Guard Mail Sieve

Validator for b.mail.agent.sieve.put / .activate. The full Sieve parser + bytecode + runtime lands at v0.9.26 as b.safeSieve; this guard handles the agent-side actor + script- envelope checks that apply BEFORE parsing:

- actor-scope check — only the owner of a script (or mailScope: "admin") may edit it - script-byte cap — refuses scripts larger than maxScriptBytes (default 65536 — same cap v0.9.26's b.safeSieve will use) - script-name shape — RFC 5804 §2.3 script names are bounded UTF-8; the guard enforces the byte cap (default 256) and refuses NUL / control / slash / path-traversal shapes - line-count cap — defends scripts that are technically under the byte cap but pathological (one-character lines)

When v0.9.26 ships, b.safeSieve.validate(script) will be invoked AFTER this guard — operators who want to bytecode- validate at agent.sieve.put time pass requireParse: true and the agent calls into v0.9.26's parser.

b.guardMailSieve.validate(op, opts?) #

{
  profile:   "strict" | "balanced" | "permissive",
  posture:   "hipaa" | "pci-dss" | "gdpr" | "soc2",
  ownedNames: Array,    // names the actor owns (operator-supplied)
}

Validate a sieve-management op shape. op.kind is one of "put" / "activate" / "delete"; op.actor carries the actor; for "put" the op.name and op.script are validated; for "activate" / "delete" only op.name is required.

b.guardMailSieve.validate({
  kind: "put",
  actor: { id: "u1", mailScope: "user" },
  name:  "my-filter",
  script: "require [\"fileinto\"];\nif address :is \"From\" \"x@x\" { fileinto \"Junk\"; }",
}, { ownedNames: ["my-filter"] });

b.guardMailSieve.compliancePosture(name) #

Return the effective profile NAME for a compliance posture, or null for a name this parser does not map. Unlike the content-guard variant this returns the resolved profile string (every line-protocol parser composes gateContract.ALL_STRICT_POSTURES, so "hipaa" / "pci-dss" / "gdpr" / "soc2" all resolve to "strict") and never throws — the parser shape carries no overlay-clone, no buildProfile, and no loadRulePack. Wired by gateContract.defineParser.

b.guardMailSieve.compliancePosture("hipaa");                   // → "strict"
b.guardMailSieve.compliancePosture("not-a-regime");            // → null

Last updated 2026-08-08T16:39:49.652Z by seeder.