@cosmicdrift/kumiko-bundled-features 0.392.2 → 0.394.0

package/dist/inbound-mail-foundation/handlers/ingest-message-prepare.js

@@ -0,0 +1,131 @@
+// Pre-transaction half of the content storage: original and attachments are written while no
+// transaction holds a connection, so a slow or failing file store never pins the database. The
+// handler transaction only creates the fileRef rows (finalizePreparedContent).
+import { writeFailure } from "@cosmicdrift/kumiko-framework/errors";
+import { createFileRefFromUploadedBytes, uploadFileBytesBeforeTransaction, } from "@cosmicdrift/kumiko-framework/files";
+import { inboundMessageAggregateId } from "../aggregate-id.js";
+import { seenMessageTable } from "../entities.js";
+import { FileStorageWriteFailedError } from "../file-storage-failure.js";
+import { INBOUND_SKIPPED_ATTACHMENTS_MAX_COUNT } from "../normalize-inbound-message.js";
+import { contentWithoutFileStorage, inboundAttachmentMaxSize, inboundAttachmentTarget, inboundMessageBodyKey, originalOf, } from "./message-content.js";
+function storageFailure(cause) {
+    return writeFailure(new FileStorageWriteFailedError(cause instanceof Error ? cause : undefined));
+}
+async function releaseAll(releases) {
+    for (const release of releases)
+        await release();
+}
+// The deterministic original key is never released: a concurrent winner owns it and writing it
+// again is idempotent.
+export async function prepareInboundContent(ctx, input) {
+    const { files } = ctx.services;
+    if (!files) {
+        const unavailable = contentWithoutFileStorage(input);
+        return {
+            isSuccess: true,
+            data: {
+                bodyRef: unavailable.bodyRef,
+                uploads: [],
+                skippedAttachments: unavailable.skippedAttachments,
+                contentStorage: unavailable.contentStorage,
+            },
+        };
+    }
+    let bodyRef = input.bodyRef;
+    const original = originalOf(input);
+    if (bodyRef === "" && original) {
+        bodyRef = inboundMessageBodyKey(ctx.user.tenantId, input.accountId, input.messageAggId, original.extension);
+        try {
+            await files.ref(bodyRef).write(original.data, original.mimeType);
+        }
+        catch (err) {
+            return storageFailure(err);
+        }
+    }
+    const uploads = [];
+    const releases = [];
+    const skipped = [...(input.skippedAttachments ?? [])];
+    const maxSize = inboundAttachmentMaxSize(ctx.registry);
+    for (const attachment of input.attachments ?? []) {
+        let uploaded;
+        try {
+            uploaded = await uploadFileBytesBeforeTransaction(ctx, {
+                fileName: attachment.fileName,
+                mimeType: attachment.mimeType,
+                data: attachment.data,
+                attachTo: inboundAttachmentTarget(input.messageAggId),
+                maxSize,
+            });
+        }
+        catch (err) {
+            await releaseAll(releases);
+            return storageFailure(err);
+        }
+        // A rejected attachment (size, MIME) is a property of the mail, not an outage.
+        if (!uploaded.isSuccess) {
+            skipped.push({
+                mimeType: attachment.mimeType,
+                size: attachment.data.byteLength,
+                reason: "rejected",
+            });
+            continue;
+        }
+        uploads.push(uploaded.data);
+        if (uploaded.release)
+            releases.push(uploaded.release);
+    }
+    return {
+        isSuccess: true,
+        data: {
+            bodyRef,
+            uploads,
+            skippedAttachments: skipped.slice(0, INBOUND_SKIPPED_ATTACHMENTS_MAX_COUNT),
+            contentStorage: "stored",
+        },
+        release: () => releaseAll(releases),
+    };
+}
+/** Transaction half: creates the fileRef rows for the bytes the prepare phase wrote. */
+export async function finalizePreparedContent(ctx, prepared) {
+    const attachmentFileIds = [];
+    const skipped = [...prepared.skippedAttachments];
+    for (const upload of prepared.uploads) {
+        const created = await createFileRefFromUploadedBytes(ctx, upload);
+        if (created.isSuccess)
+            attachmentFileIds.push(created.data.id);
+        else
+            skipped.push({ mimeType: upload.mimeType, size: upload.size, reason: "rejected" });
+    }
+    return {
+        bodyRef: prepared.bodyRef,
+        attachmentFileIds,
+        skippedAttachments: skipped.slice(0, INBOUND_SKIPPED_ATTACHMENTS_MAX_COUNT),
+        contentStorage: prepared.contentStorage,
+    };
+}
+/** Dedup read first: a duplicate uploads nothing. The in-transaction dedup stays the correctness anchor. */
+export async function prepareIngestMessage(event, ctx) {
+    const { payload } = event;
+    const seen = await ctx.db.selectMany(seenMessageTable, {
+        accountId: payload.accountId,
+        providerMessageId: payload.providerMessageId,
+    });
+    if (seen.length > 0)
+        return { isSuccess: true, data: { duplicate: true } };
+    const prepared = await prepareInboundContent(ctx, {
+        accountId: payload.accountId,
+        messageAggId: inboundMessageAggregateId(payload.accountId, payload.providerMessageId),
+        bodyRef: payload.bodyRef,
+        rawMime: payload.rawMime,
+        bodyHtml: payload.bodyHtml,
+        attachments: payload.attachments,
+        skippedAttachments: payload.skippedAttachments,
+    });
+    if (!prepared.isSuccess)
+        return prepared;
+    return {
+        isSuccess: true,
+        data: { duplicate: false, content: prepared.data },
+        ...(prepared.release && { release: prepared.release }),
+    };
+}

package/dist/inbound-mail-foundation/handlers/ingest-message-schema.d.ts

@@ -0,0 +1,64 @@
+import * as z from "zod";
+export declare const ingestMessageSchema: z.ZodObject<{
+    bodyText: z.ZodDefault<z.ZodString>;
+    bodyTextTruncated: z.ZodDefault<z.ZodBoolean>;
+    rawMime: z.ZodOptional<z.ZodInstanceOf<Uint8Array<ArrayBuffer>>>;
+    bodyHtml: z.ZodOptional<z.ZodString>;
+    attachments: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        fileName: z.ZodString;
+        mimeType: z.ZodString;
+        data: z.ZodInstanceOf<Uint8Array<ArrayBuffer>>;
+    }, z.core.$strip>>>;
+    skippedAttachments: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        mimeType: z.ZodString;
+        size: z.ZodNumber;
+        reason: z.ZodEnum<{
+            mail_too_large: "mail_too_large";
+            nesting_too_deep: "nesting_too_deep";
+            no_file_storage: "no_file_storage";
+            rejected: "rejected";
+            too_large: "too_large";
+        }>;
+    }, z.core.$strip>>>;
+    accountId: z.ZodUUID;
+    ownerUserId: z.ZodNullable<z.ZodString>;
+    providerName: z.ZodString;
+    providerMessageId: z.ZodString;
+    messageIdHeader: z.ZodNullable<z.ZodString>;
+    providerThreadId: z.ZodNullable<z.ZodString>;
+    references: z.ZodArray<z.ZodString>;
+    from: z.ZodString;
+    to: z.ZodArray<z.ZodString>;
+    cc: z.ZodArray<z.ZodString>;
+    subject: z.ZodString;
+    snippet: z.ZodString;
+    receivedAtIso: z.ZodString;
+    bodyRef: z.ZodString;
+    scope: z.ZodString;
+    providerCursor: z.ZodString;
+    senderAuthentication: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+        authservId: z.ZodString;
+        spf: z.ZodEnum<{
+            fail: "fail";
+            none: "none";
+            pass: "pass";
+            unknown: "unknown";
+        }>;
+        dkim: z.ZodEnum<{
+            fail: "fail";
+            none: "none";
+            pass: "pass";
+            unknown: "unknown";
+        }>;
+        dkimDomains: z.ZodArray<z.ZodString>;
+        dmarc: z.ZodEnum<{
+            fail: "fail";
+            none: "none";
+            pass: "pass";
+            unknown: "unknown";
+        }>;
+        fromDomain: z.ZodString;
+    }, z.core.$strip>>>;
+    contentUnavailableReason: z.ZodOptional<z.ZodLiteral<"quarantined">>;
+}, z.core.$strip>;
+export type IngestMessagePayload = z.infer<typeof ingestMessageSchema>;

package/dist/inbound-mail-foundation/handlers/ingest-message-schema.js

@@ -0,0 +1,39 @@
+import * as z from "zod";
+import { senderAuthenticationFieldSchema } from "../sender-auth.js";
+import { inboundContentPayloadShape } from "./message-content.js";
+// =============================================================================
+// Input schema — the normalized provider output (RawInboundMessage,
+// types.ts) plus the envelope (accountId/providerName/providerCursor). The
+// original and attachments ride in-process as bytes and are persisted to file
+// storage here; the event itself stays blob-free (references only).
+// =============================================================================
+export const ingestMessageSchema = z.object({
+    accountId: z.uuid(),
+    /** Scope inherited from the account — the supervisor knows the
+     *  MailAccountRecord and passes ownerUserId through. */
+    ownerUserId: z.string().max(36).nullable(),
+    providerName: z.string().min(1).max(50),
+    /** Provider-native Message-ID — idempotency anchor with accountId. */
+    providerMessageId: z.string().min(1).max(500),
+    /** RFC-5322 Message-ID without <>; null → deterministic fallback. */
+    messageIdHeader: z.string().min(1).max(500).nullable(),
+    providerThreadId: z.string().min(1).max(500).nullable(),
+    /** References/In-Reply-To chain, oldest first. */
+    references: z.array(z.string().min(1).max(500)).max(200),
+    from: z.string().min(1).max(2000),
+    to: z.array(z.string().max(2000)).max(200),
+    cc: z.array(z.string().max(2000)).max(200),
+    subject: z.string().max(4000),
+    snippet: z.string().max(4000),
+    receivedAtIso: z.string().min(1),
+    /** From the app's storeBody hook; empty lets the handler store the original itself. */
+    bodyRef: z.string().max(500),
+    scope: z.string().min(1).max(200),
+    /** Cursor snapshot at ingest time — used for debugging/replay and stored in
+     *  metadata.headers, never in the payload. */
+    providerCursor: z.string().max(2000),
+    senderAuthentication: senderAuthenticationFieldSchema.optional(),
+    /** Set when the message is imported from its headers only because it sits in quarantine. */
+    contentUnavailableReason: z.literal("quarantined").optional(),
+    ...inboundContentPayloadShape,
+});

package/dist/inbound-mail-foundation/handlers/ingest-message.write.d.ts

@@ -1,21 +1,74 @@
-import type { WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
-import * as z from "zod";
-export declare const ingestMessageSchema: z.ZodObject<{
-    accountId: z.ZodUUID;
-    ownerUserId: z.ZodNullable<z.ZodString>;
-    providerName: z.ZodString;
-    providerMessageId: z.ZodString;
-    messageIdHeader: z.ZodNullable<z.ZodString>;
-    providerThreadId: z.ZodNullable<z.ZodString>;
-    references: z.ZodArray<z.ZodString>;
-    from: z.ZodString;
-    to: z.ZodArray<z.ZodString>;
-    cc: z.ZodArray<z.ZodString>;
-    subject: z.ZodString;
-    snippet: z.ZodString;
-    receivedAtIso: z.ZodString;
-    bodyRef: z.ZodString;
-    scope: z.ZodString;
-    providerCursor: z.ZodString;
-}, z.core.$strip>;
-export declare const ingestMessageHandler: WriteHandlerDef;
+import { type PreparedIngest } from "./ingest-message-prepare.ts";
+type IngestMessageData = {
+    readonly duplicate: true;
+    readonly inboundMessageAggregateId: string;
+} | {
+    readonly duplicate: false;
+    readonly inboundMessageAggregateId: string;
+    readonly threadAggregateId: string;
+    readonly threadKey: string;
+    readonly contentStorage: "stored" | "unavailable";
+};
+export declare const ingestMessageHandler: import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"ingest-message", import("zod").ZodObject<{
+    bodyText: import("zod").ZodDefault<import("zod").ZodString>;
+    bodyTextTruncated: import("zod").ZodDefault<import("zod").ZodBoolean>;
+    rawMime: import("zod").ZodOptional<import("zod").ZodInstanceOf<Uint8Array<ArrayBuffer>>>;
+    bodyHtml: import("zod").ZodOptional<import("zod").ZodString>;
+    attachments: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodObject<{
+        fileName: import("zod").ZodString;
+        mimeType: import("zod").ZodString;
+        data: import("zod").ZodInstanceOf<Uint8Array<ArrayBuffer>>;
+    }, import("zod/v4/core").$strip>>>;
+    skippedAttachments: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodObject<{
+        mimeType: import("zod").ZodString;
+        size: import("zod").ZodNumber;
+        reason: import("zod").ZodEnum<{
+            mail_too_large: "mail_too_large";
+            nesting_too_deep: "nesting_too_deep";
+            no_file_storage: "no_file_storage";
+            rejected: "rejected";
+            too_large: "too_large";
+        }>;
+    }, import("zod/v4/core").$strip>>>;
+    accountId: import("zod").ZodUUID;
+    ownerUserId: import("zod").ZodNullable<import("zod").ZodString>;
+    providerName: import("zod").ZodString;
+    providerMessageId: import("zod").ZodString;
+    messageIdHeader: import("zod").ZodNullable<import("zod").ZodString>;
+    providerThreadId: import("zod").ZodNullable<import("zod").ZodString>;
+    references: import("zod").ZodArray<import("zod").ZodString>;
+    from: import("zod").ZodString;
+    to: import("zod").ZodArray<import("zod").ZodString>;
+    cc: import("zod").ZodArray<import("zod").ZodString>;
+    subject: import("zod").ZodString;
+    snippet: import("zod").ZodString;
+    receivedAtIso: import("zod").ZodString;
+    bodyRef: import("zod").ZodString;
+    scope: import("zod").ZodString;
+    providerCursor: import("zod").ZodString;
+    senderAuthentication: import("zod").ZodOptional<import("zod").ZodNullable<import("zod").ZodObject<{
+        authservId: import("zod").ZodString;
+        spf: import("zod").ZodEnum<{
+            fail: "fail";
+            none: "none";
+            pass: "pass";
+            unknown: "unknown";
+        }>;
+        dkim: import("zod").ZodEnum<{
+            fail: "fail";
+            none: "none";
+            pass: "pass";
+            unknown: "unknown";
+        }>;
+        dkimDomains: import("zod").ZodArray<import("zod").ZodString>;
+        dmarc: import("zod").ZodEnum<{
+            fail: "fail";
+            none: "none";
+            pass: "pass";
+            unknown: "unknown";
+        }>;
+        fromDomain: import("zod").ZodString;
+    }, import("zod/v4/core").$strip>>>;
+    contentUnavailableReason: import("zod").ZodOptional<import("zod").ZodLiteral<"quarantined">>;
+}, import("zod/v4/core").$strip>, IngestMessageData, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, PreparedIngest, "skip">;
+export {};

package/dist/inbound-mail-foundation/handlers/ingest-message.write.js

@@ -2,11 +2,14 @@
 // (watch callback + fetchSince sync). Accepts a normalized
 // RawInboundMessage and performs atomically in ONE TX:
 //
+//   0. Per-message advisory lock, so a watch/poll race cannot store the same
+//      content twice (orphaned FileRefs) before the dedup checks run.
 //   1. Idempotency check (cheap: store_mail_seen_messages; defense in
 //      depth: stream existence check on the deterministic aggregateId).
 //   2. threadKey normalization (provider thread ID preferred, otherwise
 //      References chain root, otherwise Message-ID = single-message thread).
-//   3. PII encryption (from/to/cc/subject/snippet) BEFORE the append —
+//   3. Content storage (original + attachments, only after dedup) and PII
+//      encryption (from/to/cc/subject/snippet/bodyText) BEFORE the append —
 //      both the event log AND projection contain ciphertext.
 //   4. inbound-message-received append (inline projection writes
 //      read_inbound_messages in the same TX). Savepoint-scoped
@@ -20,71 +23,17 @@
 // SystemAdmin-only: the caller is the watch/sync supervisor or
 // the poll cron with a programmatic SystemUser — never a tenant request.
 import { configuredPiiSubjectKms, encryptPiiFieldValues, } from "@cosmicdrift/kumiko-framework/crypto";
-import { acquireNamespacedAdvisoryLock, countWhere } from "@cosmicdrift/kumiko-framework/db";
-import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
+import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
-import * as z from "zod";
 import { inboundMessageAggregateId, mailThreadAggregateId } from "../aggregate-id.js";
-import { INBOUND_MESSAGE_PII_FIELDS, inboundMessageEntity, MAIL_THREAD_PII_FIELDS, mailThreadEntity, seenMessageTable, } from "../entities.js";
-import { INBOUND_MESSAGE_AGGREGATE_TYPE, INBOUND_MESSAGE_RECEIVED_EVENT_QN, MAIL_THREAD_AGGREGATE_TYPE, MAIL_THREAD_UPDATED_EVENT_QN, } from "../events.js";
-import { inboundMessagesProjectionTable } from "../projection.js";
-// =============================================================================
-// Input schema — the normalized provider output (RawInboundMessage,
-// types.ts) plus the envelope (accountId/providerName/providerCursor). rawMime
-// is intentionally excluded: the caller persists the body to
-// file-foundation BEFORE the ingest call and passes only bodyRef — the
-// handler payload remains blob-free (event-store discipline).
-// =============================================================================
-export const ingestMessageSchema = z.object({
-    accountId: z.uuid(),
-    /** Scope inherited from the account — the supervisor knows the
-     *  MailAccountRecord and passes ownerUserId through. */
-    ownerUserId: z.string().max(36).nullable(),
-    providerName: z.string().min(1).max(50),
-    /** Provider-native Message-ID — idempotency anchor with accountId. */
-    providerMessageId: z.string().min(1).max(500),
-    /** RFC-5322 Message-ID without <>; null → deterministic fallback. */
-    messageIdHeader: z.string().min(1).max(500).nullable(),
-    providerThreadId: z.string().min(1).max(500).nullable(),
-    /** References/In-Reply-To chain, oldest first. */
-    references: z.array(z.string().min(1).max(500)).max(200),
-    from: z.string().min(1).max(2000),
-    to: z.array(z.string().max(2000)).max(200),
-    cc: z.array(z.string().max(2000)).max(200),
-    subject: z.string().max(4000),
-    snippet: z.string().max(4000),
-    receivedAtIso: z.string().min(1),
-    /** file-foundation-Ref; leer im snippet-only-Mode. */
-    bodyRef: z.string().max(500),
-    scope: z.string().min(1).max(200),
-    /** Cursor snapshot at ingest time — used for debugging/replay and stored in
-     *  metadata.headers, never in the payload. */
-    providerCursor: z.string().max(2000),
-});
-/**
- * Normalizes threadKey:
- *   1. Use the provider thread ID when present — prefix it with the provider
- *      so IMAP References keys and Graph conversationIds never collide.
- *   2. Otherwise use the root of the References chain (the oldest Message-ID,
- *      which is the thread anchor shared by all replies).
- *   3. Otherwise use the own Message-ID → single-message thread; a later
- *      reply carries it as the References root and joins the same thread.
- */
-function buildThreadKey(p, effectiveMessageIdHeader) {
-    if (p.providerThreadId)
-        return `${p.providerName}:${p.providerThreadId}`.slice(0, 500);
-    const referencesRoot = p.references[0];
-    if (referencesRoot)
-        return `mid:${referencesRoot}`.slice(0, 500);
-    return `mid:${effectiveMessageIdHeader}`.slice(0, 500);
-}
-const THREAD_ROLLUP_MAX_ATTEMPTS = 5;
-// pg_advisory_xact_lock namespace (int4) for the step-5 thread-rollup lock
-// — 'inbm' as ASCII, keeps it disjoint from the framework's other fixed
-// single-int advisory-lock keys (schema bootstrap, es-ops boot).
-const THREAD_ROLLUP_LOCK_NAMESPACE = 0x696e626d;
+import { INBOUND_MESSAGE_PII_FIELDS, inboundMessageEntity, seenMessageTable } from "../entities.js";
+import { INBOUND_MESSAGE_AGGREGATE_TYPE, INBOUND_MESSAGE_RECEIVED_EVENT_QN, } from "../events.js";
+import { finalizePreparedContent, prepareIngestMessage, } from "./ingest-message-prepare.js";
+import { ingestMessageSchema } from "./ingest-message-schema.js";
+import { contentStateOf, MESSAGE_LOCK_NAMESPACE, storeInboundMessageContent, } from "./message-content.js";
+import { appendThreadRollup, buildThreadKey } from "./thread-rollup.js";
 const THREAD_ROLLUP_ADVISORY_LOCK_REASON = "takes the per-thread advisory lock and counts the caller tenant's thread messages; TenantDb has no lock/count API";
-export const ingestMessageHandler = {
+export const ingestMessageHandler = defineWriteHandler({
     name: "ingest-message",
     schema: ingestMessageSchema,
     access: { roles: ["SystemAdmin"] },
@@ -93,11 +42,14 @@ export const ingestMessageHandler = {
         grants: ["unsafeRaw"],
         reason: THREAD_ROLLUP_ADVISORY_LOCK_REASON,
     },
+    // Nested (an app handler dispatching ingest-message) there is no phase; the handler then stores in its own transaction.
+    beforeTransactionWhenNested: "skip",
+    beforeTransaction: prepareIngestMessage,
     handler: async (event, ctx) => {
-        // @cast-boundary engine-payload — dispatcher-zod-validated payload
-        const payload = event.payload;
+        const { payload } = event;
         const tenantId = event.user.tenantId;
         const messageAggId = inboundMessageAggregateId(payload.accountId, payload.providerMessageId);
+        await ctx.db.advisoryXactLock(MESSAGE_LOCK_NAMESPACE, messageAggId);
         // ---------------------------------------------------------------
         // 1. Idempotency. Use the deduplication anchor row first because it is
         //    cheap. The stream check afterward provides defense in depth if
@@ -142,9 +94,24 @@ export const ingestMessageHandler = {
         //    (primitives only, upcaster-safe). If no KMS is configured, pass
         //    through plaintext (engine-off behavior).
         // ---------------------------------------------------------------
+        const prepared = event.prepared;
+        const content = prepared?.duplicate === false
+            ? await finalizePreparedContent(ctx, prepared.content)
+            : await storeInboundMessageContent(ctx, {
+                accountId: payload.accountId,
+                messageAggId,
+                bodyRef: payload.bodyRef,
+                rawMime: payload.rawMime,
+                bodyHtml: payload.bodyHtml,
+                attachments: payload.attachments,
+                skippedAttachments: payload.skippedAttachments,
+            });
+        const contentUnavailableReason = payload.contentUnavailableReason ??
+            (content.contentStorage === "unavailable" ? "no_file_storage" : null);
         const piiKms = configuredPiiSubjectKms();
         const messagePlainPii = {
             tenantId,
+            bodyText: payload.bodyText,
             from: payload.from,
             to: JSON.stringify(payload.to),
             cc: JSON.stringify(payload.cc),
@@ -169,8 +136,21 @@ export const ingestMessageHandler = {
             subject: encryptedMessageFields.subject,
             snippet: encryptedMessageFields.snippet,
             receivedAtIso: payload.receivedAtIso,
-            bodyRef: payload.bodyRef,
+            bodyRef: content.bodyRef,
             scope: payload.scope,
+            senderAuthentication: payload.senderAuthentication ?? null,
+            bodyText: encryptedMessageFields.bodyText,
+            bodyTextTruncated: payload.bodyTextTruncated,
+            attachmentFileIds: content.attachmentFileIds,
+            skippedAttachments: content.skippedAttachments,
+            contentState: payload.contentUnavailableReason !== undefined
+                ? "unavailable"
+                : contentStateOf({
+                    bodyText: payload.bodyText,
+                    hasOriginal: payload.rawMime !== undefined || payload.bodyHtml !== undefined,
+                    contentStorage: content.contentStorage,
+                }),
+            contentUnavailableReason,
         };
         const messageHeaders = {
             providerMessageId: payload.providerMessageId,
@@ -195,73 +175,15 @@ export const ingestMessageHandler = {
                 data: { duplicate: true, inboundMessageAggregateId: messageAggId },
             };
         }
-        // ---------------------------------------------------------------
-        // 5. Thread-Rollup. New snapshot (live COUNT + max(lastMessageAt)) via
-        //    ctx.events.tryAppend in a bounded retry loop — the apply stays a
-        //    dumb, replay-idempotent UPSERT. lastMessageAtIso is not PII (a
-        //    timestamp), so it stays plaintext-comparable; subject is
-        //    encrypted once up front (constant across retries, doesn't
-        //    depend on the thread's prior state).
-        //
-        //    messageCount is a live COUNT, not previousCount+1, so two
-        //    concurrent ingests on the same thread (Watch-Push vs.
-        //    Poll-Reconciliation overlap, or two different messages of the
-        //    same thread arriving at once) converge on the true count.
-        //    acquireNamespacedAdvisoryLock below serializes this whole
-        //    countWhere+append section per threadAggId — transaction-scoped,
-        //    so it survives events.tryAppend's inner SAVEPOINT and releases at
-        //    the enclosing TX's commit/rollback. Without it, a concurrent
-        //    commit landing between countWhere and events.tryAppend's own fresh
-        //    version-read makes the append succeed with a stale count instead
-        //    of a VersionConflictError, so the retry loop below never sees it
-        //    as a conflict to retry (the original gap). Unlike step 4, a
-        //    lost version-conflict race here must NOT be treated as a no-op
-        //    duplicate — skipping would leave this message's contribution to
-        //    messageCount/lastMessageAt out of the thread forever. Exhausting
-        //    all attempts throws, rolling back the whole TX (including the
-        //    step-4 message append) for a clean re-ingest.
-        // ---------------------------------------------------------------
-        const threadPlainPii = { tenantId, subject: payload.subject };
-        const encryptedThreadFields = piiKms
-            ? await encryptPiiFieldValues(threadPlainPii, mailThreadEntity, MAIL_THREAD_PII_FIELDS, piiKms, {
-                requestId: `inbound-mail-foundation:ingest-message:thread:${threadAggId}`,
-                tenantId,
-            }, { tenantId, entityName: MAIL_THREAD_AGGREGATE_TYPE })
-            : threadPlainPii;
-        const threadRollupRunner = ctx.db.unsafeRaw();
-        await acquireNamespacedAdvisoryLock(threadRollupRunner, THREAD_ROLLUP_LOCK_NAMESPACE, threadAggId);
-        let threadAppendOk = false;
-        for (let attempt = 1; attempt <= THREAD_ROLLUP_MAX_ATTEMPTS && !threadAppendOk; attempt++) {
-            const threadEvents = await ctx.events.load(threadAggId);
-            const lastThreadEvent = threadEvents[threadEvents.length - 1];
-            // @cast-boundary engine-payload — eigene events, shape via defineEvent
-            const previousThread = lastThreadEvent?.payload;
-            const previousLastAt = previousThread?.lastMessageAtIso ?? "";
-            const newLastAt = payload.receivedAtIso > previousLastAt ? payload.receivedAtIso : previousLastAt;
-            const messageCount = await countWhere(threadRollupRunner, inboundMessagesProjectionTable, {
-                tenantId,
-                threadKey,
-            });
-            const threadEventPayload = {
-                threadKey,
-                subject: encryptedThreadFields.subject,
-                lastMessageAtIso: newLastAt,
-                messageCount,
-            };
-            const threadAppend = await ctx.events.tryAppend({
-                aggregateId: threadAggId,
-                aggregateType: MAIL_THREAD_AGGREGATE_TYPE,
-                type: MAIL_THREAD_UPDATED_EVENT_QN,
-                payload: threadEventPayload,
-                headers: messageHeaders,
-            });
-            threadAppendOk = threadAppend.ok;
-        }
-        if (!threadAppendOk) {
-            throw new InternalError({
-                message: `ingest-message: thread-rollup append for "${threadAggId}" lost the version-conflict race ${THREAD_ROLLUP_MAX_ATTEMPTS} times in a row — aborting for a clean re-ingest instead of persisting a stale messageCount.`,
-            });
-        }
+        await appendThreadRollup(ctx, {
+            tenantId,
+            threadAggId,
+            threadKey,
+            subject: payload.subject,
+            receivedAtIso: payload.receivedAtIso,
+            headers: messageHeaders,
+            piiKms,
+        });
         // ---------------------------------------------------------------
         // 6. Deduplication anchor. It runs in the same TX as the appends, so
         //    if the handler fails, everything is rolled back together.
@@ -279,7 +201,8 @@ export const ingestMessageHandler = {
                 inboundMessageAggregateId: messageAggId,
                 threadAggregateId: threadAggId,
                 threadKey,
+                contentStorage: content.contentStorage,
             },
         };
     },
-};
+});

package/dist/inbound-mail-foundation/handlers/list-accounts.query.d.ts

@@ -1,2 +1,3 @@
 import { type QueryHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
-export declare const listAccountsQuery: QueryHandlerDef;
+import type { InboundMailRoles } from "../mail-roles.ts";
+export declare function createListAccountsQuery({ memberRoles, adminRoles, }: InboundMailRoles): QueryHandlerDef;