hosting/microsoft.mdx; the inbox-and-calendar guide, the Google self-hosting page, README and the decision log are updated.

🤖 Generated with Claude Code

https://claude.ai/code/session_01JBeuHate5rfgqAkLcHzJww

---

Generated by Claude Code