@novacraft-engineering/mailbox 0.1.0

package/app/api/mail/maintenance/bodies/route.ts

@@ -0,0 +1,30 @@
+import { timingSafeEqual } from 'node:crypto'
+import { NextResponse } from 'next/server'
+import { migrateBodiesToBucket } from '@/lib/mailbox'
+
+export const runtime = 'nodejs'
+export const maxDuration = 300
+
+/**
+ * Maintenance is driven by a script rather than a browser, so it carries its own token —
+ * separate from the session secret, which cannot be rotated without signing everybody out.
+ */
+function authorised(req: Request): boolean {
+  const secret = process.env.MAINTENANCE_TOKEN
+  if (!secret) return false
+  const token = (req.headers.get('authorization') ?? '').replace(/^Bearer\s+/i, '')
+  if (token.length !== secret.length) return false
+  try {
+    return timingSafeEqual(Buffer.from(token), Buffer.from(secret))
+  } catch {
+    return false
+  }
+}
+
+export async function POST(req: Request) {
+  if (!authorised(req)) return NextResponse.json({ ok: false, error: 'Unauthorised' }, { status: 403 })
+  const url = new URL(req.url)
+  const limit = Math.min(Number(url.searchParams.get('limit') ?? 40) || 40, 200)
+  const result = await migrateBodiesToBucket(limit, url.searchParams.get('count') === '1')
+  return NextResponse.json({ ok: true, ...result })
+}

package/app/api/mail/maintenance/list-columns/route.ts

@@ -0,0 +1,25 @@
+import { timingSafeEqual } from 'node:crypto'
+import { NextResponse } from 'next/server'
+import { backfillListColumns } from '@/lib/mailbox'
+
+export const runtime = 'nodejs'
+export const maxDuration = 300
+
+function authorised(req: Request): boolean {
+  const secret = process.env.MAINTENANCE_TOKEN
+  if (!secret) return false
+  const token = (req.headers.get('authorization') ?? '').replace(/^Bearer\s+/i, '')
+  if (token.length !== secret.length) return false
+  try {
+    return timingSafeEqual(Buffer.from(token), Buffer.from(secret))
+  } catch {
+    return false
+  }
+}
+
+export async function POST(req: Request) {
+  if (!authorised(req)) return NextResponse.json({ ok: false, error: 'Unauthorised' }, { status: 403 })
+  const limit = Math.min(Number(new URL(req.url).searchParams.get('limit') ?? 500) || 500, 2000)
+  const result = await backfillListColumns(limit)
+  return NextResponse.json({ ok: true, ...result })
+}

package/app/api/mail/maintenance/threads/route.ts

@@ -0,0 +1,32 @@
+import { timingSafeEqual } from 'node:crypto'
+import { NextResponse } from 'next/server'
+import { assignThreads, refreshThreadsFrom } from '@/lib/mailbox'
+
+export const runtime = 'nodejs'
+export const maxDuration = 300
+
+function authorised(req: Request): boolean {
+  const secret = process.env.MAINTENANCE_TOKEN
+  if (!secret) return false
+  const token = (req.headers.get('authorization') ?? '').replace(/^Bearer\s+/i, '')
+  if (token.length !== secret.length) return false
+  try {
+    return timingSafeEqual(Buffer.from(token), Buffer.from(secret))
+  } catch {
+    return false
+  }
+}
+
+export async function POST(req: Request) {
+  if (!authorised(req)) return NextResponse.json({ ok: false, error: 'Unauthorised' }, { status: 403 })
+  const url = new URL(req.url)
+  const limit = Math.min(Number(url.searchParams.get('limit') ?? 300) || 300, 1000)
+  if (url.searchParams.get('phase') === 'refresh') {
+    const owner = url.searchParams.get('afterOwner')
+    const threadId = url.searchParams.get('afterThread')
+    const result = await refreshThreadsFrom(owner && threadId ? { owner, threadId } : null, limit)
+    return NextResponse.json({ ok: true, ...result })
+  }
+  const result = await assignThreads(limit)
+  return NextResponse.json({ ok: true, ...result })
+}

package/app/api/mail/me/route.ts

@@ -0,0 +1,13 @@
+import { NextResponse } from 'next/server'
+import { mailAuthGuard, resolveAccount } from '@/lib/dev-auth'
+import { usingDefaultPassword } from '@/lib/mailbox'
+
+export const runtime = 'nodejs'
+
+export async function GET(req: Request) {
+  const guard = await mailAuthGuard(req)
+  if (guard) return guard
+  const account = await resolveAccount(req)
+  const defaultPassword = account.email ? await usingDefaultPassword(account.email) : false
+  return NextResponse.json({ ok: true, ...account, defaultPassword })
+}

package/app/api/mail/outgoing-upload/route.ts

@@ -0,0 +1,37 @@
+import { randomBytes } from 'node:crypto'
+import { NextResponse } from 'next/server'
+import { mailAuthGuard, resolveAccount } from '@/lib/dev-auth'
+import { presign } from '@/lib/r2'
+
+export const runtime = 'nodejs'
+
+const MAX_BYTES = 2 * 1024 * 1024 * 1024
+
+/**
+ * Hands back a presigned PUT so the browser uploads straight to the bucket. The bytes
+ * never pass through a serverless function, which has a request-body ceiling far below
+ * what people attach, and the URL is short-lived so it is not a standing grant.
+ */
+export async function POST(req: Request) {
+  const guard = await mailAuthGuard(req)
+  if (guard) return guard
+  const account = await resolveAccount(req)
+  if (!account.email) return NextResponse.json({ ok: false, error: 'Not signed in.' }, { status: 401 })
+
+  let body: { filename?: string; size?: number; contentType?: string }
+  try {
+    body = await req.json()
+  } catch {
+    return NextResponse.json({ ok: false, error: 'Invalid JSON' }, { status: 400 })
+  }
+
+  const filename = (body.filename ?? '').trim()
+  if (!filename) return NextResponse.json({ ok: false, error: 'A filename is required.' }, { status: 400 })
+  if ((body.size ?? 0) > MAX_BYTES) {
+    return NextResponse.json({ ok: false, error: 'That file is larger than 2GB.' }, { status: 413 })
+  }
+
+  const safe = filename.replace(/[^\w.\- ]+/g, '_').slice(0, 120)
+  const key = `outgoing/${randomBytes(9).toString('hex')}/${safe}`
+  return NextResponse.json({ ok: true, key, uploadUrl: presign(key, 'PUT', 3600) })
+}

package/app/api/mail/password/route.ts

@@ -0,0 +1,64 @@
+import { NextResponse } from 'next/server'
+import { mailAuthGuard, resolveAccount, verifyMailAuth } from '@/lib/dev-auth'
+import { clearResetTokens, setAccountPassword } from '@/lib/mailbox'
+import { hashPassword, passwordProblem } from '@/lib/password'
+import { clientKey, rateLimit } from '@/lib/rate-limit'
+import { attachSession, issueSession, passwordFingerprint } from '@/lib/session'
+
+export const runtime = 'nodejs'
+
+export async function POST(req: Request) {
+  const guard = await mailAuthGuard(req)
+  if (guard) return guard
+
+  // This endpoint verifies the current password, so it is a guessing oracle too.
+  const limited = rateLimit(clientKey(req, 'password'), 10, 15 * 60 * 1000)
+  if (limited) return limited
+
+  let body: { current?: string; next?: string }
+  try {
+    body = await req.json()
+  } catch {
+    return NextResponse.json({ ok: false, error: 'Invalid request.' }, { status: 400 })
+  }
+
+  const current = String(body.current ?? '')
+  const next = String(body.next ?? '')
+
+  if (next === current) {
+    return NextResponse.json(
+      { ok: false, error: 'That is the password you are already using.' },
+      { status: 400 },
+    )
+  }
+
+  const account = await resolveAccount(req)
+  if (!account.email) {
+    return NextResponse.json({ ok: false, error: 'Not signed in.' }, { status: 401 })
+  }
+
+  const problem = passwordProblem(next, account.email)
+  if (problem) {
+    return NextResponse.json({ ok: false, error: problem }, { status: 400 })
+  }
+
+  // Re-check the current password rather than trusting the session header, so a
+  // borrowed unlocked screen cannot be used to take the account over.
+  const confirmed = await verifyMailAuth(account.email, current)
+  if (!confirmed.ok) {
+    return NextResponse.json(
+      { ok: false, error: 'That is not your current password.' },
+      { status: 403 },
+    )
+  }
+
+  const passwordHash = await hashPassword(next)
+  await setAccountPassword(account.email, passwordHash)
+  // Any reset link that was already in flight is now a way back in for whoever asked for it.
+  await clearResetTokens(account.email).catch(() => {})
+
+  // Every other signed-in device fails its fingerprint check from here on; this response
+  // carries the replacement so the person who made the change stays signed in.
+  const session = issueSession(account.email, passwordFingerprint(passwordHash))
+  return attachSession(NextResponse.json({ ok: true }), session)
+}

package/app/api/mail/pixel/[id]/route.ts

@@ -0,0 +1,20 @@
+import { markPixelOpened } from '@/lib/mailbox'
+
+export const runtime = 'nodejs'
+export const dynamic = 'force-dynamic'
+
+const PIXEL = Buffer.from('R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7', 'base64')
+
+export async function GET(_req: Request, { params }: { params: Promise<{ id: string }> }) {
+  const { id } = await params
+  if (id) await markPixelOpened(id).catch(() => {})
+  return new Response(PIXEL, {
+    headers: {
+      'Content-Type': 'image/gif',
+      'Content-Length': String(PIXEL.length),
+      'Cache-Control': 'no-store, no-cache, must-revalidate, proxy-revalidate',
+      Pragma: 'no-cache',
+      Expires: '0',
+    },
+  })
+}

package/app/api/mail/push/route.ts

@@ -0,0 +1,42 @@
+import { NextResponse } from 'next/server'
+import { mailAuthGuard, resolveAccount } from '@/lib/dev-auth'
+import { deletePushSubscription, savePushSubscription, type PushSubscriptionRow } from '@/lib/mailbox'
+
+export const runtime = 'nodejs'
+
+export async function GET(req: Request) {
+  const guard = await mailAuthGuard(req)
+  if (guard) return guard
+  return NextResponse.json({ ok: true, publicKey: process.env.VAPID_PUBLIC_KEY ?? null })
+}
+
+export async function POST(req: Request) {
+  const guard = await mailAuthGuard(req)
+  if (guard) return guard
+  const account = await resolveAccount(req)
+  const owner = account.address ?? account.email
+  if (!owner) return NextResponse.json({ ok: false, error: 'Not signed in.' }, { status: 401 })
+
+  let body: Partial<PushSubscriptionRow>
+  try {
+    body = await req.json()
+  } catch {
+    return NextResponse.json({ ok: false, error: 'Invalid JSON' }, { status: 400 })
+  }
+  const endpoint = typeof body.endpoint === 'string' ? body.endpoint : ''
+  const p256dh = typeof body.keys?.p256dh === 'string' ? body.keys.p256dh : ''
+  const auth = typeof body.keys?.auth === 'string' ? body.keys.auth : ''
+  if (!/^https:\/\//.test(endpoint) || !p256dh || !auth) {
+    return NextResponse.json({ ok: false, error: 'That is not a push subscription.' }, { status: 400 })
+  }
+  await savePushSubscription(owner, { endpoint, keys: { p256dh, auth } })
+  return NextResponse.json({ ok: true })
+}
+
+export async function DELETE(req: Request) {
+  const guard = await mailAuthGuard(req)
+  if (guard) return guard
+  const endpoint = new URL(req.url).searchParams.get('endpoint') ?? ''
+  if (endpoint) await deletePushSubscription(endpoint)
+  return NextResponse.json({ ok: true })
+}

package/app/api/mail/render-template/route.ts

@@ -0,0 +1,58 @@
+import { NextResponse } from 'next/server'
+import {
+  academyFollowupSubject,
+  contactFollowupSubject,
+  renderAcademyFollowupEmail,
+  renderContactFollowupEmail,
+} from '@/lib/emails'
+import { mailAuthGuard } from '@/lib/dev-auth'
+
+export const runtime = 'nodejs'
+
+type Body = {
+  template?: 'academy' | 'contact'
+  firstName?: string
+  courses?: string
+  cohortDate?: string
+  projectType?: string
+  includeAcademy?: boolean
+}
+
+export async function POST(req: Request) {
+  const guard = await mailAuthGuard(req)
+  if (guard) return guard
+
+  let body: Body
+  try {
+    body = await req.json()
+  } catch {
+    return NextResponse.json({ ok: false, error: 'Invalid JSON' }, { status: 400 })
+  }
+
+  const firstName = (body.firstName ?? '').trim() || 'there'
+
+  if (body.template === 'academy') {
+    const courses = (body.courses ?? '').trim()
+    const cohortDate = (body.cohortDate ?? '').trim()
+    if (!courses || !cohortDate) {
+      return NextResponse.json({ ok: false, error: 'Pick at least one course and a cohort date' }, { status: 400 })
+    }
+    const html = renderAcademyFollowupEmail({ firstName, courses, cohortDate })
+    return NextResponse.json({ ok: true, subject: academyFollowupSubject(courses), html })
+  }
+
+  if (body.template === 'contact') {
+    const projectType = (body.projectType ?? '').trim()
+    if (!projectType) {
+      return NextResponse.json({ ok: false, error: 'Set a project type' }, { status: 400 })
+    }
+    const html = renderContactFollowupEmail({
+      firstName,
+      projectType,
+      includeAcademy: body.includeAcademy ? 'true' : 'false',
+    })
+    return NextResponse.json({ ok: true, subject: contactFollowupSubject(projectType), html })
+  }
+
+  return NextResponse.json({ ok: false, error: 'Unknown template' }, { status: 400 })
+}

package/app/api/mail/request-reset/route.ts

@@ -0,0 +1,65 @@
+import { BRAND } from '@/lib/brand'
+import { randomBytes } from 'node:crypto'
+import { NextResponse } from 'next/server'
+import { Resend } from 'resend'
+import { isMailAccount } from '@/lib/dev-auth'
+import { createResetToken, recordSentMeta } from '@/lib/mailbox'
+import { publicOrigin } from '@/lib/public-url'
+import { clientKey, rateLimit } from '@/lib/rate-limit'
+
+export const runtime = 'nodejs'
+
+const RESET_TTL_MS = 30 * 60 * 1000
+
+export async function POST(req: Request) {
+  const limited = rateLimit(clientKey(req, 'request-reset'), 5, 60 * 60 * 1000)
+  if (limited) return limited
+
+  let body: { email?: string }
+  try {
+    body = await req.json()
+  } catch {
+    return NextResponse.json({ ok: false, error: 'Invalid JSON' }, { status: 400 })
+  }
+
+  const email = (body.email ?? '').trim().toLowerCase()
+
+  // Also capped per address, so a rotating-IP caller cannot bury someone in reset mail.
+  const perAddress = rateLimit(`request-reset-address:${email}`, 5, 60 * 60 * 1000)
+  if (perAddress) return NextResponse.json({ ok: true })
+  // Always answer ok so we never reveal which addresses are valid accounts.
+  if (!(await isMailAccount(email))) {
+    return NextResponse.json({ ok: true })
+  }
+
+  const token = randomBytes(32).toString('hex')
+  await createResetToken(email, token, Date.now() + RESET_TTL_MS)
+
+  const apiKey = process.env.RESEND_API_KEY
+  if (apiKey) {
+    const from = (process.env.MAIL_FROM ?? process.env.RESEND_FROM ?? BRAND.supportEmail)
+      .replace(/^.*<|>$/g, '')
+      .trim()
+    const resetUrl = `${publicOrigin(req)}/mail/reset?token=${token}`
+    const resend = new Resend(apiKey)
+    try {
+      const { data } = await resend.emails.send({
+        from: `${BRAND.name} Mail <${from}>`,
+        to: [email],
+        subject: `Reset your ${BRAND.name} Mail password`,
+        text: `Someone requested a password reset for ${BRAND.name} Mail.\n\nSet a new password: ${resetUrl}\n\nThis link expires in 30 minutes. If you didn't request it, ignore this email — your password won't change.`,
+        html: `<div style="font-family:Arial,Helvetica,sans-serif;font-size:15px;line-height:1.6;color:#1A1030;">
+          <p style="margin:0 0 12px;color:${BRAND.colors.accent};font-weight:600;">Reset your ${BRAND.name} Mail password</p>
+          <p style="margin:0 0 16px;">Click below to set a new password. The link expires in 30 minutes.</p>
+          <a href="${resetUrl}" style="display:inline-block;background:${BRAND.colors.accent};color:#fff;text-decoration:none;font-weight:600;padding:11px 20px;border-radius:8px;">Set a new password</a>
+          <p style="margin:16px 0 0;color:#8E84A8;font-size:13px;">Didn't request this? Ignore this email — your password won't change.</p>
+        </div>`,
+      })
+      if (data?.id) await recordSentMeta(data.id, null, true).catch(() => {})
+    } catch (err) {
+      console.warn('[mail] reset email failed:', err)
+    }
+  }
+
+  return NextResponse.json({ ok: true })
+}

package/app/api/mail/reset/route.ts

@@ -0,0 +1,46 @@
+import { NextResponse } from 'next/server'
+import { hashPassword, passwordProblem } from '@/lib/password'
+import { resetPasswordWithToken, resetTokenEmail } from '@/lib/mailbox'
+import { clientKey, rateLimit } from '@/lib/rate-limit'
+import { attachSession, issueSession, passwordFingerprint } from '@/lib/session'
+
+export const runtime = 'nodejs'
+
+export async function POST(req: Request) {
+  // A reset token is a bearer credential, so guessing one needs a ceiling like login has.
+  const limited = rateLimit(clientKey(req, 'reset'), 10, 15 * 60 * 1000)
+  if (limited) return limited
+
+  let body: { token?: string; password?: string }
+  try {
+    body = await req.json()
+  } catch {
+    return NextResponse.json({ ok: false, error: 'Invalid JSON' }, { status: 400 })
+  }
+
+  const token = (body.token ?? '').trim()
+  const password = body.password ?? ''
+  if (!token) {
+    return NextResponse.json({ ok: false, error: 'Missing reset token' }, { status: 400 })
+  }
+
+  // Resolved before the token is spent so a rejected password does not burn the link.
+  const owner = await resetTokenEmail(token)
+  if (!owner) {
+    return NextResponse.json({ ok: false, error: 'This reset link is invalid or has expired' }, { status: 400 })
+  }
+
+  const problem = passwordProblem(password, owner)
+  if (problem) {
+    return NextResponse.json({ ok: false, error: problem }, { status: 400 })
+  }
+
+  const passwordHash = await hashPassword(password)
+  const email = await resetPasswordWithToken(token, passwordHash)
+  if (!email) {
+    return NextResponse.json({ ok: false, error: 'This reset link is invalid or has expired' }, { status: 400 })
+  }
+
+  const session = issueSession(email, passwordFingerprint(passwordHash))
+  return attachSession(NextResponse.json({ ok: true, email }), session)
+}

package/app/api/mail/send/route.ts

@@ -0,0 +1,205 @@
+import { BRAND } from '@/lib/brand'
+import { randomUUID } from 'node:crypto'
+import { NextResponse } from 'next/server'
+import { sendMail } from '@/lib/mail-provider'
+import { mailAuthGuard, resolveAccount } from '@/lib/dev-auth'
+import { presign } from '@/lib/r2'
+import { recordContact, recordPixel, recordSentMeta, recordSentMessage } from '@/lib/mailbox'
+import { publicOrigin } from '@/lib/public-url'
+
+export const runtime = 'nodejs'
+
+type SendBody = {
+  to?: string[]
+  cc?: string[]
+  bcc?: string[]
+  replyTo?: string
+  fromName?: string
+  subject?: string
+  html?: string
+  text?: string
+  scheduledAt?: string
+  inReplyTo?: string
+  /** Admin only: the mailbox to send on behalf of. */
+  actAs?: string
+  attachments?: Array<{ filename: string; content?: string; path?: string; key?: string }>
+}
+
+export async function POST(req: Request) {
+  const guard = await mailAuthGuard(req)
+  if (guard) return guard
+
+  const account = await resolveAccount(req)
+
+  const apiKey = process.env.RESEND_API_KEY
+  if (!apiKey) {
+    return NextResponse.json({ ok: false, error: 'RESEND_API_KEY not configured' }, { status: 500 })
+  }
+
+  let body: SendBody
+  try {
+    body = await req.json()
+  } catch {
+    return NextResponse.json({ ok: false, error: 'Invalid JSON' }, { status: 400 })
+  }
+
+  const recipients = (body.to ?? []).filter(Boolean)
+
+  // Send from the accessor's personal address so replies route back to their mailbox.
+  //
+  // Mail goes out as the account that is signed in. Sending as somebody else went with
+  // browsing their mailbox, which no longer happens; the claim is refused here rather
+  // than trusted, because the client can ask to send as anyone.
+  const actingAddress: string | null = null
+  const requestedActAs = body.actAs?.trim().toLowerCase()
+  if (requestedActAs && requestedActAs !== account.address?.toLowerCase()) {
+    return NextResponse.json(
+      { ok: false, error: 'You can only send from your own address.' },
+      { status: 403 },
+    )
+  }
+
+  const fromAddress =
+    actingAddress ?? account.address ?? process.env.MAIL_FROM ?? process.env.RESEND_FROM ?? BRAND.supportEmail
+
+  // Sending to your own address loops the message back through the inbound
+  // webhook and lands it in the mailbox it came from, which reads as a delivery
+  // failure to the person who sent it. Refuse it outright.
+  //
+  // Checked against the address actually being sent from, not account.address: an
+  // accessor with no address of their own still sends as the shared inbox, and
+  // that send would loop just the same.
+  const senderAddress = fromAddress.replace(/^.*<|>$/g, '').trim().toLowerCase()
+  if (senderAddress) {
+    const everyRecipient = [...recipients, ...(body.cc ?? []), ...(body.bcc ?? [])]
+      .map(entry => String(entry).replace(/^.*<|>$/g, '').trim().toLowerCase())
+    if (everyRecipient.includes(senderAddress)) {
+      return NextResponse.json(
+        { ok: false, error: 'You cannot send a message to your own address.' },
+        { status: 400 },
+      )
+    }
+  }
+
+  if (!recipients.length) {
+    return NextResponse.json({ ok: false, error: 'At least one recipient is required' }, { status: 400 })
+  }
+  if (!body.subject?.trim()) {
+    return NextResponse.json({ ok: false, error: 'Subject is required' }, { status: 400 })
+  }
+  if (!body.html?.trim() && !body.text?.trim()) {
+    return NextResponse.json({ ok: false, error: 'Email body is required' }, { status: 400 })
+  }
+
+  const rawAttachments = (body.attachments ?? []).filter(entry => entry.filename && (entry.content || entry.path || entry.key))
+  if (rawAttachments.length && body.scheduledAt) {
+    // Resend rejects attachments on scheduled sends — surface it before the API does.
+    return NextResponse.json(
+      { ok: false, error: 'Resend does not support attachments on scheduled emails — send now or drop the attachments' },
+      { status: 400 },
+    )
+  }
+
+  // Embed each attachment as base64 content. Resend fetches `path` URLs unreliably,
+  // so we pull the blob server-side (no browser body limit) and hand Resend the bytes.
+  let attachments: Array<{ filename: string; content: string }>
+  try {
+    attachments = await Promise.all(
+      rawAttachments.map(async entry => {
+        if (entry.content) return { filename: entry.filename, content: entry.content }
+
+        // Attachments live in the bucket; the key is signed here rather than trusting a
+        // URL from the client, so a caller cannot point this at somewhere it should not read.
+        let source: URL
+        if (entry.key) {
+          if (!/^outgoing\/[a-f0-9]{18}\/[\w.\- ]{1,120}$/.test(entry.key)) {
+            throw new Error(`Unsupported attachment source for ${entry.filename}`)
+          }
+          source = new URL(presign(entry.key, 'GET', 300))
+        } else {
+          source = new URL(entry.path!)
+          if (source.protocol !== 'https:' || !source.hostname.endsWith('.public.blob.vercel-storage.com')) {
+            throw new Error(`Unsupported attachment source for ${entry.filename}`)
+          }
+        }
+        const response = await fetch(source)
+        if (!response.ok) throw new Error(`Could not fetch attachment ${entry.filename}`)
+        const buffer = Buffer.from(await response.arrayBuffer())
+        return { filename: entry.filename, content: buffer.toString('base64') }
+      }),
+    )
+  } catch (fetchError) {
+    return NextResponse.json({ ok: false, error: (fetchError as Error).message }, { status: 502 })
+  }
+
+  const bareAddress = fromAddress.includes('<') ? fromAddress : `${BRAND.name} <${fromAddress}>`
+  const from = body.fromName?.trim()
+    ? `${body.fromName.trim().replace(/[<>"]/g, '')} <${bareAddress.replace(/^.*<|>$/g, '')}>`
+    : bareAddress
+  const replyTo = body.replyTo?.trim() || account.address || undefined
+
+  // Open-tracking pixel: a 1x1 image whose load hits our endpoint, so we can tell
+  // an HTML email was opened independently of Resend's own tracking.
+  const origin = publicOrigin(req)
+  const pixelId = randomUUID()
+  const trackedHtml = body.html?.trim()
+    ? `${body.html.trim()}<img src="${origin}/api/mail/pixel/${pixelId}" alt="" width="1" height="1" style="display:none;width:1px;height:1px;border:0" />`
+    : null
+
+  // Thread the reply: In-Reply-To/References point at the inbound Message-ID so the
+  // recipient's client threads it, and so future replies chain back to this conversation.
+  const inReplyToId = body.inReplyTo?.trim()
+    ? `<${body.inReplyTo.trim().replace(/[<>]/g, '')}>`
+    : null
+
+  const fromEmail = from.replace(/^.*<|>$/g, '').trim()
+  const fromName = from.includes('<') ? from.slice(0, from.indexOf('<')).replace(/["']/g, '').trim() : undefined
+
+  let data: { id: string | null }
+  try {
+    data = await sendMail({
+      from: fromEmail,
+      fromName: fromName || undefined,
+      to: recipients,
+      cc: body.cc,
+      bcc: body.bcc,
+      replyTo,
+      subject: body.subject.trim(),
+      html: trackedHtml,
+      text: body.text,
+      scheduledAt: body.scheduledAt,
+      attachments,
+      ...(inReplyToId ? { headers: { 'In-Reply-To': inReplyToId, References: inReplyToId } } : {}),
+    })
+  } catch (sendError) {
+    return NextResponse.json({ ok: false, error: (sendError as Error).message }, { status: 502 })
+  }
+
+  await Promise.all([
+    ...[...recipients, ...(body.cc ?? []), ...(body.bcc ?? [])].map(address => recordContact(address, null).catch(() => {})),
+    trackedHtml && data?.id
+      ? recordPixel(pixelId, data.id, recipients[0] ?? '', body.subject.trim()).catch(() => {})
+      : Promise.resolve(),
+    data?.id ? recordSentMeta(data.id, account.address, false, body.inReplyTo ?? null).catch(() => {}) : Promise.resolve(),
+    data?.id
+      ? recordSentMessage({
+          id: data.id,
+          from,
+          to: recipients,
+          cc: body.cc ?? [],
+          bcc: body.bcc ?? [],
+          replyTo: replyTo ? [replyTo] : [],
+          subject: body.subject!.trim(),
+          html: trackedHtml,
+          text: body.text ?? null,
+          createdAt: new Date().toISOString(),
+          // Recorded so the Sent folder and a forward read our own bucket rather than
+          // the provider's, which keeps these only as long as it chooses to.
+          attachments: rawAttachments
+            .filter(entry => entry.key)
+            .map(entry => ({ filename: entry.filename, key: entry.key })),
+        }).catch(() => {})
+      : Promise.resolve(),
+  ])
+  return NextResponse.json({ ok: true, id: data?.id, scheduledAt: body.scheduledAt ?? null })
+}