@blamejs/blamejs-shop 0.4.56 → 0.4.57

package/lib/vendor/blamejs/lib/mail-helo.js

@@ -114,7 +114,6 @@ var MailHeloError = defineClass("MailHeloError", { alwaysPermanent: true });
 // trailing); §2.3.5 domain: dot-joined LDH labels; total ≤ 255 octets
 // per RFC 1035 §2.3.4.
 var LDH_LABEL_RE = /^[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?$/;                                      // allow:regex-no-length-cap — anchored + per-label repeat cap matches RFC 5321 §2.3.5
-var ADDR_LIT_V4_RE = /^\[((?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(?:\.(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})\]$/;  // allow:regex-no-length-cap — anchored + per-octet repeat cap
 var ADDR_LIT_V6_RE = /^\[IPv6:([0-9a-fA-F:.]+)\]$/;                                                       // allow:regex-no-length-cap — IPv6 textual bounded by overall maxBytes
 
 var DEFAULT_MAX_BYTES = 255;                                                                              // RFC 1035 §2.3.4 cap
@@ -201,7 +200,7 @@ var LOCALHOST_REFUSED = Object.freeze({
  */
 async function evaluate(ctx, opts) {
   opts = opts || {};
-  var profile = opts.profile || (opts.posture && COMPLIANCE_POSTURES[opts.posture]) || DEFAULT_PROFILE;
+  var profile = gateContract.resolveProfileName(opts, COMPLIANCE_POSTURES, DEFAULT_PROFILE);
   if (!PROFILES[profile]) {
     throw new MailHeloError("mail-helo/bad-profile",
       "evaluate: unknown profile '" + profile + "'");
@@ -233,7 +232,7 @@ async function evaluate(ctx, opts) {
   }
 
   // Classify shape: address-literal vs domain vs invalid.
-  var v4Lit = claimed.match(ADDR_LIT_V4_RE);
+  var v4Lit = claimed.match(ipUtils.IPV4_ADDR_LITERAL_RE);
   var v6Lit = claimed.match(ADDR_LIT_V6_RE);
   if (v4Lit) {
     if (v4Lit[1] !== ctx.ip) {

package/lib/vendor/blamejs/lib/mail-journal.js

@@ -69,6 +69,7 @@
  */
 
 var C = require("./constants");
+var safeBuffer = require("./safe-buffer");
 var validateOpts = require("./validate-opts");
 var numericBounds = require("./numeric-bounds");
 var safeJson = require("./safe-json");
@@ -265,7 +266,7 @@ function create(opts) {
       throw new MailJournalError("mail-journal/bad-body",
         "mail.journal.record: opts.bodyBytes must be a Buffer");
     }
-    if (req.bodyBytes.length > C.BYTES.mib(256)) {                                                    // per-message cap
+    if (safeBuffer.byteLengthOf(req.bodyBytes) > C.BYTES.mib(256)) {                                                    // per-message cap
       throw new MailJournalError("mail-journal/too-large",
         "mail.journal.record: message " + req.bodyBytes.length + " bytes exceeds 256 MiB cap");
     }

package/lib/vendor/blamejs/lib/mail-mdn.js

@@ -31,6 +31,7 @@
 var bCrypto = require("./crypto");
 var lazyRequire = require("./lazy-require");
 var mimeParse = require("./mime-parse");
+var structuredFields = require("./structured-fields");
 var audit = lazyRequire(function () { return require("./audit"); });
 var C = require("./constants");
 var validateOpts = require("./validate-opts");
@@ -84,9 +85,9 @@ function _parseDisposition(value) {
   }
   var modePart = value.slice(0, semi).trim();
   var typePart = value.slice(semi + 1).trim();
-  var slash = modePart.indexOf("/");
-  var actionMode = slash === -1 ? modePart.toLowerCase() : modePart.slice(0, slash).trim().toLowerCase();
-  var sendingMode = slash === -1 ? null : modePart.slice(slash + 1).trim().toLowerCase();
+  var mkv = structuredFields.parseKeyValuePiece(modePart, "/");
+  var actionMode = mkv.key;
+  var sendingMode = mkv.value === null ? null : mkv.value.trim().toLowerCase();
   var type = typePart.toLowerCase();
   // Strip /modifier off the type token.
   var typeSlash = type.indexOf("/");

package/lib/vendor/blamejs/lib/mail-rbl.js

@@ -87,15 +87,12 @@ var { defineClass }    = require("./framework-error");
 var lazyRequire        = require("./lazy-require");
 var ipUtils            = require("./ip-utils");
 var gateContract       = require("./gate-contract");
+var codepointClass     = require("./codepoint-class");
 
 var audit              = lazyRequire(function () { return require("./audit"); });
 
 var MailRblError = defineClass("MailRblError", { alwaysPermanent: true });
 
-var IPV4_RE       = /^(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(?:\.(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}$/;  // allow:regex-no-length-cap — anchored + per-octet repeat-cap
-var IPV6_HEX_RE   = /^[0-9a-fA-F:]+$/;                                                                    // allow:regex-no-length-cap — checked by length cap below
-var IPV6_MAX_LEN  = 39;                                                                                   // max IPv6 textual length (8 groups × 4 hex + 7 colons)
-
 var DEFAULT_TIMEOUT_MS    = C.TIME.seconds(5);
 var DEFAULT_CONCURRENCY   = 8;                                                                           // concurrent-query cap, not bytes
 var DEFAULT_PROFILE       = "strict";
@@ -142,7 +139,7 @@ function create(opts) {
     throw new MailRblError("mail-rbl/bad-resolver",
       "create: opts.resolver must be a b.network.dns.resolver.create() instance");
   }
-  var profile = opts.profile || (opts.posture && COMPLIANCE_POSTURES[opts.posture]) || DEFAULT_PROFILE;
+  var profile = gateContract.resolveProfileName(opts, COMPLIANCE_POSTURES, DEFAULT_PROFILE);
   if (!PROFILES[profile]) {
     throw new MailRblError("mail-rbl/bad-profile",
       "create: unknown profile '" + profile + "'");
@@ -286,11 +283,11 @@ function reverseIp(ip) {
       "reverseIp: ip must be a non-empty string");
   }
   // IPv4 first.
-  if (IPV4_RE.test(ip)) {
+  if (ipUtils.isIPv4(ip)) {
     return ip.split(".").reverse().join(".");
   }
   // IPv6 — accept canonical / compressed forms. Expand and nibble-reverse.
-  if (ip.length > IPV6_MAX_LEN || !IPV6_HEX_RE.test(ip)) {
+  if (!ipUtils.looksLikeIPv6Hex(ip)) {
     throw new MailRblError("mail-rbl/bad-input",
       "reverseIp: '" + ip + "' is not a valid IPv4 or IPv6 address");
   }
@@ -336,7 +333,7 @@ function _validateZoneNames(zones) {
     // if non-ASCII upstream).
     for (var c = 0; c < z.length; c += 1) {
       var cc = z.charCodeAt(c);
-      if (cc < 0x20 || cc === 0x7f || cc > 0x7e) {                                                       // RFC 1035 ASCII zone-name shape
+      if (codepointClass.isForbiddenControlChar(cc, { forbidTab: true }) || cc > 0x7e) {                 // RFC 1035 ASCII zone-name shape (printable ASCII only)
         throw new MailRblError("mail-rbl/bad-zone",
           "list zone '" + z + "' contains non-ASCII or control chars");
       }

package/lib/vendor/blamejs/lib/mail-scan.js

@@ -173,7 +173,7 @@ function create(opts) {
     validateOpts.requireNonEmptyString(service, "mail.scan.create.service",
       MailScanError, "mail-scan/bad-service");
   }
-  var profile = opts.profile || (opts.posture && COMPLIANCE_POSTURES[opts.posture]) || DEFAULT_PROFILE;
+  var profile = gateContract.resolveProfileName(opts, COMPLIANCE_POSTURES, DEFAULT_PROFILE);
   if (!PROFILES[profile]) {
     throw new MailScanError("mail-scan/bad-profile",
       "mail.scan.create.profile: unknown '" + profile + "' (valid: strict / balanced / permissive)");
@@ -194,7 +194,7 @@ function create(opts) {
       throw new MailScanError("mail-scan/bad-input",
         "mail.scan.scan: messageBytes must be non-empty");
     }
-    if (messageBytes.length > caps.maxMessageBytes) {
+    if (safeBuffer.byteLengthOf(messageBytes) > caps.maxMessageBytes) {
       throw new MailScanError("mail-scan/oversize-message",
         "mail.scan.scan: messageBytes=" + messageBytes.length + " exceeds maxMessageBytes=" +
         caps.maxMessageBytes);

package/lib/vendor/blamejs/lib/mail-send-deliver.js

@@ -441,16 +441,32 @@ function create(opts) {
   validateOpts(opts,
     ["hostname", "resolver", "policy", "retry", "dsn", "timeouts", "audit", "transportFactory", "port"],
     "mail.send.deliver.create");
-  validateOpts.requireNonEmptyString(opts.hostname,
-    "mail.send.deliver.create: hostname (local HELO/EHLO + DSN Reporting-MTA)",
-    DeliverError, "deliver/bad-hostname");
-  // Submission/smarthost relays listen on 587 (RFC 6409) or implicit-TLS
-  // 465 (RFC 8314) rather than the IANA SMTP port 25 (RFC 5321 §2.3.4)
-  // that direct MX delivery uses. Operators routing through such a relay
-  // set opts.port; the value is range-checked here (RFC 6335 §6) so a
-  // typo fails at config time, not on the first connect attempt.
-  validateOpts.optionalPort(opts.port,
-    "mail.send.deliver.create: port", DeliverError, "deliver/bad-port");
+  // hostname is required; opts.port (when present) must be a valid connect
+  // port. Submission/smarthost relays listen on 587 (RFC 6409) or
+  // implicit-TLS 465 (RFC 8314) rather than the IANA SMTP port 25
+  // (RFC 5321 §2.3.4) that direct MX delivery uses. Operators routing
+  // through such a relay set opts.port; the value is range-checked here
+  // (RFC 6335 §6) so a typo fails at config time, not on the first
+  // connect attempt.
+  // The shape is the authoritative, exhaustive opts contract: every key
+  // the factory accepts is declared here. hostname + port carry their
+  // final per-field codes; the sub-object opts (policy / retry / dsn /
+  // timeouts) are shape-checked only for object-ness here, with their
+  // field-level validation (and the distinct per-field codes operators
+  // see) applied below where each sub-object is resolved.
+  validateOpts.shape(opts, {
+    hostname:         { rule: "required-string", code: "deliver/bad-hostname",
+                        label: "mail.send.deliver.create: hostname (local HELO/EHLO + DSN Reporting-MTA)" },
+    port:             { rule: "optional-port", code: "deliver/bad-port" },
+    resolver:         { rule: "optional-plain-object", code: "deliver/bad-resolver",
+                        label: "mail.send.deliver.create: resolver (b.network.dns.resolver handle)" },
+    policy:           { rule: "optional-plain-object", code: "deliver/bad-policy" },
+    retry:            { rule: "optional-plain-object", code: "deliver/bad-retry" },
+    dsn:              { rule: "optional-plain-object", code: "deliver/bad-dsn" },
+    timeouts:         { rule: "optional-plain-object", code: "deliver/bad-timeouts" },
+    audit:            { rule: "optional-boolean", code: "deliver/bad-audit" },
+    transportFactory: { rule: "optional-function", code: "deliver/bad-transport-factory" },
+  }, "mail.send.deliver.create", DeliverError, "deliver/bad-opts");
   var port = opts.port || DEFAULT_PORT_SMTP;
 
   var policy = opts.policy || {};
@@ -480,10 +496,12 @@ function create(opts) {
 
   var timeouts = opts.timeouts || {};
   validateOpts(timeouts, ["mxLookupMs", "perHostMs"], "mail.send.deliver.create.timeouts");
-  validateOpts.optionalPositiveInt(timeouts.mxLookupMs,
-    "mail.send.deliver.create.timeouts.mxLookupMs", DeliverError, "deliver/bad-timeout-mxLookupMs");
-  validateOpts.optionalPositiveInt(timeouts.perHostMs,
-    "mail.send.deliver.create.timeouts.perHostMs", DeliverError, "deliver/bad-timeout-perHostMs");
+  validateOpts.shape(timeouts, {
+    mxLookupMs: { rule: "optional-positive-int", code: "deliver/bad-timeout-mxLookupMs",
+                  label: "mail.send.deliver.create.timeouts.mxLookupMs" },
+    perHostMs:  { rule: "optional-positive-int", code: "deliver/bad-timeout-perHostMs",
+                  label: "mail.send.deliver.create.timeouts.perHostMs" },
+  }, "mail.send.deliver.create.timeouts", DeliverError, "deliver/bad-timeouts");
   var mxLookupTimeoutMs = timeouts.mxLookupMs !== undefined
     ? timeouts.mxLookupMs : DEFAULT_MX_LOOKUP_TIMEOUT_MS;
   var perHostTimeoutMs = timeouts.perHostMs !== undefined
@@ -502,12 +520,7 @@ function create(opts) {
   }
 
   var auditEnabled = opts.audit !== false;
-  function _auditEmit(action, outcome, metadata) {
-    if (!auditEnabled) return;
-    try {
-      audit().safeEmit({ action: action, outcome: outcome, metadata: metadata || {} });
-    } catch (_e) { /* drop-silent — hot-path audit */ }
-  }
+  var _auditEmit = audit().namespaced(null, { audit: auditEnabled });
 
   async function deliver(envelope) {
     if (!envelope || typeof envelope !== "object") {

package/lib/vendor/blamejs/lib/mail-server-imap.js

@@ -117,7 +117,7 @@
  */
 
 var net  = require("node:net");
-var lazyRequire = require("./lazy-require");
+var safeBuffer = require("./safe-buffer");
 var C = require("./constants");
 var bCrypto = require("./crypto");
 var numericBounds = require("./numeric-bounds");
@@ -126,9 +126,10 @@ var guardImapCommand = require("./guard-imap-command");
 var mailServerRateLimit = require("./mail-server-rate-limit");
 var mailServerRegistry = require("./mail-server-registry");
 var mailServerTls = require("./mail-server-tls");
+var mailServerNet = require("./mail-server-net");
 var { defineClass } = require("./framework-error");
 
-var audit = lazyRequire(function () { return require("./audit"); });
+var auditEmit = require("./audit-emit");
 
 var MailServerImapError = defineClass("MailServerImapError", { alwaysPermanent: true });
 
@@ -138,6 +139,7 @@ var DEFAULT_IDLE_TIMEOUT_MS  = C.TIME.minutes(30);
 var IDLE_BANDWIDTH_TIMEOUT_MS = C.TIME.minutes(29);  // RFC 2177 §3 — re-issue before 30
 var DEFAULT_GREETING_VENDOR  = "blamejs IMAP4rev2";
 var pkgVersion = require("../package.json").version;
+var codepointClass = require("./codepoint-class");
 
 // Error-message clamp bytes — protocol-string clamp, not a byte count.
 // Centralized so the marker lives in one place
@@ -196,10 +198,7 @@ function _parseImapDateTime(s) {
 function _validateMailboxName(name, opts) {
   if (typeof name !== "string" || name.length === 0) return false;
   if (name.length > 1024) return false;                                                              // mailbox name cap
-  for (var i = 0; i < name.length; i += 1) {
-    var c = name.charCodeAt(i);
-    if (c < 0x20 || c === 0x7F) return false;                                                        // control-byte refusal
-  }
+  if (codepointClass.firstControlCharOffset(name, { forbidTab: true }) !== -1) return false;        // control-byte refusal
   if (name.indexOf("..") !== -1) return false;
   if (name === "/" || name[0] === "/" || name[name.length - 1] === "/") return false;
   // Modified-UTF7 detection — RFC 3501 §5.1.3. Sequences are
@@ -275,40 +274,18 @@ function create(opts) {
   var mailStore         = opts.mailStore;
   var allowLegacyMUtf7  = profile === "permissive";
 
-  var rateLimit;
-  if (opts.rateLimit === false) {
-    rateLimit = mailServerRateLimit.create({ disabled: true });
-  } else if (opts.rateLimit && typeof opts.rateLimit.admitConnection === "function") {
-    rateLimit = opts.rateLimit;
-  } else {
-    rateLimit = mailServerRateLimit.create(opts.rateLimit || {});
-  }
+  var rateLimit = mailServerRateLimit.resolve(opts.rateLimit);
 
-  var tcpServer    = null;
-  var listening    = false;
   var connections  = new Set();
 
-  function _emit(action, metadata, outcome) {
-    try {
-      audit().safeEmit({
-        action:   action,
-        outcome:  outcome || "success",
-        metadata: metadata || {},
-      });
-    } catch (_e) { /* drop-silent — audit best-effort */ }
-  }
+  var _emit = auditEmit.emit;
 
   function _handleConnection(rawSocket) {
-    var remoteAddress = rawSocket.remoteAddress || "0.0.0.0";
-    var admit = rateLimit.admitConnection(remoteAddress);
-    if (!admit.ok) {
-      _emit("mail.server.imap.rate_limit_refused",
-        { remoteAddress: remoteAddress, reason: admit.reason }, "denied");
-      try { rawSocket.write("* BAD Too many connections from your IP\r\n"); }
-      catch (_e) { /* socket may be down */ }
-      try { rawSocket.destroy(); } catch (_e2) { /* idempotent */ }
-      return;
-    }
+    var remoteAddress = mailServerNet.admitConnection(rawSocket, rateLimit, _emit, {
+      refusedEvent: "mail.server.imap.rate_limit_refused",
+      refusalLine:  "* BAD Too many connections from your IP\r\n",
+    });
+    if (remoteAddress === null) return;
     rawSocket.once("close", function () { rateLimit.releaseConnection(remoteAddress); });
 
     var connectionId = "imapconn-" + bCrypto.generateToken(8);                                       // connection-id length
@@ -389,7 +366,7 @@ function create(opts) {
       }
       var crlf = state.lineBuffer.indexOf("\r\n");
       if (crlf === -1) {
-        if (state.lineBuffer.length > maxLineBytes) {
+        if (safeBuffer.byteLengthOf(state.lineBuffer) > maxLineBytes) {
           _writeUntagged(socket, "BAD Line too long (cap " + maxLineBytes + ")");
           _close(socket, state);
         }
@@ -932,20 +909,17 @@ function create(opts) {
     //     would let the post-TLS state machine resume an exchange that
     //     started in plaintext, conflating cleartext + TLS-protected
     //     phases of the same SASL run.
-    // Listener-removal + idle-timeout re-arm live in the shared
-    // upgradeSocket helper (b.mail.server.tls.upgradeSocket).
-    state.lineBuffer    = Buffer.alloc(0);
-    state.pendingLiteral = null;
-    state.authPending    = null;
-    mailServerTls.upgradeSocket({
-      plainSocket:   socket,
+    // The pre-handshake state-drain (lineBuffer + pendingLiteral +
+    // authPending), listener-removal, idle-timeout re-arm, and the
+    // post-handshake read-pump live in the shared upgradeLineProtocol
+    // helper (b.mail.server.tls.upgradeLineProtocol).
+    mailServerTls.upgradeLineProtocol({
+      state:         state,
+      socket:        socket,
       secureContext: opts.tlsContext,
       idleTimeoutMs: idleTimeoutMs,
-      onSecure: function (_tlsSocket) { state.tls = true; },
-      onData: function (tlsSocket, chunk) {
-        state.lineBuffer = Buffer.concat([state.lineBuffer, chunk]);
-        _drainBuffer(state, tlsSocket);
-      },
+      clearFields:   ["pendingLiteral", "authPending"],
+      drain:         _drainBuffer,
       onError: function (err) {
         _emit("mail.server.imap.tls_handshake_failed",
           { connectionId: state.id, error: (err && err.message) || String(err) }, "failure");
@@ -1476,7 +1450,7 @@ function create(opts) {
               if (q && typeof q.usedBytes === "number" &&
                   typeof q.capBytes === "number" &&
                   q.capBytes > 0 &&
-                  q.usedBytes + literalBody.length > q.capBytes) {
+                  q.usedBytes + safeBuffer.byteLengthOf(literalBody) > q.capBytes) {
                 var err = new Error("APPEND would exceed quota (used " + q.usedBytes +
                   " + " + literalBody.length + " > cap " + q.capBytes + ")");
                 err.code = "mail-server-imap/overquota";
@@ -1812,44 +1786,15 @@ function create(opts) {
   }
 
   // ---- Lifecycle ----------------------------------------------------------
-  async function listen(listenOpts) {
-    listenOpts = listenOpts || {};
-    if (listening) {
-      throw new MailServerImapError("mail-server-imap/already-listening",
-        "listen: already listening");
-    }
-    var port    = listenOpts.port    === undefined ? 143 : listenOpts.port;                           // RFC 9051 IMAP port (IANA)
-    var address = listenOpts.address || "0.0.0.0";
-    tcpServer = net.createServer(function (socket) { _handleConnection(socket); });
-    return new Promise(function (resolve, reject) {
-      tcpServer.once("error", reject);
-      tcpServer.listen(port, address, function () {
-        listening = true;
-        tcpServer.removeListener("error", reject);
-        _emit("mail.server.imap.listening",
-          { port: port, address: address });
-        resolve({ port: tcpServer.address().port, address: address });
-      });
-    });
-  }
-
-  async function close() {
-    if (!listening) return;
-    listening = false;
-    for (var s of connections) { try { s.destroy(); } catch (_e) { /* idempotent */ } }
-    connections.clear();
-    return new Promise(function (resolve) {
-      tcpServer.close(function () {
-        _emit("mail.server.imap.closed", {});
-        resolve();
-      });
-    });
-  }
-
-  return {
-    listen:               listen,
-    close:                close,
-  };
+  return mailServerNet.createStoreServer(net, {
+    defaultPort:      143,                                                                              // RFC 9051 IMAP port (IANA)
+    handleConnection: _handleConnection,
+    errorClass:       MailServerImapError,
+    errorCodePrefix:  "mail-server-imap/",
+    emit:             _emit,
+    connections:      connections,
+    eventBase:        "mail.server.imap",
+  });
 }
 
 module.exports = {

package/lib/vendor/blamejs/lib/mail-server-jmap.js

@@ -129,6 +129,7 @@ var mailServerRegistry = require("./mail-server-registry");
 var { defineClass } = require("./framework-error");
 
 var audit = lazyRequire(function () { return require("./audit"); });
+var auditEmit = require("./audit-emit");
 
 var MailServerJmapError = defineClass("MailServerJmapError", { alwaysPermanent: true });
 
@@ -232,15 +233,7 @@ function create(opts) {
   });
   var sessionState = bCrypto.generateToken(16);                                                       // opaque session-state token length
 
-  function _emit(action, metadata, outcome) {
-    try {
-      audit().safeEmit({
-        action:   action,
-        outcome:  outcome || "success",
-        metadata: metadata || {},
-      });
-    } catch (_e) { /* drop-silent — audit best-effort */ }
-  }
+  var _emit = auditEmit.emit;
 
   // ---- Back-reference resolution (RFC 8620 §3.7) -------------------------
   //
@@ -520,7 +513,10 @@ function create(opts) {
     });
   }
 
-  function sessionHandler(req, res) {
+  // _requireActor(req, res) — resolve the authenticated actor; on absence,
+  // write the RFC 8620 401 forbidden Problem-Details body and return null so
+  // the caller returns. Shared by every JMAP handler that gates on actor.
+  function _requireActor(req, res) {
     var actor = req.user || (req.actor || null);
     if (!actor) {
       res.statusCode = 401;
@@ -529,8 +525,28 @@ function create(opts) {
         type:        "urn:ietf:params:jmap:error:forbidden",
         description: "Authentication required",
       }));
-      return;
+      return null;
     }
+    return actor;
+  }
+
+  // _forEachQueryParam(query, fn) — split a raw URL query string on "&" and
+  // hand each non-empty pair to fn(rawKey, rawValue): the key is the text
+  // before the first "=", the value the remainder (both still
+  // percent-encoded — the caller decodes the slices it keeps).
+  function _forEachQueryParam(query, fn) {
+    query.split("&").forEach(function (pair) {
+      if (!pair) return;
+      var eq = pair.indexOf("=");
+      var k = eq === -1 ? pair : pair.slice(0, eq);
+      var v = eq === -1 ? "" : pair.slice(eq + 1);
+      fn(k, v);
+    });
+  }
+
+  function sessionHandler(req, res) {
+    var actor = _requireActor(req, res);
+    if (!actor) return;
     Promise.resolve().then(function () { return opts.accountsFor(actor); })
       .then(function (accountInfo) {
         var info = accountInfo || { primaryAccounts: {}, accounts: {} };
@@ -592,16 +608,8 @@ function create(opts) {
   // closeafter=no (default) — keep open until disconnect.
   // ping=<seconds> — keepalive interval (default 30s, min 5s, max 900s).
   function eventSourceHandler(req, res) {
-    var actor = req.user || (req.actor || null);
-    if (!actor) {
-      res.statusCode = 401;
-      res.setHeader("Content-Type", "application/json; charset=utf-8");
-      res.end(JSON.stringify({
-        type:        "urn:ietf:params:jmap:error:forbidden",
-        description: "Authentication required",
-      }));
-      return;
-    }
+    var actor = _requireActor(req, res);
+    if (!actor) return;
     if (typeof opts.mailStore.subscribePush !== "function") {
       res.statusCode = 503;
       res.setHeader("Content-Type", "application/json; charset=utf-8");
@@ -618,11 +626,7 @@ function create(opts) {
     var qIdx = url.indexOf("?");
     var query = qIdx === -1 ? "" : url.slice(qIdx + 1);
     var params = Object.create(null);
-    query.split("&").forEach(function (pair) {
-      if (!pair) return;
-      var eq = pair.indexOf("=");
-      var k = eq === -1 ? pair : pair.slice(0, eq);
-      var v = eq === -1 ? "" : pair.slice(eq + 1);
+    _forEachQueryParam(query, function (k, v) {
       try { params[decodeURIComponent(k)] = decodeURIComponent(v); }
       catch (_e) { /* drop-silent — malformed % encoding */ }
     });
@@ -797,16 +801,8 @@ function create(opts) {
   }
 
   function uploadHandler(req, res) {
-    var actor = req.user || (req.actor || null);
-    if (!actor) {
-      res.statusCode = 401;
-      res.setHeader("Content-Type", "application/json; charset=utf-8");
-      res.end(JSON.stringify({
-        type:        "urn:ietf:params:jmap:error:forbidden",
-        description: "Authentication required",
-      }));
-      return;
-    }
+    var actor = _requireActor(req, res);
+    if (!actor) return;
     if (typeof opts.mailStore.uploadBlob !== "function") {
       res.statusCode = 503;
       res.setHeader("Content-Type", "application/json; charset=utf-8");
@@ -938,16 +934,8 @@ function create(opts) {
   // shaped buffer (Buffer or async-iterable) + the canonical MIME
   // type; the handler pipes it to the response.
   function downloadHandler(req, res) {
-    var actor = req.user || (req.actor || null);
-    if (!actor) {
-      res.statusCode = 401;
-      res.setHeader("Content-Type", "application/json; charset=utf-8");
-      res.end(JSON.stringify({
-        type:        "urn:ietf:params:jmap:error:forbidden",
-        description: "Authentication required",
-      }));
-      return;
-    }
+    var actor = _requireActor(req, res);
+    if (!actor) return;
     if (typeof opts.mailStore.downloadBlob !== "function") {
       res.statusCode = 503;
       res.setHeader("Content-Type", "application/json; charset=utf-8");
@@ -970,11 +958,7 @@ function create(opts) {
     var qIdx2 = rawUrl.indexOf("?");
     var query = qIdx2 === -1 ? "" : rawUrl.slice(qIdx2 + 1);
     var acceptType = "";
-    query.split("&").forEach(function (pair) {
-      if (!pair) return;
-      var eq = pair.indexOf("=");
-      var k = eq === -1 ? pair : pair.slice(0, eq);
-      var v = eq === -1 ? "" : pair.slice(eq + 1);
+    _forEachQueryParam(query, function (k, v) {
       if (k === "accept") {
         try { acceptType = decodeURIComponent(v); } catch (_e) { /* silent-catch: malformed % encoding */ }
       }