Merge branch 'claude/webmail-offline-replica' into 'dev'

feat(electron): real offline mail replica — delta sync, full bodies, retention

See merge request gitlab-instance-b9b5cf2f/vncmail-plus!6

app/(main)/[locale]/page.tsx

@@ -1080,6 +1080,21 @@ export default function Home() {
         } catch {
           /* the index is optional */
         }
+        // The offline REPLICA's launch catch-up. Same reasoning as the index's,
+        // plus one of its own: a `/changes` cursor cannot tell us about anything
+        // that happened while the process was dead, so a cycle at launch is what
+        // drains the backlog. One cycle is bounded, so a first sync of a large
+        // mailbox needs several - `chainSync` runs them with a hard cap.
+        //
+        // Sequenced AFTER the index rather than in parallel: both write the same
+        // SQLite file, and although `busy_timeout` makes concurrent writers safe,
+        // there is no reason to spend the contention during first paint.
+        try {
+          const { chainSync } = await import('@/lib/offline-replica-client');
+          await chainSync({ slot: useAccountStore.getState().getActiveAccount()?.cookieSlot });
+        } catch {
+          /* the replica is optional */
+        }
       })();
       // Deliberately after the initial mailbox fetch settles: the catch-up is a
       // background nicety and must not compete with first paint.

app/api/offline/mail/route.ts

@@ -0,0 +1,87 @@
+// GET /api/offline/mail?kind=mailboxes|list|message - the OFFLINE READ SURFACE.
+//
+// THIS ROUTE MUST NEVER MAKE A NETWORK CALL. That is the whole feature: it is
+// consulted precisely when the backend is unreachable, so a JMAP session fetch to
+// learn the account id would fail for the exact reason the route was called. The
+// account is resolved from the request's own encrypted `jmap_stalwart_ctx` cookie
+// (a local decrypt) and from the account ids the store already holds rows for.
+//
+// It is a FALLBACK, not a cache in front of the server - see `read.ts`'s header
+// for the coherence rules that depend on that, and `lib/offline-fallback-client.ts`
+// for the one place that decides a read has genuinely failed.
+import { NextRequest, NextResponse } from 'next/server';
+import {
+  readEnvelopePage, readMailboxes, readMessage,
+} from '@/lib/offline-replica/read';
+import {
+  resolveIndexSession, resolveReadAccountId, withReplica,
+} from '@/lib/offline-replica/engine';
+import { gateReplicaRoute, NO_STORE, replicaErrorResponse } from '@/lib/offline-replica/route-gate';
+
+export const runtime = 'nodejs';
+export const dynamic = 'force-dynamic';
+
+const MAX_LIMIT = 200;
+
+export async function GET(request: NextRequest) {
+  const gated = gateReplicaRoute();
+  if (gated) return gated;
+
+  const params = request.nextUrl.searchParams;
+  const kind = params.get('kind') ?? 'mailboxes';
+  if (kind !== 'mailboxes' && kind !== 'list' && kind !== 'message') {
+    return NextResponse.json({ error: 'kind must be mailboxes, list or message' }, { status: 400 });
+  }
+
+  try {
+    const session = await resolveIndexSession(request);
+    const payload = await withReplica(session.accountId, (store) => {
+      const jmapAccountId = resolveReadAccountId(store, params.get('jmapAccountId'));
+      if (!jmapAccountId) {
+        // Nothing synced yet for this account. Not an error - the caller falls
+        // back to whatever it would have shown without a replica.
+        return { empty: true as const };
+      }
+
+      if (kind === 'mailboxes') {
+        return { empty: false as const, jmapAccountId, mailboxes: readMailboxes(store, jmapAccountId) };
+      }
+
+      if (kind === 'list') {
+        const rawLimit = Number(params.get('limit') ?? '50');
+        const limit = Number.isFinite(rawLimit)
+          ? Math.min(Math.max(Math.trunc(rawLimit), 1), MAX_LIMIT)
+          : 50;
+        const rawOffset = Number(params.get('offset') ?? '0');
+        const offset = Number.isFinite(rawOffset) ? Math.max(Math.trunc(rawOffset), 0) : 0;
+        // An absent mailboxId means "everything", which is what the unified views
+        // ask for; an empty string is a caller bug and must not silently widen.
+        const mailboxParam = params.get('mailboxId');
+        const mailboxId = mailboxParam === null ? null : mailboxParam;
+        if (mailboxId === '') {
+          return { empty: true as const };
+        }
+        const page = readEnvelopePage(store, jmapAccountId, mailboxId, limit, offset);
+        return { empty: false as const, jmapAccountId, ...page };
+      }
+
+      const id = params.get('id');
+      if (!id || id.length > 256) return { empty: true as const };
+      const message = readMessage(store, jmapAccountId, id);
+      if (!message) return { empty: false as const, jmapAccountId, email: null, hasBody: false };
+      return {
+        empty: false as const,
+        jmapAccountId,
+        email: message.email,
+        hasBody: message.hasBody,
+      };
+    });
+
+    if (payload.empty) {
+      return NextResponse.json({ ok: true, available: false }, { headers: NO_STORE });
+    }
+    return NextResponse.json({ ok: true, available: true, ...payload }, { headers: NO_STORE });
+  } catch (error) {
+    return replicaErrorResponse(error, 'offline read');
+  }
+}

app/api/offline/status/route.ts

@@ -0,0 +1,104 @@
+// GET    /api/offline/status - size, freshness and retention policy, for Settings.
+// PUT    /api/offline/status - update the retention policy.
+// DELETE /api/offline/status - purge the replica.
+//
+// The POLICY LIVES IN THE ENCRYPTED STORE, not in renderer localStorage. The
+// design review's H1 was that a server-side engine cannot read a renderer-only
+// setting; keeping the policy server-side means the retention pass always has the
+// value it needs, while the DECISION TO SYNC AT ALL stays with the renderer, so
+// nothing is ever materialised for an account that never opted in.
+//
+// Like every read here, GET makes no network call: an offline user must still be
+// able to see what they have and free the space.
+import { NextRequest, NextResponse } from 'next/server';
+import { clampPolicy, POLICY_LIMITS, type RetentionPolicy } from '@/lib/offline-replica/store';
+import { resolveIndexSession, resolveReadAccountId, withReplica } from '@/lib/offline-replica/engine';
+import { gateReplicaRoute, NO_STORE, replicaErrorResponse } from '@/lib/offline-replica/route-gate';
+
+export const runtime = 'nodejs';
+export const dynamic = 'force-dynamic';
+
+export async function GET(request: NextRequest) {
+  const gated = gateReplicaRoute();
+  if (gated) return gated;
+  try {
+    const session = await resolveIndexSession(request);
+    const payload = await withReplica(session.accountId, (store) => {
+      const jmapAccountId = resolveReadAccountId(store, null);
+      const policy = store.getPolicy();
+      const flags = store.getFlags(Date.now());
+      if (!jmapAccountId) {
+        return {
+          policy,
+          limits: POLICY_LIMITS,
+          synced: false,
+          stats: null,
+          coveragePhase: 'never-run',
+          resyncRequired: flags.resyncRequired,
+          lastCycleAt: flags.lastCycleAt ?? null,
+          lastCycleOk: flags.lastCycleOk ?? null,
+        };
+      }
+      return {
+        policy,
+        limits: POLICY_LIMITS,
+        synced: true,
+        stats: store.stats(jmapAccountId),
+        coveragePhase: store.getCoverage(jmapAccountId)?.phase ?? 'never-run',
+        coveredFrom: store.getCoverage(jmapAccountId)?.coveredFrom ?? null,
+        resyncRequired: flags.resyncRequired,
+        lastCycleAt: flags.lastCycleAt ?? null,
+        lastCycleOk: flags.lastCycleOk ?? null,
+        lastCycleError: flags.lastCycleError ?? null,
+      };
+    });
+    return NextResponse.json({ ok: true, ...payload }, { headers: NO_STORE });
+  } catch (error) {
+    return replicaErrorResponse(error, 'offline status');
+  }
+}
+
+export async function PUT(request: NextRequest) {
+  const gated = gateReplicaRoute();
+  if (gated) return gated;
+
+  let body: Record<string, unknown> = {};
+  try {
+    const text = await request.text();
+    if (text.trim()) body = JSON.parse(text) as Record<string, unknown>;
+  } catch {
+    return NextResponse.json({ error: 'Malformed JSON body' }, { status: 400 });
+  }
+
+  const policy = clampPolicy(body as Partial<RetentionPolicy>);
+  try {
+    const session = await resolveIndexSession(request);
+    await withReplica(session.accountId, (store) => {
+      store.transaction(() => { store.setPolicy(policy); });
+    });
+    // The cycle applies it: a widen re-enters coverage scanning, a narrow evicts,
+    // and the clock guard is told this was INTENT rather than a glitch by the
+    // `lastEnvelopeDays` it compares against.
+    return NextResponse.json({ ok: true, policy }, { headers: NO_STORE });
+  } catch (error) {
+    return replicaErrorResponse(error, 'offline policy update');
+  }
+}
+
+export async function DELETE(request: NextRequest) {
+  const gated = gateReplicaRoute();
+  if (gated) return gated;
+  try {
+    const session = await resolveIndexSession(request);
+    await withReplica(session.accountId, (store) => {
+      // ALL OF IT, cursors included. A record wipe that leaves cursors behind is
+      // the one state no amount of syncing repairs: `/changes` structurally cannot
+      // re-deliver mail that already existed when the cursor was captured, so the
+      // next cycle would advance a live cursor over an empty store forever.
+      store.transaction(() => { store.purgeAll(); });
+    });
+    return NextResponse.json({ ok: true, purged: true }, { headers: NO_STORE });
+  } catch (error) {
+    return replicaErrorResponse(error, 'offline purge');
+  }
+}

app/api/offline/sync/route.ts

@@ -0,0 +1,49 @@
+// POST /api/offline/sync - run ONE bounded delta-sync cycle for the calling
+// session's account.
+//
+// The renderer drives this: once at launch (catch-up for whatever changed while
+// the app was closed, for which no push event was ever delivered) and on each
+// JMAP `StateChange` from the live push connection. There is no background worker
+// and no resident credential - see `lib/offline-replica/sync.ts`'s header for why
+// that architecture choice keeps most of the original design review's critical
+// findings out of scope entirely.
+//
+// A cycle is BOUNDED. `unfinishedWork: true` means "call again", and the renderer
+// chains with a cap; it never means an error.
+import { NextRequest, NextResponse } from 'next/server';
+import { clampPolicy, type RetentionPolicy } from '@/lib/offline-replica/store';
+import { resolveIndexSession, syncAccount } from '@/lib/offline-replica/engine';
+import { gateReplicaRoute, NO_STORE, replicaErrorResponse } from '@/lib/offline-replica/route-gate';
+
+export const runtime = 'nodejs';
+export const dynamic = 'force-dynamic';
+
+export async function POST(request: NextRequest) {
+  const gated = gateReplicaRoute();
+  if (gated) return gated;
+
+  let body: Record<string, unknown> = {};
+  try {
+    const text = await request.text();
+    if (text.trim()) body = JSON.parse(text) as Record<string, unknown>;
+  } catch {
+    return NextResponse.json({ error: 'Malformed JSON body' }, { status: 400 });
+  }
+
+  const rawPolicy = body.policy;
+  const policy: RetentionPolicy | undefined =
+    rawPolicy && typeof rawPolicy === 'object' && !Array.isArray(rawPolicy)
+      ? clampPolicy(rawPolicy as Partial<RetentionPolicy>)
+      : undefined;
+
+  try {
+    const session = await resolveIndexSession(request);
+    const report = await syncAccount(session, {
+      policy,
+      forceResync: body.forceResync === true,
+    });
+    return NextResponse.json({ ok: report.ok, report }, { headers: NO_STORE });
+  } catch (error) {
+    return replicaErrorResponse(error, 'sync');
+  }
+}