apple-mail-mcp 2.19.22 → 2.20.1

package/README.md

@@ -164,11 +164,11 @@ tool, and troubleshooting. Verify any time by running the **`doctor`** tool.
 | **Search Messages**   | Search by sender, subject, content, date range, read/flagged status — across all accounts                                                |
 | **Read Messages**     | Get full email content (plain text or HTML)                                                                                              |
 | **Read Headers**      | Get a message's raw RFC 5322 headers — the author's `Date:`, Message-ID, threading ids, `Received:` trace — without downloading the body |
-| **Send Email**        | Compose and send new emails (attach by file path or inline base64 content)                                                               |
+| **Send Email**        | Compose and send new emails (attach by file path or inline base64 content; optional `inReplyTo`/`references` threading over SMTP)        |
 | **Send Serial Email** | Mail merge — send personalized emails to a list of recipients with {{placeholder}} support                                               |
-| **Create Draft**      | Save emails to Drafts folder (attach by file path or inline base64 content)                                                              |
-| **Reply**             | Reply to messages (with reply-all support)                                                                                               |
-| **Forward**           | Forward messages to new recipients                                                                                                       |
+| **Create Draft**      | Save emails to Drafts folder (attach by file path or inline base64 content; threaded drafts filed over IMAP)                             |
+| **Reply**             | Reply to messages (with reply-all support and attachments)                                                                               |
+| **Forward**           | Forward messages to new recipients (with extra attachments)                                                                              |
 | **Get Thread**        | Group a conversation by normalized subject (across AppleScript or IMAP)                                                                  |
 | **Mark Read/Unread**  | Change read status (single or batch)                                                                                                     |
 | **Flag/Unflag**       | Flag or unflag messages (single or batch)                                                                                                |
@@ -402,16 +402,19 @@ Send a new email immediately.
 
 **⚠️ Safety:** Sends real mail immediately and cannot be unsent. Confirm the recipients, subject, and body with the user before calling.
 
-| Parameter     | Type                                    | Required | Description                                                                                                                                                                                                                    |
-| ------------- | --------------------------------------- | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| `to`          | string[]                                | Yes      | Recipient addresses                                                                                                                                                                                                            |
-| `subject`     | string                                  | Yes      | Email subject                                                                                                                                                                                                                  |
-| `body`        | string                                  | Yes      | Email body (plain text)                                                                                                                                                                                                        |
-| `cc`          | string[]                                | No       | CC recipients                                                                                                                                                                                                                  |
-| `bcc`         | string[]                                | No       | BCC recipients                                                                                                                                                                                                                 |
-| `account`     | string                                  | No       | Mail.app account label, or an email-form SMTP From override. An SMTP override must match `APPLE_MAIL_MCP_SMTP_USER`, `APPLE_MAIL_MCP_SMTP_FROM`, or an address in `APPLE_MAIL_MCP_SMTP_ALLOWED_FROM`                           |
-| `attachments` | (string \| {filename, contentBase64})[] | No       | Up to 20 attachments: absolute file paths inside the configured read roots (e.g., `"/Users/me/Documents/report.pdf"`) and/or inline `{filename, contentBase64}` objects up to 25 MiB decoded each                              |
-| `transport`   | `"applescript"` \| `"smtp"`             | No       | Send transport. If omitted, **SMTP is used automatically when configured** (otherwise AppleScript). Pass `"smtp"` to require clean MIME, or `"applescript"` to force the Mail.app path — see [SMTP transport](#smtp-transport) |
+| Parameter     | Type                                    | Required | Description                                                                                                                                                                                                                                           |
+| ------------- | --------------------------------------- | -------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `to`          | string[]                                | Yes      | Recipient addresses                                                                                                                                                                                                                                   |
+| `subject`     | string                                  | Yes      | Email subject                                                                                                                                                                                                                                         |
+| `body`        | string                                  | Yes      | Email body (plain text)                                                                                                                                                                                                                               |
+| `cc`          | string[]                                | No       | CC recipients                                                                                                                                                                                                                                         |
+| `bcc`         | string[]                                | No       | BCC recipients                                                                                                                                                                                                                                        |
+| `account`     | string                                  | No       | Mail.app account label, or an email-form SMTP From override. An SMTP override must match `APPLE_MAIL_MCP_SMTP_USER`, `APPLE_MAIL_MCP_SMTP_FROM`, or an address in `APPLE_MAIL_MCP_SMTP_ALLOWED_FROM`                                                  |
+| `attachments` | (string \| {filename, contentBase64})[] | No       | Up to 20 attachments: absolute file paths inside the configured read roots (e.g., `"/Users/me/Documents/report.pdf"`) and/or inline `{filename, contentBase64}` objects up to 25 MiB decoded each                                                     |
+| `transport`   | `"applescript"` \| `"smtp"`             | No       | Send transport. If omitted, **SMTP is used automatically when configured** (otherwise AppleScript). Pass `"smtp"` to require clean MIME, or `"applescript"` to force the Mail.app path — see [SMTP transport](#smtp-transport)                        |
+| `replyTo`     | string                                  | No       | SMTP only: `Reply-To` header, when replies should go somewhere other than the From address. Ignored on the AppleScript transport                                                                                                                      |
+| `inReplyTo`   | string                                  | No       | SMTP only (2.20.0): thread the message as a reply — the parent's `Message-ID` token with angle brackets, e.g. `"<abc@mail.example.com>"`. Emitted verbatim, never RFC 2047-encoded. See [Threading headers](#threading-headers-inreplyto--references) |
+| `references`  | string[]                                | No       | SMTP only (2.20.0): the `References` chain, oldest first (the parent's own `References` + its `Message-ID`). Defaults to `[inReplyTo]` when omitted                                                                                                   |
 
 **Example:**
 
@@ -425,6 +428,22 @@ Send a new email immediately.
 }
 ```
 
+##### Threading headers (`inReplyTo` / `references`)
+
+`send-email` and `create-draft` accept caller-built threading headers (2.20.0, #267) for
+callers that compose the recipients and quoted text themselves. **Prefer
+`reply-to-message`** — it derives recipients, `In-Reply-To`/`References` and the quote
+from the original, and (since 2.20.0) takes attachments too.
+
+- Each value must be a single RFC 5322 msg-id token **with** angle brackets
+  (`<left@right>`, no whitespace); anything else is rejected by validation.
+- The headers are always emitted as plain `<id>` tokens — never RFC 2047-encoded, even
+  for Outlook/Exchange IDs longer than 76 characters (a long header is folded at
+  whitespace between tokens, which is legal and does not alter the id).
+- Mail.app's AppleScript cannot set these headers, so they are **never silently
+  dropped**: `send-email` refuses them unless the SMTP transport is in use, and
+  `create-draft` files a threaded draft over IMAP instead of through Mail.app (below).
+
 ##### SMTP transport
 
 On macOS 15+ (Sequoia/Tahoe), Mail.app wraps any AppleScript-injected body in
@@ -783,10 +802,27 @@ Save an email to Drafts without sending.
 | `body`        | string                                  | Yes      | Email body (plain text)                                                                                                                                |
 | `cc`          | string[]                                | No       | CC recipients                                                                                                                                          |
 | `bcc`         | string[]                                | No       | BCC recipients                                                                                                                                         |
-| `account`     | string                                  | No       | Account for draft                                                                                                                                      |
+| `account`     | string                                  | No       | Account for draft. With `inReplyTo`/`references` it must name a configured IMAP account (label or login)                                               |
 | `attachments` | (string \| {filename, contentBase64})[] | No       | Up to 20 attachments: absolute file paths inside the configured read roots and/or inline `{filename, contentBase64}` objects up to 25 MiB decoded each |
-
-**Returns:** Confirmation that draft was created.
+| `inReplyTo`   | string                                  | No       | (2.20.0) Parent `Message-ID` token, e.g. `"<abc@mail.example.com>"` — makes this a **threaded draft** (see below)                                      |
+| `references`  | string[]                                | No       | (2.20.0) `References` chain, oldest first; defaults to `[inReplyTo]`                                                                                   |
+
+**Returns:** Confirmation that draft was created, with `transport` (`applescript`, or `imap` for a threaded draft).
+
+**Threaded drafts (2.20.0, #267):** Mail.app's `outgoing message` has no header property,
+so a draft with `inReplyTo`/`references` cannot go through AppleScript. Instead the
+server composes it with the same MIME builder as the SMTP send (attachments included) and
+files it over IMAP into the account's Drafts mailbox (SPECIAL-USE `\Drafts`), flagged
+`\Draft`. The account is `account` when given (it must be a configured IMAP account —
+pass the exact `accountLabel` or login from `list-accounts`/your `APPLE_MAIL_MCP_IMAP_*`
+config, e.g. `"user@icloud.com"`; a generic provider name like `"iCloud"` is not a
+recognized alias and is refused);
+otherwise the IMAP account whose login is the SMTP identity, else the only configured
+IMAP account. When none qualifies — IMAP unconfigured, an unknown `account`, or several
+accounts and no way to choose — the call **fails and files nothing**; it never falls back
+to an unthreaded Mail.app draft. The result names the Drafts `mailbox`, the `account` and
+the draft's `messageId`. Without threading headers, `create-draft` is unchanged
+(AppleScript).
 
 #### `get-thread`
 
@@ -832,13 +868,14 @@ Map `imap:` message IDs to their numeric Mail.app IDs, via each message's RFC 53
 
 Reply to an existing message.
 
-| Parameter   | Type    | Required | Description                                                                                    |
-| ----------- | ------- | -------- | ---------------------------------------------------------------------------------------------- |
-| `id`        | string  | Yes      | Message ID to reply to                                                                         |
-| `body`      | string  | Yes      | Reply body (plain text; HTML tags such as `<br>` are not rendered)                             |
-| `replyAll`  | boolean | No       | Reply to all recipients (default: false)                                                       |
-| `send`      | boolean | No       | Send immediately (default: true, false = save as draft)                                        |
-| `transport` | string  | No       | `smtp` or `applescript`; omitted prefers configured SMTP when sending. Drafts use AppleScript. |
+| Parameter     | Type                                    | Required | Description                                                                                                                                                                        |
+| ------------- | --------------------------------------- | -------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `id`          | string                                  | Yes      | Message ID to reply to                                                                                                                                                             |
+| `body`        | string                                  | Yes      | Reply body (plain text; HTML tags such as `<br>` are not rendered)                                                                                                                 |
+| `replyAll`    | boolean                                 | No       | Reply to all recipients (default: false)                                                                                                                                           |
+| `send`        | boolean                                 | No       | Send immediately (default: true, false = save as draft)                                                                                                                            |
+| `transport`   | string                                  | No       | `smtp` or `applescript`; omitted prefers configured SMTP when sending. Drafts use AppleScript.                                                                                     |
+| `attachments` | (string \| {filename, contentBase64})[] | No       | Up to 20 attachments, same rules as `send-email`: absolute file paths inside the configured read roots and/or inline `{filename, contentBase64}` objects up to 25 MiB decoded each |
 
 **Example - Reply to sender only:**
 
@@ -860,6 +897,30 @@ Reply to an existing message.
 }
 ```
 
+**Example - Reply all with an attachment (2.20.0):**
+
+```json
+{
+  "id": "imap:eyJhIjoiV29yayIsInAiOiJJTkJPWCIsInUiOjQyfQ",
+  "body": "Here is the PDF you asked for.",
+  "replyAll": true,
+  "attachments": [
+    "/Users/me/Documents/quote.pdf",
+    { "filename": "notes.txt", "contentBase64": "SGVsbG8K" }
+  ]
+}
+```
+
+**Attachments (2.20.0, #267):** same schema, limits (20 items, 25 MiB each) and read
+roots as `send-email`, validated before the original is fetched — an out-of-roots path
+fails with exactly `send-email`'s error. Recipients, threading headers and the quote are
+identical to the same call without attachments. Over SMTP the files ride the same
+nodemailer path `send-email` uses, so the Sent-folder copy (`sentCopy`) carries them too.
+On the AppleScript transport they are added with `make new attachment` **after** the
+reply content is set and before `save`/`send` (inline items are written to `0600` temp
+files and removed afterwards), so a `send: false` draft contains both the attachments and
+the quoted original. Results report `attachmentCount`.
+
 **Delivery:** `imap:` IDs are read directly from their encoded account, mailbox, and UID. Numeric IDs are read through Mail.app. With SMTP configured, replies use clean MIME with the original `Message-ID` in `In-Reply-To` and the full `References` chain. Only the original plain-text body is quoted; the new text is not. Pass `transport: "smtp"` to require this path, or `transport: "applescript"` to use Mail.app explicitly.
 
 **AppleScript transport quoting (v2.19.12):** every draft (`send: false`) and any send that falls back to AppleScript (SMTP not configured) also gets the original quoted — an "On \<date\>, \<sender\> wrote:" attribution line followed by the `> `-prefixed original body, built the same way as the SMTP path. Mail's own `reply`/`forward` AppleScript commands generate this quote internally but expose no way to read it back, so it's built here instead of relying on Mail's (unreadable) copy. Unlike SMTP, this path has no sending-identity restriction — it's read-only source lookup, not sending.
@@ -868,7 +929,7 @@ Reply to an existing message.
 
 The direct IMAP source read is bounded to 25 MiB, including MIME attachments. Its account login must match the SMTP login, configured From, or an explicitly configured `APPLE_MAIL_MCP_SMTP_ALLOWED_FROM` identity; otherwise the call fails rather than sending from an unrelated account. The SMTP configuration still represents a single sending identity, not a per-account SMTP registry.
 
-Success includes `transport` and, for SMTP when returned by the server, the new `messageId`. SMTP submission does not add a local Sent copy; server-side Sent-folder behavior is unchanged. `send-email` is for **new conversations**: adding `Re:` to its subject does not add threading headers. Use this reply tool with the original id instead.
+Success includes `transport`, `attachmentCount` and, for SMTP when returned by the server, the new `messageId`. Over SMTP a best-effort Sent-folder copy is filed over IMAP exactly as for `send-email` (`sentCopy` / `sentCopyError`, see [SMTP transport](#smtp-transport)). `send-email` is for **new conversations**: adding `Re:` to its subject does not add threading headers. Use this reply tool with the original id instead.
 
 **⚠️ Safety:** With the default `send: true`, sends real mail immediately and cannot be unsent. Confirm the recipients, subject, and body with the user before calling (or pass `send: false` to save a draft for review).
 
@@ -878,15 +939,18 @@ Success includes `transport` and, for SMTP when returned by the server, the new
 
 Forward a message to new recipients.
 
-| Parameter   | Type     | Required | Description                                                                                    |
-| ----------- | -------- | -------- | ---------------------------------------------------------------------------------------------- |
-| `id`        | string   | Yes      | Message ID to forward                                                                          |
-| `to`        | string[] | Yes      | Recipients to forward to                                                                       |
-| `body`      | string   | No       | Message to prepend (plain text)                                                                |
-| `send`      | boolean  | No       | Send immediately (default: true, false = save as draft)                                        |
-| `transport` | string   | No       | `smtp` or `applescript`; omitted prefers configured SMTP when sending. Drafts use AppleScript. |
+| Parameter     | Type                                    | Required | Description                                                                                                                                                                                   |
+| ------------- | --------------------------------------- | -------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `id`          | string                                  | Yes      | Message ID to forward                                                                                                                                                                         |
+| `to`          | string[]                                | Yes      | Recipients to forward to                                                                                                                                                                      |
+| `body`        | string                                  | No       | Message to prepend (plain text)                                                                                                                                                               |
+| `send`        | boolean                                 | No       | Send immediately (default: true, false = save as draft)                                                                                                                                       |
+| `transport`   | string                                  | No       | `smtp` or `applescript`; omitted prefers configured SMTP when sending. Drafts use AppleScript.                                                                                                |
+| `attachments` | (string \| {filename, contentBase64})[] | No       | Up to 20 additional attachments, same rules as `send-email`: absolute file paths inside the configured read roots and/or inline `{filename, contentBase64}` objects up to 25 MiB decoded each |
+
+**Delivery:** uses the same source lookup, transport selection, 25 MiB source limit, account-identity check, and failure behavior as `reply-to-message`. A forward deliberately starts a new conversation, so it has no `In-Reply-To` or `References` headers. The existing plain-text forwarding behavior is unchanged: original attachments are not reattached. See [SMTP transport](#smtp-transport). On the AppleScript transport, a `body` is merged with the forwarded-message header block and original text the same way the SMTP path builds it (see `reply-to-message`'s AppleScript transport quoting note); with no `body`, Mail's own forward content is left untouched — unless `attachments` are given, in which case the forwarded-message block is built the same way so Mail has a paragraph to anchor the new files after.
 
-**Delivery:** uses the same source lookup, transport selection, 25 MiB source limit, account-identity check, and failure behavior as `reply-to-message`. A forward deliberately starts a new conversation, so it has no `In-Reply-To` or `References` headers. The existing plain-text forwarding behavior is unchanged: original attachments are not reattached. See [SMTP transport](#smtp-transport). On the AppleScript transport, a `body` is merged with the forwarded-message header block and original text the same way the SMTP path builds it (see `reply-to-message`'s AppleScript transport quoting note); with no `body`, Mail's own forward content is left untouched.
+**Attachments (2.20.0, #267):** `attachments` adds new files to the forward, with or without a prepended `body`, under the same rules, validation and per-transport mechanics as `reply-to-message`'s attachments. They are independent of the original's attachments (which the SMTP path still does not reattach).
 
 SMTP forwarding requires a readable plain-text original. HTML-only IMAP messages and failed Mail.app body reads return an error before sending instead of silently omitting the original content. Explicitly select `transport: "applescript"` to forward these with Mail.app; no automatic fallback occurs. An intentionally empty plain-text message is still valid.
 
@@ -963,7 +1027,18 @@ List attachments on a message.
 | --------- | ------ | -------- | ----------- |
 | `id`      | string | Yes      | Message ID  |
 
-**Returns:** List of attachments with name, MIME type, and size.
+**Returns:** List of attachments with name, MIME type, and `size` — the **decoded** byte count,
+i.e. what `fetch-attachment` returns.
+
+**Sizes over IMAP.** `BODYSTRUCTURE` reports a part's size in its transfer encoding, so a
+base64 attachment's raw figure is ~4/3 of the file. `list-attachments` converts it: a
+`Content-Disposition` `size=` parameter wins when present; 7bit/8bit/binary parts are exact
+as reported; base64 parts are measured exactly from a short tail of each part (padding and
+line wrap), fetched in one batched `FETCH` for the whole message; quoted-printable parts up
+to 64 KiB are fetched and counted exactly. If a part can't be measured (the probe fails, the
+wrap is irregular, or a quoted-printable part is larger), the size is an estimate within a
+few bytes for base64 — an upper bound for quoted-printable — and the entry carries
+`sizeApproximate: true`. `fetch-attachment` always reports the exact `bytes`.
 
 ---
 

package/build/cli.js

@@ -57841,11 +57841,15 @@ __export(imapClient_exports, {
   MAX_UNSCOPED_SEARCH_DEPTH: () => MAX_UNSCOPED_SEARCH_DEPTH,
   __resetPool: () => __resetPool,
   __setPoolConnect: () => __setPoolConnect,
+  base64DecodedLength: () => base64DecodedLength,
+  base64DecodedSizeFromTail: () => base64DecodedSizeFromTail,
   bodyStructureHasAttachments: () => bodyStructureHasAttachments,
   buildImapConnectionOptions: () => buildImapConnectionOptions,
   decodeImapId: () => decodeImapId,
+  decodedSizeWithoutBody: () => decodedSizeWithoutBody,
   dropAllPools: () => dropAllPools,
   encodeImapId: () => encodeImapId,
+  imapAppendDraft: () => imapAppendDraft,
   imapAppendSentCopy: () => imapAppendSentCopy,
   imapBatchDelete: () => imapBatchDelete,
   imapBatchFlag: () => imapBatchFlag,
@@ -57883,6 +57887,8 @@ __export(imapClient_exports, {
   matchMailbox: () => matchMailbox,
   normalizeMessageId: () => normalizeMessageId,
   omittedNote: () => omittedNote,
+  quotedPrintableDecodedLength: () => quotedPrintableDecodedLength,
+  resolveDraftImapAccount: () => resolveDraftImapAccount,
   resolveImapConfig: () => resolveImapConfig,
   resolveImapConfigs: () => resolveImapConfigs,
   resolveMailboxPath: () => resolveMailboxPath,
@@ -58940,6 +58946,40 @@ async function imapAppendSentCopy(smtpUser, raw, deps = {}) {
     return { attempted: true, success: false, error: errText(e) };
   }
 }
+function resolveDraftImapAccount(account, smtpUser, env = process.env) {
+  const specs = listImapAccountSpecs(env);
+  const why = "Mail.app's AppleScript cannot set In-Reply-To/References on a draft, so a threaded draft is filed over IMAP into the account's Drafts mailbox";
+  if (specs.length === 0) {
+    throw new Error(
+      `${why}, and IMAP is not configured. Configure IMAP, omit inReplyTo/references, or use reply-to-message with send=false. ${SETUP_HINT}`
+    );
+  }
+  let spec;
+  if (account) {
+    spec = specs.find((s) => specMatchesSelector(s, account));
+    if (!spec) {
+      throw new Error(
+        `${why}, and "${account}" is not a configured IMAP account. Configured: ${specs.map((s) => s.accountLabel).join(", ")}.`
+      );
+    }
+  } else {
+    spec = (smtpUser ? specs.find((s) => specMatchesSelector(s, smtpUser)) : void 0) ?? (specs.length === 1 ? specs[0] : void 0);
+    if (!spec) {
+      throw new Error(
+        `${why}; several IMAP accounts are configured, so pass \`account\` to choose one: ${specs.map((s) => s.accountLabel).join(", ")}.`
+      );
+    }
+  }
+  return { label: spec.accountLabel, user: spec.user };
+}
+async function imapAppendDraft(account, raw, deps = {}) {
+  return withClient({ ...deps, account: deps.account ?? account }, async (client, cfg) => {
+    const path3 = await resolveMailboxPath(client, "drafts", "list");
+    const res = await client.append(path3, raw, ["\\Draft", "\\Seen"]);
+    if (!res) throw new Error(`server rejected the APPEND to "${path3}" (IMAP NO/BAD)`);
+    return { mailbox: path3, account: cfg.accountLabel };
+  });
+}
 async function withMailbox(path3, deps, fn) {
   return withClient(deps, async (client) => {
     const lock = await client.getMailboxLock(path3);
@@ -59308,6 +59348,56 @@ async function imapDeleteMessageById(id, deps = {}) {
     }
   });
 }
+function dispositionSize(params) {
+  const raw = params?.size?.trim();
+  return raw && /^\d+$/.test(raw) ? Number(raw) : void 0;
+}
+function base64DecodedLength(body) {
+  const s = typeof body === "string" ? body : body.toString("latin1");
+  const n = s.replace(/[^A-Za-z0-9+/]/g, "").length;
+  return Math.floor(n * 3 / 4);
+}
+function base64DecodedSizeFromTail(total, tail) {
+  if (tail.length >= total) return base64DecodedLength(tail);
+  const s = tail.toString("latin1");
+  const term = s.includes("\r\n") ? "\r\n" : "\n";
+  const segs = s.split(term);
+  if (segs.length < 3) return void 0;
+  let trailing = 0;
+  while (segs.length > 1 && segs[segs.length - 1] === "") {
+    segs.pop();
+    trailing++;
+  }
+  const last = segs[segs.length - 1];
+  const full = segs.slice(1, -1);
+  if (full.length === 0 || !last) return void 0;
+  const L = full[0].length;
+  const alphabet = /^[A-Za-z0-9+/]+$/;
+  if (L === 0 || L % 4 !== 0 || !full.every((l) => l.length === L && alphabet.test(l))) {
+    return void 0;
+  }
+  const m = /^([A-Za-z0-9+/]*)(=*)$/.exec(last);
+  if (!m || m[2].length > 2 || last.length > L) return void 0;
+  const before = total - trailing * term.length - last.length;
+  if (before < 0 || before % (L + term.length) !== 0) return void 0;
+  const chars = before / (L + term.length) * L + last.length;
+  if (chars % 4 !== 0) return void 0;
+  return chars / 4 * 3 - m[2].length;
+}
+function quotedPrintableDecodedLength(body) {
+  const s = (typeof body === "string" ? body : body.toString("latin1")).replace(/=\r?\n/g, "");
+  const escapes = s.match(/=[0-9A-Fa-f]{2}/g)?.length ?? 0;
+  return s.length - escapes * 2;
+}
+function decodedSizeWithoutBody(a) {
+  if (a.declaredSize !== void 0) return { size: a.declaredSize, exact: true };
+  if (a.encoding === "base64") {
+    const chars = a.encodedSize - 2 * Math.floor(a.encodedSize / 78);
+    return { size: Math.floor(chars * 3 / 4), exact: false };
+  }
+  if (a.encoding === "quoted-printable") return { size: a.encodedSize, exact: false };
+  return { size: a.encodedSize, exact: true };
+}
 function collectAttachments(node, out = []) {
   if (!node) return out;
   const filename = node.dispositionParameters?.filename || node.parameters?.name;
@@ -59319,7 +59409,9 @@ function collectAttachments(node, out = []) {
       part: node.part,
       filename: filename || `part-${node.part}`,
       mimeType: node.type || "application/octet-stream",
-      size: node.size ?? 0
+      encodedSize: node.size ?? 0,
+      encoding: (node.encoding || "").toLowerCase().trim(),
+      declaredSize: dispositionSize(node.dispositionParameters)
     });
   }
   for (const child of node.childNodes ?? []) collectAttachments(child, out);
@@ -59340,6 +59432,52 @@ async function streamToBuffer(content, maxBytes) {
   }
   return Buffer.concat(chunks);
 }
+async function resolveDecodedSizes(client, uid, atts) {
+  const out = atts.map(decodedSizeWithoutBody);
+  const probes = [];
+  atts.forEach((a, i) => {
+    if (a.declaredSize !== void 0 || a.encodedSize <= 0) return;
+    if (a.encoding === "base64") {
+      probes.push({ i, start: Math.max(0, a.encodedSize - BASE64_TAIL_WINDOW), kind: "b64" });
+    } else if (a.encoding === "quoted-printable" && a.encodedSize <= QP_EXACT_MAX_BYTES) {
+      probes.push({ i, start: 0, kind: "qp" });
+    }
+  });
+  if (probes.length === 0) return out;
+  let parts;
+  try {
+    const msg = await client.fetchOne(
+      String(uid),
+      {
+        uid: true,
+        bodyParts: probes.map((p) => ({
+          key: atts[p.i].part,
+          start: p.start,
+          maxLength: atts[p.i].encodedSize - p.start
+        }))
+      },
+      { uid: true }
+    );
+    parts = msg ? msg.bodyParts : void 0;
+  } catch {
+    return out;
+  }
+  for (const p of probes) {
+    const a = atts[p.i];
+    const buf = parts?.get(a.part.toLowerCase());
+    if (!buf) continue;
+    let exact;
+    if (p.kind === "qp") {
+      exact = quotedPrintableDecodedLength(buf);
+    } else {
+      const requested = a.encodedSize - p.start;
+      const total = buf.length < requested ? p.start + buf.length : a.encodedSize;
+      exact = base64DecodedSizeFromTail(total, buf);
+    }
+    if (exact !== void 0) out[p.i] = { size: exact, exact: true };
+  }
+  return out;
+}
 async function imapListAttachments(id, deps = {}) {
   const ref = decodeImapId(id);
   if (!ref) return { success: false, error: `Not an IMAP message id: "${id}".` };
@@ -59348,12 +59486,18 @@ async function imapListAttachments(id, deps = {}) {
     if (!msg || !msg.bodyStructure) {
       return { success: false, error: `IMAP message UID ${ref.uid} not found in "${ref.path}".` };
     }
-    const attachments = collectAttachments(msg.bodyStructure).map((a) => ({
-      id: `${id}#${a.part}`,
-      name: a.filename,
-      mimeType: a.mimeType,
-      size: a.size
-    }));
+    const atts = collectAttachments(msg.bodyStructure);
+    const sizes = await resolveDecodedSizes(client, ref.uid, atts);
+    const attachments = atts.map((a, i) => {
+      const info = {
+        id: `${id}#${a.part}`,
+        name: a.filename,
+        mimeType: a.mimeType,
+        size: sizes[i].size
+      };
+      if (!sizes[i].exact) info.sizeApproximate = true;
+      return info;
+    });
     return { success: true, attachments };
   });
 }
@@ -59374,10 +59518,11 @@ async function imapFetchAttachment(id, attachmentName, deps = {}) {
         error: `Attachment "${attachmentName}" not found on UID ${ref.uid}. Available: ${names}.`
       };
     }
-    if (match.size > MAX_IMAP_ATTACHMENT_BYTES) {
+    const expected = decodedSizeWithoutBody(match).size;
+    if (expected > MAX_IMAP_ATTACHMENT_BYTES) {
       return {
         success: false,
-        error: `IMAP attachment "${attachmentName}" is ${match.size} bytes; the maximum is ${MAX_IMAP_ATTACHMENT_BYTES} bytes (25 MiB).`
+        error: `IMAP attachment "${attachmentName}" is ${expected} bytes; the maximum is ${MAX_IMAP_ATTACHMENT_BYTES} bytes (25 MiB).`
       };
     }
     try {
@@ -59565,7 +59710,7 @@ async function imapThread(id, deps = {}, limit = 50) {
     true
   );
 }
-var import_imapflow, IMAP_ENV, defaultConnect, SPECIAL_USE_ALIASES, NOT_DELETED, LARGE_MAILBOX_MESSAGES, FIRST_SEARCH_WINDOW, MAX_WINDOW, MAX_UNSCOPED_SEARCH_DEPTH, ROW_QUERY, ROW_QUERY_NO_STRUCTURE, ROW_QUERY_HEADERS_ONLY, DELETED_MARGIN, poolConnect, pools, connecting, MAX_COMPOSE_SOURCE_BYTES, MAX_RFC822_INLINE_BYTES, MAX_RFC822_FILE_BYTES, HEADER_WINDOW_BYTES, MAIL_FLAG_BITS, imapMarkRead, imapMarkUnread, FALLBACK_TRASH_PATH, imapBatchMarkRead, imapBatchMarkUnread, imapBatchFlag, imapBatchUnflag, imapBatchDelete;
+var import_imapflow, IMAP_ENV, defaultConnect, SPECIAL_USE_ALIASES, NOT_DELETED, LARGE_MAILBOX_MESSAGES, FIRST_SEARCH_WINDOW, MAX_WINDOW, MAX_UNSCOPED_SEARCH_DEPTH, ROW_QUERY, ROW_QUERY_NO_STRUCTURE, ROW_QUERY_HEADERS_ONLY, DELETED_MARGIN, poolConnect, pools, connecting, MAX_COMPOSE_SOURCE_BYTES, MAX_RFC822_INLINE_BYTES, MAX_RFC822_FILE_BYTES, HEADER_WINDOW_BYTES, MAIL_FLAG_BITS, imapMarkRead, imapMarkUnread, FALLBACK_TRASH_PATH, BASE64_TAIL_WINDOW, QP_EXACT_MAX_BYTES, imapBatchMarkRead, imapBatchMarkUnread, imapBatchFlag, imapBatchUnflag, imapBatchDelete;
 var init_imapClient = __esm({
   "src/services/imapClient.ts"() {
     "use strict";
@@ -59670,6 +59815,8 @@ var init_imapClient = __esm({
     imapMarkRead = (id, deps = {}) => flagOp(id, "\\Seen", true, deps);
     imapMarkUnread = (id, deps = {}) => flagOp(id, "\\Seen", false, deps);
     FALLBACK_TRASH_PATH = "Trash";
+    BASE64_TAIL_WINDOW = 1024;
+    QP_EXACT_MAX_BYTES = 64 * 1024;
     imapBatchMarkRead = (ids, deps = {}) => imapBatch(ids, deps, async (c, uids) => {
       assertMutated(
         await c.messageFlagsAdd(uids, ["\\Seen"], { uid: true }),
@@ -59795,6 +59942,27 @@ function buildAttachments(attachments) {
     return { filename: a.filename, content: decodeInlineAttachment(a.contentBase64) };
   });
 }
+function buildMailOptions(opts, from, attachments) {
+  const html = opts.htmlBody?.trim() ? opts.htmlBody : void 0;
+  return {
+    from,
+    to: opts.to,
+    cc: opts.cc,
+    bcc: opts.bcc,
+    subject: opts.subject,
+    text: opts.body,
+    // When present, nodemailer emits multipart/alternative (text + html).
+    html,
+    attachments,
+    // RFC 5322 threading for SMTP replies/forwards (2.5.0). nodemailer treats
+    // In-Reply-To / References as structured msg-id headers and never
+    // RFC 2047-encodes them, however long the id (pinned by a test, #267).
+    inReplyTo: opts.inReplyTo?.trim() || void 0,
+    references: opts.references?.length ? opts.references : void 0,
+    // Reply-To header (2.18.0, issue #220): nodemailer already supports this.
+    replyTo: opts.replyTo?.trim() || void 0
+  };
+}
 async function sendViaSmtp(opts, config, createTransport2 = nodemailer_default.createTransport, appendSentCopy = defaultAppendSentCopy) {
   let cfg;
   try {
@@ -59833,23 +60001,7 @@ async function sendViaSmtp(opts, config, createTransport2 = nodemailer_default.c
     requireTLS,
     auth: { user: cfg.user, pass: cfg.pass }
   });
-  const html = opts.htmlBody?.trim() ? opts.htmlBody : void 0;
-  const mailOptions = {
-    from: requestedFrom || cfg.from,
-    to: opts.to,
-    cc: opts.cc,
-    bcc: opts.bcc,
-    subject: opts.subject,
-    text: opts.body,
-    // When present, nodemailer emits multipart/alternative (text + html).
-    html,
-    attachments,
-    // RFC 5322 threading for SMTP replies/forwards (2.5.0).
-    inReplyTo: opts.inReplyTo?.trim() || void 0,
-    references: opts.references?.length ? opts.references : void 0,
-    // Reply-To header (2.18.0, issue #220): nodemailer already supports this.
-    replyTo: opts.replyTo?.trim() || void 0
-  };
+  const mailOptions = buildMailOptions(opts, requestedFrom || cfg.from, attachments);
   try {
     const info = await transporter.sendMail(mailOptions);
     let copyFields = {};