@bobfrankston/mailx-types 0.1.111 → 0.1.113

package/address.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Email address parsing — the ONE place mailx reads addresses out of header
+ * values and decides whether a string is an address.
+ *
+ * 2026-10-26 — Claude Code (Opus 5.5), at Bob's direction ("fold the other
+ * address regexes into the shared functions"). Before this, about a dozen
+ * call sites each carried their own address regex: the send paths, trust,
+ * the store, list-identity, compose, the editor's link detection, contacts,
+ * groups and the CLI. They disagreed on which characters an address may
+ * hold, and the narrowest one (`[\w.+-]+@`) cut
+ * `bernardgreenberg=msn.com@groups.io` to `msn.com@groups.io` in RCPT TO.
+ * Parsing is structural here — split the header on top-level commas, take
+ * the `<…>` part or the bare entry — so no function guesses at the
+ * characters of a local part.
+ *
+ * Pure, no I/O, browser-safe.
+ */
+/** One parsed entry of an address header. */
+export interface ParsedAddress {
+    /** Display name, unquoted and unescaped; "" when there is none. */
+    name: string;
+    /** The addr-spec, as written (case kept). */
+    address: string;
+}
+/** Split an address header on top-level commas (outside quotes and angle
+ *  brackets; `\` escapes inside quotes honored). Moved here from index.ts. */
+export declare function splitAddressHeader(value: string): string[];
+/** Every entry of an address header that carries an addr-spec, with its
+ *  display name. Entries with no address (a bare name, an empty group like
+ *  `Undisclosed recipients:;`) are left out. */
+export declare function parseAddressList(value: string): ParsedAddress[];
+/** The first entry of an address header value, or null. */
+export declare function parseAddress(value: string): ParsedAddress | null;
+/** The addr-spec of every entry — what SMTP RCPT TO / MAIL FROM must carry.
+ *
+ *  2026-10-25: replaced the `/[\w.+-]+@[\w.-]+/g` scan that all three send
+ *  paths carried, which omitted characters RFC 5322 allows in a local part
+ *  (`= ! # $ % & ' * / ? ^ { | } ~`) and so turned
+ *  `bernardgreenberg=msn.com@groups.io` into `msn.com@groups.io`. */
+export declare function envelopeAddresses(value: string): string[];
+/** The first addr-spec in a header value (`"Name" <a@b>`, `a@b (comment)`,
+ *  or a bare `a@b`), or "". Case kept; callers that compare lowercase it. */
+export declare function firstAddress(value: string): string;
+/** Is `s` — a bare addr-spec, no display name — plausibly deliverable?
+ *  Something before the last `@`, a dotted domain after it, and no blanks or
+ *  angle brackets anywhere. The rule all five copies of
+ *  `/^[^\s<>@]+@[^\s<>@]+\.[^\s<>@]+$/` encoded, written without a pattern
+ *  whose domain part could be split two ways. Any character RFC 5322 allows
+ *  in a local part passes. */
+export declare function isValidAddress(s: string): boolean;
+export declare const ADDRESS_IN_TEXT: string;
+/** Every address-shaped run in free text. */
+export declare function findAddressesInText(text: string): string[];
+//# sourceMappingURL=address.d.ts.map

package/address.js

@@ -0,0 +1,138 @@
+/**
+ * Email address parsing — the ONE place mailx reads addresses out of header
+ * values and decides whether a string is an address.
+ *
+ * 2026-10-26 — Claude Code (Opus 5.5), at Bob's direction ("fold the other
+ * address regexes into the shared functions"). Before this, about a dozen
+ * call sites each carried their own address regex: the send paths, trust,
+ * the store, list-identity, compose, the editor's link detection, contacts,
+ * groups and the CLI. They disagreed on which characters an address may
+ * hold, and the narrowest one (`[\w.+-]+@`) cut
+ * `bernardgreenberg=msn.com@groups.io` to `msn.com@groups.io` in RCPT TO.
+ * Parsing is structural here — split the header on top-level commas, take
+ * the `<…>` part or the bare entry — so no function guesses at the
+ * characters of a local part.
+ *
+ * Pure, no I/O, browser-safe.
+ */
+/** Split an address header on top-level commas (outside quotes and angle
+ *  brackets; `\` escapes inside quotes honored). Moved here from index.ts. */
+export function splitAddressHeader(value) {
+    const parts = [];
+    let cur = "";
+    let inAngle = false;
+    let inQuote = false;
+    for (let i = 0; i < value.length; i++) {
+        const ch = value[i];
+        if (inQuote && ch === "\\" && i + 1 < value.length) {
+            cur += ch + value[++i];
+            continue;
+        }
+        if (ch === '"' && !inAngle)
+            inQuote = !inQuote;
+        else if (ch === "<" && !inQuote)
+            inAngle = true;
+        else if (ch === ">" && !inQuote)
+            inAngle = false;
+        if (ch === "," && !inAngle && !inQuote) {
+            parts.push(cur);
+            cur = "";
+            continue;
+        }
+        cur += ch;
+    }
+    if (cur.trim())
+        parts.push(cur);
+    return parts.map(p => p.trim()).filter(Boolean);
+}
+/** Text on both sides of the last `@`: the least an addr-spec must have. */
+function hasAddrShape(spec) {
+    const at = spec.lastIndexOf("@");
+    return at > 0 && at < spec.length - 1;
+}
+/** Every entry of an address header that carries an addr-spec, with its
+ *  display name. Entries with no address (a bare name, an empty group like
+ *  `Undisclosed recipients:;`) are left out. */
+export function parseAddressList(value) {
+    if (!value)
+        return [];
+    const out = [];
+    for (const part of splitAddressHeader(value)) {
+        const angle = /<([^<>]*)>\s*$/.exec(part);
+        let name = "";
+        let spec;
+        if (angle) {
+            spec = angle[1].trim();
+            name = part.slice(0, angle.index).replace(/\([^()]*\)/g, "").trim();
+            if (name.length >= 2 && name.startsWith('"') && name.endsWith('"'))
+                name = name.slice(1, -1).replace(/\\(.)/g, "$1");
+        }
+        else {
+            // No angle brackets: an addr-spec has no unquoted blanks, so when
+            // the entry has words around it ("mailing list x@y", a sloppy
+            // "Bob bob@x.com") the address is the word that has the shape.
+            const words = part.replace(/\([^()]*\)/g, " ").trim().split(/\s+/);
+            spec = words.find(hasAddrShape) || "";
+        }
+        if (hasAddrShape(spec))
+            out.push({ name, address: spec });
+    }
+    return out;
+}
+/** The first entry of an address header value, or null. */
+export function parseAddress(value) {
+    return parseAddressList(value)[0] || null;
+}
+/** The addr-spec of every entry — what SMTP RCPT TO / MAIL FROM must carry.
+ *
+ *  2026-10-25: replaced the `/[\w.+-]+@[\w.-]+/g` scan that all three send
+ *  paths carried, which omitted characters RFC 5322 allows in a local part
+ *  (`= ! # $ % & ' * / ? ^ { | } ~`) and so turned
+ *  `bernardgreenberg=msn.com@groups.io` into `msn.com@groups.io`. */
+export function envelopeAddresses(value) {
+    return parseAddressList(value).map(a => a.address);
+}
+/** The first addr-spec in a header value (`"Name" <a@b>`, `a@b (comment)`,
+ *  or a bare `a@b`), or "". Case kept; callers that compare lowercase it. */
+export function firstAddress(value) {
+    return parseAddressList(value)[0]?.address || "";
+}
+/** Is `s` — a bare addr-spec, no display name — plausibly deliverable?
+ *  Something before the last `@`, a dotted domain after it, and no blanks or
+ *  angle brackets anywhere. The rule all five copies of
+ *  `/^[^\s<>@]+@[^\s<>@]+\.[^\s<>@]+$/` encoded, written without a pattern
+ *  whose domain part could be split two ways. Any character RFC 5322 allows
+ *  in a local part passes. */
+export function isValidAddress(s) {
+    const t = (s || "").trim();
+    if (!t || /[\s<>]/.test(t))
+        return false;
+    const at = t.lastIndexOf("@");
+    if (at <= 0)
+        return false;
+    const local = t.slice(0, at);
+    const domain = t.slice(at + 1);
+    if (local.includes("@") || domain.includes("@"))
+        return false;
+    const dot = domain.indexOf(".");
+    return dot > 0 && dot < domain.length - 1;
+}
+/** Regex SOURCE for an address appearing inside free text (prose, a display
+ *  name) — where there is no header structure to split on, so a pattern is
+ *  the only tool. Local part: the RFC 5322 atext characters plus dots; domain:
+ *  dotted labels. Each piece matches one way only (`@` and `.` are not in the
+ *  classes they separate). Exported as a source string so a caller can embed
+ *  it in a larger alternation (the spell checker's skip spans).
+ *  (2026-10-26, Claude Code (Opus 5.5): replaces the spell checker's
+ *  `[\w.+\-]+@…` and displayNameClaimsOtherAddress's `[A-Za-z0-9._%+-]+@…`.) */
+// The lookbehind lets a match START only where a run of local-part characters
+// starts. Without it a long run with no `@` (a pasted base64 blob) was retried
+// from every position inside it, re-reading the rest each time: 80,000
+// characters took 5.3 s (measured 2026-10-26). With it each run is read once.
+const LOCAL_CHARS = String.raw `\w.!#$%&'*+\/=?^\`{|}~\-`;
+export const ADDRESS_IN_TEXT = String.raw `(?<![${LOCAL_CHARS}])[${LOCAL_CHARS}]+@[A-Za-z0-9\-]+(?:\.[A-Za-z0-9\-]+)+`;
+/** Every address-shaped run in free text. */
+export function findAddressesInText(text) {
+    return (text || "").match(new RegExp(ADDRESS_IN_TEXT, "g")) || [];
+}
+//# sourceMappingURL=address.js.map

package/groups.js

@@ -8,6 +8,7 @@
  * names of other groups (recursive aliasing). Cycles are detected; depth
  * is capped at 10 nested levels.
  */
+import { firstAddress } from "./address.js";
 /** Split a comma-or-semicolon recipient string into tokens. Respects
  *  angle-bracket address blocks ("Name, Suffix <a@b>") so a comma inside
  *  the display name doesn't split the entry. */
@@ -40,15 +41,15 @@ export function splitRecipients(raw) {
  *  a display name)? Anything containing "@" with non-whitespace on both
  *  sides counts. */
 export function isAddressToken(token) {
-    return /^[^@\s][^@]*@[^@\s]+(\s|$)|<[^>]+@[^>]+>/.test(token) || /^[^\s<>@]+@[^\s<>@]+$/.test(token);
+    // 2026-10-26 — Claude Code (Opus 5.5): shared parser (address.ts) instead of
+    // its own patterns; "Name <a@b>" and a bare "a@b" both parse.
+    return !!firstAddress(token);
 }
 /** Extract the bare email address from a token. Returns the original token
  *  lowercased if it has no angle-bracket form. */
 export function extractAddress(token) {
-    const m = token.match(/<([^>]+)>/);
-    if (m)
-        return m[1].trim().toLowerCase();
-    return token.trim().toLowerCase();
+    // 2026-10-26 — Claude Code (Opus 5.5): shared parser (address.ts).
+    return (firstAddress(token) || token).trim().toLowerCase();
 }
 /** Expand a recipient string by resolving group names against `groups`.
  *  Group names take precedence: if a token matches a group name AND looks

package/headers.d.ts

@@ -0,0 +1,87 @@
+/**
+ * Message headers — the ONE place mailx reads a header section and names
+ * the header fields it cares about.
+ *
+ * 2026-10-27 — Claude Code (Opus 5.5), at Bob's direction ("Isn't there a
+ * single header parse that is shared?" / "the string cc shouldn't be strewn
+ * around the code"). There wasn't: trust.ts, list-identity.ts,
+ * outgoingEnvelope, the desktop store, Android's web-service, the CLI index
+ * rebuild (twice) and the spam-report CSV each read headers their own way —
+ * different rules for case, folding and repeated fields, and every one
+ * spelled the field names itself. One of them took the first `Delivered-To:`
+ * anywhere in the first 4 KB, body included; another missed `CC:` written in
+ * capitals. Field names live in HEADER below; reading lives in the functions.
+ *
+ * Pure, no I/O, browser-safe.
+ */
+/** Header field names, lowercase (lookups ignore case). Add a field here
+ *  rather than writing its name at a call site. */
+export declare const HEADER: {
+    readonly from: "from";
+    readonly to: "to";
+    readonly cc: "cc";
+    readonly bcc: "bcc";
+    readonly replyTo: "reply-to";
+    readonly sender: "sender";
+    readonly subject: "subject";
+    readonly date: "date";
+    readonly messageId: "message-id";
+    readonly returnPath: "return-path";
+    readonly deliveredTo: "delivered-to";
+    readonly xOriginalTo: "x-original-to";
+    readonly envelopeTo: "envelope-to";
+    readonly resentFrom: "resent-from";
+    readonly xOriginalFrom: "x-original-from";
+    readonly listId: "list-id";
+    readonly listPost: "list-post";
+    readonly listUnsubscribe: "list-unsubscribe";
+    readonly listUnsubscribePost: "list-unsubscribe-post";
+    readonly authenticationResults: "authentication-results";
+    readonly xSpamStatus: "x-spam-status";
+    readonly xSpamFlag: "x-spam-flag";
+    readonly xSpamReport: "x-spam-report";
+    readonly xMailxDraftId: "x-mailx-draft-id";
+};
+/** The fields whose addresses a message is sent to (SMTP RCPT TO). */
+export declare const RECIPIENT_HEADERS: readonly ["to", "cc", "bcc"];
+/** Receiving-server fields naming the address a copy was delivered to:
+ *  qmail/Gmail, Postfix, Exim spellings of the same fact. */
+export declare const DELIVERY_HEADERS: readonly ["delivered-to", "x-original-to", "envelope-to"];
+/** One header field occurrence: lowercase name and the raw `Name: value`
+ *  line (continuation lines included) — the shape of mailparser's
+ *  `headerLines`, so a parsed message can be read with the same functions. */
+export interface HeaderLine {
+    key: string;
+    line: string;
+}
+/** Offset where the header section of raw RFC 822 text ends (the first
+ *  blank line), or -1 when there is no body. */
+export declare function headerSectionEnd(raw: string): number;
+/** Every header field of raw RFC 822 text, in order, repeated fields kept.
+ *  Only the header section is read, so a `Cc:` line quoted in the body is
+ *  never mistaken for a header. */
+export declare function readHeaderLines(raw: string): HeaderLine[];
+/** The line ending raw text uses ("\r\n" or "\n"). */
+export declare function lineEnding(raw: string): string;
+/** Every value of a field, unfolded and trimmed, in message order. */
+export declare function headerValues(lines: readonly HeaderLine[], name: string): string[];
+/** The first value of a field, or "". */
+export declare function headerValue(lines: readonly HeaderLine[], name: string): string;
+/** Every value of a field with its folding KEPT (continuation line breaks and
+ *  their whitespace), trimmed at the ends. For fields whose line structure
+ *  carries meaning: SpamAssassin's X-Spam-Report lists one rule per line, and
+ *  trust.ts parses it by line. Most callers want headerValues. */
+export declare function headerRawValues(lines: readonly HeaderLine[], name: string): string[];
+/** The first value of a field, folding kept, or "". */
+export declare function headerRawValue(lines: readonly HeaderLine[], name: string): string;
+/** List-Unsubscribe (RFC 2369) split into its mailto: and http(s): targets,
+ *  plus whether List-Unsubscribe-Post offers RFC 8058 one-click. Reads the
+ *  raw header so BOTH targets are seen (mailparser's structured view kept
+ *  only one). Moved here from mailx-store/store.ts 2026-10-27 so Android
+ *  (which kept only the raw value) gets the same answer. */
+export declare function listUnsubscribeOf(lines: readonly HeaderLine[]): {
+    mail: string;
+    http: string;
+    oneClick: boolean;
+};
+//# sourceMappingURL=headers.d.ts.map

package/headers.js

@@ -0,0 +1,138 @@
+/**
+ * Message headers — the ONE place mailx reads a header section and names
+ * the header fields it cares about.
+ *
+ * 2026-10-27 — Claude Code (Opus 5.5), at Bob's direction ("Isn't there a
+ * single header parse that is shared?" / "the string cc shouldn't be strewn
+ * around the code"). There wasn't: trust.ts, list-identity.ts,
+ * outgoingEnvelope, the desktop store, Android's web-service, the CLI index
+ * rebuild (twice) and the spam-report CSV each read headers their own way —
+ * different rules for case, folding and repeated fields, and every one
+ * spelled the field names itself. One of them took the first `Delivered-To:`
+ * anywhere in the first 4 KB, body included; another missed `CC:` written in
+ * capitals. Field names live in HEADER below; reading lives in the functions.
+ *
+ * Pure, no I/O, browser-safe.
+ */
+/** Header field names, lowercase (lookups ignore case). Add a field here
+ *  rather than writing its name at a call site. */
+export const HEADER = {
+    from: "from",
+    to: "to",
+    cc: "cc",
+    bcc: "bcc",
+    replyTo: "reply-to",
+    sender: "sender",
+    subject: "subject",
+    date: "date",
+    messageId: "message-id",
+    returnPath: "return-path",
+    deliveredTo: "delivered-to",
+    xOriginalTo: "x-original-to",
+    envelopeTo: "envelope-to",
+    resentFrom: "resent-from",
+    xOriginalFrom: "x-original-from",
+    listId: "list-id",
+    listPost: "list-post",
+    listUnsubscribe: "list-unsubscribe",
+    listUnsubscribePost: "list-unsubscribe-post",
+    authenticationResults: "authentication-results",
+    xSpamStatus: "x-spam-status",
+    xSpamFlag: "x-spam-flag",
+    xSpamReport: "x-spam-report",
+    xMailxDraftId: "x-mailx-draft-id",
+};
+/** The fields whose addresses a message is sent to (SMTP RCPT TO). */
+export const RECIPIENT_HEADERS = [HEADER.to, HEADER.cc, HEADER.bcc];
+/** Receiving-server fields naming the address a copy was delivered to:
+ *  qmail/Gmail, Postfix, Exim spellings of the same fact. */
+export const DELIVERY_HEADERS = [HEADER.deliveredTo, HEADER.xOriginalTo, HEADER.envelopeTo];
+/** Offset where the header section of raw RFC 822 text ends (the first
+ *  blank line), or -1 when there is no body. */
+export function headerSectionEnd(raw) {
+    return (raw || "").search(/\r?\n\r?\n/);
+}
+/** Every header field of raw RFC 822 text, in order, repeated fields kept.
+ *  Only the header section is read, so a `Cc:` line quoted in the body is
+ *  never mistaken for a header. */
+export function readHeaderLines(raw) {
+    const end = headerSectionEnd(raw);
+    const section = end === -1 ? (raw || "") : raw.slice(0, end);
+    const out = [];
+    // Split keeping each line's own ending, so a field rebuilt from `line`
+    // (outgoingEnvelope's Bcc strip) is byte-identical to what was read.
+    const parts = section.split(/(\r?\n)/);
+    for (let i = 0; i < parts.length; i += 2) {
+        const physical = parts[i];
+        const eol = parts[i - 1] ?? "";
+        if (/^[ \t]/.test(physical) && out.length) {
+            out[out.length - 1].line += eol + physical;
+            continue;
+        }
+        const colon = physical.indexOf(":");
+        if (colon <= 0)
+            continue;
+        out.push({ key: physical.slice(0, colon).trim().toLowerCase(), line: physical });
+    }
+    return out;
+}
+/** The line ending raw text uses ("\r\n" or "\n"). */
+export function lineEnding(raw) {
+    return /\r\n/.test(raw || "") ? "\r\n" : "\n";
+}
+/** Every value of a field, unfolded and trimmed, in message order. */
+export function headerValues(lines, name) {
+    const want = name.toLowerCase();
+    const out = [];
+    for (const h of lines || []) {
+        if ((h.key || "").toLowerCase() !== want)
+            continue;
+        const colon = h.line.indexOf(":");
+        if (colon >= 0)
+            out.push(h.line.slice(colon + 1).replace(/\r?\n[ \t]+/g, " ").trim());
+    }
+    return out;
+}
+/** The first value of a field, or "". */
+export function headerValue(lines, name) {
+    return headerValues(lines, name)[0] ?? "";
+}
+/** Every value of a field with its folding KEPT (continuation line breaks and
+ *  their whitespace), trimmed at the ends. For fields whose line structure
+ *  carries meaning: SpamAssassin's X-Spam-Report lists one rule per line, and
+ *  trust.ts parses it by line. Most callers want headerValues. */
+export function headerRawValues(lines, name) {
+    const want = name.toLowerCase();
+    const out = [];
+    for (const h of lines || []) {
+        if ((h.key || "").toLowerCase() !== want)
+            continue;
+        const colon = h.line.indexOf(":");
+        if (colon >= 0)
+            out.push(h.line.slice(colon + 1).trim());
+    }
+    return out;
+}
+/** The first value of a field, folding kept, or "". */
+export function headerRawValue(lines, name) {
+    return headerRawValues(lines, name)[0] ?? "";
+}
+/** List-Unsubscribe (RFC 2369) split into its mailto: and http(s): targets,
+ *  plus whether List-Unsubscribe-Post offers RFC 8058 one-click. Reads the
+ *  raw header so BOTH targets are seen (mailparser's structured view kept
+ *  only one). Moved here from mailx-store/store.ts 2026-10-27 so Android
+ *  (which kept only the raw value) gets the same answer. */
+export function listUnsubscribeOf(lines) {
+    let mail = "";
+    let http = "";
+    for (const m of headerValue(lines, HEADER.listUnsubscribe).matchAll(/<([^<>]+)>/g)) {
+        const url = m[1].trim();
+        if (!mail && /^mailto:/i.test(url))
+            mail = url;
+        else if (!http && /^https?:/i.test(url))
+            http = url;
+    }
+    const oneClick = /one-?click/i.test(headerValue(lines, HEADER.listUnsubscribePost));
+    return { mail, http, oneClick };
+}
+//# sourceMappingURL=headers.js.map

package/index.d.ts

@@ -427,20 +427,6 @@ export declare function formatAddressListForHeader(list: {
     name?: string;
     address?: string;
 }[] | undefined): string;
-/** The addr-spec of every entry in an address header — what SMTP RCPT TO /
- *  MAIL FROM must carry. One per comma-separated entry (commas inside quotes
- *  and angle brackets don't split): the `<…>` part when there is one, else the
- *  entry itself minus any `(comment)`. Entries without an `@` are dropped.
- *
- *  2026-10-25 — Claude Code (Opus 5.5), at Bob's direction. Replaces the
- *  `/[\w.+-]+@[\w.-]+/g` scan that all three send paths (desktop mailx-imap,
- *  Android android-bootstrap and sync-manager) carried as copies. That class
- *  omits characters RFC 5322 allows in a local part (`= ! # $ % & ' * / ? ^ { | } ~`),
- *  so `bernardgreenberg=msn.com@groups.io` (groups.io's relay address for a
- *  member) matched as `msn.com@groups.io`: the To header was right, the
- *  envelope was wrong, and groups.io bounced "The group 'msn.com' does not
- *  exist". Taking the addr-spec whole avoids guessing at its characters. */
-export declare function envelopeAddresses(value: string): string[];
 /** What an SMTP send needs from a finished RFC 822 message. */
 export interface OutgoingEnvelope {
     /** RCPT TO: every addr-spec in To, Cc and Bcc. */
@@ -629,6 +615,10 @@ export declare function parseInvite(ics: string): ParsedInvite | null;
  * case specially").
  */
 export declare function inviteHasGoogleRsvp(bodyHtml: string): boolean;
-export { readListIdentity } from "./list-identity.js";
+export { HEADER, RECIPIENT_HEADERS, DELIVERY_HEADERS, readHeaderLines, headerValue, headerValues, headerRawValue, headerRawValues, headerSectionEnd, lineEnding, listUnsubscribeOf } from "./headers.js";
+export type { HeaderLine } from "./headers.js";
+export { splitAddressHeader, parseAddressList, parseAddress, envelopeAddresses, firstAddress, isValidAddress, ADDRESS_IN_TEXT, findAddressesInText } from "./address.js";
+export type { ParsedAddress } from "./address.js";
+export { readListIdentity, groupsIoOriginal } from "./list-identity.js";
 export type { ListIdentity, ListHeaderLine } from "./list-identity.js";
 //# sourceMappingURL=index.d.ts.map

package/index.js

@@ -221,61 +221,6 @@ export function formatAddressForHeader(name, address) {
 export function formatAddressListForHeader(list) {
     return (list || []).map(a => formatAddressForHeader(a.name, a.address || "")).join(", ");
 }
-/** Split an address header on top-level commas (outside quotes and angle
- *  brackets; `\` escapes inside quotes honored). */
-function splitAddressHeader(value) {
-    const parts = [];
-    let cur = "";
-    let inAngle = false;
-    let inQuote = false;
-    for (let i = 0; i < value.length; i++) {
-        const ch = value[i];
-        if (inQuote && ch === "\\" && i + 1 < value.length) {
-            cur += ch + value[++i];
-            continue;
-        }
-        if (ch === '"' && !inAngle)
-            inQuote = !inQuote;
-        else if (ch === "<" && !inQuote)
-            inAngle = true;
-        else if (ch === ">" && !inQuote)
-            inAngle = false;
-        if (ch === "," && !inAngle && !inQuote) {
-            parts.push(cur);
-            cur = "";
-            continue;
-        }
-        cur += ch;
-    }
-    if (cur.trim())
-        parts.push(cur);
-    return parts.map(p => p.trim()).filter(Boolean);
-}
-/** The addr-spec of every entry in an address header — what SMTP RCPT TO /
- *  MAIL FROM must carry. One per comma-separated entry (commas inside quotes
- *  and angle brackets don't split): the `<…>` part when there is one, else the
- *  entry itself minus any `(comment)`. Entries without an `@` are dropped.
- *
- *  2026-10-25 — Claude Code (Opus 5.5), at Bob's direction. Replaces the
- *  `/[\w.+-]+@[\w.-]+/g` scan that all three send paths (desktop mailx-imap,
- *  Android android-bootstrap and sync-manager) carried as copies. That class
- *  omits characters RFC 5322 allows in a local part (`= ! # $ % & ' * / ? ^ { | } ~`),
- *  so `bernardgreenberg=msn.com@groups.io` (groups.io's relay address for a
- *  member) matched as `msn.com@groups.io`: the To header was right, the
- *  envelope was wrong, and groups.io bounced "The group 'msn.com' does not
- *  exist". Taking the addr-spec whole avoids guessing at its characters. */
-export function envelopeAddresses(value) {
-    if (!value)
-        return [];
-    const out = [];
-    for (const part of splitAddressHeader(value)) {
-        const angle = /<([^<>]*)>\s*$/.exec(part);
-        const spec = (angle ? angle[1] : part.replace(/\([^()]*\)/g, "")).trim();
-        if (spec.includes("@"))
-            out.push(spec);
-    }
-    return out;
-}
 /** Build the SMTP envelope and the transmitted copy of an outgoing message.
  *  ONE implementation for every send path (desktop mailx-imap sendRaw, Android
  *  android-bootstrap and sync-manager), which each used to carry their own copy
@@ -288,22 +233,18 @@ export function envelopeAddresses(value) {
  *  Bcc is stripped from the header section only, continuation lines included,
  *  so a quoted "Bcc:" in the body is never eaten. */
 export function outgoingEnvelope(raw, fallbackSender) {
-    const headerEnd = raw.search(/\r?\n\r?\n/);
-    const headerRaw = headerEnd === -1 ? raw : raw.slice(0, headerEnd);
-    const headerSec = headerRaw.replace(/\r?\n[ \t]+/g, " ");
-    const field = (name) => headerSec.match(new RegExp(`^${name}:[ \\t]*(.*)$`, "mi"))?.[1] ?? "";
-    const recipients = [
-        ...envelopeAddresses(field("To")),
-        ...envelopeAddresses(field("Cc")),
-        ...envelopeAddresses(field("Bcc")),
-    ];
-    const sender = envelopeAddresses(field("From"))[0] || fallbackSender;
-    const messageId = field("Message-ID").match(/<[^<>]+>/)?.[0] ?? "";
-    // The `(\r?\n|$)` tail takes the line ending with the header so no blank
-    // line is left mid-headers; the final trim covers Bcc as the last header.
-    const stripBcc = (h) => h.replace(/^Bcc:[^\n]*(\r?\n[ \t][^\n]*)*(\r?\n|$)/mi, "").replace(/\r?\n$/, "");
-    const rawToSend = headerEnd === -1 ? stripBcc(raw) : stripBcc(headerRaw) + raw.slice(headerEnd);
-    return { recipients, sender, subject: field("Subject").trim(), messageId, rawToSend };
+    // 2026-10-27: headers read by the shared headers.ts (was a local regex
+    // per field, and a `^Bcc:` regex for the strip).
+    const lines = readHeaderLines(raw);
+    const recipients = RECIPIENT_HEADERS.flatMap(name => headerValues(lines, name).flatMap(envelopeAddresses));
+    const sender = envelopeAddresses(headerValue(lines, HEADER.from))[0] || fallbackSender;
+    const messageId = headerValue(lines, HEADER.messageId).match(/<[^<>]+>/)?.[0] ?? "";
+    // Bcc leaves the transmitted copy: the header section is rebuilt from the
+    // fields read above minus Bcc, each line byte-for-byte as it came in.
+    const end = headerSectionEnd(raw);
+    const kept = lines.filter(h => h.key !== HEADER.bcc).map(h => h.line).join(lineEnding(raw));
+    const rawToSend = end === -1 ? kept : kept + raw.slice(end);
+    return { recipients, sender, subject: headerValue(lines, HEADER.subject), messageId, rawToSend };
 }
 /** Entries of an address header that a reader would see as an address with
  *  no `@` — e.g. the "Frankston" in `Frankston, Bob <x@y>`. Empty when sound. */
@@ -667,8 +608,9 @@ export function displayNameClaimsOtherAddress(name, address) {
         return null;
     const real = (address || "").trim().toLowerCase();
     // Deliberately loose: anything shaped like local@domain.tld inside the name.
-    const m = n.match(/[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/g);
-    if (!m)
+    // 2026-10-26 — Claude Code (Opus 5.5): shared free-text pattern (address.ts).
+    const m = findAddressesInText(n);
+    if (!m.length)
         return null;
     const realDomain = real.split("@").pop() || "";
     for (const claimed of m) {
@@ -907,6 +849,12 @@ export function inviteHasGoogleRsvp(bodyHtml) {
         return false;
     return /calendar\.google\.com\/calendar\/event\?action=RESPOND/i.test(bodyHtml);
 }
+// Header parsing: one reader for the whole app, field names in HEADER.
+import { HEADER, RECIPIENT_HEADERS, readHeaderLines, headerValue, headerValues, headerSectionEnd, lineEnding } from "./headers.js";
+export { HEADER, RECIPIENT_HEADERS, DELIVERY_HEADERS, readHeaderLines, headerValue, headerValues, headerRawValue, headerRawValues, headerSectionEnd, lineEnding, listUnsubscribeOf } from "./headers.js";
+// Address parsing: one splitter, one notion of "is this an address".
+import { splitAddressHeader, envelopeAddresses, findAddressesInText } from "./address.js";
+export { splitAddressHeader, parseAddressList, parseAddress, envelopeAddresses, firstAddress, isValidAddress, ADDRESS_IN_TEXT, findAddressesInText } from "./address.js";
 // Delivery address + mailing-list identity for reply's From (desktop + Android).
-export { readListIdentity } from "./list-identity.js";
+export { readListIdentity, groupsIoOriginal } from "./list-identity.js";
 //# sourceMappingURL=index.js.map

package/list-identity.d.ts

@@ -20,11 +20,9 @@
  * two cannot drift apart again. Pure: header lines and body text in, strings
  * out — no I/O, browser-safe.
  */
-/** A header line as mailparser's `headerLines` gives it: lowercase key, raw `Key: value` line. */
-export interface ListHeaderLine {
-    key: string;
-    line: string;
-}
+import { type HeaderLine } from "./headers.js";
+/** Kept as an alias so existing imports keep working; the shape lives in headers.ts. */
+export type ListHeaderLine = HeaderLine;
 export interface ListIdentity {
     /** Address the RECEIVING server recorded delivering this copy to
      *  (Delivered-To / X-Original-To / Envelope-To), or "". A mailing list's
@@ -48,6 +46,16 @@ export interface ListIdentity {
      *  real address is in Resent-From. (2026-10-26, Claude Code (Opus 5.5).) */
     listAuthor: string;
 }
+/** groups.io's stand-in for a member's address, `local=domain@groups.io`,
+ *  decoded back to `local@domain`; "" for anything else. groups.io refuses
+ *  mail sent to the stand-in and names the decoded form as the one to use
+ *  ("To reply to this person, send your message to bernardgreenberg@msn.com").
+ *  The LAST `=` separates local part from domain. Real groups.io addresses
+ *  (`group@`, `group+owner@`) carry no `=`, so they pass through.
+ *  (2026-10-27, Claude Code (Opus 5.5): reply needs this for EVERY such
+ *  address in To/Cc, not only the From — Bernard Cc's himself, and groups.io
+ *  rewrites that Cc too.) */
+export declare function groupsIoOriginal(address: string): string;
 /** Read the delivery and list facts out of a parsed message. */
 export declare function readListIdentity(headerLines: readonly ListHeaderLine[], bodyText: string, bodyHtml: string): ListIdentity;
 //# sourceMappingURL=list-identity.d.ts.map

package/list-identity.js

@@ -20,21 +20,12 @@
  * two cannot drift apart again. Pure: header lines and body text in, strings
  * out — no I/O, browser-safe.
  */
-/** Value of every occurrence of a header, unfolded, in message order. */
-function headerValues(lines, name) {
-    const want = name.toLowerCase();
-    const out = [];
-    for (const h of lines || []) {
-        if ((h.key || "").toLowerCase() !== want)
-            continue;
-        const colon = h.line.indexOf(":");
-        if (colon >= 0)
-            out.push(h.line.slice(colon + 1).replace(/\r?\n[ \t]+/g, " ").trim());
-    }
-    return out;
-}
+import { firstAddress } from "./address.js";
+import { HEADER, DELIVERY_HEADERS, headerValues } from "./headers.js";
+// Header reading: shared headerValues (headers.ts), 2026-10-27.
+/** First addr-spec in a header value, lowercased (shared parser: address.ts). */
 function bareAddress(value) {
-    return ((value || "").match(/[^\s<>,;:"]+@[^\s<>,;:"]+/)?.[0] || "").toLowerCase();
+    return firstAddress(value || "").toLowerCase();
 }
 /** qmail/ezmlm, and groups.io after them, stamp `Delivered-To: mailing list
  *  <addr>` on the copy they fan out, to catch mail loops. It names the LIST,
@@ -48,12 +39,25 @@ const LIST_DELIVERED_TO = /^mailing list\s/i;
  *  optional anchor tail, then blanks, then the bracket), so a long body with
  *  no footer fails in a single pass. */
 const GROUPS_IO_SUBSCRIBER = /groups\.io\/g\/[^\s"'<>\/]+\/leave\/[^\s"'<>]*(?:["']>Unsubscribe<\/a>)?\s*\[([^\s\[\]<>@]+@[^\s\[\]<>@]+)\]/i;
+/** groups.io's stand-in for a member's address, `local=domain@groups.io`,
+ *  decoded back to `local@domain`; "" for anything else. groups.io refuses
+ *  mail sent to the stand-in and names the decoded form as the one to use
+ *  ("To reply to this person, send your message to bernardgreenberg@msn.com").
+ *  The LAST `=` separates local part from domain. Real groups.io addresses
+ *  (`group@`, `group+owner@`) carry no `=`, so they pass through.
+ *  (2026-10-27, Claude Code (Opus 5.5): reply needs this for EVERY such
+ *  address in To/Cc, not only the From — Bernard Cc's himself, and groups.io
+ *  rewrites that Cc too.) */
+export function groupsIoOriginal(address) {
+    const m = (address || "").trim().match(/^(.+)=([^=@\s]+)@groups\.io$/i);
+    return m ? `${m[1]}@${m[2]}` : "";
+}
 /** Read the delivery and list facts out of a parsed message. */
 export function readListIdentity(headerLines, bodyText, bodyHtml) {
     // Receiving-server headers: each agent PREPENDS its own, so the first
     // that is not a list's loop marker is the final delivery to this mailbox.
     let deliveredTo = "";
-    for (const key of ["delivered-to", "x-original-to", "envelope-to"]) {
+    for (const key of DELIVERY_HEADERS) {
         for (const value of headerValues(headerLines, key)) {
             if (LIST_DELIVERED_TO.test(value))
                 continue;
@@ -65,13 +69,13 @@ export function readListIdentity(headerLines, bodyText, bodyHtml) {
         if (deliveredTo)
             break;
     }
-    const rawListId = headerValues(headerLines, "list-id")[0] || "";
+    const rawListId = headerValues(headerLines, HEADER.listId)[0] || "";
     const listId = ((rawListId.match(/<([^>]+)>/)?.[1]) || rawListId).trim().toLowerCase();
     if (!listId)
         return { deliveredTo, listId: "", listAddresses: [], listSubscriber: "", listAuthor: "" };
-    const listPost = (headerValues(headerLines, "list-post")[0] || "").match(/<mailto:([^>?]+)/i)?.[1] || "";
+    const listPost = (headerValues(headerLines, HEADER.listPost)[0] || "").match(/<mailto:([^>?]+)/i)?.[1] || "";
     const listAddresses = [];
-    for (const candidate of [listPost, headerValues(headerLines, "reply-to")[0], headerValues(headerLines, "sender")[0]]) {
+    for (const candidate of [listPost, headerValues(headerLines, HEADER.replyTo)[0], headerValues(headerLines, HEADER.sender)[0]]) {
         const addr = bareAddress(candidate || "");
         if (addr && !listAddresses.includes(addr))
             listAddresses.push(addr);
@@ -87,10 +91,9 @@ export function readListIdentity(headerLines, bodyText, bodyHtml) {
         // A rewritten From is `local=domain@groups.io`. Resent-From carries
         // the original; failing that, the rewrite itself encodes it (the
         // LAST `=` separates local part from domain).
-        const from = bareAddress(headerValues(headerLines, "from")[0] || "");
-        const rewritten = from.match(/^(.+)=([^=@]+)@groups\.io$/);
-        if (rewritten)
-            listAuthor = bareAddress(headerValues(headerLines, "resent-from")[0] || "") || `${rewritten[1]}@${rewritten[2]}`;
+        const decoded = groupsIoOriginal(bareAddress(headerValues(headerLines, HEADER.from)[0] || ""));
+        if (decoded)
+            listAuthor = bareAddress(headerValues(headerLines, HEADER.resentFrom)[0] || "") || decoded;
     }
     return { deliveredTo, listId, listAddresses, listSubscriber, listAuthor };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bobfrankston/mailx-types",
-  "version": "0.1.111",
+  "version": "0.1.113",
   "type": "module",
   "main": "index.js",
   "types": "index.d.ts",

package/trust.js

@@ -28,6 +28,8 @@
  * be you. Forwarded mail fails SPF constantly, and flagging that would be
  * exactly the cry-wolf banner this is trying not to be.
  */
+import { firstAddress } from "./address.js";
+import { HEADER, headerRawValue, headerRawValues } from "./headers.js";
 /** What the reader can vouch for, and the allowlist.jsonc key each one is
  *  written to. One table, shared by the desktop service and the Android
  *  web-service, so "trust X" cannot land in different keys on the two
@@ -43,33 +45,19 @@ export const TRUST_LIST_KEYS = {
     // 2026-09-30 — see TrustInput.trustedLinkHosts.
     linkhost: "trustedLinkHosts",
 };
-/** First value of a header, case-insensitive. */
-function header(lines, name) {
-    const want = name.toLowerCase();
-    for (const h of lines) {
-        if ((h.key || "").toLowerCase() !== want)
-            continue;
-        const colon = h.line.indexOf(":");
-        return colon < 0 ? "" : h.line.slice(colon + 1).trim();
-    }
-    return "";
-}
-/** All values of a repeated header. */
-function headerAll(lines, name) {
-    const want = name.toLowerCase();
-    const out = [];
-    for (const h of lines) {
-        if ((h.key || "").toLowerCase() !== want)
-            continue;
-        const colon = h.line.indexOf(":");
-        if (colon >= 0)
-            out.push(h.line.slice(colon + 1).trim());
-    }
-    return out;
-}
+// 2026-10-27 — Claude Code (Opus 5.5): header reading moved to the shared
+// headers.ts (one parse for the whole app); these names stay as the local
+// spelling the checks below use.
+// The RAW readers: trust parses some fields by line (X-Spam-Report) and
+// unfolds the rest itself (see unfold below), exactly as before the move.
+const header = (lines, name) => headerRawValue(lines, name);
+const headerAll = (lines, name) => headerRawValues(lines, name);
+// 2026-10-26 — Claude Code (Opus 5.5): the addr-spec comes from the shared
+// parser (address.ts) instead of a first-`@`-token scan. The scan took the
+// first token holding an `@` ANYWHERE in the value, so `"ceo@bank.com"
+// <x@evil.example>` read as ceo@bank.com — the display name, not the address.
 function bare(addr) {
-    const m = (addr || "").match(/[^\s<>,;]+@[^\s<>,;]+/);
-    return (m ? m[0] : addr || "").toLowerCase().replace(/[.,;]+$/, "");
+    return (firstAddress(addr || "") || addr || "").toLowerCase().replace(/[.,;]+$/, "");
 }
 /** Do two hostnames belong to the same organisation?
  *
@@ -208,7 +196,7 @@ function classifyRule(name, dmarcFailed, listRelayed = false) {
  *  author (Google Calendar signs d=google.com on an invitation From the
  *  organizer), which is exactly what makes it an intermediary. */
 function dkimSigners(input) {
-    const auth = headerAll(input.headerLines, "authentication-results")[0] || "";
+    const auth = headerAll(input.headerLines, HEADER.authenticationResults)[0] || "";
     const out = [];
     for (const part of auth.split(";")) {
         if (!/\bdkim=pass\b/i.test(part))
@@ -232,7 +220,7 @@ function alignedPass(input) {
         return "";
     if (dkimSigners(input).some(d => sameOrg(d, fromDomain)))
         return "dkim";
-    const auth = headerAll(input.headerLines, "authentication-results")[0] || "";
+    const auth = headerAll(input.headerLines, HEADER.authenticationResults)[0] || "";
     for (const part of auth.split(";")) {
         if (!/\bspf=pass\b/i.test(part))
             continue;
@@ -296,7 +284,7 @@ function provedSenderVia(input) {
  *  and `trustedLists` never counts on such a message. */
 function listProof(input) {
     const none = { id: "", proved: false, host: "" };
-    const raw = header(input.headerLines, "list-id");
+    const raw = header(input.headerLines, HEADER.listId);
     if (!raw)
         return none;
     // `Meeting Announcements <ieee-cs.mit.edu>` or bare `<ieee-cs.mit.edu>`;
@@ -304,9 +292,9 @@ function listProof(input) {
     const id = (raw.match(/<([^>]+)>/)?.[1] || raw).trim().toLowerCase();
     if (!id)
         return none;
-    const senderDomain = (bare(header(input.headerLines, "sender")).split("@")[1] || "").toLowerCase();
+    const senderDomain = (bare(header(input.headerLines, HEADER.sender)).split("@")[1] || "").toLowerCase();
     const hosts = [senderDomain, id].filter(Boolean);
-    const auth = headerAll(input.headerLines, "authentication-results")[0] || "";
+    const auth = headerAll(input.headerLines, HEADER.authenticationResults)[0] || "";
     for (const part of auth.split(";")) {
         if (/\bspf=pass\b/i.test(part)) {
             // iecc writes `spf.mailfrom=user@host`, Microsoft `smtp.mailfrom=host`.
@@ -324,7 +312,7 @@ function listProof(input) {
     return { id, proved: false, host: "" };
 }
 function dmarcProof(input) {
-    const auth = headerAll(input.headerLines, "authentication-results")[0] || "";
+    const auth = headerAll(input.headerLines, HEADER.authenticationResults)[0] || "";
     if (!auth)
         return { pass: false, failed: false, authFailures: [], domain: "", policy: "" };
     // What the server caught failing, by name. An outright authentication
@@ -429,8 +417,8 @@ function linkHostTrusted(host, trusted) {
     return trusted.some(t => h === t || h.endsWith("." + t));
 }
 function analyzeServerSpam(input) {
-    const status = unfold(header(input.headerLines, "x-spam-status"));
-    const flag = header(input.headerLines, "x-spam-flag");
+    const status = unfold(header(input.headerLines, HEADER.xSpamStatus));
+    const flag = header(input.headerLines, HEADER.xSpamFlag);
     if (!status && !flag)
         return null;
     const score = Number(status.match(/score=(-?[\d.]+)/)?.[1]);
@@ -451,7 +439,7 @@ function analyzeServerSpam(input) {
     const trustedLists = (input.trustedLists || []).map(l => (l || "").trim().toLowerCase());
     const list = { ...listFound, trusted: listFound.proved && trustedLists.includes(listFound.id) };
     const authFailures = list.proved && !dmarc.failed ? dmarc.authFailures.filter(f => f !== "DKIM") : dmarc.authFailures;
-    const report = parseSpamReport(header(input.headerLines, "x-spam-report"));
+    const report = parseSpamReport(header(input.headerLines, HEADER.xSpamReport));
     // Everything up to the first lowercase key=value — SpamAssassin's trailing
     // shortcircuit=/autolearn=/version= fields. Cutting on "not a rule name"
     // rather than on whitespace is what keeps "...,WORD_INVIS shortcircuit=no"
@@ -638,7 +626,7 @@ function serverSpamVerdict(input) {
     // The party that sent this on the author's behalf, when it signed: the
     // Sender: header names it and a verified signature backs the claim. That
     // is the one the reader can sensibly vouch for as an intermediary.
-    const senderDomain = (bare(header(input.headerLines, "sender")).split("@")[1] || "").toLowerCase();
+    const senderDomain = (bare(header(input.headerLines, HEADER.sender)).split("@")[1] || "").toLowerCase();
     const relay = senderDomain ? a.signers.find(s => sameOrg(s, senderDomain)) : "";
     const via = relay && !a.proved ? { via: relay } : {};
     // Say WHICH party and HOW, in the finding itself (Bob 2026-09-08: "the
@@ -766,7 +754,7 @@ function selfSpoof(input) {
     const own = new Set(input.ownAddresses.map(bare).filter(Boolean));
     if (!own.has(from))
         return null;
-    const auth = headerAll(input.headerLines, "authentication-results").join(" ; ");
+    const auth = headerAll(input.headerLines, HEADER.authenticationResults).join(" ; ");
     if (!auth)
         return null;
     // The From domain passed DMARC, aligned, at the receiving server: the
@@ -800,7 +788,7 @@ function selfSpoof(input) {
     if (!failed.length) {
         if (/\b(spf|dkim|dmarc)=pass\b/i.test(auth))
             return null;
-        const envelopeAddr = bare(header(input.headerLines, "return-path"));
+        const envelopeAddr = bare(header(input.headerLines, HEADER.returnPath));
         const note = envelopeAddr && envelopeAddr !== from ? `; envelope sender ${envelopeAddr}` : "";
         return {
             id: "self-spoof",
@@ -811,7 +799,7 @@ function selfSpoof(input) {
     }
     // Name the envelope sender when it disagrees — that is the address that
     // actually sent this, and seeing it beside the claim is the whole story.
-    const envelope = bare(header(input.headerLines, "return-path"));
+    const envelope = bare(header(input.headerLines, HEADER.returnPath));
     const envelopeNote = envelope && envelope !== from ? `; actually sent by ${envelope}` : "";
     return {
         id: "self-spoof",
@@ -1091,7 +1079,7 @@ function listRewrittenAuthor(input, fromDomain) {
     const encoded = local.match(/^([^=]+)=([a-z0-9.-]+\.[a-z]{2,})$/i);
     if (encoded)
         return `${encoded[1]}@${encoded[2]}`.toLowerCase();
-    for (const name of ["x-original-from", "resent-from"]) {
+    for (const name of [HEADER.xOriginalFrom, HEADER.resentFrom]) {
         const addr = bare(header(input.headerLines, name));
         if (addr.includes("@"))
             return addr;