@bobfrankston/mailx-store 0.1.91 → 0.1.95

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bobfrankston/mailx-store",
-  "version": "0.1.91",
+  "version": "0.1.95",
   "type": "module",
   "main": "index.js",
   "types": "index.d.ts",
@@ -9,8 +9,8 @@
   },
   "license": "ISC",
   "dependencies": {
-    "@bobfrankston/mailx-types": "^0.1.59",
-    "@bobfrankston/mailx-settings": "^0.1.59",
+    "@bobfrankston/mailx-types": "^0.1.63",
+    "@bobfrankston/mailx-settings": "^0.1.62",
     "@bobfrankston/mailx-bus": "^0.1.2",
     "mailparser": "^3.7.2"
   },
@@ -29,8 +29,8 @@
   },
   ".transformedSnapshot": {
     "dependencies": {
-      "@bobfrankston/mailx-types": "^0.1.59",
-      "@bobfrankston/mailx-settings": "^0.1.59",
+      "@bobfrankston/mailx-types": "^0.1.63",
+      "@bobfrankston/mailx-settings": "^0.1.62",
       "@bobfrankston/mailx-bus": "^0.1.2",
       "mailparser": "^3.7.2"
     }

package/store.d.ts

@@ -19,6 +19,7 @@
  * be able to consume it without depending on mailx-service — that's the
  * "arrow points the right way" property of the architecture.
  */
+import { type TrustFinding, type SpamScore } from "@bobfrankston/mailx-types";
 import type { ParsedInvite } from "@bobfrankston/mailx-types";
 import { MailxDB } from "./db.js";
 import { FileMessageStore } from "./file-store.js";
@@ -53,6 +54,12 @@ export interface StoreMessage extends MessageEnvelope {
     bodyOnDisk: boolean;
     deliveredTo: string;
     returnPath: string;
+    /** Evidence that this message is forged — empty for ordinary mail. See
+     *  assessMessageTrust; the viewer renders these above the body. */
+    trust: TrustFinding[];
+    /** The receiving server SpamAssassin score, present or not, flagged or
+     *  not. Shown as a badge so a below-threshold score is still visible. */
+    spamScore: SpamScore;
     listUnsubscribe: string;
     listUnsubscribeMail: string;
     listUnsubscribeHttp: string;

package/store.js

@@ -21,6 +21,7 @@
  */
 import * as fs from "node:fs";
 import { parseSerial } from "./parse-serial.js";
+import { assessMessageTrust, spamScoreOf } from "@bobfrankston/mailx-types";
 import { parseInvite } from "@bobfrankston/mailx-types";
 import { storeBus } from "./bus.js";
 import { sanitizeHtml, htmlToPlainText } from "@bobfrankston/mailx-types";
@@ -532,6 +533,30 @@ export class Store {
             if (dAddr && recipients.includes(dAddr))
                 allowRemote = true;
         }
+        // Forgery evidence. Runs on the RAW html on purpose: sanitizeHtml
+        // disarms the image-map overlay, so by the time bodyHtml is safe the
+        // thing worth reporting is gone. Header-only checks would be immune,
+        // but the link checks would silently stop firing.
+        //
+        // "Own addresses" is the union of the recipient allowlist and the
+        // address this copy was delivered to. Delivered-To matters most: it
+        // needs no configuration and it is exactly the address a self-spoof
+        // forges, so an alias the user never got round to listing is still
+        // covered. (Claude Code 2026-08-25)
+        const trustHeaderLines = (parsed.headerLines || []).map(h => ({ key: h.key, line: h.line }));
+        const trust = assessMessageTrust({
+            headerLines: trustHeaderLines,
+            fromAddress: envelope.from?.address || "",
+            ownAddresses: [...recipients, (deliveredTo.match(/[^\s<>]+@[^\s<>]+/) || [""])[0]].filter(Boolean),
+            bodyHtml,
+            bodyText,
+        });
+        // The server's score travels separately from the findings: a finding is
+        // an accusation and fires only on evidence, this is a measurement the
+        // reader asked to see either way (Bob 2026-08-25). A 2.7 against a 4.5
+        // threshold is "did not quite trip the wire", which is not the same
+        // thing as clean — and that is exactly the message that got through.
+        const spamScore = spamScoreOf(trustHeaderLines);
         if (bodyHtml && !allowRemote) {
             const result = sanitizeHtml(bodyHtml);
             bodyHtml = result.html;
@@ -543,7 +568,7 @@ export class Store {
             hasRemoteContent, remoteAllowed: allowRemote,
             attachments,
             cached: true,
-            deliveredTo, returnPath,
+            deliveredTo, returnPath, trust, spamScore,
             listUnsubscribe, listUnsubscribeMail, listUnsubscribeHttp, listUnsubscribeOneClick,
             // body_path in the DB is stored relative to the body-store
             // basePath; resolve to absolute so the UI's "Source" button