@remit/mailbox-service 0.0.112 → 0.0.113

package/dist/connection-test.js

@@ -0,0 +1,152 @@
+/**
+ * Connection testing utilities for IMAP and SMTP servers
+ *
+ * Used to validate credentials before saving account configuration.
+ */
+import { createConnection as createNetConnection } from "node:net";
+import { connect as tlsConnect } from "node:tls";
+import { createTransport } from "nodemailer";
+import { MailConnectionError } from "./types.js";
+// TODO(#468): Wire OAuth testConnection once authType/oauthRefreshTokenHash are
+// available on Account. For OAuth accounts, mint a token via MailOAuthService
+// before calling testImapConnection / testSmtpConnection, and map
+// RefreshTokenError(reauth-required) to MailConnectionError("auth", ...).
+const TEST_TIMEOUT_MS = 12_000;
+/**
+ * Build nodemailer auth object from credentials.
+ */
+const buildSmtpAuth = (user, credentials) => {
+    if (credentials.kind === "password") {
+        return { user, pass: credentials.password };
+    }
+    return {
+        type: "OAuth2",
+        user,
+        accessToken: credentials.accessToken,
+    };
+};
+/**
+ * Test IMAP connection with provided credentials.
+ *
+ * Uses a raw socket to send AUTH PLAIN directly — bypasses the CAPABILITY
+ * round-trip that IMAP clients typically perform first, avoiding deadlocks
+ * with servers that pipeline their tagged responses.
+ *
+ * Supports plaintext, direct TLS (secure: true), and STARTTLS (startTls: true).
+ */
+export const testImapConnection = async (config) => {
+    if (config.credentials.kind !== "password") {
+        return { success: false, error: "OAuth not supported for connection test" };
+    }
+    const { user, credentials } = config;
+    const authPlain = Buffer.from(`\x00${user}\x00${credentials.password}`).toString("base64");
+    return new Promise((resolve) => {
+        let settled = false;
+        const done = (result) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timeoutId);
+            resolve(result);
+        };
+        const timeoutId = setTimeout(() => done({ success: false, error: "Connection timed out" }), TEST_TIMEOUT_MS);
+        let buf = "";
+        let phase = "greeting";
+        // biome-ignore lint/suspicious/noExplicitAny: socket type varies between net.Socket and tls.TLSSocket
+        let sock;
+        const onData = (chunk) => {
+            buf += chunk.toString();
+            const lines = buf.split("\r\n");
+            buf = lines.pop() ?? "";
+            for (const line of lines) {
+                if (phase === "greeting" && /^\* OK/i.test(line)) {
+                    if (config.startTls) {
+                        phase = "starttls";
+                        sock.write("A001 STARTTLS\r\n");
+                    }
+                    else {
+                        phase = "auth";
+                        sock.write(`A001 AUTHENTICATE PLAIN ${authPlain}\r\n`);
+                    }
+                }
+                else if (phase === "starttls" && /^A001 OK/i.test(line)) {
+                    phase = "tls-upgrade";
+                    // Upgrade socket to TLS in place
+                    const tlsSock = tlsConnect({
+                        socket: sock,
+                        host: config.host,
+                        rejectUnauthorized: false,
+                    });
+                    tlsSock.on("data", onData);
+                    tlsSock.on("error", onError);
+                    tlsSock.once("secureConnect", () => {
+                        phase = "auth";
+                        sock = tlsSock;
+                        sock.write(`A002 AUTHENTICATE PLAIN ${authPlain}\r\n`);
+                    });
+                }
+                else if (phase === "auth" &&
+                    (/^A00[12] OK/i.test(line) || /^A001 OK/i.test(line))) {
+                    phase = "done";
+                    sock.write("A099 LOGOUT\r\n");
+                    done({ success: true });
+                }
+                else if (phase === "auth" &&
+                    (/^A00[12] NO/i.test(line) || /^A00[12] BAD/i.test(line))) {
+                    phase = "done";
+                    sock.destroy();
+                    done({ success: false, error: "Authentication failed" });
+                }
+            }
+        };
+        const onError = (err) => {
+            done({ success: false, error: err.message });
+        };
+        if (config.secure) {
+            sock = tlsConnect({
+                host: config.host,
+                port: config.port,
+                rejectUnauthorized: false,
+            });
+        }
+        else {
+            sock = createNetConnection({ host: config.host, port: config.port });
+        }
+        sock.on("data", onData);
+        sock.on("error", onError);
+    });
+};
+/**
+ * Test SMTP connection with provided credentials
+ *
+ * Uses nodemailer's verify() method to test authentication.
+ */
+export const testSmtpConnection = async (config) => {
+    const transport = createTransport({
+        host: config.host,
+        port: config.port,
+        secure: config.secure,
+        auth: buildSmtpAuth(config.user, config.credentials),
+        connectionTimeout: TEST_TIMEOUT_MS,
+        greetingTimeout: TEST_TIMEOUT_MS,
+        socketTimeout: TEST_TIMEOUT_MS,
+    });
+    const attempt = transport
+        .verify()
+        .then(() => ({ success: true }))
+        .catch((error) => {
+        if (error instanceof MailConnectionError) {
+            return { success: false, error: error.message };
+        }
+        return {
+            success: false,
+            error: error instanceof Error ? error.message : "Connection failed",
+        };
+    })
+        .finally(() => transport.close());
+    const timeout = new Promise((resolve) => setTimeout(() => {
+        transport.close();
+        resolve({ success: false, error: "Connection timed out" });
+    }, TEST_TIMEOUT_MS));
+    return Promise.race([attempt, timeout]);
+};

package/dist/external-move.d.ts

@@ -0,0 +1,94 @@
+import type { IMailboxRepository, IMessageRepository, MailboxItem, MessageItem } from "@remit/data-ports";
+import type { IImapConnection } from "./types.js";
+export interface ExternalMoveLogger {
+    info(obj: Record<string, unknown>, msg: string): void;
+    warn(obj: Record<string, unknown>, msg: string): void;
+}
+/**
+ * Whether a sighting of an already-stored message in this mailbox CONTESTS the
+ * placement the row holds (#859). Contesting is not deciding: the sighting is a
+ * candidate move, and {@link confirmDepartures} is what turns it into one.
+ *
+ * Three sightings do not even contest. The same mailbox is the row standing
+ * where it already is. Gmail's All Mail, Starred and Important hold every
+ * message that also lives in a real folder, so they are views rather than filing
+ * locations; following one would empty every other folder's listing. And a row
+ * whose own mutation has not settled is in flight, not stale
+ * (imap-mutations R1): the server's answer predates the move reader is still
+ * waiting on, so taking it would undo the optimistic write. The sync path
+ * reconciles rather than waits (imap-mutations R2): it never blocks on a
+ * mutation, it re-reads the row on the next sighting after the move settles.
+ *
+ * In flight is `status`, and `status` alone (#1096, imap-mutations R3). Every
+ * outbound mutation writes `moving` or `deleting` and only settling returns the
+ * row to `active`, so `active` is precisely the set nothing is coming for —
+ * whatever `syncStatus` says about how the row got there. A row put back by
+ * `abandonDelete` carries `abandoned`, and it needs this repair more than any
+ * other row does: nothing routine settles it, and reader shares its mailboxes,
+ * so refusing it left a message whose delete was refused unable to follow a
+ * move the user then made in another client.
+ */
+export declare const sightingContestsPlacement: (mailbox: MailboxItem, message: Pick<MessageItem, "mailboxId" | "status">) => boolean;
+/**
+ * The exact placement a verdict was reached for. The probe reads the row outside
+ * the transaction that acts on it, so the verdict names the mailbox and uid it
+ * was reached for; a row that moved in between matches no verdict and is left
+ * unsettled.
+ */
+export declare const placementKey: (messageId: string, mailboxId: string, uid: number) => string;
+export interface DepartureVerdicts {
+    /**
+     * Placements the source folder no longer holds. A sighting elsewhere of one
+     * of these is a move, and re-points the row.
+     */
+    departed: Set<string>;
+    /**
+     * Placements a verdict was reached for at all, departed or still held. A
+     * contested sighting outside this set was not decided — the source could not
+     * be asked, or the row has moved since it was — and its uid is held back from
+     * the watermark so the next round serves the sighting again. Without that a
+     * single unanswerable round would leave the row mispointed until a cursor
+     * rebuild, which is the silent never-repair this whole change is about.
+     */
+    settled: Set<string>;
+    /**
+     * Message ids whose sighting has to go through the save pipeline: departed,
+     * or contested with no verdict. Every other sighting changes no placement.
+     */
+    needsSave: Set<string>;
+}
+export interface DepartureProbeDeps {
+    connection: Pick<IImapConnection, "openBox" | "search">;
+    mailboxService: Pick<IMailboxRepository, "get">;
+    messageService: Pick<IMessageRepository, "get">;
+    log: ExternalMoveLogger;
+}
+/**
+ * Which of this batch's messages have really left the folder their row points at
+ * (#1146).
+ *
+ * A message sighted in a second real folder has not necessarily moved. Living in
+ * two folders at once is ordinary mail: a Gmail user label, a Sieve `fileinto`
+ * beside a `keep`, a Sent copy a mailing list echoes back. Reading every such
+ * sighting as a move takes the message out of the folder it is still in, and
+ * whichever folder the sync round enumerates last wins — which is how a labelled
+ * message disappeared from the Inbox on the next sync.
+ *
+ * What separates a move from a copy is the source folder: a move empties it, a
+ * copy leaves it alone. So the source is asked, and only a source that no longer
+ * holds the uid the row claims makes the sighting a move. A move another client
+ * made is still followed — that is the case where the source really is empty —
+ * and reader stops fighting a second client over mail neither of them moved.
+ *
+ * The question is asked with a UID SEARCH rather than a FETCH, for the reason
+ * `isMessageGoneFromOpenMailbox` documents: imapflow drops rows on back-to-back
+ * FETCHes (#408), and absence read off a FETCH would file live mail as departed.
+ * `IImapConnection.search` throws on a failed SEARCH, so an empty answer means
+ * the server matched nothing. The SEARCH names the contested uids rather than
+ * ALL: the answer needed is about those uids, and a folder's whole uid set is a
+ * page of traffic per batch for an account with a large Inbox.
+ *
+ * One SEARCH per source folder per batch, and no IMAP at all when nothing is
+ * contested — which is every round on an account whose folders do not overlap.
+ */
+export declare const confirmDepartures: (deps: DepartureProbeDeps, accountId: string, sightedIn: MailboxItem, messageIds: string[]) => Promise<DepartureVerdicts>;

package/dist/external-move.js

@@ -0,0 +1,173 @@
+import { isVirtualCopyMailbox } from "@remit/data-ports/virtual-copy";
+import { MessageStatus } from "@remit/domain-enums";
+/**
+ * Whether a sighting of an already-stored message in this mailbox CONTESTS the
+ * placement the row holds (#859). Contesting is not deciding: the sighting is a
+ * candidate move, and {@link confirmDepartures} is what turns it into one.
+ *
+ * Three sightings do not even contest. The same mailbox is the row standing
+ * where it already is. Gmail's All Mail, Starred and Important hold every
+ * message that also lives in a real folder, so they are views rather than filing
+ * locations; following one would empty every other folder's listing. And a row
+ * whose own mutation has not settled is in flight, not stale
+ * (imap-mutations R1): the server's answer predates the move reader is still
+ * waiting on, so taking it would undo the optimistic write. The sync path
+ * reconciles rather than waits (imap-mutations R2): it never blocks on a
+ * mutation, it re-reads the row on the next sighting after the move settles.
+ *
+ * In flight is `status`, and `status` alone (#1096, imap-mutations R3). Every
+ * outbound mutation writes `moving` or `deleting` and only settling returns the
+ * row to `active`, so `active` is precisely the set nothing is coming for —
+ * whatever `syncStatus` says about how the row got there. A row put back by
+ * `abandonDelete` carries `abandoned`, and it needs this repair more than any
+ * other row does: nothing routine settles it, and reader shares its mailboxes,
+ * so refusing it left a message whose delete was refused unable to follow a
+ * move the user then made in another client.
+ */
+export const sightingContestsPlacement = (mailbox, message) => {
+    if (message.mailboxId === mailbox.mailboxId)
+        return false;
+    if (isVirtualCopyMailbox(mailbox))
+        return false;
+    return message.status === MessageStatus.active;
+};
+/**
+ * The exact placement a verdict was reached for. The probe reads the row outside
+ * the transaction that acts on it, so the verdict names the mailbox and uid it
+ * was reached for; a row that moved in between matches no verdict and is left
+ * unsettled.
+ */
+export const placementKey = (messageId, mailboxId, uid) => `${messageId}:${mailboxId}:${uid}`;
+/**
+ * Which of this batch's messages have really left the folder their row points at
+ * (#1146).
+ *
+ * A message sighted in a second real folder has not necessarily moved. Living in
+ * two folders at once is ordinary mail: a Gmail user label, a Sieve `fileinto`
+ * beside a `keep`, a Sent copy a mailing list echoes back. Reading every such
+ * sighting as a move takes the message out of the folder it is still in, and
+ * whichever folder the sync round enumerates last wins — which is how a labelled
+ * message disappeared from the Inbox on the next sync.
+ *
+ * What separates a move from a copy is the source folder: a move empties it, a
+ * copy leaves it alone. So the source is asked, and only a source that no longer
+ * holds the uid the row claims makes the sighting a move. A move another client
+ * made is still followed — that is the case where the source really is empty —
+ * and reader stops fighting a second client over mail neither of them moved.
+ *
+ * The question is asked with a UID SEARCH rather than a FETCH, for the reason
+ * `isMessageGoneFromOpenMailbox` documents: imapflow drops rows on back-to-back
+ * FETCHes (#408), and absence read off a FETCH would file live mail as departed.
+ * `IImapConnection.search` throws on a failed SEARCH, so an empty answer means
+ * the server matched nothing. The SEARCH names the contested uids rather than
+ * ALL: the answer needed is about those uids, and a folder's whole uid set is a
+ * page of traffic per batch for an account with a large Inbox.
+ *
+ * One SEARCH per source folder per batch, and no IMAP at all when nothing is
+ * contested — which is every round on an account whose folders do not overlap.
+ */
+export const confirmDepartures = async (deps, accountId, sightedIn, messageIds) => {
+    const verdicts = {
+        departed: new Set(),
+        settled: new Set(),
+        needsSave: new Set(),
+    };
+    if (messageIds.length === 0)
+        return verdicts;
+    const stored = await deps.messageService.get(messageIds);
+    // A row carrying no uid names no placement the source can be asked about, so
+    // it reaches no verdict here and its sighting is served again next round. It
+    // is not reachable from a sync — `upsertWithStatus` writes the uid the FETCH
+    // returned — and a folder that somehow produces one stalls its cursor and
+    // raises the alert rather than repairing a row against nothing.
+    const contested = stored.filter((row) => row.uid > 0 && sightingContestsPlacement(sightedIn, row));
+    if (contested.length === 0)
+        return verdicts;
+    const bySource = new Map();
+    for (const row of contested) {
+        const group = bySource.get(row.mailboxId);
+        if (group === undefined) {
+            bySource.set(row.mailboxId, [row]);
+            continue;
+        }
+        group.push(row);
+    }
+    for (const [sourceMailboxId, rows] of bySource) {
+        await askSource(deps, accountId, sightedIn, sourceMailboxId, rows, verdicts);
+    }
+    for (const row of contested) {
+        const key = placementKey(row.messageId, row.mailboxId, row.uid);
+        if (verdicts.departed.has(key) || !verdicts.settled.has(key)) {
+            verdicts.needsSave.add(row.messageId);
+        }
+    }
+    return verdicts;
+};
+const readSource = async (deps, accountId, sourceMailboxId, rows) => {
+    const source = await deps.mailboxService.get(accountId, sourceMailboxId);
+    // A row whose source is All Mail, Starred or Important is not filed there:
+    // those folders hold a copy of everything and never release anything, so
+    // asking them would answer "still here" forever and freeze the row on a view.
+    if (isVirtualCopyMailbox(source)) {
+        return { kind: "copiesEverything", path: source.fullPath };
+    }
+    const box = await deps.connection.openBox(source.fullPath, true);
+    // A source folder on a different UIDVALIDITY axis holds no uid these rows can
+    // be compared against, so its message set is evidence of nothing (RFC 9051
+    // 2.3.1.1). The cursor rebuild re-keys that folder; until it has, the
+    // sightings stay unsettled and come back next round.
+    if (box.uidvalidity !== source.uidValidity) {
+        return {
+            kind: "rekeyed",
+            path: source.fullPath,
+            stored: source.uidValidity,
+            served: box.uidvalidity,
+        };
+    }
+    const held = await deps.connection.search([
+        ["UID", rows.map((row) => row.uid).join(",")],
+    ]);
+    return { kind: "holds", path: source.fullPath, held: new Set(held) };
+};
+const askSource = async (deps, accountId, sightedIn, sourceMailboxId, rows, verdicts) => {
+    const settle = (row, departed) => {
+        const key = placementKey(row.messageId, row.mailboxId, row.uid);
+        verdicts.settled.add(key);
+        if (departed)
+            verdicts.departed.add(key);
+    };
+    // A source folder reader cannot reach decides nothing, and does not fail the
+    // round either. Another client renaming or deleting it between the row being
+    // written and now is ordinary — reader shares its mailboxes — and the sync of
+    // the unrelated folder that sighted these messages must survive it.
+    const answer = await readSource(deps, accountId, sourceMailboxId, rows).catch((error) => ({
+        kind: "unreachable",
+        reason: error instanceof Error ? error.message : String(error),
+    }));
+    const observed = {
+        sourceMailboxId,
+        sightedMailboxId: sightedIn.mailboxId,
+        contested: rows.length,
+    };
+    if (answer.kind === "unreachable") {
+        deps.log.warn({ ...observed, error: answer.reason }, "Could not ask the source folder whether it still holds these messages; leaving the sightings unsettled this round");
+        return;
+    }
+    if (answer.kind === "rekeyed") {
+        deps.log.warn({
+            ...observed,
+            sourceMailboxPath: answer.path,
+            storedUidValidity: answer.stored,
+            servedUidValidity: answer.served,
+        }, "Source folder is on a different UIDVALIDITY axis; leaving these sightings unsettled this round");
+        return;
+    }
+    if (answer.kind === "copiesEverything") {
+        for (const row of rows)
+            settle(row, true);
+        deps.log.info({ ...observed, sourceMailboxPath: answer.path }, "Row points at a folder that copies every message; the sighting in a real folder is where it lives");
+        return;
+    }
+    for (const row of rows)
+        settle(row, !answer.held.has(row.uid));
+};

package/dist/filter-operations.d.ts

@@ -0,0 +1,42 @@
+import { type FilterItem, type IAccountRepository, type IFilterRepository, type IMailboxRepository, type MailboxItem, type OrganizeJobRequestItem, type UpdateFilterInput } from "@remit/data-ports";
+import { type OrganizeJobDeps, type OrganizeJobOwner } from "./organize-job.js";
+import { type Refusable } from "./refusal.js";
+export type NewFilter = Pick<FilterItem, "name" | "scope" | "expiresAt" | "matchOperator" | "literalClauses" | "actionLabelId" | "actionMailboxId">;
+export type FilterPatch = Pick<UpdateFilterInput, "name" | "scope" | "expiresAt" | "matchOperator" | "literalClauses" | "actionLabelId" | "actionMailboxId" | "state">;
+export interface FilterPage {
+    items: FilterItem[];
+    continuationToken?: string;
+}
+export interface CreatedFilter {
+    filter: FilterItem;
+    organizeJob: OrganizeJobRequestItem;
+}
+interface AccountDeps {
+    account: Pick<IAccountRepository, "get">;
+}
+interface ActionFolderDeps {
+    mailbox: Pick<IMailboxRepository, "resolveAccountId"> & {
+        get(accountId: string, mailboxId: string): Promise<MailboxItem>;
+    };
+}
+export declare const resolveFilterUpdate: (current: Pick<FilterItem, "scope" | "expiresAt" | "state" | "disabledReason" | "actionMailboxId">, patch: FilterPatch, now?: number) => Refusable<UpdateFilterInput>;
+export declare const listFilters: (deps: AccountDeps & {
+    filter: Pick<IFilterRepository, "listPageByAccountConfig" | "refreshExpiry">;
+}, accountConfigId: string, query: {
+    accountId: string;
+    continuationToken: string | undefined;
+}) => Promise<Refusable<FilterPage>>;
+export declare const createFilter: (deps: AccountDeps & ActionFolderDeps & OrganizeJobDeps & {
+    filter: Pick<IFilterRepository, "create">;
+}, owner: OrganizeJobOwner, input: {
+    accountId: string;
+    filter: NewFilter;
+}) => Promise<Refusable<CreatedFilter>>;
+export declare const updateFilter: (deps: AccountDeps & ActionFolderDeps & {
+    filter: Pick<IFilterRepository, "get" | "update">;
+}, accountConfigId: string, input: {
+    accountId: string;
+    filterId: string;
+    patch: FilterPatch;
+}) => Promise<Refusable<FilterItem>>;
+export {};

package/dist/filter-operations.js

@@ -0,0 +1,211 @@
+import { deriveFilterTtl, FILTER_NO_ACTION, } from "@remit/data-ports";
+import { FilterDisabledReason, FilterScope, FilterState, } from "@remit/domain-enums";
+import { queueOrganizeJob, } from "./organize-job.js";
+import { folderInAccount, ownedAccount, settledFolder } from "./ownership.js";
+import { accept, invalid } from "./refusal.js";
+// Only these keys reach the repo, and a key absent from the body stays absent,
+// so a rename never bumps ruleChangedAt and a smuggled ttl is dropped.
+const pickFilterUpdate = (body) => {
+    const patch = {};
+    if (Object.hasOwn(body, "name"))
+        patch.name = body.name;
+    if (Object.hasOwn(body, "scope"))
+        patch.scope = body.scope;
+    if (Object.hasOwn(body, "expiresAt"))
+        patch.expiresAt = body.expiresAt;
+    if (Object.hasOwn(body, "matchOperator")) {
+        patch.matchOperator = body.matchOperator;
+    }
+    if (Object.hasOwn(body, "literalClauses")) {
+        patch.literalClauses = body.literalClauses;
+    }
+    if (Object.hasOwn(body, "actionLabelId")) {
+        patch.actionLabelId = body.actionLabelId;
+    }
+    if (Object.hasOwn(body, "actionMailboxId")) {
+        patch.actionMailboxId = body.actionMailboxId;
+    }
+    if (Object.hasOwn(body, "state"))
+        patch.state = body.state;
+    return patch;
+};
+// A Temporary filter always carries expiresAt; outside Temporary both
+// expiresAt and the table-wide ttl stay absent, or the row would be swept.
+const resolveFilterScopeExpiry = (current, patch) => {
+    const scope = patch.scope ?? current.scope;
+    if (scope !== FilterScope.Temporary) {
+        if (Object.hasOwn(patch, "expiresAt") && patch.expiresAt) {
+            return invalid("expiresAt only applies to a Temporary filter — switch scope to Temporary to set one.");
+        }
+        return accept({
+            scope,
+            expiresAt: undefined,
+            ttl: undefined,
+            state: FilterState.Active,
+        });
+    }
+    const expiresAt = Object.hasOwn(patch, "expiresAt")
+        ? patch.expiresAt
+        : current.expiresAt;
+    if (!expiresAt) {
+        return invalid("A Temporary filter needs expiresAt — pick a date, or switch scope to Standing.");
+    }
+    const ttl = deriveFilterTtl(scope, expiresAt);
+    const state = new Date(expiresAt).getTime() > Date.now()
+        ? FilterState.Active
+        : FilterState.Expired;
+    return accept({ scope, expiresAt, ttl, state });
+};
+const hasLapsed = (filter, now) => filter.scope === FilterScope.Temporary &&
+    filter.expiresAt !== undefined &&
+    new Date(filter.expiresAt).getTime() <= now;
+const FOLDERLESS_REASONS = new Set([
+    FilterDisabledReason.AwaitingFolder,
+    FilterDisabledReason.FolderCreateFailed,
+]);
+const folderlessMessage = (reason) => reason === FilterDisabledReason.AwaitingFolder
+    ? "This filter has no folder to move mail into yet. Wait for its folder to be created on the mail server, or pick a folder in the rule, then turn it on."
+    : "The mail server refused to create this filter's folder. Pick a folder in the rule, then turn it on.";
+export const resolveFilterUpdate = (current, patch, now = Date.now()) => {
+    if (patch.state === FilterState.Expired) {
+        return invalid("A filter expires through its date, not its state. Set it Active or Disabled, or change its expiry.");
+    }
+    const folderless = current.state === FilterState.Disabled &&
+        FOLDERLESS_REASONS.has(current.disabledReason);
+    const folder = patch.actionMailboxId ?? current.actionMailboxId;
+    const picked = folderless && folder !== FILTER_NO_ACTION;
+    const pickedReason = picked
+        ? { disabledReason: FilterDisabledReason.UserDisabled }
+        : {};
+    const touchesTiming = Object.hasOwn(patch, "scope") || Object.hasOwn(patch, "expiresAt");
+    if (!touchesTiming && patch.state === undefined) {
+        return accept({ ...patch, ...pickedReason });
+    }
+    let timing;
+    if (touchesTiming) {
+        const resolved = resolveFilterScopeExpiry(current, patch);
+        if (!resolved.ok)
+            return resolved;
+        timing = resolved.value;
+    }
+    const lapsed = timing
+        ? timing.state === FilterState.Expired
+        : hasLapsed(current, now);
+    if (patch.state === FilterState.Active && lapsed) {
+        return invalid("This filter has expired. Move its date forward or make it Standing to turn it back on.");
+    }
+    const wanted = patch.state ?? current.state;
+    const merged = { ...patch, ...timing };
+    if (wanted === FilterState.Disabled) {
+        return accept({
+            ...merged,
+            state: FilterState.Disabled,
+            ...(folderless
+                ? pickedReason
+                : patch.state === FilterState.Disabled
+                    ? { disabledReason: FilterDisabledReason.UserDisabled }
+                    : {}),
+        });
+    }
+    if (lapsed) {
+        return accept({
+            ...merged,
+            state: FilterState.Expired,
+            disabledReason: FilterDisabledReason.None,
+        });
+    }
+    if (folderless && folder === FILTER_NO_ACTION) {
+        return invalid(folderlessMessage(current.disabledReason));
+    }
+    return accept({
+        ...merged,
+        state: FilterState.Active,
+        disabledReason: FilterDisabledReason.None,
+    });
+};
+// The sentinel means "no move action" and binds to nothing, so it is not
+// gated, and neither is a patch that leaves the field alone.
+const settledActionFolder = async (deps, accountId, actionMailboxId) => {
+    if (actionMailboxId === undefined || actionMailboxId === FILTER_NO_ACTION) {
+        return accept(actionMailboxId);
+    }
+    const target = await deps.mailbox.get(accountId, actionMailboxId);
+    const inAccount = folderInAccount(target, accountId, "act");
+    if (!inAccount.ok)
+        return inAccount;
+    const settled = settledFolder(target);
+    if (!settled.ok)
+        return settled;
+    return accept(actionMailboxId);
+};
+const existingActionFolder = async (deps, accountId, actionMailboxId) => {
+    if (actionMailboxId === FILTER_NO_ACTION)
+        return accept(actionMailboxId);
+    if ((await deps.mailbox.resolveAccountId(actionMailboxId)) === null) {
+        return invalid("The folder this filter moves mail into no longer exists. Pick another folder, then turn the filter on.");
+    }
+    return settledActionFolder(deps, accountId, actionMailboxId);
+};
+export const listFilters = async (deps, accountConfigId, query) => {
+    const owned = ownedAccount(await deps.account.get(query.accountId), accountConfigId, "read");
+    if (!owned.ok)
+        return owned;
+    const page = await deps.filter.listPageByAccountConfig(accountConfigId, {
+        continuationToken: query.continuationToken,
+    });
+    // Reading the list lazily expires a lapsed Temporary filter.
+    const items = await Promise.all(page.items.map((item) => deps.filter.refreshExpiry(item)));
+    return accept({ items, continuationToken: page.continuationToken });
+};
+export const createFilter = async (deps, owner, input) => {
+    const { accountConfigId, userId } = owner;
+    const { accountId, filter: rule } = input;
+    const owned = ownedAccount(await deps.account.get(accountId), accountConfigId, "act");
+    if (!owned.ok)
+        return owned;
+    const scoped = resolveFilterScopeExpiry({ scope: rule.scope, expiresAt: undefined }, { scope: rule.scope, expiresAt: rule.expiresAt });
+    if (!scoped.ok)
+        return scoped;
+    const target = await settledActionFolder(deps, accountId, rule.actionMailboxId);
+    if (!target.ok)
+        return target;
+    const filter = await deps.filter.create({
+        accountConfigId,
+        name: rule.name,
+        scope: scoped.value.scope,
+        expiresAt: scoped.value.expiresAt,
+        ttl: scoped.value.ttl,
+        matchOperator: rule.matchOperator,
+        literalClauses: rule.literalClauses,
+        actionLabelId: rule.actionLabelId,
+        actionMailboxId: rule.actionMailboxId,
+    });
+    // The new filter's first pass over existing mail.
+    const organizeJob = await queueOrganizeJob(deps, {
+        accountConfigId,
+        userId,
+        filterId: filter.filterId,
+    });
+    return accept({ filter, organizeJob });
+};
+export const updateFilter = async (deps, accountConfigId, input) => {
+    const { accountId, filterId } = input;
+    const owned = ownedAccount(await deps.account.get(accountId), accountConfigId, "act");
+    if (!owned.ok)
+        return owned;
+    const patch = pickFilterUpdate(input.patch);
+    const target = await settledActionFolder(deps, accountId, patch.actionMailboxId);
+    if (!target.ok)
+        return target;
+    const current = await deps.filter.get(accountConfigId, filterId);
+    const resolved = resolveFilterUpdate(current, patch);
+    if (!resolved.ok)
+        return resolved;
+    if (patch.state === FilterState.Active &&
+        patch.actionMailboxId === undefined) {
+        const existing = await existingActionFolder(deps, accountId, current.actionMailboxId);
+        if (!existing.ok)
+            return existing;
+    }
+    return accept(await deps.filter.update(accountConfigId, filterId, resolved.value));
+};