@bobfrankston/mailx-types 0.1.84 → 0.1.86

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bobfrankston/mailx-types",
-  "version": "0.1.84",
+  "version": "0.1.86",
   "type": "module",
   "main": "index.js",
   "types": "index.d.ts",

package/trust.js

@@ -432,6 +432,13 @@ function serverSpamVerdict(input) {
     const senderDomain = (bare(header(input.headerLines, "sender")).split("@")[1] || "").toLowerCase();
     const relay = senderDomain ? a.signers.find(s => sameOrg(s, senderDomain)) : "";
     const via = relay && !a.proved ? { via: relay } : {};
+    // Say WHICH party and HOW, in the finding itself (Bob 2026-09-08: "the
+    // banner should tell which and how"). The action's label is quoted so
+    // the reader can match it to the button — and to the allowlist.jsonc
+    // entry it writes, `trustedIntermediaries`.
+    const relayNote = relay && !a.proved
+        ? `. Sent on the author's behalf by ${relay}, which signed it; "Trust ${relay} as an intermediary" stops this note for mail ${relay} signs.`
+        : "";
     const numbers = Number.isFinite(a.score) && Number.isFinite(a.threshold)
         ? `SpamAssassin score ${a.score} of ${a.threshold}`
         : "flagged by SpamAssassin";
@@ -482,7 +489,7 @@ function serverSpamVerdict(input) {
         id: "server-spam-verdict",
         severity: "caution",
         text: "Your mail server classified this as spam before delivering it.",
-        detail: `${proof}${numbers}${why}${bayes}`,
+        detail: `${proof}${numbers}${why}${bayes}${relayNote}`,
         ...via,
     };
 }
@@ -680,11 +687,15 @@ function redirectorLink(input) {
             // only then: a redirector nobody signed for has no party to vouch
             // for, and a list entry could not clear it anyway.
             const signer = signers.find(s => sameOrg(s, url.hostname));
+            // Which party, and how — or why there is no party (Bob 2026-09-08).
+            const how = signer
+                ? ` ${signer} signed this message; "Trust ${signer} as an intermediary" stops this warning for links through ${signer} in mail it signs.`
+                : ` Nobody signed this message for ${url.hostname}, so there is no intermediary to trust; only the sender could vouch for the link.`;
             return {
                 id: "redirector-link",
                 severity: "caution",
                 text: `A link hides where it goes: it passes through ${url.hostname} and ends at ${target.hostname}.`,
-                detail: `${url.hostname} -> ${target.hostname}`,
+                detail: `${url.hostname} -> ${target.hostname}.${how}`,
                 ...(signer ? { via: signer } : {}),
             };
         }