@blamejs/blamejs-shop 0.5.12 → 0.5.13

package/lib/vendor/blamejs/test/layer-0-primitives/mail-dkim.test.js

@@ -353,6 +353,31 @@ async function testDkimVerifyHappyPath() {
   check("verify: warnings array on pass", Array.isArray(rv[0].warnings));
 }
 
+async function testDkimVerifyBareLfMessage() {
+  // A message signed on the CRLF wire but read back from a Unix file /
+  // mbox (CRs stripped) arrives bare-LF. The public verifier must
+  // normalize it to canonical CRLF and verify — not throw an uncaught
+  // dkim/missing-body-separator out of the header/body split. RED before
+  // the _splitHeadersBody LF->CRLF normalization: verify() threw.
+  // Reset the process-local DKIM key cache: a prior test cached a different
+  // key under the same example.com/s1 selector, which would otherwise shadow
+  // this message's key (the cache is consulted before the injected dnsLookup).
+  b.mail.dkim._resetDkimKeyCacheForTest();
+  var kp = _rsaKeypair();
+  var signed = await _signedMessage(kp);
+  var bareLf = signed.replace(/\r\n/g, "\n");
+  var b64 = _spkiPemToB64(kp.publicKey);
+  var dnsLookup = async function () { return [["v=DKIM1; k=rsa; p=" + b64]]; };
+  var threw = null;
+  var rv = null;
+  try { rv = await b.mail.dkim.verify(bareLf, { dnsLookup: dnsLookup }); }
+  catch (e) { threw = e; }
+  check("verify: bare-LF message does not throw", threw === null);
+  check("verify: bare-LF message returns a verdict array", Array.isArray(rv));
+  check("verify: CRLF-signed message transported bare-LF verifies pass",
+        rv && rv[0] && rv[0].result === "pass");
+}
+
 async function testDkimVerifyKeyCacheHit() {
   // Same selector/domain twice → second fetch must hit cache.
   b.mail.dkim._resetDkimKeyCacheForTest();
@@ -798,6 +823,773 @@ async function testArcAmsLTagAppendRefused() {
         rv[0] && rv[0].result === "fail");
 }
 
+// ---- Coverage: uncovered error / adversarial / defensive / option-default
+//      branches (sign + verify). Each drives the REAL b.mail.dkim consumer
+//      path with an injected DNS stub — never real DNS. ----
+
+// Body-hash (relaxed) helper mirroring lib _bodyHashB64 with the default
+// (no l=) path, so an adversarial signature can carry a body-correct bh=
+// and reach the header / key / algorithm guards past the body-hash gate.
+function _relaxedBodyHash(body) {
+  var canon = b.mail.dkim._canonBodyRelaxedForTest(body);
+  return nodeCrypto.createHash("sha256").update(Buffer.from(canon, "utf8")).digest("base64");
+}
+
+// Build a message with an arbitrary DKIM-Signature tag list. Used for the
+// adversarial-verify cases whose verdict is decided BEFORE cryptographic
+// verification (v=, x=/t=, missing d/s, missing bh/b, h= without from) — so
+// the b= value need not be a valid signature.
+function _messageWithSig(tags, body) {
+  return "From: alice@example.com\r\n" +
+         "DKIM-Signature: " + tags.join("; ") + "\r\n" +
+         "\r\n" + (body === undefined ? "Hi\r\n" : body);
+}
+
+// Build a FULLY-VALID relaxed/relaxed single-signature message (h=from)
+// with optional extra tags (t=, x=, l=) folded into the signed content, so
+// the signature verifies and the run reaches _verifySingleSignature's
+// pass path. Mirrors the manual construction the l= tests already use.
+function _buildRelaxedSigned(kp, domain, selector, extraTags, body) {
+  var dkim = b.mail.dkim;
+  body = body === undefined ? "Hello world.\r\n" : body;
+  var bh = _relaxedBodyHash(body);
+  var fromValue = " Alice <alice@" + domain + ">";
+  var tags = ["v=1", "a=rsa-sha256", "c=relaxed/relaxed",
+              "d=" + domain, "s=" + selector, "h=from", "bh=" + bh];
+  if (extraTags) tags = tags.concat(extraTags);
+  tags.push("b=");
+  var unsigned = tags.join("; ");
+  var canonHeaders =
+    dkim._canonHeaderRelaxedForTest("From", fromValue) +
+    dkim._canonHeaderRelaxedForTest("DKIM-Signature", unsigned).replace(/\r\n$/, "");
+  var sig = nodeCrypto.createSign("RSA-SHA256").update(canonHeaders)
+    .sign(kp.privateKey).toString("base64");
+  var finalSig = unsigned.replace(/b=$/, "b=" + sig);
+  return "From:" + fromValue + "\r\n" +
+         "DKIM-Signature: " + finalSig + "\r\n" +
+         "\r\n" + body;
+}
+
+// ---- create() input-shape branches ----
+
+function testDkimCreateInputBranches() {
+  var kp = _rsaKeypair();
+
+  // headersToSign element that isn't a non-empty string → bad-headers.
+  var threw = null;
+  try {
+    b.mail.dkim.create({ domain: "example.com", selector: "s1",
+      privateKey: kp.privateKey, headersToSign: ["from", 123] });
+  } catch (e) { threw = e; }
+  check("create: non-string headersToSign element → bad-headers",
+        threw && /dkim\/bad-headers/.test(threw.code || ""));
+
+  // privateKey of a non-string / non-object type → missing-private-key.
+  threw = null;
+  try {
+    b.mail.dkim.create({ domain: "example.com", selector: "s1", privateKey: 123 });
+  } catch (e) { threw = e; }
+  check("create: numeric privateKey → missing-private-key",
+        threw && /dkim\/missing-private-key/.test(threw.code || ""));
+
+  // privateKey as a Buffer (Buffer.isBuffer branch) → parses + signs.
+  var bufSigner = b.mail.dkim.create({ domain: "example.com", selector: "s1",
+    privateKey: Buffer.from(kp.privateKey, "utf8") });
+  check("create: accepts a Buffer PEM privateKey",
+        typeof bufSigner.sign === "function");
+
+  // privateKey as a pre-built crypto.KeyObject (the non-string, non-Buffer
+  // object branch — used directly without re-parsing).
+  var keyObj = nodeCrypto.createPrivateKey({ key: kp.privateKey, format: "pem" });
+  var koSigner = b.mail.dkim.create({ domain: "example.com", selector: "s1",
+    privateKey: keyObj });
+  var koSigned = koSigner.sign(
+    "From: a@example.com\r\nSubject: t\r\n\r\nbody\r\n");
+  check("create: accepts a crypto.KeyObject privateKey and signs",
+        /^DKIM-Signature: /.test(koSigned));
+
+  // create() with no argument object at all → opts defaults to {} then the
+  // domain guard throws (the opts || {} default branch).
+  threw = null;
+  try { b.mail.dkim.create(); } catch (e) { threw = e; }
+  check("create: no argument → bad-domain",
+        threw && /dkim\/bad-domain/.test(threw.code || ""));
+}
+
+function testDkimSignerAuditDisabled() {
+  // audit:false suppresses the sign-success + missing-header audit emits
+  // (the auditOn === false option-default branch), and signing still works.
+  var kp = _rsaKeypair();
+  var signer = b.mail.dkim.create({
+    domain: "noaudit.example", selector: "na",
+    privateKey: kp.privateKey, audit: false,
+    headersToSign: ["from", "subject", "x-absent-header"],
+  });
+  var signed = signer.sign(
+    "From: a@noaudit.example\r\nSubject: t\r\nDate: Mon, 5 May 2026 12:00:00 +0000\r\n" +
+    "Message-ID: <n@noaudit.example>\r\n\r\nbody\r\n");
+  check("create audit:false → signs with audit emits suppressed",
+        /^DKIM-Signature: /.test(signed));
+}
+
+async function testDkimEd25519VerifyRoundTrip() {
+  // The ed25519-sha256 VERIFY path (RFC 8463): sign then verify against the
+  // published k=ed25519 key. Exercises the ed25519 nodeAlgo=null verify
+  // branch that the RSA round-trips never reach.
+  var kp = _ed25519Keypair();
+  b.mail.dkim._resetDkimKeyCacheForTest();
+  var signer = b.mail.dkim.create({
+    domain: "ed.example", selector: "e1",
+    privateKey: kp.privateKey, algorithm: "ed25519-sha256",
+  });
+  var msg =
+    "From: alice@ed.example\r\nTo: bob@example.org\r\nSubject: Ed\r\n" +
+    "Date: Mon, 5 May 2026 12:00:00 +0000\r\nMessage-ID: <ed@example.com>\r\n\r\nBody\r\n";
+  var signed = signer.sign(msg);
+  var b64 = _spkiPemToB64(kp.publicKey);
+  var rv = await b.mail.dkim.verify(signed,
+    { dnsLookup: async function () { return [["v=DKIM1; k=ed25519; p=" + b64]]; } });
+  check("ed25519 verify: round-trip passes (RFC 8463)",
+        rv[0] && rv[0].result === "pass");
+}
+
+// ---- simple/* canonicalization sign + verify round-trips ----
+
+function testDkimSimpleCanonDirect() {
+  var sb = b.mail.dkim._canonBodySimpleForTest;
+  var rb = b.mail.dkim._canonBodyRelaxedForTest;
+  // simple body: strips trailing empty lines (the while-loop branch).
+  check("simple body: strips trailing empty lines",
+        sb("hi\r\n\r\n\r\n") === "hi\r\n");
+  // simple body: a body with no trailing CRLF gains one.
+  check("simple body: appends missing trailing CRLF",
+        sb("hi") === "hi\r\n");
+  // relaxed body: an all-empty-line body collapses to a bare CRLF.
+  check("relaxed body: all-empty-line body → bare CRLF",
+        rb("\r\n\r\n") === "\r\n");
+}
+
+async function testDkimSimpleCanonRoundTrips() {
+  // relaxed/simple exercises SIMPLE BODY canonicalization on both the sign
+  // and verify sides; the header canon stays relaxed (which unfolds the
+  // folded DKIM-Signature header) so the round-trip is RFC-correct and
+  // passes. This is the legitimate simple-body coverage path.
+  var kpB = _rsaKeypair();
+  b.mail.dkim._resetDkimKeyCacheForTest();
+  var signerB = b.mail.dkim.create({
+    domain: "sbody.example", selector: "sb",
+    privateKey: kpB.privateKey, canonicalization: "relaxed/simple",
+  });
+  var msgB =
+    "From: alice@sbody.example\r\nTo: bob@example.org\r\n" +
+    "Subject: Simple body\r\nDate: Mon, 5 May 2026 12:00:00 +0000\r\n" +
+    "Message-ID: <sb@example.com>\r\n\r\nLine one\r\nLine two\r\n\r\n";
+  var signedB = signerB.sign(msgB);
+  check("relaxed/simple sign: emits c=relaxed/simple",
+        signedB.indexOf("c=relaxed/simple") !== -1);
+  var b64B = _spkiPemToB64(kpB.publicKey);
+  var rvB = await b.mail.dkim.verify(signedB,
+    { dnsLookup: async function () { return [["v=DKIM1; k=rsa; p=" + b64B]]; } });
+  check("relaxed/simple verify: simple-body round-trip passes",
+        rvB[0] && rvB[0].result === "pass");
+
+  // simple HEADER canonicalization (simple/simple, simple/relaxed) drives
+  // the _canonHeaderSimple sign + verify branches. NOTE: the framework
+  // signer signs the UNFOLDED DKIM-Signature tag string, but the wire
+  // header is folded (CRLF+WSP) and simple header canonicalization does not
+  // unfold — so the verifier canonicalizes different bytes than were signed
+  // and the self-verify does NOT pass. This documents current behavior; see
+  // the reported simple-header-canon signature-computation bug.
+  var simpleHeaderCanons = ["simple/simple", "simple/relaxed"];
+  for (var si = 0; si < simpleHeaderCanons.length; si += 1) {
+    var canon = simpleHeaderCanons[si];
+    var kp = _rsaKeypair();
+    b.mail.dkim._resetDkimKeyCacheForTest();
+    var signer = b.mail.dkim.create({
+      domain: "shdr" + si + ".example", selector: "sh" + si,
+      privateKey: kp.privateKey, canonicalization: canon,
+    });
+    var msg =
+      "From: alice@shdr" + si + ".example\r\nTo: bob@example.org\r\n" +
+      "Subject: Simple header\r\nDate: Mon, 5 May 2026 12:00:00 +0000\r\n" +
+      "Message-ID: <sh" + si + "@example.com>\r\n\r\nLine one\r\n";
+    var signed = signer.sign(msg);
+    check("simple-header sign: emits c=" + canon,
+          signed.indexOf("c=" + canon) !== -1);
+    var b64 = _spkiPemToB64(kp.publicKey);
+    var dnsLookup = async function () { return [["v=DKIM1; k=rsa; p=" + b64]]; };
+    var rv = await b.mail.dkim.verify(signed, { dnsLookup: dnsLookup });
+    // Simple header canonicalization signs and verifies the DKIM-Signature
+    // header verbatim (folded, one space after the colon) per RFC 6376 §3.4.1,
+    // so a folded simple-header signature now round-trips.
+    check("simple-header verify: folded " + canon + " self-verify passes",
+          rv[0] && rv[0].result === "pass");
+  }
+}
+
+async function testDkimSimpleCanonHonorsWireFieldName() {
+  // Simple header canon is verbatim, INCLUDING the DKIM-Signature field-name
+  // casing exactly as it appears on the wire — the verifier must canonicalize
+  // with the parsed field name, not a hardcoded "DKIM-Signature". So a peer that
+  // signs and sends `dkim-signature:` (lowercase) verifies, and a message whose
+  // field name was altered after signing no longer matches. Proven here by
+  // altering the on-wire casing after signing: the signature was computed over
+  // "DKIM-Signature", so the lowercased wire must NOT verify. (Before the fix
+  // the verifier ignored the on-wire name and this passed spuriously.)
+  var kp = _rsaKeypair();
+  b.mail.dkim._resetDkimKeyCacheForTest();
+  var signer = b.mail.dkim.create({
+    domain: "wirename.example", selector: "wn",
+    privateKey: kp.privateKey, canonicalization: "simple/simple",
+  });
+  var msg =
+    "From: alice@wirename.example\r\nTo: bob@example.org\r\n" +
+    "Subject: Wire name\r\nDate: Mon, 5 May 2026 12:00:00 +0000\r\n" +
+    "Message-ID: <wn@example.com>\r\n\r\nBody.\r\n";
+  var signed = signer.sign(msg);
+  var b64 = _spkiPemToB64(kp.publicKey);
+  var dnsLookup = async function () { return [["v=DKIM1; k=rsa; p=" + b64]]; };
+  var rvUpper = await b.mail.dkim.verify(signed, { dnsLookup: dnsLookup });
+  check("simple-canon verify: canonical DKIM-Signature casing verifies",
+        rvUpper[0] && rvUpper[0].result === "pass");
+  // Alter ONLY the field-name casing on the wire (the signed bytes used
+  // "DKIM-Signature"), leaving everything else intact.
+  var loweredWire = signed.replace(/^DKIM-Signature:/, "dkim-signature:");
+  var rvLower = await b.mail.dkim.verify(loweredWire, { dnsLookup: dnsLookup });
+  check("simple-canon verify: honors the on-wire field-name casing (altered name does not verify)",
+        rvLower[0] && rvLower[0].result === "fail");
+}
+
+// ---- Cross-implementation conformance: openssl-signed simple/simple vector ----
+//
+// The signature bytes below were produced by an INDEPENDENT implementation:
+// OpenSSL (`openssl dgst -sha256 -sign` — RSASSA-PKCS1-v1_5) over
+// hand-constructed RFC 6376 simple/simple canonicalization. bh= is the
+// SHA-256 of the verbatim CRLF body (section 3.4.3); b= signs the four h=
+// headers verbatim (each with its CRLF) followed by the DKIM-Signature
+// header with an empty b= value and no trailing CRLF (sections 3.4.1 and
+// 3.7). No framework code participated in producing the fixture, so a pass
+// here proves cross-implementation ACCEPTANCE of simple canonicalization —
+// a self-round-trip alone stays green when sign and verify share the same
+// canonicalization bug. The tampered-body / tampered-header controls prove
+// the pass is cryptographic, not vacuous.
+async function testDkimOpensslSimpleCanonInteropVector() {
+  var BH = "AD876huuF731JvLItVmRCvApI83P8LTA8/xaXm2Hu8Y=";
+  var SIG =
+    "i62Ti4k531wo/A2u2rk8G5J8JpgM0+MBj6vJbmwzz6MiMYEwS6XfO1GAOL0rUtM3TSNeWjKg" +
+    "ul2XjS4C5bVMjRQma1W+TzcJh3aHL8UXTc8K64DQ8isZ61BsN8v/iaIf/z5/6MZIOxlnaAbn" +
+    "CVWm/1OU3qvhKxyFOU9aCl+EaHuHGlvF1EM/bBpPpu9jmjRzSvj6Nyojw1tFl/g4HfOaCvpv" +
+    "wVmOBo49O1voWHC3CHDHK5rbURzf/dVC37aviTkjTgbh5I8QTcRVllBAMOs5LYl5zHAr1Jop" +
+    "h+8omZwednKI/Inj//S0EsyZeM6iKkuNX1nP3c460DH65jexsLj49Q==";
+  var PUB_B64 =
+    "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0VM3DGY3FSvXw58NTv2nMzJ149kB" +
+    "Q6KuTQBaRjjQfrYxRAbLhCSgatNz55GbZlBR0Uj7sYmGzte18sef5AqCWY4lXrD/+97S0GjH" +
+    "jUMHzQhp9Tk1m4yVnfqJp2MgXyMi31yrRvRkmNM7XD/EC07HuugHcKGnPRsHQV6kyGUkeuHt" +
+    "lQYRx058jTOWja6mcc0/nVQa08GM4703QYl6j3ZgSiu90fFnw77uswcuaKgwPIw3V66uPNPS" +
+    "VhqxGLyuXF4fw1DvYtRyJ/3liMNhqClEqDSwKfSEK6Z8nE/4M8Nv3BZA0OOzitDmqzyXkcdY" +
+    "At3XbaUHc0Gpbs5MYV7k2YXKWQIDAQAB";
+
+  var message =
+    "DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; " +
+      "d=openssl-interop.example; s=oss1; h=from:to:subject:date; " +
+      "bh=" + BH + "; b=" + SIG + "\r\n" +
+    "From: interop@openssl-interop.example\r\n" +
+    "To: rcpt@blamejs.example\r\n" +
+    "Subject: DKIM simple canonicalization interop\r\n" +
+    "Date: Thu, 01 Jan 2026 00:00:00 +0000\r\n" +
+    "\r\n" +
+    "Interop body line one.\r\nInterop body line two.\r\n";
+
+  var dnsLookup = async function () { return [["v=DKIM1; k=rsa; p=" + PUB_B64]]; };
+
+  b.mail.dkim._resetDkimKeyCacheForTest();
+  var rv = await b.mail.dkim.verify(message, { dnsLookup: dnsLookup });
+  check("openssl interop: independently-signed simple/simple vector passes",
+        Array.isArray(rv) && rv.length === 1 && rv[0].result === "pass");
+  check("openssl interop: pass verdict carries zero errors",
+        rv[0] && Array.isArray(rv[0].errors) && rv[0].errors.length === 0);
+  check("openssl interop: verdict identifies the signing domain and selector",
+        rv[0] && rv[0].d === "openssl-interop.example" && rv[0].s === "oss1");
+
+  // Control 1: one flipped body byte breaks the simple body hash.
+  var bodyTampered = message.replace("Interop body line two.", "Interop body line 2wo.");
+  var rvBody = await b.mail.dkim.verify(bodyTampered, { dnsLookup: dnsLookup });
+  check("openssl interop: tampered body fails (body hash mismatch)",
+        rvBody[0] && rvBody[0].result === "fail" &&
+        /body hash mismatch/.test((rvBody[0].errors || []).join(",")));
+
+  // Control 2: one flipped byte in a signed header breaks the signature.
+  var hdrTampered = message.replace("Subject: DKIM simple", "Subject: DKIM Simple");
+  var rvHdr = await b.mail.dkim.verify(hdrTampered, { dnsLookup: dnsLookup });
+  check("openssl interop: tampered signed header fails signature verification",
+        rvHdr[0] && rvHdr[0].result === "fail" &&
+        /signature verification failed/.test((rvHdr[0].errors || []).join(",")));
+}
+
+// ---- verify(): input + option-default guards ----
+
+async function testDkimVerifyBadInputAndOptions() {
+  var kp = _rsaKeypair();
+  var signed = await _signedMessage(kp);
+  var b64 = _spkiPemToB64(kp.publicKey);
+  var dnsLookup = async function () { return [["v=DKIM1; k=rsa; p=" + b64]]; };
+
+  // Empty / non-string rfc822 → bad-input throw.
+  var threw = null;
+  try { await b.mail.dkim.verify(""); } catch (e) { threw = e; }
+  check("verify: empty rfc822 → bad-input", threw && /dkim\/bad-input/.test(threw.code || ""));
+  threw = null;
+  try { await b.mail.dkim.verify(12345); } catch (e) { threw = e; }
+  check("verify: non-string rfc822 → bad-input", threw && /dkim\/bad-input/.test(threw.code || ""));
+
+  // A well-formed valid clockSkewMs (the accepted numeric branch).
+  b.mail.dkim._resetDkimKeyCacheForTest();
+  var rvSkew = await b.mail.dkim.verify(signed, { dnsLookup: dnsLookup, clockSkewMs: 60000 });
+  check("verify: accepts a valid clockSkewMs (finite, < ceiling)",
+        rvSkew[0] && rvSkew[0].result === "pass");
+
+  // maxSignatures range-check: below 1 and above the ceiling throw.
+  threw = null;
+  try { await b.mail.dkim.verify(signed, { dnsLookup: dnsLookup, maxSignatures: 0 }); }
+  catch (e) { threw = e; }
+  check("verify: maxSignatures < 1 → bad-max-signatures",
+        threw && /dkim\/bad-max-signatures/.test(threw.code || ""));
+  threw = null;
+  try { await b.mail.dkim.verify(signed, { dnsLookup: dnsLookup, maxSignatures: 99 }); }
+  catch (e) { threw = e; }
+  check("verify: maxSignatures > ceiling → bad-max-signatures",
+        threw && /dkim\/bad-max-signatures/.test(threw.code || ""));
+
+  // A valid in-range maxSignatures (the accepted numeric branch).
+  b.mail.dkim._resetDkimKeyCacheForTest();
+  var rvMax = await b.mail.dkim.verify(signed, { dnsLookup: dnsLookup, maxSignatures: 4 });
+  check("verify: accepts an in-range maxSignatures",
+        rvMax[0] && rvMax[0].result === "pass");
+}
+
+async function testDkimVerifyNoSignatureHeaders() {
+  // A message with no DKIM-Signature header → single "none" result.
+  var msg = "From: a@example.com\r\nSubject: unsigned\r\n\r\nbody\r\n";
+  var rv = await b.mail.dkim.verify(msg, { dnsLookup: async function () { return [[""]]; } });
+  check("verify: unsigned message → [{ result: 'none' }]",
+        Array.isArray(rv) && rv[0] && rv[0].result === "none" &&
+        /no DKIM-Signature/.test((rv[0].errors || []).join(",")));
+}
+
+// ---- verify(): v= / x= / t= NumericDate guards (decided pre-crypto) ----
+
+async function testDkimVerifyBadVersion() {
+  var rv = await b.mail.dkim.verify(
+    _messageWithSig(["v=2", "a=rsa-sha256", "c=relaxed/relaxed",
+      "d=v.example", "s=s", "h=from", "bh=AAA", "b=AAA"]),
+    { dnsLookup: async function () { return [["v=DKIM1; k=rsa; p=AAA"]]; } });
+  check("verify: v=2 → permerror (only v=1 supported)",
+        rv[0] && rv[0].result === "permerror" && /only v=1/.test((rv[0].errors || []).join(",")));
+}
+
+async function testDkimVerifyExpiredAndUnparseableDates() {
+  var nowSec = Math.floor(Date.now() / 1000);
+  var stub = { dnsLookup: async function () { return [["v=DKIM1; k=rsa; p=AAA"]]; } };
+
+  // x= in the past (beyond the default 5-min skew) → expired permerror.
+  var rvExp = await b.mail.dkim.verify(
+    _messageWithSig(["v=1", "a=rsa-sha256", "c=relaxed/relaxed",
+      "d=x.example", "s=s", "h=from", "bh=AAA", "x=" + (nowSec - 3600), "b=AAA"]), stub);
+  check("verify: expired x= → permerror",
+        rvExp[0] && rvExp[0].result === "permerror" && /has expired/.test((rvExp[0].errors || []).join(",")));
+
+  // x= present but not digits-only → fail-closed permerror.
+  var rvXbad = await b.mail.dkim.verify(
+    _messageWithSig(["v=1", "a=rsa-sha256", "c=relaxed/relaxed",
+      "d=x.example", "s=s", "h=from", "bh=AAA", "x=12abc", "b=AAA"]), stub);
+  check("verify: unparseable x= → permerror (NumericDate required)",
+        rvXbad[0] && rvXbad[0].result === "permerror" &&
+        /x= present but unparseable/.test((rvXbad[0].errors || []).join(",")));
+
+  // t= present but not digits-only → fail-closed permerror.
+  var rvTbad = await b.mail.dkim.verify(
+    _messageWithSig(["v=1", "a=rsa-sha256", "c=relaxed/relaxed",
+      "d=t.example", "s=s", "h=from", "bh=AAA", "t=notanum", "b=AAA"]), stub);
+  check("verify: unparseable t= → permerror (NumericDate required)",
+        rvTbad[0] && rvTbad[0].result === "permerror" &&
+        /t= present but unparseable/.test((rvTbad[0].errors || []).join(",")));
+
+  // t= more than 24h in the future → sanity permerror.
+  var rvFuture = await b.mail.dkim.verify(
+    _messageWithSig(["v=1", "a=rsa-sha256", "c=relaxed/relaxed",
+      "d=t.example", "s=s", "h=from", "bh=AAA", "t=" + (nowSec + 48 * 3600), "b=AAA"]), stub);
+  check("verify: t= >24h in the future → permerror",
+        rvFuture[0] && rvFuture[0].result === "permerror" &&
+        /more than 24h in the future/.test((rvFuture[0].errors || []).join(",")));
+
+  // x= before t= (expiry earlier than signing time) → ordering permerror.
+  var rvOrder = await b.mail.dkim.verify(
+    _messageWithSig(["v=1", "a=rsa-sha256", "c=relaxed/relaxed",
+      "d=t.example", "s=s", "h=from", "bh=AAA",
+      "t=" + (nowSec + 100), "x=" + (nowSec + 50), "b=AAA"]), stub);
+  check("verify: x= before t= → permerror (x must be after t)",
+        rvOrder[0] && rvOrder[0].result === "permerror" &&
+        /x= must be after t=/.test((rvOrder[0].errors || []).join(",")));
+}
+
+async function testDkimVerifyValidDatesPassThrough() {
+  // A fully-valid signature carrying non-expired t= + x= reaches the pass
+  // path (exercises the accepted t=/x= branches, not the reject branches).
+  var kp = _rsaKeypair();
+  b.mail.dkim._resetDkimKeyCacheForTest();
+  var nowSec = Math.floor(Date.now() / 1000);
+  var signed = _buildRelaxedSigned(kp, "dates.example", "sd",
+    ["t=" + (nowSec - 60), "x=" + (nowSec + 3600)]);
+  var b64 = _spkiPemToB64(kp.publicKey);
+  var rv = await b.mail.dkim.verify(signed,
+    { dnsLookup: async function () { return [["v=DKIM1; k=rsa; p=" + b64]]; } });
+  check("verify: valid non-expired t= + x= passes through to verification",
+        rv[0] && rv[0].result === "pass");
+}
+
+async function testDkimVerifyMissingDomainSelector() {
+  // Signature with neither d= nor s= → permerror (missing d= or s=).
+  var rv = await b.mail.dkim.verify(
+    _messageWithSig(["v=1", "a=rsa-sha256", "c=relaxed/relaxed",
+      "h=from", "bh=AAA", "b=AAA"]),
+    { dnsLookup: async function () { return [["v=DKIM1; k=rsa; p=AAA"]]; } });
+  check("verify: missing d=/s= → permerror",
+        rv[0] && rv[0].result === "permerror" &&
+        /missing d= or s=/.test((rv[0].errors || []).join(",")));
+}
+
+// ---- verify(): key-resolution error paths ----
+
+async function testDkimVerifyKeyLookupErrors() {
+  // ENOTFOUND from the resolver → permerror key-not-found.
+  var rvNx = await b.mail.dkim.verify(
+    _messageWithSig(["v=1", "a=rsa-sha256", "c=relaxed/relaxed",
+      "d=nx.example", "s=s", "h=from", "bh=AAA", "b=AAA"]),
+    { dnsLookup: async function () { var e = new Error("nx"); e.code = "ENOTFOUND"; throw e; } });
+  check("verify: ENOTFOUND key lookup → permerror (no TXT record)",
+        rvNx[0] && rvNx[0].result === "permerror" &&
+        /no DKIM TXT record/.test((rvNx[0].errors || []).join(",")));
+
+  // A generic resolver failure (no ENOTFOUND/ENODATA code) → temperror.
+  var rvTemp = await b.mail.dkim.verify(
+    _messageWithSig(["v=1", "a=rsa-sha256", "c=relaxed/relaxed",
+      "d=temp.example", "s=s", "h=from", "bh=AAA", "b=AAA"]),
+    { dnsLookup: async function () { throw new Error("connection reset"); } });
+  check("verify: generic key-lookup failure → temperror",
+        rvTemp[0] && rvTemp[0].result === "temperror" &&
+        /lookup for .* failed/.test((rvTemp[0].errors || []).join(",")));
+}
+
+async function testDkimVerifyKeyRecordShapes() {
+  var kp = _rsaKeypair();
+  var b64 = _spkiPemToB64(kp.publicKey);
+
+  // A bare-string TXT record (not the [[chunk]] shape) still parses.
+  b.mail.dkim._resetDkimKeyCacheForTest();
+  var signed = await _signedMessage(kp);
+  var rvStr = await b.mail.dkim.verify(signed,
+    { dnsLookup: async function () { return "v=DKIM1; k=rsa; p=" + b64; } });
+  check("verify: accepts a bare-string TXT record shape",
+        rvStr[0] && rvStr[0].result === "pass");
+
+  // An empty TXT record → key-not-found (empty) → permerror.
+  var rvEmpty = await b.mail.dkim.verify(
+    _messageWithSig(["v=1", "a=rsa-sha256", "c=relaxed/relaxed",
+      "d=e.example", "s=s", "h=from", "bh=AAA", "b=AAA"]),
+    { dnsLookup: async function () { return ""; } });
+  check("verify: empty TXT record → permerror (key record is empty)",
+        rvEmpty[0] && rvEmpty[0].result === "permerror" &&
+        /empty/.test((rvEmpty[0].errors || []).join(",")));
+
+  // A record present but missing p= → permerror (missing p=).
+  var rvNoP = await b.mail.dkim.verify(
+    _messageWithSig(["v=1", "a=rsa-sha256", "c=relaxed/relaxed",
+      "d=nop.example", "s=s", "h=from", "bh=AAA", "b=AAA"]),
+    { dnsLookup: async function () { return [["v=DKIM1; k=rsa"]]; } });
+  check("verify: key record without p= → permerror (missing p=)",
+        rvNoP[0] && rvNoP[0].result === "permerror" &&
+        /missing p=/.test((rvNoP[0].errors || []).join(",")));
+
+  // An explicitly-revoked key (empty p=) → fail (well-formed, withdrawn).
+  var rvRevoked = await b.mail.dkim.verify(
+    _messageWithSig(["v=1", "a=rsa-sha256", "c=relaxed/relaxed",
+      "d=rev.example", "s=s", "h=from", "bh=AAA", "b=AAA"]),
+    { dnsLookup: async function () { return [["v=DKIM1; k=rsa; p="]]; } });
+  check("verify: revoked key (empty p=) → fail",
+        rvRevoked[0] && rvRevoked[0].result === "fail" &&
+        /revoked/.test((rvRevoked[0].errors || []).join(",")));
+
+  // Key k= family disagrees with the signature a= family → permerror.
+  var rvKMismatch = await b.mail.dkim.verify(
+    _messageWithSig(["v=1", "a=rsa-sha256", "c=relaxed/relaxed",
+      "d=km.example", "s=s", "h=from", "bh=AAA", "b=AAA"]),
+    { dnsLookup: async function () { return [["v=DKIM1; k=ed25519; p=AAA"]]; } });
+  check("verify: key k= family != signature a= family → permerror",
+        rvKMismatch[0] && rvKMismatch[0].result === "permerror" &&
+        /does not match signature a=/.test((rvKMismatch[0].errors || []).join(",")));
+}
+
+// ---- verify(): _verifySingleSignature body-hash / header / key guards ----
+
+async function testDkimVerifySingleSignatureGuards() {
+  var kp = _rsaKeypair();
+  var b64 = _spkiPemToB64(kp.publicKey);
+  var goodKey = async function () { return [["v=DKIM1; k=rsa; p=" + b64]]; };
+  var bhBody = "guarded body\r\n";
+  var bh = _relaxedBodyHash(bhBody);
+
+  // Signature with no bh= tag → permerror (missing bh=).
+  var rvNoBh = await b.mail.dkim.verify(
+    _messageWithSig(["v=1", "a=rsa-sha256", "c=relaxed/relaxed",
+      "d=nobh.example", "s=s", "h=from", "b=AAA"], bhBody),
+    { dnsLookup: goodKey });
+  check("verify: signature missing bh= → permerror",
+        rvNoBh[0] && rvNoBh[0].result === "permerror" &&
+        /missing bh=/.test((rvNoBh[0].errors || []).join(",")));
+
+  // A tampered body (correct-length but different content) → body-hash fail.
+  var rvBhMismatch = await b.mail.dkim.verify(
+    _messageWithSig(["v=1", "a=rsa-sha256", "c=relaxed/relaxed",
+      "d=bhmm.example", "s=s", "h=from", "bh=" + bh, "b=AAA"], "TAMPERED body\r\n"),
+    { dnsLookup: goodKey });
+  check("verify: body-hash mismatch → fail",
+        rvBhMismatch[0] && rvBhMismatch[0].result === "fail" &&
+        /body hash mismatch/.test((rvBhMismatch[0].errors || []).join(",")));
+
+  // Correct bh but h= omits 'from' → permerror (from not covered).
+  var rvNoFrom = await b.mail.dkim.verify(
+    _messageWithSig(["v=1", "a=rsa-sha256", "c=relaxed/relaxed",
+      "d=nofrom.example", "s=s", "h=to", "bh=" + bh, "b=AAA"], bhBody),
+    { dnsLookup: goodKey });
+  check("verify: h= without 'from' → permerror",
+        rvNoFrom[0] && rvNoFrom[0].result === "permerror" &&
+        /does not include 'from'/.test((rvNoFrom[0].errors || []).join(",")));
+
+  // Correct bh + h=from but no b= tag → permerror (missing b=).
+  var rvNoB = await b.mail.dkim.verify(
+    _messageWithSig(["v=1", "a=rsa-sha256", "c=relaxed/relaxed",
+      "d=nob.example", "s=s", "h=from", "bh=" + bh], bhBody),
+    { dnsLookup: goodKey });
+  check("verify: signature missing b= → permerror",
+        rvNoB[0] && rvNoB[0].result === "permerror" &&
+        /missing b=/.test((rvNoB[0].errors || []).join(",")));
+
+  // l= present but not digits-only → fail-closed permerror.
+  var rvLbad = await b.mail.dkim.verify(
+    _messageWithSig(["v=1", "a=rsa-sha256", "c=relaxed/relaxed",
+      "d=lbad.example", "s=s", "h=from", "bh=" + bh, "l=12x", "b=AAA"], bhBody),
+    { dnsLookup: goodKey });
+  check("verify: unparseable l= → permerror (unsigned integer required)",
+        rvLbad[0] && rvLbad[0].result === "permerror" &&
+        /l= present but unparseable/.test((rvLbad[0].errors || []).join(",")));
+
+  // Correct bh + h=from + b= present, but the published key p= is garbage
+  // that node:crypto cannot parse → permerror (key parse failed).
+  var rvKeyParse = await b.mail.dkim.verify(
+    _messageWithSig(["v=1", "a=rsa-sha256", "c=relaxed/relaxed",
+      "d=keyparse.example", "s=s", "h=from", "bh=" + bh, "b=AAAA"], bhBody),
+    { dnsLookup: async function () { return [["v=DKIM1; k=rsa; p=@@not-base64-der@@"]]; } });
+  check("verify: unparseable key material → permerror (key parse failed)",
+        rvKeyParse[0] && rvKeyParse[0].result === "permerror" &&
+        /key parse failed/.test((rvKeyParse[0].errors || []).join(",")));
+
+  // a= names a supported family (rsa) but an unsupported full algorithm
+  // (rsa-sha1) → permerror (unsupported DKIM algorithm). Take a valid
+  // rsa-sha256 signature and re-label its a= so bh stays valid and the
+  // run reaches the algorithm check before any crypto verify.
+  b.mail.dkim._resetDkimKeyCacheForTest();
+  var validSigned = _buildRelaxedSigned(kp, "alg.example", "sa");
+  var relabeled = validSigned.replace("a=rsa-sha256", "a=rsa-sha1");
+  var rvUnsupported = await b.mail.dkim.verify(relabeled, { dnsLookup: goodKey });
+  check("verify: unsupported a= algorithm (rsa-sha1) → permerror",
+        rvUnsupported[0] && rvUnsupported[0].result === "permerror" &&
+        /unsupported DKIM algorithm/.test((rvUnsupported[0].errors || []).join(",")));
+}
+
+async function testDkimVerifyCryptoThrowsPath() {
+  // a=rsa-sha256 (digest sha256) but the published key is an Ed25519 key
+  // with no k= tag, so the k= guard is skipped and node:crypto.verify is
+  // invoked with a digest the key type rejects → it THROWS, and the
+  // verifier maps the throw to a permerror rather than crashing.
+  var edKp = _ed25519Keypair();
+  var edB64 = _spkiPemToB64(edKp.publicKey);
+  var body = "throws body\r\n";
+  var bh = _relaxedBodyHash(body);
+  b.mail.dkim._resetDkimKeyCacheForTest();
+  var rv = await b.mail.dkim.verify(
+    _messageWithSig(["v=1", "a=rsa-sha256", "c=relaxed/relaxed",
+      "d=throws.example", "s=s", "h=from", "bh=" + bh, "b=AAAA"], body),
+    { dnsLookup: async function () { return [["v=DKIM1; p=" + edB64]]; } });
+  check("verify: node:crypto.verify throw is caught → permerror",
+        rv[0] && rv[0].result === "permerror" &&
+        /verify threw/.test((rv[0].errors || []).join(",")));
+}
+
+// ---- verify(): key cache expiry + eviction ----
+
+async function testDkimKeyCacheExpiry() {
+  // A cached key entry past its TTL is dropped and re-fetched. Advance the
+  // clock via a scoped Date.now override (deterministic; no wall-clock wait).
+  b.mail.dkim._resetDkimKeyCacheForTest();
+  var kp = _rsaKeypair();
+  var b64 = _spkiPemToB64(kp.publicKey);
+  var signed = await _signedMessage(kp);
+  var calls = 0;
+  var dnsLookup = async function () { calls += 1; return [["v=DKIM1; k=rsa; p=" + b64]]; };
+  var realNow = Date.now;
+  try {
+    await b.mail.dkim.verify(signed, { dnsLookup: dnsLookup });   // fetch + cache
+    var base = realNow();
+    Date.now = function () { return base + 6 * 60 * 1000; };      // TTL is 5 min
+    await b.mail.dkim.verify(signed, { dnsLookup: dnsLookup });   // expired → re-fetch
+    check("verify: key cache entry past TTL is evicted and re-fetched",
+          calls === 2);
+  } finally {
+    Date.now = realNow;
+  }
+}
+
+async function testDkimKeyCacheEvictionBound() {
+  // Fill the key cache past its max-entries bound so the oldest entry is
+  // evicted (the DoS-bounding eviction path). Each verify pins a distinct
+  // domain; a k=-family mismatch short-circuits before any crypto verify,
+  // so the fill is cheap. The first-inserted selector must be re-fetched
+  // after the eviction wave, proving the oldest entry was dropped.
+  b.mail.dkim._resetDkimKeyCacheForTest();
+  var MAX = 1024;   // lib DKIM_KEY_CACHE_MAX_ENTRIES (module-private)
+  var fetches = Object.create(null);
+  var dnsLookup = async function (qname) {
+    fetches[qname] = (fetches[qname] || 0) + 1;
+    return [["v=DKIM1; k=ed25519; p=AAA"]];   // mismatch vs a=rsa-sha256 → permerror pre-crypto
+  };
+  async function verifyDomain(dom) {
+    return b.mail.dkim.verify(
+      _messageWithSig(["v=1", "a=rsa-sha256", "c=relaxed/relaxed",
+        "d=" + dom, "s=s", "h=from", "bh=AAA", "b=AAA"]),
+      { dnsLookup: dnsLookup });
+  }
+  var firstDomain = "g0.evict.example";
+  await verifyDomain(firstDomain);                        // insert oldest
+  for (var i = 1; i <= MAX; i += 1) {                     // MAX more → oldest evicted
+    await verifyDomain("g" + i + ".evict.example");
+  }
+  var firstQname = "s._domainkey." + firstDomain;
+  var before = fetches[firstQname];
+  await verifyDomain(firstDomain);                        // must miss → re-fetch
+  check("verify: oldest key-cache entry evicted past the max-entries bound",
+        fetches[firstQname] === before + 1);
+}
+
+// ---- dualSigner() + bootstrap() validation branches ----
+
+function testDualSignerValidation() {
+  var kp = _rsaKeypair();
+  function shouldThrow(label, opts, codeRe) {
+    var threw = null;
+    try { b.mail.dkim.dualSigner(opts); } catch (e) { threw = e; }
+    check("dualSigner: " + label, threw && codeRe.test(threw.code || ""));
+  }
+  shouldThrow("missing rsa/eddsa → dual-signer-missing",
+    { domain: "example.com" }, /dkim\/dual-signer-missing/);
+  shouldThrow("missing eddsa → dual-signer-missing",
+    { domain: "example.com", rsa: { selector: "r", privateKey: kp.privateKey } },
+    /dkim\/dual-signer-missing/);
+  shouldThrow("missing domain → dual-signer-missing-domain",
+    { rsa: { selector: "r", privateKey: kp.privateKey },
+      eddsa: { selector: "e", privateKey: _ed25519Keypair().privateKey } },
+    /dkim\/dual-signer-missing-domain/);
+}
+
+function testBootstrapMoreValidation() {
+  function shouldThrow(label, opts, codeRe) {
+    var threw = null;
+    try { b.mail.dkim.bootstrap(opts); } catch (e) { threw = e; }
+    check("bootstrap: " + label, threw && codeRe.test(threw.code || ""));
+  }
+  // Domain that fails the DNS-hostname shape (leading hyphen).
+  shouldThrow("rejects malformed domain shape",
+    { domain: "-bad-.example", selector: "s1" }, /dkim\/bad-domain/);
+  // Dual with a malformed explicit rsaSelector.
+  shouldThrow("dual rejects malformed rsaSelector",
+    { domain: "example.com", selector: "s1", algorithm: "dual", rsaSelector: "bad/sel" },
+    /dkim\/bad-selector/);
+  // Dual with sub-floor rsaBits.
+  shouldThrow("dual rejects sub-floor rsaBits",
+    { domain: "example.com", selector: "s1", algorithm: "dual", rsaBits: 512 },
+    /dkim\/bad-rsa-bits/);
+}
+
+// RFC 8463 §3-4 — an ed25519 DKIM key is published as the RAW 32-byte key,
+// base64'd (44 chars), the form every conformant sender uses. The verifier must
+// accept it; it previously SPKI-wrapped the raw bytes so createPublicKey threw
+// and a valid ed25519 signature returned permerror.
+async function testDkimVerifyEd25519RawKeyRfc8463() {
+  var kp = _ed25519Keypair();
+  var signer = b.mail.dkim.create({
+    domain:     "example.com",
+    selector:   "ed1",
+    privateKey: kp.privateKey,
+    algorithm:  "ed25519-sha256",
+  });
+  var rfc822 =
+    "From: alice@example.com\r\n" +
+    "To: bob@example.org\r\n" +
+    "Subject: Test ed raw\r\n" +
+    "Date: Mon, 5 May 2026 12:00:00 +0000\r\n" +
+    "Message-ID: <ed-raw@example.com>\r\n" +
+    "\r\n" +
+    "Hello raw ed25519.\r\n";
+  var signed = signer.sign(rfc822);
+  var rawB64 = nodeCrypto.createPublicKey(kp.publicKey)
+    .export({ type: "spki", format: "der" }).subarray(-32).toString("base64");
+  check("ed25519 raw key is the 44-char RFC 8463 form (not 60-char SPKI)", rawB64.length === 44);
+  var dnsLookup = async function () { return [["v=DKIM1; k=ed25519; p=" + rawB64]]; };
+  var rv = await b.mail.dkim.verify(signed, { dnsLookup: dnsLookup });
+  check("ed25519 raw-key (RFC 8463) DKIM signature verifies pass",
+        Array.isArray(rv) && rv[0] && rv[0].result === "pass");
+}
+
+// A record `p=<raw-32-byte-key>` with NO k= is an RSA record (RFC 6376 §3.6.1
+// default). It must NOT verify an a=ed25519-sha256 signature just because the
+// key is 32 bytes long — a key-family confusion the record never authorized.
+async function testDkimEd25519KFamilyConfusionRefused() {
+  var kp = _ed25519Keypair();
+  var rawB64 = nodeCrypto.createPublicKey(kp.publicKey)
+    .export({ type: "spki", format: "der" }).subarray(-32).toString("base64");
+  // Distinct selectors so the per-qname key cache does not carry one record's
+  // key into the other's lookup.
+  function signWith(sel) {
+    return b.mail.dkim.create({
+      domain: "example.com", selector: sel, privateKey: kp.privateKey, algorithm: "ed25519-sha256",
+    }).sign("From: a@example.com\r\nTo: b@example.org\r\nSubject: x\r\n\r\nbody\r\n");
+  }
+  // (negative) record omits k= (defaults rsa) → the ed25519 signature is refused.
+  var rvNo = await b.mail.dkim.verify(signWith("edkconfno"),
+    { dnsLookup: async function () { return [["v=DKIM1; p=" + rawB64]]; } });
+  check("ed25519 sig against a k=-absent (RSA-default) raw-key record is refused",
+        Array.isArray(rvNo) && rvNo[0] && rvNo[0].result === "permerror");
+  // (positive control) with k=ed25519 it verifies.
+  var rvOk = await b.mail.dkim.verify(signWith("edkconfok"),
+    { dnsLookup: async function () { return [["v=DKIM1; k=ed25519; p=" + rawB64]]; } });
+  check("ed25519 sig against a k=ed25519 raw-key record verifies pass",
+        Array.isArray(rvOk) && rvOk[0] && rvOk[0].result === "pass");
+}
+
+// bootstrap must PUBLISH the raw 32-byte ed25519 key (44 base64 chars), not
+// SPKI DER (60 chars) — the SPKI form does not verify at a conformant receiver,
+// so the framework's own default-algorithm signatures would be undeliverable.
+function testDkimBootstrapEd25519PublishesRawKey() {
+  var bs = b.mail.dkim.bootstrap({ domain: "example.com", selector: "ed1", algorithm: "ed25519-sha256" });
+  var m = /p=([A-Za-z0-9+/=]+)/.exec(bs.dnsTxtValue);
+  check("bootstrap ed25519: p= present", m !== null);
+  check("bootstrap ed25519: p= is the 44-char raw key (RFC 8463), not 60-char SPKI",
+        m !== null && m[1].length === 44);
+  // And the published raw key round-trips: a signature from bootstrap's signer
+  // verifies against the published p=.
+  var rawB64 = m ? m[1] : "";
+  check("bootstrap ed25519: published p= is a 32-byte key", Buffer.from(rawB64, "base64").length === 32);
+}
+
 async function run() {
   testDkimSurfaceAndValidation();
   testDkimCanonicalization();
@@ -807,6 +1599,10 @@ async function run() {
   testDkimSignerRejectsBadInput();
   testDkimRejectsLTagBodyLength();
   await testDkimVerifyHappyPath();
+  await testDkimVerifyEd25519RawKeyRfc8463();
+  await testDkimEd25519KFamilyConfusionRefused();
+  testDkimBootstrapEd25519PublishesRawKey();
+  await testDkimVerifyBareLfMessage();
   await testDkimVerifyKeyCacheHit();
   await testDkimVerifySmallKeyRejected();
   await testCalendarValidation();
@@ -827,6 +1623,28 @@ async function run() {
   await testDkimVerifyLTagCountsCanonicalizedOctets();
   await testDkimVerifyLTagAppendAfterSignatureRefused();
   await testArcAmsLTagAppendRefused();
+  // Uncovered error / adversarial / defensive / option-default branches
+  testDkimCreateInputBranches();
+  testDkimSignerAuditDisabled();
+  await testDkimEd25519VerifyRoundTrip();
+  testDkimSimpleCanonDirect();
+  await testDkimSimpleCanonRoundTrips();
+  await testDkimSimpleCanonHonorsWireFieldName();
+  await testDkimOpensslSimpleCanonInteropVector();
+  await testDkimVerifyBadInputAndOptions();
+  await testDkimVerifyNoSignatureHeaders();
+  await testDkimVerifyBadVersion();
+  await testDkimVerifyExpiredAndUnparseableDates();
+  await testDkimVerifyValidDatesPassThrough();
+  await testDkimVerifyMissingDomainSelector();
+  await testDkimVerifyKeyLookupErrors();
+  await testDkimVerifyKeyRecordShapes();
+  await testDkimVerifySingleSignatureGuards();
+  await testDkimVerifyCryptoThrowsPath();
+  await testDkimKeyCacheExpiry();
+  await testDkimKeyCacheEvictionBound();
+  testDualSignerValidation();
+  testBootstrapMoreValidation();
 }
 
 module.exports = { run: run };