@remit/imap-worker 0.0.82 → 0.0.84

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remit/imap-worker",
-  "version": "0.0.82",
+  "version": "0.0.84",
   "type": "module",
   "main": "dist/index.js",
   "exports": {
@@ -41,6 +41,7 @@
     "@remit/search-index-worker": "*",
     "@remit/sqs-client": "*",
     "@remit/backend": "*",
+    "@remit/calendar-service": "*",
     "@remit/domain-enums": "*",
     "@remit/mail-oauth-service": "*",
     "@remit/secrets-service": "*",

package/src/account-check.test.ts

@@ -4,6 +4,7 @@ import type { AccountItem } from "@remit/data-ports";
 import {
 	isAccountDeleted,
 	isAccountReauthRequired,
+	isMailSyncDisabled,
 	isReservedHost,
 	isUnsyncableHost,
 } from "./account-check.js";
@@ -120,3 +121,29 @@ describe("isAccountReauthRequired", () => {
 		);
 	});
 });
+
+describe("isMailSyncDisabled", () => {
+	it("returns false for a mail-only account", () => {
+		assert.equal(
+			isMailSyncDisabled(buildAccount({ syncedServices: ["Mail"] }), log),
+			false,
+		);
+	});
+
+	it("returns false for an account syncing mail and calendar", () => {
+		assert.equal(
+			isMailSyncDisabled(
+				buildAccount({ syncedServices: ["Mail", "Calendar"] }),
+				log,
+			),
+			false,
+		);
+	});
+
+	it("returns true for a calendar-only account", () => {
+		assert.equal(
+			isMailSyncDisabled(buildAccount({ syncedServices: ["Calendar"] }), log),
+			true,
+		);
+	});
+});

package/src/account-check.ts

@@ -1,4 +1,5 @@
 import type { AccountItem } from "@remit/data-ports";
+import { AccountService } from "@remit/domain-enums";
 import type { Logger } from "@remit/logger-lambda";
 
 /**
@@ -86,3 +87,15 @@ export const isAccountReauthRequired = (
 	}
 	return false;
 };
+
+export const isMailSyncDisabled = (
+	account: AccountItem,
+	log: Logger,
+): boolean => {
+	if (account.syncedServices.includes(AccountService.Mail)) return false;
+	log.info(
+		{ accountId: account.accountId, syncedServices: account.syncedServices },
+		"Skipping account: mail sync is off",
+	);
+	return true;
+};

package/src/handlers/sync-mailboxes.ts

@@ -21,7 +21,11 @@ import {
 	type MailCredentials,
 } from "@remit/mailbox-service";
 import pMap from "p-map";
-import { isAccountDeleted, isUnsyncableHost } from "../account-check.js";
+import {
+	isAccountDeleted,
+	isMailSyncDisabled,
+	isUnsyncableHost,
+} from "../account-check.js";
 import { emitEvent } from "../emit.js";
 import type { SyncMailboxesEvent, SyncMessagesEvent } from "../events.js";
 import { withOAuthLifecycle } from "../with-oauth-lifecycle.js";
@@ -120,6 +124,10 @@ export const syncMailboxes = async (
 		return;
 	}
 
+	if (isMailSyncDisabled(account, log)) {
+		return;
+	}
+
 	// A reserved/never-resolvable IMAP host (RFC 2606) can never connect, so a
 	// sync attempt would retry and dead-letter forever. Skip cleanly — ack the
 	// event without connecting or throwing.

package/src/handlers/sync-messages.test.ts

@@ -256,6 +256,7 @@ const liveAccount = {
 	accountId: "acc-1",
 	accountConfigId: "acc-cfg-1",
 	imapHost: "localhost",
+	syncedServices: ["Mail"],
 	username: "user@localhost",
 } as unknown as AccountItem;
 
@@ -542,3 +543,25 @@ describe("syncMessages — a delete that lands mid-round (issue #339)", () => {
 		assert.equal(harness.accountUpdates[0]?.syncPhase, "error");
 	});
 });
+
+describe("syncMessages — an account with mail sync off", () => {
+	it("acks the event without connecting and without touching the mailbox", async () => {
+		const { log } = buildLogger();
+		let mailboxReads = 0;
+		const harness = buildSyncDeps({
+			accountGet: async () =>
+				({ ...liveAccount, syncedServices: ["Calendar"] }) as AccountItem,
+			mailboxGet: async () => {
+				mailboxReads += 1;
+				return {};
+			},
+		});
+
+		await assert.doesNotReject(
+			syncMessages(syncEvent("mbx-1"), log, harness.deps),
+		);
+
+		assert.equal(harness.lifecycleCalls, 0);
+		assert.equal(mailboxReads, 0);
+	});
+});

package/src/handlers/sync-messages.ts

@@ -27,7 +27,11 @@ import {
 	type SyncedMessage,
 } from "@remit/mailbox-service";
 import pMap from "p-map";
-import { isAccountDeleted, isUnsyncableHost } from "../account-check.js";
+import {
+	isAccountDeleted,
+	isMailSyncDisabled,
+	isUnsyncableHost,
+} from "../account-check.js";
 import { emitEvent } from "../emit.js";
 import type {
 	FlagPushEvent,
@@ -126,6 +130,10 @@ export const syncMessages = async (
 		return;
 	}
 
+	if (isMailSyncDisabled(account, log)) {
+		return;
+	}
+
 	// A reserved/never-resolvable IMAP host (RFC 2606) can never connect, so a
 	// sync attempt would retry and dead-letter forever. Skip cleanly — ack the
 	// event without connecting or throwing.

package/src/mail-sync-selection.sqlite.test.ts

@@ -0,0 +1,229 @@
+import assert from "node:assert/strict";
+import { randomUUID } from "node:crypto";
+import { afterEach, beforeEach, describe, it } from "node:test";
+import type { SendMessageCommand, SQSClient } from "@aws-sdk/client-sqs";
+import {
+	_resetForTest,
+	type RemitClient,
+	setClient,
+} from "@remit/backend/client";
+import type { AccountItem } from "@remit/data-ports";
+import {
+	AccountAuthType,
+	AccountService,
+	ConnectionState,
+	MailboxCursorState,
+} from "@remit/domain-enums";
+import {
+	AccountRepo,
+	DrizzleMessageRepository,
+	MailboxRepo,
+} from "@remit/drizzle-service";
+import { createShippedSqliteDb } from "@remit/drizzle-service/test-sqlite";
+import type { Logger } from "@remit/logger-lambda";
+import { syncMailboxes } from "./handlers/sync-mailboxes.js";
+import {
+	type SyncMessagesDeps,
+	syncMessages,
+} from "./handlers/sync-messages.js";
+import { runSchedulerTick } from "./scheduler/run-tick.js";
+
+const NOW = 1_700_000_000_000;
+
+const silentLogger: Logger = (() => {
+	const noop = () => {};
+	const stub = {
+		info: noop,
+		warn: noop,
+		error: noop,
+		debug: noop,
+		fatal: noop,
+		trace: noop,
+		child: () => stub,
+	};
+	return stub as unknown as Logger;
+})();
+
+let accounts: AccountRepo;
+let mailboxes: MailboxRepo;
+let messages: DrizzleMessageRepository;
+let client: RemitClient;
+let close: () => void;
+
+beforeEach(() => {
+	const store = createShippedSqliteDb();
+	close = store.close;
+	accounts = new AccountRepo(store.db);
+	mailboxes = new MailboxRepo(store.db);
+	messages = new DrizzleMessageRepository(store.db as never);
+	client = {
+		account: accounts,
+		mailbox: mailboxes,
+		message: messages,
+	} as unknown as RemitClient;
+	setClient(client);
+});
+
+afterEach(() => {
+	_resetForTest();
+	close();
+});
+
+const seedSyncedAccount = async (): Promise<{
+	account: AccountItem;
+	mailboxId: string;
+	messageId: string;
+}> => {
+	const account = await accounts.create({
+		accountConfigId: "cfg-1181",
+		username: "person@example.com",
+		email: "person@example.com",
+		authType: AccountAuthType.Password,
+		passwordHash: '{"ciphertext":"x"}',
+		imapHost: "imap.example.com",
+		imapPort: 993,
+		imapTls: true,
+		imapStartTls: false,
+		isActive: true,
+		connectionState: ConnectionState.Authenticated,
+	});
+	const created = await mailboxes.create({
+		accountId: account.accountId,
+		namespacePrefix: "",
+		hierarchyDelimiter: "/",
+		fullPath: "INBOX",
+		uidValidity: 7,
+		uidNext: 4,
+		highestModseq: "42",
+		messageCount: 1,
+		unseenCount: 0,
+		deletedCount: 0,
+		totalSize: 10,
+		lastSyncUid: 3,
+		highWaterMarkUid: 3,
+		lastMessageSyncAt: NOW,
+		cursorState: MailboxCursorState.normal,
+	} as Parameters<MailboxRepo["create"]>[0]);
+	if (created.outcome !== "Created") throw new Error("INBOX path taken");
+	const mailbox = created.mailbox;
+	const messageId = randomUUID();
+	await messages.create({
+		messageId,
+		mailboxId: mailbox.mailboxId,
+		uid: 3,
+		sequenceNumber: 1,
+		rfc822Size: 10,
+		internalDate: NOW,
+		envelopeId: randomUUID(),
+		rootBodyPartId: randomUUID(),
+		status: "active",
+		syncStatus: "synced",
+	});
+	return { account, mailboxId: mailbox.mailboxId, messageId };
+};
+
+const tick = async (): Promise<{ enqueued: number; accountIds: string[] }> => {
+	const sent: SendMessageCommand[] = [];
+	const sqsClient = {
+		send: async (command: SendMessageCommand) => {
+			sent.push(command);
+			return {};
+		},
+	} as unknown as SQSClient;
+	const result = await runSchedulerTick({
+		accountService: accounts,
+		sqsClient,
+		queueUrl: "https://queue.test/mailboxes",
+		log: silentLogger,
+		tickIntervalMs: 60_000,
+		offlineIntervalMs: 0,
+		now: NOW,
+	});
+	return {
+		enqueued: result.enqueued,
+		accountIds: sent.map(
+			(command) => JSON.parse(command.input.MessageBody ?? "{}").accountId,
+		),
+	};
+};
+
+const setServices = (
+	accountId: string,
+	syncedServices: AccountItem["syncedServices"],
+) => accounts.update(accountId, { syncedServices });
+
+describe("turning mail sync off and on again", () => {
+	it("stops every mail sync entry point and keeps the stored mail", async () => {
+		const { account, mailboxId, messageId } = await seedSyncedAccount();
+		const storedMailboxes = await mailboxes.listAllByAccount(account.accountId);
+		const storedMessage = await messages.get(messageId);
+
+		await setServices(account.accountId, [AccountService.Calendar]);
+
+		assert.deepEqual(await tick(), { enqueued: 0, accountIds: [] });
+
+		await syncMailboxes(
+			{
+				type: "SYNC_MAILBOXES",
+				eventId: "evt-mailboxes",
+				timestamp: NOW,
+				accountId: account.accountId,
+			},
+			silentLogger,
+		);
+
+		let lifecycleCalls = 0;
+		const deps = {
+			getClient: async () => client,
+			buildLifecycleDeps: () => ({}),
+			withOAuthLifecycle: async () => {
+				lifecycleCalls += 1;
+			},
+		} as unknown as SyncMessagesDeps;
+		await syncMessages(
+			{
+				type: "SYNC_MESSAGES",
+				eventId: "evt-messages",
+				timestamp: NOW,
+				accountId: account.accountId,
+				mailboxId,
+			},
+			silentLogger,
+			deps,
+		);
+		assert.equal(lifecycleCalls, 0);
+
+		assert.deepEqual(
+			await mailboxes.listAllByAccount(account.accountId),
+			storedMailboxes,
+		);
+		assert.deepEqual(await messages.get(messageId), storedMessage);
+		assert.equal(
+			(await accounts.get(account.accountId)).connectionState,
+			ConnectionState.Authenticated,
+		);
+	});
+
+	it("resumes from the stored markers when mail is turned back on", async () => {
+		const { account, messageId } = await seedSyncedAccount();
+		const storedMailboxes = await mailboxes.listAllByAccount(account.accountId);
+		const storedMessage = await messages.get(messageId);
+
+		await setServices(account.accountId, [AccountService.Calendar]);
+		await tick();
+		await setServices(account.accountId, [
+			AccountService.Mail,
+			AccountService.Calendar,
+		]);
+
+		assert.deepEqual(await tick(), {
+			enqueued: 1,
+			accountIds: [account.accountId],
+		});
+		assert.deepEqual(
+			await mailboxes.listAllByAccount(account.accountId),
+			storedMailboxes,
+		);
+		assert.deepEqual(await messages.get(messageId), storedMessage);
+	});
+});

package/src/scheduler/attachment-sweep.test.ts

@@ -43,6 +43,7 @@ const eligibleAccount = (accountId: string) =>
 		email: `${accountId}@example.com`,
 		username: accountId,
 		authType: "password",
+		syncedServices: ["Mail"],
 		imapHost: "imap.example.com",
 		imapPort: 993,
 		imapTls: true,

package/src/scheduler/calendar-subscriptions.test.ts

@@ -0,0 +1,159 @@
+import assert from "node:assert/strict";
+import { describe, it } from "node:test";
+import type { CalendarFeedFetcher } from "@remit/calendar-service";
+import { MemoryCalendarStore } from "@remit/calendar-service/memory-store";
+import type { CalendarCollectionItem } from "@remit/data-ports";
+import { CalendarSource } from "@remit/domain-enums";
+import type { Logger } from "@remit/logger-lambda";
+import { refreshDueCalendarSubscriptions } from "./calendar-subscriptions.js";
+
+const INTERVAL_MS = 15 * 60 * 1000;
+const NOW = 1_800_000_000_000;
+
+const FEED = `${[
+	"BEGIN:VCALENDAR",
+	"VERSION:2.0",
+	"PRODID:-//Example//Published Calendar//EN",
+	"BEGIN:VEVENT",
+	"UID:ferry@calendar.example",
+	"DTSTAMP:20260901T000000Z",
+	"DTSTART:20260908T070000Z",
+	"DTEND:20260908T080000Z",
+	"SUMMARY:Ferry crossing",
+	"END:VEVENT",
+	"END:VCALENDAR",
+].join("\r\n")}\r\n`;
+
+const logged = (): { log: Logger; lines: string[] } => {
+	const lines: string[] = [];
+	const capture = (...args: unknown[]) => {
+		lines.push(JSON.stringify(args));
+	};
+	const log = {
+		info: capture,
+		warn: capture,
+		error: capture,
+		debug: capture,
+		fatal: capture,
+		trace: capture,
+		child: () => log,
+	} as unknown as Logger;
+	return { log, lines };
+};
+
+const subscription = async (
+	store: MemoryCalendarStore,
+	urlSegment: string,
+	checkedAt: number,
+): Promise<CalendarCollectionItem> => {
+	const created = await store.transaction((repos) =>
+		repos.calendarCollection.create({
+			accountConfigId: "account-config-1",
+			urlSegment,
+			displayName: urlSegment,
+			source: CalendarSource.Subscribed,
+			subscriptionUrl: `https://calendar.example/${urlSegment}/private-feedfacecafe.ics`,
+			subscriptionEnabled: true,
+		}),
+	);
+	return store.transaction((repos) =>
+		repos.calendarCollection.update(
+			created.accountConfigId,
+			created.calendarId,
+			{ subscriptionCheckedAt: checkedAt },
+		),
+	);
+};
+
+const recording =
+	(asked: string[], answer: (url: string) => Response): CalendarFeedFetcher =>
+	async (url) => {
+		asked.push(url);
+		return answer(url);
+	};
+
+describe("refreshDueCalendarSubscriptions", () => {
+	it("fetches the subscriptions that are due and skips the rest", async () => {
+		const store = new MemoryCalendarStore();
+		const due = await subscription(store, "due", NOW - INTERVAL_MS);
+		await subscription(store, "fresh", NOW - 60_000);
+		const paused = await subscription(store, "paused", 0);
+		await store.transaction((repos) =>
+			repos.calendarCollection.update(
+				paused.accountConfigId,
+				paused.calendarId,
+				{ subscriptionEnabled: false },
+			),
+		);
+		const asked: string[] = [];
+
+		const tally = await refreshDueCalendarSubscriptions(
+			{
+				calendarCollection: {
+					listEnabledSubscriptions: () =>
+						store.transaction((repos) =>
+							repos.calendarCollection.listEnabledSubscriptions(),
+						),
+				},
+				calendarUnitOfWork: store,
+				log: logged().log,
+				fetcher: recording(asked, () => new Response(FEED, { status: 200 })),
+			},
+			NOW,
+			INTERVAL_MS,
+		);
+
+		assert.deepEqual(asked, [due.subscriptionUrl]);
+		assert.deepEqual(tally, { refreshed: 1, failed: 0, notDue: 1 });
+		const objects = await store.transaction((repos) =>
+			repos.calendarObject.listByCalendar(due.calendarId),
+		);
+		assert.deepEqual(
+			objects.map((object) => object.summary),
+			["Ferry crossing"],
+		);
+	});
+
+	it("counts a feed that fails, keeps refreshing the others, and never logs an address", async () => {
+		const store = new MemoryCalendarStore();
+		const broken = await subscription(store, "broken", 0);
+		const working = await subscription(store, "working", 0);
+		const { log, lines } = logged();
+
+		const tally = await refreshDueCalendarSubscriptions(
+			{
+				calendarCollection: {
+					listEnabledSubscriptions: () =>
+						store.transaction((repos) =>
+							repos.calendarCollection.listEnabledSubscriptions(),
+						),
+				},
+				calendarUnitOfWork: store,
+				log,
+				fetcher: recording([], (url) =>
+					url === broken.subscriptionUrl
+						? new Response("gone", { status: 410 })
+						: new Response(FEED, { status: 200 }),
+				),
+			},
+			NOW,
+			INTERVAL_MS,
+		);
+
+		assert.deepEqual(tally, { refreshed: 1, failed: 1, notDue: 0 });
+		const stored = await store.transaction((repos) =>
+			repos.calendarCollection.get(broken.accountConfigId, broken.calendarId),
+		);
+		assert.equal(stored.subscriptionError, "the feed answered HTTP 410");
+		assert.equal(stored.subscriptionCheckedAt, NOW);
+		const refreshed = await store.transaction((repos) =>
+			repos.calendarCollection.get(working.accountConfigId, working.calendarId),
+		);
+		assert.equal(refreshed.subscriptionFetchedAt, NOW);
+		assert.ok(lines.some((line) => line.includes(broken.calendarId)));
+		assert.equal(
+			lines.some((line) => line.includes("private-feedfacecafe")),
+			false,
+		);
+	});
+});

package/src/scheduler/calendar-subscriptions.ts

@@ -0,0 +1,103 @@
+import type { RemitClient } from "@remit/backend/client";
+import {
+	type CalendarFeedFetcher,
+	isSubscriptionDue,
+	refreshCalendarSubscription,
+} from "@remit/calendar-service";
+import type {
+	ICalendarCollectionRepository,
+	ICalendarUnitOfWork,
+} from "@remit/data-ports";
+import type { Logger } from "@remit/logger-lambda";
+import pMap from "p-map";
+
+const REFRESH_CONCURRENCY = 4;
+
+export interface CalendarSubscriptionTally {
+	refreshed: number;
+	failed: number;
+	notDue: number;
+}
+
+export interface CalendarSubscriptionRefreshDeps {
+	calendarCollection: Pick<
+		ICalendarCollectionRepository,
+		"listEnabledSubscriptions"
+	>;
+	calendarUnitOfWork: ICalendarUnitOfWork;
+	log: Logger;
+	fetcher?: CalendarFeedFetcher;
+}
+
+/**
+ * Re-reads every enabled subscription whose last fetch is at least
+ * `intervalMs` old. A disabled subscription is never listed, which is what
+ * stops its refresh while leaving its events in place.
+ *
+ * One feed's failure is recorded on its own collection and counted here; it
+ * never stops the others. The log names the calendar and the reason, never the
+ * URL, which for a Google secret address is the whole credential.
+ */
+export const refreshDueCalendarSubscriptions = async (
+	deps: CalendarSubscriptionRefreshDeps,
+	now: number,
+	intervalMs: number,
+): Promise<CalendarSubscriptionTally> => {
+	const enabled = await deps.calendarCollection.listEnabledSubscriptions();
+	const due = enabled.filter((collection) =>
+		isSubscriptionDue(collection, now, intervalMs),
+	);
+
+	const outcomes = await pMap(
+		due,
+		(collection) =>
+			refreshCalendarSubscription(
+				deps.calendarUnitOfWork,
+				collection,
+				now,
+				deps.fetcher,
+			).then(
+				(refresh) => {
+					if (refresh.ok) return true;
+					deps.log.warn(
+						{ calendarId: collection.calendarId, reason: refresh.reason },
+						"Calendar subscription could not be refreshed",
+					);
+					return false;
+				},
+				(error: unknown) => {
+					deps.log.error(
+						{ calendarId: collection.calendarId, error },
+						"Calendar subscription refresh failed",
+					);
+					return false;
+				},
+			),
+		{ concurrency: REFRESH_CONCURRENCY },
+	);
+
+	return {
+		refreshed: outcomes.filter(Boolean).length,
+		failed: outcomes.filter((ok) => !ok).length,
+		notDue: enabled.length - due.length,
+	};
+};
+
+export const buildCalendarSubscriptionRefresh =
+	(
+		client: Pick<RemitClient, "calendarCollection" | "calendarUnitOfWork">,
+		log: Logger,
+	): ((
+		now: number,
+		intervalMs: number,
+	) => Promise<CalendarSubscriptionTally>) =>
+	(now, intervalMs) =>
+		refreshDueCalendarSubscriptions(
+			{
+				calendarCollection: client.calendarCollection,
+				calendarUnitOfWork: client.calendarUnitOfWork,
+				log,
+			},
+			now,
+			intervalMs,
+		);

package/src/scheduler/handler.ts

@@ -4,6 +4,7 @@ import { createQueueProducer } from "@remit/sqs-client/producer";
 import type { ScheduledHandler } from "aws-lambda";
 import { env } from "expect-env";
 import { buildAttachmentSweep } from "./attachment-sweep.js";
+import { buildCalendarSubscriptionRefresh } from "./calendar-subscriptions.js";
 import { getOfflineIntervalMs, getTickIntervalMs } from "./config.js";
 import { runSchedulerTick } from "./run-tick.js";
 
@@ -45,5 +46,6 @@ export const handler: ScheduledHandler = withTelemetry(async (event) => {
 		// to block storage, so nothing refuses an upload against a draft that is
 		// already gone and this sweep is the only thing that collects it.
 		sweepAttachments: buildAttachmentSweep(client, log),
+		refreshCalendarSubscriptions: buildCalendarSubscriptionRefresh(client, log),
 	});
 });

package/src/scheduler/loop.test.ts

@@ -9,6 +9,8 @@ const RESULT: SchedulerTickResult = {
 	skipped: 0,
 	swept: 0,
 	sweepFailed: 0,
+	subscriptionsRefreshed: 0,
+	subscriptionsFailed: 0,
 };
 
 // Only the loop's own two calls matter here; the tick is a stub, so what it is

package/src/scheduler/run-tick.test.ts

@@ -2,6 +2,7 @@ import assert from "node:assert/strict";
 import { describe, it } from "node:test";
 import type { SendMessageCommand, SQSClient } from "@aws-sdk/client-sqs";
 import type { AccountItem, AccountSchedulerPage } from "@remit/data-ports";
+import { AccountService } from "@remit/domain-enums";
 import type { Logger } from "@remit/logger-lambda";
 import { runSchedulerTick } from "./run-tick.js";
 
@@ -62,6 +63,7 @@ const baseAccount = (overrides: Partial<AccountItem>): AccountItem =>
 		smtpTls: false,
 		smtpStartTls: true,
 		smtpUsername: "",
+		syncedServices: [AccountService.Mail],
 		isActive: true,
 		connectionState: "authenticated",
 		createdAt: NOW - 1_000_000,
@@ -364,3 +366,113 @@ describe("the attachment sweep inside a tick", () => {
 		assert.equal(result.sweepFailed, 0);
 	});
 });
+
+describe("runSchedulerTick and the account's synced services", () => {
+	const tickWith = async (syncedServices: AccountItem["syncedServices"]) => {
+		const accountService = fakeAccountService([
+			{
+				items: [baseAccount({ accountId: "acct_1", syncedServices })],
+				cursor: null,
+			},
+		]);
+		const { sqsClient, sent } = fakeSqsClient();
+		const result = await runSchedulerTick({
+			accountService,
+			sqsClient,
+			queueUrl: "https://queue.test/mailboxes",
+			log: createNoopLogger(),
+			tickIntervalMs: TICK_INTERVAL_MS,
+			offlineIntervalMs: OFFLINE_INTERVAL_MS,
+			now: NOW,
+		});
+		return { result, sent };
+	};
+
+	it("enqueues mail sync for a mail-only account", async () => {
+		const { result, sent } = await tickWith([AccountService.Mail]);
+
+		assert.equal(result.enqueued, 1);
+		assert.equal(sent.length, 1);
+	});
+
+	it("enqueues mail sync for an account syncing mail and calendar", async () => {
+		const { result, sent } = await tickWith([
+			AccountService.Mail,
+			AccountService.Calendar,
+		]);
+
+		assert.equal(result.enqueued, 1);
+		assert.equal(sent.length, 1);
+	});
+
+	it("skips a calendar-only account", async () => {
+		const { result, sent } = await tickWith([AccountService.Calendar]);
+
+		assert.equal(result.enqueued, 0);
+		assert.equal(result.skipped, 1);
+		assert.equal(sent.length, 0);
+	});
+});
+
+describe("the calendar subscription refresh inside a tick", () => {
+	const oneAccount = () => [
+		{
+			items: [baseAccount({ accountId: "acct_1", lastSyncAt: 0 })],
+			cursor: null,
+		} as unknown as AccountSchedulerPage,
+	];
+
+	it("runs once per tick, against the offline interval", async () => {
+		const { sqsClient } = fakeSqsClient();
+		const calls: [number, number][] = [];
+
+		const result = await runSchedulerTick({
+			accountService: fakeAccountService(oneAccount()),
+			sqsClient,
+			queueUrl: "https://queue.test/mailboxes",
+			log: createNoopLogger(),
+			tickIntervalMs: TICK_INTERVAL_MS,
+			offlineIntervalMs: OFFLINE_INTERVAL_MS,
+			now: NOW,
+			refreshCalendarSubscriptions: async (now, intervalMs) => {
+				calls.push([now, intervalMs]);
+				return { refreshed: 2, failed: 1, notDue: 4 };
+			},
+		});
+
+		assert.deepEqual(calls, [[NOW, OFFLINE_INTERVAL_MS]]);
+		assert.equal(result.subscriptionsRefreshed, 2);
+		assert.equal(result.subscriptionsFailed, 1);
+		assert.equal(result.enqueued, 1);
+	});
+
+	it("keeps the tick alive when the refresh throws", async () => {
+		const { sqsClient, sent } = fakeSqsClient();
+		const { log, calls } = createCapturingLogger();
+
+		const result = await runSchedulerTick({
+			accountService: fakeAccountService(oneAccount()),
+			sqsClient,
+			queueUrl: "https://queue.test/mailboxes",
+			log,
+			tickIntervalMs: TICK_INTERVAL_MS,
+			offlineIntervalMs: OFFLINE_INTERVAL_MS,
+			now: NOW,
+			refreshCalendarSubscriptions: async () => {
+				throw new Error("database is locked");
+			},
+		});
+
+		assert.equal(sent.length, 1);
+		assert.equal(result.subscriptionsRefreshed, 0);
+		assert.ok(
+			calls.some(
+				(entry) =>
+					entry.level === "error" &&
+					entry.args.some((arg) =>
+						String(arg).includes("Calendar subscription refresh failed"),
+					),
+			),
+		);
+	});
+});

package/src/scheduler/run-tick.ts

@@ -10,8 +10,10 @@ import pMap from "p-map";
 import {
 	isAccountDeleted,
 	isAccountReauthRequired,
+	isMailSyncDisabled,
 	isUnsyncableHost,
 } from "../account-check.js";
+import type { CalendarSubscriptionTally } from "./calendar-subscriptions.js";
 import {
 	SCHEDULER_ENQUEUE_CONCURRENCY,
 	SCHEDULER_PAGE_SIZE,
@@ -42,6 +44,15 @@ export interface RunSchedulerTickDeps {
 	 * both real entry points pass it.
 	 */
 	sweepAttachments?: (account: AccountItem) => Promise<void>;
+	/**
+	 * Re-read the calendar subscriptions whose last fetch is older than
+	 * `offlineIntervalMs` — the same knob that says how stale mail may get.
+	 * Optional only so a test can leave it out; both real entry points pass it.
+	 */
+	refreshCalendarSubscriptions?: (
+		now: number,
+		intervalMs: number,
+	) => Promise<CalendarSubscriptionTally>;
 }
 
 export interface SchedulerTickResult {
@@ -50,6 +61,8 @@ export interface SchedulerTickResult {
 	skipped: number;
 	swept: number;
 	sweepFailed: number;
+	subscriptionsRefreshed: number;
+	subscriptionsFailed: number;
 }
 
 /**
@@ -78,6 +91,7 @@ const silentLogger: Logger = (() => {
 
 const isEligible = (account: AccountItem): boolean => {
 	if (isAccountDeleted(account, silentLogger)) return false;
+	if (isMailSyncDisabled(account, silentLogger)) return false;
 	if (isUnsyncableHost(account, silentLogger)) return false;
 	if (isAccountReauthRequired(account, silentLogger)) return false;
 	// An account storing no credential can only produce a sync that fails at
@@ -191,10 +205,43 @@ export const runSchedulerTick = async (
 		cursor = page.cursor ?? undefined;
 	} while (cursor);
 
+	let subscriptionsRefreshed = 0;
+	let subscriptionsFailed = 0;
+	if (deps.refreshCalendarSubscriptions) {
+		// After every page is enqueued, for the same reason the sweep runs after
+		// the enqueue: a slow feed must never cost an account its mail. Contained
+		// like the sweep, so an unreadable store costs a tick's refresh and not
+		// the scheduler.
+		const tally = await deps
+			.refreshCalendarSubscriptions(now, offlineIntervalMs)
+			.catch((error: unknown) => {
+				log.error({ error }, "Calendar subscription refresh failed");
+				return { refreshed: 0, failed: 0, notDue: 0 };
+			});
+		subscriptionsRefreshed = tally.refreshed;
+		subscriptionsFailed = tally.failed;
+	}
+
 	log.info(
-		{ scanned, enqueued, skipped, swept, sweepFailed },
+		{
+			scanned,
+			enqueued,
+			skipped,
+			swept,
+			sweepFailed,
+			subscriptionsRefreshed,
+			subscriptionsFailed,
+		},
 		"Scheduled-sync tick complete",
 	);
 
-	return { scanned, enqueued, skipped, swept, sweepFailed };
+	return {
+		scanned,
+		enqueued,
+		skipped,
+		swept,
+		sweepFailed,
+		subscriptionsRefreshed,
+		subscriptionsFailed,
+	};
 };

package/src/scheduler/runner.ts

@@ -7,6 +7,7 @@ import { createQueueProducer } from "@remit/sqs-client/producer";
 
 import { env } from "expect-env";
 import { buildAttachmentSweep } from "./attachment-sweep.js";
+import { buildCalendarSubscriptionRefresh } from "./calendar-subscriptions.js";
 import { getOfflineIntervalMs, getTickIntervalMs } from "./config.js";
 import { runSchedulerLoop } from "./loop.js";
 import { runSchedulerTick } from "./run-tick.js";
@@ -80,6 +81,10 @@ const runLoop = async (): Promise<void> => {
 			tickIntervalMs,
 			offlineIntervalMs,
 			sweepAttachments: buildAttachmentSweep(client, log),
+			refreshCalendarSubscriptions: buildCalendarSubscriptionRefresh(
+				client,
+				log,
+			),
 		},
 		heartbeat: createHeartbeat("tick"),
 		onHeartbeatError: onBeatError,