Agent Mailboxes

Rotate a mailbox password. The new password is server-generated and shown once; this is also the recovery path for a lost password. Access: paid orders and owner-only asset operations are routed through the Daski gateway. The gateway obtains a short-lived wallet signature bound to the exact provider, action, asset, and request; the provider rejects direct anonymous access. When to use: - You lost the mailbox password (there is no other recovery — the provider does not store it). - Routine credential rotation, or after a suspected leak. Inputs: - `address` — a mailbox controlled by the signing payer wallet. Works on suspended/expired mailboxes too. Effect: existing IMAP/SMTP sessions are invalidated. Returns: artifact `{ address, credentials }` with the new password (shown once; replays redact after 7 days). Next step: store the new password; reconnect IMAP/SMTP.

Check whether a mailbox address is available, its price, and — for custom domains — the DNS records still required. Free, no auth. When to use: - Before `create-mailbox`, always. - To fetch the required MX/SPF record set for a custom domain. Inputs: - `address` — the full address to check, e.g. `[email protected]`. - `dnsSetup` — `manual` (default) or `automatic`; use the same mode in create-mailbox. - `payer` — the intended wallet address. Omission reports `payer_required`; a candidate address does not itself authorize a claim. Returns: A2A task; artifact includes `address, available, reason, purchasable, purchaseBlockers, checkedAt, readiness, price, domain`. `readiness` includes `state, reasons, checkedAt, ownership, dns, records`; each record supplies `type, name` (full DNS name), `host` (relative host), `value, priority`. - `available` — the name itself is free. - `purchasable` — this candidate payer meets the selected setup mode: verified DNS in manual mode, or an eligible automatic plan. DNS status remains separate. Obtain a fresh payer-bound quote before payment. - An external domain needs TXT `_daski-mail.<domain>` with exact `daski-mail-owner=<lowercase payer>` as well as the returned MX/SPF records. Managed domains use current owner control instead of TXT. Eligible managed DNS advertises autoConfigurable: true; choose dnsSetup: automatic on both availability and create-mailbox to prepare records after payment and wait for propagation. Manual mode still requires verified public mail DNS before payment. - Sender authentication (DKIM/DMARC) is not a purchase prerequisite. After the mailbox exists, `get-mailbox-authentication` returns any DKIM and DMARC records still to publish. - `dns: conflict` means incompatible public records; `lookup_unavailable` means the resolver could not answer, not missing DNS. Fix records or retry lookup before payment. - `domain.claimed` — a custom domain already provisioned by a tenant; only that tenant (or the domain's Daski owner) can add mailboxes. Next step: - `purchasable: true` → `daski_get_payment_challenge` with `payerAddress`, then `daski_buy_outcome` after approval. - `purchaseBlockers` contains `dns_conflict` → resolve the conflicting records first (`list-dns-records`, then `set-dns-record`/`delete-dns-record`), re-check, then buy. - For manual setup, publish the returned records and recheck before payment. For eligible automatic setup, explicitly select dnsSetup: automatic; do not perform separate DNS edits. Existing conflicting records are never replaced. A paid dns_pending order resumes without another payment.

Provision a working email mailbox for one year ($9.99/yr). On success you receive IMAP + SMTP credentials, retained encrypted for authorized recovery for seven days. Access: paid orders and owner-only asset operations are routed through the Daski gateway. The gateway obtains a short-lived wallet signature bound to the exact provider, action, asset, and request; the provider rejects direct anonymous access. When to use: - You want an email identity on a hosted shared domain (instant — pick a free local part from `check-availability`). - You want a mailbox on your own domain. Supply the actual payer to `check-availability`. Choose `dnsSetup: "automatic"` for payer-owned Daski-managed DNS: payment authorizes additive mail records and the order waits for propagation before provisioning. Omitted or manual mode requires verified mail DNS before payment. External domains always require payer-specific ownership TXT and mail DNS before payment; automatic mode is refused. When NOT to use: - `check-availability` reported the name taken or reserved. - Public DNS or payer ownership is unverified — satisfy the returned prerequisites before purchasing. - You lost a mailbox password — use `change-password`, not a new mailbox. Inputs: - `address` — the full mailbox address, e.g. `[email protected]` or `[email protected]`. Lowercase letters, digits, and internal `.`, `_`, `-` in the local part. - `dnsSetup` — `manual` (default) or `automatic`; automatic requires eligible payer-owned registrar DNS. - `contactEmail` (optional) — where expiry reminders are sent (T-30 and T-7 days). CREDENTIALS ARE SHOWN ONCE: the artifact carries the password at delivery and on authorized idempotent recovery for 7 days; after that it is permanently redacted and recovery is `change-password`. Store the password immediately. Suspension semantics: a suspended or expired mailbox stops SENDING but can still be READ over IMAP — your mail is never held hostage while you renew or resolve an abuse flag. Abuse policy (shared domains): the mail supplier monitors outbound sending. If the supplier suspends a mailbox for abuse, the owning buyer is banned from creating mailboxes platform-wide and all their shared-domain mailboxes stop sending. An active ban blocks purchase readiness (payer_creation_banned); a ban arriving after payment holds the working order for human Review without supplier provisioning. The message is "Sender reputation too low for shared email address." Do not purchase while banned. Returns: A2A task; on `state: 'completed'` the artifact is `{ address, credentials: { username, password, imap: { host, port }, smtp: { host, port }, webmail_url }, expiresAt, domainKind, dnsStatus?, dnsApplied? }`. If DNS regresses after payment, the order waits in `operations.fulfillment.phase: dns_pending` and rechecks every five minutes. Keep the same order and do not pay again. `waiting_capacity` means ready and queued. Support requires a stable signed `{requestId,message}`; the accepted receipt names a human Review, not email delivery. Operator-approved recovery uses the original payment; `operations.recovery.state: completed` means Completed after recovery while the original failed outcome remains history. Next step: - Save the password. - Connect over IMAP (read) and SMTP (send) with the returned endpoints. - `get-mailbox-info` any time for status, quota, and DNS health.

**Destructive.** Delete a mailbox and purge its stored mail at the supplier. NO REFUND is issued for remaining paid term. Access: paid orders and owner-only asset operations are routed through the Daski gateway. The gateway obtains a short-lived wallet signature bound to the exact provider, action, asset, and request; the provider rejects direct anonymous access. When to use: - The mailbox is no longer needed and you accept losing its stored mail and remaining term. When NOT to use: - You want to stop paying but keep the address until expiry — just let it lapse instead (sending stops at expiry, mail stays readable through the grace window). - You want new credentials — use `change-password`. Inputs: - `address` — a mailbox controlled by the signing payer wallet. The first wallet-authorized call only stages this action and returns the exact effect summary and earliest execution time. After the delay, a fresh wallet authorization must confirm that exact staged action; cancellation is available before execution. Returns: artifact `{ address, deleted: true, dataPurged: true, refund: "none" }`. The freed address becomes available for anyone to register. Next step: none — the asset enters the terminal `deleted` state.

Read the full state of a mailbox you own: asset state and expiry, live supplier state (quota, suspension, sending), domain kind + DNS health, and the IMAP/SMTP endpoints. Never returns the password. Access: paid orders and owner-only asset operations are routed through the Daski gateway. The gateway obtains a short-lived wallet signature bound to the exact provider, action, asset, and request; the provider rejects direct anonymous access. When to use: - "What's the status of my mailbox?", "when does it expire?", "why can't it send?" - Pre-flight before `renew-mailbox` / `delete-mailbox`. Inputs: - `address` — a mailbox you own through this provider. Works on active, suspended, and expired (grace-window) mailboxes. Returns: A2A task; artifact `{ address, assetState, expiresAt, renewalEligible, ownerCreationBanned, displayName: null, supplier: { suspended, sendingEnabled, quotaUsedMb, quotaLimitMb }, domain: { name, kind, dns? }, endpoints }`. Reading the result: - `domain.dns` (custom domains only) is a LIVE PUBLIC-RESOLVER query run at call time — the one public-resolution-backed signal this service returns. `"unverified"` + `missingRecords` means those records did not resolve publicly just now, and you may say so as fact. It is not a delivery test. - `supplier.sendingEnabled` is SMTP-submission state at the mail supplier, NOT deliverability. Do not relay it as "email works". - `displayName` is always `null`: mailboxes have no server-side From display name — it is a mail-client setting with no Daski skill behind it. Answer that question directly; do NOT spend this signed two-call handshake to "check". Next step: `renew-mailbox`, `change-password`, or `delete-mailbox` as needed. For sender authentication (DKIM signing, DMARC) and the exact records to publish, use `get-mailbox-authentication`.

Preview the current price of a paid mailbox skill. Free, no auth. Pricing is fixed ($9.99/yr seed value, operator-configurable), so this mostly matters for budget display. Inputs: - `skillId` — `create-mailbox` or `renew-mailbox`. Returns: artifact `{ skillId, amount, amountUsd, currency: 'USDC', term: '1 year', validUntil }` (`amount` in atomic USDC, ×10⁻⁶ for dollars). Next step: `daski_buy_service` with the same skillId.

Extend a mailbox by one year ($9.99/yr). Renewal during the post-expiry grace window restores sending. Access: paid orders and owner-only asset operations are routed through the Daski gateway. The gateway obtains a short-lived wallet signature bound to the exact provider, action, asset, and request; the provider rejects direct anonymous access. When to use: - An expiry reminder arrived (T-30/T-7 days), or `get-mailbox-info` shows expiry near. - The mailbox expired less than 30 days ago (grace window) — renewing reactivates it with mail intact. When NOT to use: - The mailbox was deleted (grace window passed) — the address must be re-registered with `create-mailbox` and old mail is gone. Inputs: - `address` — the mailbox to renew. Any payer is accepted (paying to extend someone's mailbox is a gift); the mailbox must be managed here. Note: renewing a mailbox that is suspended for abuse extends the term but does NOT restore sending — that requires the operator. Suspension semantics: a suspended or expired mailbox stops SENDING but can still be READ over IMAP — your mail is never held hostage while you renew or resolve an abuse flag. Returns: A2A task; artifact `{ address, expiresAt, restored }`. Next step: `get-mailbox-info` to confirm the new expiry.

Read sender authentication (DKIM signing and DMARC) for the domain of a mailbox you own, with the exact public DNS records still to publish. Separate from mail routing (MX/SPF), which `get-mailbox-info` reports. Access: paid orders and owner-only asset operations are routed through the Daski gateway. The gateway obtains a short-lived wallet signature bound to the exact provider, action, asset, and request; the provider rejects direct anonymous access. When to use: - "Is my mail signed?", "which DKIM/DMARC records do I add?", after creating a mailbox on a domain whose DNS is hosted outside Daski. - Rechecking after publishing the records. Inputs: - `address` — a mailbox you own through this provider. Works on active, suspended, and expired (grace-window) mailboxes. Returns: A2A task; artifact `{ address, domain: { name, kind }, authentication: { status, dkim, dmarc, selector?, requiredRecords: [{ type, host, value }], note } }`. Reading the result: - `status`: `not_configured` (no key prepared yet; Daski support can start it), `dns_pending` (publish every `requiredRecords` entry at the domain's DNS host; `host` is relative to the domain), `dns_conflict`, `lookup_unavailable` (the resolver could not answer; recheck later), `signing_pending`, `signing_configured` or `attention`. - Signing starts automatically once the DKIM key resolves publicly; no access to the mail supplier is needed. `signing_configured` means the supplier signs outbound mail with this key. It is not a delivery or inbox-placement test. - An existing or inherited DMARC policy is preserved as found. Shared Daski domains list no records: Daski publishes them. Next step: publish `requiredRecords` (for a Daski-managed domain, `set-dns-record`), then call this again to confirm.