@remit/mailbox-service 0.0.112 → 0.0.113

package/dist/outbox-attachment.js

@@ -0,0 +1,273 @@
+import { holdsRoom } from "@remit/data-ports";
+import { ConflictError } from "@remit/data-ports/errors";
+import { base36uuid } from "@remit/data-ports/id";
+import { OutboxAttachmentRejectionReason } from "@remit/domain-enums";
+import { buildOutboxAttachmentKey, UPLOAD_URL_TTL_SECONDS, } from "@remit/storage-service";
+import { loadOutboxAttachmentContents, outboxAttachmentContentId, } from "./outbox-attachment-content.js";
+import { normalizeAttachmentContentType, sanitizeAttachmentFilename, } from "./outbox-attachment-filename.js";
+import { isOpenForWork } from "./outbox-status.js";
+/**
+ * 25 MB is what most receiving servers accept, and base64 inflates it to roughly
+ * 34 MB on the wire. The same number caps one file and the sum of a draft's
+ * files, so a single file can fill a message.
+ */
+export const OUTBOX_ATTACHMENT_MAX_TOTAL_BYTES = 25 * 1024 * 1024;
+/**
+ * A ceiling on how many files one draft can accumulate. The byte cap does not
+ * bound the count — a thousand one-byte files stay far under it.
+ */
+export const OUTBOX_ATTACHMENT_MAX_COUNT = 25;
+const formatBytes = (bytes) => `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
+export class OutboxAttachmentService {
+    outboxMessageService;
+    attachments;
+    storage;
+    now;
+    constructor(config) {
+        this.outboxMessageService = config.outboxMessageService;
+        this.attachments = config.outboxAttachmentService;
+        this.storage = config.storage;
+        this.now = config.now ?? (() => Math.floor(Date.now() / 1000));
+    }
+    /**
+     * Resolve a draft the caller is entitled to act on.
+     *
+     * Mode "act": the caller has named the draft, so a foreign one is denied with
+     * 403 rather than feigned as a 404. An entry the user can no longer work on
+     * is a conflict. Both abort the request — only the file itself comes back as
+     * a result the composer can render next to the row it refused.
+     *
+     * Same predicate the composer's other two writes use. A `failed` message is
+     * editable and sendable again (#933), and an attachment is part of what the
+     * correction may be — a message refused for the wrong file would otherwise
+     * still be stuck.
+     */
+    getWritableDraft = async (accountConfigId, outboxMessageId) => {
+        const outbox = await this.outboxMessageService.get(accountConfigId, outboxMessageId, "act");
+        if (!isOpenForWork(outbox.status)) {
+            throw new ConflictError(`This message is already ${outbox.status} and can no longer take an attachment. Start a new message to change it.`);
+        }
+        return outbox;
+    };
+    usedBytesOn = async (accountConfigId, outboxMessageId) => {
+        const held = await this.attachments.listByOutboxMessage(accountConfigId, outboxMessageId);
+        const nowSeconds = this.now();
+        return held
+            .filter((item) => holdsRoom(item, nowSeconds))
+            .reduce((total, item) => total + item.sizeBytes, 0);
+    };
+    reject = (reason, message, usedBytes) => ({
+        outcome: "Rejected",
+        rejection: {
+            reason,
+            message,
+            limitBytes: OUTBOX_ATTACHMENT_MAX_TOTAL_BYTES,
+            usedBytes,
+        },
+    });
+    /**
+     * Room on a draft for one file, and somewhere to put it.
+     *
+     * The row is written before the URL is handed out, and writing it is what
+     * claims the room — the count and the insert are one database transaction, so
+     * two requests arriving together cannot both be told there was space. That is
+     * the whole of the cap; nothing above this layer needs to serialize anything.
+     */
+    mint = async (input) => {
+        const outbox = await this.getWritableDraft(input.accountConfigId, input.outboxMessageId);
+        const filename = sanitizeAttachmentFilename(input.filename);
+        if (filename === null) {
+            return this.reject(OutboxAttachmentRejectionReason.UnusableFilename, "That file's name is empty once path separators and hidden characters are removed. Rename it and try again.", await this.usedBytesOn(input.accountConfigId, input.outboxMessageId));
+        }
+        if (input.sizeBytes <= 0) {
+            return this.reject(OutboxAttachmentRejectionReason.EmptyFile, `"${filename}" is empty, so there is nothing to attach.`, await this.usedBytesOn(input.accountConfigId, input.outboxMessageId));
+        }
+        if (input.sizeBytes > OUTBOX_ATTACHMENT_MAX_TOTAL_BYTES) {
+            return this.reject(OutboxAttachmentRejectionReason.FileTooLarge, `"${filename}" is ${formatBytes(input.sizeBytes)}, over the ${formatBytes(OUTBOX_ATTACHMENT_MAX_TOTAL_BYTES)} a message can carry.`, await this.usedBytesOn(input.accountConfigId, input.outboxMessageId));
+        }
+        const nowSeconds = this.now();
+        const reservationExpiresAt = nowSeconds + UPLOAD_URL_TTL_SECONDS;
+        // The id is the row's own, and the key is built from it after the fact, so
+        // there is exactly one place an attachment's identity comes from.
+        const outboxAttachmentId = base36uuid();
+        const storageKey = buildOutboxAttachmentKey(input.accountConfigId, outbox.accountId, input.outboxMessageId, outboxAttachmentId);
+        const reserved = await this.attachments.reserve({
+            outboxAttachmentId,
+            outboxMessageId: input.outboxMessageId,
+            accountId: outbox.accountId,
+            accountConfigId: input.accountConfigId,
+            filename,
+            contentType: normalizeAttachmentContentType(input.contentType),
+            sizeBytes: input.sizeBytes,
+            storageKey,
+            reservationExpiresAt,
+        }, {
+            maxTotalBytes: OUTBOX_ATTACHMENT_MAX_TOTAL_BYTES,
+            maxCount: OUTBOX_ATTACHMENT_MAX_COUNT,
+            nowSeconds,
+        });
+        if (reserved.outcome === "OverCountCap") {
+            return this.reject(OutboxAttachmentRejectionReason.TooManyAttachments, `This message already carries ${OUTBOX_ATTACHMENT_MAX_COUNT} files, the most one message can hold. Remove one to attach "${filename}".`, reserved.usedBytes);
+        }
+        if (reserved.outcome === "OverByteCap") {
+            return this.reject(OutboxAttachmentRejectionReason.MessageTooLarge, `"${filename}" is ${formatBytes(input.sizeBytes)} and this message already carries ${formatBytes(reserved.usedBytes)}, over the ${formatBytes(OUTBOX_ATTACHMENT_MAX_TOTAL_BYTES)} it can send.`, reserved.usedBytes);
+        }
+        const target = await this.storage.createOutboxAttachmentUploadUrl({
+            accountConfigId: input.accountConfigId,
+            accountId: outbox.accountId,
+            outboxMessageId: input.outboxMessageId,
+            outboxAttachmentId: reserved.item.outboxAttachmentId,
+            sizeBytes: input.sizeBytes,
+            expiresAt: reservationExpiresAt,
+        });
+        return {
+            outcome: "Minted",
+            reservation: {
+                outboxAttachmentId: reserved.item.outboxAttachmentId,
+                outboxMessageId: input.outboxMessageId,
+                filename: reserved.item.filename,
+                contentType: reserved.item.contentType,
+                sizeBytes: reserved.item.sizeBytes,
+                contentId: outboxAttachmentContentId(reserved.item.outboxAttachmentId),
+                uploadUrl: target.uploadUrl,
+                uploadExpiresAt: reservationExpiresAt,
+            },
+        };
+    };
+    /**
+     * Turn an upload into an attachment, on storage's word rather than the
+     * client's.
+     *
+     * On a hosted deployment the bytes went straight to block storage and this is
+     * the first the API hears of them, so the size is read back before the row is
+     * moved to Stored. An object that is absent, or not the size reserved for it,
+     * does not become an attachment — phase 4 sends these bytes, and an
+     * attachment recorded over nothing is a message that cannot be built.
+     */
+    complete = async (input) => {
+        const outbox = await this.getWritableDraft(input.accountConfigId, input.outboxMessageId);
+        const held = await this.attachments.listByOutboxMessage(input.accountConfigId, input.outboxMessageId);
+        const nowSeconds = this.now();
+        const usedBytes = held
+            .filter((item) => holdsRoom(item, nowSeconds))
+            .reduce((total, item) => total + item.sizeBytes, 0);
+        const row = held.find((item) => item.outboxAttachmentId === input.outboxAttachmentId);
+        if (!row || !holdsRoom(row, nowSeconds)) {
+            return this.reject(OutboxAttachmentRejectionReason.ReservationExpired, "That upload took too long and its reservation has lapsed. Attach the file again.", usedBytes);
+        }
+        // Completing twice is a retry, not a fault: the second call is told what
+        // the first was.
+        if (row.state === "Stored") {
+            return { outcome: "Completed", attachment: row };
+        }
+        const stored = await this.storage.statOutboxAttachment(input.accountConfigId, outbox.accountId, input.outboxMessageId, input.outboxAttachmentId);
+        if (stored === null) {
+            return this.reject(OutboxAttachmentRejectionReason.UploadMissing, "The file never finished uploading. Attach it again.", usedBytes);
+        }
+        if (stored.sizeBytes !== row.sizeBytes) {
+            // What landed is not what was announced. Take the row and the bytes,
+            // so the room goes back and nothing points at a file that is not there.
+            await this.attachments.deleteMany(input.accountConfigId, [
+                input.outboxAttachmentId,
+            ]);
+            await this.storage.deleteOutboxAttachment(input.accountConfigId, outbox.accountId, input.outboxMessageId, input.outboxAttachmentId);
+            return this.reject(OutboxAttachmentRejectionReason.SizeMismatch, "What arrived is not the file that was announced. Attach it again.", Math.max(0, usedBytes - row.sizeBytes));
+        }
+        const confirmed = await this.attachments.markStored(input.accountConfigId, input.outboxAttachmentId, stored.sizeBytes);
+        if (confirmed === null) {
+            // Another completion moved it between the read and the update. Read it
+            // back rather than guess.
+            const settled = await this.attachments.get(input.accountConfigId, input.outboxAttachmentId);
+            return { outcome: "Completed", attachment: settled };
+        }
+        return { outcome: "Completed", attachment: confirmed };
+    };
+    /**
+     * Whether an attachment is still owed its bytes. The self-hosted upload route
+     * asks before it writes, so a URL minted before a discard cannot put bytes
+     * back under a draft that is gone.
+     */
+    hasLiveReservation = async (accountConfigId, outboxAttachmentId) => {
+        const row = await this.attachments
+            .get(accountConfigId, outboxAttachmentId)
+            .catch(() => null);
+        // Pending only. A Stored row has already been confirmed at a size, and its
+        // URL stays signed for the rest of its window — accepting a second write
+        // would let the same-length bytes behind a confirmed attachment be
+        // replaced.
+        return (row !== null &&
+            row.state === "Pending" &&
+            row.reservationExpiresAt >= this.now());
+    };
+    /**
+     * What a draft holds, as the composer should see it: reservations that have
+     * lapsed are not files, and showing one with no way to tell it apart is worse
+     * than not showing it.
+     */
+    listFor = async (accountConfigId, outboxMessageId) => {
+        const nowSeconds = this.now();
+        const held = await this.attachments.listByOutboxMessage(accountConfigId, outboxMessageId);
+        return held.filter((item) => holdsRoom(item, nowSeconds));
+    };
+    /**
+     * The files a message goes out with, bytes included. The Sent copy is built
+     * from the same rows the wire copy was, so the two carry the same parts.
+     */
+    contentsFor = (accountConfigId, accountId, outboxMessageId) => loadOutboxAttachmentContents({ attachments: this.attachments, storage: this.storage }, { accountConfigId, accountId, outboxMessageId }, this.now());
+    /**
+     * The file that stops a send, if any: one still uploading, or one whose
+     * upload never finished. A message must not leave without a file its sender
+     * can see in the composer.
+     */
+    unfinishedUpload = async (accountConfigId, outboxMessageId) => {
+        const live = await this.listFor(accountConfigId, outboxMessageId);
+        return live.find((item) => item.state !== "Stored");
+    };
+    /**
+     * Drop the draft's lapsed reservations and answer with the ids that are still
+     * good. The sweep runs this before it decides what to collect: a lapsed row
+     * would otherwise keep vouching for bytes nothing will ever send, and the
+     * object would never be collected while the row that names it survives.
+     */
+    reapAndListLive = async (accountConfigId, outboxMessageId) => {
+        await this.attachments.deleteLapsedReservations(accountConfigId, outboxMessageId, this.now());
+        const held = await this.attachments.listByOutboxMessage(accountConfigId, outboxMessageId);
+        return held.map((item) => item.outboxAttachmentId);
+    };
+    /**
+     * Keep only the named attachments, deleting the rest with their bytes. This
+     * is how a composer removes a file: the update states what the draft keeps.
+     */
+    retainOnly = async (accountConfigId, accountId, outboxMessageId, keepIds) => {
+        const held = await this.attachments.listByOutboxMessage(accountConfigId, outboxMessageId);
+        const keep = new Set(keepIds);
+        const drop = held.filter((item) => !keep.has(item.outboxAttachmentId));
+        if (drop.length === 0)
+            return;
+        // Bytes first, rows second — the same order as `discardAll`, and for the
+        // same reason: while a row exists its object is accounted for, so a
+        // failure part-way leaves something the sweep can still finish. One
+        // object that will not delete must not strand the rest, so the failures
+        // are collected and raised together once the rows are gone.
+        const failures = [];
+        for (const item of drop) {
+            await this.storage
+                .deleteOutboxAttachment(accountConfigId, accountId, outboxMessageId, item.outboxAttachmentId)
+                .catch((error) => failures.push(error));
+        }
+        await this.attachments.deleteMany(accountConfigId, drop.map((item) => item.outboxAttachmentId));
+        if (failures.length > 0) {
+            throw new AggregateError(failures, `Could not delete ${failures.length} of ${drop.length} attachment objects; their rows are gone and the sweep will collect them`);
+        }
+    };
+    /**
+     * Drop every file a draft holds, rows and bytes, as the draft is retired —
+     * a discard, or the APPEND to Sent that removes the row once the message has
+     * left. Rows go last: while they exist the objects are accounted for, and a
+     * failure part-way leaves the sweep able to finish the job.
+     */
+    discardAll = async (accountConfigId, accountId, outboxMessageId) => {
+        await this.storage.deleteOutboxAttachments(accountConfigId, accountId, outboxMessageId);
+        await this.attachments.deleteByOutboxMessage(accountConfigId, outboxMessageId);
+    };
+}

package/dist/outbox-queue.d.ts

@@ -0,0 +1,73 @@
+import type { FifoQueueProducer, IAccountRepository, IOutboxMessageRepository, OutboxMessageItem } from "@remit/data-ports";
+import type { OutboxAttachmentService } from "./outbox-attachment.js";
+export interface SendMessageEvent {
+    type: "SEND_MESSAGE";
+    eventId: string;
+    timestamp: number;
+    accountId: string;
+    outboxMessageId: string;
+}
+export interface OutboxQueueLogger {
+    info(obj: Record<string, unknown>, msg: string): void;
+    error(obj: Record<string, unknown>, msg: string): void;
+}
+export interface OutboxQueueConfig {
+    outboxMessageService: IOutboxMessageRepository;
+    outboxAttachmentService: OutboxAttachmentService;
+    accountService: IAccountRepository;
+    queue: FifoQueueProducer<SendMessageEvent>;
+    logger?: OutboxQueueLogger;
+}
+export interface CreateDraftInput {
+    accountId: string;
+    accountConfigId: string;
+    fromAddress: string;
+    fromName?: string;
+    toAddresses: string[];
+    ccAddresses?: string[];
+    bccAddresses?: string[];
+    subject?: string;
+    textBody?: string;
+    htmlBody?: string;
+    inReplyTo?: string;
+    references?: string[];
+}
+export interface UpdateDraftInput {
+    toAddresses?: string[];
+    ccAddresses?: string[];
+    bccAddresses?: string[];
+    subject?: string;
+    textBody?: string;
+    htmlBody?: string;
+    inReplyTo?: string;
+    references?: string[];
+}
+export declare class OutboxQueueService {
+    private outboxMessageService;
+    private outboxAttachmentService;
+    private accountService;
+    private queue;
+    private log;
+    constructor(config: OutboxQueueConfig);
+    createDraft: (input: CreateDraftInput) => Promise<OutboxMessageItem>;
+    updateDraft: (accountConfigId: string, outboxMessageId: string, input: UpdateDraftInput) => Promise<OutboxMessageItem>;
+    private refuseWithoutMail;
+    send: (accountConfigId: string, outboxMessageId: string) => Promise<OutboxMessageItem>;
+    createAndSend: (input: CreateDraftInput) => Promise<OutboxMessageItem>;
+    deleteDraft: (accountConfigId: string, outboxMessageId: string) => Promise<void>;
+    /**
+     * Take a row back out of `queued` after the enqueue reported a failure.
+     *
+     * Conditional on `queued`, because the event may have landed regardless — an
+     * error from `SendMessage` says the response was lost, not that the broker
+     * refused it. If the worker already has the row, it holds the newer truth and
+     * this write does nothing.
+     *
+     * Never rejects. The enqueue failure is what went wrong and what the caller
+     * has to hear; a settle that also fails would replace it with the wrong
+     * cause, so it is logged and the row is left where #936 found it — which the
+     * caller's error at least names.
+     */
+    private settleUnqueued;
+    private enqueueSend;
+}

package/dist/outbox-queue.js

@@ -0,0 +1,284 @@
+import { randomUUID } from "node:crypto";
+import { BadRequestError, ConflictError, MailSyncOffError, } from "@remit/data-ports/errors";
+import { bareMessageId } from "@remit/data-ports/id";
+import { AccountService, OutboxMessageStatus } from "@remit/domain-enums";
+import { isOpenForWork } from "./outbox-status.js";
+const noopLogger = {
+    info: () => { },
+    error: () => { },
+};
+const MAX_REFERENCES = 21;
+const capReferences = (ids) => ids.length <= MAX_REFERENCES
+    ? ids
+    : [ids[0], ...ids.slice(ids.length - (MAX_REFERENCES - 1))];
+const bareThreadingHeaders = (input) => ({
+    ...(input.inReplyTo !== undefined && {
+        inReplyTo: bareMessageId(input.inReplyTo),
+    }),
+    ...(input.references !== undefined && {
+        references: capReferences([
+            ...new Set(input.references.map(bareMessageId).filter((id) => id !== "")),
+        ]),
+    }),
+});
+/**
+ * Nobody to send to. `@minItems(1)` on the create input is the only thing that
+ * has ever stood between a zero-recipient message and nodemailer, which refuses
+ * an empty envelope — and refuses it inside the SMTP worker, where the failure
+ * lands in the DLQ rather than in front of the person who pressed Send. Neither
+ * route into the queue passes that schema: a draft is created with a recipient
+ * and can be edited down to none, and `send` never sees the create input at all.
+ *
+ * Cc and Bcc count. A message addressed only in Bcc is a real message with a
+ * real envelope; only a message with no address anywhere has nowhere to go.
+ */
+const hasNowhereToGo = (message) => (message.toAddresses?.length ?? 0) === 0 &&
+    (message.ccAddresses?.length ?? 0) === 0 &&
+    (message.bccAddresses?.length ?? 0) === 0;
+const NO_RECIPIENT_MESSAGE = "This message has nobody to send to. Add a recipient before sending it.";
+const MAIL_SYNC_OFF_SEND_MESSAGE = "Mail is turned off for this account, so it cannot send. Turn Mail back on for this account in Settings to send from it.";
+const ENQUEUE_FAILED_MESSAGE = "This message could not be handed to the outgoing queue, so it was not sent. Send it again.";
+const MOVED_WHILE_EDITING_MESSAGE = "This message started sending while it was being edited, so the change was not saved. Open the Outbox to see where it stands.";
+const MOVED_WHILE_SENDING_MESSAGE = "This message already left the queue and cannot be sent again. Open the Outbox to see where it stands.";
+/**
+ * Where a row goes when the enqueue reports a failure — never `draft`, and
+ * never back to `draft` where it came from.
+ *
+ * A throw from `SendMessage` does not prove the broker refused the event. This
+ * queue is not FIFO on the send path and carries no deduplication id, so a
+ * timeout or a lost response leaves an event that may still be delivered. And
+ * `draft` is inside the worker's send fence (`SENDABLE_STATUSES`, smtp-worker
+ * `send-message-core.ts`): a row put back there is sendable by the landed event
+ * and by the user pressing Send, which is two copies of one message. `failed`
+ * is outside that fence, so the landed event is dropped on arrival, and a
+ * `failed` row is editable and sendable by hand (#933) — the recovery survives.
+ *
+ * `blocked` is outside the fence too and names a cause the enqueue did not
+ * change, so a row that came from there goes back to it.
+ */
+const settledStatusFor = (priorStatus) => priorStatus === OutboxMessageStatus.blocked
+    ? OutboxMessageStatus.blocked
+    : OutboxMessageStatus.failed;
+const generateMessageId = (domain) => {
+    const timestamp = Date.now();
+    const random = randomUUID().replace(/-/g, "").slice(0, 16);
+    return `${timestamp}.${random}@${domain}`;
+};
+const extractDomain = (email) => {
+    const atIndex = email.lastIndexOf("@");
+    if (atIndex === -1)
+        return "localhost";
+    return email.slice(atIndex + 1);
+};
+export class OutboxQueueService {
+    outboxMessageService;
+    outboxAttachmentService;
+    accountService;
+    queue;
+    log;
+    constructor(config) {
+        this.outboxMessageService = config.outboxMessageService;
+        this.outboxAttachmentService = config.outboxAttachmentService;
+        this.accountService = config.accountService;
+        this.queue = config.queue;
+        this.log = config.logger ?? noopLogger;
+    }
+    createDraft = async (input) => {
+        const domain = extractDomain(input.fromAddress);
+        const messageIdValue = generateMessageId(domain);
+        const outbox = await this.outboxMessageService.create({
+            accountId: input.accountId,
+            accountConfigId: input.accountConfigId,
+            fromAddress: input.fromAddress,
+            fromName: input.fromName,
+            toAddresses: input.toAddresses,
+            ccAddresses: input.ccAddresses,
+            bccAddresses: input.bccAddresses,
+            subject: input.subject,
+            textBody: input.textBody,
+            htmlBody: input.htmlBody,
+            ...bareThreadingHeaders(input),
+            messageIdValue,
+            status: OutboxMessageStatus.draft,
+        });
+        this.log.info({ outboxMessageId: outbox.outboxMessageId, accountId: input.accountId }, "Created draft outbox message");
+        return outbox;
+    };
+    updateDraft = async (accountConfigId, outboxMessageId, input) => {
+        const existing = await this.outboxMessageService.get(accountConfigId, outboxMessageId, "act");
+        if (!isOpenForWork(existing.status)) {
+            throw new ConflictError(`This message is already ${existing.status} and can no longer be edited as a draft. Start a new message to change it.`);
+        }
+        // Editing a settled failure returns the row to `draft`: it is no longer the
+        // message that failed, and the Outbox renders a `failed` row with its
+        // `lastError` — a failure reported against text that never went out. The
+        // same row moves to Drafts carrying its content, recipients and
+        // attachments, so there is no copy to reconcile.
+        //
+        // Conditional on the status this decision was read from. A concurrent send
+        // can move the row to `queued` between the two, and an unconditional write
+        // would pull it back to `draft` with its event already on the wire — the
+        // worker's fence takes `draft`, so that row goes out and stays sendable.
+        const updated = await this.outboxMessageService.updateIfStatus(accountConfigId, outboxMessageId, existing.status, {
+            ...(existing.status !== OutboxMessageStatus.draft && {
+                status: OutboxMessageStatus.draft,
+            }),
+            ...(input.toAddresses !== undefined && {
+                toAddresses: input.toAddresses,
+            }),
+            ...(input.ccAddresses !== undefined && {
+                ccAddresses: input.ccAddresses,
+            }),
+            ...(input.bccAddresses !== undefined && {
+                bccAddresses: input.bccAddresses,
+            }),
+            ...(input.subject !== undefined && { subject: input.subject }),
+            ...(input.textBody !== undefined && { textBody: input.textBody }),
+            ...(input.htmlBody !== undefined && { htmlBody: input.htmlBody }),
+            ...bareThreadingHeaders(input),
+        });
+        if (!updated)
+            throw new ConflictError(MOVED_WHILE_EDITING_MESSAGE);
+        this.log.info({ outboxMessageId }, "Updated draft outbox message");
+        return updated;
+    };
+    refuseWithoutMail = async (accountId) => {
+        const account = await this.accountService.get(accountId);
+        if (account.syncedServices.includes(AccountService.Mail))
+            return;
+        throw new MailSyncOffError(MAIL_SYNC_OFF_SEND_MESSAGE, accountId);
+    };
+    send = async (accountConfigId, outboxMessageId) => {
+        const existing = await this.outboxMessageService.get(accountConfigId, outboxMessageId, "act");
+        if (!isOpenForWork(existing.status)) {
+            throw new ConflictError(`This message is already ${existing.status} and cannot be sent again. Open the Outbox to see where it stands.`);
+        }
+        if (hasNowhereToGo(existing)) {
+            throw new BadRequestError(NO_RECIPIENT_MESSAGE);
+        }
+        await this.refuseWithoutMail(existing.accountId);
+        const unfinished = await this.outboxAttachmentService.unfinishedUpload(accountConfigId, outboxMessageId);
+        if (unfinished) {
+            throw new BadRequestError(`"${unfinished.filename}" has not finished uploading. Wait for it, or remove it, and send again.`);
+        }
+        // Conditional on the status this send was decided against, so two presses —
+        // or a press racing the worker — produce one queued row and one conflict
+        // rather than two events for the same message.
+        const updated = await this.outboxMessageService.updateIfStatus(accountConfigId, outboxMessageId, existing.status, { status: OutboxMessageStatus.queued });
+        if (!updated)
+            throw new ConflictError(MOVED_WHILE_SENDING_MESSAGE);
+        // A reservation made from another tab between the check above and the
+        // move to `queued` got past it; one made after the move is refused, so a
+        // second look now is the last word.
+        const lateUpload = await this.outboxAttachmentService.unfinishedUpload(accountConfigId, outboxMessageId);
+        if (lateUpload) {
+            await this.outboxMessageService.updateIfStatus(accountConfigId, outboxMessageId, OutboxMessageStatus.queued, { status: existing.status });
+            throw new BadRequestError(`"${lateUpload.filename}" has not finished uploading. Wait for it, or remove it, and send again.`);
+        }
+        // `queued` is a dead end for a row the queue never accepted: `send` takes
+        // draft, failed and blocked, `deleteDraft` those three plus unfiled, so a
+        // row parked at `queued` by a failed enqueue is neither sendable nor
+        // discardable (#845.8). Settle it and let the enqueue failure surface —
+        // the row stays reachable, the caller still hears no.
+        await this.enqueueSend(existing.accountId, outboxMessageId).catch(async (error) => {
+            await this.settleUnqueued(accountConfigId, outboxMessageId, existing.status);
+            throw error;
+        });
+        this.log.info({ outboxMessageId, accountId: existing.accountId }, "Queued outbox message for sending");
+        return updated;
+    };
+    createAndSend = async (input) => {
+        if (hasNowhereToGo(input)) {
+            throw new BadRequestError(NO_RECIPIENT_MESSAGE);
+        }
+        await this.refuseWithoutMail(input.accountId);
+        const domain = extractDomain(input.fromAddress);
+        const messageIdValue = generateMessageId(domain);
+        const outbox = await this.outboxMessageService.create({
+            accountId: input.accountId,
+            accountConfigId: input.accountConfigId,
+            fromAddress: input.fromAddress,
+            fromName: input.fromName,
+            toAddresses: input.toAddresses,
+            ccAddresses: input.ccAddresses,
+            bccAddresses: input.bccAddresses,
+            subject: input.subject,
+            textBody: input.textBody,
+            htmlBody: input.htmlBody,
+            ...bareThreadingHeaders(input),
+            messageIdValue,
+            status: OutboxMessageStatus.queued,
+        });
+        // Same dead end as in `send`: a row parked at `queued` by an enqueue that
+        // threw is neither sendable nor discardable (#845.8, #931, #936). This row
+        // is new, so there is no prior status — it settles at `failed`, carrying
+        // the reason, which keeps the composed text editable and sendable while
+        // staying outside the fence a landed event has to pass.
+        await this.enqueueSend(input.accountId, outbox.outboxMessageId).catch(async (error) => {
+            await this.settleUnqueued(input.accountConfigId, outbox.outboxMessageId, OutboxMessageStatus.failed);
+            throw error;
+        });
+        this.log.info({ outboxMessageId: outbox.outboxMessageId, accountId: input.accountId }, "Created and queued outbox message for sending");
+        return outbox;
+    };
+    deleteDraft = async (accountConfigId, outboxMessageId) => {
+        const existing = await this.outboxMessageService.get(accountConfigId, outboxMessageId, "act");
+        // `unfiled` is discardable: the message was delivered but never landed in
+        // a Sent folder, so this row is the only copy the user has and dismissing
+        // it is their acknowledgement.
+        if (existing.status !== OutboxMessageStatus.draft &&
+            existing.status !== OutboxMessageStatus.failed &&
+            existing.status !== OutboxMessageStatus.blocked &&
+            existing.status !== OutboxMessageStatus.unfiled) {
+            throw new ConflictError(`This message is already ${existing.status} and can no longer be discarded. Open the Outbox to see where it stands.`);
+        }
+        // Files first, row second. Nothing but this row points at those objects,
+        // so a row deleted ahead of a sweep that then fails leaves bytes no one
+        // can reach; the other order leaves a draft whose files are gone, which
+        // is at least visible. A storage failure aborts the discard outright.
+        await this.outboxAttachmentService.discardAll(accountConfigId, existing.accountId, outboxMessageId);
+        await this.outboxMessageService.delete(accountConfigId, outboxMessageId);
+        this.log.info({ outboxMessageId }, "Deleted outbox message");
+    };
+    /**
+     * Take a row back out of `queued` after the enqueue reported a failure.
+     *
+     * Conditional on `queued`, because the event may have landed regardless — an
+     * error from `SendMessage` says the response was lost, not that the broker
+     * refused it. If the worker already has the row, it holds the newer truth and
+     * this write does nothing.
+     *
+     * Never rejects. The enqueue failure is what went wrong and what the caller
+     * has to hear; a settle that also fails would replace it with the wrong
+     * cause, so it is logged and the row is left where #936 found it — which the
+     * caller's error at least names.
+     */
+    settleUnqueued = async (accountConfigId, outboxMessageId, priorStatus) => {
+        const status = settledStatusFor(priorStatus);
+        await this.outboxMessageService
+            .updateIfStatus(accountConfigId, outboxMessageId, OutboxMessageStatus.queued, {
+            status,
+            ...(status === OutboxMessageStatus.failed && {
+                lastError: ENQUEUE_FAILED_MESSAGE,
+            }),
+        })
+            .catch((settleError) => {
+            this.log.error({ outboxMessageId, settleError: String(settleError) }, "Could not settle an outbox message the queue refused");
+        });
+    };
+    enqueueSend = async (accountId, outboxMessageId) => {
+        const event = {
+            type: "SEND_MESSAGE",
+            eventId: randomUUID(),
+            timestamp: Date.now(),
+            accountId,
+            outboxMessageId,
+        };
+        await this.queue.send({
+            body: event,
+            groupId: accountId,
+            deduplicationId: event.eventId,
+        });
+        this.log.info({ eventId: event.eventId, accountId, outboxMessageId }, "Enqueued SEND_MESSAGE event");
+    };
+}

package/{src/outbox-status.ts → dist/outbox-status.d.ts}

@@ -1,6 +1,4 @@
 import type { OutboxMessageItem } from "@remit/data-ports";
-import { OutboxMessageStatus } from "@remit/domain-enums";
-
 /**
  * Whether the message is still the user's to work on: nothing of it is on the
  * wire, so Send, Edit and its attachments all apply.
@@ -15,7 +13,4 @@ import { OutboxMessageStatus } from "@remit/domain-enums";
  * Everything absent is in the worker's hands or settled: `queued` and `sending`
  * are mid-flight, `sent` and `unfiled` were delivered.
  */
-export const isOpenForWork = (status: OutboxMessageItem["status"]): boolean =>
-	status === OutboxMessageStatus.draft ||
-	status === OutboxMessageStatus.failed ||
-	status === OutboxMessageStatus.blocked;
+export declare const isOpenForWork: (status: OutboxMessageItem["status"]) => boolean;

package/dist/outbox-status.js

@@ -0,0 +1,18 @@
+import { OutboxMessageStatus } from "@remit/domain-enums";
+/**
+ * Whether the message is still the user's to work on: nothing of it is on the
+ * wire, so Send, Edit and its attachments all apply.
+ *
+ * One predicate for all three because they answer the same question, and
+ * splitting them is what dead-ended a refused message. Sending took `failed`
+ * while editing took only `draft`, so a message the server turned away for a
+ * bad address could be re-sent unchanged or deleted, and nothing else — Retry
+ * queued the same envelope, and Edit took a 409 on the flush that precedes the
+ * send (#933).
+ *
+ * Everything absent is in the worker's hands or settled: `queued` and `sending`
+ * are mid-flight, `sent` and `unfiled` were delivered.
+ */
+export const isOpenForWork = (status) => status === OutboxMessageStatus.draft ||
+    status === OutboxMessageStatus.failed ||
+    status === OutboxMessageStatus.blocked;