proton-mail-bridge-client 2.0.1 → 2.0.3

package/dist/index.js

@@ -16,7 +16,7 @@ import { BackgroundSyncService } from "./services/background-sync-service.js";
 import { DeliveryQueueService } from "./services/delivery-queue-service.js";
 import { DraftStoreService } from "./services/draft-store-service.js";
 import { LocalIndexService } from "./services/local-index-service.js";
-import { BULK_ITEM_TIMEOUT_MS, describeImapError, isLikelyAuthenticationError, isLikelyConnectionError, isLikelyTlsMismatchError, SimpleIMAPService } from "./services/simple-imap-service.js";
+import { BULK_ITEM_TIMEOUT_MS, describeImapError, isLikelyAuthenticationError, isLikelyConnectionError, isLikelyTlsMismatchError, SimpleIMAPService, UID_VALIDITY_MISMATCH_ERROR } from "./services/simple-imap-service.js";
 import { applySignature, SMTPService } from "./services/smtp-service.js";
 import { SnoozeService } from "./services/snooze-service.js";
 import { TemplateService } from "./services/template-service.js";
@@ -135,13 +135,14 @@ const TOOLS = [
     },
     {
         name: "send_test_email",
-        description: "Send a minimal diagnostic email to confirm Proton Bridge SMTP credentials and connectivity. Use before relying on send_email in a new environment. Prefer get_connection_status for a connectivity check that does not actually send mail. Returns transport debug info and delivery status.",
+        description: "Send a minimal diagnostic email to confirm Proton Bridge SMTP credentials and connectivity. Use before relying on send_email in a new environment. Prefer get_connection_status for a connectivity check that does not actually send mail. Returns transport debug info and delivery status. Requires PROTONMAIL_ALLOW_SEND, and confirmed:true when PROTONMAIL_CONFIRM_DESTRUCTIVE is enabled; subject to PROTONMAIL_RESTRICT_OUTBOUND_TO_SELF like every other send path.",
         annotations: { destructiveHint: true },
         inputSchema: {
             type: "object",
             properties: {
                 to: { type: "string", description: "Recipient email address." },
                 customMessage: { type: "string", description: "Optional custom test body." },
+                confirmed: { type: "boolean", description: "Set to true to confirm this send when PROTONMAIL_CONFIRM_DESTRUCTIVE is enabled." },
             },
             required: ["to"],
         },
@@ -2369,27 +2370,32 @@ async function getAnalyticsSampleFromIndex(imapService, localIndexService, days,
     return result.emails;
 }
 async function runEmailAction(imapService, emailId, action, targetFolder) {
+    // undefined for an old-format id (no embedded UIDVALIDITY) — every method
+    // below's own assertMailboxUidValidity guard already treats that as
+    // "unverifiable, don't block on it", same as every direct single-message
+    // tool handler.
+    const uidValidity = parseEmailId(emailId).uidValidity;
     switch (action) {
         case "mark_read":
-            return imapService.markEmailRead(emailId, true);
+            return imapService.markEmailRead(emailId, true, uidValidity);
         case "mark_unread":
-            return imapService.markEmailRead(emailId, false);
+            return imapService.markEmailRead(emailId, false, uidValidity);
         case "star":
-            return imapService.starEmail(emailId, true);
+            return imapService.starEmail(emailId, true, uidValidity);
         case "unstar":
-            return imapService.starEmail(emailId, false);
+            return imapService.starEmail(emailId, false, uidValidity);
         case "archive":
-            return imapService.archiveEmail(emailId);
+            return imapService.archiveEmail(emailId, uidValidity);
         case "trash":
-            return imapService.trashEmail(emailId);
+            return imapService.trashEmail(emailId, uidValidity);
         case "restore":
-            return imapService.restoreEmail(emailId, targetFolder);
+            return imapService.restoreEmail(emailId, targetFolder, uidValidity);
         case "move":
             if (!targetFolder)
                 throw new McpError(ErrorCode.InvalidParams, "targetFolder is required for action 'move'.");
-            return imapService.moveEmail(emailId, targetFolder);
+            return imapService.moveEmail(emailId, targetFolder, uidValidity);
         case "delete":
-            return imapService.deleteEmail(emailId);
+            return imapService.deleteEmail(emailId, uidValidity);
     }
 }
 function emailSourceFromActionResult(result) {
@@ -2500,11 +2506,19 @@ function ensureBulkBatchSize(uidsLength, max) {
         throw new McpError(ErrorCode.InvalidParams, "Batch size " + uidsLength + " exceeds limit " + max + ". Use match criteria to narrow the scope, or increase maxBatchSize.");
     }
 }
-function getBulkNotFoundEmailIds(emailIds, folder) {
+// `currentUidValidity` is optional and, when omitted, preserves the exact
+// original behavior (folder/format check only) — every caller that already
+// knows the folder's current UIDVALIDITY (the bulk_delete/bulk_update_flags/
+// bulk_update_labels handlers below, via a single shared getMailboxUidValidity
+// call reused for both this and resolveUidsForBulkOp) should pass it, so a
+// stale-generation id gets its own clear error instead of being lumped in
+// with a genuinely malformed one.
+function getBulkNotFoundEmailIds(emailIds, folder, currentUidValidity) {
     if (!emailIds) {
         return [];
     }
-    return emailIds.filter((emailId) => {
+    const excluded = [];
+    for (const emailId of emailIds) {
         // Found live: this compared the emailId's folder segment against
         // `folder` as raw, still-percent-encoded text — createEmailId encodes
         // it (Folders/MCP-Snoozed -> Folders%2FMCP-Snoozed) but `folder` here
@@ -2515,30 +2529,50 @@ function getBulkNotFoundEmailIds(emailIds, folder) {
         // reported genuinely valid ids as notFound. parseEmailId already does
         // the matching decodeURIComponent correctly — reuse it instead of
         // hand-rolling the same parse a second, inconsistent way.
+        let parsed;
         try {
-            const parsed = parseEmailId(emailId);
-            return parsed.folder !== folder;
+            parsed = parseEmailId(emailId);
         }
         catch {
-            return true;
+            excluded.push({ emailId, error: "Email ID could not be resolved to a UID." });
+            continue;
         }
-    });
+        if (parsed.folder !== folder) {
+            excluded.push({ emailId, error: "Email ID could not be resolved to a UID." });
+            continue;
+        }
+        // An id with no embedded uidValidity (pre-this-fix format) is
+        // unverifiable, not stale — same "can't check it, so don't block on
+        // it" stance assertMailboxUidValidity already takes for the
+        // single-message mutation path. Only a *checkable* mismatch is
+        // treated as a stale reference. resolveUidsForBulkOp applies this
+        // exact same exclusion (see its own comment) against the exact same
+        // currentUidValidity value, so the uid this method silently drops from
+        // execution and the id this method reports as excluded here always
+        // agree.
+        if (currentUidValidity !== undefined &&
+            parsed.uidValidity !== undefined &&
+            parsed.uidValidity !== currentUidValidity) {
+            excluded.push({ emailId, error: UID_VALIDITY_MISMATCH_ERROR });
+        }
+    }
+    return excluded;
 }
-function withBulkNotFound(result, notFoundEmailIds) {
-    if (notFoundEmailIds.length === 0) {
+function withBulkNotFound(result, excludedEmailIds) {
+    if (excludedEmailIds.length === 0) {
         return result;
     }
     return {
         ...result,
-        total: result.total + notFoundEmailIds.length,
-        notFound: result.notFound + notFoundEmailIds.length,
+        total: result.total + excludedEmailIds.length,
+        notFound: result.notFound + excludedEmailIds.length,
         results: [
             ...result.results,
-            ...notFoundEmailIds.map((emailId) => ({
+            ...excludedEmailIds.map(({ emailId, error }) => ({
                 uid: 0,
                 emailId,
                 ok: false,
-                error: "Email ID could not be resolved to a UID.",
+                error,
             })),
         ],
     };
@@ -2776,6 +2810,9 @@ export function createServer(config, options = {}) {
     const draftStore = new DraftStoreService(config, logger);
     const backgroundSyncService = new BackgroundSyncService(config, imapService, localIndexService, logger);
     const deliveryQueueService = new DeliveryQueueService(config, smtpService, logger);
+    // Lets a fired scheduled_send close the loop back to its source draft —
+    // see DeliveryQueueService.checkDue()'s draftStore usage.
+    deliveryQueueService.setDraftStore(draftStore);
     const snoozeService = new SnoozeService(config, imapService, logger);
     const templateService = new TemplateService(config, logger);
     if (options.startBackgroundSync) {
@@ -3075,11 +3112,13 @@ export function createServer(config, options = {}) {
                     });
                 }
                 case "send_test_email": {
-                    ensureSendAllowed(config.runtime);
                     const to = requireString(args, "to");
                     if (!isValidEmail(to)) {
                         throw new McpError(ErrorCode.InvalidParams, "to must be a valid email address.");
                     }
+                    ensureDestructiveConfirmed(config.runtime, normalizeBoolean(args.confirmed, false), `Send test email to ${to}`);
+                    ensureSendAllowed(config.runtime);
+                    ensureOutboundRecipientsAllowed(config.runtime, config.smtp.username, [to]);
                     const result = await withAudit(auditService, name, args, async () => smtpService.sendTestEmail(to, optionalString(args, "customMessage")));
                     return createTextResult({
                         messageId: result.messageId,
@@ -3676,24 +3715,78 @@ export function createServer(config, options = {}) {
                             note: "No email was sent.",
                         }, false, [draftSource(draft)]);
                     }
-                    const result = await withAudit(auditService, name, args, async () => smtpService.sendEmail({
-                        to: draft.to,
-                        cc: draft.cc,
-                        bcc: draft.bcc,
-                        subject: draft.subject,
-                        body: draft.body,
-                        isHtml: draft.isHtml,
-                        priority: draft.priority,
-                        replyTo: draft.replyTo,
-                        inReplyTo: draft.inReplyTo,
-                        references: draft.references,
-                        attachments: draft.attachments,
-                        // Draft content is already finalized and reviewed — appending a
-                        // signature invisibly at send time would change what the user
-                        // saw and approved. If a signature is wanted, it belongs in the
-                        // draft body itself.
-                        appendSignature: false,
-                    }));
+                    // Atomic claim: the status/pending-scheduled checks above are read
+                    // then acted on non-atomically, so two concurrent send_draft calls
+                    // (or a scheduled send firing at the same instant) could both pass
+                    // them. claimForSending() re-reads status under the draft store's
+                    // lock and flips "draft" -> "sending" in that same critical
+                    // section — only the call that wins the claim proceeds to SMTP.
+                    await draftStore.claimForSending(draft.id);
+                    // Found live: withAudit wrapped the SMTP call, so an audit-log
+                    // write failure AFTER a successful send (e.g. disk full) was
+                    // indistinguishable from a send failure — it threw out of
+                    // withAudit, and the catch below reverted an already-sent draft
+                    // back to "draft", making it resendable and enabling a genuine
+                    // duplicate delivery. SMTP is called directly here so its outcome
+                    // (and the revert-on-failure below) can't be corrupted by a
+                    // separate audit-write failure — the audit record for the success
+                    // case is written afterward, on its own, with a failure there only
+                    // logged, never reverting a send that already happened.
+                    const sendStartedAt = Date.now();
+                    let result;
+                    try {
+                        result = await smtpService.sendEmail({
+                            to: draft.to,
+                            cc: draft.cc,
+                            bcc: draft.bcc,
+                            subject: draft.subject,
+                            body: draft.body,
+                            isHtml: draft.isHtml,
+                            priority: draft.priority,
+                            replyTo: draft.replyTo,
+                            inReplyTo: draft.inReplyTo,
+                            references: draft.references,
+                            attachments: draft.attachments,
+                            // Draft content is already finalized and reviewed — appending a
+                            // signature invisibly at send time would change what the user
+                            // saw and approved. If a signature is wanted, it belongs in the
+                            // draft body itself.
+                            appendSignature: false,
+                        });
+                    }
+                    catch (error) {
+                        // Mirrors SnoozeService.wake()'s catch handler: revert the claim
+                        // so the draft is retryable instead of stuck in "sending"
+                        // forever because SMTP failed.
+                        await draftStore.revertSending(draft.id);
+                        await auditService
+                            .record({
+                            timestamp: new Date().toISOString(),
+                            tool: name,
+                            status: "error",
+                            durationMs: Date.now() - sendStartedAt,
+                            input: sanitizeAuditValue(args),
+                            error: error instanceof Error ? error.message : String(error),
+                        })
+                            .catch((auditError) => logger.error("Failed to record audit log for a failed send_draft", "MCPServer", {
+                            draftId: draft.id,
+                            error: auditError,
+                        }));
+                        throw error;
+                    }
+                    try {
+                        await auditService.record({
+                            timestamp: new Date().toISOString(),
+                            tool: name,
+                            status: "success",
+                            durationMs: Date.now() - sendStartedAt,
+                            input: sanitizeAuditValue(args),
+                            result: sanitizeAuditValue(result),
+                        });
+                    }
+                    catch (auditError) {
+                        logger.error("Failed to record audit log for a successful send_draft — the email was already sent, so the draft is not being reverted", "MCPServer", { draftId: draft.id, error: auditError });
+                    }
                     let sentDraft = await draftStore.markSent(draft.id, {
                         messageId: result.messageId,
                         accepted: result.accepted,
@@ -3938,7 +4031,12 @@ export function createServer(config, options = {}) {
                     if (labelsToAdd.length === 0 && labelsToRemove.length === 0) {
                         throw new McpError(ErrorCode.InvalidParams, "Provide at least one label in labelsToAdd or labelsToRemove.");
                     }
-                    const result = await withAudit(auditService, name, args, async () => imapService.updateMessageLabels(emailId, labelsToAdd, labelsToRemove));
+                    // undefined for an old-format id (no embedded UIDVALIDITY) —
+                    // updateMessageLabels's own assertMailboxUidValidity guard already
+                    // treats that as "unverifiable, don't block on it", same as every
+                    // other mutation handler below.
+                    const uidValidity = parseEmailId(emailId).uidValidity;
+                    const result = await withAudit(auditService, name, args, async () => imapService.updateMessageLabels(emailId, labelsToAdd, labelsToRemove, uidValidity));
                     return createTextResult(result, false, [emailSource({ id: emailId })]);
                 }
                 case "update_message_flags": {
@@ -3953,7 +4051,8 @@ export function createServer(config, options = {}) {
                     if (flagsToAdd.length === 0 && flagsToRemove.length === 0) {
                         throw new McpError(ErrorCode.InvalidParams, "Provide at least one flag in flagsToAdd or flagsToRemove.");
                     }
-                    const result = await withAudit(auditService, name, args, async () => imapService.updateMessageFlags(emailId, flagsToAdd, flagsToRemove));
+                    const uidValidity = parseEmailId(emailId).uidValidity;
+                    const result = await withAudit(auditService, name, args, async () => imapService.updateMessageFlags(emailId, flagsToAdd, flagsToRemove, uidValidity));
                     return createTextResult(result, false, [emailSource({ id: emailId })]);
                 }
                 case "count_messages": {
@@ -4016,7 +4115,12 @@ export function createServer(config, options = {}) {
                     const folder = optionalString(args, "folder") ?? "INBOX";
                     const targetFolder = requireString(args, "targetFolder");
                     const max = getBulkMaxBatchSize(args);
-                    const notFoundEmailIds = getBulkNotFoundEmailIds(emailIds, folder);
+                    // Only fetched (an extra STATUS round trip) when there are ids to
+                    // check against it — a match-only bulk_move has no ids that could
+                    // be stale, since match resolves directly against the live
+                    // mailbox each time.
+                    const currentUidValidity = emailIds ? await imapService.getMailboxUidValidity(folder) : undefined;
+                    const notFoundEmailIds = getBulkNotFoundEmailIds(emailIds, folder, currentUidValidity);
                     const preview = await imapService.bulkMove({
                         emailIds,
                         match,
@@ -4054,16 +4158,32 @@ export function createServer(config, options = {}) {
                         throw new McpError(ErrorCode.InvalidParams, "Provide emailIds OR match, not both.");
                     const folder = optionalString(args, "folder") ?? "INBOX";
                     const max = getBulkMaxBatchSize(args);
-                    const notFoundEmailIds = getBulkNotFoundEmailIds(emailIds, folder);
-                    const preview = await imapService.bulkDelete({
-                        emailIds,
-                        match,
-                        folder,
-                        permanent,
-                        dryRun: true,
-                    });
-                    ensureBulkBatchSize(preview.total, max);
+                    // Fetched once, up front, and reused for both the notFound
+                    // reporting below and resolveUidsForBulkOp's own filtering — a
+                    // single shared point-in-time value, same "resolve once" spirit
+                    // as the uids resolution itself, so the ids this call reports as
+                    // excluded and the uids it actually acts on can never disagree
+                    // about which generation was current. Only fetched when there are
+                    // ids to check against it (a match-only call has none).
+                    const currentUidValidity = emailIds ? await imapService.getMailboxUidValidity(folder) : undefined;
+                    const notFoundEmailIds = getBulkNotFoundEmailIds(emailIds, folder, currentUidValidity);
+                    // Resolve the match/emailIds set exactly once and reuse it for both
+                    // the preview and the real run — see resolveUidsForBulkOp's
+                    // comment for why re-resolving `match` a second time (the old
+                    // dry-run-then-real-run pattern) could silently exceed maxBatchSize.
+                    // Also excludes any id whose embedded UIDVALIDITY is stale — see
+                    // resolveUidsForBulkOp's comment.
+                    const uids = await imapService.resolveUidsForBulkOp(folder, emailIds, match, currentUidValidity);
+                    ensureBulkBatchSize(uids.length, max);
                     if (normalizeBoolean(args.dryRun, false)) {
+                        const preview = await imapService.bulkDelete({
+                            emailIds,
+                            match,
+                            folder,
+                            permanent,
+                            resolvedUids: uids,
+                            dryRun: true,
+                        });
                         return createTextResult(withBulkNotFound(preview, notFoundEmailIds));
                     }
                     const result = await withAudit(auditService, name, args, () => imapService.bulkDelete({
@@ -4071,6 +4191,7 @@ export function createServer(config, options = {}) {
                         match,
                         folder,
                         permanent,
+                        resolvedUids: uids,
                         dryRun: false,
                     }));
                     return createTextResult(withBulkNotFound(result, notFoundEmailIds));
@@ -4093,13 +4214,22 @@ export function createServer(config, options = {}) {
                         throw new McpError(ErrorCode.InvalidParams, "Provide flagsToAdd or flagsToRemove.");
                     const folder = optionalString(args, "folder") ?? "INBOX";
                     const max = getBulkMaxBatchSize(args);
-                    const notFoundEmailIds = getBulkNotFoundEmailIds(emailIds, folder);
-                    const preview = await imapService.bulkUpdateFlags({ emailIds, match, folder, flagsToAdd, flagsToRemove, dryRun: true });
-                    ensureBulkBatchSize(preview.total, max);
+                    // See the bulk_delete case above for why this is fetched once and
+                    // shared between notFound reporting and uid resolution.
+                    const currentUidValidity = emailIds ? await imapService.getMailboxUidValidity(folder) : undefined;
+                    const notFoundEmailIds = getBulkNotFoundEmailIds(emailIds, folder, currentUidValidity);
+                    // Resolve the match/emailIds set exactly once and reuse it for both
+                    // the preview and the real run — see resolveUidsForBulkOp's
+                    // comment for why re-resolving `match` a second time (the old
+                    // dry-run-then-real-run pattern) could silently exceed maxBatchSize.
+                    // Also excludes any id whose embedded UIDVALIDITY is stale.
+                    const uids = await imapService.resolveUidsForBulkOp(folder, emailIds, match, currentUidValidity);
+                    ensureBulkBatchSize(uids.length, max);
                     if (normalizeBoolean(args.dryRun, false)) {
+                        const preview = await imapService.bulkUpdateFlags({ emailIds, match, folder, flagsToAdd, flagsToRemove, resolvedUids: uids, dryRun: true });
                         return createTextResult(withBulkNotFound(preview, notFoundEmailIds));
                     }
-                    const result = await withAudit(auditService, name, args, () => imapService.bulkUpdateFlags({ emailIds, match, folder, flagsToAdd, flagsToRemove, dryRun: false }));
+                    const result = await withAudit(auditService, name, args, () => imapService.bulkUpdateFlags({ emailIds, match, folder, flagsToAdd, flagsToRemove, resolvedUids: uids, dryRun: false }));
                     return createTextResult(withBulkNotFound(result, notFoundEmailIds));
                 }
                 case "bulk_update_labels": {
@@ -4118,13 +4248,22 @@ export function createServer(config, options = {}) {
                     const labelsToRemove = Array.isArray(args.labelsToRemove) ? args.labelsToRemove.map(String) : [];
                     const folder = optionalString(args, "folder") ?? "INBOX";
                     const max = getBulkMaxBatchSize(args);
-                    const notFoundEmailIds = getBulkNotFoundEmailIds(emailIds, folder);
-                    const preview = await imapService.bulkUpdateLabels({ emailIds, match, folder, labelsToAdd, labelsToRemove, dryRun: true });
-                    ensureBulkBatchSize(preview.total, max);
+                    // See the bulk_delete case above for why this is fetched once and
+                    // shared between notFound reporting and uid resolution.
+                    const currentUidValidity = emailIds ? await imapService.getMailboxUidValidity(folder) : undefined;
+                    const notFoundEmailIds = getBulkNotFoundEmailIds(emailIds, folder, currentUidValidity);
+                    // Resolve the match/emailIds set exactly once and reuse it for both
+                    // the preview and the real run — see resolveUidsForBulkOp's
+                    // comment for why re-resolving `match` a second time (the old
+                    // dry-run-then-real-run pattern) could silently exceed maxBatchSize.
+                    // Also excludes any id whose embedded UIDVALIDITY is stale.
+                    const uids = await imapService.resolveUidsForBulkOp(folder, emailIds, match, currentUidValidity);
+                    ensureBulkBatchSize(uids.length, max);
                     if (normalizeBoolean(args.dryRun, false)) {
+                        const preview = await imapService.bulkUpdateLabels({ emailIds, match, folder, labelsToAdd, labelsToRemove, resolvedUids: uids, dryRun: true });
                         return createTextResult(withBulkNotFound(preview, notFoundEmailIds));
                     }
-                    const result = await withAudit(auditService, name, args, () => imapService.bulkUpdateLabels({ emailIds, match, folder, labelsToAdd, labelsToRemove, dryRun: false }));
+                    const result = await withAudit(auditService, name, args, () => imapService.bulkUpdateLabels({ emailIds, match, folder, labelsToAdd, labelsToRemove, resolvedUids: uids, dryRun: false }));
                     return createTextResult(withBulkNotFound(result, notFoundEmailIds));
                 }
                 case "top_senders": {
@@ -4222,20 +4361,27 @@ export function createServer(config, options = {}) {
                     ensureMailboxWriteAllowed(config.runtime);
                     ensureDestructiveConfirmed(config.runtime, normalizeBoolean(args?.confirmed, false), "Permanently delete folder and all messages in it: " + requireString(args, "path"));
                     return createTextResult(await withAudit(auditService, name, args, async () => imapService.deleteFolder(requireString(args, "path"))));
-                case "mark_email_read":
+                case "mark_email_read": {
                     ensureEmailActionAllowed(config.runtime, normalizeBoolean(args.isRead, true) ? "mark_read" : "mark_unread");
-                    return createTextResult(await withAudit(auditService, name, args, async () => imapService.markEmailRead(requireString(args, "emailId"), normalizeBoolean(args.isRead, true))));
-                case "star_email":
+                    const emailId = requireString(args, "emailId");
+                    const uidValidity = parseEmailId(emailId).uidValidity;
+                    return createTextResult(await withAudit(auditService, name, args, async () => imapService.markEmailRead(emailId, normalizeBoolean(args.isRead, true), uidValidity)));
+                }
+                case "star_email": {
                     ensureEmailActionAllowed(config.runtime, normalizeBoolean(args.isStarred, true) ? "star" : "unstar");
-                    return createTextResult(await withAudit(auditService, name, args, async () => imapService.starEmail(requireString(args, "emailId"), normalizeBoolean(args.isStarred, true))));
+                    const emailId = requireString(args, "emailId");
+                    const uidValidity = parseEmailId(emailId).uidValidity;
+                    return createTextResult(await withAudit(auditService, name, args, async () => imapService.starEmail(emailId, normalizeBoolean(args.isStarred, true), uidValidity)));
+                }
                 case "move_email":
                     {
                         ensureEmailActionAllowed(config.runtime, "move");
                         const emailId = requireString(args, "emailId");
                         const targetFolder = requireString(args, "targetFolder");
+                        const uidValidity = parseEmailId(emailId).uidValidity;
                         const result = await withAudit(auditService, name, args, async () => {
                             try {
-                                return await imapService.moveEmail(emailId, targetFolder);
+                                return await imapService.moveEmail(emailId, targetFolder, uidValidity);
                             }
                             catch (error) {
                                 if (isMissingTargetFolderError(error)) {
@@ -4260,7 +4406,9 @@ export function createServer(config, options = {}) {
                 case "archive_email":
                     {
                         ensureEmailActionAllowed(config.runtime, "archive");
-                        const result = await withAudit(auditService, name, args, async () => imapService.archiveEmail(requireString(args, "emailId")));
+                        const emailId = requireString(args, "emailId");
+                        const uidValidity = parseEmailId(emailId).uidValidity;
+                        const result = await withAudit(auditService, name, args, async () => imapService.archiveEmail(emailId, uidValidity));
                         const sources = result.targetEmailId
                             ? [
                                 {
@@ -4277,7 +4425,9 @@ export function createServer(config, options = {}) {
                 case "trash_email":
                     {
                         ensureEmailActionAllowed(config.runtime, "trash");
-                        const result = await withAudit(auditService, name, args, async () => imapService.trashEmail(requireString(args, "emailId")));
+                        const emailId = requireString(args, "emailId");
+                        const uidValidity = parseEmailId(emailId).uidValidity;
+                        const result = await withAudit(auditService, name, args, async () => imapService.trashEmail(emailId, uidValidity));
                         const sources = result.targetEmailId
                             ? [
                                 {
@@ -4294,7 +4444,9 @@ export function createServer(config, options = {}) {
                 case "restore_email":
                     {
                         ensureEmailActionAllowed(config.runtime, "restore");
-                        const result = await withAudit(auditService, name, args, async () => imapService.restoreEmail(requireString(args, "emailId"), optionalString(args, "targetFolder")));
+                        const emailId = requireString(args, "emailId");
+                        const uidValidity = parseEmailId(emailId).uidValidity;
+                        const result = await withAudit(auditService, name, args, async () => imapService.restoreEmail(emailId, optionalString(args, "targetFolder"), uidValidity));
                         const sources = result.targetEmailId
                             ? [
                                 {
@@ -4367,10 +4519,13 @@ export function createServer(config, options = {}) {
                     const result = await withAudit(auditService, name, args, async () => templateService.render(requireString(args, "id"), variables));
                     return createTextResult(result);
                 }
-                case "delete_email":
+                case "delete_email": {
                     ensureDestructiveConfirmed(config.runtime, normalizeBoolean(args.confirmed, false), `Permanently delete ${String(args.emailId ?? "?")} (cannot be recovered)`);
                     ensureMailboxWriteAllowed(config.runtime);
-                    return createTextResult(await withAudit(auditService, name, args, async () => imapService.deleteEmail(requireString(args, "emailId"))));
+                    const emailId = requireString(args, "emailId");
+                    const uidValidity = parseEmailId(emailId).uidValidity;
+                    return createTextResult(await withAudit(auditService, name, args, async () => imapService.deleteEmail(emailId, uidValidity)));
+                }
                 case "batch_email_action":
                     {
                         const emailIds = [...new Set(parseStringListArg(args, "emailIds"))];
@@ -4609,7 +4764,7 @@ export function createServer(config, options = {}) {
                         },
                         drafts: {
                             total: drafts.length,
-                            active: drafts.filter((draft) => draft.status === "draft").length,
+                            active: drafts.filter((draft) => draft.status !== "sent").length,
                             remoteSynced: drafts.filter((draft) => draft.remoteSyncState === "synced").length,
                             syncFailed: drafts.filter((draft) => draft.remoteSyncState === "sync_failed").length,
                         },