@novacraft-engineering/mailbox 0.4.24 → 0.4.26

package/lib/mail-provider.ts

@@ -166,9 +166,8 @@ function buildRawMime(payload: SendPayload): string {
 }
 
 async function sendViaSes(payload: SendPayload): Promise<SendResult> {
-  // buildRawMime deliberately writes no Bcc header; SES is told the blind recipients here.
   const region = process.env.AWS_SES_REGION ?? 'eu-north-1'
-  return { id: await sesSendRaw(buildRawMime(payload), region, payload.bcc ?? []) }
+  return { id: await sesSendRaw(buildRawMime(payload), region, { to: payload.to, cc: payload.cc, bcc: payload.bcc }) }
 }
 
 /**

package/lib/mailbox.ts

@@ -1313,14 +1313,19 @@ export async function refreshThreadsFrom(
   return { refreshed: pairs.length, cursor: last ? { owner: String(last.owner), threadId: String(last.thread_id) } : null }
 }
 
+/** RFC 7489 §7.2.1.1's subject line, and Amazon's variant of it. Nobody types this by hand. */
+export function isDmarcAggregateReport(subject: string | null | undefined): boolean {
+  return /^(dmarc aggregate )?report domain:[\s\S]*\bsubmitter:/i.test((subject ?? '').trim())
+}
+
 export async function appendInbound(
   email: Omit<InboundEmail, 'starred' | 'archived' | 'trashed' | 'labels' | 'threadId'>,
 ): Promise<void> {
   await ensureMailSchema()
   const sql = db()
   await sql`
-    INSERT INTO mail_inbox (id, from_addr, to_addrs, cc, bcc, reply_to, subject, html, body_text, headers, received_at, read, attachments, owner, snippet, thread_meta, attach_meta, addressed, risk, risk_reasons, spam)
-    VALUES (${email.id}, ${email.from}, ${JSON.stringify(email.to)}, ${JSON.stringify(email.cc)}, ${JSON.stringify(email.bcc)}, ${JSON.stringify(email.replyTo)}, ${email.subject}, ${email.html}, ${email.text}, ${JSON.stringify(email.headers)}, ${email.receivedAt}, ${email.read}, ${JSON.stringify(email.attachments)}, ${email.owner ?? null}, ${listSnippet(email.text)}, ${threadMeta(email.headers)}, ${attachMeta(email.attachments)}, ${classifyAddressed(email.owner, email.to, email.cc)}, ${email.risk ?? 'clean'}, ${JSON.stringify(email.riskReasons ?? [])}, ${email.spam ? 1 : 0})
+    INSERT INTO mail_inbox (id, from_addr, to_addrs, cc, bcc, reply_to, subject, html, body_text, headers, received_at, read, attachments, owner, snippet, thread_meta, attach_meta, addressed, risk, risk_reasons, spam, archived)
+    VALUES (${email.id}, ${email.from}, ${JSON.stringify(email.to)}, ${JSON.stringify(email.cc)}, ${JSON.stringify(email.bcc)}, ${JSON.stringify(email.replyTo)}, ${email.subject}, ${email.html}, ${email.text}, ${JSON.stringify(email.headers)}, ${email.receivedAt}, ${email.read}, ${JSON.stringify(email.attachments)}, ${email.owner ?? null}, ${listSnippet(email.text)}, ${threadMeta(email.headers)}, ${attachMeta(email.attachments)}, ${classifyAddressed(email.owner, email.to, email.cc)}, ${email.risk ?? 'clean'}, ${JSON.stringify(email.riskReasons ?? [])}, ${email.spam ? 1 : 0}, ${isDmarcAggregateReport(email.subject) ? 1 : 0})
     ON CONFLICT (id) DO NOTHING`
   await threadMessage({ id: email.id, owner: email.owner ?? null, subject: email.subject, receivedAt: email.receivedAt })
   await invalidateCounts(email.owner)

package/lib/receive.test.ts

@@ -23,3 +23,27 @@ test('only mail addressed to a hosted domain is ingested', async () => {
   assert.equal(addressedToUs(['x@metroperilinsbrokers.com.evil.net']), false)
 
 })
+
+test('the To line comes from the header, not from the copy the provider delivered', async () => {
+  const { headerAddresses } = await import('./receive.ts')
+
+  assert.deepEqual(
+    headerAddresses('eric.samuel@coronationinsurance.com.ng, sijuatobatele@lasacoassurance.com'),
+    ['eric.samuel@coronationinsurance.com.ng', 'sijuatobatele@lasacoassurance.com'],
+  )
+  assert.deepEqual(
+    headerAddresses('"Adeolu Ajao" <aajao@custodianinsurance.com>, "Ernest Okpata" <eokpata.metroperil@gmail.com>'),
+    ['aajao@custodianinsurance.com', 'eokpata.metroperil@gmail.com'],
+  )
+  assert.deepEqual(headerAddresses('"Doe, John" <john@example.com>, jane@example.com'), ['john@example.com', 'jane@example.com'], 'a comma inside a quoted name does not split it')
+  assert.deepEqual(headerAddresses('"Say \\"hi\\", please" <quote@example.com>'), ['quote@example.com'], 'an escaped quote does not end the name')
+  assert.deepEqual(headerAddresses('undisclosed-recipients:;'), [], 'a blind copy has no visible recipient')
+  assert.deepEqual(headerAddresses('team: a@example.com, b@example.com;'), ['a@example.com', 'b@example.com'])
+  assert.deepEqual(headerAddresses(['a@example.com', '"B" <b@example.com>']), ['a@example.com', 'b@example.com'])
+  assert.deepEqual(headerAddresses('john@x.com (John)'), ['john@x.com'], 'a trailing comment is not part of the address')
+  assert.deepEqual(headerAddresses('john@x.com (Smith, John), k@x.com'), ['john@x.com', 'k@x.com'], 'a comma inside a comment does not split')
+  assert.deepEqual(headerAddresses('"Ops <ops@old.com>" <real@x.com>, k@x.com'), ['real@x.com', 'k@x.com'], 'brackets inside a quoted name are not the address')
+  assert.deepEqual(headerAddresses('Jo (a "b) <j@x.com>, k@x.com'), ['j@x.com', 'k@x.com'])
+  assert.deepEqual(headerAddresses(undefined), [])
+  assert.deepEqual(headerAddresses(''), [])
+})

package/lib/receive.ts

@@ -1,8 +1,8 @@
 import { BRAND, ADDRESS_DOMAINS } from '@/lib/brand'
 import { sendPush } from '@/lib/push'
 import { stripOwnPixel } from '@/lib/email-html'
-import { FORWARD_RECIPIENTS, MAIL_DOMAIN } from '@/lib/dev-auth'
-import { ADDRESS_ALIASES, appendInbound, judgeMessage, noteSender, senderStanding, senderDomainOf, getAccountByAddress, inboundExists, recordContact, recordSentMeta, repairInbound } from '@/lib/mailbox'
+import { FORWARDING_ENABLED, FORWARD_RECIPIENTS, MAIL_DOMAIN } from '@/lib/dev-auth'
+import { ADDRESS_ALIASES, appendInbound, isDmarcAggregateReport, judgeMessage, noteSender, senderStanding, senderDomainOf, getAccountByAddress, inboundExists, recordContact, recordSentMeta, repairInbound } from '@/lib/mailbox'
 import { sendMail } from '@/lib/mail-provider'
 
 /**
@@ -66,6 +66,45 @@ function escapeHtml(src: string): string {
   return src.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;')
 }
 
+/**
+ * The addresses in a To or Cc header, bare, in the shape the provider already gives Cc.
+ *
+ * The provider's own `to` is the envelope recipient of the one copy it delivered, so every
+ * mailbox on a message saw itself in the To line — a colleague copied in read as though the
+ * client had written to them.
+ */
+export function headerAddresses(value: unknown): string[] {
+  const raw = Array.isArray(value) ? value.join(', ') : typeof value === 'string' ? value : ''
+  const entries: string[] = []
+  let current = ''
+  let quoted = false
+  let angled = false
+  let comment = 0
+  for (let index = 0; index < raw.length; index += 1) {
+    const char = raw[index]
+    if ((quoted || comment) && char === '\\') {
+      current += char + (raw[index + 1] ?? '')
+      index += 1
+      continue
+    }
+    if (char === '"' && !comment) quoted = !quoted
+    else if (!quoted && char === '(') comment += 1
+    else if (!quoted && char === ')' && comment) comment -= 1
+    else if (!quoted && !comment && char === '<') angled = true
+    else if (!quoted && !comment && char === '>') angled = false
+    if ((char === ',' || char === ';') && !quoted && !angled && !comment) {
+      entries.push(current)
+      current = ''
+    } else current += char
+  }
+  entries.push(current)
+  return entries
+    .map(entry => entry.replace(/"(?:[^"\\]|\\.)*"/g, ' ').replace(/\((?:[^()\\]|\\.)*\)/g, ' '))
+    .map(entry => entry.replace(/^[^<]*?:/, ''))
+    .map(entry => (entry.match(/<([^>]*)>/)?.[1] ?? entry).trim())
+    .filter(address => /^[^\s@<>"()]+@[^\s@<>"()]+$/.test(address))
+}
+
 export type ReceivedEmail = {
   html: string | null
   text: string | null
@@ -189,6 +228,7 @@ export async function forwardToAccounts(
   ownerAddress: string | null,
   files?: SendAttachment[],
 ): Promise<void> {
+  if (!FORWARDING_ENABLED || isDmarcAggregateReport(inbound.subject)) return
   const owningAccount = ownerAddress ? await getAccountByAddress(ownerAddress) : null
   const recipient = owningAccount?.email ?? FORWARD_RECIPIENTS[0] // fallback: the admin
   if (!recipient) return
@@ -265,6 +305,7 @@ export async function ingestReceived(
     ...(Array.isArray(data.bcc) ? (data.bcc as string[]) : []),
   ].filter(Boolean)
   const owner = await attributeOwner(recipients)
+  const toHeader = (full?.headers as Record<string, unknown> | undefined)?.to
   const fromAddress = full?.from || String(data.from ?? '')
   const senderDomain = senderDomainOf(fromAddress)
   const standing = await senderStanding(owner, senderDomain)
@@ -293,7 +334,9 @@ export async function ingestReceived(
     // Held out of the inbox, not merely labelled, once the weight passes the threshold.
     spam: verdicts.quarantine,
     from: full?.from || String(data.from ?? ''),
-    to: full?.to ?? (Array.isArray(data.to) ? (data.to as string[]) : [String(data.to ?? '')]),
+    to: toHeader !== undefined || Object.keys(full?.headers ?? {}).length
+      ? headerAddresses(toHeader)
+      : full?.to ?? (Array.isArray(data.to) ? (data.to as string[]) : [String(data.to ?? '')]),
     cc: full?.cc ?? (Array.isArray(data.cc) ? (data.cc as string[]) : []),
     bcc: full?.bcc ?? (Array.isArray(data.bcc) ? (data.bcc as string[]) : []),
     replyTo: full?.replyTo ?? (Array.isArray(data.reply_to) ? (data.reply_to as string[]) : []),
@@ -320,9 +363,8 @@ export async function ingestReceived(
   // or forwarded. Without this, every message the provider account receives for any tenant
   // lands in whichever deployment holds the webhook, filed to its shared inbox because no
   // local account matches — one tenant reading another's mail.
-  const envelope = [...inbound.to, ...inbound.cc, ...inbound.bcc]
-  if (!addressedToUs(envelope)) {
-    throw new Error(`refusing ${emailId}: addressed to ${envelope.join(', ') || 'nobody'}, which is not a domain this mailbox hosts`)
+  if (!addressedToUs(recipients)) {
+    throw new Error(`refusing ${emailId}: addressed to ${recipients.join(', ') || 'nobody'}, which is not a domain this mailbox hosts`)
   }
 
   // Pull the bytes once: they become our stored copy and the forward's attachments.
@@ -341,11 +383,13 @@ export async function ingestReceived(
   await noteSender(owner, senderDomain, 'received').catch(() => {})
   const sender = parseSender(inbound.from)
   await recordContact(sender.email, sender.name)
-  await sendPush(inbound.owner, {
-    title: sender.name || sender.email || 'New mail',
-    body: inbound.subject,
-    tag: emailId,
-  }).catch(() => {})
+  if (!isDmarcAggregateReport(inbound.subject)) {
+    await sendPush(inbound.owner, {
+      title: sender.name || sender.email || 'New mail',
+      body: inbound.subject,
+      tag: emailId,
+    }).catch(() => {})
+  }
   await forwardToAccounts(
     emailId,
     full ?? {

package/lib/scheduled.ts

@@ -124,11 +124,49 @@ const MAX_ATTEMPTS = 5
  * Hands over every message whose time has come. Each row is claimed with a conditional
  * update before it is sent, so two runners overlapping cannot send the same mail twice.
  */
+/**
+ * Sends one queued message, if it is still waiting. The claim is a single conditional
+ * update, so whichever caller gets there first sends it and every other caller — the
+ * minute cron, the page that watched its undo window close — finds nothing to do.
+ */
+async function dispatchRow(row: Record<string, unknown>): Promise<'sent' | 'failed' | 'skipped'> {
+  const sql = db()
+  const id = String(row.id)
+  const claimed = await sql`
+    UPDATE mail_scheduled SET status = 'sending' WHERE id = ${id} AND status = 'pending' RETURNING id`
+  if (!claimed.length) return 'skipped'
+
+  const send = parse(row.payload)
+  if (!send) {
+    await sql`UPDATE mail_scheduled SET status = 'failed', last_error = 'unreadable payload' WHERE id = ${id}`
+    return 'failed'
+  }
+
+  try {
+    // scheduledAt is deliberately dropped: the wait already happened here.
+    const { scheduledAt: _ignored, ...payload } = send.payload
+    const result = await sendMail(
+      payload.html ? { ...payload, html: absoluteUrls(payload.html, BRAND.publicUrl) } : payload,
+    )
+    await recordSend(send, result?.id ?? null)
+    await sql`
+      UPDATE mail_scheduled SET status = 'sent', sent_id = ${result?.id ?? null}, last_error = NULL WHERE id = ${id}`
+    return 'sent'
+  } catch (err) {
+    const attempts = Number(row.attempts ?? 0) + 1
+    const reason = err instanceof Error ? err.message : String(err)
+    await sql`
+      UPDATE mail_scheduled
+      SET status = ${attempts >= MAX_ATTEMPTS ? 'failed' : 'pending'}, attempts = ${attempts}, last_error = ${reason}
+      WHERE id = ${id}`
+    return 'failed'
+  }
+}
+
 export async function dispatchDue(limit = 25): Promise<{ due: number; sent: number; failed: number }> {
   await ensureMailSchema()
-  const sql = db()
   const now = new Date().toISOString()
-  const due = await sql`
+  const due = await db()`
     SELECT id, payload, attempts FROM mail_scheduled
     WHERE status = 'pending' AND send_after <= ${now}
     ORDER BY send_after LIMIT ${limit}`
@@ -136,37 +174,33 @@ export async function dispatchDue(limit = 25): Promise<{ due: number; sent: numb
   let sent = 0
   let failed = 0
   for (const row of due) {
-    const id = String(row.id)
-    const claimed = await sql`
-      UPDATE mail_scheduled SET status = 'sending' WHERE id = ${id} AND status = 'pending' RETURNING id`
-    if (!claimed.length) continue
-
-    const send = parse(row.payload)
-    if (!send) {
-      await sql`UPDATE mail_scheduled SET status = 'failed', last_error = 'unreadable payload' WHERE id = ${id}`
-      failed += 1
-      continue
-    }
-
-    try {
-      // scheduledAt is deliberately dropped: the wait already happened here.
-      const { scheduledAt: _ignored, ...payload } = send.payload
-      const result = await sendMail(
-        payload.html ? { ...payload, html: absoluteUrls(payload.html, BRAND.publicUrl) } : payload,
-      )
-      await recordSend(send, result?.id ?? null)
-      await sql`
-        UPDATE mail_scheduled SET status = 'sent', sent_id = ${result?.id ?? null}, last_error = NULL WHERE id = ${id}`
-      sent += 1
-    } catch (err) {
-      const attempts = Number(row.attempts ?? 0) + 1
-      const reason = err instanceof Error ? err.message : String(err)
-      await sql`
-        UPDATE mail_scheduled
-        SET status = ${attempts >= MAX_ATTEMPTS ? 'failed' : 'pending'}, attempts = ${attempts}, last_error = ${reason}
-        WHERE id = ${id}`
-      failed += 1
-    }
+    const outcome = await dispatchRow(row)
+    if (outcome === 'sent') sent += 1
+    if (outcome === 'failed') failed += 1
   }
   return { due: due.length, sent, failed }
 }
+
+// How early a message may be sent on its owner's say-so. It covers a page clock running a
+// little ahead of ours, and no more: a message scheduled for tomorrow is not sent now
+// because a page asked, which is what "Send now" and its explicit reschedule are for.
+const EARLY_TOLERANCE_MS = 30_000
+
+/**
+ * The owner's page watched the undo window close. Sending then, rather than at the next
+ * minute cron, is what makes "Sent" true when the page says it. Already sent counts as
+ * sent: the cron may have got there first.
+ */
+export async function dispatchNow(id: string, owner: string): Promise<'sent' | 'already-sent' | 'not-due' | 'failed' | 'missing'> {
+  await ensureMailSchema()
+  const rows = await db()`
+    SELECT id, payload, attempts, status, send_after FROM mail_scheduled
+    WHERE id = ${id} AND lower(owner) = ${owner.toLowerCase()}`
+  const row = rows[0]
+  if (!row) return 'missing'
+  if (row.status === 'sent' || row.status === 'sending') return 'already-sent'
+  if (row.status !== 'pending') return 'failed'
+  if (Date.parse(String(row.send_after)) > Date.now() + EARLY_TOLERANCE_MS) return 'not-due'
+  const outcome = await dispatchRow(row)
+  return outcome === 'skipped' ? 'already-sent' : outcome
+}

package/lib/ses-send.test.ts

@@ -0,0 +1,21 @@
+import assert from 'node:assert/strict'
+import { sesDestination } from './ses-send.ts'
+
+// The bug: with a blind copy present, only the blind copy was handed to SES, and SES
+// delivers a raw message to its Destination alone — the real recipients were dropped.
+assert.deepEqual(
+  sesDestination({ to: ['rokoeman@example.com'], bcc: ['automated@example.org'] }),
+  { ToAddresses: ['rokoeman@example.com'], BccAddresses: ['automated@example.org'] },
+)
+assert.deepEqual(
+  sesDestination({ to: ['Robert <robert@example.com>'], cc: ['"Ops, Team" <ops@example.com>'] }),
+  { ToAddresses: ['robert@example.com'], CcAddresses: ['ops@example.com'] },
+  'display names stay in the headers; the envelope carries bare addresses',
+)
+assert.deepEqual(
+  sesDestination({ to: ['a@example.com'], cc: ['A@example.com'], bcc: ['a@example.com', 'b@example.com'] }),
+  { ToAddresses: ['a@example.com'], BccAddresses: ['b@example.com'] },
+  'an address named twice is delivered once',
+)
+assert.deepEqual(sesDestination({ to: ['a@example.com'] }), { ToAddresses: ['a@example.com'] })
+console.log('ok - ses envelope carries every recipient')

package/lib/ses-send.ts

@@ -7,15 +7,39 @@ export function sesConfigured(): boolean {
   return Boolean(process.env.SES_ACCESS_KEY_ID && process.env.SES_SECRET_ACCESS_KEY)
 }
 
+export type SesRecipients = { to: string[]; cc?: string[]; bcc?: string[] }
+
+const addressOnly = (entry: string): string => (entry.match(/<([^>]+)>/)?.[1] ?? entry).trim()
+
 /**
- * `blindCopies` are envelope recipients only. A Bcc header inside the MIME would be handed
- * to everyone the message reaches, so the address is named to SES instead of written down
- * where the recipient can read it.
+ * The envelope, spelled out in full. Once a raw message names any Destination, SES delivers
+ * to that list and nothing else — the To and Cc headers inside the MIME are not added to it —
+ * so naming only the blind copies sent the message to the blind copies alone. Bcc never goes
+ * in the MIME, where every recipient could read it; it lives here and only here.
  */
+export function sesDestination(recipients: SesRecipients) {
+  const seen = new Set<string>()
+  const take = (list: string[] | undefined) =>
+    (list ?? []).map(addressOnly).filter(address => {
+      const key = address.toLowerCase()
+      if (!address || seen.has(key)) return false
+      seen.add(key)
+      return true
+    })
+  const to = take(recipients.to)
+  const cc = take(recipients.cc)
+  const bcc = take(recipients.bcc)
+  return {
+    ...(to.length ? { ToAddresses: to } : {}),
+    ...(cc.length ? { CcAddresses: cc } : {}),
+    ...(bcc.length ? { BccAddresses: bcc } : {}),
+  }
+}
+
 export async function sesSendRaw(
   raw: string,
   region = process.env.AWS_SES_REGION ?? 'eu-north-1',
-  blindCopies: string[] = [],
+  recipients: SesRecipients,
 ): Promise<string | null> {
   const id = process.env.SES_ACCESS_KEY_ID
   const secret = process.env.SES_SECRET_ACCESS_KEY
@@ -25,7 +49,7 @@ export async function sesSendRaw(
   const path = '/v2/email/outbound-emails'
   const body = JSON.stringify({
     Content: { Raw: { Data: Buffer.from(raw, 'utf8').toString('base64') } },
-    ...(blindCopies.length ? { Destination: { BccAddresses: blindCopies } } : {}),
+    Destination: sesDestination(recipients),
   })
   const amzDate = new Date().toISOString().replace(/[:-]|\.\d{3}/g, '')
   const stamp = amzDate.slice(0, 8)

package/lib/sns.ts

@@ -0,0 +1,68 @@
+import { createPublicKey, createVerify } from 'node:crypto'
+
+export type SnsEnvelope = {
+  Type: string
+  MessageId?: string
+  TopicArn?: string
+  Subject?: string
+  Message?: string
+  Timestamp?: string
+  Token?: string
+  SubscribeURL?: string
+  SignatureVersion?: string
+  Signature?: string
+  SigningCertURL?: string
+}
+
+const SIGNED_FIELDS: Record<string, string[]> = {
+  Notification: ['Message', 'MessageId', 'Subject', 'Timestamp', 'TopicArn', 'Type'],
+  SubscriptionConfirmation: ['Message', 'MessageId', 'SubscribeURL', 'Timestamp', 'Token', 'TopicArn', 'Type'],
+  UnsubscribeConfirmation: ['Message', 'MessageId', 'SubscribeURL', 'Timestamp', 'Token', 'TopicArn', 'Type'],
+}
+
+/** A certificate from anywhere but AWS proves nothing about who signed the message. */
+export function awsSnsUrl(raw: string, suffix: string): boolean {
+  try {
+    const url = new URL(raw)
+    return url.protocol === 'https:' && url.pathname.endsWith(suffix) && /^sns\.[a-z0-9-]+\.amazonaws\.com$/.test(url.hostname)
+  } catch {
+    return false
+  }
+}
+
+const certCache = new Map<string, string>()
+
+async function fetchCert(url: string): Promise<string> {
+  const cached = certCache.get(url)
+  if (cached) return cached
+  const response = await fetch(url)
+  if (!response.ok) throw new Error(`certificate fetch failed (${response.status})`)
+  const pem = await response.text()
+  certCache.set(url, pem)
+  return pem
+}
+
+/**
+ * True only for a message AWS signed for `topicArn`. The topic is not optional: any AWS
+ * account can create a topic, subscribe this URL to it and send messages SNS signs
+ * perfectly well, so a valid signature alone says nothing about whose topic it came from.
+ */
+export async function verifySns(envelope: SnsEnvelope, topicArn: string | undefined): Promise<boolean> {
+  if (!topicArn || envelope.TopicArn !== topicArn) return false
+  if (!envelope.Signature || !envelope.SigningCertURL || !awsSnsUrl(envelope.SigningCertURL, '.pem')) return false
+  const fields = SIGNED_FIELDS[envelope.Type]
+  if (!fields) return false
+  let canonical = ''
+  for (const field of fields) {
+    const value = (envelope as Record<string, unknown>)[field]
+    if (value !== undefined && value !== null) canonical += `${field}\n${String(value)}\n`
+  }
+  try {
+    const verifier = createVerify(envelope.SignatureVersion === '2' ? 'RSA-SHA256' : 'RSA-SHA1')
+    verifier.update(canonical, 'utf8')
+    verifier.end()
+    return verifier.verify(createPublicKey(await fetchCert(envelope.SigningCertURL)), Buffer.from(envelope.Signature, 'base64'))
+  } catch {
+    return false
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@novacraft-engineering/mailbox",
-  "version": "0.4.24",
+  "version": "0.4.26",
   "description": "A shared webmail app: one codebase, one deployment per mailbox. Threads, a rich composer with signatures, attachments on S3-compatible storage, sharing links, full-text search, web push and PWA install.",
   "keywords": [
     "webmail",
@@ -51,6 +51,7 @@
     "@tiptap/react": "^3.31.3",
     "@tiptap/starter-kit": "^3.31.3",
     "next": "^16.3.5",
+    "nspell": "2.1.5",
     "react": "19.3.0",
     "react-dom": "19.3.0",
     "resend": "^6.12.3",
@@ -58,6 +59,7 @@
   },
   "devDependencies": {
     "@types/node": "^22",
+    "@types/nspell": "2.1.6",
     "@types/react": "^19",
     "@types/react-dom": "^19",
     "@types/web-push": "^3.6.4",