@bobfrankston/mailx 1.0.244 → 1.0.251

package/packages/mailx-imap/index.d.ts

@@ -3,7 +3,7 @@
  * Multi-account IMAP management wrapping iflow.
  * Syncs messages to local store, emits events for new mail.
  */
-import { type TransportFactory } from "@bobfrankston/iflow-direct";
+import type { TransportFactory } from "@bobfrankston/tcp-transport";
 import { MailxDB, FileMessageStore } from "@bobfrankston/mailx-store";
 import type { AccountConfig, MessageEnvelope, Folder } from "@bobfrankston/mailx-types";
 import { EventEmitter } from "node:events";
@@ -103,14 +103,19 @@ export declare class ImapManager extends EventEmitter {
     private handleSyncError;
     /** Sync just INBOX for each account (fast check for new mail) */
     syncInbox(): Promise<void>;
-    /** Quick inbox check — uses IMAP STATUS (single command, no mailbox open).
-     *  If message count changed, triggers inbox sync for that account. */
-    private lastInboxCounts;
+    /** Quick inbox check — per-account lightweight probe.
+     *  If the probe value changed since last time, triggers an inbox sync.
+     *  The marker is only advanced after a successful sync so that a failed
+     *  sync doesn't eat the "new mail" signal and make us stop retrying. */
+    private lastInboxMarker;
     private quickCheckRunning;
+    /** Shared quick-check skeleton: probe → compare → sync-if-changed → advance marker.
+     *  `probe` returns the current marker value; `sync` runs only when it differs
+     *  from the previously stored value. Marker is advanced only after sync resolves. */
+    private quickCheck;
     /** Check a single account's inbox — uses its own connection, never blocked by sync */
     quickInboxCheckAccount(accountId: string): Promise<void>;
-    /** Quick Gmail inbox check — one lightweight API call to check for new messages */
-    private lastGmailInboxTop;
+    private quickImapCheck;
     private quickGmailCheck;
     /** Check all accounts (used by legacy callers) */
     quickInboxCheck(): Promise<void>;
@@ -203,7 +208,9 @@ export declare class ImapManager extends EventEmitter {
      *  directory is safe again. Any legitimate files that land there (crash
      *  recovery, manual drop) will get sent. */
     private processLocalQueue;
-    /** Send a raw RFC 2822 message via SMTP for a given account */
+    /** Send a raw RFC 2822 message via SMTP for a given account.
+     *  Uses @bobfrankston/smtp-direct with the same TransportFactory as IMAP —
+     *  same TCP byte-stream interface, no nodemailer dependency. */
     private sendRawViaSMTP;
     /** Process Outbox — send pending messages with flag-based interlock */
     processOutbox(accountId: string): Promise<void>;

package/packages/mailx-imap/index.js

@@ -12,7 +12,9 @@ import * as fs from "node:fs";
 import * as path from "node:path";
 import { simpleParser } from "mailparser";
 import { GmailApiProvider } from "./providers/gmail-api.js";
+import { SmtpClient } from "@bobfrankston/smtp-direct";
 import * as os from "node:os";
+import { fileURLToPath } from "node:url";
 // Well-known ports — no magic numbers
 const SMTP_PORT_STARTTLS = 587;
 const SMTP_PORT_IMPLICIT_TLS = 465;
@@ -367,7 +369,10 @@ export class ImapManager extends EventEmitter {
             let credPath = path.join(getConfigDir(), "google-credentials.json");
             if (!fs.existsSync(credPath)) {
                 try {
-                    const pkgDir = path.dirname(import.meta.resolve("@bobfrankston/iflow-direct").replace("file:///", "").replace("file://", ""));
+                    // Use fileURLToPath, NOT string-replace on "file://" — on Linux,
+                    // file:///usr/local/... loses its leading slash via .replace("file:///",
+                    // "") and becomes relative, so fs.existsSync silently fails.
+                    const pkgDir = path.dirname(fileURLToPath(import.meta.resolve("@bobfrankston/iflow-direct")));
                     for (const name of ["iflow-credentials.json"]) {
                         const p = path.join(pkgDir, name);
                         if (fs.existsSync(p)) {
@@ -758,6 +763,7 @@ export class ImapManager extends EventEmitter {
         // Use recalcFolderCounts — single SQL query instead of fetching all messages
         this.db.recalcFolderCounts(folderId);
         this.emit("syncProgress", accountId, `sync:${folder.path}`, 100);
+        const syncedAt = Date.now();
         // Notify client to refresh if anything changed
         if (newCount > 0 || deletedCount > 0) {
             const updatedFolder = this.db.getFolders(accountId).find(f => f.id === folderId);
@@ -765,7 +771,8 @@ export class ImapManager extends EventEmitter {
                 [folderId]: { total: updatedFolder?.totalCount || 0, unread: updatedFolder?.unreadCount || 0 }
             });
         }
-        this.db.updateLastSync(accountId, Date.now());
+        this.emit("folderSynced", accountId, folderId, syncedAt);
+        this.db.updateLastSync(accountId, syncedAt);
         return newCount;
     }
     /** Sync all folders for all accounts */
@@ -1014,6 +1021,7 @@ export class ImapManager extends EventEmitter {
         }
         this.db.recalcFolderCounts(folder.id);
         this.emit("folderCountsChanged", accountId, {});
+        this.emit("folderSynced", accountId, folder.id, Date.now());
         this.emit("syncProgress", accountId, `sync:${folder.path}`, 100);
     }
     /** Store API-fetched messages to DB */
@@ -1139,39 +1147,61 @@ export class ImapManager extends EventEmitter {
             this.inboxSyncing = false;
         }
     }
-    /** Quick inbox check — uses IMAP STATUS (single command, no mailbox open).
-     *  If message count changed, triggers inbox sync for that account. */
-    lastInboxCounts = new Map();
+    /** Quick inbox check — per-account lightweight probe.
+     *  If the probe value changed since last time, triggers an inbox sync.
+     *  The marker is only advanced after a successful sync so that a failed
+     *  sync doesn't eat the "new mail" signal and make us stop retrying. */
+    lastInboxMarker = new Map();
     quickCheckRunning = new Set(); // per-account guard
-    /** Check a single account's inbox — uses its own connection, never blocked by sync */
-    async quickInboxCheckAccount(accountId) {
+    /** Shared quick-check skeleton: probe → compare → sync-if-changed → advance marker.
+     *  `probe` returns the current marker value; `sync` runs only when it differs
+     *  from the previously stored value. Marker is advanced only after sync resolves. */
+    async quickCheck(accountId, probe, sync) {
         if (this.quickCheckRunning.has(accountId))
             return;
         if (this.reauthenticating.has(accountId))
             return;
-        if (this.isGmailAccount(accountId)) {
-            return this.quickGmailCheck(accountId);
-        }
         this.quickCheckRunning.add(accountId);
-        let client = null;
         try {
-            const inbox = this.db.getFolders(accountId).find(f => f.specialUse === "inbox");
-            if (!inbox)
+            const current = await probe();
+            if (current === null || current === "")
                 return;
-            client = this.newClient(accountId);
-            const count = await client.getMessagesCount("INBOX");
-            const prev = this.lastInboxCounts.get(accountId) ?? count;
-            this.lastInboxCounts.set(accountId, count);
-            if (count !== prev) {
-                console.log(`  [check] ${accountId} INBOX: ${prev} → ${count}`);
-                await this.syncFolder(accountId, inbox.id, client);
+            const prev = this.lastInboxMarker.get(accountId);
+            if (prev === undefined || current !== prev) {
+                await sync(current, prev);
             }
-            await client.logout();
-            client = null;
+            // Only advance after sync succeeds — a thrown error skips this line
+            // and the next tick will see the same delta and retry.
+            this.lastInboxMarker.set(accountId, current);
         }
         catch {
             // Lightweight check — silently ignore errors
         }
+        finally {
+            this.quickCheckRunning.delete(accountId);
+        }
+    }
+    /** Check a single account's inbox — uses its own connection, never blocked by sync */
+    async quickInboxCheckAccount(accountId) {
+        if (this.isGmailAccount(accountId))
+            return this.quickGmailCheck(accountId);
+        return this.quickImapCheck(accountId);
+    }
+    async quickImapCheck(accountId) {
+        const inbox = this.db.getFolders(accountId).find(f => f.specialUse === "inbox");
+        if (!inbox)
+            return;
+        let client = null;
+        try {
+            await this.quickCheck(accountId, async () => {
+                client = this.newClient(accountId);
+                return await client.getMessagesCount("INBOX");
+            }, async (count, prev) => {
+                if (prev !== undefined)
+                    console.log(`  [check] ${accountId} INBOX: ${prev} → ${count}`);
+                await this.syncFolder(accountId, inbox.id, client);
+            });
+        }
         finally {
             if (client) {
                 try {
@@ -1179,44 +1209,31 @@ export class ImapManager extends EventEmitter {
                 }
                 catch { /* */ }
             }
-            this.quickCheckRunning.delete(accountId);
         }
     }
-    /** Quick Gmail inbox check — one lightweight API call to check for new messages */
-    lastGmailInboxTop = new Map();
     async quickGmailCheck(accountId) {
-        if (this.quickCheckRunning.has(accountId))
+        const config = this.configs.get(accountId);
+        if (!config?.tokenProvider)
             return;
-        this.quickCheckRunning.add(accountId);
-        try {
-            const config = this.configs.get(accountId);
-            if (!config?.tokenProvider)
-                return;
+        const inbox = this.db.getFolders(accountId).find(f => f.specialUse === "inbox");
+        if (!inbox)
+            return;
+        await this.quickCheck(accountId, async () => {
             const token = await config.tokenProvider();
-            // Single API call: get just the first message ID
             const res = await globalThis.fetch(`https://gmail.googleapis.com/gmail/v1/users/me/messages?q=in:inbox&maxResults=1`, { headers: { "Authorization": `Bearer ${token}` } });
             if (!res.ok)
-                return;
+                return null;
             const data = await res.json();
-            const topId = data.messages?.[0]?.id || "";
-            const prev = this.lastGmailInboxTop.get(accountId) ?? topId;
-            this.lastGmailInboxTop.set(accountId, topId);
-            if (topId && topId !== prev) {
+            return data.messages?.[0]?.id || null;
+        }, async (_topId, prev) => {
+            if (prev !== undefined)
                 console.log(`  [check] ${accountId} INBOX: new message detected`);
-                const inbox = this.db.getFolders(accountId).find(f => f.specialUse === "inbox");
-                if (inbox) {
-                    const api = this.getGmailProvider(accountId);
-                    await this.syncFolderViaApi(accountId, inbox, api);
-                    this.db.recalcFolderCounts(inbox.id);
-                    this.emit("folderCountsChanged", accountId, {});
-                    await api.close();
-                }
-            }
-        }
-        catch { /* lightweight — ignore errors */ }
-        finally {
-            this.quickCheckRunning.delete(accountId);
-        }
+            const api = this.getGmailProvider(accountId);
+            await this.syncFolderViaApi(accountId, inbox, api);
+            this.db.recalcFolderCounts(inbox.id);
+            this.emit("folderCountsChanged", accountId, {});
+            await api.close();
+        });
     }
     /** Check all accounts (used by legacy callers) */
     async quickInboxCheck() {
@@ -1968,6 +1985,37 @@ export class ImapManager extends EventEmitter {
     async processLocalQueue(accountId) {
         const outboxDir = path.join(getConfigDir(), "outbox", accountId);
         const queuedDir = path.join(getConfigDir(), "sending", accountId, "queued");
+        // Recovery sweep: any *.sending-<host>-<pid> on THIS host whose PID is
+        // dead (process crashed mid-send) gets unclaimed so the next tick can
+        // retry. Foreign hosts are left alone — we have no way to know if their
+        // process is alive. Cross-host stale recovery is the IMAP-folder path's
+        // job (sweeper looks at server-side claim flags, not local files).
+        for (const dir of [outboxDir, queuedDir]) {
+            if (!fs.existsSync(dir))
+                continue;
+            for (const f of fs.readdirSync(dir)) {
+                const m = f.match(/^(.+)\.sending-([^-]+)-(\d+)$/);
+                if (!m)
+                    continue;
+                const [, original, host, pidStr] = m;
+                if (host !== this.hostname)
+                    continue;
+                const pid = parseInt(pidStr);
+                let alive = false;
+                try {
+                    process.kill(pid, 0);
+                    alive = true;
+                }
+                catch { /* dead */ }
+                if (alive)
+                    continue; // live claim — owner (sibling or self) still has it
+                try {
+                    fs.renameSync(path.join(dir, f), path.join(dir, original));
+                    console.log(`  [outbox] Recovered stale claim ${f} → ${original}`);
+                }
+                catch { /* ignore */ }
+            }
+        }
         const filesToSend = [];
         for (const dir of [outboxDir, queuedDir]) {
             if (!fs.existsSync(dir))
@@ -1985,32 +2033,57 @@ export class ImapManager extends EventEmitter {
             const nowMs = Date.now();
             for (const { dir, file } of filesToSend) {
                 const filePath = path.join(dir, file);
-                let raw = fs.readFileSync(filePath, "utf-8");
+                // Atomic claim: rename to <file>.sending-<host>-<pid> so a sibling
+                // process scanning the same dir can't grab the same .ltr. Filesystem
+                // rename is atomic; loser sees ENOENT and skips. Without this, two
+                // mailx instances on one machine (or two ticks within one process)
+                // could both pass the Message-ID dedup check and both call SMTP.
+                const claimSuffix = `.sending-${this.hostname}-${process.pid}`;
+                const claimedPath = filePath + claimSuffix;
+                try {
+                    fs.renameSync(filePath, claimedPath);
+                }
+                catch (e) {
+                    if (e.code === "ENOENT")
+                        continue; // another process won
+                    throw e;
+                }
+                let raw = fs.readFileSync(claimedPath, "utf-8");
                 // Per-message rate limit: if a prior attempt set X-Mailx-Retry-After
                 // in the future, skip this file for now. Minimizes the race where the
                 // SMTP server actually accepted DATA but we lost the ack and would
                 // otherwise retry immediately on the next 10s tick.
                 const retryInfo = parseRetryInfo(raw);
-                if (retryInfo.nextAttemptAt > nowMs)
+                if (retryInfo.nextAttemptAt > nowMs) {
+                    // Release claim — let next tick reconsider
+                    try {
+                        fs.renameSync(claimedPath, filePath);
+                    }
+                    catch { /* ignore */ }
                     continue;
+                }
                 // Record this attempt: strip internal X-Mailx-Retry-After, append a new
                 // X-Mailx-Retry: N <ISO-timestamp> line to the headers. The updated file
                 // is written back *before* the send so a crash mid-send doesn't lose state.
                 const attempt = retryInfo.attemptCount + 1;
                 raw = stripHeaderField(raw, "X-Mailx-Retry-After");
                 raw = insertHeaderBeforeBody(raw, `X-Mailx-Retry: ${attempt} ${new Date().toISOString()}`);
-                fs.writeFileSync(filePath, raw, "utf-8");
+                fs.writeFileSync(claimedPath, raw, "utf-8");
                 try {
                     await this.sendRawViaSMTP(accountId, raw);
-                    fs.renameSync(filePath, path.join(sentDir, file));
+                    fs.renameSync(claimedPath, path.join(sentDir, file));
                     console.log(`  [outbox] Sent ${file} via SMTP → sent/ (attempt ${attempt})`);
                 }
                 catch (e) {
-                    // Persist a next-attempt timestamp so the same file won't be retried
-                    // until RETRY_DELAY_MS later — gives the server time to settle.
+                    // Persist a next-attempt timestamp and release the claim so the
+                    // file is visible to the scan loop again.
                     const nextAt = new Date(nowMs + OUTBOX_RETRY_DELAY_MS).toISOString();
                     const withDelay = insertHeaderBeforeBody(raw, `X-Mailx-Retry-After: ${nextAt}`);
-                    fs.writeFileSync(filePath, withDelay, "utf-8");
+                    fs.writeFileSync(claimedPath, withDelay, "utf-8");
+                    try {
+                        fs.renameSync(claimedPath, filePath);
+                    }
+                    catch { /* file stays claimed; recovery sweeper will handle */ }
                     console.error(`  [outbox] Send failed for ${file} (attempt ${attempt}, retry after ${nextAt}): ${e.message}`);
                 }
             }
@@ -2041,36 +2114,34 @@ export class ImapManager extends EventEmitter {
             // IMAP still unreachable — leave files for next attempt
         }
     }
-    /** Send a raw RFC 2822 message via SMTP for a given account */
+    /** Send a raw RFC 2822 message via SMTP for a given account.
+     *  Uses @bobfrankston/smtp-direct with the same TransportFactory as IMAP —
+     *  same TCP byte-stream interface, no nodemailer dependency. */
     async sendRawViaSMTP(accountId, raw) {
         const settings = loadSettings();
         const account = settings.accounts.find(a => a.id === accountId);
         if (!account?.smtp)
             throw new Error(`No SMTP config for ${accountId}`);
-        // SMTP auth: use explicit SMTP credentials, fall back to IMAP credentials
-        let smtpAuth;
+        const smtpPort = account.smtp.port || SMTP_PORT_STARTTLS;
+        const smtpHost = account.smtp.host || account.imap?.host;
+        if (!smtpHost)
+            throw new Error(`No SMTP host for ${accountId}`);
+        // SMTP auth: explicit SMTP creds, fall back to IMAP creds for password auth.
         const smtpAuthType = account.smtp.auth || (account.imap?.password ? "password" : undefined);
+        const smtpUser = account.smtp.user || account.imap?.user || account.email;
+        let auth;
         if (smtpAuthType === "password") {
-            smtpAuth = {
-                user: account.smtp.user || account.imap?.user || account.email,
-                pass: account.smtp.password || account.imap?.password,
-            };
+            const pass = account.smtp.password || account.imap?.password;
+            if (!pass)
+                throw new Error("SMTP password not configured");
+            auth = { method: "PLAIN", user: smtpUser, pass };
         }
         else if (smtpAuthType === "oauth2") {
-            const accessToken = await this.getOAuthToken(accountId);
-            if (!accessToken)
+            const token = await this.getOAuthToken(accountId);
+            if (!token)
                 throw new Error("OAuth token not available");
-            smtpAuth = { type: "OAuth2", user: account.smtp.user || account.imap?.user || account.email, accessToken };
+            auth = { method: "XOAUTH2", user: smtpUser, token };
         }
-        const { createTransport } = await import("nodemailer");
-        const smtpPort = account.smtp.port || SMTP_PORT_STARTTLS;
-        const transport = createTransport({
-            host: account.smtp.host || account.imap?.host,
-            port: smtpPort,
-            secure: smtpPort === SMTP_PORT_IMPLICIT_TLS, // 465 = implicit TLS, 587 = STARTTLS
-            auth: smtpAuth,
-            tls: { rejectUnauthorized: false },
-        });
         const parseAddrs = (s) => s.match(/[\w.+-]+@[\w.-]+/g) || [];
         const toMatch = raw.match(/^To:\s*(.+)$/mi);
         const ccMatch = raw.match(/^Cc:\s*(.+)$/mi);
@@ -2088,17 +2159,33 @@ export class ImapManager extends EventEmitter {
             throw new Error("No recipients");
         // Dedup: skip if this Message-ID has already been sent. Prevents the
         // outbox from re-sending the same file across crash/restart cycles.
-        // Without this, a queued .ltr that was mid-delivery when mailx crashed
-        // would be re-sent on every startup until the rename loop completed.
         const messageId = messageIdMatch ? messageIdMatch[1] : "";
         if (messageId && this.db.hasSentMessage(messageId)) {
             console.log(`  [smtp] ${accountId}: SKIP ${messageId} — already in sent_log`);
-            return; // caller will move the file to sent/ without re-sending
+            return;
         }
         const rawToSend = raw.replace(/^Bcc:.*\r?\n/mi, "");
         this.saveSendingCopy(accountId, rawToSend, "sent");
-        await transport.sendMail({ envelope: { from: sender, to: recipients }, raw: rawToSend });
-        // Record the successful send so future attempts dedupe against it.
+        const smtp = new SmtpClient({
+            host: smtpHost,
+            port: smtpPort,
+            secure: smtpPort === SMTP_PORT_IMPLICIT_TLS,
+            auth,
+            localname: os.hostname(),
+        }, this.transportFactory);
+        try {
+            await smtp.connect();
+            const result = await smtp.sendMail({ from: sender, to: recipients }, rawToSend);
+            if (result.rejected.length > 0) {
+                console.log(`  [smtp] ${accountId}: ${result.rejected.length} recipient(s) rejected: ${result.rejected.map(r => `${r.address} (${r.code})`).join(", ")}`);
+            }
+        }
+        finally {
+            try {
+                await smtp.quit();
+            }
+            catch { /* ignore */ }
+        }
         if (messageId) {
             this.db.recordSent(messageId, accountId, subjectMatch?.[1]?.trim() || "", recipients);
         }
@@ -2130,21 +2217,54 @@ export class ImapManager extends EventEmitter {
                 catch { }
                 return;
             }
-            const sendingFlag = `$Sending-${this.hostname}`;
+            // Stale-claim recovery: if a peer (or our prior incarnation) crashed
+            // mid-send, the $Sending-<host>-<ts> flag would otherwise pin the
+            // message forever. Sweep flags older than STALE_CLAIM_MS first.
+            const STALE_CLAIM_MS = 3600_000; // 1 hour — far longer than any reasonable SMTP send
+            const nowSec = Math.floor(Date.now() / 1000);
+            // Encode our claim with a seconds-since-epoch timestamp so peers
+            // (and our own restart sweeper) can identify stale entries.
+            const sendingFlag = `$Sending-${this.hostname}-${nowSec}`;
             for (const uid of uids) {
                 // Check flags — skip if already being sent or permanently failed
                 const flags = await client.getFlags(outboxFolder.path, uid);
-                if (flags.some((f) => f.startsWith("$Sending")))
+                // Sweep stale claims. New form: $Sending-<host>-<sec>. Old form
+                // ($Sending-<host>, no timestamp) is treated as stale on first
+                // encounter — safe because if its owner is alive, it'll re-claim
+                // with a fresh timestamped flag on its next tick.
+                const claimFlags = flags.filter((f) => f.startsWith("$Sending"));
+                for (const cf of claimFlags) {
+                    const m = cf.match(/^\$Sending-(.+?)(?:-(\d+))?$/);
+                    if (!m)
+                        continue;
+                    const tsSec = m[2] ? parseInt(m[2]) : 0;
+                    const ageSec = nowSec - tsSec;
+                    if (ageSec * 1000 > STALE_CLAIM_MS) {
+                        try {
+                            await client.removeFlags(outboxFolder.path, uid, [cf]);
+                            console.log(`  [outbox] Swept stale claim ${cf} on UID ${uid} (age ${Math.round(ageSec / 60)}m)`);
+                        }
+                        catch { /* ignore */ }
+                    }
+                }
+                // Re-read flags after sweep
+                const flagsNow = (claimFlags.length > 0)
+                    ? await client.getFlags(outboxFolder.path, uid)
+                    : flags;
+                if (flagsNow.some((f) => f.startsWith("$Sending")))
                     continue;
-                if (flags.includes("$PermanentFailure"))
+                if (flagsNow.includes("$PermanentFailure"))
                     continue;
-                if (flags.includes("$Failed")) {
+                if (flagsNow.includes("$Failed")) {
                     // Retry: remove failed flag
                     await client.removeFlags(outboxFolder.path, uid, ["$Failed"]);
                 }
                 // Claim this message
                 await client.addFlags(outboxFolder.path, uid, [sendingFlag]);
-                // Re-check — did we win the race?
+                // Re-check — did we win the race? (TOCTOU window: two devices
+                // both reaching addFlags concurrently both see ≥2 sending flags
+                // and both back off — fails safe; nobody sends this tick, next
+                // tick one wins.)
                 const flagsAfter = await client.getFlags(outboxFolder.path, uid);
                 const sendingFlags = flagsAfter.filter((f) => f.startsWith("$Sending"));
                 if (sendingFlags.length > 1 || (sendingFlags.length === 1 && sendingFlags[0] !== sendingFlag)) {

package/packages/mailx-imap/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bobfrankston/mailx-imap",
-  "version": "0.1.4",
+  "version": "0.1.5",
   "type": "module",
   "main": "index.js",
   "types": "index.d.ts",
@@ -13,8 +13,9 @@
     "@bobfrankston/mailx-settings": "file:../mailx-settings",
     "@bobfrankston/mailx-store": "file:../mailx-store",
     "@bobfrankston/iflow-direct": "file:../../../MailApps/iflow-direct",
-    "@bobfrankston/oauthsupport": "file:../../../../projects/oauth/oauthsupport",
-    "nodemailer": "^7.0.0"
+    "@bobfrankston/tcp-transport": "file:../../../MailApps/tcp-transport",
+    "@bobfrankston/smtp-direct": "file:../../../MailApps/smtp-direct",
+    "@bobfrankston/oauthsupport": "file:../../../../projects/oauth/oauthsupport"
   },
   "repository": {
     "type": "git",

package/packages/mailx-imap/providers/gmail-api.js

@@ -45,7 +45,11 @@ export class GmailApiProvider {
     }
     async fetch(path, options = {}) {
         const token = await this.tokenProvider();
-        for (let attempt = 0; attempt < 3; attempt++) {
+        const maxAttempts = 6;
+        const baseDelayMs = 1000;
+        const maxDelayMs = 60_000;
+        let lastStatus = 0;
+        for (let attempt = 0; attempt < maxAttempts; attempt++) {
             const res = await globalThis.fetch(`${API}${path}`, {
                 ...options,
                 headers: {
@@ -55,9 +59,24 @@ export class GmailApiProvider {
                 },
             });
             if (res.status === 429 || res.status >= 500) {
-                // Rate limited or server error — back off and retry
-                const delay = (attempt + 1) * 2000;
-                console.log(`  [gmail] ${res.status} error, waiting ${delay / 1000}s...`);
+                lastStatus = res.status;
+                // Honor Retry-After if present (seconds or HTTP-date)
+                const retryAfter = res.headers.get("Retry-After");
+                let delay = baseDelayMs * Math.pow(2, attempt);
+                if (retryAfter) {
+                    const asInt = parseInt(retryAfter, 10);
+                    if (!isNaN(asInt))
+                        delay = asInt * 1000;
+                    else {
+                        const when = Date.parse(retryAfter);
+                        if (!isNaN(when))
+                            delay = Math.max(0, when - Date.now());
+                    }
+                }
+                // Full jitter to avoid synchronized retries
+                delay = Math.min(maxDelayMs, delay);
+                delay = Math.floor(delay * (0.5 + Math.random() * 0.5));
+                console.log(`  [gmail] ${res.status} (attempt ${attempt + 1}/${maxAttempts}), waiting ${(delay / 1000).toFixed(1)}s${retryAfter ? ` (Retry-After: ${retryAfter})` : ""}...`);
                 await new Promise(r => setTimeout(r, delay));
                 continue;
             }
@@ -67,7 +86,7 @@ export class GmailApiProvider {
             }
             return res.json();
         }
-        throw new Error("Gmail API: failed after 3 retries");
+        throw new Error(`Gmail API: failed after ${maxAttempts} retries (last status ${lastStatus})`);
     }
     async listFolders() {
         const data = await this.fetch("/labels");

package/packages/mailx-server/index.js

@@ -230,6 +230,9 @@ imapManager.on("syncProgress", (accountId, phase, progress) => {
 imapManager.on("folderCountsChanged", (accountId, counts) => {
     broadcast({ type: "folderCountsChanged", accountId, counts });
 });
+imapManager.on("folderSynced", (accountId, folderId, syncedAt) => {
+    broadcast({ type: "folderSynced", accountId, entries: [{ folderId, syncedAt }] });
+});
 imapManager.on("syncError", (accountId, error) => {
     broadcast({ type: "error", message: `${accountId}: ${error}` });
 });

package/packages/mailx-store/db.js

@@ -59,8 +59,10 @@ const SCHEMA = `
     CREATE INDEX IF NOT EXISTS idx_messages_message_id
         ON messages(message_id);
 
-    CREATE INDEX IF NOT EXISTS idx_messages_thread_id
-        ON messages(account_id, thread_id);
+    -- Note: idx_messages_thread_id is created by the addColumnIfMissing migration
+    -- in the constructor, AFTER thread_id is guaranteed to exist. Including it
+    -- here would crash startup on any pre-thread_id DB because exec(SCHEMA) runs
+    -- before the column-add migration.
 
     CREATE TABLE IF NOT EXISTS sent_log (
         message_id TEXT PRIMARY KEY,

package/packages/mailx-store/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bobfrankston/mailx-store",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "type": "module",
   "main": "index.js",
   "types": "index.d.ts",