From 608249f00ab3b75abc3e8235203bf5565b4dfe4a Mon Sep 17 00:00:00 2001
From: Alexander Saal <developer@kasapi-cli.chm-projects.de>
Date: Sat, 23 May 2026 15:53:24 +0200
Subject: [PATCH 1/2] =?UTF-8?q?feat(mail):=20mailstandardfilter=20write=20?=
 =?UTF-8?q?endpoints=20=E2=80=94=20add=20/=20delete?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Wires add_mailstandardfilter and delete_mailstandardfilter through the
shared kaswrite seam plus the #109 / #131 / #132 CLI plumbing as a
vertical slice (Closes #116, part of #13). Both subcommands are gated:
the KAS API has no update action, so add replaces the configured filter
chain wholesale, and delete removes every configured filter in one shot.

- internal/mailfilter/write.go adds Client.Add/Delete (semicolon-joined
  --filter chain, per-field validation, kaswrite contract).
- internal/cli/mail.go wires "mail filters add | delete" with the
  destructive flag set, a confirm verb that phrases the all-at-once
  delete explicitly ("remove all standard filters of mail account
  <login>") and a Long help that points users at "mail accounts get
  <login>" → mail_spamfilter for outcome verification.
- testdata/response_failed_internal_server_error.xml captures the
  observed envelope-level PHP sizeof() fault that
  delete_mailstandardfilter sometimes returns even after the chain was
  removed; mailfilter.Client.Delete surfaces it verbatim (locked in by
  TestClientDeleteSurfacesInternalServerFault). docs/usage/
  destructive-writes.md documents the quirk + verification path.
- testdata/mailfilter/add_mailstandardfilter_{request,response_success}.xml
  and get_mailstandardfilter_response_success.xml refreshed against the
  live API by the maintainer; the slice's read tests still pass against
  the real-shape fixture.

Closes #116.
---
 CHANGELOG.md                                  |  30 +++
 docs/cli/kasapi-cli_mail.md                   |   2 +-
 docs/cli/kasapi-cli_mail_filters.md           |   4 +-
 docs/cli/kasapi-cli_mail_filters_add.md       |  46 ++++
 docs/cli/kasapi-cli_mail_filters_delete.md    |  48 +++++
 docs/cli/kasapi-cli_mail_filters_list.md      |   2 +-
 docs/usage/destructive-writes.md              |   1 +
 internal/cli/mail.go                          |  75 ++++++-
 internal/cli/mail_test.go                     |  96 ++++++++-
 internal/mailfilter/doc.go                    |   7 +-
 internal/mailfilter/fault_test.go             |  23 +-
 internal/mailfilter/mailfilter.go             |  37 ++--
 internal/mailfilter/write.go                  | 120 +++++++++++
 internal/mailfilter/write_test.go             | 202 ++++++++++++++++++
 .../add_mailstandardfilter_request.xml        |   2 +-
 ...dd_mailstandardfilter_response_success.xml |  21 +-
 ...et_mailstandardfilter_response_success.xml |   2 +-
 .../response_failed_internal_server_error.xml |   9 +
 18 files changed, 684 insertions(+), 43 deletions(-)
 create mode 100644 docs/cli/kasapi-cli_mail_filters_add.md
 create mode 100644 docs/cli/kasapi-cli_mail_filters_delete.md
 create mode 100644 internal/mailfilter/write.go
 create mode 100644 internal/mailfilter/write_test.go
 create mode 100644 testdata/response_failed_internal_server_error.xml

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0f5f084..b71460a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -96,6 +96,36 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
+- Mail standard filter write endpoints (#116, #13 write slice):
+  `kasapi-cli mail filters add <mail-login> --filter <item> [--filter
+  <item>...]` and `… delete <mail-login>` wire
+  `add_mailstandardfilter` / `delete_mailstandardfilter`. Both are
+  gated by the #109 confirmation prompt: the KAS API has no
+  `update_mailstandardfilter` action, so `add` *replaces* the configured
+  filter chain wholesale (items previously set but missing from the new
+  `--filter` list are dropped), which is destructive to recover from
+  without a stored copy. Both honour `--dry-run` (#132) and emit a #131
+  audit record. Repeatable `--filter` items are joined with `;` on the
+  wire (the format the captured `add_mailstandardfilter` request
+  fixture uses); each item is either a bare filter id (e.g. `pdw`) or
+  `<filter-id>:<option>=<value>` (e.g. `spamc_move:move=Spam`). Items
+  must be non-empty and must not contain `;` themselves. `delete` takes
+  only `<mail-login>` and removes the whole chain in one shot — the KAS
+  API exposes no per-item delete — so its prompt verb is "remove all
+  standard filters of mail account" rather than the bare "delete" used
+  elsewhere, to make the all-at-once effect explicit. **Known API
+  quirk**: `delete_mailstandardfilter` sometimes surfaces an
+  envelope-level SOAP fault (an internal `sizeof()` PHP error) even
+  when the chain was in fact removed on the server; the fault is
+  surfaced verbatim, and `docs/usage/destructive-writes.md` documents
+  the verification path (`mail accounts get <login>` → `mail_spamfilter`).
+
+- A new shared envelope-level fault fixture
+  `testdata/response_failed_internal_server_error.xml` captures the
+  generic PHP `sizeof()` runtime error wrapped in a SOAP-ENV:Server
+  fault. It is exercised by the soap fixture walker and by
+  `mailfilter.Client.Delete`'s "fault surfaced verbatim" test.
+
 - Mail account write endpoints (#114, #13 write slice):
   `kasapi-cli mail accounts add <address> --password <pw> [field flags]`,
   `… update <mail-login> [field flags]` and
diff --git a/docs/cli/kasapi-cli_mail.md b/docs/cli/kasapi-cli_mail.md
index 00c15cb..bc4a36a 100644
--- a/docs/cli/kasapi-cli_mail.md
+++ b/docs/cli/kasapi-cli_mail.md
@@ -30,7 +30,7 @@ Inspect mail accounts and filters; inspect and manage forwards and mailing lists
 
 * [kasapi-cli](kasapi-cli.md)	 - Command-line client for the All-Inkl KAS API
 * [kasapi-cli mail accounts](kasapi-cli_mail_accounts.md)	 - Inspect and manage mail accounts (get/add/update/delete_mailaccount)
-* [kasapi-cli mail filters](kasapi-cli_mail_filters.md)	 - Inspect mail standard filters (get_mailstandardfilter)
+* [kasapi-cli mail filters](kasapi-cli_mail_filters.md)	 - Inspect and manage mail standard filters (get/add/delete_mailstandardfilter)
 * [kasapi-cli mail forwards](kasapi-cli_mail_forwards.md)	 - Inspect and manage mail forwards (get/add/update/delete_mailforward)
 * [kasapi-cli mail lists](kasapi-cli_mail_lists.md)	 - Inspect and manage mailing lists (get/add/update/delete_mailinglist)
 
diff --git a/docs/cli/kasapi-cli_mail_filters.md b/docs/cli/kasapi-cli_mail_filters.md
index 0af8ebe..400a31e 100644
--- a/docs/cli/kasapi-cli_mail_filters.md
+++ b/docs/cli/kasapi-cli_mail_filters.md
@@ -1,6 +1,6 @@
 ## kasapi-cli mail filters
 
-Inspect mail standard filters (get_mailstandardfilter)
+Inspect and manage mail standard filters (get/add/delete_mailstandardfilter)
 
 ### Options
 
@@ -29,5 +29,7 @@ Inspect mail standard filters (get_mailstandardfilter)
 ### SEE ALSO
 
 * [kasapi-cli mail](kasapi-cli_mail.md)	 - Inspect mail accounts and filters; inspect and manage forwards and mailing lists
+* [kasapi-cli mail filters add](kasapi-cli_mail_filters_add.md)	 - Set the standard-filter chain on a mail account (add_mailstandardfilter)
+* [kasapi-cli mail filters delete](kasapi-cli_mail_filters_delete.md)	 - Remove every standard filter from a mail account (delete_mailstandardfilter)
 * [kasapi-cli mail filters list](kasapi-cli_mail_filters_list.md)	 - List the available standard mail filters (get_mailstandardfilter)
 
diff --git a/docs/cli/kasapi-cli_mail_filters_add.md b/docs/cli/kasapi-cli_mail_filters_add.md
new file mode 100644
index 0000000..a1589eb
--- /dev/null
+++ b/docs/cli/kasapi-cli_mail_filters_add.md
@@ -0,0 +1,46 @@
+## kasapi-cli mail filters add
+
+Set the standard-filter chain on a mail account (add_mailstandardfilter)
+
+### Synopsis
+
+Set the configured standard-filter chain on a mail account via
+add_mailstandardfilter. Each --filter is one item of the chain, either a
+bare filter id (e.g. "pdw") or "<filter-id>:<option>=<value>" (e.g.
+"spamc_move:move=Spam"). Items are joined with ';' on the wire and the
+chain replaces what was configured before — there is no per-item add.
+Use "mail filters list" for the available filter ids.
+
+```
+kasapi-cli mail filters add <mail-login> --filter <item> [--filter <item>...] [flags]
+```
+
+### Options
+
+```
+      --filter stringArray   filter chain item (repeatable; replaces the full chain)
+  -h, --help                 help for add
+```
+
+### Options inherited from parent commands
+
+```
+      --audit-log string                 append a JSON-Lines audit record for each write action to this file (also KAS_AUDIT_LOG); a logfmt line always goes to stderr regardless
+      --auth-data string                 KAS auth data (overrides config and KAS_AUTHDATA)
+      --auth-type string                 KAS auth strategy: 'plain' = send password on each KasApi call (no KasAuth, no 2FA support); 'session' = bootstrap via KasAuth and reuse the credential token. Overrides config and KAS_AUTHTYPE.
+      --config string                    path to the kasapi-cli config file (overrides the default location)
+      --dry-run                          preview a destructive command's KAS request (action + redacted parameters) and exit 0 without dispatching or prompting; honours --output
+      --login string                     KAS login (overrides config and KAS_LOGIN)
+      --otp string                       2FA one-time PIN — sent to KasAuth as session_2fa during the credential-token bootstrap. Requires auth_type=session; the KAS API does not document 2FA on direct kas_auth_type=plain calls.
+  -o, --output string                    output format: json|yaml|table (default table)
+      --profile string                   profile to select from the config file (overrides default_profile)
+      --session-lifetime int             session_lifetime in seconds passed to KasAuth (1..30000); 0 keeps the server default. Requires auth_type=session.
+      --session-update-lifetime string   session_update_lifetime passed to KasAuth ('Y' = sliding window, 'N' = fixed). Empty omits the parameter. Requires auth_type=session.
+  -v, --verbose                          enable verbose logging on stderr
+  -y, --yes                              skip confirmation prompts on destructive operations
+```
+
+### SEE ALSO
+
+* [kasapi-cli mail filters](kasapi-cli_mail_filters.md)	 - Inspect and manage mail standard filters (get/add/delete_mailstandardfilter)
+
diff --git a/docs/cli/kasapi-cli_mail_filters_delete.md b/docs/cli/kasapi-cli_mail_filters_delete.md
new file mode 100644
index 0000000..cbb8bd9
--- /dev/null
+++ b/docs/cli/kasapi-cli_mail_filters_delete.md
@@ -0,0 +1,48 @@
+## kasapi-cli mail filters delete
+
+Remove every standard filter from a mail account (delete_mailstandardfilter)
+
+### Synopsis
+
+Remove every configured standard filter from a mail account via
+delete_mailstandardfilter. The KAS action takes only the mail login and
+drops the whole chain in one shot — there is no per-item delete.
+
+Note: the API sometimes surfaces an envelope-level SOAP fault (an
+internal "sizeof()" PHP error) even when the chain is in fact removed
+on the server. The fault is surfaced verbatim; if you see it, verify
+the actual outcome with "mail accounts get <login>" — the configured
+chain is reported in the mail_spamfilter field.
+
+```
+kasapi-cli mail filters delete <mail-login> [flags]
+```
+
+### Options
+
+```
+  -h, --help   help for delete
+```
+
+### Options inherited from parent commands
+
+```
+      --audit-log string                 append a JSON-Lines audit record for each write action to this file (also KAS_AUDIT_LOG); a logfmt line always goes to stderr regardless
+      --auth-data string                 KAS auth data (overrides config and KAS_AUTHDATA)
+      --auth-type string                 KAS auth strategy: 'plain' = send password on each KasApi call (no KasAuth, no 2FA support); 'session' = bootstrap via KasAuth and reuse the credential token. Overrides config and KAS_AUTHTYPE.
+      --config string                    path to the kasapi-cli config file (overrides the default location)
+      --dry-run                          preview a destructive command's KAS request (action + redacted parameters) and exit 0 without dispatching or prompting; honours --output
+      --login string                     KAS login (overrides config and KAS_LOGIN)
+      --otp string                       2FA one-time PIN — sent to KasAuth as session_2fa during the credential-token bootstrap. Requires auth_type=session; the KAS API does not document 2FA on direct kas_auth_type=plain calls.
+  -o, --output string                    output format: json|yaml|table (default table)
+      --profile string                   profile to select from the config file (overrides default_profile)
+      --session-lifetime int             session_lifetime in seconds passed to KasAuth (1..30000); 0 keeps the server default. Requires auth_type=session.
+      --session-update-lifetime string   session_update_lifetime passed to KasAuth ('Y' = sliding window, 'N' = fixed). Empty omits the parameter. Requires auth_type=session.
+  -v, --verbose                          enable verbose logging on stderr
+  -y, --yes                              skip confirmation prompts on destructive operations
+```
+
+### SEE ALSO
+
+* [kasapi-cli mail filters](kasapi-cli_mail_filters.md)	 - Inspect and manage mail standard filters (get/add/delete_mailstandardfilter)
+
diff --git a/docs/cli/kasapi-cli_mail_filters_list.md b/docs/cli/kasapi-cli_mail_filters_list.md
index d64c192..8e7f1da 100644
--- a/docs/cli/kasapi-cli_mail_filters_list.md
+++ b/docs/cli/kasapi-cli_mail_filters_list.md
@@ -32,5 +32,5 @@ kasapi-cli mail filters list [flags]
 
 ### SEE ALSO
 
-* [kasapi-cli mail filters](kasapi-cli_mail_filters.md)	 - Inspect mail standard filters (get_mailstandardfilter)
+* [kasapi-cli mail filters](kasapi-cli_mail_filters.md)	 - Inspect and manage mail standard filters (get/add/delete_mailstandardfilter)
 
diff --git a/docs/usage/destructive-writes.md b/docs/usage/destructive-writes.md
index cbcc96e..74db5d5 100644
--- a/docs/usage/destructive-writes.md
+++ b/docs/usage/destructive-writes.md
@@ -45,6 +45,7 @@ the deviations.
 | [`databases`](https://github.com/chmmou/kasapi-cli/issues/122) | **Louder delete prompt**: `delete_database` uses the verb `"permanently delete"` (vs the bare `"delete"` every other slice uses) because the action drops the database AND every row in it — the loudest data-loss surface of the v0.2.0 write phase. Password key splits between actions: `--password` → `database_password` on add, `database_new_password` on update. `--allowed-hosts` is **optional**: an empty value is the KAS API's documented "any host may connect" wildcard, sent verbatim on the wire. |
 | [`ddnsusers`](https://github.com/chmmou/kasapi-cli/issues/121) | **No `_new_password` split**: `--password` maps to `dyndns_password` on both `add` and `update`. `update_ddnsuser` accepts `--target-ipv4` / `--target-ipv6` instead of `add`'s legacy `--target-ip`; the ipv4/ipv6 keys are undocumented in the KAS API docs but verified to work against the live system (the captured update request fixture is authoritative). |
 | [`mail accounts`](https://github.com/chmmou/kasapi-cli/issues/114) | **Louder delete prompt**: `delete_mailaccount` uses `"permanently delete"` (shared with `databases`) — it drops the mailbox AND every message in it. `add` splits the address on the last `@` into `local_part` / `domain_part`; `update`/`delete` address the account by its generated `mail_login`. Password key splits between actions: `--password` → `mail_password` on add, `mail_new_password` on update. `add`'s Y/N/text toggles and XLIST folder names default to the KAS API's own defaults; `--responder` is passed through verbatim (`N`, `Y`, or a `<start>\|<end>` timestamp range). |
+| [`mail filters`](https://github.com/chmmou/kasapi-cli/issues/116) | **Both `add` and `delete` are gated**, not just `delete`: there is no `update_mailstandardfilter`, so `add_mailstandardfilter` *replaces* the configured chain wholesale (any previously-set items not in the new `--filter` list are dropped). Repeatable `--filter <item>` is joined with `;` on the wire (items must not contain `;` and not be empty). `delete_mailstandardfilter` takes only `<mail-login>` and removes the whole chain in one shot; the prompt phrases this as *"remove all standard filters of mail account &lt;login&gt;"* to make the all-at-once effect explicit. **Known API quirk**: `delete` sometimes returns an envelope-level SOAP fault (an internal `sizeof()` PHP error) even when the chain was in fact removed on the server. The fault is surfaced verbatim — if you see it, verify the actual outcome via `kasapi-cli mail accounts get <login>` (the configured chain is reported in the `mail_spamfilter` field). |
 
 ## The contract
 
diff --git a/internal/cli/mail.go b/internal/cli/mail.go
index f89325f..57a4e31 100644
--- a/internal/cli/mail.go
+++ b/internal/cli/mail.go
@@ -190,9 +190,13 @@ func newMailListsGetCmd(opts *RootOptions) *cobra.Command {
 func newMailFiltersCmd(opts *RootOptions) *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "filters",
-		Short: "Inspect mail standard filters (get_mailstandardfilter)",
+		Short: "Inspect and manage mail standard filters (get/add/delete_mailstandardfilter)",
 	}
-	cmd.AddCommand(newMailFiltersListCmd(opts))
+	cmd.AddCommand(
+		newMailFiltersListCmd(opts),
+		newMailFiltersAddCmd(opts),
+		newMailFiltersDeleteCmd(opts),
+	)
 	return cmd
 }
 
@@ -207,6 +211,73 @@ func newMailFiltersListCmd(opts *RootOptions) *cobra.Command {
 	}
 }
 
+func newMailFiltersAddCmd(opts *RootOptions) *cobra.Command {
+	var items []string
+	cmd := &cobra.Command{
+		Use:   "add <mail-login> --filter <item> [--filter <item>...]",
+		Short: "Set the standard-filter chain on a mail account (add_mailstandardfilter)",
+		Long: `Set the configured standard-filter chain on a mail account via
+add_mailstandardfilter. Each --filter is one item of the chain, either a
+bare filter id (e.g. "pdw") or "<filter-id>:<option>=<value>" (e.g.
+"spamc_move:move=Spam"). Items are joined with ';' on the wire and the
+chain replaces what was configured before — there is no per-item add.
+Use "mail filters list" for the available filter ids.`,
+		Args: cobra.ExactArgs(1),
+		RunE: runWriteE(opts, func(args []string) (writeSpec, error) {
+			if len(items) == 0 {
+				return writeSpec{}, fmt.Errorf("at least one --filter is required")
+			}
+			login := args[0]
+			return writeSpec{
+				action:      "add_mailstandardfilter",
+				destructive: true,
+				confirm:     ConfirmAction{Verb: "replace the standard-filter chain of", Resource: "mail account", ID: login},
+				params:      mailfilter.AddParams(login, items),
+				dispatch: func(c *api.Client, ctx context.Context) (string, error) {
+					if derr := mailfilter.NewClient(c).Add(ctx, login, items); derr != nil {
+						return "", derr
+					}
+					return "configured mail standard filter for " + login, nil
+				},
+			}, nil
+		}),
+	}
+	cmd.Flags().StringArrayVar(&items, "filter", nil, "filter chain item (repeatable; replaces the full chain)")
+	return cmd
+}
+
+func newMailFiltersDeleteCmd(opts *RootOptions) *cobra.Command {
+	return &cobra.Command{
+		Use:   "delete <mail-login>",
+		Short: "Remove every standard filter from a mail account (delete_mailstandardfilter)",
+		Long: `Remove every configured standard filter from a mail account via
+delete_mailstandardfilter. The KAS action takes only the mail login and
+drops the whole chain in one shot — there is no per-item delete.
+
+Note: the API sometimes surfaces an envelope-level SOAP fault (an
+internal "sizeof()" PHP error) even when the chain is in fact removed
+on the server. The fault is surfaced verbatim; if you see it, verify
+the actual outcome with "mail accounts get <login>" — the configured
+chain is reported in the mail_spamfilter field.`,
+		Args: cobra.ExactArgs(1),
+		RunE: runWriteE(opts, func(args []string) (writeSpec, error) {
+			login := args[0]
+			return writeSpec{
+				action:      "delete_mailstandardfilter",
+				destructive: true,
+				confirm:     ConfirmAction{Verb: "remove all standard filters of", Resource: "mail account", ID: login},
+				params:      mailfilter.DeleteParams(login),
+				dispatch: func(c *api.Client, ctx context.Context) (string, error) {
+					if derr := mailfilter.NewClient(c).Delete(ctx, login); derr != nil {
+						return "", derr
+					}
+					return "removed mail standard filters for " + login, nil
+				},
+			}, nil
+		}),
+	}
+}
+
 func newMailAccountsCmd(opts *RootOptions) *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "accounts",
diff --git a/internal/cli/mail_test.go b/internal/cli/mail_test.go
index 861cc06..f56c3b5 100644
--- a/internal/cli/mail_test.go
+++ b/internal/cli/mail_test.go
@@ -360,8 +360,100 @@ func TestMailFiltersHelpListsSubcommands(t *testing.T) {
 		t.Fatalf("Execute: %v", err)
 	}
 	out := buf.String()
-	if !strings.Contains(out, "list") {
-		t.Errorf("--help output missing %q\n%s", "list", out)
+	for _, want := range []string{"list", "add", "delete"} {
+		if !strings.Contains(out, want) {
+			t.Errorf("--help output missing %q\n%s", want, out)
+		}
+	}
+}
+
+// add_mailstandardfilter without --filter is rejected at build time
+// (before any gating or credential resolution) — the KAS API would
+// otherwise fault missing_parameter.
+func TestMailFiltersAddRejectsNoFilter(t *testing.T) {
+	t.Parallel()
+	root, opts := cli.NewRootCmd()
+	root.AddCommand(cli.NewMailCmd(opts))
+	var buf bytes.Buffer
+	root.SetOut(&buf)
+	root.SetErr(&buf)
+	root.SetArgs([]string{"mail", "filters", "add", "m0000001"})
+	err := root.Execute()
+	if err == nil {
+		t.Fatalf("Execute: want error, got nil")
+	}
+	if cli.CodeFor(err) != cli.ExitUserError {
+		t.Errorf("exit code = %d, want ExitUserError", cli.CodeFor(err))
+	}
+}
+
+// Both destructive subcommands (add — replaces the chain wholesale —
+// and delete) must refuse on a non-interactive stdin without --yes
+// rather than dispatch unconfirmed.
+func TestMailFiltersDestructiveRefuseNonTTY(t *testing.T) {
+	t.Parallel()
+	for _, args := range [][]string{
+		{"mail", "filters", "add", "m0000001", "--filter", "pdw"},
+		{"mail", "filters", "delete", "m0000001"},
+	} {
+		t.Run(args[2], func(t *testing.T) {
+			t.Parallel()
+			root, opts := cli.NewRootCmd()
+			root.AddCommand(cli.NewMailCmd(opts))
+			var buf bytes.Buffer
+			root.SetOut(&buf)
+			root.SetErr(&buf)
+			root.SetIn(strings.NewReader(""))
+			root.SetArgs(append(args,
+				"--login", "w0000000", "--auth-data", "x", "--auth-type", "plain"))
+			err := root.Execute()
+			if err == nil {
+				t.Fatalf("Execute %v: want refusal error, got nil", args)
+			}
+			if !errors.Is(err, cli.ErrConfirmationRequired) {
+				t.Errorf("err = %v, want ErrConfirmationRequired", err)
+			}
+		})
+	}
+}
+
+// The mail filters add chain assembly is the most-likely drift surface
+// (repeatable --filter joined with ';'). --dry-run renders the exact
+// KAS params it would dispatch as JSON so this asserts the assembly end
+// to end without a network call.
+func TestMailFiltersAddDryRunChainAssembly(t *testing.T) {
+	t.Parallel()
+	root, opts := cli.NewRootCmd()
+	root.AddCommand(cli.NewMailCmd(opts))
+	var out, errb bytes.Buffer
+	root.SetOut(&out)
+	root.SetErr(&errb)
+	root.SetArgs([]string{
+		"mail", "filters", "add", "m0000001",
+		"--filter", "pdw",
+		"--filter", "virus_mark",
+		"--filter", "spamc_move:move=Spam",
+		"--dry-run", "-o", "json",
+		"--login", "w0", "--auth-data", "x", "--auth-type", "plain",
+	})
+	if err := root.Execute(); err != nil {
+		t.Fatalf("Execute: %v", err)
+	}
+	var got struct {
+		Action string            `json:"action"`
+		Params map[string]string `json:"params"`
+	}
+	if err := json.Unmarshal(out.Bytes(), &got); err != nil {
+		t.Fatalf("unmarshal dry-run output: %v\n%s", err, out.String())
+	}
+	if got.Action != "add_mailstandardfilter" {
+		t.Errorf("action = %q, want add_mailstandardfilter", got.Action)
+	}
+	if got.Params["mail_login"] != "m0000001" {
+		t.Errorf("params[mail_login] = %q, want m0000001", got.Params["mail_login"])
+	}
+	if got.Params["filter"] != "pdw;virus_mark;spamc_move:move=Spam" {
+		t.Errorf("params[filter] = %q, want pdw;virus_mark;spamc_move:move=Spam", got.Params["filter"])
 	}
 }
 
diff --git a/internal/mailfilter/doc.go b/internal/mailfilter/doc.go
index c7c782e..7509b00 100644
--- a/internal/mailfilter/doc.go
+++ b/internal/mailfilter/doc.go
@@ -1,4 +1,7 @@
 // Package mailfilter holds the domain types and use cases for the KAS
-// mail-standard-filter endpoints (get_mailstandardfilter,
-// add_mailstandardfilter, delete_mailstandardfilter). See issues #9 and #13.
+// mail-standard-filter endpoints: get_mailstandardfilter (read; the
+// catalogue of available filters) plus add_mailstandardfilter and
+// delete_mailstandardfilter (write; set / clear the configured filter
+// chain on a mail account, wired via the kaswrite seam). See issues #9,
+// #13 and #116.
 package mailfilter
diff --git a/internal/mailfilter/fault_test.go b/internal/mailfilter/fault_test.go
index fe9a33d..7c4064b 100644
--- a/internal/mailfilter/fault_test.go
+++ b/internal/mailfilter/fault_test.go
@@ -6,10 +6,29 @@ import (
 	"github.com/chmmou/kasapi-cli/internal/testutil"
 )
 
+// TestFaultFixturesDecodeToDocumentedCodes is the
+// testutil.AssertFaultFixtures anchor for the mailfilter slice: every
+// _response_failed_*.xml under testdata/mailfilter/ must decode to a
+// *soap.FaultError with a non-empty code, and each entry below pins the
+// captured faultstring to the slug encoded in the filename. The
+// envelope-level internal-server-error captured for the
+// delete_mailstandardfilter quirk lives at the shared top level
+// (testdata/response_failed_internal_server_error.xml) and is exercised
+// by write_test.go and by the soap-level fixture walker.
 func TestFaultFixturesDecodeToDocumentedCodes(t *testing.T) {
 	t.Parallel()
 	testutil.AssertFaultFixtures(t, "mailfilter", map[string]string{
-		"add_mailstandardfilter_response_failed_action_syntax_incorrect.xml": "action_syntax_incorrect",
-		"add_mailstandardfilter_response_failed_filter_doesnt_exist.xml":     "filter_doesnt_exist",
+		"add_mailstandardfilter_response_failed_action_syntax_incorrect.xml":        "action_syntax_incorrect",
+		"add_mailstandardfilter_response_failed_filter_doesnt_exist.xml":            "filter_doesnt_exist",
+		"add_mailstandardfilter_response_failed_filter_not_allowed.xml":             "filter_not_allowed",
+		"add_mailstandardfilter_response_failed_login_not_found.xml":                "login_not_found",
+		"add_mailstandardfilter_response_failed_mail_login_syntax_incorrect.xml":    "mail_login_syntax_incorrect",
+		"add_mailstandardfilter_response_failed_missing_parameter.xml":              "missing_parameter",
+		"add_mailstandardfilter_response_failed_spamfilter_not_in_contract.xml":     "spamfilter_not_in_contract",
+		"add_mailstandardfilter_response_failed_unknown_filtertype.xml":             "unknown_filtertype",
+		"delete_mailstandardfilter_response_failed_in_progress.xml":                 "in_progress",
+		"delete_mailstandardfilter_response_failed_login_not_found.xml":             "login_not_found",
+		"delete_mailstandardfilter_response_failed_mail_login_syntax_incorrect.xml": "mail_login_syntax_incorrect",
+		"delete_mailstandardfilter_response_failed_missing_parameter.xml":           "missing_parameter",
 	})
 }
diff --git a/internal/mailfilter/mailfilter.go b/internal/mailfilter/mailfilter.go
index a0b71fc..26f4958 100644
--- a/internal/mailfilter/mailfilter.go
+++ b/internal/mailfilter/mailfilter.go
@@ -25,26 +25,39 @@ type StandardFilter struct {
 // satisfies cli.Tabular.
 type StandardFilterList []StandardFilter
 
-// Client groups the read endpoint scoped to mail standard filters.
-// Get is intentionally absent: the KAS docs at
+// Client groups the read endpoint scoped to mail standard filters
+// (get_mailstandardfilter, which lists the filter catalogue available to
+// the contract) and the write endpoints add_mailstandardfilter /
+// delete_mailstandardfilter (see write.go). The raw Caller is kept
+// alongside the read helper so the write methods can dispatch their own
+// KAS actions through the shared kaswrite seam.
+//
+// Get is intentionally absent on the read side: the KAS docs at
 // https://kasapi.kasserver.com/dokumentation/phpdoc/files/get-mailstandardfilter-inc.html
 // list only the three standard auth parameters (kas_login,
-// kas_auth_data, kas_auth_type) — there is no filter parameter
-// for looking up a single filter, the endpoint always returns the
-// full list. Verified against the KAS docs while closing the
-// mailfilter.Get follow-up from issue #73.
+// kas_auth_data, kas_auth_type) — there is no filter parameter for
+// looking up a single filter, the endpoint always returns the full
+// catalogue. Verified against the KAS docs while closing the
+// mailfilter.Get follow-up from issue #73. The chain *configured* on a
+// given mailbox is reported by get_mailaccounts in the
+// mail_spamfilter field; callers wanting to confirm the outcome of an
+// add/delete on a specific account read it from there.
 type Client struct {
 	lg kasread.ListGet[StandardFilterList, StandardFilter]
+	c  Caller
 }
 
 // NewClient returns a Client backed by the given Caller.
 func NewClient(c Caller) *Client {
-	return &Client{lg: kasread.ListGet[StandardFilterList, StandardFilter]{
-		Caller:  c,
-		Action:  "get_mailstandardfilter",
-		Label:   "mailfilter",
-		Decoder: DecodeStandardFilters,
-	}}
+	return &Client{
+		lg: kasread.ListGet[StandardFilterList, StandardFilter]{
+			Caller:  c,
+			Action:  "get_mailstandardfilter",
+			Label:   "mailfilter",
+			Decoder: DecodeStandardFilters,
+		},
+		c: c,
+	}
 }
 
 // List calls get_mailstandardfilter and decodes the response into a
diff --git a/internal/mailfilter/write.go b/internal/mailfilter/write.go
new file mode 100644
index 0000000..2d3c808
--- /dev/null
+++ b/internal/mailfilter/write.go
@@ -0,0 +1,120 @@
+package mailfilter
+
+import (
+	"context"
+	"errors"
+	"strings"
+
+	"github.com/chmmou/kasapi-cli/internal/kaswrite"
+)
+
+// ErrUnexpectedReturnString is the shared canonical post-call-contract
+// sentinel, re-exported so errors.Is(err, mailfilter.ErrUnexpectedReturnString)
+// keeps working and the slice stays self-describing. See
+// kaswrite.ErrUnexpectedReturnString for the full contract.
+var ErrUnexpectedReturnString = kaswrite.ErrUnexpectedReturnString
+
+const (
+	addAction    = "add_mailstandardfilter"
+	deleteAction = "delete_mailstandardfilter"
+)
+
+// Field-prefixed constants are the KAS request keys add_mailstandardfilter
+// and delete_mailstandardfilter accept. Both actions identify the target
+// mailbox by mail_login; add additionally carries the joined filter chain
+// in the single filter key.
+//
+// The filter chain is a semicolon-separated list of items where each item
+// is either a bare filter id (e.g. "pdw") or "<filter-id>:<option>=<value>"
+// (e.g. "spamc_move:move=Spam"). The captured add_mailstandardfilter
+// request fixture is authoritative. delete_mailstandardfilter takes only
+// mail_login and removes the whole configured chain in one shot — there is
+// no per-item delete on the KAS API.
+const (
+	FieldMailLogin = "mail_login"
+	FieldFilter    = "filter"
+)
+
+// JoinFilters builds the filter-chain string add_mailstandardfilter
+// expects: semicolon-joined items, no leading or trailing separator. Empty
+// items and items containing the separator itself are rejected because
+// the KAS API has no escaping for either case and a typo would otherwise
+// silently extend the chain.
+func JoinFilters(items []string) (string, error) {
+	if len(items) == 0 {
+		return "", errors.New("mailfilter: at least one filter item is required")
+	}
+	for _, item := range items {
+		if item == "" {
+			return "", errors.New("mailfilter: filter item must not be empty")
+		}
+		if strings.Contains(item, ";") {
+			return "", errors.New("mailfilter: filter item must not contain ';' (use a separate --filter)")
+		}
+	}
+	return strings.Join(items, ";"), nil
+}
+
+// Add sets the standard-filter chain on a mail account
+// (add_mailstandardfilter). The chain is sent verbatim as a single
+// semicolon-joined string built from filterItems by JoinFilters; both
+// mailLogin and a non-empty filterItems slice are validated before any
+// SOAP call so the CLI can fail fast on an obviously incomplete request.
+// Per the KAS docs the action replaces the configured chain wholesale.
+func (cl *Client) Add(ctx context.Context, mailLogin string, filterItems []string) error {
+	if mailLogin == "" {
+		return errors.New("mailfilter: add_mailstandardfilter requires a non-empty mail login")
+	}
+	chain, err := JoinFilters(filterItems)
+	if err != nil {
+		return err
+	}
+	_, err = kaswrite.Call(ctx, cl.c, "mailfilter", addAction, map[string]any{
+		FieldMailLogin: mailLogin,
+		FieldFilter:    chain,
+	})
+	return err
+}
+
+// AddParams builds the add_mailstandardfilter KAS request parameter map.
+// It is the single source of truth for the request shape so the CLI
+// dry-run preview / audit record and the dispatched call cannot diverge.
+// The filter chain is joined by JoinFilters; an empty or malformed slice
+// surfaces as an error there, but AddParams itself returns the params
+// nil-tolerant (an empty chain string) so callers that already validated
+// can build the map without re-checking. Real callers go through Add,
+// which validates first.
+func AddParams(mailLogin string, filterItems []string) map[string]any {
+	chain, _ := JoinFilters(filterItems)
+	return map[string]any{
+		FieldMailLogin: mailLogin,
+		FieldFilter:    chain,
+	}
+}
+
+// Delete removes the entire standard-filter chain from a mail account
+// (delete_mailstandardfilter). The KAS action takes only mail_login and
+// drops every configured filter at once — there is no per-item delete.
+//
+// Observed quirk: even on a successful removal the API sometimes surfaces
+// a generic envelope-level SOAP fault (the captured
+// testdata/response_failed_internal_server_error.xml carries a PHP
+// "sizeof(): Argument #1 ($value) must be of type Countable|array, null
+// given" string in faultstring) while the filter is in fact gone on the
+// server. We do NOT special-case that fault — the Caller surfaces it
+// verbatim so the audit log and the exit code reflect what KAS reported.
+// Callers can verify the actual outcome via mail accounts get <login>
+// (the configured chain is reported in the mail_spamfilter field).
+func (cl *Client) Delete(ctx context.Context, mailLogin string) error {
+	if mailLogin == "" {
+		return errors.New("mailfilter: delete_mailstandardfilter requires a non-empty mail login")
+	}
+	_, err := kaswrite.Call(ctx, cl.c, "mailfilter", deleteAction, DeleteParams(mailLogin))
+	return err
+}
+
+// DeleteParams builds the delete_mailstandardfilter KAS request parameter
+// map (single source of truth, see AddParams).
+func DeleteParams(mailLogin string) map[string]any {
+	return map[string]any{FieldMailLogin: mailLogin}
+}
diff --git a/internal/mailfilter/write_test.go b/internal/mailfilter/write_test.go
new file mode 100644
index 0000000..abd1afd
--- /dev/null
+++ b/internal/mailfilter/write_test.go
@@ -0,0 +1,202 @@
+package mailfilter_test
+
+import (
+	"context"
+	"errors"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/chmmou/kasapi-cli/internal/mailfilter"
+	"github.com/chmmou/kasapi-cli/internal/soap"
+	"github.com/chmmou/kasapi-cli/internal/testutil"
+)
+
+func sampleFilters() []string {
+	return []string{
+		"pdw",
+		"virus_mark",
+		"spamc_move:move=Spam",
+		"rspamd:move=Spam",
+		"brbl:move=Spam",
+		"rbl_cbl:move=Spam",
+		"scbl:move=Spam",
+	}
+}
+
+func TestClientAdd(t *testing.T) {
+	t.Parallel()
+	resp := testutil.DecodeFixture(t, "mailfilter/add_mailstandardfilter_response_success.xml")
+	fc := &testutil.FakeCaller{Resp: resp}
+	err := mailfilter.NewClient(fc).Add(context.Background(), "m0000001", sampleFilters())
+	if err != nil {
+		t.Fatalf("Add: %v", err)
+	}
+	if fc.GotAction != "add_mailstandardfilter" {
+		t.Errorf("action = %q, want add_mailstandardfilter", fc.GotAction)
+	}
+	if got, _ := fc.GotParams["mail_login"].(string); got != "m0000001" {
+		t.Errorf("params[mail_login] = %v, want m0000001", fc.GotParams["mail_login"])
+	}
+	wantFilter := "pdw;virus_mark;spamc_move:move=Spam;rspamd:move=Spam;brbl:move=Spam;rbl_cbl:move=Spam;scbl:move=Spam"
+	if got, _ := fc.GotParams["filter"].(string); got != wantFilter {
+		t.Errorf("params[filter] = %q, want %q", fc.GotParams["filter"], wantFilter)
+	}
+}
+
+func TestClientDelete(t *testing.T) {
+	t.Parallel()
+	resp := testutil.DecodeFixture(t, "mailfilter/delete_mailstandardfilter_response_success.xml")
+	fc := &testutil.FakeCaller{Resp: resp}
+	err := mailfilter.NewClient(fc).Delete(context.Background(), "m0000001")
+	if err != nil {
+		t.Fatalf("Delete: %v", err)
+	}
+	if fc.GotAction != "delete_mailstandardfilter" {
+		t.Errorf("action = %q, want delete_mailstandardfilter", fc.GotAction)
+	}
+	if got, _ := fc.GotParams["mail_login"].(string); got != "m0000001" {
+		t.Errorf("params[mail_login] = %v, want m0000001", fc.GotParams["mail_login"])
+	}
+	if _, ok := fc.GotParams["filter"]; ok {
+		t.Errorf("delete params must not carry a filter key, got %v", fc.GotParams)
+	}
+}
+
+// TestClientDeleteSurfacesInternalServerFault locks in the documented
+// quirk: delete_mailstandardfilter sometimes returns a generic
+// envelope-level SOAP fault even though the chain was in fact removed on
+// the server. We decode the captured shared fixture
+// (testdata/response_failed_internal_server_error.xml) the same way the
+// real *api.Client does (soap.Decode → *soap.FaultError) and route that
+// error through the FakeCaller, then assert Delete surfaces it
+// verbatim. A future client-side "treat as success" shortcut would
+// have to remove this assertion deliberately.
+func TestClientDeleteSurfacesInternalServerFault(t *testing.T) {
+	t.Parallel()
+	path := filepath.Join(testutil.RepoRoot(t), "testdata", "response_failed_internal_server_error.xml")
+	//nolint:gosec // G304: rooted at the repo testdata/ dir.
+	f, oerr := os.Open(path)
+	if oerr != nil {
+		t.Fatalf("open fixture: %v", oerr)
+	}
+	defer func() { _ = f.Close() }()
+	_, derr := soap.Decode(f)
+	var fe *soap.FaultError
+	if !errors.As(derr, &fe) {
+		t.Fatalf("soap.Decode err = %T (%v), want *soap.FaultError", derr, derr)
+	}
+	if !strings.Contains(fe.Fault.String, "sizeof()") {
+		t.Fatalf("fixture FaultError.String = %q, want the captured PHP message", fe.Fault.String)
+	}
+	fc := &testutil.FakeCaller{Err: fe}
+	err := mailfilter.NewClient(fc).Delete(context.Background(), "m0000001")
+	if err == nil {
+		t.Fatal("Delete err = nil, want the internal-server-error fault surfaced")
+	}
+	var got *soap.FaultError
+	if !errors.As(err, &got) {
+		t.Fatalf("Delete err = %T (%v), want *soap.FaultError wrapped", err, err)
+	}
+	if !strings.Contains(got.Fault.String, "sizeof()") {
+		t.Errorf("propagated FaultError.String = %q, want the captured PHP message", got.Fault.String)
+	}
+}
+
+func TestWriteValidation(t *testing.T) {
+	t.Parallel()
+	c := mailfilter.NewClient(&testutil.FakeCaller{})
+	ctx := context.Background()
+
+	if err := c.Add(ctx, "", sampleFilters()); err == nil ||
+		!strings.Contains(err.Error(), "mail login") {
+		t.Errorf("Add empty login err = %v, want mail-login validation", err)
+	}
+	if err := c.Add(ctx, "m0000001", nil); err == nil ||
+		!strings.Contains(err.Error(), "filter item") {
+		t.Errorf("Add no filters err = %v, want filter-item validation", err)
+	}
+	if err := c.Add(ctx, "m0000001", []string{"pdw", ""}); err == nil ||
+		!strings.Contains(err.Error(), "empty") {
+		t.Errorf("Add empty item err = %v, want empty-item validation", err)
+	}
+	if err := c.Add(ctx, "m0000001", []string{"pdw;virus_mark"}); err == nil ||
+		!strings.Contains(err.Error(), ";") {
+		t.Errorf("Add semicolon-in-item err = %v, want semicolon validation", err)
+	}
+	if err := c.Delete(ctx, ""); err == nil ||
+		!strings.Contains(err.Error(), "mail login") {
+		t.Errorf("Delete empty login err = %v, want mail-login validation", err)
+	}
+}
+
+func TestUnexpectedReturnString(t *testing.T) {
+	t.Parallel()
+	// Synthetic response with ReturnString != "TRUE" — kaswrite must
+	// wrap this into ErrUnexpectedReturnString.
+	bad := &soap.Response{Body: soap.ResponseBody{ReturnString: "FALSE"}}
+	for _, tc := range []struct {
+		name string
+		run  func(*mailfilter.Client) error
+	}{
+		{"Add", func(c *mailfilter.Client) error {
+			return c.Add(context.Background(), "m0000001", sampleFilters())
+		}},
+		{"Delete", func(c *mailfilter.Client) error {
+			return c.Delete(context.Background(), "m0000001")
+		}},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			c := mailfilter.NewClient(&testutil.FakeCaller{Resp: bad})
+			if err := tc.run(c); !errors.Is(err, mailfilter.ErrUnexpectedReturnString) {
+				t.Errorf("%s err = %v, want errors.Is ErrUnexpectedReturnString", tc.name, err)
+			}
+		})
+	}
+}
+
+func TestWritePropagatesError(t *testing.T) {
+	t.Parallel()
+	want := errors.New("boom")
+	c := mailfilter.NewClient(&testutil.FakeCaller{Err: want})
+	if err := c.Add(context.Background(), "m0000001", sampleFilters()); !errors.Is(err, want) {
+		t.Errorf("Add err = %v, want %v wrapped", err, want)
+	}
+	if err := c.Delete(context.Background(), "m0000001"); !errors.Is(err, want) {
+		t.Errorf("Delete err = %v, want %v wrapped", err, want)
+	}
+}
+
+func TestParamBuilders(t *testing.T) {
+	t.Parallel()
+	addParams := mailfilter.AddParams("m0000001", []string{"pdw", "virus_mark"})
+	if got, _ := addParams["mail_login"].(string); got != "m0000001" {
+		t.Errorf("AddParams[mail_login] = %v, want m0000001", addParams["mail_login"])
+	}
+	if got, _ := addParams["filter"].(string); got != "pdw;virus_mark" {
+		t.Errorf("AddParams[filter] = %v, want pdw;virus_mark", addParams["filter"])
+	}
+	delParams := mailfilter.DeleteParams("m0000001")
+	if got, _ := delParams["mail_login"].(string); got != "m0000001" {
+		t.Errorf("DeleteParams[mail_login] = %v, want m0000001", delParams["mail_login"])
+	}
+	if _, ok := delParams["filter"]; ok {
+		t.Errorf("DeleteParams must not carry a filter key, got %v", delParams)
+	}
+}
+
+func TestJoinFilters(t *testing.T) {
+	t.Parallel()
+	got, err := mailfilter.JoinFilters([]string{"a", "b:opt=x", "c"})
+	if err != nil {
+		t.Fatalf("JoinFilters: %v", err)
+	}
+	if got != "a;b:opt=x;c" {
+		t.Errorf("JoinFilters = %q, want %q", got, "a;b:opt=x;c")
+	}
+	if _, err := mailfilter.JoinFilters(nil); err == nil {
+		t.Errorf("JoinFilters(nil) err = nil, want validation error")
+	}
+}
diff --git a/testdata/mailfilter/add_mailstandardfilter_request.xml b/testdata/mailfilter/add_mailstandardfilter_request.xml
index 24ba2d5..a5515ca 100644
--- a/testdata/mailfilter/add_mailstandardfilter_request.xml
+++ b/testdata/mailfilter/add_mailstandardfilter_request.xml
@@ -6,7 +6,7 @@
             {
                 "KasRequestParams": {
                     "mail_login": "m0000001",
-                    "filter": "spamfilter:reject;virusfilter:reject"
+                    "filter": "pdw;virus_mark;spamc_move:move=Spam;rspamd:move=Spam;brbl:move=Spam;rbl_cbl:move=Spam;scbl:move=Spam"
                 },
                 "kas_action": "add_mailstandardfilter",
                 "kas_auth_data": "REDACTED",
diff --git a/testdata/mailfilter/add_mailstandardfilter_response_success.xml b/testdata/mailfilter/add_mailstandardfilter_response_success.xml
index 69efb85..cd2e42c 100644
--- a/testdata/mailfilter/add_mailstandardfilter_response_success.xml
+++ b/testdata/mailfilter/add_mailstandardfilter_response_success.xml
@@ -8,7 +8,7 @@
                     <value xsi:type="ns2:Map">
                         <item>
                             <key xsi:type="xsd:string">KasRequestTime</key>
-                            <value xsi:type="xsd:int">1777744000</value>
+                            <value xsi:type="xsd:int">1779530157</value>
                         </item>
                         <item>
                             <key xsi:type="xsd:string">KasRequestType</key>
@@ -23,7 +23,7 @@
                                 </item>
                                 <item>
                                     <key xsi:type="xsd:string">filter</key>
-                                    <value xsi:type="xsd:string">spamfilter:reject;virusfilter:reject</value>
+                                    <value xsi:type="xsd:string">pdw;virus_mark;spamc_move:move=Spam;rspamd:move=Spam;brbl:move=Spam;rbl_cbl:move=Spam;scbl:move=Spam</value>
                                 </item>
                             </value>
                         </item>
@@ -44,24 +44,9 @@
                             <key xsi:type="xsd:string">ReturnInfo</key>
                             <value xsi:type="xsd:string"></value>
                         </item>
-                        <item>
-                            <key xsi:type="xsd:string">Msg</key>
-                            <value SOAP-ENC:arrayType="ns2:Map[1]" xsi:type="SOAP-ENC:Array">
-                                <item xsi:type="ns2:Map">
-                                    <item>
-                                        <key xsi:type="xsd:string">type</key>
-                                        <value xsi:type="xsd:string">success</value>
-                                    </item>
-                                    <item>
-                                        <key xsi:type="xsd:string">text</key>
-                                        <value xsi:type="xsd:string">The standard filter has been created.</value>
-                                    </item>
-                                </item>
-                            </value>
-                        </item>
                     </value>
                 </item>
             </return>
         </ns1:KasApiResponse>
     </SOAP-ENV:Body>
-</SOAP-ENV:Envelope>
+</SOAP-ENV:Envelope>
\ No newline at end of file
diff --git a/testdata/mailfilter/get_mailstandardfilter_response_success.xml b/testdata/mailfilter/get_mailstandardfilter_response_success.xml
index 4b93600..67fdc9d 100644
--- a/testdata/mailfilter/get_mailstandardfilter_response_success.xml
+++ b/testdata/mailfilter/get_mailstandardfilter_response_success.xml
@@ -8,7 +8,7 @@
                     <value xsi:type="ns2:Map">
                         <item>
                             <key xsi:type="xsd:string">KasRequestTime</key>
-                            <value xsi:type="xsd:int">1777745066</value>
+                            <value xsi:type="xsd:int">1779527701</value>
                         </item>
                         <item>
                             <key xsi:type="xsd:string">KasRequestType</key>
diff --git a/testdata/response_failed_internal_server_error.xml b/testdata/response_failed_internal_server_error.xml
new file mode 100644
index 0000000..0b6ed34
--- /dev/null
+++ b/testdata/response_failed_internal_server_error.xml
@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/">
+    <SOAP-ENV:Body>
+        <SOAP-ENV:Fault>
+            <faultcode>SOAP-ENV:Server</faultcode>
+            <faultstring>sizeof(): Argument #1 ($value) must be of type Countable|array, null given</faultstring>
+        </SOAP-ENV:Fault>
+    </SOAP-ENV:Body>
+</SOAP-ENV:Envelope>
\ No newline at end of file

From 40a063a50f523284a9abc47d31b6f7bcbcf1306d Mon Sep 17 00:00:00 2001
From: Alexander Saal <developer@kasapi-cli.chm-projects.de>
Date: Sat, 23 May 2026 15:58:33 +0200
Subject: [PATCH 2/2] fix(mailfilter): validate --filter chain before dry-run /
 audit emission

Post-#189-review blocker fix. AddParams previously joined the items
internally and discarded the JoinFilters error via blank assignment,
so a CLI dry-run / audit record could capture filter="" when the
user passed an empty --filter item or one containing the ';'
separator, while the dispatched Add call would later fail validation.
The audit log and the action it logs must not diverge.

- AddParams now takes the already-joined chain string and is a pure
  map builder; JoinFilters stays the single validator.
- Client.Add validates as before and routes through AddParams once
  joined.
- The CLI runWriteE closure validates via JoinFilters before building
  the writeSpec, so an invalid item produces a user error before the
  dry-run preview, the audit record or the prompt fire.
- TestMailFiltersAddRejectsBadFilter pins the new behaviour (empty
  item / embedded ';' both rejected; --dry-run --yes still runs the
  validator before any audit emission), TestParamBuilders aligned with
  the new AddParams signature.
---
 internal/cli/mail.go              | 10 +++++-
 internal/cli/mail_test.go         | 60 +++++++++++++++++++++++--------
 internal/mailfilter/write.go      | 23 +++++-------
 internal/mailfilter/write_test.go |  2 +-
 4 files changed, 64 insertions(+), 31 deletions(-)

diff --git a/internal/cli/mail.go b/internal/cli/mail.go
index 57a4e31..cc567e9 100644
--- a/internal/cli/mail.go
+++ b/internal/cli/mail.go
@@ -227,12 +227,20 @@ Use "mail filters list" for the available filter ids.`,
 			if len(items) == 0 {
 				return writeSpec{}, fmt.Errorf("at least one --filter is required")
 			}
+			// Validate + join here, before the writeSpec is built, so the
+			// dry-run preview and the audit record see the exact chain
+			// string that will be dispatched and an invalid item cannot
+			// reach the audit log with a silently-empty filter field.
+			chain, err := mailfilter.JoinFilters(items)
+			if err != nil {
+				return writeSpec{}, err
+			}
 			login := args[0]
 			return writeSpec{
 				action:      "add_mailstandardfilter",
 				destructive: true,
 				confirm:     ConfirmAction{Verb: "replace the standard-filter chain of", Resource: "mail account", ID: login},
-				params:      mailfilter.AddParams(login, items),
+				params:      mailfilter.AddParams(login, chain),
 				dispatch: func(c *api.Client, ctx context.Context) (string, error) {
 					if derr := mailfilter.NewClient(c).Add(ctx, login, items); derr != nil {
 						return "", derr
diff --git a/internal/cli/mail_test.go b/internal/cli/mail_test.go
index f56c3b5..0d53d04 100644
--- a/internal/cli/mail_test.go
+++ b/internal/cli/mail_test.go
@@ -367,23 +367,53 @@ func TestMailFiltersHelpListsSubcommands(t *testing.T) {
 	}
 }
 
-// add_mailstandardfilter without --filter is rejected at build time
-// (before any gating or credential resolution) — the KAS API would
-// otherwise fault missing_parameter.
-func TestMailFiltersAddRejectsNoFilter(t *testing.T) {
+// add_mailstandardfilter without --filter, or with a malformed --filter
+// (empty item, embedded ';'), is rejected at build time before any
+// gating, credential resolution OR audit/dry-run record is emitted —
+// the KAS API would otherwise fault missing_parameter or accept a
+// silently-mangled chain. The dry-run + --yes path is asserted
+// explicitly so the validation runs even when the user is wired up for
+// non-interactive automation.
+func TestMailFiltersAddRejectsBadFilter(t *testing.T) {
 	t.Parallel()
-	root, opts := cli.NewRootCmd()
-	root.AddCommand(cli.NewMailCmd(opts))
-	var buf bytes.Buffer
-	root.SetOut(&buf)
-	root.SetErr(&buf)
-	root.SetArgs([]string{"mail", "filters", "add", "m0000001"})
-	err := root.Execute()
-	if err == nil {
-		t.Fatalf("Execute: want error, got nil")
+	cases := []struct {
+		name string
+		args []string
+	}{
+		{
+			"no --filter",
+			[]string{"mail", "filters", "add", "m0000001"},
+		},
+		{
+			"empty --filter item",
+			[]string{"mail", "filters", "add", "m0000001", "--filter", ""},
+		},
+		{
+			"--filter contains ';'",
+			[]string{"mail", "filters", "add", "m0000001", "--filter", "pdw;virus_mark"},
+		},
 	}
-	if cli.CodeFor(err) != cli.ExitUserError {
-		t.Errorf("exit code = %d, want ExitUserError", cli.CodeFor(err))
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			t.Parallel()
+			root, opts := cli.NewRootCmd()
+			root.AddCommand(cli.NewMailCmd(opts))
+			var buf bytes.Buffer
+			root.SetOut(&buf)
+			root.SetErr(&buf)
+			// --dry-run + --yes would otherwise skip the prompt and emit
+			// an audit record — assert the validator still runs first.
+			root.SetArgs(append(append([]string{}, c.args...),
+				"--dry-run", "--yes",
+				"--login", "w0000000", "--auth-data", "x", "--auth-type", "plain"))
+			err := root.Execute()
+			if err == nil {
+				t.Fatalf("Execute %v: want error, got nil", c.args)
+			}
+			if cli.CodeFor(err) != cli.ExitUserError {
+				t.Errorf("exit code = %d, want ExitUserError", cli.CodeFor(err))
+			}
+		})
 	}
 }
 
diff --git a/internal/mailfilter/write.go b/internal/mailfilter/write.go
index 2d3c808..55e803c 100644
--- a/internal/mailfilter/write.go
+++ b/internal/mailfilter/write.go
@@ -69,23 +69,18 @@ func (cl *Client) Add(ctx context.Context, mailLogin string, filterItems []strin
 	if err != nil {
 		return err
 	}
-	_, err = kaswrite.Call(ctx, cl.c, "mailfilter", addAction, map[string]any{
-		FieldMailLogin: mailLogin,
-		FieldFilter:    chain,
-	})
+	_, err = kaswrite.Call(ctx, cl.c, "mailfilter", addAction, AddParams(mailLogin, chain))
 	return err
 }
 
-// AddParams builds the add_mailstandardfilter KAS request parameter map.
-// It is the single source of truth for the request shape so the CLI
-// dry-run preview / audit record and the dispatched call cannot diverge.
-// The filter chain is joined by JoinFilters; an empty or malformed slice
-// surfaces as an error there, but AddParams itself returns the params
-// nil-tolerant (an empty chain string) so callers that already validated
-// can build the map without re-checking. Real callers go through Add,
-// which validates first.
-func AddParams(mailLogin string, filterItems []string) map[string]any {
-	chain, _ := JoinFilters(filterItems)
+// AddParams builds the add_mailstandardfilter KAS request parameter map
+// from an already-joined chain string. It is the single source of truth
+// for the request shape so the CLI dry-run preview / audit record and
+// the dispatched call cannot diverge. Callers obtain the chain from
+// JoinFilters (which validates the items and rejects empties /
+// embedded ';' separators) so an invalid slice cannot silently produce
+// an empty chain string here.
+func AddParams(mailLogin, chain string) map[string]any {
 	return map[string]any{
 		FieldMailLogin: mailLogin,
 		FieldFilter:    chain,
diff --git a/internal/mailfilter/write_test.go b/internal/mailfilter/write_test.go
index abd1afd..44e75dd 100644
--- a/internal/mailfilter/write_test.go
+++ b/internal/mailfilter/write_test.go
@@ -171,7 +171,7 @@ func TestWritePropagatesError(t *testing.T) {
 
 func TestParamBuilders(t *testing.T) {
 	t.Parallel()
-	addParams := mailfilter.AddParams("m0000001", []string{"pdw", "virus_mark"})
+	addParams := mailfilter.AddParams("m0000001", "pdw;virus_mark")
 	if got, _ := addParams["mail_login"].(string); got != "m0000001" {
 		t.Errorf("AddParams[mail_login] = %v, want m0000001", addParams["mail_login"])
 	}