@cosmicdrift/kumiko-bundled-features 0.141.0 → 0.143.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.141.0",
+  "version": "0.143.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -48,6 +48,9 @@
     "./subscription-mollie": "./src/subscription-mollie/index.ts",
     "./foundation-shared": "./src/foundation-shared/index.ts",
     "./mail-foundation": "./src/mail-foundation/index.ts",
+    "./inbound-mail-foundation": "./src/inbound-mail-foundation/index.ts",
+    "./inbound-provider-inmemory": "./src/inbound-provider-inmemory/index.ts",
+    "./inbound-provider-imap": "./src/inbound-provider-imap/index.ts",
     "./mail-transport-smtp": "./src/mail-transport-smtp/index.ts",
     "./mail-transport-inmemory": "./src/mail-transport-inmemory/index.ts",
     "./file-foundation": "./src/file-foundation/index.ts",
@@ -107,12 +110,14 @@
     "./step-dispatcher": "./src/step-dispatcher/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.141.0",
-    "@cosmicdrift/kumiko-framework": "0.141.0",
-    "@cosmicdrift/kumiko-headless": "0.141.0",
-    "@cosmicdrift/kumiko-renderer": "0.141.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.141.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.143.0",
+    "@cosmicdrift/kumiko-framework": "0.143.0",
+    "@cosmicdrift/kumiko-headless": "0.143.0",
+    "@cosmicdrift/kumiko-renderer": "0.143.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.143.0",
     "@mollie/api-client": "^4.5.0",
+    "imapflow": "^1.3.3",
+    "mailparser": "^3.9.8",
     "@node-rs/argon2": "^2.0.2",
     "@types/nodemailer": "^8.0.0",
     "clsx": "^2.1.1",
@@ -133,6 +138,7 @@
     "LICENSE"
   ],
   "devDependencies": {
-    "@testing-library/user-event": "^14.6.1"
+    "@testing-library/user-event": "^14.6.1",
+    "@types/mailparser": "^3.4.6"
   }
 }

package/src/inbound-mail-foundation/__tests__/feature.test.ts

@@ -0,0 +1,169 @@
+// feature.ts contract tests for inbound-mail-foundation.
+
+import { describe, expect, test } from "bun:test";
+import { Temporal } from "temporal-polyfill";
+import { inboundMessageAggregateId, mailThreadAggregateId } from "../aggregate-id";
+import {
+  INBOUND_MAIL_FOUNDATION_FEATURE,
+  INBOUND_MAIL_PROVIDER_EXTENSION,
+  inboundCredentialSecretKey,
+} from "../constants";
+import { inboundMailFoundationFeature } from "../feature";
+import { isVisibleToCaller } from "../handlers/scope-visibility";
+import { signOAuthState, verifyOAuthState } from "../oauth-state";
+import { isInboundMailProviderPlugin } from "../types";
+
+describe("inboundMailFoundationFeature — shape", () => {
+  test("has the expected name", () => {
+    expect(inboundMailFoundationFeature.name).toBe(INBOUND_MAIL_FOUNDATION_FEATURE);
+    expect(inboundMailFoundationFeature.name).toBe("inbound-mail-foundation");
+  });
+
+  test("does NOT require config — Multi-Provider, Provider-Config liegt in den Plugins", () => {
+    // Drift-Pin (Plan §1.3): KEIN globaler provider-config-key. Ein
+    // Tenant kann parallel IMAP + M365 + Gmail verbinden — der Provider
+    // steht pro MailAccount-Row.
+    expect(inboundMailFoundationFeature.requires).not.toContain("config");
+  });
+
+  test("declares the 'inboundMailProvider' extension-point", () => {
+    expect(
+      inboundMailFoundationFeature.registrarExtensions[INBOUND_MAIL_PROVIDER_EXTENSION],
+    ).toBeDefined();
+  });
+
+  test("5 domain-events registriert", () => {
+    const events = inboundMailFoundationFeature.events;
+    expect(events["mail-account-connected"]).toBeDefined();
+    expect(events["mail-account-updated"]).toBeDefined();
+    expect(events["mail-account-disconnected"]).toBeDefined();
+    expect(events["inbound-message-received"]).toBeDefined();
+    expect(events["mail-thread-updated"]).toBeDefined();
+  });
+
+  test("SyncCursor + SeenMessage sind unmanaged (NICHT event-sourced, Plan §3.4)", () => {
+    // Drift-Pin: als r.entity würden die Tick-State-Tabellen (a) das
+    // Event-Log fluten und (b) beim Projection-Rebuild gewischt.
+    const unmanaged = Object.keys(inboundMailFoundationFeature.unmanagedTables);
+    expect(unmanaged.length).toBe(2);
+  });
+});
+
+describe("aggregate-ids — deterministic drift-pins", () => {
+  // In Stein gemeißelt: ein Namespace-Wechsel würde jeden existing
+  // Stream re-keyen → kaputte Idempotency. Werte einmalig berechnet.
+  test("inboundMessageAggregateId is stable", () => {
+    expect(inboundMessageAggregateId("11111111-1111-1111-1111-111111111111", "uid-42")).toBe(
+      "c3a5c3fc-706e-5c66-8617-d6c08e0f4a6b",
+    );
+  });
+
+  test("mailThreadAggregateId is stable", () => {
+    expect(
+      mailThreadAggregateId("22222222-2222-2222-2222-222222222222", "mid:root@example.com"),
+    ).toBe("45c4d3a9-0a97-5a0b-a3c5-4ba9c8740dcd");
+  });
+
+  test("same account + same providerMessageId → same stream (dedup anchor)", () => {
+    const a = inboundMessageAggregateId("acc", "m1");
+    expect(inboundMessageAggregateId("acc", "m1")).toBe(a);
+    expect(inboundMessageAggregateId("acc2", "m1")).not.toBe(a);
+    expect(inboundMessageAggregateId("acc", "m2")).not.toBe(a);
+  });
+});
+
+describe("oauth-state — sign/verify roundtrip", () => {
+  const secret = "test-state-secret";
+  const payload = {
+    tenantId: "00000000-0000-0000-0000-00000000aaaa",
+    ownerUserId: "00000000-0000-0000-0000-00000000bbbb",
+    providerKey: "imap",
+    mailbox: "user@example.com",
+  };
+
+  test("roundtrip carries tenantId + ownerUserId + providerKey + mailbox", () => {
+    const state = signOAuthState(payload, 15, secret);
+    const verified = verifyOAuthState(state, secret);
+    expect(verified.ok).toBe(true);
+    if (!verified.ok) return;
+    expect(verified.payload.tenantId).toBe(payload.tenantId);
+    expect(verified.payload.ownerUserId).toBe(payload.ownerUserId);
+    expect(verified.payload.providerKey).toBe("imap");
+    expect(verified.payload.mailbox).toBe("user@example.com");
+    expect(verified.payload.nonce.length).toBeGreaterThan(0);
+  });
+
+  test("ownerUserId=null (shared mailbox) survives the roundtrip", () => {
+    const state = signOAuthState({ ...payload, ownerUserId: null }, 15, secret);
+    const verified = verifyOAuthState(state, secret);
+    expect(verified.ok).toBe(true);
+    if (!verified.ok) return;
+    expect(verified.payload.ownerUserId).toBeNull();
+  });
+
+  test("tampered payload → bad_signature", () => {
+    const state = signOAuthState(payload, 15, secret);
+    const [b64, exp, sig] = state.split(".");
+    const evil = {
+      ...payload,
+      tenantId: "00000000-0000-0000-0000-00000000cccc",
+      nonce: "x",
+    };
+    const evilB64 = Buffer.from(JSON.stringify(evil), "utf8").toString("base64url");
+    const forged = `${evilB64}.${exp}.${sig}`;
+    expect(b64).not.toBe(evilB64);
+    expect(verifyOAuthState(forged, secret)).toEqual({ ok: false, reason: "bad_signature" });
+  });
+
+  test("wrong secret → bad_signature", () => {
+    const state = signOAuthState(payload, 15, secret);
+    expect(verifyOAuthState(state, "other-secret")).toEqual({
+      ok: false,
+      reason: "bad_signature",
+    });
+  });
+
+  test("expired state → expired", () => {
+    const past = Temporal.Now.instant().subtract({ hours: 1 });
+    const state = signOAuthState(payload, 15, secret, past);
+    expect(verifyOAuthState(state, secret)).toEqual({ ok: false, reason: "expired" });
+  });
+
+  test("garbage → malformed", () => {
+    expect(verifyOAuthState("not-a-state", secret)).toEqual({ ok: false, reason: "malformed" });
+  });
+});
+
+describe("scope-visibility (Plan Entscheidung 2)", () => {
+  const owner = { id: "user-1", roles: ["User"] as const };
+  const other = { id: "user-2", roles: ["User"] as const };
+  const admin = { id: "user-3", roles: ["TenantAdmin"] as const };
+
+  test("shared row (ownerUserId=null) ist für alle sichtbar", () => {
+    expect(isVisibleToCaller({ ownerUserId: null }, owner)).toBe(true);
+    expect(isVisibleToCaller({ ownerUserId: null }, other)).toBe(true);
+  });
+
+  test("persönliche Row nur für Owner + TenantAdmin", () => {
+    const row = { ownerUserId: "user-1" };
+    expect(isVisibleToCaller(row, owner)).toBe(true);
+    expect(isVisibleToCaller(row, other)).toBe(false);
+    expect(isVisibleToCaller(row, admin)).toBe(true);
+  });
+});
+
+describe("plugin type-guard + secret-key helper", () => {
+  test("isInboundMailProviderPlugin verlangt verify + fetch", () => {
+    expect(isInboundMailProviderPlugin({ verify: async () => {}, fetch: async () => ({}) })).toBe(
+      true,
+    );
+    expect(isInboundMailProviderPlugin({ verify: async () => {} })).toBe(false);
+    expect(isInboundMailProviderPlugin(null)).toBe(false);
+  });
+
+  test("inboundCredentialSecretKey ist per-Account gekeyt", () => {
+    expect(inboundCredentialSecretKey("abc")).toBe(
+      "inbound-mail-foundation:inbound.credential.abc",
+    );
+  });
+});

package/src/inbound-mail-foundation/__tests__/inbound-mail-foundation.integration.test.ts

@@ -0,0 +1,437 @@
+// Integration-test für inbound-mail-foundation. Treibt connect/ingest/
+// list/disconnect durch den full Dispatcher + DB (setupTestStack, echte
+// HTTP — kein Fake-Dispatcher).
+//
+// Plan-Pflicht-Szenarien (§6 Phase 1):
+//   - Dedup: 2× dieselbe providerMessageId → 1 Event/Row, duplicate=true
+//   - Raw-Event-Row: PII als Ciphertext im Event-Store, Klartext nur
+//     über die decrypt-on-read-Queries
+//   - Projection-Rebuild: Event-Log-Replay reproduziert die Read-Models
+//   - Scope-Sichtbarkeit (ownerUserId): persönliches Postfach nur für
+//     Owner + TenantAdmin
+//   - Crypto-Shredding: Subject-Key-Erase macht Payload unlesbar (#800)
+
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import {
+  configuredPiiSubjectKms,
+  configurePiiSubjectKms,
+  decryptPiiFieldValues,
+  InMemoryKmsAdapter,
+  isPiiCiphertext,
+  PII_ERASED_SENTINEL,
+  resetPiiSubjectKmsForTests,
+} from "@cosmicdrift/kumiko-framework/crypto";
+import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import { createEventsTable, loadAggregate } from "@cosmicdrift/kumiko-framework/event-store";
+import { rebuildProjection } from "@cosmicdrift/kumiko-framework/pipeline";
+import {
+  createTestUser,
+  setupTestStack,
+  type TestStack,
+  testTenantId,
+  unsafeCreateEntityTable,
+} from "@cosmicdrift/kumiko-framework/stack";
+import {
+  createComplianceProfilesFeature,
+  tenantComplianceProfileEntity,
+} from "../../compliance-profiles";
+import { createConfigFeature } from "../../config";
+import { inboundProviderInMemoryFeature } from "../../inbound-provider-inmemory";
+import { createTenantFeature } from "../../tenant/feature";
+import { createTenantLifecycleFeature } from "../../tenant-lifecycle";
+import { inboundMessageAggregateId, mailThreadAggregateId } from "../aggregate-id";
+import { InboundMailFoundationHandlers, InboundMailFoundationQueries } from "../constants";
+import { seenMessageEntity, syncCursorEntity } from "../entities";
+import { inboundMailFoundationFeature } from "../feature";
+import {
+  inboundMessagesProjectionTable,
+  mailAccountsProjectionTable,
+  mailThreadsProjectionTable,
+} from "../projection";
+
+// =============================================================================
+// Setup
+// =============================================================================
+
+let stack: TestStack;
+let db: DbConnection;
+
+beforeAll(async () => {
+  stack = await setupTestStack({
+    features: [
+      createConfigFeature(),
+      createTenantFeature(),
+      createComplianceProfilesFeature(),
+      createTenantLifecycleFeature(),
+      inboundMailFoundationFeature,
+      inboundProviderInMemoryFeature,
+    ],
+  });
+  db = stack.db;
+  await createEventsTable(db);
+  await unsafeCreateEntityTable(db, tenantComplianceProfileEntity);
+  // Unmanaged direct-write stores — kein r.entity, kein Auto-Push.
+  await unsafeCreateEntityTable(db, syncCursorEntity);
+  await unsafeCreateEntityTable(db, seenMessageEntity);
+  // PII-Felder sind tenantOwned — Handler rufen configuredPiiSubjectKms()
+  // direkt (raw r.projection, kein Executor-Wiring), wie run{Prod,Dev}App
+  // at boot.
+  configurePiiSubjectKms(new InMemoryKmsAdapter());
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+  resetPiiSubjectKmsForTests();
+});
+
+function adminFor(tenantNumber: number) {
+  return createTestUser({
+    id: tenantNumber,
+    tenantId: testTenantId(tenantNumber),
+    roles: ["TenantAdmin", "SystemAdmin"],
+  });
+}
+
+function ingestPayload(
+  accountId: string,
+  overrides: Partial<{
+    ownerUserId: string | null;
+    providerMessageId: string;
+    messageIdHeader: string | null;
+    references: string[];
+    from: string;
+    subject: string;
+    receivedAtIso: string;
+  }> = {},
+) {
+  return {
+    accountId,
+    ownerUserId: overrides.ownerUserId ?? null,
+    providerName: "inmemory",
+    providerMessageId: overrides.providerMessageId ?? "uid-1",
+    messageIdHeader: overrides.messageIdHeader ?? "msg-1@example.com",
+    providerThreadId: null,
+    references: overrides.references ?? [],
+    from: overrides.from ?? "sender@example.com",
+    to: ["inbox@tenant.example"],
+    cc: [],
+    subject: overrides.subject ?? "Hello",
+    snippet: "Hello world …",
+    receivedAtIso: overrides.receivedAtIso ?? "2026-07-01T10:00:00Z",
+    bodyRef: "",
+    scope: "inbox",
+    providerCursor: '{"offset":1}',
+  };
+}
+
+async function connectSharedAccount(admin: ReturnType<typeof adminFor>): Promise<string> {
+  const result = (await stack.http.writeOk(
+    InboundMailFoundationHandlers.connectAccount,
+    {
+      provider: "inmemory",
+      authMethod: "password",
+      displayName: "Team-Inbox",
+      address: "inbox@tenant.example",
+      scope: "shared",
+    },
+    admin,
+  )) as { accountId: string };
+  expect(result.accountId).toBeDefined();
+  return result.accountId;
+}
+
+// =============================================================================
+// Scenarios
+// =============================================================================
+
+describe("scenario 1: connect-account + list mit decrypt-on-read", () => {
+  test("connect legt Stream + Projection-Row an; address ist at-rest Ciphertext, list liefert Klartext", async () => {
+    const admin = adminFor(4001);
+    const accountId = await connectSharedAccount(admin);
+
+    // Raw event-log payload: Ciphertext.
+    const events = await loadAggregate(db, accountId, admin.tenantId);
+    expect(events).toHaveLength(1);
+    const payload = events[0]?.payload as { address?: string };
+    expect(payload.address).not.toBe("inbox@tenant.example");
+    expect(isPiiCiphertext(payload.address)).toBe(true);
+
+    // Raw projection row: Ciphertext.
+    const rawRows = await selectMany(db, mailAccountsProjectionTable, { id: accountId });
+    expect(rawRows).toHaveLength(1);
+    expect(isPiiCiphertext(rawRows[0]?.["address"])).toBe(true);
+    expect(rawRows[0]?.["status"]).toBe("active");
+
+    // decrypt-on-read list-query: Klartext.
+    const list = (await stack.http.queryOk(
+      InboundMailFoundationQueries.listAccounts,
+      {},
+      admin,
+    )) as { rows: Array<Record<string, unknown>> };
+    const row = list.rows.find((r) => r["id"] === accountId);
+    expect(row?.["address"]).toBe("inbox@tenant.example");
+  });
+});
+
+describe("scenario 2: ingest-message — Dedup + Thread-Rollup", () => {
+  test("dieselbe providerMessageId 2× → genau 1 Row, duplicate=true; Thread zählt korrekt", async () => {
+    const admin = adminFor(4002);
+    const accountId = await connectSharedAccount(admin);
+
+    const first = (await stack.http.writeOk(
+      InboundMailFoundationHandlers.ingestMessage,
+      ingestPayload(accountId, { providerMessageId: "uid-1", messageIdHeader: "root@example.com" }),
+      admin,
+    )) as Record<string, unknown>;
+    expect(first["duplicate"]).toBe(false);
+    expect(first["inboundMessageAggregateId"]).toBe(inboundMessageAggregateId(accountId, "uid-1"));
+
+    // Replay (IDLE-Doppel-Notify / Cursor-Overlap) → duplicate, kein 2. Row.
+    const replay = (await stack.http.writeOk(
+      InboundMailFoundationHandlers.ingestMessage,
+      ingestPayload(accountId, { providerMessageId: "uid-1", messageIdHeader: "root@example.com" }),
+      admin,
+    )) as Record<string, unknown>;
+    expect(replay["duplicate"]).toBe(true);
+
+    const msgRows = await selectMany(db, inboundMessagesProjectionTable, {
+      accountId,
+    });
+    expect(msgRows).toHaveLength(1);
+
+    // Reply im selben Thread (References-Root) → Thread-Count 2.
+    const reply = (await stack.http.writeOk(
+      InboundMailFoundationHandlers.ingestMessage,
+      ingestPayload(accountId, {
+        providerMessageId: "uid-2",
+        messageIdHeader: "reply-1@example.com",
+        references: ["root@example.com"],
+        subject: "Re: Hello",
+        receivedAtIso: "2026-07-01T11:00:00Z",
+      }),
+      admin,
+    )) as Record<string, unknown>;
+    expect(reply["duplicate"]).toBe(false);
+    expect(reply["threadKey"]).toBe("mid:root@example.com");
+    expect(reply["threadAggregateId"]).toBe(
+      mailThreadAggregateId(admin.tenantId, "mid:root@example.com"),
+    );
+
+    const threadRows = await selectMany(db, mailThreadsProjectionTable, {
+      id: mailThreadAggregateId(admin.tenantId, "mid:root@example.com"),
+    });
+    expect(threadRows).toHaveLength(1);
+    expect(threadRows[0]?.["messageCount"]).toBe(2);
+    expect(String(threadRows[0]?.["lastMessageAt"])).toContain("2026-07-01T11:00:00");
+
+    // Raw message row: PII-Ciphertext; message:list liefert Klartext.
+    expect(isPiiCiphertext(msgRows[0]?.["from"])).toBe(true);
+    expect(isPiiCiphertext(msgRows[0]?.["subject"])).toBe(true);
+    const list = (await stack.http.queryOk(
+      InboundMailFoundationQueries.listMessages,
+      { accountId },
+      admin,
+    )) as { rows: Array<Record<string, unknown>> };
+    expect(list.rows).toHaveLength(2);
+    const firstRow = list.rows.find((r) => r["messageIdHeader"] === "root@example.com");
+    expect(firstRow?.["from"]).toBe("sender@example.com");
+    expect(firstRow?.["subject"]).toBe("Hello");
+  });
+});
+
+describe("scenario 3: Scope-Sichtbarkeit (persönliches Postfach)", () => {
+  test("Messages eines user-scoped Accounts sieht nur der Owner (+ TenantAdmin)", async () => {
+    const tenantNumber = 4003;
+    const owner = createTestUser({
+      id: 40031,
+      tenantId: testTenantId(tenantNumber),
+      roles: ["TenantAdmin", "SystemAdmin"],
+    });
+    const otherUser = createTestUser({
+      id: 40032,
+      tenantId: testTenantId(tenantNumber),
+      roles: ["User"],
+    });
+    const otherAdmin = createTestUser({
+      id: 40033,
+      tenantId: testTenantId(tenantNumber),
+      roles: ["TenantAdmin"],
+    });
+
+    const connect = (await stack.http.writeOk(
+      InboundMailFoundationHandlers.connectAccount,
+      {
+        provider: "inmemory",
+        authMethod: "password",
+        displayName: "Privat",
+        address: "owner@tenant.example",
+        scope: "user",
+      },
+      owner,
+    )) as { accountId: string };
+
+    await stack.http.writeOk(
+      InboundMailFoundationHandlers.ingestMessage,
+      ingestPayload(connect.accountId, {
+        ownerUserId: owner.id,
+        providerMessageId: "uid-personal-1",
+        messageIdHeader: "personal-1@example.com",
+      }),
+      owner,
+    );
+
+    const forOwner = (await stack.http.queryOk(
+      InboundMailFoundationQueries.listMessages,
+      { accountId: connect.accountId },
+      owner,
+    )) as { rows: unknown[] };
+    expect(forOwner.rows).toHaveLength(1);
+
+    const forOther = (await stack.http.queryOk(
+      InboundMailFoundationQueries.listMessages,
+      { accountId: connect.accountId },
+      otherUser,
+    )) as { rows: unknown[] };
+    expect(forOther.rows).toHaveLength(0);
+
+    const forAdmin = (await stack.http.queryOk(
+      InboundMailFoundationQueries.listMessages,
+      { accountId: connect.accountId },
+      otherAdmin,
+    )) as { rows: unknown[] };
+    expect(forAdmin.rows).toHaveLength(1);
+  });
+});
+
+describe("scenario 4: Account-Lifecycle", () => {
+  test("update → disconnect → update wird abgelehnt, disconnect ist idempotent", async () => {
+    const admin = adminFor(4004);
+    const accountId = await connectSharedAccount(admin);
+
+    await stack.http.writeOk(
+      InboundMailFoundationHandlers.updateAccount,
+      { accountId, status: "degraded", watchState: "backoff:5000ms", reason: "test" },
+      admin,
+    );
+    let rows = await selectMany(db, mailAccountsProjectionTable, { id: accountId });
+    expect(rows[0]?.["status"]).toBe("degraded");
+    // connected_at bleibt der Erst-Connect-Zeitpunkt (SET-Klausel lässt
+    // die Spalte aus).
+    const connectedAt = String(rows[0]?.["connectedAt"]);
+
+    const disconnect = (await stack.http.writeOk(
+      InboundMailFoundationHandlers.disconnectAccount,
+      { accountId, reason: "test" },
+      admin,
+    )) as Record<string, unknown>;
+    expect(disconnect["alreadyDisconnected"]).toBe(false);
+    rows = await selectMany(db, mailAccountsProjectionTable, { id: accountId });
+    expect(rows[0]?.["status"]).toBe("disconnected");
+    expect(String(rows[0]?.["connectedAt"])).toBe(connectedAt);
+
+    // Idempotent: zweiter disconnect ist success-no-op.
+    const again = (await stack.http.writeOk(
+      InboundMailFoundationHandlers.disconnectAccount,
+      { accountId, reason: "test" },
+      admin,
+    )) as Record<string, unknown>;
+    expect(again["alreadyDisconnected"]).toBe(true);
+
+    // update auf disconnected Account → 422 (kein Supervisor-Race darf
+    // einen getrennten Account wiederbeleben).
+    const err = await stack.http.writeErr(
+      InboundMailFoundationHandlers.updateAccount,
+      { accountId, status: "active", reason: "test" },
+      admin,
+    );
+    expect(err.httpStatus).toBe(422);
+  });
+});
+
+describe("scenario 5: Projection-Rebuild reproduziert die Read-Models (Plan §3.4)", () => {
+  test("rebuild aus dem Event-Log → identische inbound-message-Rows", async () => {
+    const admin = adminFor(4005);
+    const accountId = await connectSharedAccount(admin);
+    await stack.http.writeOk(
+      InboundMailFoundationHandlers.ingestMessage,
+      ingestPayload(accountId, { providerMessageId: "uid-r1", messageIdHeader: "r1@example.com" }),
+      admin,
+    );
+    await stack.http.writeOk(
+      InboundMailFoundationHandlers.ingestMessage,
+      ingestPayload(accountId, {
+        providerMessageId: "uid-r2",
+        messageIdHeader: "r2@example.com",
+        references: ["r1@example.com"],
+        receivedAtIso: "2026-07-02T09:00:00Z",
+      }),
+      admin,
+    );
+
+    const before = await selectMany(db, inboundMessagesProjectionTable, { accountId });
+    expect(before).toHaveLength(2);
+
+    const result = await rebuildProjection("inbound-mail-foundation:projection:inbound-message", {
+      db,
+      registry: stack.registry,
+    });
+    expect(result.eventsProcessed).toBeGreaterThanOrEqual(2);
+
+    const after = await selectMany(db, inboundMessagesProjectionTable, { accountId });
+    expect(after).toHaveLength(2);
+    const key = (rows: Array<Record<string, unknown>>) =>
+      rows.map((r) => `${r["id"]}|${r["threadKey"]}|${r["from"]}|${r["subject"]}`).sort();
+    expect(key(after as Array<Record<string, unknown>>)).toEqual(
+      key(before as Array<Record<string, unknown>>),
+    );
+
+    // Thread-Rollup ebenso rebuild-fähig.
+    const threadResult = await rebuildProjection("inbound-mail-foundation:projection:mail-thread", {
+      db,
+      registry: stack.registry,
+    });
+    expect(threadResult.eventsProcessed).toBeGreaterThanOrEqual(2);
+    const threads = await selectMany(db, mailThreadsProjectionTable, {
+      id: mailThreadAggregateId(admin.tenantId, "mid:r1@example.com"),
+    });
+    expect(threads[0]?.["messageCount"]).toBe(2);
+  });
+});
+
+describe("scenario 6: crypto-shredding (#800)", () => {
+  test("Subject-Key-Erase macht den Event-Payload permanent unlesbar", async () => {
+    const admin = adminFor(4006);
+    const accountId = await connectSharedAccount(admin);
+    await stack.http.writeOk(
+      InboundMailFoundationHandlers.ingestMessage,
+      ingestPayload(accountId, {
+        providerMessageId: "uid-shred",
+        messageIdHeader: "shred@example.com",
+        from: "secret-sender@example.com",
+      }),
+      admin,
+    );
+
+    const events = await loadAggregate(
+      db,
+      inboundMessageAggregateId(accountId, "uid-shred"),
+      admin.tenantId,
+    );
+    const ciphertext = (events[0]?.payload as { from?: string }).from as string;
+    expect(isPiiCiphertext(ciphertext)).toBe(true);
+
+    const kms = configuredPiiSubjectKms();
+    if (!kms) throw new Error("expected a configured PII-subject KMS in this test stack");
+    await kms.eraseKey(
+      { kind: "tenant", tenantId: admin.tenantId },
+      { requestId: "test:crypto-shred", eraseReason: "test" },
+    );
+
+    const decrypted = await decryptPiiFieldValues({ from: ciphertext }, ["from"], kms, {
+      requestId: "test:crypto-shred-verify",
+    });
+    expect(decrypted["from"]).toBe(PII_ERASED_SENTINEL);
+    expect(decrypted["from"]).not.toBe("secret-sender@example.com");
+  });
+});

package/src/inbound-mail-foundation/aggregate-id.ts

@@ -0,0 +1,40 @@
+import { v5 as uuidv5 } from "uuid";
+
+// Fixed UUID-namespaces für deterministic aggregate-id-Ableitung.
+// Generiert einmalig (2026-07-12), in Stein gemeißelt: ein Wechsel würde
+// jeden existing aggregate-Stream re-keyen → kaputte Message-Historie,
+// kaputte Idempotency. Drift-Pins in __tests__/feature.test.ts.
+
+/** Namespace für inbound-message-Streams. */
+const INBOUND_MESSAGE_NAMESPACE = "7f2a9c41-3d6b-4e0f-9c58-2b1e7a4d8f63";
+
+/** Namespace für mail-thread-Streams. */
+const MAIL_THREAD_NAMESPACE = "b48d1e72-5c9a-4f36-8e0d-6a3f9b2c7e15";
+
+/**
+ * Deterministic aggregate-id für eine inbound-message. Key ist
+ * (accountId, providerMessageId): derselbe Provider-Fetch der zweimal
+ * dieselbe Message liefert (IDLE-Doppel-Notify, Cursor-Overlap,
+ * Watch-Restart-Replay) landet auf demselben Stream — der Idempotency-
+ * Check im ingest-handler sieht den bereits appendeten Event.
+ *
+ * accountId (nicht tenantId) im Key: zwei Accounts desselben Tenants
+ * können dieselbe Mail empfangen (CC an beide Postfächer) — das sind
+ * fachlich ZWEI inbound-messages.
+ */
+// @wrapper-known uuid-domain
+export function inboundMessageAggregateId(accountId: string, providerMessageId: string): string {
+  return uuidv5(`${accountId}:${providerMessageId}`, INBOUND_MESSAGE_NAMESPACE);
+}
+
+/**
+ * Deterministic aggregate-id für einen mail-thread. Key ist
+ * (tenantId, threadKey) — Threads sind tenant-weit, nicht account-weit:
+ * eine Konversation die über zwei verbundene Postfächer läuft ist EIN
+ * Thread. threadKey kommt normalisiert vom Provider (References/
+ * In-Reply-To-Chain bzw. Provider-Thread-ID).
+ */
+// @wrapper-known uuid-domain
+export function mailThreadAggregateId(tenantId: string, threadKey: string): string {
+  return uuidv5(`${tenantId}:${threadKey}`, MAIL_THREAD_NAMESPACE);
+}