@cosmicdrift/kumiko-samples 0.393.0 → 0.395.0

package/packages/bundled-features/src/inbound-provider-imap/screens.ts

@@ -1,125 +1,219 @@
 import {
   IMAP_CONNECT_SCREEN_ID,
   IMAP_RECONNECT_SCREEN_ID,
+  type InboundMailRoles,
   MAIL_ACCOUNT_LIST_SCREEN_QN,
+  MY_IMAP_CONNECT_SCREEN_ID,
+  MY_IMAP_RECONNECT_SCREEN_ID,
+  MY_MAIL_ACCOUNT_LIST_SCREEN_QN,
 } from "@cosmicdrift/kumiko-bundled-features/inbound-mail-foundation";
 import { i18nKey } from "@cosmicdrift/kumiko-framework/engine";
 import type { ActionFormScreenDefinition } from "@cosmicdrift/kumiko-framework/ui-types";
 import { ImapHandlers, ImapQueries, SMTP_SUBMISSION_PORT } from "./constants.ts";
 
-// Reached from the toolbar of the foundation's mail account list, never from the nav.
-export const imapConnectScreen: ActionFormScreenDefinition = {
-  id: IMAP_CONNECT_SCREEN_ID,
-  type: "actionForm",
-  agent: { expose: false },
-  handler: ImapHandlers.connectMailbox,
-  fields: {
-    displayName: { type: "text", required: true, maxLength: 200 },
-    address: { type: "text", required: true, maxLength: 320, format: "email" },
-    host: { type: "text", required: true, maxLength: 255 },
-    port: {
-      type: "number",
-      integer: true,
-      grouping: false,
-      required: true,
-      min: 1,
-      max: 65535,
-      default: 993,
-    },
-    user: { type: "text", required: true, maxLength: 320 },
-    password: { type: "text", required: true, format: "password", sensitive: true },
-    smtpHost: { type: "text", maxLength: 255 },
-    smtpPort: {
-      type: "number",
-      integer: true,
-      grouping: false,
-      required: true,
-      min: 1,
-      max: 65535,
-      default: SMTP_SUBMISSION_PORT,
-    },
-  },
-  layout: {
-    sections: [
-      // The name-based icon guess reads "address" as a postal address.
-      { fields: ["displayName", { field: "address", icon: "mail" }] },
-      {
-        title: i18nKey("inboundMail.imap.connect.server"),
-        fields: ["host", "port", "user", "password"],
+// The admin form connects a shared mailbox, the member form a personal one. The member form carries
+// no sender-check field because that policy is tenant-wide and only admins set it.
+function createConnectScreen(variant: {
+  readonly id: string;
+  readonly handler: string;
+  readonly roles: readonly string[];
+  readonly returnTarget: string;
+  readonly withSenderCheck: boolean;
+}): ActionFormScreenDefinition {
+  return {
+    id: variant.id,
+    type: "actionForm",
+    agent: { expose: false },
+    handler: variant.handler,
+    fields: {
+      displayName: { type: "text", required: true, maxLength: 200 },
+      address: { type: "text", required: true, maxLength: 320, format: "email" },
+      host: { type: "text", required: true, maxLength: 255 },
+      port: {
+        type: "number",
+        integer: true,
+        grouping: false,
+        required: true,
+        min: 1,
+        max: 65535,
+        default: 993,
       },
-      {
-        title: i18nKey("inboundMail.imap.connect.outgoing"),
-        description: i18nKey("inboundMail.imap.connect.outgoingHint"),
-        fields: ["smtpHost", "smtpPort"],
+      user: { type: "text", required: true, maxLength: 320 },
+      password: { type: "text", required: true, format: "password", sensitive: true },
+      smtpHost: { type: "text", maxLength: 255 },
+      smtpPort: {
+        type: "number",
+        integer: true,
+        grouping: false,
+        required: true,
+        min: 1,
+        max: 65535,
+        default: SMTP_SUBMISSION_PORT,
       },
-    ],
-  },
-  submitLabel: i18nKey("inboundMail.imap.connect.submit"),
-  redirect: MAIL_ACCOUNT_LIST_SCREEN_QN,
-  cancelTarget: MAIL_ACCOUNT_LIST_SCREEN_QN,
-  access: { roles: ["SystemAdmin", "TenantAdmin"] },
-  dormant: true,
-};
+      ...(variant.withSenderCheck && { trustedAuthservId: { type: "text", maxLength: 255 } }),
+    },
+    layout: {
+      sections: [
+        // The name-based icon guess reads "address" as a postal address.
+        { fields: ["displayName", { field: "address", icon: "mail" }] },
+        {
+          title: i18nKey("inboundMail.imap.connect.server"),
+          fields: ["host", "port", "user", "password"],
+        },
+        {
+          title: i18nKey("inboundMail.imap.connect.outgoing"),
+          description: i18nKey("inboundMail.imap.connect.outgoingHint"),
+          fields: ["smtpHost", "smtpPort"],
+        },
+        ...(variant.withSenderCheck
+          ? [
+              {
+                title: i18nKey("inboundMail.imap.connect.senderCheck"),
+                description: i18nKey("inboundMail.imap.connect.senderCheckHint"),
+                fields: ["trustedAuthservId"],
+              },
+            ]
+          : []),
+      ],
+    },
+    submitLabel: i18nKey("inboundMail.imap.connect.submit"),
+    redirect: variant.returnTarget,
+    cancelTarget: variant.returnTarget,
+    access: { roles: [...variant.roles] },
+    dormant: true,
+  };
+}
+
+// Reached from the toolbar of the foundation's mail account list, never from the nav.
+export const createImapConnectScreen = ({
+  adminRoles,
+}: InboundMailRoles): ActionFormScreenDefinition =>
+  createConnectScreen({
+    id: IMAP_CONNECT_SCREEN_ID,
+    handler: ImapHandlers.connectMailbox,
+    roles: adminRoles,
+    returnTarget: MAIL_ACCOUNT_LIST_SCREEN_QN,
+    withSenderCheck: true,
+  });
+
+// Reached from the toolbar of "My mail accounts".
+export const createMyImapConnectScreen = ({
+  memberRoles,
+}: InboundMailRoles): ActionFormScreenDefinition =>
+  createConnectScreen({
+    id: MY_IMAP_CONNECT_SCREEN_ID,
+    handler: ImapHandlers.connectMyMailbox,
+    roles: memberRoles,
+    returnTarget: MY_MAIL_ACCOUNT_LIST_SCREEN_QN,
+    withSenderCheck: false,
+  });
 
 // Reached from the "Reconnect" row action of an account with a sign-in error. The record id comes
 // from the path; the load query returns the stored server settings, never the password.
-export const imapReconnectScreen: ActionFormScreenDefinition = {
-  id: IMAP_RECONNECT_SCREEN_ID,
-  type: "actionForm",
-  agent: { expose: false },
-  handler: ImapHandlers.reconnectMailbox,
-  load: { query: ImapQueries.reconnectPrefill, idParam: "accountId" },
-  fields: {
-    accountId: { type: "text", required: true },
-    displayName: { type: "text", maxLength: 200 },
-    host: { type: "text", required: true, maxLength: 255 },
-    port: {
-      type: "number",
-      integer: true,
-      grouping: false,
-      required: true,
-      min: 1,
-      max: 65535,
-      default: 993,
-    },
-    user: { type: "text", required: true, maxLength: 320 },
-    password: { type: "text", required: true, format: "password", sensitive: true },
-    smtpHost: { type: "text", maxLength: 255 },
-    smtpPort: {
-      type: "number",
-      integer: true,
-      grouping: false,
-      required: true,
-      min: 1,
-      max: 65535,
-      default: SMTP_SUBMISSION_PORT,
-    },
-  },
-  layout: {
-    sections: [
-      {
-        title: i18nKey("inboundMail.imap.connect.server"),
-        description: i18nKey("inboundMail.imap.reconnect.hint"),
-        // The id only travels in the payload; the admin recognises the mailbox by its name.
-        fields: [
-          { field: "accountId", visible: false },
-          { field: "displayName", readOnly: true, submit: false },
-          "host",
-          "port",
-          "user",
-          "password",
-        ],
+// The admin and the owner variant share this form; the owner's carries no sender-check field
+// because that policy is tenant-wide and only admins set it.
+function createReconnectScreen(variant: {
+  readonly id: string;
+  readonly roles: readonly string[];
+  readonly returnTarget: string;
+  readonly withSenderCheck: boolean;
+}): ActionFormScreenDefinition {
+  return {
+    id: variant.id,
+    type: "actionForm",
+    agent: { expose: false },
+    handler: ImapHandlers.reconnectMailbox,
+    load: { query: ImapQueries.reconnectPrefill, idParam: "accountId" },
+    fields: {
+      accountId: { type: "text", required: true },
+      displayName: { type: "text", maxLength: 200 },
+      host: { type: "text", required: true, maxLength: 255 },
+      port: {
+        type: "number",
+        integer: true,
+        grouping: false,
+        required: true,
+        min: 1,
+        max: 65535,
+        default: 993,
       },
-      {
-        title: i18nKey("inboundMail.imap.connect.outgoing"),
-        description: i18nKey("inboundMail.imap.connect.outgoingHint"),
-        fields: ["smtpHost", "smtpPort"],
+      user: { type: "text", required: true, maxLength: 320 },
+      password: { type: "text", required: true, format: "password", sensitive: true },
+      smtpHost: { type: "text", maxLength: 255 },
+      smtpPort: {
+        type: "number",
+        integer: true,
+        grouping: false,
+        required: true,
+        min: 1,
+        max: 65535,
+        default: SMTP_SUBMISSION_PORT,
       },
-    ],
-  },
-  submitLabel: i18nKey("inboundMail.imap.reconnect.submit"),
-  redirect: MAIL_ACCOUNT_LIST_SCREEN_QN,
-  cancelTarget: MAIL_ACCOUNT_LIST_SCREEN_QN,
-  access: { roles: ["SystemAdmin", "TenantAdmin"] },
-  dormant: true,
-};
+      ...(variant.withSenderCheck && { trustedAuthservId: { type: "text", maxLength: 255 } }),
+    },
+    layout: {
+      sections: [
+        {
+          title: i18nKey("inboundMail.imap.connect.server"),
+          description: i18nKey("inboundMail.imap.reconnect.hint"),
+          // The id only travels in the payload; the user recognises the mailbox by its name.
+          fields: [
+            { field: "accountId", visible: false },
+            { field: "displayName", readOnly: true, submit: false },
+            "host",
+            "port",
+            "user",
+            "password",
+          ],
+        },
+        {
+          title: i18nKey("inboundMail.imap.connect.outgoing"),
+          description: i18nKey("inboundMail.imap.connect.outgoingHint"),
+          fields: ["smtpHost", "smtpPort"],
+        },
+        ...(variant.withSenderCheck
+          ? [
+              {
+                title: i18nKey("inboundMail.imap.connect.senderCheck"),
+                description: i18nKey("inboundMail.imap.connect.senderCheckHint"),
+                fields: ["trustedAuthservId"],
+              },
+            ]
+          : []),
+      ],
+    },
+    submitLabel: i18nKey("inboundMail.imap.reconnect.submit"),
+    redirect: variant.returnTarget,
+    cancelTarget: variant.returnTarget,
+    access: { roles: [...variant.roles] },
+    dormant: true,
+  };
+}
+
+export const createImapReconnectScreen = ({
+  adminRoles,
+}: InboundMailRoles): ActionFormScreenDefinition =>
+  createReconnectScreen({
+    id: IMAP_RECONNECT_SCREEN_ID,
+    roles: adminRoles,
+    returnTarget: MAIL_ACCOUNT_LIST_SCREEN_QN,
+    withSenderCheck: true,
+  });
+
+// Reached from the "Reactivate" row action of "My mail accounts".
+export const createMyImapReconnectScreen = ({
+  memberRoles,
+}: InboundMailRoles): ActionFormScreenDefinition =>
+  createReconnectScreen({
+    id: MY_IMAP_RECONNECT_SCREEN_ID,
+    roles: memberRoles,
+    returnTarget: MY_MAIL_ACCOUNT_LIST_SCREEN_QN,
+    withSenderCheck: false,
+  });
+
+export const createImapScreens = (roles: InboundMailRoles): ActionFormScreenDefinition[] => [
+  createImapConnectScreen(roles),
+  createImapReconnectScreen(roles),
+  createMyImapConnectScreen(roles),
+  createMyImapReconnectScreen(roles),
+];

package/packages/bundled-features/src/inbound-provider-imap/send-mail.ts

@@ -9,8 +9,9 @@ import {
   type MailAccountRecord,
   MailSendNotConfiguredError,
   MailSendRejectedError,
+  type OutboundAttachment,
   type OutboundMailMessage,
-  type OutboundMailSent,
+  type ProviderSentMail,
 } from "@cosmicdrift/kumiko-bundled-features/inbound-mail-foundation";
 import MailComposer from "nodemailer/lib/mail-composer";
 import { FEATURE_NAME } from "./constants.ts";
@@ -37,7 +38,8 @@ export async function sendFromImapAccount(
   ctx: InboundMailContext,
   account: MailAccountRecord,
   message: OutboundMailMessage,
-): Promise<OutboundMailSent> {
+  attachments: readonly OutboundAttachment[],
+): Promise<ProviderSentMail> {
   const doc = await readCredentialDocument(ctx, account);
   if (!doc.smtpHost || !doc.password) {
     throw new MailSendNotConfiguredError(
@@ -55,6 +57,13 @@ export async function sendFromImapAccount(
     ...(message.html !== undefined && { html: message.html }),
     ...(message.inReplyTo && { inReplyTo: message.inReplyTo }),
     ...(message.references && { references: [...message.references] }),
+    ...(attachments.length > 0 && {
+      attachments: attachments.map((attachment) => ({
+        filename: attachment.fileName,
+        contentType: attachment.mimeType,
+        content: Buffer.from(attachment.data),
+      })),
+    }),
   }).compile();
   const raw = await mime.build();
 

package/packages/bundled-features/src/inbound-provider-imap/sender-auth-headers.ts

@@ -0,0 +1,36 @@
+import {
+  fromDomainOf,
+  parseSenderAuthentication,
+  type SenderAuthentication,
+} from "@cosmicdrift/kumiko-bundled-features/inbound-mail-foundation";
+import type { ParsedMail } from "mailparser";
+
+const HEADER_NAME = "authentication-results";
+
+// headerLines keeps every occurrence in file order, topmost first. Unlike `headers`, which merges
+// repeated headers, the order is what the trust rule depends on.
+function authenticationResultValues(parsed: ParsedMail): string[] {
+  return parsed.headerLines
+    .filter((header) => header.key === HEADER_NAME)
+    .map((header) => header.line.slice(header.line.indexOf(":") + 1));
+}
+
+// A From header with addresses of several domains cannot be bound to one DMARC verdict.
+function singleFromDomain(parsed: ParsedMail): string | null {
+  const domains = new Set(
+    (parsed.from?.value ?? []).map((address) => fromDomainOf(address.address ?? "")),
+  );
+  const [only] = domains;
+  return domains.size === 1 && only ? only : null;
+}
+
+export function senderAuthenticationOf(
+  parsed: ParsedMail,
+  trustedAuthservId: string | null,
+): SenderAuthentication | null {
+  return parseSenderAuthentication(
+    authenticationResultValues(parsed),
+    trustedAuthservId,
+    singleFromDomain(parsed),
+  );
+}

package/packages/bundled-features/src/inbound-provider-imap/watch-mailbox.ts

@@ -0,0 +1,109 @@
+import type {
+  InboundMailContext,
+  MailAccountRecord,
+  RawInboundMessage,
+  RejectedInboundMessage,
+} from "@cosmicdrift/kumiko-bundled-features/inbound-mail-foundation";
+import type { ImapFlow } from "imapflow";
+import { readCredentialDocument } from "./credential-document.ts";
+import { createImapClient, IMAP_MAILBOX, imapMailHostGuard, mapImapError } from "./imap-client.ts";
+import { coerceDate, parseOrReject } from "./parse-message.ts";
+
+// IMAP IDLE (imapflow idles automatically while the mailbox is open
+// and emits 'exists' for new messages).
+
+export async function watchMailbox(
+  ctx: InboundMailContext,
+  account: MailAccountRecord,
+  handlers: {
+    readonly onMessages: (
+      msgs: readonly RawInboundMessage[],
+      rejected?: readonly RejectedInboundMessage[],
+    ) => Promise<void>;
+    readonly onError: (err: unknown) => void;
+  },
+): Promise<() => Promise<void>> {
+  const doc = await readCredentialDocument(ctx, account);
+  const client: ImapFlow = await createImapClient(doc, imapMailHostGuard());
+  let stopped = false;
+
+  try {
+    await client.connect();
+    const mailbox = await client.mailboxOpen(IMAP_MAILBOX);
+    const uidValidity = String(mailbox.uidValidity);
+    // uidNext is the next UID to be assigned, so everything from here is
+    // "new".
+    let nextUid = Number(mailbox.uidNext ?? 1);
+
+    const drainNew = async () => {
+      const messages: RawInboundMessage[] = [];
+      const rejected: RejectedInboundMessage[] = [];
+      let maxSeen = nextUid - 1;
+      for await (const msg of client.fetch(
+        `${nextUid}:*`,
+        { uid: true, internalDate: true, source: true, envelope: true },
+        { uid: true },
+      )) {
+        // `N:*` gotcha (see fetch): filter out the previous last message.
+        if (msg.uid < nextUid || !msg.source) continue;
+        const parsed = await parseOrReject({
+          source: msg.source,
+          envelope: msg.envelope,
+          uid: msg.uid,
+          uidValidity,
+          internalDate: coerceDate(msg.internalDate ?? undefined),
+          trustedAuthservId: account.trustedAuthservId ?? null,
+        });
+        if ("message" in parsed) messages.push(parsed.message);
+        else rejected.push(parsed.rejected);
+        if (msg.uid > maxSeen) maxSeen = msg.uid;
+      }
+      nextUid = maxSeen + 1;
+      if (messages.length > 0 || rejected.length > 0) await handlers.onMessages(messages, rejected);
+    };
+
+    client.on("exists", () => {
+      // skip: ignore delayed exists events after the watcher has stopped.
+      if (stopped) return;
+      void drainNew().catch((err) => {
+        if (!stopped) handlers.onError(mapImapError(err, doc.host));
+      });
+    });
+    const die = (err: unknown) => {
+      // skip: already stopped or terminated; fire onError only once.
+      if (stopped) return;
+      stopped = true;
+      handlers.onError(mapImapError(err, doc.host));
+    };
+    client.on("error", die);
+    client.on("close", () => die(new Error("connection closed")));
+
+    // IDLE loop: 'exists' fires ONLY while client.idle() is running
+    // (verified empirically against greenmail). Each intervening command
+    // (drainNew-fetch) ends idle(), so the loop re-enters idle() until
+    // stop() closes the connection.
+    void (async () => {
+      while (!stopped) {
+        try {
+          await client.idle();
+        } catch (err) {
+          if (!stopped) die(err);
+          // skip: the idle loop ends; die() has informed the supervisor (or stop()
+          // was the cause).
+          return;
+        }
+      }
+    })();
+
+    return async () => {
+      stopped = true;
+      client.removeAllListeners("exists");
+      client.removeAllListeners("error");
+      client.removeAllListeners("close");
+      await client.logout().catch(() => {});
+    };
+  } catch (err) {
+    await client.logout().catch(() => {});
+    throw mapImapError(err, doc.host);
+  }
+}

package/packages/bundled-features/src/inbound-provider-inmemory/feature.ts

@@ -13,11 +13,13 @@
 
 import {
   InboundAuthError,
+  type InboundContentFetchResult,
   type InboundFetchResult,
   type InboundMailContext,
   type InboundMailProviderPlugin,
   type MailAccountRecord,
   type RawInboundMessage,
+  type RejectedInboundMessage,
   type SyncCursorPayload,
 } from "@cosmicdrift/kumiko-bundled-features/inbound-mail-foundation";
 import { requireSecretsContext } from "@cosmicdrift/kumiko-bundled-features/secrets";
@@ -36,11 +38,21 @@ type WatchHandlers = {
   readonly onError: (err: unknown) => void;
 };
 
+type LogEntry =
+  | { readonly message: RawInboundMessage }
+  | { readonly rejected: RejectedInboundMessage };
+
 type AccountState = {
-  readonly log: RawInboundMessage[];
+  readonly log: LogEntry[];
+  // What fetchContent serves; a message that is not in here counts as gone from the server.
+  readonly fullContent: Map<string, RawInboundMessage>;
+  readonly contentFetches: string[][];
   watch: WatchHandlers | null;
+  watchedTrustedAuthservId: string | null | undefined;
   nextFetchError: unknown;
   nextVerifyError: unknown;
+  hangingFetch: Promise<void> | null;
+  lastFetchSignal: AbortSignal | undefined;
   credentialSecretKey: string | null;
 };
 
@@ -51,9 +63,14 @@ function stateFor(accountId: string): AccountState {
   if (!state) {
     state = {
       log: [],
+      fullContent: new Map(),
+      contentFetches: [],
       watch: null,
+      watchedTrustedAuthservId: undefined,
       nextFetchError: null,
       nextVerifyError: null,
+      hangingFetch: null,
+      lastFetchSignal: undefined,
       credentialSecretKey: null,
     };
     accounts.set(accountId, state);
@@ -66,10 +83,25 @@ function stateFor(accountId: string): AccountState {
  *  cursor — the foundation's deduplication makes this idempotent. */
 export async function seedInboundMessage(accountId: string, msg: RawInboundMessage): Promise<void> {
   const state = stateFor(accountId);
-  state.log.push(msg);
+  state.log.push({ message: msg });
   if (state.watch) await state.watch.onMessages([msg]);
 }
 
+/** Test helper: a mail the provider cannot parse; fetch reports it as rejected and moves on. */
+export function seedRejectedInboundMessage(accountId: string, providerMessageId: string): void {
+  stateFor(accountId).log.push({ rejected: { providerMessageId, reason: "unparseable" } });
+}
+
+/** Test helper: the full version of a message that fetchContent serves later. */
+export function setInboundFullContent(accountId: string, msg: RawInboundMessage): void {
+  stateFor(accountId).fullContent.set(msg.providerMessageId, msg);
+}
+
+/** Test helper: the provider message ids of every fetchContent call so far. */
+export function contentFetchesOf(accountId: string): readonly (readonly string[])[] {
+  return stateFor(accountId).contentFetches;
+}
+
 /** Test helper: injects a one-shot error into the next fetch (e.g.
  *  InboundAuthError or InboundCursorInvalidError). */
 export function failNextFetchWith(accountId: string, err: unknown): void {
@@ -81,6 +113,25 @@ export function failNextVerifyWith(accountId: string, err: unknown): void {
   stateFor(accountId).nextVerifyError = err;
 }
 
+/** Test helper: fetches of the account do not return until `release()`, whatever the abort signal
+ *  says, like a provider that ignores cancellation on a dead connection. */
+export function hangFetchesOf(accountId: string): { readonly release: () => void } {
+  const state = stateFor(accountId);
+  const { promise, resolve } = Promise.withResolvers<void>();
+  state.hangingFetch = promise;
+  return {
+    release: () => {
+      state.hangingFetch = null;
+      resolve();
+    },
+  };
+}
+
+/** Test helper: the abort signal the last fetch of the account received. */
+export function lastFetchSignalOf(accountId: string): AbortSignal | undefined {
+  return stateFor(accountId).lastFetchSignal;
+}
+
 /** Test helper: every fetch reads this tenant secret first, like a real
  *  provider reads its stored credentials; a missing secret is an auth error. */
 export function requireCredentialSecretOnFetch(accountId: string, key: string): void {
@@ -116,6 +167,11 @@ export function isWatching(accountId: string): boolean {
   return accounts.get(accountId)?.watch != null;
 }
 
+/** Test helper: the trustedAuthservId of the account the last watch was started with. */
+export function watchedTrustedAuthservIdOf(accountId: string): string | null | undefined {
+  return accounts.get(accountId)?.watchedTrustedAuthservId;
+}
+
 /** Test-Helper: kompletter State-Reset (Test-Isolation — Mock-States
  *  nie zwischen Tests teilen). */
 export function resetInboundInMemory(): void {
@@ -142,6 +198,8 @@ export const inMemoryInboundMailPlugin: InboundMailProviderPlugin = {
   },
   fetch: async (ctx, account, cursor, opts): Promise<InboundFetchResult> => {
     const state = stateFor(account.id);
+    state.lastFetchSignal = opts.signal;
+    if (state.hangingFetch) await state.hangingFetch;
     if (state.nextFetchError) {
       const err = state.nextFetchError;
       state.nextFetchError = null;
@@ -153,15 +211,29 @@ export const inMemoryInboundMailPlugin: InboundMailProviderPlugin = {
     const offset = offsetOf(cursor);
     const slice = state.log.slice(offset, offset + opts.maxMessages);
     const nextOffset = offset + slice.length;
+    const rejected = slice.flatMap((entry) => ("rejected" in entry ? [entry.rejected] : []));
     return {
-      messages: slice,
+      messages: slice.flatMap((entry) => ("message" in entry ? [entry.message] : [])),
+      ...(rejected.length > 0 && { rejected }),
       nextCursor: { offset: nextOffset },
       hasMore: nextOffset < state.log.length,
     };
   },
+  fetchContent: async (_ctx, account, providerMessageIds): Promise<InboundContentFetchResult> => {
+    const state = stateFor(account.id);
+    state.contentFetches.push([...providerMessageIds]);
+    const messages = providerMessageIds.flatMap((id) => state.fullContent.get(id) ?? []);
+    const found = new Set(messages.map((m) => m.providerMessageId));
+    return {
+      messages,
+      missing: providerMessageIds.filter((id) => !found.has(id)),
+      rejected: [],
+    };
+  },
   watch: async (_ctx, account, handlers) => {
     const state = stateFor(account.id);
     state.watch = handlers;
+    state.watchedTrustedAuthservId = account.trustedAuthservId ?? null;
     return async () => {
       if (state.watch === handlers) state.watch = null;
     };