@aitne/daemon 0.1.8 → 0.1.9

package/dist/api/routes/mail/_pa_wip_mail/gating.js

@@ -1,98 +0,0 @@
-import { INTEGRATION_DESCRIPTORS, } from "@aitne/shared";
-export const ALL_KINDS = [
-    "gmail",
-    "outlook",
-    "yahoo",
-    "icloud",
-];
-export const PROVIDER_LABELS = {
-    gmail: "Gmail",
-    outlook: "Outlook",
-    yahoo: "Yahoo Mail",
-    icloud: "iCloud Mail",
-};
-export function gatedIntegrationForKind(kind) {
-    if (kind === "gmail")
-        return "gmail";
-    if (kind === "outlook")
-        return "outlook_mail";
-    return null;
-}
-export function delegatedMailIntegrationMessage(key, delegatedBackend) {
-    const descriptor = INTEGRATION_DESCRIPTORS[key];
-    const displayName = descriptor.displayName;
-    const owner = delegatedBackend
-        ? `delegated to ${delegatedBackend}`
-        : "delegated";
-    // User-managed connector integrations (Outlook today) ship no
-    // daemon-side proxy. The agent must use whatever Outlook MCP /
-    // connector the user wired up on the chosen backend; pointing at
-    // `/api/integrations/.../invoke` would be a lie.
-    if (descriptor.userManagedConnector) {
-        return [
-            `${displayName} is in delegated mode (${owner}).`,
-            `The agent backend is expected to use the user-installed ${displayName} MCP / connector tools — the daemon does not proxy this integration.`,
-            "Other mail accounts remain available through /api/mail/*.",
-        ].join(" ");
-    }
-    return [
-        `${displayName} is in delegated mode (${owner}).`,
-        `Same-backend sessions: use the connector's native ${displayName} MCP tools.`,
-        `Cross-backend sessions: call POST /api/integrations/${key}/invoke.`,
-        `Non-${displayName} mail accounts remain available through /api/mail/*.`,
-    ].join(" ");
-}
-/**
- * INTEGRATION_NATIVE_MODE_DESIGN.md §9.2 — `/api/mail/*` cannot be
- * prefix-gated by `integration-route-gate.ts` because it is
- * multi-provider; the gated kinds (Gmail, Outlook) get a per-account
- * 410 inside the handler. This helper produces the body for
- * `delegated` and `native` modes (the two daemonless modes that have
- * an explicit redirect target — the user's MCP). `disabled` is
- * intentionally NOT gated here: the integration map defaults to
- * `disabled`, and a fresh install with Gmail/Outlook accounts already
- * provisioned would otherwise 410 their entire `/api/mail/*` surface
- * before the user has even visited the mode picker. The integration
- * registry's poller filter handles the `disabled` case at the data
- * path; the route-level 410 for disabled is reserved for the
- * centralised middleware where `apiRoutesTouched` declares prefix
- * coverage.
- *
- * The error codes mirror the centralised middleware's vocabulary so
- * dashboards can branch on the same string regardless of which gate
- * fired.
- */
-export function gatedMailIntegrationResponse(key, state) {
-    const descriptor = INTEGRATION_DESCRIPTORS[key];
-    const displayName = descriptor.displayName;
-    if (state.mode === "delegated") {
-        return {
-            error: "integration_delegated",
-            message: delegatedMailIntegrationMessage(key, state.delegatedBackend ?? null),
-            integration: key,
-            backend: state.delegatedBackend ?? null,
-            mode: "delegated",
-        };
-    }
-    if (state.mode === "native") {
-        const nb = state.nativeBackend ?? null;
-        // User-managed integrations (Outlook) point at the user's installed
-        // MCP; descriptor-driven (Gmail) point at the backend's hosted
-        // connector and the SKILL.native.<backend>.md body. Mirrors the
-        // central route gate's branching so the agent gets symmetric copy
-        // whether the request hits a prefix-gated route or a multi-provider
-        // route.
-        const message = descriptor.userManagedConnector
-            ? `${displayName} is in native mode (bound to ${nb ?? "main backend"}). The agent backend is expected to use the user-installed ${displayName} MCP / connector tools — the daemon does not poll and does not expose a proxy for this integration. Other mail accounts remain available through /api/mail/*.`
-            : `${displayName} is in native mode (bound to ${nb ?? "main backend"}). Use the backend's native MCP tools (see the SKILL.native.${nb ?? "<backend>"}.md body); the daemon does not poll and does not expose a proxy for this integration. Other mail accounts remain available through /api/mail/*.`;
-        return {
-            error: "integration_native",
-            message,
-            integration: key,
-            backend: nb,
-            mode: "native",
-        };
-    }
-    return null;
-}
-//# sourceMappingURL=gating.js.map

package/dist/api/routes/mail/_pa_wip_mail/gating.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"gating.js","sourceRoot":"","sources":["../../../../../src/api/routes/mail/_pa_wip_mail/gating.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,GAExB,MAAM,eAAe,CAAC;AAGvB,MAAM,CAAC,MAAM,SAAS,GAAgC;IACpD,OAAO;IACP,SAAS;IACT,OAAO;IACP,QAAQ;CACT,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAqC;IAC/D,KAAK,EAAE,OAAO;IACd,OAAO,EAAE,SAAS;IAClB,KAAK,EAAE,YAAY;IACnB,MAAM,EAAE,aAAa;CACtB,CAAC;AAaF,MAAM,UAAU,uBAAuB,CACrC,IAAsB;IAEtB,IAAI,IAAI,KAAK,OAAO;QAAE,OAAO,OAAO,CAAC;IACrC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,cAAc,CAAC;IAC9C,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,+BAA+B,CAC7C,GAA4B,EAC5B,gBAA2C;IAE3C,MAAM,UAAU,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAC;IAChD,MAAM,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;IAC3C,MAAM,KAAK,GAAG,gBAAgB;QAC5B,CAAC,CAAC,gBAAgB,gBAAgB,EAAE;QACpC,CAAC,CAAC,WAAW,CAAC;IAChB,8DAA8D;IAC9D,+DAA+D;IAC/D,iEAAiE;IACjE,iDAAiD;IACjD,IAAI,UAAU,CAAC,oBAAoB,EAAE,CAAC;QACpC,OAAO;YACL,GAAG,WAAW,0BAA0B,KAAK,IAAI;YACjD,2DAA2D,WAAW,sEAAsE;YAC5I,2DAA2D;SAC5D,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACd,CAAC;IACD,OAAO;QACL,GAAG,WAAW,0BAA0B,KAAK,IAAI;QACjD,qDAAqD,WAAW,aAAa;QAC7E,uDAAuD,GAAG,UAAU;QACpE,OAAO,WAAW,sDAAsD;KACzE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,4BAA4B,CAC1C,GAA4B,EAC5B,KAIC;IAQD,MAAM,UAAU,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAC;IAChD,MAAM,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;IAC3C,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QAC/B,OAAO;YACL,KAAK,EAAE,uBAAuB;YAC9B,OAAO,EAAE,+BAA+B,CACtC,GAAG,EACH,KAAK,CAAC,gBAAgB,IAAI,IAAI,CAC/B;YACD,WAAW,EAAE,GAAG;YAChB,OAAO,EAAE,KAAK,CAAC,gBAAgB,IAAI,IAAI;YACvC,IAAI,EAAE,WAAW;SAClB,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,EAAE,GAAG,KAAK,CAAC,aAAa,IAAI,IAAI,CAAC;QACvC,oEAAoE;QACpE,+DAA+D;QAC/D,gEAAgE;QAChE,kEAAkE;QAClE,oEAAoE;QACpE,SAAS;QACT,MAAM,OAAO,GAAG,UAAU,CAAC,oBAAoB;YAC7C,CAAC,CAAC,GAAG,WAAW,gCAAgC,EAAE,IAAI,cAAc,8DAA8D,WAAW,+JAA+J;YAC5S,CAAC,CAAC,GAAG,WAAW,gCAAgC,EAAE,IAAI,cAAc,+DAA+D,EAAE,IAAI,WAAW,iJAAiJ,CAAC;QACxS,OAAO;YACL,KAAK,EAAE,oBAAoB;YAC3B,OAAO;YACP,WAAW,EAAE,GAAG;YAChB,OAAO,EAAE,EAAE;YACX,IAAI,EAAE,QAAQ;SACf,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/api/routes/mail/_pa_wip_mail/mail/accounts.d.ts

@@ -1,4 +0,0 @@
-import type { Hono } from "hono";
-import type { MailRouteDependencies } from "./dependencies.js";
-export declare function registerAccountsRoutes(app: Hono, deps: MailRouteDependencies): void;
-//# sourceMappingURL=accounts.d.ts.map

package/dist/api/routes/mail/_pa_wip_mail/mail/accounts.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"accounts.d.ts","sourceRoot":"","sources":["../../../../../../src/api/routes/mail/_pa_wip_mail/mail/accounts.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAajC,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAI/D,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,IAAI,EACT,IAAI,EAAE,qBAAqB,GAC1B,IAAI,CAySN"}

package/dist/api/routes/mail/_pa_wip_mail/mail/accounts.js

@@ -1,289 +0,0 @@
-import { streamSSE } from "hono/streaming";
-import { createLogger } from "../../../logging.js";
-import { readJsonBody } from "../../json-body.js";
-import { composeIssue, respondWithAgentError } from "../../helpers/agent-errors.js";
-import { loadOutlookClientConfig } from "../../../services/mail/outlook/client-config.js";
-import { runLoopbackOAuth, OAuthLoopbackError, OAuthLoopbackTimeoutError, } from "../../../services/mail/outlook/oauth-loopback.js";
-import { runDeviceCodeOAuth } from "../../../services/mail/outlook/oauth-device-code.js";
-import { DuplicateAccountError } from "../../../services/mail/account-registry.js";
-const logger = createLogger("mail-api");
-export function registerAccountsRoutes(app, deps) {
-    // GET /mail/accounts — all configured accounts (dashboard, setup).
-    // GET /mail/accounts?active=1 — scope-gated subset that matches what
-    // `accounts.md` materializes and what the unified poller observes:
-    //   kind ∈ enabledMailProviders ∧ account.active ∧ authStatus === "healthy".
-    // Skills that need to refresh a stale `accounts.md` MUST pass `?active=1`
-    // — raw listAccounts() includes dormant / unhealthy rows and will mislead
-    // the agent into picking an id that every operation will 4xx on.
-    app.get("/mail/accounts", (c) => {
-        const registry = deps.services.mail;
-        if (!registry) {
-            return c.json({ accounts: [] });
-        }
-        const activeOnly = c.req.query("active") === "1";
-        const accounts = activeOnly
-            ? registry.listActiveAccounts()
-            : registry.listAccounts();
-        return c.json({ accounts });
-    });
-    // POST /mail/accounts blocks for the duration of the loopback PKCE flow —
-    // up to OAuthLoopbackTimeoutError's 5-minute cap (see oauth-loopback.ts).
-    // Dashboard clients MUST configure a long fetch timeout for this route.
-    // Headless environments (SSH, WSL) should use /mail/accounts/device-code.
-    app.post("/mail/accounts", async (c) => {
-        const registry = deps.services.mail;
-        if (!registry) {
-            return respondWithAgentError(c, 503, [
-                composeIssue("mail.not_configured", {
-                    field: "services.mail",
-                    received: "<unavailable>",
-                }),
-            ]);
-        }
-        if (!deps.blobStore) {
-            return respondWithAgentError(c, 503, [
-                composeIssue("mail.blob_store_unavailable", {
-                    field: "deps.blobStore",
-                    received: "<unavailable>",
-                }),
-            ]);
-        }
-        const parsedBody = await readJsonBody(c);
-        if (!parsedBody.ok)
-            return parsedBody.response;
-        const body = parsedBody.body;
-        if (body?.kind === "gmail") {
-            // The primary Gmail mailbox now participates in the unified mail
-            // surface via the shared Google OAuth credentials from
-            // /config/google-auth. Additional Gmail accounts still need a
-            // per-account Google OAuth credential store and are intentionally
-            // not wired up yet.
-            return respondWithAgentError(c, 501, [
-                composeIssue("mail.not_implemented", {
-                    field: "kind",
-                    received: "gmail",
-                    hint: "Additional Gmail accounts are not implemented yet. The primary Gmail identity is configured through /config/google-auth and is exposed on the unified /mail/* surface automatically.",
-                }),
-            ], {
-                legacyFields: {
-                    message: "Additional Gmail accounts are not implemented yet. The primary Gmail identity is configured through /config/google-auth and is exposed on the unified /mail/* surface automatically.",
-                },
-            });
-        }
-        if (body?.kind !== "outlook") {
-            return respondWithAgentError(c, 400, [
-                composeIssue("mail.unsupported_kind", {
-                    field: "kind",
-                    received: body?.kind ?? "<missing>",
-                    hint: "Only outlook is supported on this endpoint. Yahoo/iCloud use POST /config/mail/app-password. The primary Gmail account uses /config/google-auth; extra Gmail accounts are not implemented.",
-                }),
-            ], {
-                legacyFields: {
-                    message: "Only outlook is supported on this endpoint. Yahoo/iCloud use POST /config/mail/app-password. The primary Gmail account uses /config/google-auth; extra Gmail accounts are not implemented.",
-                },
-            });
-        }
-        // §UI v2 auth-then-enable: registration is allowed regardless of
-        // enabledMailProviders. The provider becomes live only when the user
-        // toggles "Enable" on the dashboard mail card.
-        const clientConfig = await loadOutlookClientConfig(deps.blobStore);
-        if (!clientConfig) {
-            return respondWithAgentError(c, 412, [
-                composeIssue("mail.outlook_client_config_missing", {
-                    field: "outlookClientConfig",
-                    received: "<unset>",
-                }),
-            ], { legacyFields: { message: "PUT /api/config/mail/outlook/client-config first." } });
-        }
-        let oauthResult;
-        try {
-            oauthResult = await runLoopbackOAuth({ clientConfig });
-        }
-        catch (err) {
-            if (err instanceof OAuthLoopbackTimeoutError) {
-                return respondWithAgentError(c, 408, [
-                    composeIssue("mail.oauth_timeout", {
-                        field: "outlook.oauth",
-                        received: err.message,
-                    }),
-                ], { legacyFields: { message: err.message } });
-            }
-            if (err instanceof OAuthLoopbackError) {
-                return c.json({ error: err.code, message: err.message }, 400);
-            }
-            logger.error({ err }, "outlook oauth bootstrap failed");
-            return c.json({ error: "oauth_failed", message: err instanceof Error ? err.message : String(err) }, 500);
-        }
-        try {
-            const account = await registry.addAccount({
-                kind: "outlook",
-                email: oauthResult.email,
-                label: typeof body?.label === "string" ? body.label : undefined,
-                authType: "oauth",
-                secretPayload: oauthResult.serializedCache,
-            });
-            return c.json({ status: "completed", account });
-        }
-        catch (err) {
-            if (err instanceof DuplicateAccountError) {
-                return c.json({ error: err.code, message: err.message }, 409);
-            }
-            logger.error({ err, email: oauthResult.email }, "outlook addAccount failed after OAuth");
-            return c.json({ error: "add_account_failed", message: err instanceof Error ? err.message : String(err) }, 500);
-        }
-    });
-    // Device-code fallback (§B2). Used by headless/SSH environments where the
-    // loopback flow's browser-open would fail. Streams SSE events:
-    //   `prompt`    { userCode, verificationUri, expiresIn, message }
-    //   `completed` { account }
-    //   `failed`    { error, message }
-    //
-    // MSAL's acquireTokenByDeviceCode blocks until the user completes verification
-    // in their browser, so this endpoint may remain open for several minutes.
-    app.post("/mail/accounts/device-code", async (c) => {
-        const registry = deps.services.mail;
-        if (!registry) {
-            return respondWithAgentError(c, 503, [
-                composeIssue("mail.not_configured", {
-                    field: "services.mail",
-                    received: "<unavailable>",
-                }),
-            ]);
-        }
-        if (!deps.blobStore) {
-            return respondWithAgentError(c, 503, [
-                composeIssue("mail.blob_store_unavailable", {
-                    field: "deps.blobStore",
-                    received: "<unavailable>",
-                }),
-            ]);
-        }
-        const parsedBody = await readJsonBody(c);
-        if (!parsedBody.ok)
-            return parsedBody.response;
-        const body = parsedBody.body;
-        if (body?.kind !== "outlook") {
-            return respondWithAgentError(c, 400, [
-                composeIssue("mail.unsupported_kind", {
-                    field: "kind",
-                    received: body?.kind ?? "<missing>",
-                    hint: "Device-code flow is Outlook-only on this endpoint. Use POST /mail/accounts for other providers.",
-                }),
-            ]);
-        }
-        // §UI v2 auth-then-enable: registration allowed regardless of
-        // enabledMailProviders. The Enable toggle on the dashboard mail card
-        // governs whether the agent observes this account.
-        const clientConfig = await loadOutlookClientConfig(deps.blobStore);
-        if (!clientConfig) {
-            return respondWithAgentError(c, 412, [
-                composeIssue("mail.outlook_client_config_missing", {
-                    field: "outlookClientConfig",
-                    received: "<unset>",
-                }),
-            ], { legacyFields: { message: "PUT /api/config/mail/outlook/client-config first." } });
-        }
-        const label = typeof body?.label === "string" ? body.label : undefined;
-        return streamSSE(c, async (stream) => {
-            try {
-                const result = await runDeviceCodeOAuth({
-                    clientConfig,
-                    onPrompt: async (info) => {
-                        await stream.writeSSE({
-                            event: "prompt",
-                            data: JSON.stringify(info),
-                        });
-                    },
-                });
-                try {
-                    const account = await registry.addAccount({
-                        kind: "outlook",
-                        email: result.email,
-                        label,
-                        authType: "oauth",
-                        secretPayload: result.serializedCache,
-                    });
-                    await stream.writeSSE({
-                        event: "completed",
-                        data: JSON.stringify({ account }),
-                    });
-                }
-                catch (err) {
-                    if (err instanceof DuplicateAccountError) {
-                        await stream.writeSSE({
-                            event: "failed",
-                            data: JSON.stringify({ error: err.code, message: err.message }),
-                        });
-                        return;
-                    }
-                    throw err;
-                }
-            }
-            catch (err) {
-                logger.error({ err }, "device-code oauth failed");
-                await stream.writeSSE({
-                    event: "failed",
-                    data: JSON.stringify({
-                        error: "device_code_failed",
-                        message: err instanceof Error ? err.message : String(err),
-                    }),
-                });
-            }
-        });
-    });
-    // Active-toggle for a single account. Distinct from provider-level enable
-    // (§6.0): users can disable one Outlook account while keeping the "Outlook"
-    // provider enabled.
-    app.patch("/mail/accounts/:accountId", async (c) => {
-        const registry = deps.services.mail;
-        if (!registry) {
-            return respondWithAgentError(c, 503, [
-                composeIssue("mail.not_configured", {
-                    field: "services.mail",
-                    received: "<unavailable>",
-                }),
-            ]);
-        }
-        const accountId = c.req.param("accountId");
-        const parsedBody = await readJsonBody(c);
-        if (!parsedBody.ok)
-            return parsedBody.response;
-        const active = parsedBody.body?.active;
-        if (typeof active !== "boolean") {
-            return c.json({ error: "invalid_body", message: "active: boolean required" }, 400);
-        }
-        const updated = await registry.setActive(accountId, active);
-        if (!updated) {
-            return respondWithAgentError(c, 404, [
-                composeIssue("mail.account_not_found", {
-                    field: "accountId",
-                    received: c.req.param("id") ?? "<unknown>",
-                }),
-            ]);
-        }
-        return c.json({ status: "updated", account: updated });
-    });
-    app.delete("/mail/accounts/:accountId", async (c) => {
-        const registry = deps.services.mail;
-        if (!registry) {
-            return respondWithAgentError(c, 503, [
-                composeIssue("mail.not_configured", {
-                    field: "services.mail",
-                    received: "<unavailable>",
-                }),
-            ]);
-        }
-        const accountId = c.req.param("accountId");
-        const removed = await registry.removeAccount(accountId);
-        if (!removed) {
-            return respondWithAgentError(c, 404, [
-                composeIssue("mail.account_not_found", {
-                    field: "accountId",
-                    received: accountId,
-                }),
-            ]);
-        }
-        return c.json({ status: "removed", accountId });
-    });
-}
-//# sourceMappingURL=accounts.js.map

package/dist/api/routes/mail/_pa_wip_mail/mail/accounts.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"accounts.js","sourceRoot":"","sources":["../../../../../../src/api/routes/mail/_pa_wip_mail/mail/accounts.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AACpF,OAAO,EAAE,uBAAuB,EAAE,MAAM,iDAAiD,CAAC;AAC1F,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,yBAAyB,GAC1B,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,qDAAqD,CAAC;AACzF,OAAO,EAAE,qBAAqB,EAAE,MAAM,4CAA4C,CAAC;AAGnF,MAAM,MAAM,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;AAExC,MAAM,UAAU,sBAAsB,CACpC,GAAS,EACT,IAA2B;IAE3B,mEAAmE;IACnE,qEAAqE;IACrE,mEAAmE;IACnE,6EAA6E;IAC7E,0EAA0E;IAC1E,0EAA0E;IAC1E,iEAAiE;IACjE,GAAG,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC,EAAE,EAAE;QAC9B,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QACpC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;QAClC,CAAC;QACD,MAAM,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,GAAG,CAAC;QACjD,MAAM,QAAQ,GAAG,UAAU;YACzB,CAAC,CAAC,QAAQ,CAAC,kBAAkB,EAAE;YAC/B,CAAC,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;QAC5B,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,0EAA0E;IAC1E,0EAA0E;IAC1E,wEAAwE;IACxE,0EAA0E;IAC1E,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QACpC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,qBAAqB,CAAC,CAAC,EAAE,GAAG,EAAE;gBACnC,YAAY,CAAC,qBAAqB,EAAE;oBAClC,KAAK,EAAE,eAAe;oBACtB,QAAQ,EAAE,eAAe;iBAC1B,CAAC;aACH,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,OAAO,qBAAqB,CAAC,CAAC,EAAE,GAAG,EAAE;gBACnC,YAAY,CAAC,6BAA6B,EAAE;oBAC1C,KAAK,EAAE,gBAAgB;oBACvB,QAAQ,EAAE,eAAe;iBAC1B,CAAC;aACH,CAAC,CAAC;QACL,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC,CAAC,CAAC,CAAC;QACzC,IAAI,CAAC,UAAU,CAAC,EAAE;YAAE,OAAO,UAAU,CAAC,QAAQ,CAAC;QAC/C,MAAM,IAAI,GAAG,UAAU,CAAC,IAAkD,CAAC;QAC3E,IAAI,IAAI,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;YAC3B,iEAAiE;YACjE,uDAAuD;YACvD,8DAA8D;YAC9D,kEAAkE;YAClE,oBAAoB;YACpB,OAAO,qBAAqB,CAAC,CAAC,EAAE,GAAG,EAAE;gBACnC,YAAY,CAAC,sBAAsB,EAAE;oBACnC,KAAK,EAAE,MAAM;oBACb,QAAQ,EAAE,OAAO;oBACjB,IAAI,EACF,sLAAsL;iBACzL,CAAC;aACH,EAAE;gBACD,YAAY,EAAE;oBACZ,OAAO,EACL,sLAAsL;iBACzL;aACF,CAAC,CAAC;QACL,CAAC;QACD,IAAI,IAAI,EAAE,IAAI,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,qBAAqB,CAAC,CAAC,EAAE,GAAG,EAAE;gBACnC,YAAY,CAAC,uBAAuB,EAAE;oBACpC,KAAK,EAAE,MAAM;oBACb,QAAQ,EAAE,IAAI,EAAE,IAAI,IAAI,WAAW;oBACnC,IAAI,EACF,4LAA4L;iBAC/L,CAAC;aACH,EAAE;gBACD,YAAY,EAAE;oBACZ,OAAO,EACL,4LAA4L;iBAC/L;aACF,CAAC,CAAC;QACL,CAAC;QACD,iEAAiE;QACjE,qEAAqE;QACrE,+CAA+C;QAE/C,MAAM,YAAY,GAAG,MAAM,uBAAuB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACnE,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,qBAAqB,CAAC,CAAC,EAAE,GAAG,EAAE;gBACnC,YAAY,CAAC,oCAAoC,EAAE;oBACjD,KAAK,EAAE,qBAAqB;oBAC5B,QAAQ,EAAE,SAAS;iBACpB,CAAC;aACH,EAAE,EAAE,YAAY,EAAE,EAAE,OAAO,EAAE,mDAAmD,EAAE,EAAE,CAAC,CAAC;QACzF,CAAC;QAED,IAAI,WAAyD,CAAC;QAC9D,IAAI,CAAC;YACH,WAAW,GAAG,MAAM,gBAAgB,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC;QACzD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,yBAAyB,EAAE,CAAC;gBAC7C,OAAO,qBAAqB,CAAC,CAAC,EAAE,GAAG,EAAE;oBACnC,YAAY,CAAC,oBAAoB,EAAE;wBACjC,KAAK,EAAE,eAAe;wBACtB,QAAQ,EAAE,GAAG,CAAC,OAAO;qBACtB,CAAC;iBACH,EAAE,EAAE,YAAY,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YACjD,CAAC;YACD,IAAI,GAAG,YAAY,kBAAkB,EAAE,CAAC;gBACtC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;YAChE,CAAC;YACD,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,gCAAgC,CAAC,CAAC;YACxD,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EACpF,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC;gBACxC,IAAI,EAAE,SAAS;gBACf,KAAK,EAAE,WAAW,CAAC,KAAK;gBACxB,KAAK,EAAE,OAAO,IAAI,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;gBAC/D,QAAQ,EAAE,OAAO;gBACjB,aAAa,EAAE,WAAW,CAAC,eAAe;aAC3C,CAAC,CAAC;YACH,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,qBAAqB,EAAE,CAAC;gBACzC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;YAChE,CAAC;YACD,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,EAAE,uCAAuC,CAAC,CAAC;YACzF,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,oBAAoB,EAAE,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAC1F,GAAG,CACJ,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,0EAA0E;IAC1E,+DAA+D;IAC/D,kEAAkE;IAClE,4BAA4B;IAC5B,mCAAmC;IACnC,EAAE;IACF,+EAA+E;IAC/E,0EAA0E;IAC1E,GAAG,CAAC,IAAI,CAAC,4BAA4B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACjD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QACpC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,qBAAqB,CAAC,CAAC,EAAE,GAAG,EAAE;gBACnC,YAAY,CAAC,qBAAqB,EAAE;oBAClC,KAAK,EAAE,eAAe;oBACtB,QAAQ,EAAE,eAAe;iBAC1B,CAAC;aACH,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,OAAO,qBAAqB,CAAC,CAAC,EAAE,GAAG,EAAE;gBACnC,YAAY,CAAC,6BAA6B,EAAE;oBAC1C,KAAK,EAAE,gBAAgB;oBACvB,QAAQ,EAAE,eAAe;iBAC1B,CAAC;aACH,CAAC,CAAC;QACL,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC,CAAC,CAAC,CAAC;QACzC,IAAI,CAAC,UAAU,CAAC,EAAE;YAAE,OAAO,UAAU,CAAC,QAAQ,CAAC;QAC/C,MAAM,IAAI,GAAG,UAAU,CAAC,IAAkD,CAAC;QAC3E,IAAI,IAAI,EAAE,IAAI,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,qBAAqB,CAAC,CAAC,EAAE,GAAG,EAAE;gBACnC,YAAY,CAAC,uBAAuB,EAAE;oBACpC,KAAK,EAAE,MAAM;oBACb,QAAQ,EAAE,IAAI,EAAE,IAAI,IAAI,WAAW;oBACnC,IAAI,EAAE,iGAAiG;iBACxG,CAAC;aACH,CAAC,CAAC;QACL,CAAC;QACD,8DAA8D;QAC9D,qEAAqE;QACrE,mDAAmD;QAEnD,MAAM,YAAY,GAAG,MAAM,uBAAuB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACnE,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,qBAAqB,CAAC,CAAC,EAAE,GAAG,EAAE;gBACnC,YAAY,CAAC,oCAAoC,EAAE;oBACjD,KAAK,EAAE,qBAAqB;oBAC5B,QAAQ,EAAE,SAAS;iBACpB,CAAC;aACH,EAAE,EAAE,YAAY,EAAE,EAAE,OAAO,EAAE,mDAAmD,EAAE,EAAE,CAAC,CAAC;QACzF,CAAC;QAED,MAAM,KAAK,GAAG,OAAO,IAAI,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QAEvE,OAAO,SAAS,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACnC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC;oBACtC,YAAY;oBACZ,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;wBACvB,MAAM,MAAM,CAAC,QAAQ,CAAC;4BACpB,KAAK,EAAE,QAAQ;4BACf,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;yBAC3B,CAAC,CAAC;oBACL,CAAC;iBACF,CAAC,CAAC;gBACH,IAAI,CAAC;oBACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC;wBACxC,IAAI,EAAE,SAAS;wBACf,KAAK,EAAE,MAAM,CAAC,KAAK;wBACnB,KAAK;wBACL,QAAQ,EAAE,OAAO;wBACjB,aAAa,EAAE,MAAM,CAAC,eAAe;qBACtC,CAAC,CAAC;oBACH,MAAM,MAAM,CAAC,QAAQ,CAAC;wBACpB,KAAK,EAAE,WAAW;wBAClB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC;qBAClC,CAAC,CAAC;gBACL,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAI,GAAG,YAAY,qBAAqB,EAAE,CAAC;wBACzC,MAAM,MAAM,CAAC,QAAQ,CAAC;4BACpB,KAAK,EAAE,QAAQ;4BACf,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;yBAChE,CAAC,CAAC;wBACH,OAAO;oBACT,CAAC;oBACD,MAAM,GAAG,CAAC;gBACZ,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,0BAA0B,CAAC,CAAC;gBAClD,MAAM,MAAM,CAAC,QAAQ,CAAC;oBACpB,KAAK,EAAE,QAAQ;oBACf,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;wBACnB,KAAK,EAAE,oBAAoB;wBAC3B,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;qBAC1D,CAAC;iBACH,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,0EAA0E;IAC1E,4EAA4E;IAC5E,oBAAoB;IACpB,GAAG,CAAC,KAAK,CAAC,2BAA2B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACjD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QACpC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,qBAAqB,CAAC,CAAC,EAAE,GAAG,EAAE;gBACnC,YAAY,CAAC,qBAAqB,EAAE;oBAClC,KAAK,EAAE,eAAe;oBACtB,QAAQ,EAAE,eAAe;iBAC1B,CAAC;aACH,CAAC,CAAC;QACL,CAAC;QACD,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAE3C,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC,CAAC,CAAC,CAAC;QACzC,IAAI,CAAC,UAAU,CAAC,EAAE;YAAE,OAAO,UAAU,CAAC,QAAQ,CAAC;QAC/C,MAAM,MAAM,GAAI,UAAU,CAAC,IAAoC,EAAE,MAAM,CAAC;QACxE,IAAI,OAAO,MAAM,KAAK,SAAS,EAAE,CAAC;YAChC,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,0BAA0B,EAAE,EAC9D,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAC5D,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,qBAAqB,CAAC,CAAC,EAAE,GAAG,EAAE;gBACnC,YAAY,CAAC,wBAAwB,EAAE;oBACrC,KAAK,EAAE,WAAW;oBAClB,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,WAAW;iBAC3C,CAAC;aACH,CAAC,CAAC;QACL,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,MAAM,CAAC,2BAA2B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QACpC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,qBAAqB,CAAC,CAAC,EAAE,GAAG,EAAE;gBACnC,YAAY,CAAC,qBAAqB,EAAE;oBAClC,KAAK,EAAE,eAAe;oBACtB,QAAQ,EAAE,eAAe;iBAC1B,CAAC;aACH,CAAC,CAAC;QACL,CAAC;QACD,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAC3C,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;QACxD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,qBAAqB,CAAC,CAAC,EAAE,GAAG,EAAE;gBACnC,YAAY,CAAC,wBAAwB,EAAE;oBACrC,KAAK,EAAE,WAAW;oBAClB,QAAQ,EAAE,SAAS;iBACpB,CAAC;aACH,CAAC,CAAC;QACL,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/api/routes/mail/_pa_wip_mail/mail/app-password.d.ts

@@ -1,4 +0,0 @@
-import type { Hono } from "hono";
-import type { MailRouteDependencies } from "./dependencies.js";
-export declare function registerAppPasswordRoutes(app: Hono, deps: MailRouteDependencies): void;
-//# sourceMappingURL=app-password.d.ts.map

package/dist/api/routes/mail/_pa_wip_mail/mail/app-password.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"app-password.d.ts","sourceRoot":"","sources":["../../../../../../src/api/routes/mail/_pa_wip_mail/mail/app-password.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAejC,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAI/D,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,IAAI,EACT,IAAI,EAAE,qBAAqB,GAC1B,IAAI,CA6NN"}

package/dist/api/routes/mail/_pa_wip_mail/mail/app-password.js

@@ -1,192 +0,0 @@
-import { createLogger } from "../../../logging.js";
-import { readJsonBody } from "../../json-body.js";
-import { composeIssue, respondWithAgentError } from "../../helpers/agent-errors.js";
-import { buildImapAccountSecret, isImapAppPasswordKind, serializeImapAccountSecret, } from "../../../services/mail/imap/app-password.js";
-import { classifyImapAuthFailure } from "../../../services/mail/imap/auth-failure-classifier.js";
-import { verifyImapAccountSecret } from "../../../services/mail/imap/client.js";
-import { DuplicateAccountError, ProviderNotImplementedError, } from "../../../services/mail/account-registry.js";
-const logger = createLogger("mail-api");
-export function registerAppPasswordRoutes(app, deps) {
-    const verifyImapCredentials = deps.verifyImapAccountSecret ?? verifyImapAccountSecret;
-    app.post("/config/mail/app-password", async (c) => {
-        const registry = deps.services.mail;
-        if (!registry) {
-            return respondWithAgentError(c, 503, [
-                composeIssue("mail.not_configured", {
-                    field: "services.mail",
-                    received: "<unavailable>",
-                }),
-            ]);
-        }
-        const parsedBody = await readJsonBody(c);
-        if (!parsedBody.ok)
-            return parsedBody.response;
-        const body = parsedBody.body;
-        const kindCandidate = typeof body?.kind === "string" ? body.kind : null;
-        const email = typeof body?.email === "string" ? body.email : null;
-        const appPassword = typeof body?.appPassword === "string" ? body.appPassword : null;
-        if (!kindCandidate ||
-            !isImapAppPasswordKind(kindCandidate) ||
-            !email ||
-            email.length === 0 ||
-            !appPassword ||
-            appPassword.length === 0) {
-            return c.json({
-                error: "invalid_body",
-                message: "kind(yahoo|icloud), email, and appPassword are required.",
-            }, 400);
-        }
-        const kind = kindCandidate;
-        // §UI v2 auth-then-enable: registration allowed regardless of
-        // enabledMailProviders. The Enable toggle on the dashboard mail card
-        // governs whether the agent observes this account.
-        const secret = buildImapAccountSecret(kind, email, appPassword);
-        let capabilities;
-        try {
-            capabilities = await verifyImapCredentials(secret);
-        }
-        catch (err) {
-            const classified = classifyImapAuthFailure({
-                errorName: err instanceof Error ? err.name : null,
-                message: getImapErrorMessage(err),
-                responseCode: getErrorResponseCode(err),
-            });
-            if (classified.status === "requires_consent") {
-                return c.json({
-                    error: "imap_auth_failed",
-                    message: "IMAP login failed. Verify the email address and app password, then try again.",
-                }, 400);
-            }
-            if (classified.status === "degraded" || classified.status === "transient") {
-                return c.json({
-                    error: "imap_connect_failed",
-                    message: "The IMAP server could not be reached or rejected the login attempt. Try again shortly.",
-                }, 502);
-            }
-            logger.error({ err, kind, email }, "app-password IMAP verification failed");
-            return c.json({ error: "add_account_failed", message: err instanceof Error ? err.message : String(err) }, 500);
-        }
-        try {
-            const account = await registry.addAccount({
-                kind,
-                email,
-                label: typeof body?.label === "string" ? body.label : undefined,
-                authType: "app_password",
-                secretPayload: serializeImapAccountSecret(secret),
-                idleEnabled: true,
-                capabilities: capabilities ?? undefined,
-            });
-            return c.json({ status: "completed", account });
-        }
-        catch (err) {
-            if (err instanceof DuplicateAccountError) {
-                return c.json({ error: err.code, message: err.message }, 409);
-            }
-            if (err instanceof ProviderNotImplementedError) {
-                return c.json({ error: err.code, message: err.message }, 400);
-            }
-            logger.error({ err, kind, email }, "app-password account add failed");
-            return c.json({ error: "add_account_failed", message: err instanceof Error ? err.message : String(err) }, 500);
-        }
-    });
-    // Refresh an existing IMAP (Yahoo / iCloud) account's app password without
-    // deleting and re-creating the row. Used when the user rotates the password
-    // at the provider and the account flips to `requires_consent`. The route
-    // verifies the new credentials against the IMAP server before persisting,
-    // then resets `auth_status` to `healthy`.
-    app.post("/config/mail/app-password/:accountId/refresh", async (c) => {
-        const registry = deps.services.mail;
-        if (!registry) {
-            return respondWithAgentError(c, 503, [
-                composeIssue("mail.not_configured", {
-                    field: "services.mail",
-                    received: "<unavailable>",
-                }),
-            ]);
-        }
-        const accountId = c.req.param("accountId");
-        const account = registry.getAccount(accountId);
-        if (!account) {
-            return respondWithAgentError(c, 404, [
-                composeIssue("mail.account_not_found", {
-                    field: "accountId",
-                    received: accountId,
-                }),
-            ]);
-        }
-        if (account.kind !== "yahoo" && account.kind !== "icloud") {
-            return respondWithAgentError(c, 400, [
-                composeIssue("mail.unsupported_kind", {
-                    field: "account.kind",
-                    received: account.kind,
-                    hint: "App-password refresh only supports yahoo / icloud. Outlook re-authenticates via the OAuth loopback flow.",
-                }),
-            ], { legacyFields: { message: "App-password refresh only supports yahoo / icloud. Outlook re-authenticates via the OAuth loopback flow." } });
-        }
-        const parsedBody = await readJsonBody(c);
-        if (!parsedBody.ok)
-            return parsedBody.response;
-        const body = parsedBody.body;
-        const appPassword = typeof body?.appPassword === "string" ? body.appPassword : null;
-        if (!appPassword || appPassword.length === 0) {
-            return c.json({ error: "invalid_body", message: "appPassword is required." }, 400);
-        }
-        const secret = buildImapAccountSecret(account.kind, account.email, appPassword);
-        let capabilities;
-        try {
-            capabilities = await verifyImapCredentials(secret);
-        }
-        catch (err) {
-            const classified = classifyImapAuthFailure({
-                errorName: err instanceof Error ? err.name : null,
-                message: getImapErrorMessage(err),
-                responseCode: getErrorResponseCode(err),
-            });
-            if (classified.status === "requires_consent") {
-                return c.json({
-                    error: "imap_auth_failed",
-                    message: "IMAP login failed with the new password. Generate a fresh app password and try again.",
-                }, 400);
-            }
-            if (classified.status === "degraded" || classified.status === "transient") {
-                return c.json({
-                    error: "imap_connect_failed",
-                    message: "The IMAP server could not be reached. Try again shortly.",
-                }, 502);
-            }
-            logger.error({ err, accountId }, "app-password refresh verification failed");
-            return c.json({ error: "refresh_failed", message: err instanceof Error ? err.message : String(err) }, 500);
-        }
-        try {
-            const updated = await registry.refreshImapSecret(accountId, serializeImapAccountSecret(secret), capabilities ?? undefined);
-            if (!updated) {
-                return respondWithAgentError(c, 404, [
-                    composeIssue("mail.account_not_found", {
-                        field: "accountId",
-                        received: c.req.param("id") ?? "<unknown>",
-                    }),
-                ]);
-            }
-            return c.json({ status: "refreshed", account: updated });
-        }
-        catch (err) {
-            logger.error({ err, accountId }, "app-password refresh failed");
-            return c.json({ error: "refresh_failed", message: err instanceof Error ? err.message : String(err) }, 500);
-        }
-    });
-}
-function getErrorResponseCode(err) {
-    const candidate = err?.responseCode;
-    return typeof candidate === "number" ? candidate : null;
-}
-// ImapFlow sets err.message to the generic "Command failed" and puts the
-// actual IMAP server response code in serverResponseCode (e.g. "AUTHENTICATIONFAILED")
-// and the human text in responseText. Concatenate all three so that the
-// classifyImapAuthFailure patterns can match the real server response.
-function getImapErrorMessage(err) {
-    if (!(err instanceof Error))
-        return String(err);
-    const e = err;
-    return [err.message, e.serverResponseCode, e.responseText].filter(Boolean).join(" ");
-}
-//# sourceMappingURL=app-password.js.map

package/dist/api/routes/mail/_pa_wip_mail/mail/app-password.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"app-password.js","sourceRoot":"","sources":["../../../../../../src/api/routes/mail/_pa_wip_mail/mail/app-password.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AACpF,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,0BAA0B,GAC3B,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AACjG,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AAChF,OAAO,EACL,qBAAqB,EACrB,2BAA2B,GAC5B,MAAM,4CAA4C,CAAC;AAGpD,MAAM,MAAM,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;AAExC,MAAM,UAAU,yBAAyB,CACvC,GAAS,EACT,IAA2B;IAE3B,MAAM,qBAAqB,GACzB,IAAI,CAAC,uBAAuB,IAAI,uBAAuB,CAAC;IAE1D,GAAG,CAAC,IAAI,CAAC,2BAA2B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAChD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QACpC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,qBAAqB,CAAC,CAAC,EAAE,GAAG,EAAE;gBACnC,YAAY,CAAC,qBAAqB,EAAE;oBAClC,KAAK,EAAE,eAAe;oBACtB,QAAQ,EAAE,eAAe;iBAC1B,CAAC;aACH,CAAC,CAAC;QACL,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC,CAAC,CAAC,CAAC;QACzC,IAAI,CAAC,UAAU,CAAC,EAAE;YAAE,OAAO,UAAU,CAAC,QAAQ,CAAC;QAC/C,MAAM,IAAI,GAAG,UAAU,CAAC,IAKhB,CAAC;QACT,MAAM,aAAa,GAAG,OAAO,IAAI,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;QACxE,MAAM,KAAK,GAAG,OAAO,IAAI,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;QAClE,MAAM,WAAW,GACf,OAAO,IAAI,EAAE,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;QAElE,IACE,CAAC,aAAa;YACd,CAAC,qBAAqB,CAAC,aAAa,CAAC;YACrC,CAAC,KAAK;YACN,KAAK,CAAC,MAAM,KAAK,CAAC;YAClB,CAAC,WAAW;YACZ,WAAW,CAAC,MAAM,KAAK,CAAC,EACxB,CAAC;YACD,OAAO,CAAC,CAAC,IAAI,CACX;gBACE,KAAK,EAAE,cAAc;gBACrB,OAAO,EAAE,0DAA0D;aACpE,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,aAAa,CAAC;QAC3B,8DAA8D;QAC9D,qEAAqE;QACrE,mDAAmD;QAEnD,MAAM,MAAM,GAAG,sBAAsB,CAAC,IAAI,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;QAChE,IAAI,YAAwE,CAAC;QAC7E,IAAI,CAAC;YACH,YAAY,GAAG,MAAM,qBAAqB,CAAC,MAAM,CAAC,CAAC;QACrD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,UAAU,GAAG,uBAAuB,CAAC;gBACzC,SAAS,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;gBACjD,OAAO,EAAE,mBAAmB,CAAC,GAAG,CAAC;gBACjC,YAAY,EAAE,oBAAoB,CAAC,GAAG,CAAC;aACxC,CAAC,CAAC;YACH,IAAI,UAAU,CAAC,MAAM,KAAK,kBAAkB,EAAE,CAAC;gBAC7C,OAAO,CAAC,CAAC,IAAI,CACX;oBACE,KAAK,EAAE,kBAAkB;oBACzB,OAAO,EACL,+EAA+E;iBAClF,EACD,GAAG,CACJ,CAAC;YACJ,CAAC;YACD,IAAI,UAAU,CAAC,MAAM,KAAK,UAAU,IAAI,UAAU,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;gBAC1E,OAAO,CAAC,CAAC,IAAI,CACX;oBACE,KAAK,EAAE,qBAAqB;oBAC5B,OAAO,EACL,wFAAwF;iBAC3F,EACD,GAAG,CACJ,CAAC;YACJ,CAAC;YACD,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,uCAAuC,CAAC,CAAC;YAC5E,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,oBAAoB,EAAE,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAC1F,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC;gBACxC,IAAI;gBACJ,KAAK;gBACL,KAAK,EAAE,OAAO,IAAI,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;gBAC/D,QAAQ,EAAE,cAAc;gBACxB,aAAa,EAAE,0BAA0B,CAAC,MAAM,CAAC;gBACjD,WAAW,EAAE,IAAI;gBACjB,YAAY,EAAE,YAAY,IAAI,SAAS;aACxC,CAAC,CAAC;YACH,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,qBAAqB,EAAE,CAAC;gBACzC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;YAChE,CAAC;YACD,IAAI,GAAG,YAAY,2BAA2B,EAAE,CAAC;gBAC/C,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;YAChE,CAAC;YACD,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,iCAAiC,CAAC,CAAC;YACtE,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,oBAAoB,EAAE,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAC1F,GAAG,CACJ,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,2EAA2E;IAC3E,4EAA4E;IAC5E,yEAAyE;IACzE,0EAA0E;IAC1E,0CAA0C;IAC1C,GAAG,CAAC,IAAI,CAAC,8CAA8C,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACnE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QACpC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,qBAAqB,CAAC,CAAC,EAAE,GAAG,EAAE;gBACnC,YAAY,CAAC,qBAAqB,EAAE;oBAClC,KAAK,EAAE,eAAe;oBACtB,QAAQ,EAAE,eAAe;iBAC1B,CAAC;aACH,CAAC,CAAC;QACL,CAAC;QAED,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAC3C,MAAM,OAAO,GAAG,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAC/C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,qBAAqB,CAAC,CAAC,EAAE,GAAG,EAAE;gBACnC,YAAY,CAAC,wBAAwB,EAAE;oBACrC,KAAK,EAAE,WAAW;oBAClB,QAAQ,EAAE,SAAS;iBACpB,CAAC;aACH,CAAC,CAAC;QACL,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC1D,OAAO,qBAAqB,CAAC,CAAC,EAAE,GAAG,EAAE;gBACnC,YAAY,CAAC,uBAAuB,EAAE;oBACpC,KAAK,EAAE,cAAc;oBACrB,QAAQ,EAAE,OAAO,CAAC,IAAI;oBACtB,IAAI,EACF,0GAA0G;iBAC7G,CAAC;aACH,EAAE,EAAE,YAAY,EAAE,EAAE,OAAO,EAAE,0GAA0G,EAAE,EAAE,CAAC,CAAC;QAChJ,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC,CAAC,CAAC,CAAC;QACzC,IAAI,CAAC,UAAU,CAAC,EAAE;YAAE,OAAO,UAAU,CAAC,QAAQ,CAAC;QAC/C,MAAM,IAAI,GAAG,UAAU,CAAC,IAAwC,CAAC;QACjE,MAAM,WAAW,GACf,OAAO,IAAI,EAAE,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;QAClE,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7C,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,0BAA0B,EAAE,EAC9D,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,sBAAsB,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QAChF,IAAI,YAAwE,CAAC;QAC7E,IAAI,CAAC;YACH,YAAY,GAAG,MAAM,qBAAqB,CAAC,MAAM,CAAC,CAAC;QACrD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,UAAU,GAAG,uBAAuB,CAAC;gBACzC,SAAS,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;gBACjD,OAAO,EAAE,mBAAmB,CAAC,GAAG,CAAC;gBACjC,YAAY,EAAE,oBAAoB,CAAC,GAAG,CAAC;aACxC,CAAC,CAAC;YACH,IAAI,UAAU,CAAC,MAAM,KAAK,kBAAkB,EAAE,CAAC;gBAC7C,OAAO,CAAC,CAAC,IAAI,CACX;oBACE,KAAK,EAAE,kBAAkB;oBACzB,OAAO,EACL,uFAAuF;iBAC1F,EACD,GAAG,CACJ,CAAC;YACJ,CAAC;YACD,IAAI,UAAU,CAAC,MAAM,KAAK,UAAU,IAAI,UAAU,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;gBAC1E,OAAO,CAAC,CAAC,IAAI,CACX;oBACE,KAAK,EAAE,qBAAqB;oBAC5B,OAAO,EACL,0DAA0D;iBAC7D,EACD,GAAG,CACJ,CAAC;YACJ,CAAC;YACD,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,0CAA0C,CAAC,CAAC;YAC7E,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,gBAAgB,EAAE,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EACtF,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,iBAAiB,CAC9C,SAAS,EACT,0BAA0B,CAAC,MAAM,CAAC,EAClC,YAAY,IAAI,SAAS,CAC1B,CAAC;YACF,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,qBAAqB,CAAC,CAAC,EAAE,GAAG,EAAE;oBACnC,YAAY,CAAC,wBAAwB,EAAE;wBACrC,KAAK,EAAE,WAAW;wBAClB,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,WAAW;qBAC3C,CAAC;iBACH,CAAC,CAAC;YACL,CAAC;YACD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QAC3D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,6BAA6B,CAAC,CAAC;YAChE,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,gBAAgB,EAAE,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EACtF,GAAG,CACJ,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,oBAAoB,CAAC,GAAY;IACxC,MAAM,SAAS,GAAI,GAAyC,EAAE,YAAY,CAAC;IAC3E,OAAO,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1D,CAAC;AAED,yEAAyE;AACzE,uFAAuF;AACvF,wEAAwE;AACxE,uEAAuE;AACvE,SAAS,mBAAmB,CAAC,GAAY;IACvC,IAAI,CAAC,CAAC,GAAG,YAAY,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;IAChD,MAAM,CAAC,GAAG,GAA6D,CAAC;IACxE,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,kBAAkB,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACvF,CAAC"}