@bobfrankston/mailx 1.0.50 → 1.0.57

package/packages/mailx-api/index.js

@@ -1,317 +1,65 @@
 /**
  * @bobfrankston/mailx-api
- * Express Router with all REST endpoints for the mailx client.
+ * Thin Express Router — delegates all logic to mailx-service.
  */
 import { Router } from "express";
-import { loadSettings, saveSettings, loadAllowlist, saveAllowlist, getStorePath } from "@bobfrankston/mailx-settings";
-import { simpleParser } from "mailparser";
-/** Sanitize HTML email body — strip remote content (images, CSS, scripts, event handlers) */
-function sanitizeHtml(html) {
-    let hasRemoteContent = false;
-    // Remove <script> tags and content
-    let clean = html.replace(/<script\b[^>]*>[\s\S]*?<\/script>/gi, "");
-    // Remove event handlers (onclick, onload, onerror, etc.)
-    clean = clean.replace(/\s+on\w+\s*=\s*("[^"]*"|'[^']*'|[^\s>]+)/gi, "");
-    // Replace remote images with placeholder — keep data: and cid: URIs
-    clean = clean.replace(/<img\b([^>]*)\bsrc\s*=\s*("[^"]*"|'[^']*')/gi, (match, before, src) => {
-        const url = src.slice(1, -1); // remove quotes
-        if (url.startsWith("data:") || url.startsWith("cid:"))
-            return match;
-        hasRemoteContent = true;
-        return `<img${before}src="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='20' height='20'%3E%3Crect fill='%23888' width='20' height='20' rx='3'/%3E%3Ctext x='10' y='14' text-anchor='middle' fill='white' font-size='12'%3E⊘%3C/text%3E%3C/svg%3E" data-blocked-src=${src} title="Remote image blocked"`;
-    });
-    // Block remote CSS via <link> tags
-    clean = clean.replace(/<link\b[^>]*rel\s*=\s*["']stylesheet["'][^>]*>/gi, (match) => {
-        hasRemoteContent = true;
-        return `<!-- blocked: ${match.replace(/--/g, "")} -->`;
-    });
-    // Block background images in inline styles
-    clean = clean.replace(/url\s*\(\s*(['"]?)(https?:\/\/[^)]+)\1\s*\)/gi, (match, _q, url) => {
-        hasRemoteContent = true;
-        return `url("") /* blocked: ${url} */`;
-    });
-    // Remove <form> tags
-    clean = clean.replace(/<\/?form\b[^>]*>/gi, "");
-    // Remove <iframe> tags (within email body)
-    clean = clean.replace(/<iframe\b[^>]*>[\s\S]*?<\/iframe>/gi, "");
-    return { html: clean, hasRemoteContent };
-}
+import { MailxService } from "@bobfrankston/mailx-service";
 export function createApiRouter(db, imapManager) {
+    const svc = new MailxService(db, imapManager);
     const router = Router();
     router.use((req, res, next) => { res.type("json"); res.set("Cache-Control", "no-store"); next(); });
     // ── Accounts ──
-    router.get("/accounts", (req, res) => {
-        const accounts = db.getAccounts();
-        const settings = loadSettings();
-        // Merge settings flags
-        const enriched = accounts.map(a => {
-            const cfg = settings.accounts.find(s => s.id === a.id);
-            return { ...a, label: cfg?.label, defaultSend: cfg?.defaultSend || false };
-        });
-        res.json(enriched);
-    });
+    router.get("/accounts", (req, res) => { res.json(svc.getAccounts()); });
     // ── Folders ──
-    router.get("/folders/:accountId", (req, res) => {
-        const folders = db.getFolders(req.params.accountId);
-        res.json(folders);
-    });
+    router.get("/folders/:accountId", (req, res) => { res.json(svc.getFolders(req.params.accountId)); });
     // ── Messages ──
-    // Unified inbox — MUST be before :accountId/:folderId route
     router.get("/messages/unified/inbox", (req, res) => {
-        const page = Number(req.query.page) || 1;
-        const pageSize = Number(req.query.pageSize) || 50;
-        const result = db.getUnifiedInbox(page, pageSize);
-        res.json(result);
+        res.json(svc.getUnifiedInbox(Number(req.query.page) || 1, Number(req.query.pageSize) || 50));
     });
-    // Per-folder messages (after unified to avoid route conflict)
     router.get("/messages/:accountId/:folderId", (req, res) => {
-        const result = db.getMessages({
-            accountId: req.params.accountId,
-            folderId: Number(req.params.folderId),
-            page: Number(req.query.page) || 1,
-            pageSize: Number(req.query.pageSize) || 50,
-            sort: req.query.sort || "date",
-            sortDir: req.query.sortDir || "desc",
-            search: req.query.search
-        });
-        res.json(result);
+        res.json(svc.getMessages(req.params.accountId, Number(req.params.folderId), Number(req.query.page) || 1, Number(req.query.pageSize) || 50, req.query.sort || "date", req.query.sortDir || "desc", req.query.search));
     });
     router.get("/message/:accountId/:uid", async (req, res) => {
         try {
-            const { accountId, uid } = req.params;
-            let allowRemote = req.query.allowRemote === "true";
-            const folderId = req.query.folderId ? Number(req.query.folderId) : undefined;
-            const envelope = db.getMessageByUid(accountId, Number(uid), folderId);
-            if (!envelope)
-                return res.status(404).json({ error: "Message not found" });
-            // Load body from store or fetch on demand from IMAP
-            let bodyHtml = "";
-            let bodyText = "";
-            let hasRemoteContent = false;
-            let attachments = [];
-            const t0 = Date.now();
-            let raw = null;
-            try {
-                raw = await imapManager.fetchMessageBody(accountId, envelope.folderId, envelope.uid);
-            }
-            catch (fetchErr) {
-                console.error(`  [fetch] Failed UID ${uid}: ${fetchErr.message || fetchErr}`);
-                // Return envelope with error instead of 500 — user can still see headers
-                return res.json({ ...envelope, bodyHtml: "", bodyText: `[Message body unavailable: ${fetchErr.message || "IMAP connection failed"}]`, hasRemoteContent: false, remoteAllowed: false, attachments: [], emlPath: "", deliveredTo: "", returnPath: "", listUnsubscribe: "" });
-            }
-            const t1 = Date.now();
-            if (raw) {
-                const parsed = await simpleParser(raw);
-                const t2 = Date.now();
-                if (t2 - t0 > 2000)
-                    console.log(`  [slow] Message ${uid}: fetch=${t1 - t0}ms parse=${t2 - t1}ms total=${t2 - t0}ms (${raw.length} bytes)`);
-                bodyHtml = parsed.html || "";
-                bodyText = parsed.text || "";
-                attachments = (parsed.attachments || []).map((a, i) => ({
-                    id: i,
-                    filename: a.filename || `attachment-${i}`,
-                    mimeType: a.contentType || "application/octet-stream",
-                    size: a.size || 0,
-                    contentId: a.contentId || ""
-                }));
-            }
-            // Sanitize HTML — block remote content unless allowed or sender is on allow-list
-            if (bodyHtml && !allowRemote) {
-                const allowList = loadAllowlist();
-                const senderAddr = envelope.from?.address || "";
-                const senderDomain = senderAddr.split("@")[1] || "";
-                const toAddrs = (envelope.to || []).map((a) => a.address);
-                const isAllowed = allowList.senders.includes(senderAddr) ||
-                    allowList.domains.includes(senderDomain) ||
-                    toAddrs.some((a) => allowList.recipients?.includes(a));
-                if (isAllowed) {
-                    allowRemote = true;
-                }
-                else {
-                    const result = sanitizeHtml(bodyHtml);
-                    bodyHtml = result.html;
-                    hasRemoteContent = result.hasRemoteContent;
-                }
-            }
-            // Build .eml file path
-            const storePath = getStorePath();
-            const emlPath = `${storePath}/${accountId}/${envelope.folderId}/${envelope.uid}.eml`;
-            // Extract useful headers (values may be strings or structured objects)
-            let deliveredTo = "";
-            let returnPath = "";
-            let listUnsubscribe = "";
-            if (raw) {
-                const parsed2 = await simpleParser(raw);
-                const hdr = (key) => {
-                    let v = parsed2.headers.get(key);
-                    if (!v)
-                        return "";
-                    if (Array.isArray(v))
-                        v = v[0];
-                    if (typeof v === "string")
-                        return v;
-                    if (typeof v === "object" && v !== null) {
-                        if ("text" in v)
-                            return v.text || "";
-                        if ("value" in v)
-                            return String(v.value);
-                        if ("address" in v)
-                            return v.address || "";
-                    }
-                    return String(v);
-                };
-                // Get the real Delivered-To, skipping relay domains from account config
-                const msgSettings = loadSettings();
-                const acctConfig = msgSettings.accounts.find((a) => a.id === accountId);
-                const relayDomains = acctConfig?.relayDomains || [];
-                const prefixes = acctConfig?.deliveredToPrefix || [];
-                const rawDelivered = parsed2.headers.get("delivered-to");
-                if (rawDelivered) {
-                    const deliveredList = Array.isArray(rawDelivered) ? rawDelivered : [rawDelivered];
-                    for (let i = deliveredList.length - 1; i >= 0; i--) {
-                        const d = deliveredList[i];
-                        const addr = typeof d === "string" ? d : d?.text || d?.address || String(d);
-                        if (!relayDomains.some(rd => addr.includes(`@${rd}`))) {
-                            deliveredTo = addr;
-                            break;
-                        }
-                    }
-                    if (!deliveredTo && deliveredList.length > 0) {
-                        const d = deliveredList[deliveredList.length - 1];
-                        deliveredTo = typeof d === "string" ? d : d?.text || d?.address || String(d);
-                    }
-                    // Strip prefix from local part to get clean alias
-                    if (deliveredTo && prefixes.length > 0) {
-                        const [local, domain] = deliveredTo.split("@");
-                        for (const prefix of prefixes) {
-                            if (local.startsWith(prefix)) {
-                                deliveredTo = `${local.slice(prefix.length)}@${domain}`;
-                                break;
-                            }
-                        }
-                    }
-                }
-                returnPath = hdr("return-path").replace(/[<>]/g, "");
-                // mailparser merges List-* headers into a "list" object
-                const listHeaders = parsed2.headers.get("list");
-                if (listHeaders?.unsubscribe) {
-                    const unsub = listHeaders.unsubscribe;
-                    listUnsubscribe = unsub.url || (unsub.mail ? `mailto:${unsub.mail}` : "");
-                }
-            }
-            const message = {
-                ...envelope,
-                bodyHtml,
-                bodyText,
-                hasRemoteContent,
-                remoteAllowed: allowRemote,
-                attachments,
-                emlPath,
-                deliveredTo,
-                returnPath,
-                listUnsubscribe,
-            };
-            res.json(message);
+            const msg = await svc.getMessage(req.params.accountId, Number(req.params.uid), req.query.allowRemote === "true", req.query.folderId ? Number(req.query.folderId) : undefined);
+            res.json(msg);
         }
         catch (e) {
-            res.status(500).json({ error: e.message });
+            res.status(e.message === "Message not found" ? 404 : 500).json({ error: e.message });
         }
     });
     router.patch("/message/:accountId/:uid/flags", async (req, res) => {
-        const { accountId, uid } = req.params;
-        const { flags } = req.body;
-        const envelope = db.getMessageByUid(accountId, Number(uid));
-        // Local-first: update DB, queue IMAP sync
-        await imapManager.updateFlagsLocal(accountId, Number(uid), envelope?.folderId || 0, flags);
-        res.json({ ok: true });
+        try {
+            await svc.updateFlags(req.params.accountId, Number(req.params.uid), req.body.flags);
+            res.json({ ok: true });
+        }
+        catch (e) {
+            res.status(500).json({ error: e.message });
+        }
     });
     // ── Remote content allow-list ──
     router.post("/settings/allow-remote", (req, res) => {
-        const { type, value } = req.body;
-        const list = loadAllowlist();
-        if (type === "sender" && !list.senders.includes(value)) {
-            list.senders.push(value);
-        }
-        else if (type === "domain" && !list.domains.includes(value)) {
-            list.domains.push(value);
-        }
-        else if (type === "recipient") {
-            if (!list.recipients)
-                list.recipients = [];
-            if (!list.recipients.includes(value))
-                list.recipients.push(value);
-        }
-        saveAllowlist(list);
-        console.log(`  [allow] Added ${type}: ${value}`);
+        svc.allowRemoteContent(req.body.type, req.body.value);
         res.json({ ok: true });
     });
     // ── Search ──
     router.get("/search", async (req, res) => {
-        const q = req.query.q || "";
-        const page = Number(req.query.page) || 1;
-        const pageSize = Number(req.query.pageSize) || 50;
-        const scope = req.query.scope || "all";
-        const accountId = req.query.accountId || "";
-        const folderId = Number(req.query.folderId) || 0;
-        if (!q.trim())
-            return res.json({ items: [], total: 0, page, pageSize });
         try {
-            if (scope === "server" && accountId) {
-                // IMAP server search
-                const folders = db.getFolders(accountId);
-                const folder = folderId ? folders.find(f => f.id === folderId) : folders.find(f => f.specialUse === "inbox");
-                if (!folder)
-                    return res.json({ items: [], total: 0, page, pageSize });
-                const criteria = {};
-                // Parse qualifiers
-                const fromMatch = q.match(/from:(\S+)/i);
-                const toMatch = q.match(/to:(\S+)/i);
-                const subjectMatch = q.match(/subject:(.+?)(?:\s+\w+:|$)/i);
-                const bodyText = q.replace(/(?:from|to|subject):\S+/gi, "").trim();
-                if (fromMatch)
-                    criteria.from = fromMatch[1];
-                if (toMatch)
-                    criteria.to = toMatch[1];
-                if (subjectMatch)
-                    criteria.subject = subjectMatch[1].trim();
-                if (bodyText)
-                    criteria.body = bodyText;
-                const uids = await imapManager.searchOnServer(accountId, folder.path, criteria);
-                // Fetch envelopes for matching UIDs from local DB
-                const items = uids.slice((page - 1) * pageSize, page * pageSize)
-                    .map(uid => db.getMessageByUid(accountId, uid, folderId))
-                    .filter(Boolean);
-                res.json({ items, total: uids.length, page, pageSize });
-            }
-            else if (scope === "current" && accountId && folderId) {
-                // Search within current folder only
-                const result = db.searchMessages(q, page, pageSize, accountId, folderId);
-                res.json(result);
-            }
-            else {
-                // All folders (default)
-                const result = db.searchMessages(q, page, pageSize);
-                res.json(result);
-            }
+            const result = await svc.search(req.query.q || "", Number(req.query.page) || 1, Number(req.query.pageSize) || 50, req.query.scope || "all", req.query.accountId, Number(req.query.folderId) || 0);
+            res.json(result);
         }
         catch (e) {
             res.status(500).json({ error: e.message });
         }
     });
     router.post("/search/rebuild", (req, res) => {
-        const count = db.rebuildSearchIndex();
-        console.log(`  Rebuilt search index: ${count} messages`);
-        res.json({ ok: true, indexed: count });
-    });
-    // ── Sync status ──
-    router.get("/sync/pending", (req, res) => {
-        const count = db.getTotalPendingSyncCount();
-        res.json({ pending: count });
+        res.json({ ok: true, indexed: svc.rebuildSearchIndex() });
     });
     // ── Sync ──
+    router.get("/sync/pending", (req, res) => { res.json(svc.getSyncPending()); });
     router.post("/sync", async (req, res) => {
         try {
-            await imapManager.syncAll();
+            await svc.syncAll();
             res.json({ ok: true });
         }
         catch (e) {
@@ -320,24 +68,7 @@ export function createApiRouter(db, imapManager) {
     });
     router.post("/sync/:accountId", async (req, res) => {
         try {
-            const folders = await imapManager.syncFolders(req.params.accountId);
-            // INBOX first
-            folders.sort((a, b) => {
-                if (a.specialUse === "inbox")
-                    return -1;
-                if (b.specialUse === "inbox")
-                    return 1;
-                return 0;
-            });
-            for (const folder of folders) {
-                try {
-                    await imapManager.syncFolder(req.params.accountId, folder.id);
-                }
-                catch (e) {
-                    // Non-existent folders handled internally by syncFolder caller
-                    console.error(`  Skipping folder ${folder.path}: ${e.message}`);
-                }
-            }
+            await svc.syncAccount(req.params.accountId);
             res.json({ ok: true });
         }
         catch (e) {
@@ -347,45 +78,7 @@ export function createApiRouter(db, imapManager) {
     // ── Send ──
     router.post("/send", async (req, res) => {
         try {
-            const msg = req.body;
-            const settings = loadSettings();
-            const account = settings.accounts.find(a => a.id === msg.from);
-            if (!account)
-                return res.status(400).json({ error: `Unknown account: ${msg.from}` });
-            // Use custom From address if provided, otherwise account default
-            const fromHeader = msg.fromAddress || `${account.name} <${account.email}>`;
-            // Build RFC 822 message
-            const to = msg.to.map((a) => a.name ? `${a.name} <${a.address}>` : a.address).join(", ");
-            const cc = msg.cc?.map((a) => a.name ? `${a.name} <${a.address}>` : a.address).join(", ");
-            const bcc = msg.bcc?.map((a) => a.name ? `${a.name} <${a.address}>` : a.address).join(", ");
-            const body = msg.bodyHtml || msg.bodyText || "";
-            const bodyBase64 = Buffer.from(body, "utf-8").toString("base64").replace(/(.{76})/g, "$1\r\n");
-            const headers = [
-                `From: ${fromHeader}`,
-                `To: ${to}`,
-                cc ? `Cc: ${cc}` : null,
-                bcc ? `Bcc: ${bcc}` : null,
-                `Subject: ${msg.subject}`,
-                `Date: ${new Date().toUTCString()}`,
-                msg.inReplyTo ? `In-Reply-To: ${msg.inReplyTo}` : null,
-                msg.references?.length ? `References: ${msg.references.join(" ")}` : null,
-                `MIME-Version: 1.0`,
-                `Content-Type: text/html; charset=UTF-8`,
-                `Content-Transfer-Encoding: base64`,
-            ].filter(h => h !== null).join("\r\n");
-            const rawMessage = `${headers}\r\n\r\n${bodyBase64}`;
-            // Local-first: save to sync queue, worker will APPEND to Outbox and send
-            imapManager.queueOutgoingLocal(account.id, rawMessage);
-            console.log(`  Queued locally: ${msg.subject} via ${account.id} from ${fromHeader}`);
-            // Record recipient addresses for autocomplete
-            for (const addr of msg.to)
-                db.recordSentAddress(addr.name, addr.address);
-            if (msg.cc)
-                for (const addr of msg.cc)
-                    db.recordSentAddress(addr.name, addr.address);
-            if (msg.bcc)
-                for (const addr of msg.bcc)
-                    db.recordSentAddress(addr.name, addr.address);
+            await svc.send(req.body);
             res.json({ ok: true, queued: true });
         }
         catch (e) {
@@ -396,62 +89,39 @@ export function createApiRouter(db, imapManager) {
     // ── Delete ──
     router.delete("/message/:accountId/:uid", async (req, res) => {
         try {
-            const { accountId, uid } = req.params;
-            const envelope = db.getMessageByUid(accountId, Number(uid));
-            if (!envelope)
-                return res.status(404).json({ error: "Message not found" });
-            await imapManager.trashMessage(accountId, envelope.folderId, envelope.uid);
+            await svc.deleteMessage(req.params.accountId, Number(req.params.uid));
             res.json({ ok: true });
         }
         catch (e) {
-            console.error(`  Delete error: ${e.message}`);
-            res.status(500).json({ error: e.message });
+            const status = e.message === "Message not found" ? 404 : 500;
+            res.status(status).json({ error: e.message });
         }
     });
-    // ── Move message to another folder ──
+    // ── Move ──
     router.post("/message/:accountId/:uid/move", async (req, res) => {
         try {
-            const { accountId, uid } = req.params;
-            const { targetFolderId, targetAccountId } = req.body;
-            if (targetFolderId == null)
-                return res.status(400).json({ error: "targetFolderId required" });
-            const envelope = db.getMessageByUid(accountId, Number(uid));
-            if (!envelope)
-                return res.status(404).json({ error: "Message not found" });
-            if (targetAccountId && targetAccountId !== accountId) {
-                // Cross-account move via iflow
-                await imapManager.moveMessageCrossAccount(accountId, envelope.uid, envelope.folderId, targetAccountId, targetFolderId);
-            }
-            else {
-                // Same-account move
-                await imapManager.moveMessage(accountId, envelope.uid, envelope.folderId, targetFolderId);
-            }
+            await svc.moveMessage(req.params.accountId, Number(req.params.uid), req.body.targetFolderId, req.body.targetAccountId);
             res.json({ ok: true });
         }
         catch (e) {
-            console.error(`  Move error: ${e.message}`);
-            res.status(500).json({ error: e.message });
+            const status = e.message === "Message not found" ? 404 : 500;
+            res.status(status).json({ error: e.message });
         }
     });
-    // ── Undelete (move from Trash back to original folder) ──
+    // ── Undelete ──
     router.post("/message/:accountId/:uid/undelete", async (req, res) => {
         try {
-            const { accountId, uid } = req.params;
-            const { folderId } = req.body;
-            await imapManager.undeleteMessage(accountId, Number(uid), folderId);
+            await svc.undeleteMessage(req.params.accountId, Number(req.params.uid), req.body.folderId);
             res.json({ ok: true });
         }
         catch (e) {
-            console.error(`  Undelete error: ${e.message}`);
             res.status(500).json({ error: e.message });
         }
     });
-    // ── Direct IMAP delete (for messages not in local DB) ──
+    // ── Direct IMAP delete ──
     router.delete("/imap/:accountId/:folderPath/:uid", async (req, res) => {
         try {
-            const { accountId, uid } = req.params;
-            const folderPath = decodeURIComponent(req.params.folderPath);
-            await imapManager.deleteOnServer(accountId, folderPath, Number(uid));
+            await svc.deleteOnServer(req.params.accountId, decodeURIComponent(req.params.folderPath), Number(req.params.uid));
             res.json({ ok: true });
         }
         catch (e) {
@@ -459,123 +129,45 @@ export function createApiRouter(db, imapManager) {
         }
     });
     // ── Folder management ──
-    // Create subfolder
     router.post("/folder/:accountId", async (req, res) => {
         try {
-            const { accountId } = req.params;
-            const { parentPath, name } = req.body;
-            const fullPath = parentPath ? `${parentPath}.${name}` : name;
-            const client = imapManager.createPublicClient(accountId);
-            try {
-                await client.createmailbox(fullPath);
-                await imapManager.syncFolders(accountId, client);
-                await client.logout();
-            }
-            finally {
-                try {
-                    await client.logout();
-                }
-                catch { /* */ }
-            }
+            await svc.createFolder(req.params.accountId, req.body.parentPath, req.body.name);
             res.json({ ok: true });
         }
         catch (e) {
             res.status(500).json({ error: e.message });
         }
     });
-    // Rename folder
     router.post("/folder/:accountId/:folderId/rename", async (req, res) => {
         try {
-            const { accountId, folderId } = req.params;
-            const { newName } = req.body;
-            const folder = db.getFolders(accountId).find(f => f.id === Number(folderId));
-            if (!folder)
-                return res.status(404).json({ error: "Folder not found" });
-            const parts = folder.path.split(folder.delimiter || ".");
-            parts[parts.length - 1] = newName;
-            const newPath = parts.join(folder.delimiter || ".");
-            const client = imapManager.createPublicClient(accountId);
-            try {
-                // iflow doesn't have renamemailbox yet — use raw imapflow
-                await client.withConnection(async () => {
-                    await client.client.mailboxRename(folder.path, newPath);
-                });
-                await imapManager.syncFolders(accountId, client);
-                await client.logout();
-            }
-            finally {
-                try {
-                    await client.logout();
-                }
-                catch { /* */ }
-            }
+            await svc.renameFolder(req.params.accountId, Number(req.params.folderId), req.body.newName);
             res.json({ ok: true });
         }
         catch (e) {
             res.status(500).json({ error: e.message });
         }
     });
-    // Delete folder
     router.delete("/folder/:accountId/:folderId", async (req, res) => {
         try {
-            const { accountId, folderId } = req.params;
-            const folder = db.getFolders(accountId).find(f => f.id === Number(folderId));
-            if (!folder)
-                return res.status(404).json({ error: "Folder not found" });
-            const client = imapManager.createPublicClient(accountId);
-            try {
-                await client.withConnection(async () => {
-                    await client.client.mailboxDelete(folder.path);
-                });
-                db.deleteFolder(Number(folderId));
-                await client.logout();
-            }
-            finally {
-                try {
-                    await client.logout();
-                }
-                catch { /* */ }
-            }
+            await svc.deleteFolder(req.params.accountId, Number(req.params.folderId));
             res.json({ ok: true });
         }
         catch (e) {
             res.status(500).json({ error: e.message });
         }
     });
-    // Mark all messages in folder as read
     router.post("/folder/:accountId/:folderId/mark-read", async (req, res) => {
         try {
-            const { accountId, folderId } = req.params;
-            db.markFolderRead(Number(folderId));
+            svc.markFolderRead(Number(req.params.folderId));
             res.json({ ok: true });
         }
         catch (e) {
             res.status(500).json({ error: e.message });
         }
     });
-    // Empty folder (permanently delete all messages)
     router.post("/folder/:accountId/:folderId/empty", async (req, res) => {
         try {
-            const { accountId, folderId } = req.params;
-            const folder = db.getFolders(accountId).find(f => f.id === Number(folderId));
-            if (!folder)
-                return res.status(404).json({ error: "Folder not found" });
-            db.deleteAllMessages(accountId, Number(folderId));
-            // Also delete on IMAP
-            const client = imapManager.createPublicClient(accountId);
-            try {
-                const uids = await client.getUids(folder.path);
-                for (const uid of uids) {
-                    await client.deleteMessageByUid(folder.path, uid);
-                }
-                await client.logout();
-            }
-            finally {
-                try {
-                    await client.logout();
-                }
-                catch { /* */ }
-            }
+            await svc.emptyFolder(req.params.accountId, Number(req.params.folderId));
             res.json({ ok: true });
         }
         catch (e) {
@@ -585,58 +177,31 @@ export function createApiRouter(db, imapManager) {
     // ── Attachments ──
     router.get("/message/:accountId/:uid/attachment/:attachmentId", async (req, res) => {
         try {
-            const { accountId, uid, attachmentId } = req.params;
-            const folderId = req.query.folderId ? Number(req.query.folderId) : undefined;
-            const envelope = db.getMessageByUid(accountId, Number(uid), folderId);
-            if (!envelope)
-                return res.status(404).json({ error: "Message not found" });
-            const raw = await imapManager.fetchMessageBody(accountId, envelope.folderId, envelope.uid);
-            if (!raw)
-                return res.status(404).json({ error: "Message body not available" });
-            const parsed = await simpleParser(raw);
-            const att = parsed.attachments?.[Number(attachmentId)];
-            if (!att)
-                return res.status(404).json({ error: "Attachment not found" });
-            res.set("Content-Type", att.contentType || "application/octet-stream");
-            res.set("Content-Disposition", `inline; filename="${(att.filename || "attachment").replace(/"/g, "")}""`);
+            const att = await svc.getAttachment(req.params.accountId, Number(req.params.uid), Number(req.params.attachmentId), req.query.folderId ? Number(req.query.folderId) : undefined);
+            res.set("Content-Type", att.contentType);
+            res.set("Content-Disposition", `inline; filename="${att.filename}"`);
             res.send(att.content);
         }
         catch (e) {
-            res.status(500).json({ error: e.message });
+            const status = e.message.includes("not found") || e.message.includes("not available") ? 404 : 500;
+            res.status(status).json({ error: e.message });
         }
     });
     // ── Drafts ──
     router.post("/draft", async (req, res) => {
         try {
             const { accountId, subject, bodyHtml, bodyText, to, cc, previousDraftUid } = req.body;
-            const settings = loadSettings();
-            const account = settings.accounts.find(a => a.id === accountId);
-            if (!account)
-                return res.status(400).json({ error: `Unknown account: ${accountId}` });
-            const headers = [
-                `From: ${account.name} <${account.email}>`,
-                to ? `To: ${to}` : null,
-                cc ? `Cc: ${cc}` : null,
-                `Subject: ${subject || "(no subject)"}`,
-                `Date: ${new Date().toUTCString()}`,
-                `MIME-Version: 1.0`,
-                `Content-Type: text/html; charset=UTF-8`,
-            ].filter(h => h !== null).join("\r\n");
-            const raw = `${headers}\r\n\r\n${bodyHtml || bodyText || ""}`;
-            const uid = await imapManager.saveDraft(accountId, raw, previousDraftUid);
+            const uid = await svc.saveDraft(accountId, subject, bodyHtml, bodyText, to, cc, previousDraftUid);
             res.json({ ok: true, draftUid: uid });
         }
         catch (e) {
-            console.error(`  Draft save error: ${e.message}`);
             res.status(500).json({ error: e.message });
         }
     });
     router.delete("/draft", async (req, res) => {
         try {
-            const { accountId, draftUid } = req.body;
-            if (accountId && draftUid) {
-                await imapManager.deleteDraft(accountId, draftUid);
-            }
+            if (req.body.accountId && req.body.draftUid)
+                await svc.deleteDraft(req.body.accountId, req.body.draftUid);
             res.json({ ok: true });
         }
         catch (e) {
@@ -644,36 +209,22 @@ export function createApiRouter(db, imapManager) {
         }
     });
     // ── Contacts ──
-    router.get("/contacts", (req, res) => {
-        const q = req.query.q || "";
-        if (q.length < 1)
-            return res.json([]);
-        const results = db.searchContacts(q);
-        res.json(results);
-    });
+    router.get("/contacts", (req, res) => { res.json(svc.searchContacts(req.query.q || "")); });
     router.post("/contacts/sync-google", async (req, res) => {
         try {
-            await imapManager.syncAllContacts();
+            await svc.syncGoogleContacts();
             res.json({ ok: true });
         }
         catch (e) {
             res.status(500).json({ error: e.message });
         }
     });
-    router.post("/contacts/seed", (req, res) => {
-        const added = db.seedContactsFromMessages();
-        console.log(`  Seeded ${added} contacts from message history`);
-        res.json({ ok: true, added });
-    });
+    router.post("/contacts/seed", (req, res) => { res.json({ ok: true, added: svc.seedContacts() }); });
     // ── Settings ──
-    router.get("/settings", (req, res) => {
-        const settings = loadSettings();
-        res.json(settings);
-    });
-    router.put("/settings", (req, res) => {
-        saveSettings(req.body);
-        res.json({ ok: true });
-    });
+    router.get("/settings", (req, res) => { res.json(svc.getSettings()); });
+    router.put("/settings", (req, res) => { svc.saveSettings(req.body); res.json({ ok: true }); });
     return router;
 }
+// Re-export the service for direct use (Android bridge, worker thread, etc.)
+export { MailxService } from "@bobfrankston/mailx-service";
 //# sourceMappingURL=index.js.map