@push.rocks/smartmta 13.1.0 → 14.0.0

package/native-notices/manifest.json

@@ -27,7 +27,6 @@
         "bzip2@0.6.1",
         "cc@1.3.0",
         "cfg-if@1.0.4",
-        "charset@0.1.5",
         "cipher@0.4.4",
         "clap@4.6.3",
         "clap_builder@4.6.2",
@@ -102,7 +101,6 @@
         "mail-auth@0.7.5",
         "mail-builder@0.4.4",
         "mail-parser@0.11.5",
-        "mailparse@0.16.1",
         "memchr@2.8.3",
         "miniz_oxide@0.8.9",
         "mio@1.2.2",
@@ -126,7 +124,6 @@
         "quick-xml@0.38.4",
         "quick_cache@0.6.24",
         "quote@1.0.47",
-        "quoted_printable@0.5.2",
         "rand@0.9.5",
         "rand_chacha@0.9.0",
         "rand_core@0.9.5",
@@ -232,7 +229,6 @@
         "bzip2@0.6.1",
         "cc@1.3.0",
         "cfg-if@1.0.4",
-        "charset@0.1.5",
         "cipher@0.4.4",
         "clap@4.6.3",
         "clap_builder@4.6.2",
@@ -307,7 +303,6 @@
         "mail-auth@0.7.5",
         "mail-builder@0.4.4",
         "mail-parser@0.11.5",
-        "mailparse@0.16.1",
         "memchr@2.8.3",
         "miniz_oxide@0.8.9",
         "mio@1.2.2",
@@ -331,7 +326,6 @@
         "quick-xml@0.38.4",
         "quick_cache@0.6.24",
         "quote@1.0.47",
-        "quoted_printable@0.5.2",
         "rand@0.9.5",
         "rand_chacha@0.9.0",
         "rand_core@0.9.5",
@@ -761,30 +755,6 @@
         }
       ]
     },
-    {
-      "name": "charset",
-      "version": "0.1.5",
-      "source": "registry+https://github.com/rust-lang/crates.io-index",
-      "license": "Apache-2.0 OR MIT",
-      "files": [
-        {
-          "path": "crates/charset-0.1.5/copyright",
-          "licenses": []
-        },
-        {
-          "path": "crates/charset-0.1.5/license-apache",
-          "licenses": [
-            "Apache-2.0"
-          ]
-        },
-        {
-          "path": "crates/charset-0.1.5/license-mit",
-          "licenses": [
-            "MIT"
-          ]
-        }
-      ]
-    },
     {
       "name": "cipher",
       "version": "0.4.4",
@@ -2223,20 +2193,6 @@
         }
       ]
     },
-    {
-      "name": "mailparse",
-      "version": "0.16.1",
-      "source": "registry+https://github.com/rust-lang/crates.io-index",
-      "license": "0BSD",
-      "files": [
-        {
-          "path": "crates/mailparse-0.16.1/license",
-          "licenses": [
-            "0BSD"
-          ]
-        }
-      ]
-    },
     {
       "name": "memchr",
       "version": "2.8.3",
@@ -2688,20 +2644,6 @@
         }
       ]
     },
-    {
-      "name": "quoted_printable",
-      "version": "0.5.2",
-      "source": "registry+https://github.com/rust-lang/crates.io-index",
-      "license": "0BSD",
-      "files": [
-        {
-          "path": "crates/quoted_printable-0.5.2/license",
-          "licenses": [
-            "0BSD"
-          ]
-        }
-      ]
-    },
     {
       "name": "rand",
       "version": "0.9.5",
@@ -4451,9 +4393,6 @@
     "crates/cc-1.3.0/license-mit": "378f5840b258e2779c39418f3f2d7b2ba96f1c7917dd6be0713f88305dbda397",
     "crates/cfg-if-1.0.4/license-apache": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2",
     "crates/cfg-if-1.0.4/license-mit": "378f5840b258e2779c39418f3f2d7b2ba96f1c7917dd6be0713f88305dbda397",
-    "crates/charset-0.1.5/copyright": "5918196cdc0b35bca82b9b21b775b4e344dafe95ca9b6b716906c36b4a1161da",
-    "crates/charset-0.1.5/license-apache": "cfc7749b96f63bd31c3c42b5c471bf756814053e847c10f3eb003417bc523d30",
-    "crates/charset-0.1.5/license-mit": "3fa4ca83dcc9237839b1bdeb2e6d16bdfb5ec0c5ce42b24694d8bbf0dcbef72c",
     "crates/cipher-0.4.4/license-apache": "a9040321c3712d8fd0b09cf52b17445de04a23a10165049ae187cd39e5c86be5",
     "crates/cipher-0.4.4/license-mit": "5c7bd92d1f096f12203dc1b601e3cb17484fa1b023e30b6b8edcc80e416237ec",
     "crates/clap-4.6.3/license-apache": "c6596eb7be8581c18be736c846fb9173b69eccf6ef94c5135893ec56bd92ba08",
@@ -4594,7 +4533,6 @@
     "crates/mail-builder-0.4.4/mit.txt": "23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3",
     "crates/mail-parser-0.11.5/apache-2.0.txt": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2",
     "crates/mail-parser-0.11.5/mit.txt": "23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3",
-    "crates/mailparse-0.16.1/license": "b3d6ddb122348e7ce92973bdafd8fb0b643beb3ecdfc32c15d73fb44c7f5ba62",
     "crates/memchr-2.8.3/copying": "01c266bced4a434da0051174d6bee16a4c82cf634e2679b6155d40d75012390f",
     "crates/memchr-2.8.3/license-mit": "0f96a83840e146e43c0ec96a22ec1f392e0680e6c1226e6f3ba87e0740af850f",
     "crates/memchr-2.8.3/unlicense": "7e12e5df4bae12cb21581ba157ced20e1986a0508dd10d0e8a4ab9a4cf94e85c",
@@ -4640,7 +4578,6 @@
     "crates/quick_cache-0.6.24/licence.md": "c845c85aa74d7eb1fb6848d2d96360a5edfe51dfbacbf96d7bb5193951e79b1a",
     "crates/quote-1.0.47/license-apache": "62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a",
     "crates/quote-1.0.47/license-mit": "23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3",
-    "crates/quoted_printable-0.5.2/license": "b3d6ddb122348e7ce92973bdafd8fb0b643beb3ecdfc32c15d73fb44c7f5ba62",
     "crates/rand-0.9.5/copyright": "90eb64f0279b0d9432accfa6023ff803bc4965212383697eee27a0f426d5f8d5",
     "crates/rand-0.9.5/license-apache": "35242e7a83f69875e6edeff02291e688c97caafe2f8902e4e19b49d3e78b4cab",
     "crates/rand-0.9.5/license-mit": "209fbbe0ad52d9235e37badf9cadfe4dbdc87203179c0899e738b39ade42177b",
@@ -4792,7 +4729,7 @@
     "native/tikv-jemalloc-sys-0.7.1+5.3.1-0-g81034ce1f1373e37dc865038e1bc8eeecf559ce8/jemalloc-5.3.1/jemalloc-copying": "94aa2caa98c25d942f58b956c71dba6a99ff98fc3a31cbc669fe2a4cd0268b53",
     "native/zstd-sys-2.0.16+zstd.1.5.7/zstd-1.5.7/zstd-copying": "f9c375a1be4a41f7b70301dd83c91cb89e41567478859b77eef375a52d782505",
     "native/zstd-sys-2.0.16+zstd.1.5.7/zstd-1.5.7/zstd-license": "7055266497633c9025b777c78eb7235af13922117480ed5c674677adc381c9d8",
-    "readme.md": "39afaa90fa9c385bc949af82714d064f2cd856cd0f4f294b2c5e74057b32f17f",
+    "readme.md": "c13dc71596cdeebe53a22c7c9c8446347ee56d0abf6bd3ec9bf2a2acb0444da3",
     "runtime/gcc/gpl-3.0.txt": "8ceb4b9ee5adedde47b31e975c1d90c73ad27b6b165a1dcd80c7c545eb65b903",
     "runtime/gcc/runtime-library-exception-3.1.txt": "9d6b43ce4d8de0c878bf16b54d8e7a10d9bd42b75178153e3af6a815bdc90f74",
     "runtime/libunwind-22.1.2/license.txt": "b5efebcaca80879234098e52d1725e6d9eb8fb96a19fce625d39184b705f7b6d",

package/native-notices/readme.md

@@ -12,12 +12,12 @@ package's own code is covered by its own license.
 
 | Target | Rust target | Linkage | Cargo packages |
 | --- | --- | --- | --- |
-| linux_amd64_musl | x86_64-unknown-linux-musl | static musl | 193 |
-| linux_arm64_musl | aarch64-unknown-linux-musl | static musl | 193 |
+| linux_amd64_musl | x86_64-unknown-linux-musl | static musl | 190 |
+| linux_arm64_musl | aarch64-unknown-linux-musl | static musl | 190 |
 
 ## Contents
 
-- `crates/`: the license and notice files of the 193 third-party Cargo packages compiled
+- `crates/`: the license and notice files of the 190 third-party Cargo packages compiled
   for these targets (normal and build dependencies, including procedural macros;
   development dependencies are excluded), copied verbatim. `manifest.json` records each
   package's license expression, the texts that cover it, and the targets it is built for.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@push.rocks/smartmta",
-  "version": "13.1.0",
+  "version": "14.0.0",
   "description": "A high-performance, enterprise-grade Mail Transfer Agent (MTA) built from scratch in TypeScript with Rust acceleration.",
   "keywords": [
     "mta",
@@ -31,16 +31,15 @@
     ".": "./dist_ts/index.js"
   },
   "devDependencies": {
-    "@git.zone/cli": "^10.0.0",
-    "@git.zone/tsbuild": "^6.0.2",
-    "@git.zone/tsrust": "^5.0.0",
-    "@git.zone/tstest": "^8.0.0",
+    "@git.zone/cli": "^11.0.1",
+    "@git.zone/rsrepo": "^1.1.1",
+    "@git.zone/tsrepo": "^1.1.1",
     "@types/node": "^26.6.5",
     "tsx": "^4.23.15"
   },
   "dependencies": {
     "@push.rocks/smartlog": "^5.0.1",
-    "@push.rocks/smartmail": "^3.1.2",
+    "@push.rocks/smartmail": "^3.2.0",
     "@push.rocks/smartpath": "^6.0.0",
     "@push.rocks/smartrust": "^2.6.0",
     "@tsclass/tsclass": "^9.5.0",
@@ -69,10 +68,10 @@
     "access": "public"
   },
   "scripts": {
-    "test": "tstest test/ --logfile --verbose --timeout 60",
+    "test": "tsrepo test test/ --logfile --verbose --timeout 60",
     "test:rust": "cd rust && cargo test",
-    "build": "tsbuild tsfolders && tsrust",
-    "build:release": "(tsbuild tsfolders) && (tsrust --configured-targets) && (tsrust verify)",
-    "check": "tsbuild check"
+    "build": "tsrepo build tsfolders && rsrepo",
+    "build:release": "(tsrepo build tsfolders) && (rsrepo --configured-targets) && (rsrepo verify)",
+    "check": "tsrepo check"
   }
 }

package/readme.md

@@ -355,7 +355,7 @@ Without this, an authenticated submission addressed to a domain this server host
 
 `hooks.onMessageData` runs after `DATA` and before the final SMTP response — but only for envelopes with **no** resolved `store` or `deliver` action; terminal local deliveries go through `hooks.onAcceptEnvelope` instead and never invoke `onMessageData`. Its `rawMessage` holds the same exact received bytes as in `hooks.onAcceptEnvelope`, final CRLF included. Return `{ accepted: true }` only after your application has accepted responsibility for the message, such as after durable persistence. Set `continueProcessing: false` when the consumer owns all downstream processing.
 
-`hooks.onAcceptEnvelope` is the terminal durable owner for any envelope containing a resolved `store` or `deliver` action. It receives the exact raw RFC822 bytes (`rawMessage`): the message as the client sent it, with only the DATA dot-stuffing removed and the CRLF that ends the last line kept (RFC 5321 §4.1.1.4: the first CRLF of `<CRLF>.<CRLF>` belongs to the message), so the bytes can be relayed unchanged through `enqueueRawEmail()`, `sendRawOutboundEmail()` or an unsigned raw relay. The listener refuses a message that contains a bare CR or bare LF (RFC 5321 §2.3.8) with `550 5.6.0` after reading it to its end-of-data marker, without calling a hook, so every handed-off message uses canonical CRLF line endings. It also receives the complete per-recipient route resolution (`resolvedRecipientRoutes`), and the Rust security verdicts (`securityResults`). It must durably persist the message before resolving — the SMTP `250` is only sent after the hook resolves. Throwing an `AcceptEnvelopeRejectionError` with a `5xx` code rejects the envelope permanently with that status; any other error or a `smtp.messageAcceptanceTimeoutMs` timeout refuses the envelope with a temporary `451`. Use `createAcceptedEnvelopeDispatchPlan()` inside the hook to snapshot the resolved plan for later replay-safe `dispatchAcceptedEnvelope()` calls. Both `AcceptEnvelopeRejectionError` and `IAcceptEnvelopeContext` are exported.
+`hooks.onAcceptEnvelope` is the terminal durable owner for any envelope containing a resolved `store` or `deliver` action. It receives the exact raw RFC822 bytes (`rawMessage`): the message as the client sent it, with only the DATA dot-stuffing removed and the CRLF that ends the last line kept (RFC 5321 §4.1.1.4: the first CRLF of `<CRLF>.<CRLF>` belongs to the message), so the bytes can be relayed unchanged through `enqueueRawEmail()`, `sendRawOutboundEmail()` or an unsigned raw relay. The listener refuses a message that contains a bare CR or bare LF (RFC 5321 §2.3.8) with `550 5.6.0` after reading it to its end-of-data marker, without calling a hook, so every handed-off message uses canonical CRLF line endings. It also receives the complete per-recipient route resolution (`resolvedRecipientRoutes`), and the Rust security verdicts (`securityResults`). It must durably persist the message before resolving — the SMTP `250` is only sent after the hook resolves. Throwing an `AcceptEnvelopeRejectionError` with a `5xx` code rejects the envelope permanently with that status; any other error or a `smtp.messageAcceptanceTimeoutMs` timeout refuses the envelope with a temporary `451`. Use `createAcceptedEnvelopeDispatchPlan()` inside the hook to snapshot the resolved plan for later replay-safe `dispatchAcceptedEnvelope()` calls on a started server: a replay that builds an `Email` parses the stored bytes with the Rust parser of the DATA path (`parseMessage`). Both `AcceptEnvelopeRejectionError` and `IAcceptEnvelopeContext` are exported.
 
 Use `smtp.securePort` when the implicit TLS listener uses a remapped backend port instead of public `465`; the configured secure port must also be present in `ports`, otherwise `start()` throws.
 
@@ -646,6 +646,8 @@ Embedders can check `smartMtaCapabilities.selectorCorrectDkimSigning`, `callerMa
 
 All verification is powered by the Rust binary. For inbound mail, `UnifiedEmailServer` runs the full security pipeline **automatically** — DKIM, SPF, DMARC, content scanning, and IP reputation in a single Rust pass. Results are attached as headers (`Received-SPF`, `X-DKIM-Result`, `X-DMARC-Result`).
 
+A From that names more than one domain (one field with several domains, or several From fields) cannot be evaluated for DMARC (RFC 9989 §5.3.1); such a message gets `X-DMARC-Result: quarantine` and is marked as potential spam (§11.5). When no DMARC policy was evaluated (no From domain, no DMARC record, or a DNS error), the action is `none`, never `pass`.
+
 For direct TypeScript usage, `SpfVerifier` is exported as a lightweight SPF record parser. DKIM signing/key management is handled through `DKIMCreator` and the Rust bridge; SPF, DKIM, and DMARC verification results are produced by the automatic inbound security pipeline.
 
 ```typescript
@@ -901,18 +903,23 @@ The Rust `mailer-bin` process is supervised by `RustSecurityBridge`:
 
 Tune with `RustSecurityBridge.configure({ maxRestartAttempts, healthCheckIntervalMs, healthCheckTimeoutMs, restartBackoffBaseMs, restartBackoffMaxMs })`.
 
+### 📏 IPC Line Cap
+
+Every JSON line between TypeScript and `mailer-bin` is limited by one cap, `4 × maxMessageSize` bytes (41,943,040 at the 10 MiB default). `UnifiedEmailServer` sets it through `RustSecurityBridge.setMaxMessageSize(maxMessageSize)` before the bridge starts; the bridge passes the same value to smartrust (`maxPayloadSize`) and to `mailer-bin --max-line-bytes`, so both ends of the transport agree, and a changed `maxMessageSize` (also through `updateOptions()`, which restarts the listener) restarts the process with the new cap. Rust never writes a line over the cap: a received message whose `emailReceived` event would exceed it is refused at DATA with `552 5.3.4 Parsed message size exceeds maximum of <cap> bytes`. The outbound requests `sendEmail`, `sendRawEmail`, `signDkim` and `verifyDkim` are limited by the same cap: a request line above it is refused by smartrust before anything is written (`Outbound message exceeds maxPayloadSize`), which is about 3 × `maxMessageSize` of message.
+
 ## 🦀 Rust Acceleration Layer
 
-Performance-critical operations are implemented in Rust and communicate with the TypeScript runtime via `@push.rocks/smartrust` (JSON-over-stdin/stdout IPC). The Rust workspace lives at `rust/` with four crates:
+Performance-critical operations are implemented in Rust and communicate with the TypeScript runtime via `@push.rocks/smartrust` (JSON-over-stdin/stdout IPC). The Rust workspace lives at `rust/` with five crates:
 
 | Crate | Status | Purpose |
 |---|---|---|
+| `mailer-mime` | Complete | The inbound RFC 5322 / MIME parser: one parse per message at DATA, for the content scan, DMARC alignment and the `emailReceived` event's `parsed` result, from which TypeScript builds the `Email` (stored bytes through `parseMessage`); a clean-room implementation of `docs/cleanroom/mailer-mime.md` |
 | `mailer-core` | Complete | Email types, validation, MIME building, bounce detection |
 | `mailer-security` | Complete | DKIM sign/verify, SPF, DMARC, IP reputation/DNSBL, content scanning |
 | `mailer-smtp` | Complete | Full SMTP protocol engine — TCP/TLS server + client, STARTTLS, AUTH, pipelining, connection pooling, in-process security pipeline |
 | `mailer-bin` | Complete | CLI + smartrust IPC bridge — wires everything together |
 
-`RustSecurityBridge` finds `mailer-bin` in the package's `dist_rust/` (or a local `rust/target` build). Inside a Node.js single executable application (built with `@git.zone/tssea`), smartrust runs the sidecar the executable embeds under the name `mailer-bin` instead and searches nothing else; a sidecar the executable cannot provide makes `start()` resolve `false`, and background restarts look it up again.
+`RustSecurityBridge` finds `mailer-bin` in the package's `dist_rust/` (or a local `rust/target` build). Inside a Node.js single executable application (built with `tsrepo sea` from `@git.zone/tsrepo`), smartrust runs the sidecar the executable embeds under the name `mailer-bin` instead and searches nothing else; a sidecar the executable cannot provide makes `start()` resolve `false`, and background restarts look it up again.
 
 The shipped Linux binaries are static musl executables. The SMTP client connects with `TcpStream::connect("host:port")` (`rust/crates/mailer-smtp/src/client/connection.rs`), so a host name it connects to (an MX or smarthost name, or a `connect_host`) is looked up through the C library, which is musl: only `/etc/hosts` and `/etc/resolv.conf` are consulted, and no NSS modules (`nsswitch.conf`, systemd-resolved's NSS module, LDAP and the like) take part. The SPF, DKIM, DMARC and DNSBL lookups use the hickory resolver instead.
 
@@ -929,6 +936,7 @@ The shipped Linux binaries are static musl executables. The SMTP client connects
 | Content scanning (text patterns) | 🦀 Rust | Regex engine performance |
 | Bounce detection (pattern matching) | 🦀 Rust | Regex engine performance |
 | Email validation & MIME building | 🦀 Rust | Parsing performance |
+| Inbound MIME parsing (`mailer-mime`, at DATA and through `parseMessage`) | 🦀 Rust | One linear-time parse with explicit limits for hostile input |
 | Email routing & orchestration | 🟦 TypeScript | Business logic, flexibility |
 | Delivery queue & retry | 🟦 TypeScript | State management, persistence |
 | Template rendering | 🟦 TypeScript | String interpolation |
@@ -968,10 +976,10 @@ pnpm run build
 pnpm test
 
 # Run specific test files
-tstest test/test.e2e.server-lifecycle.node.ts --verbose --timeout 60
-tstest test/test.e2e.inbound-smtp.node.ts --verbose --timeout 60
-tstest test/test.e2e.routing-actions.node.ts --verbose --timeout 60
-tstest test/test.e2e.outbound-delivery.node.ts --verbose --timeout 60
+pnpm exec tsrepo test test/test.e2e.server-lifecycle.node.ts --verbose --timeout 60
+pnpm exec tsrepo test test/test.e2e.inbound-smtp.node.ts --verbose --timeout 60
+pnpm exec tsrepo test test/test.e2e.routing-actions.node.ts --verbose --timeout 60
+pnpm exec tsrepo test test/test.e2e.outbound-delivery.node.ts --verbose --timeout 60
 ```
 
 **E2E tests** exercise the full pipeline — starting `UnifiedEmailServer`, connecting via raw TCP sockets, sending SMTP transactions, verifying routing actions, and testing outbound delivery through a mock SMTP receiver.
@@ -1009,15 +1017,15 @@ third-party works too.
 
 Every binary carries its notices beside it in `dist_rust/`:
 `mailer-bin_<target>.third-party-notices.json` and `.txt`, in the format that
-[`@git.zone/tssea`](https://code.foss.global/git.zone/tssea) merges into a
+[`@git.zone/tsrepo`](https://code.foss.global/git.zone/tsrepo)'s `sea` build merges into a
 single executable application. Keep that pair with any separately distributed
-copy of a `mailer-bin` executable. `@git.zone/tsrust` projects them from the
+copy of a `mailer-bin` executable. [`@git.zone/rsrepo`](https://code.foss.global/git.zone/rsrepo) projects them from the
 committed `native-notices/` directory, which ships in the npm package as well.
-`tsrust notices` generates that directory from `rust/Cargo.lock`, the toolchain
+`rsrepo notices` generates that directory from `rust/Cargo.lock`, the toolchain
 pinned in `rust-toolchain.toml` and the `notices` overrides in `.smartconfig.json`
 (reviewed project texts live in `legal/`); every build checks it and
-`tsrust verify` checks the release binaries' notices. Regenerate it with
-`pnpm exec tsrust notices` after any change to the Cargo graph, the toolchain or
+`rsrepo verify` checks the release binaries' notices. Regenerate it with
+`pnpm exec rsrepo notices` after any change to the Cargo graph, the toolchain or
 the targets, and review the diff.
 
 ## License and Legal Information

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@push.rocks/smartmta',
-  version: '13.1.0',
+  version: '14.0.0',
   description: 'A high-performance, enterprise-grade Mail Transfer Agent (MTA) built from scratch in TypeScript with Rust acceleration.'
 }

package/ts/mail/routing/classes.unified.email.server.ts

@@ -37,7 +37,7 @@ import { Email } from '../core/classes.email.js';
 import { DomainRegistry } from './classes.domain.registry.js';
 import { DnsManager } from './classes.dns.manager.js';
 import { BounceManager, BounceType, BounceCategory } from '../core/classes.bouncemanager.js';
-import type { ISmtpSendResult, IOutboundEmail } from '../../security/classes.rustsecuritybridge.js';
+import type { ISmtpSendResult, IOutboundEmail, IBridgeParsedMessage } from '../../security/classes.rustsecuritybridge.js';
 import { MultiModeDeliverySystem, type IDeliveryStats, type IMultiModeDeliveryOptions } from '../delivery/classes.delivery.system.js';
 import {
   ACCEPTED_ENVELOPE_IDEMPOTENCY_RETENTION_MS,
@@ -1383,6 +1383,9 @@ export class UnifiedEmailServer extends EventEmitter {
     try {
       await this.startDeliveryPipeline();
       this.startAcceptedEnvelopeDispatchCleanup();
+      // The IPC line cap derives from the SMTP size limit and is fixed per mailer-bin process,
+      // so it is set before the bridge starts (and before any parseMessage call).
+      await this.rustBridge.setMaxMessageSize(this.getMaxMessageSize());
       await this.startRustBridge();
       await this.initializeDkimAndDns();
       await this.startDeliveryProcessing();
@@ -1419,6 +1422,11 @@ export class UnifiedEmailServer extends EventEmitter {
     logger.log('info', 'Email delivery system started');
   }
 
+  /** The SMTP size limit, which the bridge's IPC line cap derives from. */
+  private getMaxMessageSize(): number {
+    return this.options.maxMessageSize || 10 * 1024 * 1024;
+  }
+
   private async startRustBridge(): Promise<void> {
     const bridgeOk = await this.rustBridge.start();
     if (!bridgeOk) {
@@ -1618,7 +1626,7 @@ export class UnifiedEmailServer extends EventEmitter {
       tlsCertPem,
       tlsKeyPem,
       ...(tlsTerminatedPorts.length > 0 ? { tlsTerminatedPorts } : {}),
-      maxMessageSize: this.options.maxMessageSize || 10 * 1024 * 1024,
+      maxMessageSize: this.getMaxMessageSize(),
       maxConnections: this.options.maxConnections || this.options.maxClients || 100,
       maxRecipients: 100,
       connectionTimeoutSecs: this.options.connectionTimeout ? Math.floor(this.options.connectionTimeout / 1000) : 30,
@@ -1727,6 +1735,9 @@ export class UnifiedEmailServer extends EventEmitter {
         this.smtpListenerActive = false;
         await this.rustBridge.stopSmtpServer();
         if (this.smtpListenerShutdown) return;
+        // With the listener stopped, a changed maximum message size restarts the bridge with
+        // the new line cap before the listener comes back with the new size.
+        await this.rustBridge.setMaxMessageSize(this.getMaxMessageSize());
         await this.startSmtpServer();
       })
       .catch(async (error) => {
@@ -2479,36 +2490,15 @@ export class UnifiedEmailServer extends EventEmitter {
 
   /**
    * The mailbox addresses of every From header field, one list per field in
-   * message order. Groups are flattened into their member mailboxes, and a
-   * repeated From field is kept rather than collapsed to one occurrence,
-   * because scope enforcement and Email.from must see every mailbox a
-   * recipient's client might display. A field that yields no mailbox, such
-   * as an empty group or an encoded word in place of an address, gives an
-   * empty list.
-   */
-  private parseFromHeaderFields(
-    headers: ReadonlyArray<{ key: string; value: string }>,
-  ): string[][] {
-    return headers
-      .filter((header) => header.key === 'from')
-      .map((header) =>
-        plugins.smartmail.parseAddressList(header.value).map((mailbox) => mailbox.email),
-      );
-  }
-
-  /**
-   * The From header fields of the header section of a raw message, see
-   * parseFromHeaderFields. Parsing stops at the first CRLFCRLF header
-   * boundary when present (the Rust receiver normalizes line endings to
-   * CRLF); a bodyless message without one is parsed whole.
+   * message order, as the Rust parser read them (`parsed.fromFields`). Groups
+   * are flattened into their member mailboxes, and a repeated From field is
+   * kept rather than collapsed to one occurrence, because scope enforcement and
+   * Email.from must see every mailbox a recipient's client might display. A
+   * field that yields no mailbox, such as an empty group or an encoded word in
+   * place of an address, gives an empty list.
    */
-  private async parseHeaderFromFields(rawMessage: Buffer): Promise<string[][]> {
-    const headerBoundary = rawMessage.indexOf('\r\n\r\n');
-    const headerSection = headerBoundary === -1
-      ? rawMessage
-      : rawMessage.subarray(0, headerBoundary + 4);
-    const parsed = await plugins.smartmail.parseMailMessage(headerSection);
-    return this.parseFromHeaderFields(parsed.headers);
+  private fromFieldAddresses(parsed: IBridgeParsedMessage): string[][] {
+    return parsed.fromFields.map((field) => field.map((mailbox) => mailbox.email));
   }
 
   /**
@@ -2520,7 +2510,7 @@ export class UnifiedEmailServer extends EventEmitter {
    */
   private async checkAuthenticatedHeaderFromScope(
     email: Email,
-    rawMessage: Buffer,
+    fromFields: string[][],
     session: IExtendedSmtpSession,
   ): Promise<ISmtpDecision | null> {
     const username = session.user?.username;
@@ -2539,13 +2529,8 @@ export class UnifiedEmailServer extends EventEmitter {
       smtpCode: 553,
       smtpMessage: `5.7.1 Header From address not permitted for authenticated user ${username}`,
     };
-    let fromFields: string[][];
-    try {
-      fromFields = await this.parseHeaderFromFields(rawMessage);
-    } catch {
-      // A header section that cannot be read cannot be shown to be in scope
-      return notPermitted;
-    }
+    // A message the parser rejects never reaches this check: Rust refuses it at
+    // DATA, as it refuses a header section that ends before its empty line.
     let fromMailboxes: string[];
     if (fromFields.length === 0) {
       // A message without a From field is accepted deliberately: Email.from
@@ -3348,14 +3333,18 @@ export class UnifiedEmailServer extends EventEmitter {
       }
 
 
-      const email = await this.createEmailFromBuffer(rawMessageBuffer, session);
+      // The one parse Rust made at DATA; this path never parses again.
+      if (!data.parsed) {
+        throw new Error('emailReceived event without its parsed message');
+      }
+      const email = this.createEmailFromParsed(data.parsed, session);
 
       // Header-From alignment for scoped authenticated accounts must be
       // enforced before any durable acceptance or routing: the RCPT phase
       // only ever saw the envelope MAIL FROM.
       const headerFromViolation = await this.checkAuthenticatedHeaderFromScope(
         email,
-        rawMessageBuffer,
+        this.fromFieldAddresses(data.parsed),
         session,
       );
       if (headerFromViolation) {
@@ -3523,45 +3512,58 @@ export class UnifiedEmailServer extends EventEmitter {
     }
   }
 
+  /**
+   * Builds the Email of stored message bytes (the replay paths
+   * dispatchAcceptedEnvelope and processEmailByMode(Buffer)) with the parser
+   * and setting of the DATA path, through mailer-bin's parseMessage, so a
+   * replay rebuilds the Email the live path built for the same bytes.
+   */
   private async createEmailFromBuffer(emailData: Buffer, session: IExtendedSmtpSession): Promise<Email> {
+    let parsed: IBridgeParsedMessage;
     try {
-      // Forwarded messages stay attachments of their bytes, so a relay hands them on unchanged
-      const parsed = await plugins.smartmail.parseMailMessage(emailData, { rfc822Attachments: true });
-      const headerFromMailboxes = this.parseFromHeaderFields(parsed.headers).flat();
-      const envelopeRecipients = session.envelope.rcptTo.map(recipient => recipient.address);
-      const parsedHeaders = new Map<string, string>();
-      for (const header of parsed.headers) {
-        if (this.isStandardParsedHeader(header.key)) {
-          continue;
-        }
-        // Raw values as written; a repeated field joins its values with ', '
-        const previous = parsedHeaders.get(header.key);
-        parsedHeaders.set(header.key, previous === undefined ? header.value : `${previous}, ${header.value}`);
-      }
-      return new Email({
-        // The first mailbox of the From fields in message order, groups flattened
-        from: headerFromMailboxes[0] || session.envelope.mailFrom.address,
-        to: envelopeRecipients.length > 0
-          ? envelopeRecipients
-          : parsed.to.map(recipient => recipient.email),
-        cc: parsed.cc.map(recipient => recipient.email),
-        bcc: [],
-        subject: parsed.subject || '',
-        // A message that carries only HTML is read and scanned through its text
-        text: parsed.text ?? (parsed.html ? plugins.smartmail.htmlToText(parsed.html) : ''),
-        html: parsed.html || undefined,
-        headers: Object.fromEntries(parsedHeaders),
-        attachments: parsed.attachments.map(attachment => ({
-          filename: attachment.filename || '',
-          content: Buffer.from(attachment.content),
-          contentType: attachment.contentType,
-          ...(attachment.contentId ? { contentId: attachment.contentId } : {}),
-        })),
-      });
+      parsed = await this.rustBridge.parseMessage(emailData);
     } catch (error) {
       logger.log('error', `Error parsing email data: ${(error as Error).message}`);
       throw new Error(`Error parsing email data: ${(error as Error).message}`);
     }
+    return this.createEmailFromParsed(parsed, session);
+  }
+
+  /** The Email of a message the Rust parser read (docs/cleanroom/mailer-mime.md section 2.2). */
+  private createEmailFromParsed(parsed: IBridgeParsedMessage, session: IExtendedSmtpSession): Email {
+    const headerFromMailboxes = this.fromFieldAddresses(parsed).flat();
+    const envelopeRecipients = session.envelope.rcptTo.map(recipient => recipient.address);
+    const parsedHeaders = new Map<string, string>();
+    for (const header of parsed.headers) {
+      if (this.isStandardParsedHeader(header.key)) {
+        continue;
+      }
+      // Raw values as written; a repeated field joins its values with ', '
+      const previous = parsedHeaders.get(header.key);
+      parsedHeaders.set(header.key, previous === undefined ? header.value : `${previous}, ${header.value}`);
+    }
+    // Each body travels once, as body groups; an HTML-only group is read through
+    // smartmail's HTML-to-text, the only HTML converter.
+    const bodies = plugins.smartmail.joinMailBodyGroups(parsed.bodyGroups);
+    return new Email({
+      // The first mailbox of the From fields in message order, groups flattened
+      from: headerFromMailboxes[0] || session.envelope.mailFrom.address,
+      to: envelopeRecipients.length > 0
+        ? envelopeRecipients
+        : parsed.to.map(recipient => recipient.email),
+      cc: parsed.cc.map(recipient => recipient.email),
+      bcc: [],
+      subject: parsed.subject || '',
+      text: bodies.text,
+      html: bodies.html,
+      headers: Object.fromEntries(parsedHeaders),
+      attachments: parsed.attachments.map(attachment => ({
+        filename: attachment.filename || '',
+        content: Buffer.from(attachment.content, 'base64'),
+        contentType: attachment.contentType,
+        ...(attachment.contentId ? { contentId: attachment.contentId } : {}),
+      })),
+    });
   }
 
   private isStandardParsedHeader(headerName: string): boolean {
@@ -4141,6 +4143,9 @@ export class UnifiedEmailServer extends EventEmitter {
     const tlsTerminatedPortsChanged = options.smtp !== undefined
       && JSON.stringify(options.smtp.tlsTerminatedPorts ?? [])
         !== JSON.stringify(this.options.smtp?.tlsTerminatedPorts ?? []);
+    // The size limit is listener configuration and fixes the bridge's IPC line cap.
+    const maxMessageSizeChanged = options.maxMessageSize !== undefined
+      && options.maxMessageSize !== this.options.maxMessageSize;
 
     if (portsChanged) {
       this.stop().then(() => {
@@ -4188,7 +4193,9 @@ export class UnifiedEmailServer extends EventEmitter {
           ? 'SMTP TLS material replaced by configuration update'
           : tlsTerminatedPortsChanged
             ? 'SMTP upstream-terminated port list changed by configuration update'
-            : undefined;
+            : maxMessageSizeChanged
+              ? 'SMTP maximum message size changed by configuration update'
+              : undefined;
       if (listenerRestartReason && this.smtpListenerActive && !this.smtpListenerShutdown) {
         this.scheduleSmtpListenerRestart(listenerRestartReason);
       }