diff --git a/app/api/mailboxes/[email]/route.ts b/app/api/mailboxes/[email]/route.ts
index 2fe3c9b..e925935 100644
--- a/app/api/mailboxes/[email]/route.ts
+++ b/app/api/mailboxes/[email]/route.ts
@@ -3,8 +3,8 @@ import { auth } from "@/auth";
 import { deleteMailbox, editMailbox, getMailboxes } from "@/lib/mailcow";
 import { canAccessDomain } from "@/lib/users";
 
-async function checkAccess(session: Awaited<ReturnType<typeof auth>>, email: string) {
-  if (!session) return false;
+async function checkAccess(session: any, email: string) {
+  if (!session?.user) return false;
   const domain = email.split("@")[1];
   return canAccessDomain(session.user.domains ?? [], domain);
 }
diff --git a/lib/imap.ts b/lib/imap.ts
index c988a30..f57864f 100644
--- a/lib/imap.ts
+++ b/lib/imap.ts
@@ -136,7 +136,7 @@ export async function listMessages(
   try {
     const lock = await client.getMailboxLock(folder);
     try {
-      const total = client.mailbox?.exists ?? 0;
+      const total = (client.mailbox && typeof client.mailbox !== "boolean" && client.mailbox.exists) ? client.mailbox.exists : 0;
       if (total === 0) return { messages: [], total: 0 };
 
       // Newest first: fetch from end
@@ -155,6 +155,7 @@ export async function listMessages(
         size: true,
       })) {
         const env = msg.envelope;
+        if (!env) continue;
         messages.push({
           uid: msg.uid,
           seq: msg.seq,
@@ -300,7 +301,7 @@ export async function deleteMessage(
       // If already in Trash, permanently delete
       if (folder.toLowerCase().includes("trash")) {
         await client.messageFlagsAdd(String(uid), ["\\Deleted"], { uid: true });
-        await client.expunge();
+        // Message flagged as deleted; will be expunged when mailbox is closed
       } else {
         // Move to Trash
         await client.messageMove(String(uid), "Trash", { uid: true });