@bobfrankston/rmfmail 1.0.680 → 1.0.686

package/packages/mailx-settings/docs/prod.md

@@ -0,0 +1,224 @@
+# prod / dev release workflow
+
+Status: design. Two viable approaches; pick one. Both deliver the same shape:
+
+- `rebuild.cmd` publishes builds without affecting what casual users get.
+- A separate `prod.cmd` step promotes a known-good build to be what casual users install.
+- Casual users keep typing `npm install -g @bobfrankston/rmfmail` (no flags).
+- Dev users explicitly opt in.
+
+## Key invariant (answers the obvious confusion)
+
+`@latest` is **what casual `npm install` gets**. It only moves when prod.cmd promotes. So between promotions:
+
+```
+@latest = @prod = 1.0.609   ← last promoted, what users get
+@dev    = 1.0.620           ← every rebuild bumps this
+```
+
+Casual users keep installing 1.0.609 until you say so. Dev tip never accidentally becomes the casual install.
+
+---
+
+## Approach A — npm dist-tags (one package)
+
+### Mechanics
+
+npm's built-in [dist-tag](https://docs.npmjs.com/cli/v10/commands/npm-dist-tag) feature: one package, multiple movable pointers.
+
+- `npm publish --tag dev` sets `@dev` to the new version. `@latest` untouched.
+- `npm dist-tag add @bobfrankston/rmfmail@<v> prod` moves the `prod` pointer; `npm dist-tag add ... latest` moves `latest` too. Two HTTP calls, no republish.
+
+### Required changes
+
+**1. npmglobalize** — accepts a `--dist-tag` flag and forwards to `npm publish`. ~5 lines. See `docs/npmglobalize-disttag.md` for the patch.
+
+**2. rebuild.cmd** — invoke `npmglobalize --dist-tag dev`. One-line edit.
+
+**3. prod.cmd** — new file. Explicit arg wins; otherwise query npm for the
+current `@dev` and promote that. (`@dev` is the right default because you've
+just published it via `rebuild.cmd` and want it to become user-facing.)
+
+```cmd
+@echo off
+setlocal
+set V=%1
+if "%V%"=="" (
+  for /f "delims=" %%v in ('npm view @bobfrankston/rmfmail dist-tags.dev') do set V=%%v
+)
+if "%V%"=="" (
+  echo No version supplied and 'npm view ... dist-tags.dev' returned empty.
+  echo Usage: prod.cmd [version]   e.g. prod.cmd 1.0.611
+  exit /b 1
+)
+echo Promoting @bobfrankston/rmfmail@%V% to prod and latest...
+call npm dist-tag add @bobfrankston/rmfmail@%V% prod
+call npm dist-tag add @bobfrankston/rmfmail@%V% latest
+echo Done.
+endlocal
+```
+
+Roll back to an older known-good: `prod.cmd 1.0.598` — explicit arg path.
+
+The "default = local package.json" alternative (if you never want to query
+the registry):
+
+```cmd
+for /f "tokens=2 delims=:," %%v in ('findstr /b "  \"version\":" "%~dp0app\package.json"') do set V=%%~v
+set V=%V: =%
+set V=%V:"=%
+```
+
+Use whichever default matches your workflow — the explicit-arg path works
+either way.
+
+### Workflow
+
+1. Edit code, run `rebuild.cmd` — version bumps, publishes as `@dev`. `@latest`/`@prod` unaffected.
+2. On the dev machine: `npm install -g @bobfrankston/rmfmail@dev` to grab the freshest build.
+3. When something feels stable: run `prod.cmd`. Promotes the current `package.json` version to `@prod` and `@latest`.
+4. On the prod machine (and any default install): `npm install -g @bobfrankston/rmfmail` (no tag) gets the newly-promoted version.
+
+Roll back: `npm dist-tag add @bobfrankston/rmfmail@<earlier> prod` + `... latest`. No republish, no version bump.
+
+### Effort
+
+- npmglobalize change: ~5 lines, ~5 minutes.
+- `rebuild.cmd`: one-line edit.
+- `prod.cmd`: 15 lines, fresh file.
+- Test cycle: ~10 minutes.
+
+---
+
+## Approach B — wrapper packages
+
+### Mechanics
+
+Split the current single package into three:
+
+| Name | Role | Versioning |
+|---|---|---|
+| `@bobfrankston/rmfmailapp` | Today's actual code. | Bumps freely on every build. |
+| `@bobfrankston/rmfmail` | Wrapper. `dependencies: { rmfmailapp: "1.0.609" }` pinned. | Bumps only on promotion. |
+| `@bobfrankston/rmfmaildev` | Wrapper. `dependencies: { rmfmailapp: "*" }`. | Tracks rmfmailapp tip. |
+
+Casual user: `npm install -g @bobfrankston/rmfmail` — installs the wrapper, which pulls in the pinned rmfmailapp via npm's normal dependency resolution. Wrapper's `bin` shim invokes rmfmailapp's actual entry point, so the CLI is identical.
+
+Promotion = git commit on the wrapper bumping `dependencies.rmfmailapp` from one frozen version to another, plus `npm publish` of the wrapper.
+
+### Layout
+
+```
+mailx/
+  rmfmailapp/                # was app/
+    package.json   "name": "@bobfrankston/rmfmailapp"
+    bin/, packages/, client/  unchanged
+  rmfmail/                   # NEW
+    package.json   pins rmfmailapp version
+    bin/rmfmail.js shim that imports rmfmailapp's entry
+  rmfmaildev/                # NEW
+    package.json   "*" range or always-repinned
+    bin/rmfmaildev.js shim
+```
+
+### `rmfmail/package.json`
+
+```json
+{
+  "name": "@bobfrankston/rmfmail",
+  "version": "1.0.0",
+  "type": "module",
+  "bin": { "rmfmail": "bin/rmfmail.js" },
+  "dependencies": { "@bobfrankston/rmfmailapp": "1.0.609" }
+}
+```
+
+### `rmfmail/bin/rmfmail.js`
+
+```js
+#!/usr/bin/env node
+import { createRequire } from "node:module";
+const require = createRequire(import.meta.url);
+await import(`file://${require.resolve("@bobfrankston/rmfmailapp/bin/mailx.js")}`);
+```
+
+### `rmfmaildev/package.json`
+
+Same shape but `"@bobfrankston/rmfmailapp": "*"` so npm always resolves to the freshest published rmfmailapp.
+
+### Required changes
+
+**1. Rename** `@bobfrankston/rmfmail` → `@bobfrankston/rmfmailapp` in `app/package.json` and any workspace deps that reference it. One-time.
+
+**2. Create** `rmfmail/` and `rmfmaildev/` directories with the package.json + shim listed above. ~30 lines total.
+
+**3. prod.cmd** — bumps the pin and publishes the wrapper:
+
+```cmd
+@echo off
+setlocal
+set TARGET=%1
+if "%TARGET%"=="" (
+  for /f "tokens=2 delims=:," %%v in ('findstr /b "  \"version\":" "%~dp0rmfmailapp\package.json"') do set TARGET=%%~v
+  set TARGET=%TARGET: =%
+  set TARGET=%TARGET:"=%
+)
+node -e "const p=require('./rmfmail/package.json'); p.dependencies['@bobfrankston/rmfmailapp']='%TARGET%'; require('fs').writeFileSync('./rmfmail/package.json', JSON.stringify(p,null,2)+'\n');"
+cd rmfmail
+call npm version patch
+call npm publish --access public
+cd ..
+git add rmfmail/package.json
+git commit -m "rmfmail: pin rmfmailapp@%TARGET%"
+endlocal
+```
+
+**4. npmglobalize**: no changes required.
+
+### Workflow
+
+1. Build, run `rebuild.cmd` — publishes rmfmailapp.
+2. Dev install: `npm install -g @bobfrankston/rmfmaildev`. Pulls latest rmfmailapp through the `*` range.
+3. Promotion: `prod.cmd 1.0.611`. Edits rmfmail's pin, bumps wrapper patch version, publishes wrapper, commits.
+4. Casual install: `npm install -g @bobfrankston/rmfmail` resolves the new wrapper, npm fetches the pinned rmfmailapp, both land under the wrapper.
+
+Roll back: edit rmfmail/package.json to a prior pin, `git revert`, republish wrapper.
+
+### Effort
+
+- One-time rename: ~30 minutes.
+- Wrapper skeletons: ~15 minutes.
+- prod.cmd: ~15 minutes.
+- Test: ~30 minutes.
+- Total: ~1.5 hours up-front, then near-zero per promotion.
+
+---
+
+## Comparison
+
+| | A: dist-tags | B: wrappers |
+|--|--|--|
+| Number of npm packages | 1 | 3 (app + 2 wrappers) |
+| What "promotion" is | `npm dist-tag add` (HTTP call) | git commit + `npm publish` of wrapper |
+| Promotion in git history | no (registry-only) | yes |
+| Roll-back | retag prior version | `git revert` then republish wrapper |
+| npmglobalize change needed | yes (`--tag` flag, ~5 lines) | no |
+| Casual install command | `npm install -g @bobfrankston/rmfmail` | (same) |
+| Dev install command | `... rmfmail@dev` | `... rmfmaildev` |
+| One-time setup work | ~15 minutes | ~1.5 hours |
+| Per-promotion work | seconds (registry call) | minutes (commit + publish) |
+| Multi-channel future (beta, rc) | more dist-tags | more wrappers |
+
+## Recommendation
+
+If you want it working today with minimum disturbance: **A (dist-tags)**.
+
+If auditability of "what version was prod when" matters and you're willing to spend the one-time rename: **B (wrappers)**.
+
+A → B migration later is straightforward (the rename and wrapper creation is the same work whenever you do it; dist-tags become a non-issue once wrappers exist).
+
+## What neither approach does
+
+- Does not enable side-by-side coexistence on a single machine — that's the orthogonal `RMFMAIL_PROFILE` env-var design (separate config dir, AUMID, mailto handler, etc.).
+- Does not change the in-app updater. mailx's existing version-check flow keeps working with either.
+- Does not affect Android. APKs aren't on npm — `prod-android.md` is the parallel document with the equivalent channel-manifest design.

package/packages/mailx-settings/docs/push-relay.md

@@ -0,0 +1,141 @@
+# Push Relay (C127, optional)
+
+Status: design only — not yet built. Relevant when polling latency feels too slow OR when battery / quota matters more than now.
+
+## Problem
+
+mailx polls Google Calendar / Gmail / Outlook for changes. Polling is cheap, simple, and works on every network — the right default. But it has two costs:
+
+1. **Latency floor.** Even at a 5 s syncToken cadence, "the user just rescheduled this on their phone" takes ~5 s to surface in mailx. For most workflows that's invisible; for "alarm fires for an event that was moved an hour ago" it isn't.
+2. **Battery / quota on mobile.** The Android shell polls the same way the desktop does; on a phone that's measurable wakeups.
+
+Push notifications (Google's `events.watch`, Microsoft Graph webhook subscriptions, Gmail's `users.watch`) fix both, but only deliver to a public HTTPS URL. The desktop client doesn't have one. So we need a relay.
+
+## Shape
+
+A standalone Node service in `MailApps/relayer/`, deployed wherever the operator runs other small services (alerter-style: tiny Express app, one config file, one long-running process). One relay process serves multiple users; per-user state is keyed by user-issued tokens.
+
+```
+┌──────────────┐  watch       ┌─────────┐  webhook   ┌───────────┐  WS/SSE   ┌────────┐
+│ Google / MS  │ ──register── │ relayer │ ◀────────  │ relayer   │ ◀────────│ rmfmail│
+│ Calendar API │              │ /sub    │            │ /hook/:id │            │ client │
+└──────────────┘              └─────────┘            └───────────┘            └────────┘
+       ▲                          │                                                ▲
+       │  events.watch(           │  per-subscription state:                       │
+       │    address: relayer/hook │    upstream channel id, expiry, owner-token,   │
+       │    token: per-sub secret │    fan-out endpoints                           │
+       │  )                       │                                                │
+       └──── done by relayer on   │                                                │
+            client request, with  │                                                │
+            client-supplied OAuth │                                                │
+            access token (kept    │                                                │
+            short-lived; client   │                                                │
+            re-presents on        │                                                │
+            renewal)              │                                                │
+                                  ▼
+```
+
+Three roles, separable:
+- **Subscriber API** — clients POST to register what they want watched.
+- **Hook receiver** — public endpoint(s) the upstream services post to.
+- **Fan-out** — per-subscription WS or SSE that holds open client connections and pushes payloads.
+
+## API (relayer side)
+
+Generic relay shape — caller specifies upstream service + the params that service needs to register a watch. The relay knows enough about each supported upstream to issue the watch-registration call and decode the inbound webhook envelope; it doesn't introspect payload content.
+
+```
+POST /subscribe
+  body: {
+    upstream:  "google-calendar" | "google-gmail" | "ms-graph-events" | …
+    params:    { …upstream-specific watch args, e.g. calendarId, accessToken, expiry preference }
+    deliver:   "sse" | "ws"
+  }
+  → 200 {
+    subscriptionId: "<uuid>",
+    deliverUrl:     "/sub/<uuid>",      // open SSE / WS here
+    authToken:      "<random-secret>",  // present on connect
+    expiresAt:      <ms>                // when relay's upstream channel needs renewal
+  }
+
+POST /subscribe/<id>/renew
+  body: { params: { accessToken: "<fresh OAuth>" } }
+  → 200 { expiresAt: <ms> }
+
+DELETE /subscribe/<id>
+  → 204 (also calls upstream stop-watch)
+
+GET /subscribe/<id>/status
+  → 200 { upstream, expiresAt, lastEventAt, queueDepth }
+
+GET /sub/<id>      (SSE) — emits `data: {payload}\n\n` per upstream event
+                   (or WS upgrade) — same payload shape as text frames
+```
+
+Auth: `Authorization: Bearer <authToken>` on every call after `/subscribe`. The token issued at subscribe time scopes the subscription; one client manages one or more subscriptions, each with its own token.
+
+## API (client side)
+
+Two settings the user fills in:
+- `pushRelayUrl` — e.g. `https://mail1.example.com:NNNN`
+- `pushRelayCredentials` — issued by the operator at first contact (one-time, opaque blob; relay verifies)
+
+When `pushRelayUrl` is non-empty, the client at startup:
+1. Reads its previous subscription IDs from local config.
+2. For each, opens the SSE / WS connection.
+3. If the connection refuses with "unknown subscription" (relay restart, expiry), re-subscribes from scratch with the current OAuth token and stores the new id.
+4. Hooks the inbound event stream into the same `mailxapi.onEvent` channel the daemon already uses, so the alarm subsystem / message-list / folder-tree all consume push events the same way they consume the daemon's IDLE / sync events.
+
+The client owns OAuth tokens; the relay receives short-lived access tokens at register / renew time, doesn't store refresh tokens.
+
+## Reliability
+
+- **Replay queue per subscription** — last N events (in-memory ring, e.g. N=100) so a brief disconnect doesn't lose events. Client passes `Last-Event-ID` (SSE) or a sequence cursor (WS) on reconnect.
+- **Channel renewal** — relay tracks each upstream channel's expiry, schedules renewal at 80% of TTL, calls back to the client (via the WS/SSE itself) for a fresh OAuth token if needed.
+- **Fail-open** — if the relay is unreachable, the client's existing syncToken polling continues. Push is "freshness boost," never load-bearing for correctness.
+
+## Generic relay vs per-upstream code
+
+The relay needs per-upstream code for:
+- How to register a watch (the API call shape varies).
+- How to decode the inbound webhook envelope (Google sends headers in `X-Goog-*`, Graph sends a JSON body, etc.).
+- How to renew or stop a watch.
+
+Per-upstream is a small adapter (~50–100 lines each). Adding "Outlook Tasks" or "iCloud Calendar" later is a new file in `relayer/upstreams/`. The fan-out, subscription store, WS/SSE plumbing, replay buffer — all generic, written once.
+
+## Operator footprint
+
+- One Node process, one port, one HTTPS cert (or behind a reverse proxy that handles TLS).
+- Storage: SQLite or JSON for the subscription map (small — one row per active subscription).
+- Logs to a file the operator already tails.
+- No queue infrastructure, no message broker, no DB cluster.
+
+This is the same operational shape as alerter — drop into `MailApps/`, deploy alongside other small services, treat as one more daemon.
+
+## When to build this
+
+Only when polling demonstrably isn't fast enough, OR when mobile battery becomes a real concern (push lets the Android shell wake on event instead of polling on a timer). Polling at 5–10 s syncToken cadence is functionally instant for the "user rescheduled an event" case and quota-cheap. Push is a freshness optimization, not a correctness fix.
+
+## Alternatives considered
+
+- **Cloudflare Workers + Durable Objects** — cleaner per-user-isolation story but requires each user to deploy their own Worker (or one shared operator-run Worker, with a different trust shape). Higher onboarding friction; users without a CF account can't use it. Pro: free tier, edge latency. Con: vendor lock-in, two-click onboarding minimum (account + token).
+- **Cloudflare Tunnel / ngrok to the local daemon** — no relay needed, the daemon exposes its own webhook receiver. Catch: only works while the daemon is running; events while offline are lost (recovered by the next syncToken poll, which already exists). Per-instance tunnel.
+- **Status quo (poll only)** — what mailx does today. Right default; this doc is for when "default isn't enough."
+
+## Files (when built)
+
+```
+MailApps/relayer/
+  package.json
+  tsconfig.json
+  index.ts           — Express server + WS upgrade + SSE
+  upstreams/
+    google-calendar.ts
+    google-gmail.ts
+    ms-graph-events.ts
+  subs.ts            — subscription store (SQLite)
+  fanout.ts          — per-sub connection pool + replay buffer
+  readme.md          — operator doc (deploy + config)
+```
+
+Client side: extend `mailx-service` with a `pushRelayClient.ts` that opens / re-opens / re-subscribes; surface its status in the existing sync-status banner.

package/packages/mailx-settings/docs/rmf-tiny.md

@@ -0,0 +1,156 @@
+# `rmf-tiny` — optional TinyMCE editor adapter for rmfmail
+
+Status: design only. Not implemented.
+
+## Goal
+
+Let users who want Thunderbird-class paste fidelity opt into TinyMCE without baking it into rmfmail itself. Bob 2026-05-09 verified: pasted a Word document into Thunderbird, tiptap, Quill, and TinyMCE — only TinyMCE preserved the formatting (boxed monospace block with borders, paragraph spacing, font preservation). Nothing else came close.
+
+The license catch — TinyMCE is GPLv2 — means rmfmail (MIT) can't bundle it. The arms-length pattern is the resolution: rmfmail ships **no** TinyMCE bytes; a separate `rmf-tiny` package the user installs themselves provides the adapter + pulls in TinyMCE via npm.
+
+## Shape
+
+```
+@bobfrankston/rmfmail            ← MIT, ships no TinyMCE
+  client/compose/editor.ts       ← MailxEditor interface + factory
+                                   gains a "tinymce" branch that
+                                   dynamically imports rmf-tiny
+
+@bobfrankston/rmf-tiny           ← MIT (the adapter glue is original code)
+  package.json                   ← peerDependency: tinymce
+  src/adapter.ts                 ← implements MailxEditor against TinyMCE
+  README.md                      ← install instructions
+```
+
+User opts in:
+
+```
+npm install -g @bobfrankston/rmf-tiny tinymce
+```
+
+(Two packages explicit — keeps the licensing posture clean. rmf-tiny is just the adapter; tinymce comes from Tiny's own npm publication, not bundled with anything rmfmail-related.)
+
+In rmfmail Settings → Compose → Editor: the dropdown grows a "TinyMCE (requires rmf-tiny)" option. If selected and the import fails, surface a status-bar error pointing at the install command.
+
+## Why a separate package, not a flag inside rmfmail
+
+- rmfmail's git history and npm tarball never contain TinyMCE → distribution layer is clean.
+- rmf-tiny is small (~200 lines of adapter glue + a thin install README) and can be MIT — no GPL infection because it imports TinyMCE at runtime via the same kind of dynamic boundary npm packages always use. Combination at user's machine is fully GPL-permitted.
+- Other editors can follow the same pattern (`rmf-ckeditor`, `rmf-prosemirror-pro`) without polluting rmfmail.
+
+## Why call it `rmf-tiny`
+
+Short, distinguishable from the upstream package, namespaces under your scope (`@bobfrankston/rmf-tiny`), and "tiny" is the upstream's own brand so the connection is obvious. Other naming options:
+- `@bobfrankston/mailx-tinymce-adapter` (verbose, descriptive)
+- `@bobfrankston/rmftiny` (no hyphen, matches rmfmail style)
+
+`rmf-tiny` is fine; pick the form that scans cleanest in the install line.
+
+## Files
+
+### `rmf-tiny/package.json`
+
+```json
+{
+  "name": "@bobfrankston/rmf-tiny",
+  "version": "0.1.0",
+  "description": "TinyMCE editor adapter for rmfmail. Bring-your-own TinyMCE.",
+  "type": "module",
+  "main": "src/adapter.js",
+  "license": "MIT",
+  "peerDependencies": {
+    "tinymce": ">=6"
+  },
+  "peerDependenciesMeta": {
+    "tinymce": { "optional": false }
+  }
+}
+```
+
+`peerDependencies` puts the install responsibility on the user — `npm install @bobfrankston/rmf-tiny` warns that `tinymce` must also be installed; rmf-tiny does not vendor or bundle TinyMCE.
+
+### `rmf-tiny/src/adapter.ts`
+
+```ts
+// MIT-licensed adapter glue. Imports the user-installed TinyMCE at
+// runtime; doesn't redistribute any TinyMCE bytes. Implements the same
+// `MailxEditor` interface rmfmail's createEditor factory expects, so
+// the host code path is identical.
+import type { Editor as TinyEditor } from "tinymce";
+
+export interface MailxEditor {
+    setHtml(html: string): void;
+    getHtml(): string;
+    getText(): string;
+    focus(): void;
+    setCursor(pos: number): void;
+    root: HTMLElement;
+    // …other methods rmfmail's interface requires
+}
+
+export async function createTinyMceEditor(container: HTMLElement): Promise<MailxEditor> {
+    // Dynamic import — fails clearly if the user hasn't installed tinymce.
+    const tinymce = (await import("tinymce")).default;
+    // Plus the plugins TinyMCE's paste-from-Word handler needs:
+    await Promise.all([
+        import("tinymce/themes/silver"),
+        import("tinymce/icons/default"),
+        import("tinymce/plugins/paste"),
+        import("tinymce/plugins/lists"),
+        import("tinymce/plugins/link"),
+        import("tinymce/plugins/table"),
+        import("tinymce/plugins/code"),
+    ]);
+    // ... initialize tinymce against `container`, return MailxEditor shim.
+}
+```
+
+The actual init/wire-up is the work — wrapping TinyMCE's API in our `MailxEditor` shape, hooking paste events, setHtml/getHtml round-tripping, etc. Maybe ~200 lines.
+
+### rmfmail-side change to `editor.ts`
+
+```ts
+export async function createEditor(
+    container: HTMLElement,
+    type: "quill" | "tiptap" | "tinymce"
+): Promise<MailxEditor> {
+    if (type === "tinymce") {
+        try {
+            const m = await import("@bobfrankston/rmf-tiny");
+            return m.createTinyMceEditor(container);
+        } catch (e: any) {
+            const status = document.getElementById("status-sync");
+            if (status) status.textContent = `TinyMCE editor not available — install: npm install -g @bobfrankston/rmf-tiny tinymce`;
+            return createQuillEditor(container);  // fall back so compose still works
+        }
+    }
+    if (type === "tiptap") return createTiptapEditor(container);
+    return createQuillEditor(container);
+}
+```
+
+Settings panel adds the "TinyMCE" option in the editor dropdown.
+
+## Effort
+
+- `rmf-tiny` package skeleton (package.json, README, basic adapter shell): ~30 minutes.
+- Adapter wiring (init, setHtml/getHtml, paste handling, toolbar config): ~3 hours including testing the Word-paste case.
+- rmfmail-side factory branch + Settings dropdown option: ~30 minutes.
+- Documentation for users (README in rmf-tiny + Settings tooltip): ~30 minutes.
+
+About half a day total.
+
+## Order
+
+1. Build `rmf-tiny` against your local TinyMCE install. Verify the Word-paste case actually works through your adapter.
+2. Add the factory branch and Settings option to rmfmail.
+3. Publish `rmf-tiny` to npm.
+4. Document the opt-in install command in rmfmail's Settings tooltip and `README.md`.
+
+Don't publish the adapter until the Word-paste case actually works end-to-end through the adapter — TinyMCE direct is one thing, our adapter possibly mangles it differently.
+
+## Caveats
+
+- The adapter must not re-implement parts of TinyMCE — it's a thin wrapper. Re-implementing parts of GPL code in MIT is the legal trap; staying purely in adapter / interface territory is safe.
+- TinyMCE's bundle is large (~1MB minified). Users opting in pay that cost on the first compose-window load. Fine for opt-in; would be unacceptable as a default.
+- `rmf-tiny` major version should track TinyMCE's major version (rmf-tiny@7.x for tinymce@7.x) so peerDependency mismatches are obvious.

package/packages/mailx-settings/index.d.ts

@@ -46,7 +46,7 @@ export declare function getStorageInfo(): {
 /** Fill in provider defaults for an account based on email domain.
  *  Exported so mailx-service's leanAccountsJsonc helper can reuse the same
  *  canonicalization rules that loadAccounts uses. */
-export declare function normalizeAccount(acct: any, globalName?: string): AccountConfig;
+export declare function normalizeAccount(acct: any, globalName?: string, globalSig?: any, globalSignature?: string): AccountConfig;
 declare const DEFAULT_PREFERENCES: {
     ui: {
         theme: "system" | "dark" | "light";
@@ -101,7 +101,7 @@ export declare function loadAccountsAsync(): Promise<AccountConfig[]>;
  *  - Drop `imap.user` / `smtp.user` if they equal the email.
  *  - Drop `sig.html: false` (default; only keep when user enabled HTML sigs).
  *  - Keep field order: id → label → email → primary* → imap → smtp → defaultSend
- *    → relayDomains → deliveredToPrefix → identityDomains → syncContacts → sig.
+ *    → relayDomains → identityDomains → syncContacts → sig.
  *    Curated for readability, not alphabetic. */
 export declare function denormalizeAccount(acct: AccountConfig, globalName?: string): any;
 /** Save account configs */

package/packages/mailx-settings/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAKH,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAC;AAyG5G,QAAA,MAAM,SAAS,QAA4E,CAAC;AAiE5F,qFAAqF;AACrF,KAAK,kBAAkB,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,OAAO,CAAC,EAAE;IAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,KAAK,IAAI,CAAC;AAE/G,wBAAgB,YAAY,CAAC,EAAE,EAAE,kBAAkB,GAAG,MAAM,IAAI,CAM/D;AAOD,wBAAgB,iBAAiB,IAAI,MAAM,GAAG,IAAI,CAA2B;AAU7E,iBAAS,YAAY,IAAI,MAAM,CAgB9B;AAOD,sEAAsE;AACtE,wBAAsB,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAoCxE;AAED;;qCAEqC;AACrC,wBAAsB,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA8BjF;AAyBD,2CAA2C;AAC3C,wBAAgB,WAAW,IAAI,OAAO,CAErC;AAED,4CAA4C;AAC5C,wBAAgB,cAAc,IAAI;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,OAAO,GAAG,KAAK,GAAG,OAAO,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,CA+B3L;AAuID;;qDAEqD;AACrD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,GAAG,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,aAAa,CA4D9E;AAMD,QAAA,MAAM,mBAAmB;;eAEE,QAAQ,GAAG,MAAM,GAAG,OAAO;gBAC3B,OAAO,GAAG,QAAQ;;;;;;;;;;;;;;;;;;;;CAoB5C,CAAC;AAEF,QAAA,MAAM,oBAAoB,EAAE,oBAS3B,CAAC;AAEF,QAAA,MAAM,iBAAiB;aACJ,MAAM,EAAE;aACR,MAAM,EAAE;gBACL,MAAM,EAAE;oBAOJ,MAAM,EAAE;oBACR,MAAM,EAAE;CACjC,CAAC;AAIF,2BAA2B;AAC3B,wBAAgB,YAAY,IAAI,aAAa,EAAE,CA0C9C;AAoCD;;;;0CAI0C;AAC1C,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC,CAqBlE;AAED;;;;;;;;;;;;;;;iDAeiD;AACjD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,aAAa,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,GAAG,CA+ChF;AAED,2BAA2B;AAC3B;;;oEAGoE;AACpE,wBAAsB,YAAY,CAAC,QAAQ,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAyC3E;AAED;;;wEAGwE;AACxE,wBAAgB,QAAQ,IAAI,MAAM,CAWjC;AAED;;4DAE4D;AAC5D,wBAAsB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAoB1D;AAED;;;;;uEAKuE;AACvE,wBAAsB,uBAAuB,IAAI,OAAO,CAAC,IAAI,CAAC,CAmB7D;AAED;;;;;;kCAMkC;AAClC,wBAAsB,wBAAwB,IAAI,OAAO,CAAC,IAAI,CAAC,CAa9D;AAED;;;;;0CAK0C;AAC1C,wBAAsB,4BAA4B,IAAI,OAAO,CAAC,IAAI,CAAC,CAYlE;AAED,wEAAwE;AACxE,wBAAgB,eAAe,IAAI,OAAO,mBAAmB,CAkC5D;AAED,uBAAuB;AACvB,wBAAgB,eAAe,CAAC,KAAK,EAAE,GAAG,GAAG,IAAI,CAEhD;AAED,iCAAiC;AACjC,wBAAgB,gBAAgB,IAAI,oBAAoB,CAGvD;AAED,iCAAiC;AACjC,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,oBAAoB,GAAG,IAAI,CAIrE;AAED,qCAAqC;AACrC,wBAAgB,aAAa,IAAI,OAAO,iBAAiB,CAExD;AAED,4EAA4E;AAC5E,wBAAsB,aAAa,CAAC,IAAI,EAAE,OAAO,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAqBjF;AAcD,6EAA6E;AAC7E,wBAAgB,YAAY,IAAI,aAAa,CA0B5C;AAyBD,wBAAsB,YAAY,CAAC,QAAQ,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAkBzE;AAED,oCAAoC;AACpC,wBAAgB,YAAY,IAAI,MAAM,CAGrC;AAED,qDAAqD;AACrD,wBAAgB,YAAY,IAAI,MAAM,CAErC;AAED,wCAAwC;AACxC,OAAO,EAAE,YAAY,EAAE,CAAC;AAKxB,kDAAkD;AAClD,wBAAgB,eAAe,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAkB5E;AAED;;;mFAGmF;AACnF,wBAAsB,eAAe,CAAC,QAAQ,GAAE,QAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAclF;AAED,QAAA,MAAM,gBAAgB,EAAE,aAMvB,CAAC;AAEF,8FAA8F;AAC9F,wBAAgB,cAAc,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAQzD;AAED,uEAAuE;AACvE,wBAAgB,WAAW,IAAI,OAAO,CAGrC;AAED,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,SAAS,EAAE,CAAC;AAErG;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA0ClE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAKH,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAC;AAyG5G,QAAA,MAAM,SAAS,QAA4E,CAAC;AAiE5F,qFAAqF;AACrF,KAAK,kBAAkB,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,OAAO,CAAC,EAAE;IAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,KAAK,IAAI,CAAC;AAE/G,wBAAgB,YAAY,CAAC,EAAE,EAAE,kBAAkB,GAAG,MAAM,IAAI,CAM/D;AAOD,wBAAgB,iBAAiB,IAAI,MAAM,GAAG,IAAI,CAA2B;AAU7E,iBAAS,YAAY,IAAI,MAAM,CAgB9B;AAOD,sEAAsE;AACtE,wBAAsB,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAoCxE;AAED;;qCAEqC;AACrC,wBAAsB,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA8BjF;AAyBD,2CAA2C;AAC3C,wBAAgB,WAAW,IAAI,OAAO,CAErC;AAED,4CAA4C;AAC5C,wBAAgB,cAAc,IAAI;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,OAAO,GAAG,KAAK,GAAG,OAAO,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,CA+B3L;AAuID;;qDAEqD;AACrD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,GAAG,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,GAAG,EAAE,eAAe,CAAC,EAAE,MAAM,GAAG,aAAa,CA6DzH;AAMD,QAAA,MAAM,mBAAmB;;eAEE,QAAQ,GAAG,MAAM,GAAG,OAAO;gBAC3B,OAAO,GAAG,QAAQ;;;;;;;;;;;;;;;;;;;;CAoB5C,CAAC;AAEF,QAAA,MAAM,oBAAoB,EAAE,oBAS3B,CAAC;AAEF,QAAA,MAAM,iBAAiB;aACJ,MAAM,EAAE;aACR,MAAM,EAAE;gBACL,MAAM,EAAE;oBAOJ,MAAM,EAAE;oBACR,MAAM,EAAE;CACjC,CAAC;AAIF,2BAA2B;AAC3B,wBAAgB,YAAY,IAAI,aAAa,EAAE,CA4C9C;AAoCD;;;;0CAI0C;AAC1C,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC,CAuBlE;AAED;;;;;;;;;;;;;;;iDAeiD;AACjD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,aAAa,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,GAAG,CA8ChF;AAED,2BAA2B;AAC3B;;;oEAGoE;AACpE,wBAAsB,YAAY,CAAC,QAAQ,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAyC3E;AAED;;;wEAGwE;AACxE,wBAAgB,QAAQ,IAAI,MAAM,CAWjC;AAED;;4DAE4D;AAC5D,wBAAsB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAoB1D;AAED;;;;;uEAKuE;AACvE,wBAAsB,uBAAuB,IAAI,OAAO,CAAC,IAAI,CAAC,CAmB7D;AAED;;;;;;kCAMkC;AAClC,wBAAsB,wBAAwB,IAAI,OAAO,CAAC,IAAI,CAAC,CAa9D;AAED;;;;;0CAK0C;AAC1C,wBAAsB,4BAA4B,IAAI,OAAO,CAAC,IAAI,CAAC,CAYlE;AAED,wEAAwE;AACxE,wBAAgB,eAAe,IAAI,OAAO,mBAAmB,CAkC5D;AAED,uBAAuB;AACvB,wBAAgB,eAAe,CAAC,KAAK,EAAE,GAAG,GAAG,IAAI,CAEhD;AAED,iCAAiC;AACjC,wBAAgB,gBAAgB,IAAI,oBAAoB,CAGvD;AAED,iCAAiC;AACjC,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,oBAAoB,GAAG,IAAI,CAIrE;AAED,qCAAqC;AACrC,wBAAgB,aAAa,IAAI,OAAO,iBAAiB,CAExD;AAED,4EAA4E;AAC5E,wBAAsB,aAAa,CAAC,IAAI,EAAE,OAAO,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAqBjF;AAcD,6EAA6E;AAC7E,wBAAgB,YAAY,IAAI,aAAa,CA0B5C;AAyBD,wBAAsB,YAAY,CAAC,QAAQ,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAkBzE;AAED,oCAAoC;AACpC,wBAAgB,YAAY,IAAI,MAAM,CAGrC;AAED,qDAAqD;AACrD,wBAAgB,YAAY,IAAI,MAAM,CAErC;AAED,wCAAwC;AACxC,OAAO,EAAE,YAAY,EAAE,CAAC;AAKxB,kDAAkD;AAClD,wBAAgB,eAAe,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAkB5E;AAED;;;mFAGmF;AACnF,wBAAsB,eAAe,CAAC,QAAQ,GAAE,QAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAclF;AAED,QAAA,MAAM,gBAAgB,EAAE,aAMvB,CAAC;AAEF,8FAA8F;AAC9F,wBAAgB,cAAc,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAQzD;AAED,uEAAuE;AACvE,wBAAgB,WAAW,IAAI,OAAO,CAGrC;AAED,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,SAAS,EAAE,CAAC;AAErG;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA0ClE"}

package/packages/mailx-settings/index.js

@@ -492,7 +492,7 @@ const PROVIDERS = {
 /** Fill in provider defaults for an account based on email domain.
  *  Exported so mailx-service's leanAccountsJsonc helper can reuse the same
  *  canonicalization rules that loadAccounts uses. */
-export function normalizeAccount(acct, globalName) {
+export function normalizeAccount(acct, globalName, globalSig, globalSignature) {
     const email = acct.email || "";
     const localPart = email.split("@")[0]?.toLowerCase() || "";
     const domain = email.split("@")[1]?.toLowerCase() || "";
@@ -535,7 +535,6 @@ export function normalizeAccount(acct, globalName) {
         defaultSend: acct.defaultSend,
         syncContacts: acct.syncContacts ?? (provider?.imap.auth === "oauth2"),
         relayDomains: acct.relayDomains,
-        deliveredToPrefix: acct.deliveredToPrefix,
         identityDomains: acct.identityDomains,
         // `spam` passthrough retired 2026-04-22 — markAsSpamMessages now finds
         // the junk folder via `specialUse === "junk"` on the DB folder record
@@ -546,9 +545,11 @@ export function normalizeAccount(acct, globalName) {
         // `as any` is the minimum-blast-radius way to add the field without
         // blocking the build. Once mailx-types has rebuilt once (post-field)
         // this cast can be removed.
-        ...(acct.signature ? { signature: acct.signature } : {}),
+        ...(acct.signature ? { signature: acct.signature } : (globalSignature ? { signature: globalSignature } : {})),
         ...(acct.sig && typeof acct.sig === "object" && typeof acct.sig.text === "string"
-            ? { sig: { text: acct.sig.text, html: !!acct.sig.html } } : {}),
+            ? { sig: { text: acct.sig.text, html: !!acct.sig.html } }
+            : (globalSig && typeof globalSig === "object" && typeof globalSig.text === "string"
+                ? { sig: { text: globalSig.text, html: !!globalSig.html } } : {})),
     };
 }
 // ── Defaults ──
@@ -637,13 +638,15 @@ export function loadAccounts() {
         }
         const raw = accounts.accounts || accounts;
         const globalName = accounts.name || "";
-        const result = deduplicateAccounts(raw.map((a) => normalizeAccount(a, globalName)));
+        const globalSig = accounts.sig;
+        const globalSignature = accounts.signature;
+        const result = deduplicateAccounts(raw.map((a) => normalizeAccount(a, globalName, globalSig, globalSignature)));
         return applyAccountOverrides(result);
     }
     // Legacy: read from settings.jsonc
     const legacy = loadLegacySettings();
     if (legacy?.accounts)
-        return applyAccountOverrides(legacy.accounts.map((a) => normalizeAccount(a, legacy.name)));
+        return applyAccountOverrides(legacy.accounts.map((a) => normalizeAccount(a, legacy.name, legacy.sig, legacy.signature)));
     return DEFAULT_ACCOUNTS;
 }
 /** Normalize email for dedup — Gmail ignores dots before @ */
@@ -699,8 +702,10 @@ export async function loadAccountsAsync() {
             if (data?.accounts || Array.isArray(data)) {
                 const raw = data.accounts || data;
                 const globalName = data.name || "";
+                const globalSig = data.sig;
+                const globalSignature = data.signature;
                 // cloudRead has already cached content to LOCAL_DIR.
-                return applyAccountOverrides(raw.map((a) => normalizeAccount(a, globalName)));
+                return applyAccountOverrides(raw.map((a) => normalizeAccount(a, globalName, globalSig, globalSignature)));
             }
         }
         // Cloud unreachable / unparseable — fall through to local cache.
@@ -721,7 +726,7 @@ export async function loadAccountsAsync() {
  *  - Drop `imap.user` / `smtp.user` if they equal the email.
  *  - Drop `sig.html: false` (default; only keep when user enabled HTML sigs).
  *  - Keep field order: id → label → email → primary* → imap → smtp → defaultSend
- *    → relayDomains → deliveredToPrefix → identityDomains → syncContacts → sig.
+ *    → relayDomains → identityDomains → syncContacts → sig.
  *    Curated for readability, not alphabetic. */
 export function denormalizeAccount(acct, globalName) {
     const domain = (acct.email || "").split("@")[1]?.toLowerCase() || "";
@@ -779,8 +784,6 @@ export function denormalizeAccount(acct, globalName) {
         out.enabled = false; // default true → omit
     if (acct.relayDomains && acct.relayDomains.length > 0)
         out.relayDomains = acct.relayDomains;
-    if (acct.deliveredToPrefix && acct.deliveredToPrefix.length > 0)
-        out.deliveredToPrefix = acct.deliveredToPrefix;
     if (acct.identityDomains && acct.identityDomains.length > 0)
         out.identityDomains = acct.identityDomains;
     // syncContacts default: true for OAuth, false otherwise. Only emit when