@bobfrankston/mailx-store 0.1.35 → 0.1.37

package/db.d.ts

@@ -371,6 +371,27 @@ export declare class MailxDB {
      *  here but NOT on the server gets its membership dropped (which
      *  may then GC the messages row if it has no other folders). */
     getUidsForFolder(_accountId: string, folderId: number): number[];
+    /** List recent rows in a folder for a Sent-sweep / reconciliation pass.
+     *  Returns only the columns the sweeper needs (uid, message_id, date,
+     *  subject, size, has_attachments, preview, body_path) for every row in
+     *  the given folder cached after `sinceMs`. Empty-message-id rows are
+     *  excluded because the sweep keys on Message-ID. */
+    getRecentMessagesByCachedAt(accountId: string, folderId: number, sinceMs: number): {
+        uid: number;
+        message_id: string;
+        date: number;
+        subject: string;
+        size: number;
+        has_attachments: number;
+        preview: string;
+        body_path: string;
+    }[];
+    /** Rebind a local row to a different server UID without re-upserting.
+     *  Used by the Sent-sweep to repair optimistic-insert mispredictions
+     *  (local row was inserted at the predicted UIDNEXT but the server
+     *  appended at a different real UID). Idempotent: if no row matches
+     *  (already rebound by an earlier sync), it's a no-op. */
+    updateMessageUid(accountId: string, folderId: number, oldUid: number, newUid: number): void;
     /** Delete a message by account + UID. Reason is propagated into the
      *  audit_log so the DB carries an authoritative trail of every removal. */
     deleteMessage(accountId: string, uid: number, reason?: string, source?: string): void;

package/db.js

@@ -1977,6 +1977,41 @@ export class MailxDB {
         const rows = this.db.prepare("SELECT uid FROM message_folders WHERE folder_id = ?").all(folderId);
         return rows.map(r => r.uid);
     }
+    /** List recent rows in a folder for a Sent-sweep / reconciliation pass.
+     *  Returns only the columns the sweeper needs (uid, message_id, date,
+     *  subject, size, has_attachments, preview, body_path) for every row in
+     *  the given folder cached after `sinceMs`. Empty-message-id rows are
+     *  excluded because the sweep keys on Message-ID. */
+    getRecentMessagesByCachedAt(accountId, folderId, sinceMs) {
+        return this.db.prepare(`SELECT uid, message_id, date, subject, size, has_attachments, preview, body_path
+             FROM messages
+             WHERE account_id = ? AND folder_id = ? AND cached_at >= ?
+               AND message_id IS NOT NULL AND message_id <> ''`).all(accountId, folderId, sinceMs);
+    }
+    /** Rebind a local row to a different server UID without re-upserting.
+     *  Used by the Sent-sweep to repair optimistic-insert mispredictions
+     *  (local row was inserted at the predicted UIDNEXT but the server
+     *  appended at a different real UID). Idempotent: if no row matches
+     *  (already rebound by an earlier sync), it's a no-op. */
+    updateMessageUid(accountId, folderId, oldUid, newUid) {
+        if (oldUid === newUid)
+            return;
+        try {
+            this.db.prepare(`UPDATE messages SET uid = ?, cached_at = ?
+                 WHERE account_id = ? AND folder_id = ? AND uid = ?`).run(newUid, Date.now(), accountId, folderId, oldUid);
+        }
+        catch (e) {
+            // UNIQUE constraint can fire when both old and new UIDs already
+            // exist in the row set (newer sync re-fetched the real UID).
+            // Drop the stale predicted row in that case.
+            if (/UNIQUE/i.test(e?.message || "")) {
+                this.db.prepare(`DELETE FROM messages WHERE account_id = ? AND folder_id = ? AND uid = ?`).run(accountId, folderId, oldUid);
+            }
+            else {
+                throw e;
+            }
+        }
+    }
     /** Delete a message by account + UID. Reason is propagated into the
      *  audit_log so the DB carries an authoritative trail of every removal. */
     deleteMessage(accountId, uid, reason, source) {

package/file-store.d.ts

@@ -26,7 +26,16 @@ export declare class FileMessageStore implements MessageStore {
     private resolveStored;
     /** Write a new body. Returns a path RELATIVE to basePath; caller stores
      *  it in `body_path`. The (folderId, uid) args are kept for interface
-     *  compatibility; they do NOT affect the filename. */
+     *  compatibility; they do NOT affect the filename.
+     *
+     *  Defensive content check: if the FIRST line of the would-be .eml
+     *  matches an IMAP client-command pattern (`<tag> <UPPERCASE_CMD> ...`),
+     *  the upstream IMAP parser desynced and wrote one of mailx's own
+     *  outbound commands into the response stream — see the
+     *  a39a84e1853441bcac09e1b3e1463e8d.eml corruption (2026-05-23). Refuse
+     *  the write rather than persist garbage that the message-viewer will
+     *  later render as broken. The caller's exception path treats this the
+     *  same as any other transient fetch error; the reconciler re-enqueues. */
     putMessage(accountId: string, _folderId: number, _uid: number, raw: Buffer): Promise<string>;
     /** Resolve a stored body_path (relative or absolute) to an absolute
      *  filesystem path. Returns "" if the input doesn't resolve to a file

package/file-store.js

@@ -43,8 +43,33 @@ export class FileMessageStore {
     }
     /** Write a new body. Returns a path RELATIVE to basePath; caller stores
      *  it in `body_path`. The (folderId, uid) args are kept for interface
-     *  compatibility; they do NOT affect the filename. */
+     *  compatibility; they do NOT affect the filename.
+     *
+     *  Defensive content check: if the FIRST line of the would-be .eml
+     *  matches an IMAP client-command pattern (`<tag> <UPPERCASE_CMD> ...`),
+     *  the upstream IMAP parser desynced and wrote one of mailx's own
+     *  outbound commands into the response stream — see the
+     *  a39a84e1853441bcac09e1b3e1463e8d.eml corruption (2026-05-23). Refuse
+     *  the write rather than persist garbage that the message-viewer will
+     *  later render as broken. The caller's exception path treats this the
+     *  same as any other transient fetch error; the reconciler re-enqueues. */
     async putMessage(accountId, _folderId, _uid, raw) {
+        if (raw.length >= 6) {
+            // Look at the first ≤512 bytes to spot a leaked IMAP command.
+            // Pattern: optional CRLFs, then `<tag> <CMD> ...` where tag
+            // starts with a letter+digits (iflow tags are like `A123`,
+            // `B47`) and CMD is all-caps with at least 4 chars.
+            const sniff = raw.subarray(0, Math.min(512, raw.length)).toString("ascii");
+            const firstNonBlank = sniff.replace(/^\s+/, "");
+            // Strict: tag is letter + digits, then a space, then an
+            // all-caps IMAP command keyword. Real RFC822 headers can't
+            // match because they require a `Name: value` shape (colon),
+            // and `Return-Path:`, `Received:`, `Subject:` etc. are
+            // capitalized but include a colon and mixed case in tokens.
+            if (/^[A-Z]+\d+ (UID )?(FETCH|SEARCH|STORE|COPY|MOVE|EXPUNGE|SELECT|EXAMINE|APPEND|LIST|LSUB|STATUS|NOOP|IDLE|DONE|LOGIN|LOGOUT|CAPABILITY|AUTHENTICATE)\b/.test(firstNonBlank)) {
+                throw new Error(`putMessage: refusing to write corrupt body — IMAP command leaked into response stream (first line: ${firstNonBlank.split(/\r?\n/)[0].substring(0, 100)})`);
+            }
+        }
         const rel = this.newRelativePath(accountId);
         const abs = path.join(this.basePath, rel);
         fs.mkdirSync(path.dirname(abs), { recursive: true });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bobfrankston/mailx-store",
-  "version": "0.1.35",
+  "version": "0.1.37",
   "type": "module",
   "main": "index.js",
   "types": "index.d.ts",