@bobfrankston/mailx-store 0.1.93 → 0.1.97

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bobfrankston/mailx-store",
-  "version": "0.1.93",
+  "version": "0.1.97",
   "type": "module",
   "main": "index.js",
   "types": "index.d.ts",
@@ -9,8 +9,8 @@
   },
   "license": "ISC",
   "dependencies": {
-    "@bobfrankston/mailx-types": "^0.1.61",
-    "@bobfrankston/mailx-settings": "^0.1.60",
+    "@bobfrankston/mailx-types": "^0.1.65",
+    "@bobfrankston/mailx-settings": "^0.1.63",
     "@bobfrankston/mailx-bus": "^0.1.2",
     "mailparser": "^3.7.2"
   },
@@ -29,8 +29,8 @@
   },
   ".transformedSnapshot": {
     "dependencies": {
-      "@bobfrankston/mailx-types": "^0.1.61",
-      "@bobfrankston/mailx-settings": "^0.1.60",
+      "@bobfrankston/mailx-types": "^0.1.65",
+      "@bobfrankston/mailx-settings": "^0.1.63",
       "@bobfrankston/mailx-bus": "^0.1.2",
       "mailparser": "^3.7.2"
     }

package/store.d.ts

@@ -19,7 +19,7 @@
  * be able to consume it without depending on mailx-service — that's the
  * "arrow points the right way" property of the architecture.
  */
-import { type TrustFinding } from "@bobfrankston/mailx-types";
+import { type TrustFinding, type SpamScore } from "@bobfrankston/mailx-types";
 import type { ParsedInvite } from "@bobfrankston/mailx-types";
 import { MailxDB } from "./db.js";
 import { FileMessageStore } from "./file-store.js";
@@ -57,6 +57,9 @@ export interface StoreMessage extends MessageEnvelope {
     /** Evidence that this message is forged — empty for ordinary mail. See
      *  assessMessageTrust; the viewer renders these above the body. */
     trust: TrustFinding[];
+    /** The receiving server SpamAssassin score, present or not, flagged or
+     *  not. Shown as a badge so a below-threshold score is still visible. */
+    spamScore: SpamScore;
     listUnsubscribe: string;
     listUnsubscribeMail: string;
     listUnsubscribeHttp: string;

package/store.js

@@ -21,7 +21,7 @@
  */
 import * as fs from "node:fs";
 import { parseSerial } from "./parse-serial.js";
-import { assessMessageTrust } from "@bobfrankston/mailx-types";
+import { assessMessageTrust, spamScoreOf } from "@bobfrankston/mailx-types";
 import { parseInvite } from "@bobfrankston/mailx-types";
 import { storeBus } from "./bus.js";
 import { sanitizeHtml, htmlToPlainText } from "@bobfrankston/mailx-types";
@@ -543,12 +543,24 @@ export class Store {
         // needs no configuration and it is exactly the address a self-spoof
         // forges, so an alias the user never got round to listing is still
         // covered. (Claude Code 2026-08-25)
-        const trust = assessMessageTrust({
-            headerLines: (parsed.headerLines || []).map(h => ({ key: h.key, line: h.line })),
+        const trustHeaderLines = (parsed.headerLines || []).map(h => ({ key: h.key, line: h.line }));
+        const trustInput = {
+            headerLines: trustHeaderLines,
             fromAddress: envelope.from?.address || "",
             ownAddresses: [...recipients, (deliveredTo.match(/[^\s<>]+@[^\s<>]+/) || [""])[0]].filter(Boolean),
             bodyHtml,
-        });
+            bodyText,
+        };
+        const trust = assessMessageTrust(trustInput);
+        // The server's score travels separately from the findings: a finding is
+        // an accusation and fires only on evidence, this is a measurement the
+        // reader asked to see either way (Bob 2026-08-25). A 2.7 against a 4.5
+        // threshold is "did not quite trip the wire", which is not the same
+        // thing as clean — and that is exactly the message that got through.
+        // Same input as the findings, so the chip and the banner are computed
+        // from one analysis and cannot contradict each other about whether the
+        // sender was proved. (Claude Code 2026-08-27)
+        const spamScore = spamScoreOf(trustInput);
         if (bodyHtml && !allowRemote) {
             const result = sanitizeHtml(bodyHtml);
             bodyHtml = result.html;
@@ -560,7 +572,7 @@ export class Store {
             hasRemoteContent, remoteAllowed: allowRemote,
             attachments,
             cached: true,
-            deliveredTo, returnPath, trust,
+            deliveredTo, returnPath, trust, spamScore,
             listUnsubscribe, listUnsubscribeMail, listUnsubscribeHttp, listUnsubscribeOneClick,
             // body_path in the DB is stored relative to the body-store
             // basePath; resolve to absolute so the UI's "Source" button