@cosmicdrift/kumiko-samples 0.338.0

package/packages/bundled-features/src/inbound-provider-imap/credential-document.ts

@@ -0,0 +1,51 @@
+// Connection-Dokument im per-Account-Secret-Slot
+// (inboundCredentialSecretKey(accountId), Plan §4).
+//
+// **Warum JSON im Secret statt Tenant-Config-Keys:** anders als
+// mail-transport-smtp (EIN SMTP pro Tenant) hat Inbound MEHRERE
+// Accounts pro Tenant mit verschiedenen Hosts — per-Tenant-Config-Keys
+// können das nicht tragen. Host/Port/User sind zusammen mit dem
+// Passwort ein zusammengehöriges Verbindungs-Dokument; der Slot ist
+// ohnehin encrypted-at-rest.
+//
+// authMethod des Accounts bestimmt die Interpretation:
+//   password → { host, port, secure, user, password }
+//   xoauth2  → { host, port, secure, user, accessToken } — V1-Fallback:
+//              Token-Beschaffung/-Refresh gehört den OAuth-Providern
+//              (M365/Gmail, Phase 4/5); der imap-Provider konsumiert
+//              nur einen gültigen Access-Token aus dem Slot.
+
+import * as z from "zod";
+
+export const imapCredentialDocumentSchema = z.object({
+  host: z.string().min(1).max(255),
+  port: z.number().int().min(1).max(65535).default(993),
+  secure: z.boolean().default(true),
+  user: z.string().min(1).max(320),
+  password: z.string().min(1).optional(),
+  accessToken: z.string().min(1).optional(),
+});
+export type ImapCredentialDocument = z.infer<typeof imapCredentialDocumentSchema>;
+
+export type ImapCredentialRejection = "not_json" | "invalid_schema" | "missing_credentials";
+
+export type ParseCredentialResult =
+  | { readonly ok: true; readonly doc: ImapCredentialDocument }
+  | { readonly ok: false; readonly reason: ImapCredentialRejection; readonly detail?: string };
+
+export function parseImapCredentialDocument(raw: string): ParseCredentialResult {
+  let json: unknown;
+  try {
+    json = JSON.parse(raw);
+  } catch {
+    return { ok: false, reason: "not_json" };
+  }
+  const parsed = imapCredentialDocumentSchema.safeParse(json);
+  if (!parsed.success) {
+    return { ok: false, reason: "invalid_schema", detail: parsed.error.message };
+  }
+  if (!parsed.data.password && !parsed.data.accessToken) {
+    return { ok: false, reason: "missing_credentials", detail: "needs password or accessToken" };
+  }
+  return { ok: true, doc: parsed.data };
+}

package/packages/bundled-features/src/inbound-provider-imap/feature.ts

@@ -0,0 +1,286 @@
+// kumiko-feature-version: 1
+//
+// inbound-provider-imap — IMAP-Implementierung der inbound-mail-
+// foundation Plugin-API. Deckt den DACH-Long-Tail (IONOS, Telekom,
+// Strato, GMX/Web.de, mailbox.org, Hetzner, all-inkl) via Passwort/
+// App-Passwort ab — komplett OHNE OAuth. XOAUTH2 als Fallback für
+// M365-/Gmail-Konten (Access-Token aus dem Secret-Slot; Token-Refresh
+// gehört den OAuth-Providern, Phase 4/5).
+//
+// **Was diese Feature liefert:**
+//   1. Plugin-Registration via r.useExtension("inboundMailProvider",
+//      "imap", { verify, fetch, watch }).
+//   2. verify: connect+logout mit typisiertem Fehler-Mapping.
+//   3. fetch: inkrementeller Sync über UIDVALIDITY:lastUid-Cursor —
+//      UIDVALIDITY-Wechsel wirft InboundCursorInvalidError (Foundation
+//      resettet + resynct im Backfill-Fenster). Erst-Befüllung via
+//      SEARCH since=backfillWindowDays.
+//   4. watch: IMAP IDLE via imapflow — 'exists'-Event → neue UIDs
+//      fetchen → onMessages; Verbindungs-Tod → onError (Supervisor
+//      restartet mit Backoff, der Provider reconnected NICHT selbst).
+//
+// Credentials: JSON-Dokument im per-Account-Secret-Slot
+// (credential-document.ts) — kein Tenant-Config, weil mehrere Accounts
+// pro Tenant verschiedene Hosts haben.
+
+import {
+  INBOUND_MAIL_PROVIDER_EXTENSION,
+  InboundAuthError,
+  type InboundFetchResult,
+  type InboundMailContext,
+  type InboundMailProviderPlugin,
+  inboundCredentialSecretKey,
+  type MailAccountRecord,
+  type RawInboundMessage,
+} from "@cosmicdrift/kumiko-bundled-features/inbound-mail-foundation";
+import { requireSecretsContext } from "@cosmicdrift/kumiko-bundled-features/secrets";
+import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
+import { instantToLegacyDate } from "@cosmicdrift/kumiko-framework/time";
+import type { ImapFlow, MailboxObject } from "imapflow";
+import { Temporal } from "temporal-polyfill";
+import { type ImapCredentialDocument, parseImapCredentialDocument } from "./credential-document.js";
+import {
+  assertUidValidity,
+  coerceDate,
+  createImapClient,
+  IMAP_MAILBOX,
+  imapMailHostGuard,
+  mapImapError,
+  parseImapCursor,
+  toRawInboundMessage,
+} from "./imap-client.js";
+
+const FEATURE_NAME = "inbound-provider-imap";
+export const IMAP_PROVIDER_KEY = "imap";
+
+export { setImapMailHostLookup } from "./imap-client.js";
+
+// =============================================================================
+// Credential-Read — per-Account-Slot, Worker-tauglich (slim ctx).
+// =============================================================================
+
+async function readCredentialDocument(
+  ctx: InboundMailContext,
+  account: MailAccountRecord,
+): Promise<ImapCredentialDocument> {
+  const secrets = requireSecretsContext(ctx, FEATURE_NAME);
+  const secret = await secrets.get(account.tenantId, inboundCredentialSecretKey(account.id));
+  if (!secret) {
+    throw new InboundAuthError(
+      `${FEATURE_NAME}: no credential document in secret slot for account ${account.id} — ` +
+        `store the IMAP connection JSON under ${inboundCredentialSecretKey(account.id)} first`,
+    );
+  }
+  const parsed = parseImapCredentialDocument(secret.reveal());
+  if (!parsed.ok) {
+    throw new InboundAuthError(
+      `${FEATURE_NAME}: account ${account.id}: ${parsed.reason}${parsed.detail ? `: ${parsed.detail}` : ""}`,
+    );
+  }
+  return parsed.doc;
+}
+
+// =============================================================================
+// fetch — inkrementeller UID-Sync
+// =============================================================================
+
+async function fetchMessages(
+  ctx: InboundMailContext,
+  account: MailAccountRecord,
+  cursor: Parameters<InboundMailProviderPlugin["fetch"]>[2],
+  opts: { readonly backfillWindowDays: number; readonly maxMessages: number },
+): Promise<InboundFetchResult> {
+  const doc = await readCredentialDocument(ctx, account);
+  const client = await createImapClient(doc, imapMailHostGuard());
+  let lock: Awaited<ReturnType<typeof client.getMailboxLock>> | undefined;
+  try {
+    await client.connect();
+    lock = await client.getMailboxLock(IMAP_MAILBOX);
+    const mailbox = client.mailbox as MailboxObject;
+    const serverUidValidity = String(mailbox.uidValidity);
+    const parsedCursor = parseImapCursor(cursor);
+    assertUidValidity(parsedCursor, serverUidValidity);
+
+    // UID-Menge bestimmen: inkrementell ab lastUid+1, sonst Backfill
+    // über SEARCH since (Fenster begrenzt die Erst-Befüllung).
+    let uids: number[];
+    if (parsedCursor) {
+      const found = await client.search({ uid: `${parsedCursor.lastUid + 1}:*` }, { uid: true });
+      // `N:*`-Gotcha: liegt N über der höchsten UID, liefert IMAP
+      // trotzdem die letzte Message — rausfiltern.
+      uids = (found || []).filter((uid) => uid > parsedCursor.lastUid);
+    } else {
+      const since = Temporal.Now.instant().subtract({ hours: opts.backfillWindowDays * 24 });
+      // imapflow-API-Boundary: search() verlangt ein JS-Date.
+      uids = (await client.search({ since: instantToLegacyDate(since) }, { uid: true })) || [];
+    }
+    uids.sort((a, b) => a - b);
+
+    const batch = uids.slice(0, opts.maxMessages);
+    const hasMore = uids.length > batch.length;
+    const messages: RawInboundMessage[] = [];
+    let maxUid = parsedCursor?.lastUid ?? 0;
+
+    if (batch.length > 0) {
+      for await (const msg of client.fetch(
+        batch.join(","),
+        { uid: true, internalDate: true, source: true },
+        { uid: true },
+      )) {
+        if (!msg.source) continue;
+        messages.push(
+          await toRawInboundMessage({
+            source: msg.source,
+            uid: msg.uid,
+            uidValidity: serverUidValidity,
+            internalDate: coerceDate(msg.internalDate ?? undefined),
+          }),
+        );
+        if (msg.uid > maxUid) maxUid = msg.uid;
+      }
+    }
+
+    return {
+      messages,
+      nextCursor: { uidValidity: serverUidValidity, lastUid: maxUid },
+      hasMore,
+    };
+  } catch (err) {
+    throw err instanceof Error && "kind" in err ? err : mapImapError(err, doc.host);
+  } finally {
+    lock?.release();
+    await client.logout().catch(() => {});
+  }
+}
+
+// =============================================================================
+// watch — IMAP IDLE (imapflow idlet automatisch bei offener Mailbox und
+// emittet 'exists' bei neuen Messages).
+// =============================================================================
+
+async function watchMailbox(
+  ctx: InboundMailContext,
+  account: MailAccountRecord,
+  handlers: {
+    readonly onMessages: (msgs: readonly RawInboundMessage[]) => Promise<void>;
+    readonly onError: (err: unknown) => void;
+  },
+): Promise<() => Promise<void>> {
+  const doc = await readCredentialDocument(ctx, account);
+  const client: ImapFlow = await createImapClient(doc, imapMailHostGuard());
+  let stopped = false;
+
+  try {
+    await client.connect();
+    const mailbox = (await client.mailboxOpen(IMAP_MAILBOX)) as MailboxObject;
+    const uidValidity = String(mailbox.uidValidity);
+    // uidNext = nächste zu vergebende UID — alles ab hier ist "neu".
+    let nextUid = Number(mailbox.uidNext ?? 1);
+
+    const drainNew = async () => {
+      const messages: RawInboundMessage[] = [];
+      let maxSeen = nextUid - 1;
+      for await (const msg of client.fetch(
+        `${nextUid}:*`,
+        { uid: true, internalDate: true, source: true },
+        { uid: true },
+      )) {
+        // `N:*`-Gotcha (siehe fetch): alte letzte Message rausfiltern.
+        if (msg.uid < nextUid || !msg.source) continue;
+        messages.push(
+          await toRawInboundMessage({
+            source: msg.source,
+            uid: msg.uid,
+            uidValidity,
+            internalDate: coerceDate(msg.internalDate ?? undefined),
+          }),
+        );
+        if (msg.uid > maxSeen) maxSeen = msg.uid;
+      }
+      nextUid = maxSeen + 1;
+      if (messages.length > 0) await handlers.onMessages(messages);
+    };
+
+    client.on("exists", () => {
+      // skip: Watcher gestoppt — exists-Nachzügler ignorieren.
+      if (stopped) return;
+      void drainNew().catch((err) => {
+        if (!stopped) handlers.onError(mapImapError(err, doc.host));
+      });
+    });
+    const die = (err: unknown) => {
+      // skip: bereits gestoppt/gestorben — onError nur einmal feuern.
+      if (stopped) return;
+      stopped = true;
+      handlers.onError(mapImapError(err, doc.host));
+    };
+    client.on("error", die);
+    client.on("close", () => die(new Error("connection closed")));
+
+    // IDLE-Loop: 'exists' feuert NUR während client.idle() läuft
+    // (empirisch gegen greenmail verifiziert). Jedes zwischengeschobene
+    // Kommando (drainNew-fetch) beendet idle() — die Loop re-idlet,
+    // bis stop() die Verbindung schließt.
+    void (async () => {
+      while (!stopped) {
+        try {
+          await client.idle();
+        } catch (err) {
+          if (!stopped) die(err);
+          // skip: idle-Loop endet — die() hat den Supervisor informiert (bzw. stop() war die Ursache).
+          return;
+        }
+      }
+    })();
+
+    return async () => {
+      stopped = true;
+      client.removeAllListeners("exists");
+      client.removeAllListeners("error");
+      client.removeAllListeners("close");
+      await client.logout().catch(() => {});
+    };
+  } catch (err) {
+    await client.logout().catch(() => {});
+    throw mapImapError(err, doc.host);
+  }
+}
+
+// =============================================================================
+// Plugin + Feature-definition
+// =============================================================================
+
+/** Exportiert für den Live-Test (imap-live.integration.test.ts) —
+ *  Apps nutzen das Feature, nie das Plugin direkt. */
+export const imapInboundMailPlugin: InboundMailProviderPlugin = {
+  verify: async (ctx, account) => {
+    const doc = await readCredentialDocument(ctx, account);
+    const client = await createImapClient(doc, imapMailHostGuard());
+    try {
+      await client.connect();
+    } catch (err) {
+      throw mapImapError(err, doc.host);
+    } finally {
+      await client.logout().catch(() => {});
+    }
+  },
+  fetch: fetchMessages,
+  watch: watchMailbox,
+  // Kein oauth-Block: Passwort-Connect läuft über das Credential-
+  // Formular (connect-account + Secret-Write); XOAUTH2-Token-Flows
+  // gehören den OAuth-Providern (M365/Gmail).
+};
+
+export const inboundProviderImapFeature = defineFeature(FEATURE_NAME, (r) => {
+  r.describe(
+    'Registers the `"imap"` provider for `inbound-mail-foundation` using imapflow — password/app-password auth covers classic IMAP hosts without any OAuth (plus an XOAUTH2 fallback consuming an access token from the secret slot). Incremental sync via a UIDVALIDITY:lastUid cursor (UIDVALIDITY change triggers a cursor-invalid full resync), initial backfill bounded by the foundation backfill window, and live push via IMAP IDLE for the watch supervisor. Store the per-account connection JSON (host/port/secure/user/password) in the account credential secret slot before the first sync.',
+  );
+  r.uiHints({
+    displayLabel: "Inbound Mail · IMAP",
+    category: "notifications",
+    recommended: false,
+  });
+  r.requires("inbound-mail-foundation");
+  r.requires("secrets");
+  r.useExtension(INBOUND_MAIL_PROVIDER_EXTENSION, IMAP_PROVIDER_KEY, imapInboundMailPlugin);
+});

package/packages/bundled-features/src/inbound-provider-imap/imap-client.ts

@@ -0,0 +1,216 @@
+// imapflow-Wiring + pure Helpers des IMAP-Providers.
+// Referenz-Impl: /Users/marc/code/doc-o-mat (HEINZ) — aber inkrementeller
+// UIDVALIDITY:lastUid-Cursor statt '1:*'-Vollscan.
+
+import {
+  BlockedHostError,
+  type MailHostGuardOptions,
+  readAllowedPrivateMailHostsFromEnv,
+  resolveMailConnectTarget,
+} from "@cosmicdrift/kumiko-bundled-features/foundation-shared";
+import {
+  InboundAuthError,
+  InboundCursorInvalidError,
+  InboundTransientError,
+  type RawInboundMessage,
+  type SyncCursorPayload,
+} from "@cosmicdrift/kumiko-bundled-features/inbound-mail-foundation";
+import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
+import { legacyDateToInstant } from "@cosmicdrift/kumiko-framework/time";
+import { ImapFlow } from "imapflow";
+import { type AddressObject, type ParsedMail, simpleParser } from "mailparser";
+import { Temporal } from "temporal-polyfill";
+import type { ImapCredentialDocument } from "./credential-document.js";
+
+export const IMAP_MAILBOX = "INBOX";
+const SNIPPET_MAX = 300;
+
+const log = createFallbackLogger("inbound-provider-imap");
+
+// Tenant-visible for both branches below — must not reveal whether the host
+// was blocked (private/reserved range) or merely failed to resolve, and
+// must never include the host or the underlying error text. Server-side
+// detail goes to `log` only.
+const IMAP_HOST_UNREACHABLE_MESSAGE = "IMAP host is not reachable or not allowed";
+
+// =============================================================================
+// Client-Factory + Fehler-Mapping
+// =============================================================================
+
+// Operator escape hatch for an internal relay or a dev/test IMAP server
+// (greenmail): KUMIKO_MAIL_ALLOWED_PRIVATE_HOSTS, the same operator env
+// var mail-transport-smtp declares (see its envSchema — composeEnvSchema
+// rejects two features declaring the same key, so this feature reads it
+// without redeclaring it), never a tenant-config value, so a tenant can
+// never grant themselves the private-host bypass.
+//
+// mailHostLookup is a test-only DNS seam — production leaves it undefined,
+// so resolveMailConnectTarget uses the real resolver. Module-global state:
+// reset it in afterEach/afterAll.
+let mailHostLookup: MailHostGuardOptions["lookupFn"];
+
+export function setImapMailHostLookup(fn: MailHostGuardOptions["lookupFn"]): void {
+  mailHostLookup = fn;
+}
+
+export function imapMailHostGuard(): MailHostGuardOptions {
+  return {
+    allowedPrivateMailHosts: readAllowedPrivateMailHostsFromEnv(),
+    lookupFn: mailHostLookup,
+  };
+}
+
+// Resolves+pins doc.host before ever touching imapflow — a blocked host
+// (private/reserved range) must never reach a connect attempt. Rejection is
+// InboundAuthError (no retry, a config problem) vs InboundTransientError for
+// a DNS failure (matches mapImapError's ENOTFOUND handling below).
+export async function createImapClient(
+  doc: ImapCredentialDocument,
+  hostGuard: MailHostGuardOptions = {},
+): Promise<ImapFlow> {
+  let target: Awaited<ReturnType<typeof resolveMailConnectTarget>>;
+  try {
+    target = await resolveMailConnectTarget(doc.host, hostGuard);
+  } catch (err) {
+    const reason = err instanceof Error ? err.message : String(err);
+    if (err instanceof BlockedHostError) {
+      log.warn("rejected blocked host", { host: doc.host, reason });
+      throw new InboundAuthError(IMAP_HOST_UNREACHABLE_MESSAGE);
+    }
+    log.warn("host resolution failed", { host: doc.host, reason });
+    throw new InboundTransientError(IMAP_HOST_UNREACHABLE_MESSAGE);
+  }
+  return new ImapFlow({
+    host: target.host,
+    port: doc.port,
+    secure: doc.secure,
+    ...(target.servername && { servername: target.servername }),
+    auth: doc.password
+      ? { user: doc.user, pass: doc.password }
+      : { user: doc.user, accessToken: doc.accessToken as string },
+    logger: false,
+    emitLogs: false,
+  });
+}
+
+/** Server-Fehler → typisierte Foundation-Fehlerklassen (Plan §2). */
+export function mapImapError(err: unknown, host: string): Error {
+  // imapflow-Fehler tragen die Server-Antwort in responseText, die
+  // message ist nur "Command failed" — beides in den Match einbeziehen;
+  // authenticationFailed ist das verlässliche Flag.
+  const carrier = err as { authenticationFailed?: unknown; responseText?: unknown };
+  const responseText = typeof carrier?.responseText === "string" ? carrier.responseText : "";
+  const msg = `${err instanceof Error ? err.message : String(err)} ${responseText}`.trim();
+  if (
+    carrier?.authenticationFailed === true ||
+    /auth(entication)? failed|invalid credentials|invalid login|LOGIN failed|AUTHENTICATIONFAILED/i.test(
+      msg,
+    )
+  ) {
+    return new InboundAuthError(`IMAP auth failed at ${host}: ${msg}`);
+  }
+  if (/ENOTFOUND|ECONNREFUSED|EAI_AGAIN|ETIMEDOUT|ECONNRESET|socket|closed/i.test(msg)) {
+    return new InboundTransientError(`IMAP ${host} unreachable: ${msg}`);
+  }
+  return new InboundTransientError(`IMAP ${host}: ${msg}`);
+}
+
+// =============================================================================
+// Cursor — { uidValidity: string, lastUid: number }
+// =============================================================================
+
+export type ImapCursor = { readonly uidValidity: string; readonly lastUid: number };
+
+export function parseImapCursor(cursor: SyncCursorPayload | null): ImapCursor | null {
+  if (!cursor) return null;
+  const uidValidity = cursor["uidValidity"];
+  const lastUid = cursor["lastUid"];
+  if (typeof uidValidity !== "string" || typeof lastUid !== "number") return null;
+  return { uidValidity, lastUid };
+}
+
+/** Wirft InboundCursorInvalidError bei UIDVALIDITY-Wechsel — die
+ *  Foundation resettet den Cursor und macht einen Voll-Resync im
+ *  Backfill-Fenster (Dedup fängt Dubletten). */
+export function assertUidValidity(cursor: ImapCursor | null, serverUidValidity: string): void {
+  if (cursor && cursor.uidValidity !== serverUidValidity) {
+    throw new InboundCursorInvalidError(
+      `UIDVALIDITY changed (${cursor.uidValidity} → ${serverUidValidity}) — full resync required`,
+    );
+  }
+}
+
+// =============================================================================
+// Message-Normalisierung → RawInboundMessage
+// =============================================================================
+
+function stripAngles(id: string): string {
+  return id.replace(/^<|>$/g, "").trim();
+}
+
+/** References-Chain normalisieren: mailparser liefert string | string[]
+ *  | undefined; fehlt References, trägt In-Reply-To den Thread-Anker. */
+export function normalizeReferences(parsed: {
+  references?: string | string[];
+  inReplyTo?: string;
+}): string[] {
+  const raw = parsed.references;
+  const list = raw === undefined ? [] : Array.isArray(raw) ? raw : raw.split(/\s+/);
+  const refs = list.map(stripAngles).filter((r) => r.length > 0);
+  if (refs.length === 0 && parsed.inReplyTo) {
+    const inReplyTo = stripAngles(parsed.inReplyTo);
+    if (inReplyTo) return [inReplyTo];
+  }
+  return refs;
+}
+
+function addressList(a: AddressObject | AddressObject[] | undefined): string[] {
+  if (!a) return [];
+  const arr = Array.isArray(a) ? a : [a];
+  return arr.map((x) => x.text).filter((t): t is string => Boolean(t));
+}
+
+/** imapflow liefert internalDate je nach Codepfad als Date ODER string.
+ *  String-Form verwerfen wir bewusst (kein Date-Parsing im Feature-Code,
+ *  no-date-api) — toRawInboundMessage fällt dann auf mailparsers
+ *  Date-Header zurück, der immer als echtes Date kommt. */
+export function coerceDate(d: Date | string | undefined): Date | undefined {
+  return d instanceof Date ? d : undefined;
+}
+
+/** providerMessageId: UID ist nur innerhalb einer UIDVALIDITY eindeutig
+ *  — beides zusammen ist der stabile Idempotency-Anchor. */
+export function buildProviderMessageId(uidValidity: string, uid: number): string {
+  return `${uidValidity}:${uid}`;
+}
+
+export async function toRawInboundMessage(args: {
+  readonly source: Uint8Array;
+  readonly uid: number;
+  readonly uidValidity: string;
+  readonly internalDate: Date | undefined;
+}): Promise<RawInboundMessage> {
+  const parsed: ParsedMail = await simpleParser(Buffer.from(args.source));
+  const messageIdHeader = parsed.messageId ? stripAngles(parsed.messageId) : null;
+  const receivedAt = args.internalDate ?? parsed.date;
+  const text = parsed.text?.trim() ?? "";
+  return {
+    providerMessageId: buildProviderMessageId(args.uidValidity, args.uid),
+    messageIdHeader: messageIdHeader && messageIdHeader.length > 0 ? messageIdHeader : null,
+    providerThreadId: null,
+    references: normalizeReferences(parsed),
+    from: parsed.from?.text ?? "",
+    to: addressList(parsed.to),
+    cc: addressList(parsed.cc),
+    subject: parsed.subject ?? "",
+    snippet: text.slice(0, SNIPPET_MAX),
+    // Lib-Boundary-Bridge (Date von imapflow/mailparser) → Temporal;
+    // fehlt jedes Datum, ist Epoch der ehrliche Marker.
+    receivedAtIso: (receivedAt
+      ? legacyDateToInstant(receivedAt)
+      : Temporal.Instant.fromEpochMilliseconds(0)
+    ).toString(),
+    rawMime: args.source,
+    scope: "inbox",
+  };
+}

package/packages/bundled-features/src/inbound-provider-imap/index.ts

@@ -0,0 +1,17 @@
+// Public API of the inbound-provider-imap bundled-feature.
+
+export {
+  type ImapCredentialDocument,
+  imapCredentialDocumentSchema,
+  type ParseCredentialResult,
+  parseImapCredentialDocument,
+} from "./credential-document.js";
+export { IMAP_PROVIDER_KEY, inboundProviderImapFeature, setImapMailHostLookup } from "./feature.js";
+export {
+  assertUidValidity,
+  buildProviderMessageId,
+  type ImapCursor,
+  mapImapError,
+  normalizeReferences,
+  parseImapCursor,
+} from "./imap-client.js";

package/packages/bundled-features/src/inbound-provider-inmemory/changes.json

@@ -0,0 +1 @@
+[]