@bobfrankston/mailx 1.0.253 → 1.0.256

package/client/.msger-window.json

@@ -1 +1 @@
-{"height":1344,"width":2151,"x":380,"y":73}
+{"height":1344,"width":2151,"x":616,"y":113}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bobfrankston/mailx",
-  "version": "1.0.253",
+  "version": "1.0.256",
   "description": "Local-first email client with IMAP sync and standalone native app",
   "type": "module",
   "main": "bin/mailx.js",
@@ -20,11 +20,11 @@
     "postinstall": "node bin/postinstall.js"
   },
   "dependencies": {
-    "@bobfrankston/iflow-direct": "^0.1.15",
+    "@bobfrankston/iflow-direct": "^0.1.16",
     "@bobfrankston/iflow-node": "^0.1.5",
     "@bobfrankston/miscinfo": "^1.0.8",
-    "@bobfrankston/oauthsupport": "^1.0.23",
-    "@bobfrankston/msger": "^0.1.314",
+    "@bobfrankston/oauthsupport": "^1.0.24",
+    "@bobfrankston/msger": "^0.1.315",
     "@capacitor/android": "^8.3.0",
     "@capacitor/cli": "^8.3.0",
     "@capacitor/core": "^8.3.0",
@@ -80,11 +80,11 @@
   },
   ".transformedSnapshot": {
     "dependencies": {
-      "@bobfrankston/iflow-direct": "^0.1.15",
+      "@bobfrankston/iflow-direct": "^0.1.16",
       "@bobfrankston/iflow-node": "^0.1.5",
       "@bobfrankston/miscinfo": "^1.0.8",
-      "@bobfrankston/oauthsupport": "^1.0.23",
-      "@bobfrankston/msger": "^0.1.314",
+      "@bobfrankston/oauthsupport": "^1.0.24",
+      "@bobfrankston/msger": "^0.1.315",
       "@capacitor/android": "^8.3.0",
       "@capacitor/cli": "^8.3.0",
       "@capacitor/core": "^8.3.0",

package/packages/mailx-imap/index.js

@@ -1444,76 +1444,196 @@ export class ImapManager extends EventEmitter {
      *  auth, rate limits) count against the error budget, and the budget is
      *  generous so a few transient failures don't kill the whole run. */
     async prefetchBodies(accountId) {
-        let totalFetched = 0;
-        let deleted = 0;
-        let errors = 0;
-        let rateLimited = false;
+        const counters = { totalFetched: 0, deleted: 0, errors: 0 };
         const ERROR_BUDGET = 20;
-        // Pace body fetches to avoid slamming Gmail's rate limit. Without a
-        // delay, 500+ body-fetch API calls fire in a burst, every one hits 429,
-        // and the error budget drains before any bodies land.
-        const FETCH_DELAY_MS = this.isGmailAccount(accountId) ? 1000 : 200;
         const RATE_LIMIT_PAUSE_MS = 30000;
+        const BATCH_SIZE = 100;
+        const isGmail = this.isGmailAccount(accountId);
+        // Gmail still uses per-message fetch (HTTP /batch is a separate TODO in this file's
+        // governing unit). IMAP uses the batched `fetchBodiesBatch` path via iflow-direct —
+        // one SELECT + one UID FETCH per folder per tick instead of N round trips.
+        let announced = false;
         while (true) {
-            const missing = this.db.getMessagesWithoutBody(accountId, 100);
+            const missing = this.db.getMessagesWithoutBody(accountId, BATCH_SIZE);
             if (missing.length === 0)
                 break;
-            if (totalFetched === 0 && deleted === 0)
+            if (!announced) {
                 console.log(`  [prefetch] ${accountId}: ${missing.length}+ bodies to fetch`);
+                announced = true;
+            }
             let madeProgress = false;
-            for (const msg of missing) {
-                // If we hit a rate limit, pause before the next fetch
-                if (rateLimited) {
-                    console.log(`  [prefetch] ${accountId}: rate-limited — pausing ${RATE_LIMIT_PAUSE_MS / 1000}s`);
-                    await new Promise(r => setTimeout(r, RATE_LIMIT_PAUSE_MS));
-                    rateLimited = false;
+            if (isGmail) {
+                // Gmail batch path: group by label (what mailx calls "folder"),
+                // list once per label, bounded-concurrency fetch. Far fewer
+                // HTTP round trips than the old one-listMessageIds-per-body path.
+                // Note on the model: Gmail has labels, not folders. A message in
+                // multiple labels gets fetched twice under current grouping. A
+                // deeper label-native redesign is tracked as a separate TODO.
+                const byFolder = new Map();
+                for (const m of missing) {
+                    let arr = byFolder.get(m.folderId);
+                    if (!arr) {
+                        arr = [];
+                        byFolder.set(m.folderId, arr);
+                    }
+                    arr.push(m.uid);
+                }
+                const folders = this.db.getFolders(accountId);
+                const api = this.getGmailProvider(accountId);
+                try {
+                    for (const [folderId, uidsInFolder] of byFolder) {
+                        const folder = folders.find(f => f.id === folderId);
+                        if (!folder)
+                            continue;
+                        const received = new Set();
+                        const pending = [];
+                        try {
+                            await api.fetchBodiesBatch(folder.path, uidsInFolder, (uid, source) => {
+                                received.add(uid);
+                                pending.push((async () => {
+                                    try {
+                                        const raw = Buffer.from(source, "utf-8");
+                                        const bodyPath = await this.bodyStore.putMessage(accountId, folderId, uid, raw);
+                                        this.db.updateBodyPath(accountId, uid, bodyPath);
+                                        counters.totalFetched++;
+                                        madeProgress = true;
+                                    }
+                                    catch (e) {
+                                        console.error(`  [prefetch] ${accountId}/${uid}: store write failed: ${e.message}`);
+                                    }
+                                })());
+                            });
+                        }
+                        catch (e) {
+                            const isRate = /429|rate|too many/i.test(String(e?.message || ""));
+                            if (isRate) {
+                                console.log(`  [prefetch] ${accountId}: rate-limited — pausing ${RATE_LIMIT_PAUSE_MS / 1000}s`);
+                                await new Promise(r => setTimeout(r, RATE_LIMIT_PAUSE_MS));
+                            }
+                            else {
+                                console.error(`  [prefetch] ${accountId} folder ${folder.path}: Gmail batch fetch failed: ${e.message}`);
+                                counters.errors++;
+                            }
+                        }
+                        await Promise.all(pending);
+                        // UIDs we asked for but didn't receive are either gone
+                        // server-side OR aren't in this label (can happen if the
+                        // folder DB row was mis-labeled). Drop them so the loop
+                        // moves forward instead of spinning.
+                        for (const uid of uidsInFolder) {
+                            if (received.has(uid))
+                                continue;
+                            try {
+                                this.db.deleteMessage(accountId, uid);
+                                this.bodyStore.deleteMessage(accountId, folderId, uid).catch(() => { });
+                                counters.deleted++;
+                                madeProgress = true;
+                            }
+                            catch { /* ignore */ }
+                        }
+                        if (counters.errors >= ERROR_BUDGET)
+                            break;
+                    }
+                }
+                finally {
+                    try {
+                        await api.close();
+                    }
+                    catch { /* ignore */ }
                 }
-                else if (FETCH_DELAY_MS > 0) {
-                    await new Promise(r => setTimeout(r, FETCH_DELAY_MS));
+                if (counters.errors >= ERROR_BUDGET) {
+                    console.error(`  [prefetch] ${accountId}: stopping after ${counters.errors} errors (${counters.totalFetched} cached, ${counters.deleted} pruned)`);
+                    return;
                 }
+            }
+            else {
+                // IMAP batch path: group by folder, one UID FETCH per folder.
+                const byFolder = new Map();
+                for (const m of missing) {
+                    let arr = byFolder.get(m.folderId);
+                    if (!arr) {
+                        arr = [];
+                        byFolder.set(m.folderId, arr);
+                    }
+                    arr.push(m.uid);
+                }
+                const folders = this.db.getFolders(accountId);
+                let client = null;
                 try {
-                    const result = await this.fetchMessageBody(accountId, msg.folderId, msg.uid);
-                    if (result) {
-                        totalFetched++;
-                        madeProgress = true;
+                    client = await this.createClientWithLimit(accountId);
+                    for (const [folderId, uids] of byFolder) {
+                        const folder = folders.find(f => f.id === folderId);
+                        if (!folder)
+                            continue;
+                        const received = new Set();
+                        // onBody fires synchronously as each message streams in from the server.
+                        // Disk/DB writes are kicked off fire-and-forget; we await them after the
+                        // batch command finishes. This keeps streaming throughput high while
+                        // still giving us a single await point for progress accounting.
+                        const pending = [];
+                        try {
+                            await client.fetchBodiesBatch(folder.path, uids, (uid, source) => {
+                                received.add(uid);
+                                pending.push((async () => {
+                                    try {
+                                        const raw = Buffer.from(source, "utf-8");
+                                        const bodyPath = await this.bodyStore.putMessage(accountId, folderId, uid, raw);
+                                        this.db.updateBodyPath(accountId, uid, bodyPath);
+                                        counters.totalFetched++;
+                                        madeProgress = true;
+                                    }
+                                    catch (e) {
+                                        // EBUSY / disk error — non-fatal per message
+                                        console.error(`  [prefetch] ${accountId}/${uid}: store write failed: ${e.message}`);
+                                    }
+                                })());
+                            });
+                        }
+                        catch (e) {
+                            console.error(`  [prefetch] ${accountId} folder ${folder.path}: batch fetch failed: ${e.message}`);
+                            counters.errors++;
+                            if (counters.errors >= ERROR_BUDGET)
+                                break;
+                        }
+                        await Promise.all(pending);
+                        // UIDs we asked for but didn't receive were deleted server-side.
+                        // Drop their stale DB rows so they stop coming back next batch.
+                        for (const uid of uids) {
+                            if (received.has(uid))
+                                continue;
+                            try {
+                                this.db.deleteMessage(accountId, uid);
+                                this.bodyStore.deleteMessage(accountId, folderId, uid).catch(() => { });
+                                counters.deleted++;
+                                madeProgress = true;
+                            }
+                            catch { /* ignore */ }
+                        }
                     }
                 }
-                catch (e) {
-                    if (e?.isNotFound) {
-                        // Message deleted on the server — drop the stale row so
-                        // we stop re-asking. This also moves the loop forward
-                        // (next getMessagesWithoutBody call won't return it).
+                finally {
+                    if (client) {
                         try {
-                            this.db.deleteMessage(accountId, msg.uid);
-                            this.bodyStore.deleteMessage(accountId, msg.folderId, msg.uid).catch(() => { });
-                            deleted++;
-                            madeProgress = true;
+                            await client.logout();
                         }
                         catch { /* ignore */ }
-                        continue;
-                    }
-                    // If the error is a rate limit (429), don't count against
-                    // the budget — just slow down. The API will accept requests
-                    // again after a brief pause.
-                    if (/429|rate|too many/i.test(String(e?.message || ""))) {
-                        rateLimited = true;
-                    }
-                    else {
-                        errors++;
-                    }
-                    if (errors >= ERROR_BUDGET) {
-                        console.error(`  [prefetch] ${accountId}: stopping after ${errors} errors (${totalFetched} cached, ${deleted} pruned)`);
-                        return;
                     }
                 }
+                if (counters.errors >= ERROR_BUDGET) {
+                    console.error(`  [prefetch] ${accountId}: stopping after ${counters.errors} errors (${counters.totalFetched} cached, ${counters.deleted} pruned)`);
+                    return;
+                }
             }
-            // Safety: if we made zero progress this iteration, bail — otherwise
-            // we'd loop forever on rows that keep failing without isNotFound.
+            // Safety: zero progress this tick → bail rather than loop forever.
             if (!madeProgress)
                 break;
+            // Emit so the UI refreshes the open-circle → filled-teal indicator
+            // without waiting for the next sync cycle.
+            this.emit("folderCountsChanged", accountId, {});
         }
-        if (totalFetched > 0 || deleted > 0) {
-            console.log(`  [prefetch] ${accountId}: ${totalFetched} bodies cached, ${deleted} stale rows pruned (done)`);
+        if (counters.totalFetched > 0 || counters.deleted > 0) {
+            console.log(`  [prefetch] ${accountId}: ${counters.totalFetched} bodies cached, ${counters.deleted} stale rows pruned (done)`);
+            this.emit("folderCountsChanged", accountId, {});
         }
     }
     /** Get the body store for direct access */

package/packages/mailx-imap/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bobfrankston/mailx-imap",
-  "version": "0.1.5",
+  "version": "0.1.7",
   "type": "module",
   "main": "index.js",
   "types": "index.d.ts",

package/packages/mailx-imap/providers/gmail-api.d.ts

@@ -21,6 +21,17 @@ export declare class GmailApiProvider implements MailProvider {
     fetchSince(folder: string, sinceUid: number, options?: FetchOptions): Promise<ProviderMessage[]>;
     fetchByDate(folder: string, since: Date, before: Date, options?: FetchOptions, onChunk?: (msgs: ProviderMessage[]) => void): Promise<ProviderMessage[]>;
     fetchByUids(folder: string, uids: number[], options?: FetchOptions): Promise<ProviderMessage[]>;
+    /** Bulk-fetch raw bodies for many UIDs in one "folder" (Gmail label).
+     *  Lists the label once, builds UID→ID map, then streams bodies through
+     *  `onBody` with bounded concurrency (lets Gmail's HTTP/2 stream multiplex;
+     *  `fetch()`'s built-in 429/5xx retry handles backoff automatically).
+     *
+     *  NOTE: Gmail's model is labels, not folders — a single message can be in
+     *  many labels. Treating each label as a folder causes duplicate fetches
+     *  across labels. Proper fix tracked as separate TODO ("Gmail label-native
+     *  model"). For now we mirror the IMAP folder grouping, accepting duplicate
+     *  fetches of multi-labeled messages. */
+    fetchBodiesBatch(folder: string, uids: number[], onBody: (uid: number, source: string) => void): Promise<void>;
     fetchOne(folder: string, uid: number, options?: FetchOptions): Promise<ProviderMessage | null>;
     getUids(folder: string): Promise<number[]>;
     close(): Promise<void>;

package/packages/mailx-imap/providers/gmail-api.js

@@ -234,6 +234,56 @@ export class GmailApiProvider {
         const matchingIds = ids.filter(id => uidSet.has(idToUid(id)));
         return this.batchFetch(matchingIds, options);
     }
+    /** Bulk-fetch raw bodies for many UIDs in one "folder" (Gmail label).
+     *  Lists the label once, builds UID→ID map, then streams bodies through
+     *  `onBody` with bounded concurrency (lets Gmail's HTTP/2 stream multiplex;
+     *  `fetch()`'s built-in 429/5xx retry handles backoff automatically).
+     *
+     *  NOTE: Gmail's model is labels, not folders — a single message can be in
+     *  many labels. Treating each label as a folder causes duplicate fetches
+     *  across labels. Proper fix tracked as separate TODO ("Gmail label-native
+     *  model"). For now we mirror the IMAP folder grouping, accepting duplicate
+     *  fetches of multi-labeled messages. */
+    async fetchBodiesBatch(folder, uids, onBody) {
+        if (uids.length === 0)
+            return;
+        const query = `in:${this.folderToLabel(folder)}`;
+        const ids = await this.listMessageIds(query, 10000);
+        const uidToId = new Map();
+        for (const id of ids)
+            uidToId.set(idToUid(id), id);
+        const wanted = [];
+        for (const uid of uids) {
+            const id = uidToId.get(uid);
+            if (id)
+                wanted.push({ uid, id });
+        }
+        if (wanted.length === 0)
+            return;
+        // Bounded concurrency — 10 in-flight is safe under Gmail's per-user rate
+        // limit (250 quota units/sec, messages.get = 5 units each = 50/sec cap).
+        const CONCURRENCY = 10;
+        let cursor = 0;
+        const worker = async () => {
+            while (cursor < wanted.length) {
+                const idx = cursor++;
+                const { uid, id } = wanted[idx];
+                try {
+                    const msg = await this.fetch(`/messages/${id}?format=raw`);
+                    if (!msg?.raw)
+                        continue;
+                    const base64 = msg.raw.replace(/-/g, "+").replace(/_/g, "/");
+                    const source = new TextDecoder().decode(Uint8Array.from(atob(base64), c => c.charCodeAt(0)));
+                    onBody(uid, source);
+                }
+                catch (e) {
+                    // Per-message failure is non-fatal; keep worker alive for the rest.
+                    console.error(`  [gmail batch] UID ${uid}: ${e.message}`);
+                }
+            }
+        };
+        await Promise.all(Array.from({ length: Math.min(CONCURRENCY, wanted.length) }, () => worker()));
+    }
     async fetchOne(folder, uid, options = {}) {
         // Need to find the Gmail ID from the UID — search all messages in folder
         const query = `in:${this.folderToLabel(folder)}`;

package/packages/mailx-service/index.d.ts

@@ -6,10 +6,6 @@
 import { MailxDB } from "@bobfrankston/mailx-store";
 import { ImapManager } from "@bobfrankston/mailx-imap";
 import type { Folder, AutocompleteRequest, AutocompleteResponse, AutocompleteSettings } from "@bobfrankston/mailx-types";
-export declare function sanitizeHtml(html: string): {
-    html: string;
-    hasRemoteContent: boolean;
-};
 export declare class MailxService {
     private db;
     private imapManager;

package/packages/mailx-service/index.js

@@ -7,43 +7,8 @@ import * as dns from "node:dns/promises";
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { loadSettings, saveSettings, loadAccounts, loadAccountsAsync, saveAccounts, initCloudConfig, loadAllowlist, saveAllowlist, loadAutocomplete, saveAutocomplete, getStorePath, getStorageInfo, getConfigDir } from "@bobfrankston/mailx-settings";
+import { sanitizeHtml, encodeQuotedPrintable } from "@bobfrankston/mailx-types";
 import { simpleParser } from "mailparser";
-// ── Quoted-printable encoding (readable in debug .eml files) ──
-function encodeQuotedPrintable(text) {
-    const bytes = Buffer.from(text, "utf-8");
-    let line = "";
-    let result = "";
-    for (let i = 0; i < bytes.length; i++) {
-        const b = bytes[i];
-        let encoded;
-        if (b === 0x0D && bytes[i + 1] === 0x0A) {
-            // CRLF — output as-is
-            result += line + "\r\n";
-            line = "";
-            i++; // skip LF
-            continue;
-        }
-        else if (b === 0x0A) {
-            // Bare LF — normalize to CRLF
-            result += line + "\r\n";
-            line = "";
-            continue;
-        }
-        else if ((b >= 33 && b <= 126 && b !== 61) || b === 9 || b === 32) {
-            encoded = String.fromCharCode(b);
-        }
-        else {
-            encoded = "=" + b.toString(16).toUpperCase().padStart(2, "0");
-        }
-        if (line.length + encoded.length > 75) {
-            result += line + "=\r\n";
-            line = "";
-        }
-        line += encoded;
-    }
-    result += line;
-    return result;
-}
 // ── Email provider detection (MX-based) ──
 const GOOGLE_DOMAINS = ["gmail.com", "googlemail.com"];
 const MS_DOMAINS = ["outlook.com", "hotmail.com", "live.com"];
@@ -67,30 +32,7 @@ async function detectEmailProvider(domain) {
     catch { /* DNS lookup failed */ }
     return null;
 }
-// ── Sanitize ──
-export function sanitizeHtml(html) {
-    let hasRemoteContent = false;
-    let clean = html.replace(/<script\b[^>]*>[\s\S]*?<\/script>/gi, "");
-    clean = clean.replace(/\s+on\w+\s*=\s*("[^"]*"|'[^']*'|[^\s>]+)/gi, "");
-    clean = clean.replace(/<img\b([^>]*)\bsrc\s*=\s*("[^"]*"|'[^']*')/gi, (match, before, src) => {
-        const url = src.slice(1, -1);
-        if (url.startsWith("data:") || url.startsWith("cid:"))
-            return match;
-        hasRemoteContent = true;
-        return `<img${before}src="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='20' height='20'%3E%3Crect fill='%23888' width='20' height='20' rx='3'/%3E%3Ctext x='10' y='14' text-anchor='middle' fill='white' font-size='12'%3E⊘%3C/text%3E%3C/svg%3E" data-blocked-src=${src} title="Remote image blocked"`;
-    });
-    clean = clean.replace(/<link\b[^>]*rel\s*=\s*["']stylesheet["'][^>]*>/gi, (match) => {
-        hasRemoteContent = true;
-        return `<!-- blocked: ${match.replace(/--/g, "")} -->`;
-    });
-    clean = clean.replace(/url\s*\(\s*(['"]?)(https?:\/\/[^)]+)\1\s*\)/gi, (_match, _q, url) => {
-        hasRemoteContent = true;
-        return `url("") /* blocked: ${url} */`;
-    });
-    clean = clean.replace(/<\/?form\b[^>]*>/gi, "");
-    clean = clean.replace(/<iframe\b[^>]*>[\s\S]*?<\/iframe>/gi, "");
-    return { html: clean, hasRemoteContent };
-}
+// sanitizeHtml and encodeQuotedPrintable imported from @bobfrankston/mailx-types (shared with Android)
 // ── Service ──
 export class MailxService {
     db;

package/packages/mailx-store-web/android-bootstrap.js

@@ -110,25 +110,30 @@ class AndroidSyncManager {
     async syncAll() {
         const accounts = this.db.getAccounts();
         vlog(`syncAll: ${accounts.length} accounts in DB: ${accounts.map(a => a.id).join(",")}`);
+        // Phase 1: Sync INBOX for every account first — user sees new mail fast.
         for (const account of accounts) {
-            const hasProvider = this.providers.has(account.id);
-            vlog(`syncAll: ${account.id} hasProvider=${hasProvider}`);
+            if (!this.providers.has(account.id))
+                continue;
             try {
                 const folders = await this.syncFolders(account.id);
-                vlog(`syncAll: ${account.id} got ${folders.length} folders`);
-                const sorted = [...folders].sort((a, b) => {
-                    if (a.specialUse === "inbox")
-                        return -1;
-                    if (b.specialUse === "inbox")
-                        return 1;
-                    return 0;
-                });
-                // Sync every folder, not just the first five — the old slice(0, 5)
-                // meant subfolders past the cutoff (e.g. _spam, custom labels)
-                // never picked up moves made on other clients, and those moves
-                // also stayed visible in the source folder because reconcile
-                // (below in syncFolder) never ran for the target.
-                for (const folder of sorted) {
+                const inbox = folders.find(f => f.specialUse === "inbox");
+                if (inbox) {
+                    await this.syncFolder(account.id, inbox.id);
+                    emitEvent({ type: "syncComplete", accountId: account.id });
+                }
+            }
+            catch (e) {
+                console.error(`[sync] ${account.id} inbox: ${e.message}`);
+            }
+        }
+        // Phase 2: Remaining folders (sent, drafts, trash, then everything else).
+        for (const account of accounts) {
+            if (!this.providers.has(account.id))
+                continue;
+            try {
+                const folders = this.db.getFolders(account.id);
+                const remaining = folders.filter(f => f.specialUse !== "inbox");
+                for (const folder of remaining) {
                     try {
                         await this.syncFolder(account.id, folder.id);
                     }
@@ -788,6 +793,14 @@ export async function initAndroid() {
         vlog("periodic sync poll");
         syncManager.syncAll().catch(e => console.error(`[android] Periodic sync error: ${e.message}`));
     }, SYNC_INTERVAL_MS);
+    // Immediate sync when app comes back to foreground (e.g. user switches from
+    // another app). Without this, new messages wait up to 2 minutes after resume.
+    document.addEventListener("visibilitychange", () => {
+        if (document.visibilityState === "visible") {
+            console.log("[sync] resume poll");
+            syncManager.syncAll().catch(e => console.error(`[android] Resume sync error: ${e.message}`));
+        }
+    });
     console.log("[android] Initialization complete");
     emitEvent({ type: "connected" });
 }

package/packages/mailx-store-web/db.js

@@ -7,6 +7,7 @@
  * Bodies are stored in IndexedDB via WebMessageStore (not filesystem).
  */
 import initSqlJs from "sql.js";
+import { parseSearchQuery } from "@bobfrankston/mailx-types";
 const SCHEMA = `
     CREATE TABLE IF NOT EXISTS accounts (
         id TEXT PRIMARY KEY,
@@ -433,20 +434,20 @@ export class WebMailxDB {
     // ── Search ──
     searchMessages(query, page = 1, pageSize = 50, accountId, folderId) {
         const offset = (page - 1) * pageSize;
-        const term = `%${query}%`;
-        let where = "(subject LIKE ? OR from_name LIKE ? OR from_address LIKE ? OR preview LIKE ?)";
-        const params = [term, term, term, term];
+        const parsed = parseSearchQuery(query);
+        const allParams = [...parsed.params];
+        let where = parsed.conditions.length > 0 ? parsed.conditions.join(" AND ") : "1=0";
         if (accountId && folderId) {
             where += " AND account_id = ? AND folder_id = ?";
-            params.push(accountId, folderId);
+            allParams.push(accountId, folderId);
         }
         else if (accountId) {
             where += " AND account_id = ?";
-            params.push(accountId);
+            allParams.push(accountId);
         }
-        const countRow = this.get(`SELECT COUNT(*) as cnt FROM messages WHERE ${where}`, params);
+        const countRow = this.get(`SELECT COUNT(*) as cnt FROM messages WHERE ${where}`, allParams);
         const total = countRow?.cnt || 0;
-        const rows = this.all(`SELECT * FROM messages WHERE ${where} ORDER BY date DESC LIMIT ? OFFSET ?`, [...params, pageSize, offset]);
+        const rows = this.all(`SELECT * FROM messages WHERE ${where} ORDER BY date DESC LIMIT ? OFFSET ?`, [...allParams, pageSize, offset]);
         return { items: rows.map(r => this.rowToEnvelope(r)), total, page, pageSize };
     }
     // ── Sync Actions ──

package/packages/mailx-store-web/gmail-api-web.d.ts

@@ -24,6 +24,10 @@ export declare class GmailApiWebProvider implements MailProvider {
     fetchOne(folder: string, uid: number, options?: FetchOptions): Promise<ProviderMessage | null>;
     getUids(folder: string): Promise<number[]>;
     close(): Promise<void>;
+    /** Bulk-fetch raw bodies for many UIDs in one Gmail label. Lists the label
+     *  once, builds UID→ID map, streams bodies via `onBody` with bounded
+     *  concurrency. Mirrors GmailApiProvider.fetchBodiesBatch on desktop. */
+    fetchBodiesBatch(folder: string, uids: number[], onBody: (uid: number, source: string) => void): Promise<void>;
     /** Send an RFC 2822 message via Gmail API users.messages.send. The server
      *  handles SMTP — we just hand it the raw bytes base64url-encoded. Auto-files
      *  a copy into the Sent label, so caller does NOT need to APPEND to Sent. */

package/packages/mailx-store-web/gmail-api-web.js

@@ -227,6 +227,46 @@ export class GmailApiWebProvider {
         return ids.map(idToUid);
     }
     async close() { }
+    /** Bulk-fetch raw bodies for many UIDs in one Gmail label. Lists the label
+     *  once, builds UID→ID map, streams bodies via `onBody` with bounded
+     *  concurrency. Mirrors GmailApiProvider.fetchBodiesBatch on desktop. */
+    async fetchBodiesBatch(folder, uids, onBody) {
+        if (uids.length === 0)
+            return;
+        const query = `in:${this.folderToLabel(folder)}`;
+        const ids = await this.listMessageIds(query, 10000);
+        const uidToId = new Map();
+        for (const id of ids)
+            uidToId.set(idToUid(id), id);
+        const wanted = [];
+        for (const uid of uids) {
+            const id = uidToId.get(uid);
+            if (id)
+                wanted.push({ uid, id });
+        }
+        if (wanted.length === 0)
+            return;
+        const CONCURRENCY = 10;
+        let cursor = 0;
+        const worker = async () => {
+            while (cursor < wanted.length) {
+                const idx = cursor++;
+                const { uid, id } = wanted[idx];
+                try {
+                    const msg = await this.apiFetch(`/messages/${id}?format=raw`);
+                    if (!msg?.raw)
+                        continue;
+                    const base64 = msg.raw.replace(/-/g, "+").replace(/_/g, "/");
+                    const source = new TextDecoder().decode(Uint8Array.from(atob(base64), c => c.charCodeAt(0)));
+                    onBody(uid, source);
+                }
+                catch (e) {
+                    console.error(`[gmail batch] UID ${uid}: ${e.message}`);
+                }
+            }
+        };
+        await Promise.all(Array.from({ length: Math.min(CONCURRENCY, wanted.length) }, () => worker()));
+    }
     /** Send an RFC 2822 message via Gmail API users.messages.send. The server
      *  handles SMTP — we just hand it the raw bytes base64url-encoded. Auto-files
      *  a copy into the Sent label, so caller does NOT need to APPEND to Sent. */

package/packages/mailx-store-web/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bobfrankston/mailx-store-web",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "type": "module",
   "main": "index.js",
   "types": "index.d.ts",

package/packages/mailx-store-web/web-service.d.ts

@@ -12,10 +12,6 @@
 import type { WebMailxDB } from "./db.js";
 import type { WebMessageStore } from "./web-message-store.js";
 import type { Folder, AutocompleteSettings } from "@bobfrankston/mailx-types";
-export declare function sanitizeHtml(html: string): {
-    html: string;
-    hasRemoteContent: boolean;
-};
 export interface WebSyncManager {
     syncAll(): Promise<void>;
     syncFolders(accountId: string): Promise<Folder[]>;

package/packages/mailx-store-web/web-service.js

@@ -9,31 +9,8 @@
  * - Settings via IndexedDB + GDrive API instead of filesystem
  * - No dns.resolveMx — provider detection is static (Gmail/Outlook/Yahoo/iCloud)
  */
+import { sanitizeHtml, encodeQuotedPrintable } from "@bobfrankston/mailx-types";
 import { loadSettings, saveSettings, loadAllowlist, saveAllowlist, loadAutocomplete, saveAutocomplete, getStorageInfo } from "./web-settings.js";
-// ── HTML sanitizer (same logic as desktop) ──
-export function sanitizeHtml(html) {
-    let hasRemoteContent = false;
-    let clean = html.replace(/<script\b[^>]*>[\s\S]*?<\/script>/gi, "");
-    clean = clean.replace(/\s+on\w+\s*=\s*("[^"]*"|'[^']*'|[^\s>]+)/gi, "");
-    clean = clean.replace(/<img\b([^>]*)\bsrc\s*=\s*("[^"]*"|'[^']*')/gi, (match, before, src) => {
-        const url = src.slice(1, -1);
-        if (url.startsWith("data:") || url.startsWith("cid:"))
-            return match;
-        hasRemoteContent = true;
-        return `<img${before}src="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='20' height='20'%3E%3Crect fill='%23888' width='20' height='20' rx='3'/%3E%3Ctext x='10' y='14' text-anchor='middle' fill='white' font-size='12'%3E⊘%3C/text%3E%3C/svg%3E" data-blocked-src=${src} title="Remote image blocked"`;
-    });
-    clean = clean.replace(/<link\b[^>]*rel\s*=\s*["']stylesheet["'][^>]*>/gi, (match) => {
-        hasRemoteContent = true;
-        return `<!-- blocked: ${match.replace(/--/g, "")} -->`;
-    });
-    clean = clean.replace(/url\s*\(\s*(['"]?)(https?:\/\/[^)]+)\1\s*\)/gi, (_match, _q, url) => {
-        hasRemoteContent = true;
-        return `url("") /* blocked: ${url} */`;
-    });
-    clean = clean.replace(/<\/?form\b[^>]*>/gi, "");
-    clean = clean.replace(/<iframe\b[^>]*>[\s\S]*?<\/iframe>/gi, "");
-    return { html: clean, hasRemoteContent };
-}
 /** Parse an RFC 2822 message from raw bytes. Handles basic MIME. */
 function parseEmailSource(raw) {
     const headers = new Map();
@@ -191,41 +168,6 @@ function decodeBody(body, encoding, charset = "utf-8") {
         return new TextDecoder("utf-8").decode(bytes);
     }
 }
-// ── Quoted-printable encoding (for compose/send) ──
-function encodeQuotedPrintable(text) {
-    const encoder = new TextEncoder();
-    const bytes = encoder.encode(text);
-    let line = "";
-    let result = "";
-    for (let i = 0; i < bytes.length; i++) {
-        const b = bytes[i];
-        let encoded;
-        if (b === 0x0D && bytes[i + 1] === 0x0A) {
-            result += line + "\r\n";
-            line = "";
-            i++;
-            continue;
-        }
-        else if (b === 0x0A) {
-            result += line + "\r\n";
-            line = "";
-            continue;
-        }
-        else if ((b >= 33 && b <= 126 && b !== 61) || b === 9 || b === 32) {
-            encoded = String.fromCharCode(b);
-        }
-        else {
-            encoded = "=" + b.toString(16).toUpperCase().padStart(2, "0");
-        }
-        if (line.length + encoded.length > 75) {
-            result += line + "=\r\n";
-            line = "";
-        }
-        line += encoded;
-    }
-    result += line;
-    return result;
-}
 // ── Service ──
 export class WebMailxService {
     db;

package/packages/mailx-types/index.d.ts

@@ -236,4 +236,18 @@ export interface MessageStore {
     deleteMessage(accountId: string, folderId: number, uid: number): Promise<void>;
     hasMessage(accountId: string, folderId: number, uid: number): Promise<boolean>;
 }
+/** Sanitize HTML for safe display — strips scripts, inline handlers, remote images, forms, iframes. */
+export declare function sanitizeHtml(html: string): {
+    html: string;
+    hasRemoteContent: boolean;
+};
+/** Encode text as RFC 2045 quoted-printable. */
+export declare function encodeQuotedPrintable(text: string): string;
+/** Parse search query into structured conditions.
+ *  Supports qualifiers: from:, to:, subject: (unqualified terms search everything).
+ *  Returns { conditions, params } for SQL WHERE clause with LIKE. */
+export declare function parseSearchQuery(query: string): {
+    conditions: string[];
+    params: string[];
+};
 //# sourceMappingURL=index.d.ts.map

package/packages/mailx-types/index.js

@@ -3,5 +3,100 @@
  * Shared type definitions for the mailx email client.
  * This is the contract between client and server.
  */
-export {};
+// ── Shared Utilities ──
+// Pure functions used by both desktop (mailx-service) and Android (web-service).
+// Kept here to avoid duplication — both platforms import from mailx-types.
+/** Sanitize HTML for safe display — strips scripts, inline handlers, remote images, forms, iframes. */
+export function sanitizeHtml(html) {
+    let hasRemoteContent = false;
+    let clean = html.replace(/<script\b[^>]*>[\s\S]*?<\/script>/gi, "");
+    clean = clean.replace(/\s+on\w+\s*=\s*("[^"]*"|'[^']*'|[^\s>]+)/gi, "");
+    clean = clean.replace(/<img\b([^>]*)\bsrc\s*=\s*("[^"]*"|'[^']*')/gi, (match, before, src) => {
+        const url = src.slice(1, -1);
+        if (url.startsWith("data:") || url.startsWith("cid:"))
+            return match;
+        hasRemoteContent = true;
+        return `<img${before}src="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='20' height='20'%3E%3Crect fill='%23888' width='20' height='20' rx='3'/%3E%3Ctext x='10' y='14' text-anchor='middle' fill='white' font-size='12'%3E⊘%3C/text%3E%3C/svg%3E" data-blocked-src=${src} title="Remote image blocked"`;
+    });
+    clean = clean.replace(/<link\b[^>]*rel\s*=\s*["']stylesheet["'][^>]*>/gi, (match) => {
+        hasRemoteContent = true;
+        return `<!-- blocked: ${match.replace(/--/g, "")} -->`;
+    });
+    clean = clean.replace(/url\s*\(\s*(['"]?)(https?:\/\/[^)]+)\1\s*\)/gi, (_match, _q, url) => {
+        hasRemoteContent = true;
+        return `url("") /* blocked: ${url} */`;
+    });
+    clean = clean.replace(/<\/?form\b[^>]*>/gi, "");
+    clean = clean.replace(/<iframe\b[^>]*>[\s\S]*?<\/iframe>/gi, "");
+    return { html: clean, hasRemoteContent };
+}
+/** Encode text as RFC 2045 quoted-printable. */
+export function encodeQuotedPrintable(text) {
+    const encoder = new TextEncoder();
+    const bytes = encoder.encode(text);
+    let line = "";
+    let result = "";
+    for (let i = 0; i < bytes.length; i++) {
+        const b = bytes[i];
+        let encoded;
+        if (b === 0x0D && bytes[i + 1] === 0x0A) {
+            result += line + "\r\n";
+            line = "";
+            i++;
+            continue;
+        }
+        else if (b === 0x0A) {
+            result += line + "\r\n";
+            line = "";
+            continue;
+        }
+        else if ((b >= 33 && b <= 126 && b !== 61) || b === 9 || b === 32) {
+            encoded = String.fromCharCode(b);
+        }
+        else {
+            encoded = "=" + b.toString(16).toUpperCase().padStart(2, "0");
+        }
+        if (line.length + encoded.length > 75) {
+            result += line + "=\r\n";
+            line = "";
+        }
+        line += encoded;
+    }
+    result += line;
+    return result;
+}
+/** Parse search query into structured conditions.
+ *  Supports qualifiers: from:, to:, subject: (unqualified terms search everything).
+ *  Returns { conditions, params } for SQL WHERE clause with LIKE. */
+export function parseSearchQuery(query) {
+    const parts = query.match(/(?:[^\s"]+|"[^"]*")+/g) || [];
+    const conditions = [];
+    const params = [];
+    for (const part of parts) {
+        const fromMatch = part.match(/^from:(.+)$/i);
+        const toMatch = part.match(/^to:(.+)$/i);
+        const subjectMatch = part.match(/^subject:(.+)$/i);
+        if (fromMatch) {
+            const term = `%${fromMatch[1].replace(/"/g, "")}%`;
+            conditions.push("(from_name LIKE ? OR from_address LIKE ?)");
+            params.push(term, term);
+        }
+        else if (toMatch) {
+            const term = `%${toMatch[1].replace(/"/g, "")}%`;
+            conditions.push("(to_json LIKE ? OR cc_json LIKE ?)");
+            params.push(term, term);
+        }
+        else if (subjectMatch) {
+            const term = `%${subjectMatch[1].replace(/"/g, "")}%`;
+            conditions.push("subject LIKE ?");
+            params.push(term);
+        }
+        else {
+            const term = `%${part}%`;
+            conditions.push("(subject LIKE ? OR from_name LIKE ? OR from_address LIKE ? OR preview LIKE ?)");
+            params.push(term, term, term, term);
+        }
+    }
+    return { conditions, params };
+}
 //# sourceMappingURL=index.js.map