@bobfrankston/mailx 1.0.55 → 1.0.57

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bobfrankston/mailx",
-  "version": "1.0.55",
+  "version": "1.0.57",
   "description": "Local-first email client with IMAP sync and standalone native app",
   "type": "module",
   "main": "bin/mailx.js",

package/packages/mailx-api/index.d.ts

@@ -1,9 +1,10 @@
 /**
  * @bobfrankston/mailx-api
- * Express Router with all REST endpoints for the mailx client.
+ * Thin Express Router — delegates all logic to mailx-service.
  */
 import { Router } from "express";
 import { MailxDB } from "@bobfrankston/mailx-store";
 import { ImapManager } from "@bobfrankston/mailx-imap";
 export declare function createApiRouter(db: MailxDB, imapManager: ImapManager): Router;
+export { MailxService } from "@bobfrankston/mailx-service";
 //# sourceMappingURL=index.d.ts.map

package/packages/mailx-api/index.js

@@ -1,317 +1,65 @@
 /**
  * @bobfrankston/mailx-api
- * Express Router with all REST endpoints for the mailx client.
+ * Thin Express Router — delegates all logic to mailx-service.
  */
 import { Router } from "express";
-import { loadSettings, saveSettings, loadAllowlist, saveAllowlist, getStorePath } from "@bobfrankston/mailx-settings";
-import { simpleParser } from "mailparser";
-/** Sanitize HTML email body — strip remote content (images, CSS, scripts, event handlers) */
-function sanitizeHtml(html) {
-    let hasRemoteContent = false;
-    // Remove <script> tags and content
-    let clean = html.replace(/<script\b[^>]*>[\s\S]*?<\/script>/gi, "");
-    // Remove event handlers (onclick, onload, onerror, etc.)
-    clean = clean.replace(/\s+on\w+\s*=\s*("[^"]*"|'[^']*'|[^\s>]+)/gi, "");
-    // Replace remote images with placeholder — keep data: and cid: URIs
-    clean = clean.replace(/<img\b([^>]*)\bsrc\s*=\s*("[^"]*"|'[^']*')/gi, (match, before, src) => {
-        const url = src.slice(1, -1); // remove quotes
-        if (url.startsWith("data:") || url.startsWith("cid:"))
-            return match;
-        hasRemoteContent = true;
-        return `<img${before}src="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='20' height='20'%3E%3Crect fill='%23888' width='20' height='20' rx='3'/%3E%3Ctext x='10' y='14' text-anchor='middle' fill='white' font-size='12'%3E⊘%3C/text%3E%3C/svg%3E" data-blocked-src=${src} title="Remote image blocked"`;
-    });
-    // Block remote CSS via <link> tags
-    clean = clean.replace(/<link\b[^>]*rel\s*=\s*["']stylesheet["'][^>]*>/gi, (match) => {
-        hasRemoteContent = true;
-        return `<!-- blocked: ${match.replace(/--/g, "")} -->`;
-    });
-    // Block background images in inline styles
-    clean = clean.replace(/url\s*\(\s*(['"]?)(https?:\/\/[^)]+)\1\s*\)/gi, (match, _q, url) => {
-        hasRemoteContent = true;
-        return `url("") /* blocked: ${url} */`;
-    });
-    // Remove <form> tags
-    clean = clean.replace(/<\/?form\b[^>]*>/gi, "");
-    // Remove <iframe> tags (within email body)
-    clean = clean.replace(/<iframe\b[^>]*>[\s\S]*?<\/iframe>/gi, "");
-    return { html: clean, hasRemoteContent };
-}
+import { MailxService } from "@bobfrankston/mailx-service";
 export function createApiRouter(db, imapManager) {
+    const svc = new MailxService(db, imapManager);
     const router = Router();
     router.use((req, res, next) => { res.type("json"); res.set("Cache-Control", "no-store"); next(); });
     // ── Accounts ──
-    router.get("/accounts", (req, res) => {
-        const accounts = db.getAccounts();
-        const settings = loadSettings();
-        // Merge settings flags
-        const enriched = accounts.map(a => {
-            const cfg = settings.accounts.find(s => s.id === a.id);
-            return { ...a, label: cfg?.label, defaultSend: cfg?.defaultSend || false };
-        });
-        res.json(enriched);
-    });
+    router.get("/accounts", (req, res) => { res.json(svc.getAccounts()); });
     // ── Folders ──
-    router.get("/folders/:accountId", (req, res) => {
-        const folders = db.getFolders(req.params.accountId);
-        res.json(folders);
-    });
+    router.get("/folders/:accountId", (req, res) => { res.json(svc.getFolders(req.params.accountId)); });
     // ── Messages ──
-    // Unified inbox — MUST be before :accountId/:folderId route
     router.get("/messages/unified/inbox", (req, res) => {
-        const page = Number(req.query.page) || 1;
-        const pageSize = Number(req.query.pageSize) || 50;
-        const result = db.getUnifiedInbox(page, pageSize);
-        res.json(result);
+        res.json(svc.getUnifiedInbox(Number(req.query.page) || 1, Number(req.query.pageSize) || 50));
     });
-    // Per-folder messages (after unified to avoid route conflict)
     router.get("/messages/:accountId/:folderId", (req, res) => {
-        const result = db.getMessages({
-            accountId: req.params.accountId,
-            folderId: Number(req.params.folderId),
-            page: Number(req.query.page) || 1,
-            pageSize: Number(req.query.pageSize) || 50,
-            sort: req.query.sort || "date",
-            sortDir: req.query.sortDir || "desc",
-            search: req.query.search
-        });
-        res.json(result);
+        res.json(svc.getMessages(req.params.accountId, Number(req.params.folderId), Number(req.query.page) || 1, Number(req.query.pageSize) || 50, req.query.sort || "date", req.query.sortDir || "desc", req.query.search));
     });
     router.get("/message/:accountId/:uid", async (req, res) => {
         try {
-            const { accountId, uid } = req.params;
-            let allowRemote = req.query.allowRemote === "true";
-            const folderId = req.query.folderId ? Number(req.query.folderId) : undefined;
-            const envelope = db.getMessageByUid(accountId, Number(uid), folderId);
-            if (!envelope)
-                return res.status(404).json({ error: "Message not found" });
-            // Load body from store or fetch on demand from IMAP
-            let bodyHtml = "";
-            let bodyText = "";
-            let hasRemoteContent = false;
-            let attachments = [];
-            const t0 = Date.now();
-            let raw = null;
-            try {
-                raw = await imapManager.fetchMessageBody(accountId, envelope.folderId, envelope.uid);
-            }
-            catch (fetchErr) {
-                console.error(`  [fetch] Failed UID ${uid}: ${fetchErr.message || fetchErr}`);
-                // Return envelope with error instead of 500 — user can still see headers
-                return res.json({ ...envelope, bodyHtml: "", bodyText: `[Message body unavailable: ${fetchErr.message || "IMAP connection failed"}]`, hasRemoteContent: false, remoteAllowed: false, attachments: [], emlPath: "", deliveredTo: "", returnPath: "", listUnsubscribe: "" });
-            }
-            const t1 = Date.now();
-            if (raw) {
-                const parsed = await simpleParser(raw);
-                const t2 = Date.now();
-                if (t2 - t0 > 2000)
-                    console.log(`  [slow] Message ${uid}: fetch=${t1 - t0}ms parse=${t2 - t1}ms total=${t2 - t0}ms (${raw.length} bytes)`);
-                bodyHtml = parsed.html || "";
-                bodyText = parsed.text || "";
-                attachments = (parsed.attachments || []).map((a, i) => ({
-                    id: i,
-                    filename: a.filename || `attachment-${i}`,
-                    mimeType: a.contentType || "application/octet-stream",
-                    size: a.size || 0,
-                    contentId: a.contentId || ""
-                }));
-            }
-            // Sanitize HTML — block remote content unless allowed or sender is on allow-list
-            if (bodyHtml && !allowRemote) {
-                const allowList = loadAllowlist();
-                const senderAddr = envelope.from?.address || "";
-                const senderDomain = senderAddr.split("@")[1] || "";
-                const toAddrs = (envelope.to || []).map((a) => a.address);
-                const isAllowed = allowList.senders.includes(senderAddr) ||
-                    allowList.domains.includes(senderDomain) ||
-                    toAddrs.some((a) => allowList.recipients?.includes(a));
-                if (isAllowed) {
-                    allowRemote = true;
-                }
-                else {
-                    const result = sanitizeHtml(bodyHtml);
-                    bodyHtml = result.html;
-                    hasRemoteContent = result.hasRemoteContent;
-                }
-            }
-            // Build .eml file path
-            const storePath = getStorePath();
-            const emlPath = `${storePath}/${accountId}/${envelope.folderId}/${envelope.uid}.eml`;
-            // Extract useful headers (values may be strings or structured objects)
-            let deliveredTo = "";
-            let returnPath = "";
-            let listUnsubscribe = "";
-            if (raw) {
-                const parsed2 = await simpleParser(raw);
-                const hdr = (key) => {
-                    let v = parsed2.headers.get(key);
-                    if (!v)
-                        return "";
-                    if (Array.isArray(v))
-                        v = v[0];
-                    if (typeof v === "string")
-                        return v;
-                    if (typeof v === "object" && v !== null) {
-                        if ("text" in v)
-                            return v.text || "";
-                        if ("value" in v)
-                            return String(v.value);
-                        if ("address" in v)
-                            return v.address || "";
-                    }
-                    return String(v);
-                };
-                // Get the real Delivered-To, skipping relay domains from account config
-                const msgSettings = loadSettings();
-                const acctConfig = msgSettings.accounts.find((a) => a.id === accountId);
-                const relayDomains = acctConfig?.relayDomains || [];
-                const prefixes = acctConfig?.deliveredToPrefix || [];
-                const rawDelivered = parsed2.headers.get("delivered-to");
-                if (rawDelivered) {
-                    const deliveredList = Array.isArray(rawDelivered) ? rawDelivered : [rawDelivered];
-                    for (let i = deliveredList.length - 1; i >= 0; i--) {
-                        const d = deliveredList[i];
-                        const addr = typeof d === "string" ? d : d?.text || d?.address || String(d);
-                        if (!relayDomains.some(rd => addr.includes(`@${rd}`))) {
-                            deliveredTo = addr;
-                            break;
-                        }
-                    }
-                    if (!deliveredTo && deliveredList.length > 0) {
-                        const d = deliveredList[deliveredList.length - 1];
-                        deliveredTo = typeof d === "string" ? d : d?.text || d?.address || String(d);
-                    }
-                    // Strip prefix from local part to get clean alias
-                    if (deliveredTo && prefixes.length > 0) {
-                        const [local, domain] = deliveredTo.split("@");
-                        for (const prefix of prefixes) {
-                            if (local.startsWith(prefix)) {
-                                deliveredTo = `${local.slice(prefix.length)}@${domain}`;
-                                break;
-                            }
-                        }
-                    }
-                }
-                returnPath = hdr("return-path").replace(/[<>]/g, "");
-                // mailparser merges List-* headers into a "list" object
-                const listHeaders = parsed2.headers.get("list");
-                if (listHeaders?.unsubscribe) {
-                    const unsub = listHeaders.unsubscribe;
-                    listUnsubscribe = unsub.url || (unsub.mail ? `mailto:${unsub.mail}` : "");
-                }
-            }
-            const message = {
-                ...envelope,
-                bodyHtml,
-                bodyText,
-                hasRemoteContent,
-                remoteAllowed: allowRemote,
-                attachments,
-                emlPath,
-                deliveredTo,
-                returnPath,
-                listUnsubscribe,
-            };
-            res.json(message);
+            const msg = await svc.getMessage(req.params.accountId, Number(req.params.uid), req.query.allowRemote === "true", req.query.folderId ? Number(req.query.folderId) : undefined);
+            res.json(msg);
         }
         catch (e) {
-            res.status(500).json({ error: e.message });
+            res.status(e.message === "Message not found" ? 404 : 500).json({ error: e.message });
         }
     });
     router.patch("/message/:accountId/:uid/flags", async (req, res) => {
-        const { accountId, uid } = req.params;
-        const { flags } = req.body;
-        const envelope = db.getMessageByUid(accountId, Number(uid));
-        // Local-first: update DB, queue IMAP sync
-        await imapManager.updateFlagsLocal(accountId, Number(uid), envelope?.folderId || 0, flags);
-        res.json({ ok: true });
+        try {
+            await svc.updateFlags(req.params.accountId, Number(req.params.uid), req.body.flags);
+            res.json({ ok: true });
+        }
+        catch (e) {
+            res.status(500).json({ error: e.message });
+        }
     });
     // ── Remote content allow-list ──
     router.post("/settings/allow-remote", (req, res) => {
-        const { type, value } = req.body;
-        const list = loadAllowlist();
-        if (type === "sender" && !list.senders.includes(value)) {
-            list.senders.push(value);
-        }
-        else if (type === "domain" && !list.domains.includes(value)) {
-            list.domains.push(value);
-        }
-        else if (type === "recipient") {
-            if (!list.recipients)
-                list.recipients = [];
-            if (!list.recipients.includes(value))
-                list.recipients.push(value);
-        }
-        saveAllowlist(list);
-        console.log(`  [allow] Added ${type}: ${value}`);
+        svc.allowRemoteContent(req.body.type, req.body.value);
         res.json({ ok: true });
     });
     // ── Search ──
     router.get("/search", async (req, res) => {
-        const q = req.query.q || "";
-        const page = Number(req.query.page) || 1;
-        const pageSize = Number(req.query.pageSize) || 50;
-        const scope = req.query.scope || "all";
-        const accountId = req.query.accountId || "";
-        const folderId = Number(req.query.folderId) || 0;
-        if (!q.trim())
-            return res.json({ items: [], total: 0, page, pageSize });
         try {
-            if (scope === "server" && accountId) {
-                // IMAP server search
-                const folders = db.getFolders(accountId);
-                const folder = folderId ? folders.find(f => f.id === folderId) : folders.find(f => f.specialUse === "inbox");
-                if (!folder)
-                    return res.json({ items: [], total: 0, page, pageSize });
-                const criteria = {};
-                // Parse qualifiers
-                const fromMatch = q.match(/from:(\S+)/i);
-                const toMatch = q.match(/to:(\S+)/i);
-                const subjectMatch = q.match(/subject:(.+?)(?:\s+\w+:|$)/i);
-                const bodyText = q.replace(/(?:from|to|subject):\S+/gi, "").trim();
-                if (fromMatch)
-                    criteria.from = fromMatch[1];
-                if (toMatch)
-                    criteria.to = toMatch[1];
-                if (subjectMatch)
-                    criteria.subject = subjectMatch[1].trim();
-                if (bodyText)
-                    criteria.body = bodyText;
-                const uids = await imapManager.searchOnServer(accountId, folder.path, criteria);
-                // Fetch envelopes for matching UIDs from local DB
-                const items = uids.slice((page - 1) * pageSize, page * pageSize)
-                    .map(uid => db.getMessageByUid(accountId, uid, folderId))
-                    .filter(Boolean);
-                res.json({ items, total: uids.length, page, pageSize });
-            }
-            else if (scope === "current" && accountId && folderId) {
-                // Search within current folder only
-                const result = db.searchMessages(q, page, pageSize, accountId, folderId);
-                res.json(result);
-            }
-            else {
-                // All folders (default)
-                const result = db.searchMessages(q, page, pageSize);
-                res.json(result);
-            }
+            const result = await svc.search(req.query.q || "", Number(req.query.page) || 1, Number(req.query.pageSize) || 50, req.query.scope || "all", req.query.accountId, Number(req.query.folderId) || 0);
+            res.json(result);
         }
         catch (e) {
             res.status(500).json({ error: e.message });
         }
     });
     router.post("/search/rebuild", (req, res) => {
-        const count = db.rebuildSearchIndex();
-        console.log(`  Rebuilt search index: ${count} messages`);
-        res.json({ ok: true, indexed: count });
-    });
-    // ── Sync status ──
-    router.get("/sync/pending", (req, res) => {
-        const count = db.getTotalPendingSyncCount();
-        res.json({ pending: count });
+        res.json({ ok: true, indexed: svc.rebuildSearchIndex() });
     });
     // ── Sync ──
+    router.get("/sync/pending", (req, res) => { res.json(svc.getSyncPending()); });
     router.post("/sync", async (req, res) => {
         try {
-            await imapManager.syncAll();
+            await svc.syncAll();
             res.json({ ok: true });
         }
         catch (e) {
@@ -320,24 +68,7 @@ export function createApiRouter(db, imapManager) {
     });
     router.post("/sync/:accountId", async (req, res) => {
         try {
-            const folders = await imapManager.syncFolders(req.params.accountId);
-            // INBOX first
-            folders.sort((a, b) => {
-                if (a.specialUse === "inbox")
-                    return -1;
-                if (b.specialUse === "inbox")
-                    return 1;
-                return 0;
-            });
-            for (const folder of folders) {
-                try {
-                    await imapManager.syncFolder(req.params.accountId, folder.id);
-                }
-                catch (e) {
-                    // Non-existent folders handled internally by syncFolder caller
-                    console.error(`  Skipping folder ${folder.path}: ${e.message}`);
-                }
-            }
+            await svc.syncAccount(req.params.accountId);
             res.json({ ok: true });
         }
         catch (e) {
@@ -347,45 +78,7 @@ export function createApiRouter(db, imapManager) {
     // ── Send ──
     router.post("/send", async (req, res) => {
         try {
-            const msg = req.body;
-            const settings = loadSettings();
-            const account = settings.accounts.find(a => a.id === msg.from);
-            if (!account)
-                return res.status(400).json({ error: `Unknown account: ${msg.from}` });
-            // Use custom From address if provided, otherwise account default
-            const fromHeader = msg.fromAddress || `${account.name} <${account.email}>`;
-            // Build RFC 822 message
-            const to = msg.to.map((a) => a.name ? `${a.name} <${a.address}>` : a.address).join(", ");
-            const cc = msg.cc?.map((a) => a.name ? `${a.name} <${a.address}>` : a.address).join(", ");
-            const bcc = msg.bcc?.map((a) => a.name ? `${a.name} <${a.address}>` : a.address).join(", ");
-            const body = msg.bodyHtml || msg.bodyText || "";
-            const bodyBase64 = Buffer.from(body, "utf-8").toString("base64").replace(/(.{76})/g, "$1\r\n");
-            const headers = [
-                `From: ${fromHeader}`,
-                `To: ${to}`,
-                cc ? `Cc: ${cc}` : null,
-                bcc ? `Bcc: ${bcc}` : null,
-                `Subject: ${msg.subject}`,
-                `Date: ${new Date().toUTCString()}`,
-                msg.inReplyTo ? `In-Reply-To: ${msg.inReplyTo}` : null,
-                msg.references?.length ? `References: ${msg.references.join(" ")}` : null,
-                `MIME-Version: 1.0`,
-                `Content-Type: text/html; charset=UTF-8`,
-                `Content-Transfer-Encoding: base64`,
-            ].filter(h => h !== null).join("\r\n");
-            const rawMessage = `${headers}\r\n\r\n${bodyBase64}`;
-            // Local-first: save to sync queue, worker will APPEND to Outbox and send
-            imapManager.queueOutgoingLocal(account.id, rawMessage);
-            console.log(`  Queued locally: ${msg.subject} via ${account.id} from ${fromHeader}`);
-            // Record recipient addresses for autocomplete
-            for (const addr of msg.to)
-                db.recordSentAddress(addr.name, addr.address);
-            if (msg.cc)
-                for (const addr of msg.cc)
-                    db.recordSentAddress(addr.name, addr.address);
-            if (msg.bcc)
-                for (const addr of msg.bcc)
-                    db.recordSentAddress(addr.name, addr.address);
+            await svc.send(req.body);
             res.json({ ok: true, queued: true });
         }
         catch (e) {
@@ -396,62 +89,39 @@ export function createApiRouter(db, imapManager) {
     // ── Delete ──
     router.delete("/message/:accountId/:uid", async (req, res) => {
         try {
-            const { accountId, uid } = req.params;
-            const envelope = db.getMessageByUid(accountId, Number(uid));
-            if (!envelope)
-                return res.status(404).json({ error: "Message not found" });
-            await imapManager.trashMessage(accountId, envelope.folderId, envelope.uid);
+            await svc.deleteMessage(req.params.accountId, Number(req.params.uid));
             res.json({ ok: true });
         }
         catch (e) {
-            console.error(`  Delete error: ${e.message}`);
-            res.status(500).json({ error: e.message });
+            const status = e.message === "Message not found" ? 404 : 500;
+            res.status(status).json({ error: e.message });
         }
     });
-    // ── Move message to another folder ──
+    // ── Move ──
     router.post("/message/:accountId/:uid/move", async (req, res) => {
         try {
-            const { accountId, uid } = req.params;
-            const { targetFolderId, targetAccountId } = req.body;
-            if (targetFolderId == null)
-                return res.status(400).json({ error: "targetFolderId required" });
-            const envelope = db.getMessageByUid(accountId, Number(uid));
-            if (!envelope)
-                return res.status(404).json({ error: "Message not found" });
-            if (targetAccountId && targetAccountId !== accountId) {
-                // Cross-account move via iflow
-                await imapManager.moveMessageCrossAccount(accountId, envelope.uid, envelope.folderId, targetAccountId, targetFolderId);
-            }
-            else {
-                // Same-account move
-                await imapManager.moveMessage(accountId, envelope.uid, envelope.folderId, targetFolderId);
-            }
+            await svc.moveMessage(req.params.accountId, Number(req.params.uid), req.body.targetFolderId, req.body.targetAccountId);
             res.json({ ok: true });
         }
         catch (e) {
-            console.error(`  Move error: ${e.message}`);
-            res.status(500).json({ error: e.message });
+            const status = e.message === "Message not found" ? 404 : 500;
+            res.status(status).json({ error: e.message });
         }
     });
-    // ── Undelete (move from Trash back to original folder) ──
+    // ── Undelete ──
     router.post("/message/:accountId/:uid/undelete", async (req, res) => {
         try {
-            const { accountId, uid } = req.params;
-            const { folderId } = req.body;
-            await imapManager.undeleteMessage(accountId, Number(uid), folderId);
+            await svc.undeleteMessage(req.params.accountId, Number(req.params.uid), req.body.folderId);
             res.json({ ok: true });
         }
         catch (e) {
-            console.error(`  Undelete error: ${e.message}`);
             res.status(500).json({ error: e.message });
         }
     });
-    // ── Direct IMAP delete (for messages not in local DB) ──
+    // ── Direct IMAP delete ──
     router.delete("/imap/:accountId/:folderPath/:uid", async (req, res) => {
         try {
-            const { accountId, uid } = req.params;
-            const folderPath = decodeURIComponent(req.params.folderPath);
-            await imapManager.deleteOnServer(accountId, folderPath, Number(uid));
+            await svc.deleteOnServer(req.params.accountId, decodeURIComponent(req.params.folderPath), Number(req.params.uid));
             res.json({ ok: true });
         }
         catch (e) {
@@ -459,123 +129,45 @@ export function createApiRouter(db, imapManager) {
         }
     });
     // ── Folder management ──
-    // Create subfolder
     router.post("/folder/:accountId", async (req, res) => {
         try {
-            const { accountId } = req.params;
-            const { parentPath, name } = req.body;
-            const fullPath = parentPath ? `${parentPath}.${name}` : name;
-            const client = imapManager.createPublicClient(accountId);
-            try {
-                await client.createmailbox(fullPath);
-                await imapManager.syncFolders(accountId, client);
-                await client.logout();
-            }
-            finally {
-                try {
-                    await client.logout();
-                }
-                catch { /* */ }
-            }
+            await svc.createFolder(req.params.accountId, req.body.parentPath, req.body.name);
             res.json({ ok: true });
         }
         catch (e) {
             res.status(500).json({ error: e.message });
         }
     });
-    // Rename folder
     router.post("/folder/:accountId/:folderId/rename", async (req, res) => {
         try {
-            const { accountId, folderId } = req.params;
-            const { newName } = req.body;
-            const folder = db.getFolders(accountId).find(f => f.id === Number(folderId));
-            if (!folder)
-                return res.status(404).json({ error: "Folder not found" });
-            const parts = folder.path.split(folder.delimiter || ".");
-            parts[parts.length - 1] = newName;
-            const newPath = parts.join(folder.delimiter || ".");
-            const client = imapManager.createPublicClient(accountId);
-            try {
-                // iflow doesn't have renamemailbox yet — use raw imapflow
-                await client.withConnection(async () => {
-                    await client.client.mailboxRename(folder.path, newPath);
-                });
-                await imapManager.syncFolders(accountId, client);
-                await client.logout();
-            }
-            finally {
-                try {
-                    await client.logout();
-                }
-                catch { /* */ }
-            }
+            await svc.renameFolder(req.params.accountId, Number(req.params.folderId), req.body.newName);
             res.json({ ok: true });
         }
         catch (e) {
             res.status(500).json({ error: e.message });
         }
     });
-    // Delete folder
     router.delete("/folder/:accountId/:folderId", async (req, res) => {
         try {
-            const { accountId, folderId } = req.params;
-            const folder = db.getFolders(accountId).find(f => f.id === Number(folderId));
-            if (!folder)
-                return res.status(404).json({ error: "Folder not found" });
-            const client = imapManager.createPublicClient(accountId);
-            try {
-                await client.withConnection(async () => {
-                    await client.client.mailboxDelete(folder.path);
-                });
-                db.deleteFolder(Number(folderId));
-                await client.logout();
-            }
-            finally {
-                try {
-                    await client.logout();
-                }
-                catch { /* */ }
-            }
+            await svc.deleteFolder(req.params.accountId, Number(req.params.folderId));
             res.json({ ok: true });
         }
         catch (e) {
             res.status(500).json({ error: e.message });
         }
     });
-    // Mark all messages in folder as read
     router.post("/folder/:accountId/:folderId/mark-read", async (req, res) => {
         try {
-            const { accountId, folderId } = req.params;
-            db.markFolderRead(Number(folderId));
+            svc.markFolderRead(Number(req.params.folderId));
             res.json({ ok: true });
         }
         catch (e) {
             res.status(500).json({ error: e.message });
         }
     });
-    // Empty folder (permanently delete all messages)
     router.post("/folder/:accountId/:folderId/empty", async (req, res) => {
         try {
-            const { accountId, folderId } = req.params;
-            const folder = db.getFolders(accountId).find(f => f.id === Number(folderId));
-            if (!folder)
-                return res.status(404).json({ error: "Folder not found" });
-            db.deleteAllMessages(accountId, Number(folderId));
-            // Also delete on IMAP
-            const client = imapManager.createPublicClient(accountId);
-            try {
-                const uids = await client.getUids(folder.path);
-                for (const uid of uids) {
-                    await client.deleteMessageByUid(folder.path, uid);
-                }
-                await client.logout();
-            }
-            finally {
-                try {
-                    await client.logout();
-                }
-                catch { /* */ }
-            }
+            await svc.emptyFolder(req.params.accountId, Number(req.params.folderId));
             res.json({ ok: true });
         }
         catch (e) {
@@ -585,58 +177,31 @@ export function createApiRouter(db, imapManager) {
     // ── Attachments ──
     router.get("/message/:accountId/:uid/attachment/:attachmentId", async (req, res) => {
         try {
-            const { accountId, uid, attachmentId } = req.params;
-            const folderId = req.query.folderId ? Number(req.query.folderId) : undefined;
-            const envelope = db.getMessageByUid(accountId, Number(uid), folderId);
-            if (!envelope)
-                return res.status(404).json({ error: "Message not found" });
-            const raw = await imapManager.fetchMessageBody(accountId, envelope.folderId, envelope.uid);
-            if (!raw)
-                return res.status(404).json({ error: "Message body not available" });
-            const parsed = await simpleParser(raw);
-            const att = parsed.attachments?.[Number(attachmentId)];
-            if (!att)
-                return res.status(404).json({ error: "Attachment not found" });
-            res.set("Content-Type", att.contentType || "application/octet-stream");
-            res.set("Content-Disposition", `inline; filename="${(att.filename || "attachment").replace(/"/g, "")}""`);
+            const att = await svc.getAttachment(req.params.accountId, Number(req.params.uid), Number(req.params.attachmentId), req.query.folderId ? Number(req.query.folderId) : undefined);
+            res.set("Content-Type", att.contentType);
+            res.set("Content-Disposition", `inline; filename="${att.filename}"`);
             res.send(att.content);
         }
         catch (e) {
-            res.status(500).json({ error: e.message });
+            const status = e.message.includes("not found") || e.message.includes("not available") ? 404 : 500;
+            res.status(status).json({ error: e.message });
         }
     });
     // ── Drafts ──
     router.post("/draft", async (req, res) => {
         try {
             const { accountId, subject, bodyHtml, bodyText, to, cc, previousDraftUid } = req.body;
-            const settings = loadSettings();
-            const account = settings.accounts.find(a => a.id === accountId);
-            if (!account)
-                return res.status(400).json({ error: `Unknown account: ${accountId}` });
-            const headers = [
-                `From: ${account.name} <${account.email}>`,
-                to ? `To: ${to}` : null,
-                cc ? `Cc: ${cc}` : null,
-                `Subject: ${subject || "(no subject)"}`,
-                `Date: ${new Date().toUTCString()}`,
-                `MIME-Version: 1.0`,
-                `Content-Type: text/html; charset=UTF-8`,
-            ].filter(h => h !== null).join("\r\n");
-            const raw = `${headers}\r\n\r\n${bodyHtml || bodyText || ""}`;
-            const uid = await imapManager.saveDraft(accountId, raw, previousDraftUid);
+            const uid = await svc.saveDraft(accountId, subject, bodyHtml, bodyText, to, cc, previousDraftUid);
             res.json({ ok: true, draftUid: uid });
         }
         catch (e) {
-            console.error(`  Draft save error: ${e.message}`);
             res.status(500).json({ error: e.message });
         }
     });
     router.delete("/draft", async (req, res) => {
         try {
-            const { accountId, draftUid } = req.body;
-            if (accountId && draftUid) {
-                await imapManager.deleteDraft(accountId, draftUid);
-            }
+            if (req.body.accountId && req.body.draftUid)
+                await svc.deleteDraft(req.body.accountId, req.body.draftUid);
             res.json({ ok: true });
         }
         catch (e) {
@@ -644,36 +209,22 @@ export function createApiRouter(db, imapManager) {
         }
     });
     // ── Contacts ──
-    router.get("/contacts", (req, res) => {
-        const q = req.query.q || "";
-        if (q.length < 1)
-            return res.json([]);
-        const results = db.searchContacts(q);
-        res.json(results);
-    });
+    router.get("/contacts", (req, res) => { res.json(svc.searchContacts(req.query.q || "")); });
     router.post("/contacts/sync-google", async (req, res) => {
         try {
-            await imapManager.syncAllContacts();
+            await svc.syncGoogleContacts();
             res.json({ ok: true });
         }
         catch (e) {
             res.status(500).json({ error: e.message });
         }
     });
-    router.post("/contacts/seed", (req, res) => {
-        const added = db.seedContactsFromMessages();
-        console.log(`  Seeded ${added} contacts from message history`);
-        res.json({ ok: true, added });
-    });
+    router.post("/contacts/seed", (req, res) => { res.json({ ok: true, added: svc.seedContacts() }); });
     // ── Settings ──
-    router.get("/settings", (req, res) => {
-        const settings = loadSettings();
-        res.json(settings);
-    });
-    router.put("/settings", (req, res) => {
-        saveSettings(req.body);
-        res.json({ ok: true });
-    });
+    router.get("/settings", (req, res) => { res.json(svc.getSettings()); });
+    router.put("/settings", (req, res) => { svc.saveSettings(req.body); res.json({ ok: true }); });
     return router;
 }
+// Re-export the service for direct use (Android bridge, worker thread, etc.)
+export { MailxService } from "@bobfrankston/mailx-service";
 //# sourceMappingURL=index.js.map

package/packages/mailx-api/package.json

@@ -13,9 +13,8 @@
     "@bobfrankston/mailx-store": "file:../mailx-store",
     "@bobfrankston/mailx-imap": "file:../mailx-imap",
     "@bobfrankston/mailx-settings": "file:../mailx-settings",
-    "express": "^4.21.0",
-    "mailparser": "^3.7.2",
-    "nodemailer": "^7.0.0"
+    "@bobfrankston/mailx-service": "file:../mailx-service",
+    "express": "^4.21.0"
   },
   "devDependencies": {
     "@types/express": "^5.0.0",

package/packages/mailx-service/index.d.ts

@@ -0,0 +1,58 @@
+/**
+ * @bobfrankston/mailx-service
+ * Pure business logic — no HTTP, no Express.
+ * Both the Express API (mailx-api) and the Android bridge call these functions.
+ */
+import { MailxDB } from "@bobfrankston/mailx-store";
+import { ImapManager } from "@bobfrankston/mailx-imap";
+import type { Folder } from "@bobfrankston/mailx-types";
+export declare function sanitizeHtml(html: string): {
+    html: string;
+    hasRemoteContent: boolean;
+};
+export declare class MailxService {
+    private db;
+    private imapManager;
+    constructor(db: MailxDB, imapManager: ImapManager);
+    getAccounts(): any[];
+    getFolders(accountId: string): Folder[];
+    getUnifiedInbox(page?: number, pageSize?: number): any;
+    getMessages(accountId: string, folderId: number, page?: number, pageSize?: number, sort?: string, sortDir?: string, search?: string): any;
+    getMessage(accountId: string, uid: number, allowRemote?: boolean, folderId?: number): Promise<any>;
+    updateFlags(accountId: string, uid: number, flags: string[]): Promise<void>;
+    allowRemoteContent(type: "sender" | "domain" | "recipient", value: string): void;
+    search(q: string, page?: number, pageSize?: number, scope?: string, accountId?: string, folderId?: number): Promise<any>;
+    rebuildSearchIndex(): number;
+    getSyncPending(): {
+        pending: number;
+    };
+    syncAll(): Promise<void>;
+    syncAccount(accountId: string): Promise<void>;
+    send(msg: any): Promise<void>;
+    deleteMessage(accountId: string, uid: number): Promise<void>;
+    moveMessage(accountId: string, uid: number, targetFolderId: number, targetAccountId?: string): Promise<void>;
+    undeleteMessage(accountId: string, uid: number, folderId: number): Promise<void>;
+    deleteOnServer(accountId: string, folderPath: string, uid: number): Promise<void>;
+    createFolder(accountId: string, parentPath: string, name: string): Promise<void>;
+    renameFolder(accountId: string, folderId: number, newName: string): Promise<void>;
+    deleteFolder(accountId: string, folderId: number): Promise<void>;
+    markFolderRead(folderId: number): void;
+    emptyFolder(accountId: string, folderId: number): Promise<void>;
+    getAttachment(accountId: string, uid: number, attachmentId: number, folderId?: number): Promise<{
+        content: Buffer;
+        contentType: string;
+        filename: string;
+    }>;
+    saveDraft(accountId: string, subject: string, bodyHtml: string, bodyText: string, to?: string, cc?: string, previousDraftUid?: number): Promise<number | null>;
+    deleteDraft(accountId: string, draftUid: number): Promise<void>;
+    searchContacts(query: string): any[];
+    syncGoogleContacts(): Promise<void>;
+    seedContacts(): number;
+    getSettings(): any;
+    saveSettings(settings: any): void;
+    getStorageInfo(): {
+        provider: string;
+        mode: string;
+    };
+}
+//# sourceMappingURL=index.d.ts.map

package/packages/mailx-service/index.js

@@ -0,0 +1,456 @@
+/**
+ * @bobfrankston/mailx-service
+ * Pure business logic — no HTTP, no Express.
+ * Both the Express API (mailx-api) and the Android bridge call these functions.
+ */
+import { loadSettings, saveSettings, loadAllowlist, saveAllowlist, getStorePath, getStorageInfo } from "@bobfrankston/mailx-settings";
+import { simpleParser } from "mailparser";
+// ── Sanitize ──
+export function sanitizeHtml(html) {
+    let hasRemoteContent = false;
+    let clean = html.replace(/<script\b[^>]*>[\s\S]*?<\/script>/gi, "");
+    clean = clean.replace(/\s+on\w+\s*=\s*("[^"]*"|'[^']*'|[^\s>]+)/gi, "");
+    clean = clean.replace(/<img\b([^>]*)\bsrc\s*=\s*("[^"]*"|'[^']*')/gi, (match, before, src) => {
+        const url = src.slice(1, -1);
+        if (url.startsWith("data:") || url.startsWith("cid:"))
+            return match;
+        hasRemoteContent = true;
+        return `<img${before}src="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='20' height='20'%3E%3Crect fill='%23888' width='20' height='20' rx='3'/%3E%3Ctext x='10' y='14' text-anchor='middle' fill='white' font-size='12'%3E⊘%3C/text%3E%3C/svg%3E" data-blocked-src=${src} title="Remote image blocked"`;
+    });
+    clean = clean.replace(/<link\b[^>]*rel\s*=\s*["']stylesheet["'][^>]*>/gi, (match) => {
+        hasRemoteContent = true;
+        return `<!-- blocked: ${match.replace(/--/g, "")} -->`;
+    });
+    clean = clean.replace(/url\s*\(\s*(['"]?)(https?:\/\/[^)]+)\1\s*\)/gi, (_match, _q, url) => {
+        hasRemoteContent = true;
+        return `url("") /* blocked: ${url} */`;
+    });
+    clean = clean.replace(/<\/?form\b[^>]*>/gi, "");
+    clean = clean.replace(/<iframe\b[^>]*>[\s\S]*?<\/iframe>/gi, "");
+    return { html: clean, hasRemoteContent };
+}
+// ── Service ──
+export class MailxService {
+    db;
+    imapManager;
+    constructor(db, imapManager) {
+        this.db = db;
+        this.imapManager = imapManager;
+    }
+    // ── Accounts ──
+    getAccounts() {
+        const accounts = this.db.getAccounts();
+        const settings = loadSettings();
+        return accounts.map(a => {
+            const cfg = settings.accounts.find(s => s.id === a.id);
+            return { ...a, label: cfg?.label, defaultSend: cfg?.defaultSend || false };
+        });
+    }
+    // ── Folders ──
+    getFolders(accountId) {
+        return this.db.getFolders(accountId);
+    }
+    // ── Messages ──
+    getUnifiedInbox(page = 1, pageSize = 50) {
+        return this.db.getUnifiedInbox(page, pageSize);
+    }
+    getMessages(accountId, folderId, page = 1, pageSize = 50, sort = "date", sortDir = "desc", search) {
+        return this.db.getMessages({ accountId, folderId, page, pageSize, sort: sort, sortDir: sortDir, search });
+    }
+    async getMessage(accountId, uid, allowRemote = false, folderId) {
+        const envelope = this.db.getMessageByUid(accountId, uid, folderId);
+        if (!envelope)
+            throw new Error("Message not found");
+        let bodyHtml = "";
+        let bodyText = "";
+        let hasRemoteContent = false;
+        let attachments = [];
+        let raw = null;
+        try {
+            raw = await this.imapManager.fetchMessageBody(accountId, envelope.folderId, envelope.uid);
+        }
+        catch (fetchErr) {
+            return {
+                ...envelope, bodyHtml: "", bodyText: `[Message body unavailable: ${fetchErr.message || "IMAP connection failed"}]`,
+                hasRemoteContent: false, remoteAllowed: false, attachments: [], emlPath: "", deliveredTo: "", returnPath: "", listUnsubscribe: ""
+            };
+        }
+        if (raw) {
+            const parsed = await simpleParser(raw);
+            bodyHtml = parsed.html || "";
+            bodyText = parsed.text || "";
+            attachments = (parsed.attachments || []).map((a, i) => ({
+                id: i,
+                filename: a.filename || `attachment-${i}`,
+                mimeType: a.contentType || "application/octet-stream",
+                size: a.size || 0,
+                contentId: a.contentId || ""
+            }));
+        }
+        // Sanitize HTML
+        if (bodyHtml && !allowRemote) {
+            const allowList = loadAllowlist();
+            const senderAddr = envelope.from?.address || "";
+            const senderDomain = senderAddr.split("@")[1] || "";
+            const toAddrs = (envelope.to || []).map((a) => a.address);
+            const isAllowed = allowList.senders.includes(senderAddr) ||
+                allowList.domains.includes(senderDomain) ||
+                toAddrs.some((a) => allowList.recipients?.includes(a));
+            if (isAllowed) {
+                allowRemote = true;
+            }
+            else {
+                const result = sanitizeHtml(bodyHtml);
+                bodyHtml = result.html;
+                hasRemoteContent = result.hasRemoteContent;
+            }
+        }
+        // Extract headers
+        let deliveredTo = "";
+        let returnPath = "";
+        let listUnsubscribe = "";
+        if (raw) {
+            const parsed2 = await simpleParser(raw);
+            const hdr = (key) => {
+                let v = parsed2.headers.get(key);
+                if (!v)
+                    return "";
+                if (Array.isArray(v))
+                    v = v[0];
+                if (typeof v === "string")
+                    return v;
+                if (typeof v === "object" && v !== null) {
+                    if ("text" in v)
+                        return v.text || "";
+                    if ("value" in v)
+                        return String(v.value);
+                    if ("address" in v)
+                        return v.address || "";
+                }
+                return String(v);
+            };
+            const msgSettings = loadSettings();
+            const acctConfig = msgSettings.accounts.find((a) => a.id === accountId);
+            const relayDomains = acctConfig?.relayDomains || [];
+            const prefixes = acctConfig?.deliveredToPrefix || [];
+            const rawDelivered = parsed2.headers.get("delivered-to");
+            if (rawDelivered) {
+                const deliveredList = Array.isArray(rawDelivered) ? rawDelivered : [rawDelivered];
+                for (let i = deliveredList.length - 1; i >= 0; i--) {
+                    const d = deliveredList[i];
+                    const addr = typeof d === "string" ? d : d?.text || d?.address || String(d);
+                    if (!relayDomains.some(rd => addr.includes(`@${rd}`))) {
+                        deliveredTo = addr;
+                        break;
+                    }
+                }
+                if (!deliveredTo && deliveredList.length > 0) {
+                    const d = deliveredList[deliveredList.length - 1];
+                    deliveredTo = typeof d === "string" ? d : d?.text || d?.address || String(d);
+                }
+                if (deliveredTo && prefixes.length > 0) {
+                    const [local, domain] = deliveredTo.split("@");
+                    for (const prefix of prefixes) {
+                        if (local.startsWith(prefix)) {
+                            deliveredTo = `${local.slice(prefix.length)}@${domain}`;
+                            break;
+                        }
+                    }
+                }
+            }
+            returnPath = hdr("return-path").replace(/[<>]/g, "");
+            const listHeaders = parsed2.headers.get("list");
+            if (listHeaders?.unsubscribe) {
+                const unsub = listHeaders.unsubscribe;
+                listUnsubscribe = unsub.url || (unsub.mail ? `mailto:${unsub.mail}` : "");
+            }
+        }
+        const storePath = getStorePath();
+        const emlPath = `${storePath}/${accountId}/${envelope.folderId}/${envelope.uid}.eml`;
+        return {
+            ...envelope, bodyHtml, bodyText, hasRemoteContent, remoteAllowed: allowRemote,
+            attachments, emlPath, deliveredTo, returnPath, listUnsubscribe,
+        };
+    }
+    async updateFlags(accountId, uid, flags) {
+        const envelope = this.db.getMessageByUid(accountId, uid);
+        await this.imapManager.updateFlagsLocal(accountId, uid, envelope?.folderId || 0, flags);
+    }
+    // ── Remote content allow-list ──
+    allowRemoteContent(type, value) {
+        const list = loadAllowlist();
+        if (type === "sender" && !list.senders.includes(value))
+            list.senders.push(value);
+        else if (type === "domain" && !list.domains.includes(value))
+            list.domains.push(value);
+        else if (type === "recipient") {
+            if (!list.recipients)
+                list.recipients = [];
+            if (!list.recipients.includes(value))
+                list.recipients.push(value);
+        }
+        saveAllowlist(list);
+        console.log(`  [allow] Added ${type}: ${value}`);
+    }
+    // ── Search ──
+    async search(q, page = 1, pageSize = 50, scope = "all", accountId, folderId) {
+        if (!q.trim())
+            return { items: [], total: 0, page, pageSize };
+        if (scope === "server" && accountId) {
+            const folders = this.db.getFolders(accountId);
+            const folder = folderId ? folders.find(f => f.id === folderId) : folders.find(f => f.specialUse === "inbox");
+            if (!folder)
+                return { items: [], total: 0, page, pageSize };
+            const criteria = {};
+            const fromMatch = q.match(/from:(\S+)/i);
+            const toMatch = q.match(/to:(\S+)/i);
+            const subjectMatch = q.match(/subject:(.+?)(?:\s+\w+:|$)/i);
+            const bodyText = q.replace(/(?:from|to|subject):\S+/gi, "").trim();
+            if (fromMatch)
+                criteria.from = fromMatch[1];
+            if (toMatch)
+                criteria.to = toMatch[1];
+            if (subjectMatch)
+                criteria.subject = subjectMatch[1].trim();
+            if (bodyText)
+                criteria.body = bodyText;
+            const uids = await this.imapManager.searchOnServer(accountId, folder.path, criteria);
+            const items = uids.slice((page - 1) * pageSize, page * pageSize)
+                .map(uid => this.db.getMessageByUid(accountId, uid, folderId))
+                .filter(Boolean);
+            return { items, total: uids.length, page, pageSize };
+        }
+        else if (scope === "current" && accountId && folderId) {
+            return this.db.searchMessages(q, page, pageSize, accountId, folderId);
+        }
+        else {
+            return this.db.searchMessages(q, page, pageSize);
+        }
+    }
+    rebuildSearchIndex() {
+        const count = this.db.rebuildSearchIndex();
+        console.log(`  Rebuilt search index: ${count} messages`);
+        return count;
+    }
+    // ── Sync ──
+    getSyncPending() {
+        return { pending: this.db.getTotalPendingSyncCount() };
+    }
+    async syncAll() {
+        await this.imapManager.syncAll();
+    }
+    async syncAccount(accountId) {
+        const folders = await this.imapManager.syncFolders(accountId);
+        folders.sort((a, b) => {
+            if (a.specialUse === "inbox")
+                return -1;
+            if (b.specialUse === "inbox")
+                return 1;
+            return 0;
+        });
+        for (const folder of folders) {
+            try {
+                await this.imapManager.syncFolder(accountId, folder.id);
+            }
+            catch (e) {
+                console.error(`  Skipping folder ${folder.path}: ${e.message}`);
+            }
+        }
+    }
+    // ── Send ──
+    async send(msg) {
+        const settings = loadSettings();
+        const account = settings.accounts.find(a => a.id === msg.from);
+        if (!account)
+            throw new Error(`Unknown account: ${msg.from}`);
+        const fromHeader = msg.fromAddress || `${account.name} <${account.email}>`;
+        const to = msg.to.map((a) => a.name ? `${a.name} <${a.address}>` : a.address).join(", ");
+        const cc = msg.cc?.map((a) => a.name ? `${a.name} <${a.address}>` : a.address).join(", ");
+        const bcc = msg.bcc?.map((a) => a.name ? `${a.name} <${a.address}>` : a.address).join(", ");
+        const body = msg.bodyHtml || msg.bodyText || "";
+        const bodyBase64 = Buffer.from(body, "utf-8").toString("base64").replace(/(.{76})/g, "$1\r\n");
+        const headers = [
+            `From: ${fromHeader}`, `To: ${to}`,
+            cc ? `Cc: ${cc}` : null, bcc ? `Bcc: ${bcc}` : null,
+            `Subject: ${msg.subject}`, `Date: ${new Date().toUTCString()}`,
+            msg.inReplyTo ? `In-Reply-To: ${msg.inReplyTo}` : null,
+            msg.references?.length ? `References: ${msg.references.join(" ")}` : null,
+            `MIME-Version: 1.0`, `Content-Type: text/html; charset=UTF-8`, `Content-Transfer-Encoding: base64`,
+        ].filter(h => h !== null).join("\r\n");
+        const rawMessage = `${headers}\r\n\r\n${bodyBase64}`;
+        this.imapManager.queueOutgoingLocal(account.id, rawMessage);
+        console.log(`  Queued locally: ${msg.subject} via ${account.id} from ${fromHeader}`);
+        for (const addr of msg.to)
+            this.db.recordSentAddress(addr.name, addr.address);
+        if (msg.cc)
+            for (const addr of msg.cc)
+                this.db.recordSentAddress(addr.name, addr.address);
+        if (msg.bcc)
+            for (const addr of msg.bcc)
+                this.db.recordSentAddress(addr.name, addr.address);
+    }
+    // ── Delete / Move / Undelete ──
+    async deleteMessage(accountId, uid) {
+        const envelope = this.db.getMessageByUid(accountId, uid);
+        if (!envelope)
+            throw new Error("Message not found");
+        await this.imapManager.trashMessage(accountId, envelope.folderId, envelope.uid);
+    }
+    async moveMessage(accountId, uid, targetFolderId, targetAccountId) {
+        const envelope = this.db.getMessageByUid(accountId, uid);
+        if (!envelope)
+            throw new Error("Message not found");
+        if (targetAccountId && targetAccountId !== accountId) {
+            await this.imapManager.moveMessageCrossAccount(accountId, envelope.uid, envelope.folderId, targetAccountId, targetFolderId);
+        }
+        else {
+            await this.imapManager.moveMessage(accountId, envelope.uid, envelope.folderId, targetFolderId);
+        }
+    }
+    async undeleteMessage(accountId, uid, folderId) {
+        await this.imapManager.undeleteMessage(accountId, uid, folderId);
+    }
+    async deleteOnServer(accountId, folderPath, uid) {
+        await this.imapManager.deleteOnServer(accountId, folderPath, uid);
+    }
+    // ── Folder management ──
+    async createFolder(accountId, parentPath, name) {
+        const fullPath = parentPath ? `${parentPath}.${name}` : name;
+        const client = this.imapManager.createPublicClient(accountId);
+        try {
+            await client.createmailbox(fullPath);
+            await this.imapManager.syncFolders(accountId, client);
+            await client.logout();
+        }
+        finally {
+            try {
+                await client.logout();
+            }
+            catch { /* */ }
+        }
+    }
+    async renameFolder(accountId, folderId, newName) {
+        const folder = this.db.getFolders(accountId).find(f => f.id === folderId);
+        if (!folder)
+            throw new Error("Folder not found");
+        const parts = folder.path.split(folder.delimiter || ".");
+        parts[parts.length - 1] = newName;
+        const newPath = parts.join(folder.delimiter || ".");
+        const client = this.imapManager.createPublicClient(accountId);
+        try {
+            await client.withConnection(async () => {
+                await client.client.mailboxRename(folder.path, newPath);
+            });
+            await this.imapManager.syncFolders(accountId, client);
+            await client.logout();
+        }
+        finally {
+            try {
+                await client.logout();
+            }
+            catch { /* */ }
+        }
+    }
+    async deleteFolder(accountId, folderId) {
+        const folder = this.db.getFolders(accountId).find(f => f.id === folderId);
+        if (!folder)
+            throw new Error("Folder not found");
+        const client = this.imapManager.createPublicClient(accountId);
+        try {
+            await client.withConnection(async () => {
+                await client.client.mailboxDelete(folder.path);
+            });
+            this.db.deleteFolder(folderId);
+            await client.logout();
+        }
+        finally {
+            try {
+                await client.logout();
+            }
+            catch { /* */ }
+        }
+    }
+    markFolderRead(folderId) {
+        this.db.markFolderRead(folderId);
+    }
+    async emptyFolder(accountId, folderId) {
+        const folder = this.db.getFolders(accountId).find(f => f.id === folderId);
+        if (!folder)
+            throw new Error("Folder not found");
+        this.db.deleteAllMessages(accountId, folderId);
+        const client = this.imapManager.createPublicClient(accountId);
+        try {
+            const uids = await client.getUids(folder.path);
+            for (const uid of uids)
+                await client.deleteMessageByUid(folder.path, uid);
+            await client.logout();
+        }
+        finally {
+            try {
+                await client.logout();
+            }
+            catch { /* */ }
+        }
+    }
+    // ── Attachments ──
+    async getAttachment(accountId, uid, attachmentId, folderId) {
+        const envelope = this.db.getMessageByUid(accountId, uid, folderId);
+        if (!envelope)
+            throw new Error("Message not found");
+        const raw = await this.imapManager.fetchMessageBody(accountId, envelope.folderId, envelope.uid);
+        if (!raw)
+            throw new Error("Message body not available");
+        const parsed = await simpleParser(raw);
+        const att = parsed.attachments?.[attachmentId];
+        if (!att)
+            throw new Error("Attachment not found");
+        return {
+            content: att.content,
+            contentType: att.contentType || "application/octet-stream",
+            filename: (att.filename || "attachment").replace(/"/g, ""),
+        };
+    }
+    // ── Drafts ──
+    async saveDraft(accountId, subject, bodyHtml, bodyText, to, cc, previousDraftUid) {
+        const settings = loadSettings();
+        const account = settings.accounts.find(a => a.id === accountId);
+        if (!account)
+            throw new Error(`Unknown account: ${accountId}`);
+        const headers = [
+            `From: ${account.name} <${account.email}>`,
+            to ? `To: ${to}` : null, cc ? `Cc: ${cc}` : null,
+            `Subject: ${subject || "(no subject)"}`, `Date: ${new Date().toUTCString()}`,
+            `MIME-Version: 1.0`, `Content-Type: text/html; charset=UTF-8`,
+        ].filter(h => h !== null).join("\r\n");
+        const raw = `${headers}\r\n\r\n${bodyHtml || bodyText || ""}`;
+        return this.imapManager.saveDraft(accountId, raw, previousDraftUid);
+    }
+    async deleteDraft(accountId, draftUid) {
+        await this.imapManager.deleteDraft(accountId, draftUid);
+    }
+    // ── Contacts ──
+    searchContacts(query) {
+        if (query.length < 1)
+            return [];
+        return this.db.searchContacts(query);
+    }
+    async syncGoogleContacts() {
+        await this.imapManager.syncAllContacts();
+    }
+    seedContacts() {
+        const added = this.db.seedContactsFromMessages();
+        console.log(`  Seeded ${added} contacts from message history`);
+        return added;
+    }
+    // ── Settings ──
+    getSettings() {
+        return loadSettings();
+    }
+    saveSettings(settings) {
+        saveSettings(settings);
+    }
+    getStorageInfo() {
+        return getStorageInfo();
+    }
+}
+//# sourceMappingURL=index.js.map

package/packages/mailx-service/package.json

@@ -0,0 +1,22 @@
+{
+  "name": "@bobfrankston/mailx-service",
+  "version": "0.1.0",
+  "type": "module",
+  "main": "index.js",
+  "types": "index.d.ts",
+  "scripts": {
+    "build": "tsc"
+  },
+  "license": "ISC",
+  "dependencies": {
+    "@bobfrankston/mailx-types": "file:../mailx-types",
+    "@bobfrankston/mailx-store": "file:../mailx-store",
+    "@bobfrankston/mailx-imap": "file:../mailx-imap",
+    "@bobfrankston/mailx-settings": "file:../mailx-settings",
+    "mailparser": "^3.7.2"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/BobFrankston/mailx.git"
+  }
+}