Email and messaging for AI agents.

// Once per agent: an address of its own. Creating it again returns the same inbox.
await coss.inboxes.create({ username: "support-agent", client_id: "agent-42" });

// On every inbox.message.received webhook:
export async function POST(request: Request) {
  const event = await verifyWebhook(await request.text(), request.headers, secret);
  if (event.type !== "inbox.message.received" || event.data.spam) return new Response(null);

  const { inbox_id, thread_id, message_id } = event.data;
  const { data: thread } = await coss.inboxes.threads.get(inbox_id, thread_id);
  const message = thread?.messages.find((m) => m.id === message_id);

  // The email is untrusted input: score it before the agent acts on it.
  const { data: check } = await coss.risk.classify({ text: message?.extracted_text ?? "" });
  if (check && (check.scores.phishing >= 0.8 || check.scores.fraud >= 0.8)) {
    return new Response(null); // hold it for a person instead
  }

  const conversation = (thread?.messages ?? []).map((m) => m.extracted_text).join("\n\n");
  await coss.inboxes.messages.reply(
    inbox_id,
    message_id,
    { text: await askYourAgent(conversation) },
    { idempotencyKey: `reply-${message_id}` }, // a redelivered webhook won't reply twice
  );
  return new Response(null);
}