@remit/data-ports 0.0.83 → 0.0.84

package/dist/interfaces/mailbox-special-use.d.ts

@@ -0,0 +1,54 @@
+import type { JunkRoleMailboxes, RoleResolution } from "../folder-role.js";
+import type { MailboxSpecialUseItem, MailboxSpecialUseValue } from "../types.js";
+/**
+ * Special-use entries, plus the per-role lookup every special-folder operation
+ * goes through. The `find<Role>Mailbox` reads answer "which folder holds this
+ * role for this account", in the one precedence order `resolveMailboxForRole`
+ * defines: the user's appointment first (RFC 032 exclusive-folder-appointment,
+ * #976), then the server's SPECIAL-USE flag, then a conventional name.
+ */
+export interface IMailboxSpecialUseRepository {
+    create(mailboxId: string, specialUse: MailboxSpecialUseValue): Promise<MailboxSpecialUseItem>;
+    createMany(mailboxId: string, specialUses: MailboxSpecialUseValue[]): Promise<MailboxSpecialUseItem[]>;
+    listByMailboxId(mailboxId: string): Promise<MailboxSpecialUseItem[]>;
+    deleteByMailboxId(mailboxId: string): Promise<number>;
+    findInboxMailbox(accountId: string): Promise<{
+        mailboxId: string;
+        fullPath: string;
+    } | null>;
+    findSentMailbox(accountId: string): Promise<{
+        mailboxId: string;
+        fullPath: string;
+    } | null>;
+    findTrashMailbox(accountId: string): Promise<{
+        mailboxId: string;
+        fullPath: string;
+    } | null>;
+    /**
+     * Trash with the evidence attached, for the two verbs that weigh it: a
+     * delete files mail somewhere retrievable, an Empty Trash destroys it, and
+     * they refuse on different grounds. `null` cannot tell them apart — an
+     * appointment naming a folder that is gone is a different answer from no
+     * folder at all, and only this read distinguishes them.
+     */
+    resolveTrashRole(accountId: string): Promise<RoleResolution<{
+        mailboxId: string;
+        fullPath: string;
+    }>>;
+    findArchiveMailbox(accountId: string): Promise<{
+        mailboxId: string;
+        fullPath: string;
+    } | null>;
+    findJunkMailbox(accountId: string): Promise<{
+        mailboxId: string;
+        fullPath: string;
+    } | null>;
+    /**
+     * Junk and Trash for every account under one config, as mailbox ids. The
+     * address book is keyed by config and an address carries sightings from all
+     * of them, so a predicate over an address must weigh every account's Junk —
+     * resolving only the account in hand withholds a sender on one and restores
+     * it on the next.
+     */
+    resolveJunkRolesForConfig(accountConfigId: string): Promise<JunkRoleMailboxes>;
+}

package/dist/interfaces/mailbox-special-use.js

@@ -0,0 +1 @@
+export {};

package/dist/interfaces/mailbox.d.ts

@@ -0,0 +1,79 @@
+import type { CreateMailboxInput, CreateMailboxResult, MailboxItem, MailboxSubtreeTransitionIntent, MailboxTransitionIntent, ResultList, UpdateMailboxInput } from "../types.js";
+export interface IMailboxRepository {
+    create(input: CreateMailboxInput): Promise<CreateMailboxResult>;
+    get(accountId: string, mailboxId: string): Promise<MailboxItem>;
+    get(accountId: string, mailboxIds: string[]): Promise<MailboxItem[]>;
+    /**
+     * Resolve the owning accountId for a mailbox by its (globally unique) id,
+     * without a tenant scope. Returns only the owner id (no row content); null
+     * when the mailbox does not exist.
+     *
+     * The result is NOT a trusted tenant — it is derived from the row, so it must
+     * never be fed back as the scope of a request-facing read. It has two uses:
+     * pure system routing that has no tenant of its own (stream bridge), and ownership bootstrap where a request-facing caller
+     * compares the resolved owner's accountConfigId against its OWN authenticated
+     * accountConfigId to decide the caller may proceed.
+     */
+    resolveAccountId(mailboxId: string): Promise<string | null>;
+    update(accountId: string, mailboxId: string, input: UpdateMailboxInput, remove?: string[]): Promise<MailboxItem>;
+    /**
+     * Move one folder's mutation state from the state the caller read to the
+     * state it decided on, as one conditional write
+     * (docs/architecture/folder-rename-and-delete.md D3). The only writer of
+     * `syncStatus` and `pendingPath` — so a folder state written without a
+     * predicate is a type error rather than a convention.
+     *
+     * The predicate names one of the six states, not one of the four enum
+     * values: `wherePendingPath` as a string requires equality, `null` requires
+     * the column to be NULL, and omitting it predicates on `syncStatus` alone.
+     * A create settle that leaves it out matches a row a rename has claimed and
+     * strands it `synced` with a target on it, which is the seventh combination
+     * the invariant forbids.
+     *
+     * Resolves with the written row when the predicate matched, and with `null`
+     * when it did not — the row is absent, or somebody else won. The loser
+     * re-reads and re-decides; it never blind-retries and never writes anyway.
+     */
+    transition(accountId: string, mailboxId: string, intent: MailboxTransitionIntent): Promise<MailboxItem | null>;
+    /**
+     * Record one intent across a folder and every descendant, all-or-nothing, in
+     * one UPDATE (D6), guarded on no row of the subtree being outside a
+     * from-state, so a concurrent single-row transition makes it write nothing
+     * rather than being missed by a prior read.
+     *
+     * Resolves with every written row, or with `null` when any row in the
+     * subtree was not in an accepted from-state — in which case nothing was
+     * written. The named folder comes first and its descendants follow, but a
+     * caller wanting one row should find it by `mailboxId` rather than lean on
+     * that. This serves the intent only: a settle is per-row (D15).
+     */
+    transitionSubtree(accountId: string, mailboxId: string, intent: MailboxSubtreeTransitionIntent): Promise<MailboxItem[] | null>;
+    delete(accountId: string, mailboxId: string): Promise<void>;
+    deleteMany(accountId: string, mailboxIds: string[]): Promise<void>;
+    /**
+     * Remove a folder along with the mail it holds (D8): the messages through
+     * `deleteMessageSubtree`, so the nine per-message child tables go; then the
+     * mailbox's own child rows; then, last, the mailbox row itself.
+     *
+     * "Its own child rows" includes a `message_placement_move` marker naming this
+     * folder as a move's *destination*, not only as its source. The folder it
+     * points at is gone, so the move it records can never land, and leaving the
+     * marker behind holds a message elsewhere in the account unsettled forever.
+     *
+     * Ordered, batched and resumable rather than one transaction — the caller
+     * keeps the row `deleting` until this returns, so a redelivery re-enters and
+     * continues. `filter` rows bound to this mailbox are never touched: D16
+     * refuses the delete while any binding stands, so there is nothing to unbind
+     * and deleting a user's filters is not a folder delete's decision.
+     */
+    deleteMailboxWithMail(accountId: string, mailboxId: string): Promise<void>;
+    listByAccount(accountId: string, options?: {
+        limit?: number;
+        continuationToken?: string;
+    }): Promise<ResultList<MailboxItem>>;
+    listAllByAccount(accountId: string): Promise<MailboxItem[]>;
+    findByPath(accountId: string, fullPath: string): Promise<MailboxItem | null>;
+    getOrCreateByPath(accountId: string, fullPath: string, defaults: Omit<CreateMailboxInput, "accountId" | "fullPath">): Promise<MailboxItem>;
+    findByPathPrefix(accountId: string, pathPrefix: string, delimiter?: string): Promise<MailboxItem[]>;
+    findBySyncStatus(accountId: string, syncStatus: MailboxItem["syncStatus"]): Promise<MailboxItem[]>;
+}

package/dist/interfaces/mailbox.js

@@ -0,0 +1 @@
+export {};

package/dist/interfaces/message-flag-push.d.ts

@@ -0,0 +1,9 @@
+import type { MessageFlagPushItem, PutMessageFlagPushInput } from "../types.js";
+export interface IMessageFlagPushRepository {
+    put(input: PutMessageFlagPushInput): Promise<MessageFlagPushItem>;
+    find(messageId: string, flagName: string): Promise<MessageFlagPushItem | null>;
+    updateState(messageId: string, flagName: string, state: MessageFlagPushItem["state"]): Promise<MessageFlagPushItem>;
+    delete(messageId: string, flagName: string): Promise<void>;
+    listByAccountId(accountId: string): Promise<MessageFlagPushItem[]>;
+    listByMailboxId(mailboxId: string): Promise<MessageFlagPushItem[]>;
+}

package/dist/interfaces/message-flag-push.js

@@ -0,0 +1 @@
+export {};

package/dist/interfaces/message-flag.d.ts

@@ -0,0 +1,14 @@
+import type { CreateMessageFlagInput, MessageFlagItem } from "../types.js";
+export interface IMessageFlagRepository {
+    create(input: CreateMessageFlagInput): Promise<MessageFlagItem>;
+    get(messageFlagId: string): Promise<MessageFlagItem>;
+    get(messageFlagIds: string[]): Promise<MessageFlagItem[]>;
+    delete(messageFlagId: string): Promise<void>;
+    deleteMany(messageFlagIds: string[]): Promise<void>;
+    getFlags(messageId: string): Promise<MessageFlagItem[]>;
+    hasFlag(messageId: string, flagName: string): Promise<boolean>;
+    addFlag(messageId: string, flagName: string): Promise<MessageFlagItem>;
+    removeFlag(messageId: string, flagName: string): Promise<void>;
+    addFlags(messageId: string, flagNames: string[]): Promise<void>;
+    removeFlags(messageId: string, flagNames: string[]): Promise<void>;
+}

package/dist/interfaces/message-flag.js

@@ -0,0 +1 @@
+export {};

package/dist/interfaces/message-label.d.ts

@@ -0,0 +1,21 @@
+import type { CreateMessageLabelInput, MessageLabelItem } from "../types.js";
+export interface IMessageLabelRepository {
+    apply(input: CreateMessageLabelInput): Promise<MessageLabelItem>;
+    remove(messageId: string, labelId: string): Promise<void>;
+    listByMessageId(messageId: string): Promise<MessageLabelItem[]>;
+    /**
+     * Batch-fetch every MessageLabel row across a page of messages in one query
+     * — the read-time enrichment a thread listing needs (issue #26), mirroring
+     * the one-BatchGet-per-page contract `enrichThreadRows` already holds for
+     * Message/Address.
+     */
+    listByMessageIds(messageIds: string[]): Promise<MessageLabelItem[]>;
+    listByLabelId(accountConfigId: string, labelId: string): Promise<MessageLabelItem[]>;
+    /**
+     * Delete every MessageLabel row for a label in one statement — the message
+     * side of a label delete's cascade (issue #26). A label delete cascades in
+     * both directions: this clears the applied-to-messages side, and the
+     * caller separately deletes any filter whose actionLabelId is this label.
+     */
+    removeAllByLabelId(accountConfigId: string, labelId: string): Promise<void>;
+}

package/dist/interfaces/message-label.js

@@ -0,0 +1 @@
+export {};

package/dist/interfaces/message-placement-move.d.ts

@@ -0,0 +1,8 @@
+import type { MessagePlacementMoveItem, PutMessagePlacementMoveInput } from "../types.js";
+export interface IMessagePlacementMoveRepository {
+    put(input: PutMessagePlacementMoveInput): Promise<MessagePlacementMoveItem>;
+    find(messageId: string): Promise<MessagePlacementMoveItem | null>;
+    updateState(messageId: string, state: MessagePlacementMoveItem["state"]): Promise<MessagePlacementMoveItem>;
+    delete(messageId: string): Promise<void>;
+    listByAccountId(accountId: string): Promise<MessagePlacementMoveItem[]>;
+}

package/dist/interfaces/message-placement-move.js

@@ -0,0 +1 @@
+export {};

package/dist/interfaces/message.d.ts

@@ -0,0 +1,60 @@
+import type { CreateMessageInput, MessageDescription, MessageIdSource, MessageItem, PlacementPredicate, PlacementTransitionInput, ResultList, UpdateMessageInput } from "../types.js";
+export interface IMessageRepository {
+    create(input: CreateMessageInput): Promise<MessageItem>;
+    upsert(input: CreateMessageInput): Promise<MessageItem>;
+    upsertWithStatus(input: CreateMessageInput): Promise<{
+        item: MessageItem;
+        created: boolean;
+    }>;
+    get(messageId: string): Promise<MessageItem>;
+    get(messageIds: string[]): Promise<MessageItem[]>;
+    update(messageId: string, input: UpdateMessageInput): Promise<MessageItem>;
+    clearBodyStorageKey(messageId: string): Promise<MessageItem>;
+    clearSpamReport(messageId: string): Promise<MessageItem>;
+    delete(messageId: string): Promise<void>;
+    deleteMany(messageIds: string[]): Promise<void>;
+    /**
+     * Delete the row, its per-message subtree and its thread listings, only
+     * while its placement still matches what the caller read (imap-mutations
+     * R3). Resolves `false` when the predicate did not match and nothing was
+     * deleted.
+     */
+    deleteIfPlacement(messageId: string, expected: PlacementPredicate): Promise<boolean>;
+    listByMailbox(mailboxId: string, options?: {
+        limit?: number;
+        continuationToken?: string;
+    }): Promise<ResultList<MessageItem>>;
+    listAllByMailbox(mailboxId: string): Promise<MessageItem[]>;
+    /** Rows `moving` or `deleting` that nothing has written since `untouchedSince`, uid-0 copies included. */
+    listStrandedPlacements(mailboxIds: readonly string[], untouchedSince: number): Promise<MessageItem[]>;
+    describe(messageId: string): Promise<MessageDescription>;
+    updateUid(messageId: string, newUid: number, newMailboxId: string): Promise<MessageItem>;
+    /**
+     * Move the row's placement from the state the caller read to the state it
+     * decided on, as one conditional write (imap-mutations R3). The only writer
+     * of `mailboxId`, `status`, `syncStatus`, `abandonedMutation`,
+     * `originalMailboxId` and `originalUid`, apart from the settle in
+     * {@link updateUid} — so a placement written without a predicate is a type
+     * error rather than a convention.
+     *
+     * Resolves with the written row when the predicate matched, and with
+     * `undefined` when it did not — someone else won, or the row is gone. The
+     * loser re-reads and re-decides; it never blind-retries and never writes
+     * anyway.
+     */
+    transitionPlacement(messageId: string, expected: PlacementPredicate, next: PlacementTransitionInput): Promise<MessageItem | undefined>;
+    /**
+     * Re-point a row at the placement the mail server named for it, settled,
+     * only while it still sits where the caller read it (imap-mutations R1/R3):
+     * a user move landing in between wins and this writes nothing. The row's
+     * thread listings follow in the same batch, so the listing never shows the
+     * message in a folder its row has left. Resolves `false` when the
+     * predicate did not match.
+     */
+    repointIfPlacement(messageId: string, expected: PlacementPredicate, to: {
+        mailboxId: string;
+        uid: number;
+        isDeleted: boolean;
+    }): Promise<boolean>;
+}
+export type { MessageIdSource };

package/dist/interfaces/message.js

@@ -0,0 +1 @@
+export {};

package/dist/interfaces/organize-job-request.d.ts

@@ -0,0 +1,10 @@
+import type { CreateOrganizeJobRequestInput, OrganizeJobRequestItem, ResultList, UpdateOrganizeJobRequestInput } from "../types.js";
+export interface IOrganizeJobRequestRepository {
+    create(input: CreateOrganizeJobRequestInput): Promise<OrganizeJobRequestItem>;
+    get(organizeJobId: string): Promise<OrganizeJobRequestItem>;
+    update(organizeJobId: string, input: UpdateOrganizeJobRequestInput): Promise<OrganizeJobRequestItem>;
+    listByAccountConfig(accountConfigId: string, options?: {
+        limit?: number;
+        continuationToken?: string;
+    }): Promise<ResultList<OrganizeJobRequestItem>>;
+}

package/dist/interfaces/organize-job-request.js

@@ -0,0 +1 @@
+export {};

package/dist/interfaces/outbox-attachment.d.ts

@@ -0,0 +1,101 @@
+import type { OutboxAttachmentItem } from "../types.js";
+/**
+ * Whether an attachment is spoken for: uploaded and confirmed, or reserved and
+ * not yet lapsed. The cap counts these and nothing else. The SQLite repository
+ * states the same rule as the `WHERE` of the delete that refuses an over-cap
+ * reservation, and the two must agree exactly.
+ */
+export declare const holdsRoom: (item: OutboxAttachmentItem, nowSeconds: number) => boolean;
+export interface CreateOutboxAttachmentInput {
+    outboxAttachmentId: string;
+    outboxMessageId: string;
+    accountId: string;
+    accountConfigId: string;
+    filename: string;
+    contentType: string;
+    sizeBytes: number;
+    storageKey: string;
+    reservationExpiresAt: number;
+}
+/**
+ * The numbers the reservation must fit inside. They come from the caller — the
+ * cap is a business rule and belongs with the rest of them — but they are
+ * applied here, where the count and the insert can happen together.
+ */
+export interface OutboxAttachmentCap {
+    maxTotalBytes: number;
+    maxCount: number;
+    /** Unix seconds. A Pending row past its expiry stops holding room. */
+    nowSeconds: number;
+}
+export type ReserveOutboxAttachmentResult = {
+    outcome: "Reserved";
+    item: OutboxAttachmentItem;
+} | {
+    outcome: "OverByteCap";
+    usedBytes: number;
+} | {
+    outcome: "OverCountCap";
+    usedBytes: number;
+};
+export interface IOutboxAttachmentRepository {
+    /**
+     * Claim room on a draft, or report why there is none.
+     *
+     * **The invariant an implementation owes its callers:** of two reservations
+     * for the same draft running concurrently, at most one may observe a total
+     * that does not include the other. Either one of them sees the other's row,
+     * or one of them fails. Both being told there was room is a breach, and the
+     * consequence is a message that cannot be sent — phase 4 builds a MIME body
+     * from these rows and the receiving server rejects it.
+     *
+     * A count-then-insert only satisfies that under serializable isolation or an
+     * external lock. **The drizzle/SQLite implementation gets it from one
+     * batch:** the insert, a read of the draft's rows and a delete of the new row
+     * when the draft's live rows then break the cap commit as a unit, and
+     * batches are serialized, so the later of two reservations sees the earlier
+     * one's row. A row holds room while {@link holdsRoom} says so: stored, or a
+     * reservation not yet expired.
+     *
+     * **An adapter without serializable isolation must not do a
+     * read-then-write.** On DynamoDB in particular, a Query followed by a
+     * PutItem breaches this silently and is the failure mode that matters: it is
+     * the deployment that actually scales horizontally. Use a conditional write
+     * on a per-draft aggregate instead — an `UpdateItem` that adds the size and
+     * carries a `ConditionExpression` bounding the running total, decided on
+     * whether the condition held — and derive `usedBytes` for the rejection from
+     * the same item.
+     *
+     * Either way the caller supplies the limits: the cap is a business rule and
+     * lives with the rest of them. What is delegated here is only the atomicity.
+     */
+    reserve(input: CreateOutboxAttachmentInput, cap: OutboxAttachmentCap): Promise<ReserveOutboxAttachmentResult>;
+    /** One attachment, scoped to its tenant. Throws NotFound when it is gone. */
+    get(accountConfigId: string, outboxAttachmentId: string): Promise<OutboxAttachmentItem>;
+    /**
+     * Everything a draft holds, lapsed reservations included. Callers that care
+     * about what is live filter on state and `reservationExpiresAt`.
+     */
+    listByOutboxMessage(accountConfigId: string, outboxMessageId: string): Promise<OutboxAttachmentItem[]>;
+    /**
+     * Move a reservation to Stored at the size storage actually holds. Returns
+     * null when the row is gone or no longer Pending, so a caller can tell a
+     * lapsed reservation from a confirmed one without a second read.
+     */
+    markStored(accountConfigId: string, outboxAttachmentId: string, sizeBytes: number): Promise<OutboxAttachmentItem | null>;
+    /** Drop specific attachments from a draft. */
+    deleteMany(accountConfigId: string, outboxAttachmentIds: string[]): Promise<void>;
+    /**
+     * Drop the draft's reservations that lapsed without ever being confirmed, and
+     * report which ids went.
+     *
+     * A `Pending` row past its expiry already stops holding room, but until it is
+     * gone it still names an object — which is enough for the sweep to treat that
+     * object as accounted for and leave it. So the row has to go, and the sweep
+     * collects the bytes on the same pass. `complete` refuses a lapsed row, so
+     * nothing is racing this.
+     */
+    deleteLapsedReservations(accountConfigId: string, outboxMessageId: string, nowSeconds: number): Promise<string[]>;
+    /** Drop everything a draft holds, as part of retiring the draft. */
+    deleteByOutboxMessage(accountConfigId: string, outboxMessageId: string): Promise<void>;
+}

package/dist/interfaces/outbox-attachment.js

@@ -0,0 +1,7 @@
+/**
+ * Whether an attachment is spoken for: uploaded and confirmed, or reserved and
+ * not yet lapsed. The cap counts these and nothing else. The SQLite repository
+ * states the same rule as the `WHERE` of the delete that refuses an over-cap
+ * reservation, and the two must agree exactly.
+ */
+export const holdsRoom = (item, nowSeconds) => item.state === "Stored" || item.reservationExpiresAt >= nowSeconds;

package/dist/interfaces/outbox-message.d.ts

@@ -0,0 +1,70 @@
+import type { CreateOutboxMessageInput, OutboxMessageItem, ResultList, UpdateOutboxMessageInput } from "../types.js";
+/** `appendedUid` when no IMAP APPEND has been confirmed for the row. */
+export declare const APPENDED_UID_NONE = 0;
+/**
+ * `appendedUid` when an APPEND was confirmed but the server named no uid for
+ * it. UIDPLUS is an extension; a server without it files the copy and reports
+ * nothing, and "filed" still has to be distinguishable from "not filed".
+ */
+export declare const APPENDED_UID_UNREPORTED = -1;
+/**
+ * Whether the copy in Sent exists. One definition, because the handler deciding
+ * whether to APPEND and the repair deciding what a stranded row means both have
+ * to agree on it exactly.
+ *
+ * Only the two values that mean "filed" say so, rather than everything that is
+ * not `APPENDED_UID_NONE`. The two mistakes are not each other's equal: reading
+ * a filed row as unfiled files a second copy the user then deletes, and reading
+ * an unfiled row as filed drops the row of a delivered message that is in no
+ * folder — the disappearance the whole repair exists to prevent (#824).
+ */
+export declare const isSentCopyFiled: (message: Pick<OutboxMessageItem, "appendedUid">) => boolean;
+export interface IOutboxMessageRepository {
+    create(input: CreateOutboxMessageInput): Promise<OutboxMessageItem>;
+    /**
+     * `mode: "read"` (default) throws NotFoundError on a foreign message so a
+     * GET doesn't leak existence. `mode: "act"` throws ForbiddenError instead,
+     * for action verbs (PATCH/POST/DELETE) where the caller has already named
+     * the resource and the API contract says to explicitly deny rather than
+     * feign 404 — see ownedAccount / ownedMessages.
+     */
+    get(accountConfigId: string, outboxMessageId: string, mode?: "read" | "act"): Promise<OutboxMessageItem>;
+    get(accountConfigId: string, outboxMessageIds: string[]): Promise<OutboxMessageItem[]>;
+    update(accountConfigId: string, outboxMessageId: string, input: UpdateOutboxMessageInput): Promise<OutboxMessageItem>;
+    updateStatus(accountConfigId: string, outboxMessageId: string, status: OutboxMessageItem["status"]): Promise<OutboxMessageItem>;
+    /**
+     * Write `input` only while the row still holds `expected`, and answer `null`
+     * when it does not.
+     *
+     * Every status transition is a read the caller decided on followed by a
+     * write, and the SMTP worker or a second request can move the row between
+     * the two. Naming the status that decision was made against turns the write
+     * into a compare-and-set: an edit no longer pulls a row back out of `queued`
+     * while its send event is on the wire, and a settle no longer overwrites a
+     * status the worker has already reached. `null` is the caller's to read —
+     * a conflict for an action the user asked for, and nothing to do for a
+     * settle that has been overtaken.
+     */
+    updateIfStatus(accountConfigId: string, outboxMessageId: string, expected: OutboxMessageItem["status"], input: UpdateOutboxMessageInput): Promise<OutboxMessageItem | null>;
+    markSent(accountConfigId: string, outboxMessageId: string, fields: {
+        sentAt: number;
+        smtpMessageId?: string;
+    }): Promise<OutboxMessageItem>;
+    delete(accountConfigId: string, outboxMessageId: string): Promise<void>;
+    deleteMany(accountConfigId: string, outboxMessageIds: string[]): Promise<void>;
+    listByAccount(accountId: string, options?: {
+        limit?: number;
+        continuationToken?: string;
+    }): Promise<ResultList<OutboxMessageItem>>;
+    /**
+     * One keyset scan over several accounts, ordered globally by createdAt then
+     * outboxMessageId. The continuation token names a position in that single
+     * ordering rather than one position per account, so a second page stays
+     * coherent however the accounts' rows interleave.
+     */
+    listByAccounts(accountIds: string[], options?: {
+        limit?: number;
+        continuationToken?: string;
+    }): Promise<ResultList<OutboxMessageItem>>;
+    listQueued(accountId: string): Promise<OutboxMessageItem[]>;
+}

package/dist/interfaces/outbox-message.js

@@ -0,0 +1,20 @@
+/** `appendedUid` when no IMAP APPEND has been confirmed for the row. */
+export const APPENDED_UID_NONE = 0;
+/**
+ * `appendedUid` when an APPEND was confirmed but the server named no uid for
+ * it. UIDPLUS is an extension; a server without it files the copy and reports
+ * nothing, and "filed" still has to be distinguishable from "not filed".
+ */
+export const APPENDED_UID_UNREPORTED = -1;
+/**
+ * Whether the copy in Sent exists. One definition, because the handler deciding
+ * whether to APPEND and the repair deciding what a stranded row means both have
+ * to agree on it exactly.
+ *
+ * Only the two values that mean "filed" say so, rather than everything that is
+ * not `APPENDED_UID_NONE`. The two mistakes are not each other's equal: reading
+ * a filed row as unfiled files a second copy the user then deletes, and reading
+ * an unfiled row as filed drops the row of a delivered message that is in no
+ * folder — the disappearance the whole repair exists to prevent (#824).
+ */
+export const isSentCopyFiled = (message) => message.appendedUid > 0 || message.appendedUid === APPENDED_UID_UNREPORTED;

package/dist/interfaces/quarantine.d.ts

@@ -0,0 +1,20 @@
+import type { QuarantineItem, QuarantineUpsertInput } from "../types.js";
+export interface IQuarantineRepository {
+    /**
+     * Every quarantined message for one user, newest first. Unpaginated: the
+     * list is small by design, and it is read whole both by the settings
+     * surface and by a sync round that keeps it in memory.
+     */
+    listByAccountConfigId(accountConfigId: string): Promise<QuarantineItem[]>;
+    /**
+     * Record a message the sync path could not apply.
+     *
+     * Idempotent on the message's identity: the row is keyed by an id derived
+     * from (accountId, mailboxId, uidValidity, uid), so quarantining the same
+     * message twice rewrites one row instead of accumulating. The derivation
+     * happens here rather than at the call site — see `QuarantineUpsertInput`.
+     *
+     * A cursor may only move past a message once this has resolved.
+     */
+    upsert(input: QuarantineUpsertInput): Promise<void>;
+}

package/dist/interfaces/quarantine.js

@@ -0,0 +1 @@
+export {};

package/dist/interfaces/sender-signer-standing.d.ts

@@ -0,0 +1,26 @@
+import type { ObserveSenderSignerStandingInput, SenderSignerStandingItem } from "../types.js";
+/**
+ * Per-account record of how often one sender has been seen arriving under one
+ * DKIM signing identity.
+ *
+ * The authenticity derivation asks this port two things: whether a key already
+ * had standing when a message arrived, and — afterwards — that this message be
+ * counted. `get` answers the first and must not create anything; `observe`
+ * answers the second and is the only writer.
+ */
+export interface ISenderSignerStandingRepository {
+    /**
+     * Record one observation of a key, creating the row at `messageCount = 1`
+     * or incrementing an existing one.
+     *
+     * `firstSeenAt` is set once, on creation, and never moves — an
+     * implementation that rewrites it on the increment path erases the age the
+     * derivation reads standing from. `lastSeenAt` advances on every call.
+     */
+    observe(input: ObserveSenderSignerStandingInput): Promise<SenderSignerStandingItem>;
+    /**
+     * The standing of one key. Throws the adapter's not-found error when the
+     * key has never been observed, and creates nothing.
+     */
+    get(accountConfigId: string, senderKey: string, signerDomain: string): Promise<SenderSignerStandingItem>;
+}

package/dist/interfaces/sender-signer-standing.js

@@ -0,0 +1 @@
+export {};

package/dist/interfaces/sync-warning.d.ts

@@ -0,0 +1,11 @@
+import type { SyncWarningItem, SyncWarningKey } from "../types.js";
+export interface SurfacedSyncWarnings {
+    items: SyncWarningItem[];
+    total: number;
+}
+export interface ISyncWarningRepository {
+    listByMailboxId(mailboxId: string): Promise<SyncWarningItem[]>;
+    listSurfacedByAccountConfigId(accountConfigId: string, minAttempts: number, limit: number): Promise<SurfacedSyncWarnings>;
+    recordFailures(keys: SyncWarningKey[]): Promise<void>;
+    deleteMany(syncWarningIds: string[]): Promise<void>;
+}

package/dist/interfaces/sync-warning.js

@@ -0,0 +1 @@
+export {};