@blamejs/core 0.18.53 → 0.18.55

package/lib/mail-store.js

@@ -484,12 +484,7 @@ function create(opts) {
         maxMessageBytes: maxMessageBytes,
         maxBodyBytes: maxBodyBytes,
       };
-      if (typeof db.transaction === "function") {
-        var result;
-        db.transaction(function () { result = _appendMessage(args); })();
-        return result;
-      }
-      return _appendMessage(args);
+      return _runInTransaction(db, function () { return _appendMessage(args); });
     },
     fetchByObjectId:  function (folderName, objectid) {
       return _fetchByObjectId({
@@ -782,11 +777,7 @@ function create(opts) {
           stmtDecrementQuota.run(totalBytes, toDelete.length, folder.id);
         }
       }
-      if (typeof db.transaction === "function") {
-        db.transaction(_runTxn)();
-      } else {
-        _runTxn();
-      }
+      _runInTransaction(db, _runTxn);
       return {
         rows:    rows,
         deleted: toDelete.map(function (r) { return r.objectid; }),
@@ -800,6 +791,37 @@ function create(opts) {
 
 // ---- Append --------------------------------------------------------------
 
+// Run `fn` inside the backend's transaction, whichever calling convention the
+// backend uses, and return what `fn` returned.
+//
+// There are two, and they look identical from outside. `b.db.transaction(fn)`
+// RUNS fn between BEGIN and COMMIT and returns its result; better-sqlite3's
+// `transaction(fn)` returns a WRAPPER you then call. The code here was written
+// for the second and used against the first, which is the composition
+// `b.mailStore` documents: `db.transaction(fn)()` therefore ran the work,
+// committed it, and then threw a TypeError trying to call the result. A caller
+// retrying on that throw appended a second copy of a message already durably
+// stored, and `hardExpunge` deleted, committed, and threw the same way.
+//
+// `typeof db.transaction === "function"` is true of both and distinguishes
+// neither, which is why the guard that was there could not have caught it. What
+// distinguishes them is whether `fn` actually RAN, so that is what is checked —
+// not the shape of the return value, which would misread a callback that
+// legitimately returns a function.
+function _runInTransaction(db, fn) {
+  if (!db || typeof db.transaction !== "function") return fn();
+  var ran = false;
+  var out = db.transaction(function () { ran = true; return fn(); });
+  if (ran) return out;                       // executed already: b.db's shape
+  if (typeof out === "function") return out();   // a wrapper: better-sqlite3's
+  // Neither ran the callback nor handed back something to run. Doing the work
+  // outside a transaction would be worse than saying so: a partial write is
+  // exactly what the transaction is here to prevent.
+  throw new MailStoreError("mail-store/unusable-transaction",
+    "backend.transaction(fn) neither ran the callback nor returned a function " +
+    "to run it — the write cannot be made atomic, so it is not attempted");
+}
+
 function _appendMessage(args) {
   var rawBytes = args.rawBytes;
   if (!Buffer.isBuffer(rawBytes) && typeof rawBytes !== "string") {

package/lib/mail.js

@@ -25,6 +25,15 @@
  *   the worked example). Operators can also pass any function or
  *   `{ send }` object as a custom transport.
  *
+ *   The `smtp` transport takes `dane: [tlsaRecord, ...]` — the peer's
+ *   DNSSEC-validated TLSA records, as `b.network.smtp.policy.dane.tlsa`
+ *   returns them. When present, the certificate chain the peer presents is
+ *   matched against them once the handshake completes and the send is refused
+ *   on a mismatch (RFC 7672 §2.2), on both the implicit-TLS and STARTTLS
+ *   paths. `daneAllowPkixModes: true` additionally accepts the PKIX-TA /
+ *   PKIX-EE usages, which need a PKIX path validation the transport does not
+ *   perform. `b.mail.send.deliver` fetches the records and passes them here.
+ *
  *   DKIM-Signature header generation lives at `b.mail.dkim` (rsa-sha256
  *   default, ed25519-sha256 opt-in, dual-signer per RFC 8463 §3 for
  *   transition windows). Inbound authentication-results parsing —
@@ -82,6 +91,8 @@ var numericBounds = require("./numeric-bounds");
 var nodeTls = lazyRequire(function () { return require("node:tls"); });
 // Lazy — audit a cert-validation-disabled SMTP/TLS session at honor time.
 var networkTls = lazyRequire(function () { return require("./network-tls"); });
+// Lazy — dane.verifyChain, reached only when a send carries TLSA records.
+var smtpPolicy = lazyRequire(function () { return require("./network-smtp-policy"); });
 var safeJson = require("./safe-json");
 var safeSchema = require("./safe-schema");
 var validateOpts = require("./validate-opts");
@@ -310,6 +321,12 @@ function _isValidEmail(addr) {
 // contains non-ASCII octets.
 function _messageRequiresSmtpUtf8(message) {
   if (!message) return false;
+  // For raw bytes the addresses live in the header block, and SMTPUTF8 is about
+  // ADDRESSES — a non-ASCII body is 8BITMIME's business, below. The envelope
+  // fields are still checked after this, because `deliver` passes them
+  // alongside the raw message and either can carry the non-ASCII address.
+  var rawUtf8 = _rawText(message);
+  if (rawUtf8 !== null && _hasNonAscii(_rawHeaderBlock(rawUtf8))) return true;
   if (_hasNonAscii(message.from || "")) return true;
   if (_hasNonAscii(message.subject || "")) return true;
   var lists = [message.to, message.cc, message.bcc];
@@ -746,7 +763,63 @@ function _buildBodyPart(message) {
   };
 }
 
+// A message may arrive as FIELDS or as raw RFC 822 BYTES, and everything on the
+// send path that reads the message has to know which one it is looking at.
+//
+// `b.mail.send.deliver` requires its caller to supply raw bytes, validates them,
+// and hands them over as `raw` — and every reader here ignored that and read the
+// fields instead. A message carrying only `from`, `to` and `raw` therefore had
+// no body parts at all, so the wire body was an empty `multipart/alternative`
+// and the peer accepted it with a 250. Fixing only the body builder is not
+// enough either: the three capability detectors below decide SMTPUTF8, 8BITMIME
+// and BINARYMIME from the same fields, so a raw message would have gone out with
+// all three un-negotiated — a body that is no longer empty but is silently
+// mangled by a peer that needed the hint, which is the worse failure because it
+// looks like it worked.
+// latin1, not utf8. The rest of this file inspects the message as a string
+// (guardEmail's smuggling screen, the DKIM signer, the dot-stuffer), and a
+// utf8 decode of arbitrary 8-bit bytes replaces every invalid sequence with
+// U+FFFD — measured at 21 bytes in, 29 out, four of them destroyed. That
+// corrupts exactly the BINARYMIME payloads this transport now detects and
+// negotiates for, which is the worst case: the send succeeds and the body is
+// wrong. latin1 maps each byte to one codepoint in U+0000..U+00FF and back,
+// so the string form is a faithful stand-in for the bytes and `_wireEncoding`
+// below recovers them exactly.
+function _rawText(message) {
+  if (!message) return null;
+  var raw = message.raw;
+  if (Buffer.isBuffer(raw)) return raw.toString("latin1");
+  if (typeof raw === "string") return raw;
+  return null;
+}
+
+// Which encoding turns this message's string form back into its wire bytes.
+// A raw Buffer went through latin1 above and must come back the same way; a
+// message this transport composed itself is real text and is utf8.
+function _wireEncoding(message) {
+  return (message && Buffer.isBuffer(message.raw)) ? "latin1" : "utf8";
+}
+
+// The header block of raw bytes: everything before the first blank line. Used
+// where a decision is about the envelope and headers rather than the content —
+// SMTPUTF8 is about addresses, not about the body.
+function _rawHeaderBlock(raw) {
+  var end = raw.indexOf("\r\n\r\n");
+  if (end === -1) end = raw.indexOf("\n\n");
+  return end === -1 ? raw : raw.slice(0, end);
+}
+
+// Built from its code point, never typed: a literal NUL in this source would be
+// an invisible byte in the very check that exists to find one.
+var _NUL_CHAR = String.fromCharCode(0);
+
 function _buildRfc822(message) {
+  // Raw bytes ARE the message. Nothing is composed and nothing is re-ordered: a
+  // caller that went to the trouble of building RFC 822 itself is entitled to
+  // have those exact bytes reach the peer.
+  var rawMessage = _rawText(message);
+  if (rawMessage !== null) return rawMessage;
+
   var headers = [];
   headers.push("From: " + message.from);
   headers.push("To: " + (Array.isArray(message.to) ? message.to.join(", ") : message.to));
@@ -826,6 +899,52 @@ function _smtpTlsOpts(cfg, extra) {
   return networkTls()._stripUnreachableCertCompression(out, cfg.tlsOpts);
 }
 
+// Node hands the peer chain back as a linked structure, each cert pointing at
+// its issuer; dane.verifyChain wants the DER buffers in order, leaf first. A
+// self-signed root points at itself, so the walk stops on a cert it has already
+// taken rather than following that link forever.
+function _peerChainDer(sock) {
+  var chain = [];
+  var seen = Object.create(null);
+  var cert;
+  try { cert = sock.getPeerCertificate(true); } catch (_e) { return chain; }   // not a TLS socket, or torn down mid-handshake
+  while (cert && Buffer.isBuffer(cert.raw)) {
+    var id = cert.fingerprint256 || cert.raw.toString("hex");
+    if (seen[id]) break;
+    seen[id] = true;
+    chain.push(cert.raw);
+    cert = cert.issuerCertificate;
+  }
+  return chain;
+}
+
+// Match the peer's certificate chain against the TLSA records published for it
+// (RFC 7672 §2.2). Returns a failure reason, or null when the peer authenticated.
+// Every path that cannot reach a verdict returns a reason: an unverifiable peer
+// is not an authenticated one, and this runs only when a caller asked for DANE.
+function _daneChainFailure(sock, cfg) {
+  var chain = _peerChainDer(sock);
+  if (chain.length === 0) {
+    return "dane: peer presented no certificate chain to match against its " +
+           cfg.daneTlsa.length + " TLSA record(s)";
+  }
+  var rv;
+  try {
+    rv = smtpPolicy().dane.verifyChain(chain, cfg.daneTlsa,
+      { allowPkixModes: cfg.daneAllowPkixModes });
+  } catch (e) {
+    return "dane: chain verification could not run: " + ((e && e.message) || String(e));
+  }
+  if (!rv || rv.ok !== true) {
+    var why = (rv && rv.errors && rv.errors.length)
+      ? "; " + rv.errors.map(function (x) { return x.reason; }).join(", ")
+      : "";
+    return "dane: peer certificate chain matches none of the " +
+           cfg.daneTlsa.length + " TLSA record(s) published for it (RFC 7672 §2.2)" + why;
+  }
+  return null;
+}
+
 function smtpTransport(opts) {
   opts = opts || {};
   if (!opts.host) {
@@ -894,8 +1013,75 @@ function smtpTransport(opts) {
   // the transport's whole life. minTlsVersion stays operator-settable here,
   // unlike the framework's other clients: an MX that only speaks TLS 1.2 is
   // common, and refusing it would mean not delivering mail.
+  // RFC 7672 DANE. `dane` carries the peer's TLSA records, already
+  // DNSSEC-validated by whoever fetched them; the transport matches the
+  // certificate chain the peer presents against them once the handshake
+  // completes, and refuses to send on a mismatch. Supplying records and then
+  // not checking them would be discovery, not authentication, so an empty
+  // array is refused rather than quietly meaning "no DANE": a caller that
+  // fetched nothing must omit the option and say so.
+  //
+  // Resolved BEFORE tlsOpts because it decides what the handshake requires.
+  var daneTlsa = null;
+  if (opts.dane !== undefined && opts.dane !== null) {
+    if (!Array.isArray(opts.dane)) {
+      throw new MailError("mail/smtp-misconfigured",
+        "smtp transport: opts.dane must be an array of TLSA records " +
+        "(b.network.smtp.policy.dane.tlsa output), or omitted", true);
+    }
+    if (opts.dane.length === 0) {
+      throw new MailError("mail/smtp-misconfigured",
+        "smtp transport: opts.dane is an empty array — a peer that publishes " +
+        "no TLSA records cannot be DANE-authenticated, so omit the option " +
+        "rather than passing nothing to match against", true);
+    }
+    daneTlsa = opts.dane;
+  }
+  // PKIX-TA (0) and PKIX-EE (1) mean "this certificate, AND it must also pass
+  // PKIX path validation" (RFC 7672 §3.1.1). verifyChain refuses those usages
+  // unless the caller confirms a PKIX validator ran — and one did, precisely
+  // when the record set contains no DANE-TA/DANE-EE to replace it, because then
+  // the WebPKI check below stays on and the handshake would have failed without
+  // it. Tying the permission to that condition rather than to an opt-in is what
+  // makes a PKIX-only peer deliverable at all: it published a valid record, the
+  // chain validated, and the match was then thrown away as not-allowed.
+  //
+  // The converse matters as much. On a mixed set the WebPKI check is off for
+  // the DANE usages, so the PKIX usages' precondition no longer holds and they
+  // are not honoured — unless the operator asserts otherwise, having arranged
+  // path validation themselves.
+  var daneAllowPkixModes = opts.daneAllowPkixModes === true;
+
+  // RFC 7672 §3.1.1 — under DANE-EE (usage 3) and DANE-TA (usage 2) the TLSA
+  // record IS the trust anchor, and PKIX path validation is not performed. That
+  // is not a relaxation: it is what DANE is for, and it is the deployment DANE
+  // exists to enable — a self-signed or privately-issued MX certificate bound
+  // to its name through DNSSEC.
+  //
+  // Without this, Node's WebPKI check rejects such a peer during the handshake,
+  // before the certificate can be compared against the very records that
+  // authenticate it. Every standards-compliant DANE-only MX was deferred while
+  // matching its published records exactly.
+  //
+  // Authentication is moved, not dropped: `dane` being set makes the chain
+  // check mandatory after the handshake, and a mismatch refuses the send.
+  // PKIX-TA (0) and PKIX-EE (1) still require PKIX, so a record set containing
+  // only those leaves the WebPKI check exactly as configured.
+  var daneIsTrustAnchor = false;
+  if (daneTlsa) {
+    for (var dt = 0; dt < daneTlsa.length; dt += 1) {
+      var daneUsage = daneTlsa[dt] && daneTlsa[dt].usage;
+      if (daneUsage === 2 || daneUsage === 3) { daneIsTrustAnchor = true; break; }
+    }
+  }
+
+  // Records present, none of them a DANE trust anchor, and the WebPKI check
+  // therefore still enforced: that IS the PKIX validation the usage-0/1 records
+  // require, so their matches count.
+  if (daneTlsa && !daneIsTrustAnchor && rejectUnauthorized) daneAllowPkixModes = true;
+
   var tlsOpts = {
-    rejectUnauthorized: rejectUnauthorized,
+    rejectUnauthorized: daneIsTrustAnchor ? false : rejectUnauthorized,
     minVersion: opts.minTlsVersion || "TLSv1.3",
   };
   if (opts.ecdhCurve) tlsOpts.ecdhCurve = opts.ecdhCurve;
@@ -952,6 +1138,8 @@ function smtpTransport(opts) {
     chunkSize:       chunkSize,
     respectPeerSize: respectPeerSize,
     preferFamily:    preferFamily,
+    daneTlsa:        daneTlsa,
+    daneAllowPkixModes: daneAllowPkixModes,
   };
 
   return {
@@ -995,6 +1183,19 @@ function _smtpUtf8Suffix(requiresSmtpUtf8, peerSupportsSmtpUtf8) {
 // the "application/octet-stream" claimed content-type also count.
 function _messageRequiresBinaryMime(message) {
   if (!message) return false;
+  // Raw bytes carry their attachments already encoded, so the question is
+  // whether those bytes are 8-bit binary — a NUL is the giveaway, exactly as it
+  // is for a Buffer attachment below. Scanned over the whole message rather than
+  // a prefix, because a raw message puts its parts wherever its author did.
+  if (Buffer.isBuffer(message.raw)) {
+    for (var r = 0; r < message.raw.length; r += 1) {
+      if (message.raw[r] === 0) return true;
+    }
+    return false;
+  }
+  if (typeof message.raw === "string") {
+    return message.raw.indexOf(_NUL_CHAR) !== -1;
+  }
   if (!Array.isArray(message.attachments)) return false;
   for (var i = 0; i < message.attachments.length; i += 1) {
     var att = message.attachments[i];
@@ -1024,6 +1225,12 @@ function _messageRequiresBinaryMime(message) {
 // (NUL-bearing).
 function _messageRequires8BitMime(message) {
   if (!message) return false;
+  // Anywhere in raw bytes, headers included: 8BITMIME is about the octets on
+  // the wire, so unlike SMTPUTF8 above this is not restricted to the header
+  // block. Without it a raw message with a non-ASCII body went out with the
+  // hint un-negotiated and was mangled by any peer that needed it.
+  var raw8 = _rawText(message);
+  if (raw8 !== null) return _hasNonAscii(raw8);
   var fields = ["text", "html", "subject"];
   for (var i = 0; i < fields.length; i += 1) {
     var v = message[fields[i]];
@@ -1068,9 +1275,9 @@ function _autoDetectFamily() {
 // 1870 SIZE pre-check before MAIL FROM. Caller passes the already-
 // CRLF-normalized + dot-stuffed wire string (the same one that goes
 // into DATA / BDAT). Returns the byte count Node will write.
-function _messageWireSize(wire) {
+function _messageWireSize(wire, encoding) {
   if (typeof wire !== "string") return 0;
-  return Buffer.byteLength(wire, "utf8");
+  return Buffer.byteLength(wire, encoding || "utf8");
 }
 
 // Parse the SIZE keyword's argument from a `SIZE 12345` EHLO line.
@@ -1124,22 +1331,51 @@ function _smtpSend(message, cfg) {
     var requiresBinaryMime = _messageRequiresBinaryMime(message);
     var requires8BitMime = _messageRequires8BitMime(message);
     var dataMessage = _buildRfc822(message);
+    // Every conversion of dataMessage back to bytes uses this, so the size the
+    // peer is told, the bytes BDAT frames, and the bytes DATA writes are all
+    // the same bytes. Resolved before signing because the signer needs it too.
+    var wireEncoding = _wireEncoding(message);
     if (cfg.dkimSigner) {
-      try { dataMessage = cfg.dkimSigner.sign(dataMessage); }
-      catch (e) {
+      try {
+        // A message carrying raw octets is handed to the signer AS octets. A
+        // signature covers the bytes on the wire, and passing a latin1 wire
+        // string would have the signer read it as text, sign its UTF-8
+        // re-encoding, and hand back a decoded copy — a corrupted message
+        // carrying a signature that verifies, which is worse than an
+        // unsigned one.
+        if (wireEncoding === "latin1") {
+          var signedBuf = cfg.dkimSigner.sign(Buffer.from(dataMessage, "latin1"));
+          dataMessage = Buffer.isBuffer(signedBuf)
+            ? signedBuf.toString("latin1")
+            : String(signedBuf);
+        } else {
+          dataMessage = cfg.dkimSigner.sign(dataMessage);
+        }
+      } catch (e) {
         reject(new MailError("mail/dkim-sign-failed",
           "dkim signing failed: " + ((e && e.message) || String(e)), true));
         return;
       }
     }
-    var messageWireSize = _messageWireSize(dataMessage);
+    var messageWireSize = _messageWireSize(dataMessage, wireEncoding);
 
     // Outbound SMTP-smuggling defense — refuse before opening the
     // socket if the produced RFC 822 wire contains the bare-CR / bare-
     // LF + smuggled-verb shape (CVE-2023-51764 / 51765 / 51766 class).
     // Operator-supplied subject / body / headers can sneak the pattern
     // through _buildRfc822 if the input wasn't already gated.
-    var rv = guardEmail().validateMessage(dataMessage, { profile: "strict" });
+    //
+    // For a BINARYMIME message the screen covers the header block rather than
+    // the whole wire. A NUL is what identifies a body as binary in the first
+    // place, so screening the body for one refused every message the transport
+    // detects, negotiates and advertises support for: BINARYMIME was
+    // unreachable. Narrowing the scope is safe because the smuggling class
+    // lives in line structure, and RFC 3030 §3 sends a BINARYMIME body under
+    // BDAT, which is length-framed — there is no dot terminator to forge and no
+    // line scanning to confuse. The framing requirement is enforced below
+    // rather than assumed.
+    var screened = requiresBinaryMime ? _rawHeaderBlock(dataMessage) : dataMessage;
+    var rv = guardEmail().validateMessage(screened, { profile: "strict" });
     if (!rv.ok) {
       var critical = rv.issues.filter(function (i) {
         return i.severity === "critical";
@@ -1203,7 +1439,7 @@ function _smtpSend(message, cfg) {
     // immediately by exactly N bytes of body (no CRLF terminator on
     // the chunk; SMTP framing is purely length-based per RFC 3030 §2).
     function sendBdatChunk() {
-      if (!dataWireBytes) dataWireBytes = Buffer.from(dataMessage, "utf8");
+      if (!dataWireBytes) dataWireBytes = Buffer.from(dataMessage, wireEncoding);
       var remaining = dataWireBytes.length - bdatOffset;
       if (remaining <= 0) {
         // Empty body — send `BDAT 0 LAST` to terminate gracefully.
@@ -1285,7 +1521,14 @@ function _smtpSend(message, cfg) {
         tlsConnectOpts.port = cfg.port;
         if (family === 4 || family === 6) tlsConnectOpts.family = family;
         // allow:outbound-tls-posture — _smtpTlsOpts merges the live posture
-        attachSocket(nodeTls().connect(tlsConnectOpts));
+        var implicitSock = nodeTls().connect(tlsConnectOpts);
+        if (cfg.daneTlsa) {
+          implicitSock.on("secureConnect", function () {
+            var bad = _daneChainFailure(implicitSock, cfg);
+            if (bad) fail(bad);
+          });
+        }
+        attachSocket(implicitSock);
       } else {
         var netOpts = { host: cfg.host, port: cfg.port };
         if (family === 4 || family === 6) netOpts.family = family;
@@ -1306,6 +1549,25 @@ function _smtpSend(message, cfg) {
         peerSupportsBinaryMime  = ehloLines.indexOf("BINARYMIME")  !== -1;
         peerSupportsChunking    = ehloLines.indexOf("CHUNKING")    !== -1;
         peerSizeCap             = _parsePeerSize(ehloFullLines);
+
+        // RFC 3207 §4.2 — the client MUST discard every service extension
+        // learned before the upgrade, so nothing below may be decided from
+        // this EHLO when a STARTTLS is still to come. The cleartext leg is
+        // precisely what a network attacker can rewrite, and each of these
+        // decisions is one an injected extension line would steer: a SIZE cap
+        // that refuses every message, a CHUNKING that picks a framing the real
+        // peer never offered, a BINARYMIME whose absence refuses a message the
+        // peer would have taken.
+        //
+        // It reads as an over-refusal too. Servers commonly advertise CHUNKING
+        // and BINARYMIME only once TLS is up, so a binary message was refused
+        // before STARTTLS was even sent.
+        if (!cfg.useImplicitTLS && !upgradedToTLS) {
+          send("STARTTLS");
+          step = SMTP_STEP_STARTTLS;
+          return;
+        }
+
         // RFC 6531 §3.2 — if the message requires SMTPUTF8 and the
         // peer does not advertise it, refuse hard rather than emit a
         // mangled wire (server might still accept but headers/local
@@ -1344,12 +1606,48 @@ function _smtpSend(message, cfg) {
         // transaction. CHUNKING + BDAT is preferred when both peer
         // advertises it AND operator didn't disable it.
         useBdat = peerSupportsChunking && cfg.chunkingEnabled;
+        // RFC 6152 §3 — a body carrying octets with the high bit set needs
+        // 8BITMIME. Falling through to 7BIT and writing those octets anyway
+        // declares one thing and sends another: the peer may reject the
+        // transaction, or strip the eighth bit and deliver a corrupted message
+        // under a signature that no longer matches it. The BINARYMIME sibling
+        // below already refused; marking a body as needing an extension and
+        // then shipping it without one is the same defect either way.
+        if (requires8BitMime && !peerSupports8BitMime && !requiresBinaryMime) {
+          settled = true;
+          clearTxTimer();
+          try { socket.destroy(); } catch (_e) { /* socket may already be torn down */ }
+          reject(new MailError("mail/8bitmime-not-advertised",
+            "message body has 8-bit content but peer does not advertise 8BITMIME " +
+            "(RFC 6152); encode it as quoted-printable or base64, or deliver " +
+            "through a peer that supports the extension", true));
+          return;
+        }
         if (requiresBinaryMime)              bodyMode = "BINARYMIME";
         else if (requires8BitMime && peerSupports8BitMime) bodyMode = "8BITMIME";
         else                                 bodyMode = "7BIT";
+        // RFC 3030 §3 — a BINARYMIME body travels under BDAT, never DATA. The
+        // body may contain a bare CR, a bare LF, or a lone dot on a line, so
+        // the dot-terminated DATA framing cannot carry it: the peer would end
+        // the message early and read the remainder as commands. That is also
+        // the property the header-scoped smuggling screen above relies on, so
+        // this refusal keeps the two consistent rather than leaving the
+        // narrower screen resting on an assumption.
+        if (requiresBinaryMime && !useBdat) {
+          settled = true;
+          clearTxTimer();
+          try { socket.destroy(); } catch (_e) { /* socket may already be torn down */ }
+          reject(new MailError("mail/binarymime-requires-chunking",
+            "message body is binary (RFC 3030 BINARYMIME) but this transaction " +
+            "would use DATA framing: " +
+            (peerSupportsChunking ? "opts.chunking is disabled on this transport"
+                                  : "the peer does not advertise CHUNKING") +
+            ". A binary body cannot be dot-terminated; encode it as base64 or " +
+            "enable CHUNKING", true));
+          return;
+        }
 
-        if (!cfg.useImplicitTLS && !upgradedToTLS) { send("STARTTLS"); step = SMTP_STEP_STARTTLS; }
-        else if (cfg.user) { send("AUTH LOGIN"); step = SMTP_STEP_AUTH_USER; }
+        if (cfg.user) { send("AUTH LOGIN"); step = SMTP_STEP_AUTH_USER; }
         else { send("MAIL FROM:<" + fromAddr + ">" + _mailFromSuffix()); step = SMTP_STEP_MAIL_FROM; }
       }
       else if (step === SMTP_STEP_STARTTLS) {
@@ -1361,6 +1659,19 @@ function _smtpSend(message, cfg) {
           upgradedToTLS = true;
           try { socket.removeAllListeners("data"); } catch (_e) { /* listeners migrate to upgraded socket */ }
           attachSocket(tlsSocket);
+          // Before the second EHLO, so a peer that fails DANE never sees our
+          // credentials or the message: the handshake is done, and this is the
+          // first moment its certificate can be judged.
+          if (cfg.daneTlsa) {
+            var bad = _daneChainFailure(tlsSocket, cfg);
+            if (bad) { fail(bad); return; }
+          }
+          // RFC 3207 §4.2 — discarded, not appended to. The extension lines
+          // accumulate as they arrive, so leaving the cleartext ones in place
+          // makes the post-upgrade set the UNION of both legs, and a capability
+          // the real peer never advertised inside TLS is still believed.
+          ehloLines.length     = 0;
+          ehloFullLines.length = 0;
           send("EHLO " + cfg.ehloName);
           step = SMTP_STEP_EHLO_RESP;
         });
@@ -1421,7 +1732,23 @@ function _smtpSend(message, cfg) {
       }
       else if (step === SMTP_STEP_DATA) {
         if (code !== 354) { fail("data-rejected (code " + code + ")"); return; }
-        send(_dotStuffForData(dataMessage) + "\r\n.");
+        // Written as bytes, not as a string: socket.write(string) encodes utf8,
+        // which would re-introduce the U+FFFD substitution the latin1 round
+        // trip exists to avoid. Dot-stuffing runs on the string first because
+        // under latin1 one character is one byte, so the line scan is
+        // byte-accurate either way.
+        //
+        // RFC 5321 §4.1.1.4 — the terminator is CRLF "." CRLF, and the first
+        // CRLF belongs to the body's last line. A serialized RFC 822 message
+        // normally already ends in one, so appending another inserted a blank
+        // line: the bytes were not verbatim after all, and a DKIM signature
+        // over them no longer verified. Only the missing CRLF is added.
+        var stuffed = _dotStuffForData(dataMessage);
+        var terminator = (stuffed.length >= 2 && stuffed.slice(-2) === "\r\n")
+          ? ".\r\n" : "\r\n.\r\n";
+        try {
+          socket.write(Buffer.from(stuffed + terminator, wireEncoding));
+        } catch (e) { fail(e.message || String(e)); return; }
         step = SMTP_STEP_BODY;
       }
       else if (step === SMTP_STEP_BDAT) {
@@ -2075,9 +2402,10 @@ module.exports = {
   // verify (RFC 6376, on .dkim above alongside outbound signing),
   // DMARC (RFC 9989), ARC (RFC 8617). `.inbound.verify` is the
   // one-call receiver pipeline — SPF + DKIM + From-header extraction +
-  // DMARC policy + the RFC 8601 Authentication-Results header —
-  // composed by b.mail.server.mx at DATA time via its guardEnvelope
-  // opt and callable directly by operator-built listeners.
+  // DMARC policy + ARC chain status + the RFC 8601
+  // Authentication-Results header — composed by b.mail.server.mx at
+  // DATA time via its guardEnvelope opt and callable directly by
+  // operator-built listeners.
   spf:         mailAuth.spf,
   dmarc:       mailAuth.dmarc,
   arc:         mailAuth.arc,
@@ -2085,9 +2413,19 @@ module.exports = {
   authResults: mailAuth.authResults,
   inbound:     mailAuth.inbound,
   bimi:        mailBimi,
-  // Test-only export: lets unit tests inspect the wire format without
-  // standing up a TLS-capable SMTP fixture. Operators don't call this.
+  // Test-only exports: let unit tests inspect the wire format and the
+  // capability decisions without standing up a TLS-capable SMTP fixture that
+  // advertises SMTPUTF8 / 8BITMIME / BINARYMIME. Operators don't call these.
+  //
+  // The three detectors are exported for the same reason the builder is: they
+  // decide what goes on the wire alongside the body, they read the message the
+  // same way it does, and when the builder learned about raw bytes and they did
+  // not, a raw message went out with every hint un-negotiated. Testing the
+  // builder alone is what left that gap open.
   _buildRfc822ForTest: _buildRfc822,
+  _requiresSmtpUtf8ForTest:   _messageRequiresSmtpUtf8,
+  _requiresBinaryMimeForTest: _messageRequiresBinaryMime,
+  _requires8BitMimeForTest:   _messageRequires8BitMime,
   transports: {
     console: consoleTransport,
     memory:  memoryTransport,

package/lib/mcp.js

@@ -479,7 +479,12 @@ function _toolResultSanitize(result, opts) {
       "toolResult.sanitize: posture must be 'refuse' | 'sanitize' | 'audit-only'");
   }
   var maxBytes = opts.maxTextBytes || DEFAULT_TOOL_OUTPUT_MAX_BYTES;
-  var allowedHosts = Array.isArray(opts.allowedHosts) ? opts.allowedHosts : [];
+  // `null` when no allowlist was supplied, the array when one was — including
+  // an EMPTY one, which asks that no URL be permitted. Normalising the absent
+  // case to `[]` made the two indistinguishable, and the length test below then
+  // read both as "no restriction". A tool result is attacker-influenced
+  // content, so this is the allowlist that stops one pointing wherever it likes.
+  var allowedHosts = Array.isArray(opts.allowedHosts) ? opts.allowedHosts : null;
   if (!result || typeof result !== "object") {
     throw new McpError("mcp/bad-tool-result",
       "toolResult.sanitize: result must be an object");
@@ -522,7 +527,7 @@ function _toolResultSanitize(result, opts) {
       cleaned.push({ type: "text", text: t });
     } else if (block.type === "image" || block.type === "resource_link" || block.type === "audio") {
       var url = block.url || (block.resource && block.resource.uri);
-      if (typeof url === "string" && url.length > 0 && allowedHosts.length > 0) {
+      if (typeof url === "string" && url.length > 0 && allowedHosts) {
         var u; try { u = new URL(url); } catch (_e) { u = null; }                                // allow:raw-new-url-parse-only — operator-supplied tool URL; allowlist enforced below
         if (!u || allowedHosts.indexOf(u.host) === -1) {
           issues.push({ kind: "off-allowlist-url", index: i, url: url });
@@ -950,7 +955,10 @@ function _samplingGuard(opts) {
 function _elicitationGuard(opts) {
   opts = opts || {};
   var maxBytes    = opts.maxMessageBytes || (8 * 1024);                                          // allow:raw-byte-literal — 8 KiB elicitation message cap
-  var allowedSchemaTypes = Array.isArray(opts.allowedSchemaTypes) && opts.allowedSchemaTypes.length > 0
+  // The default applies when the option is OMITTED. An explicitly empty list
+  // says no schema type is acceptable, and falling back to the default there
+  // would answer a caller's "none" with "object".
+  var allowedSchemaTypes = Array.isArray(opts.allowedSchemaTypes)
     ? opts.allowedSchemaTypes : ["object"];
   var posture     = opts.posture || "refuse";
 

package/lib/middleware/bearer-auth.js

@@ -198,7 +198,12 @@ function create(opts) {
   }
 
   function _emitObs(metric, n, tags) {
-    try { observability().count(metric, n, tags || {}); }
+    // `safeEvent`, which is the name the module exports. It was `count`, which
+    // it does not, so this threw a TypeError on every call and the drop-silent
+    // catch below swallowed it — the counter never emitted once. `safeEvent` is
+    // itself drop-silent, so the catch stays as a belt on a working emitter
+    // rather than as the thing hiding a broken one.
+    try { observability().safeEvent(metric, n, tags || {}); }
     catch (_e) { /* best-effort */ }
   }
 

package/lib/middleware/fetch-metadata.js

@@ -316,7 +316,11 @@ function create(opts) {
     }
     _emitDenied(req, "cross-site-refused (mode=" + (mode || "?") +
                      ", dest=" + (dest || "?") + ")");
-    try { observability().count("auth.fetch_metadata.cross_site_refused", 1, {}); }
+    // `safeEvent`, not `count` — the module exports no `count`, so this threw on
+    // every cross-site refusal and the drop-silent catch swallowed it. The
+    // refusals happened; the metric that was meant to make them visible never
+    // did.
+    try { observability().safeEvent("auth.fetch_metadata.cross_site_refused", 1, {}); }
     catch (_e) { /* best-effort */ }
     return _writeReject(req, res, "Cross-site request refused.", "cross-site-refused", onDeny, problemMode);
   };