@novacraft-engineering/mailbox 0.1.0 → 0.2.0

package/lib/mailbox.ts

@@ -11,12 +11,14 @@ import { ADDRESS_ALIASES, MAIL_SEATS, type MailRole } from './brand'
 import { d1, d1Batch, d1Query } from './d1'
 import { stripCidPlaceholders } from './email-html'
 import { hashPassword } from './password'
+import { duration, type ParsedQuery } from '@/app/mail/search'
 import { turso, tursoBatch, tursoQuery } from './turso'
 import { subjectKey, threadIdFor, THREAD_GAP_MS } from './threads'
 
 export type InboundAttachment = { filename: string; contentType?: string; size?: number; shareId?: string }
 
 export type InboundEmail = {
+  snoozedUntil?: string | null
   id: string
   from: string
   to: string[]
@@ -143,6 +145,11 @@ export function ensureMailSchema(): Promise<void> {
         // sort it and then discards all but one page.
         `CREATE INDEX IF NOT EXISTS mail_inbox_list_idx ON mail_inbox (lower(owner), archived, trashed, received_at DESC, id DESC)`,
         `CREATE INDEX IF NOT EXISTS mail_inbox_owner_recent_idx ON mail_inbox (lower(owner), received_at DESC, id DESC)`,
+        // Trash and Starred cannot use the list index: archived sits ahead of trashed in it
+        // and is unconstrained for those two folders, so SQLite fell back to walking the
+        // mailbox in date order — 45,000 rows read to find the 52 that were in the bin.
+        `CREATE INDEX IF NOT EXISTS mail_inbox_owner_trash_idx ON mail_inbox (lower(owner), trashed, received_at DESC, id DESC)`,
+        `CREATE INDEX IF NOT EXISTS mail_inbox_owner_starred_idx ON mail_inbox (lower(owner), starred, trashed, received_at DESC, id DESC)`,
         // The folder counts read only these five columns. Without them all in one index
         // SQLite walks the rows themselves, and a row here can carry 50KB of html — which
         // turned a five-number summary into a 37-second scan on the larger mailboxes.
@@ -350,6 +357,15 @@ export function ensureMailSchema(): Promise<void> {
       await sqlRaw('ALTER TABLE mail_inbox ADD COLUMN thread_id TEXT').catch(() => {})
       await sqlRaw('CREATE INDEX IF NOT EXISTS mail_inbox_thread_idx ON mail_inbox (lower(owner), thread_id, received_at DESC, id DESC)').catch(() => {})
 
+      // Snooze. An ISO timestamp in the future means "not now": the message is out of the
+      // inbox until then and comes back on its own, because every folder decides from this
+      // column against the clock rather than from a flag some worker has to flip. There is
+      // no job to fall behind, and nothing to reconcile if one does.
+      await sqlRaw('ALTER TABLE mail_inbox ADD COLUMN snoozed_until TEXT').catch(() => {})
+      await sqlRaw('ALTER TABLE mail_threads ADD COLUMN snoozed_until TEXT').catch(() => {})
+      await sqlRaw('CREATE INDEX IF NOT EXISTS mail_inbox_snoozed_idx ON mail_inbox (lower(owner), snoozed_until, received_at DESC, id DESC)').catch(() => {})
+      await sqlRaw('CREATE INDEX IF NOT EXISTS mail_threads_snoozed_idx ON mail_threads (owner, snoozed_until, latest_at DESC)').catch(() => {})
+
       // Seed the mailboxes this deployment serves — metadata only, never clobber an
       // existing password_hash.
       const sql = db()
@@ -399,6 +415,7 @@ function mapInbound(row: Record<string, unknown>): InboundEmail {
     starred: Boolean(row.starred),
     archived: Boolean(row.archived),
     trashed: Boolean(row.trashed),
+    snoozedUntil: row.snoozed_until == null ? null : String(row.snoozed_until),
     labels: parseArray(row.labels),
     owner: (row.owner as string) ?? null,
     threadId: row.thread_id == null ? null : String(row.thread_id),
@@ -427,7 +444,7 @@ export type InboxPage = {
 export async function searchInbox(options: {
   text?: string
   owner?: string
-  folder?: 'inbox' | 'archive' | 'trash' | 'starred'
+  folder?: 'inbox' | 'archive' | 'trash' | 'starred' | 'snoozed'
   unread?: boolean
   starred?: boolean
   hasAttachment?: boolean
@@ -469,10 +486,15 @@ export async function searchInbox(options: {
   if (options.from) { where.push('lower(m.from_addr) LIKE ?'); args.push(`%${options.from.toLowerCase()}%`) }
   if (options.to) { where.push('lower(m.to_addrs) LIKE ?'); args.push(`%${options.to.toLowerCase()}%`) }
 
+  // A snoozed message is only out of the inbox while its time is still ahead; the clause
+  // does the waking, so nothing has to run on a timer.
+  const nowIso = new Date().toISOString()
+  const awake = "(m.snoozed_until IS NULL OR m.snoozed_until <= ?)"
   if (options.folder === 'trash') where.push('m.trashed = 1')
   else if (options.folder === 'archive') where.push('m.archived = 1 AND m.trashed = 0')
   else if (options.folder === 'starred') where.push('m.starred = 1 AND m.trashed = 0')
-  else if (options.folder === 'inbox') where.push('m.archived = 0 AND m.trashed = 0')
+  else if (options.folder === 'snoozed') { where.push('m.snoozed_until > ? AND m.trashed = 0'); args.push(nowIso) }
+  else if (options.folder === 'inbox') { where.push(`m.archived = 0 AND m.trashed = 0 AND ${awake}`); args.push(nowIso) }
 
   const filterClause = where.length ? `WHERE ${where.join(' AND ')}` : ''
 
@@ -502,7 +524,7 @@ export async function searchInbox(options: {
                 'contentType', json_extract(value, '$.contentType'),
                 'size', json_extract(value, '$.size')))
               FROM json_each(CASE WHEN json_valid(m.attachments) THEN m.attachments ELSE '[]' END)), '[]') AS attachments,
-            m.starred, m.archived, m.trashed, m.labels, m.owner, m.thread_id
+            m.starred, m.archived, m.trashed, m.snoozed_until, m.labels, m.owner, m.thread_id
      FROM ${ftsFrom}mail_inbox m ${ftsFrom ? 'ON m.rowid = fts.fts_rid' : ''} ${pageClause}
      ORDER BY m.received_at DESC, m.id DESC LIMIT ?${cursor ? '' : ' OFFSET ?'}`,
     cursor ? [...pageArgs, limit] : [...pageArgs, limit, offset],
@@ -542,14 +564,21 @@ function decodeCursor(value?: string | null): { receivedAt: string; id: string }
   }
 }
 
-export type FolderCounts = {
+export type FolderTally = {
   inbox: number
   unread: number
   starred: number
   archived: number
   trashed: number
+  snoozed: number
 }
 
+/**
+ * `conversations` is null when threads are not live, because `mail_threads` is then either
+ * empty or half-built and counting it would report a mailbox smaller than it is.
+ */
+export type FolderCounts = FolderTally & { conversations: FolderTally | null }
+
 /**
  * Folder totals for a whole mailbox.
  *
@@ -577,7 +606,9 @@ export async function countFoldersCached(owner: string): Promise<FolderCounts> {
   const row = hit[0]
   if (row && Date.now() - Date.parse(String(row.computed_at)) < COUNTS_CACHE_MS) {
     const parsed = parseJson<FolderCounts | null>(row.counts, null)
-    if (parsed) return parsed
+    // A row cached before conversations were counted has no such key; recompute rather
+    // than serve a shape the caller will read as "threads are not live".
+    if (parsed && 'conversations' in parsed) return parsed
   }
   const fresh = await countFolders(owner)
   await sql`
@@ -592,28 +623,63 @@ export async function countFolders(owner?: string): Promise<FolderCounts> {
   const sql = db()
   const scope = owner ? 'WHERE lower(owner) = ?' : ''
   const args = owner ? [owner.toLowerCase()] : []
+  const nowIso = new Date().toISOString()
 
   // One pass, not one per folder: five separate counts read the table five times
   // (206k rows against 69k here) for figures that all come off the same scan.
   const rows = await tagged(
     sql,
     `SELECT
-       SUM(CASE WHEN archived = 0 AND trashed = 0 THEN 1 ELSE 0 END) AS inbox,
-       SUM(CASE WHEN archived = 0 AND trashed = 0 AND read = 0 THEN 1 ELSE 0 END) AS unread,
+       SUM(CASE WHEN archived = 0 AND trashed = 0 AND (snoozed_until IS NULL OR snoozed_until <= ?) THEN 1 ELSE 0 END) AS inbox,
+       SUM(CASE WHEN archived = 0 AND trashed = 0 AND read = 0 AND (snoozed_until IS NULL OR snoozed_until <= ?) THEN 1 ELSE 0 END) AS unread,
        SUM(CASE WHEN starred = 1 AND trashed = 0 THEN 1 ELSE 0 END) AS starred,
        SUM(CASE WHEN archived = 1 AND trashed = 0 THEN 1 ELSE 0 END) AS archived,
-       SUM(CASE WHEN trashed = 1 THEN 1 ELSE 0 END) AS trashed
+       SUM(CASE WHEN trashed = 1 THEN 1 ELSE 0 END) AS trashed,
+       SUM(CASE WHEN snoozed_until > ? AND trashed = 0 THEN 1 ELSE 0 END) AS snoozed
      FROM mail_inbox ${scope}`,
-    args,
+    [nowIso, nowIso, nowIso, ...args],
   )
   const row = rows[0] ?? {}
   const value = (key: string) => Number((row[key] as number) ?? 0)
+
+  // The list shows one row per conversation, so the figure beside a folder has to be
+  // conversations too. Counted in messages it disagreed with the list header by three to
+  // one on the larger mailboxes, and the unread badge could exceed the folder total.
+  // The predicates are the ones listThreads pages by; they must not drift apart.
+  let conversations: FolderTally | null = null
+  if (threadsLive() && owner) {
+    const threadRows = await tagged(
+      sql,
+      `SELECT
+         SUM(CASE WHEN inbox_count > 0 AND (snoozed_until IS NULL OR snoozed_until <= ?) THEN 1 ELSE 0 END) AS inbox,
+         SUM(CASE WHEN inbox_count > 0 AND unread_count > 0 AND (snoozed_until IS NULL OR snoozed_until <= ?) THEN 1 ELSE 0 END) AS unread,
+         SUM(CASE WHEN starred_count > 0 THEN 1 ELSE 0 END) AS starred,
+         SUM(CASE WHEN archived_count > 0 THEN 1 ELSE 0 END) AS archived,
+         SUM(CASE WHEN trashed_count > 0 THEN 1 ELSE 0 END) AS trashed,
+         SUM(CASE WHEN snoozed_until > ? THEN 1 ELSE 0 END) AS snoozed
+       FROM mail_threads WHERE owner = ?`,
+      [nowIso, nowIso, nowIso, owner.toLowerCase()],
+    )
+    const threadRow = threadRows[0] ?? {}
+    const threadValue = (key: string) => Number((threadRow[key] as number) ?? 0)
+    conversations = {
+      inbox: threadValue('inbox'),
+      unread: threadValue('unread'),
+      starred: threadValue('starred'),
+      archived: threadValue('archived'),
+      trashed: threadValue('trashed'),
+      snoozed: threadValue('snoozed'),
+    }
+  }
+
   return {
     inbox: value('inbox'),
     unread: value('unread'),
     starred: value('starred'),
     archived: value('archived'),
     trashed: value('trashed'),
+    snoozed: value('snoozed'),
+    conversations,
   }
 }
 
@@ -648,6 +714,7 @@ export type ThreadRow = {
   senders: string[]
   snippet: string
   labels: string[]
+  snoozedUntil: string | null
 }
 
 /**
@@ -737,6 +804,8 @@ async function threadMessage(row: { id: string; owner: string | null; subject: s
     const threadId = await assignThread({ id: row.id, owner: row.owner, subject: row.subject, receivedAt: row.receivedAt })
     const sql = db()
     await sql`UPDATE mail_inbox SET thread_id = ${threadId} WHERE id = ${row.id}`
+    // A reply to a conversation someone put aside is the reason to stop putting it aside.
+    await setThreadSnooze(row.owner, threadId, null)
     await refreshThread(row.owner, threadId)
   } catch (err) {
     console.error('[threads] could not thread', row.id, err instanceof Error ? err.message : err)
@@ -762,7 +831,7 @@ async function rethreadAfterChange(id: string, previousOwner?: string | null, pr
   }
 }
 
-export type ThreadFolder = 'inbox' | 'archive' | 'trash' | 'starred'
+export type ThreadFolder = 'inbox' | 'archive' | 'trash' | 'starred' | 'snoozed'
 
 /** The newest conversations in a folder: one row each, already summarised. */
 export type ThreadPage = { rows: ThreadRow[]; nextCursor: string | null }
@@ -770,19 +839,26 @@ export type ThreadPage = { rows: ThreadRow[]; nextCursor: string | null }
 export async function listThreads(ownerRaw: string, folder: ThreadFolder, limit: number, cursorRaw?: string | null): Promise<ThreadPage> {
   await ensureMailSchema()
   const owner = ownerRaw.toLowerCase()
+  const nowIso = new Date().toISOString()
   const predicate =
     folder === 'archive' ? 'archived_count > 0'
     : folder === 'trash' ? 'trashed_count > 0'
     : folder === 'starred' ? 'starred_count > 0'
-    : 'inbox_count > 0'
+    : folder === 'snoozed' ? 'snoozed_until > ?'
+    : 'inbox_count > 0 AND (snoozed_until IS NULL OR snoozed_until <= ?)'
+  // Both snooze predicates carry one bound timestamp; the others carry none, and the
+  // cursor's arguments have to follow whatever the predicate used.
+  const folderArgs = folder === 'snoozed' || folder === 'inbox' ? [nowIso] : []
   const cursor = decodeCursor(cursorRaw)
   const rows = await tagged(db(), `
     SELECT thread_id, subject, first_at, latest_at, latest_id, count, unread_count, starred_count,
-      inbox_count, archived_count, trashed_count, attach_count, senders, snippet, labels
+      inbox_count, archived_count, trashed_count, attach_count, senders, snippet, labels, snoozed_until
     FROM mail_threads WHERE owner = ? AND ${predicate}
       ${cursor ? 'AND (latest_at < ? OR (latest_at = ? AND thread_id < ?))' : ''}
     ORDER BY latest_at DESC, thread_id DESC LIMIT ?`,
-    cursor ? [owner, cursor.receivedAt, cursor.receivedAt, cursor.id, limit] : [owner, limit])
+    cursor
+      ? [owner, ...folderArgs, cursor.receivedAt, cursor.receivedAt, cursor.id, limit]
+      : [owner, ...folderArgs, limit])
   const last = rows[rows.length - 1]
   const nextCursor = rows.length === limit && last ? encodeCursor(String(last.latest_at), String(last.thread_id)) : null
   const mapped = rows.map(row => ({
@@ -801,6 +877,7 @@ export async function listThreads(ownerRaw: string, folder: ThreadFolder, limit:
     senders: parseJson<string[]>(row.senders, []),
     snippet: String(row.snippet ?? ''),
     labels: parseJson<string[]>(row.labels, []),
+    snoozedUntil: row.snoozed_until == null ? null : String(row.snoozed_until),
   }))
   return { rows: mapped, nextCursor }
 }
@@ -1145,6 +1222,64 @@ export async function setInboundFlags(id: string, flags: InboundFlags): Promise<
   await rethreadAfterChange(id)
 }
 
+/**
+ * Flags every message in one conversation. The list shows a row per thread, and a client
+ * that has not loaded that thread's messages cannot name them — which is why archiving a
+ * row whose mail sat below the loaded page quietly did nothing.
+ */
+export async function setInboundFlagsForThread(
+  ownerRaw: string,
+  threadId: string,
+  flags: InboundFlags,
+): Promise<string[]> {
+  await ensureMailSchema()
+  const sql = db()
+  const owner = ownerRaw.toLowerCase()
+  const rows = await sql`
+    SELECT id FROM mail_inbox WHERE lower(owner) = ${owner} AND thread_id = ${threadId}`
+  const ids = rows.map(row => String(row.id))
+  for (const id of ids) await setInboundFlags(id, flags)
+  return ids
+}
+
+/**
+ * Snooze or wake a conversation. Snooze is a property of the conversation rather than of
+ * one message in it: the list shows a row per thread, and half a thread disappearing would
+ * be a puzzle rather than a feature. `until` of null wakes it immediately.
+ */
+export async function setThreadSnooze(
+  ownerRaw: string,
+  threadId: string,
+  until: string | null,
+): Promise<number> {
+  await ensureMailSchema()
+  const sql = db()
+  const owner = ownerRaw.toLowerCase()
+  const rows = await sql`
+    SELECT id FROM mail_inbox WHERE lower(owner) = ${owner} AND thread_id = ${threadId}`
+  for (const row of rows) {
+    await sql`UPDATE mail_inbox SET snoozed_until = ${until} WHERE id = ${String(row.id)}`
+  }
+  await sql`
+    UPDATE mail_threads SET snoozed_until = ${until}
+    WHERE owner = ${owner} AND thread_id = ${threadId}`
+  await invalidateCounts(owner)
+  return rows.length
+}
+
+/** Which of these message ids the mailbox already holds. */
+export async function inboundExists(ids: string[]): Promise<Set<string>> {
+  await ensureMailSchema()
+  const found = new Set<string>()
+  for (let i = 0; i < ids.length; i += 200) {
+    const chunk = ids.slice(i, i + 200)
+    if (!chunk.length) break
+    const rows = await tagged(db(), `SELECT id FROM mail_inbox WHERE id IN (${chunk.map(() => '?').join(',')})`, chunk)
+    for (const row of rows) found.add(String(row.id))
+  }
+  return found
+}
+
 export async function setInboundLabels(id: string, labels: string[]): Promise<void> {
   const sql = db()
   await sql`UPDATE mail_inbox SET labels = ${JSON.stringify(labels)} WHERE id = ${id}`
@@ -1428,14 +1563,121 @@ export async function recordSentMessage(message: SentMessage): Promise<void> {
     ON CONFLICT (id) DO NOTHING`
 }
 
-export async function readSentArchive(): Promise<SentMessage[]> {
+/**
+ * Which columns a search term can narrow in SQL. The precise decision is still made by
+ * matchesQuery on the rows that come back; this only keeps the scan from reading every
+ * body in the archive. A term it cannot express leaves its group unnarrowed rather than
+ * narrowing it wrongly.
+ */
+const SENT_SEARCH_COLUMNS: Record<string, string> = {
+  to: 's.to_addrs',
+  cc: 's.cc',
+  bcc: 's.bcc',
+  from: 's.from_addr',
+  subject: 's.subject',
+  // Must match the substr the exact matcher is handed, or a deep hit passes SQL then drops.
+  body: "substr(coalesce(s.body_text, ''), 1, 4000)",
+}
+
+/** A LIKE pattern for a literal term: its own wildcards are made literal too. */
+function likeLiteral(value: string): string {
+  return `%${value.replace(/[\\%_]/g, char => `\\${char}`)}%`
+}
+
+function sentSearchPrefilter(query: ParsedQuery): { clauses: string[]; args: unknown[] } {
+  const clauses: string[] = []
+  const args: unknown[] = []
+  for (const group of query.groups) {
+    const ors: string[] = []
+    const groupArgs: unknown[] = []
+    let expressible = true
+    for (const term of group) {
+      // SQLite's lower() folds ASCII only; leave such terms to the exact matcher.
+      if (/[^\x00-\x7f]/.test(term.value)) { expressible = false; break }
+      const column = term.field ? SENT_SEARCH_COLUMNS[term.field] : null
+      if (column) {
+        ors.push(`lower(coalesce(${column}, '')) ${term.negated ? 'NOT LIKE' : 'LIKE'} ? ESCAPE '\\'`)
+        groupArgs.push(likeLiteral(term.value))
+        continue
+      }
+      if (!term.field) {
+        if (term.negated) { expressible = false; break }
+        const columns = ['s.to_addrs', 's.cc', 's.from_addr', 's.subject', "substr(coalesce(s.body_text, ''), 1, 4000)"]
+        ors.push(`(${columns.map(col => `lower(coalesce(${col}, '')) LIKE ? ESCAPE '\\'`).join(' OR ')})`)
+        groupArgs.push(...columns.map(() => likeLiteral(term.value)))
+        continue
+      }
+      if (term.field === 'before' || term.field === 'after') {
+        const at = Date.parse(term.value)
+        if (Number.isNaN(at)) { expressible = false; break }
+        ors.push(`s.created_at ${term.field === 'before' ? '<' : '>'} ?`)
+        groupArgs.push(new Date(at).toISOString())
+        continue
+      }
+      if (term.field === 'older_than' || term.field === 'newer_than') {
+        const span = duration(term.value)
+        if (span == null) { expressible = false; break }
+        ors.push(`s.created_at ${term.field === 'older_than' ? '<' : '>'} ?`)
+        groupArgs.push(new Date(Date.now() - span).toISOString())
+        continue
+      }
+      expressible = false
+      break
+    }
+    if (expressible && ors.length) {
+      clauses.push(`(${ors.join(' OR ')})`)
+      args.push(...groupArgs)
+    }
+  }
+  return { clauses, args }
+}
+
+/**
+ * The sent archive for one mailbox, newest first. Unscoped, the newest 500 rows of the
+ * whole table were read and then filtered by owner, so each person saw their share of the
+ * company's last 500 sends — a quiet mailbox could see a dozen. The owner is matched on
+ * the assignment in mail_sent_meta, else on the sender address; the caller still applies
+ * its exact attribution on top.
+ *
+ * With a query, the search runs here over the whole archive instead of over whatever the
+ * client happened to have loaded, and returns the body text the matcher needs.
+ */
+export async function readSentArchive(options: {
+  ownerAddress?: string | null
+  sharedAddress?: string | null
+  query?: ParsedQuery | null
+  limit?: number
+} = {}): Promise<SentMessage[]> {
   await ensureMailSchema()
   const sql = db()
+  const limit = Math.min(Math.max(options.limit ?? 500, 1), 1000)
+  const where: string[] = ['coalesce(m.is_auto, 0) = 0']
+  const args: unknown[] = []
+
+  const owner = options.ownerAddress?.trim().toLowerCase()
+  if (owner && owner !== options.sharedAddress?.toLowerCase()) {
+    where.push(`(lower(m.owner) = ? OR ((m.owner IS NULL OR m.owner = '') AND lower(s.from_addr) LIKE ? ESCAPE '\\'))`)
+    args.push(owner, likeLiteral(owner))
+  }
+  if (options.query && !options.query.isEmpty) {
+    const prefilter = sentSearchPrefilter(options.query)
+    where.push(...prefilter.clauses)
+    args.push(...prefilter.args)
+  }
+
   // The list never shows a body, and 500 bodies is tens of megabytes — the Sent folder
-  // took half a minute to open once an archive had been imported.
-  const rows = await sql`
-    SELECT id, from_addr, to_addrs, cc, bcc, reply_to, subject, created_at, last_event
-    FROM mail_sent ORDER BY created_at DESC LIMIT 500`
+  // took half a minute to open once an archive had been imported. A search needs some of
+  // it to decide bare terms, so it gets the first few thousand characters and no more.
+  const textColumn = options.query ? "substr(coalesce(s.body_text, ''), 1, 4000)" : 'NULL'
+  const rows = await tagged(
+    sql,
+    `SELECT s.id, s.from_addr, s.to_addrs, s.cc, s.bcc, s.reply_to, s.subject, s.created_at, s.last_event,
+            ${textColumn} AS text
+     FROM mail_sent s LEFT JOIN mail_sent_meta m ON m.email_id = s.id
+     ${where.length ? `WHERE ${where.join(' AND ')}` : ''}
+     ORDER BY s.created_at DESC LIMIT ?`,
+    [...args, limit],
+  )
   return rows.map(row => ({
     id: String(row.id),
     from: (row.from_addr as string) ?? '',
@@ -1445,7 +1687,7 @@ export async function readSentArchive(): Promise<SentMessage[]> {
     replyTo: parseArray(row.reply_to),
     subject: (row.subject as string) ?? '',
     html: null,
-    text: null,
+    text: row.text == null ? null : String(row.text),
     createdAt: isoOrNull(row.created_at) ?? new Date(0).toISOString(),
     lastEvent: (row.last_event as string) ?? null,
   }))
@@ -1512,17 +1754,33 @@ export async function readSentMeta(emailIds?: string[]): Promise<Record<string,
   // The caller only ever needs rows for the messages it is about to return. Unscoped,
   // this read the whole table — thirty-odd thousand rows — on every poll of every tab,
   // which is most of a month's read quota on its own.
-  const safe = (emailIds ?? []).filter(id => /^[A-Za-z0-9._:+@-]{1,200}$/.test(id))
-  const scope = emailIds ? ` WHERE email_id IN (${safe.map(id => `'${id}'`).join(',') || "''"})` : ''
-  const rows = await sql`SELECT email_id, owner, is_auto, in_reply_to FROM mail_sent_meta${scope}`
+  // The sql tag binds every interpolation as a parameter; a spliced WHERE became `... ?`,
+  // a syntax error the callers swallowed, so every lookup came back empty.
   const out: Record<string, SentMeta> = {}
-  for (const row of rows) {
-    out[String(row.email_id)] = {
-      owner: (row.owner as string) ?? null,
-      isAuto: Boolean(row.is_auto),
-      inReplyTo: (row.in_reply_to as string) ?? null,
+  const collect = (rows: Record<string, unknown>[]) => {
+    for (const row of rows) {
+      out[String(row.email_id)] = {
+        owner: (row.owner as string) ?? null,
+        isAuto: Boolean(row.is_auto),
+        inReplyTo: (row.in_reply_to as string) ?? null,
+      }
     }
   }
+  if (!emailIds) {
+    collect(await sql`SELECT email_id, owner, is_auto, in_reply_to FROM mail_sent_meta`)
+    return out
+  }
+  for (let i = 0; i < emailIds.length; i += 200) {
+    const chunk = emailIds.slice(i, i + 200)
+    if (!chunk.length) break
+    collect(
+      await tagged(
+        sql,
+        `SELECT email_id, owner, is_auto, in_reply_to FROM mail_sent_meta WHERE email_id IN (${chunk.map(() => '?').join(',')})`,
+        chunk,
+      ),
+    )
+  }
   return out
 }
 
@@ -1686,6 +1944,9 @@ export async function resetPasswordWithToken(token: string, passwordHash: string
   await sql`
     INSERT INTO mail_accounts (email, password_hash, status, created_at) VALUES (${String(email)}, ${passwordHash}, 'active', ${nowIso()})
     ON CONFLICT (email) DO UPDATE SET password_hash = excluded.password_hash, status = 'active'`
+  // Any other link still outstanding for this address is now stale — and one of them
+  // may be the reason the password is being changed.
+  await sql`DELETE FROM mail_reset_tokens WHERE email = ${String(email)}`
   return String(email)
 }
 
@@ -1731,8 +1992,16 @@ export async function deleteStash(owner: string, kind: string, id: string): Prom
  */
 const CLAIM_LEASE_MS = 10 * 60 * 1000
 
-export async function claimWebhookEvent(id: string): Promise<boolean> {
-  if (!id) return true
+/**
+ * "busy" is the one that matters: an attempt is still inside its lease. The caller must
+ * answer the provider with a failure, not a duplicate — five stranded deliveries on the
+ * old host came from a process the platform killed mid-way, whose 5s and 5m retries were
+ * each told "already handled" and so the provider never tried again.
+ */
+export type WebhookClaim = 'claimed' | 'done' | 'busy'
+
+export async function claimWebhookEvent(id: string): Promise<WebhookClaim> {
+  if (!id) return 'claimed'
   await ensureMailSchema()
 
   const inserted = await sqlRaw(
@@ -1741,19 +2010,19 @@ export async function claimWebhookEvent(id: string): Promise<boolean> {
      RETURNING id`,
     [id, nowIso()],
   )
-  if (inserted.length > 0) return true
+  if (inserted.length > 0) return 'claimed'
 
   const existing = await sqlRaw('SELECT handled_at, status FROM mail_webhook_events WHERE id = ?', [id])
   const row = existing[0]
-  if (!row) return true
-  if (String(row.status) === 'done') return false
+  if (!row) return 'claimed'
+  if (String(row.status) === 'done') return 'done'
 
   const startedAt = new Date(String(row.handled_at)).getTime()
-  if (Number.isFinite(startedAt) && Date.now() - startedAt < CLAIM_LEASE_MS) return false
+  if (Number.isFinite(startedAt) && Date.now() - startedAt < CLAIM_LEASE_MS) return 'busy'
 
   // The attempt holding this never finished and its lease has run out. Take it over.
   await sqlRaw('UPDATE mail_webhook_events SET handled_at = ? WHERE id = ?', [nowIso(), id])
-  return true
+  return 'claimed'
 }
 
 /** Marks the delivery finished, so later redeliveries of it are refused for good. */