@novacraft-engineering/mailbox 0.1.0

package/app/api/mail/settings/route.ts

@@ -0,0 +1,35 @@
+import { NextResponse } from 'next/server'
+import { mailAuthGuard, resolveAccount } from '@/lib/dev-auth'
+import { getSettings, setSettings } from '@/lib/mailbox'
+
+export const runtime = 'nodejs'
+
+/**
+ * The authenticated identity, not the x-dev-email header: once a session cookie can carry
+ * the credential, the header is just a caller-supplied string and would let one signed-in
+ * accessor read and overwrite another's settings.
+ */
+async function ownerOf(req: Request): Promise<string> {
+  const account = await resolveAccount(req)
+  return account.email || 'local@dev'
+}
+
+export async function GET(req: Request) {
+  const guard = await mailAuthGuard(req)
+  if (guard) return guard
+  const settings = await getSettings(await ownerOf(req))
+  return NextResponse.json({ ok: true, settings })
+}
+
+export async function PUT(req: Request) {
+  const guard = await mailAuthGuard(req)
+  if (guard) return guard
+  let body: Record<string, unknown>
+  try {
+    body = await req.json()
+  } catch {
+    return NextResponse.json({ ok: false, error: 'Invalid JSON' }, { status: 400 })
+  }
+  await setSettings(await ownerOf(req), body)
+  return NextResponse.json({ ok: true })
+}

package/app/api/mail/share/attachment/route.ts

@@ -0,0 +1,91 @@
+import { randomBytes } from 'node:crypto'
+import { NextResponse } from 'next/server'
+import { mailAuthGuard, resolveAccount } from '@/lib/dev-auth'
+import { createShare, getInboundSource } from '@/lib/mailbox'
+import { hashPassword } from '@/lib/password'
+import { presign } from '@/lib/r2'
+
+export const runtime = 'nodejs'
+export const dynamic = 'force-dynamic'
+
+/**
+ * Only our own stored copies are ever copied out. The client names a message and a
+ * filename; the URL comes from the row, never from the request.
+ */
+const OWN_BLOB_HOST = /\.public\.blob\.vercel-storage\.com$/
+
+export async function POST(req: Request) {
+  const guard = await mailAuthGuard(req)
+  if (guard) return guard
+  const account = await resolveAccount(req)
+  if (!account.email) return NextResponse.json({ ok: false, error: 'Not signed in.' }, { status: 401 })
+
+  let body: { messageId?: string; filename?: string; password?: string; expiresInDays?: number; maxDownloads?: number }
+  try {
+    body = await req.json()
+  } catch {
+    return NextResponse.json({ ok: false, error: 'Invalid request.' }, { status: 400 })
+  }
+
+  const messageId = String(body.messageId ?? '')
+  const filename = String(body.filename ?? '')
+  if (!messageId || !filename) return NextResponse.json({ ok: false, error: 'Which attachment?' }, { status: 400 })
+
+  const source = await getInboundSource(messageId)
+  if (!source) return NextResponse.json({ ok: false, error: 'That message is not here.' }, { status: 404 })
+  const address = (account.address ?? '').toLowerCase()
+  const mine = Boolean(source.owner && address && source.owner.toLowerCase() === address)
+  // Sharing publishes a file to anyone with the link, so it is limited to the mailbox
+  // that received it — administering accounts does not extend to another person's files.
+  if (!mine) {
+    return NextResponse.json({ ok: false, error: 'That message is not yours to share.' }, { status: 403 })
+  }
+
+  const entry = source.attachments.find(item => String(item.filename ?? '') === filename && typeof item.url === 'string')
+  let origin: URL | null = null
+  try {
+    origin = entry ? new URL(String(entry.url)) : null
+  } catch {
+    origin = null
+  }
+  if (!entry || !origin || !OWN_BLOB_HOST.test(origin.hostname)) {
+    return NextResponse.json({ ok: false, error: 'That attachment has no stored copy to share.' }, { status: 404 })
+  }
+
+  const upstream = await fetch(origin.toString())
+  if (!upstream.ok) return NextResponse.json({ ok: false, error: 'The stored copy could not be read.' }, { status: 502 })
+  const bytes = Buffer.from(await upstream.arrayBuffer())
+  const contentType = String(entry.contentType ?? upstream.headers.get('content-type') ?? 'application/octet-stream')
+
+  const id = randomBytes(9).toString('base64url')
+  const safe = filename.replace(/[^\w.\- ]+/g, '_').slice(-120)
+  const objectKey = `shares/${randomBytes(16).toString('hex')}/${safe}`
+
+  const put = await fetch(presign(objectKey, 'PUT', 300), {
+    method: 'PUT',
+    body: bytes,
+    headers: { 'content-type': contentType },
+  })
+  if (!put.ok) {
+    return NextResponse.json({ ok: false, error: 'Could not copy the file into share storage.' }, { status: 502 })
+  }
+
+  const expiresAt =
+    body.expiresInDays && body.expiresInDays > 0
+      ? new Date(Date.now() + body.expiresInDays * 86400_000).toISOString()
+      : null
+  await createShare({
+    id,
+    objectKey,
+    filename,
+    contentType,
+    size: bytes.length,
+    passwordHash: body.password ? await hashPassword(body.password) : null,
+    owner: account.email,
+    expiresAt,
+    maxDownloads: body.maxDownloads && body.maxDownloads > 0 ? body.maxDownloads : null,
+  })
+
+  const base = process.env.MAIL_PUBLIC_URL?.replace(/\/$/, '') || new URL(req.url).origin
+  return NextResponse.json({ ok: true, id, url: `${base}/share/${id}`, expiresAt })
+}

package/app/api/mail/share/route.ts

@@ -0,0 +1,130 @@
+import { randomBytes } from 'node:crypto'
+import { NextResponse } from 'next/server'
+import { mailAuthGuard, resolveAccount } from '@/lib/dev-auth'
+import { createShare, getShare, listShares, revokeShare, setSharePassword } from '@/lib/mailbox'
+import { hashPassword } from '@/lib/password'
+import { deleteObject, presign } from '@/lib/r2'
+
+export const runtime = 'nodejs'
+export const dynamic = 'force-dynamic'
+
+/** Large enough for video, small enough that a mistake is not a bill. */
+const MAX_SHARE_BYTES = 2 * 1024 * 1024 * 1024
+
+/** Keeps the stored key opaque, so the object name leaks nothing about the sender. */
+function objectKeyFor(filename: string): string {
+  const safe = filename.replace(/[^\w.\- ]+/g, '_').slice(-120)
+  return `shares/${randomBytes(16).toString('hex')}/${safe}`
+}
+
+export async function GET(req: Request) {
+  const guard = await mailAuthGuard(req)
+  if (guard) return guard
+  const account = await resolveAccount(req)
+  if (!account.email) return NextResponse.json({ ok: false, error: 'Not signed in.' }, { status: 401 })
+  return NextResponse.json({ ok: true, shares: await listShares(account.email) })
+}
+
+/**
+ * Registers a file and hands back a URL the browser can PUT straight to. The bytes
+ * never pass through this server, so there is no request-body ceiling and a two
+ * gigabyte upload costs us nothing but the signature.
+ */
+export async function POST(req: Request) {
+  const guard = await mailAuthGuard(req)
+  if (guard) return guard
+  const account = await resolveAccount(req)
+  if (!account.email) return NextResponse.json({ ok: false, error: 'Not signed in.' }, { status: 401 })
+
+  let body: {
+    filename?: string
+    contentType?: string
+    size?: number
+    password?: string
+    expiresInDays?: number
+    maxDownloads?: number
+  }
+  try {
+    body = await req.json()
+  } catch {
+    return NextResponse.json({ ok: false, error: 'Invalid request.' }, { status: 400 })
+  }
+
+  const filename = String(body.filename ?? '').trim()
+  const size = Number(body.size ?? 0)
+  if (!filename) return NextResponse.json({ ok: false, error: 'A filename is required.' }, { status: 400 })
+  if (!Number.isFinite(size) || size <= 0) {
+    return NextResponse.json({ ok: false, error: 'A file size is required.' }, { status: 400 })
+  }
+  if (size > MAX_SHARE_BYTES) {
+    return NextResponse.json({ ok: false, error: 'That file is larger than 2GB.' }, { status: 413 })
+  }
+
+  const id = randomBytes(9).toString('base64url')
+  const objectKey = objectKeyFor(filename)
+  const expiresAt =
+    body.expiresInDays && body.expiresInDays > 0
+      ? new Date(Date.now() + body.expiresInDays * 86400_000).toISOString()
+      : null
+
+  try {
+    await createShare({
+      id,
+      objectKey,
+      filename,
+      contentType: body.contentType ?? null,
+      size,
+      passwordHash: body.password ? await hashPassword(body.password) : null,
+      owner: account.email,
+      expiresAt,
+      maxDownloads: body.maxDownloads && body.maxDownloads > 0 ? body.maxDownloads : null,
+    })
+    // An hour is plenty for the upload itself and short enough that a leaked URL
+    // is not a standing grant.
+    const uploadUrl = presign(objectKey, 'PUT', 3600)
+    return NextResponse.json({ ok: true, id, uploadUrl, objectKey })
+  } catch (err) {
+    return NextResponse.json(
+      { ok: false, error: err instanceof Error ? err.message : 'Could not prepare the upload.' },
+      { status: 500 },
+    )
+  }
+}
+
+/** Sets or clears the password on a share the caller owns. */
+export async function PATCH(req: Request) {
+  const guard = await mailAuthGuard(req)
+  if (guard) return guard
+  const account = await resolveAccount(req)
+  if (!account.email) return NextResponse.json({ ok: false, error: 'Not signed in.' }, { status: 401 })
+
+  let body: { id?: string; password?: string }
+  try {
+    body = await req.json()
+  } catch {
+    return NextResponse.json({ ok: false, error: 'Invalid request.' }, { status: 400 })
+  }
+
+  const id = String(body.id ?? '')
+  if (!id) return NextResponse.json({ ok: false, error: 'Which share?' }, { status: 400 })
+
+  const password = String(body.password ?? '').trim()
+  const updated = await setSharePassword(id, account.email, password ? await hashPassword(password) : null)
+  return NextResponse.json({ ok: updated }, { status: updated ? 200 : 404 })
+}
+
+export async function DELETE(req: Request) {
+  const guard = await mailAuthGuard(req)
+  if (guard) return guard
+  const account = await resolveAccount(req)
+  if (!account.email) return NextResponse.json({ ok: false, error: 'Not signed in.' }, { status: 401 })
+
+  const id = new URL(req.url).searchParams.get('id')
+  if (!id) return NextResponse.json({ ok: false, error: 'Which share?' }, { status: 400 })
+  // Flag first so the link dies even if storage is unreachable; then drop the bytes,
+  // because a revoked file that still sits in the bucket is not revoked.
+  const share = await getShare(id)
+  const revoked = await revokeShare(id, account.email)
+  if (revoked && share?.objectKey) await deleteObject(share.objectKey).catch(() => false)
+  return NextResponse.json({ ok: revoked }, { status: revoked ? 200 : 404 })
+}

package/app/api/mail/signature-logo/route.ts

@@ -0,0 +1,67 @@
+import { createHash } from 'node:crypto'
+import { NextResponse } from 'next/server'
+import { mailAuthGuard, resolveAccount } from '@/lib/dev-auth'
+import { presign } from '@/lib/r2'
+
+export const runtime = 'nodejs'
+
+const MAX_BYTES = 2 * 1024 * 1024
+const TYPES: Record<string, string> = {
+  'image/png': 'png',
+  'image/jpeg': 'jpg',
+  'image/gif': 'gif',
+  'image/webp': 'webp',
+  'image/svg+xml': 'svg',
+}
+
+/**
+ * A signature logo has to stay reachable for whoever opens the mail, months later, so it
+ * cannot be a presigned link that expires or an attachment. The bytes live in the bucket
+ * and this route streams them back under a stable, unauthenticated URL — the same one
+ * embedded in every message that carries the signature.
+ */
+export async function GET(req: Request) {
+  const key = new URL(req.url).searchParams.get('key')
+  if (!key || !/^signatures\/[A-Za-z0-9._-]+$/.test(key)) {
+    return NextResponse.json({ ok: false, error: 'Bad key' }, { status: 400 })
+  }
+  const upstream = await fetch(presign(key, 'GET', 300)).catch(() => null)
+  if (!upstream?.ok) return NextResponse.json({ ok: false, error: 'Not found' }, { status: 404 })
+  return new NextResponse(upstream.body, {
+    headers: {
+      'content-type': upstream.headers.get('content-type') ?? 'application/octet-stream',
+      'cache-control': 'public, max-age=31536000, immutable',
+    },
+  })
+}
+
+export async function POST(req: Request) {
+  const guard = await mailAuthGuard(req)
+  if (guard) return guard
+  const account = await resolveAccount(req)
+  if (!account.email) return NextResponse.json({ ok: false, error: 'Not signed in.' }, { status: 401 })
+
+  const contentType = (req.headers.get('content-type') ?? '').split(';')[0].trim()
+  const extension = TYPES[contentType]
+  if (!extension) {
+    return NextResponse.json({ ok: false, error: 'Use a PNG, JPEG, GIF, WebP or SVG image.' }, { status: 400 })
+  }
+
+  const bytes = Buffer.from(await req.arrayBuffer())
+  if (bytes.length === 0) return NextResponse.json({ ok: false, error: 'That file is empty.' }, { status: 400 })
+  if (bytes.length > MAX_BYTES) {
+    return NextResponse.json({ ok: false, error: 'Keep the logo under 2MB.' }, { status: 413 })
+  }
+
+  // Content-addressed, so re-uploading the same logo does not pile up copies.
+  const digest = createHash('sha256').update(bytes).digest('hex').slice(0, 24)
+  const key = `signatures/${digest}.${extension}`
+  const put = await fetch(presign(key, 'PUT', 300), {
+    method: 'PUT',
+    headers: { 'content-type': contentType },
+    body: bytes,
+  }).catch(() => null)
+  if (!put?.ok) return NextResponse.json({ ok: false, error: 'Could not store that image.' }, { status: 502 })
+
+  return NextResponse.json({ ok: true, url: `/api/mail/signature-logo?key=${encodeURIComponent(key)}` })
+}

package/app/api/mail/stash/route.ts

@@ -0,0 +1,55 @@
+import { NextResponse } from 'next/server'
+import { mailAuthGuard, resolveAccount } from '@/lib/dev-auth'
+import { deleteStash, readStash, upsertStash } from '@/lib/mailbox'
+
+export const runtime = 'nodejs'
+
+const KINDS = new Set(['draft', 'template'])
+
+/**
+ * The authenticated identity, not the x-dev-email header: once a session cookie can carry
+ * the credential, the header is just a caller-supplied string and would let one signed-in
+ * accessor read and overwrite another's drafts.
+ */
+async function ownerOf(req: Request): Promise<string> {
+  const account = await resolveAccount(req)
+  return account.email || 'local@dev'
+}
+
+export async function GET(req: Request) {
+  const guard = await mailAuthGuard(req)
+  if (guard) return guard
+  const kind = new URL(req.url).searchParams.get('kind') ?? ''
+  if (!KINDS.has(kind)) return NextResponse.json({ ok: false, error: 'Unknown kind' }, { status: 400 })
+  const items = await readStash(await ownerOf(req), kind)
+  return NextResponse.json({ ok: true, items })
+}
+
+export async function PUT(req: Request) {
+  const guard = await mailAuthGuard(req)
+  if (guard) return guard
+  let body: { kind?: string; id?: string; data?: unknown }
+  try {
+    body = await req.json()
+  } catch {
+    return NextResponse.json({ ok: false, error: 'Invalid JSON' }, { status: 400 })
+  }
+  if (!body.kind || !KINDS.has(body.kind) || !body.id) {
+    return NextResponse.json({ ok: false, error: 'kind and id are required' }, { status: 400 })
+  }
+  await upsertStash(await ownerOf(req), body.kind, body.id, body.data ?? null)
+  return NextResponse.json({ ok: true })
+}
+
+export async function DELETE(req: Request) {
+  const guard = await mailAuthGuard(req)
+  if (guard) return guard
+  const params = new URL(req.url).searchParams
+  const kind = params.get('kind') ?? ''
+  const id = params.get('id') ?? ''
+  if (!KINDS.has(kind) || !id) {
+    return NextResponse.json({ ok: false, error: 'kind and id are required' }, { status: 400 })
+  }
+  await deleteStash(await ownerOf(req), kind, id)
+  return NextResponse.json({ ok: true })
+}

package/app/api/mail/threads/route.ts

@@ -0,0 +1,18 @@
+import { NextResponse } from 'next/server'
+import { mailAuthGuard, resolveAccount } from '@/lib/dev-auth'
+import { listThreads, threadsLive, type ThreadFolder } from '@/lib/mailbox'
+
+export const runtime = 'nodejs'
+
+export async function GET(req: Request) {
+  const guard = await mailAuthGuard(req)
+  if (guard) return guard
+  if (!threadsLive()) return NextResponse.json({ ok: true, threads: [] })
+  const account = await resolveAccount(req)
+  const url = new URL(req.url)
+  const folderParam = url.searchParams.get('folder')
+  const folder: ThreadFolder = (['inbox', 'archive', 'trash', 'starred'] as const).find(f => f === folderParam) ?? 'inbox'
+  const limit = Math.min(Number(url.searchParams.get('limit') ?? 500) || 500, 1000)
+  const page = await listThreads(account.address ?? ' no-address', folder, limit, url.searchParams.get('cursor'))
+  return NextResponse.json({ ok: true, threads: page.rows, nextCursor: page.nextCursor })
+}

package/app/api/mail/upload/route.ts

@@ -0,0 +1,43 @@
+import { NextResponse } from 'next/server'
+import { handleUpload, type HandleUploadBody } from '@vercel/blob/client'
+import { authenticate, isLocalOrigin, verifyMailAuth } from '@/lib/dev-auth'
+
+export const runtime = 'nodejs'
+
+const MAX_UPLOAD_BYTES = 100 * 1024 * 1024
+
+export async function POST(req: Request): Promise<NextResponse> {
+  const body = (await req.json()) as HandleUploadBody
+
+  try {
+    const result = await handleUpload({
+      body,
+      request: req,
+      onBeforeGenerateToken: async (_pathname, clientPayload) => {
+        // The session cookie is the normal path; the credentials in clientPayload are only
+        // still read so a tab that signed in before sessions existed can finish its upload.
+        let authorized = isLocalOrigin(req) || Boolean(await authenticate(req))
+        if (!authorized && clientPayload) {
+          try {
+            const creds = JSON.parse(clientPayload) as { email?: string; password?: string }
+            authorized = (await verifyMailAuth(creds.email ?? '', creds.password ?? '')).ok
+          } catch {
+            authorized = false
+          }
+        }
+        if (!authorized) throw new Error('Unauthorized')
+        return {
+          addRandomSuffix: true,
+          maximumSizeInBytes: MAX_UPLOAD_BYTES,
+          tokenPayload: null,
+        }
+      },
+      onUploadCompleted: async () => {
+        // No-op: the URL is returned to the client, which attaches it on send.
+      },
+    })
+    return NextResponse.json(result)
+  } catch (error) {
+    return NextResponse.json({ error: (error as Error).message }, { status: 400 })
+  }
+}

package/app/api/share/[id]/route.ts

@@ -0,0 +1,85 @@
+import { NextResponse } from 'next/server'
+import { getShare, getSharePasswordHash, recordShareDownload } from '@/lib/mailbox'
+import { verifyPassword } from '@/lib/password'
+import { objectExists, presign } from '@/lib/r2'
+import { clientKey, rateLimit } from '@/lib/rate-limit'
+
+export const runtime = 'nodejs'
+export const dynamic = 'force-dynamic'
+
+/**
+ * Deliberately public: the recipient is not a mailbox holder. The share id is the
+ * capability, and the password (when set) is the second factor. Every refusal
+ * reads the same so the endpoint cannot be used to sort real ids from invented
+ * ones by their error message.
+ */
+const GONE = { ok: false as const, error: 'This link is no longer available.' }
+
+/** What the page needs to render before anyone types anything. */
+export async function GET(_req: Request, context: { params: Promise<{ id: string }> }) {
+  const { id } = await context.params
+  const share = await getShare(id)
+  if (!share || share.revoked) return NextResponse.json(GONE, { status: 404 })
+  if (share.expiresAt && new Date(share.expiresAt) < new Date()) {
+    return NextResponse.json(GONE, { status: 410 })
+  }
+  if (share.maxDownloads != null && share.downloads >= share.maxDownloads) {
+    return NextResponse.json(GONE, { status: 410 })
+  }
+  return NextResponse.json({
+    ok: true,
+    filename: share.filename,
+    size: share.size,
+    contentType: share.contentType,
+    needsPassword: share.hasPassword,
+    expiresAt: share.expiresAt,
+    downloadsLeft: share.maxDownloads == null ? null : share.maxDownloads - share.downloads,
+  })
+}
+
+/** Exchanges the password for a short-lived signed URL to the object itself. */
+export async function POST(req: Request, context: { params: Promise<{ id: string }> }) {
+  const { id } = await context.params
+
+  // The password is guessable one attempt at a time, so cap the attempts.
+  const limited = rateLimit(`${clientKey(req, 'share')}:${id}`, 10, 15 * 60 * 1000)
+  if (limited) return limited
+
+  const share = await getShare(id)
+  if (!share || share.revoked) return NextResponse.json(GONE, { status: 404 })
+  if (share.expiresAt && new Date(share.expiresAt) < new Date()) {
+    return NextResponse.json(GONE, { status: 410 })
+  }
+  if (share.maxDownloads != null && share.downloads >= share.maxDownloads) {
+    return NextResponse.json(GONE, { status: 410 })
+  }
+
+  if (share.hasPassword) {
+    let password = ''
+    try {
+      password = String(((await req.json()) as { password?: string }).password ?? '')
+    } catch {
+      // Leave it empty and fall through to the same refusal.
+    }
+    const hash = await getSharePasswordHash(id)
+    if (!hash || !(await verifyPassword(password, hash))) {
+      return NextResponse.json({ ok: false, error: 'That password is not right.' }, { status: 403 })
+    }
+  }
+
+  // Checked before the download is counted, so a missing object does not burn one of
+  // the recipient's allowed downloads.
+  if (!(await objectExists(share.objectKey))) {
+    return NextResponse.json(
+      { ok: false, error: 'This file is no longer stored. Ask whoever sent it to upload it again.' },
+      { status: 410 },
+    )
+  }
+
+  await recordShareDownload(id)
+  // Two minutes: long enough to start the download, too short to pass around.
+  const url = presign(share.objectKey, 'GET', 120, {
+    'response-content-disposition': `attachment; filename="${share.filename.replace(/"/g, '')}"`,
+  })
+  return NextResponse.json({ ok: true, url, filename: share.filename })
+}

package/app/brand/[file]/route.ts

@@ -0,0 +1,37 @@
+import { readFile } from 'node:fs/promises'
+import { extname, join } from 'node:path'
+import { NextResponse } from 'next/server'
+
+export const runtime = 'nodejs'
+
+const DIR = process.env.BRAND_ASSET_DIR ?? '/data/brand'
+
+const TYPES: Record<string, string> = {
+  '.png': 'image/png',
+  '.jpg': 'image/jpeg',
+  '.jpeg': 'image/jpeg',
+  '.gif': 'image/gif',
+  '.webp': 'image/webp',
+  '.svg': 'image/svg+xml',
+  '.ico': 'image/x-icon',
+}
+
+/**
+ * A tenant's own images, read from the volume rather than the repository, so the codebase
+ * carries no brand. Public by design: a recipient's mail client fetches the mark in a
+ * signature with no session, from wherever in the world they open the message.
+ */
+export async function GET(_request: Request, { params }: { params: Promise<{ file: string }> }) {
+  const { file } = await params
+  if (!/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(file)) return new NextResponse('Not found', { status: 404 })
+  const type = TYPES[extname(file).toLowerCase()]
+  if (!type) return new NextResponse('Not found', { status: 404 })
+  try {
+    const bytes = await readFile(join(DIR, file))
+    return new NextResponse(new Uint8Array(bytes), {
+      headers: { 'content-type': type, 'cache-control': 'public, max-age=86400' },
+    })
+  } catch {
+    return new NextResponse('Not found', { status: 404 })
+  }
+}

package/app/globals.css

@@ -0,0 +1,14 @@
+:root {
+  color-scheme: light dark;
+}
+
+* {
+  box-sizing: border-box;
+}
+
+html,
+body {
+  margin: 0;
+  padding: 0;
+  font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif;
+}

package/app/layout.tsx

@@ -0,0 +1,30 @@
+import { BRAND } from '@/lib/brand'
+import type { Metadata, Viewport } from 'next'
+import type { ReactNode } from 'react'
+import './globals.css'
+
+export const metadata: Metadata = {
+  title: `${BRAND.name} Mail`,
+  description: `${BRAND.name} team mailbox`,
+  robots: { index: false, follow: false, nocache: true, googleBot: { index: false, follow: false } },
+  manifest: '/manifest.webmanifest',
+  ...(BRAND.iconUrl
+    ? { icons: { icon: BRAND.iconUrl, shortcut: BRAND.iconUrl, apple: BRAND.appleIconUrl || BRAND.iconUrl } }
+    : {}),
+  applicationName: `${BRAND.name} Mail`,
+  appleWebApp: { capable: true, title: `${BRAND.name} Mail`, statusBarStyle: 'black-translucent' },
+  formatDetection: { telephone: false },
+}
+
+export const viewport: Viewport = {
+  themeColor: BRAND.colors.accent,
+  viewportFit: 'cover',
+}
+
+export default function RootLayout({ children }: { children: ReactNode }) {
+  return (
+    <html lang="en">
+      <body>{children}</body>
+    </html>
+  )
+}

package/app/mail/AccessCheck.tsx

@@ -0,0 +1,45 @@
+'use client'
+
+import { useEffect, useState } from 'react'
+import styles from './page.module.css'
+
+const VERBS = [
+  'Waking the mailbox',
+  'Checking your access',
+  'Verifying credentials',
+  'Opening the vault',
+  'Counting what arrived',
+  'Almost there',
+]
+
+export default function AccessCheck() {
+  const [verbIndex, setVerbIndex] = useState(0)
+
+  useEffect(() => {
+    if (verbIndex >= VERBS.length - 1) return
+    const timer = setTimeout(() => setVerbIndex(current => current + 1), verbIndex === 0 ? 900 : 1500)
+    return () => clearTimeout(timer)
+  }, [verbIndex])
+
+  return (
+    <div className={styles.loginWrap}>
+      <div className={styles.accessCheck}>
+        <div className={styles.accessStage}>
+          <span className={styles.accessMark} aria-hidden="true" />
+          <svg className={styles.accessRing} viewBox="0 0 100 100" aria-hidden="true">
+            <circle className={styles.accessRingTrack} cx="50" cy="50" r="45" />
+            <circle className={styles.accessRingArc} cx="50" cy="50" r="45" />
+          </svg>
+        </div>
+        <p className={styles.accessVerb} key={verbIndex} role="status" aria-live="polite">
+          {VERBS[verbIndex]}
+          <span className={styles.accessDots} aria-hidden="true">
+            <i />
+            <i />
+            <i />
+          </span>
+        </p>
+      </div>
+    </div>
+  )
+}