@bobfrankston/mailx-settings 0.1.14 → 0.1.16

package/docs/accounts.md

@@ -11,6 +11,11 @@
 ```jsonc
 {
   "name": "Bob Frankston",         // optional; default name applied to every account that doesn't override
+  "sig": {                         // optional; file-level signature applied to every account that doesn't override
+    "text": "—\nBob Frankston\nbob@example.com",
+    "html": false
+  },
+  "signature": "<p>—<br>Bob Frankston</p>",  // optional; file-level legacy-form fallback (used if account has no `sig`/`signature`)
   "accounts": [
     {
       "id": "gmail",                // short tag used in folder paths and the UI
@@ -19,7 +24,13 @@
       "imap": { "host": "imap.example.com", "port": 993, "tls": true, "auth": "password" },
       "smtp": { "host": "smtp.example.com", "port": 465, "tls": true, "auth": "password" },
       "enabled": true,              // false skips this account at startup
-      "identityDomains": ["alias.com"]  // extra domains for Reply-From auto-detect
+      "identityDomains": ["alias.com"],  // extra domains for Reply-From auto-detect
+      "sig": {                      // signature appended to NEW messages only (not replies/forwards)
+        "text": "—\nBob Frankston\nbob@example.com",  // \n becomes <br>; HTML-escaped
+        "html": false               // reserved; leave false (true would trust `text` as raw HTML)
+      },
+      "signature": "<p>—<br>Bob Frankston</p>"  // alternative form: HTML string,
+                                                // applied to new + reply + forward
     }
   ],
   "keys": {                         // AI provider API keys (optional)
@@ -37,6 +48,8 @@
 - **auth** — `"password"` for traditional IMAP/SMTP, `"oauth2"` for Gmail/Google Workspace/Outlook.
 - **enabled** — set `false` to keep the account record but skip sync at startup.
 - **identityDomains** — addresses you receive at on alternative domains. When you Reply, rmfmail picks the matching identity address as From instead of the account's primary.
+- **sig** — per-account signature for *new* messages (skipped on reply / forward / draft-resume). `text` is the plain-text body, HTML-escaped at insertion with `\n` → `<br>`. The optional `html` flag is reserved for "trust as raw HTML"; leave it `false` (or omit) for now. Specify either `sig` or `signature`, not both — `sig` wins if both are present and the message is new. May also be specified at the **file level** (alongside `name`) to apply across every account that doesn't define its own; per-account always wins over file-level.
+- **signature** — legacy alternative: an HTML string applied to *new + reply + forward* (positioned before the quote on replies, at the end for new messages). Useful when you want the signature on every outgoing message regardless of context. Also supported at the **file level** as a global fallback.
 - **keys.anthropic / keys.openai** — API keys for the AI features (translate / proofread / summarize / autocomplete). Lives at the file's top level alongside `accounts:` so you set it once across all your devices. Generated at console.anthropic.com or platform.openai.com. Provider selection is in `preferences.jsonc`; the key here is read based on which provider is active. Empty string means "not configured" — the AI feature silently no-ops. Local Ollama provider needs no key.
 
 ## Notes

package/docs/npmglobalize-disttag.md

@@ -0,0 +1,90 @@
+# npmglobalize — `--dist-tag` flag plumbing
+
+Purpose: let callers pass `--tag <name>` through to `npm publish` so a release can land on a non-`latest` dist-tag without modifying `package.json`. Required by `mailx`'s prod/dev workflow (`docs/prod.md`); benign for every other consumer (default behavior unchanged).
+
+## File
+
+`/c/users/bob/onedrive/xfer/bin/linuxbin/node_modules/@bobfrankston/npmglobalize/lib.js`
+
+(Or wherever the maintained source lives — this file is the deployed copy. Edit the source repo instead and rebuild if there's one.)
+
+## Step 1 — argv parsing
+
+Near the top of the script where other CLI flags are read, accept `--dist-tag` (and an alias `--tag`) followed by a tag name. Skip the value for the rest of argv processing.
+
+```js
+let distTag = "";
+{
+    const idx = process.argv.findIndex(a => a === "--dist-tag" || a === "--tag");
+    if (idx !== -1) {
+        distTag = process.argv[idx + 1] || "";
+        if (!distTag || distTag.startsWith("-")) {
+            console.error("npmglobalize: --dist-tag requires a tag name");
+            process.exit(1);
+        }
+        process.argv.splice(idx, 2);
+    }
+}
+```
+
+If npmglobalize already centralizes argv parsing (e.g. via minimist or a custom routine), insert the same logic in that path instead. Either way: extract once, store in a module-scope variable, strip from argv so downstream code doesn't see it.
+
+## Step 2 — forward to `npm publish`
+
+Around line 4486:
+
+```js
+const npmArgs = ['publish', tarballName];
+```
+
+Change to:
+
+```js
+const npmArgs = ['publish', tarballName];
+if (distTag) npmArgs.push('--tag', distTag);
+```
+
+That's the entire publish-side change. When `distTag` is empty (the default), `npmArgs` is identical to before.
+
+## Step 3 — log line
+
+Where the script announces "Publishing X@Y to npm…", include the tag if present:
+
+```js
+console.log(`Publishing ${name}@${version} to npm${distTag ? ` (tag ${distTag})` : ""}…`);
+```
+
+Helps the rebuild-cmd output show clearly that the publish landed on `dev` and not `latest`.
+
+## Step 4 — verify
+
+```bash
+# In a workspace whose package.json is publishable:
+npmglobalize --dist-tag dev
+npm view @bobfrankston/<package> dist-tags
+# Expect: { latest: '<previous>', dev: '<just-published>' }
+```
+
+Run again without the flag:
+
+```bash
+npmglobalize
+npm view @bobfrankston/<package> dist-tags
+# Expect: { latest: '<just-published>', dev: '<earlier>' }
+```
+
+If the second run accidentally bumped `dev` instead of `latest`, the argv strip in Step 1 didn't run.
+
+## Step 5 — release npmglobalize itself
+
+If npmglobalize is installed via npm (it is — `@bobfrankston/npmglobalize`), bump its own version, publish, then `npm install -g @bobfrankston/npmglobalize` on every machine that uses it. Otherwise the new flag is only present on the machine you edited.
+
+## What this does NOT change
+
+- Default publish target stays `@latest` — every existing caller of `npmglobalize` keeps working.
+- No effect on version bumping, git-tag pushing, build orchestration, or the `package.json` `dependencies` rewrite. The flag only adds to the final `npm publish` invocation.
+- Does not replace existing scripts that read npm dist-tags. dist-tags are managed in two ways now: (a) at publish time via `--tag`, (b) post-publish via `npm dist-tag add/rm`. Step 2 above only adds (a).
+
+## Effort estimate
+
+5 lines of code + a log-line tweak + a publish of npmglobalize. Maybe 15 minutes wall-clock including the verification steps.

package/docs/prod-android.md

@@ -0,0 +1,88 @@
+# prod / dev release workflow — Android (MAUI APK)
+
+Status: design only. Same intent as `prod.md` (npm side); the APK is a complete, self-contained binary so the unit of promotion is a *file*, not a dependency or dist-tag.
+
+## Simpler approach (Bob 2026-05-09)
+
+No separate MAUI project. Same source tree produces both flavors; the difference is purely in the OUTPUT filename, and "what's currently prod" is decided by which file lives at the canonical prod URL.
+
+### Today
+
+- One build target: `mailx-maui.apk` at `https://rmf39.aaz.lt/mailx/mailx-maui.apk`.
+- `versions.json` carries the version string; updater compares to running.
+- Every build overwrites the single APK. No history, no channels.
+
+### Phase 1 — start producing dev.apk too
+
+While there's no formal "production release" yet, every build produces:
+
+- `rmfmaildev.apk` (or `dev.apk`) — the just-built, latest dev tip. Updater on dev devices points here.
+- `mailx-maui.apk` — unchanged for now (current production behavior). Updater on prod devices points here.
+
+The build script writes both. Same APK contents initially — the dual output is just renamed copies. Devices on different channels read different filenames.
+
+### Phase 2 — once a release is declared
+
+Build outputs:
+
+- `rmfmaildev.apk` — every build. Always the freshest.
+- `rmfmail-<version>.apk` — versioned filename, never overwritten. One file per build.
+
+"Promoting" a known-good dev build to production = `cp rmfmail-1.0.NNN.apk rmfmail.apk` (or web-server-side: update a redirect / symlink / manifest pointer at `rmfmail.apk` to name the chosen versioned file).
+
+The canonical URLs:
+
+```
+https://rmf39.aaz.lt/mailx/rmfmail.apk           ← prod pointer (chosen versioned APK)
+https://rmf39.aaz.lt/mailx/rmfmaildev.apk        ← latest dev build
+https://rmf39.aaz.lt/mailx/rmfmail-1.0.NNN.apk   ← every released version, immutable
+```
+
+Roll back = re-point `rmfmail.apk` to a prior versioned APK.
+
+## What changes from the current build
+
+`build-apk.cmd` / `build-apk.ts`:
+
+- Read version from `package.json` (already does).
+- Build APK once.
+- Phase 1: write to `rmfmaildev.apk` AND `mailx-maui.apk` (mirror).
+- Phase 2: write to `rmfmail-<version>.apk` (versioned, never overwritten) AND `rmfmaildev.apk` (latest dev mirror).
+- Sync to web root.
+
+Promotion script (`prod-android.ps1`?) — Phase 2 only:
+
+- Take a version arg (or default to current dev build).
+- Copy / point `rmfmail.apk` at that version's APK.
+- Update `versions.json` so the updater on prod devices sees a newer version available.
+
+`AppUpdater.cs` — channel awareness:
+
+- Reads from configurable URL based on channel setting.
+- Default: prod URL (`rmfmail.apk` / corresponding `versions.json`).
+- Dev mode: dev URL.
+- Channel toggle in Settings (or build-time constant in a separate flavor — but per Bob's preference, NO separate MAUI project; channel is a runtime setting).
+
+## What this does NOT need
+
+- **No separate MAUI project**. The APK is the same binary regardless of which channel it serves; users with the dev URL configured get latest builds, users with the prod URL get whatever was last promoted. Source tree is single.
+- **No dist-tag analog**. The "tag" is just the filename / URL the updater polls.
+- **No flavor build**. Same package id, same signing key, same APK bytes — just two distribution endpoints (or, with Phase 2, two distinct files referenced from the manifests).
+
+## Coexistence on a single device
+
+Single MAUI project means a single Android package id. Two builds CAN'T be installed side-by-side without diverging package ids (Android refuses). If side-by-side becomes a real need later, reintroduce the separate-MAUI-project idea — but that's the orthogonal "I want both versions on the same phone" design, not the prod/dev release flow.
+
+## Order
+
+1. **Phase 1 first**: build script outputs `rmfmaildev.apk` alongside today's `mailx-maui.apk`. Zero behavior change for prod users; dev users (on the dev channel) get latest. ~10 lines in `build-apk.ts`.
+2. **AppUpdater channel toggle**: Settings checkbox + persisted preference + URL switch. ~50 lines.
+3. **Phase 2 when ready**: switch to versioned filenames + `rmfmail.apk` pointer + promotion script. Done when there's a real first "production release" to designate.
+
+## Effort
+
+- Phase 1: ~30 minutes (build script + manifest output).
+- AppUpdater channel: ~1 hour (Settings UI + storage + URL plumbing).
+- Phase 2: ~1 hour when activated (promotion script + versioned filenames + pointer mechanism on web root).
+
+Total ~2.5 hours wall-clock when fully wired. Phase 1 alone gets you the "always-have-a-fresh-dev-build" benefit without any commitment to the formal release flow.

package/docs/prod.md

@@ -0,0 +1,224 @@
+# prod / dev release workflow
+
+Status: design. Two viable approaches; pick one. Both deliver the same shape:
+
+- `rebuild.cmd` publishes builds without affecting what casual users get.
+- A separate `prod.cmd` step promotes a known-good build to be what casual users install.
+- Casual users keep typing `npm install -g @bobfrankston/rmfmail` (no flags).
+- Dev users explicitly opt in.
+
+## Key invariant (answers the obvious confusion)
+
+`@latest` is **what casual `npm install` gets**. It only moves when prod.cmd promotes. So between promotions:
+
+```
+@latest = @prod = 1.0.609   ← last promoted, what users get
+@dev    = 1.0.620           ← every rebuild bumps this
+```
+
+Casual users keep installing 1.0.609 until you say so. Dev tip never accidentally becomes the casual install.
+
+---
+
+## Approach A — npm dist-tags (one package)
+
+### Mechanics
+
+npm's built-in [dist-tag](https://docs.npmjs.com/cli/v10/commands/npm-dist-tag) feature: one package, multiple movable pointers.
+
+- `npm publish --tag dev` sets `@dev` to the new version. `@latest` untouched.
+- `npm dist-tag add @bobfrankston/rmfmail@<v> prod` moves the `prod` pointer; `npm dist-tag add ... latest` moves `latest` too. Two HTTP calls, no republish.
+
+### Required changes
+
+**1. npmglobalize** — accepts a `--dist-tag` flag and forwards to `npm publish`. ~5 lines. See `docs/npmglobalize-disttag.md` for the patch.
+
+**2. rebuild.cmd** — invoke `npmglobalize --dist-tag dev`. One-line edit.
+
+**3. prod.cmd** — new file. Explicit arg wins; otherwise query npm for the
+current `@dev` and promote that. (`@dev` is the right default because you've
+just published it via `rebuild.cmd` and want it to become user-facing.)
+
+```cmd
+@echo off
+setlocal
+set V=%1
+if "%V%"=="" (
+  for /f "delims=" %%v in ('npm view @bobfrankston/rmfmail dist-tags.dev') do set V=%%v
+)
+if "%V%"=="" (
+  echo No version supplied and 'npm view ... dist-tags.dev' returned empty.
+  echo Usage: prod.cmd [version]   e.g. prod.cmd 1.0.611
+  exit /b 1
+)
+echo Promoting @bobfrankston/rmfmail@%V% to prod and latest...
+call npm dist-tag add @bobfrankston/rmfmail@%V% prod
+call npm dist-tag add @bobfrankston/rmfmail@%V% latest
+echo Done.
+endlocal
+```
+
+Roll back to an older known-good: `prod.cmd 1.0.598` — explicit arg path.
+
+The "default = local package.json" alternative (if you never want to query
+the registry):
+
+```cmd
+for /f "tokens=2 delims=:," %%v in ('findstr /b "  \"version\":" "%~dp0app\package.json"') do set V=%%~v
+set V=%V: =%
+set V=%V:"=%
+```
+
+Use whichever default matches your workflow — the explicit-arg path works
+either way.
+
+### Workflow
+
+1. Edit code, run `rebuild.cmd` — version bumps, publishes as `@dev`. `@latest`/`@prod` unaffected.
+2. On the dev machine: `npm install -g @bobfrankston/rmfmail@dev` to grab the freshest build.
+3. When something feels stable: run `prod.cmd`. Promotes the current `package.json` version to `@prod` and `@latest`.
+4. On the prod machine (and any default install): `npm install -g @bobfrankston/rmfmail` (no tag) gets the newly-promoted version.
+
+Roll back: `npm dist-tag add @bobfrankston/rmfmail@<earlier> prod` + `... latest`. No republish, no version bump.
+
+### Effort
+
+- npmglobalize change: ~5 lines, ~5 minutes.
+- `rebuild.cmd`: one-line edit.
+- `prod.cmd`: 15 lines, fresh file.
+- Test cycle: ~10 minutes.
+
+---
+
+## Approach B — wrapper packages
+
+### Mechanics
+
+Split the current single package into three:
+
+| Name | Role | Versioning |
+|---|---|---|
+| `@bobfrankston/rmfmailapp` | Today's actual code. | Bumps freely on every build. |
+| `@bobfrankston/rmfmail` | Wrapper. `dependencies: { rmfmailapp: "1.0.609" }` pinned. | Bumps only on promotion. |
+| `@bobfrankston/rmfmaildev` | Wrapper. `dependencies: { rmfmailapp: "*" }`. | Tracks rmfmailapp tip. |
+
+Casual user: `npm install -g @bobfrankston/rmfmail` — installs the wrapper, which pulls in the pinned rmfmailapp via npm's normal dependency resolution. Wrapper's `bin` shim invokes rmfmailapp's actual entry point, so the CLI is identical.
+
+Promotion = git commit on the wrapper bumping `dependencies.rmfmailapp` from one frozen version to another, plus `npm publish` of the wrapper.
+
+### Layout
+
+```
+mailx/
+  rmfmailapp/                # was app/
+    package.json   "name": "@bobfrankston/rmfmailapp"
+    bin/, packages/, client/  unchanged
+  rmfmail/                   # NEW
+    package.json   pins rmfmailapp version
+    bin/rmfmail.js shim that imports rmfmailapp's entry
+  rmfmaildev/                # NEW
+    package.json   "*" range or always-repinned
+    bin/rmfmaildev.js shim
+```
+
+### `rmfmail/package.json`
+
+```json
+{
+  "name": "@bobfrankston/rmfmail",
+  "version": "1.0.0",
+  "type": "module",
+  "bin": { "rmfmail": "bin/rmfmail.js" },
+  "dependencies": { "@bobfrankston/rmfmailapp": "1.0.609" }
+}
+```
+
+### `rmfmail/bin/rmfmail.js`
+
+```js
+#!/usr/bin/env node
+import { createRequire } from "node:module";
+const require = createRequire(import.meta.url);
+await import(`file://${require.resolve("@bobfrankston/rmfmailapp/bin/mailx.js")}`);
+```
+
+### `rmfmaildev/package.json`
+
+Same shape but `"@bobfrankston/rmfmailapp": "*"` so npm always resolves to the freshest published rmfmailapp.
+
+### Required changes
+
+**1. Rename** `@bobfrankston/rmfmail` → `@bobfrankston/rmfmailapp` in `app/package.json` and any workspace deps that reference it. One-time.
+
+**2. Create** `rmfmail/` and `rmfmaildev/` directories with the package.json + shim listed above. ~30 lines total.
+
+**3. prod.cmd** — bumps the pin and publishes the wrapper:
+
+```cmd
+@echo off
+setlocal
+set TARGET=%1
+if "%TARGET%"=="" (
+  for /f "tokens=2 delims=:," %%v in ('findstr /b "  \"version\":" "%~dp0rmfmailapp\package.json"') do set TARGET=%%~v
+  set TARGET=%TARGET: =%
+  set TARGET=%TARGET:"=%
+)
+node -e "const p=require('./rmfmail/package.json'); p.dependencies['@bobfrankston/rmfmailapp']='%TARGET%'; require('fs').writeFileSync('./rmfmail/package.json', JSON.stringify(p,null,2)+'\n');"
+cd rmfmail
+call npm version patch
+call npm publish --access public
+cd ..
+git add rmfmail/package.json
+git commit -m "rmfmail: pin rmfmailapp@%TARGET%"
+endlocal
+```
+
+**4. npmglobalize**: no changes required.
+
+### Workflow
+
+1. Build, run `rebuild.cmd` — publishes rmfmailapp.
+2. Dev install: `npm install -g @bobfrankston/rmfmaildev`. Pulls latest rmfmailapp through the `*` range.
+3. Promotion: `prod.cmd 1.0.611`. Edits rmfmail's pin, bumps wrapper patch version, publishes wrapper, commits.
+4. Casual install: `npm install -g @bobfrankston/rmfmail` resolves the new wrapper, npm fetches the pinned rmfmailapp, both land under the wrapper.
+
+Roll back: edit rmfmail/package.json to a prior pin, `git revert`, republish wrapper.
+
+### Effort
+
+- One-time rename: ~30 minutes.
+- Wrapper skeletons: ~15 minutes.
+- prod.cmd: ~15 minutes.
+- Test: ~30 minutes.
+- Total: ~1.5 hours up-front, then near-zero per promotion.
+
+---
+
+## Comparison
+
+| | A: dist-tags | B: wrappers |
+|--|--|--|
+| Number of npm packages | 1 | 3 (app + 2 wrappers) |
+| What "promotion" is | `npm dist-tag add` (HTTP call) | git commit + `npm publish` of wrapper |
+| Promotion in git history | no (registry-only) | yes |
+| Roll-back | retag prior version | `git revert` then republish wrapper |
+| npmglobalize change needed | yes (`--tag` flag, ~5 lines) | no |
+| Casual install command | `npm install -g @bobfrankston/rmfmail` | (same) |
+| Dev install command | `... rmfmail@dev` | `... rmfmaildev` |
+| One-time setup work | ~15 minutes | ~1.5 hours |
+| Per-promotion work | seconds (registry call) | minutes (commit + publish) |
+| Multi-channel future (beta, rc) | more dist-tags | more wrappers |
+
+## Recommendation
+
+If you want it working today with minimum disturbance: **A (dist-tags)**.
+
+If auditability of "what version was prod when" matters and you're willing to spend the one-time rename: **B (wrappers)**.
+
+A → B migration later is straightforward (the rename and wrapper creation is the same work whenever you do it; dist-tags become a non-issue once wrappers exist).
+
+## What neither approach does
+
+- Does not enable side-by-side coexistence on a single machine — that's the orthogonal `RMFMAIL_PROFILE` env-var design (separate config dir, AUMID, mailto handler, etc.).
+- Does not change the in-app updater. mailx's existing version-check flow keeps working with either.
+- Does not affect Android. APKs aren't on npm — `prod-android.md` is the parallel document with the equivalent channel-manifest design.

package/docs/push-relay.md

@@ -0,0 +1,141 @@
+# Push Relay (C127, optional)
+
+Status: design only — not yet built. Relevant when polling latency feels too slow OR when battery / quota matters more than now.
+
+## Problem
+
+mailx polls Google Calendar / Gmail / Outlook for changes. Polling is cheap, simple, and works on every network — the right default. But it has two costs:
+
+1. **Latency floor.** Even at a 5 s syncToken cadence, "the user just rescheduled this on their phone" takes ~5 s to surface in mailx. For most workflows that's invisible; for "alarm fires for an event that was moved an hour ago" it isn't.
+2. **Battery / quota on mobile.** The Android shell polls the same way the desktop does; on a phone that's measurable wakeups.
+
+Push notifications (Google's `events.watch`, Microsoft Graph webhook subscriptions, Gmail's `users.watch`) fix both, but only deliver to a public HTTPS URL. The desktop client doesn't have one. So we need a relay.
+
+## Shape
+
+A standalone Node service in `MailApps/relayer/`, deployed wherever the operator runs other small services (alerter-style: tiny Express app, one config file, one long-running process). One relay process serves multiple users; per-user state is keyed by user-issued tokens.
+
+```
+┌──────────────┐  watch       ┌─────────┐  webhook   ┌───────────┐  WS/SSE   ┌────────┐
+│ Google / MS  │ ──register── │ relayer │ ◀────────  │ relayer   │ ◀────────│ rmfmail│
+│ Calendar API │              │ /sub    │            │ /hook/:id │            │ client │
+└──────────────┘              └─────────┘            └───────────┘            └────────┘
+       ▲                          │                                                ▲
+       │  events.watch(           │  per-subscription state:                       │
+       │    address: relayer/hook │    upstream channel id, expiry, owner-token,   │
+       │    token: per-sub secret │    fan-out endpoints                           │
+       │  )                       │                                                │
+       └──── done by relayer on   │                                                │
+            client request, with  │                                                │
+            client-supplied OAuth │                                                │
+            access token (kept    │                                                │
+            short-lived; client   │                                                │
+            re-presents on        │                                                │
+            renewal)              │                                                │
+                                  ▼
+```
+
+Three roles, separable:
+- **Subscriber API** — clients POST to register what they want watched.
+- **Hook receiver** — public endpoint(s) the upstream services post to.
+- **Fan-out** — per-subscription WS or SSE that holds open client connections and pushes payloads.
+
+## API (relayer side)
+
+Generic relay shape — caller specifies upstream service + the params that service needs to register a watch. The relay knows enough about each supported upstream to issue the watch-registration call and decode the inbound webhook envelope; it doesn't introspect payload content.
+
+```
+POST /subscribe
+  body: {
+    upstream:  "google-calendar" | "google-gmail" | "ms-graph-events" | …
+    params:    { …upstream-specific watch args, e.g. calendarId, accessToken, expiry preference }
+    deliver:   "sse" | "ws"
+  }
+  → 200 {
+    subscriptionId: "<uuid>",
+    deliverUrl:     "/sub/<uuid>",      // open SSE / WS here
+    authToken:      "<random-secret>",  // present on connect
+    expiresAt:      <ms>                // when relay's upstream channel needs renewal
+  }
+
+POST /subscribe/<id>/renew
+  body: { params: { accessToken: "<fresh OAuth>" } }
+  → 200 { expiresAt: <ms> }
+
+DELETE /subscribe/<id>
+  → 204 (also calls upstream stop-watch)
+
+GET /subscribe/<id>/status
+  → 200 { upstream, expiresAt, lastEventAt, queueDepth }
+
+GET /sub/<id>      (SSE) — emits `data: {payload}\n\n` per upstream event
+                   (or WS upgrade) — same payload shape as text frames
+```
+
+Auth: `Authorization: Bearer <authToken>` on every call after `/subscribe`. The token issued at subscribe time scopes the subscription; one client manages one or more subscriptions, each with its own token.
+
+## API (client side)
+
+Two settings the user fills in:
+- `pushRelayUrl` — e.g. `https://mail1.example.com:NNNN`
+- `pushRelayCredentials` — issued by the operator at first contact (one-time, opaque blob; relay verifies)
+
+When `pushRelayUrl` is non-empty, the client at startup:
+1. Reads its previous subscription IDs from local config.
+2. For each, opens the SSE / WS connection.
+3. If the connection refuses with "unknown subscription" (relay restart, expiry), re-subscribes from scratch with the current OAuth token and stores the new id.
+4. Hooks the inbound event stream into the same `mailxapi.onEvent` channel the daemon already uses, so the alarm subsystem / message-list / folder-tree all consume push events the same way they consume the daemon's IDLE / sync events.
+
+The client owns OAuth tokens; the relay receives short-lived access tokens at register / renew time, doesn't store refresh tokens.
+
+## Reliability
+
+- **Replay queue per subscription** — last N events (in-memory ring, e.g. N=100) so a brief disconnect doesn't lose events. Client passes `Last-Event-ID` (SSE) or a sequence cursor (WS) on reconnect.
+- **Channel renewal** — relay tracks each upstream channel's expiry, schedules renewal at 80% of TTL, calls back to the client (via the WS/SSE itself) for a fresh OAuth token if needed.
+- **Fail-open** — if the relay is unreachable, the client's existing syncToken polling continues. Push is "freshness boost," never load-bearing for correctness.
+
+## Generic relay vs per-upstream code
+
+The relay needs per-upstream code for:
+- How to register a watch (the API call shape varies).
+- How to decode the inbound webhook envelope (Google sends headers in `X-Goog-*`, Graph sends a JSON body, etc.).
+- How to renew or stop a watch.
+
+Per-upstream is a small adapter (~50–100 lines each). Adding "Outlook Tasks" or "iCloud Calendar" later is a new file in `relayer/upstreams/`. The fan-out, subscription store, WS/SSE plumbing, replay buffer — all generic, written once.
+
+## Operator footprint
+
+- One Node process, one port, one HTTPS cert (or behind a reverse proxy that handles TLS).
+- Storage: SQLite or JSON for the subscription map (small — one row per active subscription).
+- Logs to a file the operator already tails.
+- No queue infrastructure, no message broker, no DB cluster.
+
+This is the same operational shape as alerter — drop into `MailApps/`, deploy alongside other small services, treat as one more daemon.
+
+## When to build this
+
+Only when polling demonstrably isn't fast enough, OR when mobile battery becomes a real concern (push lets the Android shell wake on event instead of polling on a timer). Polling at 5–10 s syncToken cadence is functionally instant for the "user rescheduled an event" case and quota-cheap. Push is a freshness optimization, not a correctness fix.
+
+## Alternatives considered
+
+- **Cloudflare Workers + Durable Objects** — cleaner per-user-isolation story but requires each user to deploy their own Worker (or one shared operator-run Worker, with a different trust shape). Higher onboarding friction; users without a CF account can't use it. Pro: free tier, edge latency. Con: vendor lock-in, two-click onboarding minimum (account + token).
+- **Cloudflare Tunnel / ngrok to the local daemon** — no relay needed, the daemon exposes its own webhook receiver. Catch: only works while the daemon is running; events while offline are lost (recovered by the next syncToken poll, which already exists). Per-instance tunnel.
+- **Status quo (poll only)** — what mailx does today. Right default; this doc is for when "default isn't enough."
+
+## Files (when built)
+
+```
+MailApps/relayer/
+  package.json
+  tsconfig.json
+  index.ts           — Express server + WS upgrade + SSE
+  upstreams/
+    google-calendar.ts
+    google-gmail.ts
+    ms-graph-events.ts
+  subs.ts            — subscription store (SQLite)
+  fanout.ts          — per-sub connection pool + replay buffer
+  readme.md          — operator doc (deploy + config)
+```
+
+Client side: extend `mailx-service` with a `pushRelayClient.ts` that opens / re-opens / re-subscribes; surface its status in the existing sync-status banner.

package/docs/rmf-tiny.md

@@ -0,0 +1,156 @@
+# `rmf-tiny` — optional TinyMCE editor adapter for rmfmail
+
+Status: design only. Not implemented.
+
+## Goal
+
+Let users who want Thunderbird-class paste fidelity opt into TinyMCE without baking it into rmfmail itself. Bob 2026-05-09 verified: pasted a Word document into Thunderbird, tiptap, Quill, and TinyMCE — only TinyMCE preserved the formatting (boxed monospace block with borders, paragraph spacing, font preservation). Nothing else came close.
+
+The license catch — TinyMCE is GPLv2 — means rmfmail (MIT) can't bundle it. The arms-length pattern is the resolution: rmfmail ships **no** TinyMCE bytes; a separate `rmf-tiny` package the user installs themselves provides the adapter + pulls in TinyMCE via npm.
+
+## Shape
+
+```
+@bobfrankston/rmfmail            ← MIT, ships no TinyMCE
+  client/compose/editor.ts       ← MailxEditor interface + factory
+                                   gains a "tinymce" branch that
+                                   dynamically imports rmf-tiny
+
+@bobfrankston/rmf-tiny           ← MIT (the adapter glue is original code)
+  package.json                   ← peerDependency: tinymce
+  src/adapter.ts                 ← implements MailxEditor against TinyMCE
+  README.md                      ← install instructions
+```
+
+User opts in:
+
+```
+npm install -g @bobfrankston/rmf-tiny tinymce
+```
+
+(Two packages explicit — keeps the licensing posture clean. rmf-tiny is just the adapter; tinymce comes from Tiny's own npm publication, not bundled with anything rmfmail-related.)
+
+In rmfmail Settings → Compose → Editor: the dropdown grows a "TinyMCE (requires rmf-tiny)" option. If selected and the import fails, surface a status-bar error pointing at the install command.
+
+## Why a separate package, not a flag inside rmfmail
+
+- rmfmail's git history and npm tarball never contain TinyMCE → distribution layer is clean.
+- rmf-tiny is small (~200 lines of adapter glue + a thin install README) and can be MIT — no GPL infection because it imports TinyMCE at runtime via the same kind of dynamic boundary npm packages always use. Combination at user's machine is fully GPL-permitted.
+- Other editors can follow the same pattern (`rmf-ckeditor`, `rmf-prosemirror-pro`) without polluting rmfmail.
+
+## Why call it `rmf-tiny`
+
+Short, distinguishable from the upstream package, namespaces under your scope (`@bobfrankston/rmf-tiny`), and "tiny" is the upstream's own brand so the connection is obvious. Other naming options:
+- `@bobfrankston/mailx-tinymce-adapter` (verbose, descriptive)
+- `@bobfrankston/rmftiny` (no hyphen, matches rmfmail style)
+
+`rmf-tiny` is fine; pick the form that scans cleanest in the install line.
+
+## Files
+
+### `rmf-tiny/package.json`
+
+```json
+{
+  "name": "@bobfrankston/rmf-tiny",
+  "version": "0.1.0",
+  "description": "TinyMCE editor adapter for rmfmail. Bring-your-own TinyMCE.",
+  "type": "module",
+  "main": "src/adapter.js",
+  "license": "MIT",
+  "peerDependencies": {
+    "tinymce": ">=6"
+  },
+  "peerDependenciesMeta": {
+    "tinymce": { "optional": false }
+  }
+}
+```
+
+`peerDependencies` puts the install responsibility on the user — `npm install @bobfrankston/rmf-tiny` warns that `tinymce` must also be installed; rmf-tiny does not vendor or bundle TinyMCE.
+
+### `rmf-tiny/src/adapter.ts`
+
+```ts
+// MIT-licensed adapter glue. Imports the user-installed TinyMCE at
+// runtime; doesn't redistribute any TinyMCE bytes. Implements the same
+// `MailxEditor` interface rmfmail's createEditor factory expects, so
+// the host code path is identical.
+import type { Editor as TinyEditor } from "tinymce";
+
+export interface MailxEditor {
+    setHtml(html: string): void;
+    getHtml(): string;
+    getText(): string;
+    focus(): void;
+    setCursor(pos: number): void;
+    root: HTMLElement;
+    // …other methods rmfmail's interface requires
+}
+
+export async function createTinyMceEditor(container: HTMLElement): Promise<MailxEditor> {
+    // Dynamic import — fails clearly if the user hasn't installed tinymce.
+    const tinymce = (await import("tinymce")).default;
+    // Plus the plugins TinyMCE's paste-from-Word handler needs:
+    await Promise.all([
+        import("tinymce/themes/silver"),
+        import("tinymce/icons/default"),
+        import("tinymce/plugins/paste"),
+        import("tinymce/plugins/lists"),
+        import("tinymce/plugins/link"),
+        import("tinymce/plugins/table"),
+        import("tinymce/plugins/code"),
+    ]);
+    // ... initialize tinymce against `container`, return MailxEditor shim.
+}
+```
+
+The actual init/wire-up is the work — wrapping TinyMCE's API in our `MailxEditor` shape, hooking paste events, setHtml/getHtml round-tripping, etc. Maybe ~200 lines.
+
+### rmfmail-side change to `editor.ts`
+
+```ts
+export async function createEditor(
+    container: HTMLElement,
+    type: "quill" | "tiptap" | "tinymce"
+): Promise<MailxEditor> {
+    if (type === "tinymce") {
+        try {
+            const m = await import("@bobfrankston/rmf-tiny");
+            return m.createTinyMceEditor(container);
+        } catch (e: any) {
+            const status = document.getElementById("status-sync");
+            if (status) status.textContent = `TinyMCE editor not available — install: npm install -g @bobfrankston/rmf-tiny tinymce`;
+            return createQuillEditor(container);  // fall back so compose still works
+        }
+    }
+    if (type === "tiptap") return createTiptapEditor(container);
+    return createQuillEditor(container);
+}
+```
+
+Settings panel adds the "TinyMCE" option in the editor dropdown.
+
+## Effort
+
+- `rmf-tiny` package skeleton (package.json, README, basic adapter shell): ~30 minutes.
+- Adapter wiring (init, setHtml/getHtml, paste handling, toolbar config): ~3 hours including testing the Word-paste case.
+- rmfmail-side factory branch + Settings dropdown option: ~30 minutes.
+- Documentation for users (README in rmf-tiny + Settings tooltip): ~30 minutes.
+
+About half a day total.
+
+## Order
+
+1. Build `rmf-tiny` against your local TinyMCE install. Verify the Word-paste case actually works through your adapter.
+2. Add the factory branch and Settings option to rmfmail.
+3. Publish `rmf-tiny` to npm.
+4. Document the opt-in install command in rmfmail's Settings tooltip and `README.md`.
+
+Don't publish the adapter until the Word-paste case actually works end-to-end through the adapter — TinyMCE direct is one thing, our adapter possibly mangles it differently.
+
+## Caveats
+
+- The adapter must not re-implement parts of TinyMCE — it's a thin wrapper. Re-implementing parts of GPL code in MIT is the legal trap; staying purely in adapter / interface territory is safe.
+- TinyMCE's bundle is large (~1MB minified). Users opting in pay that cost on the first compose-window load. Fine for opt-in; would be unacceptable as a default.
+- `rmf-tiny` major version should track TinyMCE's major version (rmf-tiny@7.x for tinymce@7.x) so peerDependency mismatches are obvious.

package/index.d.ts

@@ -46,7 +46,7 @@ export declare function getStorageInfo(): {
 /** Fill in provider defaults for an account based on email domain.
  *  Exported so mailx-service's leanAccountsJsonc helper can reuse the same
  *  canonicalization rules that loadAccounts uses. */
-export declare function normalizeAccount(acct: any, globalName?: string): AccountConfig;
+export declare function normalizeAccount(acct: any, globalName?: string, globalSig?: any, globalSignature?: string): AccountConfig;
 declare const DEFAULT_PREFERENCES: {
     ui: {
         theme: "system" | "dark" | "light";
@@ -101,7 +101,7 @@ export declare function loadAccountsAsync(): Promise<AccountConfig[]>;
  *  - Drop `imap.user` / `smtp.user` if they equal the email.
  *  - Drop `sig.html: false` (default; only keep when user enabled HTML sigs).
  *  - Keep field order: id → label → email → primary* → imap → smtp → defaultSend
- *    → relayDomains → deliveredToPrefix → identityDomains → syncContacts → sig.
+ *    → relayDomains → identityDomains → syncContacts → sig.
  *    Curated for readability, not alphabetic. */
 export declare function denormalizeAccount(acct: AccountConfig, globalName?: string): any;
 /** Save account configs */
@@ -155,7 +155,6 @@ export declare function loadAllowlist(): typeof DEFAULT_ALLOWLIST;
 export declare function saveAllowlist(list: typeof DEFAULT_ALLOWLIST): Promise<void>;
 /** Load settings — unified view combining all files (backward compatible) */
 export declare function loadSettings(): MailxSettings;
-/** Save settings — writes to split files */
 export declare function saveSettings(settings: MailxSettings): Promise<void>;
 /** Get the local store base path */
 export declare function getStorePath(): string;

package/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAKH,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAC;AAyG5G,QAAA,MAAM,SAAS,QAA4E,CAAC;AAiE5F,qFAAqF;AACrF,KAAK,kBAAkB,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,OAAO,CAAC,EAAE;IAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,KAAK,IAAI,CAAC;AAE/G,wBAAgB,YAAY,CAAC,EAAE,EAAE,kBAAkB,GAAG,MAAM,IAAI,CAM/D;AAOD,wBAAgB,iBAAiB,IAAI,MAAM,GAAG,IAAI,CAA2B;AAU7E,iBAAS,YAAY,IAAI,MAAM,CAgB9B;AAOD,sEAAsE;AACtE,wBAAsB,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAoCxE;AAED;;qCAEqC;AACrC,wBAAsB,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA8BjF;AAyBD,2CAA2C;AAC3C,wBAAgB,WAAW,IAAI,OAAO,CAErC;AAED,4CAA4C;AAC5C,wBAAgB,cAAc,IAAI;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,OAAO,GAAG,KAAK,GAAG,OAAO,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,CA+B3L;AAuID;;qDAEqD;AACrD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,GAAG,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,aAAa,CA4D9E;AAMD,QAAA,MAAM,mBAAmB;;eAEE,QAAQ,GAAG,MAAM,GAAG,OAAO;gBAC3B,OAAO,GAAG,QAAQ;;;;;;;;;;;;;;;;;;;;CAoB5C,CAAC;AAEF,QAAA,MAAM,oBAAoB,EAAE,oBAS3B,CAAC;AAEF,QAAA,MAAM,iBAAiB;aACJ,MAAM,EAAE;aACR,MAAM,EAAE;gBACL,MAAM,EAAE;oBAOJ,MAAM,EAAE;oBACR,MAAM,EAAE;CACjC,CAAC;AAIF,2BAA2B;AAC3B,wBAAgB,YAAY,IAAI,aAAa,EAAE,CA0C9C;AAoCD;;;;0CAI0C;AAC1C,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC,CAqBlE;AAED;;;;;;;;;;;;;;;iDAeiD;AACjD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,aAAa,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,GAAG,CA+ChF;AAED,2BAA2B;AAC3B;;;oEAGoE;AACpE,wBAAsB,YAAY,CAAC,QAAQ,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAyC3E;AAED;;;wEAGwE;AACxE,wBAAgB,QAAQ,IAAI,MAAM,CAWjC;AAED;;4DAE4D;AAC5D,wBAAsB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAoB1D;AAED;;;;;uEAKuE;AACvE,wBAAsB,uBAAuB,IAAI,OAAO,CAAC,IAAI,CAAC,CAmB7D;AAED;;;;;;kCAMkC;AAClC,wBAAsB,wBAAwB,IAAI,OAAO,CAAC,IAAI,CAAC,CAa9D;AAED;;;;;0CAK0C;AAC1C,wBAAsB,4BAA4B,IAAI,OAAO,CAAC,IAAI,CAAC,CAYlE;AAED,wEAAwE;AACxE,wBAAgB,eAAe,IAAI,OAAO,mBAAmB,CAoB5D;AAED,uBAAuB;AACvB,wBAAgB,eAAe,CAAC,KAAK,EAAE,GAAG,GAAG,IAAI,CAEhD;AAED,iCAAiC;AACjC,wBAAgB,gBAAgB,IAAI,oBAAoB,CAGvD;AAED,iCAAiC;AACjC,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,oBAAoB,GAAG,IAAI,CAIrE;AAED,qCAAqC;AACrC,wBAAgB,aAAa,IAAI,OAAO,iBAAiB,CAExD;AAED,4EAA4E;AAC5E,wBAAsB,aAAa,CAAC,IAAI,EAAE,OAAO,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAqBjF;AAcD,6EAA6E;AAC7E,wBAAgB,YAAY,IAAI,aAAa,CAe5C;AAED,4CAA4C;AAC5C,wBAAsB,YAAY,CAAC,QAAQ,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAGzE;AAED,oCAAoC;AACpC,wBAAgB,YAAY,IAAI,MAAM,CAGrC;AAED,qDAAqD;AACrD,wBAAgB,YAAY,IAAI,MAAM,CAErC;AAED,wCAAwC;AACxC,OAAO,EAAE,YAAY,EAAE,CAAC;AAKxB,kDAAkD;AAClD,wBAAgB,eAAe,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAkB5E;AAED;;;mFAGmF;AACnF,wBAAsB,eAAe,CAAC,QAAQ,GAAE,QAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAclF;AAED,QAAA,MAAM,gBAAgB,EAAE,aAMvB,CAAC;AAEF,8FAA8F;AAC9F,wBAAgB,cAAc,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAQzD;AAED,uEAAuE;AACvE,wBAAgB,WAAW,IAAI,OAAO,CAGrC;AAED,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,SAAS,EAAE,CAAC;AAErG;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA0ClE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAKH,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAC;AAyG5G,QAAA,MAAM,SAAS,QAA4E,CAAC;AAiE5F,qFAAqF;AACrF,KAAK,kBAAkB,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,OAAO,CAAC,EAAE;IAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,KAAK,IAAI,CAAC;AAE/G,wBAAgB,YAAY,CAAC,EAAE,EAAE,kBAAkB,GAAG,MAAM,IAAI,CAM/D;AAOD,wBAAgB,iBAAiB,IAAI,MAAM,GAAG,IAAI,CAA2B;AAU7E,iBAAS,YAAY,IAAI,MAAM,CAgB9B;AAOD,sEAAsE;AACtE,wBAAsB,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAoCxE;AAED;;qCAEqC;AACrC,wBAAsB,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA8BjF;AAyBD,2CAA2C;AAC3C,wBAAgB,WAAW,IAAI,OAAO,CAErC;AAED,4CAA4C;AAC5C,wBAAgB,cAAc,IAAI;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,OAAO,GAAG,KAAK,GAAG,OAAO,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,CA+B3L;AAuID;;qDAEqD;AACrD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,GAAG,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,GAAG,EAAE,eAAe,CAAC,EAAE,MAAM,GAAG,aAAa,CA6DzH;AAMD,QAAA,MAAM,mBAAmB;;eAEE,QAAQ,GAAG,MAAM,GAAG,OAAO;gBAC3B,OAAO,GAAG,QAAQ;;;;;;;;;;;;;;;;;;;;CAoB5C,CAAC;AAEF,QAAA,MAAM,oBAAoB,EAAE,oBAS3B,CAAC;AAEF,QAAA,MAAM,iBAAiB;aACJ,MAAM,EAAE;aACR,MAAM,EAAE;gBACL,MAAM,EAAE;oBAOJ,MAAM,EAAE;oBACR,MAAM,EAAE;CACjC,CAAC;AAIF,2BAA2B;AAC3B,wBAAgB,YAAY,IAAI,aAAa,EAAE,CA4C9C;AAoCD;;;;0CAI0C;AAC1C,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC,CAuBlE;AAED;;;;;;;;;;;;;;;iDAeiD;AACjD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,aAAa,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,GAAG,CA8ChF;AAED,2BAA2B;AAC3B;;;oEAGoE;AACpE,wBAAsB,YAAY,CAAC,QAAQ,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAyC3E;AAED;;;wEAGwE;AACxE,wBAAgB,QAAQ,IAAI,MAAM,CAWjC;AAED;;4DAE4D;AAC5D,wBAAsB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAoB1D;AAED;;;;;uEAKuE;AACvE,wBAAsB,uBAAuB,IAAI,OAAO,CAAC,IAAI,CAAC,CAmB7D;AAED;;;;;;kCAMkC;AAClC,wBAAsB,wBAAwB,IAAI,OAAO,CAAC,IAAI,CAAC,CAa9D;AAED;;;;;0CAK0C;AAC1C,wBAAsB,4BAA4B,IAAI,OAAO,CAAC,IAAI,CAAC,CAYlE;AAED,wEAAwE;AACxE,wBAAgB,eAAe,IAAI,OAAO,mBAAmB,CAkC5D;AAED,uBAAuB;AACvB,wBAAgB,eAAe,CAAC,KAAK,EAAE,GAAG,GAAG,IAAI,CAEhD;AAED,iCAAiC;AACjC,wBAAgB,gBAAgB,IAAI,oBAAoB,CAGvD;AAED,iCAAiC;AACjC,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,oBAAoB,GAAG,IAAI,CAIrE;AAED,qCAAqC;AACrC,wBAAgB,aAAa,IAAI,OAAO,iBAAiB,CAExD;AAED,4EAA4E;AAC5E,wBAAsB,aAAa,CAAC,IAAI,EAAE,OAAO,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAqBjF;AAcD,6EAA6E;AAC7E,wBAAgB,YAAY,IAAI,aAAa,CA0B5C;AAyBD,wBAAsB,YAAY,CAAC,QAAQ,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAkBzE;AAED,oCAAoC;AACpC,wBAAgB,YAAY,IAAI,MAAM,CAGrC;AAED,qDAAqD;AACrD,wBAAgB,YAAY,IAAI,MAAM,CAErC;AAED,wCAAwC;AACxC,OAAO,EAAE,YAAY,EAAE,CAAC;AAKxB,kDAAkD;AAClD,wBAAgB,eAAe,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAkB5E;AAED;;;mFAGmF;AACnF,wBAAsB,eAAe,CAAC,QAAQ,GAAE,QAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAclF;AAED,QAAA,MAAM,gBAAgB,EAAE,aAMvB,CAAC;AAEF,8FAA8F;AAC9F,wBAAgB,cAAc,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAQzD;AAED,uEAAuE;AACvE,wBAAgB,WAAW,IAAI,OAAO,CAGrC;AAED,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,SAAS,EAAE,CAAC;AAErG;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA0ClE"}

package/index.js

@@ -492,7 +492,7 @@ const PROVIDERS = {
 /** Fill in provider defaults for an account based on email domain.
  *  Exported so mailx-service's leanAccountsJsonc helper can reuse the same
  *  canonicalization rules that loadAccounts uses. */
-export function normalizeAccount(acct, globalName) {
+export function normalizeAccount(acct, globalName, globalSig, globalSignature) {
     const email = acct.email || "";
     const localPart = email.split("@")[0]?.toLowerCase() || "";
     const domain = email.split("@")[1]?.toLowerCase() || "";
@@ -535,7 +535,6 @@ export function normalizeAccount(acct, globalName) {
         defaultSend: acct.defaultSend,
         syncContacts: acct.syncContacts ?? (provider?.imap.auth === "oauth2"),
         relayDomains: acct.relayDomains,
-        deliveredToPrefix: acct.deliveredToPrefix,
         identityDomains: acct.identityDomains,
         // `spam` passthrough retired 2026-04-22 — markAsSpamMessages now finds
         // the junk folder via `specialUse === "junk"` on the DB folder record
@@ -546,9 +545,11 @@ export function normalizeAccount(acct, globalName) {
         // `as any` is the minimum-blast-radius way to add the field without
         // blocking the build. Once mailx-types has rebuilt once (post-field)
         // this cast can be removed.
-        ...(acct.signature ? { signature: acct.signature } : {}),
+        ...(acct.signature ? { signature: acct.signature } : (globalSignature ? { signature: globalSignature } : {})),
         ...(acct.sig && typeof acct.sig === "object" && typeof acct.sig.text === "string"
-            ? { sig: { text: acct.sig.text, html: !!acct.sig.html } } : {}),
+            ? { sig: { text: acct.sig.text, html: !!acct.sig.html } }
+            : (globalSig && typeof globalSig === "object" && typeof globalSig.text === "string"
+                ? { sig: { text: globalSig.text, html: !!globalSig.html } } : {})),
     };
 }
 // ── Defaults ──
@@ -637,13 +638,15 @@ export function loadAccounts() {
         }
         const raw = accounts.accounts || accounts;
         const globalName = accounts.name || "";
-        const result = deduplicateAccounts(raw.map((a) => normalizeAccount(a, globalName)));
+        const globalSig = accounts.sig;
+        const globalSignature = accounts.signature;
+        const result = deduplicateAccounts(raw.map((a) => normalizeAccount(a, globalName, globalSig, globalSignature)));
         return applyAccountOverrides(result);
     }
     // Legacy: read from settings.jsonc
     const legacy = loadLegacySettings();
     if (legacy?.accounts)
-        return applyAccountOverrides(legacy.accounts.map((a) => normalizeAccount(a, legacy.name)));
+        return applyAccountOverrides(legacy.accounts.map((a) => normalizeAccount(a, legacy.name, legacy.sig, legacy.signature)));
     return DEFAULT_ACCOUNTS;
 }
 /** Normalize email for dedup — Gmail ignores dots before @ */
@@ -699,8 +702,10 @@ export async function loadAccountsAsync() {
             if (data?.accounts || Array.isArray(data)) {
                 const raw = data.accounts || data;
                 const globalName = data.name || "";
+                const globalSig = data.sig;
+                const globalSignature = data.signature;
                 // cloudRead has already cached content to LOCAL_DIR.
-                return applyAccountOverrides(raw.map((a) => normalizeAccount(a, globalName)));
+                return applyAccountOverrides(raw.map((a) => normalizeAccount(a, globalName, globalSig, globalSignature)));
             }
         }
         // Cloud unreachable / unparseable — fall through to local cache.
@@ -721,7 +726,7 @@ export async function loadAccountsAsync() {
  *  - Drop `imap.user` / `smtp.user` if they equal the email.
  *  - Drop `sig.html: false` (default; only keep when user enabled HTML sigs).
  *  - Keep field order: id → label → email → primary* → imap → smtp → defaultSend
- *    → relayDomains → deliveredToPrefix → identityDomains → syncContacts → sig.
+ *    → relayDomains → identityDomains → syncContacts → sig.
  *    Curated for readability, not alphabetic. */
 export function denormalizeAccount(acct, globalName) {
     const domain = (acct.email || "").split("@")[1]?.toLowerCase() || "";
@@ -779,8 +784,6 @@ export function denormalizeAccount(acct, globalName) {
         out.enabled = false; // default true → omit
     if (acct.relayDomains && acct.relayDomains.length > 0)
         out.relayDomains = acct.relayDomains;
-    if (acct.deliveredToPrefix && acct.deliveredToPrefix.length > 0)
-        out.deliveredToPrefix = acct.deliveredToPrefix;
     if (acct.identityDomains && acct.identityDomains.length > 0)
         out.identityDomains = acct.identityDomains;
     // syncContacts default: true for OAuth, false otherwise. Only emit when
@@ -982,10 +985,24 @@ export function loadPreferences() {
     if (localConfig.historyDays !== undefined) {
         shared.sync.historyDays = localConfig.historyDays;
     }
+    // Pass through any non-typed keys (calendar.showHolidays /
+    // showJewishHolidays, checkDomainReputation, externalEditor, …) so
+    // loadSettings's extras pickup sees them. Earlier this return shape
+    // was hard-restricted to {ui, sync, autocomplete} and silently
+    // dropped every other key the file contained — which is why
+    // toggling holidays looked persisted in the file but didn't take
+    // effect: loadSettings only saw ui/sync/autocomplete back.
+    const extras = {};
+    for (const k of Object.keys(shared)) {
+        if (k === "ui" || k === "sync" || k === "autocomplete")
+            continue;
+        extras[k] = shared[k];
+    }
     return {
         ui: { ...DEFAULT_PREFERENCES.ui, ...shared.ui },
         sync: { ...DEFAULT_PREFERENCES.sync, ...shared.sync },
         autocomplete: { ...DEFAULT_AUTOCOMPLETE, ...shared.autocomplete },
+        ...extras,
     };
 }
 /** Save preferences */
@@ -1047,6 +1064,16 @@ export function loadSettings() {
     const accounts = loadAccounts();
     const prefs = loadPreferences();
     const localConfig = readLocalConfig();
+    // Pull through every non-{ui,sync,autocomplete} key the preferences
+    // file had — calendar.showHolidays, checkDomainReputation,
+    // externalEditor, etc. saveSettings stores them; loadSettings has to
+    // hand them back or the round-trip is lossy and toggles "don't stick."
+    const extras = {};
+    for (const k of Object.keys(prefs)) {
+        if (k === "ui" || k === "sync" || k === "autocomplete")
+            continue;
+        extras[k] = prefs[k];
+    }
     return {
         accounts,
         ui: prefs.ui,
@@ -1056,12 +1083,57 @@ export function loadSettings() {
             basePath: localConfig.storePath || DEFAULT_STORE_PATH,
             compressionBoundaryDays: 365,
         },
+        ...extras,
     };
 }
-/** Save settings — writes to split files */
+/** Save settings — writes to split files.
+ *  Preserves arbitrary extra keys (calendar.showHolidays, checkDomainReputation,
+ *  externalEditor, …) by round-tripping the prior preferences file and
+ *  *deep-merging* the new payload over it. A shallow merge would let one
+ *  partial save (e.g. `calendar.showJewishHolidays:true`) wholesale-replace
+ *  the prior `calendar` object and clobber sibling keys (showHolidays).
+ *
+ *  Also: skip re-writing accounts.jsonc when accounts haven't actually
+ *  changed. Every saveSettings call previously paid the sync GDrive write
+ *  cost (~34 s observed in the daemon log) even for a single checkbox
+ *  toggle, because the client sends the full settings object back.
+ *  Identity comparison via JSON.stringify is good enough — JS object
+ *  identity is meaningless across an IPC round-trip. */
+function deepMerge(target, source) {
+    if (source === null || source === undefined)
+        return target;
+    if (typeof source !== "object" || Array.isArray(source))
+        return source;
+    const out = (typeof target === "object" && target !== null && !Array.isArray(target)) ? { ...target } : {};
+    for (const k of Object.keys(source)) {
+        out[k] = deepMerge(out[k], source[k]);
+    }
+    return out;
+}
+let _lastAccountsJson = null;
 export async function saveSettings(settings) {
-    await saveAccounts(settings.accounts);
-    savePreferences({ ui: settings.ui, sync: settings.sync });
+    // Skip the slow accounts write when nothing changed. Initialize the
+    // baseline lazily from the current on-disk file on first call so a
+    // restart picks up the right "did this change?" reference.
+    if (_lastAccountsJson === null) {
+        try {
+            _lastAccountsJson = JSON.stringify(loadAccounts());
+        }
+        catch {
+            _lastAccountsJson = "";
+        }
+    }
+    const incomingJson = JSON.stringify(settings.accounts);
+    if (incomingJson !== _lastAccountsJson) {
+        await saveAccounts(settings.accounts);
+        _lastAccountsJson = incomingJson;
+    }
+    const prior = loadPreferences();
+    const incoming = { ...settings };
+    delete incoming.accounts;
+    delete incoming.store;
+    const next = deepMerge(prior, incoming);
+    savePreferences(next);
 }
 /** Get the local store base path */
 export function getStorePath() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bobfrankston/mailx-settings",
-  "version": "0.1.14",
+  "version": "0.1.16",
   "type": "module",
   "main": "index.js",
   "types": "index.d.ts",
@@ -17,7 +17,7 @@
   },
   "license": "ISC",
   "dependencies": {
-    "@bobfrankston/mailx-types": "^0.1.10",
+    "@bobfrankston/mailx-types": "^0.1.11",
     "jsonc-parser": "^3.3.1"
   },
   "repository": {
@@ -33,7 +33,7 @@
   },
   ".transformedSnapshot": {
     "dependencies": {
-      "@bobfrankston/mailx-types": "^0.1.10",
+      "@bobfrankston/mailx-types": "^0.1.11",
       "jsonc-parser": "^3.3.1"
     }
   }