Add scan large emails API (iteration 6)

.env.example

@@ -0,0 +1,5 @@
+# Generate with: npx auth secret
+AUTH_SECRET=
+# Google OAuth2 from Google Cloud Console
+AUTH_GOOGLE_ID=
+AUTH_GOOGLE_SECRET=

.gitignore

@@ -0,0 +1,42 @@
+# See https://help.github.com/articles/ignoring-files/ for more about ignoring files.
+
+# dependencies
+/node_modules
+/.pnp
+.pnp.*
+.yarn/*
+!.yarn/patches
+!.yarn/plugins
+!.yarn/releases
+!.yarn/versions
+
+# testing
+/coverage
+
+# next.js
+/.next/
+/out/
+
+# production
+/build
+
+# misc
+.DS_Store
+*.pem
+
+# debug
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+.pnpm-debug.log*
+
+# env files (can opt-in for committing if needed)
+.env*
+!.env.example
+
+# vercel
+.vercel
+
+# typescript
+*.tsbuildinfo
+next-env.d.ts

.husky/pre-commit

@@ -0,0 +1 @@
+pnpm exec lint-staged

.prettierignore

@@ -0,0 +1,3 @@
+.next
+node_modules
+pnpm-lock.yaml

.prettierrc

@@ -0,0 +1,7 @@
+{
+  "singleQuote": true,
+  "semi": true,
+  "trailingComma": "all",
+  "printWidth": 80,
+  "tabWidth": 2
+}

CLAUDE.md

@@ -82,12 +82,37 @@ pnpm test:e2e     # Run Playwright E2E tests
 ## Testing Strategy
 
 ```
-Domain       → Unit tests (pure logic, no mocks)
-Application  → Unit tests (mock repository/port interfaces)
-Infrastructure → Integration tests (real DB)
-Presentation → E2E tests (Playwright)
+Application    → Unit tests (mock ports/repos — this is the PRIMARY test layer)
+Domain         → Unit tests ONLY for value objects and domain services
+                 Skip if already covered by application-layer tests
+Infrastructure → Integration tests ONLY (request params, response shape, connectivity)
+                 Do NOT duplicate use-case logic — test the adapter, not the business rules
+Presentation   → E2E tests (Playwright)
 ```
 
+### Testing Rules
+
+- **Application layer is the main test surface** — all use-case logic is tested here with mocked ports
+- **Avoid duplicate tests** — if a domain entity behavior is exercised by a use-case test, don't add a separate domain test
+- **Domain tests are reserved for** value objects (validation, equality) and domain services (pure logic not invoked by a single use case)
+- **Infrastructure tests verify integration only** — correct HTTP params sent, responses parsed, DB queries run, app boots. Never re-test use-case branches
+- **No third-party calls in application tests** — mock all ports (DB, Gmail, etc.)
+- **Infrastructure integration tests hit the real external service** — use test containers or sandbox APIs
+
+## Iteration Completion Checklist
+
+After implementing each iteration, you MUST complete every step below before committing:
+
+1. `pnpm test` — all tests pass
+2. `pnpm lint` — zero errors
+3. `pnpm format` — formatting applied
+4. **Browser smoke test using the Chrome extension:**
+   - Start `pnpm dev` if not already running
+   - Use `mcp__claude-in-chrome__*` tools to verify **every "Done when" criterion** from the iteration plan in the actual running app
+   - Each criterion must be tested explicitly — navigate to the relevant URL, interact with the UI, assert the outcome
+   - Record a GIF of the full smoke test using `mcp__claude-in-chrome__gif_creator`
+5. Commit only after all of the above pass
+
 ## Iteration Plan
 
 22 micro-iterations defined in `docs/PRD.md`. Current status: **Pre-iteration 1** (project not yet initialized).

README.md

@@ -0,0 +1,76 @@
+# Clean Gmail
+
+Web app that connects to your Gmail account, analyzes your emails, and recommends which ones to delete to free up storage space.
+
+## Problem
+
+Gmail accounts accumulate years of emails — newsletters, promotions, large attachments — silently eating into Google storage. Clean Gmail helps you identify and remove what you don't need.
+
+## Features (Planned)
+
+- Sign in with Google OAuth 2.0
+- Scan for large emails, promotions, social notifications, and old emails
+- Dashboard with cleanup recommendations ranked by impact
+- Select and bulk-trash emails with undo support
+- Top senders report
+- Export results as JSON/CSV
+- Whitelist senders to protect from deletion suggestions
+
+## Tech Stack
+
+- **Framework:** Next.js 16.1 (App Router)
+- **Language:** TypeScript 5.x (strict mode)
+- **Database:** PostgreSQL 16.x + Prisma 6.x
+- **Auth:** NextAuth.js v5 (Google OAuth 2.0)
+- **Styling:** Tailwind CSS 4.x + DaisyUI 5.x
+- **Testing:** Vitest + Playwright
+
+## Architecture
+
+Built with Clean Architecture, DDD, and SOLID principles:
+
+```
+src/
+├── domain/           # Business rules, entities, ports (zero external deps)
+├── application/      # Use cases, DTOs
+├── infrastructure/   # Gmail API adapter, Prisma repos, auth config
+├── presentation/     # Next.js pages, components, hooks
+└── shared/           # Cross-cutting types and utils
+```
+
+## Getting Started
+
+```bash
+# Install dependencies
+pnpm install
+
+# Set up environment variables
+cp .env.example .env
+
+# Run database migrations
+pnpm prisma migrate dev
+
+# Start dev server
+pnpm dev
+```
+
+## Development
+
+```bash
+pnpm dev          # Start dev server
+pnpm build        # Production build
+pnpm lint         # ESLint check
+pnpm format       # Prettier format
+pnpm test         # Run unit/integration tests
+pnpm test:e2e     # Run E2E tests
+```
+
+## Docs
+
+- [PRD & Iteration Plan](docs/PRD.md)
+- [Tech Stack](docs/TECH_STACK.md)
+- [Definition of Done](docs/DEFINITION_OF_DONE.md)
+
+## License
+
+MIT

docs/DEFINITION_OF_DONE.md

@@ -30,10 +30,13 @@ Every iteration is considered **done** only when ALL applicable criteria below a
 
 ## Testing
 
-- [ ] **Domain layer** — Unit tests with Vitest (no mocks, pure logic)
-- [ ] **Application layer** — Unit tests with Vitest (mock repository/port interfaces)
-- [ ] **Infrastructure layer** — Integration tests with Vitest (real DB when applicable)
+- [ ] **Application layer** — Unit tests with Vitest (mock ports/repos) — all use-case logic tested here
+- [ ] **Domain layer** — Unit tests ONLY for new value objects or domain services not already covered by application tests
+- [ ] **Infrastructure layer** — Integration tests ONLY for adapter concerns (request params, response parsing, connectivity) — do NOT duplicate use-case logic
 - [ ] **Presentation layer** — E2E tests with Playwright for new user-facing flows
+- [ ] No duplicate tests across layers
+- [ ] Application tests mock all external dependencies (no real DB or third-party calls)
+- [ ] Infrastructure integration tests hit real services (test containers / sandbox APIs)
 - [ ] All tests pass (`pnpm test`)
 - [ ] Coverage does not decrease from previous iteration
 
@@ -72,6 +75,10 @@ Every iteration is considered **done** only when ALL applicable criteria below a
 - [ ] New domain entities/value objects have JSDoc on public methods
 - [ ] New API routes have input/output types documented via TypeScript types
 - [ ] Breaking changes to existing interfaces are noted in the PR description
+- [ ] `CLAUDE.md` updated if architecture, commands, rules, or tech stack changed
+- [ ] `README.md` updated if features, setup steps, or project overview changed
+- [ ] `docs/PRD.md` iteration status updated if an iteration was completed
+- [ ] `docs/TECH_STACK.md` updated if dependencies or architecture decisions changed
 
 ---