@novacraft-engineering/mailbox 0.4.4 → 0.4.5

package/app/api/mail/accessors/reset-link/route.ts

@@ -0,0 +1,46 @@
+import { randomBytes } from 'node:crypto'
+import { NextResponse } from 'next/server'
+import { mailAuthGuard, resolveAccount } from '@/lib/dev-auth'
+import { createResetToken, getAccount } from '@/lib/mailbox'
+import { publicOrigin } from '@/lib/public-url'
+import { clientKey, rateLimit } from '@/lib/rate-limit'
+
+export const runtime = 'nodejs'
+
+const RESET_TTL_MS = 30 * 60 * 1000
+
+/**
+ * The way out of the loop for somebody with no recovery address: an admin, who can already
+ * read every mailbox here, mints the link and hands it over. Nothing is emailed — the point
+ * is that this person cannot receive email.
+ */
+export async function POST(req: Request) {
+  const guard = await mailAuthGuard(req)
+  if (guard) return guard
+  const actor = await resolveAccount(req)
+  if (actor.role !== 'admin') {
+    return NextResponse.json({ ok: false, error: 'Admin access required' }, { status: 403 })
+  }
+  const limited = rateLimit(clientKey(req, 'reset-link'), 20, 60 * 60 * 1000)
+  if (limited) return limited
+
+  let body: { email?: string }
+  try {
+    body = await req.json()
+  } catch {
+    return NextResponse.json({ ok: false, error: 'Invalid JSON' }, { status: 400 })
+  }
+
+  const email = (body.email ?? '').trim().toLowerCase()
+  const account = email ? await getAccount(email) : null
+  if (!account) return NextResponse.json({ ok: false, error: 'No such account' }, { status: 404 })
+
+  const token = randomBytes(32).toString('hex')
+  await createResetToken(email, token, Date.now() + RESET_TTL_MS)
+  return NextResponse.json({
+    ok: true,
+    email,
+    url: `${publicOrigin(req)}/mail/reset?token=${token}`,
+    expiresInMinutes: RESET_TTL_MS / 60000,
+  })
+}

package/app/api/mail/accessors/route.ts

@@ -91,6 +91,22 @@ export async function POST(req: Request) {
   if (existing && existing.status === 'active') {
     return NextResponse.json({ ok: false, error: 'That person already has an account' }, { status: 409 })
   }
+  if (email === inviter.email || email === inviter.address) {
+    return NextResponse.json({ ok: false, error: 'That is your own address' }, { status: 400 })
+  }
+  // An invite has to reach somebody. Sending it to a mailbox on our own domain that nobody
+  // can open yet — the very address this invite would create, most often — posts the link
+  // into a box only the new person could read once they had already accepted it.
+  const inviteeDomain = email.split('@')[1] ?? ''
+  if (ADDRESS_DOMAINS.includes(inviteeDomain)) {
+    const holder = await getAccountByAddress(email)
+    if (!holder || holder.status !== 'active') {
+      return NextResponse.json(
+        { ok: false, error: `Nobody can read ${email} yet. Send the invite to an address they already have.` },
+        { status: 400 },
+      )
+    }
+  }
 
   const role: MailRole = body.role === 'admin' ? 'admin' : 'member'
   const name = body.name?.trim() || null

package/app/api/mail/emails/[id]/route.ts

@@ -59,7 +59,7 @@ export async function GET(req: Request, { params }: { params: Promise<{ id: stri
   if (id.startsWith('mbox-') || !resend) {
     const archived = await fromArchive(id)
     if (archived) return archived
-    return NextResponse.json({ ok: false, error: resend ? 'Not found' : 'RESEND_API_KEY not configured' }, { status: resend ? 404 : 500 })
+    return NextResponse.json({ ok: false, error: 'Not found' }, { status: 404 })
   }
 
   const { data, error } = await resend.emails.get(id)
@@ -102,7 +102,11 @@ export async function PATCH(req: Request, { params }: { params: Promise<{ id: st
   const guard = await mailAuthGuard(req)
   if (guard) return guard
   const resend = getResend()
-  if (!resend) return NextResponse.json({ ok: false, error: 'RESEND_API_KEY not configured' }, { status: 500 })
+  // Rescheduling and cancelling live in Resend's API; there is no equivalent to call on
+  // another provider, so this is a missing feature rather than a missing key.
+  if (!resend) {
+    return NextResponse.json({ ok: false, error: 'Scheduled mail can only be changed on the Resend provider' }, { status: 501 })
+  }
 
   const { id } = await params
   if (!(await mayReadSent(await resolveAccount(req), id))) return NextResponse.json({ ok: false, error: 'Not found' }, { status: 404 })
@@ -125,7 +129,11 @@ export async function DELETE(req: Request, { params }: { params: Promise<{ id: s
   const guard = await mailAuthGuard(req)
   if (guard) return guard
   const resend = getResend()
-  if (!resend) return NextResponse.json({ ok: false, error: 'RESEND_API_KEY not configured' }, { status: 500 })
+  // Rescheduling and cancelling live in Resend's API; there is no equivalent to call on
+  // another provider, so this is a missing feature rather than a missing key.
+  if (!resend) {
+    return NextResponse.json({ ok: false, error: 'Scheduled mail can only be changed on the Resend provider' }, { status: 501 })
+  }
 
   const { id } = await params
   if (!(await mayReadSent(await resolveAccount(req), id))) return NextResponse.json({ ok: false, error: 'Not found' }, { status: 404 })

package/app/api/mail/emails/route.ts

@@ -48,6 +48,8 @@ export async function GET(req: Request) {
     sharedAddress: SHARED_ADDRESS,
     query,
     limit: query ? SEARCH_LIMIT : 500,
+    // Automated sends are shown rather than hidden, tagged so the list can say so.
+    includeAuto: true,
   }).catch(() => [])
   const [flags, opens, sentMeta, accounts] = await Promise.all([
     readSentFlags().catch(() => ({})),
@@ -85,15 +87,23 @@ export async function GET(req: Request) {
     return accountAddresses.has(from) ? from : SHARED_ADDRESS
   }
 
+  const isAutomated = (email: SentEmail): boolean => {
+    const meta = metaMap[email.id]
+    // Sends that predate the tagging carry no meta row, so they are still read by shape.
+    return meta ? meta.isAuto : looksAutomated(email)
+  }
+
   const emails = all
     .filter(email => {
-      const meta = metaMap[email.id]
-      if (meta?.isAuto) return false // tagged automated → never in Sent
-      if (!meta && looksAutomated(email)) return false // pre-existing automated → excluded
       if (ownerScope) return sentOwner(email) === ownerScope
       return true
     })
-    .map(email => ({ ...email, owner: sentOwner(email), inReplyTo: metaMap[email.id]?.inReplyTo ?? null }))
+    .map(email => ({
+      ...email,
+      owner: sentOwner(email),
+      inReplyTo: metaMap[email.id]?.inReplyTo ?? null,
+      isAuto: isAutomated(email),
+    }))
     .filter(email =>
       !query ||
       matchesQuery(query, {

package/app/api/mail/recovery/route.ts

@@ -0,0 +1,95 @@
+import { BRAND, ADDRESS_DOMAINS } from '@/lib/brand'
+import { randomBytes } from 'node:crypto'
+import { NextResponse } from 'next/server'
+import { mailAuthGuard, resolveAccount } from '@/lib/dev-auth'
+import { createResetToken, getAccount, recordSentMeta, setRecoveryEmail } from '@/lib/mailbox'
+import { sendMail } from '@/lib/mail-provider'
+import { renderActionEmail } from '@/lib/emails'
+import { publicOrigin } from '@/lib/public-url'
+import { clientKey, rateLimit } from '@/lib/rate-limit'
+
+export const runtime = 'nodejs'
+
+const VERIFY_TTL_MS = 24 * 60 * 60 * 1000
+
+export async function GET(req: Request) {
+  const guard = await mailAuthGuard(req)
+  if (guard) return guard
+  const identity = await resolveAccount(req)
+  const account = await getAccount(identity.email)
+  return NextResponse.json({
+    ok: true,
+    recoveryEmail: account?.recoveryEmail ?? null,
+    verified: Boolean(account?.recoveryVerified),
+  })
+}
+
+export async function POST(req: Request) {
+  const guard = await mailAuthGuard(req)
+  if (guard) return guard
+  const identity = await resolveAccount(req)
+  if (!identity.email) return NextResponse.json({ ok: false, error: 'Authentication required' }, { status: 403 })
+
+  const limited = rateLimit(clientKey(req, `recovery:${identity.email}`), 6, 60 * 60 * 1000)
+  if (limited) return limited
+
+  let body: { recovery?: string | null }
+  try {
+    body = await req.json()
+  } catch {
+    return NextResponse.json({ ok: false, error: 'Invalid JSON' }, { status: 400 })
+  }
+
+  const recovery = (body.recovery ?? '').trim().toLowerCase()
+  if (!recovery) {
+    await setRecoveryEmail(identity.email, null)
+    return NextResponse.json({ ok: true, recoveryEmail: null, verified: false })
+  }
+  if (!/^[^@\s]+@[^@\s.]+\.[^@\s]+$/.test(recovery)) {
+    return NextResponse.json({ ok: false, error: 'That is not an email address we can send to.' }, { status: 400 })
+  }
+  // A recovery address inside the mailbox it recovers is no recovery at all: the reset
+  // link would land in the inbox the person cannot open.
+  if (ADDRESS_DOMAINS.includes(recovery.split('@')[1] ?? '')) {
+    return NextResponse.json(
+      { ok: false, error: `Use an address outside ${BRAND.name} Mail — a locked mailbox cannot receive its own reset link.` },
+      { status: 400 },
+    )
+  }
+
+  await setRecoveryEmail(identity.email, recovery)
+
+  const token = randomBytes(32).toString('hex')
+  await createResetToken(identity.email, token, Date.now() + VERIFY_TTL_MS, 'verify-recovery')
+  const verifyUrl = `${publicOrigin(req)}/api/mail/recovery/verify?token=${token}`
+  const from = (process.env.MAIL_FROM ?? process.env.RESEND_FROM ?? BRAND.supportEmail).replace(/^.*<|>$/g, '').trim()
+
+  try {
+    const { id } = await sendMail({
+      from,
+      fromName: `${BRAND.name} Mail`,
+      to: [recovery],
+      subject: `Confirm this address for ${BRAND.name} Mail recovery`,
+      text: `${identity.email} listed this address as the recovery address for their ${BRAND.name} Mail account.\n\nConfirm it: ${verifyUrl}\n\nThe link expires in 24 hours. Until it is used, no reset can be sent here.`,
+      html: renderActionEmail({
+        eyebrow: `${BRAND.name} · Mail`,
+        accent: BRAND.colors.accent,
+        title: 'Confirm your recovery address',
+        body: `${identity.email} listed this address as where password resets for their ${BRAND.name} Mail account should go. Confirm it and it becomes the only place a reset link is sent.`,
+        actionLabel: 'Confirm this address',
+        actionUrl: verifyUrl,
+        expiry: 'This link expires in 24 hours.',
+        footer: "Didn't expect this? Ignore it — nothing is sent here until the link is used.",
+      }),
+    })
+    if (id) await recordSentMeta(id, null, true).catch(() => {})
+  } catch (err) {
+    console.error('[mail] recovery verification email failed:', err)
+    return NextResponse.json(
+      { ok: false, error: 'Saved, but the confirmation email could not be sent', recoveryEmail: recovery, verified: false },
+      { status: 502 },
+    )
+  }
+
+  return NextResponse.json({ ok: true, recoveryEmail: recovery, verified: false })
+}

package/app/api/mail/recovery/verify/route.ts

@@ -0,0 +1,29 @@
+import { NextResponse } from 'next/server'
+import { consumeToken, getAccount, markRecoveryVerified } from '@/lib/mailbox'
+import { publicOrigin } from '@/lib/public-url'
+import { clientKey, rateLimit } from '@/lib/rate-limit'
+
+export const runtime = 'nodejs'
+export const dynamic = 'force-dynamic'
+
+/**
+ * Opened from the recovery inbox itself, so proving the address is the whole point and no
+ * session is required. It only flips a flag: the token cannot set a password.
+ */
+export async function GET(req: Request) {
+  const limited = rateLimit(clientKey(req, 'verify-recovery'), 20, 15 * 60 * 1000)
+  if (limited) return limited
+
+  const token = new URL(req.url).searchParams.get('token')?.trim() ?? ''
+  const home = `${publicOrigin(req)}/mail`
+  if (!token) return NextResponse.redirect(`${home}?recovery=invalid`, 303)
+
+  const email = await consumeToken(token, 'verify-recovery')
+  if (!email) return NextResponse.redirect(`${home}?recovery=invalid`, 303)
+
+  const account = await getAccount(email)
+  if (!account?.recoveryEmail) return NextResponse.redirect(`${home}?recovery=invalid`, 303)
+
+  const done = await markRecoveryVerified(email, account.recoveryEmail)
+  return NextResponse.redirect(`${home}?recovery=${done ? 'verified' : 'invalid'}`, 303)
+}

package/app/api/mail/request-reset/route.ts

@@ -1,8 +1,8 @@
-import { BRAND } from '@/lib/brand'
+import { BRAND, ADDRESS_DOMAINS } from '@/lib/brand'
 import { randomBytes } from 'node:crypto'
 import { NextResponse } from 'next/server'
 import { isMailAccount } from '@/lib/dev-auth'
-import { createResetToken, recordSentMeta } from '@/lib/mailbox'
+import { createResetToken, getAccount, recordSentMeta } from '@/lib/mailbox'
 import { sendMail } from '@/lib/mail-provider'
 import { renderActionEmail } from '@/lib/emails'
 import { publicOrigin } from '@/lib/public-url'
@@ -12,6 +12,18 @@ export const runtime = 'nodejs'
 
 const RESET_TTL_MS = 30 * 60 * 1000
 
+/** j••••@outlook.com — enough to recognise the inbox, not enough to learn it. */
+function mask(address: string): string {
+  const [local, domain] = address.split('@')
+  if (!domain) return address
+  return `${local.slice(0, 1)}${'•'.repeat(Math.max(3, local.length - 1))}@${domain}`
+}
+
+/** Nothing can be mailed to an address this deployment itself hosts and has locked. */
+const isOurOwn = (address: string) => ADDRESS_DOMAINS.includes(address.split('@')[1] ?? '')
+
+const ASK_ADMIN = 'No confirmed recovery address is set for that mailbox. Ask an administrator on your company mailbox to reset it for you.'
+
 export async function POST(req: Request) {
   const limited = rateLimit(clientKey(req, 'request-reset'), 5, 60 * 60 * 1000)
   if (limited) return limited
@@ -28,9 +40,25 @@ export async function POST(req: Request) {
   // Also capped per address, so a rotating-IP caller cannot bury someone in reset mail.
   const perAddress = rateLimit(`request-reset-address:${email}`, 5, 60 * 60 * 1000)
   if (perAddress) return NextResponse.json({ ok: true })
-  // Always answer ok so we never reveal which addresses are valid accounts.
+  // An unknown address gets the same answer as a known one with nowhere to send, so the
+  // reply still cannot be used to learn who has a mailbox here.
   if (!(await isMailAccount(email))) {
-    return NextResponse.json({ ok: true })
+    return NextResponse.json({ ok: true, needsAdmin: true, message: ASK_ADMIN })
+  }
+
+  // Where the link can actually be read: the confirmed recovery address first, else the
+  // sign-in address when that is somewhere else already. An address inside this mailbox
+  // is no use — it is the thing being recovered.
+  const account = await getAccount(email)
+  const destination =
+    account?.recoveryVerified && account.recoveryEmail
+      ? account.recoveryEmail
+      : !isOurOwn(email)
+        ? email
+        : null
+
+  if (!destination) {
+    return NextResponse.json({ ok: true, needsAdmin: true, message: ASK_ADMIN })
   }
 
   const token = randomBytes(32).toString('hex')
@@ -44,14 +72,14 @@ export async function POST(req: Request) {
     const { id } = await sendMail({
       from,
       fromName: `${BRAND.name} Mail`,
-      to: [email],
+      to: [destination],
       subject: `Reset your ${BRAND.name} Mail password`,
-      text: `Someone requested a password reset for ${BRAND.name} Mail.\n\nSet a new password: ${resetUrl}\n\nThis link expires in 30 minutes. If you didn't request it, ignore this email — your password won't change.`,
+      text: `Someone requested a password reset for ${email} on ${BRAND.name} Mail.\n\nSet a new password: ${resetUrl}\n\nThis link expires in 30 minutes. If you didn't request it, ignore this email — your password won't change.`,
       html: renderActionEmail({
         eyebrow: `${BRAND.name} · Mail`,
         accent: BRAND.colors.accent,
         title: 'Reset your password',
-        body: `Someone asked to reset the password for your ${BRAND.name} Mail account. Choose a new one below.`,
+        body: `Someone asked to reset the password for ${email} on ${BRAND.name} Mail. Choose a new one below.`,
         actionLabel: 'Set a new password',
         actionUrl: resetUrl,
         expiry: 'This link expires in 30 minutes and can be used once.',
@@ -65,5 +93,5 @@ export async function POST(req: Request) {
     return NextResponse.json({ ok: false, error: 'Could not send the reset email' }, { status: 502 })
   }
 
-  return NextResponse.json({ ok: true })
+  return NextResponse.json({ ok: true, message: `Reset link sent to ${mask(destination)}.` })
 }

package/app/api/mail/send/route.ts

@@ -1,7 +1,7 @@
 import { BRAND } from '@/lib/brand'
 import { randomUUID } from 'node:crypto'
 import { NextResponse } from 'next/server'
-import { sendMail } from '@/lib/mail-provider'
+import { providerConfigProblem, sendMail } from '@/lib/mail-provider'
 import { mailAuthGuard, resolveAccount } from '@/lib/dev-auth'
 import { presign } from '@/lib/r2'
 import { recordContact, recordPixel, recordSentMeta, recordSentMessage } from '@/lib/mailbox'
@@ -31,9 +31,9 @@ export async function POST(req: Request) {
 
   const account = await resolveAccount(req)
 
-  const apiKey = process.env.RESEND_API_KEY
-  if (!apiKey) {
-    return NextResponse.json({ ok: false, error: 'RESEND_API_KEY not configured' }, { status: 500 })
+  const configProblem = providerConfigProblem()
+  if (configProblem) {
+    return NextResponse.json({ ok: false, error: configProblem }, { status: 500 })
   }
 
   let body: SendBody

package/app/api/share/[id]/download/route.ts

@@ -0,0 +1,71 @@
+import { NextResponse } from 'next/server'
+import { getShare } from '@/lib/mailbox'
+import { getObject, objectExists } from '@/lib/r2'
+import { shareTicketValid } from '@/lib/share-ticket'
+
+export const runtime = 'nodejs'
+export const dynamic = 'force-dynamic'
+
+const GONE = { ok: false as const, error: 'This link is no longer available.' }
+
+/**
+ * The bytes of a shared file, served from this domain.
+ *
+ * The share page used to send the browser to a signed bucket URL. That is a second
+ * hostname for the recipient's network to resolve and reach, and on the networks this
+ * office deals with it sometimes cannot be — which looked exactly like a dead button,
+ * because a failed navigation reports nothing back to the page it left. Every other
+ * attachment in this product is already served from here; this one now is too.
+ */
+async function resolve(id: string, ticket: string | null) {
+  if (!shareTicketValid(ticket, id)) return { error: NextResponse.json(GONE, { status: 403 }) }
+  const share = await getShare(id)
+  if (!share || share.revoked) return { error: NextResponse.json(GONE, { status: 404 }) }
+  if (share.expiresAt && new Date(share.expiresAt) < new Date()) {
+    return { error: NextResponse.json(GONE, { status: 410 }) }
+  }
+  return { share }
+}
+
+function disposition(filename: string): string {
+  const plain = filename.replace(/["\\]/g, '')
+  return `attachment; filename="${plain}"; filename*=UTF-8''${encodeURIComponent(filename)}`
+}
+
+/** Lets the page check the file is reachable before it sends the reader away from it. */
+export async function HEAD(req: Request, context: { params: Promise<{ id: string }> }) {
+  const { id } = await context.params
+  const { share, error } = await resolve(id, new URL(req.url).searchParams.get('t'))
+  if (error) return error
+  if (!(await objectExists(share.objectKey))) return NextResponse.json(GONE, { status: 410 })
+  return new Response(null, {
+    headers: {
+      'content-type': share.contentType || 'application/octet-stream',
+      'content-length': String(share.size),
+      'content-disposition': disposition(share.filename),
+    },
+  })
+}
+
+export async function GET(req: Request, context: { params: Promise<{ id: string }> }) {
+  const { id } = await context.params
+  const { share, error } = await resolve(id, new URL(req.url).searchParams.get('t'))
+  if (error) return error
+
+  const object = await getObject(share.objectKey)
+  if (!object?.body) {
+    return NextResponse.json(
+      { ok: false, error: 'This file is no longer stored. Ask whoever sent it to upload it again.' },
+      { status: 410 },
+    )
+  }
+  const length = object.headers.get('content-length')
+  return new Response(object.body, {
+    headers: {
+      'content-type': share.contentType || object.headers.get('content-type') || 'application/octet-stream',
+      'content-disposition': disposition(share.filename),
+      ...(length ? { 'content-length': length } : {}),
+      'cache-control': 'private, no-store',
+    },
+  })
+}

package/app/api/share/[id]/route.ts

@@ -1,8 +1,9 @@
 import { NextResponse } from 'next/server'
 import { getShare, getSharePasswordHash, recordShareDownload } from '@/lib/mailbox'
 import { verifyPassword } from '@/lib/password'
-import { objectExists, presign } from '@/lib/r2'
+import { objectExists } from '@/lib/r2'
 import { clientKey, rateLimit } from '@/lib/rate-limit'
+import { issueShareTicket } from '@/lib/share-ticket'
 
 export const runtime = 'nodejs'
 export const dynamic = 'force-dynamic'
@@ -37,7 +38,7 @@ export async function GET(_req: Request, context: { params: Promise<{ id: string
   })
 }
 
-/** Exchanges the password for a short-lived signed URL to the object itself. */
+/** Exchanges the password for a short-lived link to the bytes, served from this domain. */
 export async function POST(req: Request, context: { params: Promise<{ id: string }> }) {
   const { id } = await context.params
 
@@ -77,9 +78,13 @@ export async function POST(req: Request, context: { params: Promise<{ id: string
   }
 
   await recordShareDownload(id)
-  // Two minutes: long enough to start the download, too short to pass around.
-  const url = presign(share.objectKey, 'GET', 120, {
-    'response-content-disposition': `attachment; filename="${share.filename.replace(/"/g, '')}"`,
-  })
+  // Served from this domain rather than the bucket: the bucket is a second hostname for
+  // the recipient's network to reach, and when it cannot the download silently never
+  // starts. The ticket carries the password decision the short distance to the bytes.
+  const ticket = issueShareTicket(id)
+  if (!ticket) {
+    return NextResponse.json({ ok: false, error: 'Downloads are not configured.' }, { status: 503 })
+  }
+  const url = `/api/share/${encodeURIComponent(id)}/download?t=${encodeURIComponent(ticket)}`
   return NextResponse.json({ ok: true, url, filename: share.filename })
 }

package/app/mail/ConfirmDialog.tsx

@@ -11,40 +11,64 @@ export type ConfirmRequest = {
   cancelLabel?: string
   /** Paints the confirm button as destructive. */
   danger?: boolean
+  /** Asks for a value as well, replacing window.prompt. */
+  field?: { label: string; type?: 'text' | 'password'; placeholder?: string; initial?: string }
 }
 
-type Pending = ConfirmRequest & { resolve: (value: boolean) => void }
+type Settled = { ok: boolean; value: string }
+type Pending = ConfirmRequest & { resolve: (value: Settled) => void }
 
-const ConfirmContext = createContext<(request: ConfirmRequest) => Promise<boolean>>(async () => false)
+const ConfirmContext = createContext<(request: ConfirmRequest) => Promise<Settled>>(async () => ({ ok: false, value: '' }))
 
 /** Replaces window.confirm, which cannot be styled and looks like the browser, not the app. */
 export function useConfirm() {
-  return useContext(ConfirmContext)
+  const ask = useContext(ConfirmContext)
+  return useCallback(async (request: ConfirmRequest) => (await ask(request)).ok, [ask])
+}
+
+/** Replaces window.prompt. Resolves to null when dismissed, so a blank answer stays meaningful. */
+export function usePrompt() {
+  const ask = useContext(ConfirmContext)
+  return useCallback(
+    async (request: ConfirmRequest & { field: NonNullable<ConfirmRequest['field']> }) => {
+      const settled = await ask(request)
+      return settled.ok ? settled.value : null
+    },
+    [ask],
+  )
 }
 
 export function ConfirmProvider({ children }: { children: ReactNode }) {
   const [pending, setPending] = useState<Pending | null>(null)
+  const [draft, setDraft] = useState('')
+  const [reveal, setReveal] = useState(false)
   const confirmRef = useRef<HTMLButtonElement>(null)
+  const fieldRef = useRef<HTMLInputElement>(null)
 
   const confirm = useCallback(
-    (request: ConfirmRequest) => new Promise<boolean>(resolve => setPending({ ...request, resolve })),
+    (request: ConfirmRequest) => new Promise<Settled>(resolve => {
+      setDraft(request.field?.initial ?? '')
+      setReveal(false)
+      setPending({ ...request, resolve })
+    }),
     [],
   )
 
   const settle = useCallback(
-    (value: boolean) => {
+    (ok: boolean) => {
       setPending(current => {
-        current?.resolve(value)
+        current?.resolve({ ok, value: draft })
         return null
       })
     },
-    [],
+    [draft],
   )
 
   // Escape cancels and Enter confirms, matching what the native dialog did.
   useEffect(() => {
     if (!pending) return
-    confirmRef.current?.focus()
+    if (pending.field) fieldRef.current?.focus()
+    else confirmRef.current?.focus()
     const onKey = (event: KeyboardEvent) => {
       if (event.key === 'Escape') { event.preventDefault(); settle(false) }
       if (event.key === 'Enter') { event.preventDefault(); settle(true) }
@@ -67,6 +91,27 @@ export function ConfirmProvider({ children }: { children: ReactNode }) {
           >
             <p className={styles.confirmTitle}>{pending.title}</p>
             {pending.body && <div className={styles.confirmBody}>{pending.body}</div>}
+            {pending.field && (
+              <label className={styles.confirmField}>
+                <span>{pending.field.label}</span>
+                <div className={styles.pwWrap}>
+                  <input
+                    ref={fieldRef}
+                    className={styles.confirmInput}
+                    type={pending.field.type === 'password' && !reveal ? 'password' : 'text'}
+                    autoComplete={pending.field.type === 'password' ? 'new-password' : 'off'}
+                    placeholder={pending.field.placeholder}
+                    value={draft}
+                    onChange={event => setDraft(event.target.value)}
+                  />
+                  {pending.field.type === 'password' && (
+                    <button type="button" className={styles.pwToggle} onClick={() => setReveal(show => !show)}>
+                      {reveal ? 'Hide' : 'Show'}
+                    </button>
+                  )}
+                </div>
+              </label>
+            )}
             <div className={styles.confirmActions}>
               <button type="button" className={styles.confirmCancel} onClick={() => settle(false)}>
                 {pending.cancelLabel ?? 'Cancel'}

package/app/mail/page.module.css

@@ -1007,6 +1007,7 @@
 .chipDelivered { color: var(--nc-success); border-color: rgba(52,211,153,.3); }
 .chipBounced { color: var(--nc-danger); border-color: color-mix(in srgb, var(--nc-danger) 30%, transparent); }
 .chipDraft { color: var(--nc-violet-200); border-color: rgba(165,120,255,.3); }
+.chipAuto { color: var(--nc-fg-3); border-color: var(--nc-line-2); }
 
 .emptyList {
   display: flex;
@@ -5395,6 +5396,32 @@
   word-break: break-word;
 }
 
+.confirmField {
+  display: flex;
+  flex-direction: column;
+  gap: 6px;
+  margin-top: 14px;
+}
+
+.confirmField > span {
+  font: 500 12.5px/1.4 var(--nc-font-sans);
+  color: var(--nc-fg-2);
+}
+
+.confirmField .pwWrap { width: 100%; }
+
+.confirmInput {
+  width: 100%;
+  padding: 10px 12px;
+  border: 1px solid var(--nc-line-1);
+  border-radius: 10px;
+  background: var(--nc-ink-1);
+  color: var(--nc-fg-1);
+  font: 400 14px/1.4 var(--nc-font-sans);
+}
+
+.confirmInput:focus { border-color: var(--nc-violet-400); outline: none; }
+
 .confirmActions {
   display: flex;
   justify-content: flex-end;
@@ -7007,3 +7034,35 @@
     width: auto;
   }
 }
+
+
+/* ── Field-level validation ─────────────────────────────────────────────── */
+/* Shake stays on transform so it composites; the ring is a box-shadow rather
+   than a border so the field does not reflow by a pixel when it errors. */
+@keyframes ncFieldShake {
+  0%, 100% { transform: translate3d(0, 0, 0); }
+  15%      { transform: translate3d(-5px, 0, 0); }
+  30%      { transform: translate3d(4px, 0, 0); }
+  45%      { transform: translate3d(-3px, 0, 0); }
+  60%      { transform: translate3d(2px, 0, 0); }
+  80%      { transform: translate3d(-1px, 0, 0); }
+}
+
+.fieldBad,
+.fieldBad input {
+  border-color: var(--nc-danger) !important;
+  box-shadow: 0 0 0 1px var(--nc-danger);
+}
+.fieldBad {
+  animation: ncFieldShake .4s cubic-bezier(.36, .07, .19, .97) both;
+  will-change: transform;
+}
+.msgBad {
+  color: var(--nc-danger);
+  animation: ncFieldShake .4s cubic-bezier(.36, .07, .19, .97) both;
+}
+
+@media (prefers-reduced-motion: reduce) {
+  .fieldBad,
+  .msgBad { animation: none; }
+}