@remit/web-client 0.0.215 → 0.0.216

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remit/web-client",
-  "version": "0.0.215",
+  "version": "0.0.216",
   "type": "module",
   "description": "Remit web client, published as composable primitives — the app shell, auth shells, and runtime config. A distributor imports what it composes and bundles it.",
   "exports": {

package/src/components/mail/DeleteConfirmDialog.render.test.ts

@@ -144,7 +144,6 @@ const mount = (options: {
 	accountId?: string;
 	trashFolderLabel?: string;
 	staleFolderLabel?: string;
-	trashIsUnconfirmed?: boolean;
 	authProvider?: AuthProvider;
 	onConfirm?: (messageIds: string[]) => void;
 }) => {
@@ -174,7 +173,6 @@ const mount = (options: {
 								accountId: options.accountId,
 								trashFolderLabel: options.trashFolderLabel,
 								staleFolderLabel: options.staleFolderLabel,
-								trashIsUnconfirmed: options.trashIsUnconfirmed,
 								isDeleting: options.isDeleting,
 								onConfirm,
 								onCancel: () => undefined,
@@ -325,6 +323,40 @@ describe("DeleteConfirmDialog — a refusal answers itself", () => {
 		assert.match(view.text(), /The Trash folder you chose is gone/);
 	});
 
+	// #876: a row already inside the folder reader only matched by name refuses
+	// like Empty Trash's own "unconfirmed" — not a plain "Delete permanently"
+	// the server would 409 on.
+	it("asks to confirm the guessed folder before an expunge nobody confirmed", async () => {
+		const view = mount({
+			outcome: "unconfirmed",
+			count: 3,
+			accountId: ACCOUNT,
+			trashFolderLabel: "Deleted Messages",
+		});
+		const text = view.text();
+		assert.match(text, /Confirm this account's Trash folder/);
+		assert.match(text, /Deleted Messages/);
+		assert.doesNotMatch(text, /Permanently delete 3 messages\?/);
+		const confirm = view.button("Confirm the folder");
+		assert.ok(confirm, "the remedy the copy names is on screen");
+		act(() => confirm?.click());
+		// DeleteConfirmDialog's own "unconfirmed" copy shares its title with the
+		// appointment prompt's, so the title alone cannot tell the two dialogs
+		// apart — matching only that string would pass whether or not the
+		// prompt actually replaced the dialog. The picker prompt is the
+		// prompt's own wording and never appears in DeleteConfirmDialog's copy.
+		assert.match(
+			view.text(),
+			/Confirm Deleted Messages, or pick the folder this account really uses\./,
+		);
+		await settle();
+		act(() => view.byLabel("Set Prullenbak, 3 messages, as Trash")?.click());
+		assert.ok(
+			view.button("Set as Trash and delete 3 messages"),
+			"the folder picker and the delete-specific confirm label are the prompt's own, not the dialog's",
+		);
+	});
+
 	it("still acts when no single account owns the rows", () => {
 		const confirmed: string[][] = [];
 		const view = mount({
@@ -369,28 +401,12 @@ describe("DeleteConfirmDialog — a refusal answers itself", () => {
 	});
 });
 
-/**
- * D4a: an expunge inside a Trash reader only matched by name still goes
- * through — the user asked for these specific rows — but they are told which
- * folder that is, and that nobody chose it, before it happens.
- */
-describe("DeleteConfirmDialog — an expunge inside a Trash nobody confirmed", () => {
-	it("keeps today's words for a confirmed Trash", () => {
+describe("DeleteConfirmDialog — an expunge inside a confirmed Trash", () => {
+	it("asks for the expunge itself, with no folder to confirm first", () => {
 		const view = mount({ outcome: "permanent", count: 3 });
-		assert.doesNotMatch(view.text(), /nobody confirmed it/);
-	});
-
-	it("names the folder and says nobody chose it", () => {
-		const view = mount({
-			outcome: "permanent",
-			count: 3,
-			trashFolderLabel: "Deleted Messages",
-			trashIsUnconfirmed: true,
-		});
 		const text = view.text();
 		assert.match(text, /Permanently delete 3 messages\?/);
-		assert.match(text, /They are in Deleted Messages/);
-		assert.match(text, /nobody confirmed it/);
+		assert.doesNotMatch(text, /nobody confirmed it/);
 		assert.equal(view.button("Delete permanently")?.disabled, false);
 	});
 });

package/src/components/mail/DeleteConfirmDialog.tsx

@@ -5,14 +5,15 @@
  * and Flagged — so the wording and the refusal cannot drift apart again the way
  * they did between #845 and #855.
  *
- * Three of the outcomes are not confirmations at all. When the account has no
- * Trash, or the folder it appointed is gone, the server refuses the delete
- * outright; when its folder settings could not be read reader cannot say
- * whether a delete moves the mail or erases it. All three refuse and the
- * caller's `onConfirm` is never reached directly. The first two are answered
- * in place — the affirmative control opens the appointment prompt, whose own
- * confirm appoints the folder and then runs this delete. None of them may
- * render as "this folder is not Trash".
+ * Four of the outcomes are not confirmations at all. When the account has no
+ * Trash, the folder it appointed is gone, or the row would expunge inside a
+ * Trash nobody ever confirmed, the server refuses the delete outright; when
+ * its folder settings could not be read reader cannot say whether a delete
+ * moves the mail or erases it. All four refuse and the caller's `onConfirm` is
+ * never reached directly. The first three are answered in place — the
+ * affirmative control opens the appointment prompt, whose own confirm appoints
+ * the folder and then runs this delete. None of them may render as "this
+ * folder is not Trash".
  */
 import { ConfirmDialog } from "@remit/ui";
 import { useAuthProvider } from "@/auth/provider";
@@ -34,8 +35,8 @@ interface DeleteConfirmDialogProps {
 	trashFolderLabel?: string;
 	/** The folder the user appointed, now gone from the mail server. */
 	staleFolderLabel?: string;
-	/** That folder is a name match nobody ever confirmed. */
-	trashIsUnconfirmed?: boolean;
+	/** `unconfirmed`: that guessed folder by id, so the prompt opens on it. */
+	guessedMailboxId?: string;
 	/** A delete is already in flight, so the confirm cannot be pressed again. */
 	isDeleting?: boolean;
 	onConfirm: (messageIds: string[]) => void;
@@ -49,7 +50,7 @@ export const DeleteConfirmDialog = ({
 	accountId,
 	trashFolderLabel,
 	staleFolderLabel,
-	trashIsUnconfirmed = false,
+	guessedMailboxId,
 	isDeleting = false,
 	onConfirm,
 	onCancel,
@@ -61,10 +62,19 @@ export const DeleteConfirmDialog = ({
 	const copy = deleteConfirmationCopy(count, outcome, {
 		trashFolderLabel,
 		staleFolderLabel,
-		trashIsUnconfirmed,
 	});
 
-	if (outcome === "noTrash" || outcome === "staleTrash") {
+	if (
+		outcome === "noTrash" ||
+		outcome === "staleTrash" ||
+		outcome === "unconfirmed"
+	) {
+		const reason =
+			outcome === "noTrash"
+				? "none"
+				: outcome === "staleTrash"
+					? "stale"
+					: "unconfirmed";
 		return (
 			<ConfirmDialog
 				isOpen={isOpen}
@@ -79,9 +89,11 @@ export const DeleteConfirmDialog = ({
 					requestAppointment({
 						accountId,
 						role: "Trash",
-						reason: outcome === "noTrash" ? "none" : "stale",
+						reason,
 						action: { kind: "delete", count },
 						staleFolderLabel,
+						trashFolderLabel,
+						guessedMailboxId,
 						onAppointed: async () => onConfirm(replay),
 					});
 				}}

package/src/components/mail/MessageList.run-reporting.test.ts

@@ -5,6 +5,7 @@ import { describe, it } from "node:test";
 import { fileURLToPath } from "node:url";
 import { runEndingBanner } from "@/lib/bulk-action-copy";
 import type { BulkRunOutcome } from "@/lib/bulk-actions";
+import { type DeleteOutcome, deleteExpunges } from "@/lib/format";
 
 /**
  * A run states how it ended, to whoever is still there to read it (#521). The
@@ -28,6 +29,8 @@ import type { BulkRunOutcome } from "@/lib/bulk-actions";
 const here = dirname(fileURLToPath(import.meta.url));
 const source = readFileSync(resolve(here, "MessageList.tsx"), "utf8");
 
+const expunging: DeleteOutcome[] = ["permanent", "unconfirmed"];
+
 const ended = (over: Partial<BulkRunOutcome> = {}): BulkRunOutcome => ({
 	done: 100,
 	failedIds: [],
@@ -92,18 +95,24 @@ describe("reporting how a run ended", () => {
 		);
 	});
 
-	it("names an expunge as an expunge, however the run ended", () => {
-		assert.match(
-			runEndingBanner("delete", 100, ended(), "permanent")?.title ?? "",
-			/^100 permanently deleted\./,
-		);
-		assert.match(
-			runEndingBanner("delete", 3000, ended({ cancelled: true }), "permanent")
-				?.detail ?? "",
-			/100 of 3,000 permanently deleted\./,
-			"the half that ran is erased whether or not the rest did",
-		);
-	});
+	// Both outcomes a row already inside Trash produces, because both erase it.
+	// `unconfirmed` is only ever reached that way (#876), and a ternary that knew
+	// only `permanent` reported an expunge as "moved to Trash".
+	for (const outcome of expunging) {
+		it(`names a ${outcome} delete as an expunge, however the run ended`, () => {
+			assert.ok(deleteExpunges(outcome), "the copy reads this predicate");
+			assert.match(
+				runEndingBanner("delete", 100, ended(), outcome)?.title ?? "",
+				/^100 permanently deleted\./,
+			);
+			assert.match(
+				runEndingBanner("delete", 3000, ended({ cancelled: true }), outcome)
+					?.detail ?? "",
+				/100 of 3,000 permanently deleted\./,
+				"the half that ran is erased whether or not the rest did",
+			);
+		});
+	}
 });
 
 describe("the run the wizard leaves behind", () => {

package/src/components/mail/MessageList.tsx

@@ -326,8 +326,8 @@ export const MessageList = ({
 	);
 	const {
 		outcome: deleteOutcome,
-		trashIsUnconfirmed,
 		staleFolderLabel,
+		guessedMailboxId,
 	} = useDeleteOutcome(deleteScope);
 
 	// Selection state
@@ -1352,7 +1352,7 @@ export const MessageList = ({
 				// mailbox is the Trash the copy has to name.
 				trashFolderLabel={listTitle}
 				staleFolderLabel={staleFolderLabel}
-				trashIsUnconfirmed={trashIsUnconfirmed}
+				guessedMailboxId={guessedMailboxId}
 				isDeleting={isDeleting}
 				onConfirm={handleConfirmDelete}
 				onCancel={handleCancelDelete}

package/src/components/mail/RoleAppointmentPromptProvider.tsx

@@ -212,6 +212,7 @@ export const RoleAppointmentPromptProvider = ({
 					folders={folders}
 					delimiter={folderDelimiter(mailboxes)}
 					trashFolderLabel={trashFolderLabel}
+					guessedMailboxId={guessedMailboxId}
 					staleFolderLabel={
 						request.staleFolderLabel ?? trash?.staleAppointmentPath
 					}

package/src/components/mail/ThreadListInteraction.tsx

@@ -287,8 +287,8 @@ export function ThreadListInteraction({
 	);
 	const {
 		outcome: deleteOutcome,
-		trashIsUnconfirmed,
 		staleFolderLabel,
+		guessedMailboxId,
 	} = useDeleteOutcome(pendingDelete?.targets ?? NO_TARGETS);
 
 	// A verb, routed the same way the bar routes its own (#477 1.4, #508). Over a
@@ -482,7 +482,7 @@ export function ThreadListInteraction({
 				outcome={deleteOutcome}
 				accountId={pendingDelete?.targets[0]?.accountId}
 				staleFolderLabel={staleFolderLabel}
-				trashIsUnconfirmed={trashIsUnconfirmed}
+				guessedMailboxId={guessedMailboxId}
 				isDeleting={isDeleting}
 				onConfirm={confirmDelete}
 				onCancel={cancelDelete}

package/src/hooks/escalated-run-refusal.render.test.ts

@@ -0,0 +1,156 @@
+/**
+ * A select-all delete refused for its folder role is answered by the
+ * appointment prompt, not by a banner (#876).
+ *
+ * The escalated path had no branch for the coded 409, so the refusal arrived as
+ * the API's own sentence — "Appoint one under Settings › Folder roles" — under a
+ * "Couldn't delete these messages" banner. That asks a user who has just
+ * selected three thousand messages to go to another screen and rebuild the
+ * selection, which is the outcome the prompt exists to remove; the single-row
+ * path has answered it in place since #887.
+ */
+
+import assert from "node:assert/strict";
+import { afterEach, describe, it } from "node:test";
+import { QueryClientProvider } from "@tanstack/react-query";
+import { act, createElement } from "react";
+import { RoleAppointmentPromptProvider } from "@/components/mail/RoleAppointmentPromptProvider";
+import { ErrorBannerProvider } from "@/components/ui/ErrorBannerProvider";
+import { createDomHarness, type DomHarness } from "../test-support/dom";
+import { type HttpMock, mockFetch } from "../test-support/http";
+import {
+	type UseEscalatedActionsResult,
+	useEscalatedActions,
+} from "./useEscalatedActions";
+
+const INBOX = "mbx-inbox";
+const ACCOUNT = "acc-1";
+const TRASH = "mbx-trash";
+
+let harness: DomHarness | undefined;
+let http: HttpMock | undefined;
+let hook: UseEscalatedActionsResult | undefined;
+
+afterEach(() => {
+	harness?.close();
+	harness = undefined;
+	http?.restore();
+	http = undefined;
+	hook = undefined;
+});
+
+const CONFIG = {
+	accounts: [
+		{
+			accountId: ACCOUNT,
+			email: "you@example.com",
+			folderAppointments: [
+				{ role: "Trash", mailboxId: TRASH, source: "Proposed" },
+			],
+		},
+	],
+};
+
+/** Fresh every call — a `Response` body can only be read once. */
+const refusal = (): Response =>
+	new Response(
+		JSON.stringify({
+			status: 409,
+			message: "Nobody has confirmed which folder is this account's Trash",
+			code: "folder_role_unresolved",
+			details: { reason: "unconfirmed", role: "Trash", accountId: ACCOUNT },
+		}),
+		{ status: 409, headers: { "content-type": "application/json" } },
+	);
+
+const Probe = () => {
+	hook = useEscalatedActions({
+		mailboxId: INBOX,
+		accountId: ACCOUNT,
+		enabled: true,
+		predicateKey: "npm",
+		searchQuery: { query: "npm" },
+	});
+	return null;
+};
+
+const settle = async (): Promise<void> => {
+	if (!harness) throw new Error("nothing mounted");
+	for (let round = 0; round < 40; round += 1) {
+		await harness.flush();
+		await harness.wait(0);
+	}
+};
+
+const mount = async (respond: (path: string) => unknown): Promise<void> => {
+	http = mockFetch((call) => respond(call.path));
+	harness = createDomHarness();
+	await harness.renderAsync(
+		createElement(
+			QueryClientProvider,
+			{ client: harness.queryClient as never },
+			createElement(
+				ErrorBannerProvider,
+				null,
+				createElement(
+					RoleAppointmentPromptProvider,
+					null,
+					createElement(Probe),
+				),
+			),
+		),
+	);
+	await settle();
+};
+
+const runDelete = async (): Promise<void> => {
+	await act(async () => {
+		await hook?.runAction({ kind: "delete" }, [
+			{ id: "msg-1", accountId: ACCOUNT },
+		]);
+	});
+	await settle();
+};
+
+describe("a bulk delete refused for its folder role", () => {
+	it("opens the appointment prompt instead of bannering the API's sentence", async () => {
+		await mount((path) => {
+			if (path.endsWith("/config")) return CONFIG;
+			if (path.endsWith("/messages/delete")) return refusal();
+			return {};
+		});
+
+		await runDelete();
+
+		const text = harness?.text() ?? "";
+		assert.match(text, /Confirm this account's Trash folder/);
+		assert.doesNotMatch(text, /Couldn't delete these messages/);
+		assert.doesNotMatch(
+			text,
+			/Settings › Folder roles/,
+			"the raw API sentence is what the prompt replaces",
+		);
+	});
+
+	it("keeps today's banner for a 409 that is somebody else's", async () => {
+		await mount((path) => {
+			if (path.endsWith("/config")) return CONFIG;
+			if (path.endsWith("/messages/delete"))
+				return new Response(
+					JSON.stringify({
+						status: 409,
+						message: "boom",
+						code: "mailbox_not_settled",
+					}),
+					{ status: 409, headers: { "content-type": "application/json" } },
+				);
+			return {};
+		});
+
+		await runDelete();
+
+		const text = harness?.text() ?? "";
+		assert.match(text, /Couldn't delete these messages/);
+		assert.doesNotMatch(text, /Confirm this account's Trash folder/);
+	});
+});

package/src/hooks/useDeleteOutcome.ts

@@ -11,9 +11,9 @@
  * from several mailboxes and several accounts at once.
  *
  * The decision itself is `deleteOutcomeFor`, kept pure in `lib/format`; this is
- * only the read that feeds it. The two facts beside it are what the copy needs
- * to name a folder: whether the Trash it resolved is a name match nobody
- * confirmed (D4a), and the folder a stale appointment lost.
+ * only the read that feeds it. The two facts beside it are the folders the
+ * refusal has to name: the one a stale appointment lost, and the one reader
+ * guessed and is asking the user to confirm.
  */
 import { useMemo } from "react";
 import {
@@ -25,10 +25,14 @@ import { useTrashByAccount } from "./useArchiveMailbox";
 
 export interface DeleteOutcomeResult {
 	outcome: DeleteOutcome;
-	/** The Trash these rows resolve to was matched by name, never confirmed. */
-	trashIsUnconfirmed: boolean;
 	/** The folder the user appointed, when it is gone from the mail server. */
 	staleFolderLabel?: string;
+	/**
+	 * `unconfirmed`: the folder reader matched by name, which the rows are
+	 * already inside. The prompt opens with it chosen, so confirming the guess is
+	 * one tap.
+	 */
+	guessedMailboxId?: string;
 }
 
 /** The outcome of deleting `targets`. */
@@ -48,18 +52,19 @@ export const useDeleteOutcome = (
 			target.accountId ? trashByAccount.get(target.accountId) : undefined;
 		return {
 			outcome,
-			// Only the rows the delete would actually expunge — a row filed
-			// somewhere else says nothing about the folder it is moving into.
-			trashIsUnconfirmed: targets.some((target) => {
-				const trash = trashFor(target);
-				return (
-					trash?.source === "Proposed" && trash.mailboxId === target.mailboxId
-				);
-			}),
 			// The account `deleteOutcomeFor` refused on, found the way it found it.
 			staleFolderLabel: targets
 				.map(trashFor)
 				.find((trash) => trash?.source === "Stale")?.staleFolderPath,
+			// The folder that produced `unconfirmed`: a row's own mailbox, which is
+			// also its account's guessed Trash. Only that row says which folder is
+			// being asked about — a row filed elsewhere is moving, not expunging.
+			guessedMailboxId:
+				outcome === "unconfirmed"
+					? targets.find(
+							(target) => trashFor(target)?.mailboxId === target.mailboxId,
+						)?.mailboxId
+					: undefined,
 		};
 	}, [targets, trashByAccount, hasAppointments, isError]);
 };

package/src/hooks/useEscalatedActions.ts

@@ -8,8 +8,10 @@ import {
 import type { ThreadOperationsSearchThreadsData } from "@remit/api-http-client/types.gen.ts";
 import { useQueryClient } from "@tanstack/react-query";
 import { useCallback, useEffect, useRef, useState } from "react";
+import { useRoleAppointmentPrompt } from "@/components/mail/RoleAppointmentPromptProvider";
 import { useErrorBanners } from "@/components/ui/ErrorBannerProvider";
 import { buildMutationErrorBanner } from "@/components/ui/error-banners";
+import { isFolderRoleRefusal } from "@/components/ui/folder-role-refusal";
 import {
 	bulkActionFailureDetail,
 	bulkActionFailureTitle,
@@ -152,6 +154,14 @@ export const useEscalatedActions = ({
 	const runningRef = useRef(false);
 	const queryClient = useQueryClient();
 	const { pushError } = useErrorBanners();
+	const { requestAppointment } = useRoleAppointmentPrompt();
+	// The run replays itself once a folder is appointed, so it needs a handle on
+	// itself that does not make `runAction` its own dependency.
+	const runRef = useRef<UseEscalatedActionsResult["runAction"]>(async () => ({
+		done: 0,
+		failedIds: [],
+		cancelled: false,
+	}));
 
 	// A different search (or leaving search/desktop) makes any in-flight
 	// escalation meaningless — it would otherwise keep counting or offering to
@@ -298,6 +308,10 @@ export const useEscalatedActions = ({
 			cancelRef.current = false;
 			runningRef.current = true;
 			setRunningAction(action);
+			// Read before the run clears the phase below, so a refusal can say how
+			// many messages the appointment's replay is about.
+			const matched =
+				targets?.length ?? (phase.kind === "escalated" ? phase.total : 0);
 			// `honestProgress` widens `total` if `done` overtakes it (#109) — the
 			// predicate can match more by the time the run pages it than the count
 			// saw, and the bar must never show more done than out of.
@@ -337,7 +351,25 @@ export const useEscalatedActions = ({
 			setProgress(undefined);
 			setPhase({ kind: "idle" });
 
-			if (outcome.error) {
+			// A provenance refusal is answered by the appointment prompt here exactly
+			// as it is on the single-row path (#887, #876). Left to the banner it
+			// arrives as the API's own sentence — "Appoint one under Settings ›
+			// Folder roles" — which asks the user to reassemble a select-all they
+			// have already made.
+			const refusal = outcome.error
+				? isFolderRoleRefusal(outcome.error)
+				: undefined;
+			if (refusal) {
+				requestAppointment({
+					accountId: refusal.accountId,
+					role: refusal.role,
+					reason: refusal.reason,
+					action: { kind: "delete", count: matched },
+					onAppointed: async () => {
+						await runRef.current(action, targets);
+					},
+				});
+			} else if (outcome.error) {
 				pushError(
 					buildMutationErrorBanner(
 						bulkActionFailureTitle(action.kind, outcome.done),
@@ -351,8 +383,16 @@ export const useEscalatedActions = ({
 			}
 			return outcome;
 		},
-		[applyBatchFor, fetchPagesOf, phase, pushError, invalidateAfterRun],
+		[
+			applyBatchFor,
+			fetchPagesOf,
+			phase,
+			pushError,
+			invalidateAfterRun,
+			requestAppointment,
+		],
 	);
+	runRef.current = runAction;
 
 	return {
 		phase,

package/src/lib/bulk-action-copy.ts

@@ -1,6 +1,6 @@
 import type { ErrorBannerSeverity } from "@/components/ui/error-banners";
 import type { BulkRunOutcome } from "@/lib/bulk-actions";
-import { type DeleteOutcome, formatNumber } from "@/lib/format";
+import { type DeleteOutcome, deleteExpunges, formatNumber } from "@/lib/format";
 
 /** A run ending, as the list banners it. */
 export interface RunEndingBanner {
@@ -38,7 +38,7 @@ const pastTense: Record<BulkActionKind, string> = {
  * it does for one that finished — the half that ran is still erased.
  */
 const pastTenseFor = (kind: BulkActionKind, outcome: DeleteOutcome): string =>
-	kind === "delete" && outcome === "permanent"
+	kind === "delete" && deleteExpunges(outcome)
 		? "permanently deleted"
 		: pastTense[kind];
 

package/src/lib/format.test.ts

@@ -1,5 +1,7 @@
 import assert from "node:assert";
 import { describe, test } from "node:test";
+import { trashSourceMeetsAssurance } from "@remit/data-ports/folder-role";
+import { FolderAppointmentSource } from "@remit/domain-enums";
 import type { DeleteTarget, TrashResolution } from "./format.js";
 import {
 	deleteConfirmationCopy,
@@ -338,33 +340,55 @@ describe("deleteOutcomeFor", () => {
 				targets: [target("mbx-inbox", "acct-1")],
 			}),
 			"trash",
-			"only Empty Trash demands a confirmed appointment (D4)",
+			"filing mail into a name guess is reversible; only an expunge needs more",
 		);
 	});
 
-	test("never answers `unconfirmed`, whatever the rows say", () => {
-		const sources: TrashResolution["source"][] = [
-			"Appointed",
-			"Flagged",
-			"Reserved",
-			"Proposed",
-			"Stale",
-			"None",
-		];
-		for (const source of sources) {
-			for (const mailboxId of ["mbx-trash", "mbx-inbox", undefined]) {
-				assert.notStrictEqual(
-					deleteOutcomeFor({
-						...settled,
-						trashByAccount: new Map<string, TrashResolution>([
-							["acct-1", { mailboxId, source }],
-						]),
-						targets: [target("mbx-inbox", "acct-1")],
-					}),
-					"unconfirmed",
-					"the targets of a delete say nothing about a whole folder",
-				);
-			}
+	test("a row already inside a Trash resolved only by name refuses as unconfirmed (#876)", () => {
+		assert.strictEqual(
+			deleteOutcomeFor({
+				...settled,
+				trashByAccount: new Map<string, TrashResolution>([
+					["acct-1", { mailboxId: "mbx-trash", source: "Proposed" }],
+				]),
+				targets: [target("mbx-trash", "acct-1")],
+			}),
+			"unconfirmed",
+			"deleting a row already in the name-guessed folder expunges it — the same act Empty Trash refuses on this evidence",
+		);
+	});
+
+	test("one row expunging inside an unconfirmed Trash outranks a plain expunge", () => {
+		assert.strictEqual(
+			deleteOutcomeFor({
+				...settled,
+				trashByAccount: new Map<string, TrashResolution>([
+					["acct-1", { mailboxId: "mbx-trash", source: "Proposed" }],
+				]),
+				targets: [target("mbx-inbox", "acct-1"), target("mbx-trash", "acct-1")],
+			}),
+			"unconfirmed",
+		);
+	});
+
+	test("words an expunge from the same evidence the service gates it on", () => {
+		// Derived from the shared gate rather than listed here: a hand-written
+		// list is how the dialog came to offer a confirm the server 409s on.
+		// `Stale` is excluded because it refuses under its own outcome first.
+		for (const source of Object.values(FolderAppointmentSource)) {
+			if (source === FolderAppointmentSource.Stale) continue;
+			const outcome = deleteOutcomeFor({
+				...settled,
+				trashByAccount: new Map<string, TrashResolution>([
+					["acct-1", { mailboxId: "mbx-trash", source }],
+				]),
+				targets: [target("mbx-trash", "acct-1")],
+			});
+			assert.strictEqual(
+				outcome === "unconfirmed",
+				!trashSourceMeetsAssurance(source, "confirmed"),
+				`${source} must ask for what the service demands before an expunge`,
+			);
 		}
 	});
 });
@@ -438,24 +462,9 @@ describe("deleteConfirmationCopy — the refusal", () => {
 		});
 	});
 
-	test("names the folder before an expunge inside a Trash nobody confirmed", () => {
-		const copy = deleteConfirmationCopy(2, "permanent", {
-			trashFolderLabel: "Deleted Messages",
-			trashIsUnconfirmed: true,
-		});
-		assert.strictEqual(copy.title, "Permanently delete 2 messages?");
-		assert.strictEqual(
-			copy.description,
-			"They are in Deleted Messages, which reader treats as this account's Trash because of its name — nobody confirmed it. They are erased from the mail server and cannot be restored.",
-		);
-		assert.strictEqual(copy.confirmLabel, "Delete permanently");
-	});
-
 	test("drops the name clause when the caller holds no folder name", () => {
-		const copy = deleteConfirmationCopy(2, "permanent", {
-			trashIsUnconfirmed: true,
-		});
-		assert.match(copy.description, /because of its name — nobody confirmed it/);
+		const copy = deleteConfirmationCopy(3, "unconfirmed");
+		assert.match(copy.description, /matched by name — nobody confirmed it/);
 		assert.ok(!copy.description.includes("undefined"));
 	});
 });

package/src/lib/format.ts

@@ -1,3 +1,8 @@
+import {
+	type FolderAppointmentSourceValue,
+	trashSourceMeetsAssurance,
+} from "@remit/data-ports/folder-role";
+
 /**
  * Get the user's preferred locale from browser settings.
  * Falls back to 'en-US' if unavailable.
@@ -178,8 +183,6 @@ export interface DeleteConfirmationContext {
 	trashFolderLabel?: string;
 	/** The folder the user appointed, now gone from the mail server. */
 	staleFolderLabel?: string;
-	/** That folder is a name match nobody ever confirmed. */
-	trashIsUnconfirmed?: boolean;
 }
 
 /**
@@ -207,10 +210,11 @@ export interface DeleteConfirmationContext {
  * single `noTrash` member cannot — this function only ever sees the member.
  *
  * `unconfirmed` is a folder reader matched by name that nobody ever confirmed.
- * Only Empty Trash refuses on it (D4); `deleteOutcomeFor` never produces it,
- * because the targets an ordinary delete is about say nothing about a whole
- * folder. The Empty Trash surface derives it from the server's own 409, and the
- * branch lives here so both surfaces word it identically.
+ * Empty Trash refuses on it for the whole folder (D4); `deleteOutcomeFor`
+ * produces it too, for the narrower case of a row that is already inside that
+ * folder — deleting it expunges on the same name guess, and the guess is never
+ * enough to destroy mail (#876). Both surfaces derive it from the server's own
+ * 409, and the branch lives here so they word it identically.
  */
 export type DeleteOutcome =
 	| "trash"
@@ -222,13 +226,7 @@ export type DeleteOutcome =
 	| "unavailable";
 
 /** Where an account's Trash answer came from (`FolderAppointmentSource`). */
-export type TrashSource =
-	| "Appointed"
-	| "Flagged"
-	| "Reserved"
-	| "Proposed"
-	| "Stale"
-	| "None";
+export type TrashSource = FolderAppointmentSourceValue;
 
 /** One account's Trash, as `/config` resolved it. */
 export interface TrashResolution {
@@ -268,8 +266,10 @@ export interface DeleteOutcomeInput {
  * One row bound for an expunge makes the whole delete unrecoverable, so a mixed
  * set is permanent: the wording may overstate what is destroyed, never what is
  * kept. One row on an account with no Trash refuses the whole call, so that
- * outranks both. Pure, so every branch — the failure ones above all — is
- * testable without a DOM.
+ * outranks both. An expunge on a Trash nobody confirmed outranks a plain
+ * expunge in turn — the server refuses it (#876), so the dialog asks for the
+ * same confirmation up front rather than offering a confirm that 409s. Pure,
+ * so every branch — the failure ones above all — is testable without a DOM.
  */
 export const deleteOutcomeFor = ({
 	targets,
@@ -282,17 +282,33 @@ export const deleteOutcomeFor = ({
 	if (targets.length === 0) return "unknown";
 
 	let expunges = false;
+	let expungesUnconfirmed = false;
 	for (const target of targets) {
 		if (target.accountId === undefined) return "unknown";
 		const trash = trashByAccount.get(target.accountId);
 		if (trash === undefined) return "unknown";
 		if (trash.source === "Stale") return "staleTrash";
 		if (trash.mailboxId === undefined) return "noTrash";
-		if (trash.mailboxId === target.mailboxId) expunges = true;
+		if (trash.mailboxId === target.mailboxId) {
+			expunges = true;
+			if (!trashSourceMeetsAssurance(trash.source, "confirmed"))
+				expungesUnconfirmed = true;
+		}
 	}
+	if (expungesUnconfirmed) return "unconfirmed";
 	return expunges ? "permanent" : "trash";
 };
 
+/**
+ * The delete erases mail rather than filing it. Both outcomes a row already
+ * inside Trash produces say so — `unconfirmed` is only ever reached that way
+ * (#876) — and anything that reports what a delete did reads this rather than
+ * testing for `permanent`, which is how a run of expunged mail came to be
+ * announced as "moved to Trash".
+ */
+export const deleteExpunges = (outcome: DeleteOutcome): boolean =>
+	outcome === "permanent" || outcome === "unconfirmed";
+
 /**
  * The confirmation for a delete, worded for what the delete actually does.
  * Deleting mail that already sits in Trash expunges it on the server and
@@ -315,7 +331,7 @@ export const deleteConfirmationCopy = (
 ): DeleteConfirmationCopy => {
 	const quantity = count === 1 ? "1" : formatNumber(count);
 	const noun = count === 1 ? "message" : "messages";
-	const { trashFolderLabel, staleFolderLabel, trashIsUnconfirmed } = context;
+	const { trashFolderLabel, staleFolderLabel } = context;
 
 	if (outcome === "noTrash") {
 		return {
@@ -335,11 +351,18 @@ export const deleteConfirmationCopy = (
 		};
 	}
 	if (outcome === "unconfirmed") {
+		const folderClause = trashFolderLabel
+			? `reader files this account's deleted mail in ${trashFolderLabel} because of its name — nobody confirmed it.`
+			: "reader files this account's deleted mail in a folder it matched by name — nobody confirmed it.";
+		// count === 0: Empty Trash, acting on everything the folder holds. A
+		// positive count: a delete whose rows already sit in that folder, so
+		// this expunges them specifically, not the folder's whole contents.
 		return {
 			title: "Confirm this account's Trash folder",
-			description: trashFolderLabel
-				? `reader files this account's deleted mail in ${trashFolderLabel} because of its name — nobody confirmed it. Emptying a folder erases everything in it from the mail server, and that cannot be restored. Nothing has been emptied.`
-				: "reader files this account's deleted mail in a folder it matched by name — nobody confirmed it. Emptying a folder erases everything in it from the mail server, and that cannot be restored. Nothing has been emptied.",
+			description:
+				count > 0
+					? `${folderClause} Deleting ${quantity} ${noun} there erases them from the mail server, and that cannot be restored. Nothing has been deleted.`
+					: `${folderClause} Emptying a folder erases everything in it from the mail server, and that cannot be restored. Nothing has been emptied.`,
 			confirmLabel: "Confirm the folder",
 		};
 	}
@@ -359,18 +382,6 @@ export const deleteConfirmationCopy = (
 		};
 	}
 	if (outcome === "permanent") {
-		// D4a: the expunge still goes through on a Trash nobody confirmed — the
-		// user asked for these specific rows — but they are told which folder
-		// reader treats as Trash, and that nobody chose it, before it happens.
-		if (trashIsUnconfirmed) {
-			return {
-				title: `Permanently delete ${quantity} ${noun}?`,
-				description: trashFolderLabel
-					? `They are in ${trashFolderLabel}, which reader treats as this account's Trash because of its name — nobody confirmed it. They are erased from the mail server and cannot be restored.`
-					: "They are in a folder reader treats as this account's Trash because of its name — nobody confirmed it. They are erased from the mail server and cannot be restored.",
-				confirmLabel: "Delete permanently",
-			};
-		}
 		return {
 			title: `Permanently delete ${quantity} ${noun}?`,
 			description: