@upyo/jmap 0.6.0-dev.349 → 0.6.0-dev.351

package/README.md

@@ -133,3 +133,66 @@ try {
   }
 }
 ~~~~
+
+
+Sending raw MIME
+----------------
+
+`JmapTransport` implements the optional `RawTransport` interface. It uploads
+serialized MIME, imports the uploaded blob into Drafts, and submits that Email
+with an explicit delivery envelope:
+
+~~~~ typescript
+import { JmapTransport } from "@upyo/jmap";
+
+const transport = new JmapTransport({
+  sessionUrl: "https://mail.example.com/.well-known/jmap",
+  bearerToken: "your-token",
+});
+const receipt = await transport.sendRaw({
+  envelope: { from: "sender@example.com", to: ["recipient@example.net"] },
+  content: new TextEncoder().encode(
+    "From: sender@example.com\r\nSubject: Hello\r\n\r\nHello!\r\n"
+  ),
+  encoding: "7bit",
+});
+~~~~
+
+Content accepts bytes, promised bytes, Blob, or replayable attachment-style
+factories. Declaring `encoding` reads the source once per successful send;
+omitting it adds an analysis pass before upload. Every reader must reproduce
+the same bytes. `7bit` requires ASCII, `8bit` asserts ASCII MIME headers with an
+8-bit body, and `utf8` permits internationalized headers. Automatic analysis
+conservatively selects `utf8` for any non-ASCII byte. No transcoding occurs.
+
+Sources must have CRLF line endings including the final CRLF, nonempty headers,
+no NUL, and no line longer than 998 bytes excluding CRLF. Uploads stream without
+collecting the message in memory. Progress refreshes the inactivity timeout;
+cancellation stops source reads and requests source cleanup. Response parsing
+also remains subject to timeout. Pass an `AbortSignal` through `signal` in the
+second argument to `sendRaw()`.
+
+The envelope is independent of MIME headers. A configured `identityId` takes
+precedence; otherwise Upyo selects the identity matching the envelope sender,
+or falls back to the first available identity. A null sender also uses that
+fallback. The server may reject the chosen identity, envelope, or null sender.
+
+Upyo does not compose or repair the uploaded bytes. JMAP servers may repair
+imported MIME and modify messages during submission; RFC 8621 requires removal
+of Bcc during submission. Raw JMAP delivery therefore does not guarantee that
+an existing signature or byte-for-byte representation reaches the recipient.
+
+Import and submission are each attempted once. `jmap.raw_import_failed` with
+`retryable: true` means no submission was issued, although an imported Email
+may remain after a lost response. A definite server rejection is non-retryable.
+`jmap.raw_submission_unknown` means submission may have succeeded: inspect the
+server state before attempting another send. It is marked non-retryable to
+avoid duplicate delivery. Cancellation cannot recall a submitted message.
+
+An `alreadyExists` import result is reused only when the existing Email refers
+to the exact uploaded blob; matching Message-ID alone is insufficient. Upyo
+leaves imported Emails in Drafts and does not delete them after success or
+failure. The server expires unreferenced uploaded blobs according to its policy.
+
+See [RFC 8620] for uploads and request errors, and [RFC 8621] for import and
+submission behavior.

package/dist/index.cjs

@@ -66,79 +66,6 @@ function isCapabilityError(error) {
 	return error instanceof JmapApiError && error.jmapErrorType === JMAP_ERROR_TYPES.unknownCapability;
 }
 
-//#endregion
-//#region src/blob-uploader.ts
-/**
-* Upload a blob to the JMAP server.
-*
-* @param config - The resolved JMAP configuration
-* @param uploadUrl - The upload URL template from the session (e.g., "https://server/upload/{accountId}")
-* @param accountId - The account ID to upload to
-* @param blob - The blob or file to upload
-* @param signal - Optional abort signal
-* @returns The upload response containing the blobId
-*/
-async function uploadBlob(config, uploadUrl, accountId, blob, signal) {
-	signal?.throwIfAborted();
-	const url = uploadUrl.replace("{accountId}", accountId);
-	let authHeader;
-	if (config.bearerToken) authHeader = `Bearer ${config.bearerToken}`;
-	else if (config.basicAuth) {
-		const credentials = btoa(`${config.basicAuth.username}:${config.basicAuth.password}`);
-		authHeader = `Basic ${credentials}`;
-	} else throw new Error("No authentication method configured");
-	const headers = {
-		Authorization: authHeader,
-		"Content-Type": blob.type || "application/octet-stream"
-	};
-	for (const [key, value] of Object.entries(config.headers)) headers[key] = value;
-	const controller = new AbortController();
-	const timeoutId = setTimeout(() => controller.abort(), config.timeout);
-	const combinedSignal = (0, __upyo_core.combineSignals)(controller.signal, signal);
-	try {
-		const response = await fetch(url, {
-			method: "POST",
-			headers,
-			body: blob,
-			signal: combinedSignal.signal
-		});
-		if (!response.ok) {
-			const body = await response.text();
-			throw new JmapApiError(`Blob upload failed: ${response.status} ${response.statusText}`, response.status, body);
-		}
-		const result = await response.json();
-		return result;
-	} finally {
-		combinedSignal.cleanup();
-		clearTimeout(timeoutId);
-	}
-}
-
-//#endregion
-//#region src/config.ts
-/**
-* Creates a resolved JMAP configuration with default values applied.
-* @param config The user-provided configuration.
-* @returns The resolved configuration with all fields populated.
-* @throws Error if neither bearerToken nor basicAuth is provided.
-* @since 0.4.0
-*/
-function createJmapConfig(config) {
-	if (!config.bearerToken && !config.basicAuth) throw new Error("Either bearerToken or basicAuth must be provided");
-	return {
-		sessionUrl: config.sessionUrl,
-		bearerToken: config.bearerToken ?? null,
-		basicAuth: config.basicAuth ?? null,
-		accountId: config.accountId ?? null,
-		identityId: config.identityId ?? null,
-		timeout: config.timeout ?? 3e4,
-		retries: config.retries ?? 3,
-		headers: config.headers ?? {},
-		sessionCacheTtl: config.sessionCacheTtl ?? 3e5,
-		baseUrl: config.baseUrl ?? null
-	};
-}
-
 //#endregion
 //#region src/http-client.ts
 /**
@@ -147,7 +74,12 @@ function createJmapConfig(config) {
 */
 var JmapHttpClient = class {
 	config;
-	constructor(config) {
+	/**
+	* @param config HTTP and authentication settings.
+	* @param replayableRequests Whether request bodies and failed requests may be replayed.
+	*/
+	constructor(config, replayableRequests = true) {
+		this.replayableRequests = replayableRequests;
 		this.config = config;
 	}
 	/**
@@ -176,13 +108,21 @@ var JmapHttpClient = class {
 	async executeRequest(apiUrl, request, signal) {
 		signal?.throwIfAborted();
 		let lastError = null;
-		for (let attempt = 0; attempt <= this.config.retries; attempt++) {
+		const retries = this.replayableRequests ? this.config.retries : 0;
+		for (let attempt = 0; attempt <= retries; attempt++) {
 			signal?.throwIfAborted();
 			try {
 				const response = await this.fetchWithAuth(apiUrl, {
 					method: "POST",
 					headers: { "Content-Type": "application/json" },
-					body: JSON.stringify(request)
+					body: this.replayableRequests ? JSON.stringify(request) : new ReadableStream({ start(controller) {
+						controller.enqueue(new TextEncoder().encode(JSON.stringify(request)));
+						controller.close();
+					} }),
+					...this.replayableRequests ? {} : {
+						duplex: "half",
+						redirect: "error"
+					}
 				}, signal);
 				if (!response.ok) {
 					const text = await response.text();
@@ -197,7 +137,7 @@ var JmapHttpClient = class {
 					if (error.statusCode >= 400 && error.statusCode < 500) throw error;
 				}
 				lastError = error instanceof Error ? error : new Error(String(error));
-				if (attempt === this.config.retries) {
+				if (attempt === retries) {
 					if (error instanceof JmapApiError) throw error;
 					if (isAbortError$1(error)) throw new JmapApiError("JMAP request timed out.", void 0, void 0, void 0, void 0, attempt + 1);
 					throw new JmapApiError(lastError.message, void 0, void 0, void 0, void 0, attempt + 1);
@@ -260,6 +200,377 @@ function isAbortError$1(error) {
 	return error instanceof Error && error.name === "AbortError";
 }
 
+//#endregion
+//#region src/raw-upload.ts
+/** Runs a raw operation with a progress-resettable deadline through response parsing. @internal */
+async function rawOperation(timeout, operation, signal) {
+	const controller = new AbortController();
+	const combined = (0, __upyo_core.combineSignals)(controller.signal, signal);
+	let timer;
+	let finished = false;
+	const progress = () => {
+		if (finished) return;
+		clearTimeout(timer);
+		timer = setTimeout(() => controller.abort(new JmapApiError("Raw JMAP operation timed out.")), timeout);
+	};
+	let abort;
+	try {
+		combined.signal.throwIfAborted();
+		progress();
+		return await new Promise((resolve, reject) => {
+			abort = () => reject(combined.signal.reason);
+			combined.signal.addEventListener("abort", abort, { once: true });
+			Promise.resolve().then(() => {
+				combined.signal.throwIfAborted();
+				return operation(combined.signal, progress);
+			}).then(resolve, reject);
+			if (combined.signal.aborted) abort();
+		});
+	} finally {
+		finished = true;
+		clearTimeout(timer);
+		if (abort) combined.signal.removeEventListener("abort", abort);
+		controller.abort();
+		combined.cleanup();
+	}
+}
+/** @internal */
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** Streams validated MIME bytes without relying on fetch to cancel its body. @internal */
+async function uploadRawMessage(config, uploadUrl, accountId, plan, signal) {
+	return await rawOperation(config.timeout, async (outerSignal, progress) => {
+		const analysis = plan.encoding === void 0 ? await (0, __upyo_core.analyzeRawMessage)(plan, outerSignal, progress) : {
+			encoding: plan.encoding,
+			size: plan.size
+		};
+		outerSignal.throwIfAborted();
+		const controller = new AbortController();
+		const combined = (0, __upyo_core.combineSignals)(controller.signal, outerSignal);
+		const owned = combined.signal;
+		const iterator = (0, __upyo_core.iterateRawMessage)(plan, {
+			signal: owned,
+			encoding: analysis.encoding,
+			expectedSize: analysis.size,
+			onProgress: progress
+		})[Symbol.asyncIterator]();
+		let closed = false;
+		let eof = false;
+		let size = 0;
+		let sourceError;
+		let hasSourceError = false;
+		let bodyController;
+		const close = (reason) => {
+			if (closed) return;
+			closed = true;
+			controller.abort(reason);
+			if (!eof) try {
+				Promise.resolve(iterator.return?.()).catch(() => {});
+			} catch {}
+		};
+		const abort = () => {
+			try {
+				bodyController?.error(owned.reason);
+			} catch {}
+			close(owned.reason);
+		};
+		const body = new ReadableStream({
+			start(stream) {
+				bodyController = stream;
+				owned.addEventListener("abort", abort, { once: true });
+				if (owned.aborted) abort();
+			},
+			async pull(stream) {
+				try {
+					owned.throwIfAborted();
+					const item = await iterator.next();
+					owned.throwIfAborted();
+					if (item.done) {
+						eof = true;
+						progress();
+						stream.close();
+					} else {
+						size += item.value.length;
+						stream.enqueue(new Uint8Array(item.value));
+					}
+				} catch (error) {
+					if (!owned.aborted && !hasSourceError) {
+						hasSourceError = true;
+						sourceError = error;
+					}
+					try {
+						stream.error(error);
+					} catch {}
+					close(error);
+				}
+			},
+			cancel: close
+		}, { highWaterMark: 0 });
+		const headers = new Headers(config.headers);
+		if (!headers.has("Authorization")) {
+			if (config.bearerToken) headers.set("Authorization", `Bearer ${config.bearerToken}`);
+			else if (config.basicAuth) headers.set("Authorization", `Basic ${btoa(`${config.basicAuth.username}:${config.basicAuth.password}`)}`);
+		}
+		headers.set("Content-Type", "message/rfc822");
+		const request = {
+			method: "POST",
+			headers,
+			body,
+			duplex: "half",
+			redirect: "error",
+			signal: owned
+		};
+		try {
+			const response = await fetch(uploadUrl.replace("{accountId}", encodeURIComponent(accountId)), request);
+			owned.throwIfAborted();
+			if (!eof) throw new JmapApiError("Raw upload responded before validated EOF.");
+			if (!response.ok) throw new JmapApiError(`Raw upload failed: ${response.status}`, response.status, await response.text());
+			const result = await response.json();
+			owned.throwIfAborted();
+			if (!isRecord(result) || result.accountId !== accountId || typeof result.blobId !== "string" || !result.blobId || result.size !== size) throw new JmapApiError("Invalid raw upload response.");
+			return {
+				accountId,
+				blobId: result.blobId,
+				size,
+				type: typeof result.type === "string" ? result.type : "message/rfc822"
+			};
+		} catch (error) {
+			outerSignal.throwIfAborted();
+			if (hasSourceError) throw sourceError;
+			owned.throwIfAborted();
+			throw error;
+		} finally {
+			owned.removeEventListener("abort", abort);
+			close();
+			combined.cleanup();
+		}
+	}, signal);
+}
+
+//#endregion
+//#region src/raw-delivery.ts
+const using = [
+	"urn:ietf:params:jmap:core",
+	"urn:ietf:params:jmap:mail",
+	"urn:ietf:params:jmap:submission"
+];
+function failure(message, stage, retryable, unknown = false) {
+	return (0, __upyo_core.createFailedReceipt)(message, {
+		provider: "jmap",
+		code: `jmap.raw_${stage}_${unknown ? "unknown" : "failed"}`,
+		category: unknown ? "unknown" : retryable ? void 0 : "rejected",
+		retryable,
+		attempts: 1
+	});
+}
+function methodResult(response, name, id, accountId) {
+	if (!isRecord(response) || !Array.isArray(response.methodResponses)) throw new JmapApiError("Invalid raw JMAP method response.");
+	const matches = response.methodResponses.filter((entry) => Array.isArray(entry) && entry[2] === id);
+	if (matches.length !== 1) throw new JmapApiError("Missing or contradictory raw JMAP method response.");
+	const result = matches[0];
+	if (!Array.isArray(result) || result.length !== 3 || !isRecord(result[1]) || result[0] !== name && result[0] !== "error") throw new JmapApiError("Invalid raw JMAP method result.");
+	if (result[0] === "error") {
+		if (typeof result[1].type !== "string" || !result[1].type) throw new JmapApiError("Invalid raw JMAP method error.");
+	} else if (result[1].accountId !== accountId) throw new JmapApiError("Wrong account in raw JMAP response.");
+	return {
+		name: result[0],
+		args: result[1]
+	};
+}
+function creation(args) {
+	const created = isRecord(args.created) ? args.created.raw : void 0;
+	const rejected = isRecord(args.notCreated) ? args.notCreated.raw : void 0;
+	if (created !== void 0 && rejected !== void 0) throw new JmapApiError("Contradictory raw JMAP creation result.");
+	if (isRecord(created) && typeof created.id === "string" && created.id) return { created };
+	if (isRecord(rejected) && typeof rejected.type === "string" && rejected.type) return { rejected };
+	throw new JmapApiError("Missing raw JMAP creation result.");
+}
+function errorDescription(error) {
+	return `Raw JMAP operation rejected: ${String(error.type)}${typeof error.description === "string" ? `: ${error.description}` : ""}`;
+}
+function isRequestRejection(error) {
+	if (!(error instanceof JmapApiError) || !error.responseBody || error.statusCode === void 0 || error.statusCode < 400 || error.statusCode > 599) return false;
+	try {
+		const body = JSON.parse(error.responseBody);
+		if (!isRecord(body) || body.status !== void 0 && body.status !== error.statusCode) return false;
+		if (body.type === JMAP_ERROR_TYPES.limit) return typeof body.limit === "string" && body.limit.length > 0;
+		return body.type === JMAP_ERROR_TYPES.notJSON || body.type === JMAP_ERROR_TYPES.notRequest || body.type === JMAP_ERROR_TYPES.unknownCapability;
+	} catch {
+		return false;
+	}
+}
+/** Uploads, imports, then submits exactly once; uncertain submission must not be retried. @internal */
+async function deliverRawMessage(config, session, accountId, draftsMailboxId, identityId, plan, signal) {
+	const client = new JmapHttpClient({
+		...config,
+		retries: 0
+	}, false);
+	const execute = (request) => rawOperation(config.timeout, (owned) => client.executeRequest(session.apiUrl, request, owned), signal);
+	let stage = "upload";
+	try {
+		const uploaded = await uploadRawMessage(config, session.uploadUrl, accountId, plan, signal);
+		signal?.throwIfAborted();
+		stage = "import";
+		const imported = methodResult(await execute({
+			using,
+			methodCalls: [[
+				"Email/import",
+				{
+					accountId,
+					emails: { raw: {
+						blobId: uploaded.blobId,
+						mailboxIds: { [draftsMailboxId]: true }
+					} }
+				},
+				"raw-import"
+			]]
+		}), "Email/import", "raw-import", accountId);
+		if (imported.name === "error") return failure(errorDescription(imported.args), "import", imported.args.type === "serverPartialFail");
+		const { created, rejected } = creation(imported.args);
+		let emailId;
+		if (created && typeof created.id === "string") emailId = created.id;
+		else if (rejected?.type === "alreadyExists" && typeof rejected.existingId === "string" && rejected.existingId) {
+			const existing = methodResult(await execute({
+				using,
+				methodCalls: [[
+					"Email/get",
+					{
+						accountId,
+						ids: [rejected.existingId],
+						properties: ["id", "blobId"]
+					},
+					"raw-existing"
+				]]
+			}), "Email/get", "raw-existing", accountId);
+			const list = existing.args.list;
+			if (existing.name === "error" || !Array.isArray(list) || list.length !== 1 || !isRecord(list[0]) || list[0].id !== rejected.existingId || list[0].blobId !== uploaded.blobId) return failure("Existing Email does not match the uploaded raw blob.", "import", false);
+			emailId = rejected.existingId;
+		} else return failure(errorDescription(rejected ?? { type: "invalidResult" }), "import", false);
+		signal?.throwIfAborted();
+		stage = "submission";
+		const submitted = methodResult(await execute({
+			using,
+			methodCalls: [[
+				"EmailSubmission/set",
+				{
+					accountId,
+					create: { raw: {
+						emailId,
+						identityId,
+						envelope: {
+							mailFrom: { email: plan.envelope.from ?? "" },
+							rcptTo: plan.envelope.to.map((email) => ({ email }))
+						}
+					} }
+				},
+				"raw-submit"
+			]]
+		}), "EmailSubmission/set", "raw-submit", accountId);
+		if (submitted.name === "error") return failure(errorDescription(submitted.args), "submission", false, submitted.args.type === "serverPartialFail");
+		const result = creation(submitted.args);
+		if (result.rejected) return failure(errorDescription(result.rejected), "submission", false);
+		if (!result.created || typeof result.created.id !== "string") throw new JmapApiError("Missing raw submission ID.");
+		signal?.throwIfAborted();
+		return {
+			successful: true,
+			provider: "jmap",
+			messageId: result.created.id
+		};
+	} catch (error) {
+		signal?.throwIfAborted();
+		const message = error instanceof Error ? error.message : String(error);
+		if (error instanceof __upyo_core.RawMessageValidationError) return (0, __upyo_core.createFailedReceipt)(message, {
+			provider: "jmap",
+			code: "jmap.raw_message_invalid",
+			category: "validation",
+			retryable: false,
+			attempts: 1
+		});
+		const definite = isRequestRejection(error);
+		return failure(message, stage, stage !== "submission" && !definite, stage === "submission" && !definite);
+	}
+}
+/** Validates raw discovery responses before accepting delivery identifiers. @internal */
+function rawDiscoveryResult(response, method, accountId) {
+	const result = methodResult(response, method, "c0", accountId);
+	if (result.name === "error") throw new JmapApiError(errorDescription(result.args));
+	return result.args;
+}
+
+//#endregion
+//#region src/blob-uploader.ts
+/**
+* Upload a blob to the JMAP server.
+*
+* @param config - The resolved JMAP configuration
+* @param uploadUrl - The upload URL template from the session (e.g., "https://server/upload/{accountId}")
+* @param accountId - The account ID to upload to
+* @param blob - The blob or file to upload
+* @param signal - Optional abort signal
+* @returns The upload response containing the blobId
+*/
+async function uploadBlob(config, uploadUrl, accountId, blob, signal) {
+	signal?.throwIfAborted();
+	const url = uploadUrl.replace("{accountId}", accountId);
+	let authHeader;
+	if (config.bearerToken) authHeader = `Bearer ${config.bearerToken}`;
+	else if (config.basicAuth) {
+		const credentials = btoa(`${config.basicAuth.username}:${config.basicAuth.password}`);
+		authHeader = `Basic ${credentials}`;
+	} else throw new Error("No authentication method configured");
+	const headers = {
+		Authorization: authHeader,
+		"Content-Type": blob.type || "application/octet-stream"
+	};
+	for (const [key, value] of Object.entries(config.headers)) headers[key] = value;
+	const controller = new AbortController();
+	const timeoutId = setTimeout(() => controller.abort(), config.timeout);
+	const combinedSignal = (0, __upyo_core.combineSignals)(controller.signal, signal);
+	try {
+		const response = await fetch(url, {
+			method: "POST",
+			headers,
+			body: blob,
+			signal: combinedSignal.signal
+		});
+		if (!response.ok) {
+			const body = await response.text();
+			throw new JmapApiError(`Blob upload failed: ${response.status} ${response.statusText}`, response.status, body);
+		}
+		const result = await response.json();
+		return result;
+	} finally {
+		combinedSignal.cleanup();
+		clearTimeout(timeoutId);
+	}
+}
+
+//#endregion
+//#region src/config.ts
+/**
+* Creates a resolved JMAP configuration with default values applied.
+* @param config The user-provided configuration.
+* @returns The resolved configuration with all fields populated.
+* @throws Error if neither bearerToken nor basicAuth is provided.
+* @since 0.4.0
+*/
+function createJmapConfig(config) {
+	if (!config.bearerToken && !config.basicAuth) throw new Error("Either bearerToken or basicAuth must be provided");
+	return {
+		sessionUrl: config.sessionUrl,
+		bearerToken: config.bearerToken ?? null,
+		basicAuth: config.basicAuth ?? null,
+		accountId: config.accountId ?? null,
+		identityId: config.identityId ?? null,
+		timeout: config.timeout ?? 3e4,
+		retries: config.retries ?? 3,
+		headers: config.headers ?? {},
+		sessionCacheTtl: config.sessionCacheTtl ?? 3e5,
+		baseUrl: config.baseUrl ?? null
+	};
+}
+
 //#endregion
 //#region src/message-converter.ts
 /**
@@ -672,6 +983,45 @@ var JmapTransport = class {
 		}
 	}
 	/**
+	* Uploads serialized MIME, imports it, and submits it with an explicit envelope.
+	* JMAP servers may modify imported or submitted messages, including removing
+	* Bcc. Import and submission are never retried automatically.
+	* @param message Original MIME and delivery envelope.
+	* @param options Optional cancellation signal.
+	* @returns A receipt; uncertain submission outcomes are non-retryable.
+	* @throws {Error} If cancellation is requested.
+	* @since 0.6.0
+	*/
+	async sendRaw(message, options) {
+		if (message?.content instanceof Promise) message.content.catch(() => {});
+		const signal = options?.signal;
+		signal?.throwIfAborted();
+		try {
+			const plan = (0, __upyo_core.createRawMessagePlan)(message);
+			const session = await rawOperation(this.config.timeout, (owned) => this.getSession(owned), signal);
+			const capable = (id) => {
+				const account = session.accounts[id];
+				return account != null && !account.isReadOnly && JMAP_CAPABILITIES.mail in account.accountCapabilities && JMAP_CAPABILITIES.submission in account.accountCapabilities;
+			};
+			const accountId = this.config.accountId ?? Object.keys(session.accounts).find(capable);
+			if (accountId == null || !capable(accountId) || !Object.values(JMAP_CAPABILITIES).every((capability) => capability in session.capabilities)) return createJmapFailure("No writable mail and submission account found.", void 0, {
+				category: "configuration",
+				code: "jmap.no_mail_account",
+				retryable: false
+			});
+			const drafts = await rawOperation(this.config.timeout, (owned) => this.getDraftsMailboxId(session, accountId, owned, true), signal);
+			const identity = await rawOperation(this.config.timeout, (owned) => this.getIdentityId(session, accountId, plan.envelope.from ?? "", owned, true), signal);
+			return await deliverRawMessage(this.config, session, accountId, drafts, identity, plan, signal);
+		} catch (error) {
+			signal?.throwIfAborted();
+			return createJmapFailure(error instanceof Error ? error.message : String(error), error, error instanceof __upyo_core.RawMessageValidationError ? {
+				category: "validation",
+				code: "jmap.raw_message_invalid",
+				retryable: false
+			} : void 0);
+		}
+	}
+	/**
 	* Sends multiple messages in a single batched JMAP request.
 	* @param messages The messages to send.
 	* @param options Optional transport options.
@@ -818,7 +1168,7 @@ var JmapTransport = class {
 	* @returns The drafts mailbox ID.
 	* @since 0.4.0
 	*/
-	async getDraftsMailboxId(session, accountId, signal) {
+	async getDraftsMailboxId(session, accountId, signal, strict = false) {
 		const response = await this.httpClient.executeRequest(session.apiUrl, {
 			using: [JMAP_CAPABILITIES.core, JMAP_CAPABILITIES.mail],
 			methodCalls: [[
@@ -834,10 +1184,11 @@ var JmapTransport = class {
 				"c0"
 			]]
 		}, signal);
-		const mailboxResponse = response.methodResponses.find((r) => r[0] === "Mailbox/get");
+		const mailboxResponse = strict ? rawDiscoveryResult(response, "Mailbox/get", accountId) : response.methodResponses.find((r) => r[0] === "Mailbox/get")?.[1];
 		if (!mailboxResponse) throw new JmapApiError("No Mailbox/get response received");
-		const mailboxes = mailboxResponse[1].list;
+		const mailboxes = mailboxResponse.list;
 		if (!mailboxes) throw new JmapApiError("No mailboxes found");
+		if (strict && (!Array.isArray(mailboxes) || !mailboxes.every((mailbox) => isRecord(mailbox) && typeof mailbox.id === "string" && mailbox.id.length > 0))) throw new JmapApiError("Invalid mailbox identifiers in raw discovery.");
 		const drafts = mailboxes.find((m) => m.role === "drafts");
 		if (!drafts) throw new JmapApiError("No drafts mailbox found");
 		return drafts.id;
@@ -851,9 +1202,9 @@ var JmapTransport = class {
 	* @returns The identity ID.
 	* @since 0.4.0
 	*/
-	async getIdentityId(session, accountId, senderEmail, signal) {
+	async getIdentityId(session, accountId, senderEmail, signal, strict = false) {
 		if (this.config.identityId) return this.config.identityId;
-		const identityMap = await this.getIdentityMap(session, accountId, signal);
+		const identityMap = await this.getIdentityMap(session, accountId, signal, strict);
 		const matching = identityMap.get(senderEmail.toLowerCase());
 		if (matching) return matching;
 		return identityMap.values().next().value;
@@ -866,7 +1217,7 @@ var JmapTransport = class {
 	* @returns Map of lowercase email to identity ID.
 	* @since 0.4.0
 	*/
-	async getIdentityMap(session, accountId, signal) {
+	async getIdentityMap(session, accountId, signal, strict = false) {
 		if (this.config.identityId) return new Map([["*", this.config.identityId]]);
 		const response = await this.httpClient.executeRequest(session.apiUrl, {
 			using: [JMAP_CAPABILITIES.core, JMAP_CAPABILITIES.submission],
@@ -876,10 +1227,11 @@ var JmapTransport = class {
 				"c0"
 			]]
 		}, signal);
-		const identityResponse = response.methodResponses.find((r) => r[0] === "Identity/get");
+		const identityResponse = strict ? rawDiscoveryResult(response, "Identity/get", accountId) : response.methodResponses.find((r) => r[0] === "Identity/get")?.[1];
 		if (!identityResponse) throw new JmapApiError("No Identity/get response received");
-		const identities = identityResponse[1].list;
+		const identities = identityResponse.list;
 		if (!identities || identities.length === 0) throw new JmapApiError("No identities found");
+		if (strict && (!Array.isArray(identities) || !identities.every((identity) => isRecord(identity) && typeof identity.id === "string" && identity.id.length > 0 && typeof identity.email === "string"))) throw new JmapApiError("Invalid identity identifiers in raw discovery.");
 		const identityMap = /* @__PURE__ */ new Map();
 		for (const identity of identities) identityMap.set(identity.email.toLowerCase(), identity.id);
 		return identityMap;

package/dist/index.d.cts

@@ -1,4 +1,4 @@
-import { Message, Receipt, Transport, TransportOptions } from "@upyo/core";
+import { Message, RawMessage, RawTransport, Receipt, TransportOptions } from "@upyo/core";
 
 //#region src/config.d.ts
 
@@ -103,7 +103,7 @@ declare function createJmapConfig(config: JmapConfig): ResolvedJmapConfig;
  * JMAP transport for sending emails via JMAP protocol (RFC 8620/8621).
  * @since 0.4.0
  */
-declare class JmapTransport implements Transport<"jmap"> {
+declare class JmapTransport implements RawTransport<"jmap"> {
   readonly id = "jmap";
   readonly config: ResolvedJmapConfig;
   private readonly httpClient;
@@ -124,6 +124,17 @@ declare class JmapTransport implements Transport<"jmap"> {
    * @since 0.4.0
    */
   send(message: Message, options?: TransportOptions): Promise<Receipt<"jmap">>;
+  /**
+   * Uploads serialized MIME, imports it, and submits it with an explicit envelope.
+   * JMAP servers may modify imported or submitted messages, including removing
+   * Bcc. Import and submission are never retried automatically.
+   * @param message Original MIME and delivery envelope.
+   * @param options Optional cancellation signal.
+   * @returns A receipt; uncertain submission outcomes are non-retryable.
+   * @throws {Error} If cancellation is requested.
+   * @since 0.6.0
+   */
+  sendRaw(message: RawMessage, options?: TransportOptions): Promise<Receipt<"jmap">>;
   /**
    * Sends multiple messages in a single batched JMAP request.
    * @param messages The messages to send.

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { Message, Receipt, Transport, TransportOptions } from "@upyo/core";
+import { Message, RawMessage, RawTransport, Receipt, TransportOptions } from "@upyo/core";
 
 //#region src/config.d.ts
 
@@ -103,7 +103,7 @@ declare function createJmapConfig(config: JmapConfig): ResolvedJmapConfig;
  * JMAP transport for sending emails via JMAP protocol (RFC 8620/8621).
  * @since 0.4.0
  */
-declare class JmapTransport implements Transport<"jmap"> {
+declare class JmapTransport implements RawTransport<"jmap"> {
   readonly id = "jmap";
   readonly config: ResolvedJmapConfig;
   private readonly httpClient;
@@ -124,6 +124,17 @@ declare class JmapTransport implements Transport<"jmap"> {
    * @since 0.4.0
    */
   send(message: Message, options?: TransportOptions): Promise<Receipt<"jmap">>;
+  /**
+   * Uploads serialized MIME, imports it, and submits it with an explicit envelope.
+   * JMAP servers may modify imported or submitted messages, including removing
+   * Bcc. Import and submission are never retried automatically.
+   * @param message Original MIME and delivery envelope.
+   * @param options Optional cancellation signal.
+   * @returns A receipt; uncertain submission outcomes are non-retryable.
+   * @throws {Error} If cancellation is requested.
+   * @since 0.6.0
+   */
+  sendRaw(message: RawMessage, options?: TransportOptions): Promise<Receipt<"jmap">>;
   /**
    * Sends multiple messages in a single batched JMAP request.
    * @param messages The messages to send.

package/dist/index.js

@@ -1,4 +1,4 @@
-import { combineSignals, createFailedReceipt, parseRetryAfter, readAttachmentContent } from "@upyo/core";
+import { RawMessageValidationError, analyzeRawMessage, combineSignals, createFailedReceipt, createRawMessagePlan, iterateRawMessage, parseRetryAfter, readAttachmentContent } from "@upyo/core";
 import { resolveCalendarContent } from "@upyo/core/calendar";
 import { parseMessageId } from "@upyo/core/message-id";
 
@@ -43,79 +43,6 @@ function isCapabilityError(error) {
 	return error instanceof JmapApiError && error.jmapErrorType === JMAP_ERROR_TYPES.unknownCapability;
 }
 
-//#endregion
-//#region src/blob-uploader.ts
-/**
-* Upload a blob to the JMAP server.
-*
-* @param config - The resolved JMAP configuration
-* @param uploadUrl - The upload URL template from the session (e.g., "https://server/upload/{accountId}")
-* @param accountId - The account ID to upload to
-* @param blob - The blob or file to upload
-* @param signal - Optional abort signal
-* @returns The upload response containing the blobId
-*/
-async function uploadBlob(config, uploadUrl, accountId, blob, signal) {
-	signal?.throwIfAborted();
-	const url = uploadUrl.replace("{accountId}", accountId);
-	let authHeader;
-	if (config.bearerToken) authHeader = `Bearer ${config.bearerToken}`;
-	else if (config.basicAuth) {
-		const credentials = btoa(`${config.basicAuth.username}:${config.basicAuth.password}`);
-		authHeader = `Basic ${credentials}`;
-	} else throw new Error("No authentication method configured");
-	const headers = {
-		Authorization: authHeader,
-		"Content-Type": blob.type || "application/octet-stream"
-	};
-	for (const [key, value] of Object.entries(config.headers)) headers[key] = value;
-	const controller = new AbortController();
-	const timeoutId = setTimeout(() => controller.abort(), config.timeout);
-	const combinedSignal = combineSignals(controller.signal, signal);
-	try {
-		const response = await fetch(url, {
-			method: "POST",
-			headers,
-			body: blob,
-			signal: combinedSignal.signal
-		});
-		if (!response.ok) {
-			const body = await response.text();
-			throw new JmapApiError(`Blob upload failed: ${response.status} ${response.statusText}`, response.status, body);
-		}
-		const result = await response.json();
-		return result;
-	} finally {
-		combinedSignal.cleanup();
-		clearTimeout(timeoutId);
-	}
-}
-
-//#endregion
-//#region src/config.ts
-/**
-* Creates a resolved JMAP configuration with default values applied.
-* @param config The user-provided configuration.
-* @returns The resolved configuration with all fields populated.
-* @throws Error if neither bearerToken nor basicAuth is provided.
-* @since 0.4.0
-*/
-function createJmapConfig(config) {
-	if (!config.bearerToken && !config.basicAuth) throw new Error("Either bearerToken or basicAuth must be provided");
-	return {
-		sessionUrl: config.sessionUrl,
-		bearerToken: config.bearerToken ?? null,
-		basicAuth: config.basicAuth ?? null,
-		accountId: config.accountId ?? null,
-		identityId: config.identityId ?? null,
-		timeout: config.timeout ?? 3e4,
-		retries: config.retries ?? 3,
-		headers: config.headers ?? {},
-		sessionCacheTtl: config.sessionCacheTtl ?? 3e5,
-		baseUrl: config.baseUrl ?? null
-	};
-}
-
 //#endregion
 //#region src/http-client.ts
 /**
@@ -124,7 +51,12 @@ function createJmapConfig(config) {
 */
 var JmapHttpClient = class {
 	config;
-	constructor(config) {
+	/**
+	* @param config HTTP and authentication settings.
+	* @param replayableRequests Whether request bodies and failed requests may be replayed.
+	*/
+	constructor(config, replayableRequests = true) {
+		this.replayableRequests = replayableRequests;
 		this.config = config;
 	}
 	/**
@@ -153,13 +85,21 @@ var JmapHttpClient = class {
 	async executeRequest(apiUrl, request, signal) {
 		signal?.throwIfAborted();
 		let lastError = null;
-		for (let attempt = 0; attempt <= this.config.retries; attempt++) {
+		const retries = this.replayableRequests ? this.config.retries : 0;
+		for (let attempt = 0; attempt <= retries; attempt++) {
 			signal?.throwIfAborted();
 			try {
 				const response = await this.fetchWithAuth(apiUrl, {
 					method: "POST",
 					headers: { "Content-Type": "application/json" },
-					body: JSON.stringify(request)
+					body: this.replayableRequests ? JSON.stringify(request) : new ReadableStream({ start(controller) {
+						controller.enqueue(new TextEncoder().encode(JSON.stringify(request)));
+						controller.close();
+					} }),
+					...this.replayableRequests ? {} : {
+						duplex: "half",
+						redirect: "error"
+					}
 				}, signal);
 				if (!response.ok) {
 					const text = await response.text();
@@ -174,7 +114,7 @@ var JmapHttpClient = class {
 					if (error.statusCode >= 400 && error.statusCode < 500) throw error;
 				}
 				lastError = error instanceof Error ? error : new Error(String(error));
-				if (attempt === this.config.retries) {
+				if (attempt === retries) {
 					if (error instanceof JmapApiError) throw error;
 					if (isAbortError$1(error)) throw new JmapApiError("JMAP request timed out.", void 0, void 0, void 0, void 0, attempt + 1);
 					throw new JmapApiError(lastError.message, void 0, void 0, void 0, void 0, attempt + 1);
@@ -237,6 +177,377 @@ function isAbortError$1(error) {
 	return error instanceof Error && error.name === "AbortError";
 }
 
+//#endregion
+//#region src/raw-upload.ts
+/** Runs a raw operation with a progress-resettable deadline through response parsing. @internal */
+async function rawOperation(timeout, operation, signal) {
+	const controller = new AbortController();
+	const combined = combineSignals(controller.signal, signal);
+	let timer;
+	let finished = false;
+	const progress = () => {
+		if (finished) return;
+		clearTimeout(timer);
+		timer = setTimeout(() => controller.abort(new JmapApiError("Raw JMAP operation timed out.")), timeout);
+	};
+	let abort;
+	try {
+		combined.signal.throwIfAborted();
+		progress();
+		return await new Promise((resolve, reject) => {
+			abort = () => reject(combined.signal.reason);
+			combined.signal.addEventListener("abort", abort, { once: true });
+			Promise.resolve().then(() => {
+				combined.signal.throwIfAborted();
+				return operation(combined.signal, progress);
+			}).then(resolve, reject);
+			if (combined.signal.aborted) abort();
+		});
+	} finally {
+		finished = true;
+		clearTimeout(timer);
+		if (abort) combined.signal.removeEventListener("abort", abort);
+		controller.abort();
+		combined.cleanup();
+	}
+}
+/** @internal */
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** Streams validated MIME bytes without relying on fetch to cancel its body. @internal */
+async function uploadRawMessage(config, uploadUrl, accountId, plan, signal) {
+	return await rawOperation(config.timeout, async (outerSignal, progress) => {
+		const analysis = plan.encoding === void 0 ? await analyzeRawMessage(plan, outerSignal, progress) : {
+			encoding: plan.encoding,
+			size: plan.size
+		};
+		outerSignal.throwIfAborted();
+		const controller = new AbortController();
+		const combined = combineSignals(controller.signal, outerSignal);
+		const owned = combined.signal;
+		const iterator = iterateRawMessage(plan, {
+			signal: owned,
+			encoding: analysis.encoding,
+			expectedSize: analysis.size,
+			onProgress: progress
+		})[Symbol.asyncIterator]();
+		let closed = false;
+		let eof = false;
+		let size = 0;
+		let sourceError;
+		let hasSourceError = false;
+		let bodyController;
+		const close = (reason) => {
+			if (closed) return;
+			closed = true;
+			controller.abort(reason);
+			if (!eof) try {
+				Promise.resolve(iterator.return?.()).catch(() => {});
+			} catch {}
+		};
+		const abort = () => {
+			try {
+				bodyController?.error(owned.reason);
+			} catch {}
+			close(owned.reason);
+		};
+		const body = new ReadableStream({
+			start(stream) {
+				bodyController = stream;
+				owned.addEventListener("abort", abort, { once: true });
+				if (owned.aborted) abort();
+			},
+			async pull(stream) {
+				try {
+					owned.throwIfAborted();
+					const item = await iterator.next();
+					owned.throwIfAborted();
+					if (item.done) {
+						eof = true;
+						progress();
+						stream.close();
+					} else {
+						size += item.value.length;
+						stream.enqueue(new Uint8Array(item.value));
+					}
+				} catch (error) {
+					if (!owned.aborted && !hasSourceError) {
+						hasSourceError = true;
+						sourceError = error;
+					}
+					try {
+						stream.error(error);
+					} catch {}
+					close(error);
+				}
+			},
+			cancel: close
+		}, { highWaterMark: 0 });
+		const headers = new Headers(config.headers);
+		if (!headers.has("Authorization")) {
+			if (config.bearerToken) headers.set("Authorization", `Bearer ${config.bearerToken}`);
+			else if (config.basicAuth) headers.set("Authorization", `Basic ${btoa(`${config.basicAuth.username}:${config.basicAuth.password}`)}`);
+		}
+		headers.set("Content-Type", "message/rfc822");
+		const request = {
+			method: "POST",
+			headers,
+			body,
+			duplex: "half",
+			redirect: "error",
+			signal: owned
+		};
+		try {
+			const response = await fetch(uploadUrl.replace("{accountId}", encodeURIComponent(accountId)), request);
+			owned.throwIfAborted();
+			if (!eof) throw new JmapApiError("Raw upload responded before validated EOF.");
+			if (!response.ok) throw new JmapApiError(`Raw upload failed: ${response.status}`, response.status, await response.text());
+			const result = await response.json();
+			owned.throwIfAborted();
+			if (!isRecord(result) || result.accountId !== accountId || typeof result.blobId !== "string" || !result.blobId || result.size !== size) throw new JmapApiError("Invalid raw upload response.");
+			return {
+				accountId,
+				blobId: result.blobId,
+				size,
+				type: typeof result.type === "string" ? result.type : "message/rfc822"
+			};
+		} catch (error) {
+			outerSignal.throwIfAborted();
+			if (hasSourceError) throw sourceError;
+			owned.throwIfAborted();
+			throw error;
+		} finally {
+			owned.removeEventListener("abort", abort);
+			close();
+			combined.cleanup();
+		}
+	}, signal);
+}
+
+//#endregion
+//#region src/raw-delivery.ts
+const using = [
+	"urn:ietf:params:jmap:core",
+	"urn:ietf:params:jmap:mail",
+	"urn:ietf:params:jmap:submission"
+];
+function failure(message, stage, retryable, unknown = false) {
+	return createFailedReceipt(message, {
+		provider: "jmap",
+		code: `jmap.raw_${stage}_${unknown ? "unknown" : "failed"}`,
+		category: unknown ? "unknown" : retryable ? void 0 : "rejected",
+		retryable,
+		attempts: 1
+	});
+}
+function methodResult(response, name, id, accountId) {
+	if (!isRecord(response) || !Array.isArray(response.methodResponses)) throw new JmapApiError("Invalid raw JMAP method response.");
+	const matches = response.methodResponses.filter((entry) => Array.isArray(entry) && entry[2] === id);
+	if (matches.length !== 1) throw new JmapApiError("Missing or contradictory raw JMAP method response.");
+	const result = matches[0];
+	if (!Array.isArray(result) || result.length !== 3 || !isRecord(result[1]) || result[0] !== name && result[0] !== "error") throw new JmapApiError("Invalid raw JMAP method result.");
+	if (result[0] === "error") {
+		if (typeof result[1].type !== "string" || !result[1].type) throw new JmapApiError("Invalid raw JMAP method error.");
+	} else if (result[1].accountId !== accountId) throw new JmapApiError("Wrong account in raw JMAP response.");
+	return {
+		name: result[0],
+		args: result[1]
+	};
+}
+function creation(args) {
+	const created = isRecord(args.created) ? args.created.raw : void 0;
+	const rejected = isRecord(args.notCreated) ? args.notCreated.raw : void 0;
+	if (created !== void 0 && rejected !== void 0) throw new JmapApiError("Contradictory raw JMAP creation result.");
+	if (isRecord(created) && typeof created.id === "string" && created.id) return { created };
+	if (isRecord(rejected) && typeof rejected.type === "string" && rejected.type) return { rejected };
+	throw new JmapApiError("Missing raw JMAP creation result.");
+}
+function errorDescription(error) {
+	return `Raw JMAP operation rejected: ${String(error.type)}${typeof error.description === "string" ? `: ${error.description}` : ""}`;
+}
+function isRequestRejection(error) {
+	if (!(error instanceof JmapApiError) || !error.responseBody || error.statusCode === void 0 || error.statusCode < 400 || error.statusCode > 599) return false;
+	try {
+		const body = JSON.parse(error.responseBody);
+		if (!isRecord(body) || body.status !== void 0 && body.status !== error.statusCode) return false;
+		if (body.type === JMAP_ERROR_TYPES.limit) return typeof body.limit === "string" && body.limit.length > 0;
+		return body.type === JMAP_ERROR_TYPES.notJSON || body.type === JMAP_ERROR_TYPES.notRequest || body.type === JMAP_ERROR_TYPES.unknownCapability;
+	} catch {
+		return false;
+	}
+}
+/** Uploads, imports, then submits exactly once; uncertain submission must not be retried. @internal */
+async function deliverRawMessage(config, session, accountId, draftsMailboxId, identityId, plan, signal) {
+	const client = new JmapHttpClient({
+		...config,
+		retries: 0
+	}, false);
+	const execute = (request) => rawOperation(config.timeout, (owned) => client.executeRequest(session.apiUrl, request, owned), signal);
+	let stage = "upload";
+	try {
+		const uploaded = await uploadRawMessage(config, session.uploadUrl, accountId, plan, signal);
+		signal?.throwIfAborted();
+		stage = "import";
+		const imported = methodResult(await execute({
+			using,
+			methodCalls: [[
+				"Email/import",
+				{
+					accountId,
+					emails: { raw: {
+						blobId: uploaded.blobId,
+						mailboxIds: { [draftsMailboxId]: true }
+					} }
+				},
+				"raw-import"
+			]]
+		}), "Email/import", "raw-import", accountId);
+		if (imported.name === "error") return failure(errorDescription(imported.args), "import", imported.args.type === "serverPartialFail");
+		const { created, rejected } = creation(imported.args);
+		let emailId;
+		if (created && typeof created.id === "string") emailId = created.id;
+		else if (rejected?.type === "alreadyExists" && typeof rejected.existingId === "string" && rejected.existingId) {
+			const existing = methodResult(await execute({
+				using,
+				methodCalls: [[
+					"Email/get",
+					{
+						accountId,
+						ids: [rejected.existingId],
+						properties: ["id", "blobId"]
+					},
+					"raw-existing"
+				]]
+			}), "Email/get", "raw-existing", accountId);
+			const list = existing.args.list;
+			if (existing.name === "error" || !Array.isArray(list) || list.length !== 1 || !isRecord(list[0]) || list[0].id !== rejected.existingId || list[0].blobId !== uploaded.blobId) return failure("Existing Email does not match the uploaded raw blob.", "import", false);
+			emailId = rejected.existingId;
+		} else return failure(errorDescription(rejected ?? { type: "invalidResult" }), "import", false);
+		signal?.throwIfAborted();
+		stage = "submission";
+		const submitted = methodResult(await execute({
+			using,
+			methodCalls: [[
+				"EmailSubmission/set",
+				{
+					accountId,
+					create: { raw: {
+						emailId,
+						identityId,
+						envelope: {
+							mailFrom: { email: plan.envelope.from ?? "" },
+							rcptTo: plan.envelope.to.map((email) => ({ email }))
+						}
+					} }
+				},
+				"raw-submit"
+			]]
+		}), "EmailSubmission/set", "raw-submit", accountId);
+		if (submitted.name === "error") return failure(errorDescription(submitted.args), "submission", false, submitted.args.type === "serverPartialFail");
+		const result = creation(submitted.args);
+		if (result.rejected) return failure(errorDescription(result.rejected), "submission", false);
+		if (!result.created || typeof result.created.id !== "string") throw new JmapApiError("Missing raw submission ID.");
+		signal?.throwIfAborted();
+		return {
+			successful: true,
+			provider: "jmap",
+			messageId: result.created.id
+		};
+	} catch (error) {
+		signal?.throwIfAborted();
+		const message = error instanceof Error ? error.message : String(error);
+		if (error instanceof RawMessageValidationError) return createFailedReceipt(message, {
+			provider: "jmap",
+			code: "jmap.raw_message_invalid",
+			category: "validation",
+			retryable: false,
+			attempts: 1
+		});
+		const definite = isRequestRejection(error);
+		return failure(message, stage, stage !== "submission" && !definite, stage === "submission" && !definite);
+	}
+}
+/** Validates raw discovery responses before accepting delivery identifiers. @internal */
+function rawDiscoveryResult(response, method, accountId) {
+	const result = methodResult(response, method, "c0", accountId);
+	if (result.name === "error") throw new JmapApiError(errorDescription(result.args));
+	return result.args;
+}
+
+//#endregion
+//#region src/blob-uploader.ts
+/**
+* Upload a blob to the JMAP server.
+*
+* @param config - The resolved JMAP configuration
+* @param uploadUrl - The upload URL template from the session (e.g., "https://server/upload/{accountId}")
+* @param accountId - The account ID to upload to
+* @param blob - The blob or file to upload
+* @param signal - Optional abort signal
+* @returns The upload response containing the blobId
+*/
+async function uploadBlob(config, uploadUrl, accountId, blob, signal) {
+	signal?.throwIfAborted();
+	const url = uploadUrl.replace("{accountId}", accountId);
+	let authHeader;
+	if (config.bearerToken) authHeader = `Bearer ${config.bearerToken}`;
+	else if (config.basicAuth) {
+		const credentials = btoa(`${config.basicAuth.username}:${config.basicAuth.password}`);
+		authHeader = `Basic ${credentials}`;
+	} else throw new Error("No authentication method configured");
+	const headers = {
+		Authorization: authHeader,
+		"Content-Type": blob.type || "application/octet-stream"
+	};
+	for (const [key, value] of Object.entries(config.headers)) headers[key] = value;
+	const controller = new AbortController();
+	const timeoutId = setTimeout(() => controller.abort(), config.timeout);
+	const combinedSignal = combineSignals(controller.signal, signal);
+	try {
+		const response = await fetch(url, {
+			method: "POST",
+			headers,
+			body: blob,
+			signal: combinedSignal.signal
+		});
+		if (!response.ok) {
+			const body = await response.text();
+			throw new JmapApiError(`Blob upload failed: ${response.status} ${response.statusText}`, response.status, body);
+		}
+		const result = await response.json();
+		return result;
+	} finally {
+		combinedSignal.cleanup();
+		clearTimeout(timeoutId);
+	}
+}
+
+//#endregion
+//#region src/config.ts
+/**
+* Creates a resolved JMAP configuration with default values applied.
+* @param config The user-provided configuration.
+* @returns The resolved configuration with all fields populated.
+* @throws Error if neither bearerToken nor basicAuth is provided.
+* @since 0.4.0
+*/
+function createJmapConfig(config) {
+	if (!config.bearerToken && !config.basicAuth) throw new Error("Either bearerToken or basicAuth must be provided");
+	return {
+		sessionUrl: config.sessionUrl,
+		bearerToken: config.bearerToken ?? null,
+		basicAuth: config.basicAuth ?? null,
+		accountId: config.accountId ?? null,
+		identityId: config.identityId ?? null,
+		timeout: config.timeout ?? 3e4,
+		retries: config.retries ?? 3,
+		headers: config.headers ?? {},
+		sessionCacheTtl: config.sessionCacheTtl ?? 3e5,
+		baseUrl: config.baseUrl ?? null
+	};
+}
+
 //#endregion
 //#region src/message-converter.ts
 /**
@@ -649,6 +960,45 @@ var JmapTransport = class {
 		}
 	}
 	/**
+	* Uploads serialized MIME, imports it, and submits it with an explicit envelope.
+	* JMAP servers may modify imported or submitted messages, including removing
+	* Bcc. Import and submission are never retried automatically.
+	* @param message Original MIME and delivery envelope.
+	* @param options Optional cancellation signal.
+	* @returns A receipt; uncertain submission outcomes are non-retryable.
+	* @throws {Error} If cancellation is requested.
+	* @since 0.6.0
+	*/
+	async sendRaw(message, options) {
+		if (message?.content instanceof Promise) message.content.catch(() => {});
+		const signal = options?.signal;
+		signal?.throwIfAborted();
+		try {
+			const plan = createRawMessagePlan(message);
+			const session = await rawOperation(this.config.timeout, (owned) => this.getSession(owned), signal);
+			const capable = (id) => {
+				const account = session.accounts[id];
+				return account != null && !account.isReadOnly && JMAP_CAPABILITIES.mail in account.accountCapabilities && JMAP_CAPABILITIES.submission in account.accountCapabilities;
+			};
+			const accountId = this.config.accountId ?? Object.keys(session.accounts).find(capable);
+			if (accountId == null || !capable(accountId) || !Object.values(JMAP_CAPABILITIES).every((capability) => capability in session.capabilities)) return createJmapFailure("No writable mail and submission account found.", void 0, {
+				category: "configuration",
+				code: "jmap.no_mail_account",
+				retryable: false
+			});
+			const drafts = await rawOperation(this.config.timeout, (owned) => this.getDraftsMailboxId(session, accountId, owned, true), signal);
+			const identity = await rawOperation(this.config.timeout, (owned) => this.getIdentityId(session, accountId, plan.envelope.from ?? "", owned, true), signal);
+			return await deliverRawMessage(this.config, session, accountId, drafts, identity, plan, signal);
+		} catch (error) {
+			signal?.throwIfAborted();
+			return createJmapFailure(error instanceof Error ? error.message : String(error), error, error instanceof RawMessageValidationError ? {
+				category: "validation",
+				code: "jmap.raw_message_invalid",
+				retryable: false
+			} : void 0);
+		}
+	}
+	/**
 	* Sends multiple messages in a single batched JMAP request.
 	* @param messages The messages to send.
 	* @param options Optional transport options.
@@ -795,7 +1145,7 @@ var JmapTransport = class {
 	* @returns The drafts mailbox ID.
 	* @since 0.4.0
 	*/
-	async getDraftsMailboxId(session, accountId, signal) {
+	async getDraftsMailboxId(session, accountId, signal, strict = false) {
 		const response = await this.httpClient.executeRequest(session.apiUrl, {
 			using: [JMAP_CAPABILITIES.core, JMAP_CAPABILITIES.mail],
 			methodCalls: [[
@@ -811,10 +1161,11 @@ var JmapTransport = class {
 				"c0"
 			]]
 		}, signal);
-		const mailboxResponse = response.methodResponses.find((r) => r[0] === "Mailbox/get");
+		const mailboxResponse = strict ? rawDiscoveryResult(response, "Mailbox/get", accountId) : response.methodResponses.find((r) => r[0] === "Mailbox/get")?.[1];
 		if (!mailboxResponse) throw new JmapApiError("No Mailbox/get response received");
-		const mailboxes = mailboxResponse[1].list;
+		const mailboxes = mailboxResponse.list;
 		if (!mailboxes) throw new JmapApiError("No mailboxes found");
+		if (strict && (!Array.isArray(mailboxes) || !mailboxes.every((mailbox) => isRecord(mailbox) && typeof mailbox.id === "string" && mailbox.id.length > 0))) throw new JmapApiError("Invalid mailbox identifiers in raw discovery.");
 		const drafts = mailboxes.find((m) => m.role === "drafts");
 		if (!drafts) throw new JmapApiError("No drafts mailbox found");
 		return drafts.id;
@@ -828,9 +1179,9 @@ var JmapTransport = class {
 	* @returns The identity ID.
 	* @since 0.4.0
 	*/
-	async getIdentityId(session, accountId, senderEmail, signal) {
+	async getIdentityId(session, accountId, senderEmail, signal, strict = false) {
 		if (this.config.identityId) return this.config.identityId;
-		const identityMap = await this.getIdentityMap(session, accountId, signal);
+		const identityMap = await this.getIdentityMap(session, accountId, signal, strict);
 		const matching = identityMap.get(senderEmail.toLowerCase());
 		if (matching) return matching;
 		return identityMap.values().next().value;
@@ -843,7 +1194,7 @@ var JmapTransport = class {
 	* @returns Map of lowercase email to identity ID.
 	* @since 0.4.0
 	*/
-	async getIdentityMap(session, accountId, signal) {
+	async getIdentityMap(session, accountId, signal, strict = false) {
 		if (this.config.identityId) return new Map([["*", this.config.identityId]]);
 		const response = await this.httpClient.executeRequest(session.apiUrl, {
 			using: [JMAP_CAPABILITIES.core, JMAP_CAPABILITIES.submission],
@@ -853,10 +1204,11 @@ var JmapTransport = class {
 				"c0"
 			]]
 		}, signal);
-		const identityResponse = response.methodResponses.find((r) => r[0] === "Identity/get");
+		const identityResponse = strict ? rawDiscoveryResult(response, "Identity/get", accountId) : response.methodResponses.find((r) => r[0] === "Identity/get")?.[1];
 		if (!identityResponse) throw new JmapApiError("No Identity/get response received");
-		const identities = identityResponse[1].list;
+		const identities = identityResponse.list;
 		if (!identities || identities.length === 0) throw new JmapApiError("No identities found");
+		if (strict && (!Array.isArray(identities) || !identities.every((identity) => isRecord(identity) && typeof identity.id === "string" && identity.id.length > 0 && typeof identity.email === "string"))) throw new JmapApiError("Invalid identity identifiers in raw discovery.");
 		const identityMap = /* @__PURE__ */ new Map();
 		for (const identity of identities) identityMap.set(identity.email.toLowerCase(), identity.id);
 		return identityMap;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@upyo/jmap",
-  "version": "0.6.0-dev.349",
+  "version": "0.6.0-dev.351",
   "description": "JMAP transport for Upyo email library",
   "keywords": [
     "email",
@@ -53,7 +53,7 @@
   },
   "sideEffects": false,
   "peerDependencies": {
-    "@upyo/core": "0.6.0-dev.349+537f6b67"
+    "@upyo/core": "0.6.0-dev.351+b257f1a6"
   },
   "devDependencies": {
     "jmap-rfc-types": "^0.1.2",