@novacraft-engineering/mailbox 0.1.0 → 0.2.0

package/README.md

@@ -1,3 +1,5 @@
+<img src=".github/banner.png" alt="mailbox by Novacraft" width="100%">
+
 # Mailbox
 
 A shared webmail app: one codebase, one deployment per mailbox. Inbox and
@@ -16,8 +18,11 @@ for it in that same request.** This is a standing rule for every agent and every
 session. A granted deploy covers that one deploy only; it is not permission for
 the next one.
 
-Here, pushing *is* deploying. Coolify auto-deploys `master` on push, and a single
-push updates **every** live mailbox at once, not just the one you are working on.
+Here, pushing *is* deploying — for one tenant. A GitHub webhook on this repository
+points at the Coolify that serves production, so a push to `master` auto-deploys the
+**Novacraft** mailbox. The second tenant is deliberately not wired: it shares this
+repository and branch, but Coolify checks the webhook signature against each
+application's own secret, so it is skipped and still needs a manual deploy from Coolify.
 Finish the work, commit locally, leave it unpushed, and say plainly that it is
 waiting.
 

package/app/api/mail/accessors/route.ts

@@ -1,7 +1,8 @@
 import { BRAND, ADDRESS_DOMAINS as BRAND_ADDRESS_DOMAINS } from '@/lib/brand'
 import { randomBytes } from 'node:crypto'
 import { NextResponse } from 'next/server'
-import { Resend } from 'resend'
+import { sendMail } from '@/lib/mail-provider'
+import { renderActionEmail } from '@/lib/emails'
 import { mailAuthGuard, resolveAccount } from '@/lib/dev-auth'
 import {
   listAccounts,
@@ -102,29 +103,32 @@ export async function POST(req: Request) {
   const token = randomBytes(32).toString('hex')
   await createResetToken(email, token, Date.now() + INVITE_TTL_MS)
 
-  const apiKey = process.env.RESEND_API_KEY
-  if (apiKey) {
-    const from = (process.env.RESEND_FROM ?? BRAND.supportEmail).replace(/^.*<|>$/g, '')
-    const origin = process.env.MAIL_PUBLIC_URL?.replace(/\/$/, '') || new URL(req.url).origin
-    const inviteUrl = `${origin}/mail/reset?token=${token}&invite=1`
-    const resend = new Resend(apiKey)
-    try {
-      const { data } = await resend.emails.send({
-        from: `${BRAND.name} Mail <${from}>`,
-        to: [email],
-        subject: `You've been invited to ${BRAND.name} Mail`,
-        text: `${inviter.email} invited you to ${BRAND.name} Mail.\n\nSet your password to get started: ${inviteUrl}\n\nThis link expires in 7 days.`,
-        html: `<div style="font-family:Arial,Helvetica,sans-serif;font-size:15px;line-height:1.6;color:#1A1030;">
-          <p style="margin:0 0 12px;color:${BRAND.colors.accent};font-weight:600;">You've been invited to ${BRAND.name} Mail</p>
-          <p style="margin:0 0 16px;">${name ? `Hi ${name}, ` : ''}you've been given access to ${BRAND.name} Mail. Set a password to get started.</p>
-          <a href="${inviteUrl}" style="display:inline-block;background:${BRAND.colors.accent};color:#fff;text-decoration:none;font-weight:600;padding:11px 20px;border-radius:8px;">Set your password</a>
-          <p style="margin:16px 0 0;color:#8E84A8;font-size:13px;">This invite link expires in 7 days.</p>
-        </div>`,
-      })
-      if (data?.id) await recordSentMeta(data.id, null, true).catch(() => {})
-    } catch (err) {
-      console.warn('[mail] invite email failed:', err)
-    }
+  const from = (process.env.MAIL_FROM ?? process.env.RESEND_FROM ?? BRAND.supportEmail).replace(/^.*<|>$/g, '').trim()
+  const origin = process.env.MAIL_PUBLIC_URL?.replace(/\/$/, '') || new URL(req.url).origin
+  const inviteUrl = `${origin}/mail/reset?token=${token}&invite=1`
+  try {
+    const { id } = await sendMail({
+      from,
+      fromName: `${BRAND.name} Mail`,
+      to: [email],
+      subject: `You've been invited to ${BRAND.name} Mail`,
+      text: `${inviter.email} invited you to ${BRAND.name} Mail.\n\nSet your password to get started: ${inviteUrl}\n\nThis link expires in 7 days.`,
+      html: renderActionEmail({
+        eyebrow: `${BRAND.name} · Mail`,
+        accent: BRAND.colors.accent,
+        title: `You've been invited to ${BRAND.name} Mail`,
+        body: `${inviter.email} gave you access to ${BRAND.name} Mail${name ? `, ${name}` : ''}. Set a password to get started.`,
+        actionLabel: 'Set your password',
+        actionUrl: inviteUrl,
+        expiry: 'This invite link expires in 7 days.',
+        footer: `You are receiving this because ${inviter.email} invited you.`,
+      }),
+    })
+    if (id) await recordSentMeta(id, null, true).catch(() => {})
+  } catch (err) {
+    // The account row already exists; say the invite did not go out rather than imply it did.
+    console.error('[mail] invite email failed:', err)
+    return NextResponse.json({ ok: false, error: 'Account created, but the invite email could not be sent', email, address, role }, { status: 502 })
   }
 
   return NextResponse.json({ ok: true, email, address, role })

package/app/api/mail/emails/[id]/attachments/download/route.ts

@@ -1,5 +1,6 @@
 import { NextResponse } from 'next/server'
-import { mailAuthGuard } from '@/lib/dev-auth'
+import { mailAuthGuard, resolveAccount } from '@/lib/dev-auth'
+import { mayReadSent } from '@/lib/sent-access'
 import { getSentAttachments } from '@/lib/mailbox'
 import { getObject } from '@/lib/r2'
 
@@ -18,6 +19,7 @@ export async function GET(req: Request, context: { params: Promise<{ id: string
   if (guard) return guard
 
   const { id } = await context.params
+  if (!(await mayReadSent(await resolveAccount(req), id))) return NextResponse.json({ ok: false, error: 'Not found' }, { status: 404 })
   const params = new URL(req.url).searchParams
   const index = Number(params.get('index') ?? 0)
   const inline = params.get('inline') === '1'

package/app/api/mail/emails/[id]/attachments/forward/route.ts

@@ -1,6 +1,7 @@
 import { randomBytes } from 'node:crypto'
 import { NextResponse } from 'next/server'
-import { mailAuthGuard } from '@/lib/dev-auth'
+import { mailAuthGuard, resolveAccount } from '@/lib/dev-auth'
+import { mayReadSent } from '@/lib/sent-access'
 import { getSentAttachments } from '@/lib/mailbox'
 import { getObject, putObject } from '@/lib/r2'
 
@@ -21,6 +22,7 @@ export async function POST(req: Request, context: { params: Promise<{ id: string
   if (guard) return guard
 
   const { id } = await context.params
+  if (!(await mayReadSent(await resolveAccount(req), id))) return NextResponse.json({ ok: false, error: 'Not found' }, { status: 404 })
   const copied: Array<{ filename: string; size: number; contentType?: string; key: string }> = []
 
   const mint = (filename: string) =>

package/app/api/mail/emails/[id]/route.ts

@@ -1,6 +1,7 @@
 import { NextResponse } from 'next/server'
 import { Resend } from 'resend'
-import { mailAuthGuard } from '@/lib/dev-auth'
+import { mailAuthGuard, resolveAccount } from '@/lib/dev-auth'
+import { mayReadSent } from '@/lib/sent-access'
 import { getSentAttachments, readSentMessage } from '@/lib/mailbox'
 
 export const runtime = 'nodejs'
@@ -15,9 +16,19 @@ function getResend(): Resend | null {
  * our own mail_sent row is the durable source, and the provider is asked only for the
  * details it alone holds (attachment links, schedule, delivery state).
  */
+/** Served through this domain rather than the provider's host, which does not resolve on some of the networks the office uses. */
+function attachmentList(id: string, entries: Array<Record<string, unknown>>) {
+  return entries.map((entry, index) => ({
+    filename: String(entry.filename ?? 'attachment'),
+    size: Number(entry.size ?? 0),
+    downloadUrl: `/api/mail/emails/${encodeURIComponent(id)}/attachments/download?index=${index}`,
+  }))
+}
+
 async function fromArchive(id: string) {
   const stored = await readSentMessage(id).catch(() => null)
   if (!stored) return null
+  const files = await getSentAttachments(id).catch(() => [])
   return NextResponse.json({
     ok: true,
     email: {
@@ -33,7 +44,7 @@ async function fromArchive(id: string) {
       createdAt: stored.createdAt,
       scheduledAt: null,
       lastEvent: stored.lastEvent ?? '',
-      attachments: [],
+      attachments: attachmentList(id, files as Array<Record<string, unknown>>),
     },
   })
 }
@@ -42,6 +53,7 @@ export async function GET(req: Request, { params }: { params: Promise<{ id: stri
   const guard = await mailAuthGuard(req)
   if (guard) return guard
   const { id } = await params
+  if (!(await mayReadSent(await resolveAccount(req), id))) return NextResponse.json({ ok: false, error: 'Not found' }, { status: 404 })
   const resend = getResend()
 
   if (id.startsWith('mbox-') || !resend) {
@@ -63,13 +75,7 @@ export async function GET(req: Request, { params }: { params: Promise<{ id: stri
     : ((await resend.emails.attachments.list({ emailId: id }).catch(() => null))?.data as unknown as {
         data?: Array<Record<string, unknown>>
       })?.data ?? []
-  // Served through this domain rather than the provider's host, which does not resolve
-  // on some of the networks the office uses.
-  const attachments = rawAttachments.map((entry, index) => ({
-    filename: String((entry as Record<string, unknown>).filename ?? 'attachment'),
-    size: Number((entry as Record<string, unknown>).size ?? 0),
-    downloadUrl: `/api/mail/emails/${encodeURIComponent(id)}/attachments/download?index=${index}`,
-  }))
+  const attachments = attachmentList(id, rawAttachments as Array<Record<string, unknown>>)
 
   const item = data as unknown as Record<string, unknown>
   return NextResponse.json({
@@ -99,6 +105,7 @@ export async function PATCH(req: Request, { params }: { params: Promise<{ id: st
   if (!resend) return NextResponse.json({ ok: false, error: 'RESEND_API_KEY not configured' }, { status: 500 })
 
   const { id } = await params
+  if (!(await mayReadSent(await resolveAccount(req), id))) return NextResponse.json({ ok: false, error: 'Not found' }, { status: 404 })
   let body: { scheduledAt?: string }
   try {
     body = await req.json()
@@ -121,6 +128,7 @@ export async function DELETE(req: Request, { params }: { params: Promise<{ id: s
   if (!resend) return NextResponse.json({ ok: false, error: 'RESEND_API_KEY not configured' }, { status: 500 })
 
   const { id } = await params
+  if (!(await mayReadSent(await resolveAccount(req), id))) return NextResponse.json({ ok: false, error: 'Not found' }, { status: 404 })
   const { error } = await resend.emails.cancel(id)
   if (error) return NextResponse.json({ ok: false, error: error.message }, { status: 502 })
   return NextResponse.json({ ok: true })

package/app/api/mail/emails/route.ts

@@ -1,5 +1,6 @@
 import { BRAND } from '@/lib/brand'
 import { NextResponse } from 'next/server'
+import { matchesQuery, parseQuery } from '@/app/mail/search'
 import { FORWARD_RECIPIENTS, mailAuthGuard, resolveAccount } from '@/lib/dev-auth'
 import { readSentFlags, setSentFlags, readPixelOpens, readSentMeta, setSentMetaOwner, listAccounts, readSentArchive, type SentFlags } from '@/lib/mailbox'
 
@@ -17,7 +18,6 @@ const KNOWN_AUTO_SUBJECTS = new Set([`Reset your ${BRAND.name} Mail password`])
 
 /** Heuristic for pre-existing automated sends that predate owner/auto tagging. */
 function looksAutomated(email: SentEmail): boolean {
-  if (email.subject.startsWith('Fwd:')) return true
   if (KNOWN_AUTO_SUBJECTS.has(email.subject)) return true
   const internal = new Set(
     [...FORWARD_RECIPIENTS, ...(process.env.RESEND_TO ?? '').split(',')]
@@ -35,10 +35,19 @@ export async function GET(req: Request) {
   if (guard) return guard
 
   const account = await resolveAccount(req)
+  const rawQuery = new URL(req.url).searchParams.get('q')?.trim() ?? ''
+  const parsedQuery = rawQuery ? parseQuery(rawQuery) : null
+  const query = parsedQuery && !parsedQuery.isEmpty ? parsedQuery : null
+  const SEARCH_LIMIT = 400
   // Read our own archive rather than the provider's list: the history stays ours across
   // a provider switch, and every send is written here at send time.
   // Meta is looked up only for the archive rows being returned, so fetch those first.
-  const archive = await readSentArchive().catch(() => [])
+  const archive = await readSentArchive({
+    ownerAddress: account.address ?? null,
+    sharedAddress: SHARED_ADDRESS,
+    query,
+    limit: query ? SEARCH_LIMIT : 500,
+  }).catch(() => [])
   const [flags, opens, sentMeta, accounts] = await Promise.all([
     readSentFlags().catch(() => ({})),
     readPixelOpens().catch(() => ({})),
@@ -46,6 +55,8 @@ export async function GET(req: Request) {
     listAccounts().catch(() => []),
   ])
 
+  const archiveById = new Map(archive.map(item => [item.id, item]))
+  const flagOf = flags as Record<string, { starred?: boolean; archived?: boolean; trashed?: boolean }>
   const all: SentEmail[] = archive.map(item => ({
     id: item.id,
     from: item.from,
@@ -81,8 +92,28 @@ export async function GET(req: Request) {
       return true
     })
     .map(email => ({ ...email, owner: sentOwner(email), inReplyTo: metaMap[email.id]?.inReplyTo ?? null }))
-
-  return NextResponse.json({ ok: true, emails, flags, opens })
+    .filter(email =>
+      !query ||
+      matchesQuery(query, {
+        from: email.from,
+        to: email.to.join(' '),
+        cc: (archiveById.get(email.id)?.cc ?? []).join(' '),
+        bcc: (archiveById.get(email.id)?.bcc ?? []).join(' '),
+        subject: email.subject,
+        body: archiveById.get(email.id)?.text ?? '',
+        filenames: '',
+        date: new Date(email.createdAt).getTime(),
+        size: null,
+        read: true,
+        starred: Boolean(flagOf[email.id]?.starred),
+        hasAttachment: false,
+        labels: [],
+        folder: flagOf[email.id]?.trashed ? 'trash' : flagOf[email.id]?.archived ? 'archive' : 'sent',
+      }),
+    )
+
+  const truncated = Boolean(query) && archive.length >= SEARCH_LIMIT
+  return NextResponse.json({ ok: true, emails, flags, opens, searched: Boolean(query), truncated })
 }
 
 export async function PATCH(req: Request) {

package/app/api/mail/inbox/counts/route.ts

@@ -4,10 +4,10 @@ import { countFolders, countFoldersCached } from '@/lib/mailbox'
 
 const COUNTS_TTL_MS = 20 * 1000
 const countsCache = new Map<string, { at: number; value: Awaited<ReturnType<typeof countFolders>> }>()
-async function cachedCounts(owner: string) {
+async function cachedCounts(owner: string, fresh: boolean) {
   const hit = countsCache.get(owner)
-  if (hit && Date.now() - hit.at < COUNTS_TTL_MS) return hit.value
-  const value = await countFoldersCached(owner)
+  if (!fresh && hit && Date.now() - hit.at < COUNTS_TTL_MS) return hit.value
+  const value = fresh ? await countFolders(owner) : await countFoldersCached(owner)
   countsCache.set(owner, { at: Date.now(), value })
   return value
 }
@@ -20,6 +20,7 @@ export async function GET(req: Request) {
 
   // Counts describe the signed-in mailbox, matching what the list will actually show.
   const account = await resolveAccount(req)
-  const counts = await cachedCounts(account.address ?? ' no-address')
+  const fresh = new URL(req.url).searchParams.get('fresh') === '1'
+  const counts = await cachedCounts(account.address ?? ' no-address', fresh)
   return NextResponse.json({ ok: true, counts })
 }

package/app/api/mail/inbox/route.ts

@@ -1,196 +1,12 @@
-import { BRAND } from '@/lib/brand'
 import { createHmac, timingSafeEqual } from 'node:crypto'
 import { NextResponse } from 'next/server'
-import { sendPush } from '@/lib/push'
-import { FORWARD_RECIPIENTS, MAIL_DOMAIN, mailAuthGuard, isLocalOrigin, resolveAccount } from '@/lib/dev-auth'
-import { ADDRESS_ALIASES, searchInbox, appendEvent, appendInbound, recordContact, recordSentMeta, getAccountByAddress, setInboundFlags, setInboundLabels, setInboxOwner, readInbox, claimWebhookEvent, completeWebhookEvent, releaseWebhookEvent, pruneWebhookEvents, type InboundFlags } from '@/lib/mailbox'
-import { isBrevoInbound, normalizeBrevoInbound, sendMail } from '@/lib/mail-provider'
-
-// The address we send from, and the inbox that owns mail addressed to nobody specific.
-const MAIL_FROM = (process.env.MAIL_FROM ?? process.env.RESEND_FROM ?? BRAND.supportEmail).replace(/^.*<|>$/g, '').trim()
-const SHARED_ADDRESS = MAIL_FROM.toLowerCase()
-
-/** Attribute an inbound email to the accessor it was delivered to, else the shared inbox. */
-async function attributeOwner(recipients: string[]): Promise<string> {
-  for (const raw of recipients) {
-    const match = raw.match(/<([^>]+)>/)
-    const addr = (match ? match[1] : raw).trim().toLowerCase()
-    if (!addr.includes('@')) continue
-    const account = await getAccountByAddress(addr)
-    if (account?.address) {
-      const owner = account.address.toLowerCase()
-      return ADDRESS_ALIASES[owner] ?? owner
-    }
-  }
-  return SHARED_ADDRESS
-}
-
-function parseSender(raw: string): { email: string; name: string | null } {
-  const match = raw.match(/^\s*(.*?)\s*<([^>]+)>\s*$/)
-  if (match) return { name: match[1].replace(/^"|"$/g, '') || null, email: match[2].trim() }
-  return { name: null, email: raw.trim() }
-}
+import { mailAuthGuard, isLocalOrigin, resolveAccount } from '@/lib/dev-auth'
+import { searchInbox, appendEvent, appendInbound, recordContact, setInboundFlags, setInboundFlagsForThread, setInboundLabels, setThreadSnooze, setInboxOwner, readInbox, claimWebhookEvent, completeWebhookEvent, releaseWebhookEvent, pruneWebhookEvents, type InboundFlags } from '@/lib/mailbox'
+import { attributeOwner, forwardToAccounts, ingestReceived, parseSender } from '@/lib/receive'
+import { isBrevoInbound, normalizeBrevoInbound } from '@/lib/mail-provider'
 
 export const runtime = 'nodejs'
 
-function snippet(html: string | null, text: string | null): string {
-  const source = text?.trim() || (html ?? '').replace(/<style[\s\S]*?<\/style>/gi, ' ').replace(/<[^>]+>/g, ' ')
-  return source.replace(/\s+/g, ' ').trim().slice(0, 240)
-}
-
-function escapeHtml(src: string): string {
-  return src.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;')
-}
-
-type ReceivedEmail = {
-  html: string | null
-  text: string | null
-  from: string
-  to: string[]
-  cc: string[]
-  bcc: string[]
-  replyTo: string[]
-  subject: string
-  headers: Record<string, unknown>
-  createdAt: string
-  attachments: Array<{ filename: string; contentType?: string }>
-}
-
-// The email.received webhook payload carries only metadata (from/to/subject) — the body
-// lives on Resend and must be pulled from the receiving endpoint, or the inbox stores blanks.
-async function fetchReceivedEmail(emailId: string, apiKey: string): Promise<ReceivedEmail | null> {
-  try {
-    const response = await fetch(`https://api.resend.com/emails/receiving/${emailId}`, {
-      headers: { Authorization: `Bearer ${apiKey}` },
-    })
-    if (!response.ok) return null
-    const data = (await response.json()) as Record<string, unknown>
-    const rawAttachments = Array.isArray(data.attachments) ? (data.attachments as Array<Record<string, unknown>>) : []
-    return {
-      html: data.html ? String(data.html) : null,
-      text: data.text ? String(data.text) : null,
-      from: String(data.from ?? ''),
-      to: Array.isArray(data.to) ? (data.to as string[]) : [String(data.to ?? '')],
-      cc: Array.isArray(data.cc) ? (data.cc as string[]) : [],
-      bcc: Array.isArray(data.bcc) ? (data.bcc as string[]) : [],
-      replyTo: Array.isArray(data.reply_to) ? (data.reply_to as string[]) : [],
-      subject: String(data.subject ?? '(no subject)'),
-      headers: data.headers && typeof data.headers === 'object' ? (data.headers as Record<string, unknown>) : {},
-      createdAt: String(data.created_at ?? new Date().toISOString()),
-      attachments: rawAttachments
-        .map(entry => ({
-          filename: String(entry.filename ?? entry.name ?? 'attachment'),
-          contentType: entry.content_type ? String(entry.content_type) : undefined,
-        }))
-        .filter(entry => entry.filename),
-    }
-  } catch {
-    return null
-  }
-}
-
-type SendAttachment = { filename: string; content: string; contentType?: string; contentId?: string; size?: number }
-
-/**
- * Copy attachment bytes onto our own storage as the message arrives. Provider download URLs
- * expire and disappear with the account, so a stored filename alone would outlive the file.
- */
-async function rehostAttachments(
-  emailId: string,
-  files: SendAttachment[],
-): Promise<Array<{ filename: string; contentType?: string; key?: string; size?: number; contentId?: string }>> {
-  if (!files.length) return []
-  const { putObject } = await import('@/lib/r2')
-  return Promise.all(
-    files.map(async (file, index) => {
-      if (!file.content) {
-        return { filename: file.filename, contentType: file.contentType, size: file.size, contentId: file.contentId }
-      }
-      const bytes = Buffer.from(file.content, 'base64')
-      // contentId is what separates an embedded signature image from a real attachment.
-      const meta = { filename: file.filename, contentType: file.contentType, size: bytes.length, contentId: file.contentId }
-      const safeName = (file.filename || 'attachment').replace(/[^\w.\- ]+/g, '_').slice(-120)
-      const key = `attachments/${emailId}/${index}-${safeName}`
-      // Written to our own bucket and served back through this domain. The provider's
-      // own link expires, dies with the account, and points at a host outside our
-      // control; the bucket URL would be a third host again, so neither is handed out.
-      return (await putObject(key, bytes, file.contentType)) ? { ...meta, key } : meta
-    }),
-  )
-}
-
-async function fetchAttachmentBytes(emailId: string, apiKey: string): Promise<SendAttachment[]> {
-  try {
-    const response = await fetch(`https://api.resend.com/emails/receiving/${emailId}/attachments`, {
-      headers: { Authorization: `Bearer ${apiKey}` },
-    })
-    if (!response.ok) return []
-    const data = (await response.json()) as { data?: Array<Record<string, unknown>> }
-    const list = Array.isArray(data.data) ? data.data : []
-    const out: SendAttachment[] = []
-    for (const entry of list) {
-      const url = entry.download_url ? String(entry.download_url) : ''
-      const file: SendAttachment = {
-        filename: String(entry.filename ?? 'attachment'),
-        content: '',
-        contentType: entry.content_type ? String(entry.content_type) : undefined,
-        contentId: entry.content_id ? String(entry.content_id).replace(/^<|>$/g, '') : undefined,
-        size: Number(entry.size ?? 0) || undefined,
-      }
-      try {
-        const binary = url ? await fetch(url) : null
-        if (binary?.ok) file.content = Buffer.from(await binary.arrayBuffer()).toString('base64')
-      } catch (err) {
-        console.warn(`[mail] attachment pull failed for ${emailId}/${file.filename}:`, err)
-      }
-      out.push(file)
-    }
-    return out
-  } catch {
-    return []
-  }
-}
-
-// Forward the whole received email — full body + attachments — to the mail accounts.
-// Forward the inbound copy ONLY to the account that owns the mail (its login email),
-// never to every accessor — a member must not receive mail that isn't theirs.
-async function forwardToAccounts(
-  emailId: string,
-  inbound: ReceivedEmail,
-  ownerAddress: string | null,
-  files?: SendAttachment[],
-): Promise<void> {
-  const owningAccount = ownerAddress ? await getAccountByAddress(ownerAddress) : null
-  const recipient = owningAccount?.email ?? FORWARD_RECIPIENTS[0] // fallback: the admin
-  if (!recipient) return
-  // Forwarding exists to put a copy somewhere the recipient already reads. Once this
-  // domain's MX points here, an address on it is somewhere we read — so forwarding to
-  // one would deliver back into this handler and forward again, without end.
-  if (recipient.trim().toLowerCase().endsWith(`@${MAIL_DOMAIN}`)) return
-  const from = MAIL_FROM
-  // Attachment bytes only come from Resend's receiving API; under another provider the
-  // forward still goes out, just without re-attaching the files.
-  const resendKey = process.env.RESEND_API_KEY
-  const attachments = (files ?? (resendKey ? await fetchAttachmentBytes(emailId, resendKey) : [])).filter(file => file.content)
-  const header = `<div style="font-family:Arial,Helvetica,sans-serif;font-size:13px;color:#5A5170;border-left:3px solid ${BRAND.colors.accent};padding:4px 0 4px 12px;margin:0 0 16px;">---------- Forwarded message ----------<br><strong>From:</strong> ${escapeHtml(inbound.from)}<br><strong>Subject:</strong> ${escapeHtml(inbound.subject)}</div>`
-  try {
-    const data = await sendMail({
-      from: from.replace(/^.*<|>$/g, ''),
-      fromName: `${BRAND.name} Mail`,
-      to: [recipient],
-      replyTo: inbound.from || undefined,
-      subject: inbound.subject.startsWith('Fwd:') ? inbound.subject : `Fwd: ${inbound.subject}`,
-      text: inbound.text?.trim() || snippet(inbound.html, inbound.text) || ' ',
-      ...(inbound.html ? { html: `${header}${inbound.html}` } : {}),
-      ...(attachments.length ? { attachments } : {}),
-    })
-    // Tag as automated so this "Fwd:" copy never shows up in the Sent folder.
-    if (data?.id) await recordSentMeta(data.id, null, true).catch(() => {})
-  } catch (err) {
-    console.warn('[mail] inbound forward failed:', err)
-  }
-}
-
 export async function GET(req: Request) {
   const guard = await mailAuthGuard(req)
   if (guard) return guard
@@ -210,7 +26,7 @@ export async function GET(req: Request) {
   const threadId = params.get('thread') ?? undefined
   if (text || limitRaw || offset || cursor || threadId) {
     const folderParam = params.get('folder')
-    const folder = (['inbox', 'archive', 'trash', 'starred'] as const).find(f => f === folderParam)
+    const folder = (['inbox', 'archive', 'trash', 'starred', 'snoozed'] as const).find(f => f === folderParam)
     const { rows, total, nextCursor } = await searchInbox({
       text,
       owner: ownerFilter,
@@ -239,14 +55,34 @@ export async function GET(req: Request) {
 export async function PATCH(req: Request) {
   const guard = await mailAuthGuard(req)
   if (guard) return guard
-  let body: { id?: string; ids?: string[]; labels?: string[]; owner?: string } & InboundFlags
+  let body: { id?: string; ids?: string[]; threadId?: string; labels?: string[]; owner?: string; snoozedUntil?: string | null } & InboundFlags
   try {
     body = await req.json()
   } catch {
     return NextResponse.json({ ok: false, error: 'Invalid JSON' }, { status: 400 })
   }
   const ids = body.ids ?? (body.id ? [body.id] : [])
-  if (!ids.length) return NextResponse.json({ ok: false, error: 'id or ids is required' }, { status: 400 })
+  if (!ids.length && !body.threadId) {
+    return NextResponse.json({ ok: false, error: 'id, ids or threadId is required' }, { status: 400 })
+  }
+
+  // Snooze belongs to the conversation, so it is set by thread and nothing else.
+  if (body.snoozedUntil !== undefined) {
+    if (!body.threadId) {
+      return NextResponse.json({ ok: false, error: 'snoozedUntil needs a threadId' }, { status: 400 })
+    }
+    const until = body.snoozedUntil
+    if (until !== null && Number.isNaN(Date.parse(until))) {
+      return NextResponse.json({ ok: false, error: 'snoozedUntil must be a date or null' }, { status: 400 })
+    }
+    const account = await resolveAccount(req)
+    const moved = await setThreadSnooze(
+      account.address ?? ' no-address',
+      body.threadId,
+      until === null ? null : new Date(until).toISOString(),
+    )
+    return NextResponse.json({ ok: true, messages: moved })
+  }
   // Reassigning inbound mail to a mailbox is admin-only.
   if (body.owner !== undefined) {
     const account = await resolveAccount(req)
@@ -267,8 +103,13 @@ export async function PATCH(req: Request) {
   if (body.archived !== undefined) flags.archived = body.archived
   if (body.trashed !== undefined) flags.trashed = body.trashed
   if (!Object.keys(flags).length) flags.read = true
+  if (body.threadId) {
+    const account = await resolveAccount(req)
+    const changed = await setInboundFlagsForThread(account.address ?? ' no-address', body.threadId, flags)
+    return NextResponse.json({ ok: true, ids: changed })
+  }
   await Promise.all(ids.map(id => setInboundFlags(id, flags)))
-  return NextResponse.json({ ok: true })
+  return NextResponse.json({ ok: true, ids })
 }
 
 // Svix signature scheme used by Resend webhooks: HMAC-SHA256 over `${id}.${timestamp}.${payload}`
@@ -351,7 +192,7 @@ export async function POST(req: Request) {
         // Brevo carries no delivery id, so the message id stands in: a replayed batch
         // must not forward a second copy of mail already handled.
         deliveryId = `brevo:${message.id}`
-        if (!(await claimWebhookEvent(deliveryId))) continue
+        if ((await claimWebhookEvent(deliveryId)) !== 'claimed') continue
         const owner = await attributeOwner([...message.to, ...message.cc, ...message.bcc])
         await appendInbound({ ...message, read: false, owner })
         const sender = parseSender(message.from)
@@ -400,77 +241,15 @@ export async function POST(req: Request) {
     // Keyed on the delivery id, which a retry reuses, so a redelivery of something we
     // already finished is a no-op rather than a second forwarded copy.
     const deliveryId = req.headers.get('svix-id') || `received:${emailId}`
-    if (!(await claimWebhookEvent(deliveryId))) {
-      return NextResponse.json({ ok: true, duplicate: true })
+    const claim = await claimWebhookEvent(deliveryId)
+    if (claim === 'done') return NextResponse.json({ ok: true, duplicate: true })
+    if (claim === 'busy') {
+      // A 2xx here ends the provider's retries. Another attempt still holds this delivery;
+      // if it dies, the lease expires and the next retry takes over — so ask for one.
+      return NextResponse.json({ ok: false, error: 'Delivery is being handled; retry shortly' }, { status: 409 })
     }
     try {
-    const apiKey = process.env.RESEND_API_KEY
-    // The webhook payload has no body — pull the full email (html/text/attachments) from Resend.
-    const full = apiKey ? await fetchReceivedEmail(emailId, apiKey) : null
-
-    const payloadAttachments = Array.isArray(data.attachments) ? (data.attachments as Array<Record<string, unknown>>) : []
-    const inbound = {
-      id: emailId,
-      from: full?.from || String(data.from ?? ''),
-      to: full?.to ?? (Array.isArray(data.to) ? (data.to as string[]) : [String(data.to ?? '')]),
-      cc: full?.cc ?? (Array.isArray(data.cc) ? (data.cc as string[]) : []),
-      bcc: full?.bcc ?? (Array.isArray(data.bcc) ? (data.bcc as string[]) : []),
-      replyTo: full?.replyTo ?? (Array.isArray(data.reply_to) ? (data.reply_to as string[]) : []),
-      subject: full?.subject || String(data.subject ?? '(no subject)'),
-      html: full?.html ?? (data.html ? String(data.html) : null),
-      text: full?.text ?? (data.text ? String(data.text) : null),
-      headers: full?.headers ?? {},
-      receivedAt: full?.createdAt || String(data.created_at ?? new Date().toISOString()),
-      read: false,
-      attachments:
-        full?.attachments ??
-        payloadAttachments
-          .map(entry => ({
-            filename: String(entry.filename ?? entry.name ?? 'attachment'),
-            contentType: entry.content_type ? String(entry.content_type) : undefined,
-          }))
-          .filter(entry => entry.filename),
-      // Attribute (and therefore forward) to the accessor actually addressed — to, cc, OR bcc.
-      // Anything not matching a member's personal address stays in the shared (admin) inbox,
-      // so a member never receives mail they aren't a party to.
-      owner: await attributeOwner([
-        ...(Array.isArray(full?.to) ? full!.to : []),
-        ...(Array.isArray(data.to) ? (data.to as string[]) : [String(data.to ?? '')]),
-        ...(full?.cc ?? []),
-        ...(full?.bcc ?? []),
-      ]),
-    }
-    // Pull the bytes once: they become our stored copy and the forward's attachments.
-    const files = apiKey ? await fetchAttachmentBytes(emailId, apiKey) : []
-    if (files.length) inbound.attachments = await rehostAttachments(emailId, files)
-    const forwardable = files.filter(file => file.content)
-
-    await appendInbound(inbound)
-    const sender = parseSender(inbound.from)
-    await recordContact(sender.email, sender.name)
-    await sendPush(inbound.owner, {
-      title: sender.name || sender.email || 'New mail',
-      body: inbound.subject,
-      tag: emailId,
-    }).catch(() => {})
-    await forwardToAccounts(
-      emailId,
-      full ?? {
-        html: inbound.html,
-        text: inbound.text,
-        from: inbound.from,
-        to: inbound.to,
-        cc: inbound.cc,
-        bcc: inbound.bcc,
-        replyTo: inbound.replyTo,
-        subject: inbound.subject,
-        headers: inbound.headers,
-        createdAt: inbound.receivedAt,
-        attachments: inbound.attachments,
-      },
-      inbound.owner,
-      forwardable,
-    )
+      await ingestReceived(emailId, data)
     } catch (err) {
       // Give the id back so the provider's retry is allowed to redo the work.
       await releaseWebhookEvent(deliveryId)