@blamejs/blamejs-shop 0.4.31 → 0.4.32

package/lib/vendor/blamejs/lib/mail-server-jmap.js

@@ -316,6 +316,33 @@ function create(opts) {
     return cur;
   }
 
+  // ---- Account authorization (RFC 8620 §3.6.1 accountNotFound) ------------
+  //
+  // The set of accountIds an actor may touch is whatever
+  // `opts.accountsFor(actor)` enumerates in its `accounts` map — the same
+  // source the session resource advertises. Resolving it ONCE per request
+  // and rejecting any client-supplied accountId outside that set is the
+  // cross-tenant authorization control: without it, a tenant's request can
+  // name another tenant's accountId and reach the operator's method/blob
+  // handler, which must then independently re-check or leak. The listener
+  // owns this gate so every account-scoped op (method dispatch + blob
+  // upload/download) is covered uniformly.
+  async function _permittedAccountIds(actor) {
+    var info = await opts.accountsFor(actor);
+    info = info || {};
+    var accounts = info.accounts || {};
+    // A Set of the accountIds the actor is enumerated for. An empty/garbage
+    // accounts map yields an empty set → every account-scoped reference is
+    // rejected (fail-closed), which is the correct posture for an actor the
+    // operator declined to grant any account.
+    var set = Object.create(null);
+    if (accounts && typeof accounts === "object") {
+      var ids = Object.keys(accounts);
+      for (var i = 0; i < ids.length; i += 1) set[ids[i]] = true;
+    }
+    return set;
+  }
+
   // ---- Dispatch ------------------------------------------------------------
   //
   // `dispatch(actor, body)` is the operator-callable form — accepts a
@@ -340,6 +367,20 @@ function create(opts) {
       return _refusalResponse(errType, (e && e.message) || "request refused");
     }
 
+    // Resolve the actor's permitted accountId set ONCE for the whole
+    // request (RFC 8620 §3.6.1). Every account-scoped method call is gated
+    // against it below, BEFORE the operator handler runs, so a client can't
+    // name another tenant's accountId and reach the backend.
+    var permittedAccounts;
+    try {
+      permittedAccounts = await _permittedAccountIds(actor);
+    } catch (e) {
+      _emit("mail.server.jmap.accounts_for_threw",
+        { error: (e && e.message) || String(e) }, "failure");
+      return _refusalResponse("urn:ietf:params:jmap:error:serverFail",
+        "account authorization unavailable");
+    }
+
     var methodResponses = [];
     var byClientId = Object.create(null);
     for (var i = 0; i < parsed.methodCalls.length; i += 1) {
@@ -361,6 +402,24 @@ function create(opts) {
             description: "Method '" + methodName + "' not implemented on this server" }, clientId]);
         continue;
       }
+      // Cross-tenant gate (RFC 8620 §3.6.1): if the call names an accountId,
+      // it MUST be one the actor is enumerated for. Rejected BEFORE the
+      // operator handler runs so a forged/foreign accountId never reaches
+      // the backend. Calls without an accountId (account-agnostic methods)
+      // pass through unchanged.
+      if (resolvedArgs && typeof resolvedArgs === "object" &&
+          resolvedArgs.accountId !== undefined && resolvedArgs.accountId !== null) {
+        var callAccountId = resolvedArgs.accountId;
+        if (typeof callAccountId !== "string" || !permittedAccounts[callAccountId]) {
+          _emit("mail.server.jmap.account_not_found",
+            { method: methodName, accountId: typeof callAccountId === "string" ? callAccountId : null,
+              clientId: clientId }, "denied");
+          methodResponses.push(["error",
+            { type: "urn:ietf:params:jmap:error:accountNotFound",
+              description: "accountId is not accessible to this actor" }, clientId]);
+          continue;
+        }
+      }
       if (!_legacyDeprecationEmitted && registry.source(methodName) === "builtin") {
         _legacyDeprecationEmitted = true;
         _emit("mail.server.jmap.methods_opt_deprecated",
@@ -813,6 +872,40 @@ function create(opts) {
       if (refused) return;
       var bytes = collector.result();
       Promise.resolve()
+        // Cross-tenant gate (RFC 8620 §3.6.1): the accountId in the upload
+        // URL must be one the actor is enumerated for, else accountNotFound
+        // — the foreign accountId never reaches uploadBlob.
+        .then(function () { return _permittedAccountIds(actor); })
+        .then(function (permitted) {
+          if (!permitted[accountId]) {
+            _emit("mail.server.jmap.account_not_found",
+              { op: "upload", accountId: accountId }, "denied");
+            res.statusCode = 404;
+            res.setHeader("Content-Type", "application/json; charset=utf-8");
+            res.end(JSON.stringify({
+              type:        "urn:ietf:params:jmap:error:accountNotFound",
+              description: "accountId is not accessible to this actor",
+            }));
+            return;
+          }
+          return _completeUpload(bytes);
+        })
+        .catch(function (err) {
+          _emit("mail.server.jmap.upload_threw",
+            { accountId: accountId, error: (err && err.message) || String(err) }, "failure");
+          if (!res.headersSent) {
+            res.statusCode = 500;
+            res.setHeader("Content-Type", "application/json; charset=utf-8");
+            res.end(JSON.stringify({
+              type:        "urn:ietf:params:jmap:error:serverFail",
+              description: "Upload failed",
+            }));
+          }
+        });
+    });
+
+    function _completeUpload(bytes) {
+      return Promise.resolve()
         .then(function () { return opts.mailStore.uploadBlob(actor, accountId, contentType, bytes); })
         .then(function (meta) {
           if (!meta || typeof meta !== "object" || typeof meta.blobId !== "string") {
@@ -827,18 +920,10 @@ function create(opts) {
             type:      meta.type || contentType,
             size:      typeof meta.size === "number" ? meta.size : bytes.length,
           }));
-        })
-        .catch(function (err) {
-          _emit("mail.server.jmap.upload_threw",
-            { accountId: accountId, error: (err && err.message) || String(err) }, "failure");
-          res.statusCode = 500;
-          res.setHeader("Content-Type", "application/json; charset=utf-8");
-          res.end(JSON.stringify({
-            type:        "urn:ietf:params:jmap:error:serverFail",
-            description: "Upload failed",
-          }));
         });
-    });
+      // Errors from uploadBlob propagate to the req.on("end") chain's
+      // .catch (single serverFail responder, headersSent-guarded).
+    }
     req.on("error", function () {
       if (!refused) {
         refused = true;
@@ -944,9 +1029,29 @@ function create(opts) {
       }));
       return;
     }
+    var downloadDenied = false;
     Promise.resolve()
-      .then(function () { return opts.mailStore.downloadBlob(actor, accountId, blobId); })
+      // Cross-tenant gate (RFC 8620 §3.6.1): the accountId in the download
+      // URL must be one the actor is enumerated for, else accountNotFound —
+      // the foreign accountId never reaches downloadBlob.
+      .then(function () { return _permittedAccountIds(actor); })
+      .then(function (permitted) {
+        if (!permitted[accountId]) {
+          downloadDenied = true;
+          _emit("mail.server.jmap.account_not_found",
+            { op: "download", accountId: accountId, blobId: blobId }, "denied");
+          res.statusCode = 404;
+          res.setHeader("Content-Type", "application/json; charset=utf-8");
+          res.end(JSON.stringify({
+            type:        "urn:ietf:params:jmap:error:accountNotFound",
+            description: "accountId is not accessible to this actor",
+          }));
+          return undefined;
+        }
+        return opts.mailStore.downloadBlob(actor, accountId, blobId);
+      })
       .then(function (result) {
+        if (downloadDenied) return;
         if (!result || (typeof result !== "object" && !Buffer.isBuffer(result))) {
           res.statusCode = 404;
           res.setHeader("Content-Type", "application/json; charset=utf-8");

package/lib/vendor/blamejs/lib/mail-server-mx.js

@@ -73,6 +73,8 @@
  *   - `mail.server.mx.rbl_refused`       — connecting IP on a DNS blocklist (zones)
  *   - `mail.server.mx.greylist_deferred` — (ip, from, rcpt) first-seen 450 deferral
  *   - `mail.server.mx.data_refused`      — refusal reason + SMTP code (5xx vs 4xx)
+ *   - `mail.server.mx.envelope_verdict`  — DATA-phase SPF/DKIM/DMARC results + action (accept / quarantine / reject / defer) + gate mode
+ *   - `mail.server.mx.envelope_error`    — DATA-phase authentication pipeline failure or timeout (disposition follows onTemperror)
  *   - `mail.server.mx.delivered`         — agent.handoff ack
  *   - `mail.server.mx.tls_handshake_failed` — handshake error
  *   - `mail.server.mx.smtp_smuggling_detected` — CRLF.CRLF injection class
@@ -111,13 +113,20 @@
  *   (connecting-IP DNS blocklist, evaluated once per connection) and
  *   `opts.greylist` ((ip, from, rcpt) first-seen deferral) evaluate at
  *   RCPT TO and surface their verdicts on the `rcpt_to` event. The
- *   message-authentication gates (`b.guardEnvelope` SPF/DKIM/DMARC
- *   alignment) require the inbound SPF + DKIM verification results as
- *   inputs; that inbound-auth pipeline composes `b.mail.spf` +
- *   `b.mail.dmarc` + DKIM verification and lands as a follow-up, at
- *   which point the DATA-phase envelope/DMARC gate wires in. Until
- *   then operators run those checks on the delivered message via the
- *   agent handoff.
+ *   message-authentication gate (`opts.guardEnvelope`) runs at DATA
+ *   completion through `b.mail.inbound.verify` — SPF (RFC 7208) on the
+ *   envelope identity, DKIM (RFC 6376) on the message bytes, DMARC
+ *   (RFC 7489) policy + alignment on the From-header domain — and in
+ *   enforce mode refuses before the agent handoff: 550 5.7.26
+ *   (RFC 7372) when the sender's published policy says reject, 550
+ *   5.7.1 on the RFC 7489 §6.6.1 multi-From spoofing shape, 451 4.7.0
+ *   on DNS temperror or pipeline timeout (operator-tunable via
+ *   `onTemperror` / `timeoutMs`). Accepted messages carry the verdict
+ *   to the agent handoff as `auth` and gain the receiver's RFC 8601
+ *   Authentication-Results header — any sender-attached header forging
+ *   this receiver's authserv-id is stripped first (§5) — so downstream
+ *   consumers act on authenticated results instead of re-verifying;
+ *   monitor mode annotates without refusing.
  *
  * @card
  *   Inbound SMTP / MX listener. RFC 5321 state machine with SMTP-
@@ -144,6 +153,12 @@ var mailServerTls = require("./mail-server-tls");
 var { defineClass } = require("./framework-error");
 
 var audit = lazyRequire(function () { return require("./audit"); });
+// Lazy like the sibling host primitives' guard loads — the inbound
+// authentication pipeline (and the DKIM verifier whose range
+// constants the boot validation mirrors) only loads when an operator
+// wires opts.guardEnvelope.
+var mailAuth = lazyRequire(function () { return require("./mail-auth"); });
+var dkim = lazyRequire(function () { return require("./mail-dkim"); });
 
 var MailServerMxError = defineClass("MailServerMxError", { alwaysPermanent: true });
 
@@ -178,6 +193,59 @@ var RE_MAIL_FROM = /^MAIL\s+FROM:\s*<([^>]*)>(?:\s+(.*))?$/i;
 var RE_RCPT_TO   = /^RCPT\s+TO:\s*<([^>]+)>(?:\s+.*)?$/i;
 var RE_SIZE      = /SIZE=(\d+)/i;
 
+// Map the b.mail.inbound.verify verdict to the DATA-phase gate action.
+// The sender's published DMARC policy drives it (RFC 7489 §6.3 p= /
+// §6.6.2 disposition): reject → refuse at the wire; quarantine →
+// deliver annotated (an MX cannot spam-folder — the downstream agent
+// owns disposition); none / pass → accept. DNS temperror defers or
+// accepts per the operator's onTemperror choice. permerror carries a
+// reject recommendation only for the multi-From spoofing shape
+// (RFC 7489 §6.6.1), set by the pipeline itself.
+function _envelopeActionFor(inbound, gate) {
+  var dmarc = inbound.dmarc || {};
+  if (dmarc.result === "temperror") {
+    return gate.onTemperror === "accept" ? "accept" : "defer";
+  }
+  if (dmarc.recommendedAction === "reject") return "reject";
+  if (dmarc.recommendedAction === "quarantine") return "quarantine";
+  return "accept";
+}
+
+// RFC 8601 §5 — an MTA adding its own Authentication-Results header
+// MUST first remove any existing instance claiming its authserv-id: a
+// sender can pre-attach a forged header carrying the receiver's name
+// ("Authentication-Results: mx.example.com; dmarc=pass") and downstream
+// consumers that trust the receiver's A-R header would read the forged
+// verdict instead of the computed one. Headers naming OTHER
+// authserv-ids are prior-hop information and stay. Operates on the
+// header block only — the block is decoded as latin1 (byte-preserving
+// round-trip) and the body bytes are never decoded at all, so 8-bit
+// content is untouched.
+function _stripForgedAuthResults(messageBuf, authservId) {
+  if (!authservId) return messageBuf;
+  var sepIdx = messageBuf.indexOf("\r\n\r\n");
+  var headerEnd = sepIdx === -1 ? messageBuf.length : sepIdx + 2;
+  var head = messageBuf.slice(0, headerEnd).toString("latin1");
+  var rest = messageBuf.slice(headerEnd);
+  if (head.toLowerCase().indexOf("authentication-results:") === -1) return messageBuf;
+  var lines = head.split("\r\n");
+  var out = [];
+  var skipping = false;
+  var prefix = "authentication-results:";
+  var wantId = authservId.toLowerCase();
+  for (var i = 0; i < lines.length; i += 1) {
+    var line = lines[i];
+    if (skipping && (line.charAt(0) === " " || line.charAt(0) === "\t")) continue;  // folded continuation
+    skipping = false;
+    if (line.slice(0, prefix.length).toLowerCase() === prefix) {
+      var idTok = line.slice(prefix.length).trim().split(/[;\s]/)[0].toLowerCase();
+      if (idTok === wantId) { skipping = true; continue; }
+    }
+    out.push(line);
+  }
+  return Buffer.concat([Buffer.from(out.join("\r\n"), "latin1"), rest]);
+}
+
 /**
  * @primitive b.mail.server.mx.create
  * @signature b.mail.server.mx.create(opts)
@@ -202,6 +270,16 @@ var RE_SIZE      = /SIZE=(\d+)/i;
  *   maxRcptsPerMessage: number,         // default 100 — per RFC 5321 §4.5.3.1.8
  *   idleTimeoutMs:     number,          // default 5 minutes — RFC 5321 §4.5.3.2.7
  *   profile:           "strict" | "balanced" | "permissive",  // gate posture cascade
+ *   guardEnvelope:     true | {        // optional gate — DATA-phase SPF/DKIM/DMARC via b.mail.inbound.verify
+ *     mode?:          "enforce" | "monitor",   // default: enforce (monitor when profile is permissive)
+ *     onTemperror?:   "defer" | "accept",      // DNS temperror disposition; default "defer" (451 4.7.5)
+ *     authservId?:    string,                  // RFC 8601 authserv-id; default localDomains[0]
+ *     dnsLookup?:     function,                // async (qname, type) override for SPF/DKIM/DMARC lookups
+ *     maxSignatures?: number,                  // DKIM verify cap (1-16)
+ *     clockSkewMs?:   number,                  // DKIM timestamp skew tolerance
+ *     minRsaBits?:    number,                  // DKIM minimum RSA key size
+ *     timeoutMs?:     number,                  // pipeline wall-clock ceiling; default 20s (timeout → temperror disposition)
+ *   },
  *
  * @example
  *   var tls = b.network.tls.context({ cert: certPem, key: keyPem });
@@ -269,6 +347,92 @@ function create(opts) {
     rateLimit = mailServerRateLimit.create(opts.rateLimit || {});
   }
 
+  // DATA-phase message-authentication gate. `guardEnvelope: true`
+  // gates with defaults; an object tunes it. Like the sibling gates
+  // (helo / rbl / greylist) the phase is skipped when the operator
+  // doesn't wire it — the gate needs live DNS to evaluate the
+  // sender's published policy, which closed-network deployments may
+  // not have.
+  var envelopeGate = null;
+  if (opts.guardEnvelope !== undefined && opts.guardEnvelope !== false) {
+    if (opts.guardEnvelope !== true &&
+        (typeof opts.guardEnvelope !== "object" || opts.guardEnvelope === null ||
+         Array.isArray(opts.guardEnvelope))) {
+      throw new MailServerMxError("mail-server-mx/bad-opts",
+        "mail.server.mx.create: guardEnvelope must be true, false, or a config object");
+    }
+    var ge = opts.guardEnvelope === true ? {} : opts.guardEnvelope;
+    validateOpts(ge, ["mode", "onTemperror", "authservId", "dnsLookup",
+                      "maxSignatures", "clockSkewMs", "minRsaBits", "timeoutMs"],
+                 "mail.server.mx.guardEnvelope");
+    var geMode = (ge.mode === undefined || ge.mode === null)
+      ? (profile === "permissive" ? "monitor" : "enforce")
+      : ge.mode;
+    if (geMode !== "enforce" && geMode !== "monitor") {
+      throw new MailServerMxError("mail-server-mx/bad-opts",
+        "mail.server.mx.create: guardEnvelope.mode must be 'enforce' or 'monitor'");
+    }
+    var geOnTemperror = (ge.onTemperror === undefined || ge.onTemperror === null)
+      ? "defer" : ge.onTemperror;
+    if (geOnTemperror !== "defer" && geOnTemperror !== "accept") {
+      throw new MailServerMxError("mail-server-mx/bad-opts",
+        "mail.server.mx.create: guardEnvelope.onTemperror must be 'defer' or 'accept'");
+    }
+    if (ge.authservId !== undefined && ge.authservId !== null) {
+      validateOpts.requireNonEmptyString(ge.authservId,
+        "mail.server.mx.create: guardEnvelope.authservId",
+        MailServerMxError, "mail-server-mx/bad-opts");
+    }
+    if (ge.dnsLookup !== undefined && ge.dnsLookup !== null &&
+        typeof ge.dnsLookup !== "function") {
+      throw new MailServerMxError("mail-server-mx/bad-opts",
+        "mail.server.mx.create: guardEnvelope.dnsLookup must be a function");
+    }
+    // DKIM bounds caught at boot, not at the first DATA — mirroring
+    // the exact ranges b.mail.dkim.verify enforces per call, so an
+    // operator typo fails startup instead of turning every live
+    // message into an envelope_error + temperror disposition.
+    numericBounds.requireAllPositiveFiniteIntIfPresent(ge,
+      ["maxSignatures", "clockSkewMs", "minRsaBits", "timeoutMs"],
+      "mail.server.mx.guardEnvelope.", MailServerMxError, "mail-server-mx/bad-bound");
+    if (ge.maxSignatures !== undefined && ge.maxSignatures !== null &&
+        ge.maxSignatures > dkim().DKIM_MAX_SIGNATURES_PER_MESSAGE_CEILING) {
+      throw new MailServerMxError("mail-server-mx/bad-bound",
+        "mail.server.mx.create: guardEnvelope.maxSignatures " + ge.maxSignatures +
+        " exceeds the DKIM verifier ceiling " +
+        dkim().DKIM_MAX_SIGNATURES_PER_MESSAGE_CEILING +
+        " (RFC 6376 §6.1 fan-out DoS bound)");
+    }
+    if (ge.clockSkewMs !== undefined && ge.clockSkewMs !== null &&
+        ge.clockSkewMs > dkim().DKIM_CLOCK_SKEW_MS_MAX) {
+      throw new MailServerMxError("mail-server-mx/bad-bound",
+        "mail.server.mx.create: guardEnvelope.clockSkewMs " + ge.clockSkewMs +
+        " exceeds the DKIM verifier ceiling " + dkim().DKIM_CLOCK_SKEW_MS_MAX +
+        " (RFC 6376 §3.5 back-dating replay defense)");
+    }
+    envelopeGate = Object.freeze({
+      mode:          geMode,
+      onTemperror:   geOnTemperror,
+      // RFC 8601 authserv-id — the receiver's own name on the
+      // Authentication-Results header. Defaults to the first local
+      // domain; with neither, the header is skipped (the verdict
+      // still reaches the agent handoff).
+      authservId:    ge.authservId || localDomains[0] || null,
+      dnsLookup:     ge.dnsLookup || undefined,
+      maxSignatures: ge.maxSignatures,
+      clockSkewMs:   ge.clockSkewMs,
+      minRsaBits:    ge.minRsaBits,
+      // Wall-clock ceiling for the whole pipeline (SPF include chains
+      // + per-signature DKIM key fetches + DMARC policy walk). A
+      // message stuffed with signatures pointing at slow resolvers
+      // must not pin the connection slot — on timeout the message
+      // takes the temperror disposition (defer / accept per
+      // onTemperror).
+      timeoutMs:     (ge.timeoutMs === undefined || ge.timeoutMs === null)
+        ? C.TIME.seconds(20) : ge.timeoutMs,
+    });
+  }
+
   // Default-on operator-supplied-domain hardening. opts.localDomains
   // and the HELO / MAIL FROM / RCPT TO domain validations all route
   // through `b.guardDomain` for IDN homograph / Punycode-spoof defense
@@ -885,6 +1049,110 @@ function create(opts) {
           return;
         }
       }
+      // DATA-phase message authentication (opts.guardEnvelope) — SPF /
+      // DKIM / DMARC through b.mail.inbound.verify, refusing before the
+      // agent handoff so a policy-failing message never reaches storage.
+      var inboundAuth = null;
+      if (envelopeGate) {
+        var inboundVerdict = null;
+        try {
+          // Wall-clock ceiling around the whole pipeline — a message
+          // stuffed with signatures pointing at slow resolvers must
+          // not pin the connection slot. Timeout surfaces as
+          // SafeAsyncError(async/timeout) into the catch below.
+          inboundVerdict = await safeAsync.withTimeout(
+            mailAuth().inbound.verify({
+              ip:            state.remoteAddress,
+              helo:          state.helo || undefined,
+              mailFrom:      state.mailFrom || undefined,
+              message:       dedotted,
+              dnsLookup:     envelopeGate.dnsLookup,
+              maxSignatures: envelopeGate.maxSignatures,
+              clockSkewMs:   envelopeGate.clockSkewMs,
+              minRsaBits:    envelopeGate.minRsaBits,
+              authservId:    envelopeGate.authservId || undefined,
+            }),
+            envelopeGate.timeoutMs,
+            { name: "mail.server.mx.guardEnvelope" });
+        } catch (err) {
+          // Pipeline infrastructure failure or wall-clock timeout (not
+          // an authentication verdict). Same disposition as a DNS
+          // temperror: defer so the sender retries, or accept
+          // unauthenticated when the operator chose availability via
+          // onTemperror.
+          _emit("mail.server.mx.envelope_error", {
+            connectionId: state.id,
+            mailFrom:     state.mailFrom,
+            error:        (err && err.message) || String(err),
+          }, "failure");
+          if (envelopeGate.mode === "enforce" && envelopeGate.onTemperror === "defer") {
+            _writeReply(socket, REPLY_451_LOCAL_ERROR,
+              "4.7.0 Message authentication could not be completed; try again later");
+            _resetTransaction(state);
+            return;
+          }
+        }
+        if (inboundVerdict) {
+          var envAction = _envelopeActionFor(inboundVerdict, envelopeGate);
+          var dkimSummary = inboundVerdict.dkim.some(function (d) { return d.result === "pass"; })
+            ? "pass"
+            : (inboundVerdict.dkim[0] ? inboundVerdict.dkim[0].result : "none");
+          _emit("mail.server.mx.envelope_verdict", {
+            connectionId: state.id,
+            mailFrom:     state.mailFrom,
+            fromDomain:   inboundVerdict.from.domain,
+            spf:          inboundVerdict.spf.result,
+            dkim:         dkimSummary,
+            dmarc:        inboundVerdict.dmarc.result,
+            action:       envAction,
+            mode:         envelopeGate.mode,
+          }, (envAction === "reject" || envAction === "defer") ? "denied" : "success");
+          if (envelopeGate.mode === "enforce" && envAction === "reject") {
+            // RFC 7372 §3.2 — 5.7.26 ("multiple authentication checks
+            // failed") for a DMARC evaluation that failed; the
+            // multi-From / unparsable-author permerror shape is a
+            // message-acceptability refusal and keeps the generic
+            // 5.7.1.
+            var enhanced = inboundVerdict.dmarc.result === "fail" ? "5.7.26" : "5.7.1";
+            _writeReply(socket, REPLY_550_MAILBOX_UNAVAIL,
+              enhanced + " Message refused by sender authentication policy (DMARC " +
+              inboundVerdict.dmarc.result + "; SPF " + inboundVerdict.spf.result +
+              ", DKIM " + dkimSummary + ")");
+            _resetTransaction(state);
+            return;
+          }
+          if (envelopeGate.mode === "enforce" && envAction === "defer") {
+            _writeReply(socket, REPLY_451_LOCAL_ERROR,
+              "4.7.0 Sender authentication temporarily unavailable (DNS); try again later");
+            _resetTransaction(state);
+            return;
+          }
+          // Accept / quarantine / monitor mode: the verdict rides to
+          // the agent handoff as `auth`, and the receiver's RFC 8601
+          // Authentication-Results header is prepended so downstream
+          // consumers (spam-foldering quarantined mail included) act
+          // on authenticated results instead of re-verifying.
+          if (inboundVerdict.authResults) {
+            // RFC 8601 §5 — strip any sender-attached A-R header
+            // claiming this receiver's authserv-id before prepending
+            // the computed one (forged-verdict shadowing defense).
+            dedotted = _stripForgedAuthResults(dedotted, envelopeGate.authservId);
+            dedotted = Buffer.concat([
+              Buffer.from(inboundVerdict.authResults + "\r\n", "utf8"),
+              dedotted,
+            ]);
+          }
+          inboundAuth = {
+            spf:        inboundVerdict.spf,
+            dkim:       inboundVerdict.dkim,
+            dmarc:      inboundVerdict.dmarc,
+            from:       inboundVerdict.from,
+            action:     envAction,
+            mode:       envelopeGate.mode,
+            quarantine: envAction === "quarantine",
+          };
+        }
+      }
       // operator-supplied agent handoff — when wired, persist via
       // agent + write the 250 reply. When not wired, accept-and-drop
       // (audit-only mode useful for staging deployments).
@@ -897,6 +1165,7 @@ function create(opts) {
           remote:   { address: state.remoteAddress, port: state.remotePort },
           tls:      state.tls,
           helo:     state.helo,
+          auth:     inboundAuth,
           connectionId: state.id,
         }).then(function (ack) {
           _emit("mail.server.mx.delivered",

package/lib/vendor/blamejs/lib/mail-spam-score.js

@@ -70,6 +70,7 @@
 var { defineClass }   = require("./framework-error");
 var lazyRequire       = require("./lazy-require");
 var validateOpts      = require("./validate-opts");
+var gateContract      = require("./gate-contract");
 
 var audit = lazyRequire(function () { return require("./audit"); });
 
@@ -90,12 +91,7 @@ var PROFILES = Object.freeze({
   permissive: { threshold: 10.0, maxReasons: MAX_REASONS, maxReasonBytes: MAX_REASON_BYTES },
 });
 
-var COMPLIANCE_POSTURES = Object.freeze({
-  hipaa:     "strict",
-  "pci-dss": "strict",
-  gdpr:      "strict",
-  soc2:      "strict",
-});
+var COMPLIANCE_POSTURES = gateContract.ALL_STRICT_POSTURES;
 
 /**
  * @primitive b.mail.spamScore.create