@k2b/cloud 0.26.0 → 0.28.0

package/src/api/admin-outgoing-mail.ts

@@ -0,0 +1,242 @@
+import { sql } from "bun";
+import { type Context, Hono, type MiddlewareHandler } from "hono";
+import { describeRoute, validator } from "hono-openapi";
+import { z } from "zod";
+import {
+  AdminMailRecordSchema,
+  MailAppAccessSchema,
+  MailProfileInputSchema,
+  MailProfileKeySchema,
+  MailRetentionSchema,
+  MailStatusSchema,
+} from "../contracts/outgoing-mail";
+import { type AuthContext, auth, jsonResponse, requiresAdmin } from "../server";
+import { audit } from "../services/audit";
+import { outgoingMailLog } from "../services/outgoing-mail/admin";
+import { MAIL_RETENTION_KEYS, readMailRetention } from "../services/outgoing-mail/retention";
+import { type MailAuditContext, OutgoingMailError, outgoingMailStore } from "../services/outgoing-mail/store";
+import { outgoingMailTest } from "../services/outgoing-mail/test-send";
+import * as settings from "../services/settings";
+
+const retentionInput = MailRetentionSchema.refine((value) => value.recordDays >= value.contentDays, {
+  message: "Record retention must be at least content retention.",
+  path: ["recordDays"],
+});
+
+const validate = <Target extends "param" | "json" | "query", Schema extends z.ZodType>(
+  target: Target,
+  schema: Schema,
+  code: "invalid_profile" | "bad_input" = "invalid_profile",
+) =>
+  validator(target, schema, (result, c) => {
+    if (!result.success) {
+      const issue = result.error?.[0];
+      const path = issue?.path?.map((part) => (typeof part === "object" && "key" in part ? String(part.key) : String(part))).join(".");
+      return c.json(
+        {
+          code,
+          message: issue ? `${path ? `${path}: ` : ""}${issue.message}` : "Invalid outgoing mail configuration.",
+        },
+        400,
+      );
+    }
+  });
+const context = (c: Context<AuthContext>): MailAuditContext => ({
+  actor: { userId: c.get("user").id, uid: c.get("user").uid, provider: c.get("user").provider, roles: c.get("user").roles },
+  requestId: c.req.header("x-request-id"),
+});
+const idParam = z.object({ id: z.uuid() });
+const logQuery = z
+  .object({
+    app: z.string().min(1).optional(),
+    profile: MailProfileKeySchema.optional(),
+    status: z
+      .union([z.string(), z.array(z.string())])
+      .optional()
+      .transform((value) =>
+        value === undefined ? undefined : typeof value === "string" ? value.split(",") : value.flatMap((part) => part.split(",")),
+      )
+      .pipe(z.array(MailStatusSchema).max(6).optional()),
+    since: z.iso.datetime({ offset: true }).optional(),
+    ref: z
+      .string()
+      .min(1)
+      .max(200)
+      .optional()
+      .transform((value) => {
+        if (value === undefined) return undefined;
+        const colon = value.indexOf(":");
+        return colon < 0 ? { scope: value } : { scope: value.slice(0, colon), id: value.slice(colon + 1) };
+      })
+      .pipe(z.object({ scope: z.string().min(1).max(200), id: z.string().min(1).max(200).optional() }).optional()),
+    recipient: z.string().max(320).optional(),
+    cursor: z.string().max(1024).optional(),
+    limit: z.coerce.number().int().min(1).max(100).optional(),
+  })
+  .strict();
+const logPage = z.object({
+  items: z.array(AdminMailRecordSchema),
+  page: z.int(),
+  perPage: z.int(),
+  total: z.int(),
+  hasNext: z.boolean(),
+  nextCursor: z.string().optional(),
+});
+const contentResponse = z.union([
+  z.object({ purged: z.literal(true), contentPurgedAt: z.string() }),
+  z.object({
+    purged: z.literal(false),
+    text: z.string().nullable(),
+    html: z.string().nullable(),
+    headers: z.record(z.string(), z.string()).nullable(),
+  }),
+]);
+export const createAdminOutgoingMailRoutes = (authenticate: MiddlewareHandler<AuthContext> = auth.requireRole("admin")) =>
+  new Hono<AuthContext>()
+    .use("*", authenticate)
+    .use("*", async (c, next) => {
+      c.header("Cache-Control", "no-store");
+      await next();
+    })
+    .onError((error, c) => {
+      if (error instanceof OutgoingMailError) return c.json({ error: error.code, code: error.code, message: error.message }, error.status);
+      throw error;
+    })
+    .get(
+      "/retention",
+      describeRoute({
+        summary: "Read outgoing mail retention",
+        tags: ["Outgoing mail"],
+        ...requiresAdmin,
+        responses: { 200: jsonResponse(MailRetentionSchema, "Effective retention in days") },
+      }),
+      async (c) => c.json(await readMailRetention()),
+    )
+    .put(
+      "/retention",
+      describeRoute({
+        summary: "Update outgoing mail retention",
+        tags: ["Outgoing mail"],
+        ...requiresAdmin,
+        responses: {
+          200: jsonResponse(MailRetentionSchema, "Updated retention in days"),
+          400: jsonResponse(z.object({ code: z.literal("bad_input"), message: z.string() }), "Invalid retention"),
+        },
+      }),
+      validate("json", retentionInput, "bad_input"),
+      async (c) => {
+        const next = c.req.valid("json");
+        const old = await readMailRetention();
+        await sql.begin(async (tx) => {
+          await settings.set(MAIL_RETENTION_KEYS[0], next.contentDays, tx);
+          await settings.set(MAIL_RETENTION_KEYS[1], next.recordDays, tx);
+          await audit.record(
+            {
+              ...context(c),
+              action: "outgoing_mail.retention.update",
+              outcome: "allowed",
+              target: { type: "outgoing_mail_retention" },
+              metadata: { old, new: next },
+            },
+            tx,
+          );
+        });
+        await settings.invalidateSettingsCache(MAIL_RETENTION_KEYS);
+        return c.json(next);
+      },
+    )
+    .get(
+      "/messages",
+      describeRoute({
+        summary: "List outgoing mail metadata",
+        tags: ["Outgoing mail"],
+        ...requiresAdmin,
+        responses: { 200: jsonResponse(logPage, "Send log") },
+      }),
+      validate("query", logQuery, "bad_input"),
+      async (c) => {
+        const { cursor, limit, ...filter } = c.req.valid("query");
+        return c.json(await outgoingMailLog.list(filter, { cursor, perPage: limit }));
+      },
+    )
+    .get(
+      "/messages/:id",
+      describeRoute({
+        summary: "Read outgoing mail metadata",
+        tags: ["Outgoing mail"],
+        ...requiresAdmin,
+        responses: { 200: jsonResponse(AdminMailRecordSchema, "Message metadata") },
+      }),
+      validate("param", idParam, "bad_input"),
+      async (c) => c.json(await outgoingMailLog.get(c.req.valid("param").id)),
+    )
+    .get(
+      "/messages/:id/content",
+      describeRoute({
+        summary: "Read outgoing mail content with audit",
+        tags: ["Outgoing mail"],
+        ...requiresAdmin,
+        responses: { 200: jsonResponse(contentResponse, "Message content or purge marker") },
+      }),
+      validate("param", idParam, "bad_input"),
+      async (c) => c.json(await outgoingMailLog.content(c.req.valid("param").id, context(c))),
+    )
+    .post(
+      "/messages/:id/cancel",
+      describeRoute({
+        summary: "Cancel queued outgoing mail",
+        tags: ["Outgoing mail"],
+        ...requiresAdmin,
+        responses: {
+          200: jsonResponse(AdminMailRecordSchema, "Cancelled message"),
+          409: jsonResponse(
+            z.object({ code: z.literal("message_not_queued"), error: z.literal("message_not_queued"), message: z.string() }),
+            "Only queued mail can be cancelled",
+          ),
+        },
+      }),
+      validate("param", idParam, "bad_input"),
+      async (c) => c.json(await outgoingMailLog.cancel(c.req.valid("param").id, context(c))),
+    )
+    .get("/profiles", async (c) => c.json({ items: await outgoingMailStore.list() }))
+    .post(
+      "/batches/:batchId/cancel",
+      describeRoute({
+        summary: "Cancel queued outgoing mail in a batch",
+        tags: ["Outgoing mail"],
+        ...requiresAdmin,
+        responses: {
+          200: jsonResponse(z.object({ batchId: z.uuid(), cancelled: z.int().nonnegative() }), "Cancelled queued messages"),
+          404: jsonResponse(
+            z.object({ code: z.literal("batch_unknown"), error: z.literal("batch_unknown"), message: z.string() }),
+            "Unknown batch",
+          ),
+        },
+      }),
+      validate("param", z.object({ batchId: z.uuid() }), "bad_input"),
+      async (c) => c.json(await outgoingMailLog.cancelBatch(c.req.valid("param").batchId, context(c))),
+    )
+    .get("/profiles/:key", async (c) => c.json(await outgoingMailStore.get(c.req.param("key"))))
+    .put(
+      "/profiles/:key",
+      validate("param", z.object({ key: MailProfileKeySchema })),
+      validate("json", MailProfileInputSchema),
+      async (c) => {
+        const result = await outgoingMailStore.put(c.req.valid("param").key, c.req.valid("json"), context(c));
+        return c.json(result.profile, result.created ? 201 : 200);
+      },
+    )
+    .post("/profiles/:key/default", async (c) => c.json(await outgoingMailStore.setDefault(c.req.param("key")!, context(c))))
+    .delete("/profiles/:key", async (c) => {
+      await outgoingMailStore.delete(c.req.param("key")!, context(c));
+      return c.body(null, 204);
+    })
+    .post("/profiles/:key/test", validate("json", z.object({ recipient: z.email() }).strict()), async (c) => {
+      await outgoingMailTest.send(c.req.param("key")!, c.req.valid("json").recipient, context(c));
+      return c.json({ ok: true as const });
+    })
+    .get("/apps", async (c) => c.json(await outgoingMailStore.apps()))
+    .put("/apps/:appId", validate("json", MailAppAccessSchema), async (c) =>
+      c.json(await outgoingMailStore.setAppAccess(c.req.param("appId")!, c.req.valid("json"), context(c))),
+    );
+export default createAdminOutgoingMailRoutes();

package/src/api/index.ts

@@ -29,6 +29,7 @@ import adminCoreSettingsRoutes from "./admin-core-settings";
 import adminIdentityRoutes from "./admin-identity";
 import adminLifecycleRoutes from "./admin-lifecycle";
 import adminLinuxIdentityRoutes from "./admin-linux-identities";
+import adminOutgoingMailRoutes from "./admin-outgoing-mail";
 import adminRailRoutes from "./admin-rail";
 import { adminAnnouncementRoutes, announcementRoutes } from "./announcements";
 import { createAppApprovalRoutes } from "./app-approval";
@@ -77,6 +78,7 @@ const buildCoreApi = (options: CoreApiOptions) => {
     .route("/admin/core/ai-projects", adminAiProjectsRoutes)
     .route("/admin/core/ai-skills", adminAiSkillsRoutes)
     .route("/admin/core/announcements", adminAnnouncementRoutes)
+    .route("/admin/core/outgoing-mail", adminOutgoingMailRoutes)
     .route("/admin/core/settings", adminCoreSettingsRoutes)
     .route("/admin/core/rail", adminRailRoutes)
     .route("/admin/core/linux-identities", adminLinuxIdentityRoutes)

package/src/browser/FileChooser.tsx

@@ -4,6 +4,7 @@ import {
   announce,
   Button,
   createCollectionSelection,
+  FileDropTarget,
   FileGrid,
   Format,
   IconButton,
@@ -324,6 +325,16 @@ export function FileChooser(props: {
       {/* `display: contents`, so header, body, and footer stay the panel's own rows. */}
       <div ref={root} class="cloud-file-chooser">
         <PanelDialog.Header title={t().title({ multiple })} close={() => props.close([])} />
+        {/* Files dropped anywhere on the open chooser are taken like files picked from this device. */}
+        <FileDropTarget
+          label={t().dropToChoose({ multiple })}
+          accept={props.options.accept}
+          multiple={multiple}
+          disabled={downloading()}
+          onDrop={(files) => {
+            if (files.length > 0) props.close(files);
+          }}
+        />
         <div class="cloud-file-chooser__toolbar">
           <nav class="cloud-file-chooser__crumbs" aria-label={t().breadcrumbs}>
             <IconButton size="sm" variant="ghost" label={t().up} disabled={!location() || downloading()} onClick={up}>

package/src/browser/file-chooser-messages.ts

@@ -8,6 +8,7 @@ export const fileChooserMessages = i18n.define({
       sources: "Sources",
       sourceList: "Where the files come from",
       device: "This device",
+      dropToChoose: ({ multiple }: { multiple: boolean }): string => (multiple ? "Drop to add these files" : "Drop to add this file"),
       providersLoading: "Looking for apps with files…",
       providersFailed: "Apps with files could not be loaded.",
       retry: "Try again",
@@ -48,6 +49,7 @@ export const fileChooserMessages = i18n.define({
       sources: "Quellen",
       sourceList: "Woher die Dateien kommen",
       device: "Dieses Gerät",
+      dropToChoose: ({ multiple }) => (multiple ? "Ablegen, um diese Dateien hinzuzufügen" : "Ablegen, um diese Datei hinzuzufügen"),
       providersLoading: "Apps mit Dateien werden gesucht…",
       providersFailed: "Apps mit Dateien konnten nicht geladen werden.",
       retry: "Erneut versuchen",

package/src/cli/admin/ai-quotas.ts

@@ -1,4 +1,9 @@
 import { type AiModelPricing, AiModelPricingSchema } from "../../shared/ai-costs";
+import {
+  type AiModelRequestSettings,
+  AiModelRequestSettingsSchema,
+  AiModelRequestSettingsUpdateSchema,
+} from "../../shared/ai-model-request-settings";
 import {
   type AiQuotaConfig,
   AiQuotaConfigSchema,
@@ -7,7 +12,7 @@ import {
   AiQuotaReportQuerySchema,
   AiQuotaResetSchema,
 } from "../../shared/ai-quotas";
-import { type CloudCliContext, cliText, command, confirmFlag, flag, printRows, printStructured } from "../index";
+import { type CloudCliContext, cliText, command, confirmFlag, flag, printRows, printStructured, readCliInput } from "../index";
 import { apiGet, apiJson, queryString, readJsonInput } from "./shared";
 
 const path = "/api/admin/core/ai-quotas";
@@ -23,6 +28,70 @@ const confirm = (ctx: CloudCliContext, yes: boolean) => {
 };
 
 export const aiQuotaCommands = [
+  command("ai models settings get", {
+    summary: "Read model thinking level, extra parameters and configured header names",
+    flags: { id: flag.string({ required: true, description: "Model profile ID" }) },
+    async run({ ctx, flags }) {
+      print(ctx, AiModelRequestSettingsSchema.parse(await apiGet(ctx, `${path}/models/${encodeURIComponent(flags.id!)}/settings`)));
+    },
+  }),
+  command("ai models settings set", {
+    summary: "Patch one model's request settings; header values are write-only",
+    flags: {
+      id: flag.string({ required: true, description: "Model profile ID" }),
+      thinkingLevel: flag.string({ name: "thinking-level", description: "Provider-specific thinking level" }),
+      clearThinkingLevel: flag.boolean({ name: "clear-thinking-level", description: "Use the model's default thinking level" }),
+      extraBody: flag.input({ name: "extra-body", description: "Extra parameters JSON: --extra-body, --extra-body-file or --stdin" }),
+      clearExtraBody: flag.boolean({ name: "clear-extra-body", description: "Remove extra parameters" }),
+      headers: flag.input({
+        stdinName: "headers-stdin",
+        description: "Header patch JSON; use --headers-file or --headers-stdin for secrets",
+      }),
+      clearHeaders: flag.boolean({ name: "clear-headers", description: "Remove all configured extra headers before applying the patch" }),
+      yes: confirmFlag("Confirm model request settings change"),
+    },
+    async run({ ctx, flags }) {
+      if (!flags.yes) throw new Error("Model request settings changes require --yes.");
+      if (flags.thinkingLevel !== undefined && flags.clearThinkingLevel)
+        throw new Error("Choose --thinking-level or --clear-thinking-level.");
+      if (flags.extraBody.provided && flags.clearExtraBody) throw new Error("Choose --extra-body or --clear-extra-body.");
+      if (
+        !flags.extraBody.provided &&
+        !flags.headers.provided &&
+        flags.thinkingLevel === undefined &&
+        !flags.clearThinkingLevel &&
+        !flags.clearExtraBody &&
+        !flags.clearHeaders
+      )
+        throw new Error("Select at least one model request setting to change.");
+      if (flags.extraBody.source === "stdin" && flags.headers.source === "stdin")
+        throw new Error("Read one JSON input from stdin and supply the other from a file.");
+      const parseInput = async (input: typeof flags.headers, label: string): Promise<unknown> => {
+        const raw = await readCliInput(input, { required: true, label });
+        try {
+          return JSON.parse(raw!);
+        } catch {
+          throw new Error(`Invalid ${label} JSON.`);
+        }
+      };
+      const patch: Record<string, unknown> = {};
+      if (flags.thinkingLevel !== undefined || flags.clearThinkingLevel)
+        patch.reasoningEffort = flags.clearThinkingLevel ? null : flags.thinkingLevel;
+      if (flags.extraBody.provided || flags.clearExtraBody)
+        patch.extraBody = flags.clearExtraBody ? null : await parseInput(flags.extraBody, "extra parameters");
+      if (flags.headers.provided) patch.requestHeaders = await parseInput(flags.headers, "extra headers");
+      if (flags.clearHeaders) patch.clearRequestHeaders = true;
+      // Validate locally before reading the current revision or sending secrets.
+      const valid = AiModelRequestSettingsUpdateSchema.parse({ ...patch, expected: "pending" });
+      const current = await apiGet<AiModelRequestSettings>(ctx, `${path}/models/${encodeURIComponent(flags.id!)}/settings`);
+      print(
+        ctx,
+        AiModelRequestSettingsSchema.parse(
+          await apiJson(ctx, "PUT", `${path}/models/${encodeURIComponent(flags.id!)}/settings`, { ...valid, expected: current.revision }),
+        ),
+      );
+    },
+  }),
   command("ai models pricing get", {
     summary: "List configured model input/output reference prices per million tokens",
     async run({ ctx }) {

package/src/cli/admin/index.ts

@@ -25,6 +25,7 @@ import { logCommands } from "./logs";
 import { metricsCommands } from "./metrics";
 import { natsCommands } from "./nats";
 import { notificationCommands } from "./notifications";
+import { outgoingMailCommands } from "./outgoing-mail";
 import { syncCommands } from "./sync";
 import { telemetryCommands } from "./telemetry";
 import { webhookCommands } from "./webhooks";
@@ -38,6 +39,7 @@ export default defineCliCommands({
     ai: "Manage AI models, quotas, Skills, and usage.",
     "ai models": "Manage AI model configuration.",
     "ai models pricing": "Manage model reference prices.",
+    "ai models settings": "Manage model thinking levels, extra parameters, and extra headers.",
     "ai quotas background": "Inspect and release the background emergency stop.",
     "ai skills": "Inspect Assistant Skills and trusted templates.",
     "ai usage": "Inspect AI runs and usage facets.",
@@ -55,6 +57,11 @@ export default defineCliCommands({
     "nats consumers": "Inspect NATS consumers.",
     "nats streams": "Find NATS streams and buckets.",
     "notification-batches": "Manage account notification batches.",
+    "outgoing-mail": "Manage outgoing mail sender profiles, application access, and the send log.",
+    "outgoing-mail profiles": "Manage outgoing mail sender profiles.",
+    "outgoing-mail apps": "Manage application outgoing mail access.",
+    "outgoing-mail log": "Read and cancel application mail in the send log.",
+    "outgoing-mail retention": "Show or change how long the send log keeps mail.",
     notifications: "Inspect and resend email notifications.",
     postgres: "Inspect Postgres diagnostics.",
     redis: "Inspect Valkey diagnostics.",
@@ -96,6 +103,7 @@ export default defineCliCommands({
     ...workflowCommands,
     ...dataCommands,
     ...notificationCommands,
+    ...outgoingMailCommands,
     ...webhookCommands,
     ...metricsCommands,
     ...natsCommands,

package/src/cli/admin/notifications.ts

@@ -54,6 +54,8 @@ export type NotificationBatchRecipient = {
   profile: "user" | "guest";
   status: NotificationRecipientStatus;
   notificationId: string | null;
+  outgoingMailId: string | null;
+  outgoingMailStatus: string | null;
   error: string | null;
   attemptCount: number;
   sentAt: string | null;
@@ -370,6 +372,8 @@ export const notificationCommands = [
         provider: recipient.provider,
         profile: recipient.profile,
         attempts: recipient.attemptCount,
+        mailId: recipient.outgoingMailId ?? "",
+        mailStatus: recipient.outgoingMailStatus ?? "",
         error: truncate(recipient.error, 60),
         userId: recipient.userId,
       }));
@@ -381,6 +385,8 @@ export const notificationCommands = [
         { key: "provider" },
         { key: "profile" },
         { key: "attempts" },
+        { key: "mailId" },
+        { key: "mailStatus" },
         { key: "error" },
         { key: "userId" },
       ]);

package/src/cli/admin/outgoing-mail.ts

@@ -0,0 +1,215 @@
+import {
+  type AdminMailApp,
+  type AdminMailProfile,
+  type AdminMailRecord,
+  type MailPage,
+  MailProfileInputSchema,
+  type MailRetention,
+  MailRetentionSchema,
+} from "../../contracts/outgoing-mail";
+import { arg, type CloudCliContext, command, confirmFlag, flag, printStructured, readCliInput } from "../index";
+import { apiGet, apiJson, printJsonOrTable } from "./shared";
+
+const root = "/api/admin/core/outgoing-mail";
+const profilePath = (key: string) => `${root}/profiles/${encodeURIComponent(key)}`;
+const keyArgs = { key: arg.required({ valueLabel: "key" }) };
+const print = (ctx: CloudCliContext, value: unknown) => {
+  if (ctx.options.output === "json") ctx.json(value);
+  else ctx.print(JSON.stringify(value, null, 2));
+};
+const confirmed = (yes: boolean) => {
+  if (!yes) throw new Error("Outgoing mail policy changes require --yes.");
+};
+export const outgoingMailCommands = [
+  command("outgoing-mail retention show", {
+    summary: "Show outgoing mail retention in days",
+    async run({ ctx }) {
+      const result = await apiGet<MailRetention>(ctx, `${root}/retention`);
+      if (!printStructured(ctx, result)) print(ctx, result);
+    },
+  }),
+  command("outgoing-mail retention set", {
+    summary: "Set outgoing mail content and record retention",
+    flags: {
+      contentDays: flag.string({ required: true, description: "Content retention in days" }),
+      recordDays: flag.string({ required: true, description: "Record retention in days (at least content retention)" }),
+      yes: confirmFlag("Confirm changing outgoing mail retention"),
+    },
+    async run({ ctx, flags }) {
+      confirmed(flags.yes);
+      const retention = MailRetentionSchema.parse({ contentDays: Number(flags.contentDays), recordDays: Number(flags.recordDays) });
+      if (retention.recordDays < retention.contentDays) throw new Error("Record retention must be at least content retention.");
+      const result = await apiJson<MailRetention>(ctx, "PUT", `${root}/retention`, retention);
+      if (!printStructured(ctx, result)) print(ctx, result);
+    },
+  }),
+  command("outgoing-mail log list", {
+    summary: "List outgoing mail metadata",
+    flags: {
+      app: flag.string({ description: "Application ID" }),
+      profile: flag.string({ description: "Sender profile key" }),
+      status: flag.string({ description: "Comma-separated statuses" }),
+      since: flag.string({ description: "ISO timestamp" }),
+      ref: flag.string({ description: "Reference scope[:id]" }),
+      recipient: flag.string({ description: "Recipient substring" }),
+      cursor: flag.string({ description: "Next-page cursor" }),
+      limit: flag.int({ description: "Page size (1–100)" }),
+    },
+    async run({ ctx, flags }) {
+      if (flags.limit !== undefined && (!Number.isInteger(flags.limit) || flags.limit < 1 || flags.limit > 100))
+        throw new Error("--limit must be a whole number from 1 to 100.");
+      const query = new URLSearchParams();
+      for (const [key, value] of Object.entries(flags)) if (value !== undefined) query.set(key, String(value));
+      const result = await apiGet<MailPage<AdminMailRecord>>(ctx, `${root}/messages${query.size ? `?${query}` : ""}`);
+      printJsonOrTable(ctx, result, result.items, [
+        { key: "id" },
+        { key: "appId" },
+        { key: "profile" },
+        { key: "status" },
+        { key: "createdAt" },
+      ]);
+      if (ctx.options.output === "text" && result.nextCursor) ctx.print(`Next cursor: ${result.nextCursor}`);
+    },
+  }),
+  command("outgoing-mail log show", {
+    summary: "Read outgoing mail metadata, or audited content",
+    args: { id: arg.required({ valueLabel: "id" }) },
+    flags: { content: flag.boolean({ description: "Read message content (audited)" }) },
+    async run({ ctx, args, flags }) {
+      print(ctx, await apiGet(ctx, `${root}/messages/${encodeURIComponent(args.id)}${flags.content ? "/content" : ""}`));
+    },
+  }),
+  command("outgoing-mail log cancel", {
+    summary: "Cancel queued outgoing mail",
+    args: { id: arg.optional({ valueLabel: "id" }) },
+    flags: {
+      batch: flag.string({ description: "Cancel queued messages in this batch instead of one ID" }),
+      yes: confirmFlag("Confirm cancelling queued outgoing mail"),
+    },
+    async run({ ctx, args, flags }) {
+      if (!flags.yes) throw new Error("Cancelling outgoing mail requires --yes.");
+      if ((args.id !== undefined) === (flags.batch !== undefined)) throw new Error("Choose exactly one message ID or --batch <batchId>.");
+      const path = flags.batch !== undefined ? `batches/${encodeURIComponent(flags.batch)}` : `messages/${encodeURIComponent(args.id!)}`;
+      print(ctx, await apiJson(ctx, "POST", `${root}/${path}/cancel`));
+    },
+  }),
+  command("outgoing-mail profiles list", {
+    summary: "List outgoing mail sender profiles",
+    async run({ ctx }) {
+      const result = await apiGet<{ items: AdminMailProfile[] }>(ctx, `${root}/profiles`);
+      printJsonOrTable(
+        ctx,
+        result,
+        result.items.map((p) => ({
+          key: p.key,
+          name: p.name,
+          from: p.fromAddress,
+          default: p.isDefault,
+          revision: p.revision,
+          imap: p.imap ? `${p.imap.host}/${p.imap.folder}` : "off",
+          bounces: p.bounces ? (p.bounces.error ?? p.bounces.checkedAt ?? "pending") : "off",
+        })),
+        [{ key: "key" }, { key: "name" }, { key: "from" }, { key: "default" }, { key: "revision" }, { key: "imap" }, { key: "bounces" }],
+      );
+    },
+  }),
+  command("outgoing-mail profiles get", {
+    summary: "Read one outgoing mail sender profile",
+    args: keyArgs,
+    async run({ ctx, args }) {
+      const profile = await apiGet<AdminMailProfile>(ctx, profilePath(args.key));
+      print(ctx, profile);
+      if (ctx.options.output === "text")
+        ctx.print(`Bounces: ${profile.bounces ? (profile.bounces.error ?? profile.bounces.checkedAt ?? "pending") : "off"}`);
+    },
+  }),
+  command("outgoing-mail profiles put", {
+    summary: "Create or replace a sender profile with its current revision",
+    args: keyArgs,
+    flags: {
+      config: flag.input({ required: true, description: "Profile JSON; SMTP and IMAP passwords only via --config-file or --stdin" }),
+    },
+    async run({ ctx, args, flags }) {
+      const input = await readCliInput(flags.config, { label: "outgoing mail profile", required: true });
+      let raw: unknown;
+      try {
+        raw = JSON.parse(input ?? "");
+      } catch {
+        throw new Error("Invalid outgoing mail profile JSON.");
+      }
+      if (flags.config.source === "value" && raw && typeof raw === "object" && "smtpPassword" in raw)
+        throw new Error("Pass smtpPassword only through --config-file or --stdin.");
+      const parsed = MailProfileInputSchema.safeParse(raw);
+      if (!parsed.success) throw new Error("Invalid outgoing mail profile configuration.");
+      if (flags.config.source === "value" && parsed.data.imap && "password" in parsed.data.imap)
+        throw new Error("Pass imap.password only through --config-file or --stdin.");
+      print(ctx, await apiJson(ctx, "PUT", profilePath(args.key), parsed.data));
+    },
+  }),
+  command("outgoing-mail profiles set-default", {
+    summary: "Choose the default outgoing mail sender",
+    args: keyArgs,
+    flags: { yes: confirmFlag("Confirm changing the default sender") },
+    async run({ ctx, args, flags }) {
+      confirmed(flags.yes);
+      print(ctx, await apiJson(ctx, "POST", `${profilePath(args.key)}/default`));
+    },
+  }),
+  command("outgoing-mail profiles delete", {
+    summary: "Delete a sender profile that is not the default",
+    args: keyArgs,
+    flags: { yes: confirmFlag("Confirm deleting the sender profile") },
+    async run({ ctx, args, flags }) {
+      confirmed(flags.yes);
+      const response = await ctx.fetch(profilePath(args.key), { method: "DELETE" });
+      if (!response.ok) await ctx.readJson(response);
+      print(ctx, { deleted: args.key });
+    },
+  }),
+  command("outgoing-mail profiles test", {
+    summary: "Send a test email through a sender profile",
+    args: keyArgs,
+    flags: { to: flag.string({ required: true, description: "Recipient email address" }) },
+    async run({ ctx, args, flags }) {
+      print(ctx, await apiJson(ctx, "POST", `${profilePath(args.key)}/test`, { recipient: flags.to }));
+    },
+  }),
+  command("outgoing-mail apps list", {
+    summary: "List application outgoing mail permissions and profile access",
+    async run({ ctx }) {
+      const result = await apiGet<{ defaultProfile: string | null; items: AdminMailApp[] }>(ctx, `${root}/apps`);
+      printJsonOrTable(
+        ctx,
+        result,
+        result.items.map((app) => ({ ...app, profiles: app.profiles.join(",") })),
+        [{ key: "appId" }, { key: "name" }, { key: "declared" }, { key: "mode" }, { key: "profiles" }],
+      );
+    },
+  }),
+  command("outgoing-mail apps set", {
+    summary: "Set default, selected, or blocked outgoing mail access",
+    args: { app: arg.required({ valueLabel: "app" }) },
+    flags: {
+      default: flag.boolean({ description: "Use the default sender" }),
+      profiles: flag.string({ description: "Comma-separated profile keys" }),
+      none: flag.boolean({ description: "Block sending with an empty selected list" }),
+      yes: confirmFlag("Confirm application outgoing mail access change"),
+    },
+    async run({ ctx, args, flags }) {
+      confirmed(flags.yes);
+      if ([flags.default, flags.none, flags.profiles !== undefined].filter(Boolean).length !== 1)
+        throw new Error("Choose exactly one of --default, --profiles or --none.");
+      const profiles = flags.profiles?.split(",").map((key) => key.trim());
+      if (profiles?.some((key) => !key)) throw new Error("--profiles requires non-empty profile keys; use --none to block sending.");
+      print(
+        ctx,
+        await apiJson(
+          ctx,
+          "PUT",
+          `${root}/apps/${encodeURIComponent(args.app)}`,
+          flags.default ? { mode: "default" } : { mode: "selected", profiles: profiles ?? [] },
+        ),
+      );
+    },
+  }),
+];