@blamejs/blamejs-shop 0.3.56 → 0.3.58

package/lib/vendor/blamejs/test/layer-0-primitives/federation-vc-suite.test.js

@@ -5,7 +5,8 @@
  *   - b.auth.saml          (sp.buildAuthnRequest, sp.verifyResponse signature path)
  *   - b.auth.openidFederation (entity statement parse + verify, metadata-policy operators)
  *   - b.auth.oid4vp        (DCQL validator + matcher)
- *   - b.auth.oid4vci       (issuer config validation, metadata, offer creation shape)
+ *   - b.auth.oid4vci       (issuer config validation, metadata, offer creation shape,
+ *                           kid-only proof resolution via resolveKid)
  *   - b.auth.ciba          (client.create validation + binding-message rules)
  *   - b.auth.sdJwtVc       (key_attestation header surfaces through present)
  *   - b.session.isAnonymous + b.session.create({ anonymous: true })
@@ -281,6 +282,124 @@ function testOid4vciIssuerConfig() {
   check("OID4VCI: metadata has configurations",        !!meta.credential_configurations_supported["id-card-1"]);
 }
 
+// ---- OID4VCI kid-only proof via resolveKid ---------------------------
+
+// Build a holder-signed openid4vci-proof+jwt with a `kid` header and no
+// inline `jwk` (the EUDI-Wallet attested-key shape). ES256 over the
+// holder EC key.
+function _b64url(buf) {
+  return Buffer.from(buf).toString("base64url");
+}
+function _signKidProof(holderPrivKey, kid, aud, nonce) {
+  var header  = { typ: "openid4vci-proof+jwt", alg: "ES256", kid: kid };
+  var payload = { aud: aud, nonce: nonce, iat: Math.floor(Date.now() / 1000) };
+  var signingInput = _b64url(JSON.stringify(header)) + "." + _b64url(JSON.stringify(payload));
+  var sig = nodeCrypto.sign("sha256", Buffer.from(signingInput, "ascii"),
+    { key: holderPrivKey, dsaEncoding: "ieee-p1363" });
+  return signingInput + "." + _b64url(sig);
+}
+
+async function _runIssuanceWithProof(issuerOpts, proofForNonce) {
+  var captured = { holderKey: null };
+  var iss = b.auth.oid4vci.issuer.create(Object.assign({
+    credentialIssuerUrl: "https://issuer.example",
+    credentialEndpoint:  "https://issuer.example/credential",
+    tokenEndpoint:       "https://issuer.example/token",
+    sdJwtIssuer:         { issue: async function (a) { captured.holderKey = a.holderKey; return { token: "fake-sd-jwt" }; } },
+    supportedCredentials: {
+      "id-card-1": { format: "vc+sd-jwt", vct: "https://example.com/vct/identity",
+                     claims: { given_name: {} } },
+    },
+  }, issuerOpts));
+  var offer  = await iss.createCredentialOffer({ subject: "user-7", credentialIds: ["id-card-1"] });
+  var tokens = await iss.exchangePreAuthorizedCode({ preAuthCode: offer.preAuthCode });
+  var rv = await iss.issueCredential({
+    accessToken:          tokens.access_token,
+    credentialIdentifier: "id-card-1",
+    proof:                proofForNonce(tokens.c_nonce),
+    claims:               { given_name: "Alice" },
+  });
+  return { rv: rv, captured: captured };
+}
+
+async function testOid4vciKidResolver() {
+  var holderKp = nodeCrypto.generateKeyPairSync("ec", { namedCurve: "P-256" });
+  var holderPubJwk = holderKp.publicKey.export({ format: "jwk" });
+  var aud = "https://issuer.example";
+
+  // Config-time: a non-function resolveKid is refused at create().
+  var threw = false;
+  try {
+    b.auth.oid4vci.issuer.create({
+      credentialIssuerUrl: aud, credentialEndpoint: aud + "/credential", tokenEndpoint: aud + "/token",
+      sdJwtIssuer: { issue: async function () { return { token: "x" }; } },
+      supportedCredentials: { "id-card-1": { format: "vc+sd-jwt", vct: "https://x" } },
+      resolveKid: "not-a-function",
+    });
+  } catch (e) { threw = /resolveKid.*must be a function/.test(e.message); }
+  check("OID4VCI: non-function resolveKid refused at config time", threw);
+
+  // kid-only proof with a matching resolveKid → verifies + binds cnf.
+  var resolved = await _runIssuanceWithProof(
+    { resolveKid: function (kid) { return kid === "holder-key-1" ? holderPubJwk : null; } },
+    function (nonce) { return _signKidProof(holderKp.privateKey, "holder-key-1", aud, nonce); });
+  check("OID4VCI: kid-only proof with resolveKid issues credential",
+        resolved.rv && resolved.rv.credential === "fake-sd-jwt");
+  check("OID4VCI: resolved holder key bound to cnf",
+        resolved.captured.holderKey && resolved.captured.holderKey.x === holderPubJwk.x);
+
+  // resolveKid may return a node:crypto KeyObject (exported to JWK for cnf).
+  var resolvedKo = await _runIssuanceWithProof(
+    { resolveKid: function () { return holderKp.publicKey; } },
+    function (nonce) { return _signKidProof(holderKp.privateKey, "holder-key-1", aud, nonce); });
+  check("OID4VCI: resolveKid KeyObject return verifies + exports cnf JWK",
+        resolvedKo.captured.holderKey && resolvedKo.captured.holderKey.kty === "EC");
+
+  // kid-only proof with NO resolveKid configured → clear refusal (back-compat).
+  threw = false;
+  try {
+    await _runIssuanceWithProof(
+      {},
+      function (nonce) { return _signKidProof(holderKp.privateKey, "holder-key-1", aud, nonce); });
+  } catch (e) { threw = /kid-resolver-not-supported/.test(e.code) || /resolveKid/.test(e.message); }
+  check("OID4VCI: kid-only proof without resolveKid still refused", threw);
+
+  // resolveKid returns a WRONG key (different holder) → signature fails cleanly.
+  var otherKp = nodeCrypto.generateKeyPairSync("ec", { namedCurve: "P-256" });
+  threw = false;
+  try {
+    await _runIssuanceWithProof(
+      { resolveKid: function () { return otherKp.publicKey.export({ format: "jwk" }); } },
+      function (nonce) { return _signKidProof(holderKp.privateKey, "holder-key-1", aud, nonce); });
+  } catch (e) { threw = /proof-bad-signature|signature verification failed/.test(e.message); }
+  check("OID4VCI: resolveKid wrong key fails signature verification", threw);
+
+  // resolveKid returns garbage (no key) → clean refusal, no crash.
+  threw = false;
+  try {
+    await _runIssuanceWithProof(
+      { resolveKid: function () { return null; } },
+      function (nonce) { return _signKidProof(holderKp.privateKey, "holder-key-1", aud, nonce); });
+  } catch (e) { threw = /kid-unresolved/.test(e.code) || /returned no key/.test(e.message); }
+  check("OID4VCI: resolveKid returning no key refused cleanly", threw);
+
+  // resolveKid that THROWS → wrapped as a stable AuthError code, not an
+  // unhandled rejection. The resolver is operator code, so its own
+  // message is allowed through for operator debugging.
+  threw = false;
+  var isAuthErr = false;
+  try {
+    await _runIssuanceWithProof(
+      { resolveKid: function () { throw new Error("resolver-backend-down"); } },
+      function (nonce) { return _signKidProof(holderKp.privateKey, "holder-key-1", aud, nonce); });
+  } catch (e) {
+    threw = /kid-resolver-failed/.test(e.code) || /resolveKid threw/.test(e.message);
+    isAuthErr = e instanceof b.frameworkError.AuthError;
+  }
+  check("OID4VCI: resolveKid throwing yields kid-resolver-failed", threw);
+  check("OID4VCI: resolveKid failure is a typed AuthError", isAuthErr);
+}
+
 // ---- CIBA client config ----------------------------------------------
 
 function testCibaConfig() {
@@ -440,6 +559,7 @@ async function run() {
   testFederationParseAndPolicy();
   testDcqlMatch();
   testOid4vciIssuerConfig();
+  await testOid4vciKidResolver();
   testCibaConfig();
   await testSdJwtKeyAttestationStorage();
   await testAnonymousSessions();

package/lib/vendor/blamejs/test/layer-0-primitives/guard-email.test.js

@@ -93,6 +93,19 @@ function testGuardEmailMixedScript() {
         rv.issues.some(function (i) { return i.kind === "mixed-script-domain"; }));
 }
 
+function testGuardEmailUnicodeLocalPartRejected() {
+  // Unicode local-part (RFC 6531 SMTPUTF8 / EAI) is NOT accepted — the
+  // local-part is ASCII atext only (RFC 5321 §4.1.2 / RFC 5322 §3.2.3).
+  // Build the accented codepoint programmatically so the source stays
+  // pure ASCII (no attack characters as literals). U+00E9 = "e acute".
+  var local = "u" + String.fromCodePoint(0x00e9) + "ser";
+  var rv = b.guardEmail.validateAddress(local + "@example.com", { profile: "strict" });
+  check("unicode local-part not accepted (no RFC 6531 EAI mailbox)",
+        rv.ok === false);
+  check("unicode local-part surfaces as address-syntax (ASCII-only contract)",
+        rv.issues.some(function (i) { return i.kind === "address-syntax"; }));
+}
+
 function testGuardEmailSyntaxReject() {
   var rv = b.guardEmail.validateAddress("not an email", { profile: "strict" });
   check("malformed address → multi-at or address-syntax issue",
@@ -218,6 +231,7 @@ async function run() {
   testGuardEmailAddressComment();
   testGuardEmailPunycode();
   testGuardEmailMixedScript();
+  testGuardEmailUnicodeLocalPartRejected();
   testGuardEmailSyntaxReject();
   testGuardEmailBareLfSmuggling();
   testGuardEmailCrlfHeaderInjection();

package/lib/vendor/blamejs/test/layer-0-primitives/http-client-stream.test.js

@@ -164,6 +164,58 @@ async function testDownloadHttpError() {
   });
 }
 
+async function testStreamErrorBodyPreserved() {
+  // A streamed (responseMode "stream") non-2xx must surface a bounded prefix
+  // of the error body on the thrown error instead of draining it to nothing,
+  // so the caller can read the problem+json / encrypted error detail.
+  await _withServer(function (req, res) {
+    res.writeHead(403, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ error: "forbidden", detail: "stream-error-detail" }));
+  }, async function (baseUrl) {
+    var thrown = null;
+    try {
+      await b.httpClient.request({
+        url:              baseUrl + "/x",
+        method:           "GET",
+        responseMode:     "stream",
+        allowedProtocols: b.safeUrl.ALLOW_HTTP_ALL,
+        allowInternal:    true,
+      });
+    } catch (e) { thrown = e; }
+    check("stream non-2xx: threw HTTP_ERROR",       thrown != null && thrown.code === "HTTP_ERROR");
+    check("stream non-2xx: message names the status", thrown && /403/.test(thrown.message));
+    check("stream non-2xx: err.body is a Buffer",   thrown && Buffer.isBuffer(thrown.body));
+    check("stream non-2xx: err.body carries detail",
+          thrown && thrown.body && /stream-error-detail/.test(thrown.body.toString("utf8")));
+  });
+
+  // A large (> cap) error body must reject promptly with a bounded prefix —
+  // it must NOT leave the request promise pending until the whole body
+  // drains to close (if it did, this test would hang past the file timeout).
+  var BODY_LEN = 50003;
+  await _withServer(function (req, res) {
+    res.writeHead(500, { "Content-Type": "text/plain" });
+    res.end("E".repeat(BODY_LEN) + "TAIL-MARKER");
+  }, async function (baseUrl) {
+    var thrown = null;
+    try {
+      await b.httpClient.request({
+        url:              baseUrl + "/big",
+        method:           "GET",
+        responseMode:     "stream",
+        allowedProtocols: b.safeUrl.ALLOW_HTTP_ALL,
+        allowInternal:    true,
+      });
+    } catch (e) { thrown = e; }
+    check("stream large-error: threw HTTP_ERROR (did not hang)",
+          thrown != null && thrown.code === "HTTP_ERROR");
+    check("stream large-error: body bounded well below sent size",
+          thrown && thrown.body && thrown.body.length > 0 && thrown.body.length < BODY_LEN);
+    check("stream large-error: tail beyond cap was dropped",
+          thrown && thrown.body && thrown.body.toString("utf8").indexOf("TAIL-MARKER") === -1);
+  });
+}
+
 async function testDownloadBadOpts() {
   var thrown = null;
   try {
@@ -266,6 +318,7 @@ async function run() {
   await testDownloadExpectedHashMatch();
   await testDownloadHashMismatch();
   await testDownloadHttpError();
+  await testStreamErrorBodyPreserved();
   await testDownloadBadOpts();
   await testUploadHappyPath();
   await testUploadMissingFile();

package/lib/vendor/blamejs/test/layer-0-primitives/mail-auth.test.js

@@ -682,6 +682,90 @@ function testDmarcRuaGunzipBombDistinguished() {
         threw && /dmarc-rua-gunzip-bomb/.test(threw.code || ""));
 }
 
+function testDmarcRuaBuildRoundTrip() {
+  // RFC 7489 Appendix C — buildAggregateReport is the inverse of
+  // parseAggregateReport; a shaped report serialized to XML and re-
+  // parsed MUST deep-equal the input (the parser adds a derived
+  // `totals` convenience field, removed before comparison).
+  var shaped = {
+    reportMetadata: {
+      orgName: "reporter.example",
+      email: "dmarc@reporter.example",
+      reportId: "rpt-12345",
+      extraContact: null,
+      dateRange: { begin: 1700000000, end: 1700086400 },
+    },
+    policyPublished: {
+      domain: "example.com", adkim: "r", aspf: "r",
+      p: "reject", sp: "quarantine", pct: 100, fo: null,
+    },
+    records: [
+      {
+        sourceIp: "192.0.2.10", count: 7,
+        dispositions: {
+          disposition: "none", dkim: "pass", spf: "fail",
+          reasons: [{ type: "forwarded", comment: "mailing list" }],
+        },
+        identifiers: { headerFrom: "example.com", envelopeFrom: "example.com", envelopeTo: null },
+        authResults: {
+          dkim: [{ domain: "example.com", selector: "sel1", result: "pass", humanResult: null }],
+          spf: [{ domain: "example.com", result: "fail", scope: "mfrom" }],
+        },
+      },
+      {
+        // header_from carries XML metacharacters (a spoofed identifier
+        // observed in the wild) — escaping MUST survive the round-trip.
+        sourceIp: "203.0.113.5", count: 3,
+        dispositions: { disposition: "quarantine", dkim: "fail", spf: "fail", reasons: [] },
+        identifiers: { headerFrom: "evil<&>\".example.com", envelopeFrom: null, envelopeTo: null },
+        authResults: { dkim: [], spf: [{ domain: "spoof.example", result: "fail", scope: "mfrom" }] },
+      },
+    ],
+  };
+  var xml = b.mail.dmarc.buildAggregateReport(shaped);
+  check("dmarc.buildAggregateReport returns an XML string with <feedback> root",
+        typeof xml === "string" && /^<\?xml/.test(xml) && xml.indexOf("<feedback>") !== -1);
+  // The injected metacharacters must be entity-escaped in the wire form.
+  check("dmarc.buildAggregateReport escapes XML metacharacters",
+        xml.indexOf("evil<&>") === -1 && xml.indexOf("&lt;&amp;&gt;") !== -1);
+
+  var back = b.mail.dmarc.parseAggregateReport(xml);
+  delete back.totals;
+  check("dmarc.buildAggregateReport round-trips through parseAggregateReport",
+        JSON.stringify(back) === JSON.stringify(shaped));
+
+  // Optional gzip path mirrors the parser's gzip auto-detect.
+  var gz = b.mail.dmarc.buildAggregateReport(shaped, { gzip: true });
+  check("dmarc.buildAggregateReport({gzip:true}) → gzip Buffer",
+        Buffer.isBuffer(gz) && gz[0] === 0x1f && gz[1] === 0x8b);
+  var back2 = b.mail.dmarc.parseAggregateReport(gz, { contentType: "application/gzip" });
+  delete back2.totals;
+  check("dmarc.buildAggregateReport(gzip) round-trips",
+        JSON.stringify(back2) === JSON.stringify(shaped));
+}
+
+function testDmarcRuaBuildBadInput() {
+  // Config-time tier — a malformed report shape THROWS so the operator
+  // catches it before mailing the report to a peer.
+  var cases = [
+    { arg: null,                                              re: /object/ },
+    { arg: { policyPublished: {}, records: [] },             re: /reportMetadata/ },
+    { arg: { reportMetadata: {}, records: [] },              re: /policyPublished/ },
+    { arg: { reportMetadata: {}, policyPublished: {} },      re: /records/ },
+    { arg: { reportMetadata: {}, policyPublished: {},
+             records: [{ sourceIp: "1.2.3.4", count: "notnum",
+                         dispositions: {}, identifiers: {}, authResults: {} }] },
+      re: /finite integer/ },
+  ];
+  for (var i = 0; i < cases.length; i += 1) {
+    var threw = null;
+    try { b.mail.dmarc.buildAggregateReport(cases[i].arg); }
+    catch (e) { threw = e; }
+    check("dmarc.buildAggregateReport rejects bad input #" + i,
+          threw && cases[i].re.test(threw.message || ""));
+  }
+}
+
 async function testIprevValidatesPtrShape() {
   // MAIL-50 — PTR result MUST be a valid DNS-name shape (LDH labels,
   // 1..63 octets, total 1..253 octets). Synthesize via a mocked
@@ -796,19 +880,104 @@ async function testSpfMechanismMxOverLimit() {
         rv.result === "permerror" && /caps at 10/.test(rv.explanation || ""));
 }
 
-async function testSpfMechanismExistsRemainsDeferred() {
+async function testSpfMechanismExists() {
+  // RFC 7208 §5.7 + §7 — `exists:<macro-string>` resolves the expanded
+  // domain; a present A record matches. The macro `%{l}` expands to the
+  // sender local-part, so `exists:%{l}.spf.example.com` queries
+  // `alice.spf.example.com`.
+  var queried = [];
   var dnsLookup = async function (host, type) {
     if (host === "example.com" && type === "TXT") {
       return [["v=spf1 exists:%{l}.spf.example.com -all"]];
     }
+    if (type === "A") {
+      queried.push(host);
+      if (host === "alice.spf.example.com") return ["127.0.0.2"];
+    }
     var err = new Error("ENOTFOUND"); err.code = "ENOTFOUND"; throw err;
   };
   var rv = await b.mail.spf.verify({
     ip: "192.0.2.5", mailFrom: "alice@example.com", dnsLookup: dnsLookup,
   });
-  // exists deferred — surface as permerror with explicit explanation.
-  check("spf.verify(exists, deferred) → permerror with §5.7 cite",
-        rv.result === "permerror" && /5\.7/.test(rv.explanation || ""));
+  check("spf.verify(exists:%{l}..., A present) -> pass + expanded qname",
+        rv.result === "pass" && queried.some(function (q) { return q === "alice.spf.example.com"; }));
+
+  // No A record at the expanded target -> exists misses -> falls to -all.
+  var dnsMiss = async function (host, type) {
+    if (host === "example.com" && type === "TXT") {
+      return [["v=spf1 exists:%{l}.spf.example.com -all"]];
+    }
+    var err = new Error("ENOTFOUND"); err.code = "ENOTFOUND"; throw err;
+  };
+  var rv2 = await b.mail.spf.verify({
+    ip: "192.0.2.5", mailFrom: "alice@example.com", dnsLookup: dnsMiss,
+  });
+  check("spf.verify(exists, no A at target) -> fail (-all)", rv2.result === "fail");
+}
+
+async function testSpfMacroExpansionExistsIrV() {
+  // RFC 7208 §7.1-§7.4 — `%{ir}.%{v}._spf.%{d}` is the canonical per-IP
+  // exists query. For 192.0.2.10: %{ir} reverses the dotted IP to
+  // "10.2.0.192", %{v} -> "in-addr", %{d} -> the current domain.
+  // Expected qname: 10.2.0.192.in-addr._spf.example.com.
+  var queried = null;
+  var dnsLookup = async function (host, type) {
+    if (host === "example.com" && type === "TXT") {
+      return [["v=spf1 exists:%{ir}.%{v}._spf.%{d} -all"]];
+    }
+    if (type === "A") {
+      queried = host;
+      if (host === "10.2.0.192.in-addr._spf.example.com") return ["127.0.0.2"];
+    }
+    var err = new Error("ENOTFOUND"); err.code = "ENOTFOUND"; throw err;
+  };
+  var rv = await b.mail.spf.verify({
+    ip: "192.0.2.10", mailFrom: "alice@example.com",
+    helo: "mta.example.com", dnsLookup: dnsLookup,
+  });
+  check("spf macro %{ir}.%{v}._spf.%{d} expands correctly",
+        queried === "10.2.0.192.in-addr._spf.example.com" && rv.result === "pass");
+}
+
+async function testSpfMacroBadSyntaxPermerror() {
+  // RFC 7208 §7.1 — malformed macro syntax MUST permerror.
+  var shapes = [
+    { rec: "v=spf1 exists:%{z} -all",   re: /7\.2/ },     // unknown letter
+    { rec: "v=spf1 exists:%{i.x -all",  re: /closing/ },  // no closing brace
+    { rec: "v=spf1 exists:%q -all",     re: /invalid/ },  // bad escape
+    { rec: "v=spf1 exists:%{} -all",    re: /empty/ },    // empty macro
+  ];
+  for (var i = 0; i < shapes.length; i += 1) {
+    var rec = shapes[i].rec;
+    var dns = (function (r) {
+      return async function (host, type) {
+        if (host === "example.com" && type === "TXT") return [[r]];
+        var err = new Error("ENOTFOUND"); err.code = "ENOTFOUND"; throw err;
+      };
+    }(rec));
+    var rv = await b.mail.spf.verify({
+      ip: "192.0.2.1", mailFrom: "bob@example.com", dnsLookup: dns,
+    });
+    check("spf.verify(" + JSON.stringify(rec) + ") -> permerror (bad macro)",
+          rv.result === "permerror" && shapes[i].re.test(rv.explanation || ""));
+  }
+}
+
+async function testSpfExistsRespectsLookupLimit() {
+  // RFC 7208 §4.6.4 — exists A queries count toward the 10-lookup and
+  // 2-void ceilings; a chain of exists: misses MUST permerror rather
+  // than amplifying resolver work without bound.
+  var dns = async function (host, type) {
+    if (type === "TXT" && host === "example.com") {
+      return [["v=spf1 exists:a.%{d} exists:b.%{d} exists:c.%{d} -all"]];
+    }
+    var err = new Error("ENODATA"); err.code = "ENODATA"; throw err;
+  };
+  var rv = await b.mail.spf.verify({
+    ip: "192.0.2.1", mailFrom: "bob@example.com", dnsLookup: dns,
+  });
+  check("spf.verify(exists chain) -> permerror (RFC 7208 §4.6.4 void cap)",
+        rv.result === "permerror" && /void-lookup limit/.test(rv.explanation || ""));
 }
 
 async function testSpfMechanismEmptyDualCidrRefused() {
@@ -860,7 +1029,10 @@ async function run() {
   await testSpfMechanismADualCidr();
   await testSpfMechanismMx();
   await testSpfMechanismMxOverLimit();
-  await testSpfMechanismExistsRemainsDeferred();
+  await testSpfMechanismExists();
+  await testSpfMacroExpansionExistsIrV();
+  await testSpfMacroBadSyntaxPermerror();
+  await testSpfExistsRespectsLookupLimit();
   await testSpfMechanismEmptyDualCidrRefused();
   await testSpfMechanismPtrRemainsDeferred();
   testDmarcParse();
@@ -898,6 +1070,8 @@ async function run() {
   await testDmarcPctSamplingDeterministic();
   await testDmarcAlignmentUsesPsl();
   testDmarcRuaGunzipBombDistinguished();
+  testDmarcRuaBuildRoundTrip();
+  testDmarcRuaBuildBadInput();
   await testIprevValidatesPtrShape();
   await testArcHeaderSourceOrder();
 }

package/lib/vendor/blamejs/test/layer-0-primitives/mail-send-deliver.test.js

@@ -60,6 +60,50 @@ function testFactoryRefusesBadOpts() {
   });
   check("dsn without onPermanentFailure → DeliverError",
     e5 && e5.code === "deliver/bad-dsn-callback");
+
+  var e6 = threw(function () {
+    b.mail.send.deliver({ hostname: "m.example", port: 70000 }); // out of [1,65535]
+  });
+  check("out-of-range port → DeliverError",
+    e6 && e6.code === "deliver/bad-port");
+
+  var e7 = threw(function () {
+    b.mail.send.deliver({ hostname: "m.example", port: 0 });     // 0 is not a connect port
+  });
+  check("port 0 → DeliverError (connect port must be >=1)",
+    e7 && e7.code === "deliver/bad-port");
+}
+
+// ---- Submission/smarthost port ----
+
+// The default is IANA SMTP 25; an operator routing through a submission
+// relay sets port 587 (RFC 6409) / 465 (RFC 8314). The configured port
+// must reach the transport factory.
+async function testPortReachesTransport() {
+  var ports = [];
+  var fakeResolver = {
+    queryMx: async function (domain) {
+      return [{ exchange: "mx1." + domain, priority: 10 }];
+    },
+  };
+  var fakeTransport = function (opts) {
+    ports.push(opts.port);
+    return { send: async function () { return { ok: true, code: 250 }; } };
+  };
+
+  var deliverDefault = b.mail.send.deliver({
+    hostname: "mta1.example.com", resolver: fakeResolver,
+    policy: { mtaSts: "off", dane: "off" }, transportFactory: fakeTransport, audit: false,
+  });
+  await deliverDefault({ from: "ops@example.com", to: ["a@recipient.com"], rfc822: Buffer.from("hi") });
+  check("port: default is 25 when unset", ports[ports.length - 1] === 25);
+
+  var deliver587 = b.mail.send.deliver({
+    hostname: "mta1.example.com", resolver: fakeResolver, port: 587,
+    policy: { mtaSts: "off", dane: "off" }, transportFactory: fakeTransport, audit: false,
+  });
+  await deliver587({ from: "ops@example.com", to: ["b@recipient.com"], rfc822: Buffer.from("hi") });
+  check("port: configured 587 reaches the transport", ports[ports.length - 1] === 587);
 }
 
 // ---- Envelope shape validation ----
@@ -324,6 +368,7 @@ async function run() {
   await testTransientDefersPermanentFails();
   await testNullMx();
   await testMxFailover();
+  await testPortReachesTransport();
 }
 
 module.exports = { run: run };

package/lib/vendor/blamejs/test/layer-0-primitives/oauth-callback.test.js

@@ -4,12 +4,61 @@
  *   - parseCallback   (RFC 9207 AS Issuer Identifier validation)
  *   - parseJarmResponse (OAuth 2.0 JARM signed authorization response)
  *   - refreshAccessToken seen() callback (RFC 9700 §4.13 / OAuth 2.1 §6.1)
+ *   - authorizationUrl PKCE-downgrade refusal (RFC 9700 §4.13 / RFC 7636)
  */
 
+var http    = require("node:http");
 var helpers = require("../helpers");
 var b       = helpers.b;
 var check   = helpers.check;
 
+// Minimal OIDC discovery server: serves /.well-known/openid-configuration
+// with operator-chosen code_challenge_methods_supported so the PKCE
+// downgrade gate runs against a real discovery round-trip.
+function _spawnDiscoveryServer(methods) {
+  var issuerHolder = { value: null };
+  var server = http.createServer(function (req, res) {
+    var u = new URL(req.url, "http://localhost");
+    if (u.pathname !== "/.well-known/openid-configuration") { res.writeHead(404); res.end(); return; }
+    var doc = {
+      issuer:                 issuerHolder.value,
+      authorization_endpoint: issuerHolder.value + "/auth",
+      token_endpoint:         issuerHolder.value + "/token",
+      jwks_uri:               issuerHolder.value + "/jwks",
+    };
+    if (methods !== undefined) doc.code_challenge_methods_supported = methods;
+    var body = JSON.stringify(doc);
+    res.writeHead(200, { "Content-Type": "application/json", "Content-Length": Buffer.byteLength(body) });
+    res.end(body);
+  });
+  server._issuerHolder = issuerHolder;
+  return server;
+}
+
+async function _pkceDowngradeCase(methods, expectRefusal, label) {
+  var server = _spawnDiscoveryServer(methods);
+  await new Promise(function (r) { server.listen(0, "127.0.0.1", r); });
+  var issuer = "http://127.0.0.1:" + server.address().port;
+  server._issuerHolder.value = issuer;
+  try {
+    var oa = b.auth.oauth.create({
+      issuer:        issuer,
+      clientId:      "rp-dl",
+      redirectUri:   "https://rp.example/cb",
+      isOidc:        true,
+      allowHttp:     true,
+      allowInternal: true,
+    });
+    var err = null;
+    try { await oa.authorizationUrl(); } catch (e) { err = e; }
+    if (expectRefusal) {
+      check(label, err !== null && err.code === "auth-oauth/pkce-downgrade");
+    } else {
+      check(label, err === null);
+    }
+  } finally { server.close(); }
+}
+
 async function run() {
   var oauth = b.auth.oauth.create({
     issuer:        "https://idp.example",
@@ -60,6 +109,37 @@ async function run() {
     await oauth.refreshAccessToken("rt-1", { seen: async function () { return true; } });
   } catch (e) { threw = /refresh-token-replay/.test(e.code); }
   check("oauth.refreshAccessToken: seen()=true refuses replay",   threw);
+
+  // PKCE downgrade defense (RFC 9700 §4.13 / RFC 7636). An OP whose
+  // discovery metadata advertises code_challenge_methods_supported
+  // without "S256" is refused at authorizationUrl; S256-capable or
+  // field-absent OPs keep working (back-compat).
+  await _pkceDowngradeCase(["plain"], true,
+    "oauth.authorizationUrl: plain-only OP refused (PKCE downgrade)");
+  await _pkceDowngradeCase([], true,
+    "oauth.authorizationUrl: empty methods list refused (no S256)");
+  await _pkceDowngradeCase(["S256"], false,
+    "oauth.authorizationUrl: S256-only OP accepted");
+  await _pkceDowngradeCase(["S256", "plain"], false,
+    "oauth.authorizationUrl: S256+plain OP accepted");
+  await _pkceDowngradeCase(undefined, false,
+    "oauth.authorizationUrl: field-absent OP accepted (back-compat)");
+
+  // Static-endpoint client with no discovery must never gain a network
+  // fetch or a downgrade refusal — the gate only inspects already-
+  // resolved discovery metadata.
+  var oaStatic = b.auth.oauth.create({
+    issuer:                "https://static.example",
+    clientId:              "rp-static",
+    redirectUri:           "https://rp.example/cb",
+    isOidc:                true,
+    authorizationEndpoint: "https://static.example/auth",
+    tokenEndpoint:         "https://static.example/token",
+  });
+  var staticErr = null;
+  try { await oaStatic.authorizationUrl(); } catch (e) { staticErr = e; }
+  check("oauth.authorizationUrl: static endpoints skip discovery (no fetch, no refusal)",
+        staticErr === null);
 }
 
 module.exports = { run: run };