@rndmjoker/proton-mcp 0.4.4

package/dist/mail/quote.d.ts

@@ -0,0 +1,65 @@
+/**
+ * Quoting a message inside a reply, with its formatting intact.
+ *
+ * The obvious way to quote is to convert the original to text. It is safe and
+ * it is what this server did first, and measured against a real mailbox it
+ * turned out to be too expensive: 94 percent of ordinary mail is formatted, so
+ * every reply would throw away the look of nearly everything it answers.
+ *
+ * The other obvious way is to keep the original's markup and cut it down to
+ * what this server permits itself to write. Also measured, on the same
+ * mailbox: **83 percent of real messages would need work, with a median of 87
+ * removals each.** That is not a plainer quote, it is a demolished one, and the
+ * pieces that carry the look are the first to go.
+ *
+ * So the quote keeps the original **byte for byte**, with one exception that
+ * the measurement made unavoidable.
+ *
+ * ## The exception, and why it is not negotiable
+ *
+ * A `<style>` block belongs to a document, not to the element it sits in. Embed
+ * one inside a quote and its rules apply to the whole message, including the
+ * reply written above it. Measured on the same sample:
+ *
+ * | | |
+ * | :--- | :--- |
+ * | Formatted messages carrying a `<style>` block | 66 percent |
+ * | Of those, rules aimed at bare elements rather than classes | 56 percent |
+ * | The selectors, in order | `body`, `a`, `table`, `p`, `img`, `td`, `blockquote` |
+ *
+ * `blockquote` appears in thirty-six of them, which is the element this quote
+ * is wrapped in. So in more than half of all replies, the quoted message's
+ * stylesheet would reach out and restyle the sender's own words. A rule as
+ * short as `p { display: none }` would make the reply disappear while leaving
+ * the quote in place, and the person who confirmed the send would never know.
+ *
+ * Everything else stays. Inline styles, classes, tables, colours, alignment,
+ * images, links, spacing: untouched, character for character, because the parts
+ * that are kept are copied out of the original string rather than rebuilt from
+ * a parse tree. A re-serialised quote is a quote somebody rewrote.
+ *
+ * ## Images
+ *
+ * Measured: **none** of the 687 images in the sample were embedded by content
+ * id; every one was an ordinary address. So a quote needs no files carried
+ * along and its pictures simply work. Content ids are handled anyway, because
+ * "none in this sample" is not "never", and a quote with a broken image would
+ * be worse than one without.
+ */
+export interface PreparedQuote {
+    /** The original's markup, minus what reaches outside the quote. */
+    html: string;
+    /** Which elements were dropped, for the answer and for the confirmation. */
+    removed: string[];
+    /** Content ids the quote still refers to, which have to travel with it. */
+    contentIds: string[];
+}
+/**
+ * Prepares a message's markup for use as a quote.
+ *
+ * Works by cutting ranges out of the original string rather than by rebuilding
+ * it. Every character that is not inside a removed element survives exactly as
+ * it was written, which is the difference between quoting a message and
+ * paraphrasing it.
+ */
+export declare function prepareQuotedMarkup(html: string): PreparedQuote;

package/dist/mail/quote.js

@@ -0,0 +1,157 @@
+/**
+ * Quoting a message inside a reply, with its formatting intact.
+ *
+ * The obvious way to quote is to convert the original to text. It is safe and
+ * it is what this server did first, and measured against a real mailbox it
+ * turned out to be too expensive: 94 percent of ordinary mail is formatted, so
+ * every reply would throw away the look of nearly everything it answers.
+ *
+ * The other obvious way is to keep the original's markup and cut it down to
+ * what this server permits itself to write. Also measured, on the same
+ * mailbox: **83 percent of real messages would need work, with a median of 87
+ * removals each.** That is not a plainer quote, it is a demolished one, and the
+ * pieces that carry the look are the first to go.
+ *
+ * So the quote keeps the original **byte for byte**, with one exception that
+ * the measurement made unavoidable.
+ *
+ * ## The exception, and why it is not negotiable
+ *
+ * A `<style>` block belongs to a document, not to the element it sits in. Embed
+ * one inside a quote and its rules apply to the whole message, including the
+ * reply written above it. Measured on the same sample:
+ *
+ * | | |
+ * | :--- | :--- |
+ * | Formatted messages carrying a `<style>` block | 66 percent |
+ * | Of those, rules aimed at bare elements rather than classes | 56 percent |
+ * | The selectors, in order | `body`, `a`, `table`, `p`, `img`, `td`, `blockquote` |
+ *
+ * `blockquote` appears in thirty-six of them, which is the element this quote
+ * is wrapped in. So in more than half of all replies, the quoted message's
+ * stylesheet would reach out and restyle the sender's own words. A rule as
+ * short as `p { display: none }` would make the reply disappear while leaving
+ * the quote in place, and the person who confirmed the send would never know.
+ *
+ * Everything else stays. Inline styles, classes, tables, colours, alignment,
+ * images, links, spacing: untouched, character for character, because the parts
+ * that are kept are copied out of the original string rather than rebuilt from
+ * a parse tree. A re-serialised quote is a quote somebody rewrote.
+ *
+ * ## Images
+ *
+ * Measured: **none** of the 687 images in the sample were embedded by content
+ * id; every one was an ordinary address. So a quote needs no files carried
+ * along and its pictures simply work. Content ids are handled anyway, because
+ * "none in this sample" is not "never", and a quote with a broken image would
+ * be worse than one without.
+ */
+import { Parser } from 'htmlparser2';
+/**
+ * Elements dropped from a quote, with everything inside them.
+ *
+ * All of them are document-level: they say something about the message as a
+ * whole rather than about the place they stand in, so inside a quote they act
+ * outside it. That is the entire criterion, and it is why the list is short.
+ */
+const DOCUMENT_LEVEL = new Set([
+    'style', 'script', 'head', 'meta', 'link', 'title', 'base', 'noscript',
+]);
+/** Wrappers whose contents are kept and whose tags are not. */
+const UNWRAP = new Set(['html', 'body']);
+/**
+ * Prepares a message's markup for use as a quote.
+ *
+ * Works by cutting ranges out of the original string rather than by rebuilding
+ * it. Every character that is not inside a removed element survives exactly as
+ * it was written, which is the difference between quoting a message and
+ * paraphrasing it.
+ */
+export function prepareQuotedMarkup(html) {
+    /** Ranges to cut, as [start, end) in the original string. */
+    const cuts = [];
+    const removed = [];
+    const contentIds = [];
+    /** Set while inside a dropped element, so nested tags are not counted twice. */
+    let dropDepth = 0;
+    let dropStart = 0;
+    let dropName = '';
+    const parser = new Parser({
+        onopentag(name, attributes) {
+            const tag = name.toLowerCase();
+            if (dropDepth > 0) {
+                if (tag === dropName)
+                    dropDepth += 1;
+                return;
+            }
+            if (DOCUMENT_LEVEL.has(tag)) {
+                dropDepth = 1;
+                dropName = tag;
+                dropStart = parser.startIndex;
+                return;
+            }
+            if (UNWRAP.has(tag)) {
+                cuts.push([parser.startIndex, parser.endIndex + 1]);
+                return;
+            }
+            if (tag === 'img' && typeof attributes.src === 'string') {
+                const src = attributes.src.trim();
+                if (src.toLowerCase().startsWith('cid:'))
+                    contentIds.push(src.slice(4));
+            }
+        },
+        oncomment() {
+            // Comments are cut out of a quote, and it is not tidiness. Outlook acts
+            // on conditional comments, so a `<style>` block inside
+            // `<!--[if mso]>` is a stylesheet that a parser reads as a comment and
+            // a mail client executes. Measured on a real mailbox: three of 151
+            // messages hid a style block exactly there, and one hid a `<noscript>`.
+            // Every unit test in this module passed while that hole was open.
+            //
+            // Matching on `[if mso]` would close those four and leave the next
+            // variant open. Dropping comments closes the shape of the hole: nothing
+            // renders a comment except this one client, and what it renders is a
+            // layout fallback inside a quote.
+            if (dropDepth === 0)
+                cuts.push([parser.startIndex, parser.endIndex + 1]);
+        },
+        onclosetag(name) {
+            const tag = name.toLowerCase();
+            if (dropDepth > 0 && tag === dropName) {
+                dropDepth -= 1;
+                if (dropDepth === 0) {
+                    cuts.push([dropStart, parser.endIndex + 1]);
+                    removed.push(`<${tag}>`);
+                }
+                return;
+            }
+            if (dropDepth === 0 && UNWRAP.has(tag)) {
+                cuts.push([parser.startIndex, parser.endIndex + 1]);
+            }
+        },
+    }, {
+        decodeEntities: false,
+        lowerCaseTags: true,
+        lowerCaseAttributeNames: true,
+        recognizeSelfClosing: true,
+    });
+    parser.write(html);
+    parser.end();
+    // An element left open at the end of the document still has to be cut, or
+    // its content would ride along inside a quote.
+    if (dropDepth > 0) {
+        cuts.push([dropStart, html.length]);
+        removed.push(`<${dropName}>`);
+    }
+    cuts.sort((a, b) => a[0] - b[0]);
+    let out = '';
+    let at = 0;
+    for (const [start, end] of cuts) {
+        if (start > at)
+            out += html.slice(at, start);
+        at = Math.max(at, end);
+    }
+    out += html.slice(at);
+    return { html: out.trim(), removed: [...new Set(removed)], contentIds };
+}
+//# sourceMappingURL=quote.js.map

package/dist/mail/quote.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"quote.js","sourceRoot":"","sources":["../../src/mail/quote.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAEpC;;;;;;GAMG;AACH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;IAC7B,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU;CACvE,CAAC,CAAA;AAEF,+DAA+D;AAC/D,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;AAWxC;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,6DAA6D;IAC7D,MAAM,IAAI,GAA4B,EAAE,CAAA;IACxC,MAAM,OAAO,GAAa,EAAE,CAAA;IAC5B,MAAM,UAAU,GAAa,EAAE,CAAA;IAC/B,gFAAgF;IAChF,IAAI,SAAS,GAAG,CAAC,CAAA;IACjB,IAAI,SAAS,GAAG,CAAC,CAAA;IACjB,IAAI,QAAQ,GAAG,EAAE,CAAA;IAEjB,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB;QACE,SAAS,CAAC,IAAI,EAAE,UAAU;YACxB,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,CAAA;YAC9B,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;gBAClB,IAAI,GAAG,KAAK,QAAQ;oBAAE,SAAS,IAAI,CAAC,CAAA;gBACpC,OAAM;YACR,CAAC;YACD,IAAI,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC5B,SAAS,GAAG,CAAC,CAAA;gBACb,QAAQ,GAAG,GAAG,CAAA;gBACd,SAAS,GAAG,MAAM,CAAC,UAAU,CAAA;gBAC7B,OAAM;YACR,CAAC;YACD,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBACpB,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAA;gBACnD,OAAM;YACR,CAAC;YACD,IAAI,GAAG,KAAK,KAAK,IAAI,OAAO,UAAU,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;gBACxD,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,CAAA;gBACjC,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC;oBAAE,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;YACzE,CAAC;QACH,CAAC;QACD,SAAS;YACP,wEAAwE;YACxE,uDAAuD;YACvD,uEAAuE;YACvE,mEAAmE;YACnE,wEAAwE;YACxE,kEAAkE;YAClE,EAAE;YACF,mEAAmE;YACnE,wEAAwE;YACxE,qEAAqE;YACrE,kCAAkC;YAClC,IAAI,SAAS,KAAK,CAAC;gBAAE,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAA;QAC1E,CAAC;QACD,UAAU,CAAC,IAAI;YACb,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,CAAA;YAC9B,IAAI,SAAS,GAAG,CAAC,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;gBACtC,SAAS,IAAI,CAAC,CAAA;gBACd,IAAI,SAAS,KAAK,CAAC,EAAE,CAAC;oBACpB,IAAI,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,MAAM,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAA;oBAC3C,OAAO,CAAC,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,CAAA;gBAC1B,CAAC;gBACD,OAAM;YACR,CAAC;YACD,IAAI,SAAS,KAAK,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBACvC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAA;YACrD,CAAC;QACH,CAAC;KACF,EACD;QACE,cAAc,EAAE,KAAK;QACrB,aAAa,EAAE,IAAI;QACnB,uBAAuB,EAAE,IAAI;QAC7B,oBAAoB,EAAE,IAAI;KAC3B,CACF,CAAA;IAED,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAClB,MAAM,CAAC,GAAG,EAAE,CAAA;IAEZ,0EAA0E;IAC1E,+CAA+C;IAC/C,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;QAClB,IAAI,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAA;QACnC,OAAO,CAAC,IAAI,CAAC,IAAI,QAAQ,GAAG,CAAC,CAAA;IAC/B,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IAChC,IAAI,GAAG,GAAG,EAAE,CAAA;IACZ,IAAI,EAAE,GAAG,CAAC,CAAA;IACV,KAAK,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;QAChC,IAAI,KAAK,GAAG,EAAE;YAAE,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,CAAA;QAC5C,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;IACxB,CAAC;IACD,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IAErB,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,EAAE,UAAU,EAAE,CAAA;AACzE,CAAC"}

package/dist/mail/search.d.ts

@@ -0,0 +1,66 @@
+/**
+ * Searching messages.
+ *
+ * Measured against a mailbox of 26816 messages: a
+ * full-text search takes between 1.7 and 3.3 seconds, a search that finds
+ * nothing takes just as long. The Bridge walks its local database linearly,
+ * there is no index, so the time grows with the size of the mailbox.
+ *
+ * That is slow but usable, which is why this server builds no index of its own.
+ * An index would mean mirroring the decrypted mailbox to disk, undoing locally
+ * what Proton does for you.
+ *
+ * Metadata queries are cheap by comparison: unread came back in 3 ms, a size
+ * filter in 437 ms.
+ */
+import type { SearchObject } from 'imapflow';
+import type { Connection } from '../bridge/connection.js';
+import { type MessageHeader, type OrderingCost } from './messages.js';
+export interface SearchCriteria {
+    /** Free text, searched in the body and in headers. The expensive part. */
+    text?: string;
+    /** Substring of the subject. */
+    subject?: string;
+    /** Substring of the sender address or display name. */
+    from?: string;
+    /** Substring of a recipient address. */
+    to?: string;
+    /** Only messages on or after this date. */
+    since?: Date;
+    /** Only messages before this date. */
+    before?: Date;
+    /** true for unread only, false for read only. */
+    seen?: boolean;
+    /** Only starred messages. */
+    flagged?: boolean;
+    /** Minimum size in bytes. */
+    largerThan?: number;
+}
+export interface SearchResult {
+    path: string;
+    /** Number of matches, independent of paging. */
+    total: number;
+    offset: number;
+    headers: MessageHeader[];
+    /** How long the search itself took, so a caller can judge the cost. */
+    elapsedMs: number;
+    /** What putting the hits in order cost, separate from the search. */
+    ordering: OrderingCost;
+    /** True when the search included a full-text term, which is the slow case. */
+    fullText: boolean;
+}
+/** Translates the criteria into what imapflow expects. */
+export declare function buildQuery(criteria: SearchCriteria): SearchObject;
+/** Whether a query contains the expensive full-text part. */
+export declare function isFullText(criteria: SearchCriteria): boolean;
+export interface SearchOptions extends SearchCriteria {
+    limit?: number;
+    offset?: number;
+}
+/**
+ * Searches one mailbox and returns headers, never bodies.
+ *
+ * "All Mail" is the mailbox to search when the caller does not care where a
+ * message lives, since it holds everything including trash.
+ */
+export declare function searchMessages(connection: Connection, path: string, options: SearchOptions): Promise<SearchResult>;

package/dist/mail/search.js

@@ -0,0 +1,107 @@
+/**
+ * Searching messages.
+ *
+ * Measured against a mailbox of 26816 messages: a
+ * full-text search takes between 1.7 and 3.3 seconds, a search that finds
+ * nothing takes just as long. The Bridge walks its local database linearly,
+ * there is no index, so the time grows with the size of the mailbox.
+ *
+ * That is slow but usable, which is why this server builds no index of its own.
+ * An index would mean mirroring the decrypted mailbox to disk, undoing locally
+ * what Proton does for you.
+ *
+ * Metadata queries are cheap by comparison: unread came back in 3 ms, a size
+ * filter in 437 ms.
+ */
+import { BridgeError } from '../bridge/errors.js';
+import { fetchDates, fetchHeaders, orderNewestFirst, MAX_LIST_LIMIT, } from './messages.js';
+/** Translates the criteria into what imapflow expects. */
+export function buildQuery(criteria) {
+    const query = {};
+    if (criteria.text)
+        query.text = criteria.text;
+    if (criteria.subject)
+        query.header = { subject: criteria.subject };
+    if (criteria.from)
+        query.from = criteria.from;
+    if (criteria.to)
+        query.to = criteria.to;
+    if (criteria.since)
+        query.since = criteria.since;
+    if (criteria.before)
+        query.before = criteria.before;
+    if (criteria.seen !== undefined)
+        query.seen = criteria.seen;
+    if (criteria.flagged !== undefined)
+        query.flagged = criteria.flagged;
+    if (criteria.largerThan !== undefined)
+        query.larger = criteria.largerThan;
+    // An empty query would match everything, which is list_messages rather than
+    // a search. Saying so is better than silently returning the whole mailbox.
+    if (Object.keys(query).length === 0) {
+        throw new BridgeError('A search needs at least one criterion. Pass text, subject, from, to, since, before, ' +
+            'unread, starred or largerThan. To see everything in a mailbox use list_messages instead.');
+    }
+    return query;
+}
+/** Whether a query contains the expensive full-text part. */
+export function isFullText(criteria) {
+    return Boolean(criteria.text);
+}
+/**
+ * Searches one mailbox and returns headers, never bodies.
+ *
+ * "All Mail" is the mailbox to search when the caller does not care where a
+ * message lives, since it holds everything including trash.
+ */
+export async function searchMessages(connection, path, options) {
+    const { limit: rawLimit, offset: rawOffset, ...criteria } = options;
+    const limit = Math.min(Math.max(rawLimit ?? 25, 1), MAX_LIST_LIMIT);
+    const offset = Math.max(rawOffset ?? 0, 0);
+    // Built before opening the mailbox, so an empty query fails fast.
+    const query = buildQuery(criteria);
+    const started = process.hrtime.bigint();
+    const uids = await connection.withMailbox(path, async (client, status) => {
+        if (status.messages === 0)
+            return [];
+        const hits = await client.search(query, { uid: true });
+        // imapflow answers with false rather than an empty array when a search
+        // yields nothing, and `?? []` would let that through.
+        return Array.isArray(hits) ? hits : [];
+    });
+    const elapsedMs = Math.round(Number(process.hrtime.bigint() - started) / 1e6);
+    if (uids.length === 0) {
+        return {
+            path,
+            total: 0,
+            offset,
+            headers: [],
+            elapsedMs,
+            ordering: { messages: 0, elapsedMs: 0 },
+            fullText: isFullText(criteria),
+        };
+    }
+    // Ordering reads the date of every hit, because a page can only be cut out of
+    // a list that is already in order. Only the dates: the full header fetch below
+    // still covers one page, which is what keeps this affordable. A common word
+    // matched 6803 messages in the measured mailbox.
+    const orderStarted = process.hrtime.bigint();
+    const ordered = await connection.withMailbox(path, async (client) => orderNewestFirst(await fetchDates(client, uids)));
+    const ordering = {
+        messages: uids.length,
+        elapsedMs: Math.round(Number(process.hrtime.bigint() - orderStarted) / 1e6),
+    };
+    const page = ordered.slice(offset, offset + limit);
+    // Same helper the listing uses, so both produce identical entries.
+    const headers = await connection.withMailbox(path, (client) => fetchHeaders(client, page));
+    return {
+        path,
+        total: ordered.length,
+        offset,
+        headers,
+        elapsedMs,
+        ordering,
+        fullText: isFullText(criteria),
+    };
+}
+//# sourceMappingURL=search.js.map

package/dist/mail/search.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"search.js","sourceRoot":"","sources":["../../src/mail/search.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAIH,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AACjD,OAAO,EACL,UAAU,EACV,YAAY,EACZ,gBAAgB,EAChB,cAAc,GAGf,MAAM,eAAe,CAAA;AAqCtB,0DAA0D;AAC1D,MAAM,UAAU,UAAU,CAAC,QAAwB;IACjD,MAAM,KAAK,GAA4B,EAAE,CAAA;IAEzC,IAAI,QAAQ,CAAC,IAAI;QAAE,KAAK,CAAC,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAA;IAC7C,IAAI,QAAQ,CAAC,OAAO;QAAE,KAAK,CAAC,MAAM,GAAG,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAA;IAClE,IAAI,QAAQ,CAAC,IAAI;QAAE,KAAK,CAAC,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAA;IAC7C,IAAI,QAAQ,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,GAAG,QAAQ,CAAC,EAAE,CAAA;IACvC,IAAI,QAAQ,CAAC,KAAK;QAAE,KAAK,CAAC,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAA;IAChD,IAAI,QAAQ,CAAC,MAAM;QAAE,KAAK,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAA;IACnD,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS;QAAE,KAAK,CAAC,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAA;IAC3D,IAAI,QAAQ,CAAC,OAAO,KAAK,SAAS;QAAE,KAAK,CAAC,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAA;IACpE,IAAI,QAAQ,CAAC,UAAU,KAAK,SAAS;QAAE,KAAK,CAAC,MAAM,GAAG,QAAQ,CAAC,UAAU,CAAA;IAEzE,4EAA4E;IAC5E,2EAA2E;IAC3E,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,WAAW,CACnB,sFAAsF;YACpF,0FAA0F,CAC7F,CAAA;IACH,CAAC;IAED,OAAO,KAAqB,CAAA;AAC9B,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,UAAU,CAAC,QAAwB;IACjD,OAAO,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;AAC/B,CAAC;AAOD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,UAAsB,EACtB,IAAY,EACZ,OAAsB;IAEtB,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,QAAQ,EAAE,GAAG,OAAO,CAAA;IACnE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,cAAc,CAAC,CAAA;IACnE,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,IAAI,CAAC,EAAE,CAAC,CAAC,CAAA;IAE1C,kEAAkE;IAClE,MAAM,KAAK,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAA;IAElC,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,CAAA;IAEvC,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAqB,EAAE;QAC1F,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC;YAAE,OAAO,EAAE,CAAA;QACpC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAA;QACtD,uEAAuE;QACvE,sDAAsD;QACtD,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAA;IACxC,CAAC,CAAC,CAAA;IAEF,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,GAAG,CAAC,CAAA;IAE7E,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO;YACL,IAAI;YACJ,KAAK,EAAE,CAAC;YACR,MAAM;YACN,OAAO,EAAE,EAAE;YACX,SAAS;YACT,QAAQ,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE;YACvC,QAAQ,EAAE,UAAU,CAAC,QAAQ,CAAC;SAC/B,CAAA;IACH,CAAC;IAED,8EAA8E;IAC9E,+EAA+E;IAC/E,4EAA4E;IAC5E,iDAAiD;IACjD,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,CAAA;IAC5C,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAClE,gBAAgB,CAAC,MAAM,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CACjD,CAAA;IACD,MAAM,QAAQ,GAAiB;QAC7B,QAAQ,EAAE,IAAI,CAAC,MAAM;QACrB,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,YAAY,CAAC,GAAG,GAAG,CAAC;KAC5E,CAAA;IAED,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,KAAK,CAAC,CAAA;IAElD,mEAAmE;IACnE,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAA;IAE1F,OAAO;QACL,IAAI;QACJ,KAAK,EAAE,OAAO,CAAC,MAAM;QACrB,MAAM;QACN,OAAO;QACP,SAAS;QACT,QAAQ;QACR,QAAQ,EAAE,UAAU,CAAC,QAAQ,CAAC;KAC/B,CAAA;AACH,CAAC"}

package/dist/mail/send.d.ts

@@ -0,0 +1,61 @@
+/**
+ * Sending over the Bridge's SMTP interface.
+ *
+ * This is the only code in the server that can make something leave the
+ * machine, so it is deliberately small and says no in more places than it says
+ * yes. The confirmation itself is not here: it belongs to the tool layer, where
+ * the protocol's round trip lives. What is here is the part that must be true
+ * regardless of who asks.
+ *
+ * ## The certificate
+ *
+ * The Bridge password goes over SMTP exactly as it goes over IMAP, so the
+ * connection is pinned the same way. Measured on 31.07.2026: **the Bridge
+ * presents the same certificate on both ports**, fingerprint for fingerprint,
+ * so the entry recorded for IMAP is what SMTP is verified against and no second
+ * pin is needed. That is also why nothing here disables the check: if Proton
+ * ever gives the two ports different certificates, sending stops with a
+ * verification failure instead of quietly handing the password to whatever
+ * answered.
+ *
+ * ## No verification afterwards
+ *
+ * Measured on 31.07.2026: SMTP took about six and a half seconds to accept a
+ * message and answer `250 2.0.0 OK: queued`, and the message showed up over
+ * IMAP about three seconds after that. Nothing here looks for what it just
+ * sent. What SMTP accepted is what is reported, and the answer says what that
+ * does and does not mean.
+ *
+ * ## What Proton keeps
+ *
+ * Also measured, and it is the reason replying exists as a sending tool rather
+ * than only as a draft tool: **a sent message keeps its `In-Reply-To`.** A
+ * stored draft does not, and gets Proton's internal thread id in `References`
+ * instead. `References` is normalised on the way out, keeping the entries
+ * Proton can resolve and dropping the ones it cannot, which is reasonable
+ * behaviour and leaves the threading intact.
+ *
+ * The blind copies were verified to be absent from the delivered headers while
+ * the blind recipient still received the message. That is the whole reason the
+ * envelope is stated separately below.
+ */
+import type { Config, BridgeCredentials } from '../config.js';
+import { type Draft } from './compose.js';
+export interface SendOutcome {
+    messageId: string;
+    /** Addresses the Bridge took responsibility for. */
+    accepted: string[];
+    /** Addresses it refused. A message can be half delivered. */
+    rejected: string[];
+    /** What the Bridge said, for the record. */
+    response: string;
+}
+/**
+ * Sends a message.
+ *
+ * The exact bytes that were built are handed over as the message, with the
+ * envelope stated separately. That is not a detail: the envelope is what
+ * carries the blind copies, and the built message must not, so the two have to
+ * be given apart from one another.
+ */
+export declare function sendMessage(config: Config, getCredentials: () => Promise<BridgeCredentials | undefined>, readOnly: boolean, draft: Draft): Promise<SendOutcome>;

package/dist/mail/send.js

@@ -0,0 +1,132 @@
+/**
+ * Sending over the Bridge's SMTP interface.
+ *
+ * This is the only code in the server that can make something leave the
+ * machine, so it is deliberately small and says no in more places than it says
+ * yes. The confirmation itself is not here: it belongs to the tool layer, where
+ * the protocol's round trip lives. What is here is the part that must be true
+ * regardless of who asks.
+ *
+ * ## The certificate
+ *
+ * The Bridge password goes over SMTP exactly as it goes over IMAP, so the
+ * connection is pinned the same way. Measured on 31.07.2026: **the Bridge
+ * presents the same certificate on both ports**, fingerprint for fingerprint,
+ * so the entry recorded for IMAP is what SMTP is verified against and no second
+ * pin is needed. That is also why nothing here disables the check: if Proton
+ * ever gives the two ports different certificates, sending stops with a
+ * verification failure instead of quietly handing the password to whatever
+ * answered.
+ *
+ * ## No verification afterwards
+ *
+ * Measured on 31.07.2026: SMTP took about six and a half seconds to accept a
+ * message and answer `250 2.0.0 OK: queued`, and the message showed up over
+ * IMAP about three seconds after that. Nothing here looks for what it just
+ * sent. What SMTP accepted is what is reported, and the answer says what that
+ * does and does not mean.
+ *
+ * ## What Proton keeps
+ *
+ * Also measured, and it is the reason replying exists as a sending tool rather
+ * than only as a draft tool: **a sent message keeps its `In-Reply-To`.** A
+ * stored draft does not, and gets Proton's internal thread id in `References`
+ * instead. `References` is normalised on the way out, keeping the entries
+ * Proton can resolve and dropping the ones it cannot, which is reasonable
+ * behaviour and leaves the threading intact.
+ *
+ * The blind copies were verified to be absent from the delivered headers while
+ * the blind recipient still received the message. That is the whole reason the
+ * envelope is stated separately below.
+ */
+import { createTransport } from 'nodemailer';
+import { BridgeError } from '../bridge/errors.js';
+import { ensurePinned } from '../bridge/certificate.js';
+import { buildMessage, allRecipients } from './compose.js';
+/**
+ * Opens an authenticated SMTP connection to the Bridge.
+ *
+ * Built per send rather than held open. Sending is rare, and a connection that
+ * sits idle holding the Bridge password is a worse trade than a handshake.
+ */
+async function transport(config, credentials) {
+    // The pin is recorded against the IMAP port because that is where the first
+    // connection happens. Measured to be the same certificate on the SMTP port,
+    // so this is the material to verify against; a difference fails the
+    // handshake rather than being waved through.
+    const pinned = await ensurePinned(config.host, config.imapPort);
+    return createTransport({
+        host: config.host,
+        port: config.smtpPort,
+        // Plain connection upgraded via STARTTLS, which is what the Bridge offers.
+        secure: false,
+        // Not "if available": without this a server that drops STARTTLS from its
+        // greeting would get the password in the clear.
+        requireTLS: true,
+        auth: { user: credentials.user, pass: credentials.pass },
+        tls: {
+            rejectUnauthorized: true,
+            ca: [pinned.pem],
+            // The certificate does not carry 127.0.0.1 as a subject alternative
+            // name, so the hostname check has to go. It adds nothing on top of
+            // pinning: matching one specific certificate says more than matching a
+            // name written inside it.
+            checkServerIdentity: () => undefined,
+        },
+        logger: false,
+    });
+}
+function assertWritable(readOnly) {
+    if (readOnly) {
+        throw new BridgeError('The server is running read-only, so sending is refused. This is set by ' +
+            'PROTON_MCP_READ_ONLY and the web interface reports it as the current mode.');
+    }
+}
+/**
+ * Sends a message.
+ *
+ * The exact bytes that were built are handed over as the message, with the
+ * envelope stated separately. That is not a detail: the envelope is what
+ * carries the blind copies, and the built message must not, so the two have to
+ * be given apart from one another.
+ */
+export async function sendMessage(config, getCredentials, readOnly, draft) {
+    assertWritable(readOnly);
+    const credentials = await getCredentials();
+    if (!credentials) {
+        throw new BridgeError('No Bridge credentials are available, so there is nothing to send with. Sign in through ' +
+            'the configuration page first.');
+    }
+    const recipients = allRecipients(draft);
+    if (recipients.length === 0) {
+        throw new BridgeError('A message needs at least one recipient.');
+    }
+    // Built without the blind copies in the headers. They travel in the envelope
+    // below, where the other recipients never see them.
+    const raw = await buildMessage(draft, { keepBcc: false });
+    const mailer = await transport(config, credentials);
+    try {
+        const info = await mailer.sendMail({
+            // The bytes, not the fields: what was confirmed is what goes out.
+            raw,
+            envelope: {
+                from: draft.from.address,
+                to: recipients.map((r) => r.address),
+            },
+        });
+        return {
+            messageId: draft.messageId,
+            accepted: (info.accepted ?? []).map(String),
+            rejected: (info.rejected ?? []).map(String),
+            response: info.response ?? '',
+        };
+    }
+    catch (error) {
+        throw new BridgeError(`The Bridge did not accept the message: ${error.message}. ` +
+            'Nothing was sent, and it can be sent again once the Bridge is reachable.', 'unreachable', { cause: error });
+    }
+    finally {
+        mailer.close();
+    }
+}
+//# sourceMappingURL=send.js.map

package/dist/mail/send.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"send.js","sourceRoot":"","sources":["../../src/mail/send.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,EAAE,eAAe,EAAoB,MAAM,YAAY,CAAA;AAE9D,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AACvD,OAAO,EAAE,YAAY,EAAE,aAAa,EAAc,MAAM,cAAc,CAAA;AAYtE;;;;;GAKG;AACH,KAAK,UAAU,SAAS,CACtB,MAAc,EACd,WAA8B;IAE9B,4EAA4E;IAC5E,4EAA4E;IAC5E,oEAAoE;IACpE,6CAA6C;IAC7C,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAA;IAE/D,OAAO,eAAe,CAAC;QACrB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,IAAI,EAAE,MAAM,CAAC,QAAQ;QACrB,2EAA2E;QAC3E,MAAM,EAAE,KAAK;QACb,yEAAyE;QACzE,gDAAgD;QAChD,UAAU,EAAE,IAAI;QAChB,IAAI,EAAE,EAAE,IAAI,EAAE,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,CAAC,IAAI,EAAE;QACxD,GAAG,EAAE;YACH,kBAAkB,EAAE,IAAI;YACxB,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC;YAChB,oEAAoE;YACpE,mEAAmE;YACnE,uEAAuE;YACvE,0BAA0B;YAC1B,mBAAmB,EAAE,GAAG,EAAE,CAAC,SAAS;SACrC;QACD,MAAM,EAAE,KAAK;KACd,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,QAAiB;IACvC,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,IAAI,WAAW,CACnB,yEAAyE;YACvE,4EAA4E,CAC/E,CAAA;IACH,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,MAAc,EACd,cAA4D,EAC5D,QAAiB,EACjB,KAAY;IAEZ,cAAc,CAAC,QAAQ,CAAC,CAAA;IAExB,MAAM,WAAW,GAAG,MAAM,cAAc,EAAE,CAAA;IAC1C,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,WAAW,CACnB,yFAAyF;YACvF,+BAA+B,CAClC,CAAA;IACH,CAAC;IAED,MAAM,UAAU,GAAG,aAAa,CAAC,KAAK,CAAC,CAAA;IACvC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,WAAW,CAAC,yCAAyC,CAAC,CAAA;IAClE,CAAC;IAED,6EAA6E;IAC7E,oDAAoD;IACpD,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAA;IAEzD,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;IACnD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC;YACjC,kEAAkE;YAClE,GAAG;YACH,QAAQ,EAAE;gBACR,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO;gBACxB,EAAE,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;aACrC;SACF,CAAC,CAAA;QACF,OAAO;YACL,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,QAAQ,EAAE,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;YAC3C,QAAQ,EAAE,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;YAC3C,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,EAAE;SAC9B,CAAA;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,WAAW,CACnB,0CAA2C,KAAe,CAAC,OAAO,IAAI;YACpE,0EAA0E,EAC5E,aAAa,EACb,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAA;IACH,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,KAAK,EAAE,CAAA;IAChB,CAAC;AACH,CAAC"}