@serve.zone/dcrouter 32.8.0 → 33.0.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@serve.zone/dcrouter",
   "private": false,
-  "version": "32.8.0",
+  "version": "33.0.0",
   "description": "A multifaceted routing service handling mail and SMS delivery functions.",
   "type": "module",
   "bin": {
@@ -16,15 +16,15 @@
   "license": "MIT",
   "devDependencies": {
     "@git.zone/tsbuild": "^6.0.2",
-    "@git.zone/tsbundle": "^3.2.0",
+    "@git.zone/tsbundle": "^3.7.0",
     "@git.zone/tsdeno": "^1.15.0",
-    "@git.zone/tsdocker": "^3.11.0",
+    "@git.zone/tsdocker": "^3.12.0",
     "@git.zone/tsrun": "^3.0.3",
-    "@git.zone/tstest": "^7.2.0",
-    "@git.zone/tswatch": "^7.0.0",
+    "@git.zone/tstest": "^8.0.0",
+    "@git.zone/tswatch": "^7.1.1",
     "@push.rocks/smartdb-v2": "npm:@push.rocks/smartdb@2.14.6",
     "@push.rocks/smartdb-v5.2": "npm:@push.rocks/smartdb@5.2.2",
-    "@types/node": "26.6.3",
+    "@types/node": "26.6.5",
     "@types/web-push": "3.6.4"
   },
   "dependencies": {
@@ -52,7 +52,7 @@
     "@push.rocks/smartmcp": "^0.3.0",
     "@push.rocks/smartmetrics": "^3.0.3",
     "@push.rocks/smartmigration": "2.0.1",
-    "@push.rocks/smartmta": "^9.5.0",
+    "@push.rocks/smartmta": "^13.0.1",
     "@push.rocks/smartnetwork": "^4.10.1",
     "@push.rocks/smartpath": "^6.0.0",
     "@push.rocks/smartpromise": "^4.2.5",
@@ -123,7 +123,7 @@
     "third-party-notices.md"
   ],
   "engines": {
-    "node": ">=22"
+    "node": ">=22.12.0"
   },
   "scripts": {
     "test": "(tstest test/ --verbose --logfile --timeout 60)",

package/readme.md

@@ -744,7 +744,7 @@ Use `@serve.zone/dcrouter-apiclient/interfaces` (or `@serve.zone/dcrouter/interf
 
 dcrouter 32.0.0 builds against `@serve.zone/interfaces` 32.0.0: the installed interfaces release is the contract version, there is no version field on the wire and no per-shape version suffix. dcrouter serves no session that carries the 32 protocol handshake and opens none — its gateway-client, mail, Web Push and CoreMail gateway contracts are unchanged in 32.0.0 and carry no protocol offer — so no caller has to send one.
 
-Gateway-client mail contracts let Cloudly or Onebox claim exact app addresses, attach inbound `smtpForward` targets, enable managed outbound SMTP credentials, rotate those credentials, enqueue service mail, and query delivery status through TypedRequest. `getGatewayClientMailDomainCount` requires an authenticated, enabled gateway-client credential with the `gateway-clients:read` scope and `readMail` capability. It returns only that credential owner's distinct domain count; it does not accept a caller-selected owner and does not load bindings, DNS details, or recent mail. Managed SMTP users can only send as their exact claimed address; mismatched envelope or header `From` values are rejected before relay. Typed submissions may set `replyTo` to one bare printable-ASCII mailbox address. Dcrouter validates it authoritatively and renders one `Reply-To` header; custom headers remain unable to override `Reply-To` or any other protected MIME field. Delivery status queries return the dcrouter spool item state, including deferred SmartMTA errors and next retry timestamps when outbound delivery is temporarily delayed.
+Gateway-client mail contracts let Cloudly or Onebox claim exact app addresses, attach inbound `smtpForward` targets, enable managed outbound SMTP credentials, rotate those credentials, enqueue service mail, and query delivery status through TypedRequest. `getGatewayClientMailDomainCount` requires an authenticated, enabled gateway-client credential with the `gateway-clients:read` scope and `readMail` capability. It returns only that credential owner's distinct domain count; it does not accept a caller-selected owner and does not load bindings, DNS details, or recent mail. Managed SMTP credentials can only send as their exact claimed address: each one is a SmartMTA SMTP account whose sender scope is that address, so SmartMTA refuses with 553 a MAIL FROM outside it and any header `From` mailbox outside it (every mailbox of every From field, group members included). Their outbound relay route matches the credential itself (`authenticatedUser`), so no other login relays through it or signs with its DKIM key. Typed submissions may set `replyTo` to one bare printable-ASCII mailbox address. Dcrouter validates it authoritatively and renders one `Reply-To` header; custom headers remain unable to override `Reply-To` or any other protected MIME field. Delivery status queries return the dcrouter spool item state, including deferred SmartMTA errors and next retry timestamps when outbound delivery is temporarily delayed.
 
 ### Email Operations Views
 
@@ -812,6 +812,8 @@ Each account carries a sender scope ("send AS who": exact addresses plus whole d
 
 Accounts without a sender scope authenticate unrestricted but generate no relay routes — their relay permission remains whatever operator-configured routes grant. Sender domains that are not managed email domains are allowed with a warning (no managed SPF/DKIM/DMARC alignment); enabling DKIM signing is stricter and requires every sender-scope domain to be a managed, outbound-ready email domain with active DKIM material — this fails at configuration time, never at delivery time.
 
+Sender authorization is SmartMTA's scope checker alone. dcrouter never parses a `From` field or the envelope sender itself to decide who may send: it expresses every credential's sender scope as an `auth.accounts` scope and binds generated relay routes to `authenticatedUser`. A plain `auth.users` entry or an account without a sender scope is unrestricted in what it may claim, so it must never be given a credential that belongs to a tenant.
+
 Submission accounts can only authenticate over an encrypted transport (see below). A message an authenticated account sends to a domain dcrouter hosts is delivered into that local mailbox rather than relayed — authentication grants permission to relay, it does not make a locally addressed message outbound.
 
 On upgrade, a migration converts legacy plaintext `emailConfig.auth.users` entries into hashed account documents and strips the plaintext from the persisted settings. Migrated accounts are unrestricted and generate no relay routes, so authentication and relay behave byte-identically to the legacy users — relay authorization is provably not widened (or narrowed) by the migration. Scoping a migrated account is an explicit post-migration operator action through the SMTP accounts UI/API. The legacy routes themselves stay in place until an operator retires them explicitly with `removeLegacyEmailRoute { routeName }`, which edits the persisted settings through the standard restart path, refuses unknown names, and refuses generated managed route names.

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@serve.zone/dcrouter',
-  version: '32.8.0',
+  version: '33.0.0',
   description: 'A multifaceted routing service handling mail and SMS delivery functions.'
 }

package/ts/classes.dcrouter.ts

@@ -2135,9 +2135,12 @@ export class DcRouter {
             : { accepted: true };
         },
         onMessageData: async (context) => {
-          const managedSenderDecision = await this.workAppMailManager.enforceManagedSmtpSender(context);
-          if (managedSenderDecision) {
-            return managedSenderDecision;
+          // Sender authorization already happened in SmartMTA's scope
+          // checker; this only refuses a WorkApp credential that stopped
+          // being active or outbound-ready after it authenticated.
+          const managedCredentialDecision = await this.workAppMailManager.enforceManagedSmtpCredentialReady(context);
+          if (managedCredentialDecision) {
+            return managedCredentialDecision;
           }
           const configuredDecision = configuredMessageDataHook
             ? await configuredMessageDataHook(context)

package/ts/email/classes.accepted-email-spool.ts

@@ -20,6 +20,7 @@ import type {
 } from '@push.rocks/smartmta';
 import type { DcRouter } from '../classes.dcrouter.js';
 import { evaluateInboundAcceptance } from './helpers.inbound-security.js';
+import { getRawMessageHeaderSection, setRawMessageHeaderField } from './helpers.raw-message-header.js';
 export {
   evaluateInboundAcceptance,
   type IInboundAcceptanceEvaluation,
@@ -258,7 +259,7 @@ export class AcceptedEmailSpool {
     cachedEmail.cc = Array.isArray(email.cc) ? email.cc : [];
     cachedEmail.bcc = Array.isArray(email.bcc) ? email.bcc : [];
     cachedEmail.subject = email.subject || '';
-    const persistedRawMessage = this.setDcRouterCacheIdHeader(rawMessage.toString('utf8'), cachedEmail.id);
+    const persistedRawMessage = this.setDcRouterCacheIdHeader(rawMessage, cachedEmail.id);
     await this.persistRawMessage(cachedEmail, persistedRawMessage);
     cachedEmail.status = 'pending';
     cachedEmail.nextAttempt = new Date();
@@ -317,16 +318,19 @@ export class AcceptedEmailSpool {
       throw new Error('DcRouterDb is not available for email acceptance');
     }
 
+    // A string message is composed by dcrouter itself and encoded once; a
+    // Buffer is kept as the bytes it is.
     const rawMessage = plugins.buffer.Buffer.isBuffer(optionsArg.rawMessage)
-      ? optionsArg.rawMessage.toString('utf8')
-      : optionsArg.rawMessage;
+      ? optionsArg.rawMessage
+      : plugins.buffer.Buffer.from(optionsArg.rawMessage, 'utf8');
+    const headerSection = getRawMessageHeaderSection(rawMessage).toString('utf8');
     const cachedEmail = CachedEmail.createNew();
-    cachedEmail.messageId = optionsArg.messageId || this.extractHeader(rawMessage, 'message-id') || cachedEmail.id;
+    cachedEmail.messageId = optionsArg.messageId || this.extractHeader(headerSection, 'message-id') || cachedEmail.id;
     cachedEmail.from = optionsArg.envelope.mailFrom;
     cachedEmail.to = optionsArg.envelope.rcptTo;
     cachedEmail.cc = [];
     cachedEmail.bcc = [];
-    cachedEmail.subject = optionsArg.subject || this.extractHeader(rawMessage, 'subject') || '';
+    cachedEmail.subject = optionsArg.subject || this.extractHeader(headerSection, 'subject') || '';
     cachedEmail.submissionCredentialId = optionsArg.submissionCredentialId;
     cachedEmail.submissionIdempotencyKey = optionsArg.submissionIdempotencyKey;
     cachedEmail.submissionDigest = optionsArg.submissionDigest;
@@ -435,10 +439,7 @@ export class AcceptedEmailSpool {
     }
     const startedAtMs = Date.now();
 
-    const persistedRawMessage = this.setDcRouterCacheIdHeader(
-      context.rawMessage.toString('utf8'),
-      cachedEmail.id,
-    );
+    const persistedRawMessage = this.setDcRouterCacheIdHeader(context.rawMessage, cachedEmail.id);
     await this.persistRawMessage(cachedEmail, persistedRawMessage);
     cachedEmail.acceptedAt = startedAtMs;
 
@@ -585,7 +586,7 @@ export class AcceptedEmailSpool {
    */
   private async dispatchEnvelopeRecipients(
     cachedEmailArg: CachedEmail,
-    rawMessageArg: string,
+    rawMessageArg: plugins.buffer.Buffer,
     emailServerArg: UnifiedEmailServer,
   ): Promise<void> {
     const routeData = this.parseCachedEmailRouteData(cachedEmailArg);
@@ -601,7 +602,7 @@ export class AcceptedEmailSpool {
     }>;
     try {
       const dispatchResult = await emailServerArg.dispatchAcceptedEnvelope(
-        plugins.buffer.Buffer.from(rawMessageArg, 'utf8'),
+        rawMessageArg,
         envelopeDispatch.plan,
         envelopeDispatch.metadata,
       );
@@ -709,11 +710,7 @@ export class AcceptedEmailSpool {
 
     if (envelopeDispatch?.pendingRecipients?.length && !envelopeDispatch.abandonedAt) {
       const rawMessage = await this.readRawMessage(cachedEmailArg);
-      await this.dispatchEnvelopeRecipients(
-        cachedEmailArg,
-        rawMessage.toString('utf8'),
-        emailServerArg,
-      );
+      await this.dispatchEnvelopeRecipients(cachedEmailArg, rawMessage, emailServerArg);
       return true;
     }
 
@@ -1245,9 +1242,9 @@ export class AcceptedEmailSpool {
     }
   }
 
-  private extractHeader(rawMessageArg: string, headerNameArg: string): string | undefined {
+  private extractHeader(headerSectionArg: string, headerNameArg: string): string | undefined {
     const lowerName = `${headerNameArg.toLowerCase()}:`;
-    for (const line of rawMessageArg.split(/\r?\n/)) {
+    for (const line of headerSectionArg.split(/\r?\n/)) {
       if (!line) return undefined;
       if (line.toLowerCase().startsWith(lowerName)) {
         return line.slice(lowerName.length).trim();
@@ -1336,10 +1333,16 @@ export class AcceptedEmailSpool {
     }
   }
 
-  private setDcRouterCacheIdHeader(rawContent: string, cachedEmailId: string): string {
-    const headerRegex = new RegExp(`^${DCROUTER_CACHE_ID_HEADER}:.*(?:\r?\n[\t ].*)*\r?\n?`, 'gim');
-    const sanitizedContent = rawContent.replace(headerRegex, '');
-    return `${DCROUTER_CACHE_ID_HEADER}: ${cachedEmailId}\r\n${sanitizedContent}`;
+  /**
+   * The stored copy: the received bytes with exactly one cache-id field at the
+   * top of the header section. A cache-id field the client sent is replaced;
+   * the same text in the body stays.
+   */
+  private setDcRouterCacheIdHeader(
+    rawMessageArg: plugins.buffer.Buffer,
+    cachedEmailIdArg: string,
+  ): plugins.buffer.Buffer {
+    return setRawMessageHeaderField(rawMessageArg, DCROUTER_CACHE_ID_HEADER, cachedEmailIdArg);
   }
 
   private isCachedEmailTerminal(cachedEmail: CachedEmail): boolean {
@@ -1478,17 +1481,16 @@ export class AcceptedEmailSpool {
     }
   }
 
-  private async persistRawMessage(cachedEmailArg: CachedEmail, rawMessageArg: string): Promise<void> {
+  private async persistRawMessage(cachedEmailArg: CachedEmail, rawMessageArg: plugins.buffer.Buffer): Promise<void> {
     const blobStorage = this.dcRouterRef.getSmartMtaBlobStorageManager();
     if (!blobStorage) {
       throw new Error('SmartBucket storage is required before accepting SMTP messages');
     }
     const objectKey = `/email/messages/${cachedEmailArg.id}.eml`;
-    const rawMessage = plugins.buffer.Buffer.from(rawMessageArg, 'utf8');
-    await blobStorage.set(objectKey, rawMessage);
+    await blobStorage.set(objectKey, rawMessageArg);
     cachedEmailArg.rawContent = undefined;
     cachedEmailArg.rawContentObjectKey = objectKey;
-    cachedEmailArg.rawContentSize = rawMessage.length;
+    cachedEmailArg.rawContentSize = rawMessageArg.length;
   }
 
   private runCachedEmailUpdate(

package/ts/email/classes.smtp-account.manager.ts

@@ -76,11 +76,6 @@ export class SmtpAccountManager {
   private started = false;
   private mutationChain: Promise<unknown> = Promise.resolve();
 
-  /** Explicit upstream capability marker; absence is deliberately fail-closed. */
-  private get authAccountsCapability(): boolean {
-    return (plugins.smartmta as any).smartMtaCapabilities?.smtpAuthAccountsAndScopes === true;
-  }
-
   constructor(private dcRouterRef: DcRouter) {}
 
   public async start(): Promise<void> {
@@ -114,6 +109,10 @@ export class SmtpAccountManager {
    * the workapp identity contribution plus DB-backed SMTP accounts and their
    * generated relay routes. Idempotent — previously generated entries are
    * stripped by their reserved name prefixes before re-adding.
+   *
+   * WorkApp identities only ever enter as scoped `auth.accounts`, never as
+   * plain `auth.users`: an unscoped user could put any address in MAIL FROM
+   * or the header From.
    */
   public async composeEmailConfig<TConfig extends IUnifiedEmailServerOptions>(
     emailConfig: TConfig,
@@ -122,32 +121,6 @@ export class SmtpAccountManager {
     const contribution = workappContribution
       ?? await this.dcRouterRef.workAppMailManager.getStoredIdentityContribution(emailConfig);
 
-    if (!this.authAccountsCapability) {
-      // Fail closed: without the smartmta capability the accounts field would
-      // be silently ignored (or rejected), so never pretend they are active —
-      // any pre-existing accounts entry is dropped from the composed auth too.
-      if (this.accounts.size > 0) {
-        logger.log('error', `SmartMTA is missing the smtpAuthAccountsAndScopes capability — ${this.accounts.size} stored SMTP account(s) are NOT active`);
-      }
-      const authWithoutAccounts = { ...(emailConfig.auth || {}) } as NonNullable<IUnifiedEmailServerOptions['auth']>;
-      delete authWithoutAccounts.accounts;
-      return {
-        ...emailConfig,
-        routes: [
-          ...(emailConfig.routes || [])
-            .filter((route) => !isWorkAppManagedMailRouteName(route.name) && !isSmtpAccountRouteName(route.name)),
-          ...contribution.routes,
-        ],
-        auth: {
-          ...authWithoutAccounts,
-          users: [
-            ...(emailConfig.auth?.users || []).filter((user) => !isWorkAppManagedSmtpUsername(user.username)),
-            ...contribution.users,
-          ],
-        },
-      };
-    }
-
     const accountDocs = [...this.accounts.values()]
       .sort((a, b) => a.username.localeCompare(b.username));
     const smtpAccounts: ISmtpAuthAccount[] = [];
@@ -182,8 +155,8 @@ export class SmtpAccountManager {
       routes: [...configuredRoutes, ...contribution.routes, ...accountRoutes],
       auth: {
         ...(emailConfig.auth || {}),
-        users: [...configuredUsers, ...contribution.users],
-        accounts: smtpAccounts,
+        users: configuredUsers,
+        accounts: [...contribution.accounts, ...smtpAccounts],
       },
     };
   }
@@ -324,9 +297,6 @@ export class SmtpAccountManager {
 
   public async createAccount(options: ISmtpAccountCreateOptions): Promise<ISmtpAccountSecretResult> {
     return await this.runMutationExclusive(async () => {
-      if (!this.authAccountsCapability) {
-        throw new Error('SmartMTA runtime does not support SMTP auth accounts (smtpAuthAccountsAndScopes capability missing)');
-      }
       const username = this.normalizeUsername(options.username);
       const senderScope = this.normalizeSenderScope(options.senderScope);
       const recipientScope = this.normalizeRecipientScope(options.recipientScope);

package/ts/email/classes.workapp-mail-manager.ts

@@ -3,6 +3,7 @@ import type {
   IExtendedSmtpSession,
   IMessageAcceptanceContext,
   IMessageAcceptanceDecision,
+  ISmtpAuthAccount,
   IUnifiedEmailServerOptions,
 } from '@push.rocks/smartmta';
 import type { Buffer } from 'node:buffer';
@@ -83,13 +84,17 @@ class MailSubmissionValidationError extends Error {
 }
 
 /**
- * WorkApp-generated routes and SMTP users contributed to the composed email
+ * WorkApp-generated routes and SMTP accounts contributed to the composed email
  * runtime config. Consumed by SmtpAccountManager, the single owner of the
  * final `auth` block and route-list composition.
+ *
+ * Every account carries a sender scope naming exactly its identity address:
+ * SmartMTA's scope checker is the only sender authorization, for MAIL FROM and
+ * for every header From mailbox alike.
  */
 export interface IWorkAppMailRuntimeContribution {
   routes: IEmailRoute[];
-  users: Array<{ username: string; password: string }>;
+  accounts: ISmtpAuthAccount[];
 }
 
 /** Route names generated (and owned wholesale) by WorkAppMailManager. */
@@ -368,7 +373,16 @@ export class WorkAppMailManager {
     };
   }
 
-  public async enforceManagedSmtpSender(
+  /**
+   * Live readiness of a WorkApp SMTP credential at DATA time.
+   *
+   * Sender authorization is not decided here: SmartMTA checks MAIL FROM and
+   * every header From mailbox against the account's sender scope before this
+   * hook runs. What SmartMTA cannot know is whether the identity is still
+   * active and its domain still outbound-ready now, after the session
+   * authenticated.
+   */
+  public async enforceManagedSmtpCredentialReady(
     context: IMessageAcceptanceContext,
   ): Promise<IMessageAcceptanceDecision | undefined> {
     const username = context.session.user?.username;
@@ -386,18 +400,6 @@ export class WorkAppMailManager {
     } catch (error: unknown) {
       return this.rejectSenderAuthorization((error as Error).message);
     }
-
-    const envelopeFrom = this.normalizeMailboxAddress(
-      context.session.envelope?.mailFrom?.address || context.session.mailFrom || '',
-    );
-    const headerFrom = this.extractSingleHeaderFromAddress(context.rawMessage, context.email.from);
-    if (!envelopeFrom || !headerFrom) {
-      return this.rejectSenderAuthorization('Managed SMTP sender must use exactly one From address');
-    }
-    if (envelopeFrom !== identity.address || headerFrom !== identity.address) {
-      return this.rejectSenderAuthorization('Managed SMTP sender is not authorized for this From address');
-    }
-
     return undefined;
   }
 
@@ -749,15 +751,16 @@ export class WorkAppMailManager {
     const generatedOutboundRoutes = nextIdentities
       .filter((identity) => identity.enabled && identity.smtp.enabled && readyDomains.has(identity.domain))
       .map((identity) => this.buildOutboundRoute(identity, emailConfig));
-    const generatedUsers = nextIdentities
+    const generatedAccounts = nextIdentities
       .filter((identity) => identity.enabled && identity.smtp.enabled && readyDomains.has(identity.domain))
-      .map((identity) => ({
+      .map((identity): ISmtpAuthAccount => ({
         username: identity.smtp.username,
-        password: identity.smtpPassword,
+        credential: { password: identity.smtpPassword },
+        scope: { senders: [identity.address] },
       }));
     return {
       routes: [...generatedRoutes, ...generatedOutboundRoutes],
-      users: generatedUsers,
+      accounts: generatedAccounts,
     };
   }
 
@@ -859,6 +862,7 @@ export class WorkAppMailManager {
       priority: 900,
       match: {
         authenticated: true,
+        authenticatedUser: identity.smtp.username,
         senders: identity.address,
       },
       action: {
@@ -969,45 +973,6 @@ export class WorkAppMailManager {
     return `${this.normalizeLocalPart(localPart)}@${this.normalizeDomain(domain)}`;
   }
 
-  private normalizeMailboxAddress(addressArg: string): string | undefined {
-    const trimmed = addressArg?.trim();
-    if (!trimmed || trimmed === '<>') return undefined;
-    const angleMatch = trimmed.match(/<([^<>]+)>/);
-    const candidate = (angleMatch ? angleMatch[1] : trimmed).replace(/^mailto:/i, '').trim();
-    try {
-      return this.normalizeAddress(candidate);
-    } catch {
-      return undefined;
-    }
-  }
-
-  private extractSingleHeaderFromAddress(rawMessageArg: Buffer, parsedFromArg: string): string | undefined {
-    const headerSlice = rawMessageArg.subarray(0, 64 * 1024);
-    const crlfHeaderEnd = headerSlice.indexOf('\r\n\r\n');
-    const lfHeaderEnd = headerSlice.indexOf('\n\n');
-    const headerEnd = crlfHeaderEnd >= 0
-      ? crlfHeaderEnd
-      : lfHeaderEnd >= 0
-        ? lfHeaderEnd
-        : headerSlice.length;
-    const headersText = headerSlice.subarray(0, headerEnd).toString('utf8');
-    const unfoldedLines: string[] = [];
-    for (const line of headersText.split(/\r?\n/)) {
-      if (/^[\t ]/.test(line) && unfoldedLines.length > 0) {
-        unfoldedLines[unfoldedLines.length - 1] += ` ${line.trim()}`;
-      } else {
-        unfoldedLines.push(line);
-      }
-    }
-    const fromHeaders = unfoldedLines.filter((line) => /^from\s*:/i.test(line));
-    if (fromHeaders.length > 1) return undefined;
-    const headerValue = fromHeaders.length === 1
-      ? fromHeaders[0].replace(/^from\s*:/i, '').trim()
-      : parsedFromArg;
-    if (!headerValue || headerValue.includes(',')) return undefined;
-    return this.normalizeMailboxAddress(headerValue);
-  }
-
   private rejectSenderAuthorization(messageArg: string): IMessageAcceptanceDecision {
     return {
       accepted: false,

package/ts/email/helpers.raw-message-header.ts

@@ -0,0 +1,106 @@
+import * as plugins from '../plugins.js';
+
+/**
+ * Byte-level header edits on a raw RFC 5322 message.
+ *
+ * A received message is kept as the bytes the client sent: its body may be
+ * 8-bit text in any charset or binary, so it is never decoded to a string and
+ * encoded again. Only the header section is looked at, and only to find field
+ * lines; every byte outside the edited field lines is copied unchanged.
+ *
+ * Lines end at LF, with or without a preceding CR. The header section is every
+ * line before the first empty line (CRLF or a bare LF alone). A message without
+ * an empty line is all header section and has no body.
+ */
+
+const LF = 0x0a;
+const CR = 0x0d;
+const SP = 0x20;
+const HTAB = 0x09;
+const COLON = 0x3a;
+
+/** Length in bytes of the header section, up to (not including) the empty line that ends it. */
+export const getRawMessageHeaderSectionLength = (rawMessageArg: plugins.buffer.Buffer): number => {
+  let lineStart = 0;
+  while (lineStart < rawMessageArg.length) {
+    const lineFeed = rawMessageArg.indexOf(LF, lineStart);
+    if (lineFeed === -1) {
+      // A last line without a terminator is a header line: there is no body.
+      return rawMessageArg.length;
+    }
+    const contentEnd = lineFeed > lineStart && rawMessageArg[lineFeed - 1] === CR ? lineFeed - 1 : lineFeed;
+    if (contentEnd === lineStart) {
+      return lineStart;
+    }
+    lineStart = lineFeed + 1;
+  }
+  return lineStart;
+};
+
+/** The header section's bytes (a view, not a copy). */
+export const getRawMessageHeaderSection = (rawMessageArg: plugins.buffer.Buffer): plugins.buffer.Buffer => {
+  return rawMessageArg.subarray(0, getRawMessageHeaderSectionLength(rawMessageArg));
+};
+
+/** Whether a field line names `lowerCaseNameArg` (case-insensitive, optional WSP before the colon). */
+const isFieldLineNamed = (lineArg: plugins.buffer.Buffer, lowerCaseNameArg: string): boolean => {
+  const colon = lineArg.indexOf(COLON);
+  if (colon === -1) return false;
+  let nameEnd = colon;
+  while (nameEnd > 0 && (lineArg[nameEnd - 1] === SP || lineArg[nameEnd - 1] === HTAB)) {
+    nameEnd--;
+  }
+  // latin1 maps each byte to one character, so a non-ASCII byte can never
+  // compare equal to the ASCII field name.
+  return lineArg.subarray(0, nameEnd).toString('latin1').toLowerCase() === lowerCaseNameArg;
+};
+
+/**
+ * Put exactly one `name: value` field at the top of the header section.
+ *
+ * Every field of that name in the header section is removed together with its
+ * folded continuation lines; the same text in the body is left alone. The new
+ * field line ends like the message's first line (CRLF, or a bare LF for a
+ * message whose first line ends in a bare LF), so the message keeps one line
+ * ending style; a message without any line terminator gets CRLF.
+ */
+export const setRawMessageHeaderField = (
+  rawMessageArg: plugins.buffer.Buffer,
+  fieldNameArg: string,
+  valueArg: string,
+): plugins.buffer.Buffer => {
+  if (!/^[\x21-\x39\x3b-\x7e]+$/.test(fieldNameArg)) {
+    throw new Error(`Invalid header field name: ${JSON.stringify(fieldNameArg)}`);
+  }
+  if (/[\r\n]/.test(valueArg)) {
+    throw new Error(`Header field ${fieldNameArg} value must not contain CR or LF`);
+  }
+
+  const headerSectionLength = getRawMessageHeaderSectionLength(rawMessageArg);
+  const lowerCaseName = fieldNameArg.toLowerCase();
+  const parts: plugins.buffer.Buffer[] = [];
+  let removing = false;
+  let lineStart = 0;
+  while (lineStart < headerSectionLength) {
+    const lineFeed = rawMessageArg.indexOf(LF, lineStart);
+    const lineEnd = lineFeed === -1 ? headerSectionLength : lineFeed + 1;
+    const line = rawMessageArg.subarray(lineStart, lineEnd);
+    if (line[0] !== SP && line[0] !== HTAB) {
+      removing = isFieldLineNamed(line, lowerCaseName);
+    }
+    if (!removing) {
+      parts.push(line);
+    }
+    lineStart = lineEnd;
+  }
+
+  const firstLineFeed = rawMessageArg.indexOf(LF);
+  const lineEnding = firstLineFeed === -1 || (firstLineFeed > 0 && rawMessageArg[firstLineFeed - 1] === CR)
+    ? '\r\n'
+    : '\n';
+  return plugins.buffer.Buffer.concat([
+    plugins.buffer.Buffer.from(`${fieldNameArg}: ${valueArg}${lineEnding}`, 'utf8'),
+    ...parts,
+    rawMessageArg.subarray(headerSectionLength),
+  ]);
+};

package/ts_web/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@serve.zone/dcrouter',
-  version: '32.8.0',
+  version: '33.0.0',
   description: 'A multifaceted routing service handling mail and SMS delivery functions.'
 }