@remit/data-ports 0.0.10 → 0.0.12

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remit/data-ports",
-  "version": "0.0.10",
+  "version": "0.0.12",
   "type": "module",
   "main": "src/index.ts",
   "types": "src/index.ts",
@@ -28,6 +28,10 @@
     "./wellknown": {
       "types": "./src/wellknown.ts",
       "default": "./src/wellknown.ts"
+    },
+    "./update-manifest": {
+      "types": "./src/update-manifest.ts",
+      "default": "./src/update-manifest.ts"
     }
   },
   "scripts": {

package/src/id.test.ts

@@ -1,6 +1,11 @@
 import assert from "node:assert/strict";
 import { describe, it } from "node:test";
-import { deriveQuarantineId, quarantineMessageIdHash } from "./id.js";
+import {
+	deriveCopyMessageId,
+	deriveMessageId,
+	deriveQuarantineId,
+	quarantineMessageIdHash,
+} from "./id.js";
 
 const ACCOUNT = "acct-1";
 const MAILBOX = "mbx-1";
@@ -30,6 +35,38 @@ describe("deriveQuarantineId", () => {
 	});
 });
 
+describe("deriveCopyMessageId", () => {
+	const SOURCE = deriveMessageId(ACCOUNT, "<abc@example.com>");
+	const DEST = "mbx-archive";
+
+	it("is stable for the same source and destination (idempotent copy)", () => {
+		assert.equal(
+			deriveCopyMessageId(SOURCE, DEST),
+			deriveCopyMessageId(SOURCE, DEST),
+		);
+	});
+
+	it("separates a copy of one mail into two folders", () => {
+		assert.notEqual(
+			deriveCopyMessageId(SOURCE, DEST),
+			deriveCopyMessageId(SOURCE, "mbx-other"),
+		);
+	});
+
+	it("separates copies of two different mails into one folder", () => {
+		assert.notEqual(
+			deriveCopyMessageId(SOURCE, DEST),
+			deriveCopyMessageId(deriveMessageId(ACCOUNT, "<xyz@example.com>"), DEST),
+		);
+	});
+
+	it("never equals the folder-independent id sync derives", () => {
+		// Sync keys a message on deriveMessageId; the copy id folds in the
+		// destination mailbox, so the two can never collide.
+		assert.notEqual(deriveCopyMessageId(SOURCE, DEST), SOURCE);
+	});
+});
+
 describe("quarantineMessageIdHash", () => {
 	it("hashes a real Message-ID to a pinned sha256 value", () => {
 		const hash = quarantineMessageIdHash("<abc@example.com>");

package/src/id.ts

@@ -73,6 +73,29 @@ export const deriveMessageIdFromSource = (
 	source: MessageIdSource,
 ): string => deriveMessageId(accountId, normalizeMessageIdHeader(source));
 
+/**
+ * Identity of a message copied into another folder (issue #75). Derived from
+ * the source message and the destination mailbox so a copy is deterministic:
+ * copying the same mail into the same folder twice — a replayed COPY event or a
+ * repeated user copy — resolves to one row instead of a fresh unreachable
+ * duplicate each time. A random id, which is what the copy path used before,
+ * gave every attempt a new identity that no later sync or delete could reach.
+ *
+ * The destination mailbox is part of the name so a copy of one mail into two
+ * folders is two rows, one per folder. It also keeps this id out of the space
+ * sync assigns: sync keys a message on `deriveMessageId(accountId,
+ * messageIdHeader)`, which is folder-independent, so the copy row can never
+ * collide with, or be overwritten by, the canonical synced row.
+ */
+export const deriveCopyMessageId = (
+	sourceMessageId: string,
+	destinationMailboxId: string,
+): string =>
+	base36uuidv5(
+		`messagecopy:${sourceMessageId}:${destinationMailboxId}`,
+		REMIT_NAMESPACE,
+	);
+
 export const deriveThreadId = (
 	accountId: string,
 	rootMessageIdHeader: string,

package/src/update-manifest.test.ts

@@ -0,0 +1,100 @@
+import assert from "node:assert/strict";
+import { describe, it } from "node:test";
+import { UpdateManifestSchema } from "./update-manifest.js";
+
+const GOOD_MANIFEST = {
+	version: "v1.5.0",
+	publishedAt: "2026-07-18T09:00:00Z",
+	summary: "Faster search and a fix for attachments over 25 MB.",
+	releaseNotesUrl: "https://github.com/remit-mail/reader/releases/tag/v1.5.0",
+	registry: "ghcr.io/remit-mail/reader",
+};
+
+describe("UpdateManifestSchema", () => {
+	it("accepts the documented manifest shape", () => {
+		assert.deepEqual(UpdateManifestSchema.parse(GOOD_MANIFEST), GOOD_MANIFEST);
+	});
+
+	it("rejects a version that is not vX.Y.Z", () => {
+		assert.throws(() =>
+			UpdateManifestSchema.parse({ ...GOOD_MANIFEST, version: "1.5.0" }),
+		);
+		assert.throws(() =>
+			UpdateManifestSchema.parse({ ...GOOD_MANIFEST, version: "v1.5" }),
+		);
+		assert.throws(() =>
+			UpdateManifestSchema.parse({ ...GOOD_MANIFEST, version: "v1.5.0-rc1" }),
+		);
+	});
+
+	it("rejects a publishedAt that is not ISO 8601", () => {
+		assert.throws(() =>
+			UpdateManifestSchema.parse({
+				...GOOD_MANIFEST,
+				publishedAt: "18 July 2026",
+			}),
+		);
+	});
+
+	it("rejects an empty summary", () => {
+		assert.throws(() =>
+			UpdateManifestSchema.parse({ ...GOOD_MANIFEST, summary: "" }),
+		);
+	});
+
+	it("rejects a summary over 140 characters", () => {
+		assert.throws(() =>
+			UpdateManifestSchema.parse({
+				...GOOD_MANIFEST,
+				summary: "x".repeat(141),
+			}),
+		);
+	});
+
+	it("accepts a summary at exactly 140 characters", () => {
+		const summary = "x".repeat(140);
+		assert.equal(
+			UpdateManifestSchema.parse({ ...GOOD_MANIFEST, summary }).summary,
+			summary,
+		);
+	});
+
+	it("rejects a releaseNotesUrl that is not a URL", () => {
+		assert.throws(() =>
+			UpdateManifestSchema.parse({
+				...GOOD_MANIFEST,
+				releaseNotesUrl: "not-a-url",
+			}),
+		);
+	});
+
+	it("rejects a releaseNotesUrl that is not https", () => {
+		assert.throws(() =>
+			UpdateManifestSchema.parse({
+				...GOOD_MANIFEST,
+				releaseNotesUrl:
+					"http://github.com/remit-mail/reader/releases/tag/v1.5.0",
+			}),
+		);
+	});
+
+	it("rejects a releaseNotesUrl using a non-http(s) scheme", () => {
+		assert.throws(() =>
+			UpdateManifestSchema.parse({
+				...GOOD_MANIFEST,
+				releaseNotesUrl: "javascript:alert(1)",
+			}),
+		);
+	});
+
+	it("rejects an empty registry", () => {
+		assert.throws(() =>
+			UpdateManifestSchema.parse({ ...GOOD_MANIFEST, registry: "" }),
+		);
+	});
+
+	it("rejects a manifest missing a required field", () => {
+		const { summary, ...rest } = GOOD_MANIFEST;
+		assert.throws(() => UpdateManifestSchema.parse(rest));
+	});
+});

package/src/update-manifest.ts

@@ -0,0 +1,18 @@
+import { z } from "zod";
+
+export const SUMMARY_MAX_LENGTH = 140;
+
+export const UpdateManifestSchema = z.object({
+	version: z.string().regex(/^v\d+\.\d+\.\d+$/),
+	publishedAt: z.string().datetime(),
+	summary: z.string().min(1).max(SUMMARY_MAX_LENGTH),
+	releaseNotesUrl: z
+		.string()
+		.url()
+		.refine((url) => url.startsWith("https://"), {
+			message: "releaseNotesUrl must be an https:// URL",
+		}),
+	registry: z.string().min(1),
+});
+
+export type UpdateManifest = z.infer<typeof UpdateManifestSchema>;