@novacraft-engineering/mailbox 0.4.23 → 0.4.25

package/.env.example

@@ -44,10 +44,6 @@ MAIL_ADDRESS_ALIASES={}
 # (Turso or your own sqld) and needs the token below.
 DATABASE_URL=file:/data/mail.sqlite
 DATABASE_AUTH_TOKEN=
-# Optional alternative: Cloudflare D1, used only when DATABASE_URL is unset.
-CLOUDFLARE_ACCOUNT_ID=
-CLOUDFLARE_D1_TOKEN=
-D1_DATABASE_ID=
 
 # Signs the session cookie. Without it every request falls back to sending the
 # password on each call, so set it. Rotating the value signs everybody out.
@@ -62,9 +58,15 @@ AWS_SES_REGION=eu-north-1
 RESEND_API_KEY=
 RESEND_WEBHOOK_SECRET=
 
-# Optional: copy inbound mail to an outside address. Leave empty to forward
-# nothing — pointing this at an address this app receives would loop.
+# Optional: where a copy goes when inbound mail belongs to no account. Pointing this
+# at an address this app receives would loop.
 MAIL_FORWARD_TO=
+# Set to off to stop copying inbound mail to account owners' login addresses.
+MAIL_FORWARDING=on
+
+# SES delivery events arrive through SNS at /api/mail/events/ses. Only this topic is
+# accepted; leave unset and every notification is refused.
+MAIL_SES_EVENTS_TOPIC_ARN=
 
 # ─── Attachments ────────────────────────────────────────────────────────────
 # Any S3-compatible bucket: AWS S3, Cloudflare R2, Backblaze B2, MinIO, Wasabi.

package/README.md

@@ -58,11 +58,6 @@ seat whose mail someone else now reads.
 on a mounted volume, which is what a single box wants. A `libsql://` URL points
 at a hosted one — Turso, or your own `sqld` — and takes `DATABASE_AUTH_TOKEN`.
 
-If you would rather not run a database at all, leave `DATABASE_URL` unset and
-fill in the Cloudflare D1 variables instead; the app falls back to D1 over its
-REST API. Either way the queries are the same SQLite, so you can move between
-them without a coordinated redeploy.
-
 Attachments go to any S3-compatible bucket through the `S3_*` variables: AWS
 S3, Cloudflare R2, Backblaze B2, MinIO, Wasabi. The older `R2_*` names still
 work if you already set them.

package/app/api/mail/events/ses/route.ts

@@ -0,0 +1,88 @@
+import { NextResponse } from 'next/server'
+import { appendEvent, claimWebhookEvent, completeWebhookEvent, releaseWebhookEvent } from '@/lib/mailbox'
+import { awsSnsUrl, verifySns, type SnsEnvelope } from '@/lib/sns'
+
+export const runtime = 'nodejs'
+
+type SesEvent = {
+  eventType?: string
+  mail?: { messageId?: string; timestamp?: string; destination?: string[]; commonHeaders?: { subject?: string } }
+  bounce?: { bounceType?: string; bounceSubType?: string; timestamp?: string; bouncedRecipients?: Array<{ emailAddress?: string; diagnosticCode?: string }> }
+  complaint?: { timestamp?: string; complaintFeedbackType?: string }
+  delivery?: { timestamp?: string }
+  deliveryDelay?: { timestamp?: string; delayType?: string }
+  reject?: { reason?: string }
+  failure?: { errorMessage?: string }
+}
+
+// The same names Resend's webhooks use, so the Sent list reads either provider the same way.
+const EVENT_TYPES: Record<string, string> = {
+  Send: 'email.sent',
+  Delivery: 'email.delivered',
+  DeliveryDelay: 'email.delivery_delayed',
+  Bounce: 'email.bounced',
+  Complaint: 'email.complained',
+  Reject: 'email.failed',
+  RenderingFailure: 'email.failed',
+}
+
+/** SES delivery events, fanned out through an SNS topic this deployment pins by ARN. */
+export async function POST(req: Request) {
+  let envelope: SnsEnvelope
+  try {
+    envelope = JSON.parse(await req.text()) as SnsEnvelope
+  } catch {
+    return NextResponse.json({ ok: false, error: 'Invalid JSON' }, { status: 400 })
+  }
+  if (!(await verifySns(envelope, process.env.MAIL_SES_EVENTS_TOPIC_ARN))) {
+    return NextResponse.json({ ok: false, error: 'Unverified' }, { status: 403 })
+  }
+
+  if (envelope.Type === 'SubscriptionConfirmation') {
+    if (!envelope.SubscribeURL || !awsSnsUrl(envelope.SubscribeURL, '/')) {
+      return NextResponse.json({ ok: false, error: 'Unexpected subscribe URL' }, { status: 400 })
+    }
+    const confirmed = await fetch(envelope.SubscribeURL).then(response => response.ok).catch(() => false)
+    return NextResponse.json({ ok: confirmed })
+  }
+  if (envelope.Type !== 'Notification') return NextResponse.json({ ok: true, ignored: envelope.Type })
+
+  let event: SesEvent
+  try {
+    event = JSON.parse(envelope.Message ?? '{}') as SesEvent
+  } catch {
+    return NextResponse.json({ ok: false, error: 'Notification carried no JSON' }, { status: 400 })
+  }
+  const type = EVENT_TYPES[event.eventType ?? '']
+  const emailId = event.mail?.messageId
+  if (!type || !emailId) return NextResponse.json({ ok: true, ignored: event.eventType ?? 'unknown' })
+
+  const claimKey = `ses:${envelope.MessageId ?? ''}`
+  if ((await claimWebhookEvent(claimKey)) !== 'claimed') return NextResponse.json({ ok: true, duplicate: true })
+
+  const meta: Record<string, string> = {}
+  if (event.mail?.commonHeaders?.subject) meta.subject = event.mail.commonHeaders.subject
+  if (event.mail?.destination?.length) meta.to = event.mail.destination.join(', ')
+  if (event.bounce) {
+    meta.bounceType = [event.bounce.bounceType, event.bounce.bounceSubType].filter(Boolean).join(' / ')
+    const reasons = (event.bounce.bouncedRecipients ?? [])
+      .map(recipient => [recipient.emailAddress, recipient.diagnosticCode].filter(Boolean).join(': '))
+      .filter(Boolean)
+    if (reasons.length) meta.bounceMessage = reasons.join('; ')
+  }
+  if (event.complaint?.complaintFeedbackType) meta.complaint = event.complaint.complaintFeedbackType
+  if (event.deliveryDelay?.delayType) meta.delayType = event.deliveryDelay.delayType
+  if (event.reject?.reason) meta.failReason = event.reject.reason
+  if (event.failure?.errorMessage) meta.failReason = event.failure.errorMessage
+
+  const at = event.delivery?.timestamp ?? event.bounce?.timestamp ?? event.complaint?.timestamp
+    ?? event.deliveryDelay?.timestamp ?? event.mail?.timestamp ?? new Date().toISOString()
+  try {
+    await appendEvent({ emailId, type, at, meta: Object.keys(meta).length ? meta : undefined })
+  } catch (err) {
+    await releaseWebhookEvent(claimKey)
+    throw err
+  }
+  await completeWebhookEvent(claimKey)
+  return NextResponse.json({ ok: true })
+}

package/app/api/mail/scheduled/route.ts

@@ -1,7 +1,7 @@
 import { NextResponse } from 'next/server'
 import { mailAuthGuard, resolveAccount } from '@/lib/dev-auth'
 import { scopeFor } from '@/lib/scope'
-import { listScheduled, cancelScheduled, rescheduleSend } from '@/lib/scheduled'
+import { listScheduled, cancelScheduled, dispatchNow, rescheduleSend } from '@/lib/scheduled'
 
 export const runtime = 'nodejs'
 export const dynamic = 'force-dynamic'
@@ -46,3 +46,17 @@ export async function PATCH(req: Request) {
   }
   return NextResponse.json({ ok: true, scheduledAt: when.toISOString() })
 }
+
+/** Send a waiting message of the caller's now — the page calls this as its undo window closes. */
+export async function POST(req: Request) {
+  const guard = await mailAuthGuard(req)
+  if (guard) return guard
+  const account = await resolveAccount(req)
+  const body = (await req.json().catch(() => null)) as { id?: string } | null
+  const id = body?.id ?? ''
+  if (!id) return NextResponse.json({ ok: false, error: 'id is required' }, { status: 400 })
+  const outcome = await dispatchNow(id, account.address ?? '')
+  if (outcome === 'sent' || outcome === 'already-sent') return NextResponse.json({ ok: true, outcome })
+  const status = outcome === 'missing' ? 404 : outcome === 'not-due' ? 409 : 502
+  return NextResponse.json({ ok: false, outcome }, { status })
+}

package/app/api/mail/send/route.ts

@@ -6,6 +6,7 @@ import { mailAuthGuard, resolveAccount } from '@/lib/dev-auth'
 import { presign } from '@/lib/r2'
 import { recordContact, recordPixel, recordSentMeta, recordSentMessage } from '@/lib/mailbox'
 import { scheduleSend } from '@/lib/scheduled'
+import { absoluteUrls, stripOwnPixel } from '@/lib/email-html'
 import { publicOrigin } from '@/lib/public-url'
 
 export const runtime = 'nodejs'
@@ -145,7 +146,7 @@ export async function POST(req: Request) {
   const origin = publicOrigin(req)
   const pixelId = randomUUID()
   const trackedHtml = body.html?.trim()
-    ? `${body.html.trim()}<img src="${origin}/api/mail/pixel/${pixelId}" alt="" width="1" height="1" style="display:none;width:1px;height:1px;border:0" />`
+    ? `${stripOwnPixel(absoluteUrls(body.html.trim(), origin))}<img src="${origin}/api/mail/pixel/${pixelId}" alt="" width="1" height="1" style="display:none;width:1px;height:1px;border:0" />`
     : null
 
   // Thread the reply: In-Reply-To/References point at the inbound Message-ID so the

package/app/api/mail/signature-logo/route.ts

@@ -1,6 +1,7 @@
 import { createHash } from 'node:crypto'
 import { NextResponse } from 'next/server'
 import { mailAuthGuard, resolveAccount } from '@/lib/dev-auth'
+import { publicOrigin } from '@/lib/public-url'
 import { presign } from '@/lib/r2'
 
 export const runtime = 'nodejs'
@@ -88,5 +89,5 @@ export async function POST(req: Request) {
   }).catch(() => null)
   if (!put?.ok) return NextResponse.json({ ok: false, error: 'Could not store that image.' }, { status: 502 })
 
-  return NextResponse.json({ ok: true, url: `/api/mail/signature-logo?key=${encodeURIComponent(key)}` })
+  return NextResponse.json({ ok: true, url: `${publicOrigin(req)}/api/mail/signature-logo?key=${encodeURIComponent(key)}` })
 }

package/app/mail/RichEditor.tsx

@@ -1,6 +1,7 @@
 'use client'
 
 import { useCallback, useEffect, useRef, useState, useSyncExternalStore } from 'react'
+import type { Node as ProseMirrorNode } from '@tiptap/pm/model'
 import { EditorContent, Extension, NodeViewWrapper, ReactNodeViewRenderer, useEditor, type Editor, type NodeViewProps } from '@tiptap/react'
 import StarterKit from '@tiptap/starter-kit'
 import Underline from '@tiptap/extension-underline'
@@ -16,6 +17,7 @@ import Highlight from '@tiptap/extension-highlight'
 import { Table, TableCell, TableHeader, TableRow } from '@tiptap/extension-table'
 import { safeHref } from '@/lib/email-html'
 import styles from './page.module.css'
+import { TAB_TEXT, tabPress } from './tabKey'
 
 const TEXT_COLOURS = ['#030712', '#b91c1c', '#1d4ed8', '#047857', '#b45309', '#6d28d9', '#6b7280']
 const HIGHLIGHTS = ['#FEF08A', '#BBF7D0', '#BFDBFE', '#FBCFE8', '#FED7AA']
@@ -840,6 +842,49 @@ function Toolbar({ editor, uploadImage, fonts = [], baseFont }: { editor: Editor
   )
 }
 
+type TabMark = { doc: ProseMirrorNode; undo: () => void } | null
+
+/**
+ * Tab indents the body rather than leaving it; a list item is nested a level instead. A
+ * quick second Tab takes that indent back and lets focus move to the next control. Inside a
+ * table, Tab keeps moving between cells.
+ */
+const TabKey = Extension.create<Record<string, never>, { memory: { at: number; mark: TabMark } }>({
+  name: 'tabKey',
+  addStorage() {
+    return { memory: { at: 0, mark: null } }
+  },
+  addKeyboardShortcuts() {
+    return {
+      Tab: () => {
+        const editor = this.editor
+        if (editor.isActive('table')) return false
+        const { leaving, previous } = tabPress(this.storage.memory, () => null)
+        if (leaving) {
+          if (previous && previous.doc === editor.state.doc) previous.undo()
+          return false
+        }
+        let undo: () => void
+        if (editor.can().sinkListItem('listItem')) {
+          editor.commands.sinkListItem('listItem')
+          undo = () => editor.commands.liftListItem('listItem')
+        } else {
+          editor.commands.insertContent(TAB_TEXT)
+          const end = editor.state.selection.from
+          undo = () => editor.commands.deleteRange({ from: end - TAB_TEXT.length, to: end })
+        }
+        this.storage.memory.mark = { doc: editor.state.doc, undo }
+        return true
+      },
+      'Shift-Tab': () => {
+        const editor = this.editor
+        if (editor.isActive('table')) return false
+        return editor.can().liftListItem('listItem') ? editor.commands.liftListItem('listItem') : false
+      },
+    }
+  },
+})
+
 const isSpacing = (value: number) => Number.isFinite(value) && value >= 0.8 && value <= 3
 
 const LineSpacing = Extension.create({
@@ -925,6 +970,7 @@ export default function RichEditor({
       FontFamily,
       FontSize,
       LineSpacing,
+      TabKey,
       Color,
       Highlight.configure({ multicolor: true }),
       Link.configure({ openOnClick: false, autolink: true }),

package/app/mail/page.tsx

@@ -12,6 +12,7 @@ import RichEditor from './RichEditor'
 import { inlineEmailStyles, htmlToPlainText, dropUnreachableImages, outlookSafeImages, stripOwnPixel, healGooglePrivateImages } from '@/lib/email-html'
 import { BUILTIN_FONTS, DEFAULT_LINE_SPACING, EMPTY_FONT, FONT_SIZES, LINE_SPACINGS, fontFaceCss, fontStack, lineSpacingOf, type BaseFont, type CustomFont, paragraphGap } from '@/lib/fonts'
 import MailSelect, { GLYPH } from './MailSelect'
+import { handleComposeTab } from './tabKey'
 
 /** Which product an address belongs to, so the picker can wear its mark. */
 function productOf(address: string): 'vela' | 'hosting' | 'person' {
@@ -4570,14 +4571,22 @@ export default function DevMailPage() {
   }
 
   useEffect(() => {
-    if (undo && undo.sendAt <= now) {
-      setUndo(null)
-      setSentFlash('Sent')
-      window.setTimeout(() => setSentFlash(''), 2500)
-      loadSent()
-      loadQueued()
-    }
-  }, [undo, now, loadSent])
+    if (!undo || undo.sendAt > now) return
+    const id = undo.id
+    setUndo(null)
+    setSentFlash('Sending…')
+    // The window closing is the moment to send, not the next minute's dispatcher run.
+    // Saying "Sent" before the message had left is what prompted a second send.
+    fetch('/api/mail/scheduled', { method: 'POST', headers: apiHeaders(), body: JSON.stringify({ id }) })
+      .then(response => response.json().catch(() => null))
+      .then(data => setSentFlash(data?.ok ? 'Sent' : 'Queued — it will go within a minute'))
+      .catch(() => setSentFlash('Queued — it will go within a minute'))
+      .finally(() => {
+        window.setTimeout(() => setSentFlash(''), 2500)
+        loadSent()
+        loadQueued()
+      })
+  }, [undo, now, loadSent, loadQueued, apiHeaders])
 
   const cancelScheduled = async (id: string) => {
     try {
@@ -6852,7 +6861,9 @@ export default function DevMailPage() {
                       if (event.key === 'Enter' && (event.metaKey || event.ctrlKey)) {
                         event.preventDefault()
                         sendQuickReply(inbound)
+                        return
                       }
+                      handleComposeTab(event)
                     }}
                     placeholder={replyBar === 'forward' ? 'Add a note to go with the forwarded message…' : `Reply to ${parseAddress(quickReplyTarget(inbound).from) || 'sender'}…`}
                     rows={1}
@@ -6862,6 +6873,7 @@ export default function DevMailPage() {
                   <textarea
                     className={`${styles.quickReplyInput} ${styles.quickReplyHtml}`}
                     value={replyHtml}
+                    onKeyDown={event => handleComposeTab(event, '  ')}
                     onChange={event => { setReplyHtml(event.target.value); setReplyHtmlDirty(true) }}
                     onPaste={event => { pasteAttachments(event) }}
                     placeholder="Advanced: edit the message HTML directly. Changes here replace what you wrote."

package/app/mail/tabKey.ts

@@ -0,0 +1,48 @@
+import type { KeyboardEvent } from 'react'
+
+/** Two presses closer together than this leave the field instead of indenting twice. */
+export const DOUBLE_TAB_MS = 400
+
+/** Four no-break spaces: a tab character collapses to a single space in most mail clients. */
+export const TAB_TEXT = '    '
+
+/**
+ * Whether this Tab is the second of a quick pair. The first press is remembered with a way
+ * to take its indent back, which the second press uses before letting focus move on.
+ */
+export function tabPress<Mark>(memory: { at: number; mark: Mark | null }, mark: () => Mark): { leaving: boolean; previous: Mark | null } {
+  const now = Date.now()
+  if (now - memory.at < DOUBLE_TAB_MS) {
+    const previous = memory.mark
+    memory.at = 0
+    memory.mark = null
+    return { leaving: true, previous }
+  }
+  memory.at = now
+  memory.mark = mark()
+  return { leaving: false, previous: null }
+}
+
+const textareaMemory = new WeakMap<HTMLTextAreaElement, { at: number; mark: { value: string; caret: number } | null }>()
+
+/** Tab indents inside a composing textarea; a quick second Tab removes that indent and moves on. */
+export function handleComposeTab(event: KeyboardEvent<HTMLTextAreaElement>, indent: string = TAB_TEXT) {
+  if (event.key !== 'Tab' || event.shiftKey || event.altKey || event.ctrlKey || event.metaKey) return
+  const field = event.currentTarget
+  let memory = textareaMemory.get(field)
+  if (!memory) {
+    memory = { at: 0, mark: null }
+    textareaMemory.set(field, memory)
+  }
+  const { leaving, previous } = tabPress(memory, () => ({ value: '', caret: -1 }))
+  if (leaving) {
+    if (previous && previous.value === field.value && field.selectionStart === previous.caret) {
+      field.setSelectionRange(previous.caret - indent.length, previous.caret)
+      document.execCommand('delete')
+    }
+    return
+  }
+  event.preventDefault()
+  document.execCommand('insertText', false, indent)
+  memory.mark = { value: field.value, caret: field.selectionStart }
+}

package/lib/dev-auth.ts

@@ -21,10 +21,12 @@ import { passwordFingerprint, readSession } from '@/lib/session'
 export const MAIL_ACCOUNTS = MAIL_SEATS.filter(seat => seat.role === 'admin').map(seat => seat.email)
 
 /**
- * Where a copy of inbound mail is forwarded. Off unless MAIL_FORWARD_TO is set: forwarding
- * to an address this app itself receives would loop, and copying a client's mail into a
- * personal inbox is not a decision a deployment should make quietly.
+ * Inbound mail is copied to the owning account's login address when that address lives
+ * somewhere else. MAIL_FORWARDING=off stops it for the whole deployment; nothing else does.
  */
+export const FORWARDING_ENABLED = (process.env.MAIL_FORWARDING ?? 'on').trim().toLowerCase() !== 'off'
+
+/** Who gets the copy when the mail belongs to no account. */
 export const FORWARD_RECIPIENTS = (process.env.MAIL_FORWARD_TO ?? '')
   .split(',')
   .map(entry => entry.trim().toLowerCase())

package/lib/dmarc-report.test.ts

@@ -0,0 +1,18 @@
+import assert from 'node:assert/strict'
+import test from 'node:test'
+
+test('aggregate reports are recognised by their subject, and nothing else is', async () => {
+  const { isDmarcAggregateReport } = await import('./mailbox.ts')
+
+  assert.equal(isDmarcAggregateReport('Report domain: contact.novacraft.africa Submitter: google.com Report-ID: 2705410220068441608'), true)
+  assert.equal(isDmarcAggregateReport('Report domain: contact.novacraft.africa Submitter: google.com\n Report-ID: 12382647491638298144'), true, 'Google folds the header')
+  assert.equal(isDmarcAggregateReport('Report Domain: metroperilinsbrokers.com Submitter: yahoo.com Report-ID: <1790142578.13334>'), true)
+  assert.equal(isDmarcAggregateReport('Report Domain: contact.novacraft.africa Submitter: protection.outlook.com Report-ID: 9115e5ed'), true)
+  assert.equal(isDmarcAggregateReport('Dmarc Aggregate Report Domain: {metroperilinsbrokers.com} Submitter: {Amazon SES} Date: {2026-09-22}'), true)
+
+  assert.equal(isDmarcAggregateReport('Re: Report domain: contact.novacraft.africa Submitter: google.com'), false, 'a reply is a person talking')
+  assert.equal(isDmarcAggregateReport('Report domain migration plan'), false, 'no Submitter, no report')
+  assert.equal(isDmarcAggregateReport('Quarterly report: domain renewals and the submitter list'), false)
+  assert.equal(isDmarcAggregateReport(''), false)
+  assert.equal(isDmarcAggregateReport(null), false)
+})

package/lib/email-html.test.ts

@@ -1,5 +1,5 @@
 import assert from 'node:assert/strict'
-import { inlineEmailStyles, htmlToPlainText, safeHref, dropUnreachableImages, outlookSafeImages, healGooglePrivateImages } from './email-html.ts'
+import { absoluteUrls, inlineEmailStyles, htmlToPlainText, safeHref, dropUnreachableImages, outlookSafeImages, healGooglePrivateImages } from './email-html.ts'
 
 // A paragraph with no styling of its own gets the base inline style.
 assert.match(inlineEmailStyles('<p>Hello</p>'), /<p style="font-family:Arial[^"]*">Hello<\/p>/)
@@ -88,3 +88,25 @@ assert.equal(
   healGooglePrivateImages('<img src="cid:abc"><img src="https://lh3.googleusercontent.com/real.png">'),
   '<img src="cid:abc"><img src="https://lh3.googleusercontent.com/real.png">',
 )
+
+assert.equal(
+  absoluteUrls('<img src="/api/mail/signature-logo?key=signatures%2Fa.png">', 'https://mail.example.com'),
+  '<img src="https://mail.example.com/api/mail/signature-logo?key=signatures%2Fa.png">',
+)
+assert.equal(
+  absoluteUrls('<img src="/brand/mark-email.png">', 'https://mail.example.com/'),
+  '<img src="https://mail.example.com/brand/mark-email.png">',
+)
+// A forwarded sender's own relative links stay theirs: our hostname must not end up behind them.
+assert.equal(
+  absoluteUrls('<a href="/unsubscribe">stop</a><img src="/img/header.png">', 'https://mail.example.com'),
+  '<a href="/unsubscribe">stop</a><img src="/img/header.png">',
+)
+assert.equal(
+  absoluteUrls('<img src="https://cdn.example.com/a.png"><img src="//cdn/b.png">', 'https://mail.example.com'),
+  '<img src="https://cdn.example.com/a.png"><img src="//cdn/b.png">',
+)
+assert.equal(absoluteUrls('<a href="mailto:a@b.com">a</a>', 'https://mail.example.com'), '<a href="mailto:a@b.com">a</a>')
+// Idempotent: already-absolute addresses survive a second pass unchanged.
+const once = absoluteUrls('<img src="/api/mail/pixel/x">', 'https://mail.example.com')
+assert.equal(absoluteUrls(once, 'https://mail.example.com'), once)

package/lib/email-html.ts

@@ -135,6 +135,22 @@ export function healGooglePrivateImages(html: string, mark?: string | null): str
   })
 }
 
+/**
+ * A root-relative address resolves against our own app, and nowhere else. Sent out as-is it
+ * points a recipient's client at its own host, so the signature logo the composer showed
+ * happily arrives broken in every other mailbox.
+ *
+ * Only our own asset paths are rewritten. A forwarded message carries the original
+ * sender's markup verbatim, and their "/unsubscribe" belongs to their site, not ours —
+ * giving it our hostname would put our domain behind someone else's link.
+ */
+const OWN_ASSET_PATH = /\b(src|href)\s*=\s*(["'])(\/(?:api|brand)\/[^"']*)\2/gi
+
+export function absoluteUrls(html: string, origin: string): string {
+  const root = origin.replace(/\/+$/, '')
+  return html.replace(OWN_ASSET_PATH, (_tag, attribute, quote, path) => `${attribute}=${quote}${root}${path}${quote}`)
+}
+
 export function stripCidPlaceholders(text: string): string {
   return text
     .replace(/\[cid:[^\]\n]{0,300}\]/gi, '')

package/lib/mail-provider.ts

@@ -166,9 +166,8 @@ function buildRawMime(payload: SendPayload): string {
 }
 
 async function sendViaSes(payload: SendPayload): Promise<SendResult> {
-  // buildRawMime deliberately writes no Bcc header; SES is told the blind recipients here.
   const region = process.env.AWS_SES_REGION ?? 'eu-north-1'
-  return { id: await sesSendRaw(buildRawMime(payload), region, payload.bcc ?? []) }
+  return { id: await sesSendRaw(buildRawMime(payload), region, { to: payload.to, cc: payload.cc, bcc: payload.bcc }) }
 }
 
 /**

package/lib/mailbox.ts

@@ -1,6 +1,6 @@
 import { ADDRESS_ALIASES, MAIL_SEATS, type MailRole } from './brand'
 /**
- * Durable mail state on Cloudflare D1 (SQLite). Inbox, delivery events, account
+ * Durable mail state on libSQL (SQLite). Inbox, delivery events, account
  * credentials, reset tokens, and a per-account stash for drafts + saved templates.
  *
  * SQLite differences that matter here: booleans are 0/1, JSON columns are TEXT and come
@@ -8,7 +8,6 @@ import { ADDRESS_ALIASES, MAIL_SEATS, type MailRole } from './brand'
  * supplied by the app rather than `now()`.
  */
 
-import { d1, d1Batch, d1Query } from './d1'
 import { stripCidPlaceholders } from './email-html'
 import { hashPassword } from './password'
 import { duration, type ParsedQuery } from '@/app/mail/search'
@@ -67,24 +66,21 @@ export type StashItem = {
 const MAX_INBOX = 500
 const MAX_EVENTS = 150
 
-/** SQLite/libSQL once it is configured, D1 until then, so the switch needs no redeploy dance. */
-const tursoConfigured = () => Boolean(process.env.DATABASE_URL ?? process.env.TURSO_DATABASE_URL)
-
 export function db() {
-  return tursoConfigured() ? turso() : d1()
+  return turso()
 }
 
 /** Raw SQL with positional args, for queries whose shape is built at runtime. */
 function tagged(_sql: unknown, text: string, args: unknown[]): Promise<Record<string, unknown>[]> {
-  return tursoConfigured() ? tursoQuery(text, args) : d1Query(text, args)
+  return tursoQuery(text, args)
 }
 
 function sqlRaw(text: string, args: unknown[] = []): Promise<Record<string, unknown>[]> {
-  return tursoConfigured() ? tursoQuery(text, args) : d1Query(text, args)
+  return tursoQuery(text, args)
 }
 
 function dbBatch(statements: string[]): Promise<void> {
-  return tursoConfigured() ? tursoBatch(statements) : d1Batch(statements)
+  return tursoBatch(statements)
 }
 
 function nowIso(): string {
@@ -116,8 +112,8 @@ function isoOrNull(value: unknown): string | null {
 }
 
 /**
- * Create the schema on first use. D1 has no migration runner either, but unlike the
- * Postgres original we own the full CREATE, so there are no incremental ALTERs to replay.
+ * Create the schema on first use. There is no migration runner, but unlike the Postgres
+ * original we own the full CREATE, so there are no incremental ALTERs to replay.
  * Memoized per server instance.
  */
 let schemaReady: Promise<void> | null = null
@@ -1317,14 +1313,19 @@ export async function refreshThreadsFrom(
   return { refreshed: pairs.length, cursor: last ? { owner: String(last.owner), threadId: String(last.thread_id) } : null }
 }
 
+/** RFC 7489 §7.2.1.1's subject line, and Amazon's variant of it. Nobody types this by hand. */
+export function isDmarcAggregateReport(subject: string | null | undefined): boolean {
+  return /^(dmarc aggregate )?report domain:[\s\S]*\bsubmitter:/i.test((subject ?? '').trim())
+}
+
 export async function appendInbound(
   email: Omit<InboundEmail, 'starred' | 'archived' | 'trashed' | 'labels' | 'threadId'>,
 ): Promise<void> {
   await ensureMailSchema()
   const sql = db()
   await sql`
-    INSERT INTO mail_inbox (id, from_addr, to_addrs, cc, bcc, reply_to, subject, html, body_text, headers, received_at, read, attachments, owner, snippet, thread_meta, attach_meta, addressed, risk, risk_reasons, spam)
-    VALUES (${email.id}, ${email.from}, ${JSON.stringify(email.to)}, ${JSON.stringify(email.cc)}, ${JSON.stringify(email.bcc)}, ${JSON.stringify(email.replyTo)}, ${email.subject}, ${email.html}, ${email.text}, ${JSON.stringify(email.headers)}, ${email.receivedAt}, ${email.read}, ${JSON.stringify(email.attachments)}, ${email.owner ?? null}, ${listSnippet(email.text)}, ${threadMeta(email.headers)}, ${attachMeta(email.attachments)}, ${classifyAddressed(email.owner, email.to, email.cc)}, ${email.risk ?? 'clean'}, ${JSON.stringify(email.riskReasons ?? [])}, ${email.spam ? 1 : 0})
+    INSERT INTO mail_inbox (id, from_addr, to_addrs, cc, bcc, reply_to, subject, html, body_text, headers, received_at, read, attachments, owner, snippet, thread_meta, attach_meta, addressed, risk, risk_reasons, spam, archived)
+    VALUES (${email.id}, ${email.from}, ${JSON.stringify(email.to)}, ${JSON.stringify(email.cc)}, ${JSON.stringify(email.bcc)}, ${JSON.stringify(email.replyTo)}, ${email.subject}, ${email.html}, ${email.text}, ${JSON.stringify(email.headers)}, ${email.receivedAt}, ${email.read}, ${JSON.stringify(email.attachments)}, ${email.owner ?? null}, ${listSnippet(email.text)}, ${threadMeta(email.headers)}, ${attachMeta(email.attachments)}, ${classifyAddressed(email.owner, email.to, email.cc)}, ${email.risk ?? 'clean'}, ${JSON.stringify(email.riskReasons ?? [])}, ${email.spam ? 1 : 0}, ${isDmarcAggregateReport(email.subject) ? 1 : 0})
     ON CONFLICT (id) DO NOTHING`
   await threadMessage({ id: email.id, owner: email.owner ?? null, subject: email.subject, receivedAt: email.receivedAt })
   await invalidateCounts(email.owner)

package/lib/receive.test.ts

@@ -23,3 +23,27 @@ test('only mail addressed to a hosted domain is ingested', async () => {
   assert.equal(addressedToUs(['x@metroperilinsbrokers.com.evil.net']), false)
 
 })
+
+test('the To line comes from the header, not from the copy the provider delivered', async () => {
+  const { headerAddresses } = await import('./receive.ts')
+
+  assert.deepEqual(
+    headerAddresses('eric.samuel@coronationinsurance.com.ng, sijuatobatele@lasacoassurance.com'),
+    ['eric.samuel@coronationinsurance.com.ng', 'sijuatobatele@lasacoassurance.com'],
+  )
+  assert.deepEqual(
+    headerAddresses('"Adeolu Ajao" <aajao@custodianinsurance.com>, "Ernest Okpata" <eokpata.metroperil@gmail.com>'),
+    ['aajao@custodianinsurance.com', 'eokpata.metroperil@gmail.com'],
+  )
+  assert.deepEqual(headerAddresses('"Doe, John" <john@example.com>, jane@example.com'), ['john@example.com', 'jane@example.com'], 'a comma inside a quoted name does not split it')
+  assert.deepEqual(headerAddresses('"Say \\"hi\\", please" <quote@example.com>'), ['quote@example.com'], 'an escaped quote does not end the name')
+  assert.deepEqual(headerAddresses('undisclosed-recipients:;'), [], 'a blind copy has no visible recipient')
+  assert.deepEqual(headerAddresses('team: a@example.com, b@example.com;'), ['a@example.com', 'b@example.com'])
+  assert.deepEqual(headerAddresses(['a@example.com', '"B" <b@example.com>']), ['a@example.com', 'b@example.com'])
+  assert.deepEqual(headerAddresses('john@x.com (John)'), ['john@x.com'], 'a trailing comment is not part of the address')
+  assert.deepEqual(headerAddresses('john@x.com (Smith, John), k@x.com'), ['john@x.com', 'k@x.com'], 'a comma inside a comment does not split')
+  assert.deepEqual(headerAddresses('"Ops <ops@old.com>" <real@x.com>, k@x.com'), ['real@x.com', 'k@x.com'], 'brackets inside a quoted name are not the address')
+  assert.deepEqual(headerAddresses('Jo (a "b) <j@x.com>, k@x.com'), ['j@x.com', 'k@x.com'])
+  assert.deepEqual(headerAddresses(undefined), [])
+  assert.deepEqual(headerAddresses(''), [])
+})

package/lib/receive.ts

@@ -1,8 +1,8 @@
 import { BRAND, ADDRESS_DOMAINS } from '@/lib/brand'
 import { sendPush } from '@/lib/push'
 import { stripOwnPixel } from '@/lib/email-html'
-import { FORWARD_RECIPIENTS, MAIL_DOMAIN } from '@/lib/dev-auth'
-import { ADDRESS_ALIASES, appendInbound, judgeMessage, noteSender, senderStanding, senderDomainOf, getAccountByAddress, inboundExists, recordContact, recordSentMeta, repairInbound } from '@/lib/mailbox'
+import { FORWARDING_ENABLED, FORWARD_RECIPIENTS, MAIL_DOMAIN } from '@/lib/dev-auth'
+import { ADDRESS_ALIASES, appendInbound, isDmarcAggregateReport, judgeMessage, noteSender, senderStanding, senderDomainOf, getAccountByAddress, inboundExists, recordContact, recordSentMeta, repairInbound } from '@/lib/mailbox'
 import { sendMail } from '@/lib/mail-provider'
 
 /**
@@ -66,6 +66,45 @@ function escapeHtml(src: string): string {
   return src.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;')
 }
 
+/**
+ * The addresses in a To or Cc header, bare, in the shape the provider already gives Cc.
+ *
+ * The provider's own `to` is the envelope recipient of the one copy it delivered, so every
+ * mailbox on a message saw itself in the To line — a colleague copied in read as though the
+ * client had written to them.
+ */
+export function headerAddresses(value: unknown): string[] {
+  const raw = Array.isArray(value) ? value.join(', ') : typeof value === 'string' ? value : ''
+  const entries: string[] = []
+  let current = ''
+  let quoted = false
+  let angled = false
+  let comment = 0
+  for (let index = 0; index < raw.length; index += 1) {
+    const char = raw[index]
+    if ((quoted || comment) && char === '\\') {
+      current += char + (raw[index + 1] ?? '')
+      index += 1
+      continue
+    }
+    if (char === '"' && !comment) quoted = !quoted
+    else if (!quoted && char === '(') comment += 1
+    else if (!quoted && char === ')' && comment) comment -= 1
+    else if (!quoted && !comment && char === '<') angled = true
+    else if (!quoted && !comment && char === '>') angled = false
+    if ((char === ',' || char === ';') && !quoted && !angled && !comment) {
+      entries.push(current)
+      current = ''
+    } else current += char
+  }
+  entries.push(current)
+  return entries
+    .map(entry => entry.replace(/"(?:[^"\\]|\\.)*"/g, ' ').replace(/\((?:[^()\\]|\\.)*\)/g, ' '))
+    .map(entry => entry.replace(/^[^<]*?:/, ''))
+    .map(entry => (entry.match(/<([^>]*)>/)?.[1] ?? entry).trim())
+    .filter(address => /^[^\s@<>"()]+@[^\s@<>"()]+$/.test(address))
+}
+
 export type ReceivedEmail = {
   html: string | null
   text: string | null
@@ -189,6 +228,7 @@ export async function forwardToAccounts(
   ownerAddress: string | null,
   files?: SendAttachment[],
 ): Promise<void> {
+  if (!FORWARDING_ENABLED || isDmarcAggregateReport(inbound.subject)) return
   const owningAccount = ownerAddress ? await getAccountByAddress(ownerAddress) : null
   const recipient = owningAccount?.email ?? FORWARD_RECIPIENTS[0] // fallback: the admin
   if (!recipient) return
@@ -265,6 +305,7 @@ export async function ingestReceived(
     ...(Array.isArray(data.bcc) ? (data.bcc as string[]) : []),
   ].filter(Boolean)
   const owner = await attributeOwner(recipients)
+  const toHeader = (full?.headers as Record<string, unknown> | undefined)?.to
   const fromAddress = full?.from || String(data.from ?? '')
   const senderDomain = senderDomainOf(fromAddress)
   const standing = await senderStanding(owner, senderDomain)
@@ -293,7 +334,9 @@ export async function ingestReceived(
     // Held out of the inbox, not merely labelled, once the weight passes the threshold.
     spam: verdicts.quarantine,
     from: full?.from || String(data.from ?? ''),
-    to: full?.to ?? (Array.isArray(data.to) ? (data.to as string[]) : [String(data.to ?? '')]),
+    to: toHeader !== undefined || Object.keys(full?.headers ?? {}).length
+      ? headerAddresses(toHeader)
+      : full?.to ?? (Array.isArray(data.to) ? (data.to as string[]) : [String(data.to ?? '')]),
     cc: full?.cc ?? (Array.isArray(data.cc) ? (data.cc as string[]) : []),
     bcc: full?.bcc ?? (Array.isArray(data.bcc) ? (data.bcc as string[]) : []),
     replyTo: full?.replyTo ?? (Array.isArray(data.reply_to) ? (data.reply_to as string[]) : []),
@@ -320,9 +363,8 @@ export async function ingestReceived(
   // or forwarded. Without this, every message the provider account receives for any tenant
   // lands in whichever deployment holds the webhook, filed to its shared inbox because no
   // local account matches — one tenant reading another's mail.
-  const envelope = [...inbound.to, ...inbound.cc, ...inbound.bcc]
-  if (!addressedToUs(envelope)) {
-    throw new Error(`refusing ${emailId}: addressed to ${envelope.join(', ') || 'nobody'}, which is not a domain this mailbox hosts`)
+  if (!addressedToUs(recipients)) {
+    throw new Error(`refusing ${emailId}: addressed to ${recipients.join(', ') || 'nobody'}, which is not a domain this mailbox hosts`)
   }
 
   // Pull the bytes once: they become our stored copy and the forward's attachments.
@@ -341,11 +383,13 @@ export async function ingestReceived(
   await noteSender(owner, senderDomain, 'received').catch(() => {})
   const sender = parseSender(inbound.from)
   await recordContact(sender.email, sender.name)
-  await sendPush(inbound.owner, {
-    title: sender.name || sender.email || 'New mail',
-    body: inbound.subject,
-    tag: emailId,
-  }).catch(() => {})
+  if (!isDmarcAggregateReport(inbound.subject)) {
+    await sendPush(inbound.owner, {
+      title: sender.name || sender.email || 'New mail',
+      body: inbound.subject,
+      tag: emailId,
+    }).catch(() => {})
+  }
   await forwardToAccounts(
     emailId,
     full ?? {

package/lib/scheduled.ts

@@ -1,3 +1,5 @@
+import { BRAND } from '@/lib/brand'
+import { absoluteUrls } from '@/lib/email-html'
 import { randomUUID } from 'node:crypto'
 import { db, ensureMailSchema, recordContact, recordPixel, recordSentMeta, recordSentMessage } from '@/lib/mailbox'
 import { sendMail, type SendPayload } from '@/lib/mail-provider'
@@ -122,11 +124,49 @@ const MAX_ATTEMPTS = 5
  * Hands over every message whose time has come. Each row is claimed with a conditional
  * update before it is sent, so two runners overlapping cannot send the same mail twice.
  */
+/**
+ * Sends one queued message, if it is still waiting. The claim is a single conditional
+ * update, so whichever caller gets there first sends it and every other caller — the
+ * minute cron, the page that watched its undo window close — finds nothing to do.
+ */
+async function dispatchRow(row: Record<string, unknown>): Promise<'sent' | 'failed' | 'skipped'> {
+  const sql = db()
+  const id = String(row.id)
+  const claimed = await sql`
+    UPDATE mail_scheduled SET status = 'sending' WHERE id = ${id} AND status = 'pending' RETURNING id`
+  if (!claimed.length) return 'skipped'
+
+  const send = parse(row.payload)
+  if (!send) {
+    await sql`UPDATE mail_scheduled SET status = 'failed', last_error = 'unreadable payload' WHERE id = ${id}`
+    return 'failed'
+  }
+
+  try {
+    // scheduledAt is deliberately dropped: the wait already happened here.
+    const { scheduledAt: _ignored, ...payload } = send.payload
+    const result = await sendMail(
+      payload.html ? { ...payload, html: absoluteUrls(payload.html, BRAND.publicUrl) } : payload,
+    )
+    await recordSend(send, result?.id ?? null)
+    await sql`
+      UPDATE mail_scheduled SET status = 'sent', sent_id = ${result?.id ?? null}, last_error = NULL WHERE id = ${id}`
+    return 'sent'
+  } catch (err) {
+    const attempts = Number(row.attempts ?? 0) + 1
+    const reason = err instanceof Error ? err.message : String(err)
+    await sql`
+      UPDATE mail_scheduled
+      SET status = ${attempts >= MAX_ATTEMPTS ? 'failed' : 'pending'}, attempts = ${attempts}, last_error = ${reason}
+      WHERE id = ${id}`
+    return 'failed'
+  }
+}
+
 export async function dispatchDue(limit = 25): Promise<{ due: number; sent: number; failed: number }> {
   await ensureMailSchema()
-  const sql = db()
   const now = new Date().toISOString()
-  const due = await sql`
+  const due = await db()`
     SELECT id, payload, attempts FROM mail_scheduled
     WHERE status = 'pending' AND send_after <= ${now}
     ORDER BY send_after LIMIT ${limit}`
@@ -134,35 +174,33 @@ export async function dispatchDue(limit = 25): Promise<{ due: number; sent: numb
   let sent = 0
   let failed = 0
   for (const row of due) {
-    const id = String(row.id)
-    const claimed = await sql`
-      UPDATE mail_scheduled SET status = 'sending' WHERE id = ${id} AND status = 'pending' RETURNING id`
-    if (!claimed.length) continue
-
-    const send = parse(row.payload)
-    if (!send) {
-      await sql`UPDATE mail_scheduled SET status = 'failed', last_error = 'unreadable payload' WHERE id = ${id}`
-      failed += 1
-      continue
-    }
-
-    try {
-      // scheduledAt is deliberately dropped: the wait already happened here.
-      const { scheduledAt: _ignored, ...payload } = send.payload
-      const result = await sendMail(payload)
-      await recordSend(send, result?.id ?? null)
-      await sql`
-        UPDATE mail_scheduled SET status = 'sent', sent_id = ${result?.id ?? null}, last_error = NULL WHERE id = ${id}`
-      sent += 1
-    } catch (err) {
-      const attempts = Number(row.attempts ?? 0) + 1
-      const reason = err instanceof Error ? err.message : String(err)
-      await sql`
-        UPDATE mail_scheduled
-        SET status = ${attempts >= MAX_ATTEMPTS ? 'failed' : 'pending'}, attempts = ${attempts}, last_error = ${reason}
-        WHERE id = ${id}`
-      failed += 1
-    }
+    const outcome = await dispatchRow(row)
+    if (outcome === 'sent') sent += 1
+    if (outcome === 'failed') failed += 1
   }
   return { due: due.length, sent, failed }
 }
+
+// How early a message may be sent on its owner's say-so. It covers a page clock running a
+// little ahead of ours, and no more: a message scheduled for tomorrow is not sent now
+// because a page asked, which is what "Send now" and its explicit reschedule are for.
+const EARLY_TOLERANCE_MS = 30_000
+
+/**
+ * The owner's page watched the undo window close. Sending then, rather than at the next
+ * minute cron, is what makes "Sent" true when the page says it. Already sent counts as
+ * sent: the cron may have got there first.
+ */
+export async function dispatchNow(id: string, owner: string): Promise<'sent' | 'already-sent' | 'not-due' | 'failed' | 'missing'> {
+  await ensureMailSchema()
+  const rows = await db()`
+    SELECT id, payload, attempts, status, send_after FROM mail_scheduled
+    WHERE id = ${id} AND lower(owner) = ${owner.toLowerCase()}`
+  const row = rows[0]
+  if (!row) return 'missing'
+  if (row.status === 'sent' || row.status === 'sending') return 'already-sent'
+  if (row.status !== 'pending') return 'failed'
+  if (Date.parse(String(row.send_after)) > Date.now() + EARLY_TOLERANCE_MS) return 'not-due'
+  const outcome = await dispatchRow(row)
+  return outcome === 'skipped' ? 'already-sent' : outcome
+}

package/lib/ses-send.test.ts

@@ -0,0 +1,21 @@
+import assert from 'node:assert/strict'
+import { sesDestination } from './ses-send.ts'
+
+// The bug: with a blind copy present, only the blind copy was handed to SES, and SES
+// delivers a raw message to its Destination alone — the real recipients were dropped.
+assert.deepEqual(
+  sesDestination({ to: ['rokoeman@example.com'], bcc: ['automated@example.org'] }),
+  { ToAddresses: ['rokoeman@example.com'], BccAddresses: ['automated@example.org'] },
+)
+assert.deepEqual(
+  sesDestination({ to: ['Robert <robert@example.com>'], cc: ['"Ops, Team" <ops@example.com>'] }),
+  { ToAddresses: ['robert@example.com'], CcAddresses: ['ops@example.com'] },
+  'display names stay in the headers; the envelope carries bare addresses',
+)
+assert.deepEqual(
+  sesDestination({ to: ['a@example.com'], cc: ['A@example.com'], bcc: ['a@example.com', 'b@example.com'] }),
+  { ToAddresses: ['a@example.com'], BccAddresses: ['b@example.com'] },
+  'an address named twice is delivered once',
+)
+assert.deepEqual(sesDestination({ to: ['a@example.com'] }), { ToAddresses: ['a@example.com'] })
+console.log('ok - ses envelope carries every recipient')

package/lib/ses-send.ts

@@ -7,15 +7,39 @@ export function sesConfigured(): boolean {
   return Boolean(process.env.SES_ACCESS_KEY_ID && process.env.SES_SECRET_ACCESS_KEY)
 }
 
+export type SesRecipients = { to: string[]; cc?: string[]; bcc?: string[] }
+
+const addressOnly = (entry: string): string => (entry.match(/<([^>]+)>/)?.[1] ?? entry).trim()
+
 /**
- * `blindCopies` are envelope recipients only. A Bcc header inside the MIME would be handed
- * to everyone the message reaches, so the address is named to SES instead of written down
- * where the recipient can read it.
+ * The envelope, spelled out in full. Once a raw message names any Destination, SES delivers
+ * to that list and nothing else — the To and Cc headers inside the MIME are not added to it —
+ * so naming only the blind copies sent the message to the blind copies alone. Bcc never goes
+ * in the MIME, where every recipient could read it; it lives here and only here.
  */
+export function sesDestination(recipients: SesRecipients) {
+  const seen = new Set<string>()
+  const take = (list: string[] | undefined) =>
+    (list ?? []).map(addressOnly).filter(address => {
+      const key = address.toLowerCase()
+      if (!address || seen.has(key)) return false
+      seen.add(key)
+      return true
+    })
+  const to = take(recipients.to)
+  const cc = take(recipients.cc)
+  const bcc = take(recipients.bcc)
+  return {
+    ...(to.length ? { ToAddresses: to } : {}),
+    ...(cc.length ? { CcAddresses: cc } : {}),
+    ...(bcc.length ? { BccAddresses: bcc } : {}),
+  }
+}
+
 export async function sesSendRaw(
   raw: string,
   region = process.env.AWS_SES_REGION ?? 'eu-north-1',
-  blindCopies: string[] = [],
+  recipients: SesRecipients,
 ): Promise<string | null> {
   const id = process.env.SES_ACCESS_KEY_ID
   const secret = process.env.SES_SECRET_ACCESS_KEY
@@ -25,7 +49,7 @@ export async function sesSendRaw(
   const path = '/v2/email/outbound-emails'
   const body = JSON.stringify({
     Content: { Raw: { Data: Buffer.from(raw, 'utf8').toString('base64') } },
-    ...(blindCopies.length ? { Destination: { BccAddresses: blindCopies } } : {}),
+    Destination: sesDestination(recipients),
   })
   const amzDate = new Date().toISOString().replace(/[:-]|\.\d{3}/g, '')
   const stamp = amzDate.slice(0, 8)

package/lib/sns.ts

@@ -0,0 +1,68 @@
+import { createPublicKey, createVerify } from 'node:crypto'
+
+export type SnsEnvelope = {
+  Type: string
+  MessageId?: string
+  TopicArn?: string
+  Subject?: string
+  Message?: string
+  Timestamp?: string
+  Token?: string
+  SubscribeURL?: string
+  SignatureVersion?: string
+  Signature?: string
+  SigningCertURL?: string
+}
+
+const SIGNED_FIELDS: Record<string, string[]> = {
+  Notification: ['Message', 'MessageId', 'Subject', 'Timestamp', 'TopicArn', 'Type'],
+  SubscriptionConfirmation: ['Message', 'MessageId', 'SubscribeURL', 'Timestamp', 'Token', 'TopicArn', 'Type'],
+  UnsubscribeConfirmation: ['Message', 'MessageId', 'SubscribeURL', 'Timestamp', 'Token', 'TopicArn', 'Type'],
+}
+
+/** A certificate from anywhere but AWS proves nothing about who signed the message. */
+export function awsSnsUrl(raw: string, suffix: string): boolean {
+  try {
+    const url = new URL(raw)
+    return url.protocol === 'https:' && url.pathname.endsWith(suffix) && /^sns\.[a-z0-9-]+\.amazonaws\.com$/.test(url.hostname)
+  } catch {
+    return false
+  }
+}
+
+const certCache = new Map<string, string>()
+
+async function fetchCert(url: string): Promise<string> {
+  const cached = certCache.get(url)
+  if (cached) return cached
+  const response = await fetch(url)
+  if (!response.ok) throw new Error(`certificate fetch failed (${response.status})`)
+  const pem = await response.text()
+  certCache.set(url, pem)
+  return pem
+}
+
+/**
+ * True only for a message AWS signed for `topicArn`. The topic is not optional: any AWS
+ * account can create a topic, subscribe this URL to it and send messages SNS signs
+ * perfectly well, so a valid signature alone says nothing about whose topic it came from.
+ */
+export async function verifySns(envelope: SnsEnvelope, topicArn: string | undefined): Promise<boolean> {
+  if (!topicArn || envelope.TopicArn !== topicArn) return false
+  if (!envelope.Signature || !envelope.SigningCertURL || !awsSnsUrl(envelope.SigningCertURL, '.pem')) return false
+  const fields = SIGNED_FIELDS[envelope.Type]
+  if (!fields) return false
+  let canonical = ''
+  for (const field of fields) {
+    const value = (envelope as Record<string, unknown>)[field]
+    if (value !== undefined && value !== null) canonical += `${field}\n${String(value)}\n`
+  }
+  try {
+    const verifier = createVerify(envelope.SignatureVersion === '2' ? 'RSA-SHA256' : 'RSA-SHA1')
+    verifier.update(canonical, 'utf8')
+    verifier.end()
+    return verifier.verify(createPublicKey(await fetchCert(envelope.SigningCertURL)), Buffer.from(envelope.Signature, 'base64'))
+  } catch {
+    return false
+  }
+}

package/lib/turso.ts

@@ -1,5 +1,5 @@
 /**
- * Turso (libSQL) over HTTP, exposing the same tagged-template shape the D1 client used
+ * Turso (libSQL) over HTTP, exposing a tagged-template shape
  * so every call site in `mailbox.ts` reads unchanged. libSQL is SQLite, so the schema
  * and its `ON CONFLICT` clauses port without translation.
  *
@@ -45,7 +45,7 @@ export function turso(): SqlTag {
 }
 
 /**
- * Run several statements as one transaction. The D1 client could only loop, so a
+ * Run several statements as one transaction. A plain loop cannot roll back, so a
  * half-applied schema was possible; libSQL gives us the real thing.
  */
 export async function tursoBatch(statements: string[]): Promise<void> {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@novacraft-engineering/mailbox",
-  "version": "0.4.23",
+  "version": "0.4.25",
   "description": "A shared webmail app: one codebase, one deployment per mailbox. Threads, a rich composer with signatures, attachments on S3-compatible storage, sharing links, full-text search, web push and PWA install.",
   "keywords": [
     "webmail",

package/lib/d1.ts

@@ -1,64 +0,0 @@
-/**
- * Cloudflare D1 over the REST API, shaped like the `neon()` tagged-template client so
- * query call sites read the same. The app runs on Vercel, so there is no Worker binding
- * available — every statement is an HTTPS round-trip to Cloudflare.
- */
-
-type Param = string | number | null
-export type D1Sql = (strings: TemplateStringsArray, ...values: unknown[]) => Promise<Record<string, unknown>[]>
-
-const API = 'https://api.cloudflare.com/client/v4'
-
-function config() {
-  const accountId = process.env.CLOUDFLARE_ACCOUNT_ID
-  const databaseId = process.env.D1_DATABASE_ID
-  const token = process.env.CLOUDFLARE_D1_TOKEN
-  if (!accountId || !databaseId || !token) {
-    throw new Error('CLOUDFLARE_ACCOUNT_ID, D1_DATABASE_ID and CLOUDFLARE_D1_TOKEN must be configured')
-  }
-  return { accountId, databaseId, token }
-}
-
-/** SQLite has no boolean or object types — normalise before binding. */
-function toParam(value: unknown): Param {
-  if (value === undefined || value === null) return null
-  if (typeof value === 'boolean') return value ? 1 : 0
-  if (typeof value === 'number') return value
-  if (value instanceof Date) return value.toISOString()
-  if (typeof value === 'object') return JSON.stringify(value)
-  return String(value)
-}
-
-export async function d1Query(sql: string, params: unknown[] = []): Promise<Record<string, unknown>[]> {
-  const { accountId, databaseId, token } = config()
-  const response = await fetch(`${API}/accounts/${accountId}/d1/database/${databaseId}/query`, {
-    method: 'POST',
-    headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json' },
-    body: JSON.stringify({ sql, params: params.map(toParam) }),
-  })
-  const payload = (await response.json()) as {
-    success?: boolean
-    errors?: Array<{ message?: string }>
-    result?: Array<{ results?: Record<string, unknown>[]; success?: boolean; error?: string }>
-  }
-  if (!response.ok || !payload.success) {
-    const detail = payload.errors?.map(entry => entry.message).filter(Boolean).join('; ') || `HTTP ${response.status}`
-    throw new Error(`D1 query failed: ${detail}`)
-  }
-  const first = payload.result?.[0]
-  if (first?.error) throw new Error(`D1 query failed: ${first.error}`)
-  return first?.results ?? []
-}
-
-/** Tagged-template entry point: interpolations become bound `?` parameters. */
-export function d1(): D1Sql {
-  return (strings, ...values) => d1Query(strings.raw.join('?'), values)
-}
-
-/** Run several statements in order — used for schema setup. */
-export async function d1Batch(statements: string[]): Promise<void> {
-  for (const statement of statements) {
-    const trimmed = statement.trim()
-    if (trimmed) await d1Query(trimmed)
-  }
-}