@aitne/daemon 0.1.7 → 0.1.9

package/dist/api/routes/integrations/probe.d.ts

@@ -0,0 +1,20 @@
+import type { Hono } from "hono";
+import type { ApiDependencies } from "../../server.js";
+/**
+ * Register `POST /integrations/:key/probe` — evaluate or read the cached
+ * connector probe for a given backend. Phase 2 supports two modes:
+ *   - Live probe: `{liveProbe: true}` spawns the backend and enumerates
+ *     its MCP tool list, then persists.
+ *   - Cached read: body omits `tools`. Returns the latest stored row, or
+ *     `{result: null}` if no probe has been taken yet.
+ *   - Inline tools: `{tools: [...]}` accepts a pre-collected tool list
+ *     (the names the agent subprocess reported) and evaluates without
+ *     spawning. The dashboard's refresh button uses the live path;
+ *     `/health` and the setup wizard's initial render use the cached
+ *     path.
+ *
+ * No live agent subprocess is launched in the default path — keeping
+ * that out of the boot critical path is what saves the per-Opus probe
+ * cost called out in the §7 POC.
+ */
+export declare function registerProbeRoutes(app: Hono, deps: ApiDependencies): void;

package/dist/api/routes/integrations/probe.js

@@ -0,0 +1,246 @@
+import { BACKEND_IDS, INTEGRATION_DESCRIPTORS, isIntegrationKey, } from "@aitne/shared";
+import { evaluateProbe, getConnector, makeUserManagedProbeResult, } from "../../../core/integration-probe.js";
+import { LiveProbeUnsupportedError } from "../../../core/agent-core.js";
+import { readIntegrations, } from "../../../db/integrations-store.js";
+import { readProbe, writeProbe, } from "../../../db/integration-probe-store.js";
+import { createLogger } from "../../../logging.js";
+import { composeIssue, respondWithAgentError } from "../../helpers/agent-errors.js";
+const logger = createLogger("integrations-api");
+/**
+ * Register `POST /integrations/:key/probe` — evaluate or read the cached
+ * connector probe for a given backend. Phase 2 supports two modes:
+ *   - Live probe: `{liveProbe: true}` spawns the backend and enumerates
+ *     its MCP tool list, then persists.
+ *   - Cached read: body omits `tools`. Returns the latest stored row, or
+ *     `{result: null}` if no probe has been taken yet.
+ *   - Inline tools: `{tools: [...]}` accepts a pre-collected tool list
+ *     (the names the agent subprocess reported) and evaluates without
+ *     spawning. The dashboard's refresh button uses the live path;
+ *     `/health` and the setup wizard's initial render use the cached
+ *     path.
+ *
+ * No live agent subprocess is launched in the default path — keeping
+ * that out of the boot critical path is what saves the per-Opus probe
+ * cost called out in the §7 POC.
+ */
+export function registerProbeRoutes(app, deps) {
+    const { db } = deps;
+    app.post("/integrations/:key/probe", async (c) => {
+        const key = c.req.param("key");
+        if (!isIntegrationKey(key)) {
+            return respondWithAgentError(c, 404, [
+                composeIssue("integrations.unknown_integration", {
+                    field: "key",
+                    received: key,
+                }),
+            ], { legacyFields: { key } });
+        }
+        const body = await readOptionalJsonBody(c);
+        if (body === null) {
+            return respondWithAgentError(c, 400, [
+                composeIssue("integrations.invalid_json_body", {
+                    field: "body",
+                    received: "<not_json>",
+                }),
+            ]);
+        }
+        const backend = resolveProbeBackend(body.backend, db, key);
+        if (!backend.ok)
+            return c.json(backend.error, backend.status);
+        const descriptorForProbe = INTEGRATION_DESCRIPTORS[key];
+        const isUserManaged = descriptorForProbe.userManagedConnector === true;
+        // Connector existence is a descriptor-driven precondition. User-
+        // managed integrations (Outlook today) intentionally ship with an
+        // empty `backendConnectors` and skip this check — the user's MCP /
+        // connector on the chosen backend is the source of truth, not the
+        // registry. Backend availability + auth still get verified for
+        // user-managed in the live-probe branch below.
+        if (!isUserManaged) {
+            const connector = getConnector(key, backend.value);
+            /* c8 ignore start -- every registered (integration, backend) pair ships with a connector today; forward-compat guard for future partial connectors */
+            if (!connector) {
+                return c.json({
+                    error: "backend_not_supported",
+                    key,
+                    backend: backend.value,
+                    availableBackends: Object.keys(descriptorForProbe.backendConnectors),
+                }, 400);
+            }
+            /* c8 ignore stop */
+        }
+        // §4.11 live probe — `liveProbe: true` asks the daemon to spawn the
+        // target backend and enumerate its MCP tool list. User-initiated only;
+        // never fired from boot or PATCH. The descriptor + cached read paths
+        // cover the other two calling conventions.
+        //
+        // For user-managed integrations the spawn + probeTools() call still
+        // fires (this is what enforces §4.12.2 checks #1 backend resolvable
+        // and #2 backend auth valid). Only the descriptor-side capability
+        // evaluation is replaced by `makeUserManagedProbeResult`, which
+        // carries the full live tool list as `presentTools` so dashboards
+        // can show "we found N tools on your backend."
+        if (body.liveProbe === true) {
+            const core = deps.agentBackends?.find((c) => c.backendId === backend.value);
+            if (!core) {
+                return c.json({
+                    error: "backend_core_unavailable",
+                    backend: backend.value,
+                    message: `Backend '${backend.value}' is not registered in this daemon — cannot run live probe.`,
+                }, 503);
+            }
+            try {
+                const tools = await core.probeTools();
+                const result = isUserManaged
+                    ? makeUserManagedProbeResult(key, backend.value, tools)
+                    : evaluateProbe({
+                        tools,
+                        integration: key,
+                        backend: backend.value,
+                    });
+                writeProbe(db, result);
+                logger.info({
+                    key,
+                    backend: backend.value,
+                    present: result.present,
+                    missingRequired: result.missingRequired,
+                    toolCount: result.presentTools.length,
+                    userManaged: isUserManaged,
+                }, "integration live probe persisted");
+                return c.json({
+                    ok: true,
+                    cached: false,
+                    liveProbe: true,
+                    ...(isUserManaged ? { userManaged: true } : {}),
+                    result,
+                });
+            }
+            catch (err) {
+                if (err instanceof LiveProbeUnsupportedError) {
+                    return c.json({
+                        error: "live_probe_unsupported",
+                        backend: backend.value,
+                        message: err.reason,
+                    }, 501);
+                }
+                logger.error({ err, key, backend: backend.value }, "live probe failed");
+                return c.json({
+                    error: "live_probe_failed",
+                    backend: backend.value,
+                    message: err instanceof Error ? err.message : String(err),
+                }, 500);
+            }
+        }
+        const tools = body?.tools;
+        if (tools === undefined) {
+            const cached = readProbe(db, key, backend.value);
+            // 200 + result:null when there's no cached row — distinguishes
+            // "endpoint missing" (which the unknown_integration / 404 above
+            // covers) from "endpoint worked but the cache is empty," so the
+            // dashboard callers can branch without parsing error codes.
+            return c.json({
+                ok: true,
+                cached: cached !== null,
+                ...(isUserManaged ? { userManaged: true } : {}),
+                result: cached,
+            });
+        }
+        if (!Array.isArray(tools) || tools.some((t) => typeof t !== "string")) {
+            return c.json({
+                error: "invalid_body",
+                message: "`tools` must be an array of MCP tool names (strings).",
+            }, 400);
+        }
+        try {
+            const result = isUserManaged
+                ? makeUserManagedProbeResult(key, backend.value, tools)
+                : evaluateProbe({
+                    tools: tools,
+                    integration: key,
+                    backend: backend.value,
+                });
+            writeProbe(db, result);
+            logger.info({
+                key,
+                backend: backend.value,
+                present: result.present,
+                missingRequired: result.missingRequired,
+                toolCount: result.presentTools.length,
+                userManaged: isUserManaged,
+            }, "integration probe persisted");
+            return c.json({
+                ok: true,
+                cached: false,
+                ...(isUserManaged ? { userManaged: true } : {}),
+                result,
+            });
+            /* c8 ignore start -- evaluateProbe / writeProbe success path is always taken in tests; catch is defensive */
+        }
+        catch (err) {
+            logger.error({ err, key, backend: backend.value }, "probe evaluation failed");
+            return respondWithAgentError(c, 500, [
+                composeIssue("integrations.internal_error", {
+                    field: "<server>",
+                    received: "<probe_evaluation_failed>",
+                }),
+            ]);
+        }
+        /* c8 ignore stop */
+    });
+}
+/**
+ * Tolerant JSON body reader for POST routes that accept an empty body
+ * (e.g. `POST /integrations/:key/probe` with no `tools` defaults to a
+ * cached read). Returns `{}` for an empty body, `null` for invalid JSON,
+ * and the parsed value otherwise.
+ */
+async function readOptionalJsonBody(c) {
+    try {
+        const raw = await c.req.text();
+        if (raw.trim() === "")
+            return {};
+        return JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+}
+function resolveProbeBackend(raw, db, key) {
+    if (typeof raw === "string") {
+        if (!BACKEND_IDS.includes(raw)) {
+            return {
+                ok: false,
+                status: 400,
+                error: {
+                    error: "invalid_backend",
+                    message: `Unknown backend '${raw}'.`,
+                    supportedBackends: BACKEND_IDS,
+                },
+            };
+        }
+        return { ok: true, value: raw };
+    }
+    if (raw !== undefined) {
+        return {
+            ok: false,
+            status: 400,
+            error: {
+                error: "invalid_backend",
+                message: "`backend` must be a string when provided.",
+            },
+        };
+    }
+    // Default to the integration's `delegatedBackend` when one is
+    // configured — this is the backend the wizard would commit against.
+    const state = readIntegrations(db)[key];
+    if (state.delegatedBackend) {
+        return { ok: true, value: state.delegatedBackend };
+    }
+    return {
+        ok: false,
+        status: 400,
+        error: {
+            error: "backend_required",
+            message: "Pass `backend` in the request body — this integration is not currently delegated, so the daemon cannot infer one.",
+        },
+    };
+}

package/dist/api/routes/integrations-reconcile.d.ts

@@ -30,4 +30,3 @@ import type { ApiDependencies } from "../server.js";
  *      fabrication via `/api/observations/stats` `bySource`.
  */
 export declare function createIntegrationReconcileRoutes(deps: ApiDependencies): Hono;
-//# sourceMappingURL=integrations-reconcile.d.ts.map

package/dist/api/routes/integrations-reconcile.js

@@ -460,4 +460,3 @@ function writeReconcileAuditRow(deps, args) {
         logger.error({ err, integration: args.integration, windowKey: args.windowKey }, "failed to record reconcile audit row");
     }
 }
-//# sourceMappingURL=integrations-reconcile.js.map

package/dist/api/routes/knowledge.d.ts

@@ -1,4 +1,3 @@
 import { Hono } from "hono";
 import type { ApiDependencies } from "../server.js";
 export declare function createKnowledgeRoutes(deps: ApiDependencies): Hono;
-//# sourceMappingURL=knowledge.d.ts.map

package/dist/api/routes/knowledge.js

@@ -7,6 +7,7 @@ import { getContextDir } from "../../config.js";
 import { CONTEXT_RELATIVE_PATHS } from "../../core/context-paths.js";
 import { isSetupCompleted } from "../../db/runtime-state.js";
 import { createLogger, toSafeErrorMessage } from "../../logging.js";
+import { composeIssue, respondWithAgentError } from "../helpers/agent-errors.js";
 const logger = createLogger("api:knowledge");
 /** 64 KB cap. Larger sources must be split — long imports tax both the
  *  agent's context window and the strict-fidelity heuristic. */
@@ -66,7 +67,12 @@ export function createKnowledgeRoutes(deps) {
      */
     app.post("/knowledge/import", async (c) => {
         if (!deps.eventBus) {
-            return c.json({ error: "event_bus_unavailable" }, 503);
+            return respondWithAgentError(c, 503, [
+                composeIssue("knowledge.event_bus_unavailable", {
+                    field: "deps.eventBus",
+                    received: "<unavailable>",
+                }),
+            ]);
         }
         // Pre-setup uploads are rejected: the agent's PATCHes target
         // `user/<topic>.md` files that `ensureSkeletonFiles` only seeds
@@ -106,7 +112,12 @@ export function createKnowledgeRoutes(deps) {
         }
         const content = await file.text();
         if (content.trim().length === 0) {
-            return c.json({ error: "empty_file" }, 400);
+            return respondWithAgentError(c, 400, [
+                composeIssue("knowledge.empty_file", {
+                    field: "file",
+                    received: "<empty>",
+                }),
+            ]);
         }
         if (looksLikeSecret(content)) {
             return c.json({
@@ -137,7 +148,7 @@ export function createKnowledgeRoutes(deps) {
             requestedBackendId = backendRaw;
             requestedModelId = modelRaw;
         }
-        // Persist the raw blob under context/agent/scratch/. This directory
+        // Persist the raw blob under context/state/scratch/. This directory
         // is exempt from frontmatter validation, so we write the file
         // directly with Node fs rather than the Context File API. The
         // scratch_path the agent reads is the same relative path that the
@@ -221,4 +232,3 @@ export function createKnowledgeRoutes(deps) {
     });
     return app;
 }
-//# sourceMappingURL=knowledge.js.map

package/dist/api/routes/mail/accounts.d.ts

@@ -0,0 +1,3 @@
+import type { Hono } from "hono";
+import type { MailRouteDependencies } from "./dependencies.js";
+export declare function registerAccountsRoutes(app: Hono, deps: MailRouteDependencies): void;

package/dist/api/routes/mail/accounts.js

@@ -0,0 +1,288 @@
+import { streamSSE } from "hono/streaming";
+import { createLogger } from "../../../logging.js";
+import { readJsonBody } from "../../json-body.js";
+import { composeIssue, respondWithAgentError } from "../../helpers/agent-errors.js";
+import { loadOutlookClientConfig } from "../../../services/mail/outlook/client-config.js";
+import { runLoopbackOAuth, OAuthLoopbackError, OAuthLoopbackTimeoutError, } from "../../../services/mail/outlook/oauth-loopback.js";
+import { runDeviceCodeOAuth } from "../../../services/mail/outlook/oauth-device-code.js";
+import { DuplicateAccountError } from "../../../services/mail/account-registry.js";
+const logger = createLogger("mail-api");
+export function registerAccountsRoutes(app, deps) {
+    // GET /mail/accounts — all configured accounts (dashboard, setup).
+    // GET /mail/accounts?active=1 — scope-gated subset that matches what
+    // `accounts.md` materializes and what the unified poller observes:
+    //   kind ∈ enabledMailProviders ∧ account.active ∧ authStatus === "healthy".
+    // Skills that need to refresh a stale `accounts.md` MUST pass `?active=1`
+    // — raw listAccounts() includes dormant / unhealthy rows and will mislead
+    // the agent into picking an id that every operation will 4xx on.
+    app.get("/mail/accounts", (c) => {
+        const registry = deps.services.mail;
+        if (!registry) {
+            return c.json({ accounts: [] });
+        }
+        const activeOnly = c.req.query("active") === "1";
+        const accounts = activeOnly
+            ? registry.listActiveAccounts()
+            : registry.listAccounts();
+        return c.json({ accounts });
+    });
+    // POST /mail/accounts blocks for the duration of the loopback PKCE flow —
+    // up to OAuthLoopbackTimeoutError's 5-minute cap (see oauth-loopback.ts).
+    // Dashboard clients MUST configure a long fetch timeout for this route.
+    // Headless environments (SSH, WSL) should use /mail/accounts/device-code.
+    app.post("/mail/accounts", async (c) => {
+        const registry = deps.services.mail;
+        if (!registry) {
+            return respondWithAgentError(c, 503, [
+                composeIssue("mail.not_configured", {
+                    field: "services.mail",
+                    received: "<unavailable>",
+                }),
+            ]);
+        }
+        if (!deps.blobStore) {
+            return respondWithAgentError(c, 503, [
+                composeIssue("mail.blob_store_unavailable", {
+                    field: "deps.blobStore",
+                    received: "<unavailable>",
+                }),
+            ]);
+        }
+        const parsedBody = await readJsonBody(c);
+        if (!parsedBody.ok)
+            return parsedBody.response;
+        const body = parsedBody.body;
+        if (body?.kind === "gmail") {
+            // The primary Gmail mailbox now participates in the unified mail
+            // surface via the shared Google OAuth credentials from
+            // /config/google-auth. Additional Gmail accounts still need a
+            // per-account Google OAuth credential store and are intentionally
+            // not wired up yet.
+            return respondWithAgentError(c, 501, [
+                composeIssue("mail.not_implemented", {
+                    field: "kind",
+                    received: "gmail",
+                    hint: "Additional Gmail accounts are not implemented yet. The primary Gmail identity is configured through /config/google-auth and is exposed on the unified /mail/* surface automatically.",
+                }),
+            ], {
+                legacyFields: {
+                    message: "Additional Gmail accounts are not implemented yet. The primary Gmail identity is configured through /config/google-auth and is exposed on the unified /mail/* surface automatically.",
+                },
+            });
+        }
+        if (body?.kind !== "outlook") {
+            return respondWithAgentError(c, 400, [
+                composeIssue("mail.unsupported_kind", {
+                    field: "kind",
+                    received: body?.kind ?? "<missing>",
+                    hint: "Only outlook is supported on this endpoint. Yahoo/iCloud use POST /config/mail/app-password. The primary Gmail account uses /config/google-auth; extra Gmail accounts are not implemented.",
+                }),
+            ], {
+                legacyFields: {
+                    message: "Only outlook is supported on this endpoint. Yahoo/iCloud use POST /config/mail/app-password. The primary Gmail account uses /config/google-auth; extra Gmail accounts are not implemented.",
+                },
+            });
+        }
+        // §UI v2 auth-then-enable: registration is allowed regardless of
+        // enabledMailProviders. The provider becomes live only when the user
+        // toggles "Enable" on the dashboard mail card.
+        const clientConfig = await loadOutlookClientConfig(deps.blobStore);
+        if (!clientConfig) {
+            return respondWithAgentError(c, 412, [
+                composeIssue("mail.outlook_client_config_missing", {
+                    field: "outlookClientConfig",
+                    received: "<unset>",
+                }),
+            ], { legacyFields: { message: "PUT /api/config/mail/outlook/client-config first." } });
+        }
+        let oauthResult;
+        try {
+            oauthResult = await runLoopbackOAuth({ clientConfig });
+        }
+        catch (err) {
+            if (err instanceof OAuthLoopbackTimeoutError) {
+                return respondWithAgentError(c, 408, [
+                    composeIssue("mail.oauth_timeout", {
+                        field: "outlook.oauth",
+                        received: err.message,
+                    }),
+                ], { legacyFields: { message: err.message } });
+            }
+            if (err instanceof OAuthLoopbackError) {
+                return c.json({ error: err.code, message: err.message }, 400);
+            }
+            logger.error({ err }, "outlook oauth bootstrap failed");
+            return c.json({ error: "oauth_failed", message: err instanceof Error ? err.message : String(err) }, 500);
+        }
+        try {
+            const account = await registry.addAccount({
+                kind: "outlook",
+                email: oauthResult.email,
+                label: typeof body?.label === "string" ? body.label : undefined,
+                authType: "oauth",
+                secretPayload: oauthResult.serializedCache,
+            });
+            return c.json({ status: "completed", account });
+        }
+        catch (err) {
+            if (err instanceof DuplicateAccountError) {
+                return c.json({ error: err.code, message: err.message }, 409);
+            }
+            logger.error({ err, email: oauthResult.email }, "outlook addAccount failed after OAuth");
+            return c.json({ error: "add_account_failed", message: err instanceof Error ? err.message : String(err) }, 500);
+        }
+    });
+    // Device-code fallback (§B2). Used by headless/SSH environments where the
+    // loopback flow's browser-open would fail. Streams SSE events:
+    //   `prompt`    { userCode, verificationUri, expiresIn, message }
+    //   `completed` { account }
+    //   `failed`    { error, message }
+    //
+    // MSAL's acquireTokenByDeviceCode blocks until the user completes verification
+    // in their browser, so this endpoint may remain open for several minutes.
+    app.post("/mail/accounts/device-code", async (c) => {
+        const registry = deps.services.mail;
+        if (!registry) {
+            return respondWithAgentError(c, 503, [
+                composeIssue("mail.not_configured", {
+                    field: "services.mail",
+                    received: "<unavailable>",
+                }),
+            ]);
+        }
+        if (!deps.blobStore) {
+            return respondWithAgentError(c, 503, [
+                composeIssue("mail.blob_store_unavailable", {
+                    field: "deps.blobStore",
+                    received: "<unavailable>",
+                }),
+            ]);
+        }
+        const parsedBody = await readJsonBody(c);
+        if (!parsedBody.ok)
+            return parsedBody.response;
+        const body = parsedBody.body;
+        if (body?.kind !== "outlook") {
+            return respondWithAgentError(c, 400, [
+                composeIssue("mail.unsupported_kind", {
+                    field: "kind",
+                    received: body?.kind ?? "<missing>",
+                    hint: "Device-code flow is Outlook-only on this endpoint. Use POST /mail/accounts for other providers.",
+                }),
+            ]);
+        }
+        // §UI v2 auth-then-enable: registration allowed regardless of
+        // enabledMailProviders. The Enable toggle on the dashboard mail card
+        // governs whether the agent observes this account.
+        const clientConfig = await loadOutlookClientConfig(deps.blobStore);
+        if (!clientConfig) {
+            return respondWithAgentError(c, 412, [
+                composeIssue("mail.outlook_client_config_missing", {
+                    field: "outlookClientConfig",
+                    received: "<unset>",
+                }),
+            ], { legacyFields: { message: "PUT /api/config/mail/outlook/client-config first." } });
+        }
+        const label = typeof body?.label === "string" ? body.label : undefined;
+        return streamSSE(c, async (stream) => {
+            try {
+                const result = await runDeviceCodeOAuth({
+                    clientConfig,
+                    onPrompt: async (info) => {
+                        await stream.writeSSE({
+                            event: "prompt",
+                            data: JSON.stringify(info),
+                        });
+                    },
+                });
+                try {
+                    const account = await registry.addAccount({
+                        kind: "outlook",
+                        email: result.email,
+                        label,
+                        authType: "oauth",
+                        secretPayload: result.serializedCache,
+                    });
+                    await stream.writeSSE({
+                        event: "completed",
+                        data: JSON.stringify({ account }),
+                    });
+                }
+                catch (err) {
+                    if (err instanceof DuplicateAccountError) {
+                        await stream.writeSSE({
+                            event: "failed",
+                            data: JSON.stringify({ error: err.code, message: err.message }),
+                        });
+                        return;
+                    }
+                    throw err;
+                }
+            }
+            catch (err) {
+                logger.error({ err }, "device-code oauth failed");
+                await stream.writeSSE({
+                    event: "failed",
+                    data: JSON.stringify({
+                        error: "device_code_failed",
+                        message: err instanceof Error ? err.message : String(err),
+                    }),
+                });
+            }
+        });
+    });
+    // Active-toggle for a single account. Distinct from provider-level enable
+    // (§6.0): users can disable one Outlook account while keeping the "Outlook"
+    // provider enabled.
+    app.patch("/mail/accounts/:accountId", async (c) => {
+        const registry = deps.services.mail;
+        if (!registry) {
+            return respondWithAgentError(c, 503, [
+                composeIssue("mail.not_configured", {
+                    field: "services.mail",
+                    received: "<unavailable>",
+                }),
+            ]);
+        }
+        const accountId = c.req.param("accountId");
+        const parsedBody = await readJsonBody(c);
+        if (!parsedBody.ok)
+            return parsedBody.response;
+        const active = parsedBody.body?.active;
+        if (typeof active !== "boolean") {
+            return c.json({ error: "invalid_body", message: "active: boolean required" }, 400);
+        }
+        const updated = await registry.setActive(accountId, active);
+        if (!updated) {
+            return respondWithAgentError(c, 404, [
+                composeIssue("mail.account_not_found", {
+                    field: "accountId",
+                    received: accountId,
+                }),
+            ]);
+        }
+        return c.json({ status: "updated", account: updated });
+    });
+    app.delete("/mail/accounts/:accountId", async (c) => {
+        const registry = deps.services.mail;
+        if (!registry) {
+            return respondWithAgentError(c, 503, [
+                composeIssue("mail.not_configured", {
+                    field: "services.mail",
+                    received: "<unavailable>",
+                }),
+            ]);
+        }
+        const accountId = c.req.param("accountId");
+        const removed = await registry.removeAccount(accountId);
+        if (!removed) {
+            return respondWithAgentError(c, 404, [
+                composeIssue("mail.account_not_found", {
+                    field: "accountId",
+                    received: accountId,
+                }),
+            ]);
+        }
+        return c.json({ status: "removed", accountId });
+    });
+}

package/dist/api/routes/mail/app-password.d.ts

@@ -0,0 +1,3 @@
+import type { Hono } from "hono";
+import type { MailRouteDependencies } from "./dependencies.js";
+export declare function registerAppPasswordRoutes(app: Hono, deps: MailRouteDependencies): void;