@cosmicdrift/kumiko-bundled-features 0.391.1 → 0.392.0

package/dist/inbound-provider-imap/connect-mailbox.js

@@ -0,0 +1,124 @@
+// connect-mailbox: the form path for a password IMAP mailbox. The IMAP login and then the SMTP
+// login of the outgoing server are checked before the transaction opens; only then the account
+// stream and its credential secret are written, both on the request transaction, so a failure
+// leaves neither behind.
+import { InboundAuthError, InboundMailAuthMethods, InboundMailFoundationHandlers, inboundCredentialSecretKey, } from "@cosmicdrift/kumiko-bundled-features/inbound-mail-foundation";
+import { requireSecretsContext } from "@cosmicdrift/kumiko-bundled-features/secrets";
+import { defineWriteHandler, } from "@cosmicdrift/kumiko-framework/engine";
+import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
+import * as z from "zod";
+import { IMAP_CONNECT_ERRORS, IMAP_PROVIDER_KEY, SMTP_CONNECT_ERRORS } from "./constants.js";
+import { imapCredentialDocumentSchema, SMTP_IMPLICIT_TLS_PORT, smtpHostSchema, } from "./credential-document.js";
+import { connectOnce, IMAP_HOST_UNREACHABLE_MESSAGE } from "./imap-client.js";
+import { SmtpFailureError, verifySmtpLogin } from "./smtp-client.js";
+// No `secure` and no SMTP port input: the password never crosses the wire in clear text, so a
+// payload's secure:false or smtpPort is stripped like any unknown key and both logins always use
+// implicit TLS (SMTP on port 465).
+const connectMailboxSchema = imapCredentialDocumentSchema
+    .pick({ host: true, port: true, user: true })
+    .extend({
+    displayName: z.string().min(1).max(200),
+    address: z.email().max(320),
+    password: z.string().min(1).max(1000),
+    smtpHost: z.union([z.literal(""), smtpHostSchema]).nullish(),
+});
+const connectedAccountSchema = z.object({ accountId: z.string() });
+// Matched on the mapped error text, which also carries the host, so only markers no host name
+// contains: a bare "tls" or "ssl" would misread a host like ssl.example.com.
+// BoringSSL (Bun) spells the handshake error WRONG_VERSION_NUMBER, OpenSSL (Node) with spaces.
+const TLS_FAILURE = /certificate|self[- ]signed|wrong[ _]version[ _]number|EPROTO|ERR_SSL|ERR_TLS/i;
+// A fixed preview: any slice of the JSON document would expose the host or the user.
+const CREDENTIAL_PREVIEW = "IMAP login";
+const SECRET_TRANSACTION_REASON = "the credential secret is written on the request transaction so a failed account connect rolls it back too";
+// Most hosters name the outgoing server like the incoming one, or with smtp. for imap.
+export function deriveSmtpHost(imapHost) {
+    return /^imap\./i.test(imapHost) ? `smtp.${imapHost.slice("imap.".length)}` : imapHost;
+}
+function credentialDocumentOf(payload) {
+    const { host, port, user, password } = payload;
+    const smtpHost = payload.smtpHost || deriveSmtpHost(host);
+    return { host, port, secure: true, user, password, smtpHost, smtpPort: SMTP_IMPLICIT_TLS_PORT };
+}
+// The raw error carries the host and the server response; the tenant only gets the category.
+// A blocked host and an unresolvable one share one text on purpose (see createImapClient).
+function imapConnectFailureOf(err) {
+    const message = err instanceof Error ? err.message : "";
+    if (message === IMAP_HOST_UNREACHABLE_MESSAGE)
+        return "hostUnreachable";
+    if (err instanceof InboundAuthError)
+        return "loginRejected";
+    if (TLS_FAILURE.test(message))
+        return "tlsFailed";
+    return "connectFailed";
+}
+// verify never sends a mail, so a refused message cannot happen here; anything else answering
+// with an SMTP reply is a server we could not use.
+function smtpConnectFailureOf(failure) {
+    return failure === "rejected" ? "connectFailed" : failure;
+}
+async function checkSmtpLogin(doc) {
+    const { smtpHost, smtpPort, user, password } = doc;
+    // A derived host from an odd IMAP host name could not be stored as a valid document.
+    if (!smtpHost || !password || !smtpHostSchema.safeParse(smtpHost).success) {
+        return "hostUnreachable";
+    }
+    try {
+        await verifySmtpLogin({ host: smtpHost, port: smtpPort, user, password });
+        return undefined;
+    }
+    catch (err) {
+        if (err instanceof SmtpFailureError)
+            return smtpConnectFailureOf(err.failure);
+        throw err;
+    }
+}
+export const connectMailboxHandler = defineWriteHandler({
+    name: "connect-mailbox",
+    description: "Connects a shared IMAP mailbox with a password over implicit TLS: checks the IMAP login and the SMTP login of the outgoing server (given, or derived from the IMAP host) first, then creates the mail account and stores both servers, user and password as its credential secret in one step.",
+    // The payload carries the plaintext password: as a tool call it would reach the model provider.
+    agent: { expose: false },
+    schema: connectMailboxSchema,
+    access: { roles: ["SystemAdmin", "TenantAdmin"] },
+    // Each call opens a connection to a host the caller picks; the cap keeps the form from being
+    // used to scan ports or to guess passwords at someone else's mail server.
+    rateLimit: { per: "tenant+handler", limit: 10, windowSeconds: 600 },
+    escapeHatch: { grants: ["unsafeRaw"], reason: SECRET_TRANSACTION_REASON },
+    beforeTransaction: async (event, ctx) => {
+        const doc = credentialDocumentOf(event.payload);
+        try {
+            await connectOnce(doc, true);
+        }
+        catch (err) {
+            const { reason, i18nKey } = IMAP_CONNECT_ERRORS[imapConnectFailureOf(err)];
+            ctx.obs.log.warn("imap connect check failed", { reason });
+            return writeFailure(new UnprocessableError(reason, { i18nKey }));
+        }
+        const smtpFailure = await checkSmtpLogin(doc);
+        if (smtpFailure) {
+            const { reason, i18nKey } = SMTP_CONNECT_ERRORS[smtpFailure];
+            ctx.obs.log.warn("smtp connect check failed", { reason });
+            return writeFailure(new UnprocessableError(reason, { i18nKey }));
+        }
+        return { isSuccess: true, data: null };
+    },
+    handler: async (event, ctx) => {
+        const { displayName, address } = event.payload;
+        const connected = await ctx.dispatch.write(InboundMailFoundationHandlers.connectAccount, {
+            provider: IMAP_PROVIDER_KEY,
+            authMethod: InboundMailAuthMethods.password,
+            displayName,
+            address,
+            scope: "shared",
+        });
+        if (!connected.isSuccess)
+            return connected;
+        const { accountId } = connectedAccountSchema.parse(connected.data);
+        const secrets = requireSecretsContext({ secrets: ctx.services.secrets, user: ctx.user }, "connect-mailbox").withRunner(ctx.db.unsafeRaw());
+        await secrets.set(event.user.tenantId, inboundCredentialSecretKey(accountId), JSON.stringify(credentialDocumentOf(event.payload)), {
+            redact: () => CREDENTIAL_PREVIEW,
+            hint: `IMAP credentials for inbound mail account ${accountId}`,
+            updatedBy: event.user.id,
+        });
+        return { isSuccess: true, data: { accountId } };
+    },
+});

package/dist/inbound-provider-imap/constants.d.ts

@@ -0,0 +1,41 @@
+export declare const FEATURE_NAME = "inbound-provider-imap";
+export declare const IMAP_PROVIDER_KEY = "imap";
+export declare const ImapHandlers: {
+    readonly connectMailbox: "inbound-provider-imap:write:connect-mailbox";
+};
+export declare const IMAP_CONNECT_ERRORS: {
+    readonly hostUnreachable: {
+        readonly reason: "imap_host_unreachable";
+        readonly i18nKey: "inboundMail.imap.connect.errors.hostUnreachable";
+    };
+    readonly loginRejected: {
+        readonly reason: "imap_login_rejected";
+        readonly i18nKey: "inboundMail.imap.connect.errors.loginRejected";
+    };
+    readonly tlsFailed: {
+        readonly reason: "imap_tls_failed";
+        readonly i18nKey: "inboundMail.imap.connect.errors.tlsFailed";
+    };
+    readonly connectFailed: {
+        readonly reason: "imap_connect_failed";
+        readonly i18nKey: "inboundMail.imap.connect.errors.connectFailed";
+    };
+};
+export declare const SMTP_CONNECT_ERRORS: {
+    readonly hostUnreachable: {
+        readonly reason: "smtp_host_unreachable";
+        readonly i18nKey: "inboundMail.imap.connect.errors.smtpHostUnreachable";
+    };
+    readonly loginRejected: {
+        readonly reason: "smtp_login_rejected";
+        readonly i18nKey: "inboundMail.imap.connect.errors.smtpLoginRejected";
+    };
+    readonly tlsFailed: {
+        readonly reason: "smtp_tls_failed";
+        readonly i18nKey: "inboundMail.imap.connect.errors.smtpTlsFailed";
+    };
+    readonly connectFailed: {
+        readonly reason: "smtp_connect_failed";
+        readonly i18nKey: "inboundMail.imap.connect.errors.smtpConnectFailed";
+    };
+};

package/dist/inbound-provider-imap/constants.js

@@ -0,0 +1,39 @@
+export const FEATURE_NAME = "inbound-provider-imap";
+export const IMAP_PROVIDER_KEY = "imap";
+export const ImapHandlers = {
+    connectMailbox: "inbound-provider-imap:write:connect-mailbox",
+};
+export const IMAP_CONNECT_ERRORS = {
+    hostUnreachable: {
+        reason: "imap_host_unreachable",
+        i18nKey: "inboundMail.imap.connect.errors.hostUnreachable",
+    },
+    loginRejected: {
+        reason: "imap_login_rejected",
+        i18nKey: "inboundMail.imap.connect.errors.loginRejected",
+    },
+    tlsFailed: { reason: "imap_tls_failed", i18nKey: "inboundMail.imap.connect.errors.tlsFailed" },
+    connectFailed: {
+        reason: "imap_connect_failed",
+        i18nKey: "inboundMail.imap.connect.errors.connectFailed",
+    },
+};
+// Same categories as IMAP_CONNECT_ERRORS, for the outgoing server checked after the IMAP login.
+export const SMTP_CONNECT_ERRORS = {
+    hostUnreachable: {
+        reason: "smtp_host_unreachable",
+        i18nKey: "inboundMail.imap.connect.errors.smtpHostUnreachable",
+    },
+    loginRejected: {
+        reason: "smtp_login_rejected",
+        i18nKey: "inboundMail.imap.connect.errors.smtpLoginRejected",
+    },
+    tlsFailed: {
+        reason: "smtp_tls_failed",
+        i18nKey: "inboundMail.imap.connect.errors.smtpTlsFailed",
+    },
+    connectFailed: {
+        reason: "smtp_connect_failed",
+        i18nKey: "inboundMail.imap.connect.errors.smtpConnectFailed",
+    },
+};

package/dist/inbound-provider-imap/credential-document.d.ts

@@ -1,4 +1,7 @@
+import { type InboundMailContext, type MailAccountRecord } from "@cosmicdrift/kumiko-bundled-features/inbound-mail-foundation";
 import * as z from "zod";
+export declare const SMTP_IMPLICIT_TLS_PORT = 465;
+export declare const smtpHostSchema: z.ZodString;
 export declare const imapCredentialDocumentSchema: z.ZodObject<{
     host: z.ZodString;
     port: z.ZodDefault<z.ZodNumber>;
@@ -6,6 +9,8 @@ export declare const imapCredentialDocumentSchema: z.ZodObject<{
     user: z.ZodString;
     password: z.ZodOptional<z.ZodString>;
     accessToken: z.ZodOptional<z.ZodString>;
+    smtpHost: z.ZodOptional<z.ZodString>;
+    smtpPort: z.ZodDefault<z.ZodNumber>;
 }, z.core.$strip>;
 export type ImapCredentialDocument = z.infer<typeof imapCredentialDocumentSchema>;
 export type ImapCredentialRejection = "not_json" | "invalid_schema" | "missing_credentials";
@@ -18,3 +23,4 @@ export type ParseCredentialResult = {
     readonly detail?: string;
 };
 export declare function parseImapCredentialDocument(raw: string): ParseCredentialResult;
+export declare function readCredentialDocument(ctx: InboundMailContext, account: MailAccountRecord): Promise<ImapCredentialDocument>;

package/dist/inbound-provider-imap/credential-document.js

@@ -9,12 +9,27 @@
 // at rest.
 //
 // The account's authMethod determines the interpretation:
-//   password → { host, port, secure, user, password }
+//   password → { host, port, secure, user, password, smtpHost?, smtpPort }
 //   xoauth2  → { host, port, secure, user, accessToken } — V1 fallback:
 //              OAuth providers (M365/Gmail) handle token acquisition and
 //              refresh; the imap provider only consumes a valid access
 //              token from the slot.
+//
+// smtpHost is the outgoing server for sending from the mailbox, with the same user and password
+// over implicit TLS. Documents written before sending existed have none: sending reports
+// "not set up" instead of guessing a host.
+import { InboundAuthError, inboundCredentialSecretKey, } from "@cosmicdrift/kumiko-bundled-features/inbound-mail-foundation";
+import { requireSecretsContext } from "@cosmicdrift/kumiko-bundled-features/secrets";
 import * as z from "zod";
+import { FEATURE_NAME } from "./constants.js";
+export const SMTP_IMPLICIT_TLS_PORT = 465;
+// A bare host name: a port, path or whitespace would point the connect somewhere the guard did
+// not check.
+export const smtpHostSchema = z
+    .string()
+    .min(1)
+    .max(255)
+    .regex(/^[^\s:/@]+$/);
 export const imapCredentialDocumentSchema = z.object({
     host: z.string().min(1).max(255),
     port: z.number().int().min(1).max(65535).default(993),
@@ -22,6 +37,8 @@ export const imapCredentialDocumentSchema = z.object({
     user: z.string().min(1).max(320),
     password: z.string().min(1).optional(),
     accessToken: z.string().min(1).optional(),
+    smtpHost: smtpHostSchema.optional(),
+    smtpPort: z.number().int().min(1).max(65535).default(SMTP_IMPLICIT_TLS_PORT),
 });
 export function parseImapCredentialDocument(raw) {
     let json;
@@ -40,3 +57,16 @@ export function parseImapCredentialDocument(raw) {
     }
     return { ok: true, doc: parsed.data };
 }
+export async function readCredentialDocument(ctx, account) {
+    const secrets = requireSecretsContext({ secrets: ctx.secrets, auditUserId: ctx.auditUserId }, FEATURE_NAME);
+    const secret = await secrets.get(account.tenantId, inboundCredentialSecretKey(account.id));
+    if (!secret) {
+        throw new InboundAuthError(`${FEATURE_NAME}: no credential document in secret slot for account ${account.id} — ` +
+            `store the IMAP connection JSON under ${inboundCredentialSecretKey(account.id)} first`);
+    }
+    const parsed = parseImapCredentialDocument(secret.reveal());
+    if (!parsed.ok) {
+        throw new InboundAuthError(`${FEATURE_NAME}: account ${account.id}: ${parsed.reason}${parsed.detail ? `: ${parsed.detail}` : ""}`);
+    }
+    return parsed.doc;
+}

package/dist/inbound-provider-imap/feature.d.ts

@@ -1,5 +1,5 @@
 import { type InboundMailProviderPlugin } from "@cosmicdrift/kumiko-bundled-features/inbound-mail-foundation";
-export declare const IMAP_PROVIDER_KEY = "imap";
+export { IMAP_PROVIDER_KEY } from "./constants.ts";
 export { setImapMailHostLookup } from "./imap-client.ts";
 /** Exported for the live test (imap-live.integration.test.ts) —
  *  applications use the feature, never the plugin directly. */

package/dist/inbound-provider-imap/feature.js

@@ -23,33 +23,20 @@
 // (credential-document.ts), not tenant configuration, because one tenant
 // can have multiple accounts with different hosts.
 import { mailAllowedPrivateHostsEnvSchema } from "@cosmicdrift/kumiko-bundled-features/foundation-shared";
-import { INBOUND_MAIL_PROVIDER_EXTENSION, InboundAuthError, inboundCredentialSecretKey, } from "@cosmicdrift/kumiko-bundled-features/inbound-mail-foundation";
-import { requireSecretsContext } from "@cosmicdrift/kumiko-bundled-features/secrets";
+import { INBOUND_MAIL_PROVIDER_EXTENSION, } from "@cosmicdrift/kumiko-bundled-features/inbound-mail-foundation";
 import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
 import { instantToLegacyDate } from "@cosmicdrift/kumiko-framework/time";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
-import { parseImapCredentialDocument } from "./credential-document.js";
+import { connectMailboxHandler } from "./connect-mailbox.js";
+import { FEATURE_NAME, IMAP_PROVIDER_KEY } from "./constants.js";
+import { readCredentialDocument } from "./credential-document.js";
+import { INBOUND_PROVIDER_IMAP_I18N } from "./i18n.js";
 import { assertUidValidity, coerceDate, connectOnce, createImapClient, IMAP_MAILBOX, imapMailHostGuard, mapImapError, parseImapCursor, toRawInboundMessage, } from "./imap-client.js";
-const FEATURE_NAME = "inbound-provider-imap";
-export const IMAP_PROVIDER_KEY = "imap";
+import { imapConnectScreen } from "./screens.js";
+import { sendFromImapAccount } from "./send-mail.js";
+export { IMAP_PROVIDER_KEY } from "./constants.js";
 export { setImapMailHostLookup } from "./imap-client.js";
 // =============================================================================
-// Credential-Read — per-Account-Slot, Worker-tauglich (slim ctx).
-// =============================================================================
-async function readCredentialDocument(ctx, account) {
-    const secrets = requireSecretsContext({ secrets: ctx.secrets, auditUserId: ctx.auditUserId }, FEATURE_NAME);
-    const secret = await secrets.get(account.tenantId, inboundCredentialSecretKey(account.id));
-    if (!secret) {
-        throw new InboundAuthError(`${FEATURE_NAME}: no credential document in secret slot for account ${account.id} — ` +
-            `store the IMAP connection JSON under ${inboundCredentialSecretKey(account.id)} first`);
-    }
-    const parsed = parseImapCredentialDocument(secret.reveal());
-    if (!parsed.ok) {
-        throw new InboundAuthError(`${FEATURE_NAME}: account ${account.id}: ${parsed.reason}${parsed.detail ? `: ${parsed.detail}` : ""}`);
-    }
-    return parsed.doc;
-}
-// =============================================================================
 // fetch — inkrementeller UID-Sync
 // =============================================================================
 async function fetchMessages(ctx, account, cursor, opts) {
@@ -204,13 +191,14 @@ export const imapInboundMailPlugin = {
     probe: async (ctx, account) => connectOnce(await readCredentialDocument(ctx, account), true),
     fetch: fetchMessages,
     watch: watchMailbox,
+    send: sendFromImapAccount,
     // No oauth block: password authentication runs through the credential
     // form (connect-account + Secret-Write); XOAUTH2 token flows belong to
     // the OAuth providers (M365/Gmail).
 };
 export function createInboundProviderImapFeature() {
     return defineFeature(FEATURE_NAME, (r) => {
-        r.describe('Registers the `"imap"` provider for `inbound-mail-foundation` using imapflow — password/app-password auth covers classic IMAP hosts without any OAuth (plus an XOAUTH2 fallback consuming an access token from the secret slot). Incremental sync via a UIDVALIDITY:lastUid cursor (UIDVALIDITY change triggers a cursor-invalid full resync), initial backfill bounded by the foundation backfill window, and live push via IMAP IDLE for the watch supervisor. Store the per-account connection JSON (host/port/secure/user/password) in the account credential secret slot before the first sync.');
+        r.describe('Registers the `"imap"` provider for `inbound-mail-foundation` using imapflow — password/app-password auth covers classic IMAP hosts without any OAuth (plus an XOAUTH2 fallback consuming an access token from the secret slot). Incremental sync via a UIDVALIDITY:lastUid cursor (UIDVALIDITY change triggers a cursor-invalid full resync), initial backfill bounded by the foundation backfill window, and live push via IMAP IDLE for the watch supervisor. Tenant admins connect a mailbox through the "Connect mailbox" form on the mail accounts list (`connect-mailbox` checks the IMAP login and the SMTP login of the outgoing server first, then creates the account and its credential secret in one transaction); programmatic setups store the per-account connection JSON (host/port/secure/user/password, plus smtpHost/smtpPort for sending) in the account credential secret slot before the first sync. Implements the provider `send`: `sendMailFromAccount` sends over the SMTP server of the mailbox itself (implicit TLS, same login) with the mailbox address as From and stores a copy in its sent folder.');
         r.uiHints({
             displayLabel: "Inbound Mail · IMAP",
             category: "notifications",
@@ -220,5 +208,8 @@ export function createInboundProviderImapFeature() {
         r.requires({ features: ["secrets"] });
         r.envSchema(mailAllowedPrivateHostsEnvSchema);
         r.useExtension(INBOUND_MAIL_PROVIDER_EXTENSION, IMAP_PROVIDER_KEY, imapInboundMailPlugin);
+        r.writeHandler(connectMailboxHandler);
+        r.screen(imapConnectScreen);
+        r.translations({ keys: INBOUND_PROVIDER_IMAP_I18N });
     }, { dedupeOptions: {} });
 }

package/dist/inbound-provider-imap/i18n.d.ts

@@ -0,0 +1,3 @@
+export declare const INBOUND_PROVIDER_IMAP_I18N: Readonly<Record<string, {
+    readonly en: string;
+}>>;

package/dist/inbound-provider-imap/i18n.js

@@ -0,0 +1,45 @@
+import { IMAP_CONNECT_SCREEN_ID } from "@cosmicdrift/kumiko-bundled-features/inbound-mail-foundation";
+import { ACTION_FORM_ENTITY } from "@cosmicdrift/kumiko-framework/ui-types";
+import { fieldLabelKey } from "@cosmicdrift/kumiko-renderer/headless";
+import { FEATURE_NAME, IMAP_CONNECT_ERRORS, SMTP_CONNECT_ERRORS } from "./constants.js";
+const formFieldKey = (field) => fieldLabelKey(FEATURE_NAME, ACTION_FORM_ENTITY, field);
+export const INBOUND_PROVIDER_IMAP_I18N = {
+    [`screen:${IMAP_CONNECT_SCREEN_ID}.title`]: { en: "Connect mailbox" },
+    [formFieldKey("displayName")]: { en: "Name" },
+    [formFieldKey("address")]: { en: "Email address" },
+    [formFieldKey("host")]: { en: "IMAP server" },
+    [formFieldKey("port")]: { en: "Port" },
+    [formFieldKey("user")]: { en: "User name" },
+    [formFieldKey("password")]: { en: "Password" },
+    [formFieldKey("smtpHost")]: { en: "Outgoing server (SMTP)" },
+    "inboundMail.imap.connect.server": { en: "Server sign-in" },
+    "inboundMail.imap.connect.outgoing": { en: "Sending" },
+    "inboundMail.imap.connect.outgoingHint": {
+        en: "Replies go out from this address over your own mail server, with the same user name and password. Leave the field empty if the server is called like the IMAP server, with smtp. instead of imap.",
+    },
+    "inboundMail.imap.connect.submit": { en: "Check and connect" },
+    [IMAP_CONNECT_ERRORS.hostUnreachable.i18nKey]: {
+        en: "The IMAP server cannot be reached or is not allowed. Check the server name.",
+    },
+    [IMAP_CONNECT_ERRORS.loginRejected.i18nKey]: {
+        en: "The IMAP server rejected the sign-in. Check the user name and password.",
+    },
+    [IMAP_CONNECT_ERRORS.tlsFailed.i18nKey]: {
+        en: "The encrypted connection failed. Check the port and the TLS setting.",
+    },
+    [IMAP_CONNECT_ERRORS.connectFailed.i18nKey]: {
+        en: "No connection to the IMAP server. Check the server name and port.",
+    },
+    [SMTP_CONNECT_ERRORS.hostUnreachable.i18nKey]: {
+        en: "Receiving works, but sending does not: the outgoing server cannot be reached or is not allowed. Check its name.",
+    },
+    [SMTP_CONNECT_ERRORS.loginRejected.i18nKey]: {
+        en: "Receiving works, but sending does not: the outgoing server rejected the sign-in.",
+    },
+    [SMTP_CONNECT_ERRORS.tlsFailed.i18nKey]: {
+        en: "Receiving works, but sending does not: the encrypted connection to the outgoing server on port 465 failed.",
+    },
+    [SMTP_CONNECT_ERRORS.connectFailed.i18nKey]: {
+        en: "Receiving works, but sending does not: no connection to the outgoing server on port 465.",
+    },
+};

package/dist/inbound-provider-imap/imap-client.d.ts

@@ -3,6 +3,7 @@ import { type RawInboundMessage, type SyncCursorPayload } from "@cosmicdrift/kum
 import { ImapFlow } from "imapflow";
 import type { ImapCredentialDocument } from "./credential-document.ts";
 export declare const IMAP_MAILBOX = "INBOX";
+export declare const IMAP_HOST_UNREACHABLE_MESSAGE = "IMAP host is not reachable or not allowed";
 export declare function setImapMailHostLookup(fn: MailHostGuardOptions["lookupFn"]): void;
 export declare function imapMailHostGuard(): MailHostGuardOptions;
 export declare function createImapClient(doc: ImapCredentialDocument, hostGuard?: MailHostGuardOptions): Promise<ImapFlow>;

package/dist/inbound-provider-imap/imap-client.js

@@ -16,7 +16,7 @@ const log = createFallbackLogger("inbound-provider-imap");
 // was blocked (private/reserved range) or merely failed to resolve, and
 // must never include the host or the underlying error text. Server-side
 // detail goes to `log` only.
-const IMAP_HOST_UNREACHABLE_MESSAGE = "IMAP host is not reachable or not allowed";
+export const IMAP_HOST_UNREACHABLE_MESSAGE = "IMAP host is not reachable or not allowed";
 // =============================================================================
 // Client-Factory + Fehler-Mapping
 // =============================================================================

package/dist/inbound-provider-imap/screens.d.ts

@@ -0,0 +1,2 @@
+import type { ActionFormScreenDefinition } from "@cosmicdrift/kumiko-framework/ui-types";
+export declare const imapConnectScreen: ActionFormScreenDefinition;

package/dist/inbound-provider-imap/screens.js

@@ -0,0 +1,39 @@
+import { IMAP_CONNECT_SCREEN_ID, MAIL_ACCOUNT_LIST_SCREEN_QN, } from "@cosmicdrift/kumiko-bundled-features/inbound-mail-foundation";
+import { i18nKey } from "@cosmicdrift/kumiko-framework/engine";
+import { ImapHandlers } from "./constants.js";
+// Reached from the toolbar of the foundation's mail account list, never from the nav.
+export const imapConnectScreen = {
+    id: IMAP_CONNECT_SCREEN_ID,
+    type: "actionForm",
+    agent: { expose: false },
+    handler: ImapHandlers.connectMailbox,
+    fields: {
+        displayName: { type: "text", required: true, maxLength: 200 },
+        address: { type: "text", required: true, maxLength: 320, format: "email" },
+        host: { type: "text", required: true, maxLength: 255 },
+        port: { type: "number", integer: true, required: true, min: 1, max: 65535, default: 993 },
+        user: { type: "text", required: true, maxLength: 320 },
+        password: { type: "text", required: true, format: "password", sensitive: true },
+        smtpHost: { type: "text", maxLength: 255 },
+    },
+    layout: {
+        sections: [
+            // The name-based icon guess reads "address" as a postal address.
+            { fields: ["displayName", { field: "address", icon: "mail" }] },
+            {
+                title: i18nKey("inboundMail.imap.connect.server"),
+                fields: ["host", "port", "user", "password"],
+            },
+            {
+                title: i18nKey("inboundMail.imap.connect.outgoing"),
+                description: i18nKey("inboundMail.imap.connect.outgoingHint"),
+                fields: ["smtpHost"],
+            },
+        ],
+    },
+    submitLabel: i18nKey("inboundMail.imap.connect.submit"),
+    redirect: MAIL_ACCOUNT_LIST_SCREEN_QN,
+    cancelTarget: MAIL_ACCOUNT_LIST_SCREEN_QN,
+    access: { roles: ["SystemAdmin", "TenantAdmin"] },
+    dormant: true,
+};

package/dist/inbound-provider-imap/send-mail.d.ts

@@ -0,0 +1,2 @@
+import { type InboundMailContext, type MailAccountRecord, type OutboundMailMessage, type OutboundMailSent } from "@cosmicdrift/kumiko-bundled-features/inbound-mail-foundation";
+export declare function sendFromImapAccount(ctx: InboundMailContext, account: MailAccountRecord, message: OutboundMailMessage): Promise<OutboundMailSent>;

package/dist/inbound-provider-imap/send-mail.js

@@ -0,0 +1,48 @@
+// send for the imap provider: SMTP with the mailbox's own login, From = the mailbox address.
+// The MIME is built once, so the copy in the sent folder is byte for byte what went out.
+import { sanitizeMailDisplayName } from "@cosmicdrift/kumiko-bundled-features/foundation-shared";
+import { InboundAuthError, InboundTransientError, MailSendNotConfiguredError, MailSendRejectedError, } from "@cosmicdrift/kumiko-bundled-features/inbound-mail-foundation";
+import MailComposer from "nodemailer/lib/mail-composer";
+import { FEATURE_NAME } from "./constants.js";
+import { readCredentialDocument } from "./credential-document.js";
+import { appendToSentFolder } from "./sent-folder.js";
+import { SmtpFailureError, sendRawViaSmtp } from "./smtp-client.js";
+function toFoundationSendError(err) {
+    switch (err.failure) {
+        case "loginRejected":
+            return new InboundAuthError(err.message);
+        case "rejected":
+            return new MailSendRejectedError(err.message);
+        default:
+            return new InboundTransientError(err.message);
+    }
+}
+function stripAngles(id) {
+    return id.replace(/^<|>$/g, "");
+}
+export async function sendFromImapAccount(ctx, account, message) {
+    const doc = await readCredentialDocument(ctx, account);
+    if (!doc.smtpHost || !doc.password) {
+        throw new MailSendNotConfiguredError(`${FEATURE_NAME}: account ${account.id} has no outgoing server stored`);
+    }
+    const displayName = sanitizeMailDisplayName(account.displayName);
+    const mime = new MailComposer({
+        from: displayName ? { name: displayName, address: account.address } : account.address,
+        to: [...message.to],
+        ...(message.cc && { cc: [...message.cc] }),
+        subject: message.subject,
+        ...(message.text !== undefined && { text: message.text }),
+        ...(message.html !== undefined && { html: message.html }),
+        ...(message.inReplyTo && { inReplyTo: message.inReplyTo }),
+        ...(message.references && { references: [...message.references] }),
+    }).compile();
+    const raw = await mime.build();
+    try {
+        await sendRawViaSmtp({ host: doc.smtpHost, port: doc.smtpPort, user: doc.user, password: doc.password }, { from: account.address, to: [...message.to, ...(message.cc ?? [])] }, raw);
+    }
+    catch (err) {
+        throw err instanceof SmtpFailureError ? toFoundationSendError(err) : err;
+    }
+    await appendToSentFolder(doc, raw, account.id);
+    return { messageIdHeader: stripAngles(mime.messageId()) };
+}

package/dist/inbound-provider-imap/sent-folder.d.ts

@@ -0,0 +1,8 @@
+import type { ImapCredentialDocument } from "./credential-document.ts";
+type ListedMailbox = {
+    readonly path: string;
+    readonly specialUse?: string;
+};
+export declare function pickSentMailboxPath(mailboxes: readonly ListedMailbox[]): string | undefined;
+export declare function appendToSentFolder(doc: ImapCredentialDocument, raw: Buffer, accountId: string): Promise<void>;
+export {};

package/dist/inbound-provider-imap/sent-folder.js

@@ -0,0 +1,40 @@
+// Stores the copy of a sent mail in the mailbox's sent folder, so the customer finds the reply in
+// their own mail client. Best effort: the mail is already out, a failed copy is only logged.
+import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
+import { createImapClient, imapMailHostGuard } from "./imap-client.js";
+const log = createFallbackLogger("inbound-provider-imap");
+const SENT_SPECIAL_USE = "\\Sent";
+const SENT_FALLBACK_PATHS = ["Sent", "Gesendet", "INBOX.Sent"];
+export function pickSentMailboxPath(mailboxes) {
+    const flagged = mailboxes.find((mailbox) => mailbox.specialUse === SENT_SPECIAL_USE);
+    if (flagged)
+        return flagged.path;
+    for (const name of SENT_FALLBACK_PATHS) {
+        const match = mailboxes.find((mailbox) => mailbox.path.toLowerCase() === name.toLowerCase());
+        if (match)
+            return match.path;
+    }
+    return undefined;
+}
+export async function appendToSentFolder(doc, raw, accountId) {
+    let client;
+    try {
+        client = await createImapClient(doc, imapMailHostGuard());
+        await client.connect();
+        const path = pickSentMailboxPath(await client.list());
+        if (!path) {
+            log.warn("mailbox has no sent folder, sent copy not stored", { accountId });
+            return;
+        }
+        await client.append(path, raw, ["\\Seen"]);
+    }
+    catch (err) {
+        log.warn("storing the sent copy failed", {
+            accountId,
+            reason: err instanceof Error ? err.message : String(err),
+        });
+    }
+    finally {
+        await client?.logout().catch(() => { });
+    }
+}

package/dist/inbound-provider-imap/smtp-client.d.ts

@@ -0,0 +1,35 @@
+import { type MailConnectTarget } from "@cosmicdrift/kumiko-bundled-features/foundation-shared";
+export type SmtpLogin = {
+    readonly host: string;
+    readonly port: number;
+    readonly user: string;
+    readonly password: string;
+};
+export type SmtpFailure = "hostUnreachable" | "loginRejected" | "tlsFailed" | "connectFailed" | "rejected";
+export declare class SmtpFailureError extends Error {
+    readonly failure: SmtpFailure;
+    constructor(failure: SmtpFailure, detail: string);
+}
+export declare function classifySmtpError(err: unknown): SmtpFailure;
+export declare function smtpTransportOptions(login: SmtpLogin, target: MailConnectTarget): {
+    readonly host: string;
+    readonly port: number;
+    readonly secure: true;
+    readonly servername?: string | undefined;
+    readonly auth: {
+        readonly user: string;
+        readonly pass: string;
+    };
+    readonly connectionTimeout: 10000;
+    readonly greetingTimeout: 10000;
+    readonly socketTimeout: 30000;
+    readonly disableFileAccess: true;
+    readonly disableUrlAccess: true;
+    readonly logger: false;
+    readonly debug: false;
+};
+export declare function verifySmtpLogin(login: SmtpLogin): Promise<void>;
+export declare function sendRawViaSmtp(login: SmtpLogin, envelope: {
+    readonly from: string;
+    readonly to: readonly string[];
+}, raw: Buffer): Promise<void>;