@blamejs/blamejs-shop 0.0.44

package/lib/vendor/blamejs/test/integration/http-client.test.js

@@ -0,0 +1,129 @@
+"use strict";
+/**
+ * Live HTTP client round-trip against the docker-compose Caddy fixture.
+ * Exercises lib/http-client.js's request flow, both directly (HTTP) and
+ * through the Squid forward proxy on :3128 (HTTP_PROXY semantics).
+ *
+ * Caddy hosts the only "real app" endpoint in the test stack — its
+ * /healthz returns 200 "ok" — making it the natural target for both
+ * direct and proxy-routed integration coverage.
+ */
+var helpers = require("../helpers");
+var check = helpers.check;
+var services = require("../helpers/services");
+var b = require("../../");
+
+async function run() {
+  var caddySvc = await services.requireService("caddy");
+  if (!caddySvc.ok) throw new Error("caddy unreachable: " + caddySvc.reason);
+  var squidSvc = await services.requireService("squid");
+  if (!squidSvc.ok) throw new Error("squid unreachable: " + squidSvc.reason);
+  var caddyTlsSvc = await services.requireService("caddyTls");
+  if (!caddyTlsSvc.ok) throw new Error("caddy-tls unreachable: " + caddyTlsSvc.reason);
+
+  // ---- direct HTTP request ----
+  var resp = await b.httpClient.request({
+    method:           "GET",
+    url:              "http://127.0.0.1:8080/healthz",
+    allowedProtocols: b.safeUrl.ALLOW_HTTP_ALL,
+    allowInternal:    true,
+  });
+  check("direct HTTP: status 200",       resp.statusCode === 200);
+  check("direct HTTP: body 'ok'",         Buffer.isBuffer(resp.body) ? resp.body.toString() === "ok" : resp.body === "ok");
+
+  // ---- direct HTTPS with private CA (NODE_EXTRA_CA_CERTS picks it up) ----
+  var respTls = await b.httpClient.request({
+    method:        "GET",
+    url:           "https://localhost:8444/healthz",
+    allowInternal: true,
+  });
+  check("direct HTTPS: status 200",       respTls.statusCode === 200);
+
+  // ---- through Squid forward proxy ----
+  // The squid container can't reach the host's 127.0.0.1 — its own
+  // loopback is itself. From inside the docker network, caddy is
+  // reachable as `caddy:80`. The host-side test process resolves
+  // host.docker.internal to the docker host's gateway IP, but the
+  // proxy-routed path needs an address the proxy can resolve, so
+  // we route through Squid to the docker-internal "caddy" hostname.
+  if (typeof b.network.proxy._resetForTest === "function") b.network.proxy._resetForTest();
+  b.network.proxy.set({
+    http:  "http://127.0.0.1:3128",
+    https: "http://127.0.0.1:3128",
+  });
+  var proxiedResp = await b.httpClient.request({
+    method:           "GET",
+    url:              "http://caddy/healthz",
+    allowedProtocols: b.safeUrl.ALLOW_HTTP_ALL,
+    allowInternal:    true,
+  });
+  check("proxied HTTP: status 200 (via Squid → caddy)", proxiedResp.statusCode === 200);
+  check("proxied HTTP: body 'ok'",
+        Buffer.isBuffer(proxiedResp.body) ? proxiedResp.body.toString() === "ok" : proxiedResp.body === "ok");
+
+  // ---- noProxy entry should bypass the proxy (direct to host port) ----
+  if (typeof b.network.proxy._resetForTest === "function") b.network.proxy._resetForTest();
+  b.network.proxy.set({
+    http:    "http://127.0.0.1:3128",
+    no:      "127.0.0.1,localhost",
+  });
+  var bypassResp = await b.httpClient.request({
+    method:           "GET",
+    url:              "http://127.0.0.1:8080/healthz",
+    allowedProtocols: b.safeUrl.ALLOW_HTTP_ALL,
+    allowInternal:    true,
+  });
+  check("no_proxy bypass: status 200 (direct, not via squid)",
+        bypassResp.statusCode === 200);
+
+  // ---- response shapes ----
+  if (typeof b.network.proxy._resetForTest === "function") b.network.proxy._resetForTest();
+  var jsonResp = await b.httpClient.request({
+    method:           "GET",
+    url:              "http://127.0.0.1:8025/api/v1/info",  // Mailpit info endpoint
+    allowedProtocols: b.safeUrl.ALLOW_HTTP_ALL,
+    allowInternal:    true,
+  });
+  check("response: statusCode and body shape preserved",
+        jsonResp.statusCode === 200 && (Buffer.isBuffer(jsonResp.body) || typeof jsonResp.body === "string"));
+
+  // ---- 404 surfaces correctly ----
+  var notFound = null;
+  try {
+    await b.httpClient.request({
+      method:           "GET",
+      url:              "http://127.0.0.1:8080/this-does-not-exist",
+      allowedProtocols: b.safeUrl.ALLOW_HTTP_ALL,
+      allowInternal:    true,
+    });
+  } catch (e) { notFound = e; }
+  check("404: surfaces as HTTP error (or response with 404)",
+        notFound ? /404|HTTP_ERROR/.test((notFound.code || "") + " " + notFound.message) : true);
+
+  // ---- SSRF unconditional cloud-metadata block — even with proxy +
+  //      allowInternal:true the framework refuses 169.254.169.254 etc.
+  //      because the proxy can't be trusted to refuse them downstream.
+  //      Regression for #106 P1 Codex finding (v0.11.1).
+  b.network.proxy.set({ http: "http://127.0.0.1:3128" });
+  var metaErr = null;
+  try {
+    await b.httpClient.request({
+      method:           "GET",
+      url:              "http://169.254.169.254/latest/meta-data/",
+      allowedProtocols: b.safeUrl.ALLOW_HTTP_ALL,
+      allowInternal:    true,
+    });
+  } catch (eMeta) { metaErr = eMeta; }
+  check("SSRF metadata IP refused even with proxy + allowInternal:true",
+        metaErr && metaErr.code === "ssrf-guard/blocked-cloud-metadata");
+  if (typeof b.network.proxy._resetForTest === "function") b.network.proxy._resetForTest();
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  run().then(
+    function () { console.log("OK — " + helpers.getChecks() + " checks passed"); process.exit(0); },
+    function (e) { console.error("FAIL:", e.stack || e); process.exit(1); }
+  );
+}

package/lib/vendor/blamejs/test/integration/log-stream.test.js

@@ -0,0 +1,219 @@
+"use strict";
+/**
+ * Live log-stream sink test — exercises lib/log-stream.js's webhook
+ * sink against a real HTTP receiver (the Caddy fixture's :8080 echoes
+ * 200 on every request, sufficient to confirm the framework's sink
+ * code path serializes + posts records correctly), the local file sink,
+ * and the syslog sink across udp / tcp / tls transports against the
+ * docker syslog-ng container which writes to /var/log/blamejs-test.log.
+ */
+var child_process = require("node:child_process");
+var fs   = require("node:fs");
+var http = require("node:http");
+var os   = require("node:os");
+var path = require("node:path");
+var tls  = require("node:tls");
+var helpers = require("../helpers");
+var check = helpers.check;
+var services = require("../helpers/services");
+var b = require("../../");
+
+async function run() {
+  var caddy = await services.requireService("caddy");
+  if (!caddy.ok) throw new Error("caddy unreachable: " + caddy.reason);
+
+  // ---- protocol catalog ----
+  check("PROTOCOLS exposes every shipped sink (local/webhook/otlp/otlp-grpc/cloudwatch/syslog)",
+        ["local", "webhook", "otlp", "otlp-grpc", "cloudwatch", "syslog"].every(function (p) {
+          return b.logStream.PROTOCOLS.indexOf(p) !== -1;
+        }));
+  check("DEFERRED_PROTOCOLS no longer lists 'syslog' (it ships)",
+        b.logStream.DEFERRED_PROTOCOLS.indexOf("syslog") === -1);
+
+  // ---- local sink: writes records to disk ----
+  if (typeof b.logStream._resetForTest === "function") b.logStream._resetForTest();
+  var tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-log-stream-"));
+  b.logStream.init({
+    sinks: {
+      local: { protocol: "local", dir: tmpDir },
+    },
+    minLevel: "debug",
+  });
+  b.logStream.info("integration-event-1", { kind: "test", n: 1 });
+  b.logStream.warn("integration-event-2", { kind: "test", n: 2 });
+  await b.logStream.shutdown();
+  // local sink writes one file per day; collect everything in tmpDir.
+  var allLocalContent = fs.readdirSync(tmpDir)
+    .map(function (f) { return fs.readFileSync(path.join(tmpDir, f), "utf8"); })
+    .join("\n");
+  check("local sink: file contains the first event",
+        allLocalContent.indexOf("integration-event-1") !== -1);
+  check("local sink: file contains the second event",
+        allLocalContent.indexOf("integration-event-2") !== -1);
+  check("local sink: warn level recorded",
+        /"level":\s*"warn"/.test(allLocalContent));
+
+  // ---- webhook sink: posts records to a real HTTP endpoint ----
+  // Caddy responds 200 on every path. We host our own tiny capture
+  // server too, so we can inspect the bodies the framework posted.
+  var captured = [];
+  var captureServer = http.createServer(function (req, res) {
+    var chunks = [];
+    req.on("data", function (c) { chunks.push(c); });
+    req.on("end", function () {
+      try { captured.push(JSON.parse(Buffer.concat(chunks).toString("utf8"))); }
+      catch (_e) { captured.push({ _raw: Buffer.concat(chunks).toString("utf8") }); }
+      res.statusCode = 204;
+      res.end();
+    });
+  });
+  await new Promise(function (resolve) { captureServer.listen(0, "127.0.0.1", resolve); });
+  var capturePort = captureServer.address().port;
+  var captureUrl = "http://127.0.0.1:" + capturePort + "/log";
+
+  if (typeof b.logStream._resetForTest === "function") b.logStream._resetForTest();
+  b.logStream.init({
+    sinks: {
+      hooked: {
+        protocol:         "webhook",
+        url:              captureUrl,
+        allowedProtocols: b.safeUrl.ALLOW_HTTP_ALL,
+        allowInternal:    true,
+        flushIntervalMs:  50,
+      },
+    },
+    minLevel: "debug",
+  });
+  b.logStream.info("webhook-event", { route: "/payments", traceId: "abc-123" });
+  b.logStream.error("webhook-error", { reason: "boom" });
+  await b.logStream.shutdown();
+  await new Promise(function (resolve) { captureServer.close(resolve); });
+  fs.rmSync(tmpDir, { recursive: true, force: true });
+
+  check("webhook sink: at least one record posted",
+        captured.length >= 1);
+  // The webhook sink may batch records into a single body or post one
+  // body per record. Either way both events should be findable.
+  var allText = JSON.stringify(captured);
+  check("webhook sink: 'webhook-event' message landed",
+        allText.indexOf("webhook-event") !== -1);
+  check("webhook sink: 'webhook-error' message landed",
+        allText.indexOf("webhook-error") !== -1);
+  check("webhook sink: error level preserved",
+        /"level":\s*"error"/.test(allText));
+
+  // ---- syslog sink: udp / tcp against the docker syslog-ng ----
+  // The docker container appends every record to /var/log/blamejs-test.log
+  // regardless of which transport it arrived on. We emit a uniquely-tagged
+  // record per transport, flush, then docker-exec to confirm each tag
+  // landed on disk.
+  var syslog = await services.requireService("syslog");
+  if (!syslog.ok) throw new Error("syslog unreachable: " + syslog.reason);
+
+  // Truncate the log file so prior runs don't poison the assertions.
+  child_process.execFileSync("docker",
+    ["exec", "blamejs-test-syslog", "truncate", "-s", "0", "/var/log/blamejs-test.log"],
+    { stdio: "pipe" });
+
+  var transports = [
+    { name: "udp", url: "udp://127.0.0.1:5514", tag: "blamejs-udp-" + Date.now() },
+    { name: "tcp", url: "tcp://127.0.0.1:5514", tag: "blamejs-tcp-" + Date.now() },
+  ];
+
+  for (var i = 0; i < transports.length; i += 1) {
+    var t = transports[i];
+    if (typeof b.logStream._resetForTest === "function") b.logStream._resetForTest();
+    b.logStream.init({
+      sinks: { syslog: { protocol: "syslog", url: t.url, appName: t.tag } },
+      minLevel: "debug",
+    });
+    b.logStream.info("syslog-event-via-" + t.name, { transport: t.name });
+    await helpers.passiveObserve(500, "syslog " + t.name + ": send + docker syslog-ng flush to /var/log/blamejs-test.log");
+    await b.logStream.shutdown();
+  }
+  await helpers.passiveObserve(250, "syslog: final shutdown flush window across all transports");
+  var syslogLog = child_process.execFileSync("docker",
+    ["exec", "blamejs-test-syslog", "cat", "/var/log/blamejs-test.log"],
+    { stdio: ["pipe", "pipe", "pipe"] }).toString("utf8");
+
+  for (var j = 0; j < transports.length; j += 1) {
+    var trj = transports[j];
+    check("syslog " + trj.name + ": record landed in /var/log/blamejs-test.log",
+          syslogLog.indexOf(trj.tag) !== -1);
+  }
+
+  // ---- syslog TLS sink: against an ad-hoc tls.createServer ----
+  // The docker syslog-ng container's TLS port forwarded through Docker
+  // Desktop on Windows is flaky — handshakes succeed standalone but
+  // race the framework's reconnect loop. We assert the on-the-wire
+  // framing the framework produces (RFC 6587 octet-counting + RFC 5424
+  // message body) against a Node-side TLS receiver instead, which
+  // exercises every code path in lib/log-stream-syslog.js's TLS branch.
+  // Use the docker syslog cert + key directly — easier than re-issuing.
+  var serverCert = child_process.execFileSync("docker",
+    ["exec", "blamejs-test-syslog", "cat", "/certs/syslog.crt"],
+    { stdio: "pipe" }).toString("utf8");
+  var serverKey  = child_process.execFileSync("docker",
+    ["exec", "blamejs-test-syslog", "cat", "/certs/syslog.key"],
+    { stdio: "pipe" }).toString("utf8");
+  var caPath = process.env.BLAMEJS_TEST_CA_PATH;
+  var ca = caPath ? fs.readFileSync(caPath) : undefined;
+  var received = "";
+  var tlsServer = tls.createServer({ cert: serverCert, key: serverKey },
+    function (sock) { sock.on("data", function (buf) { received += buf.toString("utf8"); }); });
+  await new Promise(function (r) { tlsServer.listen(0, "127.0.0.1", r); });
+  var tlsPort = tlsServer.address().port;
+
+  var tlsTag = "blamejs-tls-" + Date.now();
+  if (typeof b.logStream._resetForTest === "function") b.logStream._resetForTest();
+  b.logStream.init({
+    sinks: { syslog: {
+      protocol: "syslog",
+      url:      "tls://localhost:" + tlsPort,
+      appName:  tlsTag,
+      ca:       ca,
+    } },
+    minLevel: "debug",
+  });
+  b.logStream.info("syslog-event-via-tls", { transport: "tls" });
+  await helpers.waitUntil(function () { return received.indexOf(tlsTag) !== -1; }, {
+    label: "syslog tls: TLS receiver got the tagged record",
+  });
+  await b.logStream.shutdown();
+  await new Promise(function (r) { tlsServer.close(r); });
+
+  check("syslog tls: record reached the TLS receiver",
+        received.indexOf(tlsTag) !== -1);
+  check("syslog tls: octet-counting framing — record begins '<bytecount> '",
+        /^\d+ <\d+>1 /.test(received));
+  check("syslog tls: RFC 5424 PRI uses local0 facility (16)",
+        /<13[0-9]>1 /.test(received));   // local0=16 → 16*8=128, info=6 → 134
+  check("syslog tls: ISO 8601 timestamp present",
+        /\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}/.test(received));
+  check("syslog tls: structured-data slot present (default '-')",
+        / - syslog-event-via-tls/.test(received));
+
+  if (typeof b.logStream._resetForTest === "function") b.logStream._resetForTest();
+  var bad = null;
+  try {
+    b.logStream.init({ sinks: { s: { protocol: "syslog", url: "http://wrong" } } });
+  } catch (e) { bad = e; }
+  check("syslog rejects http:// urls (must be udp/tcp/tls)",
+        bad && /udp|tcp|tls/.test(String(bad.message || "")));
+  if (typeof b.logStream._resetForTest === "function") b.logStream._resetForTest();
+  bad = null;
+  try {
+    b.logStream.init({ sinks: { s: { protocol: "syslog" } } });
+  } catch (e) { bad = e; }
+  check("syslog without { url } throws BAD_OPT",
+        bad && /url/i.test(String(bad.message || "")));
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  run().then(
+    function () { console.log("OK — " + helpers.getChecks() + " checks passed"); process.exit(0); },
+    function (e) { console.error("FAIL:", e.stack || e); process.exit(1); }
+  );
+}

package/lib/vendor/blamejs/test/integration/mail-crypto-smime.test.js

@@ -0,0 +1,181 @@
+"use strict";
+/**
+ * Live S/MIME sign + verify round-trip using a real X.509 chain.
+ *
+ * Composes:
+ *   - b.mtlsCa to bootstrap a CA + issue a leaf cert
+ *   - b.mail.crypto.smime.sign to wrap the message in RFC 8551
+ *     multipart/signed with PQC signers (ML-DSA-65)
+ *   - b.mail.crypto.smime.verify to walk the SignedData payload and
+ *     refuse tamper / signature mismatch / untrusted chain
+ *
+ * This exercises the v0.11.0 surface: trust-anchor chain validation
+ * via node:crypto.X509Certificate walking the chain leaf-to-root
+ * against the operator-supplied trustAnchorCertsPem set, with notBefore/
+ * notAfter checks. The pure-PQC sign path means no classical RSA/ECDSA
+ * cert is involved on the signer side; the CA is the only classical
+ * piece (the framework's mtlsCa issues classical certs by default
+ * because ML-DSA in X.509 is still draft).
+ */
+
+var fs   = require("node:fs");
+var os   = require("node:os");
+var path = require("node:path");
+var nodeCrypto = require("node:crypto");
+var helpers = require("../helpers");
+var check = helpers.check;
+var b = require("../../");
+
+async function run() {
+  // ---- Spin up an isolated mTLS CA (caKeySealedMode=disabled keeps
+  //      the CA private key on disk in plaintext — fine for the test
+  //      fixture; production wires opts.vault for sealed-at-rest).
+  var tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-smime-"));
+  try {
+    var ca = b.mtlsCa.create({ dataDir: tmpDir, caKeySealedMode: "disabled" });
+    var caBundle = await ca.initCA();
+    check("mtlsCa: caCertPem present", typeof caBundle.caCertPem === "string");
+
+    // Issue a signer leaf cert. The leaf is RSA-2048 from b.mtlsCa
+    // (which issues classical certs by default); we use its DER bytes
+    // as the SignerInfo's issuerAndSerialNumber source.
+    var leaf = await ca.generateClientCert({
+      cn:           "smime-signer.blamejs-test.example",
+      validityDays: 7,
+    });
+    var leafCertDer = Buffer.from(
+      leaf.cert.replace(/-----[^-]+-----/g, "").replace(/\s+/g, ""),
+      "base64");
+
+    // ---- PQC signer for the SignerInfo. The cert's issuer/serial
+    //      uniquely identifies which key signed the SignedData; the
+    //      actual sign + verify uses ML-DSA-65.
+    var pq = require("../../lib/pqc-software");
+    var signerKp = pq.ml_dsa_65.keygen();
+
+    // ---- Compose b.mail.crypto.smime.sign — produces an RFC 8551
+    //      multipart/signed envelope with the CMS SignedData attached.
+    var message = "From: signer@example\r\n" +
+                  "To: alice@example\r\n" +
+                  "Subject: live S/MIME roundtrip\r\n" +
+                  "\r\n" +
+                  "Live S/MIME roundtrip body.\r\n";
+
+    var signed = b.mail.crypto.smime.sign({
+      message:     message,
+      certificate: leafCertDer,
+      secretKey:   signerKp.secretKey,
+      sigAlg:      "ML-DSA-65",
+      digestAlg:   "sha3-512",
+    });
+    check("smime.sign: returns multipart envelope",
+      typeof signed.multipart === "string" &&
+      signed.multipart.indexOf("multipart/signed") !== -1);
+    check("smime.sign: micalg names sha3-512",
+      /micalg=("?)sha3-512\1/.test(signed.multipart));
+    check("smime.sign: returns raw CMS signature DER",
+      Buffer.isBuffer(signed.signature) && signed.signature.length > 0);
+
+    // ---- Verify against the signer's public key. This walks the
+    //      signed-attrs, extracts messageDigest, recomputes the digest
+    //      of the message, refuses tamper, and PQC-verifies the
+    //      signature.
+    var verified = b.mail.crypto.smime.verify({
+      message:         Buffer.from(message, "utf8"),
+      signature:       signed.signature,
+      signerPublicKey: signerKp.publicKey,
+    });
+    check("smime.verify: valid roundtrip",
+      verified && verified.valid === true);
+    check("smime.verify: sigAlg surfaced",
+      verified && verified.sigAlg === "ML-DSA-65");
+
+    // ---- Tamper test: flip a byte in the message; verify must refuse.
+    var tampered = message.replace("Live", "Damn");
+    var threw = null;
+    try {
+      b.mail.crypto.smime.verify({
+        message:         Buffer.from(tampered, "utf8"),
+        signature:       signed.signature,
+        signerPublicKey: signerKp.publicKey,
+      });
+    } catch (e) { threw = e.code; }
+    check("smime.verify: refuses tampered message body",
+      threw === "mail-crypto/smime/message-digest-mismatch");
+
+    // ---- Wrong-key test: verify with a different ML-DSA-65 key fails.
+    var otherKp = pq.ml_dsa_65.keygen();
+    threw = null;
+    try {
+      b.mail.crypto.smime.verify({
+        message:         Buffer.from(message, "utf8"),
+        signature:       signed.signature,
+        signerPublicKey: otherKp.publicKey,
+      });
+    } catch (e) { threw = e.code; }
+    check("smime.verify: refuses wrong signer public key",
+      threw === "mail-crypto/smime/signature-mismatch");
+
+    // ---- Trust-anchor chain validation — opts.trustAnchorCertsPem.
+    //      The CMS SignedData carries the leaf cert (we embedded it
+    //      via the encodeSignedData certificates field). With the CA
+    //      PEM as the trust anchor, verify walks leaf → CA.
+    //
+    //      For this composition to work we need to re-encode the
+    //      SignedData with the leaf cert in the certificates [0]
+    //      block — the sign() path above only embedded it via the
+    //      SignerInfo's issuerAndSerialNumber pointer. Re-encode
+    //      manually here to exercise the chain path.
+    var signedWithCerts = b.cms.encodeSignedData({
+      encapContent: Buffer.from(message, "utf8"),
+      digestAlg:    "sha3-512",
+      certificates: [leafCertDer],
+      signers: [{
+        certificate: leafCertDer,
+        secretKey:   signerKp.secretKey,
+        sigAlg:      "ML-DSA-65",
+      }],
+    });
+    var verifiedChain = b.mail.crypto.smime.verify({
+      message:             Buffer.from(message, "utf8"),
+      signature:           signedWithCerts,
+      signerPublicKey:     signerKp.publicKey,
+      trustAnchorCertsPem: [caBundle.caCertPem],
+    });
+    check("smime.verify: chain validates against trust anchor",
+      verifiedChain && verifiedChain.valid === true &&
+      verifiedChain.chainVerified === true);
+
+    // ---- Untrusted-chain refusal: supply an UNRELATED trust anchor.
+    var unrelatedCa = b.mtlsCa.create({
+      dataDir:           fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-smime-other-")),
+      caKeySealedMode:   "disabled",
+    });
+    var unrelatedBundle = await unrelatedCa.initCA();
+    threw = null;
+    try {
+      b.mail.crypto.smime.verify({
+        message:             Buffer.from(message, "utf8"),
+        signature:           signedWithCerts,
+        signerPublicKey:     signerKp.publicKey,
+        trustAnchorCertsPem: [unrelatedBundle.caCertPem],
+      });
+    } catch (eC) { threw = eC.code; }
+    check("smime.verify: refuses unrelated trust anchor",
+      threw === "mail-crypto/smime/untrusted-chain");
+
+    // ---- X.509 sanity — confirm node:crypto can parse the leaf and
+    //      verify its issuer matches the CA subject.
+    var leafX509 = new nodeCrypto.X509Certificate(leaf.cert);
+    var caX509   = new nodeCrypto.X509Certificate(caBundle.caCertPem);
+    check("X509: leaf issuer == CA subject (chain shape valid)",
+      leafX509.issuer === caX509.subject);
+  } finally {
+    try { fs.rmSync(tmpDir, { recursive: true, force: true }); } catch (_e) { /* best effort */ }
+  }
+}
+
+run().then(
+  function () { console.log("[mail-crypto-smime] OK"); },
+  function (e) { console.error("[mail-crypto-smime] FAIL:", e.stack || e); process.exit(1); }
+);

package/lib/vendor/blamejs/test/integration/mail-dkim.test.js

@@ -0,0 +1,152 @@
+"use strict";
+/**
+ * Live DKIM-signed SMTP delivery against the docker-compose Mailpit
+ * fixture. Exercises lib/mail-dkim.js wiring through smtpTransport's
+ * dkimSigner option — the captured message's RFC 5322 body must
+ * include a syntactically-valid DKIM-Signature header that mailpit
+ * preserves verbatim.
+ *
+ * Covers both signature algorithms the framework supports: rsa-sha256
+ * (RFC 6376) and ed25519-sha256 (RFC 8463). PQC DKIM is forward-looking
+ * — the framework's dkim docstring carries that intent already.
+ */
+var fs = require("node:fs");
+var http = require("node:http");
+var crypto = require("node:crypto");
+var helpers = require("../helpers");
+var check = helpers.check;
+var services = require("../helpers/services");
+var b = require("../../");
+
+function _httpJson(url) {
+  return new Promise(function (resolve, reject) {
+    var req = http.get(url, function (res) {
+      var chunks = [];
+      res.on("data", function (c) { chunks.push(c); });
+      res.on("end", function () {
+        var body = Buffer.concat(chunks).toString("utf8");
+        if (res.statusCode < 200 || res.statusCode >= 300) {
+          return reject(new Error("HTTP " + res.statusCode));
+        }
+        try { resolve(JSON.parse(body)); }
+        catch (_e) { reject(new Error("bad JSON")); }
+      });
+    });
+    req.once("error", reject);
+  });
+}
+
+function _httpDelete(url) {
+  return new Promise(function (resolve, reject) {
+    var u = new URL(url);
+    var req = http.request({
+      method: "DELETE", host: u.hostname, port: u.port, path: u.pathname,
+    }, function (res) {
+      res.on("data", function () {});
+      res.on("end", resolve);
+    });
+    req.once("error", reject);
+    req.end();
+  });
+}
+
+async function _runWithAlgorithm(algorithm, privateKey, label) {
+  await _httpDelete("http://127.0.0.1:8025/api/v1/messages");
+
+  var caPem = fs.readFileSync(process.env.BLAMEJS_TEST_CA_PATH, "utf8");
+  var signer = b.mail.dkim.create({
+    domain:     "example.com",
+    selector:   "test",
+    privateKey: privateKey,
+    algorithm:  algorithm,
+    headersToSign: ["From", "To", "Subject", "Date"],
+  });
+  var transport = b.mail.transports.smtp({
+    host:       "localhost",
+    port:       1025,
+    ehloName:   "blamejs-test",
+    timeoutMs:  5000,
+    ca:         caPem,
+    dkimSigner: signer,
+  });
+
+  var subject = "dkim-" + algorithm + "-" + Date.now();
+  await transport.send({
+    from:    "test@example.com",
+    to:      ["dkim@blamejs.local"],
+    subject: subject,
+    text:    "DKIM-signed test body for " + label,
+  });
+
+  var listing = await _httpJson("http://127.0.0.1:8025/api/v1/messages");
+  check("[" + label + "] mailpit captured the dkim-signed message",
+        listing.messages.length === 1);
+  var captured = listing.messages[0];
+  // mailpit's API doesn't surface DKIM-Signature in the summary listing —
+  // need the raw source via /raw to inspect signature headers.
+  var raw = await new Promise(function (resolve, reject) {
+    http.get("http://127.0.0.1:8025/api/v1/message/" + captured.ID + "/raw", function (res) {
+      var chunks = [];
+      res.on("data", function (c) { chunks.push(c); });
+      res.on("end", function () { resolve(Buffer.concat(chunks).toString("utf8")); });
+    }).once("error", reject);
+  });
+  check("[" + label + "] raw source contains DKIM-Signature header",
+        /^DKIM-Signature:\s/m.test(raw));
+  check("[" + label + "] DKIM-Signature has v=1 tag",
+        /v=1/.test(raw));
+  check("[" + label + "] DKIM-Signature has correct a= algorithm",
+        new RegExp("a=" + algorithm).test(raw));
+  check("[" + label + "] DKIM-Signature has d=example.com domain",
+        /d=example\.com/.test(raw));
+  check("[" + label + "] DKIM-Signature has s=test selector",
+        /s=test/.test(raw));
+  check("[" + label + "] DKIM-Signature has bh= body hash",
+        /bh=[A-Za-z0-9+/=]+/.test(raw));
+  check("[" + label + "] DKIM-Signature has b= signature",
+        /b=[A-Za-z0-9+/=\s]+/.test(raw));
+}
+
+async function run() {
+  var svc = await services.requireService("mailpit");
+  if (!svc.ok) throw new Error("mailpit unreachable: " + svc.reason);
+
+  // ---- rsa-sha256 (RFC 6376 default) ----
+  var rsa = crypto.generateKeyPairSync("rsa", {
+    modulusLength: 2048,
+    privateKeyEncoding: { type: "pkcs8", format: "pem" },
+    publicKeyEncoding:  { type: "spki",  format: "pem" },
+  });
+  await _runWithAlgorithm("rsa-sha256", rsa.privateKey, "rsa");
+
+  // ---- ed25519-sha256 (RFC 8463) ----
+  var ed = crypto.generateKeyPairSync("ed25519", {
+    privateKeyEncoding: { type: "pkcs8", format: "pem" },
+    publicKeyEncoding:  { type: "spki",  format: "pem" },
+  });
+  await _runWithAlgorithm("ed25519-sha256", ed.privateKey, "ed25519");
+
+  // ---- bad algorithm rejected at signer build time ----
+  var threw = null;
+  try {
+    b.mail.dkim.create({
+      domain:     "example.com",
+      selector:   "test",
+      privateKey: "not-real",
+      algorithm:  "rsa-sha1",
+    });
+  } catch (e) { threw = e; }
+  check("dkim.create: rejects unsupported algorithm",
+        threw && threw.code && /algorithm/i.test(threw.message));
+
+  await _httpDelete("http://127.0.0.1:8025/api/v1/messages");
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  run().then(
+    function () { console.log("OK — " + helpers.getChecks() + " checks passed"); process.exit(0); },
+    function (e) { console.error("FAIL:", e.stack || e); process.exit(1); }
+  );
+}