@blamejs/blamejs-shop 0.4.30 → 0.4.32

package/lib/vendor/blamejs/test/layer-0-primitives/http-client-stream.test.js

@@ -8,6 +8,9 @@
  *   - downloadStream hash-mismatch refuses, deletes tmp, throws
  *     httpclient/hash-mismatch, audits .refused
  *   - downloadStream HTTP error surfaces without dest write
+ *   - downloadStream stages into an exclusive, no-follow temp file: the
+ *     happy path round-trips and a symlink at the dest is replaced (not
+ *     followed) so the victim it pointed at is left untouched
  *   - uploadMultipartStream POSTs file body via multipart/form-data,
  *     server receives the bytes + the operator-supplied field
  *   - uploadMultipartStream missing-file refuses at config time
@@ -216,6 +219,87 @@ async function testStreamErrorBodyPreserved() {
   });
 }
 
+async function testDownloadTempCreateIsExclusiveNoFollow() {
+  // CWE-377 / CWE-59: downloadStream stages the body into a sibling temp
+  // file created with O_EXCL | O_NOFOLLOW before the atomic rename. Two
+  // properties to assert through the public API:
+  //   (a) the happy path still round-trips (the exclusive create didn't
+  //       break the streaming/rename contract);
+  //   (b) a symlink planted at the DESTINATION is replaced by the rename,
+  //       not followed — the victim the symlink pointed at stays untouched.
+  await _withServer(function (req, res) {
+    res.writeHead(200, { "Content-Type": "application/octet-stream" });
+    res.end(FIXTURE_BYTES);
+  }, async function (baseUrl) {
+    // (a) round-trip into a fresh dest, confirm exactly one final file and
+    //     no leaked temp.
+    var dir  = b.testing.tempDir("httpclient-stream-excl");
+    try {
+      var dest = path.join(dir.path, "release.bin");
+      var result = await b.httpClient.downloadStream({
+        url:              baseUrl + "/payload",
+        dest:             dest,
+        allowedProtocols: b.safeUrl.ALLOW_HTTP_ALL,
+        allowInternal:    true,
+      });
+      check("downloadStream(excl): round-trips bytes",
+            result.bytesWritten === FIXTURE_BYTES.length &&
+            fs.readFileSync(dest).equals(FIXTURE_BYTES));
+      var leftovers = fs.readdirSync(dir.path).filter(function (n) {
+        return n.indexOf("release.bin.tmp-") === 0;
+      });
+      check("downloadStream(excl): no temp file leaked on success",
+            leftovers.length === 0);
+
+      // (b) symlink-at-destination — replaced by the rename, victim safe.
+      var victim = path.join(dir.path, "victim.bin");
+      fs.writeFileSync(victim, "DO NOT OVERWRITE", { mode: 0o600 });
+      var linkDest = path.join(dir.path, "link-dest.bin");
+      var symlinkOk = true;
+      try { fs.symlinkSync(victim, linkDest); }
+      catch (_e) { symlinkOk = false; }  // Windows w/o symlink privilege
+
+      if (symlinkOk) {
+        await b.httpClient.downloadStream({
+          url:              baseUrl + "/payload",
+          dest:             linkDest,
+          allowedProtocols: b.safeUrl.ALLOW_HTTP_ALL,
+          allowInternal:    true,
+        });
+        // Open ONE no-follow fd and take both the type check (fstat) and
+        // the byte read from that same descriptor — no lstat-then-read
+        // against the path, which would be a check-then-use file-system
+        // race (CWE-367). O_NOFOLLOW makes the open fail if linkDest were
+        // still a symlink, so a successful open already proves the rename
+        // replaced the link with a regular file.
+        var linkFd = fs.openSync(linkDest, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW || 0));
+        try {
+          var linkStat = fs.fstatSync(linkFd);
+          check("downloadStream(excl): symlink dest replaced by regular file",
+                linkStat.isFile() && !linkStat.isSymbolicLink());
+          var linkBytes = Buffer.alloc(linkStat.size);
+          var linkGot = 0;
+          while (linkGot < linkStat.size) {
+            var ln = fs.readSync(linkFd, linkBytes, linkGot, linkStat.size - linkGot, null);
+            if (ln === 0) break;
+            linkGot += ln;
+          }
+          check("downloadStream(excl): symlink dest holds downloaded bytes",
+                linkGot === FIXTURE_BYTES.length && linkBytes.equals(FIXTURE_BYTES));
+        } finally {
+          fs.closeSync(linkFd);
+        }
+        check("downloadStream(excl): symlink target (victim) untouched",
+              fs.readFileSync(victim, "utf8") === "DO NOT OVERWRITE");
+      } else {
+        check("downloadStream(excl): symlink-dest case skipped (no privilege)", true);
+      }
+    } finally {
+      dir.cleanup();
+    }
+  });
+}
+
 async function testDownloadBadOpts() {
   var thrown = null;
   try {
@@ -319,6 +403,7 @@ async function run() {
   await testDownloadHashMismatch();
   await testDownloadHttpError();
   await testStreamErrorBodyPreserved();
+  await testDownloadTempCreateIsExclusiveNoFollow();
   await testDownloadBadOpts();
   await testUploadHappyPath();
   await testUploadMissingFile();

package/lib/vendor/blamejs/test/layer-0-primitives/idempotency-key.test.js

@@ -260,14 +260,18 @@ function _mockDb() {
       if (/^CREATE (TABLE|INDEX)/i.test(sql)) {
         return { run: function () { return { changes: 0 }; } };
       }
-      if (/^SELECT (k, )?fingerprint, status_code, headers, body, expires_at FROM /i.test(sql)) {
+      // b.sql emits double-quoted identifiers ("k", "fingerprint", ...);
+      // the patterns tolerate optional quotes so the mock matches the
+      // builder's quote-by-construction output as well as the legacy bare
+      // form.
+      if (/^SELECT "?k"?(, "?fingerprint"?)?.* FROM /i.test(sql)) {
         return {
           get: function (k) {
             var row = data.get(k);
             return row ? Object.assign({ k: k }, row) : undefined;
           },
-          // resealMigrate() also issues `SELECT k, ... FROM <table>`
-          // without a WHERE k = ? clause — walk all rows.
+          // resealMigrate() also issues `SELECT "k", ... FROM <table>`
+          // without a WHERE "k" = ? clause — walk all rows.
           all: function () {
             var out = [];
             data.forEach(function (row, k) {
@@ -277,7 +281,7 @@ function _mockDb() {
           },
         };
       }
-      if (/^INSERT INTO [^ ]+\(k, fingerprint, status_code, headers, body, expires_at\)/i.test(sql)) {
+      if (/^INSERT INTO .*\(\s*"?k"?, "?fingerprint"?, "?status_code"?, "?headers"?, "?body"?, "?expires_at"?\s*\)/i.test(sql)) {
         return {
           run: function (k, fingerprint, statusCode, headers, body, expiresAt) {
             data.set(k, {
@@ -291,7 +295,7 @@ function _mockDb() {
           },
         };
       }
-      if (/^DELETE FROM [^ ]+ WHERE k = \? AND expires_at <= \?/i.test(sql)) {
+      if (/^DELETE FROM .* WHERE "?k"? = \? AND "?expires_at"? <= \?/i.test(sql)) {
         return {
           run: function (k, expiresAt) {
             var row = data.get(k);
@@ -407,7 +411,7 @@ function testDbStoreExpiredRaceNoFreshClobber() {
   var origGet = db.prepare;
   db.prepare = function (sql) {
     var stmt = origGet.call(db, sql);
-    if (/^SELECT (k, )?fingerprint, status_code, headers, body, expires_at FROM /i.test(sql)) {
+    if (/^SELECT "?k"?(, "?fingerprint"?)?.* FROM /i.test(sql)) {
       var realGet = stmt.get;
       return {
         get: function (k) {

package/lib/vendor/blamejs/test/layer-0-primitives/inbox.test.js

@@ -23,16 +23,27 @@ function _makeFakeExternalDb() {
     dialect: "sqlite",
     query: async function (sql, args) {
       var sqlLower = sql.toLowerCase();
-      if (sqlLower.indexOf("insert or ignore") !== -1) {
+      // recordReceive composes through b.sql.upsert(...).doNothing()
+      // .returning(...) -> `INSERT INTO ... ON CONFLICT (...) DO NOTHING
+      // RETURNING "message_id"`. Match either that or the legacy
+      // `INSERT OR IGNORE ... RETURNING` shape. The b.sql column order is
+      // [message_id, source, ...] so args[0] = mid, args[1] = src.
+      var isDedupeInsert = sqlLower.indexOf("insert or ignore") !== -1 ||
+        (sqlLower.indexOf("insert into") !== -1 &&
+         sqlLower.indexOf("on conflict") !== -1 &&
+         sqlLower.indexOf("do nothing") !== -1);
+      if (isDedupeInsert) {
         var src = args[1], mid = args[0];
         var existing = rows.filter(function (r) { return r.source === src && r.message_id === mid; });
         if (existing.length === 0) {
           rows.push({ message_id: mid, source: src, received_at: new Date().toISOString(), processed_at: null, metadata_json: args[2] });
           lastChanges = 1;
-          // RETURNING 1 — mirror the SQLite 3.35+ semantics. Fresh
-          // inserts get one row back; duplicates get zero.
+          // RETURNING — DO NOTHING returns one row on a fresh insert, none
+          // on a duplicate. The migrated path RETURNs "message_id" (the
+          // portable presence sentinel); the freshness check only reads
+          // rows.length, so return the inserted message_id row.
           if (sqlLower.indexOf("returning") !== -1) {
-            return { rows: [{ "1": 1 }] };
+            return { rows: [{ message_id: mid }] };
           }
         } else {
           lastChanges = 0;

package/lib/vendor/blamejs/test/layer-0-primitives/legal-hold.test.js

@@ -112,7 +112,153 @@ async function run() {
   check("cryptoField.clearResidencyForTest is fn",
         typeof b.cryptoField.clearResidencyForTest === "function");
 
+  runPerRowResidencyUnit();
+
+  // ---- #114: legal-hold + subject-restriction PII must be SEALED at rest ----
+  // These local tables hold legal-basis / custodian / ticket-reference free
+  // text that links a data subject to a legal matter — PII at rest. The raw
+  // write path (sql.insert + db.prepare().run()) bypassed the structured
+  // builder's auto-seal, so the values landed in clear despite the schema.
+  var LH_SECRET    = "TOPSECRET-legal-reason-9f3a";
+  var LH_CUSTODIAN = "custodian-secret-7b2c@example.com";
+  holds.place("seal-subj-1", { reason: LH_SECRET, custodian: LH_CUSTODIAN, citation: "SEC-Rule-17a-4" });
+  var lhRaw = JSON.stringify(b.db.prepare("SELECT reason, custodian, citation FROM \"_blamejs_legal_hold\"").all());
+  check("#114 legal-hold reason is sealed at rest (not plaintext)",    lhRaw.indexOf(LH_SECRET) === -1);
+  check("#114 legal-hold custodian is sealed at rest (not plaintext)", lhRaw.indexOf(LH_CUSTODIAN) === -1);
+  var lhGet = holds.get("seal-subj-1");
+  check("#114 legal-hold get() unseals on the consumer path",
+        !!(lhGet && lhGet.reason === LH_SECRET && lhGet.custodian === LH_CUSTODIAN));
+  var lhList = holds.list();
+  check("#114 legal-hold list() unseals on the consumer path",
+        lhList.some(function (h) { return h.reason === LH_SECRET; }));
+
+  var RES_SECRET = "TOPSECRET-restrict-reason-4e1d";
+  b.subject.restrict("seal-subj-2", { on: true, reason: RES_SECRET });
+  var resRaw = JSON.stringify(b.db.prepare("SELECT reason FROM \"_blamejs_subject_restrictions\"").all());
+  check("#114 subject-restriction reason is sealed at rest (not plaintext)", resRaw.indexOf(RES_SECRET) === -1);
+
   await dbHelper.teardownTestDb(tmpDir);
 }
 
+// Returns the thrown error's .code when fn() throws, else null. Mirrors
+// the threw-matching pattern used elsewhere in the layer-0 suite.
+function codeFromThrow(fn) {
+  try { fn(); } catch (e) { return e && e.code; }
+  return null;
+}
+
+// Per-row residency unit surface (declare/get/clear). The cryptoField
+// residency registry is in-process global state, so the block restores
+// it via clearResidencyForTest in a finally so a parallel smoke file
+// running another residency case isn't poisoned.
+function runPerRowResidencyUnit() {
+  b.cryptoField.clearResidencyForTest();
+  try {
+    // ---- valid declare → return shape + getPerRowResidency round-trip ----
+    var decl = b.cryptoField.declarePerRowResidency("residents", {
+      residencyColumn: "dataRegion",
+      allowedTags:     ["eu-west-1", "us-east-1", "global"],
+    });
+    check("declarePerRowResidency returns table",
+          decl.table === "residents");
+    check("declarePerRowResidency returns residencyColumn",
+          decl.residencyColumn === "dataRegion");
+    check("declarePerRowResidency returns allowedTags copy",
+          Array.isArray(decl.allowedTags) && decl.allowedTags.length === 3 &&
+          decl.allowedTags.indexOf("eu-west-1") !== -1);
+
+    var got = b.cryptoField.getPerRowResidency("residents");
+    check("getPerRowResidency round-trips residencyColumn",
+          got && got.residencyColumn === "dataRegion");
+    check("getPerRowResidency round-trips allowedTags",
+          got && got.allowedTags.join(",") === "eu-west-1,us-east-1,global");
+    check("getPerRowResidency returns a defensive allowedTags copy",
+          got.allowedTags !== decl.allowedTags);
+    check("getPerRowResidency on undeclared table → null",
+          b.cryptoField.getPerRowResidency("never-declared") === null);
+
+    // ---- refusals: each asserts the thrown e.code ----
+    check("declarePerRowResidency empty table → table-empty code",
+          codeFromThrow(function () {
+            b.cryptoField.declarePerRowResidency("", {
+              residencyColumn: "dataRegion", allowedTags: ["eu-west-1"],
+            });
+          }) === "crypto-field/per-row-residency-table-empty");
+
+    check("declarePerRowResidency null opts → opts-not-object code",
+          codeFromThrow(function () {
+            b.cryptoField.declarePerRowResidency("residents", null);
+          }) === "crypto-field/per-row-residency-opts-not-object");
+
+    check("declarePerRowResidency bad residencyColumn → column-invalid code",
+          codeFromThrow(function () {
+            b.cryptoField.declarePerRowResidency("residents", {
+              residencyColumn: "", allowedTags: ["eu-west-1"],
+            });
+          }) === "crypto-field/per-row-residency-column-invalid");
+
+    check("declarePerRowResidency empty allowedTags → tags-invalid code",
+          codeFromThrow(function () {
+            b.cryptoField.declarePerRowResidency("residents", {
+              residencyColumn: "dataRegion", allowedTags: [],
+            });
+          }) === "crypto-field/per-row-residency-tags-invalid");
+
+    check("declarePerRowResidency non-array allowedTags → tags-invalid code",
+          codeFromThrow(function () {
+            b.cryptoField.declarePerRowResidency("residents", {
+              residencyColumn: "dataRegion", allowedTags: "eu-west-1",
+            });
+          }) === "crypto-field/per-row-residency-tags-invalid");
+
+    check("declarePerRowResidency non-string tag → tag-empty code",
+          codeFromThrow(function () {
+            b.cryptoField.declarePerRowResidency("residents", {
+              residencyColumn: "dataRegion", allowedTags: ["eu-west-1", 42],
+            });
+          }) === "crypto-field/per-row-residency-tag-empty");
+
+    // Unknown opt key throws via validateOpts (plain Error, no .code) —
+    // assert the message names the unknown key + the primitive.
+    var unknownKeyErr = null;
+    try {
+      b.cryptoField.declarePerRowResidency("residents", {
+        residencyColumn: "dataRegion", allowedTags: ["eu-west-1"], bogusKey: 1,
+      });
+    } catch (e) { unknownKeyErr = e; }
+    check("declarePerRowResidency unknown opt key throws",
+          unknownKeyErr !== null);
+    check("declarePerRowResidency unknown opt key message names the key",
+          unknownKeyErr && /unknown option 'bogusKey'/.test(unknownKeyErr.message) &&
+          /declarePerRowResidency/.test(unknownKeyErr.message));
+
+    // A sealed column can't be the residency tag column — the gate
+    // reads the tag as plaintext before sealRow, and reads return it
+    // verbatim. Declaring a sealed column refuses at declaration time.
+    b.cryptoField.registerTable("sealed_residents", { sealedFields: ["dataRegion"] });
+    check("declarePerRowResidency rejects a sealed column as the tag column",
+          codeFromThrow(function () {
+            b.cryptoField.declarePerRowResidency("sealed_residents", {
+              residencyColumn: "dataRegion", allowedTags: ["eu-west-1"],
+            });
+          }) === "crypto-field/per-row-residency-sealed-conflict");
+    check("declarePerRowResidency accepts a non-sealed column on the same table",
+          b.cryptoField.declarePerRowResidency("sealed_residents", {
+            residencyColumn: "region_tag", allowedTags: ["eu-west-1"],
+          }).residencyColumn === "region_tag");
+
+    // ---- clearResidencyForTest clears the per-row registry too ----
+    b.cryptoField.declarePerRowResidency("residents", {
+      residencyColumn: "dataRegion", allowedTags: ["eu-west-1"],
+    });
+    check("per-row residency present before clear",
+          b.cryptoField.getPerRowResidency("residents") !== null);
+    b.cryptoField.clearResidencyForTest();
+    check("clearResidencyForTest drops the per-row residency registry",
+          b.cryptoField.getPerRowResidency("residents") === null);
+  } finally {
+    b.cryptoField.clearResidencyForTest();
+  }
+}
+
 module.exports = { run: run };

package/lib/vendor/blamejs/test/layer-0-primitives/mail-auth.test.js

@@ -108,6 +108,190 @@ async function testDmarcEvaluateUnaligned() {
         rv.result === "fail" && rv.recommendedAction === "quarantine");
 }
 
+// ---- b.mail.inbound.verify — receiver pipeline (RFC 7489 §6.6) ----
+
+function _inboundDns(records) {
+  return async function (host, type) {
+    if (records[host + "/" + type]) return records[host + "/" + type];
+    var err = new Error("ENOTFOUND"); err.code = "ENOTFOUND"; throw err;
+  };
+}
+
+async function testInboundVerifyAlignedPass() {
+  var dnsLookup = _inboundDns({
+    "example.com/TXT":        [["v=spf1 ip4:192.0.2.0/24 -all"]],
+    "_dmarc.example.com/TXT": [["v=DMARC1; p=reject"]],
+  });
+  var msg = "From: Alice <alice@example.com>\r\nSubject: hi\r\n\r\nhello\r\n";
+  var v = await b.mail.inbound.verify({
+    ip:         "192.0.2.5",
+    helo:       "mail.example.com",
+    mailFrom:   "alice@example.com",
+    message:    Buffer.from(msg),
+    dnsLookup:  dnsLookup,
+    authservId: "mx.local.test",
+  });
+  check("inbound.verify: aligned SPF → dmarc pass + deliver",
+        v.spf.result === "pass" && v.dmarc.result === "pass" &&
+        v.dmarc.recommendedAction === "deliver");
+  check("inbound.verify: From extracted from Buffer message",
+        v.from.count === 1 && v.from.address === "alice@example.com" &&
+        v.from.domain === "example.com");
+  check("inbound.verify: A-R header emitted with authserv-id first",
+        typeof v.authResults === "string" &&
+        v.authResults.indexOf("Authentication-Results: mx.local.test") === 0 &&
+        /spf=pass/.test(v.authResults) && /dmarc=pass/.test(v.authResults));
+  check("inbound.verify: unsigned message verifies dkim none",
+        Array.isArray(v.dkim) && v.dkim[0] && v.dkim[0].result === "none");
+}
+
+async function testInboundVerifySpoofRejected() {
+  var dnsLookup = _inboundDns({
+    "spoofed.example/TXT":        [["v=spf1 -all"]],
+    "_dmarc.spoofed.example/TXT": [["v=DMARC1; p=reject"]],
+  });
+  var msg = "From: ceo@spoofed.example\r\nSubject: urgent\r\n\r\nwire money\r\n";
+  var v = await b.mail.inbound.verify({
+    ip:        "203.0.113.9",
+    helo:      "evil.host",
+    mailFrom:  "ceo@spoofed.example",
+    message:   msg,
+    dnsLookup: dnsLookup,
+  });
+  check("inbound.verify: spoofed sender → spf fail + dmarc fail + reject",
+        v.spf.result === "fail" && v.dmarc.result === "fail" &&
+        v.dmarc.recommendedAction === "reject");
+  check("inbound.verify: no authservId → no A-R header", v.authResults === null);
+}
+
+async function testInboundVerifyFromHeaderDiscipline() {
+  var dnsLookup = _inboundDns({});
+  // Two From fields — the header-duplication spoofing shape.
+  var dup = await b.mail.inbound.verify({
+    ip: "203.0.113.9", helo: "evil.host", mailFrom: "safe@aligned.example",
+    message: "From: safe@aligned.example\r\nFrom: ceo@victim.example\r\n\r\nbody\r\n",
+    dnsLookup: dnsLookup,
+  });
+  check("inbound.verify: duplicated From → permerror + reject (RFC 7489 §6.6.1)",
+        dup.from.count === 2 && dup.dmarc.result === "permerror" &&
+        dup.dmarc.recommendedAction === "reject");
+  // Two angle-addr authors inside one field.
+  var multi = await b.mail.inbound.verify({
+    ip: "203.0.113.9", helo: "evil.host", mailFrom: "safe@aligned.example",
+    message: "From: <safe@aligned.example> <ceo@victim.example>\r\n\r\nbody\r\n",
+    dnsLookup: dnsLookup,
+  });
+  check("inbound.verify: two angle-addrs in one From → permerror + reject",
+        multi.from.count === 2 && multi.dmarc.recommendedAction === "reject");
+  // Bare address list (no angle-addrs) — unparsable rather than
+  // picking one of the authors.
+  var bareList = await b.mail.inbound.verify({
+    ip: "203.0.113.9", helo: "evil.host", mailFrom: "safe@aligned.example",
+    message: "From: a@aligned.example, b@victim.example\r\n\r\nbody\r\n",
+    dnsLookup: dnsLookup,
+  });
+  check("inbound.verify: bare From address-list → no author domain picked + reject",
+        bareList.from.domain === null && bareList.dmarc.recommendedAction === "reject");
+  // No From header at all.
+  var none = await b.mail.inbound.verify({
+    ip: "203.0.113.9", helo: "evil.host", mailFrom: "safe@aligned.example",
+    message: "Subject: headless\r\n\r\nbody\r\n",
+    dnsLookup: dnsLookup,
+  });
+  check("inbound.verify: missing From → permerror + reject",
+        none.from.count === 0 && none.dmarc.result === "permerror" &&
+        none.dmarc.recommendedAction === "reject");
+  // Folded From header unfolds before extraction.
+  var folded = await b.mail.inbound.verify({
+    ip: "203.0.113.9", helo: "evil.host", mailFrom: "x@folded.example",
+    message: "From: Folded Name\r\n <x@folded.example>\r\nSubject: f\r\n\r\nbody\r\n",
+    dnsLookup: dnsLookup,
+  });
+  check("inbound.verify: folded From unfolds (RFC 5322 §2.2.3)",
+        folded.from.count === 1 && folded.from.domain === "folded.example");
+  // Quoted display-names: a literal `<` or comma inside a
+  // quoted-string is display-name text, not a second author — valid
+  // single-author mail must not false-positive into permerror.
+  var quotedLt = await b.mail.inbound.verify({
+    ip: "203.0.113.9", helo: "h.example", mailFrom: "u@quoted.example",
+    message: "From: \"John <Jr.> Smith\" <u@quoted.example>\r\n\r\nbody\r\n",
+    dnsLookup: dnsLookup,
+  });
+  check("inbound.verify: quoted display-name with literal < is one author",
+        quotedLt.from.count === 1 && quotedLt.from.domain === "quoted.example");
+  var quotedComma = await b.mail.inbound.verify({
+    ip: "203.0.113.9", helo: "h.example", mailFrom: "j@comma.example",
+    message: "From: \"Doe, John\" <j@comma.example>\r\n\r\nbody\r\n",
+    dnsLookup: dnsLookup,
+  });
+  check("inbound.verify: quoted display-name with comma is one author",
+        quotedComma.from.count === 1 && quotedComma.from.domain === "comma.example");
+  // Comma-separated angle-addr list — multiple authors refused.
+  var twoAngle = await b.mail.inbound.verify({
+    ip: "203.0.113.9", helo: "evil.host", mailFrom: "safe@aligned.example",
+    message: "From: <safe@aligned.example>, Boss <ceo@victim.example>\r\n\r\nbody\r\n",
+    dnsLookup: dnsLookup,
+  });
+  check("inbound.verify: comma-separated angle-addr list → multiple authors refused",
+        twoAngle.from.count === 2 && twoAngle.dmarc.recommendedAction === "reject");
+}
+
+// RFC 7489 §6.6.2 — a fail verdict computed while SPF or DKIM returned
+// temperror must surface as temperror (the transiently-failed lookup
+// could have produced the aligned pass), so the MX gate defers with
+// 451 instead of permanently refusing a legitimate sender mid-DNS-blip.
+async function testInboundVerifyTemperrorPrecedence() {
+  // SPF TXT lookup fails transiently (SERVFAIL — no ENOTFOUND code);
+  // the DMARC policy lookup itself succeeds with p=reject.
+  var dnsLookup = async function (host, type) {
+    if (host === "_dmarc.blip.example" && type === "TXT") {
+      return [["v=DMARC1; p=reject"]];
+    }
+    throw new Error("SERVFAIL");
+  };
+  var v = await b.mail.inbound.verify({
+    ip:        "203.0.113.9",
+    helo:      "mail.blip.example",
+    mailFrom:  "news@blip.example",
+    message:   "From: news@blip.example\r\nSubject: hi\r\n\r\nhello\r\n",
+    dnsLookup: dnsLookup,
+  });
+  check("inbound.verify: SPF temperror under p=reject → dmarc temperror, not fail",
+        v.spf.result === "temperror" && v.dmarc.result === "temperror" &&
+        v.dmarc.recommendedAction !== "reject");
+  // A pass stands regardless of the other authenticator's temperror:
+  // aligned DKIM pass + SPF temperror is still a DMARC pass.
+  var dnsLookup2 = async function (host, type) {
+    if (host === "_dmarc.blip.example" && type === "TXT") {
+      return [["v=DMARC1; p=reject"]];
+    }
+    throw new Error("SERVFAIL");
+  };
+  var v2 = await b.mail.dmarc.evaluate({
+    from:      "news@blip.example",
+    spf:       { result: "temperror", domain: "blip.example" },
+    dkim:      [{ result: "pass", domain: "blip.example" }],
+    dnsLookup: dnsLookup2,
+  });
+  check("dmarc.evaluate: aligned DKIM pass beats SPF temperror (pass stands)",
+        v2.result === "pass" && v2.recommendedAction === "deliver");
+}
+
+async function testInboundVerifyValidation() {
+  var e1 = null;
+  try { await b.mail.inbound.verify({ message: "x" }); } catch (e) { e1 = e; }
+  check("inbound.verify: missing ip refused", e1 !== null);
+  var e2 = null;
+  try { await b.mail.inbound.verify({ ip: "203.0.113.9", message: "" }); } catch (e) { e2 = e; }
+  check("inbound.verify: empty message refused",
+        e2 && /inbound-bad-message/.test(e2.code || ""));
+  var e3 = null;
+  try {
+    await b.mail.inbound.verify({ ip: "203.0.113.9", message: "From: a@b.c\r\n\r\nx", bogus: 1 });
+  } catch (e) { e3 = e; }
+  check("inbound.verify: unknown opt refused (config-time)", e3 !== null);
+}
+
 async function testArcVerifyMissing() {
   var msg = "ARC-Seal: i=1; a=rsa-sha256; cv=none; d=example.com; s=arc; b=AAAA\r\n" +
             "From: alice@example.com\r\n\r\nbody\r\n";
@@ -1214,6 +1398,11 @@ async function run() {
   await testDmarcEvaluateUnaligned();
   await testDmarcEvaluateOrgDomainViaPsl();
   await testDmarcEvaluateNpPolicy();
+  await testInboundVerifyAlignedPass();
+  await testInboundVerifySpoofRejected();
+  await testInboundVerifyFromHeaderDiscipline();
+  await testInboundVerifyTemperrorPrecedence();
+  await testInboundVerifyValidation();
   await testArcVerifyMissing();
   await testArcVerifyNone();
   await testArcVerifyBadSignatures();

package/lib/vendor/blamejs/test/layer-0-primitives/mail-journal.test.js

@@ -162,7 +162,9 @@ function testSealUnsealRoundTrip() {
         };
         return [];
       }
-      if (/SELECT.*FROM.*WHERE journal_id = \?/.test(sql)) {
+      // b.sql quotes identifiers ("journal_id"); match the quoted or
+      // bare column form so this fake works against the composed SQL.
+      if (/SELECT[\s\S]*FROM[\s\S]*WHERE "?journal_id"? = \?/.test(sql)) {
         return insertedRow ? [insertedRow] : [];
       }
       return [];