@novacraft-engineering/mailbox 0.4.17 → 0.4.18

package/app/mail/page.module.css

@@ -1086,6 +1086,8 @@
 
 .riskBanner strong { display: block; font-weight: 650; }
 .riskBannerWhy { display: block; margin-top: 3px; opacity: 0.92; font-size: 12.5px; }
+.riskBannerReasons { margin: 4px 0 0; padding-left: 16px; opacity: 0.92; font-size: 12.5px; list-style: disc; }
+.riskBannerReasons li { margin-top: 2px; }
 
 .riskNoteIcon,
 .riskBannerIcon { display: inline-flex; flex-shrink: 0; }

package/app/mail/page.tsx

@@ -6312,7 +6312,11 @@ export default function DevMailPage() {
                         : 'This message may not be from who it claims'}
                   </strong>
                   {(inbound.riskReasons ?? []).length > 0 && (
-                    <span className={styles.riskBannerWhy}>{(inbound.riskReasons ?? []).join(' \u00b7 ')}</span>
+                    <ul className={styles.riskBannerReasons}>
+                      {(inbound.riskReasons ?? []).map(reason => (
+                        <li key={reason}>{reason}</li>
+                      ))}
+                    </ul>
                   )}
                   <span className={styles.riskBannerWhy}>
                     Treat links and attachments here with care, and do not enter passwords or payment details.

package/lib/mailbox.ts

@@ -1103,7 +1103,7 @@ export async function refreshThread(ownerRaw: string, threadId: string): Promise
   const head = latest[0]
   await sql`
     INSERT INTO mail_threads (owner, thread_id, subject_key, subject, first_at, latest_at, latest_id, count,
-      unread_count, starred_count, inbox_count, archived_count, trashed_count, spam_count, attach_count, senders, snippet, labels, addressed)
+      unread_count, starred_count, inbox_count, archived_count, trashed_count, spam_count, attach_count, senders, snippet, labels, addressed, risk)
     VALUES (${owner}, ${threadId}, ${subjectKey(String(head?.subject ?? ''))}, ${head?.subject ?? null},
       ${String(agg[0].first_at)}, ${String(agg[0].latest_at)}, ${head?.id ?? null}, ${total},
       ${Number(agg[0].unread ?? 0)}, ${Number(agg[0].starred ?? 0)}, ${Number(agg[0].inbox ?? 0)},
@@ -1361,7 +1361,12 @@ export async function rejudgeStored(options: { before?: string; limit?: number }
     // they put it — back-fill may label it, never move it out from under them.
     const untouched = !Number(row.read) && !Number(row.starred) && !Number(row.archived) && !Number(row.trashed)
     const quarantine = verdict.quarantine && untouched
-    if (String(row.risk ?? 'clean') === verdict.risk && Boolean(Number(row.spam)) === quarantine) continue
+    if (String(row.risk ?? 'clean') === verdict.risk && Boolean(Number(row.spam)) === quarantine) {
+      // The verdict is unchanged, but the conversation summary the list reads from may still
+      // predate it — worth one refresh for the few that carry a warning.
+      if (verdict.risk !== 'clean') await rethreadAfterChange(String(row.id))
+      continue
+    }
 
     await sql`
       UPDATE mail_inbox

package/lib/schema.test.ts

@@ -0,0 +1,50 @@
+import assert from 'node:assert/strict'
+import { readdirSync, readFileSync, statSync } from 'node:fs'
+import { join } from 'node:path'
+
+const sourceFiles = (dir: string): string[] =>
+  readdirSync(dir).flatMap(entry => {
+    const path = join(dir, entry)
+    if (entry === 'node_modules' || entry === '.next') return []
+    if (statSync(path).isDirectory()) return sourceFiles(path)
+    return path.endsWith('.ts') || path.endsWith('.tsx') ? [path] : []
+  })
+
+const valueCount = (values: string): number => {
+  let depth = 0
+  let count = 1
+  for (const character of values) {
+    if ('([{'.includes(character)) depth += 1
+    else if (')]}'.includes(character)) depth -= 1
+    else if (character === ',' && depth === 0) count += 1
+  }
+  return count
+}
+
+const closingIndex = (text: string): number => {
+  let depth = 1
+  for (let index = 0; index < text.length; index += 1) {
+    if (text[index] === '(') depth += 1
+    else if (text[index] === ')') { depth -= 1; if (!depth) return index }
+  }
+  return -1
+}
+
+let checked = 0
+for (const path of [...sourceFiles('lib'), ...sourceFiles('app')]) {
+  const text = readFileSync(path, 'utf8')
+  const pattern = /INSERT\s+(?:OR\s+\w+\s+)?INTO\s+(\w+)\s*\(([^)]*)\)\s*\n?\s*VALUES\s*\(/gi
+  for (const match of text.matchAll(pattern)) {
+    const [table, columns] = [match[1], match[2]]
+    const tail = text.slice(match.index + match[0].length)
+    const end = closingIndex(tail)
+    if (end < 0) continue
+    const expected = columns.split(',').filter(column => column.trim()).length
+    const actual = valueCount(tail.slice(0, end))
+    assert.equal(actual, expected, `${path}: INSERT INTO ${table} lists ${expected} columns but ${actual} values`)
+    checked += 1
+  }
+}
+
+assert.ok(checked > 20, `expected to check many inserts, checked ${checked}`)
+console.log(`ok - ${checked} inserts balance their column and value lists`)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@novacraft-engineering/mailbox",
-  "version": "0.4.17",
+  "version": "0.4.18",
   "description": "A shared webmail app: one codebase, one deployment per mailbox. Threads, a rich composer with signatures, attachments on S3-compatible storage, sharing links, full-text search, web push and PWA install.",
   "keywords": [
     "webmail",