@cosmicdrift/kumiko-bundled-features 0.390.1 → 0.391.0

package/dist/audit/event-classification.d.ts

@@ -3,6 +3,7 @@ export type AuditEventStance = typeof TECHNICAL_EVENT | {
     readonly labelKey: string;
 };
 export declare const AUDIT_EVENT_STANCES: Readonly<Record<string, AuditEventStance>>;
+export declare const SYSTEM_ADMIN_ONLY_AGGREGATE_TYPES: readonly string[];
 export declare const FRAMEWORK_SYSTEM_EVENT_TYPES: readonly string[];
 export declare const TECHNICAL_EVENT_TYPES: readonly string[];
 export declare function eventLabelKeyOf(type: string): string | null;

package/dist/audit/event-classification.js

@@ -53,6 +53,10 @@ export const AUDIT_EVENT_STANCES = {
     "waitlist:event:purged": label("waitlist-purged"),
     "feature-toggles:event:toggle-set": label("feature-toggle-set"),
 };
+// Streams whose payload holds rows that only a SystemAdmin or a single owner may read: a
+// readiness probe run stores system-probe and personal-mailbox results next to the tenant's
+// own. Below SystemAdmin the audit log leaves these streams out entirely.
+export const SYSTEM_ADMIN_ONLY_AGGREGATE_TYPES = ["probe-run"];
 // Framework system events (kumiko:system:*) are engine plumbing, never audit-worthy on their own.
 export const FRAMEWORK_SYSTEM_EVENT_TYPES = [
     ...WORKFLOW_SYSTEM_EVENT_DEFS.keys(),

package/dist/audit/handlers/audit-events.d.ts

@@ -52,7 +52,10 @@ export type AuditListFilters = {
     cursor?: string | undefined;
     before?: string | undefined;
     includeTechnical?: boolean | undefined;
+    hiddenAggregateTypes?: readonly string[] | undefined;
 };
+/** The aggregateType condition: the requested type, minus the streams hidden from the caller. */
+export declare function aggregateTypeCondition(aggregateType: string | undefined, hidden: readonly string[] | undefined): unknown;
 /** `tenantCondition` is a tenant id, or an operator object for reads across tenants. */
 export declare function buildAuditWhere(tenantCondition: unknown, p: AuditListFilters, direction: "asc" | "desc"): WhereObject;
 type AuditEventRow = {

package/dist/audit/handlers/audit-events.js

@@ -60,11 +60,18 @@ function buildDateRange(from, to) {
 function escapeLikePattern(value) {
     return value.replace(/[\\%_]/g, (m) => `\\${m}`);
 }
+/** The aggregateType condition: the requested type, minus the streams hidden from the caller. */
+export function aggregateTypeCondition(aggregateType, hidden) {
+    if (hidden === undefined)
+        return aggregateType;
+    return { ...(aggregateType !== undefined && { in: [aggregateType] }), notIn: hidden };
+}
 /** `tenantCondition` is a tenant id, or an operator object for reads across tenants. */
 export function buildAuditWhere(tenantCondition, p, direction) {
     const where = { tenantId: tenantCondition };
-    if (p.aggregateType)
-        where["aggregateType"] = p.aggregateType;
+    const aggregateType = aggregateTypeCondition(p.aggregateType || undefined, p.hiddenAggregateTypes);
+    if (aggregateType !== undefined)
+        where["aggregateType"] = aggregateType;
     if (p.aggregateId)
         where["aggregateId"] = p.aggregateId;
     if (p.eventType)

package/dist/audit/handlers/details.query.js

@@ -5,7 +5,7 @@
 import { access, defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { AUDIT_SCOPE_VALUES } from "../web/constants.js";
-import { auditEventIdSchema, createEntityNounKeyResolver, loadAuditEvent } from "./audit-events.js";
+import { aggregateTypeCondition, auditEventIdSchema, createEntityNounKeyResolver, loadAuditEvent, } from "./audit-events.js";
 import { requireAuditSystemDb } from "./audit-system-db.js";
 import { resolveAuditScopeFilter } from "./resolve-audit-tenant.js";
 export const detailsQuery = defineQueryHandler({
@@ -19,11 +19,10 @@ export const detailsQuery = defineQueryHandler({
     handler: async (query, ctx) => {
         const scopeFilter = resolveAuditScopeFilter(query.user, query.payload.scope);
         const db = requireAuditSystemDb(ctx.systemDb, "audit:query:details").assertTenantMatch(query.user.tenantId);
+        const aggregateType = aggregateTypeCondition(scopeFilter.aggregateType, scopeFilter.hiddenAggregateTypes);
         return loadAuditEvent(db, {
             tenantId: scopeFilter.tenantId,
-            ...(scopeFilter.aggregateType !== undefined && {
-                aggregateType: scopeFilter.aggregateType,
-            }),
+            ...(aggregateType !== undefined && { aggregateType }),
             id: BigInt(query.payload.id),
         }, createEntityNounKeyResolver(ctx.registry));
     },

package/dist/audit/handlers/list.query.js

@@ -32,6 +32,7 @@ export const listQuery = defineQueryHandler({
         const where = buildAuditWhere(scopeFilter.tenantId, {
             ...p,
             aggregateType: scopeFilter.aggregateType ?? p.aggregateType,
+            hiddenAggregateTypes: scopeFilter.hiddenAggregateTypes,
             includeTechnical: includesTechnicalEntries(p.filters),
         }, direction);
         const db = requireAuditSystemDb(ctx.systemDb, "audit:query:list").assertTenantMatch(query.user.tenantId);

package/dist/audit/handlers/resolve-audit-tenant.d.ts

@@ -3,6 +3,7 @@ import { type AuditScope } from "../web/constants.ts";
 export type AuditScopeFilter = {
     readonly tenantId: string;
     readonly aggregateType?: string;
+    readonly hiddenAggregateTypes?: readonly string[];
 };
 export declare function resolveAuditScopeFilter(user: SessionUser, scope: AuditScope | undefined): AuditScopeFilter;
 export declare function assertMayReadAllTenants(user: SessionUser): void;

package/dist/audit/handlers/resolve-audit-tenant.js

@@ -2,6 +2,7 @@ import { mayOverrideTenant } from "@cosmicdrift/kumiko-framework/engine";
 import { AccessDeniedError, FrameworkReasons } from "@cosmicdrift/kumiko-framework/errors";
 import { APP_INSTANCE_STREAM_TYPE } from "@cosmicdrift/kumiko-framework/event-store";
 import { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-types/identifiers";
+import { SYSTEM_ADMIN_ONLY_AGGREGATE_TYPES } from "../event-classification.js";
 import { AuditScopes } from "../web/constants.js";
 function denySystemAdminOnlyRead() {
     throw new AccessDeniedError({
@@ -12,8 +13,11 @@ function denySystemAdminOnlyRead() {
 // The system tenant also holds personal streams of other features (session
 // revocations, exports, ...); only app-instance streams are released.
 export function resolveAuditScopeFilter(user, scope) {
-    if (scope !== AuditScopes.system)
-        return { tenantId: user.tenantId };
+    if (scope !== AuditScopes.system) {
+        return mayOverrideTenant(user)
+            ? { tenantId: user.tenantId }
+            : { tenantId: user.tenantId, hiddenAggregateTypes: SYSTEM_ADMIN_ONLY_AGGREGATE_TYPES };
+    }
     if (!mayOverrideTenant(user))
         denySystemAdminOnlyRead();
     return { tenantId: SYSTEM_TENANT_ID, aggregateType: APP_INSTANCE_STREAM_TYPE };

package/dist/auth-mfa/i18n.js

@@ -24,6 +24,7 @@ export const AUTH_MFA_FEATURE_I18N = {
     "mfa.enable.confirm.done": { en: "Two-factor authentication is now enabled." },
     "screen:auth-mfa-disable.title": { en: "Disable two-factor authentication" },
     "mfa.disable.submit": { en: "Disable" },
+    "mfa.disable.done": { en: "Two-factor authentication is now turned off." },
     "screen:auth-mfa-regenerate-recovery.title": { en: "Generate new recovery codes" },
     "mfa.regenerate.submit": { en: "Generate new codes" },
     "mfa.regenerate.reveal.title": { en: "Your new recovery codes" },

package/dist/auth-mfa/screens.js

@@ -73,6 +73,9 @@ export const mfaDisableScreen = {
     layout: { sections: [{ fields: ["code"] }] },
     submitLabel: i18nKey("mfa.disable.submit"),
     submitStyle: "danger",
+    successMessage: i18nKey("mfa.disable.done"),
+    // The used code is spent; clearing it keeps the form from looking like it still waits.
+    resetOnSuccess: true,
     cancelTarget: false,
     access: {
         openToAll: {

package/dist/file-foundation/feature.js

@@ -19,6 +19,8 @@ import { access, createTenantConfig, defineFeature, EXT_FILE_PROVIDER, FILE_STOR
 // Moved into the framework — re-exported here so `@cosmicdrift/kumiko-bundled-
 // features/file-foundation` consumers (user-data-rights, app code) keep working.
 export { createFileProviderForTenant, isFileProviderPlugin, } from "@cosmicdrift/kumiko-framework/files";
+import { FILE_FOUNDATION_I18N } from "./i18n.js";
+import { registerStorageProbe } from "./probe.js";
 const FEATURE_NAME = "file-foundation";
 export function createFileFoundationFeature() {
     return defineFeature(FEATURE_NAME, (r) => {
@@ -44,6 +46,8 @@ export function createFileFoundationFeature() {
         // Readiness gating: provider-plugins' required keys/secrets count only
         // while their plugin is the one this key selects.
         r.extensionSelector(EXT_FILE_PROVIDER, providerConfigKey);
+        r.translations({ keys: FILE_FOUNDATION_I18N });
+        registerStorageProbe(r);
         return { providerConfigKey };
     }, { dedupeOptions: {} });
 }

package/dist/file-foundation/i18n.d.ts

@@ -0,0 +1,20 @@
+export declare const FILE_PROBE_KEYS: {
+    readonly area: "file-foundation.probe.area";
+    readonly label: "file-foundation.probe.storage-roundtrip.label";
+    readonly reachable: "file-foundation.probe.storage-roundtrip.reachable";
+    readonly notConfigured: "file-foundation.probe.not-configured";
+};
+export declare const FILE_FOUNDATION_I18N: {
+    readonly "file-foundation.probe.area": {
+        readonly en: "File storage";
+    };
+    readonly "file-foundation.probe.storage-roundtrip.label": {
+        readonly en: "Write, read and delete a test file";
+    };
+    readonly "file-foundation.probe.storage-roundtrip.reachable": {
+        readonly en: "Storage reachable";
+    };
+    readonly "file-foundation.probe.not-configured": {
+        readonly en: "No file storage set up";
+    };
+};

package/dist/file-foundation/i18n.js

@@ -0,0 +1,12 @@
+export const FILE_PROBE_KEYS = {
+    area: "file-foundation.probe.area",
+    label: "file-foundation.probe.storage-roundtrip.label",
+    reachable: "file-foundation.probe.storage-roundtrip.reachable",
+    notConfigured: "file-foundation.probe.not-configured",
+};
+export const FILE_FOUNDATION_I18N = {
+    [FILE_PROBE_KEYS.area]: { en: "File storage" },
+    [FILE_PROBE_KEYS.label]: { en: "Write, read and delete a test file" },
+    [FILE_PROBE_KEYS.reachable]: { en: "Storage reachable" },
+    [FILE_PROBE_KEYS.notConfigured]: { en: "No file storage set up" },
+};

package/dist/file-foundation/index.d.ts

@@ -1,2 +1,3 @@
 export { createFileFoundationFeature, createFileProviderForTenant, type FileProviderContext, type FileProviderPlugin, isFileProviderPlugin, } from "./feature.ts";
 export { type FileRefContent, FileRefTooLargeError, FileStorageUnavailableError, fileContextForTenant, fileContextFromResolver, readFileRefContent, } from "./read-file-ref-content.ts";
+export { makeTenantStorageProviderResolver, type TenantStorageResolverCtx, } from "./storage-provider-resolver.ts";

package/dist/file-foundation/index.js

@@ -1,3 +1,4 @@
 // Public API of the file-foundation bundled-feature.
 export { createFileFoundationFeature, createFileProviderForTenant, isFileProviderPlugin, } from "./feature.js";
 export { FileRefTooLargeError, FileStorageUnavailableError, fileContextForTenant, fileContextFromResolver, readFileRefContent, } from "./read-file-ref-content.js";
+export { makeTenantStorageProviderResolver, } from "./storage-provider-resolver.js";

package/dist/file-foundation/probe.d.ts

@@ -0,0 +1,2 @@
+import { type FeatureRegistrar } from "@cosmicdrift/kumiko-framework/engine";
+export declare function registerStorageProbe(r: FeatureRegistrar<"file-foundation">): void;

package/dist/file-foundation/probe.js

@@ -0,0 +1,53 @@
+import { createSystemUser, FILE_PROVIDER_CONFIG_KEY, FILE_STORAGE_PROVIDER_BOOT_SENTINEL, } from "@cosmicdrift/kumiko-framework/engine";
+import { createConfigAccessor } from "../config/index.js";
+import { FILE_PROBE_KEYS } from "./i18n.js";
+import { makeTenantStorageProviderResolver } from "./storage-provider-resolver.js";
+const PROBE_CONTENT = new TextEncoder().encode("kumiko-readiness-probe");
+function isSameBytes(left, right) {
+    return left.length === right.length && left.every((byte, index) => byte === right[index]);
+}
+// Bypasses the file-ref entity on purpose: a probe leaves neither a ref nor events behind.
+export function registerStorageProbe(r) {
+    r.probe({
+        name: "storage-roundtrip",
+        scope: "tenant",
+        cost: "free",
+        area: FILE_PROBE_KEYS.area,
+        label: FILE_PROBE_KEYS.label,
+        run: async (ctx) => {
+            const { configResolver, secrets } = ctx.services;
+            const userId = createSystemUser(ctx.tenantId).id;
+            const notConfigured = {
+                status: "skipped",
+                message: { key: FILE_PROBE_KEYS.notConfigured },
+            };
+            if (!configResolver)
+                return notConfigured;
+            const selected = await createConfigAccessor(ctx.registry, configResolver, ctx.tenantId, userId, ctx.db)(FILE_PROVIDER_CONFIG_KEY);
+            if (selected === undefined ||
+                selected === "" ||
+                selected === FILE_STORAGE_PROVIDER_BOOT_SENTINEL) {
+                return notConfigured;
+            }
+            const provider = await makeTenantStorageProviderResolver({
+                registry: ctx.registry,
+                configResolver,
+                secrets,
+                db: ctx.db,
+                userId,
+                handlerName: "file-foundation:probe",
+            })(ctx.tenantId);
+            const key = `${ctx.tenantId}/__readiness-probe/${ctx.probeRunId}.txt`;
+            try {
+                await provider.write(key, PROBE_CONTENT, "text/plain");
+                if (!isSameBytes(await provider.read(key), PROBE_CONTENT)) {
+                    throw new Error("storage returned different bytes than were written");
+                }
+            }
+            finally {
+                await provider.delete(key);
+            }
+            return { status: "ok", message: { key: FILE_PROBE_KEYS.reachable } };
+        },
+    });
+}

package/dist/{user-data-rights/lib → file-foundation}/storage-provider-resolver.js

@@ -4,8 +4,8 @@
 // construction). Extracted from the export cron so both crons + the manual
 // forget handler share one construction site instead of inlining it three times.
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
-import { createConfigAccessor } from "../../config/index.js";
-import { createFileProviderForTenant } from "../../file-foundation/index.js";
+import { createFileProviderForTenant } from "@cosmicdrift/kumiko-framework/files";
+import { createConfigAccessor } from "../config/index.js";
 export function makeTenantStorageProviderResolver(ctx) {
     return async (tenantId) => {
         if (!ctx.configResolver) {

package/dist/inbound-mail-foundation/feature.js

@@ -52,6 +52,7 @@ import { listAccountsQuery } from "./handlers/list-accounts.query.js";
 import { listMessagesQuery } from "./handlers/list-messages.query.js";
 import { updateAccountHandler } from "./handlers/update-account.write.js";
 import { INBOUND_MAIL_FOUNDATION_I18N } from "./i18n.js";
+import { registerMailboxProbe } from "./probe.js";
 import { applyInboundMessageReceived, applyMailAccountConnected, applyMailAccountDisconnected, applyMailAccountUpdated, applyMailThreadUpdated, inboundMessagesProjectionTable, mailAccountsProjectionTable, mailThreadsProjectionTable, } from "./projection.js";
 import { runInboundMailRetention } from "./retention-sweep.js";
 import { mailAccountEditScreen, mailAccountListScreen } from "./screens.js";
@@ -149,6 +150,7 @@ export function createInboundMailFoundationFeature() {
         r.screen(mailAccountListScreen);
         r.screen(mailAccountEditScreen);
         r.translations({ keys: INBOUND_MAIL_FOUNDATION_I18N });
+        registerMailboxProbe(r);
         // Entity-specific GDPR destroy hooks — the gdpr-storage boot validator
         // checks the EXT_TENANT_DATA registration for each tenant-subject entity.
         r.useExtension(EXT_TENANT_DATA, "mail-account", {

package/dist/inbound-mail-foundation/i18n.js

@@ -1,9 +1,11 @@
 import { ACTION_FORM_ENTITY } from "@cosmicdrift/kumiko-framework/ui-types";
 import { fieldLabelKey } from "@cosmicdrift/kumiko-renderer/headless";
 import { INBOUND_MAIL_FOUNDATION_FEATURE, InboundMailAccountStatuses } from "./constants.js";
+import { INBOUND_PROBE_I18N } from "./probe-keys.js";
 import { MAIL_ACCOUNT_EDIT_SCREEN_ID, MAIL_ACCOUNT_LIST_SCREEN_ID, MAIL_ACCOUNT_STATUS_OPTION_KEY_PREFIX, } from "./screens.js";
 const formFieldKey = (field) => fieldLabelKey(INBOUND_MAIL_FOUNDATION_FEATURE, ACTION_FORM_ENTITY, field);
 export const INBOUND_MAIL_FOUNDATION_I18N = {
+    ...INBOUND_PROBE_I18N,
     [`screen:${MAIL_ACCOUNT_LIST_SCREEN_ID}.title`]: { en: "Mailboxes" },
     [`screen:${MAIL_ACCOUNT_EDIT_SCREEN_ID}.title`]: { en: "Edit mailbox" },
     "inboundMail.accounts.col.name": { en: "Name" },

package/dist/inbound-mail-foundation/probe-keys.d.ts

@@ -0,0 +1,28 @@
+export declare const INBOUND_PROBE_KEYS: {
+    readonly area: "inbound-mail-foundation.probe.area";
+    readonly label: "inbound-mail-foundation.probe.mailboxes.label";
+    readonly mailbox: "inbound-mail-foundation.probe.mailbox";
+    readonly reachable: "inbound-mail-foundation.probe.mailbox.reachable";
+    readonly authFailed: "inbound-mail-foundation.probe.mailbox.auth-failed";
+    readonly gone: "inbound-mail-foundation.probe.mailbox.gone";
+};
+export declare const INBOUND_PROBE_I18N: {
+    readonly "inbound-mail-foundation.probe.area": {
+        readonly en: "Inbound email";
+    };
+    readonly "inbound-mail-foundation.probe.mailboxes.label": {
+        readonly en: "Connected mailboxes";
+    };
+    readonly "inbound-mail-foundation.probe.mailbox": {
+        readonly en: "Mailbox {name}";
+    };
+    readonly "inbound-mail-foundation.probe.mailbox.reachable": {
+        readonly en: "Mailbox reachable";
+    };
+    readonly "inbound-mail-foundation.probe.mailbox.auth-failed": {
+        readonly en: "The mailbox rejected the stored login";
+    };
+    readonly "inbound-mail-foundation.probe.mailbox.gone": {
+        readonly en: "Mailbox no longer exists";
+    };
+};

package/dist/inbound-mail-foundation/probe-keys.js

@@ -0,0 +1,16 @@
+export const INBOUND_PROBE_KEYS = {
+    area: "inbound-mail-foundation.probe.area",
+    label: "inbound-mail-foundation.probe.mailboxes.label",
+    mailbox: "inbound-mail-foundation.probe.mailbox",
+    reachable: "inbound-mail-foundation.probe.mailbox.reachable",
+    authFailed: "inbound-mail-foundation.probe.mailbox.auth-failed",
+    gone: "inbound-mail-foundation.probe.mailbox.gone",
+};
+export const INBOUND_PROBE_I18N = {
+    [INBOUND_PROBE_KEYS.area]: { en: "Inbound email" },
+    [INBOUND_PROBE_KEYS.label]: { en: "Connected mailboxes" },
+    [INBOUND_PROBE_KEYS.mailbox]: { en: "Mailbox {name}" },
+    [INBOUND_PROBE_KEYS.reachable]: { en: "Mailbox reachable" },
+    [INBOUND_PROBE_KEYS.authFailed]: { en: "The mailbox rejected the stored login" },
+    [INBOUND_PROBE_KEYS.gone]: { en: "Mailbox no longer exists" },
+};

package/dist/inbound-mail-foundation/probe.d.ts

@@ -0,0 +1,2 @@
+import { type FeatureRegistrar } from "@cosmicdrift/kumiko-framework/engine";
+export declare function registerMailboxProbe(r: FeatureRegistrar<"inbound-mail-foundation">): void;

package/dist/inbound-mail-foundation/probe.js

@@ -0,0 +1,89 @@
+import { configuredPiiSubjectKms, decryptPiiFieldValues, } from "@cosmicdrift/kumiko-framework/crypto";
+import { createSystemUser, ProbeFailure, } from "@cosmicdrift/kumiko-framework/engine";
+import { createConfigAccessor } from "../config/index.js";
+import { INBOUND_MAIL_FOUNDATION_FEATURE, InboundMailAccountStatuses } from "./constants.js";
+import { MAIL_ACCOUNT_PII_FIELDS } from "./entities.js";
+import { INBOUND_PROBE_KEYS } from "./probe-keys.js";
+import { mailAccountsProjectionTable } from "./projection.js";
+import { resolveInboundProviderForAccount } from "./provider-factory.js";
+import { isInboundAuthError } from "./types.js";
+const SHORT_ID_LENGTH = 8;
+function providerContext(ctx) {
+    const { configResolver, secrets } = ctx.services;
+    const auditUserId = createSystemUser(ctx.tenantId).id;
+    return {
+        registry: ctx.registry,
+        ...(secrets && { secrets }),
+        auditUserId,
+        ...(configResolver && {
+            config: createConfigAccessor(ctx.registry, configResolver, ctx.tenantId, auditUserId, ctx.db),
+        }),
+    };
+}
+// Providers never see ciphertext, so the address is decrypted before the call.
+async function toAccountRecord(row, tenantId) {
+    const piiKms = configuredPiiSubjectKms();
+    const decrypted = piiKms
+        ? await decryptPiiFieldValues(row, MAIL_ACCOUNT_PII_FIELDS, piiKms, {
+            requestId: "inbound-mail-foundation:probe",
+        })
+        : row;
+    const address = decrypted["address"];
+    if (typeof address !== "string")
+        throw new Error("mailbox address did not decrypt to text");
+    return {
+        id: row.id,
+        tenantId,
+        provider: row.provider,
+        authMethod: row.authMethod,
+        ownerUserId: row.ownerUserId ?? null,
+        address,
+        displayName: row.displayName ?? "",
+        status: InboundMailAccountStatuses.active,
+        watchState: row.watchState ?? "idle",
+    };
+}
+export function registerMailboxProbe(r) {
+    r.probe({
+        name: "mailboxes",
+        scope: "tenant",
+        cost: "free",
+        area: INBOUND_PROBE_KEYS.area,
+        label: INBOUND_PROBE_KEYS.label,
+        fixScreen: `${INBOUND_MAIL_FOUNDATION_FEATURE}:screen:mail-accounts`,
+        // The address is PII, so the target label carries only the tenant-authored display name.
+        targets: async (ctx) => {
+            const rows = await ctx.db.selectMany(mailAccountsProjectionTable, {
+                status: InboundMailAccountStatuses.active,
+            });
+            return rows.map((row) => ({
+                id: row.id,
+                label: {
+                    key: INBOUND_PROBE_KEYS.mailbox,
+                    params: { name: row.displayName || row.id.slice(0, SHORT_ID_LENGTH) },
+                },
+                ...(row.ownerUserId != null && { ownerUserId: row.ownerUserId }),
+            }));
+        },
+        run: async (ctx, target) => {
+            const row = target
+                ? await ctx.db.fetchOne(mailAccountsProjectionTable, { id: target.id })
+                : undefined;
+            if (!row)
+                return { status: "skipped", message: { key: INBOUND_PROBE_KEYS.gone } };
+            const account = await toAccountRecord(row, ctx.tenantId);
+            const providerCtx = providerContext(ctx);
+            const plugin = resolveInboundProviderForAccount(providerCtx, account);
+            try {
+                await (plugin.probe ?? plugin.verify)(providerCtx, account);
+            }
+            catch (error) {
+                if (isInboundAuthError(error)) {
+                    throw new ProbeFailure({ key: INBOUND_PROBE_KEYS.authFailed });
+                }
+                throw error;
+            }
+            return { status: "ok", message: { key: INBOUND_PROBE_KEYS.reachable } };
+        },
+    });
+}

package/dist/inbound-mail-foundation/types.d.ts

@@ -137,6 +137,9 @@ export type InboundMailProviderPlugin = {
     /** Credential/reachability check during the connect flow — throws a
      *  typed error (InboundAuthError, etc.) and returns no value. */
     readonly verify: (ctx: InboundMailContext, account: MailAccountRecord) => Promise<void>;
+    /** Read-only liveness check for the system check; falls back to `verify`. Must not
+     *  change mailbox state (no flags, no new connection side effects). */
+    readonly probe?: (ctx: InboundMailContext, account: MailAccountRecord) => Promise<void>;
     /** Fetch since cursor. `cursor === null` means initial population,
      *  limited by backfillWindowDays. */
     readonly fetch: (ctx: InboundMailContext, account: MailAccountRecord, cursor: SyncCursorPayload | null, opts: {

package/dist/inbound-provider-imap/feature.js

@@ -29,7 +29,7 @@ import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
 import { instantToLegacyDate } from "@cosmicdrift/kumiko-framework/time";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import { parseImapCredentialDocument } from "./credential-document.js";
-import { assertUidValidity, coerceDate, createImapClient, IMAP_MAILBOX, imapMailHostGuard, mapImapError, parseImapCursor, toRawInboundMessage, } from "./imap-client.js";
+import { assertUidValidity, coerceDate, connectOnce, createImapClient, IMAP_MAILBOX, imapMailHostGuard, mapImapError, parseImapCursor, toRawInboundMessage, } from "./imap-client.js";
 const FEATURE_NAME = "inbound-provider-imap";
 export const IMAP_PROVIDER_KEY = "imap";
 export { setImapMailHostLookup } from "./imap-client.js";
@@ -200,19 +200,8 @@ async function watchMailbox(ctx, account, handlers) {
 /** Exported for the live test (imap-live.integration.test.ts) —
  *  applications use the feature, never the plugin directly. */
 export const imapInboundMailPlugin = {
-    verify: async (ctx, account) => {
-        const doc = await readCredentialDocument(ctx, account);
-        const client = await createImapClient(doc, imapMailHostGuard());
-        try {
-            await client.connect();
-        }
-        catch (err) {
-            throw mapImapError(err, doc.host);
-        }
-        finally {
-            await client.logout().catch(() => { });
-        }
-    },
+    verify: async (ctx, account) => connectOnce(await readCredentialDocument(ctx, account), false),
+    probe: async (ctx, account) => connectOnce(await readCredentialDocument(ctx, account), true),
     fetch: fetchMessages,
     watch: watchMailbox,
     // No oauth block: password authentication runs through the credential

package/dist/inbound-provider-imap/imap-client.d.ts

@@ -7,6 +7,7 @@ export declare function setImapMailHostLookup(fn: MailHostGuardOptions["lookupFn
 export declare function imapMailHostGuard(): MailHostGuardOptions;
 export declare function createImapClient(doc: ImapCredentialDocument, hostGuard?: MailHostGuardOptions): Promise<ImapFlow>;
 /** Server-Fehler → typisierte Foundation-Fehlerklassen (Plan §2). */
+export declare function connectOnce(doc: ImapCredentialDocument, examineInbox: boolean): Promise<void>;
 export declare function mapImapError(err: unknown, host: string): Error;
 export type ImapCursor = {
     readonly uidValidity: string;

package/dist/inbound-provider-imap/imap-client.js

@@ -70,6 +70,21 @@ export async function createImapClient(doc, hostGuard = {}) {
     });
 }
 /** Server-Fehler → typisierte Foundation-Fehlerklassen (Plan §2). */
+// examineInbox opens INBOX with EXAMINE instead of SELECT, so the system check never touches \Recent or flags.
+export async function connectOnce(doc, examineInbox) {
+    const client = await createImapClient(doc, imapMailHostGuard());
+    try {
+        await client.connect();
+        if (examineInbox)
+            await client.mailboxOpen(IMAP_MAILBOX, { readOnly: true });
+    }
+    catch (err) {
+        throw mapImapError(err, doc.host);
+    }
+    finally {
+        await client.logout().catch(() => { });
+    }
+}
 export function mapImapError(err, host) {
     // imapflow errors carry the server response in responseText; the
     // message is only "Command failed", so both are included in the match;

package/dist/mail-foundation/feature.js

@@ -33,6 +33,7 @@ import { withPiiCiphertextGuard, } from "@cosmicdrift/kumiko-bundled-features/ch
 import { requireDefined } from "@cosmicdrift/kumiko-bundled-features/foundation-shared";
 import { access, createSystemUser, createTenantConfig, defineFeature, } from "@cosmicdrift/kumiko-framework/engine";
 import { MAIL_FOUNDATION_I18N } from "./i18n.js";
+import { registerMailProbe } from "./probe.js";
 const FEATURE_NAME = "mail-foundation";
 // Extension-point name for transport-provider plugins (mail-transport-smtp,
 // mail-transport-brevo-api, ...).
@@ -85,6 +86,7 @@ export function createMailFoundationFeature() {
         // while their plugin is the one this key selects.
         r.extensionSelector(MAIL_TRANSPORT_EXTENSION, providerConfigKey);
         r.translations({ keys: MAIL_FOUNDATION_I18N });
+        registerMailProbe(r);
         return {
             /** Config-key-handle for the provider-selector. */
             providerConfigKey,

package/dist/mail-foundation/i18n.d.ts

@@ -1,3 +1,14 @@
+export declare const MAIL_PROBE_KEYS: {
+    readonly area: "mail-foundation.probe.area";
+    readonly label: "mail-foundation.probe.send-test-mail.label";
+    readonly accepted: "mail-foundation.probe.send-test-mail.accepted";
+    readonly notConfigured: "mail-foundation.probe.not-configured";
+    readonly noRecipient: "mail-foundation.probe.no-recipient";
+    readonly hostNotFound: "mail-foundation.probe.host-not-found";
+    readonly setupIncomplete: "mail-foundation.probe.setup-incomplete";
+    readonly setupFailed: "mail-foundation.probe.setup-failed";
+    readonly sendRejected: "mail-foundation.probe.send-rejected";
+};
 export declare const MAIL_FOUNDATION_I18N: {
     readonly "screen:mail-foundation-tenant.title": {
         readonly en: "Email sending";
@@ -14,4 +25,31 @@ export declare const MAIL_FOUNDATION_I18N: {
     readonly "mail-foundation.provider.platformDefault": {
         readonly en: "Platform sending (default)";
     };
+    readonly "mail-foundation.probe.area": {
+        readonly en: "Email";
+    };
+    readonly "mail-foundation.probe.send-test-mail.label": {
+        readonly en: "Test email to the person who started the check";
+    };
+    readonly "mail-foundation.probe.send-test-mail.accepted": {
+        readonly en: "Accepted by the mail server";
+    };
+    readonly "mail-foundation.probe.not-configured": {
+        readonly en: "No own email sending set up";
+    };
+    readonly "mail-foundation.probe.no-recipient": {
+        readonly en: "No email address known for the person who started the check";
+    };
+    readonly "mail-foundation.probe.host-not-found": {
+        readonly en: "Mail server not found, check the server address";
+    };
+    readonly "mail-foundation.probe.setup-incomplete": {
+        readonly en: "Email sending settings are incomplete or the server is not allowed";
+    };
+    readonly "mail-foundation.probe.setup-failed": {
+        readonly en: "Email sending could not be set up with these settings";
+    };
+    readonly "mail-foundation.probe.send-rejected": {
+        readonly en: "The mail server did not accept the test email, check address, port and login";
+    };
 };

package/dist/mail-foundation/i18n.js

@@ -1,3 +1,14 @@
+export const MAIL_PROBE_KEYS = {
+    area: "mail-foundation.probe.area",
+    label: "mail-foundation.probe.send-test-mail.label",
+    accepted: "mail-foundation.probe.send-test-mail.accepted",
+    notConfigured: "mail-foundation.probe.not-configured",
+    noRecipient: "mail-foundation.probe.no-recipient",
+    hostNotFound: "mail-foundation.probe.host-not-found",
+    setupIncomplete: "mail-foundation.probe.setup-incomplete",
+    setupFailed: "mail-foundation.probe.setup-failed",
+    sendRejected: "mail-foundation.probe.send-rejected",
+};
 export const MAIL_FOUNDATION_I18N = {
     "screen:mail-foundation-tenant.title": { en: "Email sending" },
     "mail-foundation.settings": { en: "Email sending" },
@@ -6,4 +17,19 @@ export const MAIL_FOUNDATION_I18N = {
         en: "Choose who sends your emails. The platform default needs no settings of your own.",
     },
     "mail-foundation.provider.platformDefault": { en: "Platform sending (default)" },
+    [MAIL_PROBE_KEYS.area]: { en: "Email" },
+    [MAIL_PROBE_KEYS.label]: { en: "Test email to the person who started the check" },
+    [MAIL_PROBE_KEYS.accepted]: { en: "Accepted by the mail server" },
+    [MAIL_PROBE_KEYS.notConfigured]: { en: "No own email sending set up" },
+    [MAIL_PROBE_KEYS.noRecipient]: {
+        en: "No email address known for the person who started the check",
+    },
+    [MAIL_PROBE_KEYS.hostNotFound]: { en: "Mail server not found, check the server address" },
+    [MAIL_PROBE_KEYS.setupIncomplete]: {
+        en: "Email sending settings are incomplete or the server is not allowed",
+    },
+    [MAIL_PROBE_KEYS.setupFailed]: { en: "Email sending could not be set up with these settings" },
+    [MAIL_PROBE_KEYS.sendRejected]: {
+        en: "The mail server did not accept the test email, check address, port and login",
+    },
 };

package/dist/mail-foundation/index.d.ts

@@ -1 +1,2 @@
 export { createMailFoundationFeature, createTransportForTenant, createTransportForTenantIfConfigured, isMailTransportPlugin, MAIL_TRANSPORT_EXTENSION, type MailTransportContext, type MailTransportPlugin, type TenantMailTransportScope, tenantMailTransport, } from "./feature.ts";
+export { makeTenantMailTransportResolver, type TenantMailResolverCtx, } from "./mail-transport-resolver.ts";

package/dist/mail-foundation/index.js

@@ -7,3 +7,4 @@
 //   - `MailTransportPlugin` — type that provider-features implement
 //     when registering via `r.useExtension("mailTransport", ...)`
 export { createMailFoundationFeature, createTransportForTenant, createTransportForTenantIfConfigured, isMailTransportPlugin, MAIL_TRANSPORT_EXTENSION, tenantMailTransport, } from "./feature.js";
+export { makeTenantMailTransportResolver, } from "./mail-transport-resolver.js";