# RFC 2045 Base64 Content-Transfer Body
Status: implemented in Commit 43 for the `base64-ng-mime` companion package.
## Exact Scope
The companion implements RFC 2045 Section 6.8 Base64 content-transfer body
bytes. It does not parse or generate `Content-Transfer-Encoding` headers,
MIME-Version, Content-Type, complete messages, entities, body-part headers,
multipart boundaries, or media-type canonicalization.
The immutable source is `rfc/rfc2045.txt`, SHA-256
`9bb251635dd37fda97dcce6c08dea019432117a0f1e389051d2ecbf7b76350b0`.
`rfc/rfc2045-errata.tsv` records the 2026-08-03 RFC Editor errata snapshot.
None of its three verified records changes Section 6.8.
## Encoding Contract
- Standard Base64 alphabet and canonical `=` padding.
- At most 76 encoded characters per line.
- Canonical line separators are `CRLF`.
- A final `CRLF` is explicit through `MimeBodyTerminalLineEnding`.
- Text canonicalization is the caller's responsibility. The companion accepts
and emits octets; it does not rewrite plaintext line endings before Base64.
- Every one-shot call validates exact sizing and all finite limits before its
first destination write.
## Decoding Contracts
`MimeBodyDecodePolicy::Canonical` accepts the crate-generated form: exact
76-character interior lines, `CRLF` separators, a shorter final line, and an
optional final `CRLF`. It rejects every other nonalphabet byte.
`MimeBodyDecodePolicy::Rfc2045Compatible` implements Section 6.8's instruction
to ignore line breaks and other bytes outside Table 1. It still rejects
misplaced or excessive padding, incomplete final quanta, trailing significant
data after padding, and noncanonical unused bits. Ignored non-whitespace bytes
and bare line endings are returned as warning metadata rather than silently
classified as canonical.
## Finite Limits
Every operation receives `MimeBodyLimits`. It independently bounds:
- source input bytes;
- encoded output bytes;
- decoded output bytes;
- physical transport-line bytes;
- ignored bytes outside Table 1; and
- source work between decoded output quanta.
The default is finite. Services should select protocol- and deployment-sized
limits rather than treating the defaults as an authorization policy.
## Incremental And Failure Behavior
`MimeBodyEncoder` and `MimeBodyDecoder` retain only incomplete quantum and
pending-output state. They accept arbitrary source fragmentation and one-byte
destinations. Progress is exact and caller-visible output is prefix-committing.
After malformed input, a limit failure, arithmetic overflow, or an internal
core failure, the affected encoder or decoder state is terminal.
The one-shot decode helper is stronger: it validates and measures the complete
body before writing, so every returned error leaves caller-owned output
unchanged. Allocating helpers reserve fallibly and return allocation failure.
The companion is ordinary and non-secret. It does not claim constant-time
behavior, automatic wiping, or protected memory.
## Evidence
- `scripts/verify-rfcs.sh` verifies the immutable RFC, errata, and requirement
lock offline.
- `scripts/check-2.0-mime-body.sh` runs no-default, alloc, std, clippy, docs,
conformance, interoperability, package, and naming checks.
- `tests/mime_body.rs` covers normative vectors, all line boundaries,
malformed folding, strict padding, transactional output, finite limits, and
one-byte transport fragmentation.
- Private near-`usize::MAX` state tests prove encoder and decoder arithmetic
failures latch before a partially filled quantum can be reused.
- `tests/interoperability.rs` compares canonical output and decoded bytes with
Python's `email.base64mime` and OpenSSL's Base64 command.
- `fuzz/fuzz_targets/mime_body.rs` exercises arbitrary body bytes and chunking.