@cosmicdrift/kumiko-samples 0.393.0 → 0.395.0

package/packages/bundled-features/src/inbound-mail-foundation/supervisor-ingest.ts

@@ -0,0 +1,311 @@
+// Per-message ingest for the sync supervisor. Every message is isolated: a poison mail must not
+// block the cursor of its mailbox, but a systemic outage (database, projection, KMS, file storage,
+// the app's storeBody hook) must not quarantine good mail either.
+//
+//   - permanent rejection (validation/unprocessable) -> quarantine immediately, continue
+//   - provider-side parse failures (`rejected`) -> quarantine "unparseable"
+//   - any other failure -> the batch goes on, then the failure is settled:
+//     - proven (another mail of the account went through in the same poll, for a storage failure
+//       another storage write) -> counted once per poll interval (persisted); the third counted
+//       failure quarantines the mail as "ingest_failed", below that the cursor stays before it
+//     - when every failure of this poll was counted before, they all keep being counted: a
+//       counter row exists only because its mail failed while others went through. A KMS failure
+//       among them voids this, it is never the mail's
+//     - unproven -> nothing is counted, the account is disrupted (degraded with the class of the
+//       failure) and the next interval retries from the same cursor
+//
+// Every quarantine also imports the headers, so the mail stays visible in the inbox.
+
+import { ENCRYPTION_UNAVAILABLE_CODE } from "@cosmicdrift/kumiko-framework/crypto";
+import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import { errorCodeOf, propertyOf } from "@cosmicdrift/kumiko-types/type-guards";
+import { InboundMailFoundationHandlers } from "./constants.ts";
+import { FileStorageWriteFailedError, isFileStorageWriteFailure } from "./file-storage-failure.ts";
+import {
+  clearIngestFailures,
+  countIngestFailure,
+  hasCountedIngestFailure,
+  MAX_COUNTED_INGEST_FAILURES,
+} from "./ingest-failures.ts";
+import { ingestPayloadOf } from "./ingest-payload.ts";
+import { normalizeRawInboundMessage } from "./normalize-inbound-message.ts";
+import { quarantineMessage } from "./quarantine.ts";
+import type { QuarantineReasonCode } from "./quarantine-entities.ts";
+import {
+  headerOnlyOf,
+  headerOnlyOfRejected,
+  importQuarantinedHeaders,
+} from "./quarantine-header-import.ts";
+import type { MailAccountRecord, RawInboundMessage, RejectedInboundMessage } from "./types.ts";
+
+const PERMANENT_ERROR_CODES: ReadonlySet<string> = new Set(["validation_error", "unprocessable"]);
+
+export type DispatchWrite = (args: {
+  readonly handlerQn: string;
+  readonly payload: unknown;
+  readonly tenantId: string;
+}) => Promise<{ readonly isSuccess: boolean; readonly data?: unknown; readonly error?: unknown }>;
+
+export type IngestBlockedReason =
+  | "file_storage_unavailable"
+  | "encryption_unavailable"
+  | "ingest_unavailable"
+  | "message_failing";
+
+/** What earlier batches of the same poll proved to work. */
+export type IngestProof = {
+  /** A mail was newly ingested (a duplicate proves nothing: it returns before any write). */
+  readonly ingested: boolean;
+  /** A content write to file storage or through the storeBody hook went through. */
+  readonly storageHealthy: boolean;
+};
+
+export type IngestBatchOutcome = IngestProof & {
+  readonly quarantinedNew: number;
+  /** True when a message needed file storage and none was available. */
+  readonly storageUnavailable: boolean;
+  /** Set when the batch has an unresolved failure: the cursor must not move past it. */
+  readonly blocked?: IngestBlockedReason;
+};
+
+export type IngestBatchOptions = {
+  /** Poll-interval bucket of a regular tick; absent (wake, manual sync) means failures are not counted. */
+  readonly countBucket?: number;
+  readonly signal?: AbortSignal;
+  readonly proof?: IngestProof;
+};
+
+export type MessageIngester = {
+  readonly ingestBatch: (
+    account: MailAccountRecord,
+    msgs: readonly RawInboundMessage[],
+    rejected: readonly RejectedInboundMessage[],
+    cursorSnapshot: string,
+    options?: IngestBatchOptions,
+  ) => Promise<IngestBatchOutcome>;
+};
+
+type IngesterDeps = {
+  readonly db: DbConnection;
+  readonly dispatchWrite: DispatchWrite;
+  readonly storeBody?: (account: MailAccountRecord, msg: RawInboundMessage) => Promise<string>;
+  readonly log: (line: string) => void;
+};
+
+type FailureClass = "storage" | "encryption" | "ingest";
+
+type Attempt =
+  | {
+      readonly kind: "ingested";
+      readonly duplicate: boolean;
+      readonly storage: unknown;
+      readonly storedBody: boolean;
+    }
+  | { readonly kind: "permanent" }
+  | { readonly kind: "failed"; readonly failure: FailureClass };
+
+type Failure = { readonly msg: RawInboundMessage; readonly failure: FailureClass };
+
+function attemptOfFailure(failure: unknown): Attempt {
+  if (isFileStorageWriteFailure(failure)) return { kind: "failed", failure: "storage" };
+  const code = errorCodeOf(failure);
+  if (code === ENCRYPTION_UNAVAILABLE_CODE) return { kind: "failed", failure: "encryption" };
+  return code !== undefined && PERMANENT_ERROR_CODES.has(code)
+    ? { kind: "permanent" }
+    : { kind: "failed", failure: "ingest" };
+}
+
+// The most specific class names the outage: a KMS or storage failure explains the generic ones.
+function blockedReasonOf(failures: readonly FailureClass[]): IngestBlockedReason {
+  if (failures.includes("encryption")) return "encryption_unavailable";
+  if (failures.includes("storage")) return "file_storage_unavailable";
+  return "ingest_unavailable";
+}
+
+// The original is what failed to store; writing it again would fail the header import too.
+async function everyFailureCountedBefore(
+  db: DbConnection,
+  account: MailAccountRecord,
+  failures: readonly Failure[],
+): Promise<boolean> {
+  for (const { msg, failure } of failures) {
+    if (failure === "encryption") return false;
+    const target = {
+      tenantId: account.tenantId,
+      accountId: account.id,
+      providerMessageId: msg.providerMessageId,
+    };
+    if (!(await hasCountedIngestFailure(db, target))) return false;
+  }
+  return true;
+}
+
+function quarantineHeadersOf(msg: RawInboundMessage, failure: FailureClass): RawInboundMessage {
+  const headerOnly = headerOnlyOf(msg);
+  return failure === "storage" ? { ...headerOnly, rawMime: null } : headerOnly;
+}
+
+export function createMessageIngester(deps: IngesterDeps): MessageIngester {
+  async function quarantine(
+    account: MailAccountRecord,
+    providerMessageId: string,
+    reason: QuarantineReasonCode,
+    headerOnly: RawInboundMessage | null,
+  ): Promise<boolean> {
+    const created = await quarantineMessage(
+      deps.db,
+      { tenantId: account.tenantId, accountId: account.id, providerMessageId },
+      reason,
+    );
+    await clearIngestFailures(deps.db, account.id, [providerMessageId]);
+    await importQuarantinedHeaders(deps, account, headerOnly);
+    // Ids only: subject and sender of a poison mail stay out of logs.
+    deps.log(`inbound-mail: account ${account.id} quarantined a message (${reason})`);
+    return created;
+  }
+
+  async function storeBodyOf(account: MailAccountRecord, raw: RawInboundMessage): Promise<string> {
+    if (!deps.storeBody || !raw.rawMime) return "";
+    try {
+      return await deps.storeBody(account, raw);
+    } catch (err) {
+      // The app hook writes to the app's storage: its failure is a storage failure, not the mail's.
+      throw new FileStorageWriteFailedError(err instanceof Error ? err : undefined);
+    }
+  }
+
+  async function attempt(
+    account: MailAccountRecord,
+    raw: RawInboundMessage,
+    cursorSnapshot: string,
+  ): Promise<Attempt> {
+    try {
+      const msg = normalizeRawInboundMessage(raw);
+      const bodyRef = await storeBodyOf(account, raw);
+      const result = await deps.dispatchWrite({
+        handlerQn: InboundMailFoundationHandlers.ingestMessage,
+        tenantId: account.tenantId,
+        payload: ingestPayloadOf(account, msg, { providerCursor: cursorSnapshot, bodyRef }),
+      });
+      if (result.isSuccess) {
+        return {
+          kind: "ingested",
+          duplicate: propertyOf(result.data, "duplicate") === true,
+          storage: propertyOf(result.data, "contentStorage"),
+          storedBody: bodyRef !== "",
+        };
+      }
+      return attemptOfFailure(result.error ?? {});
+    } catch (err) {
+      return attemptOfFailure(err);
+    }
+  }
+
+  // Returns the failures left unresolved: "proven" ones wait for their count, the others are the
+  // account's outage.
+  async function settleFailures(
+    account: MailAccountRecord,
+    failures: readonly Failure[],
+    proof: IngestProof,
+    options: IngestBatchOptions,
+  ): Promise<{ quarantinedNew: number; blocked?: IngestBlockedReason }> {
+    let quarantinedNew = 0;
+    const unproven: FailureClass[] = [];
+    let waiting = false;
+    // An abandoned sync (deadline) must not count; its failures are the deadline's.
+    const bucket = options.signal?.aborted ? undefined : options.countBucket;
+    // Accepted residue, no mail is lost and each case is visible:
+    //   - a first failure without proof never counts: degraded until the next new mail
+    //   - a KMS failure only holds the cursor, shown as encryption_unavailable
+    //   - a storage or ingest outage can finish the count of mails counted before (retry exists)
+    const countedBefore =
+      !(proof.ingested && proof.storageHealthy) &&
+      (await everyFailureCountedBefore(deps.db, account, failures));
+    for (const { msg, failure } of failures) {
+      const target = {
+        tenantId: account.tenantId,
+        accountId: account.id,
+        providerMessageId: msg.providerMessageId,
+      };
+      const proven =
+        (failure === "storage" ? proof.storageHealthy : proof.ingested) || countedBefore;
+      if (!proven) {
+        unproven.push(failure);
+        continue;
+      }
+      const count = bucket === undefined ? null : await countIngestFailure(deps.db, target, bucket);
+      if (count !== null && count >= MAX_COUNTED_INGEST_FAILURES) {
+        const headerOnly = quarantineHeadersOf(msg, failure);
+        if (await quarantine(account, msg.providerMessageId, "ingest_failed", headerOnly)) {
+          quarantinedNew += 1;
+        }
+        continue;
+      }
+      waiting = true;
+    }
+    if (unproven.length > 0) return { quarantinedNew, blocked: blockedReasonOf(unproven) };
+    return { quarantinedNew, ...(waiting && { blocked: "message_failing" as const }) };
+  }
+
+  async function quarantineRejected(
+    account: MailAccountRecord,
+    rejected: readonly RejectedInboundMessage[],
+  ): Promise<number> {
+    let created = 0;
+    for (const entry of rejected) {
+      const headerOnly = headerOnlyOfRejected(entry);
+      if (await quarantine(account, entry.providerMessageId, "unparseable", headerOnly))
+        created += 1;
+    }
+    return created;
+  }
+
+  async function ingestBatch(
+    account: MailAccountRecord,
+    msgs: readonly RawInboundMessage[],
+    rejected: readonly RejectedInboundMessage[],
+    cursorSnapshot: string,
+    options: IngestBatchOptions = {},
+  ): Promise<IngestBatchOutcome> {
+    let quarantinedNew = await quarantineRejected(account, rejected);
+    let storageUnavailable = false;
+    let ingested = options.proof?.ingested ?? false;
+    let storageHealthy = options.proof?.storageHealthy ?? false;
+    const failures: Failure[] = [];
+    for (const msg of msgs) {
+      const result = await attempt(account, msg, cursorSnapshot);
+      if (result.kind === "permanent") {
+        const headerOnly = headerOnlyOf(msg);
+        const created = await quarantine(
+          account,
+          msg.providerMessageId,
+          "invalid_message",
+          headerOnly,
+        );
+        if (created) quarantinedNew += 1;
+        continue;
+      }
+      if (result.kind === "failed") {
+        failures.push({ msg, failure: result.failure });
+        continue;
+      }
+      await clearIngestFailures(deps.db, account.id, [msg.providerMessageId]);
+      if (result.storage === "unavailable") storageUnavailable = true;
+      if (result.storage === "stored" || result.storedBody) storageHealthy = true;
+      if (!result.duplicate) ingested = true;
+    }
+    const settled =
+      failures.length > 0
+        ? await settleFailures(account, failures, { ingested, storageHealthy }, options)
+        : { quarantinedNew: 0 };
+    return {
+      quarantinedNew: quarantinedNew + settled.quarantinedNew,
+      storageUnavailable,
+      storageHealthy,
+      ingested,
+      ...(settled.blocked && { blocked: settled.blocked }),
+    };
+  }
+
+  return { ingestBatch };
+}

package/packages/bundled-features/src/inbound-mail-foundation/sync-account-now.ts

@@ -0,0 +1,61 @@
+// Immediate sync of one account, used when a mailbox was just connected, reconnected or re-activated.
+// Shares the per-account in-flight guard with the regular poll, so a wake never runs a second fetch
+// next to a running tick for the same account; a caller that loses the race joins the running one.
+
+import type { SyncableAccount } from "./syncable-accounts.ts";
+import type { InboundMailProviderPlugin } from "./types.ts";
+
+export type PollAccountOptions = {
+  readonly fromWake?: boolean;
+  /** Aborted when the supervisor abandons this sync; an aborted sync stores nothing. */
+  readonly signal?: AbortSignal;
+  /** Set by regular ticks only: ingest failures count once per bucket. Wake and manual syncs never count. */
+  readonly countBucket?: number;
+};
+/** "credential_pending": the secret is not stored yet, nothing was polled and no status was set. */
+export type PollAccountResult = "done" | "credential_pending";
+
+export type InFlightSyncs = Map<string, Promise<void>>;
+
+/** Runs `run` unless a sync for the account is already in flight; then returns that one instead. */
+export function runExclusivePerAccount(
+  inFlight: InFlightSyncs,
+  accountId: string,
+  run: () => Promise<void>,
+): Promise<void> {
+  const running = inFlight.get(accountId);
+  if (running) return running;
+  const started = run().finally(() => {
+    inFlight.delete(accountId);
+  });
+  inFlight.set(accountId, started);
+  return started;
+}
+
+export function createSyncAccountNow(deps: {
+  readonly inFlight: InFlightSyncs;
+  readonly loadAccount: (accountId: string) => Promise<SyncableAccount | undefined>;
+  readonly resolvePlugin: (account: SyncableAccount) => InboundMailProviderPlugin | undefined;
+  readonly pollAccount: (
+    account: SyncableAccount,
+    plugin: InboundMailProviderPlugin,
+    options: PollAccountOptions,
+  ) => Promise<PollAccountResult>;
+  readonly ensureWatcher: (
+    account: SyncableAccount,
+    plugin: InboundMailProviderPlugin,
+  ) => Promise<void>;
+  readonly isRunning: () => boolean;
+}): (accountId: string) => Promise<void> {
+  return (accountId) =>
+    runExclusivePerAccount(deps.inFlight, accountId, async () => {
+      const account = await deps.loadAccount(accountId);
+      // skip: the account is gone or no longer syncable.
+      if (!account) return;
+      const plugin = deps.resolvePlugin(account);
+      // skip: no provider plugin for this account; resolvePlugin logged it.
+      if (!plugin) return;
+      const result = await deps.pollAccount(account, plugin, { fromWake: true });
+      if (result === "done" && deps.isRunning()) await deps.ensureWatcher(account, plugin);
+    });
+}

package/packages/bundled-features/src/inbound-mail-foundation/sync-cursor-store.ts

@@ -0,0 +1,79 @@
+// Cursor persistence of the sync supervisor (unmanaged direct-write store).
+
+import type { DbRunner } from "@cosmicdrift/kumiko-framework/db";
+import { fetchOne, insertOne, updateMany } from "@cosmicdrift/kumiko-framework/db";
+import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
+import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
+import { syncCursorTable } from "./entities.ts";
+import type { MailAccountRecord, SyncCursorPayload } from "./types.ts";
+
+/** One cursor per account (one mailbox inbox) for now; multi-folder support
+ *  can add further scopes later without a schema change. */
+const CURSOR_SCOPE = "default";
+
+export type SyncCursorStore = {
+  readonly load: (accountId: string) => Promise<SyncCursorPayload | null>;
+  readonly save: (
+    account: Pick<MailAccountRecord, "id" | "tenantId">,
+    cursor: SyncCursorPayload,
+  ) => Promise<void>;
+  /** The next fetch runs as a backfill. */
+  readonly reset: (accountId: string) => Promise<void>;
+};
+
+export function createSyncCursorStore(db: DbRunner): SyncCursorStore {
+  return {
+    async load(accountId) {
+      const row = await fetchOne<{ cursor: string }>(db, syncCursorTable, {
+        accountId,
+        scope: CURSOR_SCOPE,
+      });
+      if (!row) return null;
+      try {
+        const parsed: unknown = JSON.parse(row.cursor);
+        return isPlainObject(parsed) ? parsed : null;
+      } catch {
+        return null; // a corrupt cursor counts as none → backfill; dedup catches duplicates
+      }
+    },
+
+    async save(account, cursor) {
+      const accountId = account.id;
+      const now = Temporal.Now.instant().toString();
+      const serialized = JSON.stringify(cursor);
+      const existing = await fetchOne<{ id: string }>(db, syncCursorTable, {
+        accountId,
+        scope: CURSOR_SCOPE,
+      });
+      if (existing) {
+        await updateMany(
+          db,
+          syncCursorTable,
+          { cursor: serialized, updatedAt: now },
+          { accountId, scope: CURSOR_SCOPE },
+        );
+        // skip: the update path is complete; do not fall through to the insert branch.
+        return;
+      }
+      await insertOne(db, syncCursorTable, {
+        id: crypto.randomUUID(),
+        // Direct-write store: no executor stamps the NOT NULL tenant_id for us.
+        tenantId: account.tenantId,
+        accountId,
+        scope: CURSOR_SCOPE,
+        cursor: serialized,
+        updatedAt: now,
+      });
+    },
+
+    async reset(accountId) {
+      // An empty cursor parses to null, so the next fetch runs as a backfill.
+      await updateMany(
+        db,
+        syncCursorTable,
+        { cursor: "", updatedAt: Temporal.Now.instant().toString() },
+        { accountId, scope: CURSOR_SCOPE },
+      );
+    },
+  };
+}

package/packages/bundled-features/src/inbound-mail-foundation/syncable-accounts.ts

@@ -0,0 +1,123 @@
+// Account snapshot for the sync supervisor: accounts of all tenants that should be polled, with the
+// address decrypted (providers never work with ciphertext). Degraded accounts stay in the set, so a
+// poison mail or a transient outage does not stop the sync that would heal them.
+
+import {
+  configuredPiiSubjectKms,
+  decryptPiiFieldValues,
+  ENCRYPTION_UNAVAILABLE_CODE,
+  type LocalKeyKmsAdapter,
+} from "@cosmicdrift/kumiko-framework/crypto";
+import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
+import { errorCodeOf } from "@cosmicdrift/kumiko-types/type-guards";
+import { type InboundMailAccountStatus, InboundMailAccountStatuses } from "./constants.ts";
+import { MAIL_ACCOUNT_PII_FIELDS } from "./entities.ts";
+import { mailAccountsProjectionTable } from "./projection.ts";
+import type { MailAccountRecord } from "./types.ts";
+
+export type SyncableAccount = MailAccountRecord & {
+  /** Health code currently shown on the account; supervisor-internal, not part of the provider contract. */
+  readonly lastError: string | null;
+};
+
+/** What the account health needs of an account, which an account without a readable address still has. */
+export type AccountHealthRef = Pick<SyncableAccount, "id" | "tenantId" | "status" | "lastError">;
+
+type SyncableMailAccountRow = {
+  readonly id: string;
+  readonly tenantId: string;
+  readonly provider: string;
+  readonly authMethod: string;
+  readonly ownerUserId?: string | null;
+  readonly address: string;
+  readonly displayName?: string;
+  readonly status?: string;
+  readonly watchState?: string;
+  readonly lastError?: string | null;
+  readonly trustedAuthservId?: string | null;
+};
+
+const SYNCABLE_STATUSES: readonly InboundMailAccountStatus[] = [
+  InboundMailAccountStatuses.active,
+  InboundMailAccountStatuses.degraded,
+];
+
+function syncableStatusOf(status: string | undefined): InboundMailAccountStatus {
+  return status === InboundMailAccountStatuses.degraded
+    ? InboundMailAccountStatuses.degraded
+    : InboundMailAccountStatuses.active;
+}
+
+type KeyStoreOutageListener = {
+  readonly onKeyStoreUnavailable: (account: AccountHealthRef) => Promise<void>;
+};
+
+// Undefined skips the account: one undecryptable account must not stop polling of every other
+// tenant's accounts.
+async function decryptedAddressOf(
+  row: SyncableMailAccountRow,
+  piiKms: LocalKeyKmsAdapter | undefined,
+  log: (line: string) => void,
+  health: KeyStoreOutageListener | undefined,
+): Promise<string | undefined> {
+  let decrypted: Record<string, unknown>;
+  try {
+    decrypted = piiKms
+      ? await decryptPiiFieldValues(row, MAIL_ACCOUNT_PII_FIELDS, piiKms, {
+          requestId: "inbound-mail-foundation:supervisor:list-accounts",
+        })
+      : row;
+  } catch (error) {
+    // Class name only: the message may carry ciphertext or key details.
+    const errorName = error instanceof Error ? error.name : "unknown error";
+    log(`inbound-mail: account ${row.id} skipped — address did not decrypt (${errorName})`);
+    // A key store outage is not the account's problem, but without a mark it would look active.
+    if (health && errorCodeOf(error) === ENCRYPTION_UNAVAILABLE_CODE) {
+      await health.onKeyStoreUnavailable({
+        id: row.id,
+        tenantId: row.tenantId,
+        status: syncableStatusOf(row.status),
+        lastError: row.lastError ?? null,
+      });
+    }
+    return undefined;
+  }
+  const address = decrypted["address"];
+  // Falling back to row.address would hand the ciphertext to a provider.
+  if (typeof address === "string") return address;
+  log(`inbound-mail: account ${row.id} skipped — address did not decrypt to text`);
+  return undefined;
+}
+
+export async function listSyncableAccounts(
+  db: DbConnection,
+  log: (line: string) => void,
+  options: { readonly onlyAccountId?: string; readonly health?: KeyStoreOutageListener } = {},
+): Promise<readonly SyncableAccount[]> {
+  const { onlyAccountId, health } = options;
+  const rows = await selectMany<SyncableMailAccountRow>(db, mailAccountsProjectionTable, {
+    status: { in: SYNCABLE_STATUSES },
+    ...(onlyAccountId !== undefined && { id: onlyAccountId }),
+  });
+  const piiKms = configuredPiiSubjectKms();
+  const records: SyncableAccount[] = [];
+  for (const row of rows) {
+    const address = await decryptedAddressOf(row, piiKms, log, health);
+    if (address === undefined) continue;
+    records.push({
+      id: row.id,
+      tenantId: row.tenantId,
+      provider: row.provider,
+      authMethod: row.authMethod,
+      ownerUserId: row.ownerUserId ?? null,
+      address,
+      displayName: row.displayName ?? "",
+      status: syncableStatusOf(row.status),
+      watchState: row.watchState ?? "idle",
+      lastError: row.lastError ?? null,
+      trustedAuthservId: row.trustedAuthservId ?? null,
+    });
+  }
+  return records;
+}

package/packages/bundled-features/src/inbound-mail-foundation/tenant-destroy-hook.ts

@@ -8,7 +8,7 @@
 //      operation, so O(n) is acceptable.
 //   2. Deletes the projection rows.
 //   3. For mail-account only, deletes unmanaged sync state (cursors,
-//      seen anchors), which is keyed by accountId and must therefore be
+//      seen anchors, quarantine entries, ingest failure counters), which is keyed by accountId and must therefore be
 //      collected from the account rows BEFORE deletion.
 //
 // The actual PII erasure uses crypto-shredding: eraseSubjectKeys deletes the
@@ -24,11 +24,13 @@ import {
   MAIL_ACCOUNT_AGGREGATE_TYPE,
   MAIL_THREAD_AGGREGATE_TYPE,
 } from "./events.ts";
+import { ingestFailureTable } from "./ingest-failures.ts";
 import {
   inboundMessagesProjectionTable,
   mailAccountsProjectionTable,
   mailThreadsProjectionTable,
 } from "./projection.ts";
+import { quarantineTable } from "./quarantine-entities.ts";
 
 const ARCHIVED_BY = "tenant-lifecycle:destroy";
 const REASON = "tenant_destroy";
@@ -66,6 +68,8 @@ export async function mailAccountTenantDestroyHook(ctx: TenantDataHookCtx): Prom
   for (const accountId of accountIds) {
     await ctx.db.deleteMany(syncCursorTable, { accountId });
     await ctx.db.deleteMany(seenMessageTable, { accountId });
+    await ctx.db.deleteMany(quarantineTable, { accountId });
+    await ctx.db.deleteMany(ingestFailureTable, { accountId });
   }
 }