@bobfrankston/mailx-types 0.1.86 → 0.1.88

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bobfrankston/mailx-types",
-  "version": "0.1.86",
+  "version": "0.1.88",
   "type": "module",
   "main": "index.js",
   "types": "index.d.ts",

package/trust.js

@@ -631,6 +631,18 @@ function provedSenderDomain(input) {
  *
  *   1. The redirector and the destination are the same organisation. A site
  *      bouncing through its own hostnames is routing, not hiding.
+ *   4. The link ENDS at the proved sender (2026-09-08). Microsoft 365's
+ *      Message center mail, dmarc=pass header.from=microsoft.com with
+ *      policy reject, links through its click-tracker
+ *      `nam.safelink.emails.azure.net` to `admin.microsoft.com`: two
+ *      organisations by hostname, nobody signed for azure.net, and the
+ *      sender is not the redirector — rules 1 to 3 all miss (Bob: "another
+ *      safe message flagged"). But the reader lands on the site of the party
+ *      that provably sent the mail, which is exactly where a plain link
+ *      would have taken them; the hop hides nothing from the reader. The
+ *      redirector's reputation may be borrowed, but that is the
+ *      redirector's problem, not this reader's — and the sender who chose
+ *      the route is the proved sender, who could have linked openly.
  *   2. The redirector IS the proved sender. Google's account-security notice
  *      (2026-09-02, Bob: "this is valid") links through
  *      `accounts.google.com/AccountChooser?continue=https://myaccount.google.com/…`
@@ -682,6 +694,8 @@ function redirectorLink(input) {
                 continue;
             if (sameOrg(target.hostname, url.hostname))
                 continue; // same site, not laundering
+            if (senderDomain && sameOrg(target.hostname, senderDomain))
+                continue; // ends at the proved sender (rule 4)
             // Name the signer behind this redirector, if there is one, so the
             // viewer can offer "trust google.com as an intermediary" — and
             // only then: a redirector nobody signed for has no party to vouch