@rapidmx/web-client 0.36.0 → 0.37.1

package/dist/apps/shared/mail/outbox/sendJob.js

@@ -3,7 +3,7 @@
 // SPDX-License-Identifier: MPL-2.0
 ///////////////////////////////////////////////////////////////////////////////
 import { ApiRequestError } from "../../../../lib/util/api.js";
-import { assembleDraft, assembleDraftRaw, forgetDraftImages, getMailbox, getMessage, queueMessageSend, sendMessage, setMessageRequestReceipt, } from "../../../../lib/mail/mailApi.js";
+import { assembleDraft, assembleDraftRaw, createDraft, deleteMessage, forgetDraftImages, getMailbox, getMessage, queueMessageSend, sendMessage, setMessageRequestReceipt, } from "../../../../lib/mail/mailApi.js";
 import { describeSendFailure } from "../../../../lib/mail/sendFailure.js";
 import { resolveRecipientEncryption } from "../../../../lib/crypto/composeSecurity.js";
 import { getUnlockedKeys } from "../../../../lib/crypto/keySession.js";
@@ -16,6 +16,7 @@ import { beginPendingSend, finishPendingSend, setPendingStage } from "./pendingS
 import { failOutgoing, forgetOutgoing, markOutgoingSending, markOutgoingSent, trackOutgoing } from "./outgoingReplies.js";
 import { openComposeFromOutside, requestUnlockFromOutside } from "./composeBridge.js";
 import { sendState } from "./sendState.js";
+import { notifySendFailure } from "./sendOutcomes.js";
 /** How long a background send waits for the mailbox / encryption policy it did not have, before it goes ahead treating them as unknown. Nobody waits for it. */
 export const CONTEXT_GRACE_MS = 4000;
 export function registerOutboxCounter(tracker, onQueued) {
@@ -29,19 +30,69 @@ export function registerOutboxCounter(tracker, onQueued) {
     };
 }
 const RETAINED_LIMIT = 25;
-/** The request a message was queued from, while this tab still holds it: what lets "Open draft" and "Retry" work on a failure the server reports later. */
+/** The request a message was queued from, while this tab still holds it: what lets "Open draft" and "Retry" work on a failure the server
+ * reports later. A message sent as several copies (`SendRequest.copyUids`) is held under each copy still to go, from just before it is handed
+ * over - how the first went can be reported while the next is still being handed over. */
 export function retainedRequest(draftUid) {
     return sendState.retained.get(draftUid);
 }
-/** Drops the request a message was queued from, and the pictures remembered as attached to its draft: it has gone, so neither is wanted again. */
+/** Stops holding the request of a message sent as several copies under copy `uid` - never another message's request held there since. */
+function release(fates, uid) {
+    if (sendState.retained.get(uid)?.copyFates === fates) {
+        sendState.retained.delete(uid);
+    }
+}
+/** Records that copy `uid` of a message sent as several (`fates`) has gone. Whether it was the last of them to go, each counted once, so the
+ * message is confirmed now - always, for a message sent as one. */
+function copyWent(fates, uid) {
+    if (!fates) {
+        return true;
+    }
+    release(fates, uid);
+    if (fates.get(uid) === "sent") {
+        return false;
+    }
+    fates.set(uid, "sent");
+    return [...fates.values()].every((fate) => fate === "sent");
+}
+/** Drops the request a message (or one of its copies) was queued from, and the pictures remembered as attached to its draft: it has gone, so
+ * neither is wanted again. Whether the message has now gone in full - the last of its copies to go. */
 export function forgetRetainedRequest(draftUid) {
+    const request = sendState.retained.get(draftUid);
     sendState.retained.delete(draftUid);
     forgetDraftImages(draftUid);
+    return copyWent(request?.copyFates, draftUid);
+}
+/** Records that the server couldn't relay copy `uid` of the message `request` sent as several copies (nothing for a message sent as one). */
+export function copyFailed(request, uid) {
+    request?.copyFates?.set(uid, "failed");
+}
+/** Copy `uid` of the message `request` sent as several copies is handed over again (a Retry): how it goes is to be reported once more, and
+ * finds the request held under it. Nothing for a message sent as one. */
+export function copyRetried(request, uid) {
+    if (request?.copyFates) {
+        request.copyFates.set(uid, "pending");
+        retain(request, [uid]);
+    }
 }
-function retain(request) {
-    sendState.retained.delete(request.draft.uid);
-    sendState.retained.set(request.draft.uid, request);
-    if (sendState.retained.size > RETAINED_LIMIT) {
+/** Every copy of the message `request` sent as several, when none of them has gone nor may still go - each failed, or was never handed over:
+ * nobody has the message. `undefined` while one has gone or may, and for a message sent as one. */
+export function unsentCopies(request) {
+    const fates = request?.copyFates;
+    return fates && [...fates.values()].every((fate) => fate === "failed" || fate === "unsent") ? [...fates.keys()] : undefined;
+}
+/** Stops holding a message sent as several copies under any of them: it is being written again. */
+export function forgetCopies(fates) {
+    for (const uid of fates.keys()) {
+        release(fates, uid);
+    }
+}
+function retain(request, uids) {
+    for (const uid of uids) {
+        sendState.retained.delete(uid);
+        sendState.retained.set(uid, request);
+    }
+    while (sendState.retained.size > RETAINED_LIMIT) {
         sendState.retained.delete(sendState.retained.keys().next().value);
     }
 }
@@ -56,6 +107,11 @@ export function readSendKeys(mailboxUid, signEnabled, mailbox) {
         canEncryptSelf: !!unlocked?.encryptionPrivateKey && !!unlocked.encryptionCertDer,
     };
 }
+/** Whether the sender can make an OpenPGP copy (it is encrypted to them too, with their own OpenPGP key) - or can't be told yet, the
+ * mailbox being locked: `decideSend()` then asks for the unlock rather than settling for another format, or none. */
+export function senderCanUseOpenPgp(unlocked) {
+    return !unlocked || !!unlocked.openPgpKeys?.length;
+}
 /** Whether this sender could encrypt at all: an encryption key unlocked here, enrolled on the mailbox, or offered earlier this session. */
 export function senderHasEncryptionKey(request, canEncryptSelf) {
     return canEncryptSelf || request.offeredEncrypt || !!findActivePublicKey(request.mailbox?.keys ?? [], "encrypt");
@@ -102,11 +158,15 @@ async function completeContext(request, client) {
     }
     return { mailbox, policy };
 }
-/** Builds the message's final content into the draft (plain, signed, or signed and encrypted in this browser) and returns the stored message. */
-async function assemble(request, mailbox, mode, statuses, withSignature, client) {
+/** Builds the message's final content into the draft (plain, signed, or signed and encrypted in this browser) and returns the stored
+ * message(s) to send: one, or - for an encrypted message whose recipients need both formats (restapi `specs/end-to-end_encryption.md`
+ * *OpenPGP Interoperability*) - an S/MIME copy (this draft) and an OpenPGP copy (a second draft), each listing every recipient but
+ * delivered only to the recipients of its own format (`deliverTo`). Never a plaintext copy. The second draft is added to `created` as soon as
+ * it exists, so an attempt that fails before handing it over can remove it. */
+async function assemble(request, mailbox, mode, statuses, withSignature, client, created) {
     const { draft, to, cc, bcc, subject, html } = request;
     if (mode === "plain") {
-        return assembleDraft(draft.uid, { to, cc, bcc, subject, html, intent: "send" }, client);
+        return [await assembleDraft(draft.uid, { to, cc, bcc, subject, html, intent: "send" }, client)];
     }
     const keys = readSendKeys(request.mailboxUid, request.signEnabled, mailbox);
     const own = mailbox;
@@ -127,31 +187,185 @@ async function assemble(request, mailbox, mode, statuses, withSignature, client)
     const { applyBaselineOuterHeaders, assembleOutboundMime, buildEncryptedMessage, buildSignedOnlyMessage } = await import("../../../../lib/crypto/smimeMessage.js");
     const encrypt = mode === "encrypt";
     const outerHeaders = encrypt ? applyBaselineOuterHeaders(protectedHeaders) : protectedHeaders;
-    const mimePart = encrypt
-        ? await buildEncryptedMessage(bodyContentType, html, protectedHeaders, outerHeaders, [keys.unlocked.encryptionCertDer, ...statuses.map((status) => fromBase64(status.encryptCert.publicKey))], signing)
-        : await buildSignedOnlyMessage(bodyContentType, html, protectedHeaders, signing.certDer, signing.privateKey);
-    const rawMime = assembleOutboundMime(outerHeaders, mimePart);
-    return assembleDraftRaw(draft.uid, { to, cc, bcc, subject: outerHeaders.subject, rawMime, intent: "send" }, client);
+    if (!encrypt) {
+        const signedPart = await buildSignedOnlyMessage(bodyContentType, html, protectedHeaders, signing.certDer, signing.privateKey);
+        return [await assembleDraftRaw(draft.uid, { to, cc, bcc, subject: outerHeaders.subject, rawMime: assembleOutboundMime(outerHeaders, signedPart), intent: "send" }, client)];
+    }
+    const smime = statuses.filter((status) => status.format !== "openpgp");
+    const pgp = statuses.filter((status) => status.format === "openpgp");
+    const deliverTo = (group) => (smime.length > 0 && pgp.length > 0 ? { deliverTo: group.map((status) => status.address) } : {});
+    const sent = [];
+    if (smime.length > 0) {
+        const part = await buildEncryptedMessage(bodyContentType, html, protectedHeaders, outerHeaders, [keys.unlocked.encryptionCertDer, ...smime.map((status) => fromBase64(status.encryptCert.publicKey))], signing);
+        const rawMime = assembleOutboundMime(outerHeaders, part);
+        sent.push(await assembleDraftRaw(draft.uid, { to, cc, bcc, subject: outerHeaders.subject, rawMime, intent: "send", ...deliverTo(smime) }, client));
+    }
+    if (pgp.length > 0) {
+        // OpenPGP.js and the PGP/MIME builder load only for a message that has OpenPGP recipients.
+        const [{ buildPgpEncryptedMessage, readKeysBase64 }, { armorPublicKey }] = await Promise.all([
+            import("../../../../lib/crypto/pgpMessage.js"),
+            import("../../../../lib/crypto/openpgp.js"),
+        ]);
+        const ownKey = keys.unlocked.openPgpKeys[0].privateKey;
+        const recipientKeys = await readKeysBase64(pgp.map((status) => status.openPgpKey.publicKey));
+        // Its own Message-ID: a second message, even though it is the same one for its readers.
+        const pgpHeaders = { ...protectedHeaders, messageId: `<${crypto.randomUUID()}@${domain}>` };
+        const pgpOuter = applyBaselineOuterHeaders(pgpHeaders);
+        // Signed with the sender's OpenPGP key (what an OpenPGP reader can check) whenever the message is signed, and carrying the
+        // sender's public key, so a correspondent without it can verify and reply encrypted.
+        const part = await buildPgpEncryptedMessage(bodyContentType, html, pgpHeaders, pgpOuter, [ownKey.toPublic(), ...recipientKeys], withSignature ? ownKey : undefined, armorPublicKey(ownKey.toPublic()));
+        const rawMime = assembleOutboundMime(pgpOuter, part);
+        let target = draft;
+        if (smime.length > 0) {
+            target = await createDraft(request.mailboxUid, draft.folderUid, undefined, client);
+            created.push(target);
+        }
+        sent.push(await assembleDraftRaw(target.uid, { to, cc, bcc, subject: pgpOuter.subject, rawMime, intent: "send", ...deliverTo(pgp) }, client));
+    }
+    return sent;
 }
 function failureOf(err, fallback) {
     const failure = describeSendFailure(err, fallback);
     return { message: failure.message, details: failure.lines };
 }
-/** Whether the server already holds `request`'s message as accepted (out of Drafts, or leased) - the answer to "did that request that never returned actually land?". */
-async function alreadyAccepted(request, client) {
+/** Whether `fresh`, `copy` as the server holds it now, was accepted (out of Drafts, or leased). */
+function isAccepted(copy, fresh) {
+    return fresh.folderUid !== copy.folderUid || !!fresh.scheduledSendLeaseExpiresAt || !!fresh.scheduledSendRelayedAt;
+}
+/** Whether the server already holds `copy` as accepted - the answer to "did that request that never returned actually land?". */
+async function accepted(copy, client) {
     try {
-        const fresh = await getMessage(request.draft.uid, client);
-        return fresh.folderUid !== request.draft.folderUid || !!fresh.scheduledSendLeaseExpiresAt || !!fresh.scheduledSendRelayedAt;
+        return isAccepted(copy, await getMessage(copy.uid, client));
     }
     catch {
         return false;
     }
 }
+/** Deletes the draft of a copy of a message sent as several (the OpenPGP one's) that is not to be handed over any more - unless the server
+ * holds it as accepted after all. Best effort: never rejects. */
+async function discardCopy(copy, client) {
+    try {
+        const fresh = await getMessage(copy.uid, client);
+        if (!isAccepted(copy, fresh)) {
+            await deleteMessage(fresh.uid, fresh.version, client);
+        }
+    }
+    catch {
+        // Left in Drafts, where it can be deleted by hand.
+    }
+}
+/** Whether the server already holds every copy of `request`'s message still to go (its draft, when none was built yet) as accepted. */
+async function alreadyAccepted(request, client) {
+    for (const copy of request.pendingCopies ?? [request.draft]) {
+        if (!(await accepted(copy, client))) {
+            return false;
+        }
+    }
+    return true;
+}
+/** Hands `copies` over to the server - queued, or scheduled - one after the other. One that fails stops the rest: the failure carries the
+ * copies still to go, so a retry never sends one twice (an encrypted message's other copy may already be on its way to its recipients). */
+async function handOver(request, copies, client) {
+    // A retry hands over only what was left: the request already names every copy.
+    const copyUids = request.copyUids ?? (copies.length > 1 ? copies.map((copy) => copy.uid) : undefined);
+    const copyFates = request.copyFates ?? (copyUids && new Map(copyUids.map((uid) => [uid, "unsent"])));
+    // An immediate send of several copies is held under each before any is handed over: how the first went can be reported while the next
+    // is still on its way to the server, and must find the others - a failure that offered "Open draft" would send their recipients the
+    // message again, a success not counted would leave the message never confirmed.
+    if (copyFates && !request.scheduledSendTime) {
+        for (const copy of copies) {
+            copyFates.set(copy.uid, "pending");
+        }
+        retain({ ...request, copyUids, copyFates }, copies.map((copy) => copy.uid));
+    }
+    let queued = false;
+    let completed = false;
+    for (let index = 0; index < copies.length; index++) {
+        const copy = copies[index];
+        try {
+            if (request.scheduledSendTime) {
+                await sendMessage(copy.uid, { scheduledSendTime: request.scheduledSendTime }, client);
+            }
+            else {
+                const handed = await queueMessageSend(copy.uid, client);
+                queued = handed.queued || queued;
+                // A server with no queue relayed it before answering: one of several copies has gone already.
+                if (!handed.queued && copyFates) {
+                    completed = copyWent(copyFates, copy.uid) || completed;
+                }
+            }
+        }
+        catch (err) {
+            // A request that never came back may still have landed: never offer to send it twice if it did.
+            if (!(err instanceof ApiRequestError) && (await accepted(copy, client))) {
+                queued = true;
+                continue;
+            }
+            const failure = failureOf(err, request.scheduledSendTime ? "Could not schedule this message." : "Could not send this message.");
+            // This copy and the ones after it weren't handed over: nothing of them is to be reported.
+            if (copyFates) {
+                for (const left of copies.slice(index)) {
+                    copyFates.set(left.uid, "unsent");
+                    release(copyFates, left.uid);
+                }
+            }
+            // The server has failed a copy handed over earlier (its report came while this one was on its way), and none is sent or on its
+            // way: nobody has the message - the whole message's failure, not some recipients'.
+            const fates = [...(copyFates?.values() ?? [])];
+            const nobodyHasIt = fates.includes("failed") && fates.every((fate) => fate === "failed" || fate === "unsent");
+            // A copy that went in this attempt, or in an earlier one this retries.
+            const partial = !nobodyHasIt && (index > 0 || !!request.partial);
+            return {
+                kind: "failed",
+                failure: partial
+                    ? { ...failure, partial, message: `Only some of its recipients ${request.scheduledSendTime ? "will get it" : "were sent it"} - the copy for the others didn't go. ${failure.message}` }
+                    : failure,
+                // Nothing went of a single copy: a retry decides and assembles again from the request, like the first attempt (the stored
+                // draft may have been opened and autosaved plain since). Several copies are kept even when none went, so a mixed-format
+                // retry doesn't create another OpenPGP draft.
+                pendingCopies: partial || copies.length > 1 ? copies.slice(index) : undefined,
+                copyUids,
+                copyFates,
+            };
+        }
+    }
+    if (request.scheduledSendTime) {
+        return { kind: "scheduled", copyUids, copyFates };
+    }
+    // Several copies: the message has gone only when this hand-over saw the last of them go - otherwise the server's report for the last copy
+    // to go confirms it.
+    return { kind: (copyFates ? completed : !queued) ? "sent" : "queued", copyUids, copyFates };
+}
 /** The whole client-side path of one send: settle, decide, assemble, hand over. Never rejects. `client` is the explicit `ApiClient` (from
  * `useApiClient()`) the window that built `request` was rendered under, `undefined` for the default global cookie-based session. */
 async function attempt(request, client) {
+    // The copies' drafts `assemble()` created (the OpenPGP one's): an attempt that fails before handing them over deletes them - its Retry
+    // assembles the message again, creating its own, and one left behind would reach its recipients a second time if sent from Drafts.
+    const created = [];
     try {
         await request.saved?.catch(() => undefined);
+        // Built already by the attempt that failed part-way: only what didn't go is handed over. A copy whose request seemed to fail but
+        // landed (its answer was lost, and so was the check after it) has gone since: handed over again it is refused, and the copies after
+        // it would never go - it is left out, and what fails now is a failure of only some of the recipients.
+        if (request.pendingCopies?.length) {
+            setPendingStage(request.draft.uid, "queuing");
+            const remaining = [];
+            let completed = false;
+            for (const copy of request.pendingCopies) {
+                if (!(await accepted(copy, client))) {
+                    remaining.push(copy);
+                }
+                else {
+                    // How it went has most likely been reported already, to nothing waiting for it: it isn't waited for now.
+                    completed = copyWent(request.copyFates, copy.uid) || completed;
+                }
+            }
+            if (remaining.length === 0) {
+                const { copyUids, copyFates } = request;
+                return { kind: request.scheduledSendTime ? "scheduled" : completed ? "sent" : "queued", copyUids, copyFates };
+            }
+            return await handOver(remaining.length < request.pendingCopies.length ? { ...request, partial: true } : request, remaining, client);
+        }
         const all = [...request.to, ...request.cc, ...request.bcc];
         let mailbox = request.mailbox;
         let policy = request.policy;
@@ -166,9 +380,16 @@ async function attempt(request, client) {
                 const own = mailbox;
                 const ownPrefersMutual = own.encryptPreference?.preferEncrypt === "mutual";
                 const lookups = await Promise.all(all.map((recipient) => lookupKeys(request.mailboxUid, recipient.address, client).then((lookup) => ({ lookup }), () => null)));
+                const ownOpenPgp = senderCanUseOpenPgp(keys.unlocked);
                 statuses = all.map((recipient, index) => {
                     const found = lookups[index];
-                    return found ? resolveRecipientEncryption(own.primarySmtpAddress, ownPrefersMutual, policy ?? OPEN_POLICY, recipient.address, found.lookup) : undefined;
+                    // Without an OpenPGP key of the sender's, a recipient with both formats gets S/MIME, whatever they prefer.
+                    const status = found
+                        ? resolveRecipientEncryption(own.primarySmtpAddress, ownPrefersMutual, policy ?? OPEN_POLICY, recipient.address, found.lookup, ownOpenPgp)
+                        : undefined;
+                    // An OpenPGP copy is encrypted to the sender too, with their own OpenPGP key: a recipient with only an OpenPGP key can't
+                    // be encrypted to while the unlocked session has none.
+                    return status?.format === "openpgp" && !ownOpenPgp ? { ...status, canEncrypt: false, autoEncrypt: false } : status;
                 });
             }
             lookupsComplete = true;
@@ -180,26 +401,17 @@ async function attempt(request, client) {
         if (decision.action === "rejected") {
             return { kind: "failed", failure: { message: decision.message, details: [] } };
         }
-        const assembled = await assemble(request, mailbox, decision.action, statuses, decision.action === "sign" || (decision.action === "encrypt" && decision.sign), client);
-        const withReceipt = request.requestReceipt ? await setMessageRequestReceipt(assembled, true, client) : assembled;
+        const assembled = await assemble(request, mailbox, decision.action, statuses, decision.action === "sign" || (decision.action === "encrypt" && decision.sign), client, created);
+        const copies = request.requestReceipt ? await Promise.all(assembled.map((copy) => setMessageRequestReceipt(copy, true, client))) : assembled;
         setPendingStage(request.draft.uid, "queuing");
-        try {
-            if (request.scheduledSendTime) {
-                await sendMessage(withReceipt.uid, { scheduledSendTime: request.scheduledSendTime }, client);
-                return { kind: "scheduled" };
-            }
-            const result = await queueMessageSend(withReceipt.uid, client);
-            return { kind: result.queued ? "queued" : "sent" };
-        }
-        catch (err) {
-            // A request that never came back may still have landed: never offer to send it twice if it did.
-            if (!(err instanceof ApiRequestError) && (await alreadyAccepted(request, client))) {
-                return { kind: request.scheduledSendTime ? "scheduled" : "queued" };
-            }
-            throw err;
-        }
+        // Handed over from here: a copy the hand-over doesn't deliver is its failure's to retry.
+        created.length = 0;
+        return await handOver(request, copies, client);
     }
     catch (err) {
+        for (const copy of created) {
+            await discardCopy(copy, client);
+        }
         return { kind: "failed", failure: failureOf(err, request.scheduledSendTime ? "Could not schedule this message." : "Could not send this message.") };
     }
 }
@@ -229,18 +441,42 @@ export function openDraftFromRequest(request) {
             encryptRequested: request.encryptRequested,
         },
     });
-    // Being edited again, it is no longer a message on its way in the conversation.
+    // Being edited again, it is no longer a message on its way in the conversation - and the failure's Retry, wherever it was clicked
+    // from, must not hand over the draft the window is now editing (and autosaving).
     if (opened) {
         forgetOutgoing(request.draft.uid);
+        dismiss(failureNotificationId(request.draft.uid));
     }
     return opened;
 }
 function failureNotificationId(draftUid) {
     return `send-failed:${draftUid}`;
 }
+/** "Open draft" for a message sent as several copies none of which went, each still a draft (`unsentCopies()`): the message is written again in
+ * its own draft, and the other copies' drafts (the OpenPGP one's) are deleted, best effort - it is encrypted afresh when it is sent again,
+ * and a copy left in Drafts would reach its recipients a second time if ever sent from there. */
+function openDraftDroppingCopies(request, client) {
+    if (!openDraftFromRequest(request)) {
+        return;
+    }
+    forgetCopies(request.copyFates);
+    for (const copy of request.pendingCopies.filter((copy) => copy.uid !== request.draft.uid)) {
+        forgetOutgoing(copy.uid);
+        void discardCopy(copy, client);
+    }
+}
 /** The sticky "This message wasn't sent" pop-up for a send that failed on this side, with what can be done about it. */
 function notifyFailure(request, failure, client) {
     const uid = request.draft.uid;
+    // A message sent as several copies, none of which went: each was never handed over, or the server failed it (its report came while the
+    // next was being handed over). Then it is the whole message's failure as the server reports one: one pop-up, replacing the one its report
+    // showed, whose Retry hands every copy over again - the failed one from Outbox too - and whose "Open draft" writes the message again.
+    const copies = unsentCopies(request);
+    if (copies && [...request.copyFates.values()].includes("failed")) {
+        const recipients = [...request.to, ...request.cc, ...request.bcc].map((recipient) => recipient.address);
+        notifySendFailure({ uid, mailboxUid: request.mailboxUid, subject: request.subject, recipients }, { message: failure.message, lines: failure.details }, request, client);
+        return;
+    }
     const actions = [];
     const { block } = failure;
     if (block?.keysLocked && request.mailbox?.keys?.length) {
@@ -257,7 +493,10 @@ function notifyFailure(request, failure, client) {
     else {
         actions.push({ label: "Retry", onClick: () => void retrySend(request, client) });
     }
-    actions.push({ label: "Open draft", onClick: () => void openDraftFromRequest(request) });
+    // Part of it went: editing and sending the draft again would send those recipients a second copy.
+    if (!failure.partial) {
+        actions.push({ label: "Open draft", onClick: () => void (copies ? openDraftDroppingCopies(request, client) : openDraftFromRequest(request)) });
+    }
     notify({
         id: failureNotificationId(uid),
         kind: "error",
@@ -301,16 +540,22 @@ export function startSend(request, client) {
         finishPendingSend(uid);
         if (outcome.kind === "failed") {
             tracker?.revert();
-            notifyFailure(request, outcome.failure, client);
+            notifyFailure(outcome.pendingCopies
+                ? { ...request, pendingCopies: outcome.pendingCopies, partial: outcome.failure.partial, copyUids: outcome.copyUids, copyFates: outcome.copyFates }
+                : request, outcome.failure, client);
             return;
         }
         tracker?.settle();
         if (outcome.kind === "queued") {
-            retain(request);
+            // A message sent as several copies is held under each already, from before it was handed over.
+            if (!outcome.copyFates) {
+                retain(request, [uid]);
+            }
             sendState.queuedListener?.(request.mailboxUid);
         }
         else if (outcome.kind === "sent") {
-            // A server with no queue relayed it before answering: the Sent Items copy exists already.
+            // A server with no queue relayed it before answering (or, of several copies, the last of them went in this attempt): the Sent
+            // Items copy exists already.
             markOutgoingSent(uid);
             forgetDraftImages(uid);
             notifySent();

package/dist/apps/shared/mail/outbox/sendOutcomes.d.ts

@@ -1,6 +1,18 @@
 import { SendEvent } from "../../../../lib/mail/sendEvents.js";
 import type { ApiClient } from "../../../../lib/util/api.js";
+import { SendRequest } from "./sendJob.js";
+/** The message a failure is about: as the server reports it (a `SendEvent`), or as this tab sent it. */
+export type FailedSend = Pick<SendEvent, "uid" | "mailboxUid" | "subject" | "recipients">;
 /** Shows what a send event means to the user. `client` is the explicit `ApiClient` (from `useApiClient()`) whichever code observed this push
  * event was rendered under - `undefined` (the default) for every existing caller, which keeps using the default global cookie-based session
  * exactly as before. */
 export declare function handleSendEvent(event: SendEvent, client?: ApiClient): void;
+/**
+ * The sticky "This message wasn't sent" for a message that failed, `failure` saying why, with what can be done about it - for one the server
+ * failed to relay, and for a message sent as several copies (`SendRequest.copyUids`) of which this tab couldn't hand over the rest after the
+ * server had failed one (`sendJob.ts`'s `notifyFailure()`). `request`: the one it was queued from, when this tab holds it.
+ */
+export declare function notifySendFailure(event: FailedSend, failure: {
+    message: string;
+    lines: string[];
+}, request: SendRequest | undefined, client: ApiClient | undefined): void;