@bobfrankston/mailx-types 0.1.65 → 0.1.69

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bobfrankston/mailx-types",
-  "version": "0.1.65",
+  "version": "0.1.69",
   "type": "module",
   "main": "index.js",
   "types": "index.d.ts",

package/trust.d.ts

@@ -93,8 +93,14 @@ export interface SpamScore {
      *  the chip stays visible and says so, rather than going red at a number
      *  and teaching the reader to ignore it. (Claude Code 2026-08-27) */
     kind: "forgery" | "association" | "bulk" | "unclassified";
-    /** The From domain passed DMARC, aligned, at the receiving server. */
+    /** The From line is proved — provedBy says by what. */
     proved: boolean;
+    /** Which evidence: the server's DMARC verdict, a valid signature from the
+     *  author's own domain, or never having crossed an untrusted host. The
+     *  chip's tooltip has to say which one, or it asserts a DMARC pass that
+     *  may not exist (Bob's own mail carries no Authentication-Results at
+     *  all). */
+    provedBy: "dmarc" | "dkim" | "trusted" | "";
     /** Top scoring rules, named — "6.0 URIBL_SBL (Contains an URL's NS IP
      *  listed in the Spamhaus SBL blocklist)". A number alone is unactionable;
      *  this can be judged in a second. */

package/trust.js

@@ -242,6 +242,28 @@ function analyzeServerSpam(input) {
             : present("other") ? "unclassified"
                 : rules.length ? "bulk"
                     : "unclassified";
+    // Two proofs SpamAssassin states in its own rule list, which mail that
+    // never crossed a trust boundary carries INSTEAD of an Authentication-Results
+    // header — Bob's own message to John Levine about spam handling, 2026-08-27,
+    // had neither AR nor DMARC and got a caution banner reading "links and
+    // attachments here should not be opened" on prose he had just written:
+    //
+    //   ALL_TRUSTED    Passed through trusted hosts only via SMTP
+    //   DKIM_VALID_AU  Message has a valid DKIM or DK signature from author's domain
+    //
+    // DKIM_VALID_AU is the same evidence DMARC alignment rests on — the author
+    // domain signed it and the signature verified — so it proves the From line on
+    // its own. ALL_TRUSTED says the message reached the mailbox without passing
+    // through a host the server distrusts, which is Bob's own authenticated
+    // submission; nothing could have injected it in transit. (What flagged his
+    // message was URIBL_DBL_SPAM 8.0 on blueorchestra.org — the domain he was
+    // quoting IN a discussion about spam. Guilt by association at its purest.)
+    const has = (name) => rules.some(r => r.name === name);
+    const provedBy = dmarc.pass ? "dmarc"
+        : has("DKIM_VALID_AU") ? "dkim"
+            : has("ALL_TRUSTED") ? "trusted"
+                : "";
+    const fromDomain = (bare(input.fromAddress).split("@")[1] || "").toLowerCase();
     const reasons = rules
         .filter(r => r.cls !== "neutral" && scored(r))
         .sort((a, b) => (b.score || 0) - (a.score || 0))
@@ -252,7 +274,8 @@ function analyzeServerSpam(input) {
     });
     return {
         score, threshold, flagged, rules, kind,
-        proved: dmarc.pass, provedDomain: dmarc.domain, provedPolicy: dmarc.policy,
+        proved: !!provedBy, provedBy,
+        provedDomain: dmarc.domain || fromDomain, provedPolicy: dmarc.policy,
         bayesHam: rules.some(r => r.name === "BAYES_00" || r.name === "BAYES_01"),
         authFailures: dmarc.authFailures,
         reasons,
@@ -282,6 +305,20 @@ function analyzeServerSpam(input) {
  *                                      cannot classify, which is never a
  *                                      reason to go quiet.
  */
+/** How the From line was proved, in the reader's terms — named so it can be
+ *  checked against the headers rather than believed. */
+function provedNote(a) {
+    switch (a.provedBy) {
+        case "dmarc":
+            return `DMARC pass, aligned${a.provedPolicy ? `, policy ${a.provedPolicy}` : ""}.`;
+        case "dkim":
+            return `Valid signature from ${a.provedDomain}, the sending domain itself (DKIM_VALID_AU).`;
+        case "trusted":
+            return "It passed through trusted hosts only (ALL_TRUSTED) — nothing untrusted handled it.";
+        default:
+            return "";
+    }
+}
 function serverSpamVerdict(input) {
     const a = analyzeServerSpam(input);
     if (!a || !a.flagged)
@@ -304,8 +341,10 @@ function serverSpamVerdict(input) {
         return {
             id: "server-spam-verdict",
             severity: "info",
-            text: `Your mail server scored this as spam, but ${a.provedDomain} proved it sent this.`,
-            detail: `DMARC pass, aligned${a.provedPolicy ? `, policy ${a.provedPolicy}` : ""}. ${numbers}${why}${bayes}`,
+            text: a.provedBy === "trusted"
+                ? "Your mail server scored this as spam, but it reached you without leaving your own systems."
+                : `Your mail server scored this as spam, but ${a.provedDomain} proved it sent this.`,
+            detail: `${provedNote(a)} ${numbers}${why}${bayes}`,
         };
     if (a.kind === "bulk")
         return {
@@ -314,7 +353,7 @@ function serverSpamVerdict(input) {
             text: "Your mail server rates this bulk mail — nothing that scored tests who sent it.",
             detail: `${numbers}${why}${bayes}`,
         };
-    const proof = a.proved ? `${a.provedDomain} passed DMARC, so the From line is genuine. ` : "";
+    const proof = a.proved ? `${provedNote(a)} ` : "";
     return {
         id: "server-spam-verdict",
         severity: "caution",
@@ -587,6 +626,7 @@ export function spamScoreOf(input) {
         flagged: a.flagged,
         kind: a.kind,
         proved: a.proved,
+        provedBy: a.provedBy,
         reasons: a.reasons,
     };
 }