@cosmicdrift/kumiko-framework 0.392.1 → 0.393.0

package/agents/examples/inbound-mail-triage.md

@@ -32,6 +32,10 @@ mail-triage  ← this sample                                  (the app-side cons
 3. The handler-trigger fans the write out to the worker lane; the triage job records `{ from, subject, scope, threadHint }`.
 4. A replay of the same `providerMessageId` reports `duplicate: true`, creates no second row — and the keyed triage store stays at one item.
 
+## Sign-in errors
+
+When the provider rejects the stored login, the supervisor sets the account to `auth_error` and stops fetching. With `inbound-provider-imap` mounted, the mail accounts list offers **Reconnect** on that row: the form `mail-account-reconnect-imap` is prefilled with the stored server settings (never the password), `inbound-provider-imap:write:reconnect-mailbox` checks the new login and puts the same account back to `active`. Threads, sync cursor and seen messages stay, so the next poll continues where the account stopped instead of ingesting the mailbox again. The cases are covered in `inbound-provider-imap/__tests__/reconnect-mailbox.integration.test.ts`; they need greenmail, which this sample's in-memory provider does not.
+
 ## Tests
 
 - E2E through `createAllInOneEntrypoint` (HTTP → dispatcher → BullMQ worker lane, no framework-internal shortcuts): connect → ingest → triage item appears.

package/agents/features.md

@@ -389,7 +389,7 @@ Requires: `tenant-lifecycle`
 
 ## inbound-provider-imap
 
-Registers the `"imap"` provider for `inbound-mail-foundation` using imapflow — password/app-password auth covers classic IMAP hosts without any OAuth (plus an XOAUTH2 fallback consuming an access token from the secret slot). Incremental sync via a UIDVALIDITY:lastUid cursor (UIDVALIDITY change triggers a cursor-invalid full resync), initial backfill bounded by the foundation backfill window, and live push via IMAP IDLE for the watch supervisor. Tenant admins connect a mailbox through the "Connect mailbox" form on the mail accounts list (`connect-mailbox` checks the IMAP login and the SMTP login of the outgoing server first, then creates the account and its credential secret in one transaction); programmatic setups store the per-account connection JSON (host/port/secure/user/password, plus smtpHost/smtpPort for sending) in the account credential secret slot before the first sync. Implements the provider `send`: `sendMailFromAccount` sends over the SMTP server of the mailbox itself (implicit TLS, same login) with the mailbox address as From and stores a copy in its sent folder.
+Registers the `"imap"` provider for `inbound-mail-foundation` using imapflow — password/app-password auth covers classic IMAP hosts without any OAuth (plus an XOAUTH2 fallback consuming an access token from the secret slot). Incremental sync via a UIDVALIDITY:lastUid cursor (UIDVALIDITY change triggers a cursor-invalid full resync), initial backfill bounded by the foundation backfill window, and live push via IMAP IDLE for the watch supervisor. Tenant admins connect a mailbox through the "Connect mailbox" form on the mail accounts list (`connect-mailbox` checks the IMAP login and the SMTP login of the outgoing server first, then creates the account and its credential secret in one transaction; `reconnect-mailbox` does the same check for an existing mailbox with a sign-in error and overwrites its credential secret); programmatic setups store the per-account connection JSON (host/port/secure/user/password, plus smtpHost/smtpPort for sending) in the account credential secret slot before the first sync. Implements the provider `send`: `sendMailFromAccount` sends over the SMTP server of the mailbox itself (implicit TLS, same login) with the mailbox address as From and stores a copy in its sent folder.
 
 Category: notifications
 

package/dist/internal/row-level-security.d.ts

@@ -1,3 +1,4 @@
+export { tenantScopedSecrets } from "../api/tenant-scoped-secrets.ts";
 export { isRowLevelSecurityViolation } from "../db/pg-error.ts";
 export { DEFAULT_ROW_LEVEL_SECURITY_MODE } from "../db/render-rls-ddl.ts";
 export { appHookScopedRunner, runInRowLevelSecurityScope, runInSystemRowLevelSecurityScope, systemScopedRunner, tenantRowLevelSecurityScope, } from "../db/row-level-security-scope.ts";

package/dist/internal/row-level-security.js

@@ -1,3 +1,4 @@
+export { tenantScopedSecrets } from "../api/tenant-scoped-secrets.js";
 export { isRowLevelSecurityViolation } from "../db/pg-error.js";
 export { DEFAULT_ROW_LEVEL_SECURITY_MODE } from "../db/render-rls-ddl.js";
 export { appHookScopedRunner, runInRowLevelSecurityScope, runInSystemRowLevelSecurityScope, systemScopedRunner, tenantRowLevelSecurityScope, } from "../db/row-level-security-scope.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-framework",
-  "version": "0.392.1",
+  "version": "0.393.0",
   "description": "Framework core — engine, pipeline, API, DB, and every other bit that makes Kumiko go.",
   "license": "MIT",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -199,7 +199,7 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-types": "0.392.1",
+    "@cosmicdrift/kumiko-types": "0.393.0",
     "bullmq": "^5.76.7",
     "hono": "^4.13.1",
     "i18next": "^26.1.0",
@@ -221,7 +221,7 @@
     }
   },
   "devDependencies": {
-    "@cosmicdrift/kumiko-testing": "0.392.1",
+    "@cosmicdrift/kumiko-testing": "0.393.0",
     "bun-types": "^1.4.4",
     "fflate": "^0.8.2",
     "meilisearch": "^0.58.0",