@remit/backend 0.0.143 → 0.0.144

package/dev-server/server.ts

@@ -1,384 +0,0 @@
-import { readFile } from "node:fs/promises";
-import { resolve } from "node:path";
-import { logger } from "@remit/logger-lambda";
-import {
-	metricsContentType,
-	onScrape,
-	renderMetrics,
-	setAccountSyncAges,
-} from "@remit/logger-lambda/metrics";
-import {
-	isStorageNotFoundError,
-	UPLOAD_ROUTE_PREFIX,
-} from "@remit/storage-service";
-import type { APIGatewayProxyResult } from "aws-lambda";
-import { env } from "expect-env";
-import express, {
-	type NextFunction,
-	type Request,
-	type Response,
-} from "express";
-import { handler, OpenAPISpec } from "../src/index.js";
-import { safeJsonParse } from "../src/json.js";
-import { getClient } from "../src/service/data-client.js";
-import { authorizeContentRequest } from "./content-auth.js";
-import { serveContent } from "./content-handler.js";
-import { resolveContentPath } from "./content-path.js";
-import { parseAllowedOrigins, resolveAllowOrigin } from "./cors.js";
-import { createLambdaContext, createLambdaEvent } from "./lambda-helpers.js";
-import { checkRelationalStore } from "./relational-health.js";
-import { collectAccountSyncAges } from "./sync-age.js";
-import { receiveUpload } from "./upload-handler.js";
-
-const app = express();
-
-// The self-host relational backend runs better-auth and the APISIX edge; the
-// AWS-local (DynamoDB) dev path runs neither. Everything gated on "not the
-// AWS-local path" keys off this.
-const isSelfHostBackend = process.env.DATA_BACKEND === "sqlite";
-
-// CORS is driven by CORS_ALLOWED_ORIGINS (comma-separated, or `*`). On the
-// self-host backend it is required config — refuse to start if unset, so the
-// deployed edge is never accidentally wide open by omission. On the AWS-local
-// dev path it defaults to `*` to keep the existing local flow working.
-const configuredCorsOrigins = parseAllowedOrigins(
-	process.env.CORS_ALLOWED_ORIGINS,
-);
-if (isSelfHostBackend && configuredCorsOrigins.length === 0) {
-	throw new Error(
-		"Missing required env var CORS_ALLOWED_ORIGINS (comma-separated origins, or '*')",
-	);
-}
-const corsAllowedOrigins =
-	configuredCorsOrigins.length > 0 ? configuredCorsOrigins : ["*"];
-
-// better-auth owns identity on the self-host backends. Its handler must be
-// mounted BEFORE express.json() (better-auth reads the raw body itself; a prior
-// json parser leaves its fetch calls hanging). This mirrors the production edge
-// where the same better-auth service sits in front of the API.
-if (isSelfHostBackend) {
-	// Synthetic OIDC discovery document for the APISIX edge tier. better-auth
-	// serves a JWKS but not a discovery doc; APISIX's openid-connect plugin needs
-	// one to locate the JWKS. Registered before the better-auth catch-all so it
-	// is not shadowed. `issuer` matches the token `iss`, so it stays the public
-	// BETTER_AUTH_URL. `jwks_uri` is different: APISIX fetches it directly, and
-	// on a deployment where the public origin isn't reachable from inside the
-	// container network (a tailnet/VPN address a bridge network can't route to
-	// — the shape deploy/vps's compose stack runs in), deriving it from
-	// BETTER_AUTH_URL would point APISIX at an address it cannot reach, even
-	// though it just reached this very endpoint fine.
-	//
-	// BETTER_AUTH_JWKS_URL — the same in-network override
-	// remit-auth-service's own verifier config already reads
-	// (packages/auth-service/src/config.ts) and every env file sets to
-	// the backend's in-network address — is authoritative here, not the
-	// incoming request's Host header: an operator-controlled value instead
-	// of one derived from client-supplied input. It only falls back to
-	// echoing the request's own host when unset, matching prior behavior
-	// for any environment that doesn't set it.
-	app.get(
-		"/api/auth/.well-known/openid-configuration",
-		(req: Request, res: Response) => {
-			const base =
-				process.env.BETTER_AUTH_URL ??
-				`http://localhost:${process.env.SERVER_PORT ?? "5436"}`;
-			const jwksUri =
-				process.env.BETTER_AUTH_JWKS_URL ??
-				`${req.protocol}://${req.get("host")}/api/auth/jwks`;
-			res.json({
-				issuer: base,
-				jwks_uri: jwksUri,
-				authorization_endpoint: `${base}/api/auth/authorize`,
-				token_endpoint: `${base}/api/auth/token`,
-				response_types_supported: ["token"],
-				subject_types_supported: ["public"],
-				id_token_signing_alg_values_supported: ["RS256"],
-			});
-		},
-	);
-
-	const { createAuth, resolveAuthConfig, toNodeHandler, withRateLimitLogging } =
-		await import("@remit/auth-service");
-	const auth = await createAuth(resolveAuthConfig());
-	app.all(/^\/api\/auth\//, toNodeHandler(withRateLimitLogging(auth)));
-}
-
-// Ahead of the body parsers, not after them: a body refused for its size never
-// reaches a route, and without these headers the browser reads that refusal as
-// a network failure instead of the reason it carries.
-app.use((req: Request, res: Response, next: NextFunction) => {
-	const allowOrigin = resolveAllowOrigin(
-		req.headers.origin,
-		corsAllowedOrigins,
-	);
-	if (allowOrigin) {
-		res.header("Access-Control-Allow-Origin", allowOrigin);
-		if (allowOrigin !== "*") res.header("Vary", "Origin");
-	}
-	res.header(
-		"Access-Control-Allow-Methods",
-		"GET, POST, PUT, DELETE, OPTIONS, PATCH",
-	);
-	res.header(
-		"Access-Control-Allow-Headers",
-		"Origin, X-Requested-With, Content-Type, Accept, Authorization",
-	);
-
-	if (req.method === "OPTIONS") {
-		res.sendStatus(200);
-	} else {
-		next();
-	}
-});
-
-// The self-hosted upload receiver, the write-side twin of /content below. The
-// URL that reaches here was minted by the storage backend and carries its own
-// authority: an HMAC over the storage key, an expiry and the exact byte count.
-// No bearer token, for the same reason /content has none — the grant has to
-// travel in the URL itself. A hosted deployment presigns against block storage
-// instead and nothing arrives here at all.
-app.put(
-	new RegExp(`^${UPLOAD_ROUTE_PREFIX}.+$`),
-	async (req: Request, res: Response) => {
-		const storageKey = req.path.slice(UPLOAD_ROUTE_PREFIX.length);
-		const client = await getClient();
-
-		const result = await receiveUpload(client.storage, {
-			storageKey,
-			exp: typeof req.query.exp === "string" ? req.query.exp : undefined,
-			max: typeof req.query.max === "string" ? req.query.max : undefined,
-			sig: typeof req.query.sig === "string" ? req.query.sig : undefined,
-			body: req,
-			nowSeconds: Math.floor(Date.now() / 1000),
-			secret: process.env.BETTER_AUTH_SECRET,
-			findLiveReservation: (accountConfigId, outboxAttachmentId) =>
-				client.outboxAttachment.hasLiveReservation(
-					accountConfigId,
-					outboxAttachmentId,
-				),
-		});
-
-		res.setHeader("x-remit-upload-reason", result.reason);
-		res.status(result.status);
-		res.send(result.status === 204 ? undefined : result.reason);
-	},
-);
-
-app.use(express.json({ limit: "10mb" }));
-app.use(express.urlencoded({ extended: true }));
-
-app.get("/.well-known/appspecific/com.chrome.devtools.json", () => ({}));
-
-app.get("/health", async (_req: Request, res: Response) => {
-	const relationalStoreReachable = await checkRelationalStore();
-	if (!relationalStoreReachable) {
-		res.status(503).json({ status: "unhealthy" });
-		return;
-	}
-	res.json({
-		status: "ok",
-		timestamp: new Date().toISOString(),
-		service: "remit-backend-local",
-	});
-});
-
-// The scrape endpoint (standalone-observability D2), on the port this server
-// already serves on and never routed through Caddy — deploy/vps/caddy/routes.caddy
-// proxies /api/*, /content/* and /health, and everything else goes to the static
-// web server, so there is no path from the public origin to this route.
-//
-// The per-account sync age is a database read, so it is collected when a scrape
-// arrives rather than tracked as syncs complete. A read that fails fails the
-// scrape: a signal that could not be evaluated must not render as a healthy
-// number. Only the self-host backends have a store to read here — the
-// AWS-local dev path composes its client from outside this module.
-if (isSelfHostBackend) {
-	onScrape(async () => {
-		const client = await getClient();
-		setAccountSyncAges(await collectAccountSyncAges(client, Date.now()));
-	});
-}
-
-app.get("/metrics", async (_req: Request, res: Response) => {
-	const body = await renderMetrics().catch((error: unknown) => {
-		logger.error({ error: String(error) }, "Metrics collection failed");
-		return null;
-	});
-	if (body === null) {
-		res.status(500).type("text/plain").send("metrics collection failed\n");
-		return;
-	}
-	res.setHeader("content-type", metricsContentType).send(body);
-});
-
-// Swagger UI exposes the full API schema, so it must never be on the public
-// surface. On the self-host backends this server is the deployed backend
-// container; gate the docs to the AWS-local dev path only. The generated
-// OpenAPI document is still consumed programmatically by the APISIX edge via its
-// own mounted paths — this only removes the browsable UI from the deployed
-// surface.
-//
-// Dynamic import, not a static one: swagger-ui-express uses `__dirname` to
-// locate its bundled assets on disk, which esbuild only shims (not
-// eliminates) for an unconditional top-level import — that shim plus this
-// file's own top-level `await import("@remit/auth-service")` above
-// makes the bundle's module format ambiguous to Node
-// (`ERR_AMBIGUOUS_MODULE_SYNTAX`), crashing every backend container start,
-// including the ones that never take this branch. A dynamic import here
-// keeps swagger-ui-express (and its `__dirname` shim) out of module scope
-// entirely unless this is the AWS-local dev path.
-if (!isSelfHostBackend) {
-	const swaggerUi = await import("swagger-ui-express");
-	const localSpec = { ...OpenAPISpec };
-	if (localSpec.servers) {
-		localSpec.servers[0].url = "/";
-	}
-	app.use("/api-docs", swaggerUi.serve, swaggerUi.setup(localSpec));
-}
-
-// Local stand-in for the CloudFront `/content/*` behavior. In production the
-// Lambda@Edge JWT verifier guards these requests and CloudFront serves them
-// from the storage S3 bucket via OAC. Locally we stream the bytes from the
-// filesystem-backed storage location keyed by URL path. No JWT check — this
-// server only runs against an isolated dev/e2e DynamoDB + storage tree.
-//
-// `LOCAL_CONTENT_STORAGE_BASE` lets the e2e/smoke fixture point this server at
-// the same absolute filesystem root it seeded under (repo-relative), since
-// the fixture writes from the repo root while the dev-server's cwd is the
-// playwright workspace.
-const STORAGE_LOCAL_PATH = process.env.STORAGE_LOCAL_PATH ?? ".remit/storage";
-const STORAGE_BASE = resolve(
-	process.env.LOCAL_CONTENT_STORAGE_BASE ?? process.cwd(),
-	STORAGE_LOCAL_PATH,
-);
-
-app.get(/^\/content\/.+$/, async (req: Request, res: Response) => {
-	const storageKey = req.path.replace(/^\/content\//, "");
-
-	// On the self-host stack this route is the deployed content-delivery surface;
-	// require a valid signed URL (HMAC + expiry, scoped to the owning account)
-	// before touching storage. Bearer auth can't ride on an `<img src>` content
-	// load, so the signature carried in the query string is the authorization.
-	const auth = authorizeContentRequest({
-		dataBackend: process.env.DATA_BACKEND,
-		secret: process.env.BETTER_AUTH_SECRET,
-		relativePath: storageKey,
-		exp: typeof req.query.exp === "string" ? req.query.exp : undefined,
-		sig: typeof req.query.sig === "string" ? req.query.sig : undefined,
-		nowSeconds: Math.floor(Date.now() / 1000),
-	});
-	if (!auth.authorized) {
-		res.status(auth.status).setHeader("x-remit-403-reason", auth.reason);
-		res.send(auth.reason);
-		return;
-	}
-
-	const fullPath = resolveContentPath(STORAGE_BASE, storageKey);
-	if (fullPath === null) {
-		res.status(400).send("invalid path");
-		return;
-	}
-
-	const client = await getClient();
-	const result = await serveContent(
-		{
-			// ENOENT means the body isn't synced yet (→ 202); any other read error
-			// throws so express 500s it — never masked as a missing body.
-			readObject: async (path) =>
-				readFile(path).catch((error: unknown) => {
-					if (isStorageNotFoundError(error)) return null;
-					throw error;
-				}),
-			lookupMessage: async (messageId) => {
-				// A gone message row means nothing to re-arm — still answer 202.
-				const message = await client.message.get(messageId).catch(() => null);
-				return message
-					? { mailboxId: message.mailboxId, uid: message.uid }
-					: null;
-			},
-			requestBodySync: async (input) => {
-				await client.bodySyncQueue?.requestBodySync(input);
-			},
-		},
-		{ fullPath, storageKey },
-	);
-
-	res.status(result.status);
-	for (const [name, value] of Object.entries(result.headers)) {
-		res.setHeader(name, value);
-	}
-	res.send(result.body);
-});
-
-app.all(/(.*)/, async (req: Request, res: Response) => {
-	const event = createLambdaEvent(req);
-	const context = createLambdaContext();
-
-	const result: APIGatewayProxyResult = await handler(event, context);
-	const headers = (result.headers ?? {}) as Record<string, string>;
-
-	let body: unknown = result.body;
-
-	if (
-		typeof body === "string" &&
-		headers["Content-Type"]?.includes("application/json")
-	) {
-		const parsed = await safeJsonParse<unknown>(body).catch(() => undefined);
-		if (parsed === undefined) {
-			logger.error("Failed to parse JSON body");
-		} else if (
-			parsed &&
-			typeof parsed === "object" &&
-			"statusCode" in parsed &&
-			"body" in parsed
-		) {
-			const inner = (parsed as { body: unknown }).body;
-			body =
-				typeof inner === "string"
-					? await safeJsonParse(inner).catch(() => inner)
-					: inner;
-		} else {
-			body = parsed;
-		}
-	}
-
-	res
-		.setHeaders(new Map(Object.entries(headers)))
-		.status(result.statusCode)
-		.send(body);
-});
-
-const port = env.SERVER_PORT;
-
-// This file is the backend image's entrypoint, so its startup output is the
-// first thing a log collector reads from the container. It goes through the
-// logger for the same reason every other line does: one JSON object per line is
-// the contract in deploy/vps/README.md, and a banner printed alongside it is a
-// line the pipeline cannot parse.
-//
-// This is also the everyday `npm run dev` server, so the addresses stay whole
-// and clickable — `url`, not a port a developer has to assemble one themselves.
-// Exported so a test that drives this exact app can shut the listener down
-// afterwards; nothing else has any business holding it.
-export const listener = app.listen(Number(port), "0.0.0.0", () => {
-	// biome-ignore lint/plugin/no-logger-info: the configuration a container came up on is an audit-grade signal
-	logger.info(
-		{
-			port: Number(port),
-			url: `http://localhost:${port}`,
-			dataBackend: process.env.DATA_BACKEND,
-			nodeEnv: env.NODE_ENV,
-			...(isSelfHostBackend
-				? {}
-				: { apiDocsUrl: `http://localhost:${port}/api-docs` }),
-		},
-		"Backend listening",
-	);
-
-	process.send?.("ready");
-});
-
-// Outlasts the idle timeout of every proxy that reuses connections to it.
-listener.keepAliveTimeout = 65_000;
-
-export default app;

package/dev-server/sync-age.test.ts

@@ -1,91 +0,0 @@
-import assert from "node:assert/strict";
-import { describe, it } from "node:test";
-import type { AccountItem, MailboxItem } from "@remit/data-ports";
-import { collectAccountSyncAges, type SyncAgeSource } from "./sync-age.js";
-
-const NOW = 1_700_000_000_000;
-
-const account = (overrides: Partial<AccountItem>): AccountItem =>
-	({
-		accountId: "acct-1",
-		createdAt: NOW - 600_000,
-		lastSyncAt: NOW,
-		...overrides,
-	}) as AccountItem;
-
-const mailbox = (lastMessageSyncAt: number): MailboxItem =>
-	({ mailboxId: `mbx-${lastMessageSyncAt}`, lastMessageSyncAt }) as MailboxItem;
-
-const source = (
-	accounts: AccountItem[],
-	mailboxes: Record<string, MailboxItem[]>,
-): SyncAgeSource => ({
-	account: { listAll: async () => accounts },
-	mailbox: {
-		listAllByAccount: async (accountId: string) => mailboxes[accountId] ?? [],
-	},
-});
-
-describe("collectAccountSyncAges", () => {
-	it("measures from the newest mailbox message-sync stamp", async () => {
-		const ages = await collectAccountSyncAges(
-			source([account({})], {
-				"acct-1": [mailbox(NOW - 300_000), mailbox(NOW - 60_000)],
-			}),
-			NOW,
-		);
-		assert.deepEqual(ages, [{ accountId: "acct-1", ageSeconds: 60 }]);
-	});
-
-	it("ignores account.lastSyncAt, which is stamped before the message fan-out", async () => {
-		// lastSyncAt is fresh and every message handler has been failing for an
-		// hour. The exported age must report the hour.
-		const ages = await collectAccountSyncAges(
-			source([account({ lastSyncAt: NOW })], {
-				"acct-1": [mailbox(NOW - 3_600_000)],
-			}),
-			NOW,
-		);
-		assert.deepEqual(ages, [{ accountId: "acct-1", ageSeconds: 3600 }]);
-	});
-
-	it("treats an unstamped mailbox as never synced", async () => {
-		const ages = await collectAccountSyncAges(
-			source([account({ createdAt: NOW - 900_000 })], {
-				"acct-1": [mailbox(0)],
-			}),
-			NOW,
-		);
-		assert.deepEqual(ages, [{ accountId: "acct-1", ageSeconds: 900 }]);
-	});
-
-	it("reports an account with no mailboxes at all rather than omitting it", async () => {
-		const ages = await collectAccountSyncAges(
-			source([account({ createdAt: NOW - 120_000 })], {}),
-			NOW,
-		);
-		assert.deepEqual(ages, [{ accountId: "acct-1", ageSeconds: 120 }]);
-	});
-
-	it("skips a deleted account", async () => {
-		const ages = await collectAccountSyncAges(
-			source(
-				[
-					account({ accountId: "gone", deletedAt: NOW - 1000 }),
-					account({ accountId: "live" }),
-				],
-				{ live: [mailbox(NOW - 30_000)] },
-			),
-			NOW,
-		);
-		assert.deepEqual(ages, [{ accountId: "live", ageSeconds: 30 }]);
-	});
-
-	it("never reports a negative age when a stamp is ahead of the clock", async () => {
-		const ages = await collectAccountSyncAges(
-			source([account({})], { "acct-1": [mailbox(NOW + 5_000)] }),
-			NOW,
-		);
-		assert.deepEqual(ages, [{ accountId: "acct-1", ageSeconds: 0 }]);
-	});
-});

package/dev-server/sync-age.ts

@@ -1,55 +0,0 @@
-import type { IAccountRepository, IMailboxRepository } from "@remit/data-ports";
-
-export interface SyncAgeSource {
-	readonly account: Pick<IAccountRepository, "listAll">;
-	readonly mailbox: Pick<IMailboxRepository, "listAllByAccount">;
-}
-
-export interface AccountSyncAge {
-	readonly accountId: string;
-	readonly ageSeconds: number;
-}
-
-/**
- * Seconds since each account last completed a message-sync round
- * (standalone-observability D3).
- *
- * Measured from `mailbox.lastMessageSyncAt`, not `account.lastSyncAt`.
- * `account.lastSyncAt` is stamped after the mailbox *list* sync and before the
- * per-mailbox fan-out that fetches messages, so a deployment whose message
- * handlers all throw keeps it fresh forever while no mail arrives.
- * `lastMessageSyncAt` is stamped at the end of a message-sync round, after the
- * fetch and the writes.
- *
- * The value is the age of the newest such stamp across the account's mailboxes:
- * seconds since this account last completed a round trip that would have found
- * new mail if there were any. An account with no stamped mailbox has never
- * completed one, and reports the age of the account row instead of being
- * omitted — "never synced" is the condition most worth seeing, not a gap in the
- * series.
- *
- * Labelled by account id, never by address: a scraped label travels wherever
- * the scrape goes.
- */
-export const collectAccountSyncAges = async (
-	source: SyncAgeSource,
-	now: number,
-): Promise<AccountSyncAge[]> => {
-	const accounts = await source.account.listAll();
-	const ages: AccountSyncAge[] = [];
-	for (const account of accounts) {
-		if (account.deletedAt) continue;
-		const mailboxes = await source.mailbox.listAllByAccount(account.accountId);
-		const stamps = mailboxes
-			.map((mailbox) => mailbox.lastMessageSyncAt)
-			.filter(
-				(stamp): stamp is number => typeof stamp === "number" && stamp > 0,
-			);
-		const newest = stamps.length > 0 ? Math.max(...stamps) : account.createdAt;
-		ages.push({
-			accountId: account.accountId,
-			ageSeconds: Math.max(0, Math.round((now - newest) / 1000)),
-		});
-	}
-	return ages;
-};

package/dev-server/upload-handler.ts

@@ -1,132 +0,0 @@
-import type { Readable } from "node:stream";
-import {
-	authorizeUploadRequest,
-	parseOutboxAttachmentKey,
-	type StorageService,
-} from "@remit/storage-service";
-
-/**
- * The self-hosted receiver for an attachment upload.
- *
- * A hosted deployment mints a presigned PUT and none of this runs: the browser
- * writes to block storage and the size is bound by the storage service itself.
- * Where there is no storage service to presign against, this route is the
- * equivalent, and it has to bind the same things — one attachment, one size,
- * for a while — on its own.
- */
-
-export type CollectedBody =
-	| { readonly outcome: "Collected"; readonly content: Buffer }
-	| { readonly outcome: "TooLarge" };
-
-/**
- * Read a request body, refusing it the moment it passes what was reserved.
- *
- * The count is checked per chunk and the stream destroyed on the one that
- * crosses the line, so a client that reserved a megabyte and started sending a
- * hundred is cut off after the first megabyte rather than after all of it.
- */
-export const collectLimitedBody = async (
-	stream: Readable,
-	maxBytes: number,
-): Promise<CollectedBody> => {
-	const chunks: Buffer[] = [];
-	let received = 0;
-
-	for await (const chunk of stream) {
-		const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
-		received += buffer.length;
-		if (received > maxBytes) {
-			// Stop reading, but leave the socket alone: destroying it here races the
-			// 413 the caller is about to write, and the client sees a connection
-			// reset instead of the reason it was refused.
-			stream.pause();
-			return { outcome: "TooLarge" };
-		}
-		chunks.push(buffer);
-	}
-
-	return { outcome: "Collected", content: Buffer.concat(chunks) };
-};
-
-export interface ReceiveUploadInput {
-	/** Decoded storage key, the `/outbox-upload/` prefix already stripped. */
-	storageKey: string;
-	exp: string | undefined;
-	max: string | undefined;
-	sig: string | undefined;
-	body: Readable;
-	nowSeconds: number;
-	secret: string | undefined;
-	/**
-	 * Whether the database still holds a live reservation for this attachment.
-	 * Injected rather than reached for, so the receiver stays a function of its
-	 * request and the storage it writes to.
-	 */
-	findLiveReservation: (
-		accountConfigId: string,
-		outboxAttachmentId: string,
-		nowSeconds: number,
-	) => Promise<boolean>;
-}
-
-export interface UploadResult {
-	status: number;
-	reason: string;
-}
-
-export const receiveUpload = async (
-	storage: StorageService,
-	input: ReceiveUploadInput,
-): Promise<UploadResult> => {
-	const target = parseOutboxAttachmentKey(input.storageKey);
-	if (!target) return { status: 404, reason: "not-an-attachment-key" };
-
-	const auth = authorizeUploadRequest({
-		secret: input.secret,
-		relativePath: input.storageKey,
-		exp: input.exp,
-		max: input.max,
-		sig: input.sig,
-		nowSeconds: input.nowSeconds,
-	});
-	if (!auth.authorized) {
-		return { status: auth.status, reason: auth.reason };
-	}
-
-	// A signed URL outlives the draft it was minted for, so possession of one is
-	// not enough: the database has to still hold a live reservation for this
-	// attachment. Without this a URL minted before a discard writes bytes back
-	// under a draft that no longer exists. The hosted shape cannot make this
-	// check — block storage receives the PUT directly — which is what the sweep
-	// exists for.
-	const reserved = await input.findLiveReservation(
-		target.accountConfigId,
-		target.outboxAttachmentId,
-		input.nowSeconds,
-	);
-	if (!reserved) return { status: 409, reason: "no-live-reservation" };
-
-	const collected = await collectLimitedBody(input.body, auth.maxBytes);
-	if (collected.outcome === "TooLarge") {
-		return { status: 413, reason: "over-reserved-size" };
-	}
-
-	// Exactly the reserved size, not merely under it — the same thing S3 binds
-	// when it recomputes a presigned PUT's signature over the content-length it
-	// was sent. A short body is a failed upload, and the completion would refuse
-	// it anyway; refusing here means no partial object is left to refuse.
-	if (collected.content.length !== auth.maxBytes) {
-		return { status: 400, reason: "size-mismatch" };
-	}
-
-	await storage.storeOutboxAttachment({
-		accountConfigId: target.accountConfigId,
-		accountId: target.accountId,
-		outboxMessageId: target.outboxMessageId,
-		outboxAttachmentId: target.outboxAttachmentId,
-		content: collected.content,
-	});
-
-	return { status: 204, reason: "stored" };
-};