@aitne/daemon 0.1.6 → 0.1.8

package/dist/api/routes/mail/_pa_wip_mail/validators.js

@@ -0,0 +1,131 @@
+export function parseIntParam(raw, fallback, bounds) {
+    if (!raw)
+        return fallback;
+    const n = Number.parseInt(raw, 10);
+    if (!Number.isFinite(n))
+        return fallback;
+    return Math.max(bounds.min, Math.min(bounds.max, n));
+}
+export function toStringArray(value) {
+    if (value === undefined)
+        return [];
+    if (!Array.isArray(value))
+        return null;
+    if (value.every((v) => typeof v === "string"))
+        return value;
+    return null;
+}
+export function validateSendInput(body) {
+    const raw = body;
+    const to = toStringArray(raw?.to);
+    if (!to || to.length === 0) {
+        return {
+            ok: false,
+            code: "invalid_body",
+            message: "to: non-empty string[] required",
+        };
+    }
+    if (typeof raw.subject !== "string") {
+        return {
+            ok: false,
+            code: "invalid_body",
+            message: "subject: string required",
+        };
+    }
+    const cc = raw.cc === undefined ? undefined : toStringArray(raw.cc);
+    const bcc = raw.bcc === undefined ? undefined : toStringArray(raw.bcc);
+    if (cc === null || bcc === null) {
+        return {
+            ok: false,
+            code: "invalid_body",
+            message: "cc/bcc must be string[] when present",
+        };
+    }
+    const reply = parseReplyContext(raw.reply);
+    if (reply === "invalid") {
+        return {
+            ok: false,
+            code: "invalid_body",
+            message: "reply requires inReplyToRfc822Id (string) and references (string[])",
+        };
+    }
+    return {
+        ok: true,
+        value: {
+            to,
+            cc,
+            bcc,
+            subject: raw.subject,
+            textBody: typeof raw.textBody === "string" ? raw.textBody : undefined,
+            htmlBody: typeof raw.htmlBody === "string" ? raw.htmlBody : undefined,
+            reply,
+            // `draftOnly` is intentionally NOT surfaced at the route boundary.
+            // Drafts go through POST /mail/:id/drafts (Autonomous tier); sends
+            // go through POST /mail/:id/messages/send (Notify tier). Body flags
+            // cannot be classified by the path-prefix risk classifier.
+        },
+    };
+}
+function parseReplyContext(raw) {
+    if (raw === undefined || raw === null)
+        return undefined;
+    if (typeof raw !== "object")
+        return "invalid";
+    const r = raw;
+    if (typeof r.inReplyToRfc822Id !== "string")
+        return "invalid";
+    const refs = toStringArray(r.references);
+    if (!refs)
+        return "invalid";
+    return {
+        inReplyToRfc822Id: r.inReplyToRfc822Id,
+        references: refs,
+        providerThreadId: typeof r.providerThreadId === "string" ? r.providerThreadId : undefined,
+        parentProviderMsgId: typeof r.parentProviderMsgId === "string"
+            ? r.parentProviderMsgId
+            : undefined,
+    };
+}
+export function validateUpdateDraftInput(body) {
+    const raw = body;
+    const to = raw.to === undefined ? undefined : toStringArray(raw.to);
+    const cc = raw.cc === undefined ? undefined : toStringArray(raw.cc);
+    const bcc = raw.bcc === undefined ? undefined : toStringArray(raw.bcc);
+    if (to === null || cc === null || bcc === null) {
+        return {
+            ok: false,
+            code: "invalid_body",
+            message: "to/cc/bcc must be string[] when present",
+        };
+    }
+    // `reply` tri-state: undefined = leave existing threading; null = clear;
+    // object = reshape (must include inReplyToRfc822Id + references).
+    let reply;
+    if (raw.reply === null) {
+        reply = null;
+    }
+    else if (raw.reply !== undefined) {
+        const parsed = parseReplyContext(raw.reply);
+        if (parsed === "invalid") {
+            return {
+                ok: false,
+                code: "invalid_body",
+                message: "reply requires inReplyToRfc822Id (string) and references (string[]); pass null to clear",
+            };
+        }
+        reply = parsed;
+    }
+    return {
+        ok: true,
+        value: {
+            to,
+            cc,
+            bcc,
+            subject: typeof raw.subject === "string" ? raw.subject : undefined,
+            textBody: typeof raw.textBody === "string" ? raw.textBody : undefined,
+            htmlBody: typeof raw.htmlBody === "string" ? raw.htmlBody : undefined,
+            reply,
+        },
+    };
+}
+//# sourceMappingURL=validators.js.map

package/dist/api/routes/mail/_pa_wip_mail/validators.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validators.js","sourceRoot":"","sources":["../../../../../src/api/routes/mail/_pa_wip_mail/validators.ts"],"names":[],"mappings":"AAKA,MAAM,UAAU,aAAa,CAC3B,GAAuB,EACvB,QAAgB,EAChB,MAAoC;IAEpC,IAAI,CAAC,GAAG;QAAE,OAAO,QAAQ,CAAC;IAC1B,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACnC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,QAAQ,CAAC;IACzC,OAAO,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACnC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;QAAE,OAAO,KAAiB,CAAC;IACxE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,IAAa;IAEb,MAAM,GAAG,GAAG,IAA8D,CAAC;IAC3E,MAAM,EAAE,GAAG,aAAa,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAClC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE,iCAAiC;SAC3C,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QACpC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE,0BAA0B;SACpC,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,GAAG,GAAG,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACpE,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACvE,IAAI,EAAE,KAAK,IAAI,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QAChC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE,sCAAsC;SAChD,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE,qEAAqE;SAC/E,CAAC;IACJ,CAAC;IACD,OAAO;QACL,EAAE,EAAE,IAAI;QACR,KAAK,EAAE;YACL,EAAE;YACF,EAAE;YACF,GAAG;YACH,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,QAAQ,EAAE,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;YACrE,QAAQ,EAAE,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;YACrE,KAAK;YACL,mEAAmE;YACnE,mEAAmE;YACnE,oEAAoE;YACpE,2DAA2D;SAC5D;KACF,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CACxB,GAAY;IAEZ,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACxD,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC9C,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,IAAI,OAAO,CAAC,CAAC,iBAAiB,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC9D,MAAM,IAAI,GAAG,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IACzC,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,OAAO;QACL,iBAAiB,EAAE,CAAC,CAAC,iBAAiB;QACtC,UAAU,EAAE,IAAI;QAChB,gBAAgB,EACd,OAAO,CAAC,CAAC,gBAAgB,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS;QACzE,mBAAmB,EACjB,OAAO,CAAC,CAAC,mBAAmB,KAAK,QAAQ;YACvC,CAAC,CAAC,CAAC,CAAC,mBAAmB;YACvB,CAAC,CAAC,SAAS;KAChB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,IAAa;IAIb,MAAM,GAAG,GAAG,IAAuD,CAAC;IACpE,MAAM,EAAE,GAAG,GAAG,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACpE,MAAM,EAAE,GAAG,GAAG,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACpE,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACvE,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,IAAI,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QAC/C,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE,yCAAyC;SACnD,CAAC;IACJ,CAAC;IACD,yEAAyE;IACzE,kEAAkE;IAClE,IAAI,KAAgC,CAAC;IACrC,IAAI,GAAG,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;QACvB,KAAK,GAAG,IAAI,CAAC;IACf,CAAC;SAAM,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC5C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,cAAc;gBACpB,OAAO,EACL,yFAAyF;aAC5F,CAAC;QACJ,CAAC;QACD,KAAK,GAAG,MAAM,CAAC;IACjB,CAAC;IACD,OAAO;QACL,EAAE,EAAE,IAAI;QACR,KAAK,EAAE;YACL,EAAE;YACF,EAAE;YACF,GAAG;YACH,OAAO,EAAE,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;YAClE,QAAQ,EAAE,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;YACrE,QAAQ,EAAE,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;YACrE,KAAK;SACN;KACF,CAAC;AACJ,CAAC"}

package/dist/api/routes/mail/accounts.d.ts

@@ -0,0 +1,4 @@
+import type { Hono } from "hono";
+import type { MailRouteDependencies } from "./dependencies.js";
+export declare function registerAccountsRoutes(app: Hono, deps: MailRouteDependencies): void;
+//# sourceMappingURL=accounts.d.ts.map

package/dist/api/routes/mail/accounts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"accounts.d.ts","sourceRoot":"","sources":["../../../../src/api/routes/mail/accounts.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAajC,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAI/D,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,IAAI,EACT,IAAI,EAAE,qBAAqB,GAC1B,IAAI,CAySN"}

package/dist/api/routes/mail/accounts.js

@@ -0,0 +1,289 @@
+import { streamSSE } from "hono/streaming";
+import { createLogger } from "../../../logging.js";
+import { readJsonBody } from "../../json-body.js";
+import { composeIssue, respondWithAgentError } from "../../helpers/agent-errors.js";
+import { loadOutlookClientConfig } from "../../../services/mail/outlook/client-config.js";
+import { runLoopbackOAuth, OAuthLoopbackError, OAuthLoopbackTimeoutError, } from "../../../services/mail/outlook/oauth-loopback.js";
+import { runDeviceCodeOAuth } from "../../../services/mail/outlook/oauth-device-code.js";
+import { DuplicateAccountError } from "../../../services/mail/account-registry.js";
+const logger = createLogger("mail-api");
+export function registerAccountsRoutes(app, deps) {
+    // GET /mail/accounts — all configured accounts (dashboard, setup).
+    // GET /mail/accounts?active=1 — scope-gated subset that matches what
+    // `accounts.md` materializes and what the unified poller observes:
+    //   kind ∈ enabledMailProviders ∧ account.active ∧ authStatus === "healthy".
+    // Skills that need to refresh a stale `accounts.md` MUST pass `?active=1`
+    // — raw listAccounts() includes dormant / unhealthy rows and will mislead
+    // the agent into picking an id that every operation will 4xx on.
+    app.get("/mail/accounts", (c) => {
+        const registry = deps.services.mail;
+        if (!registry) {
+            return c.json({ accounts: [] });
+        }
+        const activeOnly = c.req.query("active") === "1";
+        const accounts = activeOnly
+            ? registry.listActiveAccounts()
+            : registry.listAccounts();
+        return c.json({ accounts });
+    });
+    // POST /mail/accounts blocks for the duration of the loopback PKCE flow —
+    // up to OAuthLoopbackTimeoutError's 5-minute cap (see oauth-loopback.ts).
+    // Dashboard clients MUST configure a long fetch timeout for this route.
+    // Headless environments (SSH, WSL) should use /mail/accounts/device-code.
+    app.post("/mail/accounts", async (c) => {
+        const registry = deps.services.mail;
+        if (!registry) {
+            return respondWithAgentError(c, 503, [
+                composeIssue("mail.not_configured", {
+                    field: "services.mail",
+                    received: "<unavailable>",
+                }),
+            ]);
+        }
+        if (!deps.blobStore) {
+            return respondWithAgentError(c, 503, [
+                composeIssue("mail.blob_store_unavailable", {
+                    field: "deps.blobStore",
+                    received: "<unavailable>",
+                }),
+            ]);
+        }
+        const parsedBody = await readJsonBody(c);
+        if (!parsedBody.ok)
+            return parsedBody.response;
+        const body = parsedBody.body;
+        if (body?.kind === "gmail") {
+            // The primary Gmail mailbox now participates in the unified mail
+            // surface via the shared Google OAuth credentials from
+            // /config/google-auth. Additional Gmail accounts still need a
+            // per-account Google OAuth credential store and are intentionally
+            // not wired up yet.
+            return respondWithAgentError(c, 501, [
+                composeIssue("mail.not_implemented", {
+                    field: "kind",
+                    received: "gmail",
+                    hint: "Additional Gmail accounts are not implemented yet. The primary Gmail identity is configured through /config/google-auth and is exposed on the unified /mail/* surface automatically.",
+                }),
+            ], {
+                legacyFields: {
+                    message: "Additional Gmail accounts are not implemented yet. The primary Gmail identity is configured through /config/google-auth and is exposed on the unified /mail/* surface automatically.",
+                },
+            });
+        }
+        if (body?.kind !== "outlook") {
+            return respondWithAgentError(c, 400, [
+                composeIssue("mail.unsupported_kind", {
+                    field: "kind",
+                    received: body?.kind ?? "<missing>",
+                    hint: "Only outlook is supported on this endpoint. Yahoo/iCloud use POST /config/mail/app-password. The primary Gmail account uses /config/google-auth; extra Gmail accounts are not implemented.",
+                }),
+            ], {
+                legacyFields: {
+                    message: "Only outlook is supported on this endpoint. Yahoo/iCloud use POST /config/mail/app-password. The primary Gmail account uses /config/google-auth; extra Gmail accounts are not implemented.",
+                },
+            });
+        }
+        // §UI v2 auth-then-enable: registration is allowed regardless of
+        // enabledMailProviders. The provider becomes live only when the user
+        // toggles "Enable" on the dashboard mail card.
+        const clientConfig = await loadOutlookClientConfig(deps.blobStore);
+        if (!clientConfig) {
+            return respondWithAgentError(c, 412, [
+                composeIssue("mail.outlook_client_config_missing", {
+                    field: "outlookClientConfig",
+                    received: "<unset>",
+                }),
+            ], { legacyFields: { message: "PUT /api/config/mail/outlook/client-config first." } });
+        }
+        let oauthResult;
+        try {
+            oauthResult = await runLoopbackOAuth({ clientConfig });
+        }
+        catch (err) {
+            if (err instanceof OAuthLoopbackTimeoutError) {
+                return respondWithAgentError(c, 408, [
+                    composeIssue("mail.oauth_timeout", {
+                        field: "outlook.oauth",
+                        received: err.message,
+                    }),
+                ], { legacyFields: { message: err.message } });
+            }
+            if (err instanceof OAuthLoopbackError) {
+                return c.json({ error: err.code, message: err.message }, 400);
+            }
+            logger.error({ err }, "outlook oauth bootstrap failed");
+            return c.json({ error: "oauth_failed", message: err instanceof Error ? err.message : String(err) }, 500);
+        }
+        try {
+            const account = await registry.addAccount({
+                kind: "outlook",
+                email: oauthResult.email,
+                label: typeof body?.label === "string" ? body.label : undefined,
+                authType: "oauth",
+                secretPayload: oauthResult.serializedCache,
+            });
+            return c.json({ status: "completed", account });
+        }
+        catch (err) {
+            if (err instanceof DuplicateAccountError) {
+                return c.json({ error: err.code, message: err.message }, 409);
+            }
+            logger.error({ err, email: oauthResult.email }, "outlook addAccount failed after OAuth");
+            return c.json({ error: "add_account_failed", message: err instanceof Error ? err.message : String(err) }, 500);
+        }
+    });
+    // Device-code fallback (§B2). Used by headless/SSH environments where the
+    // loopback flow's browser-open would fail. Streams SSE events:
+    //   `prompt`    { userCode, verificationUri, expiresIn, message }
+    //   `completed` { account }
+    //   `failed`    { error, message }
+    //
+    // MSAL's acquireTokenByDeviceCode blocks until the user completes verification
+    // in their browser, so this endpoint may remain open for several minutes.
+    app.post("/mail/accounts/device-code", async (c) => {
+        const registry = deps.services.mail;
+        if (!registry) {
+            return respondWithAgentError(c, 503, [
+                composeIssue("mail.not_configured", {
+                    field: "services.mail",
+                    received: "<unavailable>",
+                }),
+            ]);
+        }
+        if (!deps.blobStore) {
+            return respondWithAgentError(c, 503, [
+                composeIssue("mail.blob_store_unavailable", {
+                    field: "deps.blobStore",
+                    received: "<unavailable>",
+                }),
+            ]);
+        }
+        const parsedBody = await readJsonBody(c);
+        if (!parsedBody.ok)
+            return parsedBody.response;
+        const body = parsedBody.body;
+        if (body?.kind !== "outlook") {
+            return respondWithAgentError(c, 400, [
+                composeIssue("mail.unsupported_kind", {
+                    field: "kind",
+                    received: body?.kind ?? "<missing>",
+                    hint: "Device-code flow is Outlook-only on this endpoint. Use POST /mail/accounts for other providers.",
+                }),
+            ]);
+        }
+        // §UI v2 auth-then-enable: registration allowed regardless of
+        // enabledMailProviders. The Enable toggle on the dashboard mail card
+        // governs whether the agent observes this account.
+        const clientConfig = await loadOutlookClientConfig(deps.blobStore);
+        if (!clientConfig) {
+            return respondWithAgentError(c, 412, [
+                composeIssue("mail.outlook_client_config_missing", {
+                    field: "outlookClientConfig",
+                    received: "<unset>",
+                }),
+            ], { legacyFields: { message: "PUT /api/config/mail/outlook/client-config first." } });
+        }
+        const label = typeof body?.label === "string" ? body.label : undefined;
+        return streamSSE(c, async (stream) => {
+            try {
+                const result = await runDeviceCodeOAuth({
+                    clientConfig,
+                    onPrompt: async (info) => {
+                        await stream.writeSSE({
+                            event: "prompt",
+                            data: JSON.stringify(info),
+                        });
+                    },
+                });
+                try {
+                    const account = await registry.addAccount({
+                        kind: "outlook",
+                        email: result.email,
+                        label,
+                        authType: "oauth",
+                        secretPayload: result.serializedCache,
+                    });
+                    await stream.writeSSE({
+                        event: "completed",
+                        data: JSON.stringify({ account }),
+                    });
+                }
+                catch (err) {
+                    if (err instanceof DuplicateAccountError) {
+                        await stream.writeSSE({
+                            event: "failed",
+                            data: JSON.stringify({ error: err.code, message: err.message }),
+                        });
+                        return;
+                    }
+                    throw err;
+                }
+            }
+            catch (err) {
+                logger.error({ err }, "device-code oauth failed");
+                await stream.writeSSE({
+                    event: "failed",
+                    data: JSON.stringify({
+                        error: "device_code_failed",
+                        message: err instanceof Error ? err.message : String(err),
+                    }),
+                });
+            }
+        });
+    });
+    // Active-toggle for a single account. Distinct from provider-level enable
+    // (§6.0): users can disable one Outlook account while keeping the "Outlook"
+    // provider enabled.
+    app.patch("/mail/accounts/:accountId", async (c) => {
+        const registry = deps.services.mail;
+        if (!registry) {
+            return respondWithAgentError(c, 503, [
+                composeIssue("mail.not_configured", {
+                    field: "services.mail",
+                    received: "<unavailable>",
+                }),
+            ]);
+        }
+        const accountId = c.req.param("accountId");
+        const parsedBody = await readJsonBody(c);
+        if (!parsedBody.ok)
+            return parsedBody.response;
+        const active = parsedBody.body?.active;
+        if (typeof active !== "boolean") {
+            return c.json({ error: "invalid_body", message: "active: boolean required" }, 400);
+        }
+        const updated = await registry.setActive(accountId, active);
+        if (!updated) {
+            return respondWithAgentError(c, 404, [
+                composeIssue("mail.account_not_found", {
+                    field: "accountId",
+                    received: accountId,
+                }),
+            ]);
+        }
+        return c.json({ status: "updated", account: updated });
+    });
+    app.delete("/mail/accounts/:accountId", async (c) => {
+        const registry = deps.services.mail;
+        if (!registry) {
+            return respondWithAgentError(c, 503, [
+                composeIssue("mail.not_configured", {
+                    field: "services.mail",
+                    received: "<unavailable>",
+                }),
+            ]);
+        }
+        const accountId = c.req.param("accountId");
+        const removed = await registry.removeAccount(accountId);
+        if (!removed) {
+            return respondWithAgentError(c, 404, [
+                composeIssue("mail.account_not_found", {
+                    field: "accountId",
+                    received: accountId,
+                }),
+            ]);
+        }
+        return c.json({ status: "removed", accountId });
+    });
+}
+//# sourceMappingURL=accounts.js.map

package/dist/api/routes/mail/accounts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"accounts.js","sourceRoot":"","sources":["../../../../src/api/routes/mail/accounts.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AACpF,OAAO,EAAE,uBAAuB,EAAE,MAAM,iDAAiD,CAAC;AAC1F,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,yBAAyB,GAC1B,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,qDAAqD,CAAC;AACzF,OAAO,EAAE,qBAAqB,EAAE,MAAM,4CAA4C,CAAC;AAGnF,MAAM,MAAM,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;AAExC,MAAM,UAAU,sBAAsB,CACpC,GAAS,EACT,IAA2B;IAE3B,mEAAmE;IACnE,qEAAqE;IACrE,mEAAmE;IACnE,6EAA6E;IAC7E,0EAA0E;IAC1E,0EAA0E;IAC1E,iEAAiE;IACjE,GAAG,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC,EAAE,EAAE;QAC9B,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QACpC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;QAClC,CAAC;QACD,MAAM,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,GAAG,CAAC;QACjD,MAAM,QAAQ,GAAG,UAAU;YACzB,CAAC,CAAC,QAAQ,CAAC,kBAAkB,EAAE;YAC/B,CAAC,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;QAC5B,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,0EAA0E;IAC1E,0EAA0E;IAC1E,wEAAwE;IACxE,0EAA0E;IAC1E,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QACpC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,qBAAqB,CAAC,CAAC,EAAE,GAAG,EAAE;gBACnC,YAAY,CAAC,qBAAqB,EAAE;oBAClC,KAAK,EAAE,eAAe;oBACtB,QAAQ,EAAE,eAAe;iBAC1B,CAAC;aACH,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,OAAO,qBAAqB,CAAC,CAAC,EAAE,GAAG,EAAE;gBACnC,YAAY,CAAC,6BAA6B,EAAE;oBAC1C,KAAK,EAAE,gBAAgB;oBACvB,QAAQ,EAAE,eAAe;iBAC1B,CAAC;aACH,CAAC,CAAC;QACL,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC,CAAC,CAAC,CAAC;QACzC,IAAI,CAAC,UAAU,CAAC,EAAE;YAAE,OAAO,UAAU,CAAC,QAAQ,CAAC;QAC/C,MAAM,IAAI,GAAG,UAAU,CAAC,IAAkD,CAAC;QAC3E,IAAI,IAAI,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;YAC3B,iEAAiE;YACjE,uDAAuD;YACvD,8DAA8D;YAC9D,kEAAkE;YAClE,oBAAoB;YACpB,OAAO,qBAAqB,CAAC,CAAC,EAAE,GAAG,EAAE;gBACnC,YAAY,CAAC,sBAAsB,EAAE;oBACnC,KAAK,EAAE,MAAM;oBACb,QAAQ,EAAE,OAAO;oBACjB,IAAI,EACF,sLAAsL;iBACzL,CAAC;aACH,EAAE;gBACD,YAAY,EAAE;oBACZ,OAAO,EACL,sLAAsL;iBACzL;aACF,CAAC,CAAC;QACL,CAAC;QACD,IAAI,IAAI,EAAE,IAAI,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,qBAAqB,CAAC,CAAC,EAAE,GAAG,EAAE;gBACnC,YAAY,CAAC,uBAAuB,EAAE;oBACpC,KAAK,EAAE,MAAM;oBACb,QAAQ,EAAE,IAAI,EAAE,IAAI,IAAI,WAAW;oBACnC,IAAI,EACF,4LAA4L;iBAC/L,CAAC;aACH,EAAE;gBACD,YAAY,EAAE;oBACZ,OAAO,EACL,4LAA4L;iBAC/L;aACF,CAAC,CAAC;QACL,CAAC;QACD,iEAAiE;QACjE,qEAAqE;QACrE,+CAA+C;QAE/C,MAAM,YAAY,GAAG,MAAM,uBAAuB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACnE,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,qBAAqB,CAAC,CAAC,EAAE,GAAG,EAAE;gBACnC,YAAY,CAAC,oCAAoC,EAAE;oBACjD,KAAK,EAAE,qBAAqB;oBAC5B,QAAQ,EAAE,SAAS;iBACpB,CAAC;aACH,EAAE,EAAE,YAAY,EAAE,EAAE,OAAO,EAAE,mDAAmD,EAAE,EAAE,CAAC,CAAC;QACzF,CAAC;QAED,IAAI,WAAyD,CAAC;QAC9D,IAAI,CAAC;YACH,WAAW,GAAG,MAAM,gBAAgB,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC;QACzD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,yBAAyB,EAAE,CAAC;gBAC7C,OAAO,qBAAqB,CAAC,CAAC,EAAE,GAAG,EAAE;oBACnC,YAAY,CAAC,oBAAoB,EAAE;wBACjC,KAAK,EAAE,eAAe;wBACtB,QAAQ,EAAE,GAAG,CAAC,OAAO;qBACtB,CAAC;iBACH,EAAE,EAAE,YAAY,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YACjD,CAAC;YACD,IAAI,GAAG,YAAY,kBAAkB,EAAE,CAAC;gBACtC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;YAChE,CAAC;YACD,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,gCAAgC,CAAC,CAAC;YACxD,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EACpF,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC;gBACxC,IAAI,EAAE,SAAS;gBACf,KAAK,EAAE,WAAW,CAAC,KAAK;gBACxB,KAAK,EAAE,OAAO,IAAI,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;gBAC/D,QAAQ,EAAE,OAAO;gBACjB,aAAa,EAAE,WAAW,CAAC,eAAe;aAC3C,CAAC,CAAC;YACH,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,qBAAqB,EAAE,CAAC;gBACzC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;YAChE,CAAC;YACD,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,EAAE,uCAAuC,CAAC,CAAC;YACzF,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,oBAAoB,EAAE,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAC1F,GAAG,CACJ,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,0EAA0E;IAC1E,+DAA+D;IAC/D,kEAAkE;IAClE,4BAA4B;IAC5B,mCAAmC;IACnC,EAAE;IACF,+EAA+E;IAC/E,0EAA0E;IAC1E,GAAG,CAAC,IAAI,CAAC,4BAA4B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACjD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QACpC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,qBAAqB,CAAC,CAAC,EAAE,GAAG,EAAE;gBACnC,YAAY,CAAC,qBAAqB,EAAE;oBAClC,KAAK,EAAE,eAAe;oBACtB,QAAQ,EAAE,eAAe;iBAC1B,CAAC;aACH,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,OAAO,qBAAqB,CAAC,CAAC,EAAE,GAAG,EAAE;gBACnC,YAAY,CAAC,6BAA6B,EAAE;oBAC1C,KAAK,EAAE,gBAAgB;oBACvB,QAAQ,EAAE,eAAe;iBAC1B,CAAC;aACH,CAAC,CAAC;QACL,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC,CAAC,CAAC,CAAC;QACzC,IAAI,CAAC,UAAU,CAAC,EAAE;YAAE,OAAO,UAAU,CAAC,QAAQ,CAAC;QAC/C,MAAM,IAAI,GAAG,UAAU,CAAC,IAAkD,CAAC;QAC3E,IAAI,IAAI,EAAE,IAAI,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,qBAAqB,CAAC,CAAC,EAAE,GAAG,EAAE;gBACnC,YAAY,CAAC,uBAAuB,EAAE;oBACpC,KAAK,EAAE,MAAM;oBACb,QAAQ,EAAE,IAAI,EAAE,IAAI,IAAI,WAAW;oBACnC,IAAI,EAAE,iGAAiG;iBACxG,CAAC;aACH,CAAC,CAAC;QACL,CAAC;QACD,8DAA8D;QAC9D,qEAAqE;QACrE,mDAAmD;QAEnD,MAAM,YAAY,GAAG,MAAM,uBAAuB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACnE,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,qBAAqB,CAAC,CAAC,EAAE,GAAG,EAAE;gBACnC,YAAY,CAAC,oCAAoC,EAAE;oBACjD,KAAK,EAAE,qBAAqB;oBAC5B,QAAQ,EAAE,SAAS;iBACpB,CAAC;aACH,EAAE,EAAE,YAAY,EAAE,EAAE,OAAO,EAAE,mDAAmD,EAAE,EAAE,CAAC,CAAC;QACzF,CAAC;QAED,MAAM,KAAK,GAAG,OAAO,IAAI,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QAEvE,OAAO,SAAS,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACnC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC;oBACtC,YAAY;oBACZ,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;wBACvB,MAAM,MAAM,CAAC,QAAQ,CAAC;4BACpB,KAAK,EAAE,QAAQ;4BACf,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;yBAC3B,CAAC,CAAC;oBACL,CAAC;iBACF,CAAC,CAAC;gBACH,IAAI,CAAC;oBACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC;wBACxC,IAAI,EAAE,SAAS;wBACf,KAAK,EAAE,MAAM,CAAC,KAAK;wBACnB,KAAK;wBACL,QAAQ,EAAE,OAAO;wBACjB,aAAa,EAAE,MAAM,CAAC,eAAe;qBACtC,CAAC,CAAC;oBACH,MAAM,MAAM,CAAC,QAAQ,CAAC;wBACpB,KAAK,EAAE,WAAW;wBAClB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC;qBAClC,CAAC,CAAC;gBACL,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAI,GAAG,YAAY,qBAAqB,EAAE,CAAC;wBACzC,MAAM,MAAM,CAAC,QAAQ,CAAC;4BACpB,KAAK,EAAE,QAAQ;4BACf,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;yBAChE,CAAC,CAAC;wBACH,OAAO;oBACT,CAAC;oBACD,MAAM,GAAG,CAAC;gBACZ,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,0BAA0B,CAAC,CAAC;gBAClD,MAAM,MAAM,CAAC,QAAQ,CAAC;oBACpB,KAAK,EAAE,QAAQ;oBACf,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;wBACnB,KAAK,EAAE,oBAAoB;wBAC3B,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;qBAC1D,CAAC;iBACH,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,0EAA0E;IAC1E,4EAA4E;IAC5E,oBAAoB;IACpB,GAAG,CAAC,KAAK,CAAC,2BAA2B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACjD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QACpC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,qBAAqB,CAAC,CAAC,EAAE,GAAG,EAAE;gBACnC,YAAY,CAAC,qBAAqB,EAAE;oBAClC,KAAK,EAAE,eAAe;oBACtB,QAAQ,EAAE,eAAe;iBAC1B,CAAC;aACH,CAAC,CAAC;QACL,CAAC;QACD,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAE3C,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC,CAAC,CAAC,CAAC;QACzC,IAAI,CAAC,UAAU,CAAC,EAAE;YAAE,OAAO,UAAU,CAAC,QAAQ,CAAC;QAC/C,MAAM,MAAM,GAAI,UAAU,CAAC,IAAoC,EAAE,MAAM,CAAC;QACxE,IAAI,OAAO,MAAM,KAAK,SAAS,EAAE,CAAC;YAChC,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,0BAA0B,EAAE,EAC9D,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAC5D,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,qBAAqB,CAAC,CAAC,EAAE,GAAG,EAAE;gBACnC,YAAY,CAAC,wBAAwB,EAAE;oBACrC,KAAK,EAAE,WAAW;oBAClB,QAAQ,EAAE,SAAS;iBACpB,CAAC;aACH,CAAC,CAAC;QACL,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,MAAM,CAAC,2BAA2B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QACpC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,qBAAqB,CAAC,CAAC,EAAE,GAAG,EAAE;gBACnC,YAAY,CAAC,qBAAqB,EAAE;oBAClC,KAAK,EAAE,eAAe;oBACtB,QAAQ,EAAE,eAAe;iBAC1B,CAAC;aACH,CAAC,CAAC;QACL,CAAC;QACD,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAC3C,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;QACxD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,qBAAqB,CAAC,CAAC,EAAE,GAAG,EAAE;gBACnC,YAAY,CAAC,wBAAwB,EAAE;oBACrC,KAAK,EAAE,WAAW;oBAClB,QAAQ,EAAE,SAAS;iBACpB,CAAC;aACH,CAAC,CAAC;QACL,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/api/routes/mail/app-password.d.ts

@@ -0,0 +1,4 @@
+import type { Hono } from "hono";
+import type { MailRouteDependencies } from "./dependencies.js";
+export declare function registerAppPasswordRoutes(app: Hono, deps: MailRouteDependencies): void;
+//# sourceMappingURL=app-password.d.ts.map

package/dist/api/routes/mail/app-password.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-password.d.ts","sourceRoot":"","sources":["../../../../src/api/routes/mail/app-password.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAejC,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAI/D,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,IAAI,EACT,IAAI,EAAE,qBAAqB,GAC1B,IAAI,CA6NN"}

package/dist/api/routes/mail/app-password.js

@@ -0,0 +1,192 @@
+import { createLogger } from "../../../logging.js";
+import { readJsonBody } from "../../json-body.js";
+import { composeIssue, respondWithAgentError } from "../../helpers/agent-errors.js";
+import { buildImapAccountSecret, isImapAppPasswordKind, serializeImapAccountSecret, } from "../../../services/mail/imap/app-password.js";
+import { classifyImapAuthFailure } from "../../../services/mail/imap/auth-failure-classifier.js";
+import { verifyImapAccountSecret } from "../../../services/mail/imap/client.js";
+import { DuplicateAccountError, ProviderNotImplementedError, } from "../../../services/mail/account-registry.js";
+const logger = createLogger("mail-api");
+export function registerAppPasswordRoutes(app, deps) {
+    const verifyImapCredentials = deps.verifyImapAccountSecret ?? verifyImapAccountSecret;
+    app.post("/config/mail/app-password", async (c) => {
+        const registry = deps.services.mail;
+        if (!registry) {
+            return respondWithAgentError(c, 503, [
+                composeIssue("mail.not_configured", {
+                    field: "services.mail",
+                    received: "<unavailable>",
+                }),
+            ]);
+        }
+        const parsedBody = await readJsonBody(c);
+        if (!parsedBody.ok)
+            return parsedBody.response;
+        const body = parsedBody.body;
+        const kindCandidate = typeof body?.kind === "string" ? body.kind : null;
+        const email = typeof body?.email === "string" ? body.email : null;
+        const appPassword = typeof body?.appPassword === "string" ? body.appPassword : null;
+        if (!kindCandidate ||
+            !isImapAppPasswordKind(kindCandidate) ||
+            !email ||
+            email.length === 0 ||
+            !appPassword ||
+            appPassword.length === 0) {
+            return c.json({
+                error: "invalid_body",
+                message: "kind(yahoo|icloud), email, and appPassword are required.",
+            }, 400);
+        }
+        const kind = kindCandidate;
+        // §UI v2 auth-then-enable: registration allowed regardless of
+        // enabledMailProviders. The Enable toggle on the dashboard mail card
+        // governs whether the agent observes this account.
+        const secret = buildImapAccountSecret(kind, email, appPassword);
+        let capabilities;
+        try {
+            capabilities = await verifyImapCredentials(secret);
+        }
+        catch (err) {
+            const classified = classifyImapAuthFailure({
+                errorName: err instanceof Error ? err.name : null,
+                message: getImapErrorMessage(err),
+                responseCode: getErrorResponseCode(err),
+            });
+            if (classified.status === "requires_consent") {
+                return c.json({
+                    error: "imap_auth_failed",
+                    message: "IMAP login failed. Verify the email address and app password, then try again.",
+                }, 400);
+            }
+            if (classified.status === "degraded" || classified.status === "transient") {
+                return c.json({
+                    error: "imap_connect_failed",
+                    message: "The IMAP server could not be reached or rejected the login attempt. Try again shortly.",
+                }, 502);
+            }
+            logger.error({ err, kind, email }, "app-password IMAP verification failed");
+            return c.json({ error: "add_account_failed", message: err instanceof Error ? err.message : String(err) }, 500);
+        }
+        try {
+            const account = await registry.addAccount({
+                kind,
+                email,
+                label: typeof body?.label === "string" ? body.label : undefined,
+                authType: "app_password",
+                secretPayload: serializeImapAccountSecret(secret),
+                idleEnabled: true,
+                capabilities: capabilities ?? undefined,
+            });
+            return c.json({ status: "completed", account });
+        }
+        catch (err) {
+            if (err instanceof DuplicateAccountError) {
+                return c.json({ error: err.code, message: err.message }, 409);
+            }
+            if (err instanceof ProviderNotImplementedError) {
+                return c.json({ error: err.code, message: err.message }, 400);
+            }
+            logger.error({ err, kind, email }, "app-password account add failed");
+            return c.json({ error: "add_account_failed", message: err instanceof Error ? err.message : String(err) }, 500);
+        }
+    });
+    // Refresh an existing IMAP (Yahoo / iCloud) account's app password without
+    // deleting and re-creating the row. Used when the user rotates the password
+    // at the provider and the account flips to `requires_consent`. The route
+    // verifies the new credentials against the IMAP server before persisting,
+    // then resets `auth_status` to `healthy`.
+    app.post("/config/mail/app-password/:accountId/refresh", async (c) => {
+        const registry = deps.services.mail;
+        if (!registry) {
+            return respondWithAgentError(c, 503, [
+                composeIssue("mail.not_configured", {
+                    field: "services.mail",
+                    received: "<unavailable>",
+                }),
+            ]);
+        }
+        const accountId = c.req.param("accountId");
+        const account = registry.getAccount(accountId);
+        if (!account) {
+            return respondWithAgentError(c, 404, [
+                composeIssue("mail.account_not_found", {
+                    field: "accountId",
+                    received: accountId,
+                }),
+            ]);
+        }
+        if (account.kind !== "yahoo" && account.kind !== "icloud") {
+            return respondWithAgentError(c, 400, [
+                composeIssue("mail.unsupported_kind", {
+                    field: "account.kind",
+                    received: account.kind,
+                    hint: "App-password refresh only supports yahoo / icloud. Outlook re-authenticates via the OAuth loopback flow.",
+                }),
+            ], { legacyFields: { message: "App-password refresh only supports yahoo / icloud. Outlook re-authenticates via the OAuth loopback flow." } });
+        }
+        const parsedBody = await readJsonBody(c);
+        if (!parsedBody.ok)
+            return parsedBody.response;
+        const body = parsedBody.body;
+        const appPassword = typeof body?.appPassword === "string" ? body.appPassword : null;
+        if (!appPassword || appPassword.length === 0) {
+            return c.json({ error: "invalid_body", message: "appPassword is required." }, 400);
+        }
+        const secret = buildImapAccountSecret(account.kind, account.email, appPassword);
+        let capabilities;
+        try {
+            capabilities = await verifyImapCredentials(secret);
+        }
+        catch (err) {
+            const classified = classifyImapAuthFailure({
+                errorName: err instanceof Error ? err.name : null,
+                message: getImapErrorMessage(err),
+                responseCode: getErrorResponseCode(err),
+            });
+            if (classified.status === "requires_consent") {
+                return c.json({
+                    error: "imap_auth_failed",
+                    message: "IMAP login failed with the new password. Generate a fresh app password and try again.",
+                }, 400);
+            }
+            if (classified.status === "degraded" || classified.status === "transient") {
+                return c.json({
+                    error: "imap_connect_failed",
+                    message: "The IMAP server could not be reached. Try again shortly.",
+                }, 502);
+            }
+            logger.error({ err, accountId }, "app-password refresh verification failed");
+            return c.json({ error: "refresh_failed", message: err instanceof Error ? err.message : String(err) }, 500);
+        }
+        try {
+            const updated = await registry.refreshImapSecret(accountId, serializeImapAccountSecret(secret), capabilities ?? undefined);
+            if (!updated) {
+                return respondWithAgentError(c, 404, [
+                    composeIssue("mail.account_not_found", {
+                        field: "accountId",
+                        received: accountId,
+                    }),
+                ]);
+            }
+            return c.json({ status: "refreshed", account: updated });
+        }
+        catch (err) {
+            logger.error({ err, accountId }, "app-password refresh failed");
+            return c.json({ error: "refresh_failed", message: err instanceof Error ? err.message : String(err) }, 500);
+        }
+    });
+}
+function getErrorResponseCode(err) {
+    const candidate = err?.responseCode;
+    return typeof candidate === "number" ? candidate : null;
+}
+// ImapFlow sets err.message to the generic "Command failed" and puts the
+// actual IMAP server response code in serverResponseCode (e.g. "AUTHENTICATIONFAILED")
+// and the human text in responseText. Concatenate all three so that the
+// classifyImapAuthFailure patterns can match the real server response.
+function getImapErrorMessage(err) {
+    if (!(err instanceof Error))
+        return String(err);
+    const e = err;
+    return [err.message, e.serverResponseCode, e.responseText].filter(Boolean).join(" ");
+}
+//# sourceMappingURL=app-password.js.map