@bobfrankston/mailx-types 0.1.78 → 0.1.82

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bobfrankston/mailx-types",
-  "version": "0.1.78",
+  "version": "0.1.82",
   "type": "module",
   "main": "index.js",
   "types": "index.d.ts",

package/trust.d.ts

@@ -109,6 +109,10 @@ export interface SpamScore {
      *  may not exist (Bob's own mail carries no Authentication-Results at
      *  all). */
     provedBy: "dmarc" | "dkim" | "trusted" | "";
+    /** Every rule that scored is a bulk-mail or blocklist test. The chip's
+     *  tooltip may say so ONLY when this is true — it is a claim about all of
+     *  the rules, and the reader can read them underneath it. */
+    bulkOnly: boolean;
     /** Top scoring rules, named — "6.0 URIBL_SBL (Contains an URL's NS IP
      *  listed in the Spamhaus SBL blocklist)". A number alone is unactionable;
      *  this can be judged in a second. */

package/trust.js

@@ -56,6 +56,20 @@ function bare(addr) {
     const m = (addr || "").match(/[^\s<>,;]+@[^\s<>,;]+/);
     return (m ? m[0] : addr || "").toLowerCase().replace(/[.,;]+$/, "");
 }
+/** Do two hostnames belong to the same organisation?
+ *
+ *  Equality or a sub/parent-domain relation, never "the last two labels
+ *  match": that would make paypal.co.uk and evil.co.uk relatives, which is
+ *  the case this whole file exists to catch. A subdomain relationship cannot
+ *  be forged across organisations, so it is safe in the other direction.
+ *  Same test displayNameClaimsOtherAddress uses on addresses. */
+function sameOrg(a, b) {
+    const x = (a || "").toLowerCase();
+    const y = (b || "").toLowerCase();
+    if (!x || !y)
+        return false;
+    return x === y || x.endsWith("." + y) || y.endsWith("." + x);
+}
 /** Rules that say THIS message lies about who sent it. The only class that
  *  earns the red banner. `KAM_DMARC_STATUS` is deliberately absent — it is a
  *  0.0-scoring status marker that fired on Mokin, a message the receiving
@@ -268,6 +282,16 @@ function analyzeServerSpam(input) {
     const unknownCouldFlagAlone = !unknown.length ? false
         : !Number.isFinite(unknownWeight) || !Number.isFinite(threshold) ? true
             : unknownWeight >= threshold;
+    // What the chip may claim about the rule set. "Every rule that scored is a
+    // bulk-mail test" is a statement about ALL of them, so it has to be
+    // checked against all of them — deriving it from `proved` (which says
+    // nothing about the rules) or from `kind` (the worst class, which says
+    // nothing about the rest) asserts something the code never looked at.
+    // The Altis Hotels welcome mail, 2026-09-03 (Bob: "marked as spam but is
+    // valid"): DMARC-proved, so the chip said "scored by bulk-mail or
+    // blocklist rules" — with 3.2 of its 8.3 coming from KAM_ACCOUNTPHISH,
+    // which is neither, listed directly underneath.
+    const bulkOnly = rules.every(r => !scored(r) || r.cls === "bulk" || r.cls === "neutral");
     const kind = (dmarc.authFailures.length || present("forgery")) ? "forgery"
         : present("association") ? "association"
             : unknownCouldFlagAlone ? "unclassified"
@@ -305,7 +329,7 @@ function analyzeServerSpam(input) {
     });
     return {
         score, threshold, flagged, rules, kind,
-        proved: !!provedBy, provedBy,
+        proved: !!provedBy, provedBy, bulkOnly,
         provedDomain: dmarc.domain || fromDomain, provedPolicy: dmarc.policy,
         bayesHam: rules.some(r => r.name === "BAYES_00" || r.name === "BAYES_01"),
         authFailures: dmarc.authFailures,
@@ -387,11 +411,19 @@ function serverSpamVerdict(input) {
                 : `Your mail server scored this as spam, but ${a.provedDomain} proved it sent this.`,
             detail: `${provedNote(a)} ${numbers}${why}${bayes}`,
         };
+    // Same discipline as the chip: "nothing that scored tests who sent it" is
+    // a claim about every rule, so it is made only when every rule was
+    // actually looked at and classified. `kind === "bulk"` does not establish
+    // that — an unclassified rule that could not have flagged the message on
+    // its own leaves the kind at bulk while remaining, by definition, a rule
+    // this file cannot say anything about.
     if (a.kind === "bulk")
         return {
             id: "server-spam-verdict",
             severity: "info",
-            text: "Your mail server rates this bulk mail — nothing that scored tests who sent it.",
+            text: a.bulkOnly
+                ? "Your mail server rates this bulk mail — nothing that scored tests who sent it."
+                : "Your mail server rates this bulk mail.",
             detail: `${numbers}${why}${bayes}`,
         };
     const proof = a.proved ? `${provedNote(a)} ` : "";
@@ -514,6 +546,23 @@ function hiddenLinkOverlay(bodyHtml) {
     }
     return null;
 }
+/** The domain the receiving server proved the From line for — "" when nothing
+ *  did. One place answers "is this sender who they say they are", so the
+ *  banner, the chip and the link checks can never disagree about it.
+ *
+ *  dmarcProof is asked first because it needs no SpamAssassin: an
+ *  Authentication-Results header alone is enough, which is what mail arriving
+ *  through the Gmail API carries. analyzeServerSpam adds the two proofs
+ *  SpamAssassin states in its own rule list instead (DKIM_VALID_AU,
+ *  ALL_TRUSTED) and returns null when the server ran no filter at all. */
+function provedSenderDomain(input) {
+    const fromDomain = (bare(input.fromAddress).split("@")[1] || "").toLowerCase();
+    if (!fromDomain)
+        return "";
+    if (dmarcProof(input).pass)
+        return fromDomain;
+    return analyzeServerSpam(input)?.proved ? fromDomain : "";
+}
 /**
  * Does a link route through a redirector carrying its real destination in the
  * query string?
@@ -523,8 +572,30 @@ function hiddenLinkOverlay(bodyHtml) {
  * whose redirect script was left open, and the destination appears only
  * percent-encoded inside a parameter. Reporting the ENDPOINT is the point — a
  * reader cannot be expected to URL-decode a query string.
+ *
+ * Laundering needs a SECOND PARTY — someone whose reputation is being spent
+ * without their consent. Two ways a link has none, both checked below, and
+ * neither of them a threshold:
+ *
+ *   1. The redirector and the destination are the same organisation. A site
+ *      bouncing through its own hostnames is routing, not hiding.
+ *   2. The redirector IS the proved sender. Google's account-security notice
+ *      (2026-09-02, Bob: "this is valid") links through
+ *      `accounts.google.com/AccountChooser?continue=https://myaccount.google.com/…`
+ *      — two hostnames that are neither equal nor sub/parent of each other,
+ *      so rule 1 alone does not save it. But the receiving server recorded
+ *      `dmarc=pass header.from=accounts.google.com`: the host in the visible
+ *      link belongs to the party that provably sent the mail, spending its
+ *      own reputation. That the sender might itself be malicious is a
+ *      different question than the one this check asks.
+ *
+ * The proof has to come from the topmost Authentication-Results, which the
+ * sender cannot write — otherwise the escape is a switch a forger flips by
+ * typing a domain into From. No proof means the check stays on.
  */
-function redirectorLink(bodyHtml) {
+function redirectorLink(input) {
+    const bodyHtml = input.bodyHtml || "";
+    const senderDomain = provedSenderDomain(input);
     for (const m of bodyHtml.matchAll(/href\s*=\s*["']([^"']+)["']/gi)) {
         let url;
         try {
@@ -535,6 +606,8 @@ function redirectorLink(bodyHtml) {
         }
         if (!/^https?:$/.test(url.protocol))
             continue;
+        if (senderDomain && sameOrg(url.hostname, senderDomain))
+            continue; // the sender's own host
         for (const [, value] of url.searchParams) {
             let target;
             try {
@@ -545,8 +618,8 @@ function redirectorLink(bodyHtml) {
             }
             if (!/^https?:$/.test(target.protocol))
                 continue;
-            if (target.hostname === url.hostname)
-                continue; // same-site, not laundering
+            if (sameOrg(target.hostname, url.hostname))
+                continue; // same site, not laundering
             return {
                 id: "redirector-link",
                 severity: "caution",
@@ -571,7 +644,7 @@ export function assessMessageTrust(input) {
         relayAuthMismatch(input),
         zeroWidthObfuscation(input.bodyText || ""),
         hiddenLinkOverlay(input.bodyHtml || ""),
-        redirectorLink(input.bodyHtml || ""),
+        redirectorLink(input),
     ].filter(Boolean);
     const rank = { danger: 0, caution: 1, info: 2 };
     return findings.sort((a, b) => rank[a.severity] - rank[b.severity]);
@@ -614,11 +687,9 @@ function relayAuthMismatch(input) {
     for (const name of RELAY_IDENTITY_HEADERS) {
         const stamped = bare(header(input.headerLines, name));
         const stampedDomain = stamped.split("@")[1] || "";
-        if (!stampedDomain || stampedDomain === fromDomain)
-            continue;
         // Sub/parent-domain is the same organisation — mail.example.com
         // sending for example.com is ordinary. Cross-organisation is not.
-        if (stampedDomain.endsWith("." + fromDomain) || fromDomain.endsWith("." + stampedDomain))
+        if (!stampedDomain || sameOrg(stampedDomain, fromDomain))
             continue;
         return {
             id: "relay-auth-mismatch",
@@ -675,6 +746,7 @@ export function spamScoreOf(input) {
         kind: a.kind,
         proved: a.proved,
         provedBy: a.provedBy,
+        bulkOnly: a.bulkOnly,
         trusted: !!input.senderTrusted && a.proved && a.kind !== "forgery" && !a.authFailures.length,
         reasons: a.reasons,
     };