@remit/api-openapi-spec 0.0.36 → 0.0.38

package/openapi.json

@@ -1413,18 +1413,69 @@
         }
       }
     },
-    "/config": {
+    "/calendar-events": {
       "get": {
-        "operationId": "ConfigOperations_getConfig",
-        "description": "Get the current user's configuration including accounts and addresses",
-        "parameters": [],
+        "operationId": "CalendarEventOperations_listCalendarEvents",
+        "description": "Expanded event occurrences in a window. The server does the recurrence\nexpansion and the client renders instances — no RRULE is ever evaluated\nin a browser, so a week grid and a day strip agree with each other and\nwith what a native client will later read over CalDAV.\n\nOccurrences are served from the stored occurrence index. A series whose\nindex stops before `to` — an open-ended event older than the expansion\nhorizon — is expanded live for this window instead, and nothing\nunbounded is written to serve a read.\n\nRefused with 400 when `from` and `to` are not ISO 8601 date-times, when\n`to` is not after `from`, or when the window is wider than a year.",
+        "parameters": [
+          {
+            "name": "from",
+            "in": "query",
+            "required": true,
+            "description": "Start of the window, an ISO 8601 date-time with zone offset. Inclusive.",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "to",
+            "in": "query",
+            "required": true,
+            "description": "End of the window, an ISO 8601 date-time with zone offset. Exclusive.",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "calendarId",
+            "in": "query",
+            "required": false,
+            "description": "Restrict to these collections, repeated once per calendar. Omitted means every calendar the caller holds.",
+            "schema": {
+              "type": "array",
+              "items": {
+                "$ref": "#/components/schemas/UUID"
+              }
+            }
+          }
+        ],
         "responses": {
           "200": {
             "description": "The request has succeeded.",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/RemitImap.ConfigDescriptionResponse"
+                  "$ref": "#/components/schemas/RemitImap.CalendarEventListResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "Validation error response",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiError"
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "Not found error response",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiError"
                 }
               }
             }
@@ -1438,12 +1489,10 @@
             "Fn::Sub": "arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:{{HandlerFunctionName}}/invocations"
           }
         }
-      }
-    },
-    "/config/export": {
-      "get": {
-        "operationId": "ConfigOperations_exportConfig",
-        "description": "Export every configured setting for the caller as one versioned JSON document. Contains no credentials: no IMAP/SMTP password and no OAuth token, encrypted or otherwise, and the credential fields are structurally absent rather than blank. The document's own shape is not defined here - it is defined by the published JSON Schema for its `schemaVersion` (build/config-schema/reader-config.v<N>.schema.json), so a file keeps validating independent of this API's models.",
+      },
+      "post": {
+        "operationId": "CalendarEventOperations_createCalendarEvent",
+        "description": "Create an event. The server builds the VEVENT and writes it through the single calendar write path — the same one an accepted invitation and a later CalDAV PUT go through — so the object, its expanded occurrences and the collection's sync sequence land together or not at all.",
         "parameters": [],
         "responses": {
           "200": {
@@ -1451,12 +1500,42 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/RemitImap.ConfigExportResponse"
+                  "$ref": "#/components/schemas/RemitImap.CalendarEventResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "Validation error response",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiError"
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "Not found error response",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiError"
                 }
               }
             }
           }
         },
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/RemitImap.CreateCalendarEventInput"
+              }
+            }
+          }
+        },
         "x-amazon-apigateway-integration": {
           "type": "aws_proxy",
           "httpMethod": "POST",
@@ -1467,12 +1546,13 @@
         }
       }
     },
-    "/mailboxes/{mailboxId}/threads": {
+    "/calendar-events/{calendarObjectId}": {
       "get": {
-        "operationId": "ThreadOperations_listThreads",
+        "operationId": "CalendarEventDetailOperations_getCalendarEvent",
+        "description": "Get one stored event, including its canonical iCalendar text and its etag.",
         "parameters": [
           {
-            "name": "mailboxId",
+            "name": "calendarObjectId",
             "in": "path",
             "required": true,
             "schema": {
@@ -1480,19 +1560,12 @@
             }
           },
           {
-            "name": "continuationToken",
-            "in": "query",
-            "required": false,
-            "schema": {
-              "type": "string"
-            }
-          },
-          {
-            "name": "order",
+            "name": "calendarId",
             "in": "query",
-            "required": false,
+            "required": true,
+            "description": "Collection the resource lives in. A resource is addressed by its collection and its own id, which is what a client holds: every occurrence a listing returns carries both.",
             "schema": {
-              "$ref": "#/components/schemas/RemitImap.SortOrder"
+              "$ref": "#/components/schemas/UUID"
             }
           }
         ],
@@ -1502,26 +1575,27 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "type": "object",
-                  "required": [
-                    "items"
-                  ],
-                  "properties": {
-                    "continuationToken": {
-                      "allOf": [
-                        {
-                          "$ref": "#/components/schemas/String800"
-                        }
-                      ],
-                      "description": "Opaque, server-minted cursor: absent means the first (or last) page, present means resume from here. Echo it back unchanged to fetch the next page. Every listing endpoint that accepts it rejects a token it cannot decode with 400 ValidationError rather than silently restarting from the first page (#136, #172)."
-                    },
-                    "items": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/components/schemas/RemitImap.ThreadMessageResponse"
-                      }
-                    }
-                  }
+                  "$ref": "#/components/schemas/RemitImap.CalendarEventResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "Validation error response",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiError"
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "Not found error response",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiError"
                 }
               }
             }
@@ -1535,14 +1609,13 @@
             "Fn::Sub": "arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:{{HandlerFunctionName}}/invocations"
           }
         }
-      }
-    },
-    "/mailboxes/{mailboxId}/threads/search": {
-      "get": {
-        "operationId": "ThreadOperations_searchThreads",
+      },
+      "patch": {
+        "operationId": "CalendarEventDetailOperations_updateCalendarEvent",
+        "description": "Update an event. `scope` says what the caller meant by editing one\ndrawing of a series: `All` rewrites the master, `This` writes a\nRECURRENCE-ID override for the named occurrence, and `Following` splits\nthe series — the master's rule is truncated and a second resource carries\nthe remainder under a UID of its own.\n\n`recurrenceId` is required for `This` and `Following` and is refused with\n400 otherwise, along with a scope other than `All` on an event that does\nnot recur, and a `recurrenceId` naming no occurrence of the series.\n\n`If-Match` makes the write conditional on the etag the caller read. A\nmismatch is 412: somebody replaced the resource in between, and applying\nthis patch would discard their change without either of them seeing it.",
         "parameters": [
           {
-            "name": "mailboxId",
+            "name": "calendarObjectId",
             "in": "path",
             "required": true,
             "schema": {
@@ -1550,128 +1623,216 @@
             }
           },
           {
-            "name": "continuationToken",
+            "name": "calendarId",
             "in": "query",
-            "required": false,
+            "required": true,
+            "description": "Collection the resource lives in",
             "schema": {
-              "type": "string"
+              "$ref": "#/components/schemas/UUID"
             }
           },
           {
-            "name": "order",
+            "name": "scope",
             "in": "query",
             "required": false,
+            "description": "Which occurrences this update applies to. Defaults to `All`.",
             "schema": {
-              "$ref": "#/components/schemas/RemitImap.SortOrder"
+              "$ref": "#/components/schemas/RemitImap.RecurrenceScope"
             }
           },
           {
-            "name": "query",
+            "name": "recurrenceId",
             "in": "query",
             "required": false,
+            "description": "RECURRENCE-ID of the occurrence the update is anchored at, as the ISO 8601 UTC instant a listing returned. Required for `This` and `Following`.",
             "schema": {
               "type": "string"
             }
           },
           {
-            "name": "subject",
-            "in": "query",
+            "name": "If-Match",
+            "in": "header",
             "required": false,
             "schema": {
               "type": "string"
             }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "The request has succeeded.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/RemitImap.CalendarEventResponse"
+                }
+              }
+            }
           },
-          {
-            "name": "from",
-            "in": "query",
-            "required": false,
-            "schema": {
-              "type": "string"
+          "400": {
+            "description": "Validation error response",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiError"
+                }
+              }
             }
           },
-          {
-            "name": "unread",
-            "in": "query",
-            "required": false,
-            "schema": {
-              "type": "boolean"
+          "404": {
+            "description": "Not found error response",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiError"
+                }
+              }
             }
           },
+          "412": {
+            "description": "The condition the request stated is no longer true. Answered when an\n`If-Match` names an etag the stored resource no longer carries: somebody else\nwrote it in between, so applying this request would silently discard their\nchange. The client re-reads the resource and decides what to do with the\nversion it now has.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiError"
+                }
+              }
+            }
+          }
+        },
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/RemitImap.UpdateCalendarEventInput"
+              }
+            }
+          }
+        },
+        "x-amazon-apigateway-integration": {
+          "type": "aws_proxy",
+          "httpMethod": "POST",
+          "passthroughBehavior": "when_no_match",
+          "uri": {
+            "Fn::Sub": "arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:{{HandlerFunctionName}}/invocations"
+          }
+        }
+      },
+      "delete": {
+        "operationId": "CalendarEventDetailOperations_deleteCalendarEvent",
+        "description": "Delete an event. `All` removes the resource and every occurrence it\nproduced; `This` writes an EXDATE for the named occurrence and keeps the\nrest of the series; `Following` truncates the series to end just before\nit.\n\nSame refusals and the same `If-Match` precondition as the update.",
+        "parameters": [
           {
-            "name": "starred",
-            "in": "query",
-            "required": false,
+            "name": "calendarObjectId",
+            "in": "path",
+            "required": true,
             "schema": {
-              "type": "boolean"
+              "$ref": "#/components/schemas/UUID"
             }
           },
           {
-            "name": "attachments",
+            "name": "calendarId",
             "in": "query",
-            "required": false,
+            "required": true,
+            "description": "Collection the resource lives in",
             "schema": {
-              "type": "boolean"
+              "$ref": "#/components/schemas/UUID"
             }
           },
           {
-            "name": "senderTrust",
+            "name": "scope",
             "in": "query",
             "required": false,
-            "description": "Filter to messages whose From address has one of these trust levels. Off-row criterion, resolved by in-handler enrichment over the capped window.",
+            "description": "Which occurrences this delete applies to. Defaults to `All`.",
             "schema": {
-              "type": "array",
-              "items": {
-                "$ref": "#/components/schemas/RemitImap.SenderTrust"
-              }
+              "$ref": "#/components/schemas/RemitImap.RecurrenceScope"
             }
           },
           {
-            "name": "category",
+            "name": "recurrenceId",
             "in": "query",
             "required": false,
-            "description": "Filter to messages with one of these header-derived categories. Applied as a SQL predicate over the whole mailbox, so a page comes back full of matches however rare the category is. `uncategorized` is one of them.",
+            "description": "RECURRENCE-ID of the occurrence the delete is anchored at. Required for `This` and `Following`.",
             "schema": {
-              "type": "array",
-              "items": {
-                "$ref": "#/components/schemas/RemitImap.MessageCategory"
-              }
+              "type": "string"
             }
           },
           {
-            "name": "dkimMismatch",
-            "in": "query",
+            "name": "If-Match",
+            "in": "header",
             "required": false,
-            "description": "Filter on the DKIM-alignment signal (true = DKIM mismatch). Off-row criterion; rows without an authenticity signal never match.",
             "schema": {
-              "type": "boolean"
+              "type": "string"
             }
-          },
-          {
-            "name": "count",
-            "in": "query",
-            "required": false,
-            "description": "Include how many messages the query matches. Counted over the whole mailbox, independent of `limit`.",
-            "schema": {
-              "type": "boolean"
+          }
+        ],
+        "responses": {
+          "204": {
+            "description": "Nothing to return. The resource, or the occurrence, is gone."
+          },
+          "400": {
+            "description": "Validation error response",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiError"
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "Not found error response",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiError"
+                }
+              }
             }
           },
+          "412": {
+            "description": "The condition the request stated is no longer true. Answered when an\n`If-Match` names an etag the stored resource no longer carries: somebody else\nwrote it in between, so applying this request would silently discard their\nchange. The client re-reads the resource and decides what to do with the\nversion it now has.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiError"
+                }
+              }
+            }
+          }
+        },
+        "x-amazon-apigateway-integration": {
+          "type": "aws_proxy",
+          "httpMethod": "POST",
+          "passthroughBehavior": "when_no_match",
+          "uri": {
+            "Fn::Sub": "arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:{{HandlerFunctionName}}/invocations"
+          }
+        }
+      }
+    },
+    "/calendar-free-busy": {
+      "get": {
+        "operationId": "CalendarFreeBusyOperations_listCalendarFreeBusy",
+        "description": "Busy spans over a window, merged across every calendar the caller holds. Backs the clash check beside a mail invitation and the free-stretch maths in the day strip, neither of which should have to fetch every event and merge them itself. Refused with 400 on the same window rules as the event listing.",
+        "parameters": [
           {
-            "name": "results",
+            "name": "from",
             "in": "query",
-            "required": false,
-            "description": "Return matching rows. Default true; set false for a count-only response.",
+            "required": true,
+            "description": "Start of the window, an ISO 8601 date-time with zone offset. Inclusive.",
             "schema": {
-              "type": "boolean"
+              "type": "string"
             }
           },
           {
-            "name": "limit",
+            "name": "to",
             "in": "query",
-            "required": false,
-            "description": "Page size for the rows returned, capped server-side at 500. Bounds the read, not the `count`.",
+            "required": true,
+            "description": "End of the window, an ISO 8601 date-time with zone offset. Exclusive.",
             "schema": {
-              "type": "integer",
-              "format": "int32"
+              "type": "string"
             }
           }
         ],
@@ -1681,7 +1842,17 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/RemitImap.ThreadSearchResponse"
+                  "$ref": "#/components/schemas/RemitImap.CalendarFreeBusyResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "Validation error response",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiError"
                 }
               }
             }
@@ -1697,18 +1868,43 @@
         }
       }
     },
-    "/me": {
-      "delete": {
-        "operationId": "MeOperations_deleteMe",
-        "description": "Request full erasure of the current user's account and all associated data",
+    "/calendars": {
+      "get": {
+        "operationId": "CalendarOperations_listCalendars",
+        "description": "List the caller's calendar collections. Provisions the account config's default collection when it has none, so a first read never comes back empty and no client has to know how a calendar gets made.",
         "parameters": [],
         "responses": {
-          "202": {
-            "description": "Response for DELETE /me (account erasure request)",
+          "200": {
+            "description": "The request has succeeded.",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/RemitImap.DeleteAccountConfigResponse"
+                  "$ref": "#/components/schemas/RemitImap.CalendarListResponse"
+                }
+              }
+            }
+          }
+        },
+        "x-amazon-apigateway-integration": {
+          "type": "aws_proxy",
+          "httpMethod": "POST",
+          "passthroughBehavior": "when_no_match",
+          "uri": {
+            "Fn::Sub": "arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:{{HandlerFunctionName}}/invocations"
+          }
+        }
+      },
+      "post": {
+        "operationId": "CalendarOperations_createCalendar",
+        "description": "Create a calendar collection. Refused with 400 when `urlSegment` is empty or already taken in this account config — the segment is the collection's identity, so a second create under the same one would otherwise silently return the collection that already exists.",
+        "parameters": [],
+        "responses": {
+          "200": {
+            "description": "The request has succeeded.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/RemitImap.CalendarResponse"
                 }
               }
             }
@@ -1729,7 +1925,7 @@
           "content": {
             "application/json": {
               "schema": {
-                "$ref": "#/components/schemas/RemitImap.DeleteMeInput"
+                "$ref": "#/components/schemas/RemitImap.CreateCalendarInput"
               }
             }
           }
@@ -1744,18 +1940,36 @@
         }
       }
     },
-    "/me/export": {
-      "post": {
-        "operationId": "MeOperations_createExport",
-        "description": "Request an export of all account data as a ZIP archive of .eml files. Returns immediately with an exportId; check GET /me/export/{exportId} for status and downloadUrl.",
-        "parameters": [],
+    "/calendars/{calendarId}": {
+      "get": {
+        "operationId": "CalendarDetailOperations_getCalendar",
+        "parameters": [
+          {
+            "name": "calendarId",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "$ref": "#/components/schemas/UUID"
+            }
+          }
+        ],
         "responses": {
-          "202": {
-            "description": "Response body for POST /me/export",
+          "200": {
+            "description": "The request has succeeded.",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/RemitImap.CreateExportResponse"
+                  "$ref": "#/components/schemas/RemitImap.CalendarResponse"
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "Not found error response",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiError"
                 }
               }
             }
@@ -1769,19 +1983,16 @@
             "Fn::Sub": "arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:{{HandlerFunctionName}}/invocations"
           }
         }
-      }
-    },
-    "/me/export/{exportId}": {
-      "get": {
-        "operationId": "MeOperations_getExport",
-        "description": "Get the status of a previously requested data export. When state is Ready, downloadUrl holds a 30-day presigned S3 URL.",
+      },
+      "patch": {
+        "operationId": "CalendarDetailOperations_updateCalendar",
         "parameters": [
           {
-            "name": "exportId",
+            "name": "calendarId",
             "in": "path",
             "required": true,
             "schema": {
-              "type": "string"
+              "$ref": "#/components/schemas/UUID"
             }
           }
         ],
@@ -1791,7 +2002,84 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/RemitImap.AccountExportRequestResponse"
+                  "$ref": "#/components/schemas/RemitImap.CalendarResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "Validation error response",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiError"
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "Not found error response",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiError"
+                }
+              }
+            }
+          }
+        },
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/RemitImap.UpdateCalendarInput"
+              }
+            }
+          }
+        },
+        "x-amazon-apigateway-integration": {
+          "type": "aws_proxy",
+          "httpMethod": "POST",
+          "passthroughBehavior": "when_no_match",
+          "uri": {
+            "Fn::Sub": "arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:{{HandlerFunctionName}}/invocations"
+          }
+        }
+      },
+      "delete": {
+        "operationId": "CalendarDetailOperations_deleteCalendar",
+        "description": "Delete a calendar collection and every event in it. Refused with 400 for the account's default collection: it is the one place an accepted invitation or a first event can land, and an account with no calendar has nowhere to put an event.",
+        "parameters": [
+          {
+            "name": "calendarId",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "$ref": "#/components/schemas/UUID"
+            }
+          }
+        ],
+        "responses": {
+          "204": {
+            "description": "Nothing to return. The resource, or the occurrence, is gone."
+          },
+          "400": {
+            "description": "Validation error response",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiError"
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "Not found error response",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiError"
                 }
               }
             }
@@ -1807,10 +2095,10 @@
         }
       }
     },
-    "/me/quarantine": {
+    "/config": {
       "get": {
-        "operationId": "MeOperations_listQuarantine",
-        "description": "List every message the sync path could not read, for the current user across all of their mail accounts (issue #72). Backs the quarantine section in settings. Unpaginated: the list is small by design, and an entry is a defect waiting to be reported rather than a page of mail.",
+        "operationId": "ConfigOperations_getConfig",
+        "description": "Get the current user's configuration including accounts and addresses",
         "parameters": [],
         "responses": {
           "200": {
@@ -1818,7 +2106,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/RemitImap.QuarantineListResponse"
+                  "$ref": "#/components/schemas/RemitImap.ConfigDescriptionResponse"
                 }
               }
             }
@@ -1834,10 +2122,10 @@
         }
       }
     },
-    "/me/vip-suggestions": {
+    "/config/export": {
       "get": {
-        "operationId": "MeOperations_listVipSuggestions",
-        "description": "List wellknown senders the user has not yet promoted to VIP. Ranked by `replyCount + inboundCount` desc with `lastInboundAt` desc as the tie-breaker. Capped at 10.",
+        "operationId": "ConfigOperations_exportConfig",
+        "description": "Export every configured setting for the caller as one versioned JSON document. Contains no credentials: no IMAP/SMTP password and no OAuth token, encrypted or otherwise, and the credential fields are structurally absent rather than blank. The document's own shape is not defined here - it is defined by the published JSON Schema for its `schemaVersion` (build/config-schema/reader-config.v<N>.schema.json), so a file keeps validating independent of this API's models.",
         "parameters": [],
         "responses": {
           "200": {
@@ -1845,7 +2133,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/RemitImap.VipSuggestionsResponse"
+                  "$ref": "#/components/schemas/RemitImap.ConfigExportResponse"
                 }
               }
             }
@@ -1861,10 +2149,10 @@
         }
       }
     },
-    "/messages/copy": {
+    "/config/import": {
       "post": {
-        "operationId": "MessageBulkOperations_copyMessages",
-        "description": "Copy messages to a destination mailbox",
+        "operationId": "ConfigOperations_importConfig",
+        "description": "Validate, or validate and apply, a config document. `mode: validate` (the default) writes nothing and returns the same report an apply would. `onExisting: abort` (the default) refuses with 409 when this configuration already holds accounts, labels, filters or address flags. Nothing is written until the whole document has validated; a write failure after that aborts the remainder and the report names exactly what landed. Imported accounts arrive inactive with `connectionState: credentials_missing` (or `reauth_required` for OAuth) - the credentials the file deliberately omits are re-entered per account afterwards.",
         "parameters": [],
         "responses": {
           "200": {
@@ -1872,13 +2160,23 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/RemitImap.MessageBulkOperationResult"
+                  "$ref": "#/components/schemas/RemitImap.ConfigImportReport"
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "Validation error response",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiError"
                 }
               }
             }
           },
           "409": {
-            "description": "The same flat 409 body, for a message whose folder and uid do not name the same message.\n\n`code: \"message_placement_unsettled\"` — the message is mid-move, so its row names the destination folder while its uid still belongs to the source; acting on that pair would hit whatever the destination holds at that uid. `details` carries `accountId`, `messageId` and `reason`, one of: `in_flight` (the move is still running, and the same request succeeds once it confirms) or `unverified` (the move gave up without confirming, so where the message sits is unknown until the folder is resynced).",
+            "description": "The import was refused because this configuration is not empty. The body is\nflat: `code`, `message` and `details` sit at the top level.\n\n`code: \"config_not_empty\"` — the configuration already holds an account, a\nlabel, a filter or an address flag. `details` names how many of each. Re-send\nwith `onExisting: merge` to upsert instead.",
             "content": {
               "application/json": {
                 "schema": {
@@ -1893,7 +2191,7 @@
           "content": {
             "application/json": {
               "schema": {
-                "$ref": "#/components/schemas/RemitImap.CopyMessagesInput"
+                "$ref": "#/components/schemas/RemitImap.ImportConfigInput"
               }
             }
           }
@@ -1908,43 +2206,66 @@
         }
       }
     },
-    "/messages/delete": {
-      "post": {
-        "operationId": "MessageBulkOperations_deleteMessages",
-        "description": "Delete messages (move to Trash or permanent delete)",
-        "parameters": [],
-        "responses": {
-          "200": {
-            "description": "The request has succeeded.",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/RemitImap.MessageBulkOperationResult"
-                }
-              }
+    "/mailboxes/{mailboxId}/threads": {
+      "get": {
+        "operationId": "ThreadOperations_listThreads",
+        "parameters": [
+          {
+            "name": "mailboxId",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "$ref": "#/components/schemas/UUID"
             }
           },
-          "409": {
-            "description": "The same flat 409 body, with the two codes this endpoint can answer with.\n\n`code: \"folder_role_unresolved\"` — as everywhere else, with `details` carrying `role`, `accountId` and `reason`.\n\n`code: \"message_placement_unsettled\"` — as `MessagePlacementConflict`, with `details` carrying `accountId`, `messageId` and `reason`.",
+          {
+            "name": "continuationToken",
+            "in": "query",
+            "required": false,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "order",
+            "in": "query",
+            "required": false,
+            "schema": {
+              "$ref": "#/components/schemas/RemitImap.SortOrder"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "The request has succeeded.",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/ApiError"
+                  "type": "object",
+                  "required": [
+                    "items"
+                  ],
+                  "properties": {
+                    "continuationToken": {
+                      "allOf": [
+                        {
+                          "$ref": "#/components/schemas/String800"
+                        }
+                      ],
+                      "description": "Opaque, server-minted cursor: absent means the first (or last) page, present means resume from here. Echo it back unchanged to fetch the next page. Every listing endpoint that accepts it rejects a token it cannot decode with 400 ValidationError rather than silently restarting from the first page (#136, #172)."
+                    },
+                    "items": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/components/schemas/RemitImap.ThreadMessageResponse"
+                      }
+                    }
+                  }
                 }
               }
             }
           }
         },
-        "requestBody": {
-          "required": true,
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/RemitImap.DeleteMessagesInput"
-              }
-            }
-          }
-        },
         "x-amazon-apigateway-integration": {
           "type": "aws_proxy",
           "httpMethod": "POST",
@@ -1955,33 +2276,156 @@
         }
       }
     },
-    "/messages/flags": {
-      "post": {
-        "operationId": "MessageBulkOperations_updateFlags",
-        "description": "Update flags on multiple messages",
-        "parameters": [],
+    "/mailboxes/{mailboxId}/threads/search": {
+      "get": {
+        "operationId": "ThreadOperations_searchThreads",
+        "parameters": [
+          {
+            "name": "mailboxId",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "$ref": "#/components/schemas/UUID"
+            }
+          },
+          {
+            "name": "continuationToken",
+            "in": "query",
+            "required": false,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "order",
+            "in": "query",
+            "required": false,
+            "schema": {
+              "$ref": "#/components/schemas/RemitImap.SortOrder"
+            }
+          },
+          {
+            "name": "query",
+            "in": "query",
+            "required": false,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "subject",
+            "in": "query",
+            "required": false,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "from",
+            "in": "query",
+            "required": false,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "unread",
+            "in": "query",
+            "required": false,
+            "schema": {
+              "type": "boolean"
+            }
+          },
+          {
+            "name": "starred",
+            "in": "query",
+            "required": false,
+            "schema": {
+              "type": "boolean"
+            }
+          },
+          {
+            "name": "attachments",
+            "in": "query",
+            "required": false,
+            "schema": {
+              "type": "boolean"
+            }
+          },
+          {
+            "name": "senderTrust",
+            "in": "query",
+            "required": false,
+            "description": "Filter to messages whose From address has one of these trust levels. Off-row criterion, resolved by in-handler enrichment over the capped window.",
+            "schema": {
+              "type": "array",
+              "items": {
+                "$ref": "#/components/schemas/RemitImap.SenderTrust"
+              }
+            }
+          },
+          {
+            "name": "category",
+            "in": "query",
+            "required": false,
+            "description": "Filter to messages with one of these header-derived categories. Applied as a SQL predicate over the whole mailbox, so a page comes back full of matches however rare the category is. `uncategorized` is one of them.",
+            "schema": {
+              "type": "array",
+              "items": {
+                "$ref": "#/components/schemas/RemitImap.MessageCategory"
+              }
+            }
+          },
+          {
+            "name": "dkimMismatch",
+            "in": "query",
+            "required": false,
+            "description": "Filter on the DKIM-alignment signal (true = DKIM mismatch). Off-row criterion; rows without an authenticity signal never match.",
+            "schema": {
+              "type": "boolean"
+            }
+          },
+          {
+            "name": "count",
+            "in": "query",
+            "required": false,
+            "description": "Include how many messages the query matches. Counted over the whole mailbox, independent of `limit`.",
+            "schema": {
+              "type": "boolean"
+            }
+          },
+          {
+            "name": "results",
+            "in": "query",
+            "required": false,
+            "description": "Return matching rows. Default true; set false for a count-only response.",
+            "schema": {
+              "type": "boolean"
+            }
+          },
+          {
+            "name": "limit",
+            "in": "query",
+            "required": false,
+            "description": "Page size for the rows returned, capped server-side at 500. Bounds the read, not the `count`.",
+            "schema": {
+              "type": "integer",
+              "format": "int32"
+            }
+          }
+        ],
         "responses": {
           "200": {
             "description": "The request has succeeded.",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/RemitImap.MessageBulkOperationResult"
+                  "$ref": "#/components/schemas/RemitImap.ThreadSearchResponse"
                 }
               }
             }
           }
         },
-        "requestBody": {
-          "required": true,
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/RemitImap.BulkUpdateFlagsInput"
-              }
-            }
-          }
-        },
         "x-amazon-apigateway-integration": {
           "type": "aws_proxy",
           "httpMethod": "POST",
@@ -1992,18 +2436,28 @@
         }
       }
     },
-    "/messages/labels": {
-      "post": {
-        "operationId": "MessageBulkOperations_updateMessageLabels",
-        "description": "Apply or remove a label on multiple messages — the manual \"just these\" scope (RFC 034 recap, issue #26). `appliedByFilterId` stays absent on the resulting `MessageLabel` rows; that provenance is reserved for filter/organize applies.",
+    "/me": {
+      "delete": {
+        "operationId": "MeOperations_deleteMe",
+        "description": "Request full erasure of the current user's account and all associated data",
         "parameters": [],
         "responses": {
-          "200": {
-            "description": "The request has succeeded.",
+          "202": {
+            "description": "Response for DELETE /me (account erasure request)",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/RemitImap.MessageBulkOperationResult"
+                  "$ref": "#/components/schemas/RemitImap.DeleteAccountConfigResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "Validation error response",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiError"
                 }
               }
             }
@@ -2014,7 +2468,7 @@
           "content": {
             "application/json": {
               "schema": {
-                "$ref": "#/components/schemas/RemitImap.UpdateMessageLabelsInput"
+                "$ref": "#/components/schemas/RemitImap.DeleteMeInput"
               }
             }
           }
@@ -2029,32 +2483,23 @@
         }
       }
     },
-    "/messages/move": {
+    "/me/export": {
       "post": {
-        "operationId": "MessageBulkOperations_moveMessages",
+        "operationId": "MeOperations_createExport",
+        "description": "Request an export of all account data as a ZIP archive of .eml files. Returns immediately with an exportId; check GET /me/export/{exportId} for status and downloadUrl.",
         "parameters": [],
         "responses": {
-          "200": {
-            "description": "The request has succeeded.",
-            "content": {
+          "202": {
+            "description": "Response body for POST /me/export",
+            "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/RemitImap.MessageBulkOperationResult"
+                  "$ref": "#/components/schemas/RemitImap.CreateExportResponse"
                 }
               }
             }
           }
         },
-        "requestBody": {
-          "required": true,
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/RemitImap.MoveMessagesInput"
-              }
-            }
-          }
-        },
         "x-amazon-apigateway-integration": {
           "type": "aws_proxy",
           "httpMethod": "POST",
@@ -2065,33 +2510,32 @@
         }
       }
     },
-    "/messages/not-spam": {
-      "post": {
-        "operationId": "MessageBulkOperations_notSpam",
-        "description": "Undo a spam report: clear the sender's `blocked` flag (never promotes to trusted/wellknown) and move each message back to `Message.originalMailboxId`. Idempotent under a repeated call. Each message is processed independently and concurrently, so the request's total wait is bounded by one message's settle timeout rather than accumulating across the batch.",
-        "parameters": [],
+    "/me/export/{exportId}": {
+      "get": {
+        "operationId": "MeOperations_getExport",
+        "description": "Get the status of a previously requested data export. When state is Ready, downloadUrl holds a 30-day presigned S3 URL.",
+        "parameters": [
+          {
+            "name": "exportId",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
         "responses": {
           "200": {
             "description": "The request has succeeded.",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/RemitImap.SpamReportBulkResult"
+                  "$ref": "#/components/schemas/RemitImap.AccountExportRequestResponse"
                 }
               }
             }
           }
         },
-        "requestBody": {
-          "required": true,
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/RemitImap.BulkMessageInput"
-              }
-            }
-          }
-        },
         "x-amazon-apigateway-integration": {
           "type": "aws_proxy",
           "httpMethod": "POST",
@@ -2102,10 +2546,10 @@
         }
       }
     },
-    "/messages/report-spam": {
-      "post": {
-        "operationId": "MessageBulkOperations_reportSpam",
-        "description": "Report messages as spam: block the sender (Address.flags.blocked) and move each message to the account's Junk folder. Skips the block (but still moves the message) when the sender is the account's own address. One call replaces composing the old separate `Block` and `Mark spam` actions — a single user intent, a single failure story. The sender block is written first and does not wait on the move; a failed move never rolls it back. Idempotent under a repeated call.",
+    "/me/quarantine": {
+      "get": {
+        "operationId": "MeOperations_listQuarantine",
+        "description": "List every message the sync path could not read, for the current user across all of their mail accounts (issue #72). Backs the quarantine section in settings. Unpaginated: the list is small by design, and an entry is a defect waiting to be reported rather than a page of mail.",
         "parameters": [],
         "responses": {
           "200": {
@@ -2113,22 +2557,12 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/RemitImap.SpamReportBulkResult"
+                  "$ref": "#/components/schemas/RemitImap.QuarantineListResponse"
                 }
               }
             }
           }
         },
-        "requestBody": {
-          "required": true,
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/RemitImap.BulkMessageInput"
-              }
-            }
-          }
-        },
         "x-amazon-apigateway-integration": {
           "type": "aws_proxy",
           "httpMethod": "POST",
@@ -2139,26 +2573,18 @@
         }
       }
     },
-    "/messages/{messageId}": {
+    "/me/vip-suggestions": {
       "get": {
-        "operationId": "MessageOperations_describeMessage",
-        "parameters": [
-          {
-            "name": "messageId",
-            "in": "path",
-            "required": true,
-            "schema": {
-              "$ref": "#/components/schemas/UUID"
-            }
-          }
-        ],
+        "operationId": "MeOperations_listVipSuggestions",
+        "description": "List wellknown senders the user has not yet promoted to VIP. Ranked by `replyCount + inboundCount` desc with `lastInboundAt` desc as the tie-breaker. Capped at 10.",
+        "parameters": [],
         "responses": {
           "200": {
             "description": "The request has succeeded.",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/RemitImap.DescribeMessageResponse"
+                  "$ref": "#/components/schemas/RemitImap.VipSuggestionsResponse"
                 }
               }
             }
@@ -2174,42 +2600,28 @@
         }
       }
     },
-    "/messages/{messageId}/flags": {
-      "patch": {
-        "operationId": "MessageOperations_updateMessageFlags",
-        "parameters": [
-          {
-            "name": "messageId",
-            "in": "path",
-            "required": true,
-            "schema": {
-              "$ref": "#/components/schemas/UUID"
-            }
-          }
-        ],
+    "/messages/copy": {
+      "post": {
+        "operationId": "MessageBulkOperations_copyMessages",
+        "description": "Copy messages to a destination mailbox",
+        "parameters": [],
         "responses": {
           "200": {
             "description": "The request has succeeded.",
             "content": {
               "application/json": {
                 "schema": {
-                  "type": "object",
-                  "properties": {
-                    "messageId": {
-                      "$ref": "#/components/schemas/UUID"
-                    },
-                    "isRead": {
-                      "type": "boolean"
-                    },
-                    "isStarred": {
-                      "type": "boolean"
-                    }
-                  },
-                  "required": [
-                    "messageId",
-                    "isRead",
-                    "isStarred"
-                  ]
+                  "$ref": "#/components/schemas/RemitImap.MessageBulkOperationResult"
+                }
+              }
+            }
+          },
+          "409": {
+            "description": "The same flat 409 body, for a message whose folder and uid do not name the same message.\n\n`code: \"message_placement_unsettled\"` — the message is mid-move, so its row names the destination folder while its uid still belongs to the source; acting on that pair would hit whatever the destination holds at that uid. `details` carries `accountId`, `messageId` and `reason`, one of: `in_flight` (the move is still running, and the same request succeeds once it confirms) or `unverified` (the move gave up without confirming, so where the message sits is unknown until the folder is resynced).",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiError"
                 }
               }
             }
@@ -2220,7 +2632,7 @@
           "content": {
             "application/json": {
               "schema": {
-                "$ref": "#/components/schemas/RemitImap.UpdateFlagsInput"
+                "$ref": "#/components/schemas/RemitImap.CopyMessagesInput"
               }
             }
           }
@@ -2235,32 +2647,43 @@
         }
       }
     },
-    "/messages/{messageId}/raw": {
-      "get": {
-        "operationId": "MessageOperations_getRawMessage",
-        "description": "Get the raw RFC822/MIME source of a message (headers and body) for inspection.",
-        "parameters": [
-          {
-            "name": "messageId",
-            "in": "path",
-            "required": true,
-            "schema": {
-              "$ref": "#/components/schemas/UUID"
-            }
-          }
-        ],
+    "/messages/delete": {
+      "post": {
+        "operationId": "MessageBulkOperations_deleteMessages",
+        "description": "Delete messages (move to Trash or permanent delete)",
+        "parameters": [],
         "responses": {
           "200": {
             "description": "The request has succeeded.",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/RemitImap.RawMessageResponse"
+                  "$ref": "#/components/schemas/RemitImap.MessageBulkOperationResult"
+                }
+              }
+            }
+          },
+          "409": {
+            "description": "The same flat 409 body, with the two codes this endpoint can answer with.\n\n`code: \"folder_role_unresolved\"` — as everywhere else, with `details` carrying `role`, `accountId` and `reason`.\n\n`code: \"message_placement_unsettled\"` — as `MessagePlacementConflict`, with `details` carrying `accountId`, `messageId` and `reason`.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiError"
                 }
               }
             }
           }
         },
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/RemitImap.DeleteMessagesInput"
+              }
+            }
+          }
+        },
         "x-amazon-apigateway-integration": {
           "type": "aws_proxy",
           "httpMethod": "POST",
@@ -2271,10 +2694,10 @@
         }
       }
     },
-    "/outbox": {
+    "/messages/flags": {
       "post": {
-        "operationId": "OutboxOperations_createOutboxMessage",
-        "description": "Create a new outbox message (draft or send immediately)",
+        "operationId": "MessageBulkOperations_updateFlags",
+        "description": "Update flags on multiple messages",
         "parameters": [],
         "responses": {
           "200": {
@@ -2282,7 +2705,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/RemitImap.OutboxMessageResponse"
+                  "$ref": "#/components/schemas/RemitImap.MessageBulkOperationResult"
                 }
               }
             }
@@ -2293,7 +2716,7 @@
           "content": {
             "application/json": {
               "schema": {
-                "$ref": "#/components/schemas/RemitImap.CreateOutboxMessageInput"
+                "$ref": "#/components/schemas/RemitImap.BulkUpdateFlagsInput"
               }
             }
           }
@@ -2306,51 +2729,35 @@
             "Fn::Sub": "arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:{{HandlerFunctionName}}/invocations"
           }
         }
-      },
-      "get": {
-        "operationId": "OutboxOperations_listOutboxMessages",
-        "description": "List outbox messages for the current account",
-        "parameters": [
-          {
-            "name": "continuationToken",
-            "in": "query",
-            "required": false,
-            "schema": {
-              "type": "string"
-            }
-          }
-        ],
+      }
+    },
+    "/messages/labels": {
+      "post": {
+        "operationId": "MessageBulkOperations_updateMessageLabels",
+        "description": "Apply or remove a label on multiple messages — the manual \"just these\" scope (RFC 034 recap, issue #26). `appliedByFilterId` stays absent on the resulting `MessageLabel` rows; that provenance is reserved for filter/organize applies.",
+        "parameters": [],
         "responses": {
           "200": {
             "description": "The request has succeeded.",
             "content": {
               "application/json": {
                 "schema": {
-                  "type": "object",
-                  "required": [
-                    "items"
-                  ],
-                  "properties": {
-                    "continuationToken": {
-                      "allOf": [
-                        {
-                          "$ref": "#/components/schemas/String800"
-                        }
-                      ],
-                      "description": "Opaque, server-minted cursor: absent means the first (or last) page, present means resume from here. Echo it back unchanged to fetch the next page. Every listing endpoint that accepts it rejects a token it cannot decode with 400 ValidationError rather than silently restarting from the first page (#136, #172)."
-                    },
-                    "items": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/components/schemas/RemitImap.OutboxMessageResponse"
-                      }
-                    }
-                  }
+                  "$ref": "#/components/schemas/RemitImap.MessageBulkOperationResult"
                 }
               }
             }
           }
         },
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/RemitImap.UpdateMessageLabelsInput"
+              }
+            }
+          }
+        },
         "x-amazon-apigateway-integration": {
           "type": "aws_proxy",
           "httpMethod": "POST",
@@ -2361,33 +2768,33 @@
         }
       }
     },
-    "/outbox/{outboxMessageId}": {
-      "get": {
-        "operationId": "OutboxDetailOperations_getOutboxMessage",
-        "description": "Get an outbox message by ID",
-        "parameters": [
-          {
-            "name": "outboxMessageId",
-            "in": "path",
-            "required": true,
-            "schema": {
-              "$ref": "#/components/schemas/UUID"
-            }
-          }
-        ],
+    "/messages/move": {
+      "post": {
+        "operationId": "MessageBulkOperations_moveMessages",
+        "parameters": [],
         "responses": {
           "200": {
             "description": "The request has succeeded.",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/RemitImap.OutboxMessageResponse"
+                  "$ref": "#/components/schemas/RemitImap.MessageBulkOperationResult"
                 }
               }
             }
           }
         },
-        "x-amazon-apigateway-integration": {
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/RemitImap.MoveMessagesInput"
+              }
+            }
+          }
+        },
+        "x-amazon-apigateway-integration": {
           "type": "aws_proxy",
           "httpMethod": "POST",
           "passthroughBehavior": "when_no_match",
@@ -2395,27 +2802,57 @@
             "Fn::Sub": "arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:{{HandlerFunctionName}}/invocations"
           }
         }
-      },
-      "patch": {
-        "operationId": "OutboxDetailOperations_updateOutboxMessage",
-        "description": "Update a draft outbox message",
-        "parameters": [
-          {
-            "name": "outboxMessageId",
-            "in": "path",
-            "required": true,
-            "schema": {
-              "$ref": "#/components/schemas/UUID"
+      }
+    },
+    "/messages/not-spam": {
+      "post": {
+        "operationId": "MessageBulkOperations_notSpam",
+        "description": "Undo a spam report: clear the sender's `blocked` flag (never promotes to trusted/wellknown) and move each message back to `Message.originalMailboxId`. Idempotent under a repeated call. Each message is processed independently and concurrently, so the request's total wait is bounded by one message's settle timeout rather than accumulating across the batch.",
+        "parameters": [],
+        "responses": {
+          "200": {
+            "description": "The request has succeeded.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/RemitImap.SpamReportBulkResult"
+                }
+              }
             }
           }
-        ],
+        },
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/RemitImap.BulkMessageInput"
+              }
+            }
+          }
+        },
+        "x-amazon-apigateway-integration": {
+          "type": "aws_proxy",
+          "httpMethod": "POST",
+          "passthroughBehavior": "when_no_match",
+          "uri": {
+            "Fn::Sub": "arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:{{HandlerFunctionName}}/invocations"
+          }
+        }
+      }
+    },
+    "/messages/report-spam": {
+      "post": {
+        "operationId": "MessageBulkOperations_reportSpam",
+        "description": "Report messages as spam: block the sender (Address.flags.blocked) and move each message to the account's Junk folder. Skips the block (but still moves the message) when the sender is the account's own address. One call replaces composing the old separate `Block` and `Mark spam` actions — a single user intent, a single failure story. The sender block is written first and does not wait on the move; a failed move never rolls it back. Idempotent under a repeated call.",
+        "parameters": [],
         "responses": {
           "200": {
             "description": "The request has succeeded.",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/RemitImap.OutboxMessageResponse"
+                  "$ref": "#/components/schemas/RemitImap.SpamReportBulkResult"
                 }
               }
             }
@@ -2426,7 +2863,7 @@
           "content": {
             "application/json": {
               "schema": {
-                "$ref": "#/components/schemas/RemitImap.UpdateOutboxMessageInput"
+                "$ref": "#/components/schemas/RemitImap.BulkMessageInput"
               }
             }
           }
@@ -2439,13 +2876,14 @@
             "Fn::Sub": "arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:{{HandlerFunctionName}}/invocations"
           }
         }
-      },
-      "delete": {
-        "operationId": "OutboxDetailOperations_deleteOutboxMessage",
-        "description": "Delete a draft or failed outbox message",
+      }
+    },
+    "/messages/{messageId}": {
+      "get": {
+        "operationId": "MessageOperations_describeMessage",
         "parameters": [
           {
-            "name": "outboxMessageId",
+            "name": "messageId",
             "in": "path",
             "required": true,
             "schema": {
@@ -2454,8 +2892,15 @@
           }
         ],
         "responses": {
-          "204": {
-            "description": "There is no content to send for this request, but the headers may be useful. "
+          "200": {
+            "description": "The request has succeeded.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/RemitImap.DescribeMessageResponse"
+                }
+              }
+            }
           }
         },
         "x-amazon-apigateway-integration": {
@@ -2468,13 +2913,12 @@
         }
       }
     },
-    "/outbox/{outboxMessageId}/attachments": {
-      "post": {
-        "operationId": "OutboxDetailOperations_mintOutboxAttachment",
-        "description": "Reserve room on a draft for a file, and get somewhere to put it",
+    "/messages/{messageId}/flags": {
+      "patch": {
+        "operationId": "MessageOperations_updateMessageFlags",
         "parameters": [
           {
-            "name": "outboxMessageId",
+            "name": "messageId",
             "in": "path",
             "required": true,
             "schema": {
@@ -2488,27 +2932,23 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/RemitImap.MintOutboxAttachmentResponse"
-                }
-              }
-            }
-          },
-          "400": {
-            "description": "Refusal response for an attachment",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/RemitImap.OutboxAttachmentRejection"
-                }
-              }
-            }
-          },
-          "413": {
-            "description": "Refusal response for an attachment",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/RemitImap.OutboxAttachmentRejection"
+                  "type": "object",
+                  "properties": {
+                    "messageId": {
+                      "$ref": "#/components/schemas/UUID"
+                    },
+                    "isRead": {
+                      "type": "boolean"
+                    },
+                    "isStarred": {
+                      "type": "boolean"
+                    }
+                  },
+                  "required": [
+                    "messageId",
+                    "isRead",
+                    "isStarred"
+                  ]
                 }
               }
             }
@@ -2519,7 +2959,7 @@
           "content": {
             "application/json": {
               "schema": {
-                "$ref": "#/components/schemas/RemitImap.MintOutboxAttachmentInput"
+                "$ref": "#/components/schemas/RemitImap.UpdateFlagsInput"
               }
             }
           }
@@ -2534,21 +2974,13 @@
         }
       }
     },
-    "/outbox/{outboxMessageId}/attachments/{outboxAttachmentId}/complete": {
-      "post": {
-        "operationId": "OutboxAttachmentOperations_completeOutboxAttachment",
-        "description": "Confirm an uploaded file against the object storage now holds",
+    "/messages/{messageId}/raw": {
+      "get": {
+        "operationId": "MessageOperations_getRawMessage",
+        "description": "Get the raw RFC822/MIME source of a message (headers and body) for inspection.",
         "parameters": [
           {
-            "name": "outboxMessageId",
-            "in": "path",
-            "required": true,
-            "schema": {
-              "$ref": "#/components/schemas/UUID"
-            }
-          },
-          {
-            "name": "outboxAttachmentId",
+            "name": "messageId",
             "in": "path",
             "required": true,
             "schema": {
@@ -2562,27 +2994,97 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/RemitImap.OutboxAttachmentResponse"
+                  "$ref": "#/components/schemas/RemitImap.RawMessageResponse"
                 }
               }
             }
-          },
-          "400": {
-            "description": "Refusal response for an attachment",
+          }
+        },
+        "x-amazon-apigateway-integration": {
+          "type": "aws_proxy",
+          "httpMethod": "POST",
+          "passthroughBehavior": "when_no_match",
+          "uri": {
+            "Fn::Sub": "arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:{{HandlerFunctionName}}/invocations"
+          }
+        }
+      }
+    },
+    "/outbox": {
+      "post": {
+        "operationId": "OutboxOperations_createOutboxMessage",
+        "description": "Create a new outbox message (draft or send immediately)",
+        "parameters": [],
+        "responses": {
+          "200": {
+            "description": "The request has succeeded.",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/RemitImap.OutboxAttachmentRejection"
+                  "$ref": "#/components/schemas/RemitImap.OutboxMessageResponse"
                 }
               }
             }
-          },
-          "413": {
-            "description": "Refusal response for an attachment",
+          }
+        },
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/RemitImap.CreateOutboxMessageInput"
+              }
+            }
+          }
+        },
+        "x-amazon-apigateway-integration": {
+          "type": "aws_proxy",
+          "httpMethod": "POST",
+          "passthroughBehavior": "when_no_match",
+          "uri": {
+            "Fn::Sub": "arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:{{HandlerFunctionName}}/invocations"
+          }
+        }
+      },
+      "get": {
+        "operationId": "OutboxOperations_listOutboxMessages",
+        "description": "List outbox messages for the current account",
+        "parameters": [
+          {
+            "name": "continuationToken",
+            "in": "query",
+            "required": false,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "The request has succeeded.",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/RemitImap.OutboxAttachmentRejection"
+                  "type": "object",
+                  "required": [
+                    "items"
+                  ],
+                  "properties": {
+                    "continuationToken": {
+                      "allOf": [
+                        {
+                          "$ref": "#/components/schemas/String800"
+                        }
+                      ],
+                      "description": "Opaque, server-minted cursor: absent means the first (or last) page, present means resume from here. Echo it back unchanged to fetch the next page. Every listing endpoint that accepts it rejects a token it cannot decode with 400 ValidationError rather than silently restarting from the first page (#136, #172)."
+                    },
+                    "items": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/components/schemas/RemitImap.OutboxMessageResponse"
+                      }
+                    }
+                  }
                 }
               }
             }
@@ -2598,10 +3100,10 @@
         }
       }
     },
-    "/outbox/{outboxMessageId}/send": {
-      "post": {
-        "operationId": "OutboxDetailOperations_sendOutboxMessage",
-        "description": "Queue a draft message for sending",
+    "/outbox/{outboxMessageId}": {
+      "get": {
+        "operationId": "OutboxDetailOperations_getOutboxMessage",
+        "description": "Get an outbox message by ID",
         "parameters": [
           {
             "name": "outboxMessageId",
@@ -2632,8 +3134,245 @@
             "Fn::Sub": "arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:{{HandlerFunctionName}}/invocations"
           }
         }
-      }
-    },
+      },
+      "patch": {
+        "operationId": "OutboxDetailOperations_updateOutboxMessage",
+        "description": "Update a draft outbox message",
+        "parameters": [
+          {
+            "name": "outboxMessageId",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "$ref": "#/components/schemas/UUID"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "The request has succeeded.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/RemitImap.OutboxMessageResponse"
+                }
+              }
+            }
+          }
+        },
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/RemitImap.UpdateOutboxMessageInput"
+              }
+            }
+          }
+        },
+        "x-amazon-apigateway-integration": {
+          "type": "aws_proxy",
+          "httpMethod": "POST",
+          "passthroughBehavior": "when_no_match",
+          "uri": {
+            "Fn::Sub": "arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:{{HandlerFunctionName}}/invocations"
+          }
+        }
+      },
+      "delete": {
+        "operationId": "OutboxDetailOperations_deleteOutboxMessage",
+        "description": "Delete a draft or failed outbox message",
+        "parameters": [
+          {
+            "name": "outboxMessageId",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "$ref": "#/components/schemas/UUID"
+            }
+          }
+        ],
+        "responses": {
+          "204": {
+            "description": "There is no content to send for this request, but the headers may be useful. "
+          }
+        },
+        "x-amazon-apigateway-integration": {
+          "type": "aws_proxy",
+          "httpMethod": "POST",
+          "passthroughBehavior": "when_no_match",
+          "uri": {
+            "Fn::Sub": "arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:{{HandlerFunctionName}}/invocations"
+          }
+        }
+      }
+    },
+    "/outbox/{outboxMessageId}/attachments": {
+      "post": {
+        "operationId": "OutboxDetailOperations_mintOutboxAttachment",
+        "description": "Reserve room on a draft for a file, and get somewhere to put it",
+        "parameters": [
+          {
+            "name": "outboxMessageId",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "$ref": "#/components/schemas/UUID"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "The request has succeeded.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/RemitImap.MintOutboxAttachmentResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "Refusal response for an attachment",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/RemitImap.OutboxAttachmentRejection"
+                }
+              }
+            }
+          },
+          "413": {
+            "description": "Refusal response for an attachment",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/RemitImap.OutboxAttachmentRejection"
+                }
+              }
+            }
+          }
+        },
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/RemitImap.MintOutboxAttachmentInput"
+              }
+            }
+          }
+        },
+        "x-amazon-apigateway-integration": {
+          "type": "aws_proxy",
+          "httpMethod": "POST",
+          "passthroughBehavior": "when_no_match",
+          "uri": {
+            "Fn::Sub": "arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:{{HandlerFunctionName}}/invocations"
+          }
+        }
+      }
+    },
+    "/outbox/{outboxMessageId}/attachments/{outboxAttachmentId}/complete": {
+      "post": {
+        "operationId": "OutboxAttachmentOperations_completeOutboxAttachment",
+        "description": "Confirm an uploaded file against the object storage now holds",
+        "parameters": [
+          {
+            "name": "outboxMessageId",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "$ref": "#/components/schemas/UUID"
+            }
+          },
+          {
+            "name": "outboxAttachmentId",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "$ref": "#/components/schemas/UUID"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "The request has succeeded.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/RemitImap.OutboxAttachmentResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "Refusal response for an attachment",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/RemitImap.OutboxAttachmentRejection"
+                }
+              }
+            }
+          },
+          "413": {
+            "description": "Refusal response for an attachment",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/RemitImap.OutboxAttachmentRejection"
+                }
+              }
+            }
+          }
+        },
+        "x-amazon-apigateway-integration": {
+          "type": "aws_proxy",
+          "httpMethod": "POST",
+          "passthroughBehavior": "when_no_match",
+          "uri": {
+            "Fn::Sub": "arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:{{HandlerFunctionName}}/invocations"
+          }
+        }
+      }
+    },
+    "/outbox/{outboxMessageId}/send": {
+      "post": {
+        "operationId": "OutboxDetailOperations_sendOutboxMessage",
+        "description": "Queue a draft message for sending",
+        "parameters": [
+          {
+            "name": "outboxMessageId",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "$ref": "#/components/schemas/UUID"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "The request has succeeded.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/RemitImap.OutboxMessageResponse"
+                }
+              }
+            }
+          }
+        },
+        "x-amazon-apigateway-integration": {
+          "type": "aws_proxy",
+          "httpMethod": "POST",
+          "passthroughBehavior": "when_no_match",
+          "uri": {
+            "Fn::Sub": "arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:{{HandlerFunctionName}}/invocations"
+          }
+        }
+      }
+    },
     "/search/semantic": {
       "get": {
         "operationId": "SemanticSearchOperations_semanticSearch",
@@ -3684,276 +4423,798 @@
             "readOnly": true
           }
         },
-        "description": "Address response for address book entries"
+        "description": "Address response for address book entries"
+      },
+      "RemitImap.AddressRole": {
+        "type": "string",
+        "enum": [
+          "from",
+          "sender",
+          "reply_to",
+          "to",
+          "cc",
+          "bcc"
+        ],
+        "description": "Address roles in message headers per RFC 2822 Sections 3.6.2 and 3.6.3"
+      },
+      "RemitImap.ApplyUpdateInput": {
+        "type": "object",
+        "required": [
+          "targetVersion"
+        ],
+        "properties": {
+          "targetVersion": {
+            "type": "string",
+            "description": "The release version to install, `vX.Y.Z`"
+          }
+        },
+        "description": "Request to install a specific release. `targetVersion` must equal the version the latest check reported; the backend passes exactly this one field across the control seam and resolves nothing else (RFC 037 R6)."
+      },
+      "RemitImap.AppointFolderRoleInput": {
+        "type": "object",
+        "required": [
+          "mailboxId"
+        ],
+        "properties": {
+          "mailboxId": {
+            "type": "string",
+            "nullable": true,
+            "description": "Mailbox to appoint to the role, or `null` to clear the appointment. Typed as an inline nullable string rather than `UUID | null`: a named scalar union renders as allOf + nullable with no sibling type, which openapi-backend's AJV rejects for a `null` value — the same gotcha documented on RenameMailboxInput.displayNameOverride. An inline string keeps `null` valid at the wire; the handler validates the value as a UUID."
+          }
+        },
+        "description": "Input for PUT /accounts/{accountId}/folder-roles/{role}. Appoints the mailbox to the role, replacing whichever mailbox previously held it (exclusive by construction — the map has one slot per role). Pass `mailboxId: null` to clear the role back to unfilled."
+      },
+      "RemitImap.AutoArchiveFlag": {
+        "type": "object",
+        "required": [
+          "value"
+        ],
+        "properties": {
+          "value": {
+            "type": "boolean"
+          }
+        },
+        "allOf": [
+          {
+            "$ref": "#/components/schemas/RemitImap.AddressFlagBase"
+          }
+        ],
+        "description": "Auto-archive: skip inbox, file directly"
+      },
+      "RemitImap.AutoArchiveFlagUpdate": {
+        "type": "object",
+        "properties": {
+          "value": {
+            "type": "boolean"
+          }
+        },
+        "allOf": [
+          {
+            "$ref": "#/components/schemas/RemitImap.AddressFlagBaseUpdate"
+          }
+        ],
+        "description": "Auto-archive: skip inbox, file directly"
+      },
+      "RemitImap.AutoMovedInfo": {
+        "type": "object",
+        "properties": {
+          "action": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/RemitImap.PlacementAction"
+              }
+            ],
+            "description": "Classifier move only: direction Remit moved the message — MoveToInbox | MoveToJunk. Absent for a standing-filter move, which names its destination via `destinationMailboxId` instead."
+          },
+          "fromPlacement": {
+            "type": "string",
+            "description": "Classifier move only: folder role the message was moved from — inbox | junk | other. Used to render \"moved from Junk\" and to resolve the undo target via MailboxRole. Absent for a standing-filter move, which names its source via `fromMailboxId`."
+          },
+          "fromMailboxId": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/UUID"
+              }
+            ],
+            "description": "Standing-filter move only: the mailbox the message was moved out of. The undo target — the client resolves its display name for the badge and moves the message back here."
+          },
+          "destinationMailboxId": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/UUID"
+              }
+            ],
+            "description": "Standing-filter move only: the mailbox the filter moved the message into. The move is still in effect while the message sits here."
+          },
+          "filterId": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/UUID"
+              }
+            ],
+            "description": "Standing-filter move only: the filter that moved the message, for the Settings › Filters link. Undo does not disable it."
+          }
+        },
+        "description": "Present only when Remit auto-moved this message on body-sync. Two shapes share this model: a classifier placement move carries `action` + `fromPlacement` (Inbox/Junk direction); a standing-filter move carries `fromMailboxId` + `destinationMailboxId` + `filterId` (an arbitrary destination folder). Absent means the message was not auto-moved by Remit — clients treat absence as no indicator."
+      },
+      "RemitImap.BlockedFlag": {
+        "type": "object",
+        "required": [
+          "value"
+        ],
+        "properties": {
+          "value": {
+            "type": "boolean"
+          }
+        },
+        "allOf": [
+          {
+            "$ref": "#/components/schemas/RemitImap.AddressFlagBase"
+          }
+        ],
+        "description": "Sender is blocked: mail is placed in Junk, and images never load, even on explicit click"
+      },
+      "RemitImap.BlockedFlagUpdate": {
+        "type": "object",
+        "properties": {
+          "value": {
+            "type": "boolean"
+          }
+        },
+        "allOf": [
+          {
+            "$ref": "#/components/schemas/RemitImap.AddressFlagBaseUpdate"
+          }
+        ],
+        "description": "Sender is blocked: mail is placed in Junk, and images never load, even on explicit click"
+      },
+      "RemitImap.BodyPartResponse": {
+        "type": "object",
+        "required": [
+          "bodyPartId",
+          "mediaType",
+          "mediaSubtype",
+          "sizeOctets",
+          "isMultipart",
+          "contentUrl"
+        ],
+        "properties": {
+          "bodyPartId": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/UUID"
+              }
+            ],
+            "description": "Primary identifier",
+            "readOnly": true
+          },
+          "mediaType": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/RemitImap.MediaType"
+              }
+            ],
+            "description": "MIME type (TEXT, IMAGE, APPLICATION, etc.)",
+            "readOnly": true
+          },
+          "mediaSubtype": {
+            "type": "string",
+            "minLength": 1,
+            "description": "MIME subtype (PLAIN, HTML, PNG, PDF, etc.)",
+            "readOnly": true
+          },
+          "contentId": {
+            "type": "string",
+            "description": "Content-ID header value",
+            "readOnly": true
+          },
+          "sizeOctets": {
+            "type": "integer",
+            "format": "int64",
+            "minimum": 0,
+            "description": "Encoded size in octets",
+            "readOnly": true
+          },
+          "disposition": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/RemitImap.ContentDisposition"
+              }
+            ],
+            "description": "Content disposition (inline or attachment)",
+            "readOnly": true
+          },
+          "dispositionFilename": {
+            "type": "string",
+            "description": "Filename from Content-Disposition",
+            "readOnly": true
+          },
+          "isMultipart": {
+            "type": "boolean",
+            "description": "True if this is a multipart container",
+            "readOnly": true
+          },
+          "contentUrl": {
+            "type": "string",
+            "format": "uri",
+            "description": "CloudFront-fronted URL for fetching this body part. Cookie-authenticated via Cognito id_token. Path: /content/accounts/{accountConfigId}/{accountId}/messages/{messageId}/parts/{partPath}. Required: handlers must throw rather than emit a placeholder when CONTENT_DELIVERY_DOMAIN is unset."
+          }
+        },
+        "description": "Body part information"
+      },
+      "RemitImap.BulkMessageInput": {
+        "type": "object",
+        "required": [
+          "messageIds"
+        ],
+        "properties": {
+          "messageIds": {
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/UUID"
+            },
+            "minItems": 1,
+            "maxItems": 100,
+            "description": "List of message IDs to operate on"
+          }
+        },
+        "description": "Input for bulk message operations"
+      },
+      "RemitImap.BulkUpdateFlagsInput": {
+        "type": "object",
+        "required": [
+          "messageIds"
+        ],
+        "properties": {
+          "messageIds": {
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/UUID"
+            },
+            "minItems": 1,
+            "maxItems": 100,
+            "description": "List of message IDs to update"
+          },
+          "isRead": {
+            "type": "boolean",
+            "description": "Set messages as read (maps to \\Seen flag)"
+          },
+          "isStarred": {
+            "type": "boolean",
+            "description": "Set messages as starred (maps to \\Flagged flag)"
+          },
+          "starColor": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/RemitImap.StarColor"
+              }
+            ],
+            "description": "Star color for visual categorization"
+          }
+        },
+        "description": "Input for bulk flag update operations"
+      },
+      "RemitImap.CalendarColor": {
+        "type": "string",
+        "enum": [
+          "Cal1",
+          "Cal2",
+          "Cal3",
+          "Cal4",
+          "Cal5",
+          "Cal6"
+        ],
+        "description": "Display color for a calendar collection. Positional rather than named: the palette is a client-side concern, so the store carries the slot and the client owns what it renders (issue #15)."
+      },
+      "RemitImap.CalendarComponentSet": {
+        "type": "string",
+        "enum": [
+          "VeventOnly"
+        ],
+        "description": "Which iCalendar components a collection accepts (RFC 4791 supported-calendar-component-set). Only VEVENT is stored today; VTODO and VJOURNAL collections would be separate members, so the value is a property of the collection rather than of each object."
+      },
+      "RemitImap.CalendarEventInstance": {
+        "type": "object",
+        "required": [
+          "calendarId",
+          "calendarObjectId",
+          "recurrenceId",
+          "icalUid",
+          "summary",
+          "start",
+          "end",
+          "allDay",
+          "status",
+          "transparency",
+          "zoneCertainty",
+          "etag",
+          "hasRecurrence"
+        ],
+        "properties": {
+          "calendarId": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/UUID"
+              }
+            ],
+            "description": "Collection this occurrence belongs to"
+          },
+          "calendarObjectId": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/UUID"
+              }
+            ],
+            "description": "Resource this occurrence was expanded from"
+          },
+          "recurrenceId": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/String64"
+              }
+            ],
+            "description": "RECURRENCE-ID of this occurrence as an ISO 8601 UTC instant, or `\"\"` for a resource that does not recur. This is the value a scoped write passes back to name the occurrence it means."
+          },
+          "icalUid": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/String512"
+              }
+            ],
+            "description": "The event's iCalendar UID, shared by every occurrence of the series"
+          },
+          "summary": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/String512"
+              }
+            ],
+            "description": "Projection of the VEVENT's SUMMARY. `\"\"` when the event carries none."
+          },
+          "start": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/String64"
+              }
+            ],
+            "description": "When this occurrence starts, as an ISO 8601 date-time with zone offset, read in the collection's timezone. A business date, not an epoch instant: an all-day occurrence carries midnight of its civil date."
+          },
+          "end": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/String64"
+              }
+            ],
+            "description": "When this occurrence ends, as an ISO 8601 date-time with zone offset. Exclusive for an all-day occurrence, per RFC 5545 3.6.1."
+          },
+          "allDay": {
+            "type": "boolean",
+            "description": "Whether this occurrence is all-day"
+          },
+          "status": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/RemitImap.CalendarEventStatus"
+              }
+            ],
+            "description": "Projection of the occurrence's STATUS"
+          },
+          "transparency": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/RemitImap.CalendarTransparency"
+              }
+            ],
+            "description": "Projection of the occurrence's TRANSP — whether it consumes free/busy time"
+          },
+          "zoneCertainty": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/RemitImap.ZoneCertainty"
+              }
+            ],
+            "description": "How the resource's start was placed on the clock. `Ambiguous` means the resource named a zone nothing could resolve, so this occurrence may be hours out; a client says so rather than presenting the guess as a fact."
+          },
+          "etag": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/String64"
+              }
+            ],
+            "description": "Entity tag of the resource this occurrence came from. Pass it as `If-Match` on a scoped write to refuse an edit built on a version somebody has since replaced."
+          },
+          "hasRecurrence": {
+            "type": "boolean",
+            "description": "Whether the resource this occurrence came from expands to more than one instance. A client showing the recurrence-scope prompt gates on this."
+          }
+        },
+        "description": "One occurrence of an event, in the window the caller asked for (issue #15).\n\nInstances are expanded by the server. A client never reads an RRULE and never\nreconstructs a series: it renders what this returns, and addresses one\noccurrence by `calendarObjectId` plus `recurrenceId`."
+      },
+      "RemitImap.CalendarEventListResponse": {
+        "type": "object",
+        "required": [
+          "items"
+        ],
+        "properties": {
+          "items": {
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/RemitImap.CalendarEventInstance"
+            }
+          }
+        },
+        "description": "Expanded occurrences in the requested window, in start order.\n\nIncludes an occurrence that began before `from` and runs into the window, up\nto a bounded lookback — a meeting that started last night is part of this\nmorning. Unpaginated: the window is the bound."
+      },
+      "RemitImap.CalendarEventResponse": {
+        "type": "object",
+        "required": [
+          "calendarObjectId",
+          "calendarId",
+          "resourceName",
+          "icalUid",
+          "icalData",
+          "etag",
+          "sequence",
+          "syncSequence",
+          "summary",
+          "dtStart",
+          "dtEnd",
+          "allDay",
+          "zoneCertainty",
+          "status",
+          "transparency",
+          "hasRecurrence",
+          "expandedThrough",
+          "createdAt",
+          "updatedAt"
+        ],
+        "properties": {
+          "calendarObjectId": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/UUID"
+              }
+            ],
+            "description": "Primary identifier, derived from calendarId + resourceName",
+            "readOnly": true
+          },
+          "calendarId": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/UUID"
+              }
+            ],
+            "description": "Collection this resource belongs to",
+            "readOnly": true
+          },
+          "resourceName": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/String256"
+              }
+            ],
+            "description": "Last path segment of the resource's URL, e.g. \"a1b2c3.ics\". Unique within the collection and chosen by whoever wrote the resource, never derived from its contents — a client is free to rename a resource without changing the event it holds.",
+            "readOnly": true
+          },
+          "icalUid": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/String512"
+              }
+            ],
+            "description": "The VEVENT's UID property (RFC 5545 3.8.4.7). Identifies the event across collections and servers, which `resourceName` does not.",
+            "readOnly": true
+          },
+          "icalData": {
+            "type": "string",
+            "description": "The complete VCALENDAR text, byte-for-byte as stored — CANONICAL. Line endings are CRLF and are never normalized; unknown properties and components are preserved verbatim.",
+            "readOnly": true
+          },
+          "etag": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/String64"
+              }
+            ],
+            "description": "Strong entity tag over the stored `icalData` bytes, used for If-Match on a conditional write and for change detection on read.",
+            "readOnly": true
+          },
+          "sequence": {
+            "type": "integer",
+            "format": "int32",
+            "description": "The VEVENT's SEQUENCE property (RFC 5545 3.8.7.4) — the organizer's own revision counter, carried for scheduling comparisons. `0` when the event declares none, which is the RFC default.",
+            "default": 0,
+            "readOnly": true
+          },
+          "syncSequence": {
+            "type": "integer",
+            "format": "int64",
+            "description": "Value the owning collection's `syncSequence` held after the write that produced this row. Pages the `bySyncSequence` read.",
+            "default": 0,
+            "readOnly": true
+          },
+          "summary": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/String512"
+              }
+            ],
+            "description": "Projection of the VEVENT's SUMMARY (RFC 5545 3.8.1.12). `\"\"` when the event carries none.",
+            "readOnly": true
+          },
+          "dtStart": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/String64"
+              }
+            ],
+            "description": "Projection of the master VEVENT's DTSTART as an ISO 8601 date-time with zone offset — a business date, not an epoch instant. An all-day event carries midnight in the event's own zone.",
+            "readOnly": true
+          },
+          "dtEnd": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/String64"
+              }
+            ],
+            "description": "Projection of the master VEVENT's effective end as an ISO 8601 date-time with zone offset, resolved from DTEND or from DTSTART + DURATION. An event with neither ends when it starts (RFC 5545 3.6.1).",
+            "readOnly": true
+          },
+          "allDay": {
+            "type": "boolean",
+            "description": "Whether the master VEVENT's DTSTART is a DATE rather than a DATE-TIME (RFC 5545 3.3.4) — an all-day or multi-day event, whose end is exclusive.",
+            "default": false,
+            "readOnly": true
+          },
+          "zoneCertainty": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/RemitImap.ZoneCertainty"
+              }
+            ],
+            "description": "How the master VEVENT's DTSTART was placed on the clock. `Ambiguous` means the resource named a zone nothing could resolve, so `dtStart` and every occurrence expanded from it may be off by hours — a client shows the event and says so rather than presenting a guess as a fact.",
+            "default": "Explicit",
+            "readOnly": true
+          },
+          "status": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/RemitImap.CalendarEventStatus"
+              }
+            ],
+            "description": "Projection of the master VEVENT's STATUS",
+            "default": "Confirmed",
+            "readOnly": true
+          },
+          "transparency": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/RemitImap.CalendarTransparency"
+              }
+            ],
+            "description": "Projection of the master VEVENT's TRANSP",
+            "default": "Opaque",
+            "readOnly": true
+          },
+          "hasRecurrence": {
+            "type": "boolean",
+            "description": "Whether the resource expands to more than its master instance — an RRULE, an RDATE, or an override VEVENT. Overrides count on their own: a client that edits one instance and then drops the rule leaves a resource with a master and its exceptions, and each of those is still an occurrence.",
+            "default": false,
+            "readOnly": true
+          },
+          "expandedThrough": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/String64"
+              }
+            ],
+            "description": "ISO 8601 UTC instant through which `CalendarEventIndex` rows exist for this resource, when the series runs past the expansion horizon and the index is therefore incomplete. `\"\"` when the index is exhaustive — a single event, or a series that ends inside the horizon. A later live-expansion pass reads this to find the resources whose instances it must compute rather than query.",
+            "default": "",
+            "readOnly": true
+          },
+          "createdAt": {
+            "type": "integer",
+            "format": "int64",
+            "readOnly": true
+          },
+          "updatedAt": {
+            "type": "integer",
+            "format": "int64",
+            "readOnly": true
+          }
+        },
+        "description": "A stored calendar resource — the bytes behind one event, plus the columns projected from them. `icalData` is canonical; every other field is derived from it on write."
       },
-      "RemitImap.AddressRole": {
+      "RemitImap.CalendarEventStatus": {
         "type": "string",
         "enum": [
-          "from",
-          "sender",
-          "reply_to",
-          "to",
-          "cc",
-          "bcc"
+          "Confirmed",
+          "Tentative",
+          "Cancelled"
         ],
-        "description": "Address roles in message headers per RFC 2822 Sections 3.6.2 and 3.6.3"
+        "description": "Projection of a VEVENT's STATUS property (RFC 5545 3.8.1.11). A VEVENT with no STATUS projects as `Confirmed`, which is the value RFC 5545 gives an event whose status is unstated."
       },
-      "RemitImap.ApplyUpdateInput": {
+      "RemitImap.CalendarFreeBusyResponse": {
         "type": "object",
         "required": [
-          "targetVersion"
+          "items"
         ],
         "properties": {
-          "targetVersion": {
-            "type": "string",
-            "description": "The release version to install, `vX.Y.Z`"
+          "items": {
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/RemitImap.CalendarFreeBusySpan"
+            }
           }
         },
-        "description": "Request to install a specific release. `targetVersion` must equal the version the latest check reported; the backend passes exactly this one field across the control seam and resolves nothing else (RFC 037 R6)."
+        "description": "Merged busy spans over the requested window, in start order. An event marked TRANSP:TRANSPARENT or STATUS:CANCELLED is not busy time and never appears here."
       },
-      "RemitImap.AppointFolderRoleInput": {
+      "RemitImap.CalendarFreeBusySpan": {
         "type": "object",
         "required": [
-          "mailboxId"
+          "start",
+          "end"
         ],
         "properties": {
-          "mailboxId": {
-            "type": "string",
-            "nullable": true,
-            "description": "Mailbox to appoint to the role, or `null` to clear the appointment. Typed as an inline nullable string rather than `UUID | null`: a named scalar union renders as allOf + nullable with no sibling type, which openapi-backend's AJV rejects for a `null` value — the same gotcha documented on RenameMailboxInput.displayNameOverride. An inline string keeps `null` valid at the wire; the handler validates the value as a UUID."
+          "start": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/String64"
+              }
+            ],
+            "description": "When the busy stretch starts, as an ISO 8601 date-time with a `+00:00` offset. A busy span is an interval on the clock rather than a civil date, so it carries no calendar's local zone — the caller renders it in whichever zone it is drawing."
+          },
+          "end": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/String64"
+              }
+            ],
+            "description": "When the busy stretch ends, as an ISO 8601 date-time with a `+00:00` offset"
           }
         },
-        "description": "Input for PUT /accounts/{accountId}/folder-roles/{role}. Appoints the mailbox to the role, replacing whichever mailbox previously held it (exclusive by construction — the map has one slot per role). Pass `mailboxId: null` to clear the role back to unfilled."
+        "description": "One stretch of time the caller is busy in. Merged across every calendar they\nhold, so two overlapping meetings in two calendars are one span and a caller\nasking \"is this slot free\" never has to do the merging itself."
       },
-      "RemitImap.AutoArchiveFlag": {
+      "RemitImap.CalendarListResponse": {
         "type": "object",
         "required": [
-          "value"
+          "items"
         ],
         "properties": {
-          "value": {
-            "type": "boolean"
+          "items": {
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/RemitImap.CalendarResponse"
+            }
           }
         },
-        "allOf": [
-          {
-            "$ref": "#/components/schemas/RemitImap.AddressFlagBase"
-          }
-        ],
-        "description": "Auto-archive: skip inbox, file directly"
+        "description": "Every calendar collection of the caller's account config, url segment first. Unpaginated: an account holds a handful of calendars, and a page boundary in a sidebar is a bug waiting to happen."
       },
-      "RemitImap.AutoArchiveFlagUpdate": {
+      "RemitImap.CalendarResponse": {
         "type": "object",
-        "properties": {
-          "value": {
-            "type": "boolean"
-          }
-        },
-        "allOf": [
-          {
-            "$ref": "#/components/schemas/RemitImap.AddressFlagBaseUpdate"
-          }
+        "required": [
+          "calendarId",
+          "accountConfigId",
+          "urlSegment",
+          "displayName",
+          "color",
+          "componentSet",
+          "source",
+          "timezone",
+          "syncSequence",
+          "createdAt",
+          "updatedAt"
         ],
-        "description": "Auto-archive: skip inbox, file directly"
-      },
-      "RemitImap.AutoMovedInfo": {
-        "type": "object",
         "properties": {
-          "action": {
+          "calendarId": {
             "allOf": [
               {
-                "$ref": "#/components/schemas/RemitImap.PlacementAction"
+                "$ref": "#/components/schemas/UUID"
               }
             ],
-            "description": "Classifier move only: direction Remit moved the message — MoveToInbox | MoveToJunk. Absent for a standing-filter move, which names its destination via `destinationMailboxId` instead."
-          },
-          "fromPlacement": {
-            "type": "string",
-            "description": "Classifier move only: folder role the message was moved from — inbox | junk | other. Used to render \"moved from Junk\" and to resolve the undo target via MailboxRole. Absent for a standing-filter move, which names its source via `fromMailboxId`."
+            "description": "Primary identifier, derived from accountConfigId + urlSegment",
+            "readOnly": true
           },
-          "fromMailboxId": {
+          "accountConfigId": {
             "allOf": [
               {
                 "$ref": "#/components/schemas/UUID"
               }
             ],
-            "description": "Standing-filter move only: the mailbox the message was moved out of. The undo target — the client resolves its display name for the badge and moves the message back here."
+            "description": "Owning account configuration",
+            "readOnly": true
           },
-          "destinationMailboxId": {
+          "urlSegment": {
             "allOf": [
               {
-                "$ref": "#/components/schemas/UUID"
+                "$ref": "#/components/schemas/String64"
               }
             ],
-            "description": "Standing-filter move only: the mailbox the filter moved the message into. The move is still in effect while the message sits here."
+            "description": "Path segment this collection is addressed by, unique within the account config. Stored case-folded, the same folding `calendarId` is derived from — a DAV path is matched case-insensitively, and storing the writer's casing would let a lookup by segment and a lookup by derived id disagree about one path. The default collection provisioned on first use holds \"default\".",
+            "readOnly": true
           },
-          "filterId": {
+          "displayName": {
             "allOf": [
               {
-                "$ref": "#/components/schemas/UUID"
+                "$ref": "#/components/schemas/String140"
               }
             ],
-            "description": "Standing-filter move only: the filter that moved the message, for the Settings › Filters link. Undo does not disable it."
-          }
-        },
-        "description": "Present only when Remit auto-moved this message on body-sync. Two shapes share this model: a classifier placement move carries `action` + `fromPlacement` (Inbox/Junk direction); a standing-filter move carries `fromMailboxId` + `destinationMailboxId` + `filterId` (an arbitrary destination folder). Absent means the message was not auto-moved by Remit — clients treat absence as no indicator."
-      },
-      "RemitImap.BlockedFlag": {
-        "type": "object",
-        "required": [
-          "value"
-        ],
-        "properties": {
-          "value": {
-            "type": "boolean"
-          }
-        },
-        "allOf": [
-          {
-            "$ref": "#/components/schemas/RemitImap.AddressFlagBase"
-          }
-        ],
-        "description": "Sender is blocked: mail is placed in Junk, and images never load, even on explicit click"
-      },
-      "RemitImap.BlockedFlagUpdate": {
-        "type": "object",
-        "properties": {
-          "value": {
-            "type": "boolean"
-          }
-        },
-        "allOf": [
-          {
-            "$ref": "#/components/schemas/RemitImap.AddressFlagBaseUpdate"
-          }
-        ],
-        "description": "Sender is blocked: mail is placed in Junk, and images never load, even on explicit click"
-      },
-      "RemitImap.BodyPartResponse": {
-        "type": "object",
-        "required": [
-          "bodyPartId",
-          "mediaType",
-          "mediaSubtype",
-          "sizeOctets",
-          "isMultipart",
-          "contentUrl"
-        ],
-        "properties": {
-          "bodyPartId": {
+            "description": "Human-readable collection name (display)"
+          },
+          "color": {
             "allOf": [
               {
-                "$ref": "#/components/schemas/UUID"
+                "$ref": "#/components/schemas/RemitImap.CalendarColor"
               }
             ],
-            "description": "Primary identifier",
-            "readOnly": true
+            "description": "Display color slot for this collection",
+            "default": "Cal1"
           },
-          "mediaType": {
+          "componentSet": {
             "allOf": [
               {
-                "$ref": "#/components/schemas/RemitImap.MediaType"
+                "$ref": "#/components/schemas/RemitImap.CalendarComponentSet"
               }
             ],
-            "description": "MIME type (TEXT, IMAGE, APPLICATION, etc.)",
-            "readOnly": true
-          },
-          "mediaSubtype": {
-            "type": "string",
-            "minLength": 1,
-            "description": "MIME subtype (PLAIN, HTML, PNG, PDF, etc.)",
-            "readOnly": true
-          },
-          "contentId": {
-            "type": "string",
-            "description": "Content-ID header value",
+            "description": "Which iCalendar components this collection accepts",
+            "default": "VeventOnly",
             "readOnly": true
           },
-          "sizeOctets": {
-            "type": "integer",
-            "format": "int64",
-            "minimum": 0,
-            "description": "Encoded size in octets",
+          "source": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/RemitImap.CalendarSource"
+              }
+            ],
+            "description": "Where this collection came from",
+            "default": "UserCreated",
             "readOnly": true
           },
-          "disposition": {
+          "timezone": {
             "allOf": [
               {
-                "$ref": "#/components/schemas/RemitImap.ContentDisposition"
+                "$ref": "#/components/schemas/String64"
               }
             ],
-            "description": "Content disposition (inline or attachment)",
-            "readOnly": true
+            "description": "IANA time zone this collection's floating times are read in, e.g. \"Europe/Amsterdam\". `\"\"` when none is set, which reads as UTC.",
+            "default": ""
           },
-          "dispositionFilename": {
-            "type": "string",
-            "description": "Filename from Content-Disposition",
+          "syncSequence": {
+            "type": "integer",
+            "format": "int64",
+            "description": "Monotonic change counter for this collection. Bumped by every write to one of its objects; the value stamped on `CalendarObject.syncSequence` is the value this counter held after that write.",
+            "default": 0,
             "readOnly": true
           },
-          "isMultipart": {
-            "type": "boolean",
-            "description": "True if this is a multipart container",
+          "createdAt": {
+            "type": "integer",
+            "format": "int64",
             "readOnly": true
           },
-          "contentUrl": {
-            "type": "string",
-            "format": "uri",
-            "description": "CloudFront-fronted URL for fetching this body part. Cookie-authenticated via Cognito id_token. Path: /content/accounts/{accountConfigId}/{accountId}/messages/{messageId}/parts/{partPath}. Required: handlers must throw rather than emit a placeholder when CONTENT_DELIVERY_DOMAIN is unset."
+          "updatedAt": {
+            "type": "integer",
+            "format": "int64",
+            "readOnly": true
           }
         },
-        "description": "Body part information"
+        "description": "A calendar collection as the API returns it."
       },
-      "RemitImap.BulkMessageInput": {
-        "type": "object",
-        "required": [
-          "messageIds"
+      "RemitImap.CalendarSource": {
+        "type": "string",
+        "enum": [
+          "Default",
+          "UserCreated",
+          "MailDerived"
         ],
-        "properties": {
-          "messageIds": {
-            "type": "array",
-            "items": {
-              "$ref": "#/components/schemas/UUID"
-            },
-            "minItems": 1,
-            "maxItems": 100,
-            "description": "List of message IDs to operate on"
-          }
-        },
-        "description": "Input for bulk message operations"
+        "description": "Where a calendar collection came from. `Default` is the one provisioned per account config on first use and is never deleted; `UserCreated` is one a person made; `MailDerived` is one populated from mail rather than by a person."
       },
-      "RemitImap.BulkUpdateFlagsInput": {
-        "type": "object",
-        "required": [
-          "messageIds"
+      "RemitImap.CalendarTransparency": {
+        "type": "string",
+        "enum": [
+          "Opaque",
+          "Transparent"
         ],
-        "properties": {
-          "messageIds": {
-            "type": "array",
-            "items": {
-              "$ref": "#/components/schemas/UUID"
-            },
-            "minItems": 1,
-            "maxItems": 100,
-            "description": "List of message IDs to update"
-          },
-          "isRead": {
-            "type": "boolean",
-            "description": "Set messages as read (maps to \\Seen flag)"
-          },
-          "isStarred": {
-            "type": "boolean",
-            "description": "Set messages as starred (maps to \\Flagged flag)"
-          },
-          "starColor": {
-            "allOf": [
-              {
-                "$ref": "#/components/schemas/RemitImap.StarColor"
-              }
-            ],
-            "description": "Star color for visual categorization"
-          }
-        },
-        "description": "Input for bulk flag update operations"
+        "description": "Projection of a VEVENT's TRANSP property (RFC 5545 3.8.2.7) — whether the event consumes free/busy time. A VEVENT with no TRANSP projects as `Opaque`, the RFC default."
       },
       "RemitImap.CanonicalMailboxRole": {
         "type": "string",
@@ -4021,6 +5282,14 @@
               "$ref": "#/components/schemas/RemitImap.AccountResponse"
             },
             "description": "Associated email accounts"
+          },
+          "pendingImport": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/RemitImap.PendingConfigImport"
+              }
+            ],
+            "description": "Absent unless a configuration import is still waiting on folders IMAP has not produced yet (#1021). Nothing polls a separate route for it."
           }
         },
         "description": "Full configuration description including accounts"
@@ -4045,6 +5314,113 @@
         },
         "description": "A configuration export: one versioned document carrying every user decision this instance holds, and no credential."
       },
+      "RemitImap.ConfigImportItemReport": {
+        "type": "object",
+        "required": [
+          "section",
+          "key",
+          "verdict"
+        ],
+        "properties": {
+          "section": {
+            "type": "string",
+            "description": "Which section: accounts | labels | filters | addressFlags | settings"
+          },
+          "key": {
+            "type": "string",
+            "description": "Human key of the item - an email, a label name, a filter name"
+          },
+          "verdict": {
+            "type": "string",
+            "description": "created | updated | unchanged | skipped | rejected"
+          },
+          "reason": {
+            "type": "string",
+            "description": "Why, when the verdict is skipped or rejected"
+          }
+        },
+        "description": "What became of one item in the submitted document"
+      },
+      "RemitImap.ConfigImportMode": {
+        "type": "string",
+        "enum": [
+          "validate",
+          "apply"
+        ],
+        "description": "Whether an import writes. The default is the dry run, so the wizard can show what a file would do before anything lands."
+      },
+      "RemitImap.ConfigImportOnExisting": {
+        "type": "string",
+        "enum": [
+          "abort",
+          "merge"
+        ],
+        "description": "What an import does when the configuration it is importing into is not empty."
+      },
+      "RemitImap.ConfigImportReport": {
+        "type": "object",
+        "required": [
+          "valid",
+          "schemaVersion",
+          "applied",
+          "items",
+          "errors",
+          "warnings",
+          "accountsNeedingCredentials"
+        ],
+        "properties": {
+          "importId": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/UUID"
+              }
+            ],
+            "description": "Import identity; present on apply, so the folder bindings this import is still waiting on can be named later"
+          },
+          "valid": {
+            "type": "boolean",
+            "description": "Whether the document is importable at all"
+          },
+          "schemaVersion": {
+            "type": "integer",
+            "format": "int32",
+            "description": "Schema version of the submitted document"
+          },
+          "applied": {
+            "type": "boolean",
+            "description": "Whether anything was written"
+          },
+          "items": {
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/RemitImap.ConfigImportItemReport"
+            },
+            "description": "Per-item verdicts"
+          },
+          "errors": {
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/ApiError"
+            },
+            "description": "Blocking problems; non-empty means nothing was written"
+          },
+          "warnings": {
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/ApiError"
+            },
+            "description": "Non-blocking notes - e.g. a folder path this account does not hold yet"
+          },
+          "accountsNeedingCredentials": {
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/UUID"
+            },
+            "description": "Accounts that landed needing a credential before they can sync"
+          }
+        },
+        "description": "The outcome of a validate or an apply. A rejected document is an answer, not a failure: `valid` is false and `errors` says why."
+      },
       "RemitImap.ConnectionState": {
         "type": "string",
         "enum": [
@@ -4052,7 +5428,8 @@
           "authenticated",
           "selected",
           "logout",
-          "reauth_required"
+          "reauth_required",
+          "credentials_missing"
         ],
         "description": "IMAP connection states per RFC 9051 Section 3"
       },
@@ -4182,6 +5559,144 @@
         },
         "description": "Input for creating a new email account"
       },
+      "RemitImap.CreateCalendarEventInput": {
+        "type": "object",
+        "required": [
+          "calendarId",
+          "summary",
+          "start",
+          "end"
+        ],
+        "properties": {
+          "calendarId": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/UUID"
+              }
+            ],
+            "description": "Collection to write the event into"
+          },
+          "summary": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/String512"
+              }
+            ],
+            "description": "SUMMARY of the event"
+          },
+          "description": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/String2048"
+              }
+            ],
+            "description": "DESCRIPTION of the event. Absent writes none."
+          },
+          "location": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/String512"
+              }
+            ],
+            "description": "LOCATION of the event. Absent writes none."
+          },
+          "start": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/String64"
+              }
+            ],
+            "description": "When the event starts: an ISO 8601 date-time with zone offset, or a `YYYY-MM-DD` date when `allDay` is set."
+          },
+          "end": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/String64"
+              }
+            ],
+            "description": "When the event ends, in the same form as `start`. Exclusive for an all-day event, per RFC 5545 3.6.1."
+          },
+          "allDay": {
+            "type": "boolean",
+            "description": "Whether this is an all-day event, whose times are civil dates rather than instants"
+          },
+          "timeZone": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/String64"
+              }
+            ],
+            "description": "IANA time zone the event is anchored in, e.g. \"Europe/Amsterdam\", written as the DTSTART TZID. Absent anchors the event in UTC. Refused with 400 when the zone is one this server cannot resolve — a calendar that accepted an unknown zone would draw the event hours away from where it belongs."
+          },
+          "status": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/RemitImap.CalendarEventStatus"
+              }
+            ],
+            "description": "STATUS of the event"
+          },
+          "transparency": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/RemitImap.CalendarTransparency"
+              }
+            ],
+            "description": "TRANSP of the event — whether it consumes free/busy time"
+          },
+          "recurrenceRule": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/String512"
+              }
+            ],
+            "description": "RRULE value for a recurring event, e.g. \"FREQ=WEEKLY;BYDAY=MO\" (RFC 5545 3.8.5.3), without the property name. `\"\"` creates a single event. Refused with 400 when it is not a rule this server can read."
+          }
+        },
+        "description": "Input for creating an event (issue #15). The server builds the VEVENT and\nwrites it through the single calendar write path, so an event created here,\none accepted from an invitation, and one PUT over CalDAV are the same bytes\nwritten the same way.\n\nTimes are ISO 8601 with zone offset — or a bare `YYYY-MM-DD` date when\n`allDay` is set. The offset pins the instant; `timeZone` names the zone the\nevent is anchored in, which is what a recurring event needs to survive a DST\ntransition. An offset alone cannot: a weekly 09:00 meeting written as\n`+02:00` becomes an 08:00 meeting in November."
+      },
+      "RemitImap.CreateCalendarInput": {
+        "type": "object",
+        "required": [
+          "displayName",
+          "urlSegment"
+        ],
+        "properties": {
+          "displayName": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/String140"
+              }
+            ],
+            "description": "Human-readable collection name (display)"
+          },
+          "urlSegment": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/String64"
+              }
+            ],
+            "description": "Path segment addressing this collection, unique within the account config. Case-folded on write, so \"Work\" and \"work\" name the same collection and the second create is refused rather than silently merged into the first."
+          },
+          "color": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/RemitImap.CalendarColor"
+              }
+            ],
+            "description": "Display colour slot. Absent takes the collection's own default."
+          },
+          "timezone": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/String64"
+              }
+            ],
+            "description": "IANA time zone this collection's floating times are read in. Absent reads them as UTC."
+          }
+        },
+        "description": "Input for creating a calendar collection (issue #15).\n\n`urlSegment` is supplied rather than derived from the display name: it is the\ncollection's identity — `calendarId` is a hash of it — and the path a CalDAV\nclient will later bookmark. Slugging a name would make two calendars called\n\"Work\" one row, and a rename would either move a bookmarked path or leave a\nsegment that no longer matches anything a person recognises. The name is the\nmutable overlay; this is the address."
+      },
       "RemitImap.CreateExportResponse": {
         "type": "object",
         "required": [
@@ -4945,6 +6460,38 @@
         ],
         "description": "Where a resolved FolderAppointment came from. Total and required: every role carries one, so a surface can tell a folder somebody chose from a folder reader guessed without inferring it from which fields happen to be present."
       },
+      "RemitImap.ImportConfigInput": {
+        "type": "object",
+        "required": [
+          "document"
+        ],
+        "properties": {
+          "mode": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/RemitImap.ConfigImportMode"
+              }
+            ],
+            "description": "`validate` writes nothing; `apply` writes.",
+            "default": "validate"
+          },
+          "onExisting": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/RemitImap.ConfigImportOnExisting"
+              }
+            ],
+            "description": "What to do when this configuration is not empty.",
+            "default": "abort"
+          },
+          "document": {
+            "type": "object",
+            "additionalProperties": {},
+            "description": "The config document, as exported."
+          }
+        },
+        "description": "Request body for POST /config/import"
+      },
       "RemitImap.JunkOnlyFlag": {
         "type": "object",
         "required": [
@@ -6213,6 +7760,31 @@
         ],
         "description": "Status of an outbox message in the send queue"
       },
+      "RemitImap.PendingConfigImport": {
+        "type": "object",
+        "required": [
+          "importId",
+          "folderPaths"
+        ],
+        "properties": {
+          "importId": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/UUID"
+              }
+            ],
+            "description": "The import still waiting"
+          },
+          "folderPaths": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            },
+            "description": "The IMAP paths no mailbox answers to yet, deduplicated"
+          }
+        },
+        "description": "An import that is still waiting for IMAP discovery to produce the folders its\nfile named. The folder appointed to a role, a folder's own display name or\nmute, and a filter's move destination are all bound by path; a path this\naccount does not hold yet is kept, not guessed, and bound the moment discovery\nfinds it."
+      },
       "RemitImap.PlacementAction": {
         "type": "string",
         "enum": [
@@ -6496,6 +8068,15 @@
         },
         "description": "Raw RFC822/MIME source of a message (headers and body), decoded as a string for inspection."
       },
+      "RemitImap.RecurrenceScope": {
+        "type": "string",
+        "enum": [
+          "This",
+          "Following",
+          "All"
+        ],
+        "description": "Which occurrences of a recurring event a write applies to (issue #15). A request parameter, never a stored column: the resource records what the series is, and this records what the caller meant by editing one drawing of it."
+      },
       "RemitImap.ReferenceType": {
         "type": "string",
         "enum": [
@@ -7505,6 +9086,79 @@
         },
         "description": "Input for updating an Address (currently flag updates only)"
       },
+      "RemitImap.UpdateCalendarEventInput": {
+        "type": "object",
+        "properties": {
+          "summary": {
+            "$ref": "#/components/schemas/String512"
+          },
+          "description": {
+            "$ref": "#/components/schemas/String2048"
+          },
+          "location": {
+            "$ref": "#/components/schemas/String512"
+          },
+          "start": {
+            "$ref": "#/components/schemas/String64"
+          },
+          "end": {
+            "$ref": "#/components/schemas/String64"
+          },
+          "allDay": {
+            "type": "boolean"
+          },
+          "timeZone": {
+            "$ref": "#/components/schemas/String64"
+          },
+          "status": {
+            "$ref": "#/components/schemas/RemitImap.CalendarEventStatus"
+          },
+          "transparency": {
+            "$ref": "#/components/schemas/RemitImap.CalendarTransparency"
+          },
+          "recurrenceRule": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/String512"
+              }
+            ],
+            "description": "RRULE value, or `\"\"` to drop the rule. Only meaningful with `scope=All` or `scope=Following`: an override is one occurrence and carries no rule of its own."
+          }
+        },
+        "description": "Input for updating an event. Every field is optional and absence means\nuntouched — a patch that carries only `summary` renames the event and moves\nnothing.\n\nWhat the patch applies to is the `scope` parameter's business: `All` rewrites\nthe master, `This` writes a RECURRENCE-ID override for one occurrence, and\n`Following` splits the series at one occurrence and applies the patch to the\nremainder."
+      },
+      "RemitImap.UpdateCalendarInput": {
+        "type": "object",
+        "properties": {
+          "displayName": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/String140"
+              }
+            ],
+            "description": "Human-readable collection name (display)"
+          },
+          "color": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/RemitImap.CalendarColor"
+              }
+            ],
+            "description": "Display color slot for this collection",
+            "default": "Cal1"
+          },
+          "timezone": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/String64"
+              }
+            ],
+            "description": "IANA time zone this collection's floating times are read in, e.g. \"Europe/Amsterdam\". `\"\"` when none is set, which reads as UTC.",
+            "default": ""
+          }
+        },
+        "description": "Input for updating a calendar collection. The name, colour and timezone are the mutable overlay; `urlSegment` is not among them, because it is the collection's identity and the path a client has bookmarked."
+      },
       "RemitImap.UpdateFilterInput": {
         "type": "object",
         "properties": {
@@ -7828,6 +9482,15 @@
         ],
         "description": "Sender is wellknown: engagement counters crossed the promotion threshold"
       },
+      "RemitImap.ZoneCertainty": {
+        "type": "string",
+        "enum": [
+          "Local",
+          "Explicit",
+          "Ambiguous"
+        ],
+        "description": "How confidently a stored time was placed on the clock. A calendar that cannot say this hides its worst failure: an event read in the wrong zone is off by hours and looks exactly like an event read correctly."
+      },
       "String140": {
         "type": "string",
         "maxLength": 140