@novacraft-engineering/mailbox 0.1.0

package/app/api/mail/emails/[id]/route.ts

@@ -0,0 +1,127 @@
+import { NextResponse } from 'next/server'
+import { Resend } from 'resend'
+import { mailAuthGuard } from '@/lib/dev-auth'
+import { getSentAttachments, readSentMessage } from '@/lib/mailbox'
+
+export const runtime = 'nodejs'
+
+function getResend(): Resend | null {
+  const apiKey = process.env.RESEND_API_KEY
+  return apiKey ? new Resend(apiKey) : null
+}
+
+/**
+ * Imported archives were never in Resend, and a provider drops its copy eventually anyway;
+ * our own mail_sent row is the durable source, and the provider is asked only for the
+ * details it alone holds (attachment links, schedule, delivery state).
+ */
+async function fromArchive(id: string) {
+  const stored = await readSentMessage(id).catch(() => null)
+  if (!stored) return null
+  return NextResponse.json({
+    ok: true,
+    email: {
+      id: stored.id,
+      from: stored.from,
+      to: stored.to,
+      cc: stored.cc,
+      bcc: stored.bcc,
+      replyTo: stored.replyTo[0] ?? null,
+      subject: stored.subject || '(no subject)',
+      html: stored.html,
+      text: stored.text,
+      createdAt: stored.createdAt,
+      scheduledAt: null,
+      lastEvent: stored.lastEvent ?? '',
+      attachments: [],
+    },
+  })
+}
+
+export async function GET(req: Request, { params }: { params: Promise<{ id: string }> }) {
+  const guard = await mailAuthGuard(req)
+  if (guard) return guard
+  const { id } = await params
+  const resend = getResend()
+
+  if (id.startsWith('mbox-') || !resend) {
+    const archived = await fromArchive(id)
+    if (archived) return archived
+    return NextResponse.json({ ok: false, error: resend ? 'Not found' : 'RESEND_API_KEY not configured' }, { status: resend ? 404 : 500 })
+  }
+
+  const { data, error } = await resend.emails.get(id)
+  if (error) {
+    const archived = await fromArchive(id)
+    if (archived) return archived
+    return NextResponse.json({ ok: false, error: error.message }, { status: 502 })
+  }
+
+  const stored = await getSentAttachments(id).catch(() => [])
+  const rawAttachments = stored.some(entry => entry.key)
+    ? stored
+    : ((await resend.emails.attachments.list({ emailId: id }).catch(() => null))?.data as unknown as {
+        data?: Array<Record<string, unknown>>
+      })?.data ?? []
+  // Served through this domain rather than the provider's host, which does not resolve
+  // on some of the networks the office uses.
+  const attachments = rawAttachments.map((entry, index) => ({
+    filename: String((entry as Record<string, unknown>).filename ?? 'attachment'),
+    size: Number((entry as Record<string, unknown>).size ?? 0),
+    downloadUrl: `/api/mail/emails/${encodeURIComponent(id)}/attachments/download?index=${index}`,
+  }))
+
+  const item = data as unknown as Record<string, unknown>
+  return NextResponse.json({
+    ok: true,
+    email: {
+      id: String(item.id ?? id),
+      from: String(item.from ?? ''),
+      to: Array.isArray(item.to) ? (item.to as string[]) : [String(item.to ?? '')],
+      cc: Array.isArray(item.cc) ? (item.cc as string[]) : [],
+      bcc: Array.isArray(item.bcc) ? (item.bcc as string[]) : [],
+      replyTo: item.reply_to ? String(item.reply_to) : null,
+      subject: String(item.subject ?? '(no subject)'),
+      html: item.html ? String(item.html) : null,
+      text: item.text ? String(item.text) : null,
+      createdAt: String(item.created_at ?? ''),
+      scheduledAt: item.scheduled_at ? String(item.scheduled_at) : null,
+      lastEvent: String(item.last_event ?? ''),
+      attachments,
+    },
+  })
+}
+
+export async function PATCH(req: Request, { params }: { params: Promise<{ id: string }> }) {
+  const guard = await mailAuthGuard(req)
+  if (guard) return guard
+  const resend = getResend()
+  if (!resend) return NextResponse.json({ ok: false, error: 'RESEND_API_KEY not configured' }, { status: 500 })
+
+  const { id } = await params
+  let body: { scheduledAt?: string }
+  try {
+    body = await req.json()
+  } catch {
+    return NextResponse.json({ ok: false, error: 'Invalid JSON' }, { status: 400 })
+  }
+  if (!body.scheduledAt) {
+    return NextResponse.json({ ok: false, error: 'scheduledAt is required' }, { status: 400 })
+  }
+
+  const { error } = await resend.emails.update({ id, scheduledAt: body.scheduledAt })
+  if (error) return NextResponse.json({ ok: false, error: error.message }, { status: 502 })
+  return NextResponse.json({ ok: true })
+}
+
+export async function DELETE(req: Request, { params }: { params: Promise<{ id: string }> }) {
+  const guard = await mailAuthGuard(req)
+  if (guard) return guard
+  const resend = getResend()
+  if (!resend) return NextResponse.json({ ok: false, error: 'RESEND_API_KEY not configured' }, { status: 500 })
+
+  const { id } = await params
+  const { error } = await resend.emails.cancel(id)
+  if (error) return NextResponse.json({ ok: false, error: error.message }, { status: 502 })
+  return NextResponse.json({ ok: true })
+}

package/app/api/mail/emails/route.ts

@@ -0,0 +1,116 @@
+import { BRAND } from '@/lib/brand'
+import { NextResponse } from 'next/server'
+import { FORWARD_RECIPIENTS, mailAuthGuard, resolveAccount } from '@/lib/dev-auth'
+import { readSentFlags, setSentFlags, readPixelOpens, readSentMeta, setSentMetaOwner, listAccounts, readSentArchive, type SentFlags } from '@/lib/mailbox'
+
+const SHARED_ADDRESS = (process.env.RESEND_FROM ?? BRAND.supportEmail).replace(/^.*<|>$/g, '').trim().toLowerCase()
+
+function fromAddressOf(email: SentEmail): string {
+  return (email.from.match(/<([^>]+)>/)?.[1] ?? email.from).trim().toLowerCase()
+}
+
+export const runtime = 'nodejs'
+
+type SentEmail = { id: string; from: string; to: string[]; subject: string; createdAt: string; scheduledAt: string | null; lastEvent: string }
+
+const KNOWN_AUTO_SUBJECTS = new Set([`Reset your ${BRAND.name} Mail password`])
+
+/** Heuristic for pre-existing automated sends that predate owner/auto tagging. */
+function looksAutomated(email: SentEmail): boolean {
+  if (email.subject.startsWith('Fwd:')) return true
+  if (KNOWN_AUTO_SUBJECTS.has(email.subject)) return true
+  const internal = new Set(
+    [...FORWARD_RECIPIENTS, ...(process.env.RESEND_TO ?? '').split(',')]
+      .map(addr => addr.trim().toLowerCase())
+      .filter(Boolean),
+  )
+  const recipients = email.to
+    .map(entry => (entry.match(/<([^>]+)>/)?.[1] ?? entry).trim().toLowerCase())
+    .filter(Boolean)
+  return recipients.length > 0 && recipients.every(addr => internal.has(addr))
+}
+
+export async function GET(req: Request) {
+  const guard = await mailAuthGuard(req)
+  if (guard) return guard
+
+  const account = await resolveAccount(req)
+  // Read our own archive rather than the provider's list: the history stays ours across
+  // a provider switch, and every send is written here at send time.
+  // Meta is looked up only for the archive rows being returned, so fetch those first.
+  const archive = await readSentArchive().catch(() => [])
+  const [flags, opens, sentMeta, accounts] = await Promise.all([
+    readSentFlags().catch(() => ({})),
+    readPixelOpens().catch(() => ({})),
+    readSentMeta(archive.map(item => item.id)).catch(() => ({})),
+    listAccounts().catch(() => []),
+  ])
+
+  const all: SentEmail[] = archive.map(item => ({
+    id: item.id,
+    from: item.from,
+    to: item.to,
+    subject: item.subject || '(no subject)',
+    createdAt: item.createdAt,
+    scheduledAt: null,
+    lastEvent: item.lastEvent ?? '',
+  }))
+
+  // Sent mail is scoped the same way the inbox is: to the signed-in mailbox, whatever
+  // the role. Administering accounts does not carry the right to read someone's sends.
+  const ownerScope: string = account.address ?? ' no-address'
+
+  // Ownership is the sender identity: the `from` address if it's an accessor's, else the
+  // shared inbox (admin). This attributes historical sends (all from hello@) correctly.
+  const accountAddresses = new Set(accounts.filter(entry => entry.address).map(entry => entry.address!.toLowerCase()))
+  const metaMap = sentMeta as Record<string, { owner: string | null; isAuto: boolean; inReplyTo: string | null }>
+  const sentOwner = (email: SentEmail): string => {
+    // An explicit assignment wins; otherwise the sender identity is the `from` address.
+    const assigned = metaMap[email.id]?.owner
+    if (assigned) return assigned
+    const from = fromAddressOf(email)
+    return accountAddresses.has(from) ? from : SHARED_ADDRESS
+  }
+
+  const emails = all
+    .filter(email => {
+      const meta = metaMap[email.id]
+      if (meta?.isAuto) return false // tagged automated → never in Sent
+      if (!meta && looksAutomated(email)) return false // pre-existing automated → excluded
+      if (ownerScope) return sentOwner(email) === ownerScope
+      return true
+    })
+    .map(email => ({ ...email, owner: sentOwner(email), inReplyTo: metaMap[email.id]?.inReplyTo ?? null }))
+
+  return NextResponse.json({ ok: true, emails, flags, opens })
+}
+
+export async function PATCH(req: Request) {
+  const guard = await mailAuthGuard(req)
+  if (guard) return guard
+  let body: { id?: string; ids?: string[]; owner?: string } & SentFlags
+  try {
+    body = await req.json()
+  } catch {
+    return NextResponse.json({ ok: false, error: 'Invalid JSON' }, { status: 400 })
+  }
+  const ids = body.ids ?? (body.id ? [body.id] : [])
+  if (!ids.length) return NextResponse.json({ ok: false, error: 'id or ids is required' }, { status: 400 })
+
+  // Reassigning a message to a mailbox is admin-only.
+  if (body.owner !== undefined) {
+    const account = await resolveAccount(req)
+    if (account.role !== 'admin') {
+      return NextResponse.json({ ok: false, error: 'Admin access required' }, { status: 403 })
+    }
+    await Promise.all(ids.map(id => setSentMetaOwner(id, body.owner!)))
+    return NextResponse.json({ ok: true })
+  }
+
+  const flags: SentFlags = {}
+  if (body.starred !== undefined) flags.starred = body.starred
+  if (body.archived !== undefined) flags.archived = body.archived
+  if (body.trashed !== undefined) flags.trashed = body.trashed
+  await Promise.all(ids.map(id => setSentFlags(id, flags)))
+  return NextResponse.json({ ok: true })
+}

package/app/api/mail/events/route.ts

@@ -0,0 +1,12 @@
+import { NextResponse } from 'next/server'
+import { mailAuthGuard } from '@/lib/dev-auth'
+import { readEvents } from '@/lib/mailbox'
+
+export const runtime = 'nodejs'
+
+export async function GET(req: Request) {
+  const guard = await mailAuthGuard(req)
+  if (guard) return guard
+  const events = await readEvents()
+  return NextResponse.json({ ok: true, events })
+}

package/app/api/mail/fonts/route.ts

@@ -0,0 +1,44 @@
+import { createHash } from 'node:crypto'
+import { NextResponse } from 'next/server'
+import { mailAuthGuard, resolveAccount } from '@/lib/dev-auth'
+import { presign } from '@/lib/r2'
+
+export const runtime = 'nodejs'
+
+const TYPES: Record<string, string> = { woff2: 'font/woff2', woff: 'font/woff', ttf: 'font/ttf', otf: 'font/otf' }
+const MAX_BYTES = 5 * 1024 * 1024
+
+export async function GET(req: Request) {
+  const key = new URL(req.url).searchParams.get('key')
+  if (!key || !/^fonts\/[a-f0-9]+\.(woff2|woff|ttf|otf)$/.test(key)) {
+    return NextResponse.json({ ok: false, error: 'Bad key' }, { status: 400 })
+  }
+  const upstream = await fetch(presign(key, 'GET', 300)).catch(() => null)
+  if (!upstream?.ok) return NextResponse.json({ ok: false, error: 'Not found' }, { status: 404 })
+  return new NextResponse(upstream.body, {
+    headers: {
+      'content-type': TYPES[key.split('.').pop() ?? ''] ?? 'application/octet-stream',
+      'cache-control': 'public, max-age=31536000, immutable',
+      'access-control-allow-origin': '*',
+    },
+  })
+}
+
+export async function POST(req: Request) {
+  const guard = await mailAuthGuard(req)
+  if (guard) return guard
+  const account = await resolveAccount(req)
+  if (!account.email) return NextResponse.json({ ok: false, error: 'Not signed in.' }, { status: 401 })
+
+  const extension = (new URL(req.url).searchParams.get('ext') ?? '').toLowerCase()
+  if (!TYPES[extension]) return NextResponse.json({ ok: false, error: 'Use a WOFF2, WOFF, TTF or OTF font file.' }, { status: 400 })
+
+  const bytes = Buffer.from(await req.arrayBuffer())
+  if (bytes.length === 0) return NextResponse.json({ ok: false, error: 'That file is empty.' }, { status: 400 })
+  if (bytes.length > MAX_BYTES) return NextResponse.json({ ok: false, error: 'Keep the font under 5MB.' }, { status: 413 })
+
+  const key = `fonts/${createHash('sha256').update(bytes).digest('hex').slice(0, 24)}.${extension}`
+  const put = await fetch(presign(key, 'PUT', 300), { method: 'PUT', headers: { 'content-type': TYPES[extension] }, body: bytes }).catch(() => null)
+  if (!put?.ok) return NextResponse.json({ ok: false, error: 'Could not store that font.' }, { status: 502 })
+  return NextResponse.json({ ok: true, url: `/api/mail/fonts?key=${encodeURIComponent(key)}` })
+}

package/app/api/mail/inbox/attachments/download/route.ts

@@ -0,0 +1,50 @@
+import { NextResponse } from 'next/server'
+import { mailAuthGuard } from '@/lib/dev-auth'
+import { getInboundAttachments } from '@/lib/mailbox'
+import { getObject } from '@/lib/r2'
+
+export const runtime = 'nodejs'
+export const dynamic = 'force-dynamic'
+
+/**
+ * Serves attachment bytes from this domain rather than handing the browser a bucket or
+ * provider URL. Those hosts are a separate name to resolve and reach, and on the networks
+ * the office actually uses some of them do not resolve at all — the message opens, the
+ * attachment does not. The reader already reached this origin to load the page, so
+ * anything served from here is reachable by definition.
+ */
+export async function GET(req: Request) {
+  const guard = await mailAuthGuard(req)
+  if (guard) return guard
+
+  const params = new URL(req.url).searchParams
+  const id = params.get('id')
+  const index = Number(params.get('index') ?? 0)
+  if (!id) return NextResponse.json({ ok: false, error: 'id is required' }, { status: 400 })
+
+  // The key is read from the message rather than taken from the caller, so this cannot
+  // be pointed at an arbitrary object in the bucket.
+  const attachments = await getInboundAttachments(id).catch(() => [])
+  const entry = attachments[Number.isFinite(index) ? index : 0]
+  const key = entry && typeof entry.key === 'string' ? entry.key : ''
+  if (!key) return NextResponse.json({ ok: false, error: 'That file is not stored here.' }, { status: 404 })
+
+  const object = await getObject(key)
+  if (!object || !object.body) {
+    return NextResponse.json({ ok: false, error: 'That file could not be read.' }, { status: 502 })
+  }
+
+  const filename = String(entry.filename ?? 'attachment').replace(/["\\]/g, '')
+  // The preview and the download button share this route. `attachment` tells the browser
+  // to save rather than render, which turns a preview into a download — so the viewer
+  // asks for `inline` and only the download button gets the other.
+  const inline = params.get('inline') === '1'
+  return new Response(object.body, {
+    headers: {
+      'content-type': String(entry.contentType ?? object.headers.get('content-type') ?? 'application/octet-stream'),
+      'content-disposition': `${inline ? 'inline' : 'attachment'}; filename="${filename}"`,
+      ...(object.headers.get('content-length') ? { 'content-length': object.headers.get('content-length')! } : {}),
+      'cache-control': 'private, max-age=3600',
+    },
+  })
+}

package/app/api/mail/inbox/attachments/forward/route.ts

@@ -0,0 +1,54 @@
+import { randomBytes } from 'node:crypto'
+import { NextResponse } from 'next/server'
+import { mailAuthGuard } from '@/lib/dev-auth'
+import { getInboundAttachments } from '@/lib/mailbox'
+import { getObject, putObject } from '@/lib/r2'
+
+export const runtime = 'nodejs'
+export const dynamic = 'force-dynamic'
+
+/**
+ * Copies the files on a received message into the outgoing space, so they can be
+ * forwarded.
+ *
+ * The send route will only attach keys under `outgoing/`, which is what stops a caller
+ * naming any object in the bucket. Rather than widen that, the copy happens here: the
+ * key is read from the message itself, never from the request, so the only files that
+ * can be copied are the ones actually on a message this caller may read.
+ */
+export async function POST(req: Request) {
+  const guard = await mailAuthGuard(req)
+  if (guard) return guard
+
+  let body: { id?: string }
+  try {
+    body = await req.json()
+  } catch {
+    return NextResponse.json({ ok: false, error: 'Invalid request.' }, { status: 400 })
+  }
+
+  const id = String(body.id ?? '')
+  if (!id) return NextResponse.json({ ok: false, error: 'Which message?' }, { status: 400 })
+
+  const held = await getInboundAttachments(id).catch(() => [])
+  const copied: Array<{ filename: string; size: number; contentType?: string; key: string }> = []
+
+  for (const entry of held) {
+    const sourceKey = typeof entry.key === 'string' ? entry.key : ''
+    if (!sourceKey) continue
+
+    const object = await getObject(sourceKey)
+    if (!object) continue
+    const bytes = Buffer.from(await object.arrayBuffer())
+
+    const filename = String(entry.filename ?? 'attachment')
+    const safe = filename.replace(/[^\w.\- ]+/g, '_').slice(0, 120)
+    const key = `outgoing/${randomBytes(9).toString('hex')}/${safe}`
+    const contentType = typeof entry.contentType === 'string' ? entry.contentType : undefined
+    if (!(await putObject(key, bytes, contentType))) continue
+
+    copied.push({ filename, size: bytes.length, contentType, key })
+  }
+
+  return NextResponse.json({ ok: true, attachments: copied })
+}

package/app/api/mail/inbox/attachments/route.ts

@@ -0,0 +1,99 @@
+import { NextResponse } from 'next/server'
+import { mailAuthGuard } from '@/lib/dev-auth'
+import { getInboundAttachments, resolveInboundBody, setInboundAttachments } from '@/lib/mailbox'
+import { isEmbedded, referencedCids } from '@/lib/attachments'
+
+export const runtime = 'nodejs'
+
+/**
+ * Our own rehosted copy wins over Resend's: the provider's download URLs expire and vanish
+ * with the account, and imported archives were never in Resend to begin with.
+ */
+export async function GET(req: Request) {
+  const guard = await mailAuthGuard(req)
+  if (guard) return guard
+
+  const id = new URL(req.url).searchParams.get('id')
+  if (!id) return NextResponse.json({ ok: false, error: 'id is required' }, { status: 400 })
+
+  // Anything we hold is served back through this domain. A bucket link and a provider
+  // link are both hosts the reader's network has to reach separately, and on some of
+  // those networks they cannot be reached at all.
+  const held = await getInboundAttachments(id).catch(() => [])
+  // The body decides which images are decoration. Read once, not once per file.
+  const body = await resolveInboundBody(id).catch(() => ({ html: null, text: null }))
+  const referenced = referencedCids(body.html)
+  const stored = held
+    .map((entry, index) => ({ entry, index }))
+    .filter(({ entry }) => typeof entry.key === 'string' && entry.key)
+    .filter(({ entry }) => !isEmbedded(entry, referenced))
+    .map(({ entry, index }) => ({
+      filename: String(entry.filename ?? 'attachment'),
+      size: Number(entry.size ?? 0),
+      contentType: typeof entry.contentType === 'string' ? entry.contentType : undefined,
+      downloadUrl: `/api/mail/inbox/attachments/download?id=${encodeURIComponent(id)}&index=${index}`,
+    }))
+  // A file too big to send was put behind a share page instead. We hold no bytes for it,
+  // but it is not lost: it has somewhere to go, and a tile with nowhere to go is a dead end.
+  const shared = held
+    .map((entry, index) => ({ entry, index }))
+    .filter(({ entry }) => typeof entry.shareId === 'string' && entry.shareId && !entry.key)
+    .map(({ entry }) => ({
+      filename: String(entry.filename ?? 'attachment'),
+      size: Number(entry.size ?? 0),
+      contentType: typeof entry.contentType === 'string' ? entry.contentType : undefined,
+      shareId: String(entry.shareId),
+      downloadUrl: `/share/${encodeURIComponent(String(entry.shareId))}`,
+    }))
+  if (stored.length || shared.length) return NextResponse.json({ ok: true, attachments: [...stored, ...shared] })
+
+  // Nothing of ours yet: this message predates the copy-on-arrival. Pull the bytes from
+  // the provider now and keep them, so the next reader is served from here and the file
+  // survives the provider's own retention window.
+  const apiKey = process.env.RESEND_API_KEY
+  if (!apiKey) return NextResponse.json({ ok: true, attachments: [] })
+
+  const response = await fetch(`https://api.resend.com/emails/receiving/${encodeURIComponent(id)}/attachments`, {
+    headers: { authorization: `Bearer ${apiKey}` },
+  })
+  if (!response.ok) return NextResponse.json({ ok: true, attachments: [] })
+
+  const payload = (await response.json()) as { data?: Array<Record<string, unknown>> }
+  const listed = payload.data ?? []
+  const { putObject } = await import('@/lib/r2')
+
+  const kept = await Promise.all(
+    listed.map(async (entry, index) => {
+      const filename = String(entry.filename ?? 'attachment')
+      const contentType = entry.content_type ? String(entry.content_type) : undefined
+      const source = entry.download_url ? String(entry.download_url) : ''
+      const contentId = entry.content_id ? String(entry.content_id).replace(/^<|>$/g, '') : undefined
+      const meta: Record<string, unknown> = { filename, contentType, size: Number(entry.size ?? 0), contentId }
+      if (!source) return meta
+      try {
+        const binary = await fetch(source)
+        if (!binary.ok) return meta
+        const bytes = Buffer.from(await binary.arrayBuffer())
+        const safeName = filename.replace(/[^\w.\- ]+/g, '_').slice(-120)
+        const key = `attachments/${id}/${index}-${safeName}`
+        if (await putObject(key, bytes, contentType)) return { ...meta, size: bytes.length, key }
+      } catch {
+        // Fall through: the file is still listed, just not ours yet.
+      }
+      return meta
+    }),
+  )
+
+  if (kept.some(entry => entry.key)) await setInboundAttachments(id, kept).catch(() => {})
+
+  const attachments = kept.map((entry, index) => ({ entry, index }))
+    .filter(({ entry }) => !isEmbedded(entry, referenced))
+    .map(({ entry, index }) => ({
+    filename: String(entry.filename ?? 'attachment'),
+    size: Number(entry.size ?? 0),
+    // Only ours are offered. A provider link that the reader's network cannot reach is
+    // worse than none: it looks like the app is broken rather than the file being absent.
+    downloadUrl: entry.key ? `/api/mail/inbox/attachments/download?id=${encodeURIComponent(id)}&index=${index}` : '',
+  }))
+  return NextResponse.json({ ok: true, attachments })
+}

package/app/api/mail/inbox/body/route.ts

@@ -0,0 +1,14 @@
+import { NextResponse } from 'next/server'
+import { mailAuthGuard } from '@/lib/dev-auth'
+import { resolveInboundBody } from '@/lib/mailbox'
+
+export const runtime = 'nodejs'
+
+export async function GET(req: Request) {
+  const guard = await mailAuthGuard(req)
+  if (guard) return guard
+  const id = new URL(req.url).searchParams.get('id')
+  if (!id) return NextResponse.json({ ok: false, error: 'id is required' }, { status: 400 })
+  const body = await resolveInboundBody(id).catch(() => ({ html: null, text: null }))
+  return NextResponse.json({ ok: true, ...body })
+}

package/app/api/mail/inbox/counts/route.ts

@@ -0,0 +1,25 @@
+import { NextResponse } from 'next/server'
+import { mailAuthGuard, resolveAccount } from '@/lib/dev-auth'
+import { countFolders, countFoldersCached } from '@/lib/mailbox'
+
+const COUNTS_TTL_MS = 20 * 1000
+const countsCache = new Map<string, { at: number; value: Awaited<ReturnType<typeof countFolders>> }>()
+async function cachedCounts(owner: string) {
+  const hit = countsCache.get(owner)
+  if (hit && Date.now() - hit.at < COUNTS_TTL_MS) return hit.value
+  const value = await countFoldersCached(owner)
+  countsCache.set(owner, { at: Date.now(), value })
+  return value
+}
+
+export const runtime = 'nodejs'
+
+export async function GET(req: Request) {
+  const guard = await mailAuthGuard(req)
+  if (guard) return guard
+
+  // Counts describe the signed-in mailbox, matching what the list will actually show.
+  const account = await resolveAccount(req)
+  const counts = await cachedCounts(account.address ?? ' no-address')
+  return NextResponse.json({ ok: true, counts })
+}