@bobfrankston/mailx-types 0.1.108 → 0.1.111

package/index.d.ts

@@ -418,6 +418,66 @@ export declare function sanitizeHtml(html: string): {
  * boundaries so a multi-byte sequence is never cut in half.
  */
 export declare function encodeHeaderWord(text: string): string;
+/** Format one recipient for a message header: `Name <addr>`, with the name
+ *  quoted (and `\` / `"` escaped) when it contains RFC 5322 specials. Use this
+ *  for every From/To/Cc/Bcc header the app writes — never interpolate by hand. */
+export declare function formatAddressForHeader(name: string | undefined, address: string): string;
+/** Format a recipient list for a header (see formatAddressForHeader). */
+export declare function formatAddressListForHeader(list: {
+    name?: string;
+    address?: string;
+}[] | undefined): string;
+/** The addr-spec of every entry in an address header — what SMTP RCPT TO /
+ *  MAIL FROM must carry. One per comma-separated entry (commas inside quotes
+ *  and angle brackets don't split): the `<…>` part when there is one, else the
+ *  entry itself minus any `(comment)`. Entries without an `@` are dropped.
+ *
+ *  2026-10-25 — Claude Code (Opus 5.5), at Bob's direction. Replaces the
+ *  `/[\w.+-]+@[\w.-]+/g` scan that all three send paths (desktop mailx-imap,
+ *  Android android-bootstrap and sync-manager) carried as copies. That class
+ *  omits characters RFC 5322 allows in a local part (`= ! # $ % & ' * / ? ^ { | } ~`),
+ *  so `bernardgreenberg=msn.com@groups.io` (groups.io's relay address for a
+ *  member) matched as `msn.com@groups.io`: the To header was right, the
+ *  envelope was wrong, and groups.io bounced "The group 'msn.com' does not
+ *  exist". Taking the addr-spec whole avoids guessing at its characters. */
+export declare function envelopeAddresses(value: string): string[];
+/** What an SMTP send needs from a finished RFC 822 message. */
+export interface OutgoingEnvelope {
+    /** RCPT TO: every addr-spec in To, Cc and Bcc. */
+    recipients: string[];
+    /** MAIL FROM: the From addr-spec, or the caller's fallback. */
+    sender: string;
+    /** Subject header value, or "". */
+    subject: string;
+    /** Message-ID header value with its angle brackets, or "". */
+    messageId: string;
+    /** The message as transmitted: Bcc removed from the header section. */
+    rawToSend: string;
+}
+/** Build the SMTP envelope and the transmitted copy of an outgoing message.
+ *  ONE implementation for every send path (desktop mailx-imap sendRaw, Android
+ *  android-bootstrap and sync-manager), which each used to carry their own copy
+ *  of this code (2026-10-25 — Claude Code (Opus 5.5), at Bob's direction:
+ *  "economy of mechanism — why does that pattern appear in multiple places").
+ *  The copies are how one too-narrow address regex reached all three.
+ *
+ *  Reads the HEADER SECTION only, unfolded: matching the whole raw file once
+ *  scraped Cc lines out of a quoted reply chain into RCPT TO (2026-07-21).
+ *  Bcc is stripped from the header section only, continuation lines included,
+ *  so a quoted "Bcc:" in the body is never eaten. */
+export declare function outgoingEnvelope(raw: string, fallbackSender: string): OutgoingEnvelope;
+/** Entries of an address header that a reader would see as an address with
+ *  no `@` — e.g. the "Frankston" in `Frankston, Bob <x@y>`. Empty when sound. */
+export declare function findBareAddresses(value: string): string[];
+/** Send-time check (Bob 2026-10-05: "perhaps put in a debugging check"):
+ *  refuse to send when a header we built would carry an address without an
+ *  `@`, which the outgoing server would silently complete with its own
+ *  domain. Throws with the offending entries named; the caller's send error
+ *  path shows it to the user. */
+export declare function assertAddressHeaders(headers: Record<string, string | undefined>): void;
+export declare function tempAssertNoBogusIeccRecipients(lists: {
+    address?: string;
+}[][]): void;
 /**
  * Encode an address header value (From/To/Cc/Bcc/Reply-To), encoding only the
  * DISPLAY NAME of each address. The addr-spec must stay literal: encoding it
@@ -569,4 +629,6 @@ export declare function parseInvite(ics: string): ParsedInvite | null;
  * case specially").
  */
 export declare function inviteHasGoogleRsvp(bodyHtml: string): boolean;
+export { readListIdentity } from "./list-identity.js";
+export type { ListIdentity, ListHeaderLine } from "./list-identity.js";
 //# sourceMappingURL=index.d.ts.map

package/index.js

@@ -194,6 +194,162 @@ function bytesToBase64(bytes) {
     // btoa exists in browsers and in Node ≥16.
     return btoa(bin);
 }
+// 2026-10-05 — Claude Code (Opus 5.5), at Bob's direction.
+// The send paths wrote `${name} <${address}>` with the name UNQUOTED. A contact
+// named "Frankston, Bob" went out as `To: Frankston, Bob <from-eleanor@...>`,
+// which every reader parses as TWO recipients: a bare "Frankston" and
+// "Bob <...>". The outgoing server (iecc's qmail) completes a bare name with
+// its own domain, so the header said Frankston@iecc.com, and every reply-all
+// bounced. Seen on Eleanor's sends since 2026-07-27 ("Frankston, Bob",
+// "Yehezkel, Revital", "Elkin Frankston, Seth"). SMTP RCPT used the parsed
+// list, so the original send itself was delivered correctly; only the header
+// was wrong.
+/** RFC 5322 `specials`: a display name containing any of these must be a
+ *  quoted-string, or the comma / @ / angle bracket is read as syntax. */
+const DISPLAY_NAME_SPECIALS = /[()<>[\]:;@\\,."]/;
+/** Format one recipient for a message header: `Name <addr>`, with the name
+ *  quoted (and `\` / `"` escaped) when it contains RFC 5322 specials. Use this
+ *  for every From/To/Cc/Bcc header the app writes — never interpolate by hand. */
+export function formatAddressForHeader(name, address) {
+    const n = (name || "").trim();
+    if (!n)
+        return address;
+    const display = DISPLAY_NAME_SPECIALS.test(n) ? `"${n.replace(/[\\"]/g, "\\$&")}"` : n;
+    return `${display} <${address}>`;
+}
+/** Format a recipient list for a header (see formatAddressForHeader). */
+export function formatAddressListForHeader(list) {
+    return (list || []).map(a => formatAddressForHeader(a.name, a.address || "")).join(", ");
+}
+/** Split an address header on top-level commas (outside quotes and angle
+ *  brackets; `\` escapes inside quotes honored). */
+function splitAddressHeader(value) {
+    const parts = [];
+    let cur = "";
+    let inAngle = false;
+    let inQuote = false;
+    for (let i = 0; i < value.length; i++) {
+        const ch = value[i];
+        if (inQuote && ch === "\\" && i + 1 < value.length) {
+            cur += ch + value[++i];
+            continue;
+        }
+        if (ch === '"' && !inAngle)
+            inQuote = !inQuote;
+        else if (ch === "<" && !inQuote)
+            inAngle = true;
+        else if (ch === ">" && !inQuote)
+            inAngle = false;
+        if (ch === "," && !inAngle && !inQuote) {
+            parts.push(cur);
+            cur = "";
+            continue;
+        }
+        cur += ch;
+    }
+    if (cur.trim())
+        parts.push(cur);
+    return parts.map(p => p.trim()).filter(Boolean);
+}
+/** The addr-spec of every entry in an address header — what SMTP RCPT TO /
+ *  MAIL FROM must carry. One per comma-separated entry (commas inside quotes
+ *  and angle brackets don't split): the `<…>` part when there is one, else the
+ *  entry itself minus any `(comment)`. Entries without an `@` are dropped.
+ *
+ *  2026-10-25 — Claude Code (Opus 5.5), at Bob's direction. Replaces the
+ *  `/[\w.+-]+@[\w.-]+/g` scan that all three send paths (desktop mailx-imap,
+ *  Android android-bootstrap and sync-manager) carried as copies. That class
+ *  omits characters RFC 5322 allows in a local part (`= ! # $ % & ' * / ? ^ { | } ~`),
+ *  so `bernardgreenberg=msn.com@groups.io` (groups.io's relay address for a
+ *  member) matched as `msn.com@groups.io`: the To header was right, the
+ *  envelope was wrong, and groups.io bounced "The group 'msn.com' does not
+ *  exist". Taking the addr-spec whole avoids guessing at its characters. */
+export function envelopeAddresses(value) {
+    if (!value)
+        return [];
+    const out = [];
+    for (const part of splitAddressHeader(value)) {
+        const angle = /<([^<>]*)>\s*$/.exec(part);
+        const spec = (angle ? angle[1] : part.replace(/\([^()]*\)/g, "")).trim();
+        if (spec.includes("@"))
+            out.push(spec);
+    }
+    return out;
+}
+/** Build the SMTP envelope and the transmitted copy of an outgoing message.
+ *  ONE implementation for every send path (desktop mailx-imap sendRaw, Android
+ *  android-bootstrap and sync-manager), which each used to carry their own copy
+ *  of this code (2026-10-25 — Claude Code (Opus 5.5), at Bob's direction:
+ *  "economy of mechanism — why does that pattern appear in multiple places").
+ *  The copies are how one too-narrow address regex reached all three.
+ *
+ *  Reads the HEADER SECTION only, unfolded: matching the whole raw file once
+ *  scraped Cc lines out of a quoted reply chain into RCPT TO (2026-07-21).
+ *  Bcc is stripped from the header section only, continuation lines included,
+ *  so a quoted "Bcc:" in the body is never eaten. */
+export function outgoingEnvelope(raw, fallbackSender) {
+    const headerEnd = raw.search(/\r?\n\r?\n/);
+    const headerRaw = headerEnd === -1 ? raw : raw.slice(0, headerEnd);
+    const headerSec = headerRaw.replace(/\r?\n[ \t]+/g, " ");
+    const field = (name) => headerSec.match(new RegExp(`^${name}:[ \\t]*(.*)$`, "mi"))?.[1] ?? "";
+    const recipients = [
+        ...envelopeAddresses(field("To")),
+        ...envelopeAddresses(field("Cc")),
+        ...envelopeAddresses(field("Bcc")),
+    ];
+    const sender = envelopeAddresses(field("From"))[0] || fallbackSender;
+    const messageId = field("Message-ID").match(/<[^<>]+>/)?.[0] ?? "";
+    // The `(\r?\n|$)` tail takes the line ending with the header so no blank
+    // line is left mid-headers; the final trim covers Bcc as the last header.
+    const stripBcc = (h) => h.replace(/^Bcc:[^\n]*(\r?\n[ \t][^\n]*)*(\r?\n|$)/mi, "").replace(/\r?\n$/, "");
+    const rawToSend = headerEnd === -1 ? stripBcc(raw) : stripBcc(headerRaw) + raw.slice(headerEnd);
+    return { recipients, sender, subject: field("Subject").trim(), messageId, rawToSend };
+}
+/** Entries of an address header that a reader would see as an address with
+ *  no `@` — e.g. the "Frankston" in `Frankston, Bob <x@y>`. Empty when sound. */
+export function findBareAddresses(value) {
+    if (!value)
+        return [];
+    return splitAddressHeader(value).filter(part => {
+        const angle = /<([^>]*)>\s*$/.exec(part);
+        const addrSpec = angle ? angle[1] : part;
+        return !addrSpec.includes("@");
+    });
+}
+/** Send-time check (Bob 2026-10-05: "perhaps put in a debugging check"):
+ *  refuse to send when a header we built would carry an address without an
+ *  `@`, which the outgoing server would silently complete with its own
+ *  domain. Throws with the offending entries named; the caller's send error
+ *  path shows it to the user. */
+export function assertAddressHeaders(headers) {
+    for (const [label, value] of Object.entries(headers)) {
+        const bare = findBareAddresses(value || "");
+        if (bare.length) {
+            throw new Error(`${label} header would contain ${bare.map(b => `"${b}"`).join(", ")} with no @ — the mail server would add its own domain to it. Not sent. Header: ${value}`);
+        }
+    }
+}
+// ─── TEMPORARY — REMOVE AFTER 2026-10-19 ───────────────────────────────────
+// 2026-10-05 — Claude Code (Opus 5.5), at Bob's direction ("add a temporary
+// bug check"). Leftovers of the unquoted-name bug above: old message headers
+// and learned contacts still hold bogus addresses like Frankston@iecc.com,
+// which reply-all copies — and they have an @, so assertAddressHeaders lets
+// them through. Real iecc recipients per Bob: johnl@ (2026-10-05), and
+// hostmaster@, accounts@, publishers@ "may be valid" — allowed.
+// iecc is specific to Bob's setup, which is why this is dated and temporary,
+// not a feature. Remove this function and its two callers (mailx-service
+// send, mailx-store-web send) once the old threads have aged out; tracked in
+// TODO.md.
+const TEMP_IECC_ALLOWED = new Set(["johnl@iecc.com", "hostmaster@iecc.com", "accounts@iecc.com", "publishers@iecc.com"]);
+export function tempAssertNoBogusIeccRecipients(lists) {
+    const bad = lists.flat()
+        .map(a => (a?.address || "").trim())
+        .filter(addr => /@iecc\.com$/i.test(addr) && !TEMP_IECC_ALLOWED.has(addr.toLowerCase()));
+    if (bad.length) {
+        throw new Error(`Recipient ${bad.join(", ")} looks like a name that the iecc server turned into an address (known real iecc addresses: ${[...TEMP_IECC_ALLOWED].join(", ")}). Remove it and send again. [temporary check, 2026-10-05]`);
+    }
+}
+// ─── END TEMPORARY ─────────────────────────────────────────────────────────
 /**
  * Encode an address header value (From/To/Cc/Bcc/Reply-To), encoding only the
  * DISPLAY NAME of each address. The addr-spec must stay literal: encoding it
@@ -234,7 +390,9 @@ export function encodeAddressHeader(value) {
         const m = /^(.*?)\s*(<[^>]*>)\s*$/.exec(p);
         if (!m)
             return p; // bare addr-spec, nothing to encode
-        const display = m[1].replace(/^"(.*)"$/s, "$1");
+        // 2026-10-05 Claude Code: undo formatAddressForHeader's \" / \\ escapes
+        // before RFC 2047-encoding (an encoded-word carries the raw text).
+        const display = m[1].replace(/^"(.*)"$/s, "$1").replace(/\\(.)/g, "$1");
         if (!display)
             return m[2];
         // eslint-disable-next-line no-control-regex
@@ -749,4 +907,6 @@ export function inviteHasGoogleRsvp(bodyHtml) {
         return false;
     return /calendar\.google\.com\/calendar\/event\?action=RESPOND/i.test(bodyHtml);
 }
+// Delivery address + mailing-list identity for reply's From (desktop + Android).
+export { readListIdentity } from "./list-identity.js";
 //# sourceMappingURL=index.js.map

package/list-identity.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Which of the reader's addresses a message was delivered to, and which
+ * mailing list it came through — the facts reply uses to pick a From.
+ *
+ * 2026-10-25 — Claude Code (Opus 5.5), at Bob's direction. Posting to the
+ * Multicians list (groups.io) needs From: Multicians@bobf.frankston.com, the
+ * subscribed address, and nothing in the message's headers names it:
+ *   - groups.io writes its OWN `Delivered-To: mailing list multicians@groups.io`
+ *     (the qmail/ezmlm loop-detection convention), which the old code took to
+ *     be the reader's address — so a reply's From became the list itself;
+ *   - the reader's own Delivered-To was lost before the message reached
+ *     IMAP. IECC did record it (`bobf-Multicians@bobf.frankston.com`), but
+ *     an older deployed mlproc (processletter.ts parseEnvelope) rewrote that
+ *     line with groups.io's marker — see MailApps/mlproc/.llm/
+ *     delivered-to-loss.md. (Corrected 2026-10-25; this said IECC recorded none.)
+ *   - groups.io names the subscriber only in its footer, after the
+ *     Unsubscribe link: `.../leave/... [Multicians@bobf.frankston.com]`.
+ *
+ * One module for desktop (mailx-store) and Android (mailx-store-web), so the
+ * two cannot drift apart again. Pure: header lines and body text in, strings
+ * out — no I/O, browser-safe.
+ */
+/** A header line as mailparser's `headerLines` gives it: lowercase key, raw `Key: value` line. */
+export interface ListHeaderLine {
+    key: string;
+    line: string;
+}
+export interface ListIdentity {
+    /** Address the RECEIVING server recorded delivering this copy to
+     *  (Delivered-To / X-Original-To / Envelope-To), or "". A mailing list's
+     *  own `Delivered-To: mailing list …` is never taken. */
+    deliveredTo: string;
+    /** List-Id identifier (`multicians.groups.io`), lowercase, or "". */
+    listId: string;
+    /** Addresses a post to this list would be sent To, most specific first:
+     *  List-Post, Reply-To, Sender. Bare, lowercase. Empty when not list mail. */
+    listAddresses: string[];
+    /** The reader's subscribed address as the list itself states it (groups.io
+     *  footer), or "". */
+    listSubscriber: string;
+    /** The author's real address when the list rewrote From into an
+     *  undeliverable stand-in, else "". groups.io turns
+     *  `bernardgreenberg@msn.com` into `"Bernard Greenberg via groups.io"
+     *  <bernardgreenberg=msn.com@groups.io>` (so his own domain's DMARC policy
+     *  doesn't reject the list's copy) and refuses mail sent to that:
+     *  "510 5.1.1 … is not a real mailbox. To reply to this person, send your
+     *  message to bernardgreenberg@msn.com" (Bob's bounce, 2026-10-26). The
+     *  real address is in Resent-From. (2026-10-26, Claude Code (Opus 5.5).) */
+    listAuthor: string;
+}
+/** Read the delivery and list facts out of a parsed message. */
+export declare function readListIdentity(headerLines: readonly ListHeaderLine[], bodyText: string, bodyHtml: string): ListIdentity;
+//# sourceMappingURL=list-identity.d.ts.map

package/list-identity.js

@@ -0,0 +1,97 @@
+/**
+ * Which of the reader's addresses a message was delivered to, and which
+ * mailing list it came through — the facts reply uses to pick a From.
+ *
+ * 2026-10-25 — Claude Code (Opus 5.5), at Bob's direction. Posting to the
+ * Multicians list (groups.io) needs From: Multicians@bobf.frankston.com, the
+ * subscribed address, and nothing in the message's headers names it:
+ *   - groups.io writes its OWN `Delivered-To: mailing list multicians@groups.io`
+ *     (the qmail/ezmlm loop-detection convention), which the old code took to
+ *     be the reader's address — so a reply's From became the list itself;
+ *   - the reader's own Delivered-To was lost before the message reached
+ *     IMAP. IECC did record it (`bobf-Multicians@bobf.frankston.com`), but
+ *     an older deployed mlproc (processletter.ts parseEnvelope) rewrote that
+ *     line with groups.io's marker — see MailApps/mlproc/.llm/
+ *     delivered-to-loss.md. (Corrected 2026-10-25; this said IECC recorded none.)
+ *   - groups.io names the subscriber only in its footer, after the
+ *     Unsubscribe link: `.../leave/... [Multicians@bobf.frankston.com]`.
+ *
+ * One module for desktop (mailx-store) and Android (mailx-store-web), so the
+ * two cannot drift apart again. Pure: header lines and body text in, strings
+ * out — no I/O, browser-safe.
+ */
+/** Value of every occurrence of a header, unfolded, in message order. */
+function headerValues(lines, name) {
+    const want = name.toLowerCase();
+    const out = [];
+    for (const h of lines || []) {
+        if ((h.key || "").toLowerCase() !== want)
+            continue;
+        const colon = h.line.indexOf(":");
+        if (colon >= 0)
+            out.push(h.line.slice(colon + 1).replace(/\r?\n[ \t]+/g, " ").trim());
+    }
+    return out;
+}
+function bareAddress(value) {
+    return ((value || "").match(/[^\s<>,;:"]+@[^\s<>,;:"]+/)?.[0] || "").toLowerCase();
+}
+/** qmail/ezmlm, and groups.io after them, stamp `Delivered-To: mailing list
+ *  <addr>` on the copy they fan out, to catch mail loops. It names the LIST,
+ *  not the subscriber, and it sits below the receiving server's own line
+ *  when there is one. */
+const LIST_DELIVERED_TO = /^mailing list\s/i;
+/** The footer groups.io appends to every copy:
+ *    text: `Unsubscribe: https://groups.io/g/<group>/leave/<ids> [addr]`
+ *    html: `<a href="https://groups.io/g/<group>/leave/<ids>">Unsubscribe</a> [addr]`
+ *  Each piece matches one way only (the URL stops at quote/space, then the
+ *  optional anchor tail, then blanks, then the bracket), so a long body with
+ *  no footer fails in a single pass. */
+const GROUPS_IO_SUBSCRIBER = /groups\.io\/g\/[^\s"'<>\/]+\/leave\/[^\s"'<>]*(?:["']>Unsubscribe<\/a>)?\s*\[([^\s\[\]<>@]+@[^\s\[\]<>@]+)\]/i;
+/** Read the delivery and list facts out of a parsed message. */
+export function readListIdentity(headerLines, bodyText, bodyHtml) {
+    // Receiving-server headers: each agent PREPENDS its own, so the first
+    // that is not a list's loop marker is the final delivery to this mailbox.
+    let deliveredTo = "";
+    for (const key of ["delivered-to", "x-original-to", "envelope-to"]) {
+        for (const value of headerValues(headerLines, key)) {
+            if (LIST_DELIVERED_TO.test(value))
+                continue;
+            if (bareAddress(value)) {
+                deliveredTo = value;
+                break;
+            }
+        }
+        if (deliveredTo)
+            break;
+    }
+    const rawListId = headerValues(headerLines, "list-id")[0] || "";
+    const listId = ((rawListId.match(/<([^>]+)>/)?.[1]) || rawListId).trim().toLowerCase();
+    if (!listId)
+        return { deliveredTo, listId: "", listAddresses: [], listSubscriber: "", listAuthor: "" };
+    const listPost = (headerValues(headerLines, "list-post")[0] || "").match(/<mailto:([^>?]+)/i)?.[1] || "";
+    const listAddresses = [];
+    for (const candidate of [listPost, headerValues(headerLines, "reply-to")[0], headerValues(headerLines, "sender")[0]]) {
+        const addr = bareAddress(candidate || "");
+        if (addr && !listAddresses.includes(addr))
+            listAddresses.push(addr);
+    }
+    // Only groups.io states the subscriber, and only in its footer; the List-Id
+    // gate keeps the pattern off every other message's body.
+    let listSubscriber = "";
+    let listAuthor = "";
+    if (listId === "groups.io" || listId.endsWith(".groups.io")) {
+        const m = (bodyText || "").match(GROUPS_IO_SUBSCRIBER) || (bodyHtml || "").match(GROUPS_IO_SUBSCRIBER);
+        if (m)
+            listSubscriber = m[1];
+        // A rewritten From is `local=domain@groups.io`. Resent-From carries
+        // the original; failing that, the rewrite itself encodes it (the
+        // LAST `=` separates local part from domain).
+        const from = bareAddress(headerValues(headerLines, "from")[0] || "");
+        const rewritten = from.match(/^(.+)=([^=@]+)@groups\.io$/);
+        if (rewritten)
+            listAuthor = bareAddress(headerValues(headerLines, "resent-from")[0] || "") || `${rewritten[1]}@${rewritten[2]}`;
+    }
+    return { deliveredTo, listId, listAddresses, listSubscriber, listAuthor };
+}
+//# sourceMappingURL=list-identity.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bobfrankston/mailx-types",
-  "version": "0.1.108",
+  "version": "0.1.111",
   "type": "module",
   "main": "index.js",
   "types": "index.d.ts",

package/trust.js

@@ -934,6 +934,15 @@ function redirectorLink(input) {
     //    trusted domain into From.
     if (senderDomain && input.senderTrusted)
         return null;
+    // 6. (2026-10-12, Claude Code (Opus 5.5), at Bob's direction: "This is
+    //    from me to me".) The proved sender is the READER — a copy of their
+    //    own reply cc'd to themselves, From bob2021b@bob.ma, DKIM_VALID_AU for
+    //    bob.ma. "Only the sender could vouch for the link" — and the sender
+    //    is the person reading, who chose the link. Same proof requirement as
+    //    rule 5: an unproved From of the reader's own address is what a
+    //    self-spoof looks like, and stays checked.
+    if (senderDomain && input.ownAddresses.map(bare).includes(bare(input.fromAddress)))
+        return null;
     // 3. (2026-09-08) The redirector belongs to a reader-listed intermediary
     //    that provably handled the message. Google Calendar wraps every link
     //    in an invitation as google.com/url?q=…, signs the mail d=google.com,
@@ -941,6 +950,18 @@ function redirectorLink(input) {
     //    is "I trust google.com to do that". Same second-party logic: the
     //    host spending its reputation is the host that signed.
     const intermediary = provedIntermediary(input);
+    // 7. (2026-10-23, Claude Code (Opus 5.5), at Bob's direction: "I want to
+    //    allow mail from Aaron through Google but not all mail through
+    //    Google. I thought I had specified that.") He had: allowlist.jsonc
+    //    `trustedSendersVia: ["aaronsylvan.com via google.com"]`. But Aaron's
+    //    Google Calendar invite is signed only d=google.com, so the From is
+    //    never proved on its own, rule 5 cannot fire, and the only offer left
+    //    was rule 3's "trust google.com as an intermediary" for ALL mail
+    //    Google signs. The via pair is the narrower answer and its proof is
+    //    the same one provedSenderVia demands (the relay's verified
+    //    signature): links through THAT relay's own hosts are cleared for
+    //    THAT sender only. Links through any other redirector stay checked.
+    const senderVia = parseSenderVia(provedSenderVia(input));
     const signers = dkimSigners(input);
     for (const m of bodyHtml.matchAll(/href\s*=\s*["']([^"']+)["']/gi)) {
         let url;
@@ -956,6 +977,8 @@ function redirectorLink(input) {
             continue; // the sender's own host
         if (intermediary && sameOrg(url.hostname, intermediary))
             continue; // a trusted relay's own host
+        if (senderVia && sameOrg(url.hostname, senderVia.signer))
+            continue; // this sender's trusted relay (rule 7)
         for (const [, value] of url.searchParams) {
             let target;
             try {
@@ -1042,11 +1065,57 @@ const RELAY_IDENTITY_HEADERS = [
     "x-auth-id",
     "x-authenticated-user",
 ];
+/**
+ * The author a mailing list rewrote out of From, or "" when the list did not
+ * rewrite it or left no trace of who it was.
+ *
+ * 2026-10-15 — Claude Code (Opus 5.5), at Bob's direction. A groups.io post by
+ * cd@libertyhaven.com arrived as `From: cd=libertyhaven.com@groups.io` (the
+ * list rewrites From to its own domain so the author's DMARC policy cannot
+ * bounce it), carrying `X-Authenticated-Sender: libertyhaven@libertyhaven.com`
+ * from the AUTHOR'S own host, one hop before the list. relayAuthMismatch
+ * compared that stamp with groups.io and painted a valid post red. A stamp
+ * describes the From that existed at the hop that wrote it — upstream of the
+ * list, that is the author's From, not the list's.
+ *
+ * Order matters. The `local=domain@list` form is built by the list from the
+ * From it actually received, so it is preferred over headers that merely
+ * travelled with the message (X-Original-From, Resent-From) and that an
+ * upstream sender could have written for itself.
+ */
+function listRewrittenAuthor(input, fromDomain) {
+    const list = listProof(input);
+    if (!list.proved || !sameOrg(fromDomain, list.host))
+        return "";
+    const local = bare(input.fromAddress).split("@")[0];
+    const encoded = local.match(/^([^=]+)=([a-z0-9.-]+\.[a-z]{2,})$/i);
+    if (encoded)
+        return `${encoded[1]}@${encoded[2]}`.toLowerCase();
+    for (const name of ["x-original-from", "resent-from"]) {
+        const addr = bare(header(input.headerLines, name));
+        if (addr.includes("@"))
+            return addr;
+    }
+    return "";
+}
 function relayAuthMismatch(input) {
-    const from = bare(input.fromAddress);
-    const fromDomain = from.split("@")[1] || "";
+    let from = bare(input.fromAddress);
+    let fromDomain = from.split("@")[1] || "";
     if (!fromDomain)
         return null;
+    // A list that provably delivered this and rewrote From to itself: the
+    // relay stamps are upstream of the list, so they are compared with the
+    // author the list rewrote out. If the list left no trace of the author
+    // there is nothing the stamp could be compared with, and no finding.
+    // (2026-10-15 — see listRewrittenAuthor.)
+    const list = listProof(input);
+    if (list.proved && sameOrg(fromDomain, list.host)) {
+        const author = listRewrittenAuthor(input, fromDomain);
+        if (!author)
+            return null;
+        from = author;
+        fromDomain = author.split("@")[1];
+    }
     for (const name of RELAY_IDENTITY_HEADERS) {
         const stamped = bare(header(input.headerLines, name));
         const stampedDomain = stamped.split("@")[1] || "";