pipework 0.253.0 → 0.255.0

package/src/infra/email/sanitize.ts

@@ -0,0 +1,284 @@
+/**
+ * Allow-list HTML sanitiser for mail from strangers. The input is tokenised and the output is built only from
+ * allow-listed tags and attributes, every tag re-serialised and every text run and attribute value escaped.
+ * No slice of the input is copied through. Output is balanced and `sanitizeHtml(sanitizeHtml(x)) === sanitizeHtml(x)`.
+ */
+
+const VOID = new Set(['br', 'hr', 'img', 'col'])
+const ALLOWED = new Set([
+  'p', 'br', 'div', 'span', 'b', 'strong', 'i', 'em', 'u', 's', 'strike', 'sub', 'sup', 'small', 'blockquote', 'pre', 'code',
+  'ul', 'ol', 'li', 'dl', 'dt', 'dd', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'hr', 'table', 'thead', 'tbody', 'tfoot', 'tr', 'th', 'td',
+  'caption', 'colgroup', 'col', 'a', 'img', 'font', 'center',
+])
+/**
+ * Dropped together with everything inside them. Wrappers such as form, button, select, option and head are not listed:
+ * they are unwrapped (tag gone, text kept) and their dangerous children are dropped one by one.
+ */
+const DROPPED = new Set([
+  'script', 'style', 'iframe', 'frame', 'frameset', 'object', 'embed', 'applet', 'input', 'textarea',
+  'svg', 'math', 'template', 'noscript', 'title', 'base', 'link', 'meta',
+])
+/** Dropped elements whose content is not markup: skipped to the matching end tag. */
+const RAW_TEXT = new Set(['script', 'style', 'iframe', 'textarea', 'template', 'noscript', 'title'])
+/** Dropped elements with no content. */
+const EMPTY_DROPPED = new Set(['input', 'base', 'link', 'meta', 'embed', 'frame'])
+
+const NAMED: Record<string, string> = {
+  amp: '&', lt: '<', gt: '>', quot: '"', apos: "'", nbsp: ' ', colon: ':', Tab: '\t', NewLine: '\n', copy: '©',
+  reg: '®', hellip: '…', mdash: '—', ndash: '–', lsquo: '‘', rsquo: '’', ldquo: '“',
+  rdquo: '”', bull: '•', middot: '·', euro: '€', zwnj: '', zwj: '', shy: '', trade: '\u2122',
+  rarr: '\u2192', larr: '\u2190', times: '\u00d7', deg: '\u00b0', laquo: '\u00ab', raquo: '\u00bb', pound: '\u00a3',
+  yen: '\u00a5', cent: '\u00a2', sect: '\u00a7', para: '\u00b6',
+}
+
+/** Marks an unknown but well-formed named reference in decoded text; `sanitizeHtml` passes it through, `htmlToText` drops it. */
+const REF_OPEN = '\ue000'
+const REF_CLOSE = '\ue001'
+const MARKERS = /[\ue000\ue001]/g
+
+/** In text mode an unknown reference like `&foo;` is wrapped in markers instead of left bare. */
+function decodeEntities(s: string, text = false): string {
+  if (text) s = s.replace(MARKERS, '')
+  if (!s.includes('&')) return s
+  return s.replace(/&(#[xX][0-9a-fA-F]+|#[0-9]+|[A-Za-z][A-Za-z0-9]*);?/g, (match, body: string) => {
+    if (body.startsWith('#')) {
+      const code = body[1] === 'x' || body[1] === 'X' ? parseInt(body.slice(2), 16) : parseInt(body.slice(1), 10)
+      if (!Number.isFinite(code) || code <= 0 || code > 0x10ffff || (code >= 0xd800 && code <= 0xdfff) || code === 0xe000 || code === 0xe001) return '�'
+      return String.fromCodePoint(code)
+    }
+    const value = match.endsWith(';') ? NAMED[body] : undefined
+    if (value !== undefined) return value
+    return text && match.endsWith(';') && body.length >= 2 && body.length <= 32 ? `${REF_OPEN}${match}${REF_CLOSE}` : match
+  })
+}
+
+function escapeText(s: string): string {
+  return s.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;')
+}
+
+/** Escapes a decoded text run, leaving the marked unknown references as written (they cannot form markup). */
+function escapeRun(s: string): string {
+  return escapeText(s).replace(/\ue000&amp;([A-Za-z][A-Za-z0-9]*;)\ue001/g, '&$1').replace(MARKERS, '')
+}
+
+function escapeAttr(s: string): string {
+  return escapeText(s).replace(/"/g, '&quot;').replace(/'/g, '&#39;')
+}
+
+type Token =
+  | { readonly t: 'text'; readonly v: string }
+  | { readonly t: 'start'; readonly name: string; readonly attrs: ReadonlyMap<string, string> }
+  | { readonly t: 'end'; readonly name: string }
+
+interface Tag { readonly end: number; readonly name: string; readonly closing: boolean; readonly selfClosing: boolean; readonly attrs: Map<string, string> }
+
+const isSpace = (c: string | undefined): boolean => c === ' ' || c === '\t' || c === '\n' || c === '\r' || c === '\f'
+const isLetter = (c: string | undefined): boolean => c !== undefined && /[A-Za-z]/.test(c)
+
+/** Reads the tag starting at `<`; null when it never closes. */
+function readTag(s: string, start: number): Tag | null {
+  const n = s.length
+  let j = start + 1
+  const closing = s[j] === '/'
+  if (closing) j++
+  const nameStart = j
+  while (j < n && !isSpace(s[j]) && s[j] !== '/' && s[j] !== '>') j++
+  const name = s.slice(nameStart, j).toLowerCase()
+  const attrs = new Map<string, string>()
+  for (;;) {
+    while (j < n && (isSpace(s[j]) || s[j] === '/')) j++
+    if (j >= n) return null
+    if (s[j] === '>') return { end: j + 1, name, closing, selfClosing: s[j - 1] === '/', attrs }
+    const aStart = j
+    while (j < n && !isSpace(s[j]) && s[j] !== '=' && s[j] !== '/' && s[j] !== '>') j++
+    if (j === aStart) { j++; continue }
+    const attr = s.slice(aStart, j).toLowerCase()
+    while (j < n && isSpace(s[j])) j++
+    let value = ''
+    if (s[j] === '=') {
+      j++
+      while (j < n && isSpace(s[j])) j++
+      const q = s[j]
+      if (q === '"' || q === "'") {
+        const k = s.indexOf(q, j + 1)
+        if (k < 0) return null
+        value = s.slice(j + 1, k)
+        j = k + 1
+      } else {
+        const vStart = j
+        while (j < n && !isSpace(s[j]) && s[j] !== '>') j++
+        value = s.slice(vStart, j)
+      }
+    }
+    if (!attrs.has(attr)) attrs.set(attr, decodeEntities(value))
+  }
+}
+
+/** Tokens of the input with dropped elements and their content already removed. Text and attribute values are decoded. */
+function* tokenize(s: string): Generator<Token> {
+  const n = s.length
+  let i = 0
+  let skip: { name: string; depth: number } | null = null
+  while (i < n) {
+    if (s[i] !== '<') {
+      const k = s.indexOf('<', i)
+      const end = k < 0 ? n : k
+      if (skip === null) yield { t: 'text', v: decodeEntities(s.slice(i, end), true) }
+      i = end
+      continue
+    }
+    const next = s[i + 1]
+    if (isLetter(next) || (next === '/' && isLetter(s[i + 2]))) {
+      const tag = readTag(s, i)
+      if (tag === null) return
+      i = tag.end
+      if (skip !== null) {
+        if (tag.name === skip.name) {
+          if (tag.closing) { if (--skip.depth === 0) skip = null } else if (!tag.selfClosing) skip.depth++
+        }
+        continue
+      }
+      if (tag.closing) { yield { t: 'end', name: tag.name }; continue }
+      if (DROPPED.has(tag.name)) {
+        if (EMPTY_DROPPED.has(tag.name) || tag.selfClosing) continue
+        if (RAW_TEXT.has(tag.name)) {
+          const close = new RegExp(`</${tag.name}[\\s/>]`, 'ig')
+          close.lastIndex = i
+          const m = close.exec(s)
+          if (m === null) return
+          const gt = s.indexOf('>', m.index)
+          if (gt < 0) return
+          i = gt + 1
+        } else skip = { name: tag.name, depth: 1 }
+        continue
+      }
+      yield { t: 'start', name: tag.name, attrs: tag.attrs }
+      continue
+    }
+    if (next === '!' || next === '?' || next === '/') {
+      let end: number
+      if (s.startsWith('<!-->', i)) end = i + 5
+      else if (s.startsWith('<!--->', i)) end = i + 6
+      else if (s.startsWith('<!--', i)) { const k = s.indexOf('-->', i + 4); end = k < 0 ? -1 : k + 3 }
+      else if (s.startsWith('<![CDATA[', i)) { const k = s.indexOf(']]>', i + 9); end = k < 0 ? -1 : k + 3 }
+      else { const k = s.indexOf('>', i + 2); end = k < 0 ? -1 : k + 1 }
+      if (end < 0) return
+      i = end
+      continue
+    }
+    // A lone '<' is text.
+    const k = s.indexOf('<', i + 1)
+    const end = k < 0 ? n : k
+    if (skip === null) yield { t: 'text', v: decodeEntities(s.slice(i, end), true) }
+    i = end
+  }
+}
+
+const cleanUrl = (v: string): string => v.replace(/[\u0000-\u001f\u007f-\u009f]/g, '').trim()
+const NUM = /^\d{1,5}$/
+const SIZE = /^\d{1,5}%?$/
+const ALIGN = /^(left|right|center|justify)$/i
+const VALIGN = /^(top|middle|bottom|baseline)$/i
+
+const ATTRS: Record<string, Record<string, RegExp | 'text'>> = {
+  a: { title: 'text' },
+  img: { alt: 'text', width: SIZE, height: SIZE, title: 'text' },
+  td: { colspan: NUM, rowspan: NUM, align: ALIGN, valign: VALIGN },
+  th: { colspan: NUM, rowspan: NUM, align: ALIGN, valign: VALIGN },
+  table: { border: NUM, cellpadding: NUM, cellspacing: NUM, width: SIZE, align: ALIGN },
+  col: { span: NUM, width: SIZE },
+  colgroup: { span: NUM, width: SIZE },
+  ol: { start: NUM, type: /^[1aAiI]$/ },
+  font: { color: /^#?[0-9A-Za-z]{3,20}$/, size: /^[+-]?\d$/, face: /^[\w ,-]{1,100}$/ },
+  p: { align: ALIGN }, div: { align: ALIGN },
+  h1: { align: ALIGN }, h2: { align: ALIGN }, h3: { align: ALIGN }, h4: { align: ALIGN }, h5: { align: ALIGN }, h6: { align: ALIGN },
+}
+
+function safeHref(attrs: ReadonlyMap<string, string>): string | null {
+  const href = cleanUrl(attrs.get('href') ?? '')
+  return /^(https?:|mailto:)/i.test(href) ? href : null
+}
+
+function serialiseStart(name: string, attrs: ReadonlyMap<string, string>): string {
+  let out = `<${name}`
+  if (name === 'a') {
+    const href = safeHref(attrs)
+    if (href !== null) out += ` href="${escapeAttr(href)}"`
+  }
+  const rules = ATTRS[name]
+  if (rules !== undefined) {
+    for (const [attr, rule] of Object.entries(rules)) {
+      const v = attrs.get(attr)
+      if (v === undefined) continue
+      if (rule === 'text' || rule.test(v.trim())) out += ` ${attr}="${escapeAttr(rule === 'text' ? v : v.trim())}"`
+    }
+  }
+  if (name === 'a') out += ' rel="noopener noreferrer nofollow" target="_blank"'
+  return out + '>'
+}
+
+/** Returns the HTML reduced to allow-listed tags and attributes: no script, event handlers, style, forms or remote resources. */
+export function sanitizeHtml(html: string): string {
+  let out = ''
+  const open: string[] = []
+  for (const tok of tokenize(html)) {
+    if (tok.t === 'text') { out += escapeRun(tok.v); continue }
+    if (!ALLOWED.has(tok.name)) continue
+    if (tok.t === 'start') {
+      if (tok.name === 'img') {
+        const src = cleanUrl(tok.attrs.get('src') ?? '')
+        if (/^cid:/i.test(src)) {
+          out += `<img src="${escapeAttr(src)}"${serialiseStart('img', tok.attrs).slice(4, -1)}>`
+        } else {
+          const alt = tok.attrs.get('alt') ?? ''
+          if (alt.trim() !== '') out += escapeText(alt)
+        }
+        continue
+      }
+      out += serialiseStart(tok.name, tok.attrs)
+      if (!VOID.has(tok.name)) open.push(tok.name)
+    } else {
+      const at = open.lastIndexOf(tok.name)
+      if (at < 0 || VOID.has(tok.name)) continue
+      while (open.length > at) out += `</${open.pop()}>`
+    }
+  }
+  while (open.length > 0) out += `</${open.pop()}>`
+  return out
+}
+
+const BLOCK = new Set(['p', 'div', 'br', 'li', 'tr', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'blockquote', 'ul', 'ol', 'table', 'pre', 'hr'])
+
+const LINE_START_ONLY = new Set(['li', 'tr', 'br'])
+
+/** The readable text of the HTML: block tags become line breaks, entities are decoded, script and style are excluded. */
+export function htmlToText(html: string): string {
+  let out = ''
+  let pre = 0
+  const links: { href: string; at: number }[] = []
+  for (const tok of tokenize(html)) {
+    if (tok.t === 'text') {
+      const v = tok.v.replace(/\ue000[^\ue001]*\ue001/g, '')
+      out += pre > 0 ? v : v.replace(/\s+/g, ' ')
+    } else if (tok.t === 'start') {
+      if (tok.name === 'pre') pre++
+      if (tok.name === 'a') {
+        const href = safeHref(tok.attrs)
+        if (href !== null) links.push({ href, at: out.length })
+      }
+      if (BLOCK.has(tok.name)) out += '\n'
+    } else {
+      if (tok.name === 'pre' && pre > 0) pre--
+      if (tok.name === 'a') {
+        const link = links.pop()
+        if (link !== undefined) {
+          const label = out.slice(link.at).trim()
+          if (label !== '' && label !== link.href && `mailto:${label}` !== link.href) out += ` (${link.href})`
+        }
+      }
+      if (BLOCK.has(tok.name) && !LINE_START_ONLY.has(tok.name)) out += '\n'
+      else if (tok.name === 'td' || tok.name === 'th') out += ' '
+    }
+  }
+  return out.split('\n').map(l => (pre > 0 ? l : l.replace(/[ \t ]+/g, ' ').trim())).join('\n').replace(/\n{3,}/g, '\n\n').trim()
+}

package/src/infra/email/schema.ts

@@ -9,6 +9,7 @@ import { define } from '../../data/domain/index.js'
 import { field } from '../../data/domain/field.js'
 import { schema } from '../../data/schema/namespace.js'
 import { index, unique } from '../../data/db/idx/index.js'
+import { sql } from '../../data/db/sql.js'
 
 export const EMAIL_TABLE_NAMES: ReadonlySet<string> = new Set([
   'pipework_email_messages', 'pipework_email_suppressions', 'pipework_email_inbound', 'pipework_email_unsubscribes',
@@ -71,6 +72,8 @@ export const emailInbound = define('pipework_email_inbound', {
   rawLocation: field.jsonb(schema.check.json()),
   rawExpiresAt: field.timestamp(),
   rawDeletedAt: field.timestamp().nullable(),
+  // Set when `sweep` nulls the address, subject, recipients and Message-ID after `metadataRetentionDays`.
+  metadataScrubbedAt: field.timestamp().nullable(),
   status: field.enum(INBOUND_STATUSES).default('received'),
   error: field.text().nullable(),
   messageIdHeader: field.text().nullable(),
@@ -92,5 +95,6 @@ export const emailInbound = define('pipework_email_inbound', {
     bySource: unique('pipework_email_inbound_source_id_key').on(t['sourceId']),
     byMessageId: index('idx_pipework_email_inbound_message_id').on(t['messageIdHeader']),
     byExpiry: index('idx_pipework_email_inbound_raw_expires').on(t['rawExpiresAt']),
+    unscrubbed: index('idx_pipework_email_inbound_unscrubbed').on(t['receivedAt']).where(sql.raw('metadata_scrubbed_at IS NULL')),
   }),
 })

package/src/infra/email/sns.ts

@@ -94,7 +94,7 @@ const processEvent = __flowStep({ ref: 'pipework/email:notification' }, async (e
     } else {
       getBaseLogger().info({ event: 'email bounce not suppressed', address, bounceType: r.bounceType }, 'transient bounce: address kept')
     }
-    await auditEmail(r.kind, messageId, { address, bounceType: r.bounceType, suppressed: permanent, messageTraceId })
+    await auditEmail(r.kind, messageId, { bounceType: r.bounceType, suppressed: permanent, messageTraceId })
   }
 })
 

package/src/infra/outbox/core.ts

@@ -13,6 +13,9 @@ const LEASE_MS = 30_000
 const BATCH = 50
 const MAX_BATCHES = 20
 const MAX_BACKOFF_MS = 3_600_000
+const SWEEP_BATCH = 500
+const DEFAULT_SWEEP_LIMIT = 10_000
+const SWEEP_EVERY_MS = 3_600_000
 
 export interface OutboxTotals {
   delivered: number
@@ -61,6 +64,27 @@ export interface OutboxOptions<D> {
   readonly onGivenUp: (row: Record<string, unknown>, attempt: number, error: string) => Promise<void>
 }
 
+/** Retention for an outbox's rows, in days. Unset: kept. */
+export interface OutboxRetention {
+  /** Delivered rows (and their payloads) older than this are deleted. */
+  readonly deliveredRetentionDays: number
+  /** Given-up rows (`failed_at` set, never delivered) older than this are deleted. Unset: kept. */
+  readonly failedRetentionDays?: number
+}
+
+/** Refuses a retention that is not whole days of zero or more, naming `who` and the option. */
+export function checkRetention(who: string, config: { readonly deliveredRetentionDays?: number; readonly failedRetentionDays?: number }): OutboxRetention | undefined {
+  for (const name of ['deliveredRetentionDays', 'failedRetentionDays'] as const) {
+    const v = config[name]
+    if (v !== undefined && !(Number.isInteger(v) && v >= 0)) throw new Error(`[pipework] ${who}: ${name} must be an integer of zero or more, got ${String(v)}.`)
+  }
+  if (config.failedRetentionDays !== undefined && config.deliveredRetentionDays === undefined) {
+    throw new Error(`[pipework] ${who}: failedRetentionDays needs deliveredRetentionDays too.`)
+  }
+  if (config.deliveredRetentionDays === undefined) return undefined
+  return { deliveredRetentionDays: config.deliveredRetentionDays, ...(config.failedRetentionDays !== undefined ? { failedRetentionDays: config.failedRetentionDays } : {}) }
+}
+
 export interface Outbox {
   /** Delivers what is due now, up to 20 batches; rows that fail wait for the next call. */
   drain(): Promise<OutboxTotals>
@@ -70,6 +94,26 @@ export interface Outbox {
    * `prev_attempts`, the attempts it had when given up.
    */
   requeue(options: { sink?: string; failedSince?: Date }): Promise<Record<string, unknown>[]>
+  /**
+   * Deletes delivered rows whose `delivered_at` is older than `deliveredRetentionDays` and, with `failedRetentionDays`,
+   * given-up rows whose `failed_at` is older than that. A row still queued or being retried is never deleted.
+   * Deletes in batches of 500, at most `limit` rows per call (default 10 000).
+   */
+  sweep(options: OutboxRetention & { limit?: number }): Promise<{ deleted: number }>
+}
+
+/** A function that runs `outbox.sweep` with `retention` at most once an hour per process, and never throws; `onError` gets a failure. No retention: does nothing. */
+export function hourlySweep(outbox: Outbox, retention: OutboxRetention | undefined, onError: (err: unknown) => void): () => Promise<void> {
+  let last = 0
+  return async () => {
+    if (retention === undefined || Date.now() - last < SWEEP_EVERY_MS) return
+    last = Date.now()
+    try {
+      await outbox.sweep(retention)
+    } catch (err) {
+      onError(err)
+    }
+  }
 }
 
 function withTimeout(promise: Promise<void>, ms: number): Promise<void> {
@@ -136,7 +180,33 @@ export function createOutbox<D>(options: OutboxOptions<D>): Outbox {
     }))
   }
 
+  async function deleteBatch(predicate: ReturnType<typeof sql>, size: number): Promise<number> {
+    const rows = await db().execute(sql`
+      DELETE FROM ${table} WHERE id IN (SELECT id FROM ${table} WHERE ${predicate} LIMIT ${size}) RETURNING id`)
+    return rows.length
+  }
+
   return {
+    async sweep(opts) {
+      const days = [['deliveredRetentionDays', opts.deliveredRetentionDays], ['failedRetentionDays', opts.failedRetentionDays], ['limit', opts.limit]] as const
+      for (const [name, v] of days) {
+        if (v !== undefined && !(Number.isInteger(v) && v >= (name === 'limit' ? 1 : 0))) {
+          throw new ValidationError({ [name]: ['must be a whole number' + (name === 'limit' ? ' of one or more' : ' of zero or more')] }, `Outbox sweep ${name} is invalid.`)
+        }
+      }
+      const delivered = sql`delivered_at IS NOT NULL AND delivered_at < clock_timestamp() - ${opts.deliveredRetentionDays} * interval '1 day'`
+      const failed = opts.failedRetentionDays === undefined ? null
+        : sql`delivered_at IS NULL AND failed_at IS NOT NULL AND failed_at < clock_timestamp() - ${opts.failedRetentionDays} * interval '1 day'`
+      const predicate = failed === null ? delivered : sql`((${delivered}) OR (${failed}))`
+      const limit = opts.limit ?? DEFAULT_SWEEP_LIMIT
+      let deleted = 0
+      while (deleted < limit) {
+        const n = await deleteBatch(predicate, Math.min(SWEEP_BATCH, limit - deleted))
+        deleted += n
+        if (n === 0) break
+      }
+      return { deleted }
+    },
     async requeue(opts) {
       if (opts.failedSince !== undefined && !(opts.failedSince instanceof Date && !Number.isNaN(opts.failedSince.getTime()))) {
         throw new ValidationError({ failedSince: ['must be a valid Date'] }, 'Outbox failedSince must be a Date.')

package/src/infra/support/handle.ts

@@ -15,8 +15,9 @@ import type { Handler } from '../../request/di/types.js'
 import { __flowStep } from '../../trace/runtime/flow-step.js'
 import { recordBeat, beatsEnabled } from '../alerts/beat.js'
 import type { Mail } from '../email/mail.js'
+import { sanitizeHtml, htmlToText } from '../email/sanitize.js'
 import type { ReceivedEmail } from '../email/inbound.js'
-import { createOutbox, type Sink, type SinkDelivery } from '../outbox/core.js'
+import { checkRetention, createOutbox, hourlySweep, type Sink, type SinkDelivery } from '../outbox/core.js'
 import { TICKET_STATES } from './schema.js'
 import { describeError } from '../../core/logging/error-chain.js'
 
@@ -98,6 +99,14 @@ export interface SupportConfig {
   readonly maxAttempts?: number
   /** First retry delay, doubling per attempt up to one hour; default 5000. */
   readonly backoffMs?: number
+  /**
+   * Days a delivered event row, with its payload (the ticket subject), is kept before the sweep deletes it. Unset: kept.
+   * `tick` (so `support.job`) runs the sweep at most once an hour per process; `sweep()` runs it on demand.
+   * The ticket audit rows carry ids only; they expire with the trace partitions (`auditRetentionDays`).
+   */
+  readonly deliveredRetentionDays?: number
+  /** Days an event row that was given up on (never delivered) is kept. Needs `deliveredRetentionDays`. Unset: kept. */
+  readonly failedRetentionDays?: number
 }
 
 export interface Ticket {
@@ -255,6 +264,8 @@ export interface Support extends WithFor<TicketApi> {
   readonly job: Handler<Record<string, unknown>, unknown>
   /** What one run of `job` does; callable from a test. Needs a Flow. */
   tick(): Promise<{ delivered: number; retried: number; failed: number }>
+  /** Deletes event rows past `deliveredRetentionDays` / `failedRetentionDays` now, up to `limit` (default 10 000); `deleted: 0` when neither is set. Needs a Flow. */
+  sweep(options?: { limit?: number }): Promise<{ deleted: number }>
   /**
    * Puts the event deliveries that were given up (and never delivered) back on the queue, for every tenant, optionally
    * only those of `sink` and/or that failed at or after `failedSince`; the next `tick` sends them. Delivery ids stay the
@@ -287,11 +298,17 @@ function toTicket(r: Record<string, unknown>): Ticket {
   }
 }
 
+/** Inbound html is stranger-sent: rows stored before sanitising at ingest are cleaned on read (idempotent). */
+function storedHtml(r: Record<string, unknown>): string | null {
+  const html = (r['html'] ?? null) as string | null
+  return html !== null && r['kind'] === 'inbound' ? sanitizeHtml(html) : html
+}
+
 function toMessage(r: Record<string, unknown>): TicketMessage {
   return {
     id: r['id'] as string, ticketId: r['ticket_id'] as string, kind: r['kind'] as TicketMessage['kind'],
     channel: r['channel'] as TicketMessage['channel'], subject: (r['subject'] ?? null) as string | null,
-    text: r['text'] as string, html: (r['html'] ?? null) as string | null, fromAddress: (r['from_address'] ?? null) as string | null,
+    text: r['text'] as string, html: storedHtml(r), fromAddress: (r['from_address'] ?? null) as string | null,
     inboundEmailId: (r['inbound_email_id'] ?? null) as string | null,
     attachments: (r['attachments'] ?? null) as TicketMessage['attachments'],
     draftStatus: (r['draft_status'] ?? null) as TicketMessage['draftStatus'], version: Number(r['version']),
@@ -351,6 +368,7 @@ export function createSupport(config: SupportConfig): Support {
   if ((joinThread as string) !== 'contact' && (joinThread as string) !== 'conversation') {
     throw new Error(`[pipework] support.create: joinThread must be 'contact' or 'conversation', got ${JSON.stringify(joinThread)}.`)
   }
+  const retention = checkRetention('support.create', config)
   const jobType = config.jobType ?? 'pipework.support.events'
   const replyTemplate = config.replyTemplate ?? 'pipework.support.reply'
   const distinctApprover = config.distinctApprover ?? true
@@ -538,7 +556,7 @@ export function createSupport(config: SupportConfig): Support {
         RETURNING *`)
       ticket = toTicket(rows[0]!)
       created = true
-      await audit(flow, tx, tenantId, 'create', ticket.id, { subject: ticket.subject, contact: ticket.contactEmail, channel: m.channel, userId: ticket.userId })
+      await audit(flow, tx, tenantId, 'create', ticket.id, { channel: m.channel, userId: ticket.userId })
     } else {
       await discardLive(flow, tx, ticket, 'customer-replied')
       if (ticket.state !== 'open') ticket = await moveTo(flow, tx, ticket, 'open', true)
@@ -549,9 +567,11 @@ export function createSupport(config: SupportConfig): Support {
       ticket = toTicket(rows[0]!)
     }
 
+    const html = m.html === null ? null : sanitizeHtml(m.html)
+    const text = m.text.trim() === '' && m.html !== null ? htmlToText(m.html) : m.text
     await tx.execute(sql`
       INSERT INTO support_message (tenant_id, ticket_id, kind, channel, text, html, from_address, inbound_email_id, attachments)
-      VALUES (${tenantId}::uuid, ${ticket.id}::uuid, 'inbound', ${m.channel}, ${m.text}, ${m.html}, ${m.fromAddress},
+      VALUES (${tenantId}::uuid, ${ticket.id}::uuid, 'inbound', ${m.channel}, ${text}, ${html}, ${m.fromAddress},
         ${m.inboundEmailId}::uuid, ${m.attachments === null ? null : JSON.stringify(m.attachments)}::jsonb)`)
     await audit(flow, tx, tenantId, 'receive', ticket.id, { channel: m.channel, emailId: m.inboundEmailId, created, separated: m.separate === true, ...(joinedBy === null ? {} : { joinedBy }), ...(userIdSet === null ? {} : { userIdSet }) })
     await emit(tx, created ? 'ticket.created' : 'ticket.customer-replied', ticket)
@@ -793,7 +813,15 @@ export function createSupport(config: SupportConfig): Support {
     await audit(flow, null, payload.tenantId, verb, row['ticket_id'] as string, { sink: row['sink'], kind: row['kind'], ...extra })
   }
 
-  const drainStep = __flowStep({ ref: 'pipework/support:tick' }, () => outbox.drain())
+  const sweepIfDue = hourlySweep(outbox, retention, (err) => {
+    getBaseLogger().error({ err }, 'support event sweep failed')
+    void recordFault('support-event-sweep', faultMessage(err), {})
+  })
+  const drainStep = __flowStep({ ref: 'pipework/support:tick' }, async () => {
+    const totals = await outbox.drain()
+    await sweepIfDue()
+    return totals
+  })
   // A beat for `alerts.source.loopStalled`, written only where the blueprint has `alerts`.
   const beat = async (outcome: { ok: boolean; error?: string }): Promise<void> => {
     const ctx = getContext()
@@ -846,6 +874,10 @@ export function createSupport(config: SupportConfig): Support {
     },
     job: job as unknown as Handler<Record<string, unknown>, unknown>,
     tick: () => tickStep(),
+    async sweep(options = {}) {
+      requireContext()
+      return retention === undefined ? { deleted: 0 } : outbox.sweep({ ...retention, ...(options.limit !== undefined ? { limit: options.limit } : {}) })
+    },
     async requeueFailed(options) {
       requireContext()
       nonEmpty('by', options.by)