@bobfrankston/mailx-store 0.1.89 → 0.1.93

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bobfrankston/mailx-store",
-  "version": "0.1.89",
+  "version": "0.1.93",
   "type": "module",
   "main": "index.js",
   "types": "index.d.ts",
@@ -9,8 +9,8 @@
   },
   "license": "ISC",
   "dependencies": {
-    "@bobfrankston/mailx-types": "^0.1.57",
-    "@bobfrankston/mailx-settings": "^0.1.58",
+    "@bobfrankston/mailx-types": "^0.1.61",
+    "@bobfrankston/mailx-settings": "^0.1.60",
     "@bobfrankston/mailx-bus": "^0.1.2",
     "mailparser": "^3.7.2"
   },
@@ -29,8 +29,8 @@
   },
   ".transformedSnapshot": {
     "dependencies": {
-      "@bobfrankston/mailx-types": "^0.1.57",
-      "@bobfrankston/mailx-settings": "^0.1.58",
+      "@bobfrankston/mailx-types": "^0.1.61",
+      "@bobfrankston/mailx-settings": "^0.1.60",
       "@bobfrankston/mailx-bus": "^0.1.2",
       "mailparser": "^3.7.2"
     }

package/store.d.ts

@@ -19,6 +19,8 @@
  * be able to consume it without depending on mailx-service — that's the
  * "arrow points the right way" property of the architecture.
  */
+import { type TrustFinding } from "@bobfrankston/mailx-types";
+import type { ParsedInvite } from "@bobfrankston/mailx-types";
 import { MailxDB } from "./db.js";
 import { FileMessageStore } from "./file-store.js";
 import type { StoreBus } from "./bus.js";
@@ -52,6 +54,9 @@ export interface StoreMessage extends MessageEnvelope {
     bodyOnDisk: boolean;
     deliveredTo: string;
     returnPath: string;
+    /** Evidence that this message is forged — empty for ordinary mail. See
+     *  assessMessageTrust; the viewer renders these above the body. */
+    trust: TrustFinding[];
     listUnsubscribe: string;
     listUnsubscribeMail: string;
     listUnsubscribeHttp: string;
@@ -63,6 +68,10 @@ export interface StoreMessage extends MessageEnvelope {
      *  back into saveDraft so the server-side dedup keeps replacing the
      *  same draft instead of stacking up a new one every save. */
     mailxDraftId: string;
+    /** Parsed VEVENT when the message carries a text/calendar part, else null.
+     *  Lets the viewer render an invite card instead of handing invite.ics to
+     *  whatever program happens to own .ics (Bob 2026-08-22). */
+    invite: ParsedInvite | null;
 }
 export declare class Store {
     /** SQLite metadata index. Exposed as a public field — sync clients

package/store.js

@@ -21,6 +21,8 @@
  */
 import * as fs from "node:fs";
 import { parseSerial } from "./parse-serial.js";
+import { assessMessageTrust } from "@bobfrankston/mailx-types";
+import { parseInvite } from "@bobfrankston/mailx-types";
 import { storeBus } from "./bus.js";
 import { sanitizeHtml, htmlToPlainText } from "@bobfrankston/mailx-types";
 import { loadSettings, loadAllowlist } from "@bobfrankston/mailx-settings";
@@ -291,6 +293,7 @@ export class Store {
             hasRemoteContent: false, remoteAllowed: allowRemote,
             attachments: [],
             cached: false,
+            invite: null,
             bodyOnDisk: false, // overridden to true on the parse-pending return
             deliveredTo: "", returnPath: "",
             listUnsubscribe: "", listUnsubscribeMail: "", listUnsubscribeHttp: "", listUnsubscribeOneClick: false,
@@ -445,6 +448,24 @@ export class Store {
             size: x.a.size || 0,
             contentId: x.a.contentId || "",
         }));
+        // Calendar invite. Read from the RAW attachment list, not the filtered
+        // one above: a text/calendar alternative has no filename and inline
+        // disposition, so the spurious-text-part filter (correctly) drops it
+        // from the attachment chips — which would also hide it from us.
+        // A malformed invite must never break rendering the message.
+        let invite = null;
+        try {
+            const calPart = (parsed.attachments || []).find((a) => /text\/calendar|application\/ics/i.test(a.contentType || "")
+                || /\.ics$/i.test(a.filename || ""));
+            if (calPart) {
+                const c = calPart.content;
+                const text = Buffer.isBuffer(c) ? c.toString("utf8") : String(c ?? "");
+                invite = parseInvite(text);
+            }
+        }
+        catch (e) {
+            console.warn("[store] invite parse failed:", e?.message || e);
+        }
         // Header extraction — Delivered-To, Return-Path, List-Unsubscribe.
         // Each delivery agent PREPENDS its Delivered-To, so the FIRST
         // (topmost) header is the final delivery to the user's actual
@@ -512,6 +533,22 @@ export class Store {
             if (dAddr && recipients.includes(dAddr))
                 allowRemote = true;
         }
+        // Forgery evidence. Runs on the RAW html on purpose: sanitizeHtml
+        // disarms the image-map overlay, so by the time bodyHtml is safe the
+        // thing worth reporting is gone. Header-only checks would be immune,
+        // but the link checks would silently stop firing.
+        //
+        // "Own addresses" is the union of the recipient allowlist and the
+        // address this copy was delivered to. Delivered-To matters most: it
+        // needs no configuration and it is exactly the address a self-spoof
+        // forges, so an alias the user never got round to listing is still
+        // covered. (Claude Code 2026-08-25)
+        const trust = assessMessageTrust({
+            headerLines: (parsed.headerLines || []).map(h => ({ key: h.key, line: h.line })),
+            fromAddress: envelope.from?.address || "",
+            ownAddresses: [...recipients, (deliveredTo.match(/[^\s<>]+@[^\s<>]+/) || [""])[0]].filter(Boolean),
+            bodyHtml,
+        });
         if (bodyHtml && !allowRemote) {
             const result = sanitizeHtml(bodyHtml);
             bodyHtml = result.html;
@@ -523,7 +560,7 @@ export class Store {
             hasRemoteContent, remoteAllowed: allowRemote,
             attachments,
             cached: true,
-            deliveredTo, returnPath,
+            deliveredTo, returnPath, trust,
             listUnsubscribe, listUnsubscribeMail, listUnsubscribeHttp, listUnsubscribeOneClick,
             // body_path in the DB is stored relative to the body-store
             // basePath; resolve to absolute so the UI's "Source" button
@@ -532,6 +569,7 @@ export class Store {
             emlPath: this.bodyStore.absolutePath(storedPath),
             isFlagged,
             mailxDraftId,
+            invite,
         };
         // Memoize for instant re-view of the same message. cacheKey is
         // path+mtime so a re-fetch (mtime changes) invalidates naturally.