fluxmail 0.10.0 → 0.11.0

package/dist/service/emailService.d.ts

@@ -4,6 +4,7 @@ import { type Entitlements } from '../licensing/entitlements.js';
 import type { FluxmailDb } from '../storage/db.js';
 import type { Principal } from '../auth.js';
 import { type ScheduledSendStatus } from '../storage/scheduledSends.js';
+import { type DeliveryOperation } from './deliveryCoordinator.js';
 import { type ConfiguredSendAsInput } from '../storage/sendAs.js';
 export interface SendInput extends DraftInput {
     /** With replyToMessageId: compute recipients from the original (reply-all semantics). */
@@ -41,6 +42,7 @@ export interface ServiceStatus {
 }
 export interface ScheduledSendInfo {
     scheduleId: string;
+    operationId?: string;
     accountId: string;
     draftId: string;
     /** ISO 8601 UTC. */
@@ -79,6 +81,30 @@ export interface BatchSearchResult {
     groups: BatchSearchGroup[];
     exhausted: boolean;
 }
+export interface ModifyResult {
+    action: ModifyAction;
+    succeededIds: string[];
+    failed: Array<{
+        messageId: string;
+        code: string;
+    }>;
+    uncertainIds: string[];
+}
+export interface SendPreview {
+    accountId: string;
+    from: string;
+    to: EmailAddress[];
+    cc: EmailAddress[];
+    bcc: EmailAddress[];
+    subject: string;
+    attachments: Array<{
+        filename: string;
+        mimeType: string;
+        sizeBytes: number;
+    }>;
+    bodyTextChars: number;
+    bodyHtmlChars: number;
+}
 /** Parse and validate a sendAt timestamp; returns epoch ms. */
 export declare function resolveSendAt(sendAtIso: string, now?: number): number;
 /**
@@ -90,11 +116,12 @@ export declare class EmailService {
     private readonly registry;
     private readonly db;
     private readonly principal?;
+    private readonly maxAttachmentBytes;
     /** Wired to SendScheduler.wake() in long-lived processes; a no-op for one-shot CLI commands. */
     onScheduleChanged: () => void;
     private readonly cursorSecret;
     private readonly cursorCodec;
-    constructor(registry: AccountRegistry, db: FluxmailDb, principal?: Principal | undefined, cursorSecret?: Buffer);
+    constructor(registry: AccountRegistry, db: FluxmailDb, principal?: Principal | undefined, cursorSecret?: Buffer, maxAttachmentBytes?: number);
     /**
      * A view restricted to a member's mailbox grants and optional connection
      * allowlist. Internal background workers use the default service instead.
@@ -118,9 +145,9 @@ export declare class EmailService {
     listAccounts(): Account[];
     status(): Promise<ServiceStatus>;
     /**
-     * Gate for MCP tool calls: throws once a lapsed license leaves the instance
-     * over the entitled caps; returns a renewal warning to attach to results
-     * while the license is in its grace period or has lapsed.
+     * Gate for MCP tool calls: throws once the instance is over the entitled
+     * caps, after a lapse or once a cap reduction's grace period ends; returns a
+     * warning to attach to results while a grace period runs or after a lapse.
      */
     enforceQuota(): string | undefined;
     private scheduledStatus;
@@ -135,6 +162,19 @@ export declare class EmailService {
     createDraft(accountId: string | undefined, d: SendInput): Promise<Message>;
     updateDraft(accountId: string | undefined, draftId: string, d: SendInput): Promise<Message>;
     deleteDraft(accountId: string | undefined, draftId: string): Promise<void>;
+    getDraft(accountId: string | undefined, draftId: string): Promise<Message>;
+    previewSend(accountId: string | undefined, input: SendInput | {
+        draftId: string;
+    }): Promise<SendPreview>;
+    getDelivery(accountId: string, operationId: string): DeliveryOperation;
+    deliver(accountId: string | undefined, input: SendInput | {
+        draftId: string;
+    }, key: string): Promise<DeliveryOperation>;
+    deliverForward(accountId: string | undefined, input: ForwardInput, key: string): Promise<DeliveryOperation>;
+    deliverScheduled(accountId: string, draftId: string, scheduleId: string): Promise<DeliveryOperation>;
+    scheduleDelivery(accountId: string | undefined, input: SendInput | {
+        draftId: string;
+    }, sendAt: string, key: string): Promise<DeliveryOperation>;
     send(accountId: string | undefined, input: SendInput | {
         draftId: string;
     }): Promise<SendResult>;
@@ -145,6 +185,7 @@ export declare class EmailService {
     scheduleSend(accountId: string | undefined, input: SendInput | {
         draftId: string;
     }, sendAtIso: string): Promise<ScheduledSendInfo>;
+    private createSchedule;
     listScheduled(accountId?: string): ScheduledSendInfo[];
     /** Cancels a pending schedule; the provider draft is kept. */
     cancelScheduled(scheduleId: string): {
@@ -162,11 +203,12 @@ export declare class EmailService {
     private validateSender;
     private selectReplySender;
     forward(accountId: string | undefined, input: ForwardInput): Promise<SendResult>;
-    modify(accountId: string | undefined, ids: string[], action: ModifyAction): Promise<void>;
+    modify(accountId: string | undefined, ids: string[], action: ModifyAction): Promise<ModifyResult>;
     getAttachment(accountId: string | undefined, messageId: string, attachmentId: string, maxBytes?: number): Promise<{
         meta: AttachmentMeta;
         content: Buffer;
     }>;
+    private assertMailContent;
 }
 export declare function buildForwardBody(original: Message, comment?: string): {
     text?: string;

package/dist/service/emailService.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"emailService.d.ts","sourceRoot":"","sources":["../../src/service/emailService.ts"],"names":[],"mappings":"AAAA,OAAO,EAUL,KAAK,OAAO,EAEZ,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,KAAK,UAAU,EACf,KAAK,MAAM,EACX,KAAK,KAAK,EACV,KAAK,OAAO,EACZ,KAAK,iBAAiB,EACtB,KAAK,YAAY,EACjB,KAAK,QAAQ,EACb,KAAK,kBAAkB,EAEvB,KAAK,UAAU,EACf,KAAK,cAAc,EACnB,KAAK,MAAM,EACZ,MAAM,gBAAgB,CAAC;AAExB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAwC,KAAK,YAAY,EAAE,MAAM,8BAA8B,CAAC;AACvG,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAEnD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C,OAAO,EASL,KAAK,mBAAmB,EACzB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EAAiD,KAAK,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAEjH,MAAM,WAAW,SAAU,SAAQ,UAAU;IAC3C,yFAAyF;IACzF,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,EAAE,EAAE,YAAY,EAAE,CAAC;IACnB,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC;IACpB,wDAAwD;IACxD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,KAAK,CACb,IAAI,CAAC,OAAO,EAAE,IAAI,GAAG,UAAU,GAAG,OAAO,GAAG,QAAQ,GAAG,eAAe,CAAC,GAAG;QACxE,KAAK,CAAC,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,CAAA;SAAE,CAAC;QAC1C,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;KACrB,CACF,CAAC;IACF,gEAAgE;IAChE,OAAO,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5B,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,mEAAmE;IACnE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,SAAS,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACrD;AAED,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,oBAAoB;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,mBAAmB,CAAC;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,kBAAkB,EAAE,CAAC;IAC/B,KAAK,EAAE,kBAAkB,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAChC;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,SAAS,EAAE,KAAK,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,iBAAiB,CAAC;IACzB,KAAK,CAAC,EAAE,gBAAgB,CAAC;CAC1B;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAC3B,SAAS,EAAE,OAAO,CAAC;CACpB;AAkED,+DAA+D;AAC/D,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,SAAa,GAAG,MAAM,CAazE;AAkBD;;;;GAIG;AACH,qBAAa,YAAY;IAQrB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,EAAE;IACnB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;IAT7B,gGAAgG;IAChG,iBAAiB,EAAE,MAAM,IAAI,CAAY;IAEzC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAoB;gBAG7B,QAAQ,EAAE,eAAe,EACzB,EAAE,EAAE,UAAU,EACd,SAAS,CAAC,EAAE,SAAS,YAAA,EACtC,YAAY,CAAC,EAAE,MAAM;IAMvB;;;OAGG;IACH,aAAa,CAAC,SAAS,EAAE,SAAS,GAAG,YAAY;IAMjD,6FAA6F;IAC7F,OAAO,CAAC,UAAU;IAIlB,OAAO,CAAC,SAAS;IAIjB,OAAO,CAAC,kBAAkB;IAK1B,OAAO,CAAC,gBAAgB;IAMxB;;;;OAIG;IACH,OAAO,CAAC,sBAAsB;IAwB9B,4DAA4D;IAC5D,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAI5C,kFAAkF;YACpE,YAAY;IAqB1B,YAAY,IAAI,OAAO,EAAE;IAInB,MAAM,IAAI,OAAO,CAAC,aAAa,CAAC;IA8DtC;;;;OAIG;IACH,YAAY,IAAI,MAAM,GAAG,SAAS;IAelC,OAAO,CAAC,eAAe;IAmBvB,WAAW,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAIlD,UAAU,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC;IAIhD,UAAU,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAMnD,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,qBAAqB,EAAE,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAsChG,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,EAAE,CAAC,EAAE,UAAU,EAAE,IAAI,GAAE,QAAa,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAiF3G,mBAAmB,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,iBAAiB,CAAC;IA4D9E,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAIvE,SAAS,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAI3E,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,EAAE,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC;IAM1E,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC;IAM3F,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI1E,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,EAAE,KAAK,EAAE,SAAS,GAAG;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,UAAU,CAAC;IAoBhG;;;OAGG;IACG,YAAY,CAChB,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,KAAK,EAAE,SAAS,GAAG;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,EACtC,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,iBAAiB,CAAC;IA6B7B,aAAa,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,iBAAiB,EAAE;IAWtD,8DAA8D;IAC9D,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,IAAI,CAAA;KAAE;IAgB7F;;;;OAIG;YACW,iBAAiB;YA+BjB,gBAAgB;YAkChB,cAAc;IAwB5B,OAAO,CAAC,iBAAiB;IAWzB,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,UAAU,CAAC;IA+BhF,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IAIzF,aAAa,CACX,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,EACpB,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC;QAAE,IAAI,EAAE,cAAc,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CAGtD;AAED,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAwBtG"}
+{"version":3,"file":"emailService.d.ts","sourceRoot":"","sources":["../../src/service/emailService.ts"],"names":[],"mappings":"AAAA,OAAO,EAWL,KAAK,OAAO,EAEZ,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,KAAK,UAAU,EACf,KAAK,MAAM,EACX,KAAK,KAAK,EACV,KAAK,OAAO,EACZ,KAAK,iBAAiB,EACtB,KAAK,YAAY,EACjB,KAAK,QAAQ,EACb,KAAK,kBAAkB,EAEvB,KAAK,UAAU,EACf,KAAK,cAAc,EACnB,KAAK,MAAM,EACZ,MAAM,gBAAgB,CAAC;AAExB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAwC,KAAK,YAAY,EAAE,MAAM,8BAA8B,CAAC;AACvG,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAEnD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C,OAAO,EASL,KAAK,mBAAmB,EACzB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EAAkD,KAAK,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAGlH,OAAO,EAAiD,KAAK,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAEjH,MAAM,WAAW,SAAU,SAAQ,UAAU;IAC3C,yFAAyF;IACzF,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,EAAE,EAAE,YAAY,EAAE,CAAC;IACnB,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC;IACpB,wDAAwD;IACxD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,KAAK,CACb,IAAI,CAAC,OAAO,EAAE,IAAI,GAAG,UAAU,GAAG,OAAO,GAAG,QAAQ,GAAG,eAAe,CAAC,GAAG;QACxE,KAAK,CAAC,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,CAAA;SAAE,CAAC;QAC1C,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;KACrB,CACF,CAAC;IACF,gEAAgE;IAChE,OAAO,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5B,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,mEAAmE;IACnE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,SAAS,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACrD;AAED,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,oBAAoB;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,mBAAmB,CAAC;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,kBAAkB,EAAE,CAAC;IAC/B,KAAK,EAAE,kBAAkB,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAChC;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,SAAS,EAAE,KAAK,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,iBAAiB,CAAC;IACzB,KAAK,CAAC,EAAE,gBAAgB,CAAC;CAC1B;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAC3B,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,YAAY,CAAC;IACrB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,MAAM,EAAE,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACnD,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,YAAY,EAAE,CAAC;IACnB,EAAE,EAAE,YAAY,EAAE,CAAC;IACnB,GAAG,EAAE,YAAY,EAAE,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC9E,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;CACvB;AAkED,+DAA+D;AAC/D,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,SAAa,GAAG,MAAM,CAazE;AAkBD;;;;GAIG;AACH,qBAAa,YAAY;IAQrB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,EAAE;IACnB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;IAE3B,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IAXrC,gGAAgG;IAChG,iBAAiB,EAAE,MAAM,IAAI,CAAY;IAEzC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAoB;gBAG7B,QAAQ,EAAE,eAAe,EACzB,EAAE,EAAE,UAAU,EACd,SAAS,CAAC,EAAE,SAAS,YAAA,EACtC,YAAY,CAAC,EAAE,MAAM,EACJ,kBAAkB,SAA+B;IAMpE;;;OAGG;IACH,aAAa,CAAC,SAAS,EAAE,SAAS,GAAG,YAAY;IAMjD,6FAA6F;IAC7F,OAAO,CAAC,UAAU;IAIlB,OAAO,CAAC,SAAS;IAIjB,OAAO,CAAC,kBAAkB;IAK1B,OAAO,CAAC,gBAAgB;IAMxB;;;;OAIG;IACH,OAAO,CAAC,sBAAsB;IAwB9B,4DAA4D;IAC5D,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAI5C,kFAAkF;YACpE,YAAY;IAqB1B,YAAY,IAAI,OAAO,EAAE;IAInB,MAAM,IAAI,OAAO,CAAC,aAAa,CAAC;IA8DtC;;;;OAIG;IACH,YAAY,IAAI,MAAM,GAAG,SAAS;IAiBlC,OAAO,CAAC,eAAe;IAmBvB,WAAW,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAIlD,UAAU,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC;IAIhD,UAAU,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAMnD,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,qBAAqB,EAAE,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAyChG,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,EAAE,CAAC,EAAE,UAAU,EAAE,IAAI,GAAE,QAAa,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAiF3G,mBAAmB,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,iBAAiB,CAAC;IA6D9E,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAIvE,SAAS,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAIrE,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,EAAE,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC;IAO1E,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC;IAOjG,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI1E,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAI1E,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,EAAE,KAAK,EAAE,SAAS,GAAG;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,WAAW,CAAC;IA8CxG,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,iBAAiB;IAWtE,OAAO,CACL,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,KAAK,EAAE,SAAS,GAAG;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,EACtC,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,iBAAiB,CAAC;IAgB7B,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAgB3G,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAyBpG,gBAAgB,CACd,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,KAAK,EAAE,SAAS,GAAG;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,EACtC,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,iBAAiB,CAAC;IAuBvB,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,EAAE,KAAK,EAAE,SAAS,GAAG;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,UAAU,CAAC;IAqBtG;;;OAGG;IACG,YAAY,CAChB,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,KAAK,EAAE,SAAS,GAAG;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,EACtC,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,iBAAiB,CAAC;YAMf,cAAc;IAiC5B,aAAa,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,iBAAiB,EAAE;IAgBtD,8DAA8D;IAC9D,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,IAAI,CAAA;KAAE;IAiB7F;;;;OAIG;YACW,iBAAiB;YA+BjB,gBAAgB;YAkChB,cAAc;IAwB5B,OAAO,CAAC,iBAAiB;IAWnB,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,UAAU,CAAC;IAyChF,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;IA2CvG,aAAa,CACX,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,EACpB,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC;QAAE,IAAI,EAAE,cAAc,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAIrD,OAAO,CAAC,iBAAiB;CAoB1B;AAED,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAwBtG"}

package/dist/service/emailService.js

@@ -1,10 +1,13 @@
-import { computeReplyRecipients, EmailError, formatAddressList, forwardSubject, isEmailError, isPortableFolderRole, normalizeEmailQuery, parseSingleAddress, supportsPortableEmailQuery, } from '@fluxmail/core';
+import { computeReplyRecipients, EmailError, formatAddressList, forwardSubject, isEmailError, isPortableFolderRole, normalizeEmailQuery, parseSingleAddress, replySubject, supportsPortableEmailQuery, } from '@fluxmail/core';
 import { randomBytes } from 'node:crypto';
 import { assertWithinQuota, checkLicenseState } from '../licensing/entitlements.js';
 import { listMembers } from '../storage/members.js';
 import { canAccessAccount, canAdminister, canSeeAccountMetadata } from '../authorization.js';
 import { cancelScheduledSend, countPending, createScheduledSend, findPendingByDraft, getScheduledSend, listScheduledSends, markSent, } from '../storage/scheduledSends.js';
 import { SearchCursorCodec } from './searchCursor.js';
+import { DeliveryCoordinator, isDefiniteDeliveryFailure } from './deliveryCoordinator.js';
+import { ClientInputError } from './publicErrors.js';
+import { DEFAULT_MAX_ATTACHMENT_BYTES } from '../config.js';
 import { listConfiguredSendAs, replaceConfiguredSendAs } from '../storage/sendAs.js';
 const SCHEDULE_GRACE_MS = 60_000;
 const SCHEDULE_MAX_HORIZON_MS = 365 * 24 * 3_600_000;
@@ -64,13 +67,13 @@ export function resolveSendAt(sendAtIso, now = Date.now()) {
     // Require an ISO 8601 shape: Date.parse alone is lenient enough to accept junk.
     const sendAt = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}/.test(sendAtIso) ? Date.parse(sendAtIso) : NaN;
     if (Number.isNaN(sendAt)) {
-        throw new EmailError('invalid_request', `Could not parse sendAt: "${sendAtIso}" (expected ISO 8601)`);
+        throw new ClientInputError('invalid_request', `Could not parse sendAt: "${sendAtIso}" (expected ISO 8601)`);
     }
     if (sendAt < now - SCHEDULE_GRACE_MS) {
-        throw new EmailError('invalid_request', 'sendAt is in the past; leave it out to send now');
+        throw new ClientInputError('invalid_request', 'sendAt is in the past; leave it out to send now');
     }
     if (sendAt > now + SCHEDULE_MAX_HORIZON_MS) {
-        throw new EmailError('invalid_request', 'sendAt is more than a year away');
+        throw new ClientInputError('invalid_request', 'sendAt is more than a year away');
     }
     return sendAt;
 }
@@ -98,14 +101,16 @@ export class EmailService {
     registry;
     db;
     principal;
+    maxAttachmentBytes;
     /** Wired to SendScheduler.wake() in long-lived processes; a no-op for one-shot CLI commands. */
     onScheduleChanged = () => { };
     cursorSecret;
     cursorCodec;
-    constructor(registry, db, principal, cursorSecret) {
+    constructor(registry, db, principal, cursorSecret, maxAttachmentBytes = DEFAULT_MAX_ATTACHMENT_BYTES) {
         this.registry = registry;
         this.db = db;
         this.principal = principal;
+        this.maxAttachmentBytes = maxAttachmentBytes;
         this.cursorSecret = cursorSecret ?? randomBytes(32);
         this.cursorCodec = new SearchCursorCodec(this.cursorSecret);
     }
@@ -114,7 +119,7 @@ export class EmailService {
      * allowlist. Internal background workers use the default service instead.
      */
     withPrincipal(principal) {
-        const scoped = new EmailService(this.registry, this.db, principal, this.cursorSecret);
+        const scoped = new EmailService(this.registry, this.db, principal, this.cursorSecret, this.maxAttachmentBytes);
         scoped.onScheduleChanged = () => this.onScheduleChanged();
         return scoped;
     }
@@ -151,10 +156,10 @@ export class EmailService {
             return this.registry.resolveAccountId();
         const accessible = this.accessibleAccounts();
         if (accessible.length === 0) {
-            throw new EmailError('invalid_request', 'No email accounts are available for this member.');
+            throw new ClientInputError('invalid_request', 'No email accounts are available for this member.');
         }
         if (accessible.length > 1) {
-            throw new EmailError('invalid_request', `Multiple accounts are available; specify accountId. Available: ${accessible
+            throw new ClientInputError('invalid_request', `Multiple accounts are available; specify accountId. Available: ${accessible
                 .map((a) => `${a.id} (${a.email})`)
                 .join(', ')}`);
         }
@@ -169,7 +174,7 @@ export class EmailService {
         const resolvedId = this.resolveScopedAccountId(accountId);
         const account = this.registry.getAccount(resolvedId);
         if (account.status === 'disabled') {
-            throw new EmailError('invalid_request', `Account ${resolvedId} is disabled`);
+            throw new ClientInputError('invalid_request', `Account ${resolvedId} is disabled`);
         }
         try {
             const result = await fn(this.registry.getProvider(resolvedId), resolvedId, account);
@@ -240,15 +245,17 @@ export class EmailService {
         };
     }
     /**
-     * Gate for MCP tool calls: throws once a lapsed license leaves the instance
-     * over the entitled caps; returns a renewal warning to attach to results
-     * while the license is in its grace period or has lapsed.
+     * Gate for MCP tool calls: throws once the instance is over the entitled
+     * caps, after a lapse or once a cap reduction's grace period ends; returns a
+     * warning to attach to results while a grace period runs or after a lapse.
      */
     enforceQuota() {
         if (!this.isInternal() && (!this.principal || !canAdminister(this.principal, 'admin.license'))) {
             const state = checkLicenseState(this.db);
-            if (state.overQuota) {
-                throw new EmailError('entitlement_exceeded', 'This Fluxmail instance is over its plan limits. Ask an administrator to renew the license or reduce usage.');
+            if (state.blocked) {
+                throw new EmailError('entitlement_exceeded', 'This Fluxmail instance is over its plan limits. Ask an administrator to ' +
+                    (state.entitlements.licensed ? 'upgrade the plan' : 'renew the license') +
+                    ' or reduce usage.');
             }
             // License dates and renewal state are instance administration details.
             return undefined;
@@ -296,14 +303,14 @@ export class EmailService {
         const normalized = identities.map((identity) => {
             const parsed = parseSingleAddress(identity.email.trim());
             if (!parsed)
-                throw new EmailError('invalid_request', `Could not parse sender address: "${identity.email}"`);
+                throw new ClientInputError('invalid_request', `Could not parse sender address: "${identity.email}"`);
             const email = parsed.email;
             const key = email.toLowerCase();
             if (key === account.email.toLowerCase()) {
-                throw new EmailError('invalid_request', 'Do not include the connected account address in configured aliases.');
+                throw new ClientInputError('invalid_request', 'Do not include the connected account address in configured aliases.');
             }
             if (seen.has(key))
-                throw new EmailError('invalid_request', `Duplicate sender address: "${email}"`);
+                throw new ClientInputError('invalid_request', `Duplicate sender address: "${email}"`);
             seen.add(key);
             const name = identity.name?.trim();
             return { email, ...(name ? { name } : {}) };
@@ -322,13 +329,13 @@ export class EmailService {
     async listMessages(accountId, q, page = {}) {
         const normalized = normalizeEmailQuery(q);
         if (!normalized.success) {
-            throw new EmailError('invalid_request', normalized.diagnostics.map((item) => item.message).join(' '), {
+            throw new ClientInputError('invalid_request', normalized.diagnostics.map((item) => item.message).join(' '), {
                 diagnostics: normalized.diagnostics,
             });
         }
         const query = normalized.query;
         if (page.includeSearchContext && !query.text) {
-            throw new EmailError('invalid_request', 'includeSearchContext requires a portable text query.');
+            throw new ClientInputError('invalid_request', 'includeSearchContext requires a portable text query.');
         }
         const pageSize = Math.min(Math.max(page.pageSize ?? 25, 1), 100);
         const ownsController = page.signal === undefined;
@@ -407,23 +414,23 @@ export class EmailService {
     }
     async searchMessagesBatch(input) {
         if (input.accounts.length < 1 || input.accounts.length > 20) {
-            throw new EmailError('invalid_request', 'Batch search requires between 1 and 20 accounts.');
+            throw new ClientInputError('invalid_request', 'Batch search requires between 1 and 20 accounts.');
         }
         const seen = new Set();
         for (const account of input.accounts) {
             if (seen.has(account.accountId))
-                throw new EmailError('invalid_request', 'Batch account IDs must be distinct.');
+                throw new ClientInputError('invalid_request', 'Batch account IDs must be distinct.');
             seen.add(account.accountId);
         }
         const normalized = normalizeEmailQuery(input.query);
         if (!normalized.success) {
-            throw new EmailError('invalid_request', normalized.diagnostics.map((item) => item.message).join(' '), {
+            throw new ClientInputError('invalid_request', normalized.diagnostics.map((item) => item.message).join(' '), {
                 diagnostics: normalized.diagnostics,
             });
         }
         const pageSize = Math.min(Math.max(input.pageSize ?? 25, 1), 100);
         if (input.includeSearchContext && !normalized.query.text) {
-            throw new EmailError('invalid_request', 'includeSearchContext requires a portable text query.');
+            throw new ClientInputError('invalid_request', 'includeSearchContext requires a portable text query.');
         }
         const controller = new AbortController();
         const startedAt = Date.now();
@@ -472,12 +479,14 @@ export class EmailService {
     getThread(accountId, threadId) {
         return this.withProvider(accountId, (p) => p.getThread(threadId));
     }
-    createDraft(accountId, d) {
+    async createDraft(accountId, d) {
+        this.assertMailContent(d);
         return this.withProvider(accountId, async (p, _id, account) => {
             return p.createDraft(await this.resolveRecipients(p, account, d));
         });
     }
-    updateDraft(accountId, draftId, d) {
+    async updateDraft(accountId, draftId, d) {
+        this.assertMailContent(d);
         return this.withProvider(accountId, async (p, _id, account) => {
             return p.updateDraft(draftId, await this.resolveRecipients(p, account, d));
         });
@@ -485,7 +494,125 @@ export class EmailService {
     deleteDraft(accountId, draftId) {
         return this.withProvider(accountId, (p) => p.deleteDraft(draftId));
     }
-    send(accountId, input) {
+    getDraft(accountId, draftId) {
+        return this.withProvider(accountId, (p) => p.getDraft(draftId));
+    }
+    previewSend(accountId, input) {
+        return this.withProvider(accountId, async (provider, resolvedId, account) => {
+            if ('draftId' in input) {
+                const draft = await provider.getDraft(input.draftId);
+                if (draft.from?.email && draft.from.email.toLowerCase() !== account.email.toLowerCase()) {
+                    await this.validateSender(provider, resolvedId, account, draft.from.email);
+                }
+                return {
+                    accountId: resolvedId,
+                    from: draft.from?.email ?? account.email,
+                    to: draft.to,
+                    cc: draft.cc ?? [],
+                    bcc: draft.bcc ?? [],
+                    subject: draft.subject,
+                    attachments: (draft.attachments ?? []).map(({ filename, mimeType, sizeBytes }) => ({
+                        filename,
+                        mimeType,
+                        sizeBytes,
+                    })),
+                    bodyTextChars: draft.body?.text?.length ?? 0,
+                    bodyHtmlChars: draft.body?.html?.length ?? 0,
+                };
+            }
+            this.assertMailContent(input);
+            const resolved = await this.resolveRecipients(provider, account, input);
+            const subject = resolved.subject ??
+                (input.replyToMessageId ? replySubject((await provider.getMessage(input.replyToMessageId)).subject) : '');
+            return {
+                accountId: resolvedId,
+                from: resolved.from ?? account.email,
+                to: resolved.to ?? [],
+                cc: resolved.cc ?? [],
+                bcc: resolved.bcc ?? [],
+                subject,
+                attachments: (resolved.attachments ?? []).map(({ filename, mimeType, content }) => ({
+                    filename,
+                    mimeType,
+                    sizeBytes: Buffer.byteLength(content, 'base64'),
+                })),
+                bodyTextChars: resolved.body.text?.length ?? 0,
+                bodyHtmlChars: resolved.body.html?.length ?? 0,
+            };
+        });
+    }
+    getDelivery(accountId, operationId) {
+        this.assertAccountAccess(accountId);
+        if (!this.principal)
+            throw new EmailError('permission_denied', 'A member session is required.');
+        return new DeliveryCoordinator(this.db).get(this.principal.principalId, this.principal.memberId, accountId, operationId);
+    }
+    deliver(accountId, input, key) {
+        const resolvedId = this.resolveScopedAccountId(accountId);
+        if (!this.principal)
+            throw new EmailError('permission_denied', 'A member session is required.');
+        return new DeliveryCoordinator(this.db).run({
+            principalId: this.principal.principalId,
+            memberId: this.principal.memberId,
+            accountId: resolvedId,
+            key,
+            kind: 'send',
+            request: input,
+        }, () => this.send(resolvedId, input));
+    }
+    deliverForward(accountId, input, key) {
+        const resolvedId = this.resolveScopedAccountId(accountId);
+        if (!this.principal)
+            throw new EmailError('permission_denied', 'A member session is required.');
+        return new DeliveryCoordinator(this.db).run({
+            principalId: this.principal.principalId,
+            memberId: this.principal.memberId,
+            accountId: resolvedId,
+            key,
+            kind: 'forward',
+            request: input,
+        }, () => this.forward(resolvedId, input));
+    }
+    deliverScheduled(accountId, draftId, scheduleId) {
+        return new DeliveryCoordinator(this.db).fireScheduled(accountId, draftId, scheduleId, () => this.withProvider(accountId, async (provider, resolvedId, account) => {
+            const draft = await provider.getDraft(draftId);
+            if (draft.from?.email && draft.from.email.toLowerCase() !== account.email.toLowerCase()) {
+                await this.validateSender(provider, resolvedId, account, draft.from.email);
+            }
+        }), () => this.withProvider(accountId, async (provider, resolvedId) => {
+            const result = await provider.send({ draftId });
+            const pending = findPendingByDraft(this.db, resolvedId, draftId);
+            if (pending) {
+                markSent(this.db, pending.id, result);
+                this.onScheduleChanged();
+            }
+            return result;
+        }));
+    }
+    scheduleDelivery(accountId, input, sendAt, key) {
+        const resolvedId = this.resolveScopedAccountId(accountId);
+        if (!this.principal)
+            throw new EmailError('permission_denied', 'A member session is required.');
+        let createdSchedule = false;
+        const scheduled = new DeliveryCoordinator(this.db).schedule({
+            principalId: this.principal.principalId,
+            memberId: this.principal.memberId,
+            accountId: resolvedId,
+            key,
+            request: { input, sendAt },
+        }, async () => {
+            const result = await this.createSchedule(resolvedId, input, sendAt);
+            createdSchedule = true;
+            return result;
+        });
+        return scheduled.finally(() => {
+            if (createdSchedule)
+                this.onScheduleChanged();
+        });
+    }
+    async send(accountId, input) {
+        if (!('draftId' in input))
+            this.assertMailContent(input);
         return this.withProvider(accountId, async (p, resolvedId, account) => {
             if ('draftId' in input) {
                 const draft = await p.getDraft(input.draftId);
@@ -509,6 +636,13 @@ export class EmailService {
      * immediately; only the schedule (draft id + fire time) is stored locally.
      */
     async scheduleSend(accountId, input, sendAtIso) {
+        const scheduled = await this.createSchedule(accountId, input, sendAtIso);
+        this.onScheduleChanged();
+        return scheduled;
+    }
+    async createSchedule(accountId, input, sendAtIso) {
+        if (!('draftId' in input))
+            this.assertMailContent(input);
         const sendAt = resolveSendAt(sendAtIso);
         const { draft, resolvedId } = await this.withProvider(accountId, async (p, id, account) => {
             let message;
@@ -518,7 +652,7 @@ export class EmailService {
             else {
                 const resolved = await this.resolveRecipients(p, account, input);
                 if (!resolved.to?.length && !resolved.cc?.length && !resolved.bcc?.length) {
-                    throw new EmailError('invalid_request', 'Cannot schedule a message with no recipients');
+                    throw new ClientInputError('invalid_request', 'Cannot schedule a message with no recipients');
                 }
                 message = await p.createDraft(resolved);
             }
@@ -534,19 +668,23 @@ export class EmailService {
             ...(draft.subject !== undefined ? { subject: draft.subject } : {}),
             ...(draft.to?.length ? { toRecipients: formatAddressList(draft.to) } : {}),
         });
-        this.onScheduleChanged();
         return toScheduledInfo(row);
     }
     listScheduled(accountId) {
+        const coordinator = new DeliveryCoordinator(this.db);
+        const withOperation = (row) => {
+            const operationId = coordinator.findScheduled(row.accountId, row.id)?.operationId;
+            return { ...toScheduledInfo(row), ...(operationId ? { operationId } : {}) };
+        };
         if (accountId !== undefined) {
-            return listScheduledSends(this.db, this.resolveScopedAccountId(accountId)).map(toScheduledInfo);
+            return listScheduledSends(this.db, this.resolveScopedAccountId(accountId)).map(withOperation);
         }
         // Listing must work across accounts, but a member key only sees its own mailboxes'.
         const rows = listScheduledSends(this.db);
         if (this.isInternal())
-            return rows.map(toScheduledInfo);
+            return rows.map(withOperation);
         const accessible = new Set(this.accessibleAccounts().map((a) => a.id));
-        return rows.filter((r) => accessible.has(r.accountId)).map(toScheduledInfo);
+        return rows.filter((r) => accessible.has(r.accountId)).map(withOperation);
     }
     /** Cancels a pending schedule; the provider draft is kept. */
     cancelScheduled(scheduleId) {
@@ -556,11 +694,12 @@ export class EmailService {
             throw new EmailError('not_found', `No scheduled send with id ${scheduleId}`);
         }
         if (row.status !== 'pending') {
-            throw new EmailError('invalid_request', `Scheduled send ${scheduleId} is already ${row.status}`);
+            throw new ClientInputError('invalid_request', `Scheduled send ${scheduleId} is already ${row.status}`);
         }
         if (!cancelScheduledSend(this.db, scheduleId)) {
-            throw new EmailError('invalid_request', `Scheduled send ${scheduleId} has already started sending`);
+            throw new ClientInputError('invalid_request', `Scheduled send ${scheduleId} has already started sending`);
         }
+        new DeliveryCoordinator(this.db).cancelScheduled(row.accountId, scheduleId);
         this.onScheduleChanged();
         return { scheduleId, draftId: row.draftId, draftKept: true };
     }
@@ -624,7 +763,7 @@ export class EmailService {
     async validateSender(provider, accountId, account, sender, known) {
         const parsed = parseSingleAddress(sender.trim());
         if (!parsed)
-            throw new EmailError('invalid_request', `Could not parse sender address: "${sender}"`);
+            throw new ClientInputError('invalid_request', `Could not parse sender address: "${sender}"`);
         if (parsed.email.toLowerCase() === account.email.toLowerCase()) {
             return {
                 email: account.email,
@@ -635,7 +774,7 @@ export class EmailService {
         }
         const identity = (known ?? (await this.sendAsIdentities(provider, accountId, account))).find((candidate) => candidate.email.toLowerCase() === parsed.email.toLowerCase());
         if (!identity)
-            throw new EmailError('invalid_request', `Sender address "${parsed.email}" is not available.`);
+            throw new ClientInputError('invalid_request', `Sender address "${parsed.email}" is not available.`);
         return identity;
     }
     selectReplySender(original, identities) {
@@ -650,13 +789,22 @@ export class EmailService {
         }
         return identities.find((identity) => identity.isPrimary) ?? identities[0];
     }
-    forward(accountId, input) {
+    async forward(accountId, input) {
+        if (Buffer.byteLength(input.comment ?? '', 'utf8') > 1024 * 1024) {
+            throw new ClientInputError('invalid_request', 'Forward comment exceeds the 1 MiB body limit.');
+        }
         return this.withProvider(accountId, async (p, resolvedId, account) => {
             const original = await p.getMessage(input.messageId);
             const includeAttachments = input.includeAttachments ?? true;
             const attachments = [];
             if (includeAttachments) {
-                for (const meta of original.attachments ?? []) {
+                const metadata = original.attachments ?? [];
+                if (metadata.length > 20)
+                    throw new ClientInputError('invalid_request', 'A message may have at most 20 attachments.');
+                if (metadata.reduce((total, item) => total + item.sizeBytes, 0) > this.maxAttachmentBytes) {
+                    throw new ClientInputError('invalid_request', 'Combined attachments exceed the configured size limit.');
+                }
+                for (const meta of metadata) {
                     const { content } = await p.getAttachment(original.id, meta.id);
                     attachments.push({
                         filename: meta.filename,
@@ -675,15 +823,73 @@ export class EmailService {
                 body: buildForwardBody(original, input.comment),
                 ...(attachments.length ? { attachments } : {}),
             };
+            this.assertMailContent(draft);
             return p.send(draft);
         });
     }
-    modify(accountId, ids, action) {
-        return this.withProvider(accountId, (p) => p.modify(ids, action));
+    async modify(accountId, ids, action) {
+        const unique = [...new Set(ids)];
+        if (unique.length < 1 || unique.length > 100) {
+            throw new ClientInputError('invalid_request', 'Modify between 1 and 100 distinct messages.');
+        }
+        const resolvedId = this.resolveScopedAccountId(accountId);
+        const result = await this.withProvider(resolvedId, async (provider) => {
+            const outcomes = Array.from({ length: unique.length }, () => 'uncertain');
+            let next = 0;
+            const worker = async () => {
+                for (;;) {
+                    const index = next++;
+                    if (index >= unique.length)
+                        return;
+                    try {
+                        await provider.modify([unique[index]], action);
+                        outcomes[index] = 'succeeded';
+                    }
+                    catch (error) {
+                        outcomes[index] = isDefiniteDeliveryFailure(error)
+                            ? { code: isEmailError(error) ? error.code : 'internal' }
+                            : 'uncertain';
+                    }
+                }
+            };
+            await Promise.all(Array.from({ length: Math.min(4, unique.length) }, () => worker()));
+            return {
+                action,
+                succeededIds: unique.filter((_, index) => outcomes[index] === 'succeeded'),
+                failed: unique.flatMap((messageId, index) => {
+                    const outcome = outcomes[index];
+                    return typeof outcome === 'object' ? [{ messageId, code: outcome.code }] : [];
+                }),
+                uncertainIds: unique.filter((_, index) => outcomes[index] === 'uncertain'),
+            };
+        });
+        if (result.failed.some(({ code }) => code === 'auth_expired')) {
+            this.registry.markStatus(resolvedId, 'auth_error');
+        }
+        return result;
     }
     getAttachment(accountId, messageId, attachmentId, maxBytes) {
         return this.withProvider(accountId, (p) => p.getAttachment(messageId, attachmentId, { maxBytes }));
     }
+    assertMailContent(input) {
+        const bodyBytes = Buffer.byteLength(input.body.text ?? '', 'utf8') + Buffer.byteLength(input.body.html ?? '', 'utf8');
+        if (bodyBytes > 1024 * 1024) {
+            throw new ClientInputError('invalid_request', 'Text and HTML bodies together must be at most 1 MiB.');
+        }
+        const attachments = input.attachments ?? [];
+        if (attachments.length > 20)
+            throw new ClientInputError('invalid_request', 'A message may have at most 20 attachments.');
+        let total = 0;
+        for (const attachment of attachments) {
+            if (!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(attachment.content)) {
+                throw new ClientInputError('invalid_request', 'Attachment content must be base64.');
+            }
+            total += Buffer.byteLength(attachment.content, 'base64');
+            if (total > this.maxAttachmentBytes) {
+                throw new ClientInputError('invalid_request', 'Combined attachments exceed the configured size limit.');
+            }
+        }
+    }
 }
 export function buildForwardBody(original, comment) {
     const headerLines = [