@bobfrankston/mailx-types 0.1.96 → 0.1.100

package/mailx-api.d.ts

@@ -172,6 +172,7 @@ export interface MailxApi {
         color: string;
         primary: boolean;
         accessRole?: string;
+        selected?: boolean;
     }>>;
     createCalendarEvent(ev: any): Promise<{
         uuid: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bobfrankston/mailx-types",
-  "version": "0.1.96",
+  "version": "0.1.100",
   "type": "module",
   "main": "index.js",
   "types": "index.d.ts",

package/trust.d.ts

@@ -39,6 +39,7 @@ export declare const TRUST_LIST_KEYS: {
     readonly domain: "trustedDomains";
     readonly intermediary: "trustedIntermediaries";
     readonly list: "trustedLists";
+    readonly via: "trustedSendersVia";
 };
 export type TrustListType = keyof typeof TRUST_LIST_KEYS;
 /** One piece of evidence that a message is not what it claims to be. */
@@ -63,6 +64,15 @@ export interface TrustFinding {
      *  when the list is not yet in allowlist.jsonc `trustedLists`, so the
      *  viewer can offer "Trust the ‹list› list". (2026-09-09) */
     list?: string;
+    /** "‹from domain› via ‹signer›": the reader trusts this sender, nothing
+     *  proves the From line, but a relay DID sign the message — so the
+     *  viewer can offer to trust the sender when that relay signs for it
+     *  (allowlist.jsonc `trustedSendersVia`). (2026-09-10) */
+    senderVia?: string;
+    /** The proved sender domain whose trust would clear this finding — set
+     *  on a redirector warning when the sender is proved but not yet on the
+     *  reader's list, so the viewer can offer "Stop warning about". (2026-09-11) */
+    sender?: string;
 }
 export interface TrustInput {
     /** Every header line, in order, as mailparser's `headerLines`. Repeated
@@ -113,6 +123,18 @@ export interface TrustInput {
      *  spf=pass for the list's bounce address, or dkim=pass for its domain.
      *  An entry counts only on such a message. See listProof. */
     trustedLists?: string[];
+    /** "‹from domain› via ‹signer domain›" entries from allowlist.jsonc
+     *  `trustedSendersVia`. Bob 2026-09-10, Ground News: From
+     *  groundnews.email, sent through Amazon SES, signed only as
+     *  amazonses.com, no DMARC record — the sender is on his list and can
+     *  never be proved, so the list was ignored (correctly) and nothing could
+     *  be approved. The evidence he does have is the pair: this sender always
+     *  arrives signed by this relay, and a relay like SES lets a customer send
+     *  only From identities it has verified. An entry counts only on a
+     *  message the named relay DKIM-signed, for the named From domain; a
+     *  forger with their own SES account is not groundnews.email's, and one
+     *  without a relay signature matches nothing. See provedSenderVia. */
+    trustedSendersVia?: string[];
 }
 /**
  * Everything findable about this message, worst first.

package/trust.js

@@ -39,6 +39,7 @@ export const TRUST_LIST_KEYS = {
     domain: "trustedDomains",
     intermediary: "trustedIntermediaries",
     list: "trustedLists",
+    via: "trustedSendersVia",
 };
 /** First value of a header, case-insensitive. */
 function header(lines, name) {
@@ -256,6 +257,27 @@ function provedIntermediary(input) {
             return entry;
     return "";
 }
+/** Parse a `trustedSendersVia` entry — "groundnews.email via amazonses.com". */
+function parseSenderVia(entry) {
+    const m = (entry || "").trim().toLowerCase().match(/^(\S+)\s+via\s+(\S+)$/);
+    return m ? { domain: m[1], signer: m[2] } : null;
+}
+/** The `trustedSendersVia` entry this message satisfies, or "": the From
+ *  domain matches the entry's, and the entry's relay is among the domains
+ *  whose signature the receiving server verified. (2026-09-10) */
+function provedSenderVia(input) {
+    const entries = (input.trustedSendersVia || []).map(parseSenderVia).filter(Boolean);
+    if (!entries.length)
+        return "";
+    const fromDomain = (bare(input.fromAddress).split("@")[1] || "").toLowerCase();
+    if (!fromDomain)
+        return "";
+    const signers = dkimSigners(input);
+    for (const e of entries)
+        if (sameOrg(fromDomain, e.domain) && signers.some(s => sameOrg(s, e.signer)))
+            return `${e.domain} via ${e.signer}`;
+    return "";
+}
 /** The mailing list this message came through, and whether the receiving
  *  server proved the list sent it. (2026-09-09)
  *
@@ -484,6 +506,7 @@ function analyzeServerSpam(input) {
         intermediary: provedIntermediary(input),
         signers: dkimSigners(input),
         list,
+        senderVia: provedSenderVia(input),
     };
 }
 /**
@@ -541,7 +564,10 @@ function serverSpamVerdict(input) {
     // A trusted mailing LIST answers it for every post the list provably
     // delivered, whoever wrote it — the From line is the list's word, not
     // the author's, and the reader subscribed to the list (2026-09-09).
-    const trustedAndProved = (input.senderTrusted && a.proved) || !!a.intermediary || a.list.trusted;
+    // A sender trusted "via" a relay that signed this message answers it
+    // too — the pair is the reader's evidence for a sender that never
+    // proves itself (2026-09-10).
+    const trustedAndProved = (input.senderTrusted && a.proved) || !!a.intermediary || a.list.trusted || !!a.senderVia;
     if (trustedAndProved && a.kind !== "forgery" && !a.authFailures.length)
         return null;
     // The party that sent this on the author's behalf, when it signed: the
@@ -604,14 +630,26 @@ function serverSpamVerdict(input) {
             detail: `${numbers}${why}${bayes}`,
         };
     const proof = a.proved ? `${provedNote(a)} ` : "";
-    if (input.senderTrusted && !a.proved)
+    if (input.senderTrusted && !a.proved) {
+        // The one thing that did verify: a relay's signature. Name it and
+        // the action — a trusted sender that can never be proved otherwise
+        // leaves the reader with a banner and no way forward (Bob
+        // 2026-09-10, Ground News via Amazon SES: "another valid site. How
+        // do I approve it?").
+        const fromDomain = (bare(input.fromAddress).split("@")[1] || "").toLowerCase();
+        const relaySigner = a.signers.find(s => !sameOrg(s, fromDomain)) || "";
+        const senderViaNote = relaySigner
+            ? `. ${relaySigner} signed this message on the sender's behalf; "Trust ${fromDomain} via ${relaySigner}" stops this note for mail from ${fromDomain} that ${relaySigner} signs.`
+            : "";
         return {
             id: "server-spam-verdict",
             severity: "caution",
             text: "This claims to be a sender you trust, but nothing proves it is.",
-            detail: `No DMARC pass, no valid signature from the sending domain, and it passed through hosts your server does not trust. ${numbers}${why}${listNote}`,
+            detail: `No DMARC pass, no valid signature from the sending domain, and it passed through hosts your server does not trust. ${numbers}${why}${listNote}${senderViaNote}`,
             ...viaList,
+            ...(relaySigner ? { senderVia: `${fromDomain} via ${relaySigner}` } : {}),
         };
+    }
     return {
         id: "server-spam-verdict",
         severity: "caution",
@@ -809,6 +847,19 @@ function provedSenderDomain(input) {
 function redirectorLink(input) {
     const bodyHtml = input.bodyHtml || "";
     const senderDomain = provedSenderDomain(input);
+    // 5. (2026-09-11) The proved sender is one the reader trusts. The
+    //    finding's own words were "only the sender could vouch for the
+    //    link" — and the reader has vouched for the sender. A Toast receipt
+    //    (dmarc=pass toasttab.com, toasttab.com on Bob's list) links through
+    //    toasttakeout.page.link, Firebase's per-app redirector, to
+    //    toasttakeout.com: two organisations by hostname, nobody signed for
+    //    page.link, the sender is neither — rules 1 to 4 all miss, and
+    //    Bob: "I trust toasttakeout.com. There should be a trust button."
+    //    Trust counts only with proof, as everywhere else: without the
+    //    server's pass the list would be a switch a forger flips by typing a
+    //    trusted domain into From.
+    if (senderDomain && input.senderTrusted)
+        return null;
     // 3. (2026-09-08) The redirector belongs to a reader-listed intermediary
     //    that provably handled the message. Google Calendar wraps every link
     //    in an invitation as google.com/url?q=…, signs the mail d=google.com,
@@ -853,13 +904,16 @@ function redirectorLink(input) {
             // Which party, and how — or why there is no party (Bob 2026-09-08).
             const how = signer
                 ? ` ${signer} signed this message; "Trust ${signer} as an intermediary" stops this warning for links through ${signer} in mail it signs.`
-                : ` Nobody signed this message for ${url.hostname}, so there is no intermediary to trust; only the sender could vouch for the link.`;
+                : senderDomain
+                    ? ` Nobody signed this message for ${url.hostname}, so there is no intermediary to trust; ${senderDomain} proved it sent this, and "Stop warning about *@${senderDomain}" lets it vouch for its own links.`
+                    : ` Nobody signed this message for ${url.hostname}, so there is no intermediary to trust; only the sender could vouch for the link, and nothing proves who the sender is.`;
             return {
                 id: "redirector-link",
                 severity: "caution",
                 text: `A link hides where it goes: it passes through ${url.hostname} and ends at ${target.hostname}.`,
                 detail: `${url.hostname} -> ${target.hostname}.${how}`,
                 ...(signer ? { via: signer } : {}),
+                ...(senderDomain && !signer ? { sender: senderDomain } : {}),
             };
         }
     }
@@ -982,7 +1036,7 @@ export function spamScoreOf(input) {
         proved: a.proved,
         provedBy: a.provedBy,
         bulkOnly: a.bulkOnly,
-        trusted: ((!!input.senderTrusted && a.proved) || !!a.intermediary || a.list.trusted) && a.kind !== "forgery" && !a.authFailures.length,
+        trusted: ((!!input.senderTrusted && a.proved) || !!a.intermediary || a.list.trusted || !!a.senderVia) && a.kind !== "forgery" && !a.authFailures.length,
         reasons: a.reasons,
         listId: a.list.id,
         listProved: a.list.proved,