@ni-c/imap-mcp 0.2.0 → 0.3.0

package/README.md

@@ -7,6 +7,7 @@
 [![license](https://img.shields.io/npm/l/%40ni-c%2Fimap-mcp)](LICENSE)
 [![container](https://img.shields.io/badge/ghcr.io-ni--c%2Fimap--mcp-blue)](https://github.com/ni-c/imap-mcp/pkgs/container/imap-mcp)
 [![docs](https://img.shields.io/badge/docs-imap--mcp.ni--c.de-informational)](https://imap-mcp.ni-c.de)
+[![HTTP • via mcp-hub](https://img.shields.io/badge/HTTP-via%20mcp--hub-6f42c1)](https://mcp-hub.ni-c.de)
 [![sponsor](https://img.shields.io/badge/sponsor-ni--c-ea4aaa?logo=githubsponsors&logoColor=white)](https://github.com/sponsors/ni-c)
 
 A [Model Context Protocol](https://modelcontextprotocol.io) (MCP) server for any IMAP
@@ -63,6 +64,11 @@ dropped on a best-effort basis (the fencing, not the stripping, is what carries
 markdown image syntax — inline and reference style — is defused so a rendering client cannot be
 made to fetch a tracking URL.
 
+That covers folder names too, and it did not always: a folder name is chosen by whoever created
+the folder, which on a shared mailbox is not necessarily you. `list_mailboxes` returns the name
+twice — `path` exactly as the server spelled it, because that is the handle every other tool
+takes, and `display_name` cleaned up for reading, with a warning on the entry when the two differ.
+
 Alongside the message you get a server-side assessment: the SPF/DKIM/DMARC verdicts with the
 authserv-id they came from, which prompt-injection shapes matched, and which words mix Latin
 with Cyrillic or Greek letters. When something matches, the warning is the first thing in the
@@ -79,9 +85,11 @@ is reported as what it is: a claim, from a header anyone could have written.
 IMAP keyword (`AiSeen` by default), so `list_new_messages` returns each message once. The human
 `\Seen` state is never touched — everything is read with `BODY.PEEK`.
 
-**Deleting asks a person.** Where the client supports MCP elicitation, `delete_messages` and
-deleting a folder raise a real dialog that the model cannot answer on its behalf. Where it does
-not, they fall back to a two-call token — and say so, rather than implying somebody approved.
+**Deleting and moving ask a person.** Where the client supports MCP elicitation, `delete_messages`,
+`move_messages` and deleting a folder raise a real dialog that the model cannot answer on its
+behalf. Where it does not, they fall back to a two-call token — and say so, rather than implying
+somebody approved. `ELICITATION=false` takes that fallback deliberately; it never removes the
+guard. See [Asking a person](https://imap-mcp.ni-c.de/guide/approval).
 
 ## Requirements
 
@@ -91,26 +99,27 @@ not, they fall back to a two-call token — and say so, rather than implying som
 
 ## Configuration
 
-| Variable                    | Required | Default       | Description                                          |
-| --------------------------- | -------- | ------------- | ---------------------------------------------------- |
-| `IMAP_HOST`                 | yes      | —             | Hostname of the IMAP server, e.g. `imap.example.net` |
-| `IMAP_USER`                 | yes      | —             | Account username, usually the address                |
-| `IMAP_PASSWORD`             | yes      | —             | Password or app-specific password                    |
-| `IMAP_PORT`                 | no       | `993` / `143` | Defaults by TLS mode                                 |
-| `IMAP_TLS`                  | no       | `implicit`    | `implicit`, `starttls` or `none`                     |
-| `IMAP_MAILBOX`              | no       | `INBOX`       | Mailbox the message tools default to                 |
-| `IMAP_READ_ONLY`            | no       | **`true`**    | Exactly `false` registers the five mailbox tools     |
-| `IMAP_ALLOW_TOOLS`          | no       | —             | Tool names, `list_*` prefixes or `essential`         |
-| `IMAP_DENY_TOOLS`           | no       | —             | Same syntax; subtracted from the allow list          |
-| `IMAP_SEEN_KEYWORD`         | no       | `AiSeen`      | Keyword for new-mail tracking; empty turns it off    |
-| `IMAP_TRUSTED_AUTHSERV_ID`  | no       | —             | The authserv-id your provider stamps; see below      |
-| `IMAP_DRAFTS_MAILBOX`       | no       | auto          | Overrides the folder found via the `\Drafts` flag    |
-| `IMAP_MAX_MESSAGES`         | no       | `100`         | Default page size                                    |
-| `IMAP_MAX_ATTACHMENT_BYTES` | no       | `1048576`     | Ceiling for returning an attachment inline           |
-| `IMAP_MAX_DOWNLOAD_BYTES`   | no       | `26214400`    | Ceiling for writing one to disk                      |
-| `IMAP_ATTACHMENT_TYPES`     | no       | see below     | Comma-separated content-type allowlist               |
-| `IMAP_DOWNLOAD_DIR`         | no       | —             | Setting it allows saving attachments there           |
-| `IMAP_INSECURE_TLS`         | no       | `false`       | Exactly `true` accepts a self-signed certificate     |
+| Variable                    | Required | Default       | Description                                                  |
+| --------------------------- | -------- | ------------- | ------------------------------------------------------------ |
+| `IMAP_HOST`                 | yes      | —             | Hostname of the IMAP server, e.g. `imap.example.net`         |
+| `IMAP_USER`                 | yes      | —             | Account username, usually the address                        |
+| `IMAP_PASSWORD`             | yes      | —             | Password or app-specific password                            |
+| `IMAP_PORT`                 | no       | `993` / `143` | Defaults by TLS mode                                         |
+| `IMAP_TLS`                  | no       | `implicit`    | `implicit`, `starttls` or `none`                             |
+| `IMAP_MAILBOX`              | no       | `INBOX`       | Mailbox the message tools default to                         |
+| `IMAP_READ_ONLY`            | no       | **`true`**    | Exactly `false` registers the five mailbox tools             |
+| `IMAP_ALLOW_TOOLS`          | no       | —             | Tool names, `list_*` prefixes or `essential`                 |
+| `IMAP_DENY_TOOLS`           | no       | —             | Same syntax; subtracted from the allow list                  |
+| `IMAP_SEEN_KEYWORD`         | no       | `AiSeen`      | Keyword for new-mail tracking; empty turns it off            |
+| `IMAP_TRUSTED_AUTHSERV_ID`  | no       | —             | The authserv-id your provider stamps; see below              |
+| `IMAP_DRAFTS_MAILBOX`       | no       | auto          | Overrides the folder found via the `\Drafts` flag            |
+| `IMAP_MAX_MESSAGES`         | no       | `100`         | Default page size                                            |
+| `IMAP_MAX_ATTACHMENT_BYTES` | no       | `1048576`     | Ceiling for returning an attachment inline                   |
+| `IMAP_MAX_DOWNLOAD_BYTES`   | no       | `26214400`    | Ceiling for writing one to disk                              |
+| `IMAP_ATTACHMENT_TYPES`     | no       | see below     | Comma-separated content-type allowlist                       |
+| `IMAP_DOWNLOAD_DIR`         | no       | —             | Setting it allows saving attachments there                   |
+| `IMAP_INSECURE_TLS`         | no       | `false`       | Exactly `true` accepts a self-signed certificate             |
+| `ELICITATION`               | no       | `true`        | `false` replaces the dialog with the token. **Not prefixed** |
 
 Booleans are compared against the literal string `true`; `1`, `yes` and `True` are not true.
 `IMAP_READ_ONLY` is the mirror image: only the literal `false` turns it off, so a typo leaves
@@ -204,6 +213,41 @@ bind mount has to be owned by it on the host: `-e IMAP_DOWNLOAD_DIR=/data -v
 "$PWD/attachments:/data"` with `chown 1000:1000 attachments`. Without
 `IMAP_DOWNLOAD_DIR` the container never writes anything.
 
+### Through mcp-hub
+
+A client that cannot spawn a local process — ChatGPT connectors, Claude on the web,
+Cursor, LibreChat — reaches imap-mcp through [mcp-hub](https://mcp-hub.ni-c.de): one
+container serves many stdio MCP servers over Streamable HTTP, with an OAuth 2.1 login
+behind a single password and long-lived tokens for the clients that cannot do OAuth. Its
+`/hub` endpoint puts every server behind six meta-tools, so one connector reaches all of
+them without N×tool schemas in the model's context, and it speaks both protocol revisions
+— a question this server asks travels through it to the person at the far end.
+
+Its `/config/mcp.json` uses Claude Code's format, so the entry is the one you already
+have:
+
+```json
+{
+  "mcpServers": {
+    "imap-mcp": {
+      "command": "npx",
+      "args": ["-y", "@ni-c/imap-mcp"],
+      "env": {
+        "IMAP_HOST": "imap.example.net",
+        "IMAP_USER": "me@example.net",
+        "IMAP_PASSWORD": "…",
+        "IMAP_ALLOW_TOOLS": "essential"
+      },
+      "denyTools": ["delete_messages"]
+    }
+  }
+}
+```
+
+`allowTools` and `denyTools` there are the hub's **own** per-server filter, which is not
+the same thing as `*_ALLOW_TOOLS` in `env` — the difference, and the mistake it invites,
+are in the [client guide](https://imap-mcp.ni-c.de/guide/clients#through-mcp-hub).
+
 ## Tools
 
 **Read** — always registered
@@ -219,13 +263,13 @@ bind mount has to be owned by it on the host: `-e IMAP_DOWNLOAD_DIR=/data -v
 
 **Mailbox** — needs `IMAP_READ_ONLY=false`
 
-| Tool                | Confirmation                                           |
-| ------------------- | ------------------------------------------------------ |
-| `set_message_flags` | none — flags are reversible, and `\Deleted` is refused |
-| `move_messages`     | 🔒 for both `move` and `copy`                          |
-| `delete_messages`   | 👤 asks the user, 🔒 where the client cannot           |
-| `manage_mailbox`    | 👤 for `delete`, 🔒 for `rename`, none for `create`    |
-| `save_draft`        | none — a draft does not leave the mailbox              |
+| Tool                | Confirmation                                              |
+| ------------------- | --------------------------------------------------------- |
+| `set_message_flags` | none — flags are reversible, and `\Deleted` is refused    |
+| `move_messages`     | 👤 for both `move` and `copy`, 🔒 where the client cannot |
+| `delete_messages`   | 👤 asks the user, 🔒 where the client cannot              |
+| `manage_mailbox`    | 👤 for `delete`, 🔒 for `rename`, none for `create`       |
+| `save_draft`        | none — a draft does not leave the mailbox                 |
 
 👤 raises a dialog the model cannot answer · 🔒 needs a confirmation token: call once to
 receive one, then again with it.
@@ -240,6 +284,41 @@ it. Use `delete_messages`, which asks.
 Neither a confirmation nor a dialog quotes a mailbox name inside its own sentence — folder
 names come from the account, which on a shared mailbox means a colleague chose them.
 
+### Structured output
+
+Every tool declares an `outputSchema` and answers with `structuredContent`
+alongside the text block, so a client can use the result without parsing prose:
+
+```jsonc
+{
+  "untrusted": true,
+  "source": "imap",
+  "mailbox": "INBOX",
+  "total_matching": 214,
+  "offset": 0,
+  "returned": 25,
+  "next_offset": 25,
+  "messages": [{ "uid": 4711, "subject": "…", "from": "…", "seen": false }],
+}
+```
+
+Every tool that reports anything out of the mailbox carries `untrusted: true`
+and `source: "imap"` as fields — a sender display name, a folder name a
+colleague chose and an attachment filename are all attacker-controllable, and
+they reach the model through the listing tools long before anyone opens a
+message. Only `get_server_info` and the five write tools are without it: those
+report this server's own configuration, or what it just did with the uids it was
+given.
+
+`get_message` and a text attachment keep the per-call nonce fence in the text
+block — the structured half states the same fields, so a client is not made to
+parse the fence to find them. An image attachment keeps its bytes in the content
+block, where a client renders them, rather than repeating the base64.
+
+A refusal is now an **error result**: an attachment the policy rejects, one whose
+bytes are an executable whatever it claimed, one too large to inline. Each was a
+plain result that read like an answer.
+
 Attachments are also available as MCP resources at `imap://message/{uid}/part/{partId}`, which
 matters where the server has no useful filesystem. The resource path runs the same allowlist,
 size limit and magic-byte check as the tool — it is not a second, unguarded door.
@@ -282,6 +361,11 @@ knowing before concluding that a filtered install reaches less of the mailbox th
 `SECURITY.md` has the trust model, what these measures do _not_ cover, and how to report a
 vulnerability.
 
+## Documentation
+
+The full guide, tool reference and security notes live at
+**[imap-mcp.ni-c.de](https://imap-mcp.ni-c.de)** (source in [`docs/`](docs/)).
+
 ## Development
 
 ```bash
@@ -303,6 +387,13 @@ network. For a live server to point the real thing at, see
 The release workflow publishes to npm (Trusted Publishing, with provenance), creates
 the GitHub release from the CHANGELOG section and updates the MCP Registry entry.
 
+## Contributing
+
+Issues, discussions and pull requests are welcome — see
+[CONTRIBUTING.md](CONTRIBUTING.md). For vulnerabilities please use
+[private reporting](https://github.com/ni-c/imap-mcp/security/advisories/new)
+rather than a public issue; the policy is in [SECURITY.md](SECURITY.md).
+
 ## License
 
-MIT © Willi Thiel
+[MIT](LICENSE) © Willi Thiel

package/dist/analyze.d.ts

@@ -28,9 +28,17 @@ export interface SecurityAssessment {
  * Deliberately not `mailparser`'s own `text` fallback: that keeps content the
  * recipient never sees. Anything hidden by inline CSS is a place to park an
  * instruction meant only for the model, so those elements are dropped before
- * the tags are stripped. Best effort, not a guarantee: nested same-name tags
- * end the non-greedy match early, and elements hidden via a stylesheet class
- * are not recognised at all.
+ * the tags are stripped.
+ *
+ * This is one pass over the input. The cursors below only ever move forward,
+ * which is the property that makes the whole function linear no matter what the
+ * sender writes: a start token that is never closed is answered once and then
+ * never looked for again, instead of restarting a bounded scan at every
+ * occurrence. Removal itself stays best effort — nested same-name tags end a
+ * block early, elements hidden via a stylesheet class are not recognised at
+ * all, and anything past the scan budget is left in place. That is acceptable
+ * for the same reason it always was: nothing downstream trusts the stripping,
+ * and the fencing in {@link wrapUntrusted} is what carries the weight.
  */
 export declare function htmlToText(html: string): string;
 /**
@@ -40,6 +48,17 @@ export declare function htmlToText(html: string): string;
  * body, because it is rendered next to one and read with the same eyes.
  */
 export declare function stripInvisible(input: string): string;
+/**
+ * The same characters, written out as escapes instead of removed.
+ *
+ * For the places where a string has to stay recognisable as the exact thing
+ * that was asked for — a confirmation dialog, an audit line. Stripping alone
+ * says "this is not what it looked like" and then shows something that looks
+ * like an ordinary name; this shows which characters were in it, so a person
+ * deciding whether to move mail into `Archive<U+202E>` can see that the folder is
+ * not the `Archive` they know.
+ */
+export declare function escapeInvisible(input: string): string;
 /**
  * Normalises text before it reaches the model: Unicode-folded, stripped of the
  * characters a human reader cannot see, auto-fetch markup defused, and

package/dist/analyze.js

@@ -86,46 +86,211 @@ const INJECTION_PATTERNS = [
     ],
 ];
 /**
- * Cap on the HTML handed to the removal regexes, and on the span a single one
- * of them may swallow. Both exist for the same reason: an unbounded `[\s\S]*?`
- * scanning for a closing tag that never comes is quadratic, and a crafted
- * 2 MB body full of unclosed tags turns that into minutes of CPU. Bounding the
- * scan makes the worst case a nuisance instead of a hang, at the cost that a
- * hidden element larger than the bound is no longer removed — which is why
- * this pass is best effort and the fencing in {@link wrapUntrusted} is what
- * actually carries the weight.
+ * Cap on the HTML this pass looks at, and on the span a single element may
+ * swallow.
+ *
+ * Neither of these is what keeps the pass cheap, and the previous version of
+ * this comment claimed otherwise. Removing an element means scanning forward
+ * for a closing token, and a bound on *that* scan bounds one factor of a
+ * product whose other factor is the number of scans an input can start. A body
+ * of `'<style '` repeated 73 000 times is 512 000 legal bytes that start 73 000
+ * bounded scans and finish none of them: the removal regexes this used to be
+ * built from took 33 seconds on it, on a single-threaded process whose
+ * transport is stdio. The scan below is a single left-to-right walk instead, so
+ * the number of start tokens no longer multiplies anything.
  */
 const MAX_HTML_CHARS = 512_000;
 const MAX_REMOVED_BLOCK_CHARS = 50_000;
 const MAX_HIDDEN_ELEMENT_CHARS = 10_000;
-const HTML_COMMENT = new RegExp(`<!--[\\s\\S]{0,${MAX_REMOVED_BLOCK_CHARS}}?-->`, 'g');
-const NON_CONTENT_ELEMENT = new RegExp(`<(script|style|head|title|noscript|template)\\b[\\s\\S]{0,${MAX_REMOVED_BLOCK_CHARS}}?<\\/\\1>`, 'gi');
-const HIDDEN_ELEMENT = new RegExp(`<([a-z0-9]+)\\b[^>]*style\\s*=\\s*("|')[^"']*(display\\s*:\\s*none|visibility\\s*:\\s*hidden|opacity\\s*:\\s*0|font-size\\s*:\\s*0)[^"']*\\2[^>]*>[\\s\\S]{0,${MAX_HIDDEN_ELEMENT_CHARS}}?<\\/\\1>`, 'gi');
+/**
+ * Total characters the walk may spend looking for closing tags, across the
+ * whole document.
+ *
+ * This is the cap on the product. Each successful removal costs the length of
+ * what it removed, and removals do not overlap, so an honest document never
+ * comes close; only an input that starts removals it never closes can exhaust
+ * it. Once it is gone the remaining elements are stripped as ordinary tags and
+ * their content stays visible — best effort degrading to less effort, never to
+ * a stalled server.
+ */
+const CLOSER_SCAN_BUDGET_FACTOR = 4;
+const CLOSER_SCAN_BUDGET_FLOOR = 100_000;
+/** Elements whose content the recipient never reads. */
+const NON_CONTENT_TAGS = new Set([
+    'script',
+    'style',
+    'head',
+    'title',
+    'noscript',
+    'template',
+]);
+/** Closing tags that end a visual block, and so earn a line break. */
+const BLOCK_TAGS = new Set([
+    'p',
+    'div',
+    'tr',
+    'li',
+    'h1',
+    'h2',
+    'h3',
+    'h4',
+    'h5',
+    'h6',
+]);
+const TAG_NAME = /^<\/?([A-Za-z][A-Za-z0-9]*)/;
+const BR_TAG = /^<br\s*\/?$/i;
+const STYLE_ATTRIBUTE = /style\s*=\s*("|')/gi;
+const HIDDEN_VALUE = /display\s*:\s*none|visibility\s*:\s*hidden|opacity\s*:\s*0|font-size\s*:\s*0/i;
+/**
+ * Whether a start tag carries an inline style that hides it.
+ *
+ * Written as "find the attribute, then look inside its value" rather than as
+ * one pattern spanning both, because the one-pattern form has to guess where
+ * the value ends and backtrack when it guesses wrong. Here each style value is
+ * inspected once and the walk over the tag never turns around.
+ */
+function hasHiddenStyle(tag) {
+    STYLE_ATTRIBUTE.lastIndex = 0;
+    for (let match = STYLE_ATTRIBUTE.exec(tag); match !== null; match = STYLE_ATTRIBUTE.exec(tag)) {
+        const quote = match[1];
+        const start = match.index + match[0].length;
+        const end = tag.indexOf(quote, start);
+        if (end < 0)
+            return false;
+        if (HIDDEN_VALUE.test(tag.slice(start, end)))
+            return true;
+        STYLE_ATTRIBUTE.lastIndex = end;
+    }
+    return false;
+}
 /**
  * Extracts readable text from HTML.
  *
  * Deliberately not `mailparser`'s own `text` fallback: that keeps content the
  * recipient never sees. Anything hidden by inline CSS is a place to park an
  * instruction meant only for the model, so those elements are dropped before
- * the tags are stripped. Best effort, not a guarantee: nested same-name tags
- * end the non-greedy match early, and elements hidden via a stylesheet class
- * are not recognised at all.
+ * the tags are stripped.
+ *
+ * This is one pass over the input. The cursors below only ever move forward,
+ * which is the property that makes the whole function linear no matter what the
+ * sender writes: a start token that is never closed is answered once and then
+ * never looked for again, instead of restarting a bounded scan at every
+ * occurrence. Removal itself stays best effort — nested same-name tags end a
+ * block early, elements hidden via a stylesheet class are not recognised at
+ * all, and anything past the scan budget is left in place. That is acceptable
+ * for the same reason it always was: nothing downstream trusts the stripping,
+ * and the fencing in {@link wrapUntrusted} is what carries the weight.
  */
 export function htmlToText(html) {
-    return html
-        .slice(0, MAX_HTML_CHARS)
-        .replace(HTML_COMMENT, ' ')
-        .replace(NON_CONTENT_ELEMENT, ' ')
-        .replace(HIDDEN_ELEMENT, ' ')
-        .replace(/<br\s*\/?>/gi, '\n')
-        .replace(/<\/(p|div|tr|li|h[1-6])>/gi, '\n')
-        .replace(/<[^>]+>/g, ' ')
+    const source = html.slice(0, MAX_HTML_CHARS);
+    const out = [];
+    // Forward-only cursors. Each call may advance them, never rewind them, so
+    // across the whole document each scans the input at most once — the same
+    // reason a `-->` that does not exist costs one pass rather than one per
+    // `<!--`.
+    let nextGt = source.indexOf('>');
+    let nextCommentEnd = source.indexOf('-->');
+    const gtFrom = (from) => {
+        while (nextGt >= 0 && nextGt < from)
+            nextGt = source.indexOf('>', nextGt + 1);
+        return nextGt;
+    };
+    const commentEndFrom = (from) => {
+        while (nextCommentEnd >= 0 && nextCommentEnd < from) {
+            nextCommentEnd = source.indexOf('-->', nextCommentEnd + 1);
+        }
+        return nextCommentEnd;
+    };
+    let budget = source.length * CLOSER_SCAN_BUDGET_FACTOR + CLOSER_SCAN_BUDGET_FLOOR;
+    /** Where `</name>` starts, or -1 when nothing closes this element in time. */
+    const closingTagFrom = (name, from, window) => {
+        if (budget <= 0)
+            return -1;
+        const stop = Math.min(source.length, from + window);
+        const needle = `</${name}>`;
+        let at = source.indexOf('</', from);
+        while (at >= 0 && at + needle.length <= stop) {
+            if (source.slice(at, at + needle.length).toLowerCase() === needle) {
+                budget -= at - from;
+                return at;
+            }
+            at = source.indexOf('</', at + 2);
+        }
+        // Charged against how far the search actually looked, not against the
+        // window: a document with no `</` at all sends every one of these to the
+        // end of the input, and a budget that only counted the window would let an
+        // attacker buy those scans at a fiftieth of their price.
+        budget -= (at < 0 ? source.length : Math.min(at, stop)) - from;
+        return -1;
+    };
+    let i = 0;
+    while (i < source.length) {
+        const lt = source.indexOf('<', i);
+        if (lt < 0) {
+            out.push(source.slice(i));
+            break;
+        }
+        if (lt > i)
+            out.push(source.slice(i, lt));
+        if (source.startsWith('<!--', lt)) {
+            const end = commentEndFrom(lt + 4);
+            if (end >= 0 && end - lt <= MAX_REMOVED_BLOCK_CHARS) {
+                out.push(' ');
+                i = end + 3;
+            }
+            else {
+                // Nothing closes it anywhere ahead, so it is text that looks like
+                // markup rather than markup. Emitting it keeps the reader honest.
+                out.push('<');
+                i = lt + 1;
+            }
+            continue;
+        }
+        const gt = gtFrom(lt + 1);
+        if (gt < 0) {
+            // No `>` in the rest of the document: everything from here is text.
+            out.push(source.slice(lt));
+            break;
+        }
+        const tag = source.slice(lt, gt);
+        const name = TAG_NAME.exec(tag)?.[1]?.toLowerCase();
+        const closing = tag.startsWith('</');
+        if (name !== undefined && !closing) {
+            const window = NON_CONTENT_TAGS.has(name)
+                ? MAX_REMOVED_BLOCK_CHARS
+                : hasHiddenStyle(tag)
+                    ? MAX_HIDDEN_ELEMENT_CHARS
+                    : 0;
+            if (window > 0) {
+                const end = closingTagFrom(name, gt + 1, window);
+                if (end >= 0) {
+                    out.push(' ');
+                    i = end + name.length + 3;
+                    continue;
+                }
+            }
+        }
+        if (BR_TAG.test(tag)) {
+            out.push('\n');
+        }
+        else if (closing && name !== undefined && BLOCK_TAGS.has(name)) {
+            out.push('\n');
+        }
+        else {
+            out.push(' ');
+        }
+        i = gt + 1;
+    }
+    return (out
+        .join('')
         .replace(/&nbsp;/gi, ' ')
         .replace(/&lt;/gi, '<')
         .replace(/&gt;/gi, '>')
         .replace(/&quot;/gi, '"')
         .replace(/&#39;/g, "'")
-        .replace(/&amp;/gi, '&');
+        // Last, so a decoded `&amp;lt;` does not turn into a `<` the caller never
+        // received.
+        .replace(/&amp;/gi, '&'));
 }
 /**
  * Removes the characters a human reader cannot see but the model can.
@@ -136,6 +301,20 @@ export function htmlToText(html) {
 export function stripInvisible(input) {
     return input.replace(INVISIBLE_CHARS, '').replace(CONTROL_CHARS, '');
 }
+/**
+ * The same characters, written out as escapes instead of removed.
+ *
+ * For the places where a string has to stay recognisable as the exact thing
+ * that was asked for — a confirmation dialog, an audit line. Stripping alone
+ * says "this is not what it looked like" and then shows something that looks
+ * like an ordinary name; this shows which characters were in it, so a person
+ * deciding whether to move mail into `Archive<U+202E>` can see that the folder is
+ * not the `Archive` they know.
+ */
+export function escapeInvisible(input) {
+    const escape = (match) => `\\u${match.codePointAt(0).toString(16).padStart(4, '0')}`;
+    return input.replace(INVISIBLE_CHARS, escape).replace(CONTROL_CHARS, escape);
+}
 /**
  * Normalises text before it reaches the model: Unicode-folded, stripped of the
  * characters a human reader cannot see, auto-fetch markup defused, and

package/dist/analyze.js.map

@@ -1 +1 @@
-{"version":3,"file":"analyze.js","sourceRoot":"","sources":["../src/analyze.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC;AAErC;;;;GAIG;AACH,MAAM,eAAe,GACnB,2EAA2E,CAAC;AAE9E;;;;;;;;;;GAUG;AACH,4CAA4C;AAC5C,MAAM,aAAa,GAAG,wDAAwD,CAAC;AAE/E;;;;;;;;GAQG;AACH,MAAM,kBAAkB,GAA6C;IACnE;QACE,sBAAsB;QACtB,+HAA+H;KAChI;IACD,yEAAyE;IACzE,8EAA8E;IAC9E,4EAA4E;IAC5E;QACE,gBAAgB;QAChB,+DAA+D;KAChE;IACD;QACE,gBAAgB;QAChB,8DAA8D;KAC/D;IACD;QACE,eAAe;QACf,6EAA6E;KAC9E;IACD;QACE,cAAc;QACd,0FAA0F;KAC3F;IACD,2EAA2E;IAC3E,wEAAwE;IACxE;QACE,oBAAoB;QACpB,4NAA4N;KAC7N;IACD;QACE,aAAa;QACb,8DAA8D;KAC/D;IACD;QACE,kBAAkB;QAClB,0FAA0F;KAC3F;IACD;QACE,gBAAgB;QAChB,wFAAwF;KACzF;IACD;QACE,aAAa;QACb,6FAA6F;KAC9F;IACD,CAAC,iBAAiB,EAAE,yCAAyC,CAAC;IAC9D;QACE,cAAc;QACd,6GAA6G;KAC9G;CACF,CAAC;AAqBF;;;;;;;;;GASG;AACH,MAAM,cAAc,GAAG,OAAO,CAAC;AAC/B,MAAM,uBAAuB,GAAG,MAAM,CAAC;AACvC,MAAM,wBAAwB,GAAG,MAAM,CAAC;AAExC,MAAM,YAAY,GAAG,IAAI,MAAM,CAC7B,kBAAkB,uBAAuB,OAAO,EAChD,GAAG,CACJ,CAAC;AACF,MAAM,mBAAmB,GAAG,IAAI,MAAM,CACpC,6DAA6D,uBAAuB,YAAY,EAChG,IAAI,CACL,CAAC;AACF,MAAM,cAAc,GAAG,IAAI,MAAM,CAC/B,gKAAgK,wBAAwB,YAAY,EACpM,IAAI,CACL,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,OAAO,IAAI;SACR,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC;SACxB,OAAO,CAAC,YAAY,EAAE,GAAG,CAAC;SAC1B,OAAO,CAAC,mBAAmB,EAAE,GAAG,CAAC;SACjC,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC;SAC5B,OAAO,CAAC,cAAc,EAAE,IAAI,CAAC;SAC7B,OAAO,CAAC,4BAA4B,EAAE,IAAI,CAAC;SAC3C,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC;SACxB,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC;SACxB,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC;SACtB,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC;SACtB,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC;SACxB,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC;SACtB,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;AAC7B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,OAAO,KAAK,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;AACvE,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,YAAY,CAAC,KAAa,EAAE,QAAQ,GAAG,cAAc;IACnE,MAAM,UAAU,GAAG,eAAe,CAAC,cAAc,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;SACxE,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC;SACvB,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC;SAC1B,IAAI,EAAE,CAAC;IACV,OAAO,UAAU,CAAC,MAAM,GAAG,QAAQ;QACjC,CAAC,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,qBAAqB,QAAQ,cAAc;QAC7E,CAAC,CAAC,UAAU,CAAC;AACjB,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CACvE,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CACjB,CAAC;AACJ,CAAC;AAED,MAAM,KAAK,GAAG,UAAU,CAAC;AACzB,MAAM,QAAQ,GAAG,iBAAiB,CAAC;AACnC,MAAM,KAAK,GAAG,iBAAiB,CAAC;AAChC,MAAM,uBAAuB,GAAG,CAAC,CAAC;AAElC;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACrC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;YAAE,SAAS;QAC9B,MAAM,OAAO,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;QAC5E,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;YAChB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YAC9B,IAAI,KAAK,CAAC,MAAM,IAAI,uBAAuB;gBAAE,MAAM;QACrD,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAA0B,EAC1B,iBAA0B;IAE1B,+DAA+D;IAC/D,MAAM,OAAO,GAAG,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,CAAC,IAAY,EAAU,EAAE;QACpC,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC5C,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,MAAM,IAAI,WAAW,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACnE,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,SAAS,CAAC;IAChD,CAAC,CAAC;IACF,MAAM,UAAU,GAAG,uBAAuB,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACpE,OAAO;QACL,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC;QAChB,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC;QAClB,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC;QACpB,UAAU;QACV,SAAS,EACP,UAAU,KAAK,SAAS;YACxB,iBAAiB,KAAK,SAAS;YAC/B,UAAU,CAAC,WAAW,EAAE,KAAK,iBAAiB,CAAC,WAAW,EAAE;KAC/D,CAAC;AACJ,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,MAAM,CACpB,IAAY,EACZ,UAA8B,EAC9B,iBAA0B;IAE1B,OAAO;QACL,UAAU,EAAE,gBAAgB,CAAC,IAAI,CAAC;QAClC,SAAS,EAAE,eAAe,CAAC,IAAI,CAAC;QAChC,IAAI,EAAE,gBAAgB,CAAC,UAAU,EAAE,iBAAiB,CAAC;KACtD,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,OAAO,CACL,IAAI;SACD,OAAO,CACN,yDAAyD,EACzD,CAAC,MAAM,EAAE,GAAW,EAAE,GAAW,EAAE,EAAE,CACnC,6CAA6C,GAAG,SAAS,GAAG,GAAG,CAClE;QACD,gEAAgE;QAChE,mEAAmE;QACnE,qEAAqE;QACrE,8DAA8D;SAC7D,OAAO,CACN,+CAA+C,EAC/C,CAAC,MAAM,EAAE,GAAW,EAAE,GAAW,EAAE,EAAE,CACnC,6CAA6C,GAAG,UAAU,GAAG,IAAI,CACpE;QACD,0EAA0E;QAC1E,8DAA8D;SAC7D,OAAO,CACN,sBAAsB,EACtB,CAAC,MAAM,EAAE,GAAW,EAAE,EAAE,CACtB,6CAA6C,GAAG,IAAI,CACvD,CACJ,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,IAAI;SAChB,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,IAAI,KAAK,IAAI,EAAE,CAAC;SACjC,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,OAAO;IACL,yEAAyE;IACzE,4EAA4E;IAC5E,0BAA0B;IAC1B,wEAAwE;QACxE,kDAAkD,IAAI,qBAAqB;QAC3E,2EAA2E;QAC3E,0EAA0E;QAC1E,iDAAiD;QACjD,wCAAwC,KAAK,WAAW;QACxD,GAAG,MAAM,IAAI;QACb,sCAAsC,KAAK,WAAW;QACtD,4EAA4E;QAC5E,2EAA2E;QAC3E,uEAAuE;QACvE,4EAA4E;QAC5E,qBAAqB,CACtB,CAAC;AACJ,CAAC"}
+{"version":3,"file":"analyze.js","sourceRoot":"","sources":["../src/analyze.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC;AAErC;;;;GAIG;AACH,MAAM,eAAe,GACnB,2EAA2E,CAAC;AAE9E;;;;;;;;;;GAUG;AACH,4CAA4C;AAC5C,MAAM,aAAa,GAAG,wDAAwD,CAAC;AAE/E;;;;;;;;GAQG;AACH,MAAM,kBAAkB,GAA6C;IACnE;QACE,sBAAsB;QACtB,+HAA+H;KAChI;IACD,yEAAyE;IACzE,8EAA8E;IAC9E,4EAA4E;IAC5E;QACE,gBAAgB;QAChB,+DAA+D;KAChE;IACD;QACE,gBAAgB;QAChB,8DAA8D;KAC/D;IACD;QACE,eAAe;QACf,6EAA6E;KAC9E;IACD;QACE,cAAc;QACd,0FAA0F;KAC3F;IACD,2EAA2E;IAC3E,wEAAwE;IACxE;QACE,oBAAoB;QACpB,4NAA4N;KAC7N;IACD;QACE,aAAa;QACb,8DAA8D;KAC/D;IACD;QACE,kBAAkB;QAClB,0FAA0F;KAC3F;IACD;QACE,gBAAgB;QAChB,wFAAwF;KACzF;IACD;QACE,aAAa;QACb,6FAA6F;KAC9F;IACD,CAAC,iBAAiB,EAAE,yCAAyC,CAAC;IAC9D;QACE,cAAc;QACd,6GAA6G;KAC9G;CACF,CAAC;AAqBF;;;;;;;;;;;;;GAaG;AACH,MAAM,cAAc,GAAG,OAAO,CAAC;AAC/B,MAAM,uBAAuB,GAAG,MAAM,CAAC;AACvC,MAAM,wBAAwB,GAAG,MAAM,CAAC;AAExC;;;;;;;;;;GAUG;AACH,MAAM,yBAAyB,GAAG,CAAC,CAAC;AACpC,MAAM,wBAAwB,GAAG,OAAO,CAAC;AAEzC,wDAAwD;AACxD,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IAC/B,QAAQ;IACR,OAAO;IACP,MAAM;IACN,OAAO;IACP,UAAU;IACV,UAAU;CACX,CAAC,CAAC;AAEH,sEAAsE;AACtE,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC;IACzB,GAAG;IACH,KAAK;IACL,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,IAAI;CACL,CAAC,CAAC;AAEH,MAAM,QAAQ,GAAG,6BAA6B,CAAC;AAC/C,MAAM,MAAM,GAAG,cAAc,CAAC;AAC9B,MAAM,eAAe,GAAG,qBAAqB,CAAC;AAC9C,MAAM,YAAY,GAChB,+EAA+E,CAAC;AAElF;;;;;;;GAOG;AACH,SAAS,cAAc,CAAC,GAAW;IACjC,eAAe,CAAC,SAAS,GAAG,CAAC,CAAC;IAC9B,KACE,IAAI,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,EACrC,KAAK,KAAK,IAAI,EACd,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,EACjC,CAAC;QACD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAW,CAAC;QACjC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QAC5C,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACtC,IAAI,GAAG,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAC1B,IAAI,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1D,eAAe,CAAC,SAAS,GAAG,GAAG,CAAC;IAClC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAa,EAAE,CAAC;IAEzB,0EAA0E;IAC1E,yEAAyE;IACzE,wEAAwE;IACxE,UAAU;IACV,IAAI,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,cAAc,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,CAAC,IAAY,EAAU,EAAE;QACtC,OAAO,MAAM,IAAI,CAAC,IAAI,MAAM,GAAG,IAAI;YACjC,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,CAAC,CAAC,CAAC;QAC3C,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;IACF,MAAM,cAAc,GAAG,CAAC,IAAY,EAAU,EAAE;QAC9C,OAAO,cAAc,IAAI,CAAC,IAAI,cAAc,GAAG,IAAI,EAAE,CAAC;YACpD,cAAc,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,cAAc,GAAG,CAAC,CAAC,CAAC;QAC7D,CAAC;QACD,OAAO,cAAc,CAAC;IACxB,CAAC,CAAC;IAEF,IAAI,MAAM,GACR,MAAM,CAAC,MAAM,GAAG,yBAAyB,GAAG,wBAAwB,CAAC;IACvE,8EAA8E;IAC9E,MAAM,cAAc,GAAG,CACrB,IAAY,EACZ,IAAY,EACZ,MAAc,EACN,EAAE;QACV,IAAI,MAAM,IAAI,CAAC;YAAE,OAAO,CAAC,CAAC,CAAC;QAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,GAAG,MAAM,CAAC,CAAC;QACpD,MAAM,MAAM,GAAG,KAAK,IAAI,GAAG,CAAC;QAC5B,IAAI,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACpC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,MAAM,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;YAC7C,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM,EAAE,CAAC;gBAClE,MAAM,IAAI,EAAE,GAAG,IAAI,CAAC;gBACpB,OAAO,EAAE,CAAC;YACZ,CAAC;YACD,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;QACpC,CAAC;QACD,sEAAsE;QACtE,yEAAyE;QACzE,2EAA2E;QAC3E,yDAAyD;QACzD,MAAM,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;QAC/D,OAAO,CAAC,CAAC,CAAC;IACZ,CAAC,CAAC;IAEF,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;QACzB,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAClC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;YACX,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1B,MAAM;QACR,CAAC;QACD,IAAI,EAAE,GAAG,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QAE1C,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC;YAClC,MAAM,GAAG,GAAG,cAAc,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;YACnC,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,GAAG,EAAE,IAAI,uBAAuB,EAAE,CAAC;gBACpD,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACd,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC;YACd,CAAC;iBAAM,CAAC;gBACN,kEAAkE;gBAClE,kEAAkE;gBAClE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACd,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACb,CAAC;YACD,SAAS;QACX,CAAC;QAED,MAAM,EAAE,GAAG,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QAC1B,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;YACX,oEAAoE;YACpE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;YAC3B,MAAM;QACR,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACjC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;QACpD,MAAM,OAAO,GAAG,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAErC,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,OAAO,EAAE,CAAC;YACnC,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC;gBACvC,CAAC,CAAC,uBAAuB;gBACzB,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC;oBACnB,CAAC,CAAC,wBAAwB;oBAC1B,CAAC,CAAC,CAAC,CAAC;YACR,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;gBACf,MAAM,GAAG,GAAG,cAAc,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;gBACjD,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;oBACb,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBACd,CAAC,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;oBAC1B,SAAS;gBACX,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,CAAC;aAAM,IAAI,OAAO,IAAI,IAAI,KAAK,SAAS,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACjE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChB,CAAC;QACD,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACb,CAAC;IAED,OAAO,CACL,GAAG;SACA,IAAI,CAAC,EAAE,CAAC;SACR,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC;SACxB,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC;SACtB,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC;SACtB,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC;SACxB,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC;QACvB,0EAA0E;QAC1E,YAAY;SACX,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAC3B,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,OAAO,KAAK,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;AACvE,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,MAAM,MAAM,GAAG,CAAC,KAAa,EAAU,EAAE,CACvC,MAAO,KAAK,CAAC,WAAW,CAAC,CAAC,CAAY,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;IACzE,OAAO,KAAK,CAAC,OAAO,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;AAC/E,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,YAAY,CAAC,KAAa,EAAE,QAAQ,GAAG,cAAc;IACnE,MAAM,UAAU,GAAG,eAAe,CAAC,cAAc,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;SACxE,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC;SACvB,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC;SAC1B,IAAI,EAAE,CAAC;IACV,OAAO,UAAU,CAAC,MAAM,GAAG,QAAQ;QACjC,CAAC,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,qBAAqB,QAAQ,cAAc;QAC7E,CAAC,CAAC,UAAU,CAAC;AACjB,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CACvE,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CACjB,CAAC;AACJ,CAAC;AAED,MAAM,KAAK,GAAG,UAAU,CAAC;AACzB,MAAM,QAAQ,GAAG,iBAAiB,CAAC;AACnC,MAAM,KAAK,GAAG,iBAAiB,CAAC;AAChC,MAAM,uBAAuB,GAAG,CAAC,CAAC;AAElC;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACrC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;YAAE,SAAS;QAC9B,MAAM,OAAO,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;QAC5E,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;YAChB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YAC9B,IAAI,KAAK,CAAC,MAAM,IAAI,uBAAuB;gBAAE,MAAM;QACrD,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAA0B,EAC1B,iBAA0B;IAE1B,+DAA+D;IAC/D,MAAM,OAAO,GAAG,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,CAAC,IAAY,EAAU,EAAE;QACpC,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC5C,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,MAAM,IAAI,WAAW,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACnE,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,SAAS,CAAC;IAChD,CAAC,CAAC;IACF,MAAM,UAAU,GAAG,uBAAuB,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACpE,OAAO;QACL,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC;QAChB,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC;QAClB,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC;QACpB,UAAU;QACV,SAAS,EACP,UAAU,KAAK,SAAS;YACxB,iBAAiB,KAAK,SAAS;YAC/B,UAAU,CAAC,WAAW,EAAE,KAAK,iBAAiB,CAAC,WAAW,EAAE;KAC/D,CAAC;AACJ,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,MAAM,CACpB,IAAY,EACZ,UAA8B,EAC9B,iBAA0B;IAE1B,OAAO;QACL,UAAU,EAAE,gBAAgB,CAAC,IAAI,CAAC;QAClC,SAAS,EAAE,eAAe,CAAC,IAAI,CAAC;QAChC,IAAI,EAAE,gBAAgB,CAAC,UAAU,EAAE,iBAAiB,CAAC;KACtD,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,OAAO,CACL,IAAI;SACD,OAAO,CACN,yDAAyD,EACzD,CAAC,MAAM,EAAE,GAAW,EAAE,GAAW,EAAE,EAAE,CACnC,6CAA6C,GAAG,SAAS,GAAG,GAAG,CAClE;QACD,gEAAgE;QAChE,mEAAmE;QACnE,qEAAqE;QACrE,8DAA8D;SAC7D,OAAO,CACN,+CAA+C,EAC/C,CAAC,MAAM,EAAE,GAAW,EAAE,GAAW,EAAE,EAAE,CACnC,6CAA6C,GAAG,UAAU,GAAG,IAAI,CACpE;QACD,0EAA0E;QAC1E,8DAA8D;SAC7D,OAAO,CACN,sBAAsB,EACtB,CAAC,MAAM,EAAE,GAAW,EAAE,EAAE,CACtB,6CAA6C,GAAG,IAAI,CACvD,CACJ,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,IAAI;SAChB,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,IAAI,KAAK,IAAI,EAAE,CAAC;SACjC,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,OAAO;IACL,yEAAyE;IACzE,4EAA4E;IAC5E,0BAA0B;IAC1B,wEAAwE;QACxE,kDAAkD,IAAI,qBAAqB;QAC3E,2EAA2E;QAC3E,0EAA0E;QAC1E,iDAAiD;QACjD,wCAAwC,KAAK,WAAW;QACxD,GAAG,MAAM,IAAI;QACb,sCAAsC,KAAK,WAAW;QACtD,4EAA4E;QAC5E,2EAA2E;QAC3E,uEAAuE;QACvE,4EAA4E;QAC5E,qBAAqB,CACtB,CAAC;AACJ,CAAC"}

package/dist/attachments.d.ts

@@ -1,4 +1,15 @@
 import type { MessageStructureObject } from 'imapflow';
+/**
+ * Extensions that are executable somewhere. The list is long on purpose: this
+ * is a refusal list applied on top of the content-type allowlist, and the cost
+ * of an extra entry is one unusual attachment that has to be fetched by other
+ * means.
+ *
+ * Exported so a test can walk it. An entry {@link extensionOf} cannot produce
+ * is not a stricter list, it is a longer one that refuses less — and nothing
+ * about reading the two declarations side by side says which is which.
+ */
+export declare const EXECUTABLE_EXTENSIONS: Set<string>;
 export interface AttachmentCandidate {
     partId: string;
     filename: string;
@@ -23,6 +34,20 @@ export interface AttachmentPolicy {
  * separators is trying to be read as something it is not.
  */
 export declare function sanitizeFilename(raw: string | undefined): string;
+/**
+ * The trailing extension of a filename, lowercased, or `''`.
+ *
+ * The character class and the length have to cover every entry of
+ * {@link EXECUTABLE_EXTENSIONS}, or the blocklist has entries that can never be
+ * read out of a name. Both used to be too narrow: `appref-ms` carries a hyphen
+ * and `application` is eleven characters, so both returned `''` — and an empty
+ * extension makes {@link checkPolicy} skip the executable check entirely rather
+ * than fail it. `Rechnung-2026.appref-ms` declared as `application/xml` (which
+ * is in the default type allowlist, and which a ClickOnce manifest genuinely
+ * is) therefore reached the download directory under its own name with no note
+ * against it. The property test over the whole set is what keeps the two in
+ * step from here on.
+ */
 export declare function extensionOf(filename: string): string;
 /**
  * Walks the MIME tree and returns every part that is an attachment.

package/dist/attachments.js

@@ -9,8 +9,12 @@ const MAX_FILENAME_LENGTH = 120;
  * is a refusal list applied on top of the content-type allowlist, and the cost
  * of an extra entry is one unusual attachment that has to be fetched by other
  * means.
+ *
+ * Exported so a test can walk it. An entry {@link extensionOf} cannot produce
+ * is not a stricter list, it is a longer one that refuses less — and nothing
+ * about reading the two declarations side by side says which is which.
  */
-const EXECUTABLE_EXTENSIONS = new Set([
+export const EXECUTABLE_EXTENSIONS = new Set([
     'ade',
     'adp',
     'app',
@@ -133,8 +137,22 @@ export function sanitizeFilename(raw) {
         ? `${cleaned.slice(0, MAX_FILENAME_LENGTH)}…`
         : cleaned;
 }
+/**
+ * The trailing extension of a filename, lowercased, or `''`.
+ *
+ * The character class and the length have to cover every entry of
+ * {@link EXECUTABLE_EXTENSIONS}, or the blocklist has entries that can never be
+ * read out of a name. Both used to be too narrow: `appref-ms` carries a hyphen
+ * and `application` is eleven characters, so both returned `''` — and an empty
+ * extension makes {@link checkPolicy} skip the executable check entirely rather
+ * than fail it. `Rechnung-2026.appref-ms` declared as `application/xml` (which
+ * is in the default type allowlist, and which a ClickOnce manifest genuinely
+ * is) therefore reached the download directory under its own name with no note
+ * against it. The property test over the whole set is what keeps the two in
+ * step from here on.
+ */
 export function extensionOf(filename) {
-    const match = /\.([A-Za-z0-9]{1,10})$/.exec(filename);
+    const match = /\.([A-Za-z0-9-]{1,16})$/.exec(filename);
     return match?.[1]?.toLowerCase() ?? '';
 }
 /**