@bobfrankston/mailx-types 0.1.111 → 0.1.112

package/address.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Email address parsing — the ONE place mailx reads addresses out of header
+ * values and decides whether a string is an address.
+ *
+ * 2026-10-26 — Claude Code (Opus 5.5), at Bob's direction ("fold the other
+ * address regexes into the shared functions"). Before this, about a dozen
+ * call sites each carried their own address regex: the send paths, trust,
+ * the store, list-identity, compose, the editor's link detection, contacts,
+ * groups and the CLI. They disagreed on which characters an address may
+ * hold, and the narrowest one (`[\w.+-]+@`) cut
+ * `bernardgreenberg=msn.com@groups.io` to `msn.com@groups.io` in RCPT TO.
+ * Parsing is structural here — split the header on top-level commas, take
+ * the `<…>` part or the bare entry — so no function guesses at the
+ * characters of a local part.
+ *
+ * Pure, no I/O, browser-safe.
+ */
+/** One parsed entry of an address header. */
+export interface ParsedAddress {
+    /** Display name, unquoted and unescaped; "" when there is none. */
+    name: string;
+    /** The addr-spec, as written (case kept). */
+    address: string;
+}
+/** Split an address header on top-level commas (outside quotes and angle
+ *  brackets; `\` escapes inside quotes honored). Moved here from index.ts. */
+export declare function splitAddressHeader(value: string): string[];
+/** Every entry of an address header that carries an addr-spec, with its
+ *  display name. Entries with no address (a bare name, an empty group like
+ *  `Undisclosed recipients:;`) are left out. */
+export declare function parseAddressList(value: string): ParsedAddress[];
+/** The first entry of an address header value, or null. */
+export declare function parseAddress(value: string): ParsedAddress | null;
+/** The addr-spec of every entry — what SMTP RCPT TO / MAIL FROM must carry.
+ *
+ *  2026-10-25: replaced the `/[\w.+-]+@[\w.-]+/g` scan that all three send
+ *  paths carried, which omitted characters RFC 5322 allows in a local part
+ *  (`= ! # $ % & ' * / ? ^ { | } ~`) and so turned
+ *  `bernardgreenberg=msn.com@groups.io` into `msn.com@groups.io`. */
+export declare function envelopeAddresses(value: string): string[];
+/** The first addr-spec in a header value (`"Name" <a@b>`, `a@b (comment)`,
+ *  or a bare `a@b`), or "". Case kept; callers that compare lowercase it. */
+export declare function firstAddress(value: string): string;
+/** Is `s` — a bare addr-spec, no display name — plausibly deliverable?
+ *  Something before the last `@`, a dotted domain after it, and no blanks or
+ *  angle brackets anywhere. The rule all five copies of
+ *  `/^[^\s<>@]+@[^\s<>@]+\.[^\s<>@]+$/` encoded, written without a pattern
+ *  whose domain part could be split two ways. Any character RFC 5322 allows
+ *  in a local part passes. */
+export declare function isValidAddress(s: string): boolean;
+export declare const ADDRESS_IN_TEXT: string;
+/** Every address-shaped run in free text. */
+export declare function findAddressesInText(text: string): string[];
+//# sourceMappingURL=address.d.ts.map

package/address.js

@@ -0,0 +1,138 @@
+/**
+ * Email address parsing — the ONE place mailx reads addresses out of header
+ * values and decides whether a string is an address.
+ *
+ * 2026-10-26 — Claude Code (Opus 5.5), at Bob's direction ("fold the other
+ * address regexes into the shared functions"). Before this, about a dozen
+ * call sites each carried their own address regex: the send paths, trust,
+ * the store, list-identity, compose, the editor's link detection, contacts,
+ * groups and the CLI. They disagreed on which characters an address may
+ * hold, and the narrowest one (`[\w.+-]+@`) cut
+ * `bernardgreenberg=msn.com@groups.io` to `msn.com@groups.io` in RCPT TO.
+ * Parsing is structural here — split the header on top-level commas, take
+ * the `<…>` part or the bare entry — so no function guesses at the
+ * characters of a local part.
+ *
+ * Pure, no I/O, browser-safe.
+ */
+/** Split an address header on top-level commas (outside quotes and angle
+ *  brackets; `\` escapes inside quotes honored). Moved here from index.ts. */
+export function splitAddressHeader(value) {
+    const parts = [];
+    let cur = "";
+    let inAngle = false;
+    let inQuote = false;
+    for (let i = 0; i < value.length; i++) {
+        const ch = value[i];
+        if (inQuote && ch === "\\" && i + 1 < value.length) {
+            cur += ch + value[++i];
+            continue;
+        }
+        if (ch === '"' && !inAngle)
+            inQuote = !inQuote;
+        else if (ch === "<" && !inQuote)
+            inAngle = true;
+        else if (ch === ">" && !inQuote)
+            inAngle = false;
+        if (ch === "," && !inAngle && !inQuote) {
+            parts.push(cur);
+            cur = "";
+            continue;
+        }
+        cur += ch;
+    }
+    if (cur.trim())
+        parts.push(cur);
+    return parts.map(p => p.trim()).filter(Boolean);
+}
+/** Text on both sides of the last `@`: the least an addr-spec must have. */
+function hasAddrShape(spec) {
+    const at = spec.lastIndexOf("@");
+    return at > 0 && at < spec.length - 1;
+}
+/** Every entry of an address header that carries an addr-spec, with its
+ *  display name. Entries with no address (a bare name, an empty group like
+ *  `Undisclosed recipients:;`) are left out. */
+export function parseAddressList(value) {
+    if (!value)
+        return [];
+    const out = [];
+    for (const part of splitAddressHeader(value)) {
+        const angle = /<([^<>]*)>\s*$/.exec(part);
+        let name = "";
+        let spec;
+        if (angle) {
+            spec = angle[1].trim();
+            name = part.slice(0, angle.index).replace(/\([^()]*\)/g, "").trim();
+            if (name.length >= 2 && name.startsWith('"') && name.endsWith('"'))
+                name = name.slice(1, -1).replace(/\\(.)/g, "$1");
+        }
+        else {
+            // No angle brackets: an addr-spec has no unquoted blanks, so when
+            // the entry has words around it ("mailing list x@y", a sloppy
+            // "Bob bob@x.com") the address is the word that has the shape.
+            const words = part.replace(/\([^()]*\)/g, " ").trim().split(/\s+/);
+            spec = words.find(hasAddrShape) || "";
+        }
+        if (hasAddrShape(spec))
+            out.push({ name, address: spec });
+    }
+    return out;
+}
+/** The first entry of an address header value, or null. */
+export function parseAddress(value) {
+    return parseAddressList(value)[0] || null;
+}
+/** The addr-spec of every entry — what SMTP RCPT TO / MAIL FROM must carry.
+ *
+ *  2026-10-25: replaced the `/[\w.+-]+@[\w.-]+/g` scan that all three send
+ *  paths carried, which omitted characters RFC 5322 allows in a local part
+ *  (`= ! # $ % & ' * / ? ^ { | } ~`) and so turned
+ *  `bernardgreenberg=msn.com@groups.io` into `msn.com@groups.io`. */
+export function envelopeAddresses(value) {
+    return parseAddressList(value).map(a => a.address);
+}
+/** The first addr-spec in a header value (`"Name" <a@b>`, `a@b (comment)`,
+ *  or a bare `a@b`), or "". Case kept; callers that compare lowercase it. */
+export function firstAddress(value) {
+    return parseAddressList(value)[0]?.address || "";
+}
+/** Is `s` — a bare addr-spec, no display name — plausibly deliverable?
+ *  Something before the last `@`, a dotted domain after it, and no blanks or
+ *  angle brackets anywhere. The rule all five copies of
+ *  `/^[^\s<>@]+@[^\s<>@]+\.[^\s<>@]+$/` encoded, written without a pattern
+ *  whose domain part could be split two ways. Any character RFC 5322 allows
+ *  in a local part passes. */
+export function isValidAddress(s) {
+    const t = (s || "").trim();
+    if (!t || /[\s<>]/.test(t))
+        return false;
+    const at = t.lastIndexOf("@");
+    if (at <= 0)
+        return false;
+    const local = t.slice(0, at);
+    const domain = t.slice(at + 1);
+    if (local.includes("@") || domain.includes("@"))
+        return false;
+    const dot = domain.indexOf(".");
+    return dot > 0 && dot < domain.length - 1;
+}
+/** Regex SOURCE for an address appearing inside free text (prose, a display
+ *  name) — where there is no header structure to split on, so a pattern is
+ *  the only tool. Local part: the RFC 5322 atext characters plus dots; domain:
+ *  dotted labels. Each piece matches one way only (`@` and `.` are not in the
+ *  classes they separate). Exported as a source string so a caller can embed
+ *  it in a larger alternation (the spell checker's skip spans).
+ *  (2026-10-26, Claude Code (Opus 5.5): replaces the spell checker's
+ *  `[\w.+\-]+@…` and displayNameClaimsOtherAddress's `[A-Za-z0-9._%+-]+@…`.) */
+// The lookbehind lets a match START only where a run of local-part characters
+// starts. Without it a long run with no `@` (a pasted base64 blob) was retried
+// from every position inside it, re-reading the rest each time: 80,000
+// characters took 5.3 s (measured 2026-10-26). With it each run is read once.
+const LOCAL_CHARS = String.raw `\w.!#$%&'*+\/=?^\`{|}~\-`;
+export const ADDRESS_IN_TEXT = String.raw `(?<![${LOCAL_CHARS}])[${LOCAL_CHARS}]+@[A-Za-z0-9\-]+(?:\.[A-Za-z0-9\-]+)+`;
+/** Every address-shaped run in free text. */
+export function findAddressesInText(text) {
+    return (text || "").match(new RegExp(ADDRESS_IN_TEXT, "g")) || [];
+}
+//# sourceMappingURL=address.js.map

package/groups.js

@@ -8,6 +8,7 @@
  * names of other groups (recursive aliasing). Cycles are detected; depth
  * is capped at 10 nested levels.
  */
+import { firstAddress } from "./address.js";
 /** Split a comma-or-semicolon recipient string into tokens. Respects
  *  angle-bracket address blocks ("Name, Suffix <a@b>") so a comma inside
  *  the display name doesn't split the entry. */
@@ -40,15 +41,15 @@ export function splitRecipients(raw) {
  *  a display name)? Anything containing "@" with non-whitespace on both
  *  sides counts. */
 export function isAddressToken(token) {
-    return /^[^@\s][^@]*@[^@\s]+(\s|$)|<[^>]+@[^>]+>/.test(token) || /^[^\s<>@]+@[^\s<>@]+$/.test(token);
+    // 2026-10-26 — Claude Code (Opus 5.5): shared parser (address.ts) instead of
+    // its own patterns; "Name <a@b>" and a bare "a@b" both parse.
+    return !!firstAddress(token);
 }
 /** Extract the bare email address from a token. Returns the original token
  *  lowercased if it has no angle-bracket form. */
 export function extractAddress(token) {
-    const m = token.match(/<([^>]+)>/);
-    if (m)
-        return m[1].trim().toLowerCase();
-    return token.trim().toLowerCase();
+    // 2026-10-26 — Claude Code (Opus 5.5): shared parser (address.ts).
+    return (firstAddress(token) || token).trim().toLowerCase();
 }
 /** Expand a recipient string by resolving group names against `groups`.
  *  Group names take precedence: if a token matches a group name AND looks

package/index.d.ts

@@ -427,20 +427,6 @@ export declare function formatAddressListForHeader(list: {
     name?: string;
     address?: string;
 }[] | undefined): string;
-/** The addr-spec of every entry in an address header — what SMTP RCPT TO /
- *  MAIL FROM must carry. One per comma-separated entry (commas inside quotes
- *  and angle brackets don't split): the `<…>` part when there is one, else the
- *  entry itself minus any `(comment)`. Entries without an `@` are dropped.
- *
- *  2026-10-25 — Claude Code (Opus 5.5), at Bob's direction. Replaces the
- *  `/[\w.+-]+@[\w.-]+/g` scan that all three send paths (desktop mailx-imap,
- *  Android android-bootstrap and sync-manager) carried as copies. That class
- *  omits characters RFC 5322 allows in a local part (`= ! # $ % & ' * / ? ^ { | } ~`),
- *  so `bernardgreenberg=msn.com@groups.io` (groups.io's relay address for a
- *  member) matched as `msn.com@groups.io`: the To header was right, the
- *  envelope was wrong, and groups.io bounced "The group 'msn.com' does not
- *  exist". Taking the addr-spec whole avoids guessing at its characters. */
-export declare function envelopeAddresses(value: string): string[];
 /** What an SMTP send needs from a finished RFC 822 message. */
 export interface OutgoingEnvelope {
     /** RCPT TO: every addr-spec in To, Cc and Bcc. */
@@ -629,6 +615,8 @@ export declare function parseInvite(ics: string): ParsedInvite | null;
  * case specially").
  */
 export declare function inviteHasGoogleRsvp(bodyHtml: string): boolean;
+export { splitAddressHeader, parseAddressList, parseAddress, envelopeAddresses, firstAddress, isValidAddress, ADDRESS_IN_TEXT, findAddressesInText } from "./address.js";
+export type { ParsedAddress } from "./address.js";
 export { readListIdentity } from "./list-identity.js";
 export type { ListIdentity, ListHeaderLine } from "./list-identity.js";
 //# sourceMappingURL=index.d.ts.map

package/index.js

@@ -221,61 +221,6 @@ export function formatAddressForHeader(name, address) {
 export function formatAddressListForHeader(list) {
     return (list || []).map(a => formatAddressForHeader(a.name, a.address || "")).join(", ");
 }
-/** Split an address header on top-level commas (outside quotes and angle
- *  brackets; `\` escapes inside quotes honored). */
-function splitAddressHeader(value) {
-    const parts = [];
-    let cur = "";
-    let inAngle = false;
-    let inQuote = false;
-    for (let i = 0; i < value.length; i++) {
-        const ch = value[i];
-        if (inQuote && ch === "\\" && i + 1 < value.length) {
-            cur += ch + value[++i];
-            continue;
-        }
-        if (ch === '"' && !inAngle)
-            inQuote = !inQuote;
-        else if (ch === "<" && !inQuote)
-            inAngle = true;
-        else if (ch === ">" && !inQuote)
-            inAngle = false;
-        if (ch === "," && !inAngle && !inQuote) {
-            parts.push(cur);
-            cur = "";
-            continue;
-        }
-        cur += ch;
-    }
-    if (cur.trim())
-        parts.push(cur);
-    return parts.map(p => p.trim()).filter(Boolean);
-}
-/** The addr-spec of every entry in an address header — what SMTP RCPT TO /
- *  MAIL FROM must carry. One per comma-separated entry (commas inside quotes
- *  and angle brackets don't split): the `<…>` part when there is one, else the
- *  entry itself minus any `(comment)`. Entries without an `@` are dropped.
- *
- *  2026-10-25 — Claude Code (Opus 5.5), at Bob's direction. Replaces the
- *  `/[\w.+-]+@[\w.-]+/g` scan that all three send paths (desktop mailx-imap,
- *  Android android-bootstrap and sync-manager) carried as copies. That class
- *  omits characters RFC 5322 allows in a local part (`= ! # $ % & ' * / ? ^ { | } ~`),
- *  so `bernardgreenberg=msn.com@groups.io` (groups.io's relay address for a
- *  member) matched as `msn.com@groups.io`: the To header was right, the
- *  envelope was wrong, and groups.io bounced "The group 'msn.com' does not
- *  exist". Taking the addr-spec whole avoids guessing at its characters. */
-export function envelopeAddresses(value) {
-    if (!value)
-        return [];
-    const out = [];
-    for (const part of splitAddressHeader(value)) {
-        const angle = /<([^<>]*)>\s*$/.exec(part);
-        const spec = (angle ? angle[1] : part.replace(/\([^()]*\)/g, "")).trim();
-        if (spec.includes("@"))
-            out.push(spec);
-    }
-    return out;
-}
 /** Build the SMTP envelope and the transmitted copy of an outgoing message.
  *  ONE implementation for every send path (desktop mailx-imap sendRaw, Android
  *  android-bootstrap and sync-manager), which each used to carry their own copy
@@ -667,8 +612,9 @@ export function displayNameClaimsOtherAddress(name, address) {
         return null;
     const real = (address || "").trim().toLowerCase();
     // Deliberately loose: anything shaped like local@domain.tld inside the name.
-    const m = n.match(/[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/g);
-    if (!m)
+    // 2026-10-26 — Claude Code (Opus 5.5): shared free-text pattern (address.ts).
+    const m = findAddressesInText(n);
+    if (!m.length)
         return null;
     const realDomain = real.split("@").pop() || "";
     for (const claimed of m) {
@@ -907,6 +853,9 @@ export function inviteHasGoogleRsvp(bodyHtml) {
         return false;
     return /calendar\.google\.com\/calendar\/event\?action=RESPOND/i.test(bodyHtml);
 }
+// Address parsing: one splitter, one notion of "is this an address".
+import { splitAddressHeader, envelopeAddresses, findAddressesInText } from "./address.js";
+export { splitAddressHeader, parseAddressList, parseAddress, envelopeAddresses, firstAddress, isValidAddress, ADDRESS_IN_TEXT, findAddressesInText } from "./address.js";
 // Delivery address + mailing-list identity for reply's From (desktop + Android).
 export { readListIdentity } from "./list-identity.js";
 //# sourceMappingURL=index.js.map

package/list-identity.js

@@ -20,6 +20,7 @@
  * two cannot drift apart again. Pure: header lines and body text in, strings
  * out — no I/O, browser-safe.
  */
+import { firstAddress } from "./address.js";
 /** Value of every occurrence of a header, unfolded, in message order. */
 function headerValues(lines, name) {
     const want = name.toLowerCase();
@@ -33,8 +34,9 @@ function headerValues(lines, name) {
     }
     return out;
 }
+/** First addr-spec in a header value, lowercased (shared parser: address.ts). */
 function bareAddress(value) {
-    return ((value || "").match(/[^\s<>,;:"]+@[^\s<>,;:"]+/)?.[0] || "").toLowerCase();
+    return firstAddress(value || "").toLowerCase();
 }
 /** qmail/ezmlm, and groups.io after them, stamp `Delivered-To: mailing list
  *  <addr>` on the copy they fan out, to catch mail loops. It names the LIST,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bobfrankston/mailx-types",
-  "version": "0.1.111",
+  "version": "0.1.112",
   "type": "module",
   "main": "index.js",
   "types": "index.d.ts",

package/trust.js

@@ -28,6 +28,7 @@
  * be you. Forwarded mail fails SPF constantly, and flagging that would be
  * exactly the cry-wolf banner this is trying not to be.
  */
+import { firstAddress } from "./address.js";
 /** What the reader can vouch for, and the allowlist.jsonc key each one is
  *  written to. One table, shared by the desktop service and the Android
  *  web-service, so "trust X" cannot land in different keys on the two
@@ -67,9 +68,12 @@ function headerAll(lines, name) {
     }
     return out;
 }
+// 2026-10-26 — Claude Code (Opus 5.5): the addr-spec comes from the shared
+// parser (address.ts) instead of a first-`@`-token scan. The scan took the
+// first token holding an `@` ANYWHERE in the value, so `"ceo@bank.com"
+// <x@evil.example>` read as ceo@bank.com — the display name, not the address.
 function bare(addr) {
-    const m = (addr || "").match(/[^\s<>,;]+@[^\s<>,;]+/);
-    return (m ? m[0] : addr || "").toLowerCase().replace(/[.,;]+$/, "");
+    return (firstAddress(addr || "") || addr || "").toLowerCase().replace(/[.,;]+$/, "");
 }
 /** Do two hostnames belong to the same organisation?
  *