@bobfrankston/mailx-store 0.1.55 → 0.1.57

package/db.d.ts

@@ -4,6 +4,18 @@
  * Message bodies are NOT here -- they live in the MessageStore backend.
  */
 import type { MessageEnvelope, Folder, EmailAddress, PagedResult, MessageQuery } from "@bobfrankston/mailx-types";
+/** Sanitize a harvested display name. A real display name carries none of
+ *  `@ < > |` — their presence means an address parser mis-split a header
+ *  (e.g. a List-Id / "domain | Name@addr" fragment) and the "name" now
+ *  embeds structural mail punctuation or a whole email address. The worst
+ *  case is an embedded address that DIFFERS from this contact's own email:
+ *  autocomplete then shows a TRUSTED name while sending ELSEWHERE. Live
+ *  example (Bob 2026-06-22): a `discovered` row name `bob.ma | Bob@bob.ma`
+ *  was wired to `miyakot@kt.rim.or.jp`, so test mail Bob addressed to
+ *  himself silently went to a stranger in Japan ("MIA"). Drop the name;
+ *  keep the contact (the email is still useful) — autocomplete falls back
+ *  to showing the bare address, which the user won't mistake for someone. */
+export declare function cleanContactName(name: string): string;
 /** User-configured patterns from contacts.jsonc `denylistPatterns`. Compiled
  *  once on settings load; invalid regexes are skipped with a warning. */
 export declare function setContactsDenyPatterns(patterns: string[]): void;
@@ -187,6 +199,26 @@ export declare class MailxDB {
     }[];
     updateLastSync(accountId: string, timestamp: number): void;
     upsertFolder(accountId: string, folderPath: string, name: string, specialUse: string, delimiter: string): number;
+    /** Rename a folder row's path (+leaf name) and rewrite every descendant
+     *  folder whose path lives under the old prefix. A single IMAP RENAME on the
+     *  server renames child mailboxes too (RFC 3501), and Gmail/Outlook rename
+     *  cascades the same way, so the local mirror must move the whole subtree in
+     *  lockstep. All in one transaction so a crash can't leave half the subtree
+     *  pointing at the old prefix.
+     *
+     *  `newName` is the new LEAF name written to the renamed row's `name`
+     *  column; descendant rows keep their own leaf names (only the prefix
+     *  changes). The (account_id, path) UNIQUE constraint means the caller must
+     *  have already verified newPath is free. */
+    renameFolderPath(accountId: string, oldPath: string, newPath: string, newName: string, delimiter: string): void;
+    /** Update only a folder's display `name`, leaving `path` untouched. For
+     *  providers whose `path` is an opaque, rename-stable id (Outlook/Graph:
+     *  path = folder id), a rename/reparent changes the display name but NOT
+     *  the id — so synthesizing a new hierarchical path (as renameFolderPath
+     *  does) would corrupt the id-as-path invariant every later Graph op relies
+     *  on. This updates the name in place. No descendant rewrite: opaque-id
+     *  children don't carry the parent in their path. */
+    renameFolderName(accountId: string, folderId: number, newName: string): void;
     getFolders(accountId: string): Folder[];
     /** Append a row to the audit_log table. Every destructive operation on
      *  the messages table writes here so "where did the rows go?" has an
@@ -252,6 +284,9 @@ export declare class MailxDB {
         inReplyTo: string;
         references: string[];
         date: number;
+        /** Date: header (send time). Defaults to `date` when the caller has no
+         *  header date, so the column is never null. */
+        sentDate?: number;
         subject: string;
         from: EmailAddress;
         to: EmailAddress[];
@@ -290,7 +325,7 @@ export declare class MailxDB {
     /** Short-TTL cache for the unified-inbox survivor COUNT (the GROUP BY that
      *  scans the whole inbox). Keyed by flaggedOnly+folder-set. */
     private _unifiedTotalCache;
-    getUnifiedInbox(page?: number, pageSize?: number, flaggedOnly?: boolean): PagedResult<MessageEnvelope>;
+    getUnifiedInbox(page?: number, pageSize?: number, flaggedOnly?: boolean, dateBasis?: "sent" | "received"): PagedResult<MessageEnvelope>;
     /** Map a `messages` row to a MessageEnvelope. Exposes `uuid` (stable local
      *  identity) and `bodyPath` (authoritative on-disk location) in addition
      *  to the server-binding metadata. */
@@ -464,6 +499,12 @@ export declare class MailxDB {
         preview: string;
         body_path: string;
     }[];
+    /** Count local rows in a folder sharing one Message-ID. The Sent-sweep
+     *  uses this as a sanity cross-check before re-APPENDing a "missing"
+     *  message: >1 local copies mean earlier duplicates synced IN from the
+     *  server, so the server-side header search that just said "missing"
+     *  was lying (the 3,704-duplicate loop, 2026-07-02). */
+    countMessagesByMessageId(accountId: string, folderId: number, messageId: string): number;
     /** Rebind a local row to a different server UID without re-upserting.
      *  Used by the Sent-sweep to repair optimistic-insert mispredictions
      *  (local row was inserted at the predicted UIDNEXT but the server
@@ -673,7 +714,10 @@ export declare class MailxDB {
     deleteContactByGoogleId(googleId: string): number;
     /** Full-text search across all messages. Supports qualifiers: from:, to:, subject: */
     searchMessages(query: string, page?: number, pageSize?: number, accountId?: string, folderId?: number, includeTrashSpam?: boolean): PagedResult<MessageEnvelope>;
-    /** Rebuild FTS index from existing messages */
+    /** Rebuild FTS index from existing messages.
+     *  body_text is seeded from `preview` here (all db.ts can reach); the full
+     *  message body is backfilled separately by mailx-imap's backfillFtsBodies()
+     *  pass, which can read the cached .eml. */
     rebuildSearchIndex(): number;
     /** Queue a local action for later sync to IMAP */
     queueSyncAction(accountId: string, action: string, uid: number, folderId: number, extra?: {

package/db.js

@@ -76,6 +76,25 @@ function isJunkContact(email, name) {
     }
     return false;
 }
+/** Sanitize a harvested display name. A real display name carries none of
+ *  `@ < > |` — their presence means an address parser mis-split a header
+ *  (e.g. a List-Id / "domain | Name@addr" fragment) and the "name" now
+ *  embeds structural mail punctuation or a whole email address. The worst
+ *  case is an embedded address that DIFFERS from this contact's own email:
+ *  autocomplete then shows a TRUSTED name while sending ELSEWHERE. Live
+ *  example (Bob 2026-06-22): a `discovered` row name `bob.ma | Bob@bob.ma`
+ *  was wired to `miyakot@kt.rim.or.jp`, so test mail Bob addressed to
+ *  himself silently went to a stranger in Japan ("MIA"). Drop the name;
+ *  keep the contact (the email is still useful) — autocomplete falls back
+ *  to showing the bare address, which the user won't mistake for someone. */
+export function cleanContactName(name) {
+    const n = (name || "").trim().replace(/^"(.*)"$/, "$1").trim();
+    if (!n)
+        return "";
+    if (/[@<>|]/.test(n))
+        return "";
+    return n;
+}
 /** User-configured patterns from contacts.jsonc `denylistPatterns`. Compiled
  *  once on settings load; invalid regexes are skipped with a warning. */
 export function setContactsDenyPatterns(patterns) {
@@ -537,6 +556,44 @@ export class MailxDB {
         // parsed (existing IMAP-synced rows that predate the prefetch-reparse
         // fix, where has_attachments stays 0 forever). NULL = never parsed.
         this.addColumnIfMissing("messages", "body_parsed_at", "INTEGER");
+        // sent_date: the message's own Date: header (when it was SENT), distinct
+        // from `date` which is the per-account arrival time (IMAP INTERNALDATE /
+        // Gmail internalDate). Kept as its own column so the list can offer a
+        // Sent/Received date basis (Bob 2026-07-01) AND so identical messages
+        // delivered to multiple accounts cluster on send time. Backfilled to
+        // `date` for existing rows so it is ALWAYS non-null → a plain index sorts
+        // it as fast as the received-date path (no COALESCE, no hot-path
+        // regression of the getUnifiedInbox streaming walk). Real send times fill
+        // in as folders re-sync (or via `-repair`).
+        this.addColumnIfMissing("messages", "sent_date", "INTEGER");
+        // One-shot heal: strip header-fold whitespace from stored Message-IDs /
+        // In-Reply-To. A folded "Message-ID:\r\n\t<...>" header reached the DB
+        // as "\t<...>" (pre-trim iflow-direct envelope parser); the tab made
+        // every HEADER search for that id return 0 → the sent-sweep re-APPENDed
+        // "missing" messages forever (3,707 duplicates of one reply,
+        // 2026-07-02). Idempotent — after the first pass the WHERE matches
+        // nothing. char(9/10/13)+space covers all RFC 5322 fold whitespace.
+        try {
+            const ws = "char(9)||char(10)||char(13)||' '";
+            this.db.exec(`UPDATE messages SET message_id = TRIM(message_id, ${ws}) WHERE message_id <> TRIM(message_id, ${ws})`);
+            this.db.exec(`UPDATE messages SET in_reply_to = TRIM(in_reply_to, ${ws}) WHERE in_reply_to IS NOT NULL AND in_reply_to <> TRIM(in_reply_to, ${ws})`);
+        }
+        catch { /* non-fatal */ }
+        try {
+            this.db.exec("CREATE INDEX IF NOT EXISTS idx_messages_folder_sentdate ON messages(account_id, folder_id, sent_date DESC)");
+        }
+        catch { /* already exists */ }
+        try {
+            this.db.exec("CREATE INDEX IF NOT EXISTS idx_messages_sentdate ON messages(folder_id, sent_date DESC)");
+        }
+        catch { /* already exists */ }
+        try {
+            // One-shot backfill: seed sent_date from date wherever it's still
+            // null. Indexed IS NULL check keeps this near-instant after the first
+            // pass; new writes set sent_date directly so it converges to a no-op.
+            this.db.exec("UPDATE messages SET sent_date = date WHERE sent_date IS NULL");
+        }
+        catch { /* non-fatal */ }
         // One-shot is_replied backfill on every boot. SQL-only, indexed
         // both sides via idx_messages_message_id and idx_messages_in_reply_to,
         // so a 100k-row mailbox finishes in milliseconds. Idempotent — after
@@ -815,18 +872,29 @@ export class MailxDB {
         if (last === TARGET)
             return;
         let dropped = 0;
+        let renamed = 0;
         try {
             const rows = this.db.prepare("SELECT id, email, name FROM contacts WHERE source IN ('discovered','sent','received')").all();
             const del = this.db.prepare("DELETE FROM contacts WHERE id = ?");
+            const blank = this.db.prepare("UPDATE contacts SET name = '' WHERE id = ?");
             for (const r of rows) {
                 if (isJunkContact(r.email || "", r.name || "")) {
                     del.run(r.id);
                     dropped++;
+                    continue;
+                }
+                // Blank mis-parsed display names that embed `@ < > |` — these
+                // can impersonate one identity while sending to another (the
+                // "bob.ma | Bob@bob.ma" → miyakot@kt.rim.or.jp cross-wire,
+                // Bob 2026-06-22). Keep the contact; drop only the unsafe name.
+                if (r.name && cleanContactName(r.name) !== r.name) {
+                    blank.run(r.id);
+                    renamed++;
                 }
             }
             this.setKv("contacts", "purge_v", TARGET);
-            if (dropped > 0)
-                console.log(`  [contacts] one-shot purge: dropped ${dropped} junk rows (${TARGET})`);
+            if (dropped > 0 || renamed > 0)
+                console.log(`  [contacts] one-shot purge: dropped ${dropped} junk rows, blanked ${renamed} unsafe names (${TARGET})`);
         }
         catch (e) {
             console.warn(`[contacts] one-shot purge failed: ${e.message}`);
@@ -1340,6 +1408,48 @@ export class MailxDB {
         const result = this.db.prepare("INSERT INTO folders (account_id, path, name, special_use, delimiter) VALUES (?, ?, ?, ?, ?)").run(accountId, folderPath, name, specialUse, delimiter);
         return Number(result.lastInsertRowid);
     }
+    /** Rename a folder row's path (+leaf name) and rewrite every descendant
+     *  folder whose path lives under the old prefix. A single IMAP RENAME on the
+     *  server renames child mailboxes too (RFC 3501), and Gmail/Outlook rename
+     *  cascades the same way, so the local mirror must move the whole subtree in
+     *  lockstep. All in one transaction so a crash can't leave half the subtree
+     *  pointing at the old prefix.
+     *
+     *  `newName` is the new LEAF name written to the renamed row's `name`
+     *  column; descendant rows keep their own leaf names (only the prefix
+     *  changes). The (account_id, path) UNIQUE constraint means the caller must
+     *  have already verified newPath is free. */
+    renameFolderPath(accountId, oldPath, newPath, newName, delimiter) {
+        const childPrefix = oldPath + delimiter;
+        this.db.exec("BEGIN");
+        try {
+            // The folder itself — path + leaf name both change.
+            this.db.prepare("UPDATE folders SET path = ?, name = ? WHERE account_id = ? AND path = ?").run(newPath, newName, accountId, oldPath);
+            // Descendants — rewrite only the path prefix, keep their leaf names.
+            // SUBSTR(path, len(childPrefix)+1) is the part after the old prefix.
+            const descendants = this.db.prepare("SELECT id, path FROM folders WHERE account_id = ? AND path LIKE ? ESCAPE '\\'").all(accountId, childPrefix.replace(/[\\%_]/g, "\\$&") + "%");
+            const upd = this.db.prepare("UPDATE folders SET path = ? WHERE id = ?");
+            for (const d of descendants) {
+                const rest = d.path.slice(oldPath.length); // includes the leading delimiter
+                upd.run(newPath + rest, d.id);
+            }
+            this.db.exec("COMMIT");
+        }
+        catch (e) {
+            this.db.exec("ROLLBACK");
+            throw e;
+        }
+    }
+    /** Update only a folder's display `name`, leaving `path` untouched. For
+     *  providers whose `path` is an opaque, rename-stable id (Outlook/Graph:
+     *  path = folder id), a rename/reparent changes the display name but NOT
+     *  the id — so synthesizing a new hierarchical path (as renameFolderPath
+     *  does) would corrupt the id-as-path invariant every later Graph op relies
+     *  on. This updates the name in place. No descendant rewrite: opaque-id
+     *  children don't carry the parent in their path. */
+    renameFolderName(accountId, folderId, newName) {
+        this.db.prepare("UPDATE folders SET name = ? WHERE account_id = ? AND id = ?").run(newName, accountId, folderId);
+    }
     getFolders(accountId) {
         const rows = this.db.prepare("SELECT * FROM folders WHERE account_id = ? ORDER BY path").all(accountId);
         const folders = rows.map(r => ({
@@ -1685,7 +1795,7 @@ export class MailxDB {
             // subject HERE, but only when the existing mid is empty AND the
             // incoming msg actually has one — never clobber a good value.
             if (msg.messageId && (!existing.message_id || existing.message_id === "")) {
-                this.db.prepare("UPDATE messages SET message_id = ?, date = ?, subject = ? WHERE id = ?").run(msg.messageId, msg.date || Date.now(), msg.subject || "", existing.id);
+                this.db.prepare("UPDATE messages SET message_id = ?, date = ?, sent_date = ?, subject = ? WHERE id = ?").run(msg.messageId, msg.date || Date.now(), msg.sentDate ?? msg.date ?? Date.now(), msg.subject || "", existing.id);
                 // The row was indexed with an empty subject (it had no envelope),
                 // so search missed it. Re-index now that we have the real subject
                 // + from/to. Standalone FTS5 → delete + insert. body_text
@@ -1760,10 +1870,10 @@ export class MailxDB {
         const result = this.db.prepare(`
             INSERT INTO messages (
                 account_id, folder_id, uid, uuid, message_id, in_reply_to, refs, thread_id,
-                date, subject, from_address, from_name, to_json, cc_json,
+                date, sent_date, subject, from_address, from_name, to_json, cc_json,
                 flags_json, size, has_attachments, preview, body_path, body_parsed_at, cached_at, provider_id, is_replied
-            ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-        `).run(msg.accountId, msg.folderId, msg.uid, uuid, msg.messageId, msg.inReplyTo, JSON.stringify(msg.references), threadId, msg.date, msg.subject, msg.from.address, msg.from.name, JSON.stringify(msg.to), JSON.stringify(msg.cc), JSON.stringify(msg.flags), msg.size, msg.hasAttachments ? 1 : 0, msg.preview, msg.bodyPath, msg.bodyPath ? Date.now() : null, Date.now(), msg.providerId || null, alreadyReplied ? 1 : 0);
+            ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+        `).run(msg.accountId, msg.folderId, msg.uid, uuid, msg.messageId, msg.inReplyTo, JSON.stringify(msg.references), threadId, msg.date, msg.sentDate ?? msg.date, msg.subject, msg.from.address, msg.from.name, JSON.stringify(msg.to), JSON.stringify(msg.cc), JSON.stringify(msg.flags), msg.size, msg.hasAttachments ? 1 : 0, msg.preview, msg.bodyPath, msg.bodyPath ? Date.now() : null, Date.now(), msg.providerId || null, alreadyReplied ? 1 : 0);
         const rowId = Number(result.lastInsertRowid);
         // Forward direction for ↩: if this message is a reply, mark the parent
         // as replied-to. Cheap indexed UPDATE; no-op when the parent isn't in
@@ -1821,7 +1931,10 @@ export class MailxDB {
         const offset = (page - 1) * pageSize;
         const sort = query.sort || "date";
         const sortDir = query.sortDir || "desc";
-        const sortCol = sort === "from" ? "m.from_name" : sort === "subject" ? "m.subject" : "m.date";
+        // Date basis: "sent" (Date: header, default — clusters identical mail
+        // and matches other clients) or "received" (per-account arrival time).
+        const dateCol = query.dateBasis === "received" ? "m.date" : "m.sent_date";
+        const sortCol = sort === "from" ? "m.from_name" : sort === "subject" ? "m.subject" : dateCol;
         let where = "m.account_id = ? AND mf.folder_id = ?";
         const params = [query.accountId, query.folderId];
         if (query.search) {
@@ -1886,6 +1999,7 @@ export class MailxDB {
             references: JSON.parse(r.refs || "[]"),
             threadId: r.thread_id || undefined,
             date: r.date,
+            sentDate: r.sent_date ?? r.date,
             subject: r.subject,
             from: { name: r.from_name, address: r.from_address },
             to: JSON.parse(r.to_json),
@@ -1904,8 +2018,13 @@ export class MailxDB {
     /** Short-TTL cache for the unified-inbox survivor COUNT (the GROUP BY that
      *  scans the whole inbox). Keyed by flaggedOnly+folder-set. */
     _unifiedTotalCache = new Map();
-    getUnifiedInbox(page = 1, pageSize = 50, flaggedOnly = false) {
+    getUnifiedInbox(page = 1, pageSize = 50, flaggedOnly = false, dateBasis = "sent") {
         const offset = (page - 1) * pageSize;
+        // Date basis: sort/stream by the Date: header (sent, default) or the
+        // per-account arrival time (received). sent_date is always non-null
+        // (backfilled to date), and idx_messages_sentdate mirrors
+        // idx_messages_folder_date, so the streaming walk stays O(page).
+        const dateCol = dateBasis === "received" ? "m.date" : "m.sent_date";
         // Find all inbox folder IDs
         const inboxRows = this.db.prepare("SELECT id FROM folders WHERE special_use = 'inbox'").all();
         if (inboxRows.length === 0)
@@ -1970,7 +2089,7 @@ export class MailxDB {
              FROM messages m
              JOIN message_folders mf ON mf.message_row_id = m.id
              WHERE mf.folder_id IN (${placeholders})${flagFilter}
-             ORDER BY m.date DESC, m.id DESC`);
+             ORDER BY ${dateCol} DESC, m.id DESC`);
         // Per-survivor enrichment (runs only for the ≤pageSize kept rows, not the
         // whole inbox). Same semantics as the old inline correlated subqueries.
         const pendingStmt = this.db.prepare("SELECT 1 FROM sync_actions WHERE account_id = ? AND uid = ? LIMIT 1");
@@ -2011,6 +2130,7 @@ export class MailxDB {
             references: JSON.parse(r.refs || "[]"),
             threadId: r.thread_id || undefined,
             date: r.date,
+            sentDate: r.sent_date ?? r.date,
             subject: r.subject,
             from: { name: r.from_name, address: r.from_address },
             to: JSON.parse(r.to_json),
@@ -2125,7 +2245,26 @@ export class MailxDB {
      *  for code paths that mean it; everyone else must pass folderId. */
     updateMessageFlags(accountId, folderId, uid, flags) {
         if (folderId != null) {
-            this.db.prepare("UPDATE messages SET flags_json = ? WHERE account_id = ? AND folder_id = ? AND uid = ?").run(JSON.stringify(flags), accountId, folderId, uid);
+            // Resolve the row via its folder MEMBERSHIP, not messages.folder_id.
+            // The message-id collapse (upsertMessage move-detect) keeps ONE
+            // `messages` row per message_id whose `folder_id` is an arbitrary
+            // "primary" folder, while the message appears in OTHER folders via
+            // `message_folders`. A `WHERE folder_id = ?` update therefore MISSED
+            // any message viewed in a folder other than its stored primary —
+            // 0 rows changed, so star/mark-read silently did nothing locally and
+            // the change "came right back" on the next render (Bob 2026-06-27).
+            // Match the membership (the same join getMessageByUid uses).
+            const r = this.db.prepare(`
+                UPDATE messages SET flags_json = ? WHERE id = (
+                    SELECT m.id FROM messages m
+                    JOIN message_folders mf ON mf.message_row_id = m.id
+                    WHERE m.account_id = ? AND mf.folder_id = ? AND mf.uid = ? LIMIT 1
+                )
+            `).run(JSON.stringify(flags), accountId, folderId, uid);
+            // Fallback for any legacy row lacking a membership entry.
+            if (r.changes === 0) {
+                this.db.prepare("UPDATE messages SET flags_json = ? WHERE account_id = ? AND folder_id = ? AND uid = ?").run(JSON.stringify(flags), accountId, folderId, uid);
+            }
         }
         else {
             this.db.prepare("UPDATE messages SET flags_json = ? WHERE account_id = ? AND uid = ?").run(JSON.stringify(flags), accountId, uid);
@@ -2425,6 +2564,19 @@ export class MailxDB {
              WHERE account_id = ? AND folder_id = ? AND cached_at >= ?
                AND message_id IS NOT NULL AND message_id <> ''`).all(accountId, folderId, sinceMs);
     }
+    /** Count local rows in a folder sharing one Message-ID. The Sent-sweep
+     *  uses this as a sanity cross-check before re-APPENDing a "missing"
+     *  message: >1 local copies mean earlier duplicates synced IN from the
+     *  server, so the server-side header search that just said "missing"
+     *  was lying (the 3,704-duplicate loop, 2026-07-02). */
+    countMessagesByMessageId(accountId, folderId, messageId) {
+        if (!messageId)
+            return 0;
+        const r = this.db.prepare(`SELECT COUNT(*) AS c FROM messages m
+             JOIN message_folders mf ON mf.message_row_id = m.id
+             WHERE m.account_id = ? AND mf.folder_id = ? AND m.message_id = ?`).get(accountId, folderId, messageId);
+        return r?.c | 0;
+    }
     /** Rebind a local row to a different server UID without re-upserting.
      *  Used by the Sent-sweep to repair optimistic-insert mispredictions
      *  (local row was inserted at the predicted UIDNEXT but the server
@@ -2579,6 +2731,7 @@ export class MailxDB {
             return;
         if (isJunkContact(lower, name))
             return;
+        name = cleanContactName(name);
         const now = Date.now();
         // discovered tier holds one row per email — bump if present, else
         // insert. Doesn't touch preferred or google rows for the same email;
@@ -2690,6 +2843,7 @@ export class MailxDB {
                 return;
             if (this.isAddressDenylisted(email))
                 return;
+            name = cleanContactName(name);
             const e = agg.get(email);
             if (e) {
                 e.cnt++;
@@ -3216,6 +3370,7 @@ export class MailxDB {
         for (const part of parts) {
             const fromMatch = part.match(/^from:(.+)$/i);
             const toMatch = part.match(/^to:(.+)$/i);
+            const ccMatch = part.match(/^cc:(.+)$/i);
             const subjectMatch = part.match(/^subject:(.+)$/i);
             const dateMatch = part.match(/^date:([><]?=?)(.+)$/i);
             const afterMatch = part.match(/^after:(.+)$/i);
@@ -3231,10 +3386,19 @@ export class MailxDB {
                     frags.push({ s: `{from_name from_address}:${term}*`, op: false });
             }
             else if (toMatch) {
+                // `to:` deliberately spans To AND Cc — when someone searches
+                // "to:bob" they mean "addressed to bob", and being Cc'd counts.
+                // Use `cc:` for a Cc-only match. (Bcc isn't indexed: it's absent
+                // on received mail by design, and only meaningful in Sent.)
                 const term = ftsClean(toMatch[1]);
                 if (term)
                     frags.push({ s: `{to_text cc_text}:${term}*`, op: false });
             }
+            else if (ccMatch) {
+                const term = ftsClean(ccMatch[1]);
+                if (term)
+                    frags.push({ s: `cc_text:${term}*`, op: false });
+            }
             else if (subjectMatch) {
                 const term = ftsClean(subjectMatch[1]);
                 if (term)
@@ -3334,6 +3498,9 @@ export class MailxDB {
             ftsQuery += sep + frags[i].s;
         }
         ftsQuery = ftsQuery.trim();
+        // (Header-scoped search is reachable via the `subject:`/`from:`/`to:`
+        // qualifiers — no separate "headers only" mode needed, and body search
+        // isn't slow enough to warrant one.)
         // No real FTS term — either qualifier-only ("is:flagged after:1w") or
         // every term sanitized away (user typed only punctuation). There is NO
         // valid FTS5 "match everything" string — `MATCH '*'` is itself an FTS5
@@ -3419,16 +3586,23 @@ export class MailxDB {
             return { items: [], total: 0, page, pageSize };
         }
     }
-    /** Rebuild FTS index from existing messages */
+    /** Rebuild FTS index from existing messages.
+     *  body_text is seeded from `preview` here (all db.ts can reach); the full
+     *  message body is backfilled separately by mailx-imap's backfillFtsBodies()
+     *  pass, which can read the cached .eml. */
     rebuildSearchIndex() {
-        // Drop and recreate in case schema changed
+        // Drop and recreate. MUST be the STANDALONE schema (no content=messages):
+        // the external-content form indexes to_text/cc_text/body_text columns
+        // that don't exist on `messages`, so content-dereferencing silently
+        // drops those terms — the exact breakage migrateFtsSchema() repairs.
+        // Recreating it here used to quietly reintroduce that bug on every
+        // -reindex (Bob 2026-06-05 "search missed to/cc/body").
         try {
             this.db.exec("DROP TABLE IF EXISTS messages_fts");
         }
         catch { /* ignore */ }
         this.db.exec(`CREATE VIRTUAL TABLE IF NOT EXISTS messages_fts USING fts5(
-            subject, from_name, from_address, to_text, cc_text, body_text,
-            content=messages, content_rowid=id
+            subject, from_name, from_address, to_text, cc_text, body_text
         )`);
         // Use a single transaction + prepared statement for speed (~50x faster than individual inserts)
         const insert = this.db.prepare("INSERT INTO messages_fts (rowid, subject, from_name, from_address, to_text, cc_text, body_text) VALUES (?, ?, ?, ?, ?, ?, ?)");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bobfrankston/mailx-store",
-  "version": "0.1.55",
+  "version": "0.1.57",
   "type": "module",
   "main": "index.js",
   "types": "index.d.ts",
@@ -9,8 +9,8 @@
   },
   "license": "ISC",
   "dependencies": {
-    "@bobfrankston/mailx-types": "^0.1.19",
-    "@bobfrankston/mailx-settings": "^0.1.30",
+    "@bobfrankston/mailx-types": "^0.1.22",
+    "@bobfrankston/mailx-settings": "^0.1.33",
     "@bobfrankston/mailx-bus": "^0.1.2",
     "mailparser": "^3.7.2"
   },
@@ -29,8 +29,8 @@
   },
   ".transformedSnapshot": {
     "dependencies": {
-      "@bobfrankston/mailx-types": "^0.1.19",
-      "@bobfrankston/mailx-settings": "^0.1.30",
+      "@bobfrankston/mailx-types": "^0.1.22",
+      "@bobfrankston/mailx-settings": "^0.1.33",
       "@bobfrankston/mailx-bus": "^0.1.2",
       "mailparser": "^3.7.2"
     }

package/store.d.ts

@@ -130,7 +130,7 @@ export declare class Store {
     /** Paginated message list for a (account, folder, ...) query. */
     getMessages(query: MessageQuery): PagedResult<MessageEnvelope>;
     /** All-Inboxes view: union of every account's INBOX, paginated. */
-    getUnifiedInbox(page?: number, pageSize?: number, flaggedOnly?: boolean): PagedResult<MessageEnvelope>;
+    getUnifiedInbox(page?: number, pageSize?: number, flaggedOnly?: boolean, dateBasis?: "sent" | "received"): PagedResult<MessageEnvelope>;
     /** Local FTS5 search. Server-scope search is the reconciler's job. */
     searchMessages(query: string, page?: number, pageSize?: number, accountId?: string, folderId?: number, includeTrashSpam?: boolean): PagedResult<MessageEnvelope>;
     /** Read a fully-parsed message (envelope + body + attachments) entirely

package/store.js

@@ -182,8 +182,8 @@ export class Store {
         return this.db.getMessages(query);
     }
     /** All-Inboxes view: union of every account's INBOX, paginated. */
-    getUnifiedInbox(page = 1, pageSize = 50, flaggedOnly = false) {
-        return this.db.getUnifiedInbox(page, pageSize, flaggedOnly);
+    getUnifiedInbox(page = 1, pageSize = 50, flaggedOnly = false, dateBasis = "sent") {
+        return this.db.getUnifiedInbox(page, pageSize, flaggedOnly, dateBasis);
     }
     /** Local FTS5 search. Server-scope search is the reconciler's job. */
     searchMessages(query, page = 1, pageSize = 50, accountId, folderId, includeTrashSpam = false) {