4ward 0.1.0

package/lambdas/forwarder/src/arc.rs

@@ -0,0 +1,258 @@
+//! Minimal first-hop ARC sealing (RFC 8617 §5) for relayed mail.
+//!
+//! - Only seals when the message carries **no** incoming ARC chain (the SES
+//!   inbound case). Existing chains are left untouched (skip, not fail).
+//! - Pure signing: no DNS, no network. Verification of upstream auth is out
+//!   of scope, so `cv=none` with an all-`none` Authentication-Results.
+//! - Fail-safe direction: a broken seal is ignored by receivers; the mail
+//!   itself is unaffected. Callers must fail **open** (skip sealing on Err).
+
+use base64::{engine::general_purpose::STANDARD as B64, Engine};
+use rsa::pkcs1::DecodeRsaPrivateKey;
+use rsa::pkcs1v15::SigningKey;
+use rsa::signature::{SignatureEncoding, Signer};
+use rsa::RsaPrivateKey;
+use sha2::{Digest, Sha256};
+
+/// Headers covered by the ARC message signature (intersected with present).
+const SIGNED: &[&str] = &[
+    "from",
+    "to",
+    "subject",
+    "date",
+    "message-id",
+    "reply-to",
+    "mime-version",
+    "content-type",
+];
+
+pub fn has_arc_chain(header_section: &str) -> bool {
+    header_section.lines().any(|l| {
+        let name = l.split_once(':').map(|(n, _)| n.trim()).unwrap_or("");
+        name.eq_ignore_ascii_case("arc-seal")
+            || name.eq_ignore_ascii_case("arc-message-signature")
+            || name.eq_ignore_ascii_case("arc-authentication-results")
+    })
+}
+
+fn compress_ws(s: &str) -> String {
+    let mut out = String::with_capacity(s.len());
+    let mut in_ws = false;
+    for c in s.chars() {
+        if c == ' ' || c == '\t' {
+            if !in_ws {
+                out.push(' ');
+                in_ws = true;
+            }
+        } else {
+            out.push(c);
+            in_ws = false;
+        }
+    }
+    out
+}
+
+/// Relaxed header canonicalization (RFC 6376 §3.4.2): lowercase name,
+/// compress WSP, drop trailing WSP. `line` must be a single unfolded header.
+fn relaxed_header(line: &str) -> Option<String> {
+    let (name, value) = line.split_once(':')?;
+    let body = compress_ws(value).trim_end().to_string();
+    // Drop leading WSP too: canonical "name:value" form.
+    let body = body.trim_start().to_string();
+    Some(format!("{}:{body}", name.trim().to_lowercase()))
+}
+
+/// Relaxed body canonicalization (RFC 6376 §3.4.3).
+fn relaxed_body(body: &str) -> String {
+    let lines: Vec<&str> = body.split('\n').collect();
+    let mut end = lines.len();
+    while end > 0 && lines[end - 1].trim_end_matches([' ', '\t', '\r']).is_empty() {
+        end -= 1;
+    }
+    lines[..end]
+        .iter()
+        .map(|l| l.trim_end_matches([' ', '\t', '\r']))
+        .collect::<Vec<_>>()
+        .join("\r\n")
+}
+
+fn split_headers_body(message: &str) -> (String, String) {
+    let norm = message.replace("\r\n", "\n").replace('\r', "\n");
+    match norm.split_once("\n\n") {
+        Some((h, b)) => (h.to_string(), b.to_string()),
+        None => (norm, String::new()),
+    }
+}
+
+/// Unfold continuation lines, preserving order. Returns (lower_name, full_line).
+fn unfolded_headers(header_section: &str) -> Vec<(String, String)> {
+    let mut out = Vec::new();
+    let mut cur = String::new();
+    for line in header_section.lines() {
+        if line.starts_with([' ', '\t']) && !cur.is_empty() {
+            cur.push(' ');
+            cur.push_str(line.trim());
+        } else {
+            if !cur.is_empty() {
+                let name = cur.split_once(':').map(|(n, _)| n.trim().to_lowercase()).unwrap_or_default();
+                out.push((name, cur.clone()));
+            }
+            cur = line.to_string();
+        }
+    }
+    if !cur.is_empty() {
+        let name = cur.split_once(':').map(|(n, _)| n.trim().to_lowercase()).unwrap_or_default();
+        out.push((name, cur));
+    }
+    out
+}
+
+fn fold_b64(prefix: &str, b64: &str) -> String {
+    // Fold long base64 across continuation lines (unfolds losslessly).
+    let mut s = String::from(prefix);
+    for (i, chunk) in b64.as_bytes().chunks(64).enumerate() {
+        if i > 0 {
+            s.push_str("\r\n ");
+        }
+        s.push_str(std::str::from_utf8(chunk).unwrap_or(""));
+    }
+    s
+}
+
+fn parse_rsa(pem: &str) -> Result<RsaPrivateKey, String> {
+    if pem.contains("BEGIN RSA PRIVATE KEY") {
+        RsaPrivateKey::from_pkcs1_pem(pem).map_err(|e| format!("pkcs1 parse: {e}"))
+    } else {
+        use rsa::pkcs8::DecodePrivateKey;
+        RsaPrivateKey::from_pkcs8_pem(pem).map_err(|e| format!("pkcs8 parse: {e}"))
+    }
+}
+
+/// Seal a fully-built relayed message. Returns the ARC header block
+/// (trailing CRLF included) to **prepend** to `message`.
+pub fn seal_first_hop(
+    message: &[u8],
+    authserv_id: &str,
+    seal_domain: &str,
+    selector: &str,
+    private_pem: &str,
+    now_unix: u64,
+) -> Result<String, String> {
+    if selector.trim().is_empty() || seal_domain.trim().is_empty() {
+        return Err("selector/domain required".into());
+    }
+    let text = String::from_utf8_lossy(message);
+    let (headers, body) = split_headers_body(&text);
+    if has_arc_chain(&headers) {
+        return Err("incoming ARC chain present; only first-hop sealing supported".into());
+    }
+    let hdrs = unfolded_headers(&headers);
+    if !hdrs.iter().any(|(n, _)| n == "from") {
+        return Err("no From header to seal".into());
+    }
+    let cover: Vec<String> = SIGNED
+        .iter()
+        .filter(|n| hdrs.iter().any(|(h, _)| h == **n))
+        .map(|s| s.to_string())
+        .collect();
+    let h_tag = cover.join(":");
+
+    let bh = B64.encode(Sha256::digest(relaxed_body(&body)));
+
+    let aar = format!(
+        "ARC-Authentication-Results: i=1; {authserv_id}; spf=none; dkim=none; dmarc=none"
+    );
+    let ams_unsigned = format!(
+        "ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d={seal_domain}; s={selector}; t={now_unix}; h={h_tag}; bh={bh}; b="
+    );
+
+    let key = parse_rsa(private_pem)?;
+    let signer = SigningKey::<Sha256>::new(key);
+
+    // AMS signs covered headers + itself (b= empty).
+    let mut ams_input = Vec::new();
+    for name in &cover {
+        let line = hdrs.iter().rev().find(|(h, _)| h == name).and_then(|(_, l)| relaxed_header(l)).ok_or("header vanished")?;
+        ams_input.extend_from_slice(line.as_bytes());
+        ams_input.extend_from_slice(b"\r\n");
+    }
+    let ams_relaxed = relaxed_header(&ams_unsigned).ok_or("ams malformed")?;
+    ams_input.extend_from_slice(ams_relaxed.as_bytes());
+    ams_input.extend_from_slice(b"\r\n");
+    let ams_sig = signer.sign(&Sha256::digest(&ams_input));
+    let ams_full = fold_b64(&ams_unsigned, &B64.encode(ams_sig.to_vec()));
+
+    // Seal signs seal(empty) + AMS + AAR, in that order.
+    let seal_unsigned = format!(
+        "ARC-Seal: i=1; a=rsa-sha256; cv=none; d={seal_domain}; s={selector}; t={now_unix}; b="
+    );
+    let mut seal_input = Vec::new();
+    for h in [&seal_unsigned, &ams_full, &aar] {
+        let r = relaxed_header(&h.replace("\r\n ", " ")).ok_or("seal input malformed")?;
+        seal_input.extend_from_slice(r.as_bytes());
+        seal_input.extend_from_slice(b"\r\n");
+    }
+    let seal_sig = signer.sign(&Sha256::digest(&seal_input));
+    let seal_full = fold_b64(&seal_unsigned, &B64.encode(seal_sig.to_vec()));
+
+    Ok(format!("{seal_full}\r\n{ams_full}\r\n{aar}\r\n"))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use rsa::pkcs1v15::VerifyingKey;
+    use rsa::signature::Verifier;
+
+    fn test_key() -> RsaPrivateKey {
+        RsaPrivateKey::new(&mut rand::thread_rng(), 1024).unwrap()
+    }
+
+    fn pem(key: &RsaPrivateKey) -> String {
+        use rsa::pkcs1::EncodeRsaPrivateKey;
+        key.to_pkcs1_pem(rsa::pkcs1::LineEnding::LF).unwrap().to_string()
+    }
+
+    const MSG: &str = "From: Alice <alice@example.org>\r\nTo: you@gmail.com\r\nSubject: hi\r\nDate: Thu, 01 Jan 2026 00:00:00 +0000\r\nContent-Type: text/plain\r\n\r\nHello\r\n";
+
+    #[test]
+    fn seals_and_verifies() {
+        let key = test_key();
+        let block = seal_first_hop(MSG.as_bytes(), "relay.example.com", "example.com", "fw1", &pem(&key), 1767225600).unwrap();
+        assert!(block.contains("ARC-Seal: i=1"), "seal header:\n{block}");
+        assert!(block.contains("ARC-Message-Signature: i=1"), "ams header");
+        assert!(block.contains("ARC-Authentication-Results: i=1"), "aar header");
+        assert!(block.contains("cv=none"), "first hop cv");
+
+        // Independently verify the AMS signature over the same inputs.
+        let unfolded_block = block.replace("\r\n ", " ");
+        let ams = unfolded_block.lines().find(|l| l.starts_with("ARC-Message-Signature:")).unwrap();
+        let b_pos = ams.find("; b=").unwrap();
+        let ams_empty = format!("{}; b=", &ams[..b_pos]);
+        let (headers, _) = split_headers_body(MSG);
+        let hdrs = unfolded_headers(&headers);
+        let mut input = Vec::new();
+        for n in ["from", "to", "subject", "date", "content-type"] {
+            let l = hdrs.iter().rev().find(|(h, _)| h == n).and_then(|(_, l)| relaxed_header(l)).unwrap();
+            input.extend_from_slice(l.as_bytes());
+            input.extend_from_slice(b"\r\n");
+        }
+        input.extend_from_slice(relaxed_header(&ams_empty).unwrap().as_bytes());
+        input.extend_from_slice(b"\r\n");
+        let sig_b64: String = ams[b_pos + 4..].split_whitespace().collect();
+        let sig = rsa::pkcs1v15::Signature::try_from(B64.decode(sig_b64).unwrap().as_slice()).unwrap();
+        VerifyingKey::<Sha256>::new(key.to_public_key()).verify(&Sha256::digest(&input), &sig).unwrap();
+    }
+
+    #[test]
+    fn skips_existing_chain() {
+        let chained = format!("ARC-Seal: i=1; cv=none; b=abc\r\n{MSG}");
+        let key = test_key();
+        assert!(seal_first_hop(chained.as_bytes(), "r", "d", "s", &pem(&key), 0).is_err());
+    }
+
+    #[test]
+    fn rejects_bad_key() {
+        assert!(seal_first_hop(MSG.as_bytes(), "r", "d", "s", "not-a-key", 0).is_err());
+    }
+}

package/lambdas/forwarder/src/main.rs

@@ -0,0 +1,369 @@
+use aws_lambda_events::event::s3::S3Event;
+use lambda_runtime::{service_fn, Error, LambdaEvent};
+use mail_builder::MessageBuilder;
+use mail_builder::headers::text::Text;
+use mail_parser::{MessageParser, MimeHeaders};
+use std::collections::HashMap;
+
+pub mod arc;
+
+/// Env-driven routing. Keep the Lambda itself stateless:
+/// - `RELAY_DOMAIN`: verified SES identity, e.g. `example.com` (From: relay@domain)
+/// - `ALIAS_MAP_JSON`: `{"support@example.com": ["you@gmail.com"], ...}`
+/// - `CATCH_ALL`: optional fallback destination
+/// - `BANNER_ENABLED`: "true"/"false"
+/// - `LOOP_SALT`: salt for loop-detection hash (defaults to relay domain)
+/// - `CONFIG_SET`: SES configuration set (bounce/complaint tracking)
+/// - `ARC_SELECTOR` + `ARC_PRIVATE_KEY`: first-hop ARC seal RSA PEM (absent = skip)
+pub const LOOP_HEADER: &str = "X-4ward-Loop-Detection";
+
+pub fn loop_hash(domain: &str, salt: &str) -> String {
+    // ponytail: djb2 hex, std-only; swap for HMAC if spoofing matters
+    let mut h: u64 = 5381;
+    for b in format!("{salt}:{domain}").bytes() {
+        h = h.wrapping_mul(33).wrapping_add(b as u64);
+    }
+    format!("{h:016x}")
+}
+
+pub fn is_loop(headers_raw: &str, expected_hash: &str) -> bool {
+    headers_raw.lines().any(|l| {
+        let lt = l.trim();
+        lt.len() > LOOP_HEADER.len()
+            && lt[..LOOP_HEADER.len()].eq_ignore_ascii_case(LOOP_HEADER)
+            && lt[LOOP_HEADER.len()..].contains(expected_hash)
+    })
+}
+
+pub fn split_alias(recipient: &str) -> Option<(String, String)> {
+    let r = recipient.trim().trim_matches(|c| c == '<' || c == '>').trim();
+    let (_, addr) = parse_address(r);
+    let (user, domain) = addr.split_once('@')?;
+    Some((user.to_lowercase(), domain.to_lowercase()))
+}
+
+fn parse_address(s: &str) -> (String, String) {
+    // "Name <addr@dom>" -> ("Name", "addr@dom"); bare addr -> ("", addr).
+    // Tolerates a missing closing '>' (e.g. after trimming).
+    if let Some(a) = s.rfind('<') {
+        let addr = s[a + 1..].trim_end_matches('>').trim();
+        if addr.contains('@') {
+            let name = s[..a].trim().trim_matches('"').trim().to_string();
+            return (name, addr.to_string());
+        }
+    }
+    (String::new(), s.trim().to_string())
+}
+
+fn alias_map() -> HashMap<String, Vec<String>> {
+    std::env::var("ALIAS_MAP_JSON")
+        .ok()
+        .and_then(|s| serde_json::from_str(&s).ok())
+        .unwrap_or_default()
+}
+
+pub fn resolve_destinations(alias: &str, domain: &str) -> Vec<String> {
+    let map = alias_map();
+    let key = format!("{alias}@{domain}");
+    if let Some(v) = map.get(&key) {
+        return v.clone();
+    }
+    // case-insensitive fallback
+    for (k, v) in &map {
+        if k.eq_ignore_ascii_case(&key) {
+            return v.clone();
+        }
+    }
+    std::env::var("CATCH_ALL").ok().filter(|s| !s.is_empty()).map(|s| vec![s]).unwrap_or_default()
+}
+
+pub fn banner_enabled() -> bool {
+    std::env::var("BANNER_ENABLED").map(|v| v != "false" && v != "0").unwrap_or(true)
+}
+
+pub fn banner_html(alias: &str, domain: &str, dest: &str, original: &str) -> String {
+    format!(
+        "<div style=\"background:#f4f4f5;padding:8px;font-size:12px;border-radius:4px;color:#333;margin-bottom:12px;\">\n  Forwarded by 4ward from <b>{alias}@{domain}</b> to <b>{dest}</b>. Original sender: <b>{original}</b>\n</div>"
+    )
+}
+
+pub fn banner_text(alias: &str, domain: &str, dest: &str, original: &str) -> String {
+    format!("Forwarded by 4ward from {alias}@{domain} to {dest}. Original sender: {original}\n\n")
+}
+
+pub struct ForwardPlan {
+    pub alias: String,
+    pub domain: String,
+    pub destinations: Vec<String>,
+    pub original_from: String,
+    pub original_from_name: String,
+    pub original_to: String,
+    pub subject: String,
+    pub loop_value: String,
+}
+
+/// Drop mail SES flagged as spam or virus: relaying it burns SES reputation.
+pub fn is_filtered(raw: &[u8]) -> bool {
+    let text = String::from_utf8_lossy(raw).replace("\r\n", "\n");
+    let headers = text.split("\n\n").next().unwrap_or("");
+    headers.lines().any(|l| {
+        match l.split_once(':') {
+            Some((n, v)) if n.trim().eq_ignore_ascii_case("X-SES-Spam-Verdict") => v.contains("FAIL"),
+            Some((n, v)) if n.trim().eq_ignore_ascii_case("X-SES-Virus-Verdict") => v.contains("FAIL"),
+            _ => false,
+        }
+    })
+}
+
+/// Pure planning step — easy to unit test without AWS.
+pub fn plan_forward(raw: &[u8], relay_domain: &str, loop_salt: &str) -> Result<Option<ForwardPlan>, String> {
+    let raw_str = String::from_utf8_lossy(raw);
+    let expected = loop_hash(relay_domain, loop_salt);
+    // Fast header-section scan for loop marker before full parse.
+    let header_section = raw_str.split("\r\n\r\n").next().unwrap_or(&raw_str).to_string();
+    let header_section = if header_section.contains('\n') && !header_section.contains("\r\n") {
+        header_section.replace('\n', "\r\n")
+    } else {
+        header_section
+    };
+    if is_loop(&header_section, &expected) {
+        return Ok(None);
+    }
+    let msg = MessageParser::default().parse(raw).ok_or("mime parse failed")?;
+    let from = msg.from().and_then(|a| a.first()).map(|a| {
+        (
+            a.name().unwrap_or("").to_string(),
+            a.address().unwrap_or("").to_string(),
+        )
+    }).unwrap_or_default();
+    let to = msg.to().and_then(|a| a.first()).map(|a| a.address().unwrap_or("").to_string()).unwrap_or_default();
+    let (alias, domain) = split_alias(&to).ok_or("no routable To header")?;
+    let destinations = resolve_destinations(&alias, &domain);
+    if destinations.is_empty() {
+        return Err("no route for recipient and no catch-all".into());
+    }
+    Ok(Some(ForwardPlan {
+        alias,
+        domain,
+        destinations,
+        original_from: from.1,
+        original_from_name: from.0,
+        original_to: to,
+        subject: msg.subject().unwrap_or("").to_string(),
+        loop_value: expected,
+    }))
+}
+
+/// Build the relayed raw MIME, preserving text/html + attachments.
+pub fn build_forwarded_raw(raw: &[u8], plan: &ForwardPlan, relay_domain: &str) -> Result<Vec<u8>, String> {
+    let msg = MessageParser::default().parse(raw).ok_or("mime parse failed")?;
+    let dest0 = plan.destinations.first().cloned().unwrap_or_default();
+    let from_name = if plan.original_from_name.trim().is_empty() {
+        plan.alias.clone()
+    } else {
+        plan.original_from_name.clone()
+    };
+    let relay_from = format!("relay@{relay_domain}");
+    let display_from = format!("{from_name} (via {})", plan.alias);
+
+    let text_body = msg.body_text(0).map(|b| b.to_string());
+    let html_body = msg.body_html(0).map(|b| b.to_string());
+
+    let (text_out, html_out) = if banner_enabled() {
+        let bt = banner_text(&plan.alias, &plan.domain, &dest0, &plan.original_from);
+        let bh = banner_html(&plan.alias, &plan.domain, &dest0, &plan.original_from);
+        (
+            text_body.map(|b| format!("{bt}{b}")),
+            html_body.map(|b| format!("{bh}{b}")),
+        )
+    } else {
+        (text_body, html_body)
+    };
+
+    let mut builder = MessageBuilder::new()
+        .from((display_from.as_str(), relay_from.as_str()))
+        .reply_to(plan.original_from.as_str())
+        .to(plan.destinations.iter().map(|s| s.as_str()).collect::<Vec<_>>())
+        .subject(plan.subject.as_str())
+        .header("X-Original-From", Text::new(plan.original_from.as_str()))
+        .header("X-Original-To", Text::new(plan.original_to.as_str()))
+        .header("X-4ward-Relay", Text::new("true"))
+        .header(LOOP_HEADER, Text::new(plan.loop_value.as_str()));
+
+    if let Some(t) = text_out.as_deref() {
+        builder = builder.text_body(t);
+    }
+    if let Some(h) = html_out.as_deref() {
+        builder = builder.html_body(h);
+    }
+    if text_out.is_none() && html_out.is_none() {
+        builder = builder.text_body("(empty message forwarded by 4ward)");
+    }
+    // Re-attach original attachments (retention, not transformation).
+    // ponytail: generic content-type; sniff real type per part if clients need it
+    let atts: Vec<(String, Vec<u8>)> = msg
+        .attachments()
+        .map(|att| {
+            (
+                att.attachment_name().unwrap_or("attachment.bin").to_string(),
+                att.contents().to_vec(),
+            )
+        })
+        .collect();
+    for (name, bytes) in &atts {
+        builder = builder.attachment("application/octet-stream", name.as_str(), bytes.as_slice());
+    }
+
+    builder.write_to_vec().map_err(|e| e.to_string())
+}
+
+async fn handle(event: LambdaEvent<S3Event>) -> Result<(), Error> {
+    let relay_domain = std::env::var("RELAY_DOMAIN").unwrap_or_default();
+    let loop_salt = std::env::var("LOOP_SALT").unwrap_or_else(|_| relay_domain.clone());
+    if relay_domain.is_empty() {
+        tracing::warn!("RELAY_DOMAIN unset, skipping");
+        return Ok(());
+    }
+    let config = aws_config::load_defaults(aws_config::BehaviorVersion::latest()).await;
+    let s3 = aws_sdk_s3::Client::new(&config);
+    let ses = aws_sdk_sesv2::Client::new(&config);
+
+    for record in event.payload.records {
+        let bucket = record.s3.bucket.name.unwrap_or_default();
+        let key = record.s3.object.key.unwrap_or_default();
+        tracing::info!(bucket = %bucket, key = %key, "fetching raw mime from s3");
+        let obj = s3.get_object().bucket(&bucket).key(&key).send().await?;
+        let bytes = obj.body.collect().await?.into_bytes().to_vec();
+
+        let plan = plan_forward(&bytes, &relay_domain, &loop_salt).map_err(|e| format!("plan: {e}"))?;
+        let plan = match plan {
+            None => {
+                tracing::warn!("loop header matched, dropping");
+                continue;
+            }
+            Some(p) => p,
+        };
+        if is_filtered(&bytes) {
+            tracing::warn!("ses spam/virus verdict FAIL, dropping (reputation protection)");
+            continue;
+        }
+        let mut raw = build_forwarded_raw(&bytes, &plan, &relay_domain).map_err(|e| format!("build: {e}"))?;
+        // First-hop ARC seal (fail-open: skip on any error, mail still flows).
+        let arc_sel = std::env::var("ARC_SELECTOR").ok().filter(|s| !s.trim().is_empty());
+        let arc_pem = std::env::var("ARC_PRIVATE_KEY").ok().filter(|s| !s.trim().is_empty());
+        if let (Some(sel), Some(pem)) = (arc_sel, arc_pem) {
+            let now = std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).map(|d| d.as_secs()).unwrap_or(0);
+            match arc::seal_first_hop(&raw, &relay_domain, &relay_domain, &sel, &pem, now) {
+                Ok(block) => {
+                    let mut sealed = block.into_bytes();
+                    sealed.extend_from_slice(&raw);
+                    raw = sealed;
+                }
+                Err(e) => tracing::warn!(error = %e, "arc seal skipped"),
+            }
+        }
+        let relay_from = format!("relay@{relay_domain}");
+        let config_set = std::env::var("CONFIG_SET").ok().filter(|s| !s.trim().is_empty());
+        ses.send_email()
+            .from_email_address(&relay_from)
+            .set_configuration_set_name(config_set)
+            .set_destination(Some(
+                aws_sdk_sesv2::types::Destination::builder()
+                    .set_to_addresses(Some(plan.destinations.clone()))
+                    .build(),
+            ))
+            .content(
+                aws_sdk_sesv2::types::EmailContent::builder()
+                    .raw(aws_sdk_sesv2::types::RawMessage::builder().data(aws_sdk_sesv2::primitives::Blob::new(raw)).build().map_err(|e| format!("raw: {e}"))?)
+                    .build(),
+            )
+            .send()
+            .await?;
+        tracing::info!(to = ?plan.destinations, "relayed via sesv2");
+    }
+    Ok(())
+}
+
+#[tokio::main]
+async fn main() -> Result<(), Error> {
+    tracing_subscriber::fmt()
+        .with_env_filter(tracing_subscriber::EnvFilter::from_default_env())
+        .json()
+        .init();
+    lambda_runtime::run(service_fn(handle)).await
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    const PLAIN: &[u8] = b"From: Alice <alice@example.org>\r\nTo: support@relay.example.com\r\nSubject: hello\r\nContent-Type: text/plain; charset=utf-8\r\n\r\nHi there";
+    const HTML: &[u8] = b"From: Bob <bob@example.org>\r\nTo: sales@relay.example.com\r\nSubject: hi html\r\nContent-Type: text/html; charset=utf-8\r\n\r\n<p>Hi <b>there</b></p>";
+
+    fn multipart_fixture() -> Vec<u8> {
+        let boundary = "BOUNDARY123";
+        format!(
+            "From: Carol <carol@example.org>\r\nTo: info@relay.example.com\r\nSubject: with file\r\nMIME-Version: 1.0\r\nContent-Type: multipart/mixed; boundary=\"{boundary}\"\r\n\r\n--{boundary}\r\nContent-Type: text/plain\r\n\r\nsee attached\r\n--{boundary}\r\nContent-Type: application/pdf; name=\"document.pdf\"\r\nContent-Transfer-Encoding: base64\r\nContent-Disposition: attachment; filename=\"document.pdf\"\r\n\r\nJVBERi0xLjQK\r\n--{boundary}--\r\n"
+        ).into_bytes()
+    }
+
+    #[test]
+    fn spam_verdict_drops() {
+        let bad = b"From: a@b.c\r\nTo: x@y.z\r\nX-SES-Spam-Verdict: FAIL\r\nSubject: t\r\n\r\nbody";
+        assert!(is_filtered(bad));
+        let virus = b"From: a@b.c\r\nTo: x@y.z\r\nX-SES-Virus-Verdict: FAIL\r\nSubject: t\r\n\r\nbody";
+        assert!(is_filtered(virus));
+        let good = b"From: a@b.c\r\nTo: x@y.z\r\nX-SES-Spam-Verdict: PASS\r\nSubject: t\r\n\r\nbody";
+        assert!(!is_filtered(good));
+        assert!(!is_filtered(PLAIN));
+    }
+
+    #[test]
+    fn loop_detection_trips() {
+        let h = loop_hash("example.com", "example.com");
+        let raw = format!("From: a@b.c\r\nTo: x@y.z\r\n{LOOP_HEADER}: {h}\r\nSubject: t\r\n\r\nbody");
+        assert!(plan_forward(raw.as_bytes(), "example.com", "example.com").unwrap().is_none());
+    }
+
+    #[test]
+    fn splits_alias() {
+        assert_eq!(split_alias("\"Support\" <Support@Example.COM>").unwrap(), ("support".into(), "example.com".into()));
+    }
+
+    #[test]
+    fn rebuild_plain_keeps_body_and_audit_headers() {
+        let relay = "example.com";
+        let plan = ForwardPlan {
+            alias: "support".into(), domain: "relay.example.com".into(),
+            destinations: vec!["you@gmail.com".into()],
+            original_from: "alice@example.org".into(), original_from_name: "Alice".into(),
+            original_to: "support@relay.example.com".into(), subject: "hello".into(),
+            loop_value: loop_hash(relay, relay),
+        };
+        let raw = build_forwarded_raw(PLAIN, &plan, relay).unwrap();
+        let s = String::from_utf8_lossy(&raw);
+        assert!(s.contains("Hi there"), "body preserved");
+        assert!(s.contains("X-Original-From"), "audit header");
+        assert!(s.contains("X-4ward-Relay"), "relay marker");
+        assert!(s.contains(LOOP_HEADER), "loop header");
+        assert!(s.contains("reply-to") || s.contains("Reply-To"), "reply-to set");
+        assert!(s.contains("Forwarded by 4ward"), "banner injected");
+    }
+
+    #[test]
+    fn rebuild_html_banner_and_attachment_retained() {
+        let relay = "example.com";
+        let plan = ForwardPlan {
+            alias: "info".into(), domain: "relay.example.com".into(),
+            destinations: vec!["you@gmail.com".into()],
+            original_from: "carol@example.org".into(), original_from_name: "Carol".into(),
+            original_to: "info@relay.example.com".into(), subject: "with file".into(),
+            loop_value: loop_hash(relay, relay),
+        };
+        let raw = build_forwarded_raw(&multipart_fixture(), &plan, relay).unwrap();
+        let s = String::from_utf8_lossy(&raw);
+        assert!(s.contains("document.pdf"), "attachment retained, got:\n{s}");
+        assert!(s.contains("X-Original-To"), "audit header");
+        let _ = HTML;
+    }
+}

package/package.json

@@ -0,0 +1,50 @@
+{
+  "name": "4ward",
+  "version": "0.1.0",
+  "description": "Serverless email infrastructure for AWS in Rust",
+  "license": "Apache-2.0",
+  "author": "tljohnsilver <tljohnsilver@users.noreply.github.com>",
+  "homepage": "https://github.com/tljohnsilver/4ward#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/tljohnsilver/4ward.git"
+  },
+  "bugs": {
+    "url": "https://github.com/tljohnsilver/4ward/issues"
+  },
+  "keywords": [
+    "aws",
+    "ses",
+    "email",
+    "email-forwarding",
+    "transactional-email",
+    "serverless",
+    "lambda",
+    "rust",
+    "srs",
+    "arc",
+    "spf",
+    "dmarc",
+    "api-gateway"
+  ],
+  "bin": {
+    "4ward": "./bin/run.js"
+  },
+  "files": [
+    "bin/",
+    "scripts/",
+    "crates/",
+    "lambdas/",
+    "docs/assets/",
+    "Cargo.toml",
+    "Cargo.lock"
+  ],
+  "scripts": {
+    "postinstall": "node ./scripts/install-binary.js"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "os": ["darwin", "linux", "win32"],
+  "cpu": ["x64", "arm64"]
+}