@bobfrankston/mailx-types 0.1.112 → 0.1.113

package/headers.d.ts

@@ -0,0 +1,87 @@
+/**
+ * Message headers — the ONE place mailx reads a header section and names
+ * the header fields it cares about.
+ *
+ * 2026-10-27 — Claude Code (Opus 5.5), at Bob's direction ("Isn't there a
+ * single header parse that is shared?" / "the string cc shouldn't be strewn
+ * around the code"). There wasn't: trust.ts, list-identity.ts,
+ * outgoingEnvelope, the desktop store, Android's web-service, the CLI index
+ * rebuild (twice) and the spam-report CSV each read headers their own way —
+ * different rules for case, folding and repeated fields, and every one
+ * spelled the field names itself. One of them took the first `Delivered-To:`
+ * anywhere in the first 4 KB, body included; another missed `CC:` written in
+ * capitals. Field names live in HEADER below; reading lives in the functions.
+ *
+ * Pure, no I/O, browser-safe.
+ */
+/** Header field names, lowercase (lookups ignore case). Add a field here
+ *  rather than writing its name at a call site. */
+export declare const HEADER: {
+    readonly from: "from";
+    readonly to: "to";
+    readonly cc: "cc";
+    readonly bcc: "bcc";
+    readonly replyTo: "reply-to";
+    readonly sender: "sender";
+    readonly subject: "subject";
+    readonly date: "date";
+    readonly messageId: "message-id";
+    readonly returnPath: "return-path";
+    readonly deliveredTo: "delivered-to";
+    readonly xOriginalTo: "x-original-to";
+    readonly envelopeTo: "envelope-to";
+    readonly resentFrom: "resent-from";
+    readonly xOriginalFrom: "x-original-from";
+    readonly listId: "list-id";
+    readonly listPost: "list-post";
+    readonly listUnsubscribe: "list-unsubscribe";
+    readonly listUnsubscribePost: "list-unsubscribe-post";
+    readonly authenticationResults: "authentication-results";
+    readonly xSpamStatus: "x-spam-status";
+    readonly xSpamFlag: "x-spam-flag";
+    readonly xSpamReport: "x-spam-report";
+    readonly xMailxDraftId: "x-mailx-draft-id";
+};
+/** The fields whose addresses a message is sent to (SMTP RCPT TO). */
+export declare const RECIPIENT_HEADERS: readonly ["to", "cc", "bcc"];
+/** Receiving-server fields naming the address a copy was delivered to:
+ *  qmail/Gmail, Postfix, Exim spellings of the same fact. */
+export declare const DELIVERY_HEADERS: readonly ["delivered-to", "x-original-to", "envelope-to"];
+/** One header field occurrence: lowercase name and the raw `Name: value`
+ *  line (continuation lines included) — the shape of mailparser's
+ *  `headerLines`, so a parsed message can be read with the same functions. */
+export interface HeaderLine {
+    key: string;
+    line: string;
+}
+/** Offset where the header section of raw RFC 822 text ends (the first
+ *  blank line), or -1 when there is no body. */
+export declare function headerSectionEnd(raw: string): number;
+/** Every header field of raw RFC 822 text, in order, repeated fields kept.
+ *  Only the header section is read, so a `Cc:` line quoted in the body is
+ *  never mistaken for a header. */
+export declare function readHeaderLines(raw: string): HeaderLine[];
+/** The line ending raw text uses ("\r\n" or "\n"). */
+export declare function lineEnding(raw: string): string;
+/** Every value of a field, unfolded and trimmed, in message order. */
+export declare function headerValues(lines: readonly HeaderLine[], name: string): string[];
+/** The first value of a field, or "". */
+export declare function headerValue(lines: readonly HeaderLine[], name: string): string;
+/** Every value of a field with its folding KEPT (continuation line breaks and
+ *  their whitespace), trimmed at the ends. For fields whose line structure
+ *  carries meaning: SpamAssassin's X-Spam-Report lists one rule per line, and
+ *  trust.ts parses it by line. Most callers want headerValues. */
+export declare function headerRawValues(lines: readonly HeaderLine[], name: string): string[];
+/** The first value of a field, folding kept, or "". */
+export declare function headerRawValue(lines: readonly HeaderLine[], name: string): string;
+/** List-Unsubscribe (RFC 2369) split into its mailto: and http(s): targets,
+ *  plus whether List-Unsubscribe-Post offers RFC 8058 one-click. Reads the
+ *  raw header so BOTH targets are seen (mailparser's structured view kept
+ *  only one). Moved here from mailx-store/store.ts 2026-10-27 so Android
+ *  (which kept only the raw value) gets the same answer. */
+export declare function listUnsubscribeOf(lines: readonly HeaderLine[]): {
+    mail: string;
+    http: string;
+    oneClick: boolean;
+};
+//# sourceMappingURL=headers.d.ts.map

package/headers.js

@@ -0,0 +1,138 @@
+/**
+ * Message headers — the ONE place mailx reads a header section and names
+ * the header fields it cares about.
+ *
+ * 2026-10-27 — Claude Code (Opus 5.5), at Bob's direction ("Isn't there a
+ * single header parse that is shared?" / "the string cc shouldn't be strewn
+ * around the code"). There wasn't: trust.ts, list-identity.ts,
+ * outgoingEnvelope, the desktop store, Android's web-service, the CLI index
+ * rebuild (twice) and the spam-report CSV each read headers their own way —
+ * different rules for case, folding and repeated fields, and every one
+ * spelled the field names itself. One of them took the first `Delivered-To:`
+ * anywhere in the first 4 KB, body included; another missed `CC:` written in
+ * capitals. Field names live in HEADER below; reading lives in the functions.
+ *
+ * Pure, no I/O, browser-safe.
+ */
+/** Header field names, lowercase (lookups ignore case). Add a field here
+ *  rather than writing its name at a call site. */
+export const HEADER = {
+    from: "from",
+    to: "to",
+    cc: "cc",
+    bcc: "bcc",
+    replyTo: "reply-to",
+    sender: "sender",
+    subject: "subject",
+    date: "date",
+    messageId: "message-id",
+    returnPath: "return-path",
+    deliveredTo: "delivered-to",
+    xOriginalTo: "x-original-to",
+    envelopeTo: "envelope-to",
+    resentFrom: "resent-from",
+    xOriginalFrom: "x-original-from",
+    listId: "list-id",
+    listPost: "list-post",
+    listUnsubscribe: "list-unsubscribe",
+    listUnsubscribePost: "list-unsubscribe-post",
+    authenticationResults: "authentication-results",
+    xSpamStatus: "x-spam-status",
+    xSpamFlag: "x-spam-flag",
+    xSpamReport: "x-spam-report",
+    xMailxDraftId: "x-mailx-draft-id",
+};
+/** The fields whose addresses a message is sent to (SMTP RCPT TO). */
+export const RECIPIENT_HEADERS = [HEADER.to, HEADER.cc, HEADER.bcc];
+/** Receiving-server fields naming the address a copy was delivered to:
+ *  qmail/Gmail, Postfix, Exim spellings of the same fact. */
+export const DELIVERY_HEADERS = [HEADER.deliveredTo, HEADER.xOriginalTo, HEADER.envelopeTo];
+/** Offset where the header section of raw RFC 822 text ends (the first
+ *  blank line), or -1 when there is no body. */
+export function headerSectionEnd(raw) {
+    return (raw || "").search(/\r?\n\r?\n/);
+}
+/** Every header field of raw RFC 822 text, in order, repeated fields kept.
+ *  Only the header section is read, so a `Cc:` line quoted in the body is
+ *  never mistaken for a header. */
+export function readHeaderLines(raw) {
+    const end = headerSectionEnd(raw);
+    const section = end === -1 ? (raw || "") : raw.slice(0, end);
+    const out = [];
+    // Split keeping each line's own ending, so a field rebuilt from `line`
+    // (outgoingEnvelope's Bcc strip) is byte-identical to what was read.
+    const parts = section.split(/(\r?\n)/);
+    for (let i = 0; i < parts.length; i += 2) {
+        const physical = parts[i];
+        const eol = parts[i - 1] ?? "";
+        if (/^[ \t]/.test(physical) && out.length) {
+            out[out.length - 1].line += eol + physical;
+            continue;
+        }
+        const colon = physical.indexOf(":");
+        if (colon <= 0)
+            continue;
+        out.push({ key: physical.slice(0, colon).trim().toLowerCase(), line: physical });
+    }
+    return out;
+}
+/** The line ending raw text uses ("\r\n" or "\n"). */
+export function lineEnding(raw) {
+    return /\r\n/.test(raw || "") ? "\r\n" : "\n";
+}
+/** Every value of a field, unfolded and trimmed, in message order. */
+export function headerValues(lines, name) {
+    const want = name.toLowerCase();
+    const out = [];
+    for (const h of lines || []) {
+        if ((h.key || "").toLowerCase() !== want)
+            continue;
+        const colon = h.line.indexOf(":");
+        if (colon >= 0)
+            out.push(h.line.slice(colon + 1).replace(/\r?\n[ \t]+/g, " ").trim());
+    }
+    return out;
+}
+/** The first value of a field, or "". */
+export function headerValue(lines, name) {
+    return headerValues(lines, name)[0] ?? "";
+}
+/** Every value of a field with its folding KEPT (continuation line breaks and
+ *  their whitespace), trimmed at the ends. For fields whose line structure
+ *  carries meaning: SpamAssassin's X-Spam-Report lists one rule per line, and
+ *  trust.ts parses it by line. Most callers want headerValues. */
+export function headerRawValues(lines, name) {
+    const want = name.toLowerCase();
+    const out = [];
+    for (const h of lines || []) {
+        if ((h.key || "").toLowerCase() !== want)
+            continue;
+        const colon = h.line.indexOf(":");
+        if (colon >= 0)
+            out.push(h.line.slice(colon + 1).trim());
+    }
+    return out;
+}
+/** The first value of a field, folding kept, or "". */
+export function headerRawValue(lines, name) {
+    return headerRawValues(lines, name)[0] ?? "";
+}
+/** List-Unsubscribe (RFC 2369) split into its mailto: and http(s): targets,
+ *  plus whether List-Unsubscribe-Post offers RFC 8058 one-click. Reads the
+ *  raw header so BOTH targets are seen (mailparser's structured view kept
+ *  only one). Moved here from mailx-store/store.ts 2026-10-27 so Android
+ *  (which kept only the raw value) gets the same answer. */
+export function listUnsubscribeOf(lines) {
+    let mail = "";
+    let http = "";
+    for (const m of headerValue(lines, HEADER.listUnsubscribe).matchAll(/<([^<>]+)>/g)) {
+        const url = m[1].trim();
+        if (!mail && /^mailto:/i.test(url))
+            mail = url;
+        else if (!http && /^https?:/i.test(url))
+            http = url;
+    }
+    const oneClick = /one-?click/i.test(headerValue(lines, HEADER.listUnsubscribePost));
+    return { mail, http, oneClick };
+}
+//# sourceMappingURL=headers.js.map

package/index.d.ts

@@ -615,8 +615,10 @@ export declare function parseInvite(ics: string): ParsedInvite | null;
  * case specially").
  */
 export declare function inviteHasGoogleRsvp(bodyHtml: string): boolean;
+export { HEADER, RECIPIENT_HEADERS, DELIVERY_HEADERS, readHeaderLines, headerValue, headerValues, headerRawValue, headerRawValues, headerSectionEnd, lineEnding, listUnsubscribeOf } from "./headers.js";
+export type { HeaderLine } from "./headers.js";
 export { splitAddressHeader, parseAddressList, parseAddress, envelopeAddresses, firstAddress, isValidAddress, ADDRESS_IN_TEXT, findAddressesInText } from "./address.js";
 export type { ParsedAddress } from "./address.js";
-export { readListIdentity } from "./list-identity.js";
+export { readListIdentity, groupsIoOriginal } from "./list-identity.js";
 export type { ListIdentity, ListHeaderLine } from "./list-identity.js";
 //# sourceMappingURL=index.d.ts.map

package/index.js

@@ -233,22 +233,18 @@ export function formatAddressListForHeader(list) {
  *  Bcc is stripped from the header section only, continuation lines included,
  *  so a quoted "Bcc:" in the body is never eaten. */
 export function outgoingEnvelope(raw, fallbackSender) {
-    const headerEnd = raw.search(/\r?\n\r?\n/);
-    const headerRaw = headerEnd === -1 ? raw : raw.slice(0, headerEnd);
-    const headerSec = headerRaw.replace(/\r?\n[ \t]+/g, " ");
-    const field = (name) => headerSec.match(new RegExp(`^${name}:[ \\t]*(.*)$`, "mi"))?.[1] ?? "";
-    const recipients = [
-        ...envelopeAddresses(field("To")),
-        ...envelopeAddresses(field("Cc")),
-        ...envelopeAddresses(field("Bcc")),
-    ];
-    const sender = envelopeAddresses(field("From"))[0] || fallbackSender;
-    const messageId = field("Message-ID").match(/<[^<>]+>/)?.[0] ?? "";
-    // The `(\r?\n|$)` tail takes the line ending with the header so no blank
-    // line is left mid-headers; the final trim covers Bcc as the last header.
-    const stripBcc = (h) => h.replace(/^Bcc:[^\n]*(\r?\n[ \t][^\n]*)*(\r?\n|$)/mi, "").replace(/\r?\n$/, "");
-    const rawToSend = headerEnd === -1 ? stripBcc(raw) : stripBcc(headerRaw) + raw.slice(headerEnd);
-    return { recipients, sender, subject: field("Subject").trim(), messageId, rawToSend };
+    // 2026-10-27: headers read by the shared headers.ts (was a local regex
+    // per field, and a `^Bcc:` regex for the strip).
+    const lines = readHeaderLines(raw);
+    const recipients = RECIPIENT_HEADERS.flatMap(name => headerValues(lines, name).flatMap(envelopeAddresses));
+    const sender = envelopeAddresses(headerValue(lines, HEADER.from))[0] || fallbackSender;
+    const messageId = headerValue(lines, HEADER.messageId).match(/<[^<>]+>/)?.[0] ?? "";
+    // Bcc leaves the transmitted copy: the header section is rebuilt from the
+    // fields read above minus Bcc, each line byte-for-byte as it came in.
+    const end = headerSectionEnd(raw);
+    const kept = lines.filter(h => h.key !== HEADER.bcc).map(h => h.line).join(lineEnding(raw));
+    const rawToSend = end === -1 ? kept : kept + raw.slice(end);
+    return { recipients, sender, subject: headerValue(lines, HEADER.subject), messageId, rawToSend };
 }
 /** Entries of an address header that a reader would see as an address with
  *  no `@` — e.g. the "Frankston" in `Frankston, Bob <x@y>`. Empty when sound. */
@@ -853,9 +849,12 @@ export function inviteHasGoogleRsvp(bodyHtml) {
         return false;
     return /calendar\.google\.com\/calendar\/event\?action=RESPOND/i.test(bodyHtml);
 }
+// Header parsing: one reader for the whole app, field names in HEADER.
+import { HEADER, RECIPIENT_HEADERS, readHeaderLines, headerValue, headerValues, headerSectionEnd, lineEnding } from "./headers.js";
+export { HEADER, RECIPIENT_HEADERS, DELIVERY_HEADERS, readHeaderLines, headerValue, headerValues, headerRawValue, headerRawValues, headerSectionEnd, lineEnding, listUnsubscribeOf } from "./headers.js";
 // Address parsing: one splitter, one notion of "is this an address".
 import { splitAddressHeader, envelopeAddresses, findAddressesInText } from "./address.js";
 export { splitAddressHeader, parseAddressList, parseAddress, envelopeAddresses, firstAddress, isValidAddress, ADDRESS_IN_TEXT, findAddressesInText } from "./address.js";
 // Delivery address + mailing-list identity for reply's From (desktop + Android).
-export { readListIdentity } from "./list-identity.js";
+export { readListIdentity, groupsIoOriginal } from "./list-identity.js";
 //# sourceMappingURL=index.js.map

package/list-identity.d.ts

@@ -20,11 +20,9 @@
  * two cannot drift apart again. Pure: header lines and body text in, strings
  * out — no I/O, browser-safe.
  */
-/** A header line as mailparser's `headerLines` gives it: lowercase key, raw `Key: value` line. */
-export interface ListHeaderLine {
-    key: string;
-    line: string;
-}
+import { type HeaderLine } from "./headers.js";
+/** Kept as an alias so existing imports keep working; the shape lives in headers.ts. */
+export type ListHeaderLine = HeaderLine;
 export interface ListIdentity {
     /** Address the RECEIVING server recorded delivering this copy to
      *  (Delivered-To / X-Original-To / Envelope-To), or "". A mailing list's
@@ -48,6 +46,16 @@ export interface ListIdentity {
      *  real address is in Resent-From. (2026-10-26, Claude Code (Opus 5.5).) */
     listAuthor: string;
 }
+/** groups.io's stand-in for a member's address, `local=domain@groups.io`,
+ *  decoded back to `local@domain`; "" for anything else. groups.io refuses
+ *  mail sent to the stand-in and names the decoded form as the one to use
+ *  ("To reply to this person, send your message to bernardgreenberg@msn.com").
+ *  The LAST `=` separates local part from domain. Real groups.io addresses
+ *  (`group@`, `group+owner@`) carry no `=`, so they pass through.
+ *  (2026-10-27, Claude Code (Opus 5.5): reply needs this for EVERY such
+ *  address in To/Cc, not only the From — Bernard Cc's himself, and groups.io
+ *  rewrites that Cc too.) */
+export declare function groupsIoOriginal(address: string): string;
 /** Read the delivery and list facts out of a parsed message. */
 export declare function readListIdentity(headerLines: readonly ListHeaderLine[], bodyText: string, bodyHtml: string): ListIdentity;
 //# sourceMappingURL=list-identity.d.ts.map

package/list-identity.js

@@ -21,19 +21,8 @@
  * out — no I/O, browser-safe.
  */
 import { firstAddress } from "./address.js";
-/** Value of every occurrence of a header, unfolded, in message order. */
-function headerValues(lines, name) {
-    const want = name.toLowerCase();
-    const out = [];
-    for (const h of lines || []) {
-        if ((h.key || "").toLowerCase() !== want)
-            continue;
-        const colon = h.line.indexOf(":");
-        if (colon >= 0)
-            out.push(h.line.slice(colon + 1).replace(/\r?\n[ \t]+/g, " ").trim());
-    }
-    return out;
-}
+import { HEADER, DELIVERY_HEADERS, headerValues } from "./headers.js";
+// Header reading: shared headerValues (headers.ts), 2026-10-27.
 /** First addr-spec in a header value, lowercased (shared parser: address.ts). */
 function bareAddress(value) {
     return firstAddress(value || "").toLowerCase();
@@ -50,12 +39,25 @@ const LIST_DELIVERED_TO = /^mailing list\s/i;
  *  optional anchor tail, then blanks, then the bracket), so a long body with
  *  no footer fails in a single pass. */
 const GROUPS_IO_SUBSCRIBER = /groups\.io\/g\/[^\s"'<>\/]+\/leave\/[^\s"'<>]*(?:["']>Unsubscribe<\/a>)?\s*\[([^\s\[\]<>@]+@[^\s\[\]<>@]+)\]/i;
+/** groups.io's stand-in for a member's address, `local=domain@groups.io`,
+ *  decoded back to `local@domain`; "" for anything else. groups.io refuses
+ *  mail sent to the stand-in and names the decoded form as the one to use
+ *  ("To reply to this person, send your message to bernardgreenberg@msn.com").
+ *  The LAST `=` separates local part from domain. Real groups.io addresses
+ *  (`group@`, `group+owner@`) carry no `=`, so they pass through.
+ *  (2026-10-27, Claude Code (Opus 5.5): reply needs this for EVERY such
+ *  address in To/Cc, not only the From — Bernard Cc's himself, and groups.io
+ *  rewrites that Cc too.) */
+export function groupsIoOriginal(address) {
+    const m = (address || "").trim().match(/^(.+)=([^=@\s]+)@groups\.io$/i);
+    return m ? `${m[1]}@${m[2]}` : "";
+}
 /** Read the delivery and list facts out of a parsed message. */
 export function readListIdentity(headerLines, bodyText, bodyHtml) {
     // Receiving-server headers: each agent PREPENDS its own, so the first
     // that is not a list's loop marker is the final delivery to this mailbox.
     let deliveredTo = "";
-    for (const key of ["delivered-to", "x-original-to", "envelope-to"]) {
+    for (const key of DELIVERY_HEADERS) {
         for (const value of headerValues(headerLines, key)) {
             if (LIST_DELIVERED_TO.test(value))
                 continue;
@@ -67,13 +69,13 @@ export function readListIdentity(headerLines, bodyText, bodyHtml) {
         if (deliveredTo)
             break;
     }
-    const rawListId = headerValues(headerLines, "list-id")[0] || "";
+    const rawListId = headerValues(headerLines, HEADER.listId)[0] || "";
     const listId = ((rawListId.match(/<([^>]+)>/)?.[1]) || rawListId).trim().toLowerCase();
     if (!listId)
         return { deliveredTo, listId: "", listAddresses: [], listSubscriber: "", listAuthor: "" };
-    const listPost = (headerValues(headerLines, "list-post")[0] || "").match(/<mailto:([^>?]+)/i)?.[1] || "";
+    const listPost = (headerValues(headerLines, HEADER.listPost)[0] || "").match(/<mailto:([^>?]+)/i)?.[1] || "";
     const listAddresses = [];
-    for (const candidate of [listPost, headerValues(headerLines, "reply-to")[0], headerValues(headerLines, "sender")[0]]) {
+    for (const candidate of [listPost, headerValues(headerLines, HEADER.replyTo)[0], headerValues(headerLines, HEADER.sender)[0]]) {
         const addr = bareAddress(candidate || "");
         if (addr && !listAddresses.includes(addr))
             listAddresses.push(addr);
@@ -89,10 +91,9 @@ export function readListIdentity(headerLines, bodyText, bodyHtml) {
         // A rewritten From is `local=domain@groups.io`. Resent-From carries
         // the original; failing that, the rewrite itself encodes it (the
         // LAST `=` separates local part from domain).
-        const from = bareAddress(headerValues(headerLines, "from")[0] || "");
-        const rewritten = from.match(/^(.+)=([^=@]+)@groups\.io$/);
-        if (rewritten)
-            listAuthor = bareAddress(headerValues(headerLines, "resent-from")[0] || "") || `${rewritten[1]}@${rewritten[2]}`;
+        const decoded = groupsIoOriginal(bareAddress(headerValues(headerLines, HEADER.from)[0] || ""));
+        if (decoded)
+            listAuthor = bareAddress(headerValues(headerLines, HEADER.resentFrom)[0] || "") || decoded;
     }
     return { deliveredTo, listId, listAddresses, listSubscriber, listAuthor };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bobfrankston/mailx-types",
-  "version": "0.1.112",
+  "version": "0.1.113",
   "type": "module",
   "main": "index.js",
   "types": "index.d.ts",

package/trust.js

@@ -29,6 +29,7 @@
  * exactly the cry-wolf banner this is trying not to be.
  */
 import { firstAddress } from "./address.js";
+import { HEADER, headerRawValue, headerRawValues } from "./headers.js";
 /** What the reader can vouch for, and the allowlist.jsonc key each one is
  *  written to. One table, shared by the desktop service and the Android
  *  web-service, so "trust X" cannot land in different keys on the two
@@ -44,30 +45,13 @@ export const TRUST_LIST_KEYS = {
     // 2026-09-30 — see TrustInput.trustedLinkHosts.
     linkhost: "trustedLinkHosts",
 };
-/** First value of a header, case-insensitive. */
-function header(lines, name) {
-    const want = name.toLowerCase();
-    for (const h of lines) {
-        if ((h.key || "").toLowerCase() !== want)
-            continue;
-        const colon = h.line.indexOf(":");
-        return colon < 0 ? "" : h.line.slice(colon + 1).trim();
-    }
-    return "";
-}
-/** All values of a repeated header. */
-function headerAll(lines, name) {
-    const want = name.toLowerCase();
-    const out = [];
-    for (const h of lines) {
-        if ((h.key || "").toLowerCase() !== want)
-            continue;
-        const colon = h.line.indexOf(":");
-        if (colon >= 0)
-            out.push(h.line.slice(colon + 1).trim());
-    }
-    return out;
-}
+// 2026-10-27 — Claude Code (Opus 5.5): header reading moved to the shared
+// headers.ts (one parse for the whole app); these names stay as the local
+// spelling the checks below use.
+// The RAW readers: trust parses some fields by line (X-Spam-Report) and
+// unfolds the rest itself (see unfold below), exactly as before the move.
+const header = (lines, name) => headerRawValue(lines, name);
+const headerAll = (lines, name) => headerRawValues(lines, name);
 // 2026-10-26 — Claude Code (Opus 5.5): the addr-spec comes from the shared
 // parser (address.ts) instead of a first-`@`-token scan. The scan took the
 // first token holding an `@` ANYWHERE in the value, so `"ceo@bank.com"
@@ -212,7 +196,7 @@ function classifyRule(name, dmarcFailed, listRelayed = false) {
  *  author (Google Calendar signs d=google.com on an invitation From the
  *  organizer), which is exactly what makes it an intermediary. */
 function dkimSigners(input) {
-    const auth = headerAll(input.headerLines, "authentication-results")[0] || "";
+    const auth = headerAll(input.headerLines, HEADER.authenticationResults)[0] || "";
     const out = [];
     for (const part of auth.split(";")) {
         if (!/\bdkim=pass\b/i.test(part))
@@ -236,7 +220,7 @@ function alignedPass(input) {
         return "";
     if (dkimSigners(input).some(d => sameOrg(d, fromDomain)))
         return "dkim";
-    const auth = headerAll(input.headerLines, "authentication-results")[0] || "";
+    const auth = headerAll(input.headerLines, HEADER.authenticationResults)[0] || "";
     for (const part of auth.split(";")) {
         if (!/\bspf=pass\b/i.test(part))
             continue;
@@ -300,7 +284,7 @@ function provedSenderVia(input) {
  *  and `trustedLists` never counts on such a message. */
 function listProof(input) {
     const none = { id: "", proved: false, host: "" };
-    const raw = header(input.headerLines, "list-id");
+    const raw = header(input.headerLines, HEADER.listId);
     if (!raw)
         return none;
     // `Meeting Announcements <ieee-cs.mit.edu>` or bare `<ieee-cs.mit.edu>`;
@@ -308,9 +292,9 @@ function listProof(input) {
     const id = (raw.match(/<([^>]+)>/)?.[1] || raw).trim().toLowerCase();
     if (!id)
         return none;
-    const senderDomain = (bare(header(input.headerLines, "sender")).split("@")[1] || "").toLowerCase();
+    const senderDomain = (bare(header(input.headerLines, HEADER.sender)).split("@")[1] || "").toLowerCase();
     const hosts = [senderDomain, id].filter(Boolean);
-    const auth = headerAll(input.headerLines, "authentication-results")[0] || "";
+    const auth = headerAll(input.headerLines, HEADER.authenticationResults)[0] || "";
     for (const part of auth.split(";")) {
         if (/\bspf=pass\b/i.test(part)) {
             // iecc writes `spf.mailfrom=user@host`, Microsoft `smtp.mailfrom=host`.
@@ -328,7 +312,7 @@ function listProof(input) {
     return { id, proved: false, host: "" };
 }
 function dmarcProof(input) {
-    const auth = headerAll(input.headerLines, "authentication-results")[0] || "";
+    const auth = headerAll(input.headerLines, HEADER.authenticationResults)[0] || "";
     if (!auth)
         return { pass: false, failed: false, authFailures: [], domain: "", policy: "" };
     // What the server caught failing, by name. An outright authentication
@@ -433,8 +417,8 @@ function linkHostTrusted(host, trusted) {
     return trusted.some(t => h === t || h.endsWith("." + t));
 }
 function analyzeServerSpam(input) {
-    const status = unfold(header(input.headerLines, "x-spam-status"));
-    const flag = header(input.headerLines, "x-spam-flag");
+    const status = unfold(header(input.headerLines, HEADER.xSpamStatus));
+    const flag = header(input.headerLines, HEADER.xSpamFlag);
     if (!status && !flag)
         return null;
     const score = Number(status.match(/score=(-?[\d.]+)/)?.[1]);
@@ -455,7 +439,7 @@ function analyzeServerSpam(input) {
     const trustedLists = (input.trustedLists || []).map(l => (l || "").trim().toLowerCase());
     const list = { ...listFound, trusted: listFound.proved && trustedLists.includes(listFound.id) };
     const authFailures = list.proved && !dmarc.failed ? dmarc.authFailures.filter(f => f !== "DKIM") : dmarc.authFailures;
-    const report = parseSpamReport(header(input.headerLines, "x-spam-report"));
+    const report = parseSpamReport(header(input.headerLines, HEADER.xSpamReport));
     // Everything up to the first lowercase key=value — SpamAssassin's trailing
     // shortcircuit=/autolearn=/version= fields. Cutting on "not a rule name"
     // rather than on whitespace is what keeps "...,WORD_INVIS shortcircuit=no"
@@ -642,7 +626,7 @@ function serverSpamVerdict(input) {
     // The party that sent this on the author's behalf, when it signed: the
     // Sender: header names it and a verified signature backs the claim. That
     // is the one the reader can sensibly vouch for as an intermediary.
-    const senderDomain = (bare(header(input.headerLines, "sender")).split("@")[1] || "").toLowerCase();
+    const senderDomain = (bare(header(input.headerLines, HEADER.sender)).split("@")[1] || "").toLowerCase();
     const relay = senderDomain ? a.signers.find(s => sameOrg(s, senderDomain)) : "";
     const via = relay && !a.proved ? { via: relay } : {};
     // Say WHICH party and HOW, in the finding itself (Bob 2026-09-08: "the
@@ -770,7 +754,7 @@ function selfSpoof(input) {
     const own = new Set(input.ownAddresses.map(bare).filter(Boolean));
     if (!own.has(from))
         return null;
-    const auth = headerAll(input.headerLines, "authentication-results").join(" ; ");
+    const auth = headerAll(input.headerLines, HEADER.authenticationResults).join(" ; ");
     if (!auth)
         return null;
     // The From domain passed DMARC, aligned, at the receiving server: the
@@ -804,7 +788,7 @@ function selfSpoof(input) {
     if (!failed.length) {
         if (/\b(spf|dkim|dmarc)=pass\b/i.test(auth))
             return null;
-        const envelopeAddr = bare(header(input.headerLines, "return-path"));
+        const envelopeAddr = bare(header(input.headerLines, HEADER.returnPath));
         const note = envelopeAddr && envelopeAddr !== from ? `; envelope sender ${envelopeAddr}` : "";
         return {
             id: "self-spoof",
@@ -815,7 +799,7 @@ function selfSpoof(input) {
     }
     // Name the envelope sender when it disagrees — that is the address that
     // actually sent this, and seeing it beside the claim is the whole story.
-    const envelope = bare(header(input.headerLines, "return-path"));
+    const envelope = bare(header(input.headerLines, HEADER.returnPath));
     const envelopeNote = envelope && envelope !== from ? `; actually sent by ${envelope}` : "";
     return {
         id: "self-spoof",
@@ -1095,7 +1079,7 @@ function listRewrittenAuthor(input, fromDomain) {
     const encoded = local.match(/^([^=]+)=([a-z0-9.-]+\.[a-z]{2,})$/i);
     if (encoded)
         return `${encoded[1]}@${encoded[2]}`.toLowerCase();
-    for (const name of ["x-original-from", "resent-from"]) {
+    for (const name of [HEADER.xOriginalFrom, HEADER.resentFrom]) {
         const addr = bare(header(input.headerLines, name));
         if (addr.includes("@"))
             return addr;