@blamejs/core 0.18.53 → 0.18.54

package/lib/mail-send-deliver.js

@@ -11,7 +11,7 @@
  *   Turnkey outbound SMTP composer. Wraps the discovery chain
  *   (MX-lookup → MTA-STS-fetch + MX-allowlist match → DANE TLSA query
  *   → REQUIRETLS handshake hint) around the existing per-host
- *   `b.mail.smtpTransport` wire-layer, plus deferred-retry scheduling
+ *   `b.mail.transports.smtp` wire-layer, plus deferred-retry scheduling
  *   for transient failures and RFC 3464 DSN generation for permanent
  *   ones.
  *
@@ -32,14 +32,18 @@
  *       requireTls: true,
  *     });
  *     // → { delivered: [{ recipient, mxHost, tlsProtocol, ... }],
- *     //     deferred:  [{ recipient, reason, retryAfterMs }],
+ *     //     deferred:  [{ recipient, mxHost, reason, retryAfterMs }],
  *     //     failed:    [{ recipient, reason, dsnSent }] }
+ *     //   deferred.mxHost is the receiver that refused, or null when the
+ *     //   deferral happened before any host was reached (an MX lookup that
+ *     //   failed). A queue view without it cannot say which peer to chase.
  *
  *   Composes:
  *     - `b.network.smtp.policy.mtaSts.fetch` + `.matchMx`  → RFC 8461 enforcement
- *     - `b.network.smtp.policy.dane.tlsa`                  → RFC 7672 TLSA query
+ *     - `b.network.smtp.policy.dane.tlsa` + `.verifyChain` → RFC 7672 TLSA query
+ *                                                            and peer authentication
  *     - `b.network.dns.resolver` (operator-supplied)        → caching + DoH posture
- *     - `b.mail.smtpTransport`                              → SMTP wire layer
+ *     - `b.mail.transports.smtp`                            → SMTP wire layer
  *     - `b.mail.requireTls`                                 → RFC 8689 REQUIRETLS
  *     - `b.mailBounce`-style RFC 3464 DSN generation         → permanent-failure
  *                                                              report-mail
@@ -104,7 +108,16 @@ function _classifySmtpOutcome(err, response) {
   if (err) {
     var code = err.code || "";
     if (/^(ECONNREFUSED|ETIMEDOUT|EHOSTUNREACH|ENETUNREACH|ENOTFOUND)$/.test(code)) return "transient";
-    if (/mta-sts|tls-policy|dane|requiretls/i.test((err.code || "") + " " + (err.message || ""))) return "permanent";
+    // A DANE failure is about THIS HOST, not this recipient: the certificate
+    // did not match the records, or the records could not be used. The ordinary
+    // cause is a rollover part-way through DNS propagation, which resolves
+    // itself — and a DSN does not. Classified permanent it also skipped every
+    // remaining MX, so one host mid-rollover bounced mail the next host would
+    // have taken. RFC 7672 §2.2: try the other hosts, defer if none
+    // authenticates. Matched before the policy class below, which keeps its
+    // permanent verdict.
+    if (/\bdane\b/i.test((err.code || "") + " " + (err.message || ""))) return "transient";
+    if (/mta-sts|tls-policy|requiretls/i.test((err.code || "") + " " + (err.message || ""))) return "permanent";
   }
   return "transient";
 }
@@ -202,8 +215,22 @@ async function _resolveMx(domain, resolver, timeoutMs) {
     // .create()` wraps DoH and returns `{ rrs: [{ exchange, priority }],
     // ttl, ... }` — the wrapper carries TTL + provenance metadata.
     // Accept both shapes; refuse anything else.
+    //
+    // The resolver's records are NOT flat. b.network.dns decodes an MX RR into
+    // `{ name, type, typeName, ttl, decoded: { preference, exchange } }`, so
+    // reading `.exchange` off the record itself yields undefined — every MX
+    // host became undefined and the first thing to touch one failed. The
+    // comment above this normalisation asserted the flat shape, and no test
+    // caught the disagreement because every one of them passes a hand-written
+    // resolver returning exactly what the comment claimed. Only a query against
+    // a real DNS response shows the difference.
     if (mxs && !Array.isArray(mxs) && Array.isArray(mxs.rrs)) {
-      mxs = mxs.rrs;
+      mxs = mxs.rrs.map(function (rr) {
+        if (rr && rr.decoded && typeof rr.decoded.exchange === "string") {
+          return { exchange: rr.decoded.exchange, priority: rr.decoded.preference };
+        }
+        return rr;                                                               // already flat
+      });
     }
     if (!Array.isArray(mxs) || mxs.length === 0) {
       throw new DeliverError("deliver/no-mx",
@@ -277,15 +304,26 @@ async function _applyMtaStsPolicy(domain, mxs, policyMode, auditEmit) {
   return filtered;
 }
 
-// Apply DANE TLSA query per RFC 7672. Returns array of TLSA records
-// for the MX host, OR null when DANE is off / no records published.
-// The primitive composes the lookup; per-cert chain verification is
-// the operator's responsibility (or future b.network.smtp.policy.dane.
-// verifyChain extension).
-async function _fetchDaneTlsa(mxHost, port, daneMode, auditEmit) {
+// Apply DANE TLSA query per RFC 7672. Returns the array of TLSA records for
+// the MX host, or null when DANE is off, the records are unusable, or the peer
+// publishes none. The records are handed to the transport, which authenticates
+// the peer's certificate chain against them via dane.verifyChain — the lookup
+// on its own is discovery, and discovery is not what "enforce" promises.
+async function _fetchDaneTlsa(mxHost, port, daneMode, dnssecValidated, resolver, auditEmit) {
   if (daneMode === "off") return null;
+  // RFC 7672 §1.3: records that were not DNSSEC-validated MUST NOT be used.
+  // Under opportunistic with no assertion they are therefore unusable before
+  // they are fetched, so asking for them buys nothing and costs a DNS round
+  // trip per MX plus a warn on every delivery. `enforce` cannot reach here
+  // without the assertion — create() refuses that combination outright.
+  if (!dnssecValidated) return null;
   try {
-    var tlsa = await smtpPolicy().dane.tlsa(mxHost, port || DEFAULT_PORT_SMTP);
+    // The operator's resolver goes with the assertion: `dnssecValidated` is a
+    // statement about THEIR resolver, so the records have to come from it. A
+    // lookup that quietly used node:dns instead would let a non-validating
+    // system resolver supply spoofed TLSA data under a validated banner.
+    var tlsa = await smtpPolicy().dane.tlsa(mxHost, port || DEFAULT_PORT_SMTP,
+      { dnssecValidated: true, resolver: resolver || undefined });
     return tlsa && tlsa.length > 0 ? tlsa : null;
   } catch (e) {
     auditEmit("mail.send.deliver.dane.skip", "warn",
@@ -304,19 +342,25 @@ async function _fetchDaneTlsa(mxHost, port, daneMode, auditEmit) {
 // outbound relay) can wrap the wire-layer surface without monkey-
 // patching the framework's mail module.
 async function _tryHost(envelope, mxHost, hostnameLocal, opts) {
-  var factory = opts.transportFactory || mailModule().smtpTransport;
+  // `transports.smtp`, which is the name `lib/mail.js` actually exports. It was
+  // reached for as `smtpTransport` — a name nothing defines — so the default was
+  // `undefined`, calling it threw, the throw was classified as a transient peer
+  // problem, and an operator who did not pass `transportFactory` got every
+  // recipient deferred 4.4.4 forever with no socket ever opened. The option is
+  // documented as an override, so the default is the path most callers take.
+  var factory = opts.transportFactory || mailModule().transports.smtp;
   var transport = factory({
     host:         mxHost,
     port:         opts.port || DEFAULT_PORT_SMTP,
     ehloName:     hostnameLocal,
     timeoutMs:    opts.perHostTimeoutMs || DEFAULT_PER_HOST_TIMEOUT_MS,
     requireTls:   envelope.requireTls === true,
-    // tls / dane verification is handed off to smtpTransport when
-    // the operator wires opts.dane (TLSA pinning) via the message
-    // shape; v1 of deliver doesn't auto-pin from the TLSA record set
-    // because chain-verification needs the cert byte-level surface
-    // smtpTransport doesn't expose yet. Operators with strict DANE
-    // posture pass dane: tlsa[] into smtpTransport directly.
+    // The TLSA records fetched for THIS MX host. The transport matches the
+    // peer's certificate chain against them once the handshake completes and
+    // refuses the send on a mismatch (RFC 7672 §2.2). Absent when the peer
+    // publishes none, or when DANE is off — the transport then behaves as it
+    // always did.
+    dane:         envelope.tlsa || undefined,
   });
   return transport.send({
     from: envelope.from,
@@ -356,14 +400,21 @@ async function _deliverOne(envelope, recipient, ctx) {
   }
   var lastErr = null;
   var lastResponse = null;
+  // The host the deferral is about. Null until one is tried, so a recipient
+  // deferred before any peer was reached reports "no host" rather than
+  // omitting the field — a consumer can then tell that apart from a host that
+  // simply was not recorded.
+  var lastMxHost = null;
   for (var i = 0; i < mxs.length; i += 1) {
     var mx = mxs[i];
-    // DANE per-MX lookup. Skipped today for verification (operator
-    // composes directly into smtpTransport.dane); this branch carries
-    // the discovery so the audit chain records the policy posture
-    // applied to each delivery attempt.
+    lastMxHost = mx.exchange;
+    // DANE per-MX lookup. The records go to the transport, which matches the
+    // peer's certificate chain against them during the handshake.
+    var mxTlsa = null;
     try {
-      await _fetchDaneTlsa(mx.exchange, ctx.port, ctx.policy.dane, ctx.auditEmit);
+      mxTlsa = await _fetchDaneTlsa(mx.exchange, ctx.port, ctx.policy.dane,
+                                    ctx.policy.dnssecValidated, ctx.resolver,
+                                    ctx.auditEmit);
     } catch (daneErr) {
       // DANE "enforce": a TLSA lookup failure means this MX host cannot
       // be used for authenticated delivery (RFC 7672 §2.2). Fail this
@@ -385,6 +436,7 @@ async function _deliverOne(envelope, recipient, ctx) {
         recipient:  recipient,
         rfc822:     envelope.rfc822,
         requireTls: envelope.requireTls,
+        tlsa:       mxTlsa,
       }, mx.exchange, ctx.hostname, ctx);
       ctx.auditEmit("mail.send.deliver.delivered", "success", {
         recipient: recipient, mxHost: mx.exchange, mxPriority: mx.priority,
@@ -411,8 +463,13 @@ async function _deliverOne(envelope, recipient, ctx) {
     }
   }
   // All MX hosts returned transient — overall outcome is transient
-  // (defer + retry).
+  // (defer + retry). `mxHost` names the last host tried, because a queue an
+  // operator reads on a bad day has to answer WHICH receiver refused: a domain
+  // with several MX hosts defers on one of them, and that decides whether to
+  // wait, to contact that receiver, or to look at one's own transport security
+  // against that host.
   return { recipient: recipient, outcome: "transient",
+           mxHost: lastMxHost,
            reason: (lastErr && lastErr.message) || "all MX hosts failed transiently",
            reasonCode: (lastResponse && lastResponse.code) || "4.4.4" };
 }
@@ -428,7 +485,7 @@ async function _deliverOne(envelope, recipient, ctx) {
  * Build a turnkey delivery handle. Returns a `deliver(envelope)`
  * function that takes a single multi-recipient envelope, resolves
  * MX records per recipient domain, applies the operator's configured
- * MTA-STS / DANE policy, attempts delivery via `b.mail.smtpTransport`,
+ * MTA-STS / DANE policy, attempts delivery via `b.mail.transports.smtp`,
  * and returns a per-recipient outcome split into `delivered` /
  * `deferred` / `failed` arrays.
  *
@@ -437,6 +494,23 @@ async function _deliverOne(envelope, recipient, ctx) {
  * after the budget elapses. The primitive does not own a background
  * scheduler — operator job-runner owns the retry lifecycle.
  *
+ * DANE (RFC 7672) authenticates the peer, not just its DNS. When the peer
+ * publishes TLSA records, they are fetched and the certificate chain it
+ * presents during the handshake is matched against them; a peer whose chain
+ * matches none of its own records is refused and the next MX is tried.
+ *
+ * The TLSA lookup goes through `opts.resolver` when one is supplied, because
+ * the DNSSEC assertion below is a statement about THAT resolver. A resolver
+ * that cannot answer TLSA is refused rather than bypassed.
+ *
+ * Because RFC 7672 §1.3 forbids using records that were not DNSSEC-validated
+ * and node:dns does not expose the AD bit, only the operator can say whether
+ * their resolver validates. `policy.dnssecValidated: true` is that statement,
+ * and `dane: "enforce"` requires it: without it every peer that publishes TLSA
+ * would be refused while every peer that publishes none was delivered to.
+ * Under `"opportunistic"` the records are unusable without it, so none are
+ * fetched.
+ *
  * Failed recipients trigger DSN composition: a RFC 3464 multipart/
  * report message is built per failed recipient and handed to the
  * operator-supplied `dsn.onPermanentFailure(envelope, recipientResult,
@@ -452,6 +526,7 @@ async function _deliverOne(envelope, recipient, ctx) {
  *   policy: {
  *     mtaSts:   "enforce" | "testing" | "off",  // default "enforce" — RFC 8461 posture
  *     dane:     "opportunistic" | "enforce" | "off",  // default "opportunistic" — RFC 7672
+ *     dnssecValidated: boolean,            // default false — assert the resolver DNSSEC-validates; required by dane "enforce"
  *   },
  *   retry: {
  *     maxAttempts:  number,                // default 5
@@ -521,7 +596,7 @@ function create(opts) {
   var port = opts.port || DEFAULT_PORT_SMTP;
 
   var policy = opts.policy || {};
-  validateOpts(policy, ["mtaSts", "dane"], "mail.send.deliver.create.policy");
+  validateOpts(policy, ["mtaSts", "dane", "dnssecValidated"], "mail.send.deliver.create.policy");
   var policyMtaSts = policy.mtaSts || "enforce";
   if (["enforce", "testing", "off"].indexOf(policyMtaSts) === -1) {
     throw new DeliverError("deliver/bad-policy-mtaSts",
@@ -532,6 +607,25 @@ function create(opts) {
     throw new DeliverError("deliver/bad-policy-dane",
       "mail.send.deliver.create.policy.dane must be opportunistic|enforce|off");
   }
+  // RFC 7672 §1.3 forbids using TLSA records that were not DNSSEC-validated,
+  // and node:dns does not surface the AD bit, so only the operator can say
+  // whether their resolver validates. Without that assertion `enforce` refuses
+  // every peer that publishes TLSA while delivering normally to every peer that
+  // publishes none — the sender's misconfiguration charged to the recipient who
+  // did the work. It is a property of this sender's resolver, so it is settled
+  // once at create() rather than surfacing per-peer as a delivery failure.
+  if (policy.dnssecValidated !== undefined && typeof policy.dnssecValidated !== "boolean") {
+    throw new DeliverError("deliver/bad-policy-dnssec",
+      "mail.send.deliver.create.policy.dnssecValidated must be a boolean when set");
+  }
+  var daneDnssecValidated = policy.dnssecValidated === true;
+  if (policyDane === "enforce" && !daneDnssecValidated) {
+    throw new DeliverError("deliver/dane-no-dnssec",
+      "policy.dane \"enforce\" requires policy.dnssecValidated: true — TLSA records " +
+      "must be DNSSEC-validated before use (RFC 7672 §1.3), and without that " +
+      "assertion enforce can only refuse the peers that publish them. Set it when " +
+      "the resolver validates DNSSEC; otherwise use \"opportunistic\" or \"off\"");
+  }
 
   var retryOpts = opts.retry || {};
   validateOpts(retryOpts, ["maxAttempts", "backoffMs"], "mail.send.deliver.create.retry");
@@ -578,8 +672,22 @@ function create(opts) {
       throw new DeliverError("deliver/bad-envelope",
         "deliver: envelope is required");
     }
-    validateOpts.requireNonEmptyString(envelope.from,
-      "deliver.envelope.from", DeliverError, "deliver/bad-envelope-from");
+    // The EMPTY string is a value here, not a missing one: RFC 5321 §4.5.5
+    // requires the null reverse path `MAIL FROM:<>` for a delivery status
+    // notification, and `b.mail.transports.smtp` already turns `""` into
+    // exactly that. Refusing it as "non-empty required" meant this composer
+    // could not send the one message shape the spec reserves a syntax for, and
+    // its own documented DSN example put a real address in the reverse path —
+    // so a bounce that failed would bounce back to the bounce's sender.
+    //
+    // The framework's other readers of an envelope sender already know this:
+    // `b.mail.spf.verify` treats an empty `mailFrom` as the null sender and
+    // falls back to the HELO identity, which is RFC 7208 §2.4 exactly.
+    if (typeof envelope.from !== "string") {
+      throw new DeliverError("deliver/bad-envelope-from",
+        "deliver.envelope.from must be a string — use \"\" for the null " +
+        "reverse path (MAIL FROM:<>) that RFC 5321 requires of a DSN");
+    }
     if (!Array.isArray(envelope.to) || envelope.to.length === 0) {
       throw new DeliverError("deliver/bad-envelope-to",
         "deliver.envelope.to must be a non-empty array");
@@ -596,7 +704,8 @@ function create(opts) {
 
     var ctx = {
       resolver:           opts.resolver || null,
-      policy:             { mtaSts: policyMtaSts, dane: policyDane },
+      policy:             { mtaSts: policyMtaSts, dane: policyDane,
+                            dnssecValidated: daneDnssecValidated },
       hostname:           opts.hostname,
       port:               port,
       mxLookupTimeoutMs:  mxLookupTimeoutMs,
@@ -638,6 +747,10 @@ function create(opts) {
           var idx = Math.min(attempts - 1, backoffMs.length - 1);
           deferred.push({
             recipient:     res.recipient,
+            // The receiver the deferral is about, or null when none was
+            // reached. A queue that records the reason and the retry time and
+            // not the peer cannot answer the first question an operator asks.
+            mxHost:        res.mxHost === undefined ? null : res.mxHost,
             reason:        res.reason,
             reasonCode:    res.reasonCode,
             attempt:       attempts,
@@ -648,7 +761,13 @@ function create(opts) {
       }
       // permanent (either direct or transient-converted-to-permanent)
       var dsnSent = false;
-      if (dsnOpts) {
+      // A message sent with the NULL reverse path gets no DSN. RFC 5321 §4.5.5
+      // is explicit, and the reason is the whole point of the null sender: the
+      // DSN's `To:` is the original `from`, so bouncing a bounce addresses it
+      // to nobody and, where the peer is less careful, to itself. This is the
+      // loop the empty reverse path exists to stop, and it is reachable the
+      // moment `""` is accepted above.
+      if (dsnOpts && envelope.from !== "") {
         try {
           var dsnMessage = _buildDsnMessage({
             dsnFrom:         dsnOpts.from,

package/lib/mail-server-imap.js

@@ -147,6 +147,7 @@ var codepointClass = require("./codepoint-class");
 // Centralized so the marker lives in one place
 // and the per-call sites read cleanly.
 var ERR_CLAMP = 200;                                                                                  // protocol-reply error-message clamp
+var CRLF_BYTES = Buffer.from("\r\n", "latin1");                                                       // RFC 9051 §2.2 line terminator, as octets
 var LINE_PREVIEW = 80;                                                                                // audit-line preview clamp
 
 // RFC 9051 §6.3.12 + RFC 5322 §3.3 date-time parser for IMAP APPEND.
@@ -237,6 +238,15 @@ function _validateMailboxName(name, opts) {
  *   rateLimit:         b.mail.server.rateLimit handle | opts | false,
  *   audit:             b.audit                // optional
  *
+ * `fetchRange` may return each row's `payload` as a Buffer, and should whenever
+ * the row carries message content. RFC 9051 §4.3 makes a literal a counted
+ * sequence of octets, and a string cannot hold one: a message octet that is not
+ * valid UTF-8 does not survive being encoded on the way to the socket, and the
+ * count the response announced stops matching the number of octets it wrote —
+ * which is what tells a client where the response ends. A Buffer payload is
+ * framed and written as the octets it holds. A string payload is unchanged and
+ * remains right for the rows that carry only attributes, such as `FLAGS (\Seen)`.
+ *
  * @example
  *   var imap = b.mail.server.imap.create({
  *     tlsContext: b.mail.server.tls.context({ certFile, keyFile }).secureContext,
@@ -450,7 +460,14 @@ function create(opts) {
         synchronizing: !parsed.literalNonSync,
       };
       if (!parsed.literalNonSync) {
-        _writeUntagged(socket, "+ Ready for literal data");
+        // RFC 9051 §7.5 — a synchronizing literal is answered with a command
+        // continuation request: a line that BEGINS with `+`. Written as an
+        // untagged response, the wire carried `* + Ready for literal data`,
+        // which is not one, so a conforming client waited for a `+` line that
+        // never came and APPEND could not complete. The non-synchronizing
+        // route is no escape either: the strict profile's guard refuses
+        // LITERAL+ and CAPABILITY does not advertise it.
+        _writeContinuation(socket, "Ready for literal data");
       }
       return;
     }
@@ -731,7 +748,7 @@ function create(opts) {
               } else if (event.kind === "LIST") {
                 _writeUntagged(socket, "LIST " + event.payload);
               } else if (event.kind === "FETCH") {
-                _writeUntagged(socket, (event.seq || "") + " FETCH (" + (event.payload || "") + ")");
+                _writeUntagged(socket, _fetchResponse(event.seq || "", event.payload));
               }
             } catch (_e) { /* drop-silent — socket may already be closed */ }
           });
@@ -967,56 +984,49 @@ function create(opts) {
     }
     _emit("mail.server.imap.auth_attempt",
       { connectionId: state.id, mechanism: mechName, remoteAddress: state.remoteAddress });
-    state.authPending = { mechanism: mechName, tag: tag, step: 0 };
+    state.authPending = { mech: mechName, tag: tag, step: 0 };
     _runAuthStep(state, socket, initialResp);
   }
 
   function _runAuthStep(state, socket, clientResp) {
     var pending = state.authPending;
-    Promise.resolve()
-      .then(function () {
-        return authConfig.verify(pending.mechanism, {
-          step:           pending.step,
-          clientResponse: clientResp,
-          tls:            state.tls,
-          remoteAddress:  state.remoteAddress,
-        });
-      })
-      .then(function (result) {
-        pending.step += 1;
-        if (result && result.pending && typeof result.challenge === "string") {
-          // Server-side challenge — `+ <base64>` per RFC 9051 §6.2.2.
-          _writeContinuation(socket, result.challenge);
-          return;
-        }
-        if (result && result.ok === true && result.actor) {
-          state.actor = result.actor;
-          state.stage = "authenticated";
-          var savedTag = pending.tag;
-          state.authPending = null;
-          _emit("mail.server.imap.auth_success",
-            { connectionId: state.id, mechanism: pending.mechanism,
-              tenantId: result.actor.tenantId || null });
-          _writeTagged(socket, savedTag, "OK [CAPABILITY " + _capabilityLine(state) + "] AUTHENTICATE completed");
-          return;
-        }
-        var failTag = pending.tag;
-        state.authPending = null;
-        rateLimit.noteAuthFailure(state.remoteAddress);
-        _emit("mail.server.imap.auth_failed",
-          { connectionId: state.id, mechanism: pending.mechanism,
-            reason: (result && result.reason) || "verify-returned-fail" }, "denied");
-        _writeTagged(socket, failTag, "NO Authentication credentials invalid");
-      })
-      .catch(function (err) {
-        var failTag = pending.tag;
+    function _fail(reason, outcome, reply) {
+      var failTag = pending.tag;
+      state.authPending = null;
+      rateLimit.noteAuthFailure(state.remoteAddress);
+      _emit("mail.server.imap.auth_failed",
+        { connectionId: state.id, mechanism: pending.mech, reason: reason }, outcome);
+      _writeTagged(socket, failTag, reply);
+    }
+    mailServerNet.runSaslStep({
+      exchange:       pending,
+      verify:         authConfig.verify,
+      credentials:    { tls: state.tls, remoteAddress: state.remoteAddress },
+      clientResponse: clientResp,
+      // Server-side challenge — `+ <base64>` per RFC 9051 §6.2.2.
+      writeChallenge: function (ch) { return _writeContinuation(socket, ch); },
+      onChallengeUnsafe: function () {
+        _fail("challenge-contains-line-terminator", "denied", "NO Authentication failed");
+      },
+      onSuccess: function (result) {
+        state.actor = result.actor;
+        state.stage = "authenticated";
+        var savedTag = pending.tag;
         state.authPending = null;
-        rateLimit.noteAuthFailure(state.remoteAddress);
-        _emit("mail.server.imap.auth_failed",
-          { connectionId: state.id, mechanism: pending.mechanism,
-            reason: (err && err.message) || String(err) }, "failure");
-        _writeTagged(socket, failTag, "NO Authentication failed");
-      });
+        _emit("mail.server.imap.auth_success",
+          { connectionId: state.id, mechanism: pending.mech,
+            tenantId: result.actor.tenantId || null });
+        _writeTagged(socket, savedTag,
+          "OK [CAPABILITY " + _capabilityLine(state) + "] AUTHENTICATE completed");
+      },
+      onFailure: function (result) {
+        _fail((result && result.reason) || "verify-returned-fail", "denied",
+              "NO Authentication credentials invalid");
+      },
+      onError: function (err) {
+        _fail((err && err.message) || String(err), "failure", "NO Authentication failed");
+      },
+    });
   }
 
   function _handleLogin(state, socket, tag, args) {
@@ -1582,10 +1592,20 @@ function create(opts) {
         for (var i = 0; i < rs.length; i += 1) {
           var r = rs[i];
           var payload = r.payload || "";
-          if (includeModseq && r.modseq !== undefined && !/MODSEQ\s*\(/.test(payload)) {
-            payload = (payload ? payload + " " : "") + "MODSEQ (" + r.modseq + ")";
+          // A Buffer payload is the backend saying "these are the message's
+          // own octets". It is assembled and written as octets end to end, so
+          // the count in the literal header is the count that reaches the wire.
+          // Concatenating it into a string instead re-encoded it as UTF-8, and
+          // the response then announced one length and sent another.
+          var octets = Buffer.isBuffer(payload);
+          var asText = octets ? payload.toString("latin1") : String(payload);
+          if (includeModseq && r.modseq !== undefined && !/MODSEQ\s*\(/.test(asText)) {
+            var modseqAttr = (asText ? " " : "") + "MODSEQ (" + r.modseq + ")";
+            payload = octets
+              ? Buffer.concat([payload, Buffer.from(modseqAttr, "latin1")])
+              : asText + modseqAttr;
           }
-          _writeUntagged(socket, r.seq + " FETCH (" + payload + ")");
+          _writeUntagged(socket, _fetchResponse(r.seq, payload));
         }
         _writeTagged(socket, tag, "OK FETCH completed");
       })
@@ -1754,17 +1774,63 @@ function create(opts) {
     state.idle = { tag: tag, timer: timer };
   }
 
+  // One line onto the socket, as OCTETS.
+  //
+  // RFC 9051 §4.3 makes a literal a counted sequence of octets, so a response
+  // carrying message content has to reach the wire as the octets the backend
+  // holds. `socket.write(string)` encodes as UTF-8, which replaces every
+  // sequence that is not valid UTF-8 and changes the length — so the count the
+  // response announced and the number of octets it wrote disagreed, and a
+  // client, which uses that count to find the end of the response, read the
+  // next response as part of this one.
+  //
+  // A Buffer `msg` is written through untouched. A string keeps its UTF-8
+  // encoding, which is what RFC 9051 §5.1 asks for in the one place a response
+  // string is not ASCII: a mailbox name, once the client has enabled UTF8=ACCEPT.
+  // Encoding those latin1 instead would keep the low byte of each character and
+  // corrupt every name outside Latin-1 — the same defect this fixes, moved.
+  function _writeLine(socket, prefix, msg) {
+    try {
+      if (Buffer.isBuffer(msg)) {
+        socket.write(Buffer.concat([Buffer.from(prefix, "latin1"), msg, CRLF_BYTES]));
+      } else {
+        socket.write(prefix + msg + "\r\n");
+      }
+    } catch (_e) { /* socket may be down */ }
+  }
+  // One untagged FETCH response. A Buffer payload is the backend saying "these
+  // are the message's own octets", and the response is assembled as octets so
+  // the count in the literal header is the count that reaches the wire; a
+  // string payload is attributes and stays a string.
+  //
+  // Two places build one of these — the FETCH command and a NOTIFY push — and
+  // a second copy of this is how the octet handling ends up right in one and
+  // wrong in the other, which is what it was.
+  function _fetchResponse(seq, payload) {
+    if (Buffer.isBuffer(payload)) {
+      return Buffer.concat([
+        Buffer.from(seq + " FETCH (", "latin1"), payload, Buffer.from(")", "latin1"),
+      ]);
+    }
+    return seq + " FETCH (" + (payload || "") + ")";
+  }
+
   function _writeTagged(socket, tag, msg) {
-    try { socket.write(tag + " " + msg + "\r\n"); }
-    catch (_e) { /* socket may be down */ }
+    _writeLine(socket, tag + " ", msg);
   }
   function _writeUntagged(socket, msg) {
-    try { socket.write("* " + msg + "\r\n"); }
-    catch (_e) { /* socket may be down */ }
+    _writeLine(socket, "* ", msg);
   }
+  // RFC 9051 §7.5 continuation. Returns false when the operator's challenge
+  // carries CR / LF / NUL: those end the line early and the remainder is read
+  // by the client as a second server response. Not hypothetical for a SCRAM or
+  // CRAM mechanism, whose challenge is composed partly from the client's own
+  // nonce, so client bytes reach this write.
   function _writeContinuation(socket, msg) {
-    try { socket.write("+ " + msg + "\r\n"); }
-    catch (_e) { /* socket may be down */ }
+    var safe = mailServerNet.saslChallengeOrNull(msg);
+    if (safe === null) return false;
+    _writeLine(socket, "+ ", safe);
+    return true;
   }
   function _close(socket, state) {
     // The drain loop's `if (state.stage === "closed") return;` guard

package/lib/mail-server-jmap.js

@@ -158,6 +158,11 @@ void C;
  *                         // capabilities the server advertises beyond core
  *   accountsFor:         async function (actor) → { primaryAccounts, accounts },
  *                         // operator-supplied accountId enumeration
+ *   webSocket:           boolean,   // default true — false stops advertising the
+ *                         // RFC 8887 WebSocket transport (capability and the
+ *                         // top-level webSocketUrl alias), for a deployment
+ *                         // that has not wired the upgrade handler
+ *   webSocketUrl:        string,    // default "/jmap/ws" — where the upgrade lives
  *   profile:             "strict" | "balanced" | "permissive",
  *   posture:             "hipaa" | "pci-dss" | "gdpr" | "soc2",
  *   audit:               b.audit                                       // optional
@@ -199,6 +204,20 @@ function create(opts) {
   var profile = opts.profile || DEFAULT_PROFILE;
   var posture = opts.posture || null;
   var serverCapabilities = opts.serverCapabilities || {};
+  // RFC 8887 §3 — whether this deployment offers the WebSocket transport. It
+  // was advertised unconditionally: the capability was injected when the
+  // consumer omitted the key, and merged back in when they supplied one, so a
+  // deployment that had not wired the upgrade handler still sent conforming
+  // clients to an endpoint that could not upgrade. The only value that
+  // suppressed it was `undefined`, and only because JSON.stringify drops such
+  // keys — an accident of serialization rather than an answer. `false` is now
+  // that answer, and a value that is neither true nor false is a
+  // misconfiguration rather than a silent default back to advertising.
+  validateOpts.optionalBoolean(opts.webSocket,
+    "mail.server.jmap.create: opts.webSocket (false stops advertising the RFC 8887 " +
+    "WebSocket transport, for a deployment that has not wired the upgrade handler)",
+    MailServerJmapError, "mail-server-jmap/bad-websocket");
+  var webSocketEnabled = opts.webSocket !== false;
 
   // JMAP method registry. Wrap operator-supplied `opts.methods` map
   // through `b.mail.serverRegistry` so per-handler resource budgets
@@ -569,14 +588,19 @@ function create(opts) {
         var defaultCaps = { "urn:ietf:params:jmap:core": {} };
         var hasOperatorWsCap = Object.prototype.hasOwnProperty.call(
           serverCapabilities, "urn:ietf:params:jmap:websocket");
-        if (!hasOperatorWsCap) {
+        if (webSocketEnabled && !hasOperatorWsCap) {
           defaultCaps["urn:ietf:params:jmap:websocket"] = {
             url:          opts.webSocketUrl || "/jmap/ws",
             supportsPush: true,
           };
         }
+        var caps = Object.assign({}, defaultCaps, serverCapabilities);
+        // `webSocket: false` is the deployment's answer, so it outranks a
+        // capability the consumer also listed in serverCapabilities — otherwise
+        // the merge above would put back exactly what was declined.
+        if (!webSocketEnabled) delete caps["urn:ietf:params:jmap:websocket"];
         var session = {
-          capabilities: Object.assign({}, defaultCaps, serverCapabilities),
+          capabilities: caps,
           accounts:     info.accounts || {},
           primaryAccounts: info.primaryAccounts || {},
           username:     actor.username || actor.id || "unknown",
@@ -587,10 +611,13 @@ function create(opts) {
           // RFC 8887 §3 — `webSocketUrl` advertises the JMAP WS
           // endpoint. Operator overrides via opts.webSocketUrl; default
           // mounts at `/jmap/ws`.
-          urlEndpointResolution: serverCapabilities["urn:ietf:params:jmap:websocket"]
+          urlEndpointResolution: (webSocketEnabled && serverCapabilities["urn:ietf:params:jmap:websocket"])
             ? { useEndpoint: opts.webSocketUrl || "/jmap/ws", urlPrefix: "" }
             : undefined,
-          webSocketUrl:   opts.webSocketUrl || "/jmap/ws",
+          // The top-level alias goes with the capability. Leaving it behind
+          // would still point a client at an endpoint that cannot upgrade,
+          // which is the whole thing `webSocket: false` is declining.
+          webSocketUrl:   webSocketEnabled ? (opts.webSocketUrl || "/jmap/ws") : undefined,
           state:        sessionState,
         };
         res.statusCode = 200;