@cosmicdrift/kumiko-samples 0.391.0 → 0.392.0

package/packages/bundled-features/src/channel-email/app-transport.ts

@@ -0,0 +1,37 @@
+import type { Registry } from "@cosmicdrift/kumiko-framework/engine";
+import type { EmailTransport } from "./types.ts";
+
+// The app transport otherwise lives only in the channel closure; publishing it lets other
+// features reach the same sender a tenant without its own provider falls back to.
+export const EMAIL_APP_TRANSPORT_EXTENSION = "emailAppTransport" as const;
+export const EMAIL_APP_TRANSPORT_USAGE = "app" as const;
+
+export type EmailAppTransport = { readonly transport: EmailTransport | null };
+
+declare module "@cosmicdrift/kumiko-framework/engine" {
+  interface KumikoExtensionOptionsMap {
+    [EMAIL_APP_TRANSPORT_EXTENSION]: EmailAppTransport;
+  }
+}
+
+function isEmailAppTransport(options: unknown): options is EmailAppTransport {
+  return (
+    typeof options === "object" &&
+    options !== null &&
+    "transport" in options &&
+    typeof options.transport === "object" &&
+    options.transport !== null &&
+    "send" in options.transport &&
+    typeof options.transport.send === "function"
+  );
+}
+
+/** The app-wide transport of channel-email, null when the app has none or no channel-email. */
+export function findEmailAppTransport(
+  registry: Pick<Registry, "getExtensionUsages">,
+): EmailTransport | null {
+  const usage = registry
+    .getExtensionUsages(EMAIL_APP_TRANSPORT_EXTENSION)
+    .find((candidate) => candidate.entityName === EMAIL_APP_TRANSPORT_USAGE);
+  return usage !== undefined && isEmailAppTransport(usage.options) ? usage.options.transport : null;
+}

package/packages/bundled-features/src/channel-email/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.392.0",
+    "type": "improvement",
+    "title": "channel-email publishes its app transport",
+    "detail": "channel-email declares the emailAppTransport extension and registers its app transport under it; findEmailAppTransport(registry) returns that transport, or null when the app has none or does not mount channel-email."
+  },
   {
     "version": "0.388.0",
     "type": "fix",

package/packages/bundled-features/src/channel-email/feature.ts

@@ -4,11 +4,13 @@ import {
 } from "@cosmicdrift/kumiko-bundled-features/delivery";
 import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
 import { featureWithEnvSchema } from "@cosmicdrift/kumiko-framework/env";
+import { EMAIL_APP_TRANSPORT_EXTENSION, EMAIL_APP_TRANSPORT_USAGE } from "./app-transport.ts";
 import { createEmailChannel, type EmailChannelOptions } from "./email-channel.ts";
 import { smtpEnvSchema } from "./env.ts";
 
 export function createChannelEmailFeature(options: EmailChannelOptions) {
   const channel = createEmailChannel(options);
+  const appTransport = options.transport ?? null;
 
   const feature = defineFeature("channel-email", (r) => {
     r.describe(
@@ -23,6 +25,10 @@ export function createChannelEmailFeature(options: EmailChannelOptions) {
     r.envSchema(smtpEnvSchema);
 
     r.translations({ keys: { "delivery.channel.email": { en: "Email" } } });
+    r.extendsRegistrar(EMAIL_APP_TRANSPORT_EXTENSION, { onRegister: () => {} });
+    r.useExtension(EMAIL_APP_TRANSPORT_EXTENSION, EMAIL_APP_TRANSPORT_USAGE, {
+      transport: appTransport,
+    });
     r.useExtension(DELIVERY_CHANNEL_EXTENSION, EMAIL_CHANNEL_NAME, {
       mode: channel.mode,
       resolve: channel.resolve,

package/packages/bundled-features/src/channel-email/index.ts

@@ -1,3 +1,8 @@
+export {
+  EMAIL_APP_TRANSPORT_EXTENSION,
+  type EmailAppTransport,
+  findEmailAppTransport,
+} from "./app-transport.ts";
 export {
   createEmailChannel,
   type EmailChannelOptions,

package/packages/bundled-features/src/channel-email/smtp-transport.ts

@@ -18,6 +18,7 @@
 // high-volume apps the caller must layer its own implementation with a
 // dedicated queue (BullMQ + retry) on top.
 
+import { sanitizeMailDisplayName } from "@cosmicdrift/kumiko-bundled-features/foundation-shared";
 import { createTransport, type Transporter } from "nodemailer";
 import addressparser from "nodemailer/lib/addressparser";
 import type { EmailAttachment, EmailMessage, EmailTransport } from "./types.ts";
@@ -51,32 +52,11 @@ export type SmtpTransportOptions = {
   readonly servername?: string;
 };
 
-function isControlCharacter(char: string): boolean {
-  const code = char.charCodeAt(0);
-  return code <= 0x1f || code === 0x7f;
-}
-
-// Mail clients often show only the display name: an embedded address ("<", ">", "@") would
-// pass for a foreign sender on the platform's own SPF/DKIM-signed domain.
-function isUnsafeDisplayNameCharacter(char: string): boolean {
-  return isControlCharacter(char) || char === "<" || char === ">" || char === "@";
-}
-
-// Control characters in a display name would let a caller inject headers.
-function sanitizedDisplayName(name: string | undefined): string | undefined {
-  const cleaned = name
-    ?.split("")
-    .map((char) => (isUnsafeDisplayNameCharacter(char) ? " " : char))
-    .join("")
-    .trim();
-  return cleaned === undefined || cleaned === "" ? undefined : cleaned;
-}
-
 function fromHeader(
   address: string,
   fromName: string | undefined,
 ): string | { readonly name: string; readonly address: string } {
-  const name = sanitizedDisplayName(fromName);
+  const name = sanitizeMailDisplayName(fromName);
   if (name === undefined) return address;
   const [parsed] = addressparser(address, { flatten: true });
   return parsed?.address ? { name, address: parsed.address } : address;

package/packages/bundled-features/src/foundation-shared/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.392.0",
+    "type": "improvement",
+    "title": "sanitizeMailDisplayName is shared",
+    "detail": "The display-name sanitizer from channel-email moved to foundation-shared as sanitizeMailDisplayName, so the IMAP sender uses the same rule. No behavior change."
+  },
   {
     "version": "0.370.0",
     "type": "improvement",

package/packages/bundled-features/src/foundation-shared/index.ts

@@ -5,6 +5,7 @@ export { buildInfoEnvSchema } from "./build-info-env.ts";
 export { requireDefined, requireNonEmpty, requireSecretSet } from "./config-helpers.ts";
 export { demoAdminEnvSchema } from "./demo-admin-env.ts";
 export { isHostAllowlisted, readHostAllowlistFromEnv } from "./host-allowlist.ts";
+export { sanitizeMailDisplayName } from "./mail-display-name.ts";
 export {
   BlockedHostError,
   HostResolutionError,

package/packages/bundled-features/src/foundation-shared/mail-display-name.ts

@@ -0,0 +1,20 @@
+function isControlCharacter(char: string): boolean {
+  const code = char.charCodeAt(0);
+  return code <= 0x1f || code === 0x7f;
+}
+
+// Mail clients often show only the display name: an embedded address ("<", ">", "@") would
+// pass for a foreign sender on the sending domain's own SPF/DKIM-signed mail.
+function isUnsafeDisplayNameCharacter(char: string): boolean {
+  return isControlCharacter(char) || char === "<" || char === ">" || char === "@";
+}
+
+// Control characters in a display name would let a caller inject headers.
+export function sanitizeMailDisplayName(name: string | undefined): string | undefined {
+  const cleaned = name
+    ?.split("")
+    .map((char) => (isUnsafeDisplayNameCharacter(char) ? " " : char))
+    .join("")
+    .trim();
+  return cleaned === undefined || cleaned === "" ? undefined : cleaned;
+}

package/packages/bundled-features/src/inbound-mail-foundation/account-record.ts

@@ -0,0 +1,48 @@
+import {
+  configuredPiiSubjectKms,
+  decryptPiiFieldValues,
+} from "@cosmicdrift/kumiko-framework/crypto";
+import { type InboundMailAccountStatus, InboundMailAccountStatuses } from "./constants.ts";
+import { MAIL_ACCOUNT_PII_FIELDS } from "./entities.ts";
+import type { MailAccountRecord } from "./types.ts";
+
+export type MailAccountRow = {
+  readonly id: string;
+  readonly tenantId: string;
+  readonly provider: string;
+  readonly authMethod: string;
+  readonly ownerUserId?: string | null;
+  readonly address: string;
+  readonly displayName?: string | null;
+  readonly status?: string | null;
+  readonly watchState?: string | null;
+};
+
+function isAccountStatus(value: unknown): value is InboundMailAccountStatus {
+  return Object.values(InboundMailAccountStatuses).some((status) => status === value);
+}
+
+// Providers never see ciphertext, so the address is decrypted before the call.
+export async function toMailAccountRecord(
+  row: MailAccountRow,
+  tenantId: string,
+  requestId: string,
+): Promise<MailAccountRecord> {
+  const piiKms = configuredPiiSubjectKms();
+  const decrypted = piiKms
+    ? await decryptPiiFieldValues(row, MAIL_ACCOUNT_PII_FIELDS, piiKms, { requestId })
+    : row;
+  const address = decrypted["address"];
+  if (typeof address !== "string") throw new Error("mailbox address did not decrypt to text");
+  return {
+    id: row.id,
+    tenantId,
+    provider: row.provider,
+    authMethod: row.authMethod,
+    ownerUserId: row.ownerUserId ?? null,
+    address,
+    displayName: row.displayName ?? "",
+    status: isAccountStatus(row.status) ? row.status : InboundMailAccountStatuses.active,
+    watchState: row.watchState ?? "idle",
+  };
+}

package/packages/bundled-features/src/inbound-mail-foundation/changes.json

@@ -1,4 +1,22 @@
 [
+  {
+    "version": "0.392.0",
+    "type": "fix",
+    "title": "Mail polling works with the row-level-security enforcing pool",
+    "detail": "createInboundMailSupervisor opens its own system scope for the cross-tenant reads and writes of accounts, cursors and seen messages. Before, passing the enforcing pool as db made every poll see no accounts."
+  },
+  {
+    "version": "0.392.0",
+    "type": "improvement",
+    "title": "The mail account list links to the IMAP connect form",
+    "detail": "mailAccountListScreen gets a \"Connect mailbox\" toolbar action that opens the screen mail-account-connect-imap. The button shows only when the app mounts inbound-provider-imap, which registers that screen. The Systemcheck fix link for inbound mail now leads to a list where a mailbox can be added."
+  },
+  {
+    "version": "0.392.0",
+    "type": "improvement",
+    "title": "Apps can send from a connected mailbox",
+    "detail": "The provider contract gets an optional send(ctx, account, message). The new server function sendMailFromAccount(ctx, { accountId, message }) is called from an app's own write handler and sends through the provider of the mailbox, with the mailbox address as From and In-Reply-To and References for replies. It returns WriteResult<{ messageIdHeader }>; failures are typed UnprocessableErrors with the reasons mail_send_not_configured, mail_send_login_rejected, mail_send_server_unreachable, mail_send_rejected and mail_send_invalid_message (i18n keys inboundMail.send.errors.*). A missing, disconnected or someone else's personal mailbox answers not found. There is no fallback to the app sender. New exports: sendMailFromAccount, MAIL_SEND_ERRORS, outboundMailMessageSchema, OutboundMailMessage, OutboundMailSent, MailSendNotConfiguredError, MailSendRejectedError. New keys in all locale packages."
+  },
   {
     "version": "0.391.0",
     "type": "improvement",

package/packages/bundled-features/src/inbound-mail-foundation/feature.ts

@@ -106,7 +106,7 @@ export function createInboundMailFoundationFeature() {
     (r) => {
       r.adoptsBundledLists();
       r.describe(
-        "Plugin host for inbound e-mail (inbox federation) — provider plugins (inbound-provider-imap, later M365 Graph / Gmail REST) register at the `inboundMailProvider` extension point with verify/fetch and optional oauth/watch (live push). The foundation owns three event-sourced streams (mail-account lifecycle, inbound-message with exactly-once ingest via deterministic aggregate ids, mail-thread rollup) and their projections `read_mail_accounts`/`read_inbound_messages`/`read_mail_threads`; PII fields are envelope-encrypted per tenant subject key before every append (crypto-shredding on tenant destroy). Wire `createInboundMailConnectRoutes` (OAuth connect + anonymous callback outside /api) and `createInboundMailSupervisor` (IDLE watch with backoff + reconciliation poll) in bin/server.ts. Consume `inbound-mail-foundation:event:inbound-message-received` from app features to attach business processes.",
+        "Plugin host for inbound e-mail (inbox federation) — provider plugins (inbound-provider-imap, later M365 Graph / Gmail REST) register at the `inboundMailProvider` extension point with verify/fetch and optional oauth/watch (live push) and send. `sendMailFromAccount(ctx, { accountId, message })` sends from a connected mailbox through its provider (From = the mailbox address, no fallback to the app sender) and answers typed failures (not configured, login rejected, server unreachable, rejected, invalid message); app write handlers call it, it is no endpoint of its own. The foundation owns three event-sourced streams (mail-account lifecycle, inbound-message with exactly-once ingest via deterministic aggregate ids, mail-thread rollup) and their projections `read_mail_accounts`/`read_inbound_messages`/`read_mail_threads`; PII fields are envelope-encrypted per tenant subject key before every append (crypto-shredding on tenant destroy). Wire `createInboundMailConnectRoutes` (OAuth connect + anonymous callback outside /api) and `createInboundMailSupervisor` (IDLE watch with backoff + reconciliation poll) in bin/server.ts. Consume `inbound-mail-foundation:event:inbound-message-received` from app features to attach business processes.",
       );
       r.uiHints({
         displayLabel: "Inbound Mail · Foundation",

package/packages/bundled-features/src/inbound-mail-foundation/i18n.ts

@@ -7,6 +7,7 @@ import {
   MAIL_ACCOUNT_LIST_SCREEN_ID,
   MAIL_ACCOUNT_STATUS_OPTION_KEY_PREFIX,
 } from "./screens.ts";
+import { MAIL_SEND_ERRORS } from "./send-from-account.ts";
 
 const formFieldKey = (field: string): string =>
   fieldLabelKey(INBOUND_MAIL_FOUNDATION_FEATURE, ACTION_FORM_ENTITY, field);
@@ -32,6 +33,7 @@ export const INBOUND_MAIL_FOUNDATION_I18N: Readonly<Record<string, { readonly en
   [`${MAIL_ACCOUNT_STATUS_OPTION_KEY_PREFIX}${InboundMailAccountStatuses.disconnected}`]: {
     en: "Disconnected",
   },
+  "inboundMail.accounts.connectImap": { en: "Connect mailbox" },
   "inboundMail.accounts.edit": { en: "Rename" },
   "inboundMail.accounts.edit.submit": { en: "Save" },
   "inboundMail.accounts.disconnect": { en: "Disconnect" },
@@ -40,4 +42,19 @@ export const INBOUND_MAIL_FOUNDATION_I18N: Readonly<Record<string, { readonly en
   },
   [formFieldKey("accountId")]: { en: "Mailbox" },
   [formFieldKey("displayName")]: { en: "Name" },
+  [MAIL_SEND_ERRORS.notConfigured.i18nKey]: {
+    en: "Sending is not set up for this mailbox. Connect the mailbox again with its outgoing server.",
+  },
+  [MAIL_SEND_ERRORS.loginRejected.i18nKey]: {
+    en: "The outgoing mail server rejected the sign-in. Check the mailbox password.",
+  },
+  [MAIL_SEND_ERRORS.serverUnreachable.i18nKey]: {
+    en: "The outgoing mail server cannot be reached. Try again later.",
+  },
+  [MAIL_SEND_ERRORS.rejected.i18nKey]: {
+    en: "The outgoing mail server refused the mail. Check the recipient address.",
+  },
+  [MAIL_SEND_ERRORS.invalidMessage.i18nKey]: {
+    en: "The mail was not sent: a recipient, the subject or the reply reference is invalid.",
+  },
 };

package/packages/bundled-features/src/inbound-mail-foundation/index.ts

@@ -68,6 +68,15 @@ export {
   type VerifyOAuthStateResult,
   verifyOAuthState,
 } from "./oauth-state.ts";
+export {
+  isMailSendNotConfiguredError,
+  isMailSendRejectedError,
+  MailSendNotConfiguredError,
+  MailSendRejectedError,
+  type OutboundMailMessage,
+  type OutboundMailSent,
+  outboundMailMessageSchema,
+} from "./outbound-mail.ts";
 export {
   inboundMessagesProjectionTable,
   mailAccountsProjectionTable,
@@ -78,9 +87,18 @@ export {
   resolveInboundProviderForKey,
 } from "./provider-factory.ts";
 export {
+  IMAP_CONNECT_SCREEN_ID,
   MAIL_ACCOUNT_EDIT_SCREEN_ID,
   MAIL_ACCOUNT_LIST_SCREEN_ID,
+  MAIL_ACCOUNT_LIST_SCREEN_QN,
 } from "./screens.ts";
+export {
+  MAIL_SEND_ERRORS,
+  type MailSendFailure,
+  type SendMailFromAccountContext,
+  type SendMailFromAccountInput,
+  sendMailFromAccount,
+} from "./send-from-account.ts";
 export {
   InboundAuthError,
   InboundCursorInvalidError,

package/packages/bundled-features/src/inbound-mail-foundation/outbound-mail.ts

@@ -0,0 +1,66 @@
+// Outbound half of the provider contract: a reply sent from a connected mailbox through the
+// customer's own mail server, never through the platform sender.
+
+import * as z from "zod";
+
+const MAX_RECIPIENTS = 50;
+const MAX_REFERENCES = 100;
+
+// Message ids travel without angle brackets, like RawInboundMessage.references. Anything that
+// could close the bracket or start a new header is refused instead of being encoded.
+const messageIdSchema = z
+  .string()
+  .min(1)
+  .max(998)
+  .regex(/^[^\s<>]+$/);
+
+export const outboundMailMessageSchema = z
+  .object({
+    to: z.array(z.email().max(320)).min(1).max(MAX_RECIPIENTS),
+    cc: z.array(z.email().max(320)).max(MAX_RECIPIENTS).optional(),
+    subject: z
+      .string()
+      .max(998)
+      .regex(/^[^\r\n]*$/),
+    text: z.string().optional(),
+    html: z.string().optional(),
+    inReplyTo: messageIdSchema.optional(),
+    references: z.array(messageIdSchema).max(MAX_REFERENCES).optional(),
+  })
+  .refine((message) => message.text !== undefined || message.html !== undefined, {
+    message: "needs text or html",
+  });
+export type OutboundMailMessage = z.infer<typeof outboundMailMessageSchema>;
+
+export type OutboundMailSent = {
+  /** Message-ID header of the sent mail, without angle brackets. */
+  readonly messageIdHeader: string;
+};
+
+// Same `kind` discriminant as the inbound error classes (see types.ts).
+
+/** The mailbox has no outgoing server stored, for example a credential document from before
+ *  sending existed. The tenant has to connect the mailbox again. */
+export class MailSendNotConfiguredError extends Error {
+  readonly kind = "mail-send-not-configured-error" as const;
+  constructor(message: string) {
+    super(message);
+    this.name = "MailSendNotConfiguredError";
+  }
+}
+
+/** The outgoing server accepted the login but refused the mail (recipient, size, policy). */
+export class MailSendRejectedError extends Error {
+  readonly kind = "mail-send-rejected-error" as const;
+  constructor(message: string) {
+    super(message);
+    this.name = "MailSendRejectedError";
+  }
+}
+
+export function isMailSendNotConfiguredError(e: unknown): e is MailSendNotConfiguredError {
+  return e instanceof Error && "kind" in e && e.kind === "mail-send-not-configured-error";
+}
+export function isMailSendRejectedError(e: unknown): e is MailSendRejectedError {
+  return e instanceof Error && "kind" in e && e.kind === "mail-send-rejected-error";
+}

package/packages/bundled-features/src/inbound-mail-foundation/probe.ts

@@ -1,7 +1,3 @@
-import {
-  configuredPiiSubjectKms,
-  decryptPiiFieldValues,
-} from "@cosmicdrift/kumiko-framework/crypto";
 import {
   createSystemUser,
   type FeatureRegistrar,
@@ -9,26 +5,16 @@ import {
   ProbeFailure,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { createConfigAccessor } from "../config/index.ts";
-import { INBOUND_MAIL_FOUNDATION_FEATURE, InboundMailAccountStatuses } from "./constants.ts";
-import { MAIL_ACCOUNT_PII_FIELDS } from "./entities.ts";
+import { type MailAccountRow, toMailAccountRecord } from "./account-record.ts";
+import { InboundMailAccountStatuses } from "./constants.ts";
 import { INBOUND_PROBE_KEYS } from "./probe-keys.ts";
 import { mailAccountsProjectionTable } from "./projection.ts";
 import { resolveInboundProviderForAccount } from "./provider-factory.ts";
-import { type InboundMailContext, isInboundAuthError, type MailAccountRecord } from "./types.ts";
+import { MAIL_ACCOUNT_LIST_SCREEN_QN } from "./screens.ts";
+import { type InboundMailContext, isInboundAuthError } from "./types.ts";
 
 const SHORT_ID_LENGTH = 8;
 
-type AccountRow = {
-  readonly id: string;
-  readonly tenantId: string;
-  readonly provider: string;
-  readonly authMethod: string;
-  readonly ownerUserId?: string | null;
-  readonly address: string;
-  readonly displayName?: string | null;
-  readonly watchState?: string | null;
-};
-
 function providerContext(ctx: ProbeContext): InboundMailContext {
   const { configResolver, secrets } = ctx.services;
   const auditUserId = createSystemUser(ctx.tenantId).id;
@@ -42,29 +28,6 @@ function providerContext(ctx: ProbeContext): InboundMailContext {
   };
 }
 
-// Providers never see ciphertext, so the address is decrypted before the call.
-async function toAccountRecord(row: AccountRow, tenantId: string): Promise<MailAccountRecord> {
-  const piiKms = configuredPiiSubjectKms();
-  const decrypted = piiKms
-    ? await decryptPiiFieldValues(row, MAIL_ACCOUNT_PII_FIELDS, piiKms, {
-        requestId: "inbound-mail-foundation:probe",
-      })
-    : row;
-  const address = decrypted["address"];
-  if (typeof address !== "string") throw new Error("mailbox address did not decrypt to text");
-  return {
-    id: row.id,
-    tenantId,
-    provider: row.provider,
-    authMethod: row.authMethod,
-    ownerUserId: row.ownerUserId ?? null,
-    address,
-    displayName: row.displayName ?? "",
-    status: InboundMailAccountStatuses.active,
-    watchState: row.watchState ?? "idle",
-  };
-}
-
 export function registerMailboxProbe(r: FeatureRegistrar<"inbound-mail-foundation">): void {
   r.probe({
     name: "mailboxes",
@@ -72,10 +35,10 @@ export function registerMailboxProbe(r: FeatureRegistrar<"inbound-mail-foundatio
     cost: "free",
     area: INBOUND_PROBE_KEYS.area,
     label: INBOUND_PROBE_KEYS.label,
-    fixScreen: `${INBOUND_MAIL_FOUNDATION_FEATURE}:screen:mail-accounts`,
+    fixScreen: MAIL_ACCOUNT_LIST_SCREEN_QN,
     // The address is PII, so the target label carries only the tenant-authored display name.
     targets: async (ctx) => {
-      const rows = await ctx.db.selectMany<AccountRow>(mailAccountsProjectionTable, {
+      const rows = await ctx.db.selectMany<MailAccountRow>(mailAccountsProjectionTable, {
         status: InboundMailAccountStatuses.active,
       });
       return rows.map((row) => ({
@@ -89,10 +52,10 @@ export function registerMailboxProbe(r: FeatureRegistrar<"inbound-mail-foundatio
     },
     run: async (ctx, target) => {
       const row = target
-        ? await ctx.db.fetchOne<AccountRow>(mailAccountsProjectionTable, { id: target.id })
+        ? await ctx.db.fetchOne<MailAccountRow>(mailAccountsProjectionTable, { id: target.id })
         : undefined;
       if (!row) return { status: "skipped", message: { key: INBOUND_PROBE_KEYS.gone } };
-      const account = await toAccountRecord(row, ctx.tenantId);
+      const account = await toMailAccountRecord(row, ctx.tenantId, "inbound-mail-foundation:probe");
       const providerCtx = providerContext(ctx);
       const plugin = resolveInboundProviderForAccount(providerCtx, account);
       try {

package/packages/bundled-features/src/inbound-mail-foundation/screens.ts

@@ -12,6 +12,11 @@ import {
 
 export const MAIL_ACCOUNT_LIST_SCREEN_ID = "mail-accounts";
 export const MAIL_ACCOUNT_EDIT_SCREEN_ID = "mail-account-edit";
+export const MAIL_ACCOUNT_LIST_SCREEN_QN = "inbound-mail-foundation:screen:mail-accounts";
+// Registered by inbound-provider-imap, which needs the IMAP client to check the login. The
+// renderer drops a navigate action whose target screen is not mounted, so the toolbar button
+// only shows in apps that mount that provider.
+export const IMAP_CONNECT_SCREEN_ID = "mail-account-connect-imap";
 
 export const MAIL_ACCOUNT_STATUS_OPTION_KEY_PREFIX = "inboundMail.accounts.status.";
 
@@ -73,6 +78,15 @@ export const mailAccountListScreen: ProjectionListScreenDefinition = {
       visible: { field: "status", ne: InboundMailAccountStatuses.disconnected },
     },
   ],
+  toolbarActions: [
+    {
+      kind: "navigate",
+      id: "connect-imap",
+      label: i18nKey("inboundMail.accounts.connectImap"),
+      screen: IMAP_CONNECT_SCREEN_ID,
+      style: "primary",
+    },
+  ],
   access: MAIL_ACCOUNT_ADMIN_ACCESS,
   dormant: true,
 };

package/packages/bundled-features/src/inbound-mail-foundation/send-from-account.ts

@@ -0,0 +1,118 @@
+// Sends a mail from a connected mailbox through the customer's own mail server. A plain server
+// function rather than a handler: the caller's own write handler owns access and agent exposure,
+// and the message (recipients, body) never becomes a dispatcher payload of its own.
+//
+// There is no fallback to the platform sender: a mailbox that cannot send answers with a typed
+// failure, so a reply never leaves under an address the recipient did not write to.
+
+import type { HandlerContext, WriteResult } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  failNotFound,
+  UnprocessableError,
+  writeFailure,
+} from "@cosmicdrift/kumiko-framework/errors";
+import { type MailAccountRow, toMailAccountRecord } from "./account-record.ts";
+import { InboundMailAccountStatuses } from "./constants.ts";
+import { isVisibleToCaller } from "./handlers/scope-visibility.ts";
+import {
+  isMailSendNotConfiguredError,
+  isMailSendRejectedError,
+  type OutboundMailMessage,
+  type OutboundMailSent,
+  outboundMailMessageSchema,
+} from "./outbound-mail.ts";
+import { mailAccountsProjectionTable } from "./projection.ts";
+import { resolveInboundProviderForAccount } from "./provider-factory.ts";
+import {
+  type InboundMailContext,
+  isInboundAuthError,
+  isInboundRateLimitError,
+  isInboundTransientError,
+} from "./types.ts";
+
+export const MAIL_SEND_ERRORS = {
+  notConfigured: {
+    reason: "mail_send_not_configured",
+    i18nKey: "inboundMail.send.errors.notConfigured",
+  },
+  loginRejected: {
+    reason: "mail_send_login_rejected",
+    i18nKey: "inboundMail.send.errors.loginRejected",
+  },
+  serverUnreachable: {
+    reason: "mail_send_server_unreachable",
+    i18nKey: "inboundMail.send.errors.serverUnreachable",
+  },
+  rejected: { reason: "mail_send_rejected", i18nKey: "inboundMail.send.errors.rejected" },
+  invalidMessage: {
+    reason: "mail_send_invalid_message",
+    i18nKey: "inboundMail.send.errors.invalidMessage",
+  },
+} as const;
+export type MailSendFailure = keyof typeof MAIL_SEND_ERRORS;
+
+export type SendMailFromAccountContext = Pick<
+  HandlerContext,
+  "db" | "registry" | "user" | "services" | "obs"
+>;
+
+export type SendMailFromAccountInput = {
+  readonly accountId: string;
+  readonly message: OutboundMailMessage;
+};
+
+const HANDLER_NAME = "inbound-mail-foundation:send-from-account";
+
+function sendFailure(failure: MailSendFailure): WriteResult<never> {
+  const { reason, i18nKey } = MAIL_SEND_ERRORS[failure];
+  return writeFailure(new UnprocessableError(reason, { i18nKey }));
+}
+
+function sendFailureOf(err: unknown): MailSendFailure | undefined {
+  if (isMailSendNotConfiguredError(err)) return "notConfigured";
+  if (isInboundAuthError(err)) return "loginRejected";
+  if (isInboundTransientError(err) || isInboundRateLimitError(err)) return "serverUnreachable";
+  if (isMailSendRejectedError(err)) return "rejected";
+  return undefined;
+}
+
+// A disconnected mailbox and someone else's personal mailbox are reported as missing, so the
+// caller cannot tell them apart from an id that never existed.
+function isSendableBy(row: MailAccountRow, user: SendMailFromAccountContext["user"]): boolean {
+  return row.status !== InboundMailAccountStatuses.disconnected && isVisibleToCaller(row, user);
+}
+
+export async function sendMailFromAccount(
+  ctx: SendMailFromAccountContext,
+  input: SendMailFromAccountInput,
+): Promise<WriteResult<OutboundMailSent>> {
+  const message = outboundMailMessageSchema.safeParse(input.message);
+  if (!message.success) return sendFailure("invalidMessage");
+
+  const row = await ctx.db.fetchOne<MailAccountRow>(mailAccountsProjectionTable, {
+    id: input.accountId,
+    tenantId: ctx.user.tenantId,
+  });
+  if (!row || !isSendableBy(row, ctx.user)) return failNotFound("mail-account", input.accountId);
+
+  const account = await toMailAccountRecord(row, ctx.user.tenantId, `${HANDLER_NAME}:${row.id}`);
+  const providerCtx: InboundMailContext = {
+    registry: ctx.registry,
+    ...(ctx.services.secrets && { secrets: ctx.services.secrets }),
+    auditUserId: ctx.user.id,
+  };
+  const plugin = resolveInboundProviderForAccount(providerCtx, account, HANDLER_NAME);
+  if (!plugin.send) return sendFailure("notConfigured");
+
+  try {
+    return { isSuccess: true, data: await plugin.send(providerCtx, account, message.data) };
+  } catch (err) {
+    const failure = sendFailureOf(err);
+    if (!failure) throw err;
+    ctx.obs.log.warn("mail send from account failed", {
+      accountId: account.id,
+      reason: MAIL_SEND_ERRORS[failure].reason,
+    });
+    return sendFailure(failure);
+  }
+}

package/packages/bundled-features/src/inbound-mail-foundation/types.ts

@@ -13,6 +13,7 @@
 import type { ConfigAccessor, Registry } from "@cosmicdrift/kumiko-framework/engine";
 import type { MetricsHandle } from "@cosmicdrift/kumiko-framework/observability";
 import { INBOUND_MAIL_PROVIDER_EXTENSION, type InboundMailAccountStatus } from "./constants.ts";
+import type { OutboundMailMessage, OutboundMailSent } from "./outbound-mail.ts";
 
 /**
  * Slim context for provider plugins.
@@ -186,6 +187,13 @@ export type InboundMailProviderPlugin = {
   ) => Promise<InboundFetchResult>;
   /** Nur OAuth-Provider. */
   readonly oauth?: InboundOAuthFlow;
+  /** Sends from the mailbox address through the customer's own server. Throws
+   *  MailSendNotConfiguredError, InboundAuthError, InboundTransientError or MailSendRejectedError. */
+  readonly send?: (
+    ctx: InboundMailContext,
+    account: MailAccountRecord,
+    message: OutboundMailMessage,
+  ) => Promise<OutboundMailSent>;
   /** Optional live push (IMAP IDLE, later Graph/Gmail webhooks).
    *  Returns stop(). Polling remains reconciliation: watch optimizes
    *  latency but is never the correctness anchor. `onError` reports a dead