@blamejs/core 0.15.12 → 0.15.14

package/lib/mail-dav.js

@@ -129,8 +129,8 @@
  *   backend. Defends the RRULE-recursion expansion-DoS class at the PUT boundary.
  */
 
-var lazyRequire = require("./lazy-require");
 var C = require("./constants");
+var markupEscape = require("./markup-escape").markupEscape;
 var safeIcal = require("./safe-ical");
 var safeVcard = require("./safe-vcard");
 var safeBuffer = require("./safe-buffer");
@@ -138,7 +138,7 @@ var validateOpts = require("./validate-opts");
 var xmlC14n = require("./xml-c14n");
 var { defineClass } = require("./framework-error");
 
-var audit = lazyRequire(function () { return require("./audit"); });
+var auditEmit = require("./audit-emit");
 
 var MailDavError = defineClass("MailDavError", { alwaysPermanent: true });
 
@@ -221,15 +221,7 @@ function create(opts) {
   var calStorage  = opts.storage.calendar || null;
   var cardStorage = opts.storage.addressbook || null;
 
-  function _emit(action, metadata, outcome) {
-    try {
-      audit().safeEmit({
-        action:   action,
-        outcome:  outcome || "success",
-        metadata: metadata || {},
-      });
-    } catch (_e) { /* drop-silent — audit best-effort */ }
-  }
+  var _emit = auditEmit.emit;
 
   // ---- URL parsing (per-tenant principal isolation) ----------------------
   //
@@ -299,28 +291,14 @@ function create(opts) {
         resolve(Buffer.from(JSON.stringify(req.body), "utf8"));
         return;
       }
-      // safeBuffer.boundedChunkCollector enforces maxBytes inside
-       // push(); any chunk that would overflow throws + we reject the
-       // promise. The body is bounded BEFORE the cap is reached so the
-       // single allocation in result() is bounded by maxBytes.
-      var collector = safeBuffer.boundedChunkCollector({
+      // collectStream's boundedChunkCollector enforces maxBytes inside push()
+      // (overflow throws → reject) and destroys the stream on cap/error.
+      safeBuffer.collectStream(req, {
         maxBytes:    maxBody,
         errorClass:  MailDavError,
         sizeCode:    "mail-dav/oversize-body",
         sizeMessage: "request body exceeds " + maxBody + " bytes",
-      });
-      req.on("data", function (chunk) {
-        try { collector.push(chunk); }
-        catch (e) {
-          req.destroy();
-          reject(e);
-        }
-      });
-      req.on("end", function () {
-        try { resolve(collector.result()); }
-        catch (e) { reject(e); }
-      });
-      req.on("error", function (e) { reject(e); });
+      }).then(resolve, reject);
     });
   }
 
@@ -370,12 +348,7 @@ function create(opts) {
 
   function _xmlEscape(s) {
     if (s === null || s === undefined) return "";
-    return String(s)
-      .replace(/&/g, "&")
-      .replace(/</g, "&lt;")
-      .replace(/>/g, "&gt;")
-      .replace(/"/g, "&quot;")
-      .replace(/'/g, "&apos;");
+    return markupEscape(s, { apos: "&apos;" });
   }
 
   // Render a small subset of well-known DAV / CalDAV / CardDAV

package/lib/mail-deploy.js

@@ -51,8 +51,10 @@ var lazyRequire = require("./lazy-require");
 var validateOpts = require("./validate-opts");
 var numericBounds = require("./numeric-bounds");
 var C = require("./constants");
+var markupEscape = require("./markup-escape").markupEscape;
 var safeJson = require("./safe-json");
 var safeBuffer = require("./safe-buffer");
+var codepointClass = require("./codepoint-class");
 var guardJson = lazyRequire(function () { return require("./guard-json"); });
 var audit = lazyRequire(function () { return require("./audit"); });
 var { defineClass } = require("./framework-error");
@@ -73,18 +75,13 @@ function _domainOk(d) {
   // header-injection class + XML-attribute-injection class.
   for (var i = 0; i < d.length; i++) {
     var c = d.charCodeAt(i);
-    if (c < 0x20 || c === 0x7F || c === 0x22) return false;                                           // refuse C0 / DEL / "
+    if (codepointClass.isForbiddenControlChar(c, { forbidTab: true }) || c === 0x22) return false;    // refuse C0 / DEL / "
   }
   return true;
 }
 
 function _xmlEscape(s) {
-  return String(s)
-    .replace(/&/g, "&amp;")
-    .replace(/</g, "&lt;")
-    .replace(/>/g, "&gt;")
-    .replace(/"/g, "&quot;")
-    .replace(/'/g, "&apos;");
+  return markupEscape(s, { apos: "&apos;" });
 }
 
 /**
@@ -126,7 +123,7 @@ function mtaStsPublish(opts) {
     throw new MailDeployError("mail-deploy/bad-domain",
       "mtaStsPublish: opts.domain must be a valid hostname");
   }
-  if (!STS_MODES[opts.mode]) {
+  if (!Object.prototype.hasOwnProperty.call(STS_MODES, opts.mode)) {
     throw new MailDeployError("mail-deploy/bad-mode",
       "mtaStsPublish: opts.mode must be 'enforce' | 'testing' | 'none'");
   }
@@ -375,7 +372,7 @@ function autoConfigXml(opts) {
     // Refuse control bytes / quote in the URL.
     for (var k = 0; k < cfg.url.length; k++) {
       var c = cfg.url.charCodeAt(k);
-      if (c < 0x20 || c === 0x7F || c === 0x22) {                                                     // C0 / DEL / "
+      if (codepointClass.isForbiddenControlChar(c, { forbidTab: true }) || c === 0x22) {                                                     // C0 / DEL / "
         throw new MailDeployError("mail-deploy/bad-jmap-url",
           "autoConfigXml: opts.jmap.url contains control byte");
       }
@@ -444,7 +441,7 @@ function autoDiscoverXml(opts) {
   // Refuse CR / LF / NUL / control bytes in email (XML injection class).
   for (var i = 0; i < opts.email.length; i++) {
     var c = opts.email.charCodeAt(i);
-    if (c < 0x20 || c === 0x7F) {                                                                     // C0 / DEL
+    if (codepointClass.isForbiddenControlChar(c, { forbidTab: true })) {                                                                     // C0 / DEL
       throw new MailDeployError("mail-deploy/bad-email",
         "autoDiscoverXml: opts.email contains control byte");
     }
@@ -733,14 +730,14 @@ function _validateTlsRptReport(raw, ctx) {
       var sRaw = summary["total-successful-session-count"];
       var fRaw = summary["total-failure-session-count"];
       if (sRaw !== undefined) {
-        if (typeof sRaw !== "number" || !isFinite(sRaw) || sRaw < 0 || Math.floor(sRaw) !== sRaw) {
+        if (!numericBounds.isNonNegativeFiniteInt(sRaw)) {
           throw new TlsRptParseError("mail-tlsrpt/bad-summary",
             "parseTlsRptReport: policies[" + i + "].summary.total-successful-session-count must be a finite non-negative integer");
         }
         totalSuccess += sRaw;
       }
       if (fRaw !== undefined) {
-        if (typeof fRaw !== "number" || !isFinite(fRaw) || fRaw < 0 || Math.floor(fRaw) !== fRaw) {
+        if (!numericBounds.isNonNegativeFiniteInt(fRaw)) {
           throw new TlsRptParseError("mail-tlsrpt/bad-summary",
             "parseTlsRptReport: policies[" + i + "].summary.total-failure-session-count must be a finite non-negative integer");
         }
@@ -779,7 +776,11 @@ function _validatePolicy(p, idx) {
       "parseTlsRptReport: policies[" + idx + "].policy missing");
   }
   var pType = policy["policy-type"];
-  if (!TLSRPT_POLICY_TYPES[pType]) {
+  // hasOwnProperty, not `TLSRPT_POLICY_TYPES[pType]`: a remote MTA's report JSON
+  // controls pType, and a bracket lookup on the plain-object allowlist resolves
+  // inherited members ("constructor"/"__proto__"/"toString") to truthy, passing
+  // an out-of-vocabulary policy-type (prototype shadowing).
+  if (typeof pType !== "string" || !Object.prototype.hasOwnProperty.call(TLSRPT_POLICY_TYPES, pType)) {
     throw new TlsRptParseError("mail-tlsrpt/bad-policy",
       "parseTlsRptReport: policies[" + idx + "].policy.policy-type '" + pType +
       "' not in {sts, tlsa, no-policy-found}");
@@ -808,7 +809,7 @@ function _validatePolicy(p, idx) {
         throw new TlsRptParseError("mail-tlsrpt/bad-failure-detail",
           "parseTlsRptReport: policies[" + idx + "].failure-details[" + k + "] must be an object");
       }
-      if (typeof fd["result-type"] === "string" && !TLSRPT_RESULT_TYPES[fd["result-type"]]) {
+      if (typeof fd["result-type"] === "string" && !Object.prototype.hasOwnProperty.call(TLSRPT_RESULT_TYPES, fd["result-type"])) {
         // Unknown result-type — surface as audit metadata but don't
         // refuse; RFC 8460 §4.4 result-type registry can grow over
         // time and we shouldn't break on new IANA entries.

package/lib/mail-dkim.js

@@ -40,6 +40,7 @@
  */
 var lazyRequire = require("./lazy-require");
 var audit       = lazyRequire(function () { return require("./audit"); });
+var structuredFields = require("./structured-fields");
 var nodeCrypto  = require("node:crypto");
 var safeBuffer  = require("./safe-buffer");
 var validateOpts = require("./validate-opts");
@@ -85,7 +86,7 @@ var RSA_LEGACY_MIN_BITS = 1024;
 function _canonHeaderRelaxed(name, value) {
   // Lowercase name, unfold continuations, collapse internal WSP runs to
   // single SP, strip leading/trailing WSP from value.
-  var unfolded = String(value).replace(/\r?\n[ \t]+/g, " ");
+  var unfolded = structuredFields.unfoldHeaderContinuations(value);
   var trimmed = unfolded.replace(/[ \t]+/g, " ").replace(/^[ \t]+|[ \t]+$/g, "");
   return name.toLowerCase() + ":" + trimmed + "\r\n";
 }
@@ -460,26 +461,13 @@ function create(opts) {
 // hard dependency on it. When omitted, falls back to node:dns.
 
 function _parseDkimTagList(value) {
-  // RFC 6376 §3.2 — tags are `key=value` separated by `;`. Whitespace
-  // around `=` and `;` is allowed and stripped. The signer folds the
-  // DKIM-Signature header across CRLF + WSP; unfold first so tag
-  // boundaries land in the right place.
-  var unfolded = String(value).replace(/\r?\n[ \t]+/g, " ");
+  // RFC 6376 §3.2 — tags are `key=value` separated by `;`, no DQUOTE in
+  // the grammar. Whitespace around `=` and `;` is stripped; the signer
+  // folds the DKIM-Signature across CRLF + WSP, so unfold first, and FWS
+  // inside a tag value is ignored, so strip all value whitespace.
+  var pairs = structuredFields.parseTagList(value, { unfold: true, stripValueWs: true });
   var tags = {};
-  var parts = unfolded.split(";");
-  for (var i = 0; i < parts.length; i += 1) {
-    var p = parts[i].trim();
-    if (p.length === 0) continue;
-    var eq = p.indexOf("=");
-    if (eq === -1) continue;
-    var key = p.slice(0, eq).trim().toLowerCase();
-    var val = p.slice(eq + 1).trim();
-    // Whitespace inside values is unfolded — RFC 6376 §3.2 says FWS
-    // (folding whitespace) is ignored within a tag value. Strip
-    // newlines + tabs while preserving the meaningful tokens.
-    val = val.replace(/\s+/g, "");
-    tags[key] = val;
-  }
+  for (var i = 0; i < pairs.length; i += 1) tags[pairs[i][0]] = pairs[i][1];
   return tags;
 }
 
@@ -570,25 +558,10 @@ function _getDefaultResolver() {
   return _defaultResolver;
 }
 
+// Reshape TXT records off this module's own resolver via the shared
+// networkDnsResolver.resolveTxt (the legacy `[[chunk1, chunk2], ...]` shape).
 async function _safeResolveTxt(qname, operatorLookup) {
-  if (operatorLookup) return operatorLookup(qname, "TXT");
-  var r = await _getDefaultResolver().queryTxt(qname);
-  // Resolver returns parsed RRs; reshape to the legacy
-  // `[[chunk1, chunk2], ...]` shape so callers downstream don't care
-  // which path produced the bytes.
-  var out = [];
-  for (var i = 0; i < r.rrs.length; i += 1) {
-    var rr = r.rrs[i];
-    if (rr && rr.type === 16) {                                                  // IANA DNS qtype TXT
-      out.push(Array.isArray(rr.decoded) ? rr.decoded : [String(rr.decoded)]);
-    }
-  }
-  if (out.length === 0) {
-    var err = new Error("no TXT records for " + qname);
-    err.code = "ENODATA";
-    throw err;
-  }
-  return out;
+  return networkDnsResolver().resolveTxt(qname, operatorLookup, _getDefaultResolver());
 }
 
 function _resetDkimKeyCacheForTest() { DKIM_KEY_CACHE.clear(); }
@@ -1244,8 +1217,16 @@ module.exports = {
   DKIM_MAX_SIGNATURES_PER_MESSAGE: DKIM_MAX_SIGNATURES_PER_MESSAGE,
   DKIM_MAX_SIGNATURES_PER_MESSAGE_CEILING: DKIM_MAX_SIGNATURES_PER_MESSAGE_CEILING,
   DKIM_CLOCK_SKEW_MS_MAX:     DKIM_CLOCK_SKEW_MS_MAX,
+  canonHeaderRelaxed:         _canonHeaderRelaxed,   // RFC 6376 §3.4.2 — shared by the ARC signer + DMARC/ARC verifier
   _canonHeaderRelaxedForTest: _canonHeaderRelaxed,
   _canonBodyRelaxedForTest:   _canonBodyRelaxed,
   _canonBodySimpleForTest:    _canonBodySimple,
   _stripBTagValueForTest:     _stripBTagValue,
+  // The header-block parser that produces the { name, value } pairs fed to the
+  // canonicalizers. Exposed so a golden-vector test can pin its byte-exact
+  // extraction (folding, exact name, leading-SP-preserved value) — the
+  // sign->verify round-trip cannot, since both sides share this parser, so a
+  // parser byte-error is self-consistent and would only surface as a signature
+  // rejection at a real external verifier.
+  _parseHeadersForTest:       _parseHeaders,
 };

package/lib/mail-greylist.js

@@ -103,6 +103,7 @@ var bCrypto            = require("./crypto");
 var lazyRequire        = require("./lazy-require");
 var ipUtils            = require("./ip-utils");
 var gateContract       = require("./gate-contract");
+var { boundedMap }     = require("./bounded-map");
 
 var audit              = lazyRequire(function () { return require("./audit"); });
 
@@ -129,9 +130,6 @@ var PROFILES = Object.freeze({
 
 var COMPLIANCE_POSTURES = gateContract.ALL_STRICT_POSTURES;
 
-var IPV4_RE = /^(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(?:\.(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}$/;       // allow:regex-no-length-cap — anchored + per-octet repeat-cap
-var IPV6_RE = /^[0-9a-fA-F:]+$/;                                                                          // allow:regex-no-length-cap — length-checked separately
-
 /**
  * @primitive b.mail.greylist.create
  * @signature b.mail.greylist.create(opts?)
@@ -163,8 +161,8 @@ var IPV6_RE = /^[0-9a-fA-F:]+$/;
  */
 function create(opts) {
   opts = opts || {};
-  var profile = opts.profile || (opts.posture && COMPLIANCE_POSTURES[opts.posture]) || DEFAULT_PROFILE;
-  if (!PROFILES[profile]) {
+  var profile = gateContract.resolveProfileName(opts, COMPLIANCE_POSTURES, DEFAULT_PROFILE);
+  if (!Object.prototype.hasOwnProperty.call(PROFILES, profile)) {
     throw new MailGreylistError("mail-greylist/bad-profile",
       "create: unknown profile '" + profile + "'");
   }
@@ -325,9 +323,7 @@ function create(opts) {
  * @example
  *   b.mail.greylist.compliancePosture("hipaa");   // → "strict"
  */
-function compliancePosture(posture) {
-  return COMPLIANCE_POSTURES[posture] || null;
-}
+var compliancePosture = gateContract.makePostureAccessor(COMPLIANCE_POSTURES);
 
 function _hashFingerprint(cidr, mailFrom, rcptTo) {
   // Namespace-hash so the on-disk key is unlinkable to the PII
@@ -341,7 +337,7 @@ function _hashFingerprint(cidr, mailFrom, rcptTo) {
 }
 
 function _cidrKey(ip, ipv4Prefix, ipv6Prefix) {
-  if (IPV4_RE.test(ip)) {
+  if (ipUtils.isIPv4(ip)) {
     var octets = ip.split(".").map(function (s) { return parseInt(s, 10); });
     var prefix = Math.min(32, Math.max(0, ipv4Prefix));                                                  // IPv4 address bit width
     // Apply prefix: zero out the host bits.
@@ -355,7 +351,7 @@ function _cidrKey(ip, ipv4Prefix, ipv6Prefix) {
       masked & 0xff,
     ].join(".") + "/" + prefix;
   }
-  if (IPV6_RE.test(ip)) {
+  if (ipUtils.looksLikeIPv6Hex(ip)) {
     // Expand IPv6, then mask. Reuse the expansion approach from
     // mail-rbl by inlining since this is a different prefix shape.
     var expanded = ipUtils.expandIpv6Hex(ip);
@@ -390,41 +386,32 @@ function _emitAudit(auditImpl, action, metadata) {
 }
 
 function _memoryStore(maxEntries) {
-  var data = new Map();
-  var insertionOrder = [];
+  // The in-memory backend is exactly the bounded-map ceiling primitive: cap
+  // the entry count and drop the oldest on insert at capacity. boundedMap owns
+  // the insertion-order tracking and eviction; this store layers greylist TTL
+  // semantics (putAt/ttlMs) on top.
+  var data = boundedMap({ maxEntries: maxEntries, policy: "evict-oldest" });
   return {
     get: async function (key) {
       var entry = data.get(key);
       return entry ? entry.value : null;
     },
     put: async function (key, value, ttlMs) {
-      if (!data.has(key)) {
-        if (data.size >= maxEntries) {
-          // Evict oldest.
-          var oldest = insertionOrder.shift();
-          if (oldest) data.delete(oldest);
-        }
-        insertionOrder.push(key);
-      }
+      // boundedMap evicts the oldest entry when a NEW key arrives at capacity;
+      // updating an existing key neither grows the map nor evicts.
       data.set(key, { value: value, putAt: Date.now(), ttlMs: ttlMs });
     },
     delete: async function (key) {
       data.delete(key);
-      var i = insertionOrder.indexOf(key);
-      if (i !== -1) insertionOrder.splice(i, 1);
     },
     gc: async function (olderThanMs) {
       var now = Date.now();
-      var removed = 0;
+      var expired = [];
       data.forEach(function (entry, key) {
-        if (now - entry.putAt > olderThanMs) {
-          data.delete(key);
-          var i = insertionOrder.indexOf(key);
-          if (i !== -1) insertionOrder.splice(i, 1);
-          removed += 1;
-        }
+        if (now - entry.putAt > olderThanMs) expired.push(key);
       });
-      return removed;
+      expired.forEach(function (key) { data.delete(key); });
+      return expired.length;
     },
   };
 }

package/lib/mail-helo.js

@@ -114,7 +114,6 @@ var MailHeloError = defineClass("MailHeloError", { alwaysPermanent: true });
 // trailing); §2.3.5 domain: dot-joined LDH labels; total ≤ 255 octets
 // per RFC 1035 §2.3.4.
 var LDH_LABEL_RE = /^[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?$/;                                      // allow:regex-no-length-cap — anchored + per-label repeat cap matches RFC 5321 §2.3.5
-var ADDR_LIT_V4_RE = /^\[((?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(?:\.(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})\]$/;  // allow:regex-no-length-cap — anchored + per-octet repeat cap
 var ADDR_LIT_V6_RE = /^\[IPv6:([0-9a-fA-F:.]+)\]$/;                                                       // allow:regex-no-length-cap — IPv6 textual bounded by overall maxBytes
 
 var DEFAULT_MAX_BYTES = 255;                                                                              // RFC 1035 §2.3.4 cap
@@ -201,8 +200,8 @@ var LOCALHOST_REFUSED = Object.freeze({
  */
 async function evaluate(ctx, opts) {
   opts = opts || {};
-  var profile = opts.profile || (opts.posture && COMPLIANCE_POSTURES[opts.posture]) || DEFAULT_PROFILE;
-  if (!PROFILES[profile]) {
+  var profile = gateContract.resolveProfileName(opts, COMPLIANCE_POSTURES, DEFAULT_PROFILE);
+  if (!Object.prototype.hasOwnProperty.call(PROFILES, profile)) {
     throw new MailHeloError("mail-helo/bad-profile",
       "evaluate: unknown profile '" + profile + "'");
   }
@@ -233,7 +232,7 @@ async function evaluate(ctx, opts) {
   }
 
   // Classify shape: address-literal vs domain vs invalid.
-  var v4Lit = claimed.match(ADDR_LIT_V4_RE);
+  var v4Lit = claimed.match(ipUtils.IPV4_ADDR_LITERAL_RE);
   var v6Lit = claimed.match(ADDR_LIT_V6_RE);
   if (v4Lit) {
     if (v4Lit[1] !== ctx.ip) {
@@ -454,9 +453,7 @@ function _emitAudit(auditImpl, action, metadata) {
  * @example
  *   b.mail.helo.compliancePosture("hipaa");   // → "strict"
  */
-function compliancePosture(posture) {
-  return COMPLIANCE_POSTURES[posture] || null;
-}
+var compliancePosture = gateContract.makePostureAccessor(COMPLIANCE_POSTURES);
 
 module.exports = {
   evaluate:                evaluate,

package/lib/mail-journal.js

@@ -69,6 +69,7 @@
  */
 
 var C = require("./constants");
+var safeBuffer = require("./safe-buffer");
 var validateOpts = require("./validate-opts");
 var numericBounds = require("./numeric-bounds");
 var safeJson = require("./safe-json");
@@ -179,9 +180,9 @@ function create(opts) {
     throw new MailJournalError("mail-journal/bad-vault",
       "b.mail.journal.create: opts.vault must be a b.vault handle");
   }
-  if (!opts.legalHold || typeof opts.legalHold.isOnHold !== "function") {
+  if (!opts.legalHold || typeof opts.legalHold.isHeld !== "function") {
     throw new MailJournalError("mail-journal/bad-legal-hold",
-      "b.mail.journal.create: opts.legalHold must be a b.legalHold handle (must expose isOnHold)");
+      "b.mail.journal.create: opts.legalHold must be a b.legalHold handle (must expose isHeld)");
   }
   if (!opts.db || typeof opts.db.runSql !== "function") {
     throw new MailJournalError("mail-journal/bad-db",
@@ -251,7 +252,7 @@ function create(opts) {
   async function record(req) {
     validateOpts.requireObject(req, "mail.journal.record",
       MailJournalError, "mail-journal/bad-record");
-    if (!ALLOWED_DIRECTIONS[req.direction]) {
+    if (!Object.prototype.hasOwnProperty.call(ALLOWED_DIRECTIONS, req.direction)) {
       throw new MailJournalError("mail-journal/bad-direction",
         "mail.journal.record: opts.direction must be 'inbound' | 'outbound' | 'internal'");
     }
@@ -265,7 +266,7 @@ function create(opts) {
       throw new MailJournalError("mail-journal/bad-body",
         "mail.journal.record: opts.bodyBytes must be a Buffer");
     }
-    if (req.bodyBytes.length > C.BYTES.mib(256)) {                                                    // per-message cap
+    if (safeBuffer.byteLengthOf(req.bodyBytes) > C.BYTES.mib(256)) {                                                    // per-message cap
       throw new MailJournalError("mail-journal/too-large",
         "mail.journal.record: message " + req.bodyBytes.length + " bytes exceeds 256 MiB cap");
     }
@@ -299,11 +300,13 @@ function create(opts) {
 
     var regimesJson = JSON.stringify(opts.regimes);
     var floorUntil  = archivedAt + floorMs;
-    // legal_hold is omitted from the INSERT so the column's
-    // `NOT NULL DEFAULT 0` applies (the prior inline `0` SQL literal) — b.sql
-    // binds every value it is given, so leaving the column out keeps the row
-    // unsealed-at-rest default without binding a redundant constant. b.sql
-    // quotes every column + binds every remaining value as a placeholder.
+    // Auto-derive the legal-hold flag from the registry: an entry whose actor is
+    // under an active legal hold is born held, exempt from retention expiry even
+    // after the floor passes (the doc's "every entry carries a legalHold flag").
+    // setLegalHold remains the manual override. isHeld already treats a lapsed
+    // (retainUntil-expired) hold as not-held, so a stale hold won't over-flag.
+    var actorHeld = !!opts.legalHold.isHeld(req.actorId);
+    // b.sql quotes every column + binds every value as a placeholder.
     var insBuilt = _t("insert").values({
       journal_id:     journalId,
       direction:      req.direction,
@@ -313,6 +316,7 @@ function create(opts) {
       size_bytes:     sizeBytes,
       regimes:        regimesJson,
       floor_until:    floorUntil,
+      legal_hold:     actorHeld ? 1 : 0,
       storage_key:    storageKey,
       sealed_payload: sealedBlob,
     }).toSql();

package/lib/mail-mdn.js

@@ -31,6 +31,7 @@
 var bCrypto = require("./crypto");
 var lazyRequire = require("./lazy-require");
 var mimeParse = require("./mime-parse");
+var structuredFields = require("./structured-fields");
 var audit = lazyRequire(function () { return require("./audit"); });
 var C = require("./constants");
 var validateOpts = require("./validate-opts");
@@ -84,9 +85,9 @@ function _parseDisposition(value) {
   }
   var modePart = value.slice(0, semi).trim();
   var typePart = value.slice(semi + 1).trim();
-  var slash = modePart.indexOf("/");
-  var actionMode = slash === -1 ? modePart.toLowerCase() : modePart.slice(0, slash).trim().toLowerCase();
-  var sendingMode = slash === -1 ? null : modePart.slice(slash + 1).trim().toLowerCase();
+  var mkv = structuredFields.parseKeyValuePiece(modePart, "/");
+  var actionMode = mkv.key;
+  var sendingMode = mkv.value === null ? null : mkv.value.trim().toLowerCase();
   var type = typePart.toLowerCase();
   // Strip /modifier off the type token.
   var typeSlash = type.indexOf("/");
@@ -161,14 +162,14 @@ function build(opts) {
   validateOpts.requireNonEmptyString(opts.finalRecipient,
     "mailMdn.build: opts.finalRecipient", MailMdnError, "mdn/missing-required-field");
   var disposition = String(opts.disposition || "").toLowerCase();
-  if (!DISPOSITION_TYPES[disposition]) {
+  if (!Object.prototype.hasOwnProperty.call(DISPOSITION_TYPES, disposition)) {
     throw _err("mdn/missing-required-field",
       "mailMdn.build: opts.disposition must be one of " +
       Object.keys(DISPOSITION_TYPES).join(" / ") +
       "; got '" + String(opts.disposition) + "'");
   }
   var actionMode = String(opts.actionMode || "manual-action").toLowerCase();
-  if (!ACTION_MODES[actionMode]) {
+  if (!Object.prototype.hasOwnProperty.call(ACTION_MODES, actionMode)) {
     throw _err("mdn/missing-required-field",
       "mailMdn.build: opts.actionMode must be one of " +
       Object.keys(ACTION_MODES).join(" / ") +
@@ -178,7 +179,7 @@ function build(opts) {
   // Accept the canonical mixed-case form too — RFC 3798 §3.2.6.2 uses
   // `MDN-sent-manually` / `MDN-sent-automatically`. Compare lower-case
   // for robustness; emit canonical mixed-case in the output.
-  if (!SENDING_MODES[sendingMode]) {
+  if (!Object.prototype.hasOwnProperty.call(SENDING_MODES, sendingMode)) {
     throw _err("mdn/missing-required-field",
       "mailMdn.build: opts.sendingMode must be one of " +
       "MDN-sent-manually / MDN-sent-automatically; got '" +
@@ -394,7 +395,11 @@ function parse(rawMessage) {
       "mailMdn.parse: message/disposition-notification missing Disposition");
   }
   var disposition = _parseDisposition(dispositionField);
-  if (!disposition || !DISPOSITION_TYPES[disposition.type]) {
+  // hasOwnProperty: the Disposition token comes from an untrusted inbound MDN, so
+  // a bracket lookup lets "constructor"/"__proto__" pass as a valid type (proto
+  // shadowing).
+  if (!disposition || typeof disposition.type !== "string" ||
+      !Object.prototype.hasOwnProperty.call(DISPOSITION_TYPES, disposition.type)) {
     throw _err("mdn/parse-failed",
       "mailMdn.parse: Disposition type token not in RFC 3798 §3.2.6 vocabulary; got '" +
       (disposition && disposition.type) + "'");

package/lib/mail-rbl.js

@@ -87,15 +87,12 @@ var { defineClass }    = require("./framework-error");
 var lazyRequire        = require("./lazy-require");
 var ipUtils            = require("./ip-utils");
 var gateContract       = require("./gate-contract");
+var codepointClass     = require("./codepoint-class");
 
 var audit              = lazyRequire(function () { return require("./audit"); });
 
 var MailRblError = defineClass("MailRblError", { alwaysPermanent: true });
 
-var IPV4_RE       = /^(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(?:\.(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}$/;  // allow:regex-no-length-cap — anchored + per-octet repeat-cap
-var IPV6_HEX_RE   = /^[0-9a-fA-F:]+$/;                                                                    // allow:regex-no-length-cap — checked by length cap below
-var IPV6_MAX_LEN  = 39;                                                                                   // max IPv6 textual length (8 groups × 4 hex + 7 colons)
-
 var DEFAULT_TIMEOUT_MS    = C.TIME.seconds(5);
 var DEFAULT_CONCURRENCY   = 8;                                                                           // concurrent-query cap, not bytes
 var DEFAULT_PROFILE       = "strict";
@@ -142,8 +139,8 @@ function create(opts) {
     throw new MailRblError("mail-rbl/bad-resolver",
       "create: opts.resolver must be a b.network.dns.resolver.create() instance");
   }
-  var profile = opts.profile || (opts.posture && COMPLIANCE_POSTURES[opts.posture]) || DEFAULT_PROFILE;
-  if (!PROFILES[profile]) {
+  var profile = gateContract.resolveProfileName(opts, COMPLIANCE_POSTURES, DEFAULT_PROFILE);
+  if (!Object.prototype.hasOwnProperty.call(PROFILES, profile)) {
     throw new MailRblError("mail-rbl/bad-profile",
       "create: unknown profile '" + profile + "'");
   }
@@ -286,11 +283,11 @@ function reverseIp(ip) {
       "reverseIp: ip must be a non-empty string");
   }
   // IPv4 first.
-  if (IPV4_RE.test(ip)) {
+  if (ipUtils.isIPv4(ip)) {
     return ip.split(".").reverse().join(".");
   }
   // IPv6 — accept canonical / compressed forms. Expand and nibble-reverse.
-  if (ip.length > IPV6_MAX_LEN || !IPV6_HEX_RE.test(ip)) {
+  if (!ipUtils.looksLikeIPv6Hex(ip)) {
     throw new MailRblError("mail-rbl/bad-input",
       "reverseIp: '" + ip + "' is not a valid IPv4 or IPv6 address");
   }
@@ -317,9 +314,7 @@ function reverseIp(ip) {
  * @example
  *   b.mail.rbl.compliancePosture("hipaa");   // → "strict"
  */
-function compliancePosture(posture) {
-  return COMPLIANCE_POSTURES[posture] || null;
-}
+var compliancePosture = gateContract.makePostureAccessor(COMPLIANCE_POSTURES);
 
 function _validateZoneNames(zones) {
   for (var i = 0; i < zones.length; i += 1) {
@@ -336,7 +331,7 @@ function _validateZoneNames(zones) {
     // if non-ASCII upstream).
     for (var c = 0; c < z.length; c += 1) {
       var cc = z.charCodeAt(c);
-      if (cc < 0x20 || cc === 0x7f || cc > 0x7e) {                                                       // RFC 1035 ASCII zone-name shape
+      if (codepointClass.isForbiddenControlChar(cc, { forbidTab: true }) || cc > 0x7e) {                 // RFC 1035 ASCII zone-name shape (printable ASCII only)
         throw new MailRblError("mail-rbl/bad-zone",
           "list zone '" + z + "' contains non-ASCII or control chars");
       }

package/lib/mail-scan.js

@@ -164,7 +164,7 @@ function create(opts) {
   numericBounds.requirePositiveFiniteInt(opts.port, "mail.scan.create.port",
     MailScanError, "mail-scan/bad-port", { max: 65535 });   // TCP port-number range cap
   var protocol = opts.protocol || DEFAULT_PROTOCOL;
-  if (!ALLOWED_PROTOCOLS[protocol]) {
+  if (!Object.prototype.hasOwnProperty.call(ALLOWED_PROTOCOLS, protocol)) {
     throw new MailScanError("mail-scan/bad-protocol",
       "mail.scan.create.protocol must be 'icap' or 'clamav-instream'; got '" + protocol + "'");
   }
@@ -173,8 +173,8 @@ function create(opts) {
     validateOpts.requireNonEmptyString(service, "mail.scan.create.service",
       MailScanError, "mail-scan/bad-service");
   }
-  var profile = opts.profile || (opts.posture && COMPLIANCE_POSTURES[opts.posture]) || DEFAULT_PROFILE;
-  if (!PROFILES[profile]) {
+  var profile = gateContract.resolveProfileName(opts, COMPLIANCE_POSTURES, DEFAULT_PROFILE);
+  if (!Object.prototype.hasOwnProperty.call(PROFILES, profile)) {
     throw new MailScanError("mail-scan/bad-profile",
       "mail.scan.create.profile: unknown '" + profile + "' (valid: strict / balanced / permissive)");
   }
@@ -194,7 +194,7 @@ function create(opts) {
       throw new MailScanError("mail-scan/bad-input",
         "mail.scan.scan: messageBytes must be non-empty");
     }
-    if (messageBytes.length > caps.maxMessageBytes) {
+    if (safeBuffer.byteLengthOf(messageBytes) > caps.maxMessageBytes) {
       throw new MailScanError("mail-scan/oversize-message",
         "mail.scan.scan: messageBytes=" + messageBytes.length + " exceeds maxMessageBytes=" +
         caps.maxMessageBytes);
@@ -448,9 +448,7 @@ function create(opts) {
  * @example
  *   b.mail.scan.compliancePosture("hipaa");   // → "strict"
  */
-function compliancePosture(posture) {
-  return COMPLIANCE_POSTURES[posture] || null;
-}
+var compliancePosture = gateContract.makePostureAccessor(COMPLIANCE_POSTURES);
 
 function _emitScanResult(auditImpl, rv) {
   if (rv.verdict === "clean") {