ghost 6.68.0 → 6.69.0

package/core/server/services/app-installations/actions.js

@@ -0,0 +1,44 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.actingContext = actingContext;
+exports.recordAppInstallationAction = recordAppInstallationAction;
+const logging_1 = __importDefault(require("@tryghost/logging"));
+/**
+ * Who is acting, read off an API frame's context.
+ *
+ * Only a staff user counts, whether signed in or using their own staff token.
+ * Integrations hold no permission to manage apps, so they never get this far.
+ */
+function actingContext(context) {
+    const frame = (context ?? {});
+    if (frame.user && !frame.integration) {
+        return { actor: { id: frame.user, type: 'user' } };
+    }
+    return { actor: null };
+}
+/**
+ * Staff history is where "who installed this, and when" lives; the installation itself
+ * does not hold it. The write is best-effort: a failed action must never fail the install
+ * or uninstall that triggered it.
+ */
+async function recordAppInstallationAction({ Action, context, event, subject, details, }) {
+    if (!context.actor) {
+        return;
+    }
+    try {
+        await Action.add({
+            event,
+            resource_type: 'app_installation',
+            resource_id: subject,
+            actor_type: context.actor.type,
+            actor_id: context.actor.id,
+            context: details,
+        }, { autoRefresh: false });
+    }
+    catch (err) {
+        logging_1.default.error(err);
+    }
+}

package/core/server/services/app-installations/codec.js

@@ -0,0 +1,20 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AppInstallationRow = void 0;
+const zod_1 = require("zod");
+const schema_1 = require("./schema");
+/**
+ * An installation joined with the approved manifest it runs, as the read query returns it
+ * and as the Admin API returns it. The columns keep their names; decoding is what turns
+ * the dates, the status and the manifest text into what the rest of Ghost works with.
+ */
+exports.AppInstallationRow = zod_1.z.object({
+    ...schema_1.DbAppInstallation.pick({
+        id: true,
+        app_id: true,
+        status: true,
+        created_at: true,
+        updated_at: true,
+    }).shape,
+    ...schema_1.DbAppInstallationManifest.pick({ manifest_url: true, manifest: true }).shape,
+});

package/core/server/services/app-installations/index.js

@@ -0,0 +1,42 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.service = exports.actingContext = void 0;
+exports.init = init;
+exports.isAvailable = isAvailable;
+const config_1 = __importDefault(require("../../../shared/config"));
+const url_utils_1 = __importDefault(require("../../../shared/url-utils"));
+const in_development_1 = require("../../data/schema/in-development");
+const actions_1 = require("./actions");
+const service_1 = require("./service");
+var actions_2 = require("./actions");
+Object.defineProperty(exports, "actingContext", { enumerable: true, get: function () { return actions_2.actingContext; } });
+function init() {
+    if (exports.service) {
+        return;
+    }
+    const { knex } = require('../../data/db');
+    const models = require('../../models');
+    const recordAction = (input) => (0, actions_1.recordAppInstallationAction)({ Action: models.Action, ...input });
+    exports.service = new service_1.AppInstallationsService({
+        knex,
+        recordAction,
+        // Read per install, not once at boot: both are config, which tests change.
+        getManifestRules: () => ({
+            ghostUrls: [url_utils_1.default.urlFor('home', true), url_utils_1.default.urlFor('admin', true)],
+            allowLocalhost: config_1.default.get('env') === 'development',
+        }),
+    });
+}
+/**
+ * Whether this database has the installations table.
+ *
+ * While the table is still in development it only exists in development and testing
+ * databases. Once it is finalised and has a migration it exists everywhere, and this is
+ * always true.
+ */
+function isAvailable() {
+    return !(0, in_development_1.isInDevelopmentTable)('app_installations') || (0, in_development_1.shouldCreateInDevelopmentTables)();
+}

package/core/server/services/app-installations/schema.js

@@ -0,0 +1,52 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DbAppInstallationManifest = exports.StoredManifest = exports.DbAppInstallation = exports.AppInstallationStatus = void 0;
+const zod_1 = require("zod");
+const manifest_1 = require("@tryghost/app-contracts/manifest");
+const boolean_1 = require("../../lib/db-types/boolean");
+const date_1 = require("../../lib/db-types/date");
+// Mirrors schema.js's `isIn` on the column, which is static config and cannot import this.
+exports.AppInstallationStatus = zod_1.z.enum(['active', 'suspended', 'uninstalled']);
+/** An installation as the table holds it. */
+exports.DbAppInstallation = zod_1.z.object({
+    id: zod_1.z.string(),
+    app_id: zod_1.z.string(),
+    current_app_id: zod_1.z.string().nullable(),
+    status: exports.AppInstallationStatus,
+    manifest_id: zod_1.z.string(),
+    pending_manifest_id: zod_1.z.string().nullable(),
+    revision: zod_1.z.number().int().nonnegative(),
+    created_at: date_1.DbDate,
+    updated_at: date_1.DbDate.nullable(),
+});
+/**
+ * The manifest as the table holds it, JSON text, against the manifest itself. A codec
+ * rather than a parse on the way out, so the write stores what the read accepts: the
+ * digest is taken from this encoding, and the read decodes exactly it.
+ */
+exports.StoredManifest = zod_1.z.codec(zod_1.z.string(), manifest_1.AppManifestSchema, {
+    decode: (text, ctx) => {
+        try {
+            return JSON.parse(text);
+        }
+        catch {
+            ctx.issues.push({
+                code: 'custom',
+                message: 'The stored manifest is not JSON.',
+                input: text,
+            });
+            return zod_1.z.NEVER;
+        }
+    },
+    encode: (manifest) => JSON.stringify(manifest),
+});
+/** A manifest an installation has run or been asked to approve, as the table holds it. */
+exports.DbAppInstallationManifest = zod_1.z.object({
+    id: zod_1.z.string(),
+    installation_id: zod_1.z.string(),
+    manifest_url: zod_1.z.string(),
+    manifest: exports.StoredManifest,
+    digest: zod_1.z.string(),
+    requires_approval: boolean_1.DbBoolean,
+    created_at: date_1.DbDate,
+});

package/core/server/services/app-installations/service.js

@@ -0,0 +1,160 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AppInstallationsService = void 0;
+const node_crypto_1 = require("node:crypto");
+const errors_1 = __importDefault(require("@tryghost/errors"));
+const bson_objectid_1 = __importDefault(require("bson-objectid"));
+const zod_1 = require("zod");
+const manifest_1 = require("@tryghost/app-contracts/manifest");
+const date_1 = require("../../lib/db-types/date");
+const codec_1 = require("./codec");
+const schema_1 = require("./schema");
+const INSTALLATIONS = 'app_installations';
+const MANIFESTS = 'app_installation_manifests';
+/**
+ * What a publisher reviews and confirms. The same manifest always serialises the same way,
+ * as encoding builds it in the schema's key order.
+ */
+function digestOf(serialisedManifest) {
+    return (0, node_crypto_1.createHash)('sha256').update(serialisedManifest).digest('hex');
+}
+function isUniqueViolation(err) {
+    const code = err?.code;
+    return (code === 'ER_DUP_ENTRY' || (typeof code === 'string' && code.startsWith('SQLITE_CONSTRAINT')));
+}
+class AppInstallationsService {
+    knex;
+    recordAction;
+    getManifestRules;
+    constructor({ knex, recordAction, getManifestRules, }) {
+        this.knex = knex;
+        this.recordAction = recordAction;
+        this.getManifestRules = getManifestRules;
+    }
+    /** Installations with the approved manifest each one runs. */
+    withApprovedManifest() {
+        return this.knex(`${INSTALLATIONS} as installation`)
+            .join(`${MANIFESTS} as approved`, 'approved.id', 'installation.manifest_id')
+            .select('installation.id', 'installation.app_id', 'installation.status', 'approved.manifest_url', 'approved.manifest', 'installation.created_at', 'installation.updated_at');
+    }
+    /** The apps installed on this site now, suspended ones included. Ended ones are not listed. */
+    async browse() {
+        const rows = await this.withApprovedManifest()
+            .whereNot('installation.status', 'uninstalled')
+            .orderBy('installation.created_at', 'asc')
+            .orderBy('installation.id', 'asc');
+        return rows.map((row) => zod_1.z.decode(codec_1.AppInstallationRow, row));
+    }
+    /** One installation by ID, whether it has ended or not. */
+    async read(id) {
+        const [row] = await this.withApprovedManifest().where('installation.id', id);
+        if (!row) {
+            throw new errors_1.default.NotFoundError({ message: 'App installation not found.' });
+        }
+        return zod_1.z.decode(codec_1.AppInstallationRow, row);
+    }
+    /**
+     * Installs an app from a manifest Ghost itself fetched from `manifestUrl`.
+     *
+     * Every install is a new installation with a new ID, including a reinstall: an ended
+     * installation is never brought back. The unique `current_app_id` is what refuses a
+     * second installation of the same app, so two confirmations racing each other end with
+     * exactly one installed and the other told so.
+     */
+    async install(context, { manifestUrl, manifest }) {
+        const parsed = (0, manifest_1.parseManifest)(manifest, { manifestUrl, ...this.getManifestRules() });
+        if (!parsed.success) {
+            throw new errors_1.default.ValidationError({
+                message: 'The app manifest is not valid.',
+                context: parsed.errors
+                    .map(({ path, message }) => (path ? `${path}: ${message}` : message))
+                    .join('; '),
+            });
+        }
+        const id = new bson_objectid_1.default().toHexString();
+        const manifestId = new bson_objectid_1.default().toHexString();
+        const serialisedManifest = zod_1.z.encode(schema_1.StoredManifest, parsed.manifest);
+        const now = (0, date_1.toDatabaseDate)(new Date());
+        // What the read query would return for this row, so the result is decoded from what
+        // was written rather than read back: the same codec reads every row, which proves the
+        // write readable without a second query.
+        const written = {
+            id,
+            app_id: parsed.manifest.id,
+            status: 'active',
+            manifest_url: parsed.manifestUrl,
+            manifest: serialisedManifest,
+            created_at: now,
+            updated_at: now,
+        };
+        try {
+            await this.knex.transaction(async (trx) => {
+                await trx(INSTALLATIONS).insert({
+                    id,
+                    app_id: written.app_id,
+                    current_app_id: written.app_id,
+                    status: written.status,
+                    manifest_id: manifestId,
+                    created_at: now,
+                    updated_at: now,
+                });
+                await trx(MANIFESTS).insert({
+                    id: manifestId,
+                    installation_id: id,
+                    // As checked, not as given: the contract keeps it within the column's width.
+                    manifest_url: written.manifest_url,
+                    manifest: serialisedManifest,
+                    digest: digestOf(serialisedManifest),
+                    requires_approval: false,
+                    created_at: now,
+                });
+            });
+        }
+        catch (err) {
+            if (isUniqueViolation(err)) {
+                throw new errors_1.default.ConflictError({
+                    message: `The app ${parsed.manifest.id} is already installed.`,
+                });
+            }
+            throw err;
+        }
+        await this.recordAction({
+            context,
+            event: 'installed',
+            subject: id,
+            details: { primary_name: parsed.manifest.name, app_id: parsed.manifest.id },
+        });
+        return zod_1.z.decode(codec_1.AppInstallationRow, written);
+    }
+    /**
+     * Ends an installation. The row stays, so the site keeps a record of what was installed.
+     *
+     * Uninstalling one that has already ended does nothing and records nothing, so a
+     * repeated request cannot add a second uninstall to the history.
+     */
+    async uninstall(context, id) {
+        const installation = await this.read(id);
+        const ended = await this.knex(INSTALLATIONS)
+            .where({ id })
+            .whereNot('status', 'uninstalled')
+            .update({
+            current_app_id: null,
+            status: 'uninstalled',
+            revision: this.knex.raw('?? + 1', ['revision']),
+            updated_at: (0, date_1.toDatabaseDate)(new Date()),
+        });
+        if (ended === 0) {
+            return;
+        }
+        await this.recordAction({
+            context,
+            event: 'uninstalled',
+            subject: id,
+            details: { primary_name: installation.manifest.name, app_id: installation.app_id },
+        });
+    }
+}
+exports.AppInstallationsService = AppInstallationsService;

package/core/server/services/automations/README.md

@@ -191,9 +191,9 @@ follow the same cursor ordering as other candidates.
 
 ## Availability
 
-The performance endpoint requires `automationsTinybirdSync`. A disabled flag,
-missing configuration/token, unavailable pipe, or invalid response produces an
-error. The automation list retains its MySQL fallback for those cases; a successful
+The performance endpoint requires Tinybird configuration. Missing
+configuration/token, unavailable pipe, or invalid response produces an error.
+The automation list retains its MySQL fallback for those cases; a successful
 empty Tinybird response still returns zero counts rather than falling back.
 
 The `automationRunAnalytics` flag controls presentation. See the

package/core/server/services/automations/automations-api.js

@@ -136,7 +136,7 @@ const repository = (0, database_automations_repository_1.createDatabaseAutomatio
     fakeWaitHoursMultiplier: (0, fake_wait_hours_multiplier_1.parseFakeWaitHoursMultiplier)(config.get('automations:fakeWaitHoursMultiplier')),
 });
 function getTinybirdClient() {
-    if (!labs.isSet('automationsTinybirdSync') || !config.get('tinybird:stats')) {
+    if (!config.get('tinybird:stats')) {
         return null;
     }
     try {

package/core/server/services/comments/comments-service-emails.js

@@ -191,12 +191,14 @@ class CommentsServiceEmails {
    * @param {*} reporter The member object who reported this comment
    */
   async notifyReport(comment, reporter) {
-    const post = await this.models.Post.findOne(
-      { id: comment.get('post_id') },
-      { withRelated: ['tags', 'authors'] },
-    );
-    const member = await this.models.Member.findOne({ id: comment.get('member_id') });
-    const owner = await this.models.User.getOwnerUser();
+    const [post, member, owner] = await Promise.all([
+      this.models.Post.findOne(
+        { id: comment.get('post_id') },
+        { withRelated: ['tags', 'authors'] },
+      ),
+      this.models.Member.findOne({ id: comment.get('member_id') }),
+      this.models.User.getOwnerUser(),
+    ]);
 
     // For now we only send the report to the owner
     const to = owner.get('email');

package/core/server/services/email-service/README.md

@@ -345,6 +345,22 @@ attempts, so a retried email reports submitting with frozen progress while it
 waits for its job, and `failed_during` is the same derivation applied to a
 failed email.
 
+Failed status includes `retryable`, derived from the current email and batch
+state. A failed email is retryable unless any batch is still `submitting`: the
+provider may have accepted that batch even though Ghost did not record the
+outcome. `EmailService.retryEmail` re-reads the same eligibility before queuing a
+retry, for both the retry endpoint and post saves. Admin requires an explicit
+`retryable: true`; older Core responses without the field hide Retry without
+requiring access to the batch-browsing endpoint.
+
+Orphaned `submitting` batches have no automatic recovery path: an operator must
+inspect the batch's Mailgun message ID, provider delivery records, and Ghost's
+submission logs to reconcile its outcome before a retry can be considered safe.
+
+Eligibility never blocks a post save. Republishing a post whose failed email is
+not retryable saves the post and leaves the email failed, without queuing a
+retry; the retry endpoint rejects the same email with a 400.
+
 The rough ETA measures recent recipient throughput, including work completed by
 concurrent workers. It stays `null` until enough timing samples are available in
 the current phase and attempt, so short sends may finish without showing an ETA.

package/core/server/services/email-service/email-service-wrapper.js

@@ -151,6 +151,7 @@ class EmailServiceWrapper {
     this.renderer = emailRenderer;
 
     this.service = new EmailService({
+      sendingStatusService,
       batchSendingService,
       sendingService,
       models: {

package/core/server/services/email-service/email-service.js

@@ -11,6 +11,7 @@
  * @property {object} newsletter
  * @property {string} emailRecipientFilter
  * @property {number} emailCount
+ * @property {number} [csdEmailCount] - How many to send from the warming domain, when domain warming is enabled
  */
 
 const BatchSendingService = require('./batch-sending-service');
@@ -27,6 +28,8 @@ const messages = {
   emailSendingDisabled: `Email sending is temporarily disabled because your account is currently in review. You should have an email about this from us already, but you can also reach us any time at support@ghost.org`,
   retryEmailStatusError: 'Can only retry emails for published posts',
   retryEmailNotFailed: 'Only failed emails can be retried',
+  retryEmailUnknownOutcome: 'Cannot retry email because the delivery outcome is unknown',
+  postChangedWhilePublishing: 'The post was changed while it was being published, please try again',
 };
 
 // Resume scanner won't pick up `pending` or `submitting` rows older than this. Rows beyond
@@ -38,9 +41,13 @@ const DEFAULT_RESUME_MAX_AGE_MS = 24 * 60 * 60 * 1000;
 // Non-terminal email statuses, both of which the boot scanner recovers.
 const RESUMABLE_EMAIL_STATUSES = ['pending', 'submitting'];
 
+const RETRY_UNKNOWN_OUTCOME_CODE = 'EMAIL_RETRY_UNKNOWN_OUTCOME';
+const RETRY_NOT_FAILED_CODE = 'BULK_EMAIL_RETRY_NOT_FAILED';
+
 class EmailService {
   #batchSendingService;
   #sendingService;
+  #sendingStatusService;
   #models;
   #settingsCache;
   #emailRenderer;
@@ -57,6 +64,7 @@ class EmailService {
    * @param {object} dependencies
    * @param {BatchSendingService} dependencies.batchSendingService
    * @param {SendingService} dependencies.sendingService
+   * @param {import('./sending-status-service').SendingStatusService} dependencies.sendingStatusService
    * @param {object} dependencies.models
    * @param {object} dependencies.models.Email
    * @param {object} [dependencies.models.EmailBatch] - Required for resumeInterruptedSends breadcrumbs
@@ -73,6 +81,7 @@ class EmailService {
   constructor({
     batchSendingService,
     sendingService,
+    sendingStatusService,
     models,
     settingsCache,
     emailRenderer,
@@ -92,6 +101,7 @@ class EmailService {
     this.#limitService = limitService;
     this.#membersRepository = membersRepository;
     this.#sendingService = sendingService;
+    this.#sendingStatusService = sendingStatusService;
     this.#verificationTrigger = verificationTrigger;
     this.#emailAnalyticsJobs = emailAnalyticsJobs;
     this.#domainWarmingService = domainWarmingService;
@@ -132,11 +142,9 @@ class EmailService {
    *
    * @param {object} newsletter - The newsletter model to send to
    * @param {string} emailRecipientFilter - The recipient filter for the email
-   * @param {object} [options]
-   * @param {number} [options.emailCount] - A previously counted audience to revalidate without recounting
-   * @returns {Promise<{emailCount: number}>} The email count if checks pass, throws if email cannot be sent
+   * @returns {Promise<{emailCount: number, csdEmailCount?: number}>} The recipient counts if checks pass, throws if email cannot be sent
    */
-  async checkCanSendEmail(newsletter, emailRecipientFilter, { emailCount: knownEmailCount } = {}) {
+  async checkCanSendEmail(newsletter, emailRecipientFilter) {
     if (!newsletter) {
       throw new errors.EmailError({
         message: tpl(messages.missingNewsletterError),
@@ -151,59 +159,73 @@ class EmailService {
       });
     }
 
-    const emailCount =
-      knownEmailCount === undefined
-        ? await this.#emailSegmenter.getMembersCount(newsletter, emailRecipientFilter)
-        : knownEmailCount;
+    const emailCount = await this.#emailSegmenter.getMembersCount(newsletter, emailRecipientFilter);
     await this.checkLimits(emailCount);
 
-    return { emailCount };
+    const csdEmailCount = this.#domainWarmingService.isEnabled()
+      ? await this.#domainWarmingService.getWarmupLimit(emailCount)
+      : undefined; // Undefined here means domain warming was not used -- distinct from 0
+
+    return { emailCount, csdEmailCount };
   }
 
   /**
+   * Creates the pending email for a post being published, from the checks `checkCanSendEmail`
+   * ran before the save. Schedule it with `scheduleEmail` once the post and email have committed.
+   *
+   * It runs no other queries, because the transaction saving the post holds a connection, and
+   * on SQLite the only one.
    *
    * @param {Post} post
-   * @param {object} [options]
-   * @param {EmailPreflight} [options.preflight] - The emailCount is reused if the newsletter and filter still match the saved post
+   * @param {object} options
+   * @param {EmailPreflight|null} options.preflight
+   * @param {object} [options.transacting]
    * @returns {Promise<Email>}
    */
-  async createEmail(post, { preflight } = {}) {
-    const newsletter = await post.getLazyRelation('newsletter');
-    const emailRecipientFilter = post.get('email_recipient_filter');
-
-    const preflightMatches =
-      preflight?.newsletter?.id &&
-      preflight.newsletter.id === newsletter?.id &&
-      preflight.emailRecipientFilter === emailRecipientFilter;
-    const { emailCount } = preflightMatches
-      ? await this.checkCanSendEmail(newsletter, emailRecipientFilter, {
-          emailCount: preflight.emailCount,
-        })
-      : await this.checkCanSendEmail(newsletter, emailRecipientFilter);
-
-    const csdEmailCount = this.#domainWarmingService.isEnabled()
-      ? await this.#domainWarmingService.getWarmupLimit(emailCount)
-      : undefined; // Undefined here means domain warming was not used -- distinct from 0
+  async createEmail(post, { preflight, transacting }) {
+    const { newsletter, emailRecipientFilter, emailCount, csdEmailCount } = preflight ?? {};
+
+    // Only a concurrent edit can save a newsletter or audience other than the one checked
+    if (
+      !newsletter ||
+      post.get('newsletter_id') !== newsletter.id ||
+      post.get('email_recipient_filter') !== emailRecipientFilter
+    ) {
+      throw new errors.UpdateCollisionError({
+        message: tpl(messages.postChangedWhilePublishing),
+      });
+    }
 
-    const email = await this.#models.Email.add({
-      post_id: post.id,
-      newsletter_id: newsletter.id,
-      status: 'pending',
-      submitted_at: new Date(),
-      track_opens: !!this.#settingsCache.get('email_track_opens'),
-      track_clicks: !!this.#settingsCache.get('email_track_clicks'),
-      feedback_enabled: !!newsletter.get('feedback_enabled'),
-      recipient_filter: emailRecipientFilter,
-      subject: this.#emailRenderer.getSubject(post),
-      from: this.#emailRenderer.getFromAddress(post, newsletter),
-      replyTo: this.#emailRenderer.getReplyToAddress(post, newsletter),
-      email_count: emailCount,
-      preflight_email_count: emailCount,
-      csd_email_count: csdEmailCount,
-      source: post.get('lexical') || post.get('mobiledoc'),
-      source_type: post.get('lexical') ? 'lexical' : 'mobiledoc',
-    });
+    return this.#models.Email.add(
+      {
+        post_id: post.id,
+        newsletter_id: newsletter.id,
+        status: 'pending',
+        submitted_at: new Date(),
+        track_opens: !!this.#settingsCache.get('email_track_opens'),
+        track_clicks: !!this.#settingsCache.get('email_track_clicks'),
+        feedback_enabled: !!newsletter.get('feedback_enabled'),
+        recipient_filter: emailRecipientFilter,
+        subject: this.#emailRenderer.getSubject(post),
+        from: this.#emailRenderer.getFromAddress(post, newsletter),
+        replyTo: this.#emailRenderer.getReplyToAddress(post, newsletter),
+        email_count: emailCount,
+        preflight_email_count: emailCount,
+        csd_email_count: csdEmailCount,
+        source: post.get('lexical') || post.get('mobiledoc'),
+        source_type: post.get('lexical') ? 'lexical' : 'mobiledoc',
+      },
+      { transacting },
+    );
+  }
 
+  /**
+   * Starts sending a committed pending email. A scheduling failure is saved on the email.
+   *
+   * @param {Email} email
+   * @returns {Promise<Email>}
+   */
+  async scheduleEmail(email) {
     try {
       await this.#batchSendingService.scheduleEmail(email);
     } catch (e) {
@@ -381,12 +403,7 @@ class EmailService {
       });
     }
 
-    if (email.get('status') !== 'failed') {
-      throw new errors.BadRequestError({
-        message: tpl(messages.retryEmailNotFailed),
-        code: 'BULK_EMAIL_RETRY_NOT_FAILED',
-      });
-    }
+    await this.checkCanRetryEmail(email.id);
 
     await this.checkLimits();
 
@@ -404,7 +421,7 @@ class EmailService {
     if (!pendingEmail) {
       throw new errors.BadRequestError({
         message: tpl(messages.retryEmailNotFailed),
-        code: 'BULK_EMAIL_RETRY_NOT_FAILED',
+        code: RETRY_NOT_FAILED_CODE,
       });
     }
 
@@ -417,6 +434,28 @@ class EmailService {
     return pendingEmail;
   }
 
+  /**
+   * Validates retry eligibility before a retry is queued.
+   * @param {string} emailId
+   * @returns {Promise<void>}
+   */
+  async checkCanRetryEmail(emailId) {
+    // Re-read persisted state: the caller's email or eligibility can be stale.
+    const eligibility = await this.#sendingStatusService.retryEligibilityFor(emailId);
+    if (eligibility === 'not-failed') {
+      throw new errors.BadRequestError({
+        message: tpl(messages.retryEmailNotFailed),
+        code: RETRY_NOT_FAILED_CODE,
+      });
+    }
+    if (eligibility === 'unknown-outcome') {
+      throw new errors.BadRequestError({
+        message: tpl(messages.retryEmailUnknownOutcome),
+        code: RETRY_UNKNOWN_OUTCOME_CODE,
+      });
+    }
+  }
+
   /**
    * @param {import('./jobs/send-email-job').default} job
    */
@@ -587,3 +626,5 @@ class EmailService {
 }
 
 module.exports = EmailService;
+module.exports.RETRY_UNKNOWN_OUTCOME_CODE = RETRY_UNKNOWN_OUTCOME_CODE;
+module.exports.RETRY_NOT_FAILED_CODE = RETRY_NOT_FAILED_CODE;

package/core/server/services/email-service/sending-status-serializers.js

@@ -13,6 +13,7 @@ const SendingResource = zod_1.z.object({
         estimated_seconds_remaining: zod_1.z.number().nullable(),
     }),
     failed_during: SendingPhaseResource.optional(),
+    retryable: zod_1.z.boolean().optional(),
 });
 const EmailStatusResource = zod_1.z.object({
     id: zod_1.z.string(),
@@ -26,7 +27,9 @@ exports.toEmailStatusesResponse = sending_status_1.EmailSendingStatus.transform(
             sending: {
                 status: sending.status,
                 progress: (0, case_keys_1.snakeKeys)(sending.progress),
-                ...(sending.status === 'failed' ? { failed_during: sending.failedDuring } : {}),
+                ...(sending.status === 'failed'
+                    ? { failed_during: sending.failedDuring, retryable: sending.retryable }
+                    : {}),
             },
         },
     ],