@blamejs/core 0.18.53 → 0.18.55

package/lib/http-client.js

@@ -621,7 +621,13 @@ function _fromH2Headers(h2Headers) {
 //   { host: "api.x.com", methods: ["GET","HEAD"] }
 //                       method-restricted; methods omitted = any method
 function hostAllowed(host, allowedHosts, method) {
-  if (!Array.isArray(allowedHosts) || allowedHosts.length === 0) return true;
+  // A NON-array means no pin was supplied, so nothing is constrained. An EMPTY
+  // array is a pin that permits nothing, and falls through to the `false` at
+  // the end rather than short-circuiting to `true` here — an allowlist that
+  // disappears when empty is a firewall rule set that opens when the last rule
+  // is deleted. Every caller enforcing this pin routes through here, so the
+  // distinction has to live at this function and not at each of them.
+  if (!Array.isArray(allowedHosts)) return true;
   var wanted = String(host || "").toLowerCase();
   var verb = String(method || "GET").toUpperCase();
   for (var ai = 0; ai < allowedHosts.length; ai++) {
@@ -720,7 +726,9 @@ function pinnedClient(client, allowedHosts) {
   // redirect the wrapper never sees is a hop none of that applied to. Returning
   // the client untouched when no pin was named would leave a 307 from https to
   // http free to resend the credentials that were checked onto the first hop.
-  var pin = (Array.isArray(allowedHosts) && allowedHosts.length > 0) ? allowedHosts : null;
+  // An EMPTY allowlist is a real pin meaning "reach nothing", not the absence
+  // of one — same reasoning as the request path above.
+  var pin = Array.isArray(allowedHosts) ? allowedHosts : null;
   return {
     request: function (opts) {
       var target = opts && opts.url;
@@ -1746,7 +1754,13 @@ function _requestSingle(opts) {
   // A disallowed call rejects with HOST_DISALLOWED AND emits an
   // audit event when opts.audit is wired (operator gets a structured
   // signal that the application tried to reach somewhere it shouldn't).
-  if (Array.isArray(opts.allowedHosts) && opts.allowedHosts.length > 0) {
+  // Gated on "was an allowlist supplied", NOT on "is it non-empty". Omitting
+  // the option is how "no egress pin" is spelled; an operator who builds the
+  // list from config and gets an empty one is saying this process may reach
+  // nothing, and reading that as "no pin" inverts the request exactly. An
+  // allowlist that disappears when empty is a firewall rule set that opens when
+  // the last rule is deleted.
+  if (Array.isArray(opts.allowedHosts)) {
     var host = u.hostname.toLowerCase();
     var method = (opts.method || "GET").toUpperCase();
     var ok = hostAllowed(host, opts.allowedHosts, method);

package/lib/mail-agent.js

@@ -77,6 +77,7 @@
 var lazyRequire        = require("./lazy-require");
 var validateOpts       = require("./validate-opts");
 var C                  = require("./constants");
+var agentAudit         = require("./agent-audit");
 var { defineClass }    = require("./framework-error");
 var guardMailQuery     = require("./guard-mail-query");
 var guardMailCompose   = require("./guard-mail-compose");
@@ -539,19 +540,33 @@ async function _expunge(ctx, args) {
       "agent.expunge: { folder, objectIds, [candidateTtlMs] } required");
   }
 
-  // Look up the regulator-mandated retention floor for the operator's
-  // active posture. For expunge semantics, the floor IS the minimum
-  // TTL — messages younger than the floor MUST NOT be hard-deleted,
-  // even on operator request. Distinct from `b.retention.
-  // complianceFloor(posture, candidateTtl)` which composes the
-  // candidate TTL into a max — that primitive's "candidate must be
-  // positive" contract doesn't apply here because expunge means TTL=0.
-  // Read the floor table directly.
+  // Look up the regulator-mandated retention floor for the operator's active
+  // posture. For expunge semantics the floor IS the minimum TTL — messages
+  // younger than it MUST NOT be hard-deleted, even on operator request.
+  //
+  // Through b.retention.complianceFloor, not the floor table it wraps. The
+  // direct read fell back to zero for anything the table did not contain, so a
+  // misspelled posture, a capitalised one ("HIPAA"), or one the table simply
+  // does not carry all permitted an unbounded hard delete with no error — a
+  // typo refused where retention windows are computed and accepted at the one
+  // call that destroys mail permanently. It also read through the prototype:
+  // posture "constructor" returned a function, which is truthy, so the `|| 0`
+  // fallback kept it and every age comparison against it was nonsense.
+  //
+  // No posture at all is a legitimate configuration and keeps the zero floor.
+  // A posture that was supplied and is not understood now throws.
   var retentionModule = require("./retention");                                                    // allow:inline-require — lazy-load until first expunge call
   var posture = (ctx && ctx.posture) || (args && args.posture) || null;
   var floorMs = 0;
   if (typeof posture === "string" && posture.length > 0) {
-    floorMs = retentionModule.COMPLIANCE_RETENTION_FLOOR_MS[posture] || 0;
+    try {
+      floorMs = retentionModule.complianceFloor(posture);
+    } catch (e) {
+      throw new MailAgentError("mail-agent/unknown-posture",
+        "expunge: posture '" + posture + "' is not a posture the framework knows, " +
+        "so no retention floor can be established and the hard delete is refused " +
+        "rather than run unbounded: " + ((e && e.message) || String(e)));
+    }
   }
 
   // Read message metadata BEFORE invoking hardExpunge so the per-id
@@ -775,10 +790,11 @@ function _auditEmitter(auditOverride) {
   };
 }
 
-function _actorShape(actor) {
-  if (!actor || typeof actor !== "object") return { id: "<unknown>" };
-  return { id: actor.id, roles: actor.roles || [] };
-}
+// Through the shared shaper rather than a local copy. This module had its own,
+// and the two drifted in exactly the way that matters: both emitted `{ id,
+// roles }` while `b.audit.record` reads `actor.userId`, so every row either
+// produced landed unattributable. One shaper means one place to be right.
+var _actorShape = agentAudit.actorShape;
 
 module.exports = {
   create:           create,

package/lib/mail-arc-sign.js

@@ -128,7 +128,12 @@ function _bodyHashB64(body, algorithm) {
   var canonical = _canonRelaxedBody(body);
   // RFC 6376 §3.4.4 — empty body canon is `\r\n` (one CRLF). Hash
   // includes that CRLF.
-  return nodeCrypto.createHash(hashAlgo).update(canonical).digest("base64");
+  //
+  // latin1, for the reason DKIM uses it: ARC seals a message the same way DKIM
+  // signs one, over the OCTETS on the wire. `update(string)` defaults to UTF-8,
+  // which re-encodes every high byte and seals a body that is not the one the
+  // message carries.
+  return nodeCrypto.createHash(hashAlgo).update(canonical, "latin1").digest("base64");
 }
 
 // RFC 8617 §5 — ARC chains MUST NOT exceed 50 hops. The verifier
@@ -182,8 +187,27 @@ function sign(opts) {
     "headersToSign", "timestamp", "audit", "excludeAarFromAms",
   ], "mail.arc.sign");
 
-  validateOpts.requireNonEmptyString(opts.rfc822, "sign: rfc822",
-    MailAuthError, "arc-sign/bad-input");
+  // A seal covers the OCTETS on the wire, so a caller holding them seals them
+  // rather than a UTF-8 decode of them. One code unit per octet from here down.
+  //
+  // Through `dkim._toWire`, which is the SAME function the DKIM signer uses.
+  // Converting the Buffer here by hand and leaving a string untouched was the
+  // first version, and it left every non-ASCII string message signed over the
+  // low byte of each code unit: the hashing and signing paths below read a
+  // string as latin1 octets, so a message that is not already ASCII has to be
+  // put into that form before it reaches them, not after. Two functions
+  // answering "which bytes is this message" is how they come to disagree.
+  var gaveBuffer = Buffer.isBuffer(opts.rfc822);
+  if (gaveBuffer) {
+    if (opts.rfc822.length === 0) {
+      throw new MailAuthError("arc-sign/bad-input",
+        "sign: rfc822 must be a non-empty Buffer or string");
+    }
+  } else {
+    validateOpts.requireNonEmptyString(opts.rfc822, "sign: rfc822",
+      MailAuthError, "arc-sign/bad-input");
+  }
+  opts = Object.assign({}, opts, { rfc822: dkim._toWire(opts.rfc822) });
   if (typeof opts.instance !== "number" || !isFinite(opts.instance) ||
       opts.instance < 1 || opts.instance > 50 ||                                        // RFC 8617 §5 chain bound
       Math.floor(opts.instance) !== opts.instance) {
@@ -387,7 +411,14 @@ function sign(opts) {
     "ARC-Seal: " + asValue + "\r\n" +
     "ARC-Message-Signature: " + amsValue + "\r\n" +
     "ARC-Authentication-Results: " + aarValue + "\r\n";
-  var sealedRfc822 = prependedHeaders + opts.rfc822;
+  // Returned in the shape it arrived in, so a caller relaying the sealed
+  // message relays the octets they handed over. See the same note in
+  // lib/mail-dkim.js sign(): a string caller gets their own string back, which
+  // is the UTF-8 decode of the wire form rather than the wire form itself.
+  var sealedWire = prependedHeaders + opts.rfc822;
+  var sealedRfc822 = gaveBuffer
+    ? Buffer.from(sealedWire, "latin1")
+    : Buffer.from(sealedWire, "latin1").toString("utf8");
 
   if (auditOn) {
     try {
@@ -418,15 +449,17 @@ function sign(opts) {
 }
 
 function _signOne(canonInput, keyObject, algorithm) {
+  // The canonicalized header octets, one code unit per octet — same boundary as
+  // the body hash above and as DKIM's.
+  var toSign = Buffer.from(canonInput, "latin1");
   if (algorithm === "ed25519-sha256") {
     // Ed25519 prehash variant — Node's `crypto.sign(null, msg, key)`
     // accepts the message directly.
-    return nodeCrypto.sign(null, Buffer.from(canonInput, "utf8"), keyObject)
-      .toString("base64");
+    return nodeCrypto.sign(null, toSign, keyObject).toString("base64");
   }
   // RSA-SHA256 / default — createSign + update + sign.
   var signer = nodeCrypto.createSign("RSA-SHA256");
-  signer.update(canonInput);
+  signer.update(toSign);
   return signer.sign(keyObject).toString("base64");
 }
 

package/lib/mail-auth.js

@@ -1926,10 +1926,15 @@ function _arcInstanceOf(value) {
 }
 
 async function arcVerify(rfc822, opts) {
-  if (typeof rfc822 !== "string" || rfc822.length === 0) {
+  if ((!Buffer.isBuffer(rfc822) && typeof rfc822 !== "string") || rfc822.length === 0) {
     throw new MailAuthError("mail-auth/arc-bad-input",
-      "arc.verify: rfc822 must be a non-empty string");
+      "arc.verify: rfc822 must be a non-empty Buffer or string");
   }
+  // A seal covers the octets on the wire, so a caller holding them verifies
+  // against them. Same boundary as DKIM, and the SAME function, so a string
+  // cannot come to mean one thing here and another there: a Buffer is octets,
+  // a string is text and its octets are its UTF-8 encoding.
+  rfc822 = dkim._toWire(rfc822);
   opts = opts || {};
   // RFC 8617 §5.1.1 / RFC 6376 §3.4 — ARC-Message-Signature verification
   // reuses the DKIM verifier, whose header/body split REQUIRES CRLF CRLF and
@@ -2083,6 +2088,15 @@ async function arcVerify(rfc822, opts) {
   // 3. Per-hop AMS + AS verification.
   var perHop = [];
   var anyFail = false;
+  // A hop that failed for a reason OTHER than the key being unreachable. RFC
+  // 8601 §2.7 keeps `temperror` apart from `fail` for exactly this reason: one
+  // is a statement about the message, the other about the resolver. Collapsing
+  // them tells a consumer a seal was forged when a DNS query timed out.
+  //
+  // Tracked as the hard case rather than the transient one, because `anyFail`
+  // without `anyHardFail` already means every non-passing hop was a temperror,
+  // and a second flag could disagree with the first.
+  var anyHardFail = false;
   // RFC 8617 §5.2 — operator-tunable clock skew on t= (signing
   // timestamp) and x= (expiration) tags. Default 5 min.
   // A present clockSkewMs must be a non-negative finite integer; an Infinity /
@@ -2142,7 +2156,16 @@ async function arcVerify(rfc822, opts) {
       amsErrors:                amsResult.errors,
       asErrors:                 asResult.errors,
     });
-    if (amsResult.result !== "pass" || asResult.result !== "pass") anyFail = true;
+    if (amsResult.result !== "pass" || asResult.result !== "pass") {
+      anyFail = true;
+      // Accumulated across ALL hops, not decided per hop: a temperror on one
+      // hop and a genuine failure on another is a genuine failure, whichever
+      // order they arrive in.
+      if ((amsResult.result !== "pass" && amsResult.result !== "temperror") ||
+          (asResult.result  !== "pass" && asResult.result  !== "temperror")) {
+        anyHardFail = true;
+      }
+    }
   }
 
   // 4. Chain Validation per RFC 8617 §5.2.
@@ -2185,12 +2208,37 @@ async function arcVerify(rfc822, opts) {
   var lastCv = perHopCv[perHopCv.length - 1];
   var chainStatus;
   var reasonOut = null;
+  // Whether this verdict is worth retrying. A consumer that lets the chain
+  // influence a disposition must not read a resolver outage as a forgery.
+  var transientOut = false;
   if (hopRuleViolation) {
     chainStatus = "fail";
     reasonOut = hopRuleViolation;
   } else if (anyFail) {
     chainStatus = "fail";
-    reasonOut = "signature-verification-failed";
+    // The chain does not validate either way, so the wire token stays "fail" —
+    // RFC 8617 §5.2 gives the chain none / pass / fail and nothing else, and
+    // putting a word on the wire that receivers have no rule for would be a
+    // worse answer than a coarse one. The distinction a consumer needs lives in
+    // the structured verdict beside it.
+    // A cv=fail recorded by a hop is TERMINAL — RFC 8617 §5.2 makes the chain
+    // unrecoverable from that point, so it is reported as the reason even when
+    // an upstream lookup also failed, and it is never transient. Retrying DNS
+    // cannot turn it into a pass, and calling it transient tells a consumer to
+    // defer and re-deliver mail that will never validate.
+    //
+    // Believing that claim requires the hop making it to have proved it made
+    // it. cv= is a token in a header the sender wrote; only the ARC-Seal
+    // covering that header says the named hop is who wrote it. So terminality
+    // is gated on the LAST hop's seal verifying: when its own key lookup
+    // temperrored, the token is unauthenticated text, and honouring it would
+    // let anyone who can stall one DNS query stamp cv=fail on a chain and turn
+    // a retryable outage into a permanent rejection.
+    var lastSeal = perHop.length ? perHop[perHop.length - 1].asResult : null;
+    var terminalCv = lastCv === "fail" && lastSeal === "pass";
+    reasonOut = terminalCv ? "last-as-cv=fail"
+      : (anyHardFail ? "signature-verification-failed" : "key-lookup-unavailable");
+    transientOut = !terminalCv && !anyHardFail;
   } else if (lastCv === "fail") {
     chainStatus = "fail";
     reasonOut = "last-as-cv=fail";
@@ -2211,6 +2259,7 @@ async function arcVerify(rfc822, opts) {
     hops:        perHop,
   };
   if (reasonOut) out.reason = reasonOut;
+  if (transientOut) out.transient = true;
   return out;
 }
 
@@ -2333,7 +2382,10 @@ async function _verifyAmsViaDkim(rfc822, hop, sigValue, tags, dkim, dnsLookup) {
   // unreachable from b.mail.dkim.verify.
   var verifyOpts = { dnsLookup: dnsLookup };
   verifyOpts[ARC_AMS_REUSE] = true;
-  var rv = await dkim.verify(synthetic, verifyOpts);
+  // As OCTETS. `synthetic` is already the wire form, one code unit per octet,
+  // and handing it over as a string would have the verifier read it as text and
+  // re-encode it as UTF-8 — hashing bytes this message does not contain.
+  var rv = await dkim.verify(dkim._wireBytes(synthetic), verifyOpts);
   if (!Array.isArray(rv) || rv.length === 0) {
     return { result: "permerror", errors: ["ams: dkim verifier returned no results"] };
   }
@@ -2401,7 +2453,11 @@ function _runVerify(signedString, sigB64, algorithm, keyB64, label) {
   var sigBuf = Buffer.from(sigB64, "base64");
   var verified;
   try {
-    verified = nodeCrypto.verify(nodeAlgo, Buffer.from(signedString, "utf8"), keyObj, sigBuf);
+    // latin1: the signer sealed the canonicalized OCTETS (lib/mail-arc-sign.js),
+    // and the message reaches here one code unit per octet. Re-encoding as UTF-8
+    // would verify against bytes the signer never saw, for any message carrying
+    // 8-bit content.
+    verified = nodeCrypto.verify(nodeAlgo, Buffer.from(signedString, "latin1"), keyObj, sigBuf);
   } catch (e) {
     return { result: "permerror",
              errors: [label + ": verify threw: " + ((e && e.message) || String(e))] };
@@ -2429,10 +2485,19 @@ void C; // C is imported for future TIME constants in policy fetchers.
 //   //    trustedDomain: "mailgun.net" }
 
 async function arcEvaluate(rfc822, opts) {
-  if (typeof rfc822 !== "string" || rfc822.length === 0) {
+  if ((!Buffer.isBuffer(rfc822) && typeof rfc822 !== "string") || rfc822.length === 0) {
     throw new MailAuthError("mail-auth/arc-bad-input",
-      "arc.evaluate: rfc822 must be a non-empty string");
-  }
+      "arc.evaluate: rfc822 must be a non-empty Buffer or string");
+  }
+  // Two views, and the distinction matters. The header re-scan below reads the
+  // message as a wire STRING; `arcVerify` resolves its own argument, and
+  // `_toWire` is idempotent on a Buffer but NOT on a string — applied twice it
+  // reads the latin1 wire form as text and re-encodes it as UTF-8, so the
+  // octets checked stop being the octets signed. Passing the wire string on
+  // made a Unicode message pass `arc.verify` and fail `arc.evaluate`, which are
+  // supposed to answer the same question.
+  rfc822 = dkim._toWire(rfc822);
+  var rfc822Octets = dkim._wireBytes(rfc822);
   opts = opts || {};
   if (!Array.isArray(opts.trustedSealers)) {
     throw new MailAuthError("mail-auth/arc-bad-trusted-sealers",
@@ -2448,7 +2513,7 @@ async function arcEvaluate(rfc822, opts) {
     trusted[d.toLowerCase()] = true;
   }
 
-  var verdict = await arcVerify(rfc822, opts);
+  var verdict = await arcVerify(rfc822Octets, opts);
   var out = {
     chainStatus:    verdict.chainStatus,
     hopCount:       verdict.hopCount,
@@ -2469,6 +2534,9 @@ async function arcEvaluate(rfc822, opts) {
     breakAt:        null,
   };
   if (verdict.reason) out.reason = verdict.reason;
+  // Carried for the same reason `reason` is: a caller deciding what to do about
+  // a chain that did not validate needs to know whether the answer is stable.
+  if (verdict.transient) out.transient = true;
 
   // Re-extract per-hop d= (signing domain on AS) AND the AAR text from
   // the original headers — the verify-result shape doesn't carry
@@ -2695,9 +2763,19 @@ function authResultsEmit(opts) {
 //     message:    rfc5322Bytes,                  // string or Buffer
 //     authservId: "mx.example.com",
 //   });
-//   // → { spf, dkim, from, dmarc, authResults }
+//   // → { spf, dkim, from, dmarc, arc, authResults }
 //   if (v.dmarc.recommendedAction === "reject") { /* refuse 550 5.7.1 */ }
 //
+// `arc.chainStatus` is "none" / "pass" / "fail" — the vocabulary RFC 8617 §5.2
+// gives the chain, and the token that goes on the wire in
+// Authentication-Results. A "fail" carries `arc.reason`, and `arc.transient` is
+// true when the chain did not validate because a key could not be looked up
+// rather than because a seal did not verify. Those want opposite responses: one
+// is a statement about the sender, the other about a resolver, and a consumer
+// that lets the chain influence a disposition must not read an outage as a
+// forgery. The header cannot carry the distinction, which is why the structured
+// verdict does.
+//
 // From-header discipline (RFC 9989 §5.3.1, RFC 7489 §6.6.1 before it):
 // DMARC evaluates exactly one author domain. A message with zero From fields, several From fields,
 // or several author addresses in one field is the header-duplication
@@ -2834,14 +2912,13 @@ async function inboundVerify(opts) {
   }
   var message = opts.message;
   if (Buffer.isBuffer(message)) {
-    // DKIM canonicalization re-encodes the string form as UTF-8
-    // (lib/mail-dkim.js hashes Buffer.from(canonicalized, "utf8")), so
-    // the byte→string decode must be utf8 for valid-UTF-8 content to
-    // round-trip exactly. Non-UTF-8 8-bit content cannot survive any
-    // decode + utf8 re-encode; such messages verify as DKIM fail and
-    // DMARC falls back to the SPF identity (RFC 9989 §4 — one
-    // aligned authenticator is sufficient to pass).
-    message = message.toString("utf8");
+    // One code unit per octet, which is what the DKIM verifier now hashes.
+    // This used to decode as UTF-8, on the reasoning that the verifier
+    // re-encoded as UTF-8 and so only valid-UTF-8 content could round-trip.
+    // That was accurate and it meant a message carrying ordinary 8-bit content
+    // verified as a DKIM fail, leaving DMARC to fall back to the SPF identity
+    // — and nothing to fall back to once the message had been forwarded.
+    message = message.toString("latin1");
   }
   if (typeof message !== "string" || message.length === 0) {
     throw new MailAuthError("mail-auth/inbound-bad-message",
@@ -2893,10 +2970,40 @@ async function inboundVerify(opts) {
   if (opts.clockSkewMs !== undefined) dkimVerifyOpts.clockSkewMs = opts.clockSkewMs;
   if (opts.maxSignatures !== undefined) dkimVerifyOpts.maxSignatures = opts.maxSignatures;
   if (opts.minRsaBits !== undefined) dkimVerifyOpts.minRsaBits = opts.minRsaBits;
-  var dkimResults = await dkim.verify(message, dkimVerifyOpts);
+  // As OCTETS. `message` is the wire form here, one code unit per octet, and
+  // both verifiers read a string as text — handing one over would re-encode it
+  // as UTF-8 and verify against bytes the sender never signed.
+  var messageOctets = dkim._wireBytes(message);
+  var dkimResults = await dkim.verify(messageOctets, dkimVerifyOpts);
+
+  // ARC (RFC 8617) — the chain a forwarder or list left behind, carrying the
+  // authentication verdict from before it rewrote the message. A receiver
+  // without it sees forwarded mail fail DMARC on the forwarder's identity with
+  // no way to recover the original result, which is the case ARC exists for.
+  //
+  // The chain is EVIDENCE, not a gate: a malformed one is reported as a fail
+  // verdict and the pipeline continues, because refusing mail over a defect in
+  // some intermediary's headers would be the receiver punishing the wrong
+  // party. Deciding what a passing chain buys a sender is local policy, which
+  // is what b.mail.arc.evaluate + trustedSealers is for.
+  var arcResult;
+  try {
+    arcResult = await arcVerify(messageOctets, { dnsLookup: opts.dnsLookup });
+  } catch (e) {
+    arcResult = { chainStatus: "fail", hopCount: 0, hops: [],
+                  reason: "arc-verify-error: " + ((e && e.message) || String(e)) };
+  }
 
   // From header + DMARC policy/alignment.
-  var from = _extractFromHeaders(_splitHeaderBlock(message).headers);
+  // The From header is read as TEXT, while DKIM and ARC above read the same
+  // message as OCTETS. Both are needed and they are not the same view: a
+  // signature covers the bytes on the wire, and an address is characters —
+  // an RFC 6531 local part written in UTF-8 aligns against a DMARC record
+  // only once it is decoded as UTF-8, and reading it octet-per-code-unit
+  // would compare mojibake. Only the header block is decoded, so the body's
+  // size does not pay for it.
+  var headerOctets = _splitHeaderBlock(message).headers;
+  var from = _extractFromHeaders(Buffer.from(headerOctets, "latin1").toString("utf8"));
   var dmarc;
   if (from.count === 1 && from.address && from.domain) {
     dmarc = await dmarcEvaluate({
@@ -2956,10 +3063,15 @@ async function inboundVerify(opts) {
     var dmarcEntry = { method: "dmarc", result: dmarc.result };
     if (from.address) dmarcEntry.from = from.address;
     arResults.push(dmarcEntry);
+    // RFC 8601 §2.7.6 — the arc method. "none" is reported like any other
+    // verdict: a receiver reading the header can tell a chain that was checked
+    // and found absent from a receiver that does not check.
+    arResults.push({ method: "arc", result: arcResult.chainStatus });
     authResults = authResultsEmit({ authservId: opts.authservId, results: arResults });
   }
 
-  return { spf: spf, dkim: dkimResults, from: from, dmarc: dmarc, authResults: authResults };
+  return { spf: spf, dkim: dkimResults, from: from, dmarc: dmarc,
+           arc: arcResult, authResults: authResults };
 }
 
 // ---- DMARC aggregate (RUA) report parser (RFC 9990 §3 / draft-ietf-dmarc-aggregate-reporting) ----

package/lib/mail-crypto-pgp.js

@@ -81,7 +81,7 @@
  *   Surface:
  *     var sigBundle = b.mail.crypto.pgp.sign({
  *       message:        "rfc822 body bytes",
- *       privateKeyPem:  "-----BEGIN PRIVATE KEY----- ...",
+ *       privateKeyPem:  "<PEM-encoded PKCS#8 private key>",
  *       passphrase:     undefined | "...",     // optional
  *       audit:          opts.audit,            // optional b.audit handle
  *     });

package/lib/mail-dkim.js

@@ -179,6 +179,51 @@ function _parseHeaders(rawHeaders) {
   return out;
 }
 
+// ---- The octet boundary ----
+//
+// RFC 6376 §3.4 signs a canonicalized OCTET stream, and a JavaScript string
+// cannot hold one: a message decoded as UTF-8 loses every sequence that is not
+// valid UTF-8 to U+FFFD, and no string re-encodes back to those bytes. Signing
+// hashed `utf8(decode_utf8(original))`, equal to the original only when the
+// original was already valid UTF-8 — 128 of the 256 single-octet values do not
+// survive it.
+//
+// So the message is carried as latin1 from here down. latin1 is a bijection
+// between bytes and code units 0x00-0xFF, which makes every string operation
+// below an operation on the octets themselves. That is not an approximation of a
+// byte implementation, it IS one: §3.4 canonicalization touches only SP, HTAB,
+// CR and LF, none of which can appear inside a multi-byte UTF-8 sequence, so a
+// byte scan and this character scan agree on every input.
+//
+// A string argument keeps its present meaning — the octets are that string's
+// UTF-8 encoding — so it is encoded once here and rejoins the same path. One
+// path, and the caller's existing signatures are unchanged.
+// NOT IDEMPOTENT ON A STRING. Applied twice to a string, the second pass reads
+// the latin1 wire form as text and re-encodes it as UTF-8, so the octets are no
+// longer the message's. It IS idempotent on a Buffer. So a function that
+// resolves a message and then hands it to another function that resolves it
+// again must pass OCTETS — `_wireBytes(_toWire(x))` — not the wire string.
+// `arc.evaluate` passed the string to `arc.verify` and the two then disagreed
+// about whether the same Unicode message's chain passed.
+//
+// Refuses anything else rather than coercing it. `String(x)` on an object
+// yields "[object Object]", which is a message this would go on to sign — and
+// the caller gets a valid signature over eleven characters instead of an error.
+function _toWire(rfc822) {
+  if (Buffer.isBuffer(rfc822)) return rfc822.toString("latin1");
+  if (typeof rfc822 !== "string") {
+    throw new DkimError("dkim/bad-input",
+      "message must be a Buffer or a string — got " +
+      (rfc822 === null ? "null" : typeof rfc822));
+  }
+  return Buffer.from(rfc822, "utf8").toString("latin1");
+}
+
+// The octets of a string that is already in the latin1 wire form above.
+function _wireBytes(wire) {
+  return Buffer.from(wire, "latin1");
+}
+
 // ---- Hashing + signing ----
 
 function _bodyHashB64(body, algorithm, canonBody, lcap) {
@@ -192,25 +237,29 @@ function _bodyHashB64(body, algorithm, canonBody, lcap) {
   // octet stream to lcap (slicing the raw body before canonicalizing diverges
   // whenever relaxed canon changes the byte count within the first lcap
   // octets — WSP-run collapse, trailing-WSP strip, CRLF normalization).
+  var buf = _wireBytes(canonicalized);
   if (typeof lcap === "number" && isFinite(lcap) && lcap >= 0) {
-    var buf = Buffer.from(canonicalized, "utf8");
     hash.update(lcap < buf.length ? buf.subarray(0, lcap) : buf);
   } else {
-    hash.update(canonicalized);
+    hash.update(buf);
   }
   return hash.digest("base64");
 }
 
 function _signString(strToSign, privateKey, algorithm) {
+  // §3.7's data hash is assembled from canonicalized header octets, so it takes
+  // the same treatment as the body: a header field carrying unencoded 8-bit
+  // content is signed as the octets it holds.
+  var toSign = _wireBytes(strToSign);
   if (algorithm === "rsa-sha256") {
     return nodeCrypto.createSign("RSA-SHA256")
-      .update(strToSign).sign(privateKey).toString("base64");
+      .update(toSign).sign(privateKey).toString("base64");
   }
   if (algorithm === "ed25519-sha256") {
     // Ed25519 in node:crypto signs the raw message (it hashes
     // internally as part of EdDSA). Per RFC 8463 the verifier still
     // sees `a=ed25519-sha256` because the body hash is sha256.
-    return nodeCrypto.sign(null, Buffer.from(strToSign, "utf8"), privateKey)
+    return nodeCrypto.sign(null, toSign, privateKey)
       .toString("base64");
   }
   throw new DkimError("dkim/bad-algorithm",
@@ -335,11 +384,15 @@ function create(opts) {
   }
 
   function sign(rfc822) {
-    if (typeof rfc822 !== "string" || rfc822.length === 0) {
+    var gaveBuffer = Buffer.isBuffer(rfc822);
+    if ((!gaveBuffer && typeof rfc822 !== "string") || rfc822.length === 0) {
       throw new DkimError("dkim/bad-input",
-        "sign() requires the rfc822 wire format as a non-empty string");
+        "sign() requires the rfc822 wire format as a non-empty Buffer or string");
     }
     var t0 = Date.now();
+    // A Buffer's own octets, or a string's UTF-8 encoding, one code unit per
+    // octet from here down.
+    rfc822 = _toWire(rfc822);
     var split = _splitHeadersBody(rfc822);
     var parsedHeaders = _parseHeaders(split.headers);
 
@@ -455,7 +508,17 @@ function create(opts) {
       durationMs: Date.now() - t0,
     });
 
-    return dkimHeaderLine + rfc822;
+    // Returned in the shape it arrived in. A caller who handed over octets is
+    // relaying what comes back, and handing them a string would put the
+    // corruption this signs around straight back into the message.
+    var out = dkimHeaderLine + rfc822;
+    // A string caller gets their own string back, not the latin1 wire form of
+    // it: the octets are that string's UTF-8 encoding, so decoding them as
+    // UTF-8 reproduces exactly what they passed, with the ASCII signature
+    // header in front. Returning the wire form instead handed back a mojibake
+    // string that no longer re-encoded to the bytes just signed, so the
+    // message failed its own verify.
+    return gaveBuffer ? _wireBytes(out) : _wireBytes(out).toString("utf8");
   }
 
   return {
@@ -808,7 +871,7 @@ function _verifySingleSignature(rfc822, parsedHeaders, sigHeader, keyTags, sigTa
   // accept legacy l= senders opts in via verify({ acceptBodyLengthLimit: true }).
   if (lcap !== undefined && !verifyOpts.acceptBodyLengthLimit) {
     var fullCanon = canonBody === "simple" ? _canonBodySimple(body) : _canonBodyRelaxed(body);
-    if (lcap < Buffer.byteLength(fullCanon, "utf8")) {
+    if (lcap < Buffer.byteLength(fullCanon, "latin1")) {
       return { result: "fail",
                errors: ["DKIM-Signature l= leaves appended body content unsigned " +
                         "(RFC 6376 §8.2 append-after-signature)"] };
@@ -924,7 +987,7 @@ function _verifySingleSignature(rfc822, parsedHeaders, sigHeader, keyTags, sigTa
   var verified;
   try {
     verified = nodeCrypto.verify(nodeAlgo,
-      Buffer.from(canonicalizedHeaders, "utf8"), keyObj, sigBuf);
+      _wireBytes(canonicalizedHeaders), keyObj, sigBuf);
   } catch (e) {
     return { result: "permerror",
              errors: ["DKIM verify threw: " + ((e && e.message) || String(e))] };
@@ -943,10 +1006,14 @@ var DKIM_CLOCK_SKEW_MS_MAX = C.TIME.hours(24);
 var DKIM_CLOCK_SKEW_MS_DEFAULT = C.TIME.minutes(5);
 
 async function verify(rfc822, opts) {
-  if (typeof rfc822 !== "string" || rfc822.length === 0) {
+  if ((!Buffer.isBuffer(rfc822) && typeof rfc822 !== "string") || rfc822.length === 0) {
     throw new DkimError("dkim/bad-input",
-      "verify(): rfc822 must be a non-empty string");
+      "verify(): rfc822 must be a non-empty Buffer or string");
   }
+  // The same octet boundary as sign(): a receiver holding wire bytes verifies
+  // against those bytes rather than against a UTF-8 decode of them, which is
+  // what a sender's signature actually covers.
+  rfc822 = _toWire(rfc822);
   opts = opts || {};
   validateOpts(opts, ["dnsLookup", "audit", "clockSkewMs", "maxSignatures",
                        "minRsaBits", "acceptBodyLengthLimit"], "mail.dkim.verify");
@@ -1392,6 +1459,8 @@ module.exports = {
   _canonBodyRelaxedForTest:   _canonBodyRelaxed,
   _canonBodySimpleForTest:    _canonBodySimple,
   _stripBTagValue:            _stripBTagValue,   // RFC 6376 §3.5 — tag-aware b= zeroing; shared by the ARC seal verifier (internal cross-module helper)
+  _toWire:                    _toWire,           // Buffer|string → the message one code unit per octet; shared with the ARC verifier so both modules answer "which bytes is this message" the same way (internal cross-module helper)
+  _wireBytes:                 _wireBytes,        // the octets of a string already in that wire form (internal cross-module helper)
   _stripBTagValueForTest:     _stripBTagValue,
   // The header-block parser that produces the { name, value } pairs fed to the
   // canonicalizers. Exposed so a golden-vector test can pin its byte-exact