@cosmicdrift/kumiko-bundled-features 0.392.2 → 0.394.0

package/dist/inbound-mail-foundation/connect-routes.js

@@ -9,29 +9,41 @@
 // Providers register no routes of their own — their oauth block is
 // resolved via resolveInboundProviderForKey. The callback trusts ONLY the
 // HMAC-verified state (CSRF-/foreign-claiming lock, see oauth-state.ts).
-import { ExtraRouteRejection, signatureRoute } from "@cosmicdrift/kumiko-framework/api";
+import { signatureRoute } from "@cosmicdrift/kumiko-framework/api";
 import { propertyOf } from "@cosmicdrift/kumiko-types/type-guards";
-import { INBOUND_MAIL_FOUNDATION_FEATURE, InboundMailAuthMethods, InboundMailFoundationHandlers, inboundCredentialSecretKey, } from "./constants.js";
-import { inboundRefreshTokenSecretOptions, } from "./oauth-access-token.js";
-import { signOAuthState, verifyOAuthState } from "./oauth-state.js";
+import { refreshTokenOrRefusal, verifyCallbackRequest, } from "./connect-callback-verify.js";
+import { connectFailureResponse, errorJson } from "./connect-route-responses.js";
+import { INBOUND_MAIL_CONNECT_PATH, INBOUND_MAIL_FOUNDATION_FEATURE, InboundMailAuthMethods, InboundMailFoundationHandlers, } from "./constants.js";
+import { isMailAdmin } from "./handlers/scope-visibility.js";
+import { readInboundMailRoles } from "./mail-roles.js";
+import { storeOAuthCallbackCredential, } from "./oauth-access-token.js";
+import { signOAuthState } from "./oauth-state.js";
 import { resolveInboundProviderForKey } from "./provider-factory.js";
 const DEFAULT_STATE_TTL_MINUTES = 15;
-const DEFAULT_CONNECT_PATH = "/api/inbound-mail/connect";
 const DEFAULT_CALLBACK_PATH = "/inbound-mail/oauth/callback";
-function errorJson(c, status, code, message) {
-    return c.json({ error: { code, message } }, status);
+// connect-account leaves a reopened mailbox off: switched on before its token is stored, the
+// supervisor would sync it with the old, failing credential.
+async function reactivateIfReopened(c, deps, tenantId, accountId, connected) {
+    if (propertyOf(connected, "reconnected") !== true)
+        return undefined;
+    const reactivated = await deps.dispatchSystemWrite({
+        handlerQn: InboundMailFoundationHandlers.reactivateAccount,
+        tenantId,
+        payload: { accountId },
+    });
+    return reactivated.isSuccess ? undefined : connectFailureResponse(c, reactivated.error);
 }
-function verifyCallbackRequest(request, stateSecret) {
-    const code = request.query["code"] ?? "";
-    const rawState = request.query["state"] ?? "";
-    if (!code || !rawState) {
-        throw new ExtraRouteRejection(400, { error: { code: "invalid_callback", message: "missing code or state" } }, "inbound-mail oauth callback missing code or state");
+// The callback connects as a system user, so connect-account's role rules (mail member at all,
+// admin for a shared mailbox) have to hold here, before the signed state is handed out.
+function connectRoleRefusal(c, deps, scope) {
+    const { memberRoles, adminRoles } = readInboundMailRoles(deps.registry);
+    if (!memberRoles.some((role) => deps.user.roles.includes(role))) {
+        return errorJson(c, 403, "mail_role_required", `${INBOUND_MAIL_FOUNDATION_FEATURE}: connecting a mailbox needs one of the roles ${memberRoles.join(", ")}`);
     }
-    const verified = verifyOAuthState(rawState, stateSecret);
-    if (!verified.ok) {
-        throw new ExtraRouteRejection(400, { error: { code: "invalid_state", message: `state rejected: ${verified.reason}` } }, `inbound-mail oauth callback state rejected: ${verified.reason}`);
+    if (scope === "shared" && !isMailAdmin(deps.user, adminRoles)) {
+        return errorJson(c, 403, "shared_mailbox_requires_admin", `${INBOUND_MAIL_FOUNDATION_FEATURE}: only ${adminRoles.join(", ")} connect a shared mailbox`);
     }
-    return { code, state: verified.payload };
+    return undefined;
 }
 /** Builds the `entry:"user"`/`entry:"signature"` extraRoute pair. Mount via
  *  `extraRoutes: createInboundMailConnectRoutes(options)`. */
@@ -39,7 +51,7 @@ export function createInboundMailConnectRoutes(options) {
     const ttl = options.stateTtlMinutes ?? DEFAULT_STATE_TTL_MINUTES;
     const connectRoute = {
         method: "GET",
-        path: options.connectPath ?? DEFAULT_CONNECT_PATH,
+        path: options.connectPath ?? INBOUND_MAIL_CONNECT_PATH,
         entry: "user",
         handler: async (c, deps) => {
             const providerKey = c.req.query("provider") ?? "";
@@ -48,6 +60,9 @@ export function createInboundMailConnectRoutes(options) {
             if (!providerKey || (scope !== "user" && scope !== "shared") || !mailbox) {
                 return errorJson(c, 400, "invalid_connect_request", `${INBOUND_MAIL_FOUNDATION_FEATURE}: expected ?provider=<key>&scope=user|shared&mailbox=<address>`);
             }
+            const refused = connectRoleRefusal(c, deps, scope);
+            if (refused)
+                return refused;
             let plugin;
             try {
                 plugin = resolveInboundProviderForKey({ registry: deps.registry }, providerKey);
@@ -108,12 +123,9 @@ export function createInboundMailConnectRoutes(options) {
                 // Provider error messages can carry token/response data — code only.
                 return errorJson(c, 502, "token_exchange_failed", "token exchange with the provider failed");
             }
-            if (!tokens.refreshToken) {
-                // No refresh token → no server-side sync possible. Consent must
-                // request offline_access (or access_type=offline) — the provider's
-                // oauth block owns the scopes.
-                return errorJson(c, 502, "no_refresh_token", `provider "${state.providerKey}" returned no refresh token — check the offline-access scope in the provider's oauth.scopes`);
-            }
+            const refreshToken = refreshTokenOrRefusal(c, state, tokens);
+            if (typeof refreshToken !== "string")
+                return refreshToken;
             // Account creation (programmatic SystemUser; the real owner comes from
             // the HMAC-verified state → ownerUserIdOverride).
             const dispatched = await deps.dispatchSystemWrite({
@@ -129,22 +141,29 @@ export function createInboundMailConnectRoutes(options) {
                 },
             });
             if (!dispatched.isSuccess) {
-                return errorJson(c, 502, "account_create_failed", JSON.stringify(dispatched.error ?? {}));
+                return connectFailureResponse(c, dispatched.error);
             }
             const accountId = propertyOf(dispatched.data, "accountId");
             if (typeof accountId !== "string") {
                 return errorJson(c, 502, "account_create_failed", "connect-account returned no accountId");
             }
-            // Refresh-token into the per-account secret slot (Slot = accountId).
-            // Access tokens (~1h) are never persisted — the supervisor re-mints
-            // them from the refresh token (oauth-access-token.ts).
-            if (options.oauthTokens) {
-                await options.oauthTokens.storeRefreshToken({ id: accountId, tenantId: state.tenantId }, tokens.refreshToken);
-                options.oauthTokens.primeFromExchange({ id: accountId }, tokens);
-            }
-            else {
-                await deps.secrets.set(state.tenantId, inboundCredentialSecretKey(accountId), tokens.refreshToken, inboundRefreshTokenSecretOptions(accountId));
+            try {
+                await storeOAuthCallbackCredential(options.oauthTokens, deps.secrets, { id: accountId, tenantId: state.tenantId }, tokens, refreshToken);
             }
+            catch {
+                return errorJson(c, 502, "credential_store_failed", "the sign-in worked but its token could not be saved; the mailbox keeps its previous state, connect it again");
+            }
+            const refused = await reactivateIfReopened(c, deps, state.tenantId, accountId, dispatched.data);
+            if (refused)
+                return refused;
+            // Best effort: the account commit already woke the supervisor before the token existed.
+            // Without this event the first sync would wait for the next poll tick; a failure here
+            // only costs that delay, so the connect itself still succeeds.
+            await deps.dispatchSystemWrite({
+                handlerQn: InboundMailFoundationHandlers.markCredentialStored,
+                tenantId: state.tenantId,
+                payload: { accountId },
+            });
             if (options.successRedirectUrl) {
                 const target = new URL(options.successRedirectUrl);
                 target.searchParams.set("accountId", accountId);

package/dist/inbound-mail-foundation/constants.d.ts

@@ -1,4 +1,4 @@
-export declare const INBOUND_MAIL_FOUNDATION_FEATURE: "inbound-mail-foundation";
+export { INBOUND_MAIL_CONNECT_PATH, INBOUND_MAIL_FOUNDATION_FEATURE, INBOUND_MAIL_RECONNECT_OAUTH_ACTION, } from "./web/constants.ts";
 export declare const INBOUND_MAIL_PROVIDER_EXTENSION: "inboundMailProvider";
 export declare const InboundMailFoundationHandlers: {
     /** Programmatic entry point for provider plugins (watch callback +
@@ -14,6 +14,18 @@ export declare const InboundMailFoundationHandlers: {
     /** Tenant admin disconnects a mailbox. The stream remains for auditing;
      *  the status becomes disconnected and the watch stops. */
     readonly disconnectAccount: "inbound-mail-foundation:write:disconnect-account";
+    /** The only way from disconnected back to active; also clears auth_error
+     *  and degraded. update-account keeps rejecting disconnected accounts. */
+    readonly reactivateAccount: "inbound-mail-foundation:write:reactivate-account";
+    readonly setTrustedAuthservId: "inbound-mail-foundation:write:set-trusted-authserv-id";
+    /** Owner or admin asks for one quarantined mail to be loaded again on the next sync. */
+    readonly retryQuarantinedMessage: "inbound-mail-foundation:write:retry-quarantined-message";
+    /** Marks all open quarantine entries of a mailbox as acknowledged. */
+    readonly acknowledgeQuarantine: "inbound-mail-foundation:write:acknowledge-quarantine";
+    /** Supervisor-only: stores the content of an already imported snippet mail. */
+    readonly attachMessageContent: "inbound-mail-foundation:write:attach-message-content";
+    /** OAuth callback only: the refresh token is stored now, so an active account can sync. */
+    readonly markCredentialStored: "inbound-mail-foundation:write:mark-credential-stored";
 };
 export declare const InboundMailFoundationQueries: {
     /** Tenant-scoped list of connected mailboxes. */
@@ -21,18 +33,45 @@ export declare const InboundMailFoundationQueries: {
     /** Tenant-scoped message list (inbox cockpit). PII is decrypted on read.
      */
     readonly listMessages: "inbound-mail-foundation:query:message:list";
+    /** Open quarantine entries of the mailboxes the caller may manage, with sender and subject from the header import. */
+    readonly listQuarantine: "inbound-mail-foundation:query:quarantine:list";
+    /** Decrypted full text, attachment ids and content state of one message. */
+    readonly messageContent: "inbound-mail-foundation:query:message:content";
 };
 export declare const InboundMailAccountStatuses: {
     /** Connected; watch/sync is running or ready to start. */
     readonly active: "active";
     /** Credentials or token are invalid; the tenant admin must reconnect. */
     readonly authError: "auth_error";
-    /** Transienter Fehler, Supervisor backoff-retried. */
+    /** Interrupted: transient failure, quarantined mail, missing file storage or KMS; see lastError. */
     readonly degraded: "degraded";
     /** Disconnected by the tenant admin; no further syncs run. */
     readonly disconnected: "disconnected";
 };
 export type InboundMailAccountStatus = (typeof InboundMailAccountStatuses)[keyof typeof InboundMailAccountStatuses];
+export declare const InboundMailLastErrors: {
+    readonly connectionFailed: "connection_failed";
+    readonly rateLimited: "rate_limited";
+    readonly messageQuarantined: "message_quarantined";
+    readonly fileStorageUnavailable: "file_storage_unavailable";
+    readonly encryptionUnavailable: "encryption_unavailable";
+    readonly ingestUnavailable: "ingest_unavailable";
+};
+export type InboundMailLastError = (typeof InboundMailLastErrors)[keyof typeof InboundMailLastErrors];
+export declare const InboundMailConnectErrors: {
+    readonly addressAlreadyConnected: {
+        readonly reason: "address_already_connected";
+        readonly i18nKey: "inboundMail.accounts.errors.addressAlreadyConnected";
+    };
+    readonly addressDisconnected: {
+        readonly reason: "address_disconnected";
+        readonly i18nKey: "inboundMail.accounts.errors.addressDisconnected";
+    };
+    readonly credentialRequired: {
+        readonly reason: "credential_required";
+        readonly i18nKey: "inboundMail.accounts.errors.credentialRequired";
+    };
+};
 /**
  * Tenant secret slot for an account: IMAP app password OR OAuth refresh
  * token. The provider interprets the contents according to `authMethod`.
@@ -51,3 +90,12 @@ export declare const InboundMailAuthMethods: {
     readonly oauth: "oauth";
 };
 export type InboundMailAuthMethod = (typeof InboundMailAuthMethods)[keyof typeof InboundMailAuthMethods];
+/** Provider key of inbound-provider-imap: only its password mailboxes have a credential form. */
+export declare const IMAP_PROVIDER_KEY = "imap";
+export declare const MailAccountReactivationPaths: {
+    /** The IMAP form of inbound-provider-imap (reconnect-mailbox). */
+    readonly passwordForm: "password_form";
+    /** The provider's OAuth sign-in through the connect route; its callback reopens the account. */
+    readonly oauthFlow: "oauth_flow";
+};
+export type MailAccountReactivationPath = (typeof MailAccountReactivationPaths)[keyof typeof MailAccountReactivationPaths];

package/dist/inbound-mail-foundation/constants.js

@@ -1,5 +1,5 @@
-// Feature name
-export const INBOUND_MAIL_FOUNDATION_FEATURE = "inbound-mail-foundation";
+import { INBOUND_MAIL_FOUNDATION_FEATURE } from "./web/constants.js";
+export { INBOUND_MAIL_CONNECT_PATH, INBOUND_MAIL_FOUNDATION_FEATURE, INBOUND_MAIL_RECONNECT_OAUTH_ACTION, } from "./web/constants.js";
 // Extension-point name for provider plugins (inbound-provider-imap,
 // inbound-provider-m365-graph, inbound-provider-gmail-rest, ...).
 export const INBOUND_MAIL_PROVIDER_EXTENSION = "inboundMailProvider";
@@ -18,6 +18,18 @@ export const InboundMailFoundationHandlers = {
     /** Tenant admin disconnects a mailbox. The stream remains for auditing;
      *  the status becomes disconnected and the watch stops. */
     disconnectAccount: "inbound-mail-foundation:write:disconnect-account",
+    /** The only way from disconnected back to active; also clears auth_error
+     *  and degraded. update-account keeps rejecting disconnected accounts. */
+    reactivateAccount: "inbound-mail-foundation:write:reactivate-account",
+    setTrustedAuthservId: "inbound-mail-foundation:write:set-trusted-authserv-id",
+    /** Owner or admin asks for one quarantined mail to be loaded again on the next sync. */
+    retryQuarantinedMessage: "inbound-mail-foundation:write:retry-quarantined-message",
+    /** Marks all open quarantine entries of a mailbox as acknowledged. */
+    acknowledgeQuarantine: "inbound-mail-foundation:write:acknowledge-quarantine",
+    /** Supervisor-only: stores the content of an already imported snippet mail. */
+    attachMessageContent: "inbound-mail-foundation:write:attach-message-content",
+    /** OAuth callback only: the refresh token is stored now, so an active account can sync. */
+    markCredentialStored: "inbound-mail-foundation:write:mark-credential-stored",
 };
 // Qualified query handler names.
 export const InboundMailFoundationQueries = {
@@ -26,6 +38,10 @@ export const InboundMailFoundationQueries = {
     /** Tenant-scoped message list (inbox cockpit). PII is decrypted on read.
      */
     listMessages: "inbound-mail-foundation:query:message:list",
+    /** Open quarantine entries of the mailboxes the caller may manage, with sender and subject from the header import. */
+    listQuarantine: "inbound-mail-foundation:query:quarantine:list",
+    /** Decrypted full text, attachment ids and content state of one message. */
+    messageContent: "inbound-mail-foundation:query:message:content",
 };
 // Normalized account status values — provider-agnostic.
 export const InboundMailAccountStatuses = {
@@ -33,11 +49,35 @@ export const InboundMailAccountStatuses = {
     active: "active",
     /** Credentials or token are invalid; the tenant admin must reconnect. */
     authError: "auth_error",
-    /** Transienter Fehler, Supervisor backoff-retried. */
+    /** Interrupted: transient failure, quarantined mail, missing file storage or KMS; see lastError. */
     degraded: "degraded",
     /** Disconnected by the tenant admin; no further syncs run. */
     disconnected: "disconnected",
 };
+// Why a mailbox is degraded. Codes only, never provider error text (that carries hosts/tokens).
+export const InboundMailLastErrors = {
+    connectionFailed: "connection_failed",
+    rateLimited: "rate_limited",
+    messageQuarantined: "message_quarantined",
+    fileStorageUnavailable: "file_storage_unavailable",
+    encryptionUnavailable: "encryption_unavailable",
+    ingestUnavailable: "ingest_unavailable",
+};
+// Business reasons of failed connect writes; connect-routes maps both to 409 with the reason code.
+export const InboundMailConnectErrors = {
+    addressAlreadyConnected: {
+        reason: "address_already_connected",
+        i18nKey: "inboundMail.accounts.errors.addressAlreadyConnected",
+    },
+    addressDisconnected: {
+        reason: "address_disconnected",
+        i18nKey: "inboundMail.accounts.errors.addressDisconnected",
+    },
+    credentialRequired: {
+        reason: "credential_required",
+        i18nKey: "inboundMail.accounts.errors.credentialRequired",
+    },
+};
 /**
  * Tenant secret slot for an account: IMAP app password OR OAuth refresh
  * token. The provider interprets the contents according to `authMethod`.
@@ -60,6 +100,16 @@ export const InboundMailAuthMethods = {
     /** Nativer OAuth-Provider (m365-graph, gmail-rest). */
     oauth: "oauth",
 };
+/** Provider key of inbound-provider-imap: only its password mailboxes have a credential form. */
+export const IMAP_PROVIDER_KEY = "imap";
+// How a mailbox the caller may re-arm gets its credential back, computed by account:list because a
+// screen row condition cannot combine provider, auth method, status and owner.
+export const MailAccountReactivationPaths = {
+    /** The IMAP form of inbound-provider-imap (reconnect-mailbox). */
+    passwordForm: "password_form",
+    /** The provider's OAuth sign-in through the connect route; its callback reopens the account. */
+    oauthFlow: "oauth_flow",
+};
 // **Multi-provider:** no global `provider` config key
 // (unlike mail-foundation, as with billing-foundation). A tenant can connect
 // an IMAP mailbox and an M365 mailbox in parallel; the provider is stored per

package/dist/inbound-mail-foundation/content-refetch.d.ts

@@ -0,0 +1,14 @@
+import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import type { DispatchWrite } from "./supervisor-ingest.ts";
+import type { InboundMailContext, InboundMailProviderPlugin, MailAccountRecord } from "./types.ts";
+export declare const CONTENT_REFETCH_BUDGET_PER_TICK = 50;
+export declare function refetchSnippetOnlyMessages(args: {
+    readonly db: DbConnection;
+    readonly dispatchWrite: DispatchWrite;
+    readonly providerCtx: InboundMailContext;
+    readonly account: MailAccountRecord;
+    readonly plugin: InboundMailProviderPlugin;
+    readonly windowDays: number;
+    readonly accessToken?: string | undefined;
+    readonly signal?: AbortSignal | undefined;
+}): Promise<void>;

package/dist/inbound-mail-foundation/content-refetch.js

@@ -0,0 +1,93 @@
+// Reloads the content of mails that were imported as snippet only (event version 1, before full text
+// storage existed). Runs after a successful poll with a small per-account budget, so a large backlog
+// is worked off over several ticks without slowing the regular sync. "unavailable" is terminal:
+// mails that are gone from the server stop being candidates.
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
+import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
+import { inboundMessageAggregateId } from "./aggregate-id.js";
+import { InboundMailFoundationHandlers } from "./constants.js";
+import { seenMessageTable } from "./entities.js";
+import { normalizeRawInboundMessage } from "./normalize-inbound-message.js";
+import { inboundMessagesProjectionTable } from "./projection.js";
+export const CONTENT_REFETCH_BUDGET_PER_TICK = 50;
+const SEEN_PAGE_SIZE = 250;
+const SEEN_MAX_PAGES = 4;
+function needsContent(row) {
+    const bodyMissing = row.bodyRef === undefined || row.bodyRef === null || row.bodyRef === "";
+    return bodyMissing && (row.contentState == null || row.contentState === "snippet");
+}
+async function findSnippetOnlyMessageIds(db, account, windowDays) {
+    const cutoff = Temporal.Now.instant().subtract({ hours: windowDays * 24 });
+    const found = [];
+    let before;
+    for (let page = 0; page < SEEN_MAX_PAGES && found.length < CONTENT_REFETCH_BUDGET_PER_TICK; page++) {
+        const seen = await selectMany(db, seenMessageTable, {
+            tenantId: account.tenantId,
+            accountId: account.id,
+            seenAt: before ? { gte: cutoff, lt: before } : { gte: cutoff },
+        }, {
+            fields: ["providerMessageId", "seenAt"],
+            orderBy: { col: "seenAt", direction: "desc" },
+            limit: SEEN_PAGE_SIZE,
+        });
+        if (seen.length === 0)
+            break;
+        const aggregateToProvider = new Map(seen.map((row) => [
+            inboundMessageAggregateId(account.id, row.providerMessageId),
+            row.providerMessageId,
+        ]));
+        const rows = await selectMany(db, inboundMessagesProjectionTable, { tenantId: account.tenantId, id: { in: [...aggregateToProvider.keys()] } }, { fields: ["id", "bodyRef", "contentState"] });
+        for (const row of rows) {
+            const providerMessageId = aggregateToProvider.get(row.id);
+            if (providerMessageId !== undefined && needsContent(row))
+                found.push(providerMessageId);
+        }
+        const oldest = seen[seen.length - 1];
+        if (seen.length < SEEN_PAGE_SIZE || !oldest)
+            break;
+        before = oldest.seenAt;
+    }
+    return found.slice(0, CONTENT_REFETCH_BUDGET_PER_TICK);
+}
+export async function refetchSnippetOnlyMessages(args) {
+    const { account, plugin, dispatchWrite } = args;
+    // skip: the provider cannot reload content.
+    if (!plugin.fetchContent)
+        return;
+    const ids = await findSnippetOnlyMessageIds(args.db, account, args.windowDays);
+    // skip: no snippet-only mail to reload.
+    if (ids.length === 0)
+        return;
+    const result = await plugin.fetchContent(args.providerCtx, account, ids, args.accessToken !== undefined || args.signal !== undefined
+        ? {
+            ...(args.accessToken !== undefined && { accessToken: args.accessToken }),
+            ...(args.signal !== undefined && { signal: args.signal }),
+        }
+        : undefined);
+    const attach = (providerMessageId, content) => dispatchWrite({
+        handlerQn: InboundMailFoundationHandlers.attachMessageContent,
+        tenantId: account.tenantId,
+        payload: { accountId: account.id, providerMessageId, ...content },
+    });
+    for (const raw of result.messages) {
+        const msg = normalizeRawInboundMessage(raw);
+        if (msg.bodyText === "" && msg.rawMime == null && msg.bodyHtml === null) {
+            // Nothing usable came back: attach would leave the mail at "snippet", i.e. a candidate on
+            // every tick. "unavailable" is terminal.
+            await attach(msg.providerMessageId, { outcome: "unavailable" });
+            continue;
+        }
+        await attach(msg.providerMessageId, {
+            outcome: "fetched",
+            bodyText: msg.bodyText,
+            bodyTextTruncated: msg.bodyTextTruncated,
+            ...(msg.rawMime != null && { rawMime: msg.rawMime }),
+            ...(msg.bodyHtml !== null && { bodyHtml: msg.bodyHtml }),
+            attachments: msg.attachments,
+            skippedAttachments: msg.skippedAttachments,
+        });
+    }
+    const gone = [...result.missing, ...result.rejected.map((r) => r.providerMessageId)];
+    for (const providerMessageId of gone)
+        await attach(providerMessageId, { outcome: "unavailable" });
+}

package/dist/inbound-mail-foundation/describe-error.d.ts

@@ -0,0 +1 @@
+export declare function describeError(err: unknown): string;

package/dist/inbound-mail-foundation/describe-error.js

@@ -0,0 +1,5 @@
+// Provider errors can embed token or response data in `message`; logs carry
+// only the error class.
+export function describeError(err) {
+    return err instanceof Error ? err.name : typeof err;
+}

package/dist/inbound-mail-foundation/entities.d.ts

@@ -19,9 +19,15 @@ export declare const mailAccountEntity: import("@cosmicdrift/kumiko-types/fields
     readonly status: import("@cosmicdrift/kumiko-types/fields").EntityTextFieldDef & {
         required: true;
     };
+    readonly lastError: import("@cosmicdrift/kumiko-types/fields").EntityTextFieldDef & {
+        required: false;
+    };
     readonly watchState: import("@cosmicdrift/kumiko-types/fields").EntityTextFieldDef & {
         required: false;
     };
+    readonly trustedAuthservId: import("@cosmicdrift/kumiko-types/fields").EntityTextFieldDef & {
+        required: false;
+    };
     readonly connectedAt: {
         readonly type: "timestamp";
         readonly description?: string;
@@ -90,6 +96,26 @@ export declare const inboundMessageEntity: import("@cosmicdrift/kumiko-types/fie
     readonly scope: import("@cosmicdrift/kumiko-types/fields").EntityTextFieldDef & {
         required: false;
     };
+    readonly bodyText: import("@cosmicdrift/kumiko-types/fields").EntityLongTextFieldDef & {
+        required: false;
+    };
+    readonly bodyTextTruncated: import("@cosmicdrift/kumiko-types/fields").BooleanFieldDef & {
+        required: false;
+        default: boolean;
+    };
+    readonly attachmentFileIds: import("@cosmicdrift/kumiko-types/fields").FilesFieldDef;
+    readonly skippedAttachments: import("@cosmicdrift/kumiko-types/fields").EntityTextFieldDef & {
+        required: false;
+    };
+    readonly senderAuthentication: import("@cosmicdrift/kumiko-types/fields").EntityTextFieldDef & {
+        required: false;
+    };
+    readonly contentState: import("@cosmicdrift/kumiko-types/fields").EntityTextFieldDef & {
+        required: false;
+    };
+    readonly contentUnavailableReason: import("@cosmicdrift/kumiko-types/fields").EntityTextFieldDef & {
+        required: false;
+    };
 }, "tenant">;
 /** Thread-Rollup. PK = aggregateId = mailThreadAggregateId(tenantId,
  *  threadKey). */

package/dist/inbound-mail-foundation/entities.js

@@ -1,6 +1,6 @@
 import { collectPiiSubjectFields } from "@cosmicdrift/kumiko-framework/crypto";
 import { deriveEntityTableMeta } from "@cosmicdrift/kumiko-framework/db";
-import { access, createEntity, createNumberField, createTextField, createTimestampField, } from "@cosmicdrift/kumiko-framework/engine";
+import { access, createBooleanField, createEntity, createFilesField, createLongTextField, createNumberField, createTextField, createTimestampField, } from "@cosmicdrift/kumiko-framework/engine";
 // ============================================================================
 // Read models for the three event-sourced aggregates
 // ============================================================================
@@ -56,7 +56,15 @@ export const mailAccountEntity = createEntity({
             personal: false,
             reason: "technical_reference",
         }),
+        // Code of InboundMailLastErrors, never provider error text. Null on rows from before the column.
+        lastError: createTextField({ maxLength: 50, personal: false, reason: "technical_reference" }),
         watchState: createTextField({ maxLength: 100, personal: false, reason: "technical_reference" }),
+        // Lower-case authserv-id of the mailbox's own server; null = none set.
+        trustedAuthservId: createTextField({
+            maxLength: 255,
+            personal: false,
+            reason: "technical_reference",
+        }),
         connectedAt: createTimestampField({ required: true }),
     },
 });
@@ -73,8 +81,7 @@ export const inboundMessageEntity = createEntity({
             reason: "technical_reference",
         }),
         // Scope is inherited from the account at ingest time: messages from a
-        // personal mailbox are visible only to the owner (+ TenantAdmin),
-        // without joining read_mail_accounts.
+        // personal mailbox are visible only to the owner, without joining read_mail_accounts.
         ownerUserId: createTextField({ maxLength: 36, personal: false, reason: "pseudonymous_fk" }),
         messageIdHeader: createTextField({
             required: true,
@@ -97,7 +104,40 @@ export const inboundMessageEntity = createEntity({
         receivedAt: createTimestampField({ required: true }),
         bodyRef: createTextField({ maxLength: 500, personal: false, reason: "technical_reference" }),
         scope: createTextField({ maxLength: 200, personal: false, reason: "technical_reference" }),
+        // Full plaintext, capped at 32_000 characters before encryption (ciphertext is ~2.3x plus envelope).
+        // Null on rows from before the column; list-messages never selects it.
+        bodyText: createLongTextField({ maxLength: 200_000, personal: "tenant", find: "none" }),
+        bodyTextTruncated: createBooleanField(),
+        // Bound to the message (entityType = the aggregate type), so the file guard answers with the
+        // mail's visibility. The fileRefs are bound at ingest, the projection copies the ids.
+        attachmentFileIds: createFilesField({ personal: false, reason: "technical_reference" }),
+        // JSON-stringified SkippedInboundAttachment[]: nullable JSON stays a text column
+        // (jsonb fields are NOT NULL), like to/cc.
+        skippedAttachments: createTextField({
+            maxLength: 20_000,
+            personal: false,
+            reason: "technical_reference",
+        }),
+        // JSON-stringified SenderAuthentication or "null"; a SQL null (rows from before the column) reads as null.
+        senderAuthentication: createTextField({
+            maxLength: 4000,
+            personal: false,
+            reason: "technical_reference",
+        }),
+        // "complete" | "snippet" | "unavailable"; null counts as "snippet".
+        contentState: createTextField({
+            maxLength: 20,
+            personal: false,
+            reason: "technical_reference",
+        }),
+        // One of INBOUND_CONTENT_UNAVAILABLE_REASONS; null while the content is there or not yet missing.
+        contentUnavailableReason: createTextField({
+            maxLength: 30,
+            personal: false,
+            reason: "technical_reference",
+        }),
     },
+    attachedFileAccess: "record-only",
 });
 /** Thread-Rollup. PK = aggregateId = mailThreadAggregateId(tenantId,
  *  threadKey). */