@blamejs/blamejs-shop 0.5.12 → 0.5.14

package/lib/vendor/blamejs/test/layer-0-primitives/mail-server-mx.test.js

@@ -15,8 +15,12 @@ var helpers = require("../helpers");
 var b       = helpers.b;
 var check   = helpers.check;
 
-var nodeNet = require("node:net");
-var nodeTls = require("node:tls");
+var nodeNet  = require("node:net");
+var nodeTls  = require("node:tls");
+// The exact audit module auditEmit resolves via require("./audit") — patch
+// its safeEmit to capture the drop-silent events the listener emits (there
+// is no test helper for global-audit capture; restore in finally).
+var auditMod = require("../../lib/audit");
 
 function testSurface() {
   check("mx.create is fn",            typeof b.mail.server.mx.create === "function");
@@ -169,6 +173,41 @@ async function _readGreeting(socket) {
   });
 }
 
+// Passive accumulator for unsolicited server replies (idle-timeout 421,
+// shutdown 421) — the caller polls the buffer via helpers.waitUntil rather
+// than issuing a command. Swallows post-close socket errors (ECONNRESET
+// when the server destroys the connection) so they don't reject the run.
+function _collect(socket) {
+  var buf = "";
+  socket.on("data", function (chunk) { buf += chunk.toString("utf8"); });
+  socket.on("error", function () { /* connection torn down by server; ignore */ });
+  return { text: function () { return buf; } };
+}
+
+// Capture the drop-silent audit events the listener emits while `fn`'s
+// window is open. Patches the exact module object auditEmit resolves and
+// restores it unconditionally, so no global-audit state leaks to the
+// smoke harness.
+function _withAuditCapture(fn) {
+  var events = [];
+  var orig = auditMod.safeEmit;
+  auditMod.safeEmit = function (evt) {
+    events.push(evt);
+    return orig.call(auditMod, evt);
+  };
+  return Promise.resolve()
+    .then(function () { return fn(events); })
+    .finally(function () { auditMod.safeEmit = orig; });
+}
+
+// Connect + read the 220 greeting, returning the live socket.
+async function _connectTo(info) {
+  var socket = nodeNet.connect(info.port, "127.0.0.1");
+  await new Promise(function (r) { socket.once("connect", r); });
+  await _readGreeting(socket);
+  return socket;
+}
+
 async function testEhloFlow() {
   // Boot the server with a permissive profile so plaintext EHLO works
   // (operator-acknowledged downgrade for staging). Skip if the test
@@ -632,10 +671,726 @@ async function testGuardEnvelopeGate() {
   } finally { await acceptSrv.close({ timeoutMs: 1000 }); }                            // allow:raw-time-literal — test-only short drain
 }
 
+// ---- Boot-time validation of the guardEnvelope config object -----------
+// The gate's tunables are validated at create() so an operator typo fails
+// startup rather than turning every live DATA into an envelope_error.
+function testGuardEnvelopeBootValidation() {
+  function expectThrow(label, opts) {
+    var threw = null;
+    try { b.mail.server.mx.create(opts); } catch (e) { threw = e; }
+    check(label, threw && (threw.code || "").indexOf("mail-server-mx/") === 0);
+  }
+  expectThrow("guardEnvelope.onTemperror invalid → throw",
+    { tlsContext: {}, guardEnvelope: { onTemperror: "maybe" } });
+  expectThrow("guardEnvelope.authservId non-string → throw",
+    { tlsContext: {}, guardEnvelope: { authservId: 123 } });
+  expectThrow("guardEnvelope.authservId empty string → throw",
+    { tlsContext: {}, guardEnvelope: { authservId: "" } });
+  expectThrow("guardEnvelope.dnsLookup non-function → throw",
+    { tlsContext: {}, guardEnvelope: { dnsLookup: "not-a-fn" } });
+
+  // A fully-specified gate config (explicit authservId + onTemperror
+  // accept + dnsLookup fn) constructs cleanly — exercises the accept
+  // branches the reject cases above skip.
+  var okServer = null;
+  try {
+    okServer = b.mail.server.mx.create({
+      tlsContext: {}, profile: "permissive",
+      guardEnvelope: {
+        mode:        "monitor",
+        onTemperror: "accept",
+        authservId:  "custom.mx.example",
+        dnsLookup:   async function () { return []; },
+      },
+    });
+  } catch (_e) { okServer = null; }
+  check("guardEnvelope full valid config constructs", okServer !== null &&
+    typeof okServer.listen === "function");
+
+  // `guardEnvelope: true` shorthand — mode defaults to the profile-derived
+  // posture (permissive → monitor, otherwise enforce).
+  var trueMonitor = null, trueEnforce = null;
+  try {
+    trueMonitor = b.mail.server.mx.create({
+      tlsContext: {}, profile: "permissive", guardEnvelope: true });
+  } catch (_e) { trueMonitor = null; }
+  try {
+    trueEnforce = b.mail.server.mx.create({ tlsContext: {}, guardEnvelope: true });
+  } catch (_e) { trueEnforce = null; }
+  check("guardEnvelope:true under permissive constructs (monitor default)",
+    trueMonitor !== null);
+  check("guardEnvelope:true under default profile constructs (enforce default)",
+    trueEnforce !== null);
+}
+
+// ---- guardDomain opt: false (disable) and object (profile override) ----
+function testGuardDomainBootOptions() {
+  var offServer = null;
+  try {
+    offServer = b.mail.server.mx.create({ tlsContext: {}, guardDomain: false });
+  } catch (_e) { offServer = null; }
+  check("guardDomain:false constructs (hardening disabled)", offServer !== null);
+
+  var objServer = null;
+  try {
+    objServer = b.mail.server.mx.create({
+      tlsContext: {}, guardDomain: { profile: "balanced" },
+    });
+  } catch (_e) { objServer = null; }
+  check("guardDomain object with profile override constructs", objServer !== null);
+
+  // guardDomain object WITHOUT its own profile falls back to the server
+  // profile.
+  var objDefault = null;
+  try {
+    objDefault = b.mail.server.mx.create({ tlsContext: {}, guardDomain: {} });
+  } catch (_e) { objDefault = null; }
+  check("guardDomain object without profile falls back to server profile",
+    objDefault !== null);
+
+  // An operator localDomains entry that guardDomain itself rejects (a
+  // special-use domain) must fail startup, not silently weaken the gate.
+  var badLocal = null;
+  try {
+    b.mail.server.mx.create({ tlsContext: {}, localDomains: ["foo.local"] });
+  } catch (e) { badLocal = e; }
+  check("localDomains rejected by guardDomain → bad-local-domain at boot",
+    badLocal !== null && /bad-local-domain/.test(badLocal.code || ""));
+}
+
+// ---- Command dispatch: NOOP / RSET / VRFY / EXPN / unknown / HELO / EHLO-no-arg
+async function testCommandDispatch() {
+  var ctx;
+  try { ctx = await _makeTestTlsContext(); }
+  catch (_e) { check("command dispatch (skipped — cert fixture unavailable)", true); return; }
+  var srv = b.mail.server.mx.create({
+    tlsContext: ctx, profile: "permissive", localDomains: ["example.com"],
+  });
+  var info = await srv.listen({ port: 0, address: "127.0.0.1" });
+  var sock;
+  try {
+    sock = await _connectTo(info);
+    check("NOOP → 250", /^250 /.test(await _sendCommand(sock, "NOOP")));
+    check("RSET → 250", /^250 /.test(await _sendCommand(sock, "RSET")));
+    check("VRFY → 502 not implemented",
+      /^502 5\.5\.1/.test(await _sendCommand(sock, "VRFY alice")));
+    check("EXPN → 502 not implemented",
+      /^502 5\.5\.1/.test(await _sendCommand(sock, "EXPN staff")));
+    check("unknown verb → 500",
+      /^500 5\.5\.2/.test(await _sendCommand(sock, "HELP")));
+    check("HELO (not EHLO) → single-line 250",
+      /^250 /.test(await _sendCommand(sock, "HELO relay.example.com")));
+    sock.destroy();
+  } finally { await srv.close({ timeoutMs: 1000 }); }                                 // allow:raw-time-literal — test-only short drain
+}
+
+// ---- Sequence + syntax errors: out-of-order commands and malformed args -
+async function testSequenceAndSyntaxErrors() {
+  var ctx;
+  try { ctx = await _makeTestTlsContext(); }
+  catch (_e) { check("sequence/syntax errors (skipped)", true); return; }
+  var srv = b.mail.server.mx.create({
+    tlsContext: ctx, profile: "permissive", localDomains: ["example.com"],
+  });
+  var info = await srv.listen({ port: 0, address: "127.0.0.1" });
+  var s1, s2;
+  try {
+    // MAIL FROM before any EHLO → 503 bad sequence.
+    s1 = await _connectTo(info);
+    check("MAIL FROM before EHLO → 503",
+      /^503 5\.5\.1/.test(await _sendCommand(s1, "MAIL FROM:<a@external.com>")));
+    s1.destroy();
+
+    // Fresh connection: EHLO, then RCPT before MAIL, DATA before RCPT,
+    // and malformed MAIL / RCPT the shape-guard passes but the listener's
+    // stricter address regex rejects (501).
+    s2 = await _connectTo(info);
+    await _sendCommand(s2, "EHLO sender.example.com");
+    check("RCPT before MAIL → 503",
+      /^503 5\.5\.1/.test(await _sendCommand(s2, "RCPT TO:<a@example.com>")));
+    check("DATA before RCPT → 503",
+      /^503 5\.5\.1/.test(await _sendCommand(s2, "DATA")));
+    check("malformed MAIL FROM (trailing junk) → 501",
+      /^501 5\.5\.4/.test(await _sendCommand(s2, "MAIL FROM:<a@external.com>extra")));
+    // Land a good MAIL so the next RCPT reaches the address parse.
+    await _sendCommand(s2, "MAIL FROM:<a@external.com>");
+    check("malformed RCPT TO (trailing junk) → 501",
+      /^501 5\.5\.4/.test(await _sendCommand(s2, "RCPT TO:<a@example.com>extra")));
+    s2.destroy();
+  } finally { await srv.close({ timeoutMs: 1000 }); }                                 // allow:raw-time-literal — test-only short drain
+}
+
+// ---- Domain hardening refuses HELO / MAIL FROM / RCPT TO bad domains ----
+// bare-IPv4-as-domain (CVE-2021-22931 class) + special-use domain (RFC 6761).
+async function testDomainRefusals() {
+  var ctx;
+  try { ctx = await _makeTestTlsContext(); }
+  catch (_e) { check("domain refusals (skipped)", true); return; }
+  var srv = b.mail.server.mx.create({
+    tlsContext: ctx, profile: "permissive", localDomains: ["example.com"],
+  });
+  var info = await srv.listen({ port: 0, address: "127.0.0.1" });
+  var s1, s2;
+  try {
+    // HELO with a bare IPv4 (not an address literal) → guardDomain refuses.
+    s1 = await _connectTo(info);
+    check("HELO bare-IPv4 domain → 501",
+      /^501 5\.5\.4/.test(await _sendCommand(s1, "HELO 1.2.3.4")));
+    s1.destroy();
+
+    s2 = await _connectTo(info);
+    await _sendCommand(s2, "EHLO sender.example.com");
+    check("MAIL FROM bare-IPv4 domain → 501",
+      /^501 5\.5\.4/.test(await _sendCommand(s2, "MAIL FROM:<x@1.2.3.4>")));
+    await _sendCommand(s2, "MAIL FROM:<s@external.com>");
+    check("RCPT TO special-use domain → 501",
+      /^501 5\.5\.4/.test(await _sendCommand(s2, "RCPT TO:<x@foo.local>")));
+    s2.destroy();
+  } finally { await srv.close({ timeoutMs: 1000 }); }                                 // allow:raw-time-literal — test-only short drain
+}
+
+// ---- Resource caps: SIZE=, per-message size, recipient count, line length
+async function testResourceLimits() {
+  var ctx;
+  try { ctx = await _makeTestTlsContext(); }
+  catch (_e) { check("resource limits (skipped)", true); return; }
+
+  // Small per-message cap: declared SIZE= over the cap refused at MAIL
+  // FROM (552), and a DATA body over the cap refused mid-stream (552).
+  var capSrv = b.mail.server.mx.create({
+    tlsContext: ctx, profile: "permissive", localDomains: ["example.com"],
+    maxMessageBytes: 64,
+  });
+  var capInfo = await capSrv.listen({ port: 0, address: "127.0.0.1" });
+  var capSock;
+  try {
+    capSock = await _connectTo(capInfo);
+    await _sendCommand(capSock, "EHLO sender.example.com");
+    check("MAIL FROM SIZE= over maxMessageBytes → 552",
+      /^552 5\.3\.4/.test(await _sendCommand(capSock, "MAIL FROM:<s@external.com> SIZE=100000")));
+    await _sendCommand(capSock, "MAIL FROM:<s@external.com>");
+    await _sendCommand(capSock, "RCPT TO:<alice@example.com>");
+    await _sendCommand(capSock, "DATA");
+    var big = "";
+    for (var i = 0; i < 200; i += 1) big += "A";
+    check("DATA body over maxMessageBytes → 552 mid-stream",
+      /^552 5\.3\.4/.test(await _sendCommand(capSock, big)));
+    capSock.destroy();
+  } finally { await capSrv.close({ timeoutMs: 1000 }); }                              // allow:raw-time-literal — test-only short drain
+
+  // Per-message recipient cap (default maxMessageBytes so SIZE overrun
+  // has room). maxRcptsPerMessage:1 → the second RCPT is refused 452.
+  var rcptSrv = b.mail.server.mx.create({
+    tlsContext: ctx, profile: "permissive", localDomains: ["example.com"],
+    maxRcptsPerMessage: 1,
+  });
+  var rcptInfo = await rcptSrv.listen({ port: 0, address: "127.0.0.1" });
+  var rcptSock;
+  try {
+    rcptSock = await _connectTo(rcptInfo);
+    await _sendCommand(rcptSock, "EHLO sender.example.com");
+    await _sendCommand(rcptSock, "MAIL FROM:<s@external.com>");
+    await _sendCommand(rcptSock, "RCPT TO:<alice@example.com>");
+    check("second RCPT past maxRcptsPerMessage → 452",
+      /^452 4\.5\.3/.test(await _sendCommand(rcptSock, "RCPT TO:<bob@example.com>")));
+    rcptSock.destroy();
+  } finally { await rcptSrv.close({ timeoutMs: 1000 }); }                             // allow:raw-time-literal — test-only short drain
+
+  // Declared SIZE= reconciled against the actual DATA byte count (RFC 1870
+  // §6.3): a body larger than the declared SIZE is refused after DATA.
+  var overrunSrv = b.mail.server.mx.create({
+    tlsContext: ctx, profile: "permissive", localDomains: ["example.com"],
+  });
+  var overrunInfo = await overrunSrv.listen({ port: 0, address: "127.0.0.1" });
+  var overrunSock;
+  try {
+    overrunSock = await _connectTo(overrunInfo);
+    await _sendCommand(overrunSock, "EHLO sender.example.com");
+    await _sendCommand(overrunSock, "MAIL FROM:<s@external.com> SIZE=10");
+    await _sendCommand(overrunSock, "RCPT TO:<alice@example.com>");
+    await _sendCommand(overrunSock, "DATA");
+    check("DATA body over declared SIZE= → 552 (RFC 1870 §6.3)",
+      /^552 5\.3\.4/.test(await _sendCommand(overrunSock,
+        "From: s@external.com\r\nSubject: overrun\r\n\r\nthis body is far larger than ten bytes\r\n.")));
+    overrunSock.destroy();
+  } finally { await overrunSrv.close({ timeoutMs: 1000 }); }                          // allow:raw-time-literal — test-only short drain
+
+  // Per-command line cap: a command line past the hard byte ceiling is
+  // refused 500 and the connection is dropped.
+  var lineSrv = b.mail.server.mx.create({
+    tlsContext: ctx, profile: "permissive", localDomains: ["example.com"],
+    maxLineBytes: 64,
+  });
+  var lineInfo = await lineSrv.listen({ port: 0, address: "127.0.0.1" });
+  var lineSock;
+  try {
+    lineSock = await _connectTo(lineInfo);
+    var overlong = "";
+    for (var j = 0; j < 400; j += 1) overlong += "A";
+    check("over-long command line → 500 5.5.6 + close",
+      /^500 5\.5\.6/.test(await _sendCommand(lineSock, overlong)));
+    lineSock.destroy();
+  } finally { await lineSrv.close({ timeoutMs: 1000 }); }                             // allow:raw-time-literal — test-only short drain
+}
+
+// ---- Per-IP RCPT-failure cap: repeated failed recipients trip a 421 + close
+// (the mailbox-enumeration backstop — RFC 5321 §3.5). A low cap makes the
+// backoff deterministic.
+async function testRcptFailureRateLimit() {
+  var ctx;
+  try { ctx = await _makeTestTlsContext(); }
+  catch (_e) { check("RCPT-failure rate limit (skipped)", true); return; }
+  var srv = b.mail.server.mx.create({
+    tlsContext: ctx, profile: "permissive", localDomains: ["example.com"],
+    rateLimit: { rcptFailuresPerIpPerMinute: 2 },
+  });
+  var info = await srv.listen({ port: 0, address: "127.0.0.1" });
+  var sock;
+  try {
+    sock = await _connectTo(info);
+    await _sendCommand(sock, "EHLO sender.example.com");
+    await _sendCommand(sock, "MAIL FROM:<s@external.com>");
+    // Two relay-denied recipients spend the failure budget.
+    check("first relay-denied RCPT → 550",
+      /^550 5\.7\.1/.test(await _sendCommand(sock, "RCPT TO:<a@notlocal.example>")));
+    check("second relay-denied RCPT → 550",
+      /^550 5\.7\.1/.test(await _sendCommand(sock, "RCPT TO:<b@notlocal.example>")));
+    // The next RCPT trips the per-IP failure cap → 421 + connection close.
+    check("RCPT past the per-IP failure cap → 421 + close",
+      /^421 4\.7\.0/.test(await _sendCommand(sock, "RCPT TO:<c@notlocal.example>")));
+    sock.destroy();
+  } finally { await srv.close({ timeoutMs: 1000 }); }                                 // allow:raw-time-literal — test-only short drain
+}
+
+// ---- SMTP-smuggling wire paths: bare-LF / bare-CR / NUL command lines and
+// a bare-LF dot-terminator in the DATA body. Captures the smtp_smuggling
+// _detected audit to prove the NUL-injection path is audited (regression:
+// the code guard emits is `guard-smtp-command/nul`, not `nul-byte`).
+async function testWireSmuggling() {
+  var ctx;
+  try { ctx = await _makeTestTlsContext(); }
+  catch (_e) { check("wire smuggling (skipped)", true); return; }
+
+  // strict profile refuses bare LF (permissive tolerates it), so the
+  // smuggling-detected audit fires for bare LF / bare CR / NUL here.
+  var strictSrv = b.mail.server.mx.create({
+    tlsContext: ctx, profile: "strict", localDomains: ["example.com"],
+  });
+  var strictInfo = await strictSrv.listen({ port: 0, address: "127.0.0.1" });
+  var cmdSock;
+  await _withAuditCapture(async function (events) {
+    try {
+      cmdSock = await _connectTo(strictInfo);
+      check("bare-LF in command line → 500",
+        /^500 5\.5\.2/.test(await _sendCommand(cmdSock, "EHLO x\ny")));
+      check("bare-CR in command line → 500",
+        /^500 5\.5\.2/.test(await _sendCommand(cmdSock, "EHLO x\rY")));
+      check("NUL byte in command line → 500",
+        /^500 5\.5\.2/.test(await _sendCommand(cmdSock, ("EHL" + String.fromCharCode(0) + "O example.com"))));
+      cmdSock.destroy();
+    } finally { if (cmdSock) cmdSock.destroy(); }
+
+    function smug(code) {
+      return events.filter(function (e) {
+        return e && e.action === "mail.server.mx.smtp_smuggling_detected" &&
+          e.metadata && e.metadata.code === code;
+      }).length;
+    }
+    check("bare-LF command emits smtp_smuggling_detected audit",
+      smug("guard-smtp-command/bare-lf") >= 1);
+    check("bare-CR command emits smtp_smuggling_detected audit",
+      smug("guard-smtp-command/bare-cr") >= 1);
+    check("NUL-byte command emits smtp_smuggling_detected audit (code /nul)",
+      smug("guard-smtp-command/nul") >= 1);
+  });
+  await strictSrv.close({ timeoutMs: 1000 });                                          // allow:raw-time-literal — test-only short drain
+
+  // DATA-body bare-LF dot terminator (the CVE-2023-51764 smuggling shape)
+  // is refused 554 mid-body under any profile.
+  var bodySrv = b.mail.server.mx.create({
+    tlsContext: ctx, profile: "permissive", localDomains: ["example.com"],
+  });
+  var bodyInfo = await bodySrv.listen({ port: 0, address: "127.0.0.1" });
+  var bodySock;
+  try {
+    bodySock = await _connectTo(bodyInfo);
+    await _sendCommand(bodySock, "EHLO sender.example.com");
+    await _sendCommand(bodySock, "MAIL FROM:<s@external.com>");
+    await _sendCommand(bodySock, "RCPT TO:<alice@example.com>");
+    await _sendCommand(bodySock, "DATA");
+    check("bare-LF dot-terminator in DATA body → 554 (SMTP smuggling)",
+      /^554 5\.7\.0/.test(await _sendCommand(bodySock, "smuggled\n.\n")));
+    bodySock.destroy();
+  } finally { await bodySrv.close({ timeoutMs: 1000 }); }                             // allow:raw-time-literal — test-only short drain
+}
+
+// ---- Operator-explicit relay allowlist admits non-local recipients ------
+async function testRelayAllowed() {
+  var ctx;
+  try { ctx = await _makeTestTlsContext(); }
+  catch (_e) { check("relay allowlist (skipped)", true); return; }
+  var srv = b.mail.server.mx.create({
+    tlsContext: ctx, profile: "permissive", localDomains: ["example.com"],
+    relayAllowedFor: [{ cidr: "0.0.0.0/0", scope: "all" }],
+  });
+  var info = await srv.listen({ port: 0, address: "127.0.0.1" });
+  var sock;
+  try {
+    sock = await _connectTo(info);
+    await _sendCommand(sock, "EHLO sender.example.com");
+    await _sendCommand(sock, "MAIL FROM:<s@external.com>");
+    check("non-local RCPT admitted when relayAllowedFor is set → 250",
+      /^250 /.test(await _sendCommand(sock, "RCPT TO:<bob@notlocal.example>")));
+    sock.destroy();
+  } finally { await srv.close({ timeoutMs: 1000 }); }                                 // allow:raw-time-literal — test-only short drain
+}
+
+// ---- relayAllowedFor enforces the entry CIDR against the peer address ---
+// A peer OUTSIDE every allowlisted range must be relay-refused; only a peer
+// INSIDE a range is admitted. Regression guard for the open-relay class where
+// a non-empty relayAllowedFor admitted every peer regardless of source
+// address (the entry `cidr` was ignored).
+async function testRelayCidrEnforced() {
+  var ctx;
+  try { ctx = await _makeTestTlsContext(); }
+  catch (_e) { check("relay CIDR enforcement (skipped)", true); return; }
+
+  // (a) Peer 127.0.0.1 is OUTSIDE 10.0.0.0/8 → relay refused with 550.
+  var denySrv = b.mail.server.mx.create({
+    tlsContext: ctx, profile: "permissive", localDomains: ["example.com"],
+    relayAllowedFor: [{ cidr: "10.0.0.0/8", scope: "internal" }],
+  });
+  var denyInfo = await denySrv.listen({ port: 0, address: "127.0.0.1" });
+  var denySock;
+  try {
+    denySock = await _connectTo(denyInfo);
+    await _sendCommand(denySock, "EHLO sender.example.com");
+    await _sendCommand(denySock, "MAIL FROM:<attacker@evil.com>");
+    check("out-of-CIDR peer relay-refused → 550 (no open relay)",
+      /^550 5\.7\.1/.test(await _sendCommand(denySock, "RCPT TO:<victim@notlocal.example>")));
+    denySock.destroy();
+  } finally { await denySrv.close({ timeoutMs: 1000 }); }                              // allow:raw-time-literal — test-only short drain
+
+  // (b) Peer 127.0.0.1 is INSIDE 127.0.0.0/8 → relay admitted with 250.
+  var allowSrv = b.mail.server.mx.create({
+    tlsContext: ctx, profile: "permissive", localDomains: ["example.com"],
+    relayAllowedFor: [{ cidr: "127.0.0.0/8", scope: "loopback" }],
+  });
+  var allowInfo = await allowSrv.listen({ port: 0, address: "127.0.0.1" });
+  var allowSock;
+  try {
+    allowSock = await _connectTo(allowInfo);
+    await _sendCommand(allowSock, "EHLO sender.example.com");
+    await _sendCommand(allowSock, "MAIL FROM:<s@external.com>");
+    check("in-CIDR peer relay admitted → 250",
+      /^250 /.test(await _sendCommand(allowSock, "RCPT TO:<bob@notlocal.example>")));
+    allowSock.destroy();
+  } finally { await allowSrv.close({ timeoutMs: 1000 }); }                             // allow:raw-time-literal — test-only short drain
+
+  // (b2) IPv4-mapped fold the relay gate relies on. An IPv4 client on the
+  // common dual-stack `::` listener is reported by Node as ::ffff:a.b.c.d;
+  // cidrContains refuses a cross-family compare, so the gate folds the mapped
+  // peer via ssrfGuard.canonicalizeHost before matching (otherwise every IPv4
+  // client on a `::` listener would be denied against a documented IPv4 CIDR).
+  // Asserted at the composed-primitive level — deterministic and hang-free,
+  // where an end-to-end `::` bind + IPv4 dialog is runtime/dual-stack dependent.
+  check("relay fold: a mapped peer canonicalizes to its IPv4 dotted form",
+    b.ssrfGuard.canonicalizeHost("::ffff:127.0.0.1") === "127.0.0.1");
+  check("relay fold: the raw mixed-family compare does NOT match (fold is required)",
+    b.ssrfGuard.cidrContains("127.0.0.0/8", "::ffff:127.0.0.1") === false);
+  check("relay fold: the folded IPv4 peer matches the IPv4 relay CIDR",
+    b.ssrfGuard.cidrContains("127.0.0.0/8", b.ssrfGuard.canonicalizeHost("::ffff:127.0.0.1")) === true);
+  check("relay fold: an out-of-CIDR mapped peer stays refused after folding (no fail-open)",
+    b.ssrfGuard.cidrContains("127.0.0.0/8", b.ssrfGuard.canonicalizeHost("::ffff:10.9.9.9")) === false);
+
+  // (c) Config-time: a malformed / mask-less relay CIDR is refused at boot.
+  function bootRejects(label, entry) {
+    var threw = null;
+    try {
+      b.mail.server.mx.create({
+        tlsContext: {}, relayAllowedFor: [entry],
+      });
+    } catch (e) { threw = e; }
+    check(label, threw && threw.code === "mail-server-mx/bad-relay-cidr");
+  }
+  bootRejects("malformed relay CIDR refused at boot", { cidr: "not-a-cidr", scope: "x" });
+  bootRejects("mask-less relay CIDR refused at boot", { cidr: "203.0.113.5", scope: "x" });
+  bootRejects("out-of-range prefix refused at boot", { cidr: "10.0.0.0/40", scope: "x" });
+  bootRejects("non-object relay entry refused at boot", "10.0.0.0/8");
+
+  // (c2) A dotted IPv4-mapped IPv6 relay CIDR (::ffff:10.0.0.0/104) is a valid
+  // spelling that cidrContains accepts; the config validation folds it to the
+  // plain IPv4 CIDR (10.0.0.0/8) so it is accepted at boot (rather than refused
+  // as bad-relay-cidr) and then matches BOTH a genuine IPv4 peer and a mapped
+  // peer via the gate's peer fold — not just the mapped form.
+  function bootAccepts(label, entry) {
+    var ok = true;
+    try { b.mail.server.mx.create({ tlsContext: {}, relayAllowedFor: [entry] }); }
+    catch (_e) { ok = false; }
+    check(label, ok);
+  }
+  bootAccepts("dotted IPv4-mapped relay CIDR accepted at boot (folded to IPv4)",
+    { cidr: "::ffff:10.0.0.0/104", scope: "internal" });
+  bootAccepts("hex-group IPv4-mapped relay CIDR accepted at boot",
+    { cidr: "::ffff:0a00:0/104", scope: "internal" });
+  check("the ::ffff:10.0.0.0/104 fold (10.0.0.0/8) matches a genuine IPv4 peer",
+    b.ssrfGuard.cidrContains("10.0.0.0/8", "10.2.3.4") === true);
+  check("the ::ffff:10.0.0.0/104 fold (10.0.0.0/8) matches an IPv4-mapped peer",
+    b.ssrfGuard.cidrContains("10.0.0.0/8", b.ssrfGuard.canonicalizeHost("::ffff:10.2.3.4")) === true);
+}
+
+// ---- Agent handoff failure surfaces a 451 transient error ---------------
+async function testAgentHandoffFailure() {
+  var ctx;
+  try { ctx = await _makeTestTlsContext(); }
+  catch (_e) { check("agent handoff failure (skipped)", true); return; }
+  var srv = b.mail.server.mx.create({
+    tlsContext: ctx, profile: "permissive", localDomains: ["example.com"],
+    agent: { handoff: async function () { throw new Error("mail store unavailable"); } },
+  });
+  var info = await srv.listen({ port: 0, address: "127.0.0.1" });
+  var sock;
+  try {
+    sock = await _connectTo(info);
+    await _sendCommand(sock, "EHLO sender.example.com");
+    await _sendCommand(sock, "MAIL FROM:<s@external.com>");
+    await _sendCommand(sock, "RCPT TO:<alice@example.com>");
+    await _sendCommand(sock, "DATA");
+    check("agent handoff rejection → 451 local delivery error",
+      /^451 4\.3\.0/.test(await _sendCommand(sock,
+        "From: s@external.com\r\nSubject: hi\r\n\r\nhello\r\n.")));
+    sock.destroy();
+  } finally { await srv.close({ timeoutMs: 1000 }); }                                 // allow:raw-time-literal — test-only short drain
+}
+
+// ---- A gate that throws is caught by the pump → 421 + connection close --
+async function testGateThrows() {
+  var ctx;
+  try { ctx = await _makeTestTlsContext(); }
+  catch (_e) { check("gate throws (skipped)", true); return; }
+  var srv = b.mail.server.mx.create({
+    tlsContext: ctx, profile: "permissive", localDomains: ["example.com"],
+    helo: { evaluate: async function () { throw new Error("gate backend down"); } },
+  });
+  var info = await srv.listen({ port: 0, address: "127.0.0.1" });
+  var sock;
+  try {
+    sock = await _connectTo(info);
+    check("throwing helo gate → 421 server error",
+      /^421 4\.3\.0/.test(await _sendCommand(sock, "EHLO sender.example.com")));
+    sock.destroy();
+  } finally { await srv.close({ timeoutMs: 1000 }); }                                 // allow:raw-time-literal — test-only short drain
+}
+
+// ---- Idle-timeout fires a 421 and closes the plaintext connection -------
+async function testIdleTimeout() {
+  var ctx;
+  try { ctx = await _makeTestTlsContext(); }
+  catch (_e) { check("idle timeout (skipped)", true); return; }
+  var srv = b.mail.server.mx.create({
+    tlsContext: ctx, profile: "permissive", localDomains: ["example.com"],
+    idleTimeoutMs: 300,                                                                // allow:raw-time-literal — test-only short idle window
+  });
+  var info = await srv.listen({ port: 0, address: "127.0.0.1" });
+  var sock;
+  try {
+    sock = await _connectTo(info);
+    var col = _collect(sock);
+    // Send nothing — the idle timer fires the transient 421.
+    await helpers.waitUntil(function () { return /^421 4\.4\.2/m.test(col.text()); },
+      { timeoutMs: 5000, label: "mx idle timeout: 421 4.4.2 delivered" });
+    check("idle connection → 421 4.4.2 + close", /^421 4\.4\.2/m.test(col.text()));
+    sock.destroy();
+  } finally { await srv.close({ timeoutMs: 1000 }); }                                 // allow:raw-time-literal — test-only short drain
+}
+
+// ---- close() drains, then force-destroys a lingering connection ---------
+async function testCloseDestroysLingering() {
+  var ctx;
+  try { ctx = await _makeTestTlsContext(); }
+  catch (_e) { check("close-drain destroy (skipped)", true); return; }
+  var srv = b.mail.server.mx.create({
+    tlsContext: ctx, profile: "permissive", localDomains: ["example.com"],
+  });
+  var info = await srv.listen({ port: 0, address: "127.0.0.1" });
+  var sock = await _connectTo(info);
+  _collect(sock);   // swallow the shutdown 421 + reset without rejecting
+  await _sendCommand(sock, "EHLO sender.example.com");
+  check("one live connection tracked before close", srv.connectionCount() === 1);
+  // Hold the client socket open; close() writes the shutdown 421, waits
+  // out the short drain, then force-destroys the lingering connection.
+  await srv.close({ timeoutMs: 200 });                                                 // allow:raw-time-literal — test-only short drain window
+  check("close() force-destroys lingering connection → count 0",
+    srv.connectionCount() === 0);
+  sock.destroy();
+}
+
+// ---- TLS error/lifecycle paths: STARTTLS-when-already-active (503),
+// a non-TLS ClientHello after the STARTTLS 220 (handshake failure), and
+// the post-STARTTLS idle timeout. Mints one CA and reuses it. ------------
+async function testTlsErrorPaths() {
+  var ca, leaf;
+  try {
+    ca = await b.mtlsEngine.generateCa({ name: "mx-tls-errpaths-ca" });
+    leaf = await b.mtlsEngine.signClientCert({
+      cn: "localhost", caCertPem: ca.caCertPem, caKeyPem: ca.caKeyPem,
+      usage: "server", sans: ["DNS:localhost", "IP:127.0.0.1"], validityDays: 1,
+    });
+  } catch (_e) { check("TLS error paths (skipped — cert fixture unavailable)", true); return; }
+  var ctx = nodeTls.createSecureContext({ key: leaf.key, cert: leaf.cert });
+
+  // ---- STARTTLS issued a second time over the negotiated TLS → 503 ----
+  var dupSrv = b.mail.server.mx.create({
+    tlsContext: ctx, profile: "permissive", localDomains: ["example.com"],
+  });
+  var dupInfo = await dupSrv.listen({ port: 0, address: "127.0.0.1" });
+  var dupPlain, dupTls;
+  try {
+    dupPlain = await _connectTo(dupInfo);
+    await _sendCommand(dupPlain, "EHLO sender.example.com");
+    check("STARTTLS → 220 ready", /^220 /.test(await _sendCommand(dupPlain, "STARTTLS")));
+    dupTls = nodeTls.connect({ socket: dupPlain, ca: [ca.caCertPem], servername: "localhost" });
+    await new Promise(function (r, j) { dupTls.once("secureConnect", r); dupTls.once("error", j); });
+    await _sendCommand(dupTls, "EHLO sender.example.com");
+    check("STARTTLS when TLS already active → 503",
+      /^503 5\.5\.1/.test(await _sendCommand(dupTls, "STARTTLS")));
+    dupTls.destroy();
+  } finally { await dupSrv.close({ timeoutMs: 1000 }); }                               // allow:raw-time-literal — test-only short drain
+
+  // ---- Non-TLS bytes after the STARTTLS 220 → handshake failure/close --
+  var hsSrv = b.mail.server.mx.create({
+    tlsContext: ctx, profile: "permissive", localDomains: ["example.com"],
+  });
+  var hsInfo = await hsSrv.listen({ port: 0, address: "127.0.0.1" });
+  var hsSock;
+  try {
+    hsSock = await _connectTo(hsInfo);
+    await _sendCommand(hsSock, "EHLO sender.example.com");
+    await _sendCommand(hsSock, "STARTTLS");
+    var closed = false;
+    hsSock.on("close", function () { closed = true; });
+    hsSock.on("error", function () { /* reset on failed handshake */ });
+    // Garbage where the TLS ClientHello should be — the server's TLS
+    // wrap errors and tears the connection down.
+    hsSock.write("this is definitely not a tls client hello\r\n");
+    await helpers.waitUntil(function () { return closed; },
+      { timeoutMs: 5000, label: "mx STARTTLS: non-TLS bytes close the connection" });
+    check("non-TLS bytes after STARTTLS 220 → connection closed", closed === true);
+    hsSock.destroy();
+  } finally { await hsSrv.close({ timeoutMs: 1000 }); }                                // allow:raw-time-literal — test-only short drain
+
+  // ---- Post-STARTTLS idle timeout fires 421 over the TLS socket -------
+  var idleSrv = b.mail.server.mx.create({
+    tlsContext: ctx, profile: "permissive", localDomains: ["example.com"],
+    idleTimeoutMs: 600,                                                                // allow:raw-time-literal — room for handshake, then idle
+  });
+  var idleInfo = await idleSrv.listen({ port: 0, address: "127.0.0.1" });
+  var idlePlain, idleTls;
+  try {
+    idlePlain = await _connectTo(idleInfo);
+    await _sendCommand(idlePlain, "EHLO sender.example.com");
+    await _sendCommand(idlePlain, "STARTTLS");
+    idleTls = nodeTls.connect({ socket: idlePlain, ca: [ca.caCertPem], servername: "localhost" });
+    await new Promise(function (r, j) { idleTls.once("secureConnect", r); idleTls.once("error", j); });
+    await _sendCommand(idleTls, "EHLO sender.example.com");
+    var tlsCol = _collect(idleTls);
+    await helpers.waitUntil(function () { return /^421 4\.4\.2/m.test(tlsCol.text()); },
+      { timeoutMs: 5000, label: "mx TLS idle timeout: 421 4.4.2 over TLS" });
+    check("post-STARTTLS idle → 421 4.4.2 over TLS", /^421 4\.4\.2/m.test(tlsCol.text()));
+    idleTls.destroy();
+  } finally { await idleSrv.close({ timeoutMs: 1000 }); }                              // allow:raw-time-literal — test-only short drain
+}
+
+// ---- Address-literal HELO / null reverse-path skip domain hardening -----
+// RFC 5321 §4.1.3 address literals (`[1.2.3.4]`) and the §4.5.5 empty
+// reverse path (`<>`) are legitimate non-domain forms; the guardDomain
+// hardening is skipped for them rather than refusing.
+async function testAddressLiteralAndNullSender() {
+  var ctx;
+  try { ctx = await _makeTestTlsContext(); }
+  catch (_e) { check("address-literal / null sender (skipped)", true); return; }
+  var srv = b.mail.server.mx.create({
+    tlsContext: ctx, profile: "permissive", localDomains: ["example.com"],
+  });
+  var info = await srv.listen({ port: 0, address: "127.0.0.1" });
+  var sock;
+  try {
+    sock = await _connectTo(info);
+    check("EHLO address literal [127.0.0.1] accepted (hardening skipped)",
+      /^250[ -]/.test(await _sendCommand(sock, "EHLO [127.0.0.1]")));
+    check("MAIL FROM:<> null reverse path accepted (bounce path)",
+      /^250 /.test(await _sendCommand(sock, "MAIL FROM:<>")));
+    check("RCPT after null sender still accepted → 250",
+      /^250 /.test(await _sendCommand(sock, "RCPT TO:<alice@example.com>")));
+    // RCPT TO address literal skips domain hardening (RFC 5321 §4.1.3);
+    // the non-local literal is then relay-refused.
+    check("RCPT TO address literal skips hardening, then relay-refused → 550",
+      /^550 5\.7\.1/.test(await _sendCommand(sock, "RCPT TO:<x@[127.0.0.1]>")));
+    sock.destroy();
+  } finally { await srv.close({ timeoutMs: 1000 }); }                                 // allow:raw-time-literal — test-only short drain
+
+  // guardDomain disabled → the HELO/EHLO hardening branch is skipped
+  // entirely (operator closed-network opt-out).
+  var offSrv = b.mail.server.mx.create({
+    tlsContext: ctx, profile: "permissive", localDomains: ["example.com"],
+    guardDomain: false,
+  });
+  var offInfo = await offSrv.listen({ port: 0, address: "127.0.0.1" });
+  var offSock;
+  try {
+    offSock = await _connectTo(offInfo);
+    check("EHLO with guardDomain disabled accepted (no hardening) → 250",
+      /^250[ -]/.test(await _sendCommand(offSock, "EHLO sender.example.com")));
+    offSock.destroy();
+  } finally { await offSrv.close({ timeoutMs: 1000 }); }                               // allow:raw-time-literal — test-only short drain
+}
+
+// ---- Per-IP concurrent-connection cap refuses the excess connection ----
+async function testConnectionRateLimit() {
+  var ctx;
+  try { ctx = await _makeTestTlsContext(); }
+  catch (_e) { check("connection rate limit (skipped)", true); return; }
+  var srv = b.mail.server.mx.create({
+    tlsContext: ctx, profile: "permissive", localDomains: ["example.com"],
+    rateLimit: { maxConcurrentConnectionsPerIp: 1 },
+  });
+  var info = await srv.listen({ port: 0, address: "127.0.0.1" });
+  var first, second;
+  try {
+    first = await _connectTo(info);   // admitted; held open to occupy the single slot
+    second = nodeNet.connect(info.port, "127.0.0.1");
+    await new Promise(function (r) { second.once("connect", r); });
+    var reply = await _readGreeting(second);   // first line is the refusal, not a 220
+    check("excess concurrent connection refused with 421 4.7.0",
+      /^421 4\.7\.0/.test(reply));
+    first.destroy();
+    second.destroy();
+  } finally { await srv.close({ timeoutMs: 1000 }); }                                 // allow:raw-time-literal — test-only short drain
+}
+
+// ---- close() is idempotent: no-arg close drains, second close is a no-op
+async function testCloseIdempotent() {
+  var ctx;
+  try { ctx = await _makeTestTlsContext(); }
+  catch (_e) { check("close idempotency (skipped)", true); return; }
+  var srv = b.mail.server.mx.create({
+    tlsContext: ctx, profile: "permissive", localDomains: ["example.com"],
+  });
+  await srv.listen({ port: 0, address: "127.0.0.1" });
+  var firstErr = null;
+  try { await srv.close(); } catch (e) { firstErr = e; }   // no opts → default drain timeout
+  check("close() with no options resolves", firstErr === null);
+  var secondErr = null;
+  try { await srv.close(); } catch (e) { secondErr = e; }  // already closed → early return
+  check("second close() is a no-op", secondErr === null);
+}
+
 async function run() {
   testSurface();
   testCreateRequiresTlsContext();
   testCreateRejectsBadBounds();
+  testGuardEnvelopeBootValidation();
+  testGuardDomainBootOptions();
   testDetectSmugglingShape();
   testFindDotTerminator();
   testDotUnstuff();
@@ -645,6 +1400,22 @@ async function run() {
   await testConnectionGates();
   await testGateOverStartTls();
   await testGuardEnvelopeGate();
+  await testCommandDispatch();
+  await testSequenceAndSyntaxErrors();
+  await testDomainRefusals();
+  await testAddressLiteralAndNullSender();
+  await testResourceLimits();
+  await testRcptFailureRateLimit();
+  await testConnectionRateLimit();
+  await testWireSmuggling();
+  await testRelayAllowed();
+  await testRelayCidrEnforced();
+  await testAgentHandoffFailure();
+  await testGateThrows();
+  await testIdleTimeout();
+  await testCloseDestroysLingering();
+  await testCloseIdempotent();
+  await testTlsErrorPaths();
 }
 
 module.exports = { run: run };