@blamejs/blamejs-shop 0.4.30 → 0.4.32

package/lib/vendor/blamejs/lib/mail-auth.js

@@ -2090,6 +2090,239 @@ function authResultsEmit(opts) {
   return "Authentication-Results: " + head + ";\r\n  " + clauses.join(sep);
 }
 
+// ---- Inbound message-authentication pipeline (RFC 7489 §6.6) ----
+//
+// One call runs the receiver-side authentication set on a message as it
+// arrives: SPF (RFC 7208) on the envelope identity, DKIM (RFC 6376) on
+// the message bytes, DMARC (RFC 7489 / DMARCbis) policy + alignment on
+// the From-header domain, and — when an authserv-id is supplied — the
+// RFC 8601 Authentication-Results header the receiver prepends before
+// delivery. b.mail.server.mx composes this at DATA time via its
+// guardEnvelope opt; operators running their own listeners (or doing
+// post-delivery verification in an agent) call it directly:
+//
+//   var v = await b.mail.inbound.verify({
+//     ip:         "203.0.113.5",
+//     helo:       "mail.sender.example",
+//     mailFrom:   "bounce@sender.example",
+//     message:    rfc5322Bytes,                  // string or Buffer
+//     authservId: "mx.example.com",
+//   });
+//   // → { spf, dkim, from, dmarc, authResults }
+//   if (v.dmarc.recommendedAction === "reject") { /* refuse 550 5.7.1 */ }
+//
+// From-header discipline (RFC 7489 §6.6.1): DMARC evaluates exactly one
+// author domain. A message with zero From fields, several From fields,
+// or several author addresses in one field is the header-duplication
+// spoofing shape — an attacker pairs an aligned-but-hidden From with the
+// one the mail client displays (the CVE-2024-7208 / CVE-2024-7209
+// hosted-relay spoofing class rides on exactly this ambiguity). Those
+// messages return `dmarc.result: "permerror"` with
+// `recommendedAction: "reject"` instead of picking one of the Froms.
+
+// RFC 5322 §2.1 — the header block ends at the first empty line. SMTP
+// wire format is CRLF; bare-LF input is accepted defensively for
+// operator-fed strings that lost CRs in their own tooling.
+function _splitHeaderBlock(message) {
+  var idx = message.indexOf("\r\n\r\n");
+  if (idx !== -1) return { headers: message.slice(0, idx), body: message.slice(idx + 4) };
+  idx = message.indexOf("\n\n");
+  if (idx !== -1) return { headers: message.slice(0, idx), body: message.slice(idx + 2) };
+  return { headers: message, body: "" };
+}
+
+// Quote-aware single pass over a From field value (RFC 5322 phrase
+// quoting): counts angle-addr pairs that contain an `@` (a `<` inside
+// a quoted-string is display-name text — `"John <Jr.> Smith" <u@d>`
+// is one author, not two) and top-level commas (address-list
+// separators; a comma inside a quoted display-name like
+// `"Doe, John" <j@d>` does not count). Records the content of the
+// last @-bearing angle-addr for extraction.
+function _countFromAuthors(value) {
+  var inQuote = false, inAngle = false, escaped = false;
+  var angleAddrs = 0, topCommas = 0, angleStart = -1;
+  var lastAddr = null;
+  for (var i = 0; i < value.length; i += 1) {
+    var ch = value.charAt(i);
+    if (escaped) { escaped = false; continue; }
+    if (ch === "\\") { escaped = true; continue; }
+    if (ch === "\"" && !inAngle) { inQuote = !inQuote; continue; }
+    if (inQuote) continue;
+    if (ch === "<" && !inAngle) { inAngle = true; angleStart = i; continue; }
+    if (ch === ">" && inAngle) {
+      inAngle = false;
+      var inner = value.slice(angleStart + 1, i).trim();
+      if (inner.indexOf("@") !== -1) { angleAddrs += 1; lastAddr = inner; }
+      continue;
+    }
+    if (ch === "," && !inAngle) topCommas += 1;
+  }
+  return { angleAddrs: angleAddrs, topCommas: topCommas, lastAddr: lastAddr };
+}
+
+// Unfold (RFC 5322 §2.2.3), collect every From: field, and extract the
+// author address. `count` is the number of From fields, widened by
+// multiple-author detection inside a single field: several @-bearing
+// angle-addrs, or a bare address-list separated by top-level commas
+// (RFC 7489 §6.6.1 — a multi-author From is the header-duplication
+// spoofing shape and must not have "one" author picked from it).
+function _extractFromHeaders(headerBlock) {
+  var unfolded = headerBlock.replace(/\r?\n[ \t]+/g, " ");
+  var lines = unfolded.split(/\r?\n/);
+  var fromValues = [];
+  for (var i = 0; i < lines.length; i += 1) {
+    var m = /^From[ \t]*:(.*)$/i.exec(lines[i]);
+    if (m) fromValues.push(m[1].trim());
+  }
+  if (fromValues.length === 0) return { count: 0, address: null, domain: null };
+  var count = fromValues.length;
+  var value = fromValues[0];
+  var authors = _countFromAuthors(value);
+  if (count === 1) {
+    if (authors.angleAddrs > 1) count = authors.angleAddrs;
+    else if (authors.topCommas > 0) count = authors.topCommas + 1;
+  }
+  var address;
+  if (authors.angleAddrs >= 1) {
+    // count > 1 is refused by the caller before the address is used;
+    // for the single-author case this is that author's angle-addr.
+    address = authors.lastAddr;
+  } else {
+    // Bare addr-spec form. An RFC 5322 addr-spec cannot contain
+    // whitespace or commas — their presence means an address list or
+    // display-name soup; extracting "the" domain from it would pick
+    // one of several authors (the §6.6.1 forbidden move), so the
+    // field is treated as unparsable instead.
+    address = value.trim();
+    if (/[\s,]/.test(address)) address = null;
+  }
+  var at = address ? address.lastIndexOf("@") : -1;
+  var domain = (at > 0 && address && at < address.length - 1)
+    ? address.slice(at + 1).toLowerCase()
+    : null;
+  return { count: count, address: address || null, domain: domain };
+}
+
+async function inboundVerify(opts) {
+  validateOpts.requireObject(opts, "inbound.verify", MailAuthError, "mail-auth/inbound-bad-input");
+  validateOpts(opts, ["ip", "helo", "mailFrom", "message", "dnsLookup", "domainExists",
+                       "maxSignatures", "clockSkewMs", "minRsaBits", "authservId"],
+               "mail.inbound.verify");
+  validateOpts.requireNonEmptyString(opts.ip, "inbound.verify: ip",
+    MailAuthError, "mail-auth/inbound-bad-ip");
+  if (opts.authservId !== undefined && opts.authservId !== null) {
+    validateOpts.requireNonEmptyString(opts.authservId, "inbound.verify: authservId",
+      MailAuthError, "mail-auth/inbound-bad-authserv-id");
+  }
+  var message = opts.message;
+  if (Buffer.isBuffer(message)) {
+    // DKIM canonicalization re-encodes the string form as UTF-8
+    // (lib/mail-dkim.js hashes Buffer.from(canonicalized, "utf8")), so
+    // the byte→string decode must be utf8 for valid-UTF-8 content to
+    // round-trip exactly. Non-UTF-8 8-bit content cannot survive any
+    // decode + utf8 re-encode; such messages verify as DKIM fail and
+    // DMARC falls back to the SPF identity (RFC 7489 §4.2 — one
+    // aligned authenticator is sufficient to pass).
+    message = message.toString("utf8");
+  }
+  if (typeof message !== "string" || message.length === 0) {
+    throw new MailAuthError("mail-auth/inbound-bad-message",
+      "inbound.verify: message must be a non-empty string or Buffer (the full RFC 5322 message)");
+  }
+  var mailFrom = (typeof opts.mailFrom === "string" && opts.mailFrom.length > 0) ? opts.mailFrom : null;
+  var helo     = (typeof opts.helo === "string" && opts.helo.length > 0) ? opts.helo : null;
+
+  // SPF — envelope identity: MAIL FROM, falling back to HELO for the
+  // null reverse-path (RFC 7208 §2.4). DNS failures surface as the
+  // RFC's temperror result, not as throws.
+  var spf;
+  if (mailFrom || helo) {
+    spf = await spfVerify({
+      ip:        opts.ip,
+      mailFrom:  mailFrom || undefined,
+      helo:      helo || undefined,
+      dnsLookup: opts.dnsLookup,
+    });
+  } else {
+    spf = { result: "none", domain: null,
+            explanation: "no MAIL FROM or HELO identity supplied", lookupCount: 0 };
+  }
+
+  // DKIM — every signature on the message (bounded by maxSignatures;
+  // a signature-less message verifies as a single `none` entry).
+  var dkimVerifyOpts = { dnsLookup: opts.dnsLookup };
+  if (opts.clockSkewMs !== undefined) dkimVerifyOpts.clockSkewMs = opts.clockSkewMs;
+  if (opts.maxSignatures !== undefined) dkimVerifyOpts.maxSignatures = opts.maxSignatures;
+  if (opts.minRsaBits !== undefined) dkimVerifyOpts.minRsaBits = opts.minRsaBits;
+  var dkimResults = await dkim.verify(message, dkimVerifyOpts);
+
+  // From header + DMARC policy/alignment.
+  var from = _extractFromHeaders(_splitHeaderBlock(message).headers);
+  var dmarc;
+  if (from.count === 1 && from.address && from.domain) {
+    dmarc = await dmarcEvaluate({
+      from:         from.address,
+      spf:          spf,
+      dkim:         dkimResults,
+      dnsLookup:    opts.dnsLookup,
+      domainExists: opts.domainExists,
+    });
+    // RFC 7489 §6.6.2 — a fail verdict computed while an authenticator
+    // returned temperror is not final: the very lookup that failed
+    // transiently could have produced the aligned pass. Surface
+    // temperror so the caller defers (the sender retries) instead of
+    // permanently refusing a legitimate sender during a DNS blip. A
+    // pass verdict stands — one aligned authenticator is sufficient
+    // regardless of the other's transient failure.
+    if (dmarc.result === "fail" &&
+        (spf.result === "temperror" ||
+         dkimResults.some(function (d) { return d.result === "temperror"; }))) {
+      dmarc.result            = "temperror";
+      dmarc.recommendedAction = null;
+      dmarc.explanation       = (dmarc.explanation ? dmarc.explanation + "; " : "") +
+        "fail computed while an authenticator returned temperror — transient, retry";
+    }
+  } else {
+    dmarc = {
+      result:            "permerror",
+      recommendedAction: "reject",
+      policy:            null,
+      alignment:         { spf: false, dkim: false },
+      orgDomain:         null,
+      explanation: from.count === 0
+        ? "message has no From header (RFC 7489 §6.6.1)"
+        : (from.count > 1
+            ? "message carries " + from.count + " From authors (RFC 7489 §6.6.1 — multi-From spoofing shape)"
+            : "From header has no parsable author domain"),
+    };
+  }
+
+  // RFC 8601 Authentication-Results — only when the caller identifies
+  // itself (the authserv-id is the receiver's own name; there is no
+  // sensible default the framework could invent).
+  var authResults = null;
+  if (opts.authservId) {
+    var arResults = [];
+    var spfEntry = { method: "spf", result: spf.result };
+    if (mailFrom) spfEntry.smtpMailfrom = mailFrom;
+    else if (helo) spfEntry.smtpHelo = helo;
+    arResults.push(spfEntry);
+    for (var di = 0; di < dkimResults.length; di += 1) {
+      var d = dkimResults[di];
+      var dkimEntry = { method: "dkim", result: d.result };
+      if (typeof d.d === "string" && d.d.length > 0) dkimEntry.domain = d.d;
+      if (typeof d.s === "string" && d.s.length > 0) dkimEntry.selector = d.s;
+      arResults.push(dkimEntry);
+    }
+    var dmarcEntry = { method: "dmarc", result: dmarc.result };
+    if (from.address) dmarcEntry.from = from.address;
+    arResults.push(dmarcEntry);
+    authResults = authResultsEmit({ authservId: opts.authservId, results: arResults });
+  }
+
+  return { spf: spf, dkim: dkimResults, from: from, dmarc: dmarc, authResults: authResults };
+}
+
 // ---- DMARC aggregate (RUA) report parser (RFC 7489 §7.2 / draft-ietf-dmarc-aggregate-reporting) ----
 //
 // MTAs that publish a DMARC `rua=` policy receive aggregate reports
@@ -2971,6 +3204,9 @@ module.exports = {
   authResults: Object.freeze({
     emit:          authResultsEmit,
   }),
+  inbound: Object.freeze({
+    verify:        inboundVerify,
+  }),
   MailAuthError: MailAuthError,
   SPF_DNS_LOOKUP_LIMIT: SPF_DNS_LOOKUP_LIMIT,
 };

package/lib/vendor/blamejs/lib/mail-crypto-smime.js

@@ -102,6 +102,7 @@ var cms          = require("./cms-codec");
 var asn1         = require("./asn1-der");
 var pqcSoftware  = require("./pqc-software");
 var bCrypto      = require("./crypto");
+var gateContract = require("./gate-contract");
 var { defineClass } = require("./framework-error");
 
 var MailCryptoError = defineClass("MailCryptoError", { alwaysPermanent: true });
@@ -121,12 +122,7 @@ var REFUSED_HASHES = ["md5", "sha1"];
 // encryption is added, it composes the same set with the @intro EFAIL
 // defenses applied.
 var PROFILES = ["strict", "balanced", "permissive"];
-var COMPLIANCE_POSTURES = {
-  hipaa:     "strict",
-  "pci-dss": "strict",
-  gdpr:      "strict",
-  soc2:      "strict",
-};
+var COMPLIANCE_POSTURES = gateContract.ALL_STRICT_POSTURES;
 
 // ---- Public surface (v0.10.16 lights up — composes b.cms) ----
 

package/lib/vendor/blamejs/lib/mail-dkim.js

@@ -1242,6 +1242,7 @@ module.exports = {
   RSA_MIN_BITS:               RSA_MIN_BITS,
   RSA_LEGACY_MIN_BITS:        RSA_LEGACY_MIN_BITS,
   DKIM_MAX_SIGNATURES_PER_MESSAGE: DKIM_MAX_SIGNATURES_PER_MESSAGE,
+  DKIM_MAX_SIGNATURES_PER_MESSAGE_CEILING: DKIM_MAX_SIGNATURES_PER_MESSAGE_CEILING,
   DKIM_CLOCK_SKEW_MS_MAX:     DKIM_CLOCK_SKEW_MS_MAX,
   _canonHeaderRelaxedForTest: _canonHeaderRelaxed,
   _canonBodyRelaxedForTest:   _canonBodyRelaxed,

package/lib/vendor/blamejs/lib/mail-greylist.js

@@ -102,6 +102,7 @@ var { defineClass }    = require("./framework-error");
 var bCrypto            = require("./crypto");
 var lazyRequire        = require("./lazy-require");
 var ipUtils            = require("./ip-utils");
+var gateContract       = require("./gate-contract");
 
 var audit              = lazyRequire(function () { return require("./audit"); });
 
@@ -126,12 +127,7 @@ var PROFILES = Object.freeze({
   permissive: { minDelayMs: C.TIME.seconds(30), whitelistTtlMs: C.TIME.days(30), ipv4Prefix: 32, ipv6Prefix: 128 },                                                                                         // RFC 6647 §4.4 prefixes
 });
 
-var COMPLIANCE_POSTURES = Object.freeze({
-  hipaa:     "strict",
-  "pci-dss": "strict",
-  gdpr:      "strict",
-  soc2:      "strict",
-});
+var COMPLIANCE_POSTURES = gateContract.ALL_STRICT_POSTURES;
 
 var IPV4_RE = /^(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(?:\.(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}$/;       // allow:regex-no-length-cap — anchored + per-octet repeat-cap
 var IPV6_RE = /^[0-9a-fA-F:]+$/;                                                                          // allow:regex-no-length-cap — length-checked separately

package/lib/vendor/blamejs/lib/mail-helo.js

@@ -104,6 +104,7 @@
 var { defineClass }    = require("./framework-error");
 var lazyRequire        = require("./lazy-require");
 var ipUtils            = require("./ip-utils");
+var gateContract       = require("./gate-contract");
 
 var audit              = lazyRequire(function () { return require("./audit"); });
 
@@ -145,12 +146,7 @@ var PROFILES = Object.freeze({
   },
 });
 
-var COMPLIANCE_POSTURES = Object.freeze({
-  hipaa:     "strict",
-  "pci-dss": "strict",
-  gdpr:      "strict",
-  soc2:      "strict",
-});
+var COMPLIANCE_POSTURES = gateContract.ALL_STRICT_POSTURES;
 
 // Operator-extensible default list of generic-rDNS patterns the
 // framework ships. Each is a RegExp — case-insensitive — designed

package/lib/vendor/blamejs/lib/mail-journal.js

@@ -72,7 +72,7 @@ var C = require("./constants");
 var validateOpts = require("./validate-opts");
 var numericBounds = require("./numeric-bounds");
 var safeJson = require("./safe-json");
-var safeSql = require("./safe-sql");
+var sql = require("./sql");
 var { defineClass } = require("./framework-error");
 var lazyRequire = require("./lazy-require");
 
@@ -213,33 +213,40 @@ function create(opts) {
   // / `messageId` / `archivedAt` / `sizeBytes` / `regimes` / `legalHold`
   // queryable without unsealing the payload. The payload (headers +
   // body) lives in the WORM bucket sealed via b.cryptoField.sealRow.
-  // Route every identifier through safeSql.quoteIdentifier — the
-  // shared substrate validates the unquoted name AND emits the
-  // dialect-correct quoted form. Index names must be built from the
-  // unquoted base then quoted independently; appending suffixes to
-  // an already-quoted token produces invalid SQL like
-  // `"_mail_journal_x"_archived_at_idx`.
-  var rawTable    = "_mail_journal_" + namespace.replace(/-/g, "_");
-  var qTable      = safeSql.quoteIdentifier(rawTable);
-  var qIdxArchAt  = safeSql.quoteIdentifier(rawTable + "_archived_at_idx");
-  var qIdxMsgId   = safeSql.quoteIdentifier(rawTable + "_message_id_idx");
-  opts.db.runSql(
-    "CREATE TABLE IF NOT EXISTS " + qTable + " (" +
-    "journal_id TEXT PRIMARY KEY, " +
-    "direction TEXT NOT NULL, " +
-    "actor_id TEXT, " +
-    "message_id TEXT, " +
-    "archived_at INTEGER NOT NULL, " +
-    "size_bytes INTEGER NOT NULL, " +
-    "regimes TEXT NOT NULL, " +
-    "floor_until INTEGER NOT NULL, " +
-    "legal_hold INTEGER NOT NULL DEFAULT 0, " +
-    "storage_key TEXT NOT NULL UNIQUE, " +
-    "sealed_payload BLOB NOT NULL" +
-    ");" +
-    "CREATE INDEX IF NOT EXISTS " + qIdxArchAt + " ON " + qTable + " (archived_at);" +
-    "CREATE INDEX IF NOT EXISTS " + qIdxMsgId  + " ON " + qTable + " (message_id);"
-  );
+  //
+  // The journal table is an operator-namespaced local table (NOT a
+  // framework `_blamejs_` table that clusterStorage rewrites), so every
+  // statement composes b.sql with quoteName:true — b.sql validates the
+  // identifier through b.safeSql and emits the dialect-quoted form,
+  // running against opts.db (the local sqlite handle) directly. `_t()`
+  // opens each verb builder pre-bound to this table so the name resolves
+  // in exactly one place.
+  var rawTable = "_mail_journal_" + namespace.replace(/-/g, "_");
+  var TBL_OPTS = { dialect: "sqlite", quoteName: true };
+  function _t(verb) { return sql[verb](rawTable, TBL_OPTS); }
+
+  // Bootstrap DDL — CREATE TABLE + the archived_at / message_id indexes.
+  // runSql is a multi-statement helper, so the three b.sql DDL strings
+  // join with `;` into one call (each b.sql build is a single validated
+  // statement; the join is the multi-statement boundary runSql expects).
+  var ddl = [
+    sql.createTable(rawTable, [
+      { name: "journal_id",     type: "text", primaryKey: true },
+      { name: "direction",      type: "text", notNull: true },
+      { name: "actor_id",       type: "text" },
+      { name: "message_id",     type: "text" },
+      { name: "archived_at",    type: "int",  notNull: true },
+      { name: "size_bytes",     type: "int",  notNull: true },
+      { name: "regimes",        type: "text", notNull: true },
+      { name: "floor_until",    type: "int",  notNull: true },
+      { name: "legal_hold",     type: "int",  notNull: true, default: 0 },
+      { name: "storage_key",    type: "text", notNull: true, unique: true },
+      { name: "sealed_payload", type: "blob", notNull: true },
+    ], TBL_OPTS).sql,
+    sql.createIndex(rawTable + "_archived_at_idx", rawTable, ["archived_at"], TBL_OPTS).sql,
+    sql.createIndex(rawTable + "_message_id_idx",  rawTable, ["message_id"],  TBL_OPTS).sql,
+  ].join(";");
+  opts.db.runSql(ddl);
 
   async function record(req) {
     validateOpts.requireObject(req, "mail.journal.record",
@@ -292,13 +299,24 @@ function create(opts) {
 
     var regimesJson = JSON.stringify(opts.regimes);
     var floorUntil  = archivedAt + floorMs;
-    opts.db.runSql(
-      "INSERT INTO " + qTable + " (journal_id, direction, actor_id, message_id, " +
-      "archived_at, size_bytes, regimes, floor_until, legal_hold, storage_key, sealed_payload) " +
-      "VALUES (?, ?, ?, ?, ?, ?, ?, ?, 0, ?, ?);",
-      [journalId, req.direction, req.actorId, req.messageId,
-       archivedAt, sizeBytes, regimesJson, floorUntil, storageKey, sealedBlob]
-    );
+    // legal_hold is omitted from the INSERT so the column's
+    // `NOT NULL DEFAULT 0` applies (the prior inline `0` SQL literal) — b.sql
+    // binds every value it is given, so leaving the column out keeps the row
+    // unsealed-at-rest default without binding a redundant constant. b.sql
+    // quotes every column + binds every remaining value as a placeholder.
+    var insBuilt = _t("insert").values({
+      journal_id:     journalId,
+      direction:      req.direction,
+      actor_id:       req.actorId,
+      message_id:     req.messageId,
+      archived_at:    archivedAt,
+      size_bytes:     sizeBytes,
+      regimes:        regimesJson,
+      floor_until:    floorUntil,
+      storage_key:    storageKey,
+      sealed_payload: sealedBlob,
+    }).toSql();
+    opts.db.runSql(insBuilt.sql, insBuilt.params);
 
     _emit("mail.journal.record", "success", {
       journalId:  journalId,
@@ -317,11 +335,12 @@ function create(opts) {
       throw new MailJournalError("mail-journal/bad-id",
         "mail.journal.getById: journalId must be a non-empty string");
     }
-    var rows = opts.db.runSql(
-      "SELECT direction, message_id, archived_at, size_bytes, regimes, floor_until, " +
-      "legal_hold, storage_key, sealed_payload FROM " + qTable + " WHERE journal_id = ?;",
-      [journalId]
-    );
+    var gbBuilt = _t("select")
+      .columns(["direction", "message_id", "archived_at", "size_bytes", "regimes",
+                "floor_until", "legal_hold", "storage_key", "sealed_payload"])
+      .where("journal_id", journalId)
+      .toSql();
+    var rows = opts.db.runSql(gbBuilt.sql, gbBuilt.params);
     if (!rows || rows.length === 0) return null;
     var r = rows[0];
     var unsealed = safeJson.parse(opts.vault.unseal(r.sealed_payload));
@@ -344,30 +363,27 @@ function create(opts) {
 
   function list(filter) {
     filter = filter || {};
+    var limit = numericBounds.isPositiveFiniteInt(filter.limit) ? Math.min(filter.limit, 1000) : 100; // list page cap
+    // Each filter term is an optional .where() leaf (AND-composed); b.sql
+    // quotes the columns + binds the values. A diagnostic clause list is
+    // kept for the audit metadata (the prior `filter: clauses` field).
     var clauses = [];
-    var args    = [];
+    var qb = _t("select").columns(["journal_id", "direction", "actor_id", "message_id",
+      "archived_at", "size_bytes", "regimes", "floor_until", "legal_hold", "storage_key"]);
     if (filter.direction && ALLOWED_DIRECTIONS[filter.direction]) {
-      clauses.push("direction = ?");
-      args.push(filter.direction);
+      qb.where("direction", filter.direction); clauses.push("direction = ?");
     }
     if (typeof filter.since === "number" && numericBounds.isPositiveFiniteInt(filter.since)) {
-      clauses.push("archived_at >= ?");
-      args.push(filter.since);
+      qb.whereOp("archived_at", ">=", filter.since); clauses.push("archived_at >= ?");
     }
     if (typeof filter.until === "number" && numericBounds.isPositiveFiniteInt(filter.until)) {
-      clauses.push("archived_at < ?");
-      args.push(filter.until);
+      qb.whereOp("archived_at", "<", filter.until); clauses.push("archived_at < ?");
     }
     if (filter.actorId && typeof filter.actorId === "string") {
-      clauses.push("actor_id = ?");
-      args.push(filter.actorId);
+      qb.where("actor_id", filter.actorId); clauses.push("actor_id = ?");
     }
-    var limit = numericBounds.isPositiveFiniteInt(filter.limit) ? Math.min(filter.limit, 1000) : 100; // list page cap
-    var where = clauses.length > 0 ? " WHERE " + clauses.join(" AND ") : "";
-    var sql = "SELECT journal_id, direction, actor_id, message_id, archived_at, " +
-              "size_bytes, regimes, floor_until, legal_hold, storage_key FROM " +
-              qTable + where + " ORDER BY archived_at DESC LIMIT " + limit + ";";
-    var rows = opts.db.runSql(sql, args);
+    var listBuilt = qb.orderBy("archived_at", "desc").limit(limit).toSql();
+    var rows = opts.db.runSql(listBuilt.sql, listBuilt.params);
     _emit("mail.journal.list", "success", { count: rows ? rows.length : 0, filter: clauses });
     return (rows || []).map(function (r) {
       return {
@@ -387,11 +403,15 @@ function create(opts) {
 
   function expireSurface(now) {
     if (now === undefined) now = Date.now();
-    var rows = opts.db.runSql(
-      "SELECT journal_id, archived_at, floor_until, message_id, regimes FROM " +
-      qTable + " WHERE floor_until < ? AND legal_hold = 0 ORDER BY archived_at ASC LIMIT 1000;",   // expiry-surface cap
-      [now]
-    );
+    // legal_hold = 0 binds as a value (the prior inline `0` literal).
+    var esBuilt = _t("select")
+      .columns(["journal_id", "archived_at", "floor_until", "message_id", "regimes"])
+      .whereOp("floor_until", "<", now)
+      .where("legal_hold", 0)
+      .orderBy("archived_at", "asc")
+      .limit(1000)                                                                                  // expiry-surface cap
+      .toSql();
+    var rows = opts.db.runSql(esBuilt.sql, esBuilt.params);
     _emit("mail.journal.expire_surface", "success", { count: rows ? rows.length : 0, now: now });
     return (rows || []).map(function (r) {
       return {
@@ -409,10 +429,11 @@ function create(opts) {
       throw new MailJournalError("mail-journal/bad-id",
         "mail.journal.setLegalHold: journalId required");
     }
-    opts.db.runSql(
-      "UPDATE " + qTable + " SET legal_hold = ? WHERE journal_id = ?;",
-      [onHold ? 1 : 0, journalId]
-    );
+    var lhBuilt = _t("update")
+      .set("legal_hold", onHold ? 1 : 0)
+      .where("journal_id", journalId)
+      .toSql();
+    opts.db.runSql(lhBuilt.sql, lhBuilt.params);
     _emit("mail.journal.legal_hold_change", "success", { journalId: journalId, onHold: !!onHold });
   }
 

package/lib/vendor/blamejs/lib/mail-rbl.js

@@ -86,6 +86,7 @@ var C                  = require("./constants");
 var { defineClass }    = require("./framework-error");
 var lazyRequire        = require("./lazy-require");
 var ipUtils            = require("./ip-utils");
+var gateContract       = require("./gate-contract");
 
 var audit              = lazyRequire(function () { return require("./audit"); });
 
@@ -105,12 +106,7 @@ var PROFILES = Object.freeze({
   permissive: { maxConcurrent: 32, perListTimeoutMs: C.TIME.seconds(20), maxListsPerQuery: 64 },         // list-count cap
 });
 
-var COMPLIANCE_POSTURES = Object.freeze({
-  hipaa:     "strict",
-  "pci-dss": "strict",
-  gdpr:      "strict",
-  soc2:      "strict",
-});
+var COMPLIANCE_POSTURES = gateContract.ALL_STRICT_POSTURES;
 
 /**
  * @primitive b.mail.rbl.create

package/lib/vendor/blamejs/lib/mail-scan.js

@@ -85,6 +85,7 @@ var lazyRequire       = require("./lazy-require");
 var validateOpts      = require("./validate-opts");
 var numericBounds     = require("./numeric-bounds");
 var safeIcap          = require("./safe-icap");
+var gateContract = require("./gate-contract");
 
 var audit             = lazyRequire(function () { return require("./audit"); });
 var guardArchive      = lazyRequire(function () { return require("./guard-archive"); });
@@ -107,12 +108,7 @@ var PROFILES = Object.freeze({
   permissive: { timeoutMs: C.TIME.seconds(120), maxMessageBytes: C.BYTES.mib(150), maxResponseBytes: C.BYTES.mib(300) },  // operator-facing default mailbox cap
 });
 
-var COMPLIANCE_POSTURES = Object.freeze({
-  hipaa:     "strict",
-  "pci-dss": "strict",
-  gdpr:      "strict",
-  soc2:      "strict",
-});
+var COMPLIANCE_POSTURES = gateContract.ALL_STRICT_POSTURES;
 
 var ALLOWED_PROTOCOLS = Object.freeze({
   "icap":            true,