@bobfrankston/mailx-types 0.1.55 → 0.1.59

package/index.d.ts

@@ -497,4 +497,60 @@ export declare function formatSender(addr: {
     text: string;
     claimed: string | null;
 };
+export interface InviteAttendee {
+    name: string;
+    email: string;
+    /** NEEDS-ACTION | ACCEPTED | DECLINED | TENTATIVE | DELEGATED */
+    status: string;
+    rsvp: boolean;
+}
+export interface ParsedInvite {
+    /** REQUEST (an invitation), REPLY (someone's RSVP), CANCEL, PUBLISH… */
+    method: string;
+    uid: string;
+    sequence: number;
+    summary: string;
+    description: string;
+    location: string;
+    /** ISO 8601. All-day events carry a bare date (no time part). */
+    start: string;
+    end: string;
+    /** IANA zone from TZID, when the invite specified one. */
+    tzid: string;
+    allDay: boolean;
+    organizer: {
+        name: string;
+        email: string;
+    };
+    attendees: InviteAttendee[];
+    /** Raw RRULE, if the event repeats. Rendered verbatim — turning it into
+     *  prose is a separate job and getting it subtly wrong is worse than
+     *  showing the rule. */
+    rrule: string;
+    status: string;
+    /** True when the invite was produced by Google Calendar. Google's own
+     *  HTML body carries working Yes/No/Maybe links, so the UI must NOT add a
+     *  second set of RSVP controls for these — see inviteHasGoogleRsvp. */
+    fromGoogle: boolean;
+}
+/**
+ * Parse the VEVENT out of a text/calendar part.
+ *
+ * Deliberately hand-rolled rather than pulling in an ICS library: mailx-types
+ * is the zero-dependency package shared with Android, and an invite card needs
+ * a dozen properties, not full RFC 5545 coverage. Returns null when there is
+ * no VEVENT to show.
+ */
+export declare function parseInvite(ics: string): ParsedInvite | null;
+/**
+ * Does the message body already carry Google's own Yes/No/Maybe controls?
+ *
+ * Google Calendar invitations embed working RSVP links
+ * (`calendar.google.com/calendar/event?action=RESPOND&rst=1|2|3`). When they
+ * are present the UI must show the invite summary but NOT a second set of RSVP
+ * buttons — two responders racing to set PARTSTAT is worse than one
+ * (Bob 2026-08-22: "Google's own responder handles it so you might detect that
+ * case specially").
+ */
+export declare function inviteHasGoogleRsvp(bodyHtml: string): boolean;
 //# sourceMappingURL=index.d.ts.map

package/index.js

@@ -479,9 +479,32 @@ export function displayNameClaimsOtherAddress(name, address) {
     const m = n.match(/[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/g);
     if (!m)
         return null;
+    const realDomain = real.split("@").pop() || "";
     for (const claimed of m) {
-        if (claimed.toLowerCase() !== real)
-            return claimed;
+        if (claimed.toLowerCase() === real)
+            continue;
+        // Same organisation is not impersonation. Plenty of legitimate senders
+        // put a contact address in the display name that differs from the
+        // envelope address at the same org — IEEE Xplore alerts arrive as
+        // `"Content-Alert@ieee.org" <no-reply@xplore.ieee.org>`, which the
+        // first cut flagged in danger red and read as a spam marker
+        // (Bob 2026-08-20: "marked as spam but is a valid message"; that
+        // message passes SPF, DKIM and DMARC and SpamAssassin scores it -2.0).
+        //
+        // Sub/parent-domain rather than "same registrable domain" on purpose:
+        // comparing the last two labels would treat paypal.co.uk and
+        // evil.co.uk as related, which is exactly the case that must stay
+        // flagged. A subdomain relationship cannot be forged across orgs.
+        const claimedDomain = claimed.toLowerCase().split("@").pop() || "";
+        if (claimedDomain && realDomain) {
+            if (claimedDomain === realDomain)
+                continue;
+            if (claimedDomain.endsWith("." + realDomain))
+                continue;
+            if (realDomain.endsWith("." + claimedDomain))
+                continue;
+        }
+        return claimed;
     }
     return null;
 }
@@ -506,4 +529,191 @@ export function formatSender(addr) {
         return { text: address, claimed: null };
     return { text: `${name} <${address}>`, claimed: displayNameClaimsOtherAddress(name, address) };
 }
+/** Unfold RFC 5545 continuation lines: a line beginning with a space or tab
+ *  continues the previous one. Google folds ATTENDEE lines mid-parameter, so
+ *  skipping this loses attendees entirely. */
+function unfoldIcs(text) {
+    const raw = (text || "").replace(/\r\n/g, "\n").split("\n");
+    const out = [];
+    for (const line of raw) {
+        if (/^[ \t]/.test(line) && out.length)
+            out[out.length - 1] += line.slice(1);
+        else
+            out.push(line);
+    }
+    return out;
+}
+/** RFC 5545 TEXT unescaping: \\n is a newline, and \\, \\; \\, are literals. */
+function unescapeIcs(v) {
+    return (v || "")
+        .replace(/\\n/gi, "\n")
+        .replace(/\\([;,\\])/g, "$1");
+}
+/** Split "KEY;PARAM=x;PARAM2=y:value" into its three pieces. */
+function splitIcsLine(line) {
+    // The first colon that is not inside a quoted parameter ends the name part.
+    let inQuote = false, colon = -1;
+    for (let i = 0; i < line.length; i++) {
+        const c = line[i];
+        if (c === '"')
+            inQuote = !inQuote;
+        else if (c === ":" && !inQuote) {
+            colon = i;
+            break;
+        }
+    }
+    if (colon < 0)
+        return null;
+    const namePart = line.slice(0, colon);
+    const value = line.slice(colon + 1);
+    const bits = namePart.split(";");
+    const key = (bits.shift() || "").toUpperCase();
+    const params = {};
+    for (const b of bits) {
+        const eq = b.indexOf("=");
+        if (eq < 0)
+            continue;
+        params[b.slice(0, eq).toUpperCase()] = b.slice(eq + 1).replace(/^"|"$/g, "");
+    }
+    return { key, params, value };
+}
+/** ICS timestamp → ISO 8601. Handles 20260823T080000 (local/zoned),
+ *  20260823T133939Z (UTC) and 20260823 (all-day). Zoned values keep their
+ *  wall-clock reading; the caller pairs them with `tzid`. */
+function icsDateToIso(v, isUtc) {
+    const m = (v || "").match(/^(\d{4})(\d{2})(\d{2})(?:T(\d{2})(\d{2})(\d{2})(Z)?)?$/);
+    if (!m)
+        return "";
+    const [, y, mo, d, hh, mm, ss, z] = m;
+    if (!hh)
+        return `${y}-${mo}-${d}`;
+    const base = `${y}-${mo}-${d}T${hh}:${mm}:${ss}`;
+    return (z || isUtc) ? base + "Z" : base;
+}
+function parseCalAddress(value, params) {
+    const email = (value || "").replace(/^mailto:/i, "").trim();
+    return { name: (params.CN || "").trim() || email, email };
+}
+/**
+ * Parse the VEVENT out of a text/calendar part.
+ *
+ * Deliberately hand-rolled rather than pulling in an ICS library: mailx-types
+ * is the zero-dependency package shared with Android, and an invite card needs
+ * a dozen properties, not full RFC 5545 coverage. Returns null when there is
+ * no VEVENT to show.
+ */
+export function parseInvite(ics) {
+    if (!ics || !/BEGIN:VEVENT/i.test(ics))
+        return null;
+    const lines = unfoldIcs(ics);
+    const out = {
+        method: "", uid: "", sequence: 0, summary: "", description: "", location: "",
+        start: "", end: "", tzid: "", allDay: false,
+        organizer: { name: "", email: "" }, attendees: [], rrule: "", status: "",
+        fromGoogle: false,
+    };
+    let inEvent = false;
+    // VTIMEZONE blocks contain their own DTSTART/RRULE — those describe the
+    // zone's DST rules, not the meeting. Ignore everything inside them.
+    let depthNonEvent = 0;
+    for (const line of lines) {
+        const up = line.toUpperCase();
+        if (up.startsWith("BEGIN:VEVENT")) {
+            inEvent = true;
+            continue;
+        }
+        if (up.startsWith("END:VEVENT")) {
+            inEvent = false;
+            continue;
+        }
+        if (!inEvent && (up.startsWith("BEGIN:VTIMEZONE") || up.startsWith("BEGIN:VALARM"))) {
+            depthNonEvent++;
+            continue;
+        }
+        if (up.startsWith("END:VTIMEZONE") || up.startsWith("END:VALARM")) {
+            if (depthNonEvent)
+                depthNonEvent--;
+            continue;
+        }
+        if (inEvent && up.startsWith("BEGIN:VALARM")) {
+            depthNonEvent++;
+            continue;
+        }
+        const p = splitIcsLine(line);
+        if (!p)
+            continue;
+        if (!inEvent) {
+            if (p.key === "METHOD")
+                out.method = p.value.trim().toUpperCase();
+            else if (p.key === "PRODID" && /google/i.test(p.value))
+                out.fromGoogle = true;
+            continue;
+        }
+        if (depthNonEvent)
+            continue; // inside VALARM
+        switch (p.key) {
+            case "SUMMARY":
+                out.summary = unescapeIcs(p.value);
+                break;
+            case "DESCRIPTION":
+                out.description = unescapeIcs(p.value);
+                break;
+            case "LOCATION":
+                out.location = unescapeIcs(p.value);
+                break;
+            case "UID":
+                out.uid = p.value.trim();
+                break;
+            case "STATUS":
+                out.status = p.value.trim().toUpperCase();
+                break;
+            case "RRULE":
+                out.rrule = p.value.trim();
+                break;
+            case "SEQUENCE":
+                out.sequence = parseInt(p.value, 10) || 0;
+                break;
+            case "DTSTART":
+                out.start = icsDateToIso(p.value.trim(), false);
+                out.tzid = p.params.TZID || out.tzid;
+                out.allDay = (p.params.VALUE || "").toUpperCase() === "DATE" || !/T/.test(p.value);
+                break;
+            case "DTEND":
+                out.end = icsDateToIso(p.value.trim(), false);
+                out.tzid = out.tzid || p.params.TZID || "";
+                break;
+            case "ORGANIZER":
+                out.organizer = parseCalAddress(p.value, p.params);
+                break;
+            case "ATTENDEE": {
+                const a = parseCalAddress(p.value, p.params);
+                out.attendees.push({
+                    name: a.name,
+                    email: a.email,
+                    status: (p.params.PARTSTAT || "NEEDS-ACTION").toUpperCase(),
+                    rsvp: (p.params.RSVP || "").toUpperCase() === "TRUE",
+                });
+                break;
+            }
+        }
+    }
+    if (!out.summary && !out.start)
+        return null;
+    return out;
+}
+/**
+ * Does the message body already carry Google's own Yes/No/Maybe controls?
+ *
+ * Google Calendar invitations embed working RSVP links
+ * (`calendar.google.com/calendar/event?action=RESPOND&rst=1|2|3`). When they
+ * are present the UI must show the invite summary but NOT a second set of RSVP
+ * buttons — two responders racing to set PARTSTAT is worse than one
+ * (Bob 2026-08-22: "Google's own responder handles it so you might detect that
+ * case specially").
+ */
+export function inviteHasGoogleRsvp(bodyHtml) {
+    if (!bodyHtml)
+        return false;
+    return /calendar\.google\.com\/calendar\/event\?action=RESPOND/i.test(bodyHtml);
+}
 //# sourceMappingURL=index.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bobfrankston/mailx-types",
-  "version": "0.1.55",
+  "version": "0.1.59",
   "type": "module",
   "main": "index.js",
   "types": "index.d.ts",