@cosmicdrift/kumiko-bundled-features 0.391.0 → 0.392.0

package/dist/inbound-mail-foundation/account-record.d.ts

@@ -0,0 +1,13 @@
+import type { MailAccountRecord } from "./types.ts";
+export type MailAccountRow = {
+    readonly id: string;
+    readonly tenantId: string;
+    readonly provider: string;
+    readonly authMethod: string;
+    readonly ownerUserId?: string | null;
+    readonly address: string;
+    readonly displayName?: string | null;
+    readonly status?: string | null;
+    readonly watchState?: string | null;
+};
+export declare function toMailAccountRecord(row: MailAccountRow, tenantId: string, requestId: string): Promise<MailAccountRecord>;

package/dist/inbound-mail-foundation/account-record.js

@@ -0,0 +1,27 @@
+import { configuredPiiSubjectKms, decryptPiiFieldValues, } from "@cosmicdrift/kumiko-framework/crypto";
+import { InboundMailAccountStatuses } from "./constants.js";
+import { MAIL_ACCOUNT_PII_FIELDS } from "./entities.js";
+function isAccountStatus(value) {
+    return Object.values(InboundMailAccountStatuses).some((status) => status === value);
+}
+// Providers never see ciphertext, so the address is decrypted before the call.
+export async function toMailAccountRecord(row, tenantId, requestId) {
+    const piiKms = configuredPiiSubjectKms();
+    const decrypted = piiKms
+        ? await decryptPiiFieldValues(row, MAIL_ACCOUNT_PII_FIELDS, piiKms, { requestId })
+        : row;
+    const address = decrypted["address"];
+    if (typeof address !== "string")
+        throw new Error("mailbox address did not decrypt to text");
+    return {
+        id: row.id,
+        tenantId,
+        provider: row.provider,
+        authMethod: row.authMethod,
+        ownerUserId: row.ownerUserId ?? null,
+        address,
+        displayName: row.displayName ?? "",
+        status: isAccountStatus(row.status) ? row.status : InboundMailAccountStatuses.active,
+        watchState: row.watchState ?? "idle",
+    };
+}

package/dist/inbound-mail-foundation/feature.js

@@ -60,7 +60,7 @@ import { INBOUND_MAIL_TENANT_DESTROY_ARCHIVE_REASON, inboundMessageTenantDestroy
 export function createInboundMailFoundationFeature() {
     return defineFeature(INBOUND_MAIL_FOUNDATION_FEATURE, (r) => {
         r.adoptsBundledLists();
-        r.describe("Plugin host for inbound e-mail (inbox federation) — provider plugins (inbound-provider-imap, later M365 Graph / Gmail REST) register at the `inboundMailProvider` extension point with verify/fetch and optional oauth/watch (live push). The foundation owns three event-sourced streams (mail-account lifecycle, inbound-message with exactly-once ingest via deterministic aggregate ids, mail-thread rollup) and their projections `read_mail_accounts`/`read_inbound_messages`/`read_mail_threads`; PII fields are envelope-encrypted per tenant subject key before every append (crypto-shredding on tenant destroy). Wire `createInboundMailConnectRoutes` (OAuth connect + anonymous callback outside /api) and `createInboundMailSupervisor` (IDLE watch with backoff + reconciliation poll) in bin/server.ts. Consume `inbound-mail-foundation:event:inbound-message-received` from app features to attach business processes.");
+        r.describe("Plugin host for inbound e-mail (inbox federation) — provider plugins (inbound-provider-imap, later M365 Graph / Gmail REST) register at the `inboundMailProvider` extension point with verify/fetch and optional oauth/watch (live push) and send. `sendMailFromAccount(ctx, { accountId, message })` sends from a connected mailbox through its provider (From = the mailbox address, no fallback to the app sender) and answers typed failures (not configured, login rejected, server unreachable, rejected, invalid message); app write handlers call it, it is no endpoint of its own. The foundation owns three event-sourced streams (mail-account lifecycle, inbound-message with exactly-once ingest via deterministic aggregate ids, mail-thread rollup) and their projections `read_mail_accounts`/`read_inbound_messages`/`read_mail_threads`; PII fields are envelope-encrypted per tenant subject key before every append (crypto-shredding on tenant destroy). Wire `createInboundMailConnectRoutes` (OAuth connect + anonymous callback outside /api) and `createInboundMailSupervisor` (IDLE watch with backoff + reconciliation poll) in bin/server.ts. Consume `inbound-mail-foundation:event:inbound-message-received` from app features to attach business processes.");
         r.uiHints({
             displayLabel: "Inbound Mail · Foundation",
             category: "notifications",

package/dist/inbound-mail-foundation/i18n.js

@@ -3,6 +3,7 @@ import { fieldLabelKey } from "@cosmicdrift/kumiko-renderer/headless";
 import { INBOUND_MAIL_FOUNDATION_FEATURE, InboundMailAccountStatuses } from "./constants.js";
 import { INBOUND_PROBE_I18N } from "./probe-keys.js";
 import { MAIL_ACCOUNT_EDIT_SCREEN_ID, MAIL_ACCOUNT_LIST_SCREEN_ID, MAIL_ACCOUNT_STATUS_OPTION_KEY_PREFIX, } from "./screens.js";
+import { MAIL_SEND_ERRORS } from "./send-from-account.js";
 const formFieldKey = (field) => fieldLabelKey(INBOUND_MAIL_FOUNDATION_FEATURE, ACTION_FORM_ENTITY, field);
 export const INBOUND_MAIL_FOUNDATION_I18N = {
     ...INBOUND_PROBE_I18N,
@@ -25,6 +26,7 @@ export const INBOUND_MAIL_FOUNDATION_I18N = {
     [`${MAIL_ACCOUNT_STATUS_OPTION_KEY_PREFIX}${InboundMailAccountStatuses.disconnected}`]: {
         en: "Disconnected",
     },
+    "inboundMail.accounts.connectImap": { en: "Connect mailbox" },
     "inboundMail.accounts.edit": { en: "Rename" },
     "inboundMail.accounts.edit.submit": { en: "Save" },
     "inboundMail.accounts.disconnect": { en: "Disconnect" },
@@ -33,4 +35,19 @@ export const INBOUND_MAIL_FOUNDATION_I18N = {
     },
     [formFieldKey("accountId")]: { en: "Mailbox" },
     [formFieldKey("displayName")]: { en: "Name" },
+    [MAIL_SEND_ERRORS.notConfigured.i18nKey]: {
+        en: "Sending is not set up for this mailbox. Connect the mailbox again with its outgoing server.",
+    },
+    [MAIL_SEND_ERRORS.loginRejected.i18nKey]: {
+        en: "The outgoing mail server rejected the sign-in. Check the mailbox password.",
+    },
+    [MAIL_SEND_ERRORS.serverUnreachable.i18nKey]: {
+        en: "The outgoing mail server cannot be reached. Try again later.",
+    },
+    [MAIL_SEND_ERRORS.rejected.i18nKey]: {
+        en: "The outgoing mail server refused the mail. Check the recipient address.",
+    },
+    [MAIL_SEND_ERRORS.invalidMessage.i18nKey]: {
+        en: "The mail was not sent: a recipient, the subject or the reply reference is invalid.",
+    },
 };

package/dist/inbound-mail-foundation/index.d.ts

@@ -6,8 +6,10 @@ export { INBOUND_MESSAGE_AGGREGATE_TYPE, INBOUND_MESSAGE_RECEIVED_EVENT_QN, INBO
 export { createInboundMailFoundationFeature } from "./feature.ts";
 export { createOAuthAccessTokenManager, inboundRefreshTokenSecretOptions, type OAuthAccessTokenManager, type OAuthAccessTokenManagerDeps, usesFoundationManagedOAuth, } from "./oauth-access-token.ts";
 export { type OAuthStatePayload, signOAuthState, type VerifyOAuthStateResult, verifyOAuthState, } from "./oauth-state.ts";
+export { isMailSendNotConfiguredError, isMailSendRejectedError, MailSendNotConfiguredError, MailSendRejectedError, type OutboundMailMessage, type OutboundMailSent, outboundMailMessageSchema, } from "./outbound-mail.ts";
 export { inboundMessagesProjectionTable, mailAccountsProjectionTable, mailThreadsProjectionTable, } from "./projection.ts";
 export { resolveInboundProviderForAccount, resolveInboundProviderForKey, } from "./provider-factory.ts";
-export { MAIL_ACCOUNT_EDIT_SCREEN_ID, MAIL_ACCOUNT_LIST_SCREEN_ID, } from "./screens.ts";
+export { IMAP_CONNECT_SCREEN_ID, MAIL_ACCOUNT_EDIT_SCREEN_ID, MAIL_ACCOUNT_LIST_SCREEN_ID, MAIL_ACCOUNT_LIST_SCREEN_QN, } from "./screens.ts";
+export { MAIL_SEND_ERRORS, type MailSendFailure, type SendMailFromAccountContext, type SendMailFromAccountInput, sendMailFromAccount, } from "./send-from-account.ts";
 export { InboundAuthError, InboundCursorInvalidError, type InboundFetchResult, type InboundMailContext, type InboundMailProviderPlugin, type InboundOAuthFlow, InboundRateLimitError, InboundTransientError, isInboundAuthError, isInboundCursorInvalidError, isInboundMailProviderPlugin, isInboundRateLimitError, isInboundTransientError, type MailAccountRecord, type OAuthTokenSet, type RawInboundMessage, type SyncCursorPayload, } from "./types.ts";
 export { createInboundMailSupervisor, type InboundMailSupervisor, type InboundMailSupervisorDeps, } from "./watch-supervisor.ts";

package/dist/inbound-mail-foundation/index.js

@@ -7,8 +7,10 @@ export { INBOUND_MESSAGE_AGGREGATE_TYPE, INBOUND_MESSAGE_RECEIVED_EVENT_QN, INBO
 export { createInboundMailFoundationFeature } from "./feature.js";
 export { createOAuthAccessTokenManager, inboundRefreshTokenSecretOptions, usesFoundationManagedOAuth, } from "./oauth-access-token.js";
 export { signOAuthState, verifyOAuthState, } from "./oauth-state.js";
+export { isMailSendNotConfiguredError, isMailSendRejectedError, MailSendNotConfiguredError, MailSendRejectedError, outboundMailMessageSchema, } from "./outbound-mail.js";
 export { inboundMessagesProjectionTable, mailAccountsProjectionTable, mailThreadsProjectionTable, } from "./projection.js";
 export { resolveInboundProviderForAccount, resolveInboundProviderForKey, } from "./provider-factory.js";
-export { MAIL_ACCOUNT_EDIT_SCREEN_ID, MAIL_ACCOUNT_LIST_SCREEN_ID, } from "./screens.js";
+export { IMAP_CONNECT_SCREEN_ID, MAIL_ACCOUNT_EDIT_SCREEN_ID, MAIL_ACCOUNT_LIST_SCREEN_ID, MAIL_ACCOUNT_LIST_SCREEN_QN, } from "./screens.js";
+export { MAIL_SEND_ERRORS, sendMailFromAccount, } from "./send-from-account.js";
 export { InboundAuthError, InboundCursorInvalidError, InboundRateLimitError, InboundTransientError, isInboundAuthError, isInboundCursorInvalidError, isInboundMailProviderPlugin, isInboundRateLimitError, isInboundTransientError, } from "./types.js";
 export { createInboundMailSupervisor, } from "./watch-supervisor.js";

package/dist/inbound-mail-foundation/outbound-mail.d.ts

@@ -0,0 +1,28 @@
+import * as z from "zod";
+export declare const outboundMailMessageSchema: z.ZodObject<{
+    to: z.ZodArray<z.ZodEmail>;
+    cc: z.ZodOptional<z.ZodArray<z.ZodEmail>>;
+    subject: z.ZodString;
+    text: z.ZodOptional<z.ZodString>;
+    html: z.ZodOptional<z.ZodString>;
+    inReplyTo: z.ZodOptional<z.ZodString>;
+    references: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>;
+export type OutboundMailMessage = z.infer<typeof outboundMailMessageSchema>;
+export type OutboundMailSent = {
+    /** Message-ID header of the sent mail, without angle brackets. */
+    readonly messageIdHeader: string;
+};
+/** The mailbox has no outgoing server stored, for example a credential document from before
+ *  sending existed. The tenant has to connect the mailbox again. */
+export declare class MailSendNotConfiguredError extends Error {
+    readonly kind: "mail-send-not-configured-error";
+    constructor(message: string);
+}
+/** The outgoing server accepted the login but refused the mail (recipient, size, policy). */
+export declare class MailSendRejectedError extends Error {
+    readonly kind: "mail-send-rejected-error";
+    constructor(message: string);
+}
+export declare function isMailSendNotConfiguredError(e: unknown): e is MailSendNotConfiguredError;
+export declare function isMailSendRejectedError(e: unknown): e is MailSendRejectedError;

package/dist/inbound-mail-foundation/outbound-mail.js

@@ -0,0 +1,52 @@
+// Outbound half of the provider contract: a reply sent from a connected mailbox through the
+// customer's own mail server, never through the platform sender.
+import * as z from "zod";
+const MAX_RECIPIENTS = 50;
+const MAX_REFERENCES = 100;
+// Message ids travel without angle brackets, like RawInboundMessage.references. Anything that
+// could close the bracket or start a new header is refused instead of being encoded.
+const messageIdSchema = z
+    .string()
+    .min(1)
+    .max(998)
+    .regex(/^[^\s<>]+$/);
+export const outboundMailMessageSchema = z
+    .object({
+    to: z.array(z.email().max(320)).min(1).max(MAX_RECIPIENTS),
+    cc: z.array(z.email().max(320)).max(MAX_RECIPIENTS).optional(),
+    subject: z
+        .string()
+        .max(998)
+        .regex(/^[^\r\n]*$/),
+    text: z.string().optional(),
+    html: z.string().optional(),
+    inReplyTo: messageIdSchema.optional(),
+    references: z.array(messageIdSchema).max(MAX_REFERENCES).optional(),
+})
+    .refine((message) => message.text !== undefined || message.html !== undefined, {
+    message: "needs text or html",
+});
+// Same `kind` discriminant as the inbound error classes (see types.ts).
+/** The mailbox has no outgoing server stored, for example a credential document from before
+ *  sending existed. The tenant has to connect the mailbox again. */
+export class MailSendNotConfiguredError extends Error {
+    kind = "mail-send-not-configured-error";
+    constructor(message) {
+        super(message);
+        this.name = "MailSendNotConfiguredError";
+    }
+}
+/** The outgoing server accepted the login but refused the mail (recipient, size, policy). */
+export class MailSendRejectedError extends Error {
+    kind = "mail-send-rejected-error";
+    constructor(message) {
+        super(message);
+        this.name = "MailSendRejectedError";
+    }
+}
+export function isMailSendNotConfiguredError(e) {
+    return e instanceof Error && "kind" in e && e.kind === "mail-send-not-configured-error";
+}
+export function isMailSendRejectedError(e) {
+    return e instanceof Error && "kind" in e && e.kind === "mail-send-rejected-error";
+}

package/dist/inbound-mail-foundation/probe.js

@@ -1,11 +1,11 @@
-import { configuredPiiSubjectKms, decryptPiiFieldValues, } from "@cosmicdrift/kumiko-framework/crypto";
 import { createSystemUser, ProbeFailure, } from "@cosmicdrift/kumiko-framework/engine";
 import { createConfigAccessor } from "../config/index.js";
-import { INBOUND_MAIL_FOUNDATION_FEATURE, InboundMailAccountStatuses } from "./constants.js";
-import { MAIL_ACCOUNT_PII_FIELDS } from "./entities.js";
+import { toMailAccountRecord } from "./account-record.js";
+import { InboundMailAccountStatuses } from "./constants.js";
 import { INBOUND_PROBE_KEYS } from "./probe-keys.js";
 import { mailAccountsProjectionTable } from "./projection.js";
 import { resolveInboundProviderForAccount } from "./provider-factory.js";
+import { MAIL_ACCOUNT_LIST_SCREEN_QN } from "./screens.js";
 import { isInboundAuthError } from "./types.js";
 const SHORT_ID_LENGTH = 8;
 function providerContext(ctx) {
@@ -20,29 +20,6 @@ function providerContext(ctx) {
         }),
     };
 }
-// Providers never see ciphertext, so the address is decrypted before the call.
-async function toAccountRecord(row, tenantId) {
-    const piiKms = configuredPiiSubjectKms();
-    const decrypted = piiKms
-        ? await decryptPiiFieldValues(row, MAIL_ACCOUNT_PII_FIELDS, piiKms, {
-            requestId: "inbound-mail-foundation:probe",
-        })
-        : row;
-    const address = decrypted["address"];
-    if (typeof address !== "string")
-        throw new Error("mailbox address did not decrypt to text");
-    return {
-        id: row.id,
-        tenantId,
-        provider: row.provider,
-        authMethod: row.authMethod,
-        ownerUserId: row.ownerUserId ?? null,
-        address,
-        displayName: row.displayName ?? "",
-        status: InboundMailAccountStatuses.active,
-        watchState: row.watchState ?? "idle",
-    };
-}
 export function registerMailboxProbe(r) {
     r.probe({
         name: "mailboxes",
@@ -50,7 +27,7 @@ export function registerMailboxProbe(r) {
         cost: "free",
         area: INBOUND_PROBE_KEYS.area,
         label: INBOUND_PROBE_KEYS.label,
-        fixScreen: `${INBOUND_MAIL_FOUNDATION_FEATURE}:screen:mail-accounts`,
+        fixScreen: MAIL_ACCOUNT_LIST_SCREEN_QN,
         // The address is PII, so the target label carries only the tenant-authored display name.
         targets: async (ctx) => {
             const rows = await ctx.db.selectMany(mailAccountsProjectionTable, {
@@ -71,7 +48,7 @@ export function registerMailboxProbe(r) {
                 : undefined;
             if (!row)
                 return { status: "skipped", message: { key: INBOUND_PROBE_KEYS.gone } };
-            const account = await toAccountRecord(row, ctx.tenantId);
+            const account = await toMailAccountRecord(row, ctx.tenantId, "inbound-mail-foundation:probe");
             const providerCtx = providerContext(ctx);
             const plugin = resolveInboundProviderForAccount(providerCtx, account);
             try {

package/dist/inbound-mail-foundation/screens.d.ts

@@ -2,6 +2,8 @@ import { type ProjectionListScreenDefinition } from "@cosmicdrift/kumiko-framewo
 import type { ActionFormScreenDefinition } from "@cosmicdrift/kumiko-framework/ui-types";
 export declare const MAIL_ACCOUNT_LIST_SCREEN_ID = "mail-accounts";
 export declare const MAIL_ACCOUNT_EDIT_SCREEN_ID = "mail-account-edit";
+export declare const MAIL_ACCOUNT_LIST_SCREEN_QN = "inbound-mail-foundation:screen:mail-accounts";
+export declare const IMAP_CONNECT_SCREEN_ID = "mail-account-connect-imap";
 export declare const MAIL_ACCOUNT_STATUS_OPTION_KEY_PREFIX = "inboundMail.accounts.status.";
 export declare const mailAccountListScreen: ProjectionListScreenDefinition;
 export declare const mailAccountEditScreen: ActionFormScreenDefinition;

package/dist/inbound-mail-foundation/screens.js

@@ -2,6 +2,11 @@ import { i18nKey, MAX_LIST_LIMIT, } from "@cosmicdrift/kumiko-framework/engine";
 import { InboundMailAccountStatuses, InboundMailFoundationHandlers, InboundMailFoundationQueries, } from "./constants.js";
 export const MAIL_ACCOUNT_LIST_SCREEN_ID = "mail-accounts";
 export const MAIL_ACCOUNT_EDIT_SCREEN_ID = "mail-account-edit";
+export const MAIL_ACCOUNT_LIST_SCREEN_QN = "inbound-mail-foundation:screen:mail-accounts";
+// Registered by inbound-provider-imap, which needs the IMAP client to check the login. The
+// renderer drops a navigate action whose target screen is not mounted, so the toolbar button
+// only shows in apps that mount that provider.
+export const IMAP_CONNECT_SCREEN_ID = "mail-account-connect-imap";
 export const MAIL_ACCOUNT_STATUS_OPTION_KEY_PREFIX = "inboundMail.accounts.status.";
 // Same roles as the update/disconnect handlers: a screen rule wider than the
 // handlers would only render actions that 403.
@@ -60,6 +65,15 @@ export const mailAccountListScreen = {
             visible: { field: "status", ne: InboundMailAccountStatuses.disconnected },
         },
     ],
+    toolbarActions: [
+        {
+            kind: "navigate",
+            id: "connect-imap",
+            label: i18nKey("inboundMail.accounts.connectImap"),
+            screen: IMAP_CONNECT_SCREEN_ID,
+            style: "primary",
+        },
+    ],
     access: MAIL_ACCOUNT_ADMIN_ACCESS,
     dormant: true,
 };

package/dist/inbound-mail-foundation/send-from-account.d.ts

@@ -0,0 +1,31 @@
+import type { HandlerContext, WriteResult } from "@cosmicdrift/kumiko-framework/engine";
+import { type OutboundMailMessage, type OutboundMailSent } from "./outbound-mail.ts";
+export declare const MAIL_SEND_ERRORS: {
+    readonly notConfigured: {
+        readonly reason: "mail_send_not_configured";
+        readonly i18nKey: "inboundMail.send.errors.notConfigured";
+    };
+    readonly loginRejected: {
+        readonly reason: "mail_send_login_rejected";
+        readonly i18nKey: "inboundMail.send.errors.loginRejected";
+    };
+    readonly serverUnreachable: {
+        readonly reason: "mail_send_server_unreachable";
+        readonly i18nKey: "inboundMail.send.errors.serverUnreachable";
+    };
+    readonly rejected: {
+        readonly reason: "mail_send_rejected";
+        readonly i18nKey: "inboundMail.send.errors.rejected";
+    };
+    readonly invalidMessage: {
+        readonly reason: "mail_send_invalid_message";
+        readonly i18nKey: "inboundMail.send.errors.invalidMessage";
+    };
+};
+export type MailSendFailure = keyof typeof MAIL_SEND_ERRORS;
+export type SendMailFromAccountContext = Pick<HandlerContext, "db" | "registry" | "user" | "services" | "obs">;
+export type SendMailFromAccountInput = {
+    readonly accountId: string;
+    readonly message: OutboundMailMessage;
+};
+export declare function sendMailFromAccount(ctx: SendMailFromAccountContext, input: SendMailFromAccountInput): Promise<WriteResult<OutboundMailSent>>;

package/dist/inbound-mail-foundation/send-from-account.js

@@ -0,0 +1,87 @@
+// Sends a mail from a connected mailbox through the customer's own mail server. A plain server
+// function rather than a handler: the caller's own write handler owns access and agent exposure,
+// and the message (recipients, body) never becomes a dispatcher payload of its own.
+//
+// There is no fallback to the platform sender: a mailbox that cannot send answers with a typed
+// failure, so a reply never leaves under an address the recipient did not write to.
+import { failNotFound, UnprocessableError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
+import { toMailAccountRecord } from "./account-record.js";
+import { InboundMailAccountStatuses } from "./constants.js";
+import { isVisibleToCaller } from "./handlers/scope-visibility.js";
+import { isMailSendNotConfiguredError, isMailSendRejectedError, outboundMailMessageSchema, } from "./outbound-mail.js";
+import { mailAccountsProjectionTable } from "./projection.js";
+import { resolveInboundProviderForAccount } from "./provider-factory.js";
+import { isInboundAuthError, isInboundRateLimitError, isInboundTransientError, } from "./types.js";
+export const MAIL_SEND_ERRORS = {
+    notConfigured: {
+        reason: "mail_send_not_configured",
+        i18nKey: "inboundMail.send.errors.notConfigured",
+    },
+    loginRejected: {
+        reason: "mail_send_login_rejected",
+        i18nKey: "inboundMail.send.errors.loginRejected",
+    },
+    serverUnreachable: {
+        reason: "mail_send_server_unreachable",
+        i18nKey: "inboundMail.send.errors.serverUnreachable",
+    },
+    rejected: { reason: "mail_send_rejected", i18nKey: "inboundMail.send.errors.rejected" },
+    invalidMessage: {
+        reason: "mail_send_invalid_message",
+        i18nKey: "inboundMail.send.errors.invalidMessage",
+    },
+};
+const HANDLER_NAME = "inbound-mail-foundation:send-from-account";
+function sendFailure(failure) {
+    const { reason, i18nKey } = MAIL_SEND_ERRORS[failure];
+    return writeFailure(new UnprocessableError(reason, { i18nKey }));
+}
+function sendFailureOf(err) {
+    if (isMailSendNotConfiguredError(err))
+        return "notConfigured";
+    if (isInboundAuthError(err))
+        return "loginRejected";
+    if (isInboundTransientError(err) || isInboundRateLimitError(err))
+        return "serverUnreachable";
+    if (isMailSendRejectedError(err))
+        return "rejected";
+    return undefined;
+}
+// A disconnected mailbox and someone else's personal mailbox are reported as missing, so the
+// caller cannot tell them apart from an id that never existed.
+function isSendableBy(row, user) {
+    return row.status !== InboundMailAccountStatuses.disconnected && isVisibleToCaller(row, user);
+}
+export async function sendMailFromAccount(ctx, input) {
+    const message = outboundMailMessageSchema.safeParse(input.message);
+    if (!message.success)
+        return sendFailure("invalidMessage");
+    const row = await ctx.db.fetchOne(mailAccountsProjectionTable, {
+        id: input.accountId,
+        tenantId: ctx.user.tenantId,
+    });
+    if (!row || !isSendableBy(row, ctx.user))
+        return failNotFound("mail-account", input.accountId);
+    const account = await toMailAccountRecord(row, ctx.user.tenantId, `${HANDLER_NAME}:${row.id}`);
+    const providerCtx = {
+        registry: ctx.registry,
+        ...(ctx.services.secrets && { secrets: ctx.services.secrets }),
+        auditUserId: ctx.user.id,
+    };
+    const plugin = resolveInboundProviderForAccount(providerCtx, account, HANDLER_NAME);
+    if (!plugin.send)
+        return sendFailure("notConfigured");
+    try {
+        return { isSuccess: true, data: await plugin.send(providerCtx, account, message.data) };
+    }
+    catch (err) {
+        const failure = sendFailureOf(err);
+        if (!failure)
+            throw err;
+        ctx.obs.log.warn("mail send from account failed", {
+            accountId: account.id,
+            reason: MAIL_SEND_ERRORS[failure].reason,
+        });
+        return sendFailure(failure);
+    }
+}

package/dist/inbound-mail-foundation/types.d.ts

@@ -1,6 +1,7 @@
 import type { ConfigAccessor, Registry } from "@cosmicdrift/kumiko-framework/engine";
 import type { MetricsHandle } from "@cosmicdrift/kumiko-framework/observability";
 import { INBOUND_MAIL_PROVIDER_EXTENSION, type InboundMailAccountStatus } from "./constants.ts";
+import type { OutboundMailMessage, OutboundMailSent } from "./outbound-mail.ts";
 /**
  * Slim context for provider plugins.
  *
@@ -157,6 +158,9 @@ export type InboundMailProviderPlugin = {
     }) => Promise<InboundFetchResult>;
     /** Nur OAuth-Provider. */
     readonly oauth?: InboundOAuthFlow;
+    /** Sends from the mailbox address through the customer's own server. Throws
+     *  MailSendNotConfiguredError, InboundAuthError, InboundTransientError or MailSendRejectedError. */
+    readonly send?: (ctx: InboundMailContext, account: MailAccountRecord, message: OutboundMailMessage) => Promise<OutboundMailSent>;
     /** Optional live push (IMAP IDLE, later Graph/Gmail webhooks).
      *  Returns stop(). Polling remains reconciliation: watch optimizes
      *  latency but is never the correctness anchor. `onError` reports a dead

package/dist/inbound-mail-foundation/watch-supervisor.js

@@ -44,6 +44,7 @@
 // racing a new holder.
 import { configuredPiiSubjectKms, decryptPiiFieldValues, } from "@cosmicdrift/kumiko-framework/crypto";
 import { fetchOne, insertOne, selectMany, updateMany } from "@cosmicdrift/kumiko-framework/db";
+import { systemScopedRunner } from "@cosmicdrift/kumiko-framework/internal/row-level-security";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
 import { InboundMailAccountStatuses, InboundMailFoundationHandlers } from "./constants.js";
@@ -79,10 +80,11 @@ export function createInboundMailSupervisor(deps) {
     // configured TTL — real deployments (default 90s) never hit it.
     const renewIntervalMs = Math.max(50, Math.floor((leaseTtlSeconds * 1000) / 3));
     const log = deps.log ?? (() => { });
+    const systemDb = systemScopedRunner(deps.db, "mail sync supervisor polls accounts and cursors of all tenants outside a request");
     const oauthTokens = deps.oauthTokens ??
         (deps.providerCtx.secrets
             ? createOAuthAccessTokenManager({
-                db: deps.db,
+                db: systemDb,
                 secrets: deps.providerCtx.secrets,
                 providerCtx: deps.providerCtx,
             })
@@ -107,7 +109,7 @@ export function createInboundMailSupervisor(deps) {
     // decrypted (providers never work with ciphertext).
     // ---------------------------------------------------------------
     async function listActiveAccounts() {
-        const rows = await selectMany(deps.db, mailAccountsProjectionTable, {
+        const rows = await selectMany(systemDb, mailAccountsProjectionTable, {
             status: InboundMailAccountStatuses.active,
         });
         const piiKms = configuredPiiSubjectKms();
@@ -152,7 +154,7 @@ export function createInboundMailSupervisor(deps) {
     // Cursor-Persistenz (unmanaged direct-write store).
     // ---------------------------------------------------------------
     async function loadCursor(accountId) {
-        const row = await fetchOne(deps.db, syncCursorTable, {
+        const row = await fetchOne(systemDb, syncCursorTable, {
             accountId,
             scope: CURSOR_SCOPE,
         });
@@ -170,16 +172,16 @@ export function createInboundMailSupervisor(deps) {
         const accountId = account.id;
         const now = Temporal.Now.instant().toString();
         const serialized = JSON.stringify(cursor);
-        const existing = await fetchOne(deps.db, syncCursorTable, {
+        const existing = await fetchOne(systemDb, syncCursorTable, {
             accountId,
             scope: CURSOR_SCOPE,
         });
         if (existing) {
-            await updateMany(deps.db, syncCursorTable, { cursor: serialized, updatedAt: now }, { accountId, scope: CURSOR_SCOPE });
+            await updateMany(systemDb, syncCursorTable, { cursor: serialized, updatedAt: now }, { accountId, scope: CURSOR_SCOPE });
             // skip: the update path is complete; do not fall through to the insert branch.
             return;
         }
-        await insertOne(deps.db, syncCursorTable, {
+        await insertOne(systemDb, syncCursorTable, {
             id: crypto.randomUUID(),
             // Direct-write store: no executor stamps the NOT NULL tenant_id for us.
             tenantId: account.tenantId,
@@ -192,7 +194,7 @@ export function createInboundMailSupervisor(deps) {
     async function resetCursor(accountId) {
         // No deleteMany import is needed: an empty cursor parses to null, so the
         // next fetch runs as a backfill.
-        await updateMany(deps.db, syncCursorTable, { cursor: "", updatedAt: Temporal.Now.instant().toString() }, { accountId, scope: CURSOR_SCOPE });
+        await updateMany(systemDb, syncCursorTable, { cursor: "", updatedAt: Temporal.Now.instant().toString() }, { accountId, scope: CURSOR_SCOPE });
     }
     // ---------------------------------------------------------------
     // Ingest: every message goes through the standard write handler.
@@ -271,7 +273,7 @@ export function createInboundMailSupervisor(deps) {
             // One bind parameter per id: a full-mailbox listing would exceed Postgres' 65535 limit.
             const seenIds = new Set();
             for (let start = 0; start < providerMessageIds.length; start += SEEN_LOOKUP_CHUNK_SIZE) {
-                const seen = await selectMany(deps.db, seenMessageTable, {
+                const seen = await selectMany(systemDb, seenMessageTable, {
                     tenantId: account.tenantId,
                     accountId: account.id,
                     providerMessageId: {

package/dist/inbound-provider-imap/connect-mailbox.d.ts

@@ -0,0 +1,13 @@
+import * as z from "zod";
+export declare function deriveSmtpHost(imapHost: string): string;
+export declare const connectMailboxHandler: import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"connect-mailbox", z.ZodObject<{
+    host: z.ZodString;
+    port: z.ZodDefault<z.ZodNumber>;
+    user: z.ZodString;
+    displayName: z.ZodString;
+    address: z.ZodEmail;
+    password: z.ZodString;
+    smtpHost: z.ZodOptional<z.ZodNullable<z.ZodUnion<readonly [z.ZodLiteral<"">, z.ZodString]>>>;
+}, z.core.$strip>, {
+    accountId: string;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, null>;