@novacraft-engineering/mailbox 0.1.0

package/lib/default-signature.ts

@@ -0,0 +1,68 @@
+import { BRAND } from './brand'
+
+/**
+ * The mark with the brand colour in its pixels. A mail client cannot apply a CSS mask,
+ * so this asset must carry its colour in the colour channels rather than the alpha.
+ */
+export const MARK_URL = BRAND.markUrl
+export const MARK_WIDTH = 200
+
+/** What a signature needs to know about the tenant; BRAND on the server, CLIENT_BRAND in the browser. */
+export type SignatureBrand = {
+  name: string
+  legalName: string
+  website: string
+  websiteUrl: string
+  markUrl: string
+  address: string
+  tel: string
+  regulatory: string
+  disclaimer: string
+  colors: { accent: string; link: string; muted: string }
+  signatureMark: { border: string; radius: string }
+}
+
+function escapeHtml(value: string): string {
+  return value.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;')
+}
+
+function markStyle(brand: SignatureBrand, width: number): string {
+  const { border, radius } = brand.signatureMark
+  const colour = border === 'accent' ? brand.colors.accent : border
+  const frame = !colour || colour === 'none' ? 'border:0;' : `padding:8px;border:1px solid ${colour};border-radius:${radius}px;`
+  return `display:block;width:${width}px;height:auto;${frame}`
+}
+
+/** Falls back to the part before the @ when a mailbox has no name on it. */
+export function defaultSignature(name: string | null | undefined, address: string, mobile?: string, brand: SignatureBrand = BRAND): string {
+  const { accent, link, muted } = brand.colors
+  const local = address.split('@')[0] ?? ''
+  const who = escapeHtml((name ?? '').trim() || local.replace(/[._-]+/g, ' '))
+  const email = escapeHtml(address)
+  const phones = [brand.tel ? `Tel: ${escapeHtml(brand.tel)}` : '', mobile ? `Mobile: ${escapeHtml(mobile)}` : ''].filter(Boolean).join(', ')
+  const line2 = [brand.address ? escapeHtml(brand.address) : '', phones].filter(Boolean).join(' | ')
+
+  return [
+    `<p><img src="${escapeHtml(brand.markUrl)}" width="${MARK_WIDTH}" alt="${escapeHtml(brand.name)}" style="${markStyle(brand, MARK_WIDTH)}" /></p>`,
+    `<p><span style="font-size: 10pt; color: ${accent};"><strong>${who} | ${escapeHtml(brand.legalName)}</strong></span></p>`,
+    line2 ? `<p><span style="font-size: 10pt; color: ${accent};">${line2}</span></p>` : '',
+    `<p><span style="font-size: 8pt; color: ${accent};">Email: </span>`,
+    `<a target="_blank" rel="noopener noreferrer nofollow" href="mailto:${email}"><span style="font-size: 8pt; color: ${link};"><u>${email}</u></span></a></p>`,
+    `<p><span style="font-size: 8pt; color: ${accent};">Website: </span>`,
+    `<a target="_blank" rel="noopener noreferrer nofollow" href="${escapeHtml(brand.websiteUrl)}/"><span style="font-size: 8pt; color: ${link};">${escapeHtml(brand.website)}</span></a></p>`,
+    brand.regulatory ? `<p><span style="font-size: 8pt; color: rgb(0, 0, 0);"><strong>${escapeHtml(brand.regulatory)}</strong></span></p>` : '',
+    '<hr>',
+    `<p><span style="font-size: 8pt; color: ${muted};">${escapeHtml(brand.disclaimer)}</span></p>`,
+  ].join('')
+}
+
+/**
+ * Put a person into the signature the firm wrote. The placeholders are the only thing the
+ * editor of that signature has to know about, so they are spelled the way people expect.
+ */
+export function fillSignature(template: string, who: { name: string; email: string; mobile?: string }): string {
+  return template
+    .replace(/\{\{\s*name\s*\}\}/gi, escapeHtml(who.name))
+    .replace(/\{\{\s*email\s*\}\}/gi, escapeHtml(who.email))
+    .replace(/\{\{\s*mobile\s*\}\}/gi, escapeHtml(who.mobile ?? ''))
+}

package/lib/dev-auth.ts

@@ -0,0 +1,222 @@
+import { BRAND } from './brand'
+/**
+ * Shared dev backdoor auth utilities.
+ *
+ * On localhost: everything is allowed (for local development).
+ * On production: requires x-dev-email and x-dev-password headers
+ * whose SHA-256 hashes match DEV_ADMIN_EMAIL_HASH / DEV_ADMIN_PASSWORD_HASH.
+ */
+
+import { createHash } from 'node:crypto'
+import { NextResponse } from 'next/server'
+import { getAccount, getAccountPasswordHash, setAccountPassword, MAIL_SEATS, type MailRole } from '@/lib/mailbox'
+import { hashPassword, verifyPassword, isLegacyHash } from '@/lib/password'
+import { passwordFingerprint, readSession } from '@/lib/session'
+
+/**
+ * The two original accounts. They may sign in with the email-derived default password
+ * (local-part@your-domain). Everyone invited afterwards MUST set a password via their
+ * invite link — no default-password fallback — so a pending invite can't be logged into.
+ */
+export const MAIL_ACCOUNTS = MAIL_SEATS.filter(seat => seat.role === 'admin').map(seat => seat.email)
+
+/**
+ * Where a copy of inbound mail is forwarded. Off unless MAIL_FORWARD_TO is set: forwarding
+ * to an address this app itself receives would loop, and copying a client's mail into a
+ * personal inbox is not a decision a deployment should make quietly.
+ */
+export const FORWARD_RECIPIENTS = (process.env.MAIL_FORWARD_TO ?? '')
+  .split(',')
+  .map(entry => entry.trim().toLowerCase())
+  .filter(Boolean)
+
+function isLegacyDefaultAccount(email: string): boolean {
+  return MAIL_ACCOUNTS.includes(email.trim().toLowerCase())
+}
+
+/** An address is a valid accessor if it exists in mail_accounts. */
+export async function isMailAccount(email: string): Promise<boolean> {
+  const normalized = email.trim().toLowerCase()
+  if (!normalized) return false
+  if (isLegacyDefaultAccount(normalized)) return true
+  return (await getAccount(normalized)) !== null
+}
+
+/** Domain every mailbox address lives on. */
+export const MAIL_DOMAIN = (BRAND.domain).trim().toLowerCase()
+
+export function defaultPasswordFor(email: string): string {
+  const localPart = email.trim().toLowerCase().split('@')[0]
+  return `${localPart}@${MAIL_DOMAIN}`
+}
+
+export function isLocalOrigin(req: Request): boolean {
+  // origin/referer/host are client-supplied; only trust them off a deployed runtime.
+  if (process.env.NODE_ENV === 'production' || process.env.VERCEL) return false
+  const origin = req.headers.get('origin') ?? ''
+  const referer = req.headers.get('referer') ?? ''
+  const host = req.headers.get('host') ?? ''
+  const localHosts = ['localhost', '127.0.0.1', '::1']
+  const check = (s: string) =>
+    localHosts.some((h) => s.startsWith(`http://${h}`) || s.startsWith(`https://${h}`))
+  return check(origin) || check(referer) || localHosts.some((h) => host.startsWith(h))
+}
+
+function sha256(s: string): string {
+  return createHash('sha256').update(s).digest('hex')
+}
+
+export function verifyDevAuth(req: Request): { ok: boolean; error?: string } {
+  // Localhost is always allowed
+  if (isLocalOrigin(req)) return { ok: true }
+
+  const emailHashEnv = process.env.DEV_ADMIN_EMAIL_HASH ?? ''
+  const passwordHashEnv = process.env.DEV_ADMIN_PASSWORD_HASH ?? ''
+
+  // If hashes are not configured, backdoor is disabled on production
+  if (!emailHashEnv || !passwordHashEnv) {
+    return { ok: false, error: 'Backdoor disabled' }
+  }
+
+  const email = req.headers.get('x-dev-email') ?? ''
+  const password = req.headers.get('x-dev-password') ?? ''
+
+  if (!email || !password) {
+    return { ok: false, error: 'Authentication required' }
+  }
+
+  const emailHash = sha256(email)
+  const passwordHash = sha256(password)
+
+  if (emailHash !== emailHashEnv || passwordHash !== passwordHashEnv) {
+    return { ok: false, error: 'Invalid credentials' }
+  }
+
+  return { ok: true }
+}
+
+/** Handy wrapper for route handlers. */
+export function devAuthGuard(req: Request): NextResponse | null {
+  const result = verifyDevAuth(req)
+  if (!result.ok) {
+    return NextResponse.json({ ok: false, error: result.error }, { status: 403 })
+  }
+  return null
+}
+
+/**
+ * Auth for the mail client. Accepts, in order: localhost, the legacy single-admin
+ * env hashes, and the two named mail accounts (custom password from Blob, else the
+ * email-derived default). Async because custom passwords live in the Blob store.
+ */
+export async function verifyMailAuth(
+  email: string,
+  password: string,
+): Promise<{ ok: boolean; email?: string; error?: string }> {
+  const normalized = email.trim().toLowerCase()
+
+  const emailHashEnv = process.env.DEV_ADMIN_EMAIL_HASH ?? ''
+  const passwordHashEnv = process.env.DEV_ADMIN_PASSWORD_HASH ?? ''
+  if (emailHashEnv && passwordHashEnv) {
+    if (sha256(email) === emailHashEnv && sha256(password) === passwordHashEnv) {
+      return { ok: true, email: normalized }
+    }
+  }
+
+  const account = await getAccount(normalized)
+  const legacy = isLegacyDefaultAccount(normalized)
+  if (!account && !legacy) {
+    return { ok: false, error: 'Invalid credentials' }
+  }
+
+  const custom = account?.hasPassword ? await getAccountPasswordHash(normalized) : undefined
+
+  if (custom) {
+    if (await verifyPassword(password, custom)) {
+      // Anyone still on an unsalted digest is upgraded the moment they sign in,
+      // so the weak hashes drain out of the table without a migration.
+      if (isLegacyHash(custom)) {
+        await setAccountPassword(normalized, await hashPassword(password)).catch(() => {})
+      }
+      return { ok: true, email: normalized }
+    }
+    return { ok: false, error: 'Invalid credentials' }
+  }
+
+  // No stored password: only the bootstrap admin gets the address-derived default.
+  // Invited people must set their own via the link they were sent.
+  if (legacy && password === defaultPasswordFor(normalized)) {
+    return { ok: true, email: normalized }
+  }
+  return { ok: false, error: 'Invalid credentials' }
+}
+
+/** The session tag for an address as it stands right now, for minting a fresh cookie. */
+export async function currentFingerprint(email: string): Promise<string> {
+  const normalized = email.trim().toLowerCase()
+  const account = await getAccount(normalized)
+  const stored = account?.hasPassword ? await getAccountPasswordHash(normalized) : undefined
+  return passwordFingerprint(stored)
+}
+
+/**
+ * A session cookie only counts while it still matches the account's current password hash,
+ * so changing or resetting a password signs out every device that was already signed in.
+ */
+async function sessionIdentity(req: Request): Promise<string | null> {
+  const session = readSession(req)
+  if (!session) return null
+
+  const account = await getAccount(session.email)
+  if (!account && !isLegacyDefaultAccount(session.email)) return null
+  if (account && account.status !== 'active') return null
+
+  const stored = account?.hasPassword ? await getAccountPasswordHash(session.email) : undefined
+  if (session.fingerprint !== passwordFingerprint(stored)) return null
+
+  return session.email
+}
+
+/**
+ * The authenticated address for a request: the session cookie first, then the credential
+ * headers. The header path is kept so an already-open tab keeps working across the deploy
+ * that introduced sessions, and for the localhost dev bypass.
+ */
+export async function authenticate(req: Request): Promise<string | null> {
+  const fromSession = await sessionIdentity(req)
+  if (fromSession) return fromSession
+
+  const email = req.headers.get('x-dev-email') ?? ''
+  const password = req.headers.get('x-dev-password') ?? ''
+  if (!email || !password) return null
+
+  const result = await verifyMailAuth(email, password)
+  return result.ok ? (result.email ?? null) : null
+}
+
+/**
+ * Resolve the acting account for owner-scoping. Never falls back to the admin owner on a
+ * deployed runtime: a route that reaches here unauthenticated gets no mailbox rather than
+ * everybody's, so forgetting the guard cannot hand out the shared inbox.
+ */
+export async function resolveAccount(
+  req: Request,
+): Promise<{ email: string; address: string | null; name: string | null; role: MailRole }> {
+  const identity = (await authenticate(req)) ?? ''
+  if (identity) {
+    const account = await getAccount(identity)
+    if (account) return { email: account.email, address: account.address, name: account.name ?? null, role: account.role }
+    return { email: identity, address: null, name: null, role: 'member' }
+  }
+
+  // No session means no identity, on localhost as anywhere else. Standing in for the
+  // admin owner here meant that signing in as one person and losing the session for any
+  // reason silently showed you the shared inbox instead of theirs.
+  return { email: '', address: null, name: null, role: 'member' }
+}
+
+/** Guard for mail routes: a valid session or credential headers, localhost included. */
+export async function mailAuthGuard(req: Request): Promise<NextResponse | null> {
+  if (await authenticate(req)) return null
+  return NextResponse.json({ ok: false, error: 'Authentication required' }, { status: 403 })
+}

package/lib/email-html.test.ts

@@ -0,0 +1,74 @@
+import assert from 'node:assert/strict'
+import { inlineEmailStyles, htmlToPlainText, safeHref, dropUnreachableImages, outlookSafeImages } from './email-html.ts'
+
+// A paragraph with no styling of its own gets the base inline style.
+assert.match(inlineEmailStyles('<p>Hello</p>'), /<p style="font-family:Arial[^"]*">Hello<\/p>/)
+
+// The author's own colour survives, and sits after the base so it wins.
+const coloured = inlineEmailStyles('<p style="color:#ff0000">Red</p>')
+assert.ok(coloured.includes('color:#ff0000'), 'author colour kept')
+assert.ok(coloured.indexOf('font-family') < coloured.indexOf('color:#ff0000'), 'author style wins')
+
+// Tags we do not style are left exactly as they were.
+assert.equal(inlineEmailStyles('<strong>bold</strong>'), '<strong>bold</strong>')
+
+// Lists, links and tables all pick up styles.
+assert.match(inlineEmailStyles('<a href="https://x.test">x</a>'), /style="color:/)
+assert.match(inlineEmailStyles('<td>c</td>'), /border:1px solid/)
+
+// Plain text falls out readable, with list bullets preserved.
+assert.equal(htmlToPlainText('<p>One</p><ul><li>A</li><li>B</li></ul>'), 'One\n\n  • A\n  • B')
+assert.equal(htmlToPlainText('<p>a &amp; b</p>'), 'a & b')
+
+// A bare domain becomes https, an address becomes mailto.
+assert.equal(safeHref('example.com'), 'https://example.com')
+assert.equal(safeHref('  claims@example.com '), 'mailto:claims@example.com')
+
+// Addresses that already carry an allowed scheme are left alone.
+assert.equal(safeHref('https://x.test/a'), 'https://x.test/a')
+assert.equal(safeHref('tel:+2348000000000'), 'tel:+2348000000000')
+
+// Script-bearing schemes are refused outright, in any casing or padding.
+assert.equal(safeHref('javascript:alert(1)'), null)
+assert.equal(safeHref('  JavaScript:alert(1)'), null)
+assert.equal(safeHref('data:text/html;base64,PHN2Zz4='), null)
+assert.equal(safeHref('file:///etc/passwd'), null)
+assert.equal(safeHref('   '), null)
+
+// A path-bearing value with an @ in it is a URL, not an email address.
+assert.equal(safeHref('x.test/u@v'), 'https://x.test/u@v')
+
+console.log('email-html: all assertions passed')
+
+// A signature pasted from Outlook carries a file:// image nobody else can load.
+assert.equal(
+  dropUnreachableImages('<p></p><img src="file:///C:/Users/x/logo.png"><p>Name</p><img src="https://a.b/l.png" alt="">'),
+  '<p></p><p>Name</p><img src="https://a.b/l.png" alt="">',
+)
+assert.equal(dropUnreachableImages('<img src="cid:abc">x<img src="/api/mail/signature-logo?key=signatures/a.png">'), 'x<img src="/api/mail/signature-logo?key=signatures/a.png">')
+
+// A profile's default font reaches every paragraph, but headings keep their own size.
+const based = inlineEmailStyles('<p>Hi</p><h1>Title</h1>', { family: 'Poppins', size: '17px' })
+assert.match(based, /<p style="font-family:'Poppins',Arial,Helvetica,sans-serif;font-size:17px;/)
+assert.match(based, /<h1 style="font-family:'Poppins',Arial,Helvetica,sans-serif;font-size:24px;/)
+
+// A plain left-aligned image is not worth a table, so it is left exactly as it was.
+const plainImage = '<img src="https://x.test/m.png" style="display:block;width:200px;height:auto;border:0;">'
+assert.equal(outlookSafeImages(plainImage), plainImage)
+
+// A framed one becomes a one-cell table, because Word ignores borders on an image.
+const framed = outlookSafeImages('<img src="https://x.test/m.png" style="display:block;width:140px;border:1px solid #a90317;padding:8px;border-radius:8px;">')
+assert.match(framed, /<table[^>]*>/, 'framed image is wrapped in a table')
+assert.ok(!framed.includes('align="left"'), 'and never floated, which would wrap the signature around it')
+assert.match(framed, /<td style="[^"]*border:1px solid #a90317/, 'the border moves to the cell')
+assert.match(framed, /<td style="[^"]*padding:8px/, 'so does the padding')
+assert.match(framed, /<img[^>]+style="display:block;width:140px;height:auto;border:0"/, 'the image itself is left plain')
+
+// Centring needs the table too, and the alignment marker never reaches the recipient.
+const centred = outlookSafeImages('<img src="https://x.test/m.png" data-align="center" style="display:block;width:90px;border:0;">')
+assert.match(centred, /<table[^>]+align="center"/, 'centred image is wrapped')
+assert.ok(!centred.includes('data-align'), 'the editor marker is stripped')
+
+// A linked logo keeps its link, inside the cell rather than around the table.
+const linked = outlookSafeImages('<a href="https://x.test"><img src="https://x.test/m.png" style="display:block;width:100px;border:1px solid #000;"></a>')
+assert.match(linked, /<td[^>]*><a href="https:\/\/x\.test"><img/, 'the anchor sits inside the cell')

package/lib/email-html.ts

@@ -0,0 +1,169 @@
+import { BRAND } from './brand'
+/**
+ * Turn editor HTML into HTML an email client will render.
+ *
+ * Mail is not the web. Outlook renders with Word's engine: it drops <style> blocks, ignores
+ * flexbox and grid, and honours only a narrow set of inline properties — so every rule the
+ * editor expresses through a class or a stylesheet has to be pushed onto the element itself.
+ * Gmail additionally strips anything it does not recognise, which is why the styles below are
+ * deliberately plain.
+ */
+
+const FONT = "font-family:Arial,Helvetica,sans-serif;"
+
+/** Inline styles applied per tag, in the order the tags appear in the document. */
+const STYLES: Record<string, string> = {
+  p: `${FONT}font-size:15px;line-height:1.65;color:#030712;margin:0 0 14px;`,
+  h1: `${FONT}font-size:24px;line-height:1.3;color:#030712;margin:24px 0 12px;font-weight:700;`,
+  h2: `${FONT}font-size:20px;line-height:1.35;color:#030712;margin:22px 0 10px;font-weight:700;`,
+  h3: `${FONT}font-size:17px;line-height:1.4;color:#030712;margin:20px 0 8px;font-weight:700;`,
+  ul: `${FONT}font-size:15px;line-height:1.65;color:#030712;margin:0 0 14px;padding-left:22px;`,
+  ol: `${FONT}font-size:15px;line-height:1.65;color:#030712;margin:0 0 14px;padding-left:22px;`,
+  li: 'margin:0 0 6px;',
+  blockquote:
+    `${FONT}font-size:15px;line-height:1.65;color:#45414f;margin:0 0 14px;padding:2px 0 2px 14px;border-left:3px solid #E8E2F4;`,
+  a: `color:${BRAND.colors.accent};text-decoration:underline;`,
+  code: "font-family:'Courier New',Courier,monospace;font-size:14px;background:#F5F3F8;padding:1px 4px;border-radius:3px;",
+  pre: "font-family:'Courier New',Courier,monospace;font-size:13px;background:#F5F3F8;padding:12px 14px;border-radius:6px;overflow:auto;margin:0 0 14px;",
+  table: 'border-collapse:collapse;margin:0 0 14px;',
+  td: `${FONT}font-size:15px;line-height:1.6;color:#030712;border:1px solid #E4E4EC;padding:7px 10px;`,
+  th: `${FONT}font-size:15px;line-height:1.6;color:#030712;border:1px solid #E4E4EC;padding:7px 10px;background:#F7F7FA;text-align:left;font-weight:700;`,
+  hr: 'border:0;border-top:1px solid #E4E4EC;margin:22px 0;',
+  img: 'max-width:100%;height:auto;display:block;border:0;',
+}
+
+export function inlineEmailStyles(html: string, base?: { family?: string; size?: string }): string {
+  const family = base?.family?.replace(/'/g, '').trim()
+  const size = base?.size?.trim()
+  const styles = Object.fromEntries(
+    Object.entries(STYLES).map(([tag, style]) => {
+      let adjusted = style
+      if (family) adjusted = adjusted.replace('font-family:Arial,Helvetica,sans-serif;', `font-family:'${family}',Arial,Helvetica,sans-serif;`)
+      if (size && !/^h[123]$/.test(tag)) adjusted = adjusted.replace('font-size:15px;', `font-size:${size};`)
+      return [tag, adjusted]
+    }),
+  )
+  const withBase = (tag: string, attrs: string) => {
+    const style = styles[tag]
+    const existing = attrs.match(/\sstyle="([^"]*)"/i)
+    if (!existing) return `${attrs} style="${style}"`
+    return attrs.replace(existing[0], ` style="${style}${existing[1]}"`)
+  }
+  return html.replace(/<([a-z0-9]+)((?:\s[^>]*)?)>/gi, (match, rawTag: string, attrs: string) => {
+    const tag = rawTag.toLowerCase()
+    if (!styles[tag]) return match
+    return `<${rawTag}${withBase(tag, attrs)}>`
+  })
+}
+
+/**
+ * A plain-text fallback. Every message carries one: some clients prefer it, and a message
+ * with no text part is markedly more likely to be filed as spam.
+ */
+export function htmlToPlainText(html: string): string {
+  return html
+    .replace(/<(style|script)[\s\S]*?<\/\1>/gi, '')
+    .replace(/<li[^>]*>/gi, '\n  • ')
+    // Not </li>: the opening tag already broke the line, and closing it too double-spaced
+    // every bullet.
+    .replace(/<\/(p|div|h[1-6]|tr)>/gi, '\n')
+    .replace(/<br\s*\/?>/gi, '\n')
+    .replace(/<[^>]+>/g, '')
+    .replace(/&nbsp;/g, ' ')
+    .replace(/&amp;/g, '&')
+    .replace(/&lt;/g, '<')
+    .replace(/&gt;/g, '>')
+    .replace(/&quot;/g, '"')
+    .replace(/&#39;/g, "'")
+    .replace(/\n{3,}/g, '\n\n')
+    .trim()
+}
+
+const SAFE_SCHEME = /^(https?:|mailto:|tel:)/i
+
+/**
+ * Normalises a user-typed address, or rejects it. The result is embedded in mail that
+ * recipients click, so anything that is not an ordinary web/mail/phone address — most
+ * of all `javascript:` and `data:` — has to come back null rather than be passed on.
+ */
+export function safeHref(raw: string): string | null {
+  const value = raw.trim()
+  if (!value) return null
+  if (SAFE_SCHEME.test(value)) return value
+  if (/^[a-z][a-z0-9+.-]*:/i.test(value)) return null
+  return value.includes('@') && !value.includes('/') ? `mailto:${value}` : `https://${value}`
+}
+
+/**
+ * Removes the `[cid:...]` markers a client leaves in the plain-text alternative where an
+ * embedded image sat. They stand in for a signature logo the text part cannot draw, so
+ * they carry nothing for a reader and appear mid-sentence, usually straight after a
+ * sign-off. The html alternative never contains them.
+ */
+/** Drops <img> tags whose source is not reachable from a recipient's mail client. */
+export function dropUnreachableImages(html: string): string {
+  return html.replace(/<img\b[^>]*>/gi, tag => {
+    const src = /\bsrc\s*=\s*["']([^"']*)["']/i.exec(tag)?.[1]?.trim() ?? ''
+    return /^(https?:\/\/|data:image\/|\/)/i.test(src) ? tag : ''
+  })
+}
+
+export function stripCidPlaceholders(text: string): string {
+  return text
+    .replace(/\[cid:[^\]\n]{0,300}\]/gi, '')
+    // A placeholder on its own line leaves the blank line it sat on behind.
+    .replace(/[ \t]+$/gm, '')
+    .replace(/\n{3,}/g, '\n\n')
+}
+
+function declarations(style: string): Record<string, string> {
+  return Object.fromEntries(
+    style
+      .split(';')
+      .map(part => part.split(':'))
+      .filter(pair => pair.length === 2)
+      .map(([name, value]) => [name.trim().toLowerCase(), value.trim()]),
+  )
+}
+
+function declarationText(pairs: Record<string, string>): string {
+  return Object.entries(pairs)
+    .filter(([, value]) => value)
+    .map(([name, value]) => `${name}:${value}`)
+    .join(';')
+}
+
+const FRAMELESS = ['none', '0', '0px']
+
+/**
+ * Outlook on Windows lays mail out with Word, which ignores padding and borders on an image
+ * and centres nothing. A framed or centred image is therefore emitted as a one-cell table,
+ * which Word does honour, with the image plain inside it. Everything else is left alone.
+ */
+export function outlookSafeImages(html: string): string {
+  return html.replace(/(<a[^>]*>)?\s*(<img[^>]*>)\s*(<\/a>)?/gi, (whole, open: string | undefined, tag: string, close: string | undefined) => {
+    const anchored = Boolean(open && close)
+    const image = anchored ? tag : whole
+    const style = declarations(/style="([^"]*)"/i.exec(image)?.[1] ?? '')
+    const align = (/data-align="(left|center|right)"/i.exec(image)?.[1] ?? 'left').toLowerCase()
+    const framed = Boolean(style.border) && !FRAMELESS.includes(style.border)
+    const stripped = image.replace(/\sdata-align="[^"]*"/i, '')
+    // Nothing to protect this one from: leave it byte for byte as the writer left it.
+    if (!framed && align === 'left') return anchored ? `${open}${stripped}${close}` : stripped
+    const plain = stripped.replace(
+      /\sstyle="[^"]*"/i,
+      ` style="${declarationText({ display: 'block', width: style.width ?? '', height: 'auto', border: '0' })}"`,
+    )
+    const inner = anchored ? `${open}${plain}${close}` : plain
+    const cell = declarationText({
+      border: framed ? style.border : '',
+      'border-radius': framed ? (style['border-radius'] ?? '') : '',
+      padding: framed ? (style.padding ?? '0') : '0',
+    })
+    // align="left" on a table is a float in HTML, and the signature then wrapped itself
+    // around the logo. Only centring and right alignment name an alignment at all.
+    const aligned = align === 'left' ? '' : ` align="${align}"`
+    const outer = align === 'center' ? 'margin:0 auto;' : align === 'right' ? 'margin-left:auto;' : ''
+    return `<table role="presentation" border="0" cellpadding="0" cellspacing="0"${aligned} style="border-collapse:separate;${outer}"><tr><td style="${cell}">${inner}</td></tr></table>`
+  })
+}