@bobfrankston/mailx-types 0.1.42 → 0.1.45

package/mailx-api.d.ts

@@ -204,6 +204,13 @@ export interface MailxApi {
         status: number;
         statusText: string;
     }>;
+    /** Fetch a remote image's bytes for the viewer's "Copy image" action —
+     *  cross-origin images can't be read inside the WebView (no CORS headers,
+     *  tainted canvas), so the daemon does it. Optional: desktop-only. */
+    fetchRemoteImage?(url: string): Promise<{
+        base64: string;
+        contentType: string;
+    }>;
     consumePendingMailto(): any | Promise<any>;
     /** C46 Windows Share target — startup-race twin of the daemon's
      *  fs.watch on pending-share.json. Optional: desktop-only. */

package/mime-inline-images.d.ts

@@ -27,10 +27,6 @@ export interface InlineImagePart {
     mime: string;
     base64: string;
 }
-/** Pull base64 `data:` images out of the HTML, replacing each src with a
- *  `cid:` reference. Identical data: URIs (the same image pasted twice)
- *  collapse to one part. `idDomain` scopes the Content-IDs (RFC 2392 wants
- *  msg-id-like uniqueness). */
 export declare function extractInlineImages(html: string, idDomain: string): {
     html: string;
     images: InlineImagePart[];

package/mime-inline-images.js

@@ -25,18 +25,62 @@
  *  `cid:` reference. Identical data: URIs (the same image pasted twice)
  *  collapse to one part. `idDomain` scopes the Content-IDs (RFC 2392 wants
  *  msg-id-like uniqueness). */
+/** Base64 of a UTF-8 string, in both runtimes this package targets: the
+ *  daemon (Node, no `btoa` on older majors) and the browser/WebView (no
+ *  `Buffer`). SVG markup is text, so it must go through UTF-8 bytes rather
+ *  than `btoa` directly, which throws on any character above U+00FF. */
+function utf8ToBase64(text) {
+    const bytes = new TextEncoder().encode(text);
+    // Reached through globalThis, not by name: this module is type-checked
+    // against the BROWSER lib for the client build, where `Buffer` has no
+    // declaration at all.
+    const B = globalThis.Buffer;
+    if (B)
+        return B.from(bytes).toString("base64");
+    let bin = "";
+    for (const b of bytes)
+        bin += String.fromCharCode(b);
+    return btoa(bin);
+}
 export function extractInlineImages(html, idDomain) {
     const images = [];
     const byDataUri = new Map(); // data-uri → contentId
     const stamp = `${Date.now().toString(36)}${Math.random().toString(36).slice(2, 8)}`;
-    const out = html.replace(/(<img\b[^>]*?\ssrc=)(["'])(data:(image\/[\w.+-]+);base64,([A-Za-z0-9+/=\s]+))\2/gi, (_m, prefix, quote, dataUri, mime, b64) => {
+    // Two encodings, one job. `;base64,` is what an editor produces when it
+    // ingests a pasted bitmap — but SVG normally arrives URL-ENCODED
+    // (`data:image/svg+xml,%3Csvg…`), which is how most tools export it and
+    // what you get pasting markup. Matching only the base64 form left those
+    // as raw `data:` URIs on the wire: invisible in Outlook, stripped by
+    // Gmail — exactly the breakage v1.2.179 fixed for bitmaps, still live for
+    // SVG until now (Bob 2026-08-09: "can I put an SVG image into a
+    // message?"). Percent-encoded payloads are decoded and re-encoded to
+    // base64 so every inline image leaves as a normal MIME part.
+    const out = html.replace(/(<img\b[^>]*?\ssrc=)(["'])(data:(image\/[\w.+-]+)(;base64)?,([^"']+))\2/gi, (_m, prefix, quote, dataUri, mime, isB64, payload) => {
         let cid = byDataUri.get(dataUri);
         if (!cid) {
+            let base64;
+            if (isB64) {
+                // Strip whitespace the editor may have wrapped into the URI;
+                // the send path re-wraps at 76 cols per RFC 2045.
+                base64 = payload.replace(/\s+/g, "");
+            }
+            else {
+                try {
+                    base64 = utf8ToBase64(decodeURIComponent(payload));
+                }
+                catch {
+                    // Malformed percent-encoding — leave the src untouched
+                    // rather than emit a corrupt part. Better a broken
+                    // image the sender can see in their own Sent copy than
+                    // a silently mangled attachment.
+                    return _m;
+                }
+            }
+            if (!base64)
+                return _m;
             cid = `img${images.length + 1}.${stamp}@${idDomain}`;
             byDataUri.set(dataUri, cid);
-            // Strip whitespace the editor may have wrapped into the URI;
-            // the send path re-wraps at 76 cols per RFC 2045.
-            images.push({ contentId: cid, mime, base64: b64.replace(/\s+/g, "") });
+            images.push({ contentId: cid, mime, base64 });
         }
         return `${prefix}${quote}cid:${cid}${quote}`;
     });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bobfrankston/mailx-types",
-  "version": "0.1.42",
+  "version": "0.1.45",
   "type": "module",
   "main": "index.js",
   "types": "index.d.ts",

package/test/inline-images.test.mjs

@@ -0,0 +1,79 @@
+/**
+ * Every inline image must leave as a MIME part with a `cid:` reference — no
+ * `data:` URI may survive onto the wire, in either of the two encodings a
+ * data URI comes in.
+ *
+ * Run: node packages/mailx-types/test/inline-images.test.mjs
+ */
+import assert from "node:assert";
+import { extractInlineImages } from "../mime-inline-images.js";
+
+const PNG_B64 = "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8z8BQDwAEhQGAhKmMIQAAAABJRU5ErkJggg==";
+const SVG_TEXT = `<svg xmlns="http://www.w3.org/2000/svg" width="10" height="10"><rect width="10" height="10" fill="#08f"/></svg>`;
+const SVG_B64 = Buffer.from(SVG_TEXT, "utf8").toString("base64");
+
+let n = 0;
+const check = (name, html, expectParts, expectMime) => {
+    const r = extractInlineImages(html, "bob.ma");
+    assert.strictEqual(r.images.length, expectParts, `${name}: expected ${expectParts} part(s), got ${r.images.length}`);
+    if (expectParts > 0) {
+        assert.strictEqual(r.images[0].mime, expectMime, `${name}: wrong mime (${r.images[0].mime})`);
+        assert.ok(!/data:/i.test(r.html), `${name}: a data: URI survived into the sent HTML`);
+        assert.match(r.html, /src="cid:img1\./, `${name}: src not rewritten to cid:`);
+        assert.doesNotThrow(() => Buffer.from(r.images[0].base64, "base64"), `${name}: part payload is not valid base64`);
+    }
+    n++;
+};
+
+check("base64 PNG", `<p>x</p><img src="data:image/png;base64,${PNG_B64}">`, 1, "image/png");
+check("base64 SVG", `<p>x</p><img src="data:image/svg+xml;base64,${SVG_B64}">`, 1, "image/svg+xml");
+
+// The form SVG actually arrives in — percent-encoded markup, not base64.
+const urlSvg = `<p>x</p><img src="data:image/svg+xml,${encodeURIComponent(SVG_TEXT)}">`;
+check("URL-encoded SVG", urlSvg, 1, "image/svg+xml");
+
+// …and its payload must decode back to the original markup.
+{
+    const r = extractInlineImages(urlSvg, "bob.ma");
+    const round = Buffer.from(r.images[0].base64, "base64").toString("utf8");
+    assert.strictEqual(round, SVG_TEXT, "URL-encoded SVG did not round-trip through the MIME part");
+    n++;
+}
+
+// Non-ASCII inside SVG text must survive (btoa alone would throw here).
+{
+    const svg = `<svg xmlns="http://www.w3.org/2000/svg"><text>café — naïve ✓</text></svg>`;
+    const r = extractInlineImages(`<img src="data:image/svg+xml,${encodeURIComponent(svg)}">`, "bob.ma");
+    assert.strictEqual(r.images.length, 1, "non-ASCII SVG produced no part");
+    assert.strictEqual(Buffer.from(r.images[0].base64, "base64").toString("utf8"), svg, "non-ASCII SVG mangled");
+    n++;
+}
+
+// Malformed percent-encoding: leave the tag alone rather than emit a corrupt part.
+{
+    const bad = `<img src="data:image/svg+xml,%E0%A4%A">`;
+    const r = extractInlineImages(bad, "bob.ma");
+    assert.strictEqual(r.images.length, 0, "a malformed data URI must not become a part");
+    assert.strictEqual(r.html, bad, "a malformed data URI must be left untouched");
+    n++;
+}
+
+// The same image twice collapses to one part.
+{
+    const two = `<img src="data:image/png;base64,${PNG_B64}"><img src="data:image/png;base64,${PNG_B64}">`;
+    const r = extractInlineImages(two, "bob.ma");
+    assert.strictEqual(r.images.length, 1, "identical images should share one part");
+    assert.strictEqual((r.html.match(/cid:/g) || []).length, 2, "both tags should reference the shared cid");
+    n++;
+}
+
+// A remote image is not ours to inline.
+{
+    const remote = `<img src="https://example.com/x.png">`;
+    const r = extractInlineImages(remote, "bob.ma");
+    assert.strictEqual(r.images.length, 0);
+    assert.strictEqual(r.html, remote);
+    n++;
+}
+
+console.log(`inline-images: ${n} checks passed`);