@bobfrankston/mailx-types 0.1.96 → 0.1.98

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bobfrankston/mailx-types",
-  "version": "0.1.96",
+  "version": "0.1.98",
   "type": "module",
   "main": "index.js",
   "types": "index.d.ts",

package/trust.d.ts

@@ -39,6 +39,7 @@ export declare const TRUST_LIST_KEYS: {
     readonly domain: "trustedDomains";
     readonly intermediary: "trustedIntermediaries";
     readonly list: "trustedLists";
+    readonly via: "trustedSendersVia";
 };
 export type TrustListType = keyof typeof TRUST_LIST_KEYS;
 /** One piece of evidence that a message is not what it claims to be. */
@@ -63,6 +64,11 @@ export interface TrustFinding {
      *  when the list is not yet in allowlist.jsonc `trustedLists`, so the
      *  viewer can offer "Trust the ‹list› list". (2026-09-09) */
     list?: string;
+    /** "‹from domain› via ‹signer›": the reader trusts this sender, nothing
+     *  proves the From line, but a relay DID sign the message — so the
+     *  viewer can offer to trust the sender when that relay signs for it
+     *  (allowlist.jsonc `trustedSendersVia`). (2026-09-10) */
+    senderVia?: string;
 }
 export interface TrustInput {
     /** Every header line, in order, as mailparser's `headerLines`. Repeated
@@ -113,6 +119,18 @@ export interface TrustInput {
      *  spf=pass for the list's bounce address, or dkim=pass for its domain.
      *  An entry counts only on such a message. See listProof. */
     trustedLists?: string[];
+    /** "‹from domain› via ‹signer domain›" entries from allowlist.jsonc
+     *  `trustedSendersVia`. Bob 2026-09-10, Ground News: From
+     *  groundnews.email, sent through Amazon SES, signed only as
+     *  amazonses.com, no DMARC record — the sender is on his list and can
+     *  never be proved, so the list was ignored (correctly) and nothing could
+     *  be approved. The evidence he does have is the pair: this sender always
+     *  arrives signed by this relay, and a relay like SES lets a customer send
+     *  only From identities it has verified. An entry counts only on a
+     *  message the named relay DKIM-signed, for the named From domain; a
+     *  forger with their own SES account is not groundnews.email's, and one
+     *  without a relay signature matches nothing. See provedSenderVia. */
+    trustedSendersVia?: string[];
 }
 /**
  * Everything findable about this message, worst first.

package/trust.js

@@ -39,6 +39,7 @@ export const TRUST_LIST_KEYS = {
     domain: "trustedDomains",
     intermediary: "trustedIntermediaries",
     list: "trustedLists",
+    via: "trustedSendersVia",
 };
 /** First value of a header, case-insensitive. */
 function header(lines, name) {
@@ -256,6 +257,27 @@ function provedIntermediary(input) {
             return entry;
     return "";
 }
+/** Parse a `trustedSendersVia` entry — "groundnews.email via amazonses.com". */
+function parseSenderVia(entry) {
+    const m = (entry || "").trim().toLowerCase().match(/^(\S+)\s+via\s+(\S+)$/);
+    return m ? { domain: m[1], signer: m[2] } : null;
+}
+/** The `trustedSendersVia` entry this message satisfies, or "": the From
+ *  domain matches the entry's, and the entry's relay is among the domains
+ *  whose signature the receiving server verified. (2026-09-10) */
+function provedSenderVia(input) {
+    const entries = (input.trustedSendersVia || []).map(parseSenderVia).filter(Boolean);
+    if (!entries.length)
+        return "";
+    const fromDomain = (bare(input.fromAddress).split("@")[1] || "").toLowerCase();
+    if (!fromDomain)
+        return "";
+    const signers = dkimSigners(input);
+    for (const e of entries)
+        if (sameOrg(fromDomain, e.domain) && signers.some(s => sameOrg(s, e.signer)))
+            return `${e.domain} via ${e.signer}`;
+    return "";
+}
 /** The mailing list this message came through, and whether the receiving
  *  server proved the list sent it. (2026-09-09)
  *
@@ -484,6 +506,7 @@ function analyzeServerSpam(input) {
         intermediary: provedIntermediary(input),
         signers: dkimSigners(input),
         list,
+        senderVia: provedSenderVia(input),
     };
 }
 /**
@@ -541,7 +564,10 @@ function serverSpamVerdict(input) {
     // A trusted mailing LIST answers it for every post the list provably
     // delivered, whoever wrote it — the From line is the list's word, not
     // the author's, and the reader subscribed to the list (2026-09-09).
-    const trustedAndProved = (input.senderTrusted && a.proved) || !!a.intermediary || a.list.trusted;
+    // A sender trusted "via" a relay that signed this message answers it
+    // too — the pair is the reader's evidence for a sender that never
+    // proves itself (2026-09-10).
+    const trustedAndProved = (input.senderTrusted && a.proved) || !!a.intermediary || a.list.trusted || !!a.senderVia;
     if (trustedAndProved && a.kind !== "forgery" && !a.authFailures.length)
         return null;
     // The party that sent this on the author's behalf, when it signed: the
@@ -604,14 +630,26 @@ function serverSpamVerdict(input) {
             detail: `${numbers}${why}${bayes}`,
         };
     const proof = a.proved ? `${provedNote(a)} ` : "";
-    if (input.senderTrusted && !a.proved)
+    if (input.senderTrusted && !a.proved) {
+        // The one thing that did verify: a relay's signature. Name it and
+        // the action — a trusted sender that can never be proved otherwise
+        // leaves the reader with a banner and no way forward (Bob
+        // 2026-09-10, Ground News via Amazon SES: "another valid site. How
+        // do I approve it?").
+        const fromDomain = (bare(input.fromAddress).split("@")[1] || "").toLowerCase();
+        const relaySigner = a.signers.find(s => !sameOrg(s, fromDomain)) || "";
+        const senderViaNote = relaySigner
+            ? `. ${relaySigner} signed this message on the sender's behalf; "Trust ${fromDomain} via ${relaySigner}" stops this note for mail from ${fromDomain} that ${relaySigner} signs.`
+            : "";
         return {
             id: "server-spam-verdict",
             severity: "caution",
             text: "This claims to be a sender you trust, but nothing proves it is.",
-            detail: `No DMARC pass, no valid signature from the sending domain, and it passed through hosts your server does not trust. ${numbers}${why}${listNote}`,
+            detail: `No DMARC pass, no valid signature from the sending domain, and it passed through hosts your server does not trust. ${numbers}${why}${listNote}${senderViaNote}`,
             ...viaList,
+            ...(relaySigner ? { senderVia: `${fromDomain} via ${relaySigner}` } : {}),
         };
+    }
     return {
         id: "server-spam-verdict",
         severity: "caution",
@@ -982,7 +1020,7 @@ export function spamScoreOf(input) {
         proved: a.proved,
         provedBy: a.provedBy,
         bulkOnly: a.bulkOnly,
-        trusted: ((!!input.senderTrusted && a.proved) || !!a.intermediary || a.list.trusted) && a.kind !== "forgery" && !a.authFailures.length,
+        trusted: ((!!input.senderTrusted && a.proved) || !!a.intermediary || a.list.trusted || !!a.senderVia) && a.kind !== "forgery" && !a.authFailures.length,
         reasons: a.reasons,
         listId: a.list.id,
         listProved: a.list.proved,