@serve.zone/interfaces 20.1.0 → 20.2.0

package/changelog.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 2026-07-29 - 20.2.0
+
+### Features
+
+- add CoreMail data and request contracts (coremail)
+  - Export CoreMail shared data models, transfer grants, desired-state structures, reconciliation status, and limits
+  - Add CoreMail TypedRequest interfaces for workload authentication, outbound submissions, inbound delivery handling, reconciliation, and gateway handoffs
+  - Document CoreMail authority, transfer, and desired-state constraints with contract coverage
+  - Bump @api.global/typedrequest-interfaces to ^4.0.0
+
 ## 2026-07-29 - 20.1.0
 
 ### Features

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@serve.zone/interfaces',
-    version: '20.1.0',
+    version: '20.2.0',
     description: 'Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSx3QkFBd0I7SUFDOUIsT0FBTyxFQUFFLFFBQVE7SUFDakIsV0FBVyxFQUFFLHVGQUF1RjtDQUNyRyxDQUFBIn0=

package/dist_ts/data/coremail.d.ts

@@ -0,0 +1,216 @@
+/**
+ * Shared CoreMail contracts.
+ *
+ * Workload authority is always derived from an authenticated transport
+ * session. Application-facing request DTOs therefore carry message or
+ * delivery identifiers only and never caller-selected tenant, service, or
+ * binding authority.
+ */
+export type TCoreMailSha256 = `sha256:${string}`;
+export type TCoreMailCapability = 'outbound' | 'inbound';
+export type TCoreMailBindingState = 'active' | 'disabled';
+export type TCoreMailCredentialState = 'current' | 'retiring';
+export type TCoreMailPartKind = 'text' | 'html' | 'attachment';
+export type TCoreMailTransferMethod = 'PUT' | 'GET';
+export type TCoreMailSubmissionState = 'preparing' | 'uploading' | 'ready' | 'accepted' | 'queued' | 'delivering' | 'delivered' | 'deferred' | 'failed' | 'deadLettered';
+export type TCoreMailInboundDeliveryState = 'pending' | 'fetching' | 'fetched' | 'acknowledged';
+export type TCoreMailInboundAckOutcome = 'processed' | 'discarded';
+export type TCoreMailRecipientAction = 'accept' | 'reject' | 'defer';
+export type TCoreMailReconciliationState = 'applying' | 'ready' | 'failed';
+export type TCoreMailErrorCode = 'AUTHENTICATION_FAILED' | 'AUTHENTICATION_EXPIRED' | 'AUTHORITY_REVOKED' | 'CAPABILITY_DENIED' | 'NOT_FOUND' | 'INVALID_REQUEST' | 'INVALID_MAILBOX' | 'INVALID_SENDER' | 'INVALID_RECIPIENT' | 'INVALID_HEADER' | 'PAYLOAD_LIMIT_EXCEEDED' | 'IDEMPOTENCY_CONFLICT' | 'STATE_CONFLICT' | 'TRANSFER_GRANT_EXPIRED' | 'TRANSFER_GRANT_REPLAYED' | 'TRANSFER_LENGTH_MISMATCH' | 'TRANSFER_DIGEST_MISMATCH' | 'TRANSFER_ENCODING_UNSUPPORTED' | 'OBJECT_INTEGRITY_CONFLICT' | 'DELIVERY_NOT_FETCHED' | 'GATEWAY_UNAVAILABLE' | 'RECONCILIATION_FENCE_MISMATCH';
+export interface ICoreMailErrorData {
+    code: TCoreMailErrorCode;
+    retryable: boolean;
+    retryAfterMs?: number;
+}
+export interface ICoreMailMailbox {
+    address: string;
+    displayName?: string;
+}
+export interface ICoreMailEnvelope {
+    mailFrom: string;
+    rcptTo: string[];
+}
+export interface ICoreMailHeader {
+    name: string;
+    value: string;
+}
+export interface ICoreMailContentDescriptor {
+    partId: string;
+    kind: TCoreMailPartKind;
+    contentType: string;
+    filename?: string;
+    contentId?: string;
+    sha256: TCoreMailSha256;
+    lengthBytes: number;
+}
+export interface ICoreMailOutboundMessageDescriptor {
+    sender: ICoreMailMailbox;
+    recipients: {
+        to: ICoreMailMailbox[];
+        cc?: ICoreMailMailbox[];
+        bcc?: ICoreMailMailbox[];
+    };
+    replyTo?: ICoreMailMailbox;
+    subject: string;
+    /** Ordered headers. Transport-owned MIME headers are not accepted here. */
+    headers?: ICoreMailHeader[];
+    /** Ordered body and attachment descriptors. Bytes move through bounded HTTP transfers. */
+    parts: ICoreMailContentDescriptor[];
+}
+export interface ICoreMailTransferGrant {
+    grantId: string;
+    method: TCoreMailTransferMethod;
+    /** Same-origin path. Callers use the authenticated CoreMail or gateway endpoint they already hold. */
+    path: string;
+    /** One-time bearer capability. It must never be logged or persisted by a consumer. */
+    bearerToken: string;
+    sha256: TCoreMailSha256;
+    lengthBytes: number;
+    contentType: string;
+    expiresAt: number;
+}
+export interface ICoreMailUploadGrant extends ICoreMailTransferGrant {
+    method: 'PUT';
+}
+export interface ICoreMailDownloadGrant extends ICoreMailTransferGrant {
+    method: 'GET';
+}
+export interface ICoreMailPartStatus {
+    partId: string;
+    state: 'missing' | 'uploading' | 'complete' | 'failed';
+    sha256: TCoreMailSha256;
+    lengthBytes: number;
+}
+export interface ICoreMailSubmission {
+    submissionId: string;
+    idempotencyKey: string;
+    submissionDigest: TCoreMailSha256;
+    state: TCoreMailSubmissionState;
+    parts: ICoreMailPartStatus[];
+    transportMessageId?: string;
+    attempts: number;
+    nextAttemptAt?: number;
+    acceptedAt?: number;
+    deliveredAt?: number;
+    createdAt: number;
+    updatedAt: number;
+}
+export interface ICoreMailInboundDelivery {
+    deliveryId: string;
+    transportDeliveryId: string;
+    state: TCoreMailInboundDeliveryState;
+    envelope: ICoreMailEnvelope;
+    rawMime: {
+        sha256: TCoreMailSha256;
+        lengthBytes: number;
+        contentType: 'message/rfc822';
+    };
+    messageId?: string;
+    subject?: string;
+    receivedAt: number;
+    updatedAt: number;
+}
+export interface ICoreMailBindingCredentialVerifier {
+    credentialId: string;
+    version: number;
+    state: TCoreMailCredentialState;
+    /** Password-verifier string only. Plaintext credential material is never part of desired state. */
+    verificationHash: string;
+    acceptUntil?: number;
+}
+export interface ICoreMailBindingDesiredState {
+    schemaVersion: 1;
+    bindingId: string;
+    serviceId: string;
+    tenantId: string;
+    revision: number;
+    state: TCoreMailBindingState;
+    capabilities: TCoreMailCapability[];
+    credentials: ICoreMailBindingCredentialVerifier[];
+    allowedSenders: string[];
+    inboundRecipients: string[];
+    defaultSender?: string;
+    limits?: {
+        messagesPerMinute?: number;
+        messagesPerDay?: number;
+        maxPendingInbound?: number;
+    };
+}
+export interface ICoreMailGatewayDesiredState {
+    endpointUrl: string;
+    credentialId: string;
+    credentialVersion: number;
+    /** Key in CoreMail's resolved runtime secret material, never a plaintext value. */
+    credentialSecretKey: string;
+}
+export interface ICoreMailDesiredState {
+    schemaVersion: 1;
+    configEpoch: number;
+    bindings: ICoreMailBindingDesiredState[];
+    gateway: ICoreMailGatewayDesiredState;
+}
+export interface ICoreMailReplicaIdentity {
+    taskId: string;
+    serviceId: string;
+    rolloutId: string;
+    rolloutGeneration: number;
+    imageDigest: TCoreMailSha256;
+}
+export interface ICoreMailBindingReconciliationStatus {
+    bindingId: string;
+    revision: number;
+    state: TCoreMailBindingState;
+    activeSessionsByCredentialVersion: Array<{
+        version: number;
+        count: number;
+    }>;
+}
+export interface ICoreMailReconciliationStatus {
+    replica: ICoreMailReplicaIdentity;
+    state: TCoreMailReconciliationState;
+    appliedConfigEpoch: number;
+    appliedDesiredStateDigest: TCoreMailSha256;
+    bindings: ICoreMailBindingReconciliationStatus[];
+    updatedAt: number;
+    errorCode?: TCoreMailErrorCode;
+}
+export interface ICoreMailRecipientResolution {
+    recipient: string;
+    action: TCoreMailRecipientAction;
+    /** Opaque, short-lived handle returned only for accepted recipients. */
+    routingHandle?: string;
+    smtpCode?: number;
+    message?: string;
+}
+export interface ICoreMailGatewayMessageDescriptor {
+    envelope: ICoreMailEnvelope;
+    rawMime: {
+        sha256: TCoreMailSha256;
+        lengthBytes: number;
+        contentType: 'message/rfc822';
+    };
+}
+export interface ICoreMailGatewayOutboundStatus {
+    transportMessageId: string;
+    state: Extract<TCoreMailSubmissionState, 'accepted' | 'queued' | 'delivering' | 'delivered' | 'deferred' | 'failed' | 'deadLettered'>;
+    attempts: number;
+    nextAttemptAt?: number;
+    smtpCode?: number;
+    updatedAt: number;
+}
+export declare const coreMailLimits: Readonly<{
+    readonly controlMessageBytes: number;
+    readonly desiredStateBytes: number;
+    readonly textPartBytes: number;
+    readonly htmlPartBytes: number;
+    readonly attachmentCount: 16;
+    readonly attachmentBytes: number;
+    readonly aggregateAttachmentBytes: number;
+    readonly mimeFramingBytes: number;
+    readonly serializedMimeBytes: number;
+    readonly transferGrantTtlMs: number;
+    readonly transferHeaderTimeoutMs: number;
+    readonly transferIdleTimeoutMs: number;
+    readonly transferOverallTimeoutMs: number;
+}>;

package/dist_ts/data/coremail.js

@@ -0,0 +1,24 @@
+/**
+ * Shared CoreMail contracts.
+ *
+ * Workload authority is always derived from an authenticated transport
+ * session. Application-facing request DTOs therefore carry message or
+ * delivery identifiers only and never caller-selected tenant, service, or
+ * binding authority.
+ */
+export const coreMailLimits = Object.freeze({
+    controlMessageBytes: 64 * 1024,
+    desiredStateBytes: 8 * 1024 * 1024,
+    textPartBytes: 1 * 1024 * 1024,
+    htmlPartBytes: 2 * 1024 * 1024,
+    attachmentCount: 16,
+    attachmentBytes: 10 * 1024 * 1024,
+    aggregateAttachmentBytes: 17 * 1024 * 1024,
+    mimeFramingBytes: 512 * 1024,
+    serializedMimeBytes: 30 * 1024 * 1024,
+    transferGrantTtlMs: 5 * 60 * 1000,
+    transferHeaderTimeoutMs: 10 * 1000,
+    transferIdleTimeoutMs: 15 * 1000,
+    transferOverallTimeoutMs: 2 * 60 * 1000,
+});
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY29yZW1haWwuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL2NvcmVtYWlsLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOzs7Ozs7O0dBT0c7QUErUEgsTUFBTSxDQUFDLE1BQU0sY0FBYyxHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUM7SUFDMUMsbUJBQW1CLEVBQUUsRUFBRSxHQUFHLElBQUk7SUFDOUIsaUJBQWlCLEVBQUUsQ0FBQyxHQUFHLElBQUksR0FBRyxJQUFJO0lBQ2xDLGFBQWEsRUFBRSxDQUFDLEdBQUcsSUFBSSxHQUFHLElBQUk7SUFDOUIsYUFBYSxFQUFFLENBQUMsR0FBRyxJQUFJLEdBQUcsSUFBSTtJQUM5QixlQUFlLEVBQUUsRUFBRTtJQUNuQixlQUFlLEVBQUUsRUFBRSxHQUFHLElBQUksR0FBRyxJQUFJO0lBQ2pDLHdCQUF3QixFQUFFLEVBQUUsR0FBRyxJQUFJLEdBQUcsSUFBSTtJQUMxQyxnQkFBZ0IsRUFBRSxHQUFHLEdBQUcsSUFBSTtJQUM1QixtQkFBbUIsRUFBRSxFQUFFLEdBQUcsSUFBSSxHQUFHLElBQUk7SUFDckMsa0JBQWtCLEVBQUUsQ0FBQyxHQUFHLEVBQUUsR0FBRyxJQUFJO0lBQ2pDLHVCQUF1QixFQUFFLEVBQUUsR0FBRyxJQUFJO0lBQ2xDLHFCQUFxQixFQUFFLEVBQUUsR0FBRyxJQUFJO0lBQ2hDLHdCQUF3QixFQUFFLENBQUMsR0FBRyxFQUFFLEdBQUcsSUFBSTtDQUMvQixDQUFDLENBQUMifQ==

package/dist_ts/data/index.d.ts

@@ -1,6 +1,7 @@
 export * from './cloudlyconfig.js';
 export * from './cluster.js';
 export * from './config.js';
+export * from './coremail.js';
 export * from './deployment.js';
 export * from './deploymentadoption.js';
 export * from './deploymentoperation.js';

package/dist_ts/data/index.js

@@ -1,6 +1,7 @@
 export * from './cloudlyconfig.js';
 export * from './cluster.js';
 export * from './config.js';
+export * from './coremail.js';
 export * from './deployment.js';
 export * from './deploymentadoption.js';
 export * from './deploymentoperation.js';
@@ -35,4 +36,4 @@ export * from './traffic.js';
 export * from './user.js';
 export * from './version.js';
 export * from './webpush.js';
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL2luZGV4LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLGNBQWMsb0JBQW9CLENBQUM7QUFDbkMsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxpQkFBaUIsQ0FBQztBQUNoQyxjQUFjLHlCQUF5QixDQUFDO0FBQ3hDLGNBQWMsMEJBQTBCLENBQUM7QUFDekMsY0FBYywwQkFBMEIsQ0FBQztBQUN6QyxjQUFjLGdCQUFnQixDQUFDO0FBQy9CLGNBQWMsVUFBVSxDQUFDO0FBQ3pCLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsWUFBWSxDQUFDO0FBQzNCLGNBQWMsdUJBQXVCLENBQUM7QUFDdEMsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyxnQkFBZ0IsQ0FBQztBQUMvQixjQUFjLFlBQVksQ0FBQztBQUMzQixjQUFjLHFCQUFxQixDQUFDO0FBQ3BDLGNBQWMsc0JBQXNCLENBQUM7QUFDckMsY0FBYyw2QkFBNkIsQ0FBQztBQUM1QyxjQUFjLFdBQVcsQ0FBQztBQUMxQixjQUFjLGVBQWUsQ0FBQztBQUM5QixjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLG1CQUFtQixDQUFDO0FBQ2xDLGNBQWMsa0JBQWtCLENBQUM7QUFDakMsY0FBYyxnQkFBZ0IsQ0FBQztBQUMvQixjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLGtCQUFrQixDQUFDO0FBQ2pDLGNBQWMsZUFBZSxDQUFDO0FBQzlCLGNBQWMsY0FBYyxDQUFDO0FBQzdCLGNBQWMsbUJBQW1CLENBQUM7QUFDbEMsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxvQkFBb0IsQ0FBQztBQUNuQyxjQUFjLGNBQWMsQ0FBQztBQUM3QixjQUFjLFdBQVcsQ0FBQztBQUMxQixjQUFjLGNBQWMsQ0FBQztBQUM3QixjQUFjLGNBQWMsQ0FBQyJ9
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL2luZGV4LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLGNBQWMsb0JBQW9CLENBQUM7QUFDbkMsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxlQUFlLENBQUM7QUFDOUIsY0FBYyxpQkFBaUIsQ0FBQztBQUNoQyxjQUFjLHlCQUF5QixDQUFDO0FBQ3hDLGNBQWMsMEJBQTBCLENBQUM7QUFDekMsY0FBYywwQkFBMEIsQ0FBQztBQUN6QyxjQUFjLGdCQUFnQixDQUFDO0FBQy9CLGNBQWMsVUFBVSxDQUFDO0FBQ3pCLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsWUFBWSxDQUFDO0FBQzNCLGNBQWMsdUJBQXVCLENBQUM7QUFDdEMsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyxnQkFBZ0IsQ0FBQztBQUMvQixjQUFjLFlBQVksQ0FBQztBQUMzQixjQUFjLHFCQUFxQixDQUFDO0FBQ3BDLGNBQWMsc0JBQXNCLENBQUM7QUFDckMsY0FBYyw2QkFBNkIsQ0FBQztBQUM1QyxjQUFjLFdBQVcsQ0FBQztBQUMxQixjQUFjLGVBQWUsQ0FBQztBQUM5QixjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLG1CQUFtQixDQUFDO0FBQ2xDLGNBQWMsa0JBQWtCLENBQUM7QUFDakMsY0FBYyxnQkFBZ0IsQ0FBQztBQUMvQixjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLGtCQUFrQixDQUFDO0FBQ2pDLGNBQWMsZUFBZSxDQUFDO0FBQzlCLGNBQWMsY0FBYyxDQUFDO0FBQzdCLGNBQWMsbUJBQW1CLENBQUM7QUFDbEMsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxvQkFBb0IsQ0FBQztBQUNuQyxjQUFjLGNBQWMsQ0FBQztBQUM3QixjQUFjLFdBQVcsQ0FBQztBQUMxQixjQUFjLGNBQWMsQ0FBQztBQUM3QixjQUFjLGNBQWMsQ0FBQyJ9

package/dist_ts/requests/coremail.d.ts

@@ -0,0 +1,248 @@
+import type * as plugins from '../plugins.js';
+import type { ICoreMailEnvelope, ICoreMailDownloadGrant, ICoreMailGatewayMessageDescriptor, ICoreMailGatewayOutboundStatus, ICoreMailInboundDelivery, ICoreMailOutboundMessageDescriptor, ICoreMailRecipientResolution, ICoreMailReconciliationStatus, ICoreMailReplicaIdentity, ICoreMailSubmission, ICoreMailUploadGrant, TCoreMailInboundAckOutcome, TCoreMailSha256 } from '../data/coremail.js';
+import type { IMailConnectionInfo } from '../data/mail.js';
+export interface IReq_CoreMailAuthenticateWorkload extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_CoreMailAuthenticateWorkload> {
+    method: 'coreMailAuthenticateWorkload';
+    request: {
+        bindingId: string;
+        credentialId: string;
+        credentialVersion: number;
+        credentialSecret: string;
+    };
+    response: {
+        authenticated: true;
+        credentialVersion: number;
+        capabilities: Array<'outbound' | 'inbound'>;
+    };
+}
+export interface IReq_CoreMailPrepareOutboundSubmission extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_CoreMailPrepareOutboundSubmission> {
+    method: 'coreMailPrepareOutboundSubmission';
+    request: {
+        /** Required replay key. Authority is added by the authenticated server session. */
+        idempotencyKey: string;
+        message: ICoreMailOutboundMessageDescriptor;
+    };
+    response: {
+        submission: ICoreMailSubmission;
+        replayed: boolean;
+    };
+}
+export interface IReq_CoreMailPrepareOutboundPartUpload extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_CoreMailPrepareOutboundPartUpload> {
+    method: 'coreMailPrepareOutboundPartUpload';
+    request: {
+        submissionId: string;
+        partId: string;
+    };
+    response: {
+        grant: ICoreMailUploadGrant;
+    };
+}
+export interface IReq_CoreMailCompleteOutboundPartUpload extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_CoreMailCompleteOutboundPartUpload> {
+    method: 'coreMailCompleteOutboundPartUpload';
+    request: {
+        submissionId: string;
+        partId: string;
+        grantId: string;
+        sha256: TCoreMailSha256;
+        lengthBytes: number;
+    };
+    response: {
+        submission: ICoreMailSubmission;
+    };
+}
+export interface IReq_CoreMailFinalizeOutboundSubmission extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_CoreMailFinalizeOutboundSubmission> {
+    method: 'coreMailFinalizeOutboundSubmission';
+    request: {
+        submissionId: string;
+    };
+    response: {
+        submission: ICoreMailSubmission;
+    };
+}
+export interface IReq_CoreMailGetOutboundSubmission extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_CoreMailGetOutboundSubmission> {
+    method: 'coreMailGetOutboundSubmission';
+    request: {
+        submissionId: string;
+    };
+    response: {
+        submission: ICoreMailSubmission;
+    };
+}
+export interface IReq_CoreMailListInboundDeliveries extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_CoreMailListInboundDeliveries> {
+    method: 'coreMailListInboundDeliveries';
+    request: {
+        afterDeliveryId?: string;
+        limit: number;
+    };
+    response: {
+        deliveries: ICoreMailInboundDelivery[];
+    };
+}
+export interface IReq_CoreMailPrepareInboundFetch extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_CoreMailPrepareInboundFetch> {
+    method: 'coreMailPrepareInboundFetch';
+    request: {
+        deliveryId: string;
+    };
+    response: {
+        grant: ICoreMailDownloadGrant;
+    };
+}
+export interface IReq_CoreMailCompleteInboundFetch extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_CoreMailCompleteInboundFetch> {
+    method: 'coreMailCompleteInboundFetch';
+    request: {
+        deliveryId: string;
+        grantId: string;
+        sha256: TCoreMailSha256;
+        lengthBytes: number;
+    };
+    response: {
+        delivery: ICoreMailInboundDelivery;
+    };
+}
+export interface IReq_CoreMailAcknowledgeInboundDelivery extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_CoreMailAcknowledgeInboundDelivery> {
+    method: 'coreMailAcknowledgeInboundDelivery';
+    request: {
+        deliveryId: string;
+        outcome: TCoreMailInboundAckOutcome;
+    };
+    response: {
+        delivery: ICoreMailInboundDelivery;
+        replayed: boolean;
+    };
+}
+export interface IReq_CoreMailAuthenticateControl extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_CoreMailAuthenticateControl> {
+    method: 'coreMailAuthenticateControl';
+    request: {
+        credentialId: string;
+        credentialVersion: number;
+        credentialSecret: string;
+    };
+    response: {
+        authenticated: true;
+        replica: ICoreMailReplicaIdentity;
+    };
+}
+export interface IReq_CoreMailPrepareDesiredStateUpload extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_CoreMailPrepareDesiredStateUpload> {
+    method: 'coreMailPrepareDesiredStateUpload';
+    request: {
+        expectedAppliedConfigEpoch: number;
+        configEpoch: number;
+        desiredStateDigest: TCoreMailSha256;
+        lengthBytes: number;
+    };
+    response: {
+        reconciliationId: string;
+        grant: ICoreMailUploadGrant;
+        replayed: boolean;
+    };
+}
+export interface IReq_CoreMailApplyDesiredState extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_CoreMailApplyDesiredState> {
+    method: 'coreMailApplyDesiredState';
+    request: {
+        reconciliationId: string;
+        grantId: string;
+        desiredStateDigest: TCoreMailSha256;
+        lengthBytes: number;
+    };
+    response: {
+        status: ICoreMailReconciliationStatus;
+    };
+}
+export interface IReq_CoreMailGetReconciliationStatus extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_CoreMailGetReconciliationStatus> {
+    method: 'coreMailGetReconciliationStatus';
+    request: {
+        configEpoch: number;
+        desiredStateDigest: TCoreMailSha256;
+    };
+    response: {
+        status: ICoreMailReconciliationStatus;
+    };
+}
+export interface IReq_CoreMailGatewayAuthenticate extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_CoreMailGatewayAuthenticate> {
+    method: 'coreMailGatewayAuthenticate';
+    request: {
+        credentialId: string;
+        credentialVersion: number;
+        credentialSecret: string;
+    };
+    response: {
+        authenticated: true;
+        credentialVersion: number;
+    };
+}
+export interface IReq_CoreMailGatewayResolveRecipients extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_CoreMailGatewayResolveRecipients> {
+    method: 'coreMailGatewayResolveRecipients';
+    request: {
+        envelope: ICoreMailEnvelope;
+        recipients: string[];
+        source: IMailConnectionInfo;
+    };
+    response: {
+        resolutions: ICoreMailRecipientResolution[];
+    };
+}
+export interface IReq_CoreMailGatewayPrepareInboundHandoff extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_CoreMailGatewayPrepareInboundHandoff> {
+    method: 'coreMailGatewayPrepareInboundHandoff';
+    request: {
+        transportDeliveryId: string;
+        routingHandles: string[];
+        message: ICoreMailGatewayMessageDescriptor;
+        source: IMailConnectionInfo;
+    };
+    response: {
+        handoffId: string;
+        grant?: ICoreMailUploadGrant;
+        replayed: boolean;
+    };
+}
+export interface IReq_CoreMailGatewayCompleteInboundHandoff extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_CoreMailGatewayCompleteInboundHandoff> {
+    method: 'coreMailGatewayCompleteInboundHandoff';
+    request: {
+        handoffId: string;
+        grantId: string;
+        sha256: TCoreMailSha256;
+        lengthBytes: number;
+    };
+    response: {
+        accepted: true;
+        deliveryIds: string[];
+        replayed: boolean;
+    };
+}
+export interface IReq_CoreMailGatewayPrepareOutboundHandoff extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_CoreMailGatewayPrepareOutboundHandoff> {
+    method: 'coreMailGatewayPrepareOutboundHandoff';
+    request: {
+        transportSubmissionId: string;
+        submissionDigest: TCoreMailSha256;
+        message: ICoreMailGatewayMessageDescriptor;
+        /** CoreMail-issued GET grant. dcrouter resolves the path against the authenticated peer. */
+        grant: ICoreMailDownloadGrant;
+    };
+    response: {
+        transportMessageId: string;
+        status: ICoreMailGatewayOutboundStatus;
+        replayed: boolean;
+    };
+}
+export interface IReq_CoreMailGatewayCompleteOutboundHandoff extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_CoreMailGatewayCompleteOutboundHandoff> {
+    method: 'coreMailGatewayCompleteOutboundHandoff';
+    request: {
+        transportMessageId: string;
+        grantId: string;
+        sha256: TCoreMailSha256;
+        lengthBytes: number;
+    };
+    response: {
+        status: ICoreMailGatewayOutboundStatus;
+        replayed: boolean;
+    };
+}
+export interface IReq_CoreMailGatewayGetOutboundStatus extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_CoreMailGatewayGetOutboundStatus> {
+    method: 'coreMailGatewayGetOutboundStatus';
+    request: {
+        transportMessageId: string;
+    };
+    response: {
+        status: ICoreMailGatewayOutboundStatus;
+    };
+}

package/dist_ts/requests/coremail.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY29yZW1haWwuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9yZXF1ZXN0cy9jb3JlbWFpbC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiIn0=

package/dist_ts/requests/index.d.ts

@@ -6,6 +6,7 @@ import * as backupRequests from './backup.js';
 import * as certificateRequests from './certificate.js';
 import * as clusterRequests from './cluster.js';
 import * as configRequests from './config.js';
+import * as coreMailRequests from './coremail.js';
 import * as corestoreRequests from './corestore.js';
 import * as deploymentRequests from './deployment.js';
 import * as dnsRequests from './dns.js';
@@ -33,7 +34,7 @@ import * as statusRequests from './status.js';
 import * as taskRequests from './task.js';
 import * as versionRequests from './version.js';
 import * as webPushRequests from './webpush.js';
-export { adminRequests as admin, appStoreRequests as appstore, baremetalRequests as baremetal, baseOsRequests as baseos, backupRequests as backup, certificateRequests as certificate, clusterRequests as cluster, configRequests as config, corestoreRequests as corestore, deploymentRequests as deployment, dnsRequests as dns, domainRequests as domain, externalRegistryRequests as externalRegistry, gatewayRequests as gateway, hostedAppRequests as hostedapp, identityRequests as identity, imageRequests as image, informRequests as inform, logRequests as log, mailRequests as mail, migrationRequests as migration, networkRequests as network, nodeRequests as node, platformRequests as platform, routingRequests as routing, secretRequests as secret, secretBundleRequests as secretbundle, secretGroupRequests as secretgroup, serverRequests as server, serviceRequests as service, settingsRequests as settings, statusRequests as status, taskRequests as task, versionRequests as version, webPushRequests as webpush, };
+export { adminRequests as admin, appStoreRequests as appstore, baremetalRequests as baremetal, baseOsRequests as baseos, backupRequests as backup, certificateRequests as certificate, clusterRequests as cluster, configRequests as config, coreMailRequests as coremail, corestoreRequests as corestore, deploymentRequests as deployment, dnsRequests as dns, domainRequests as domain, externalRegistryRequests as externalRegistry, gatewayRequests as gateway, hostedAppRequests as hostedapp, identityRequests as identity, imageRequests as image, informRequests as inform, logRequests as log, mailRequests as mail, migrationRequests as migration, networkRequests as network, nodeRequests as node, platformRequests as platform, routingRequests as routing, secretRequests as secret, secretBundleRequests as secretbundle, secretGroupRequests as secretgroup, serverRequests as server, serviceRequests as service, settingsRequests as settings, statusRequests as status, taskRequests as task, versionRequests as version, webPushRequests as webpush, };
 export * from './inform.js';
 export * from './hostedapp.js';
 export * from './mail.js';

package/dist_ts/requests/index.js

@@ -7,6 +7,7 @@ import * as backupRequests from './backup.js';
 import * as certificateRequests from './certificate.js';
 import * as clusterRequests from './cluster.js';
 import * as configRequests from './config.js';
+import * as coreMailRequests from './coremail.js';
 import * as corestoreRequests from './corestore.js';
 import * as deploymentRequests from './deployment.js';
 import * as dnsRequests from './dns.js';
@@ -34,9 +35,9 @@ import * as statusRequests from './status.js';
 import * as taskRequests from './task.js';
 import * as versionRequests from './version.js';
 import * as webPushRequests from './webpush.js';
-export { adminRequests as admin, appStoreRequests as appstore, baremetalRequests as baremetal, baseOsRequests as baseos, backupRequests as backup, certificateRequests as certificate, clusterRequests as cluster, configRequests as config, corestoreRequests as corestore, deploymentRequests as deployment, dnsRequests as dns, domainRequests as domain, externalRegistryRequests as externalRegistry, gatewayRequests as gateway, hostedAppRequests as hostedapp, identityRequests as identity, imageRequests as image, informRequests as inform, logRequests as log, mailRequests as mail, migrationRequests as migration, networkRequests as network, nodeRequests as node, platformRequests as platform, routingRequests as routing, secretRequests as secret, secretBundleRequests as secretbundle, secretGroupRequests as secretgroup, serverRequests as server, serviceRequests as service, settingsRequests as settings, statusRequests as status, taskRequests as task, versionRequests as version, webPushRequests as webpush, };
+export { adminRequests as admin, appStoreRequests as appstore, baremetalRequests as baremetal, baseOsRequests as baseos, backupRequests as backup, certificateRequests as certificate, clusterRequests as cluster, configRequests as config, coreMailRequests as coremail, corestoreRequests as corestore, deploymentRequests as deployment, dnsRequests as dns, domainRequests as domain, externalRegistryRequests as externalRegistry, gatewayRequests as gateway, hostedAppRequests as hostedapp, identityRequests as identity, imageRequests as image, informRequests as inform, logRequests as log, mailRequests as mail, migrationRequests as migration, networkRequests as network, nodeRequests as node, platformRequests as platform, routingRequests as routing, secretRequests as secret, secretBundleRequests as secretbundle, secretGroupRequests as secretgroup, serverRequests as server, serviceRequests as service, settingsRequests as settings, statusRequests as status, taskRequests as task, versionRequests as version, webPushRequests as webpush, };
 export * from './inform.js';
 export * from './hostedapp.js';
 export * from './mail.js';
 export * from './webpush.js';
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9yZXF1ZXN0cy9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLGVBQWUsQ0FBQztBQUV6QyxPQUFPLEtBQUssYUFBYSxNQUFNLFlBQVksQ0FBQztBQUM1QyxPQUFPLEtBQUssZ0JBQWdCLE1BQU0sZUFBZSxDQUFDO0FBQ2xELE9BQU8sS0FBSyxpQkFBaUIsTUFBTSxnQkFBZ0IsQ0FBQztBQUNwRCxPQUFPLEtBQUssY0FBYyxNQUFNLGFBQWEsQ0FBQztBQUM5QyxPQUFPLEtBQUssY0FBYyxNQUFNLGFBQWEsQ0FBQztBQUM5QyxPQUFPLEtBQUssbUJBQW1CLE1BQU0sa0JBQWtCLENBQUM7QUFDeEQsT0FBTyxLQUFLLGVBQWUsTUFBTSxjQUFjLENBQUM7QUFDaEQsT0FBTyxLQUFLLGNBQWMsTUFBTSxhQUFhLENBQUM7QUFDOUMsT0FBTyxLQUFLLGlCQUFpQixNQUFNLGdCQUFnQixDQUFDO0FBQ3BELE9BQU8sS0FBSyxrQkFBa0IsTUFBTSxpQkFBaUIsQ0FBQztBQUN0RCxPQUFPLEtBQUssV0FBVyxNQUFNLFVBQVUsQ0FBQztBQUN4QyxPQUFPLEtBQUssY0FBYyxNQUFNLGFBQWEsQ0FBQztBQUM5QyxPQUFPLEtBQUssd0JBQXdCLE1BQU0sdUJBQXVCLENBQUM7QUFDbEUsT0FBTyxLQUFLLGVBQWUsTUFBTSxjQUFjLENBQUM7QUFDaEQsT0FBTyxLQUFLLGlCQUFpQixNQUFNLGdCQUFnQixDQUFDO0FBQ3BELE9BQU8sS0FBSyxnQkFBZ0IsTUFBTSxlQUFlLENBQUM7QUFDbEQsT0FBTyxLQUFLLGFBQWEsTUFBTSxZQUFZLENBQUM7QUFDNUMsT0FBTyxLQUFLLGNBQWMsTUFBTSxhQUFhLENBQUM7QUFDOUMsT0FBTyxLQUFLLFdBQVcsTUFBTSxVQUFVLENBQUM7QUFDeEMsT0FBTyxLQUFLLFlBQVksTUFBTSxXQUFXLENBQUM7QUFDMUMsT0FBTyxLQUFLLGlCQUFpQixNQUFNLGdCQUFnQixDQUFDO0FBQ3BELE9BQU8sS0FBSyxlQUFlLE1BQU0sY0FBYyxDQUFDO0FBQ2hELE9BQU8sS0FBSyxZQUFZLE1BQU0sV0FBVyxDQUFDO0FBQzFDLE9BQU8sS0FBSyxnQkFBZ0IsTUFBTSxlQUFlLENBQUM7QUFDbEQsT0FBTyxLQUFLLGVBQWUsTUFBTSxjQUFjLENBQUM7QUFDaEQsT0FBTyxLQUFLLGNBQWMsTUFBTSxhQUFhLENBQUM7QUFDOUMsT0FBTyxLQUFLLG9CQUFvQixNQUFNLG1CQUFtQixDQUFDO0FBQzFELE9BQU8sS0FBSyxtQkFBbUIsTUFBTSxrQkFBa0IsQ0FBQztBQUN4RCxPQUFPLEtBQUssY0FBYyxNQUFNLGFBQWEsQ0FBQztBQUM5QyxPQUFPLEtBQUssZUFBZSxNQUFNLGNBQWMsQ0FBQztBQUNoRCxPQUFPLEtBQUssZ0JBQWdCLE1BQU0sZUFBZSxDQUFDO0FBQ2xELE9BQU8sS0FBSyxjQUFjLE1BQU0sYUFBYSxDQUFDO0FBQzlDLE9BQU8sS0FBSyxZQUFZLE1BQU0sV0FBVyxDQUFDO0FBQzFDLE9BQU8sS0FBSyxlQUFlLE1BQU0sY0FBYyxDQUFDO0FBQ2hELE9BQU8sS0FBSyxlQUFlLE1BQU0sY0FBYyxDQUFDO0FBRWhELE9BQU8sRUFDTCxhQUFhLElBQUksS0FBSyxFQUN0QixnQkFBZ0IsSUFBSSxRQUFRLEVBQzVCLGlCQUFpQixJQUFJLFNBQVMsRUFDOUIsY0FBYyxJQUFJLE1BQU0sRUFDeEIsY0FBYyxJQUFJLE1BQU0sRUFDeEIsbUJBQW1CLElBQUksV0FBVyxFQUNsQyxlQUFlLElBQUksT0FBTyxFQUMxQixjQUFjLElBQUksTUFBTSxFQUN4QixpQkFBaUIsSUFBSSxTQUFTLEVBQzlCLGtCQUFrQixJQUFJLFVBQVUsRUFDaEMsV0FBVyxJQUFJLEdBQUcsRUFDbEIsY0FBYyxJQUFJLE1BQU0sRUFDeEIsd0JBQXdCLElBQUksZ0JBQWdCLEVBQzVDLGVBQWUsSUFBSSxPQUFPLEVBQzFCLGlCQUFpQixJQUFJLFNBQVMsRUFDOUIsZ0JBQWdCLElBQUksUUFBUSxFQUM1QixhQUFhLElBQUksS0FBSyxFQUN0QixjQUFjLElBQUksTUFBTSxFQUN4QixXQUFXLElBQUksR0FBRyxFQUNsQixZQUFZLElBQUksSUFBSSxFQUNwQixpQkFBaUIsSUFBSSxTQUFTLEVBQzlCLGVBQWUsSUFBSSxPQUFPLEVBQzFCLFlBQVksSUFBSSxJQUFJLEVBQ3BCLGdCQUFnQixJQUFJLFFBQVEsRUFDNUIsZUFBZSxJQUFJLE9BQU8sRUFDMUIsY0FBYyxJQUFJLE1BQU0sRUFDeEIsb0JBQW9CLElBQUksWUFBWSxFQUNwQyxtQkFBbUIsSUFBSSxXQUFXLEVBQ2xDLGNBQWMsSUFBSSxNQUFNLEVBQ3hCLGVBQWUsSUFBSSxPQUFPLEVBQzFCLGdCQUFnQixJQUFJLFFBQVEsRUFDNUIsY0FBYyxJQUFJLE1BQU0sRUFDeEIsWUFBWSxJQUFJLElBQUksRUFDcEIsZUFBZSxJQUFJLE9BQU8sRUFDMUIsZUFBZSxJQUFJLE9BQU8sR0FDM0IsQ0FBQztBQUVGLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsZ0JBQWdCLENBQUM7QUFDL0IsY0FBYyxXQUFXLENBQUM7QUFDMUIsY0FBYyxjQUFjLENBQUMifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9yZXF1ZXN0cy9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLGVBQWUsQ0FBQztBQUV6QyxPQUFPLEtBQUssYUFBYSxNQUFNLFlBQVksQ0FBQztBQUM1QyxPQUFPLEtBQUssZ0JBQWdCLE1BQU0sZUFBZSxDQUFDO0FBQ2xELE9BQU8sS0FBSyxpQkFBaUIsTUFBTSxnQkFBZ0IsQ0FBQztBQUNwRCxPQUFPLEtBQUssY0FBYyxNQUFNLGFBQWEsQ0FBQztBQUM5QyxPQUFPLEtBQUssY0FBYyxNQUFNLGFBQWEsQ0FBQztBQUM5QyxPQUFPLEtBQUssbUJBQW1CLE1BQU0sa0JBQWtCLENBQUM7QUFDeEQsT0FBTyxLQUFLLGVBQWUsTUFBTSxjQUFjLENBQUM7QUFDaEQsT0FBTyxLQUFLLGNBQWMsTUFBTSxhQUFhLENBQUM7QUFDOUMsT0FBTyxLQUFLLGdCQUFnQixNQUFNLGVBQWUsQ0FBQztBQUNsRCxPQUFPLEtBQUssaUJBQWlCLE1BQU0sZ0JBQWdCLENBQUM7QUFDcEQsT0FBTyxLQUFLLGtCQUFrQixNQUFNLGlCQUFpQixDQUFDO0FBQ3RELE9BQU8sS0FBSyxXQUFXLE1BQU0sVUFBVSxDQUFDO0FBQ3hDLE9BQU8sS0FBSyxjQUFjLE1BQU0sYUFBYSxDQUFDO0FBQzlDLE9BQU8sS0FBSyx3QkFBd0IsTUFBTSx1QkFBdUIsQ0FBQztBQUNsRSxPQUFPLEtBQUssZUFBZSxNQUFNLGNBQWMsQ0FBQztBQUNoRCxPQUFPLEtBQUssaUJBQWlCLE1BQU0sZ0JBQWdCLENBQUM7QUFDcEQsT0FBTyxLQUFLLGdCQUFnQixNQUFNLGVBQWUsQ0FBQztBQUNsRCxPQUFPLEtBQUssYUFBYSxNQUFNLFlBQVksQ0FBQztBQUM1QyxPQUFPLEtBQUssY0FBYyxNQUFNLGFBQWEsQ0FBQztBQUM5QyxPQUFPLEtBQUssV0FBVyxNQUFNLFVBQVUsQ0FBQztBQUN4QyxPQUFPLEtBQUssWUFBWSxNQUFNLFdBQVcsQ0FBQztBQUMxQyxPQUFPLEtBQUssaUJBQWlCLE1BQU0sZ0JBQWdCLENBQUM7QUFDcEQsT0FBTyxLQUFLLGVBQWUsTUFBTSxjQUFjLENBQUM7QUFDaEQsT0FBTyxLQUFLLFlBQVksTUFBTSxXQUFXLENBQUM7QUFDMUMsT0FBTyxLQUFLLGdCQUFnQixNQUFNLGVBQWUsQ0FBQztBQUNsRCxPQUFPLEtBQUssZUFBZSxNQUFNLGNBQWMsQ0FBQztBQUNoRCxPQUFPLEtBQUssY0FBYyxNQUFNLGFBQWEsQ0FBQztBQUM5QyxPQUFPLEtBQUssb0JBQW9CLE1BQU0sbUJBQW1CLENBQUM7QUFDMUQsT0FBTyxLQUFLLG1CQUFtQixNQUFNLGtCQUFrQixDQUFDO0FBQ3hELE9BQU8sS0FBSyxjQUFjLE1BQU0sYUFBYSxDQUFDO0FBQzlDLE9BQU8sS0FBSyxlQUFlLE1BQU0sY0FBYyxDQUFDO0FBQ2hELE9BQU8sS0FBSyxnQkFBZ0IsTUFBTSxlQUFlLENBQUM7QUFDbEQsT0FBTyxLQUFLLGNBQWMsTUFBTSxhQUFhLENBQUM7QUFDOUMsT0FBTyxLQUFLLFlBQVksTUFBTSxXQUFXLENBQUM7QUFDMUMsT0FBTyxLQUFLLGVBQWUsTUFBTSxjQUFjLENBQUM7QUFDaEQsT0FBTyxLQUFLLGVBQWUsTUFBTSxjQUFjLENBQUM7QUFFaEQsT0FBTyxFQUNMLGFBQWEsSUFBSSxLQUFLLEVBQ3RCLGdCQUFnQixJQUFJLFFBQVEsRUFDNUIsaUJBQWlCLElBQUksU0FBUyxFQUM5QixjQUFjLElBQUksTUFBTSxFQUN4QixjQUFjLElBQUksTUFBTSxFQUN4QixtQkFBbUIsSUFBSSxXQUFXLEVBQ2xDLGVBQWUsSUFBSSxPQUFPLEVBQzFCLGNBQWMsSUFBSSxNQUFNLEVBQ3hCLGdCQUFnQixJQUFJLFFBQVEsRUFDNUIsaUJBQWlCLElBQUksU0FBUyxFQUM5QixrQkFBa0IsSUFBSSxVQUFVLEVBQ2hDLFdBQVcsSUFBSSxHQUFHLEVBQ2xCLGNBQWMsSUFBSSxNQUFNLEVBQ3hCLHdCQUF3QixJQUFJLGdCQUFnQixFQUM1QyxlQUFlLElBQUksT0FBTyxFQUMxQixpQkFBaUIsSUFBSSxTQUFTLEVBQzlCLGdCQUFnQixJQUFJLFFBQVEsRUFDNUIsYUFBYSxJQUFJLEtBQUssRUFDdEIsY0FBYyxJQUFJLE1BQU0sRUFDeEIsV0FBVyxJQUFJLEdBQUcsRUFDbEIsWUFBWSxJQUFJLElBQUksRUFDcEIsaUJBQWlCLElBQUksU0FBUyxFQUM5QixlQUFlLElBQUksT0FBTyxFQUMxQixZQUFZLElBQUksSUFBSSxFQUNwQixnQkFBZ0IsSUFBSSxRQUFRLEVBQzVCLGVBQWUsSUFBSSxPQUFPLEVBQzFCLGNBQWMsSUFBSSxNQUFNLEVBQ3hCLG9CQUFvQixJQUFJLFlBQVksRUFDcEMsbUJBQW1CLElBQUksV0FBVyxFQUNsQyxjQUFjLElBQUksTUFBTSxFQUN4QixlQUFlLElBQUksT0FBTyxFQUMxQixnQkFBZ0IsSUFBSSxRQUFRLEVBQzVCLGNBQWMsSUFBSSxNQUFNLEVBQ3hCLFlBQVksSUFBSSxJQUFJLEVBQ3BCLGVBQWUsSUFBSSxPQUFPLEVBQzFCLGVBQWUsSUFBSSxPQUFPLEdBQzNCLENBQUM7QUFFRixjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLGdCQUFnQixDQUFDO0FBQy9CLGNBQWMsV0FBVyxDQUFDO0FBQzFCLGNBQWMsY0FBYyxDQUFDIn0=

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serve.zone/interfaces",
-  "version": "20.1.0",
+  "version": "20.2.0",
   "private": false,
   "description": "Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.",
   "exports": {
@@ -17,7 +17,7 @@
   "author": "Task Venture Capital GmbH",
   "license": "MIT",
   "dependencies": {
-    "@api.global/typedrequest-interfaces": "^3.0.19",
+    "@api.global/typedrequest-interfaces": "^4.0.0",
     "@push.rocks/smartlog-interfaces": "^3.0.2",
     "@tsclass/tsclass": "^9.5.1"
   },

package/readme.md

@@ -480,6 +480,35 @@ const provisioning: requests.gateway.IReq_ProvisionGatewayClientCredential['requ
 
 `getGatewayClientContext` returns effective live policy. A `gatewayClient` role necessarily includes the credential ID, bound client ID/type, and `policyGeneration`; consumers should reject admin/operator or mismatched contexts rather than falling back to a caller-supplied owner ID. `getGatewayClientMailOverview` provides an owner-scoped domain and recent-message summary. `getGatewayClientMailDomainCount` derives ownership exclusively from the authenticating gateway credential and returns `{ count: number }` for its distinct configured mail domains. Cloudly therefore uses only `dcrouterGatewayApiToken`; the former `dcrouterOpsApiToken` setting is not part of `data.ICloudlySettings`.
 
+### CoreMail contracts
+
+`requests.coremail` is the shared contract boundary for authenticated workload
+sessions, Coreflow reconciliation, and the CoreMail-to-dcrouter gateway
+session. Only the three authentication handshakes carry reusable peer
+credentials. Subsequent transfer operations may carry a scoped, short-lived,
+one-time bearer capability, while every subsequent workload request derives
+tenant, service, binding, capabilities, allowed senders, and credential version
+from the server-owned TypedSocket peer.
+
+Large content never travels inside TypedRequest JSON. Outbound body parts and
+attachments use prepare/upload/complete operations with short-lived one-time
+HTTP transfer grants. Inbound delivery uses bounded delivery listing followed
+by prepare/fetch/complete and an explicit acknowledgement after the workload
+has processed the exact byte count and SHA-256 digest. `data.coreMailLimits`
+defines the 64 KiB control-frame boundary, bounded structured content, the
+30 MiB serialized MIME ceiling, transfer deadlines, and five-minute grant
+lifetime.
+
+Coreflow applies `data.ICoreMailDesiredState` with a config-epoch
+compare-and-set fence. It stages the digest-fenced JSON snapshot through a
+bounded one-time HTTP upload, then applies it by reconciliation ID, so a large
+binding set never bypasses the 64 KiB control-frame boundary. Desired bindings
+contain password verifiers and secret references only, never plaintext
+workload or dcrouter credentials.
+Reconciliation status carries the exact CoreMail task, rollout generation, and
+image digest so Coreflow can correlate every response with its authoritative
+current task roster.
+
 Request groups are exported by product area:
 
 - `requests.admin`
@@ -490,6 +519,7 @@ Request groups are exported by product area:
 - `requests.certificate`
 - `requests.cluster`
 - `requests.config`
+- `requests.coremail`
 - `requests.corestore`
 - `requests.deployment`
 - `requests.dns`

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@serve.zone/interfaces',
-  version: '20.1.0',
+  version: '20.2.0',
   description: 'Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.'
 }

package/ts/data/coremail.ts

@@ -0,0 +1,277 @@
+/**
+ * Shared CoreMail contracts.
+ *
+ * Workload authority is always derived from an authenticated transport
+ * session. Application-facing request DTOs therefore carry message or
+ * delivery identifiers only and never caller-selected tenant, service, or
+ * binding authority.
+ */
+
+export type TCoreMailSha256 = `sha256:${string}`;
+
+export type TCoreMailCapability = 'outbound' | 'inbound';
+export type TCoreMailBindingState = 'active' | 'disabled';
+export type TCoreMailCredentialState = 'current' | 'retiring';
+export type TCoreMailPartKind = 'text' | 'html' | 'attachment';
+export type TCoreMailTransferMethod = 'PUT' | 'GET';
+export type TCoreMailSubmissionState =
+  | 'preparing'
+  | 'uploading'
+  | 'ready'
+  | 'accepted'
+  | 'queued'
+  | 'delivering'
+  | 'delivered'
+  | 'deferred'
+  | 'failed'
+  | 'deadLettered';
+export type TCoreMailInboundDeliveryState = 'pending' | 'fetching' | 'fetched' | 'acknowledged';
+export type TCoreMailInboundAckOutcome = 'processed' | 'discarded';
+export type TCoreMailRecipientAction = 'accept' | 'reject' | 'defer';
+export type TCoreMailReconciliationState = 'applying' | 'ready' | 'failed';
+
+export type TCoreMailErrorCode =
+  | 'AUTHENTICATION_FAILED'
+  | 'AUTHENTICATION_EXPIRED'
+  | 'AUTHORITY_REVOKED'
+  | 'CAPABILITY_DENIED'
+  | 'NOT_FOUND'
+  | 'INVALID_REQUEST'
+  | 'INVALID_MAILBOX'
+  | 'INVALID_SENDER'
+  | 'INVALID_RECIPIENT'
+  | 'INVALID_HEADER'
+  | 'PAYLOAD_LIMIT_EXCEEDED'
+  | 'IDEMPOTENCY_CONFLICT'
+  | 'STATE_CONFLICT'
+  | 'TRANSFER_GRANT_EXPIRED'
+  | 'TRANSFER_GRANT_REPLAYED'
+  | 'TRANSFER_LENGTH_MISMATCH'
+  | 'TRANSFER_DIGEST_MISMATCH'
+  | 'TRANSFER_ENCODING_UNSUPPORTED'
+  | 'OBJECT_INTEGRITY_CONFLICT'
+  | 'DELIVERY_NOT_FETCHED'
+  | 'GATEWAY_UNAVAILABLE'
+  | 'RECONCILIATION_FENCE_MISMATCH';
+
+export interface ICoreMailErrorData {
+  code: TCoreMailErrorCode;
+  retryable: boolean;
+  retryAfterMs?: number;
+}
+
+export interface ICoreMailMailbox {
+  address: string;
+  displayName?: string;
+}
+
+export interface ICoreMailEnvelope {
+  mailFrom: string;
+  rcptTo: string[];
+}
+
+export interface ICoreMailHeader {
+  name: string;
+  value: string;
+}
+
+export interface ICoreMailContentDescriptor {
+  partId: string;
+  kind: TCoreMailPartKind;
+  contentType: string;
+  filename?: string;
+  contentId?: string;
+  sha256: TCoreMailSha256;
+  lengthBytes: number;
+}
+
+export interface ICoreMailOutboundMessageDescriptor {
+  sender: ICoreMailMailbox;
+  recipients: {
+    to: ICoreMailMailbox[];
+    cc?: ICoreMailMailbox[];
+    bcc?: ICoreMailMailbox[];
+  };
+  replyTo?: ICoreMailMailbox;
+  subject: string;
+  /** Ordered headers. Transport-owned MIME headers are not accepted here. */
+  headers?: ICoreMailHeader[];
+  /** Ordered body and attachment descriptors. Bytes move through bounded HTTP transfers. */
+  parts: ICoreMailContentDescriptor[];
+}
+
+export interface ICoreMailTransferGrant {
+  grantId: string;
+  method: TCoreMailTransferMethod;
+  /** Same-origin path. Callers use the authenticated CoreMail or gateway endpoint they already hold. */
+  path: string;
+  /** One-time bearer capability. It must never be logged or persisted by a consumer. */
+  bearerToken: string;
+  sha256: TCoreMailSha256;
+  lengthBytes: number;
+  contentType: string;
+  expiresAt: number;
+}
+
+export interface ICoreMailUploadGrant extends ICoreMailTransferGrant {
+  method: 'PUT';
+}
+
+export interface ICoreMailDownloadGrant extends ICoreMailTransferGrant {
+  method: 'GET';
+}
+
+export interface ICoreMailPartStatus {
+  partId: string;
+  state: 'missing' | 'uploading' | 'complete' | 'failed';
+  sha256: TCoreMailSha256;
+  lengthBytes: number;
+}
+
+export interface ICoreMailSubmission {
+  submissionId: string;
+  idempotencyKey: string;
+  submissionDigest: TCoreMailSha256;
+  state: TCoreMailSubmissionState;
+  parts: ICoreMailPartStatus[];
+  transportMessageId?: string;
+  attempts: number;
+  nextAttemptAt?: number;
+  acceptedAt?: number;
+  deliveredAt?: number;
+  createdAt: number;
+  updatedAt: number;
+}
+
+export interface ICoreMailInboundDelivery {
+  deliveryId: string;
+  transportDeliveryId: string;
+  state: TCoreMailInboundDeliveryState;
+  envelope: ICoreMailEnvelope;
+  rawMime: {
+    sha256: TCoreMailSha256;
+    lengthBytes: number;
+    contentType: 'message/rfc822';
+  };
+  messageId?: string;
+  subject?: string;
+  receivedAt: number;
+  updatedAt: number;
+}
+
+export interface ICoreMailBindingCredentialVerifier {
+  credentialId: string;
+  version: number;
+  state: TCoreMailCredentialState;
+  /** Password-verifier string only. Plaintext credential material is never part of desired state. */
+  verificationHash: string;
+  acceptUntil?: number;
+}
+
+export interface ICoreMailBindingDesiredState {
+  schemaVersion: 1;
+  bindingId: string;
+  serviceId: string;
+  tenantId: string;
+  revision: number;
+  state: TCoreMailBindingState;
+  capabilities: TCoreMailCapability[];
+  credentials: ICoreMailBindingCredentialVerifier[];
+  allowedSenders: string[];
+  inboundRecipients: string[];
+  defaultSender?: string;
+  limits?: {
+    messagesPerMinute?: number;
+    messagesPerDay?: number;
+    maxPendingInbound?: number;
+  };
+}
+
+export interface ICoreMailGatewayDesiredState {
+  endpointUrl: string;
+  credentialId: string;
+  credentialVersion: number;
+  /** Key in CoreMail's resolved runtime secret material, never a plaintext value. */
+  credentialSecretKey: string;
+}
+
+export interface ICoreMailDesiredState {
+  schemaVersion: 1;
+  configEpoch: number;
+  bindings: ICoreMailBindingDesiredState[];
+  gateway: ICoreMailGatewayDesiredState;
+}
+
+export interface ICoreMailReplicaIdentity {
+  taskId: string;
+  serviceId: string;
+  rolloutId: string;
+  rolloutGeneration: number;
+  imageDigest: TCoreMailSha256;
+}
+
+export interface ICoreMailBindingReconciliationStatus {
+  bindingId: string;
+  revision: number;
+  state: TCoreMailBindingState;
+  activeSessionsByCredentialVersion: Array<{
+    version: number;
+    count: number;
+  }>;
+}
+
+export interface ICoreMailReconciliationStatus {
+  replica: ICoreMailReplicaIdentity;
+  state: TCoreMailReconciliationState;
+  appliedConfigEpoch: number;
+  appliedDesiredStateDigest: TCoreMailSha256;
+  bindings: ICoreMailBindingReconciliationStatus[];
+  updatedAt: number;
+  errorCode?: TCoreMailErrorCode;
+}
+
+export interface ICoreMailRecipientResolution {
+  recipient: string;
+  action: TCoreMailRecipientAction;
+  /** Opaque, short-lived handle returned only for accepted recipients. */
+  routingHandle?: string;
+  smtpCode?: number;
+  message?: string;
+}
+
+export interface ICoreMailGatewayMessageDescriptor {
+  envelope: ICoreMailEnvelope;
+  rawMime: {
+    sha256: TCoreMailSha256;
+    lengthBytes: number;
+    contentType: 'message/rfc822';
+  };
+}
+
+export interface ICoreMailGatewayOutboundStatus {
+  transportMessageId: string;
+  state: Extract<
+    TCoreMailSubmissionState,
+    'accepted' | 'queued' | 'delivering' | 'delivered' | 'deferred' | 'failed' | 'deadLettered'
+  >;
+  attempts: number;
+  nextAttemptAt?: number;
+  smtpCode?: number;
+  updatedAt: number;
+}
+
+export const coreMailLimits = Object.freeze({
+  controlMessageBytes: 64 * 1024,
+  desiredStateBytes: 8 * 1024 * 1024,
+  textPartBytes: 1 * 1024 * 1024,
+  htmlPartBytes: 2 * 1024 * 1024,
+  attachmentCount: 16,
+  attachmentBytes: 10 * 1024 * 1024,
+  aggregateAttachmentBytes: 17 * 1024 * 1024,
+  mimeFramingBytes: 512 * 1024,
+  serializedMimeBytes: 30 * 1024 * 1024,
+  transferGrantTtlMs: 5 * 60 * 1000,
+  transferHeaderTimeoutMs: 10 * 1000,
+  transferIdleTimeoutMs: 15 * 1000,
+  transferOverallTimeoutMs: 2 * 60 * 1000,
+} as const);

package/ts/data/index.ts

@@ -1,6 +1,7 @@
 export * from './cloudlyconfig.js';
 export * from './cluster.js';
 export * from './config.js';
+export * from './coremail.js';
 export * from './deployment.js';
 export * from './deploymentadoption.js';
 export * from './deploymentoperation.js';

package/ts/requests/coremail.ts

@@ -0,0 +1,346 @@
+import type * as plugins from '../plugins.js';
+import type {
+  ICoreMailEnvelope,
+  ICoreMailDownloadGrant,
+  ICoreMailGatewayMessageDescriptor,
+  ICoreMailGatewayOutboundStatus,
+  ICoreMailInboundDelivery,
+  ICoreMailOutboundMessageDescriptor,
+  ICoreMailRecipientResolution,
+  ICoreMailReconciliationStatus,
+  ICoreMailReplicaIdentity,
+  ICoreMailSubmission,
+  ICoreMailUploadGrant,
+  TCoreMailInboundAckOutcome,
+  TCoreMailSha256,
+} from '../data/coremail.js';
+import type { IMailConnectionInfo } from '../data/mail.js';
+
+export interface IReq_CoreMailAuthenticateWorkload extends plugins.typedrequestInterfaces.implementsTR<
+  plugins.typedrequestInterfaces.ITypedRequest,
+  IReq_CoreMailAuthenticateWorkload
+> {
+  method: 'coreMailAuthenticateWorkload';
+  request: {
+    bindingId: string;
+    credentialId: string;
+    credentialVersion: number;
+    credentialSecret: string;
+  };
+  response: {
+    authenticated: true;
+    credentialVersion: number;
+    capabilities: Array<'outbound' | 'inbound'>;
+  };
+}
+
+export interface IReq_CoreMailPrepareOutboundSubmission extends plugins.typedrequestInterfaces.implementsTR<
+  plugins.typedrequestInterfaces.ITypedRequest,
+  IReq_CoreMailPrepareOutboundSubmission
+> {
+  method: 'coreMailPrepareOutboundSubmission';
+  request: {
+    /** Required replay key. Authority is added by the authenticated server session. */
+    idempotencyKey: string;
+    message: ICoreMailOutboundMessageDescriptor;
+  };
+  response: {
+    submission: ICoreMailSubmission;
+    replayed: boolean;
+  };
+}
+
+export interface IReq_CoreMailPrepareOutboundPartUpload extends plugins.typedrequestInterfaces.implementsTR<
+  plugins.typedrequestInterfaces.ITypedRequest,
+  IReq_CoreMailPrepareOutboundPartUpload
+> {
+  method: 'coreMailPrepareOutboundPartUpload';
+  request: {
+    submissionId: string;
+    partId: string;
+  };
+  response: {
+    grant: ICoreMailUploadGrant;
+  };
+}
+
+export interface IReq_CoreMailCompleteOutboundPartUpload extends plugins.typedrequestInterfaces.implementsTR<
+  plugins.typedrequestInterfaces.ITypedRequest,
+  IReq_CoreMailCompleteOutboundPartUpload
+> {
+  method: 'coreMailCompleteOutboundPartUpload';
+  request: {
+    submissionId: string;
+    partId: string;
+    grantId: string;
+    sha256: TCoreMailSha256;
+    lengthBytes: number;
+  };
+  response: {
+    submission: ICoreMailSubmission;
+  };
+}
+
+export interface IReq_CoreMailFinalizeOutboundSubmission extends plugins.typedrequestInterfaces.implementsTR<
+  plugins.typedrequestInterfaces.ITypedRequest,
+  IReq_CoreMailFinalizeOutboundSubmission
+> {
+  method: 'coreMailFinalizeOutboundSubmission';
+  request: {
+    submissionId: string;
+  };
+  response: {
+    submission: ICoreMailSubmission;
+  };
+}
+
+export interface IReq_CoreMailGetOutboundSubmission extends plugins.typedrequestInterfaces.implementsTR<
+  plugins.typedrequestInterfaces.ITypedRequest,
+  IReq_CoreMailGetOutboundSubmission
+> {
+  method: 'coreMailGetOutboundSubmission';
+  request: {
+    submissionId: string;
+  };
+  response: {
+    submission: ICoreMailSubmission;
+  };
+}
+
+export interface IReq_CoreMailListInboundDeliveries extends plugins.typedrequestInterfaces.implementsTR<
+  plugins.typedrequestInterfaces.ITypedRequest,
+  IReq_CoreMailListInboundDeliveries
+> {
+  method: 'coreMailListInboundDeliveries';
+  request: {
+    afterDeliveryId?: string;
+    limit: number;
+  };
+  response: {
+    deliveries: ICoreMailInboundDelivery[];
+  };
+}
+
+export interface IReq_CoreMailPrepareInboundFetch extends plugins.typedrequestInterfaces.implementsTR<
+  plugins.typedrequestInterfaces.ITypedRequest,
+  IReq_CoreMailPrepareInboundFetch
+> {
+  method: 'coreMailPrepareInboundFetch';
+  request: {
+    deliveryId: string;
+  };
+  response: {
+    grant: ICoreMailDownloadGrant;
+  };
+}
+
+export interface IReq_CoreMailCompleteInboundFetch extends plugins.typedrequestInterfaces.implementsTR<
+  plugins.typedrequestInterfaces.ITypedRequest,
+  IReq_CoreMailCompleteInboundFetch
+> {
+  method: 'coreMailCompleteInboundFetch';
+  request: {
+    deliveryId: string;
+    grantId: string;
+    sha256: TCoreMailSha256;
+    lengthBytes: number;
+  };
+  response: {
+    delivery: ICoreMailInboundDelivery;
+  };
+}
+
+export interface IReq_CoreMailAcknowledgeInboundDelivery extends plugins.typedrequestInterfaces.implementsTR<
+  plugins.typedrequestInterfaces.ITypedRequest,
+  IReq_CoreMailAcknowledgeInboundDelivery
+> {
+  method: 'coreMailAcknowledgeInboundDelivery';
+  request: {
+    deliveryId: string;
+    outcome: TCoreMailInboundAckOutcome;
+  };
+  response: {
+    delivery: ICoreMailInboundDelivery;
+    replayed: boolean;
+  };
+}
+
+export interface IReq_CoreMailAuthenticateControl extends plugins.typedrequestInterfaces.implementsTR<
+  plugins.typedrequestInterfaces.ITypedRequest,
+  IReq_CoreMailAuthenticateControl
+> {
+  method: 'coreMailAuthenticateControl';
+  request: {
+    credentialId: string;
+    credentialVersion: number;
+    credentialSecret: string;
+  };
+  response: {
+    authenticated: true;
+    replica: ICoreMailReplicaIdentity;
+  };
+}
+
+export interface IReq_CoreMailPrepareDesiredStateUpload extends plugins.typedrequestInterfaces.implementsTR<
+  plugins.typedrequestInterfaces.ITypedRequest,
+  IReq_CoreMailPrepareDesiredStateUpload
+> {
+  method: 'coreMailPrepareDesiredStateUpload';
+  request: {
+    expectedAppliedConfigEpoch: number;
+    configEpoch: number;
+    desiredStateDigest: TCoreMailSha256;
+    lengthBytes: number;
+  };
+  response: {
+    reconciliationId: string;
+    grant: ICoreMailUploadGrant;
+    replayed: boolean;
+  };
+}
+
+export interface IReq_CoreMailApplyDesiredState extends plugins.typedrequestInterfaces.implementsTR<
+  plugins.typedrequestInterfaces.ITypedRequest,
+  IReq_CoreMailApplyDesiredState
+> {
+  method: 'coreMailApplyDesiredState';
+  request: {
+    reconciliationId: string;
+    grantId: string;
+    desiredStateDigest: TCoreMailSha256;
+    lengthBytes: number;
+  };
+  response: {
+    status: ICoreMailReconciliationStatus;
+  };
+}
+
+export interface IReq_CoreMailGetReconciliationStatus extends plugins.typedrequestInterfaces.implementsTR<
+  plugins.typedrequestInterfaces.ITypedRequest,
+  IReq_CoreMailGetReconciliationStatus
+> {
+  method: 'coreMailGetReconciliationStatus';
+  request: {
+    configEpoch: number;
+    desiredStateDigest: TCoreMailSha256;
+  };
+  response: {
+    status: ICoreMailReconciliationStatus;
+  };
+}
+
+export interface IReq_CoreMailGatewayAuthenticate extends plugins.typedrequestInterfaces.implementsTR<
+  plugins.typedrequestInterfaces.ITypedRequest,
+  IReq_CoreMailGatewayAuthenticate
+> {
+  method: 'coreMailGatewayAuthenticate';
+  request: {
+    credentialId: string;
+    credentialVersion: number;
+    credentialSecret: string;
+  };
+  response: {
+    authenticated: true;
+    credentialVersion: number;
+  };
+}
+
+export interface IReq_CoreMailGatewayResolveRecipients extends plugins.typedrequestInterfaces.implementsTR<
+  plugins.typedrequestInterfaces.ITypedRequest,
+  IReq_CoreMailGatewayResolveRecipients
+> {
+  method: 'coreMailGatewayResolveRecipients';
+  request: {
+    envelope: ICoreMailEnvelope;
+    recipients: string[];
+    source: IMailConnectionInfo;
+  };
+  response: {
+    resolutions: ICoreMailRecipientResolution[];
+  };
+}
+
+export interface IReq_CoreMailGatewayPrepareInboundHandoff extends plugins.typedrequestInterfaces.implementsTR<
+  plugins.typedrequestInterfaces.ITypedRequest,
+  IReq_CoreMailGatewayPrepareInboundHandoff
+> {
+  method: 'coreMailGatewayPrepareInboundHandoff';
+  request: {
+    transportDeliveryId: string;
+    routingHandles: string[];
+    message: ICoreMailGatewayMessageDescriptor;
+    source: IMailConnectionInfo;
+  };
+  response: {
+    handoffId: string;
+    grant?: ICoreMailUploadGrant;
+    replayed: boolean;
+  };
+}
+
+export interface IReq_CoreMailGatewayCompleteInboundHandoff extends plugins.typedrequestInterfaces.implementsTR<
+  plugins.typedrequestInterfaces.ITypedRequest,
+  IReq_CoreMailGatewayCompleteInboundHandoff
+> {
+  method: 'coreMailGatewayCompleteInboundHandoff';
+  request: {
+    handoffId: string;
+    grantId: string;
+    sha256: TCoreMailSha256;
+    lengthBytes: number;
+  };
+  response: {
+    accepted: true;
+    deliveryIds: string[];
+    replayed: boolean;
+  };
+}
+
+export interface IReq_CoreMailGatewayPrepareOutboundHandoff extends plugins.typedrequestInterfaces.implementsTR<
+  plugins.typedrequestInterfaces.ITypedRequest,
+  IReq_CoreMailGatewayPrepareOutboundHandoff
+> {
+  method: 'coreMailGatewayPrepareOutboundHandoff';
+  request: {
+    transportSubmissionId: string;
+    submissionDigest: TCoreMailSha256;
+    message: ICoreMailGatewayMessageDescriptor;
+    /** CoreMail-issued GET grant. dcrouter resolves the path against the authenticated peer. */
+    grant: ICoreMailDownloadGrant;
+  };
+  response: {
+    transportMessageId: string;
+    status: ICoreMailGatewayOutboundStatus;
+    replayed: boolean;
+  };
+}
+
+export interface IReq_CoreMailGatewayCompleteOutboundHandoff extends plugins.typedrequestInterfaces.implementsTR<
+  plugins.typedrequestInterfaces.ITypedRequest,
+  IReq_CoreMailGatewayCompleteOutboundHandoff
+> {
+  method: 'coreMailGatewayCompleteOutboundHandoff';
+  request: {
+    transportMessageId: string;
+    grantId: string;
+    sha256: TCoreMailSha256;
+    lengthBytes: number;
+  };
+  response: {
+    status: ICoreMailGatewayOutboundStatus;
+    replayed: boolean;
+  };
+}
+
+export interface IReq_CoreMailGatewayGetOutboundStatus extends plugins.typedrequestInterfaces.implementsTR<
+  plugins.typedrequestInterfaces.ITypedRequest,
+  IReq_CoreMailGatewayGetOutboundStatus
+> {
+  method: 'coreMailGatewayGetOutboundStatus';
+  request: {
+    transportMessageId: string;
+  };
+  response: {
+    status: ICoreMailGatewayOutboundStatus;
+  };
+}

package/ts/requests/index.ts

@@ -8,6 +8,7 @@ import * as backupRequests from './backup.js';
 import * as certificateRequests from './certificate.js';
 import * as clusterRequests from './cluster.js';
 import * as configRequests from './config.js';
+import * as coreMailRequests from './coremail.js';
 import * as corestoreRequests from './corestore.js';
 import * as deploymentRequests from './deployment.js';
 import * as dnsRequests from './dns.js';
@@ -45,6 +46,7 @@ export {
   certificateRequests as certificate,
   clusterRequests as cluster,
   configRequests as config,
+  coreMailRequests as coremail,
   corestoreRequests as corestore,
   deploymentRequests as deployment,
   dnsRequests as dns,