@blamejs/blamejs-shop 0.0.127 → 0.0.128

package/lib/vendor/blamejs/test/layer-0-primitives/cwt.test.js

@@ -0,0 +1,137 @@
+"use strict";
+/**
+ * Layer 0 — b.cwt (RFC 8392 CBOR Web Token) = COSE_Sign1 over a CBOR
+ * claims map. Composes b.cose (signature + alg allowlist) + b.cbor.
+ * Covers round-trip + standard-claim mapping + exp/nbf/iss/aud
+ * enforcement + tag-61 + tamper (delegated to cose).
+ */
+
+var b = require("../../index");
+var helpers = require("../helpers");
+var check = helpers.check;
+var nodeCrypto = require("node:crypto");
+
+var EC = nodeCrypto.generateKeyPairSync("ec", { namedCurve: "P-256" });
+function _now() { return Math.floor(Date.now() / 1000); }
+
+function testSurface() {
+  check("b.cwt.sign exposed", typeof b.cwt.sign === "function");
+  check("b.cwt.verify exposed", typeof b.cwt.verify === "function");
+  check("b.cwt.CLAIM_LABELS maps standard claims", b.cwt.CLAIM_LABELS.iss === 1 && b.cwt.CLAIM_LABELS.exp === 4 && b.cwt.CLAIM_LABELS.cti === 7);
+  check("b.cwt.CwtError exposed", typeof b.cwt.CwtError === "function");
+}
+
+async function testRoundTrip() {
+  var now = _now();
+  var cwt = await b.cwt.sign(
+    { iss: "issuer.example", sub: "dev-42", aud: "svc", exp: now + 3600, nbf: now - 10, iat: now, scope: "telemetry" },
+    { alg: "ES256", privateKey: EC.privateKey, kid: "k1" });
+  check("sign: produces a COSE_Sign1 (tag 18 → 0xd2)", cwt[0] === 0xd2);
+  var v = await b.cwt.verify(cwt, { algorithms: ["ES256"], publicKey: EC.publicKey });
+  check("verify: standard claims mapped back to names", v.claims.iss === "issuer.example" && v.claims.sub === "dev-42" && v.claims.exp === now + 3600);
+  check("verify: custom claim preserved", v.claims.scope === "telemetry");
+  check("verify: raw Map uses integer labels", v.raw.get(1) === "issuer.example" && v.raw.get(4) === now + 3600);
+  check("verify: alg surfaced", v.alg === "ES256");
+}
+
+async function testTimeClaims() {
+  var now = _now();
+  var expired = await b.cwt.sign({ exp: now - 3600 }, { alg: "ES256", privateKey: EC.privateKey });
+  var e1 = null;
+  try { await b.cwt.verify(expired, { algorithms: ["ES256"], publicKey: EC.publicKey }); } catch (e) { e1 = e; }
+  check("verify: expired token refused", e1 && e1.code === "cwt/expired");
+
+  var future = await b.cwt.sign({ nbf: now + 3600 }, { alg: "ES256", privateKey: EC.privateKey });
+  var e2 = null;
+  try { await b.cwt.verify(future, { algorithms: ["ES256"], publicKey: EC.publicKey }); } catch (e) { e2 = e; }
+  check("verify: not-yet-valid (nbf) token refused", e2 && e2.code === "cwt/not-yet-valid");
+
+  // Clock skew tolerance: exp 30s in the past passes with 60s skew.
+  var justExpired = await b.cwt.sign({ exp: now - 30 }, { alg: "ES256", privateKey: EC.privateKey });
+  var skewOk = await b.cwt.verify(justExpired, { algorithms: ["ES256"], publicKey: EC.publicKey, clockSkewSec: 60 });
+  check("verify: clock skew tolerates marginally-expired exp", skewOk.claims.exp === now - 30);
+
+  // now override (testing): a token valid in the future verifies if now is advanced.
+  var fut = await b.cwt.sign({ nbf: now + 100, exp: now + 200 }, { alg: "ES256", privateKey: EC.privateKey });
+  var adv = await b.cwt.verify(fut, { algorithms: ["ES256"], publicKey: EC.publicKey, now: (now + 150) * 1000 });
+  check("verify: now override advances the clock", adv.claims.nbf === now + 100);
+}
+
+async function testIssuerAudience() {
+  var cwt = await b.cwt.sign({ iss: "iss-A", aud: ["svc-1", "svc-2"] }, { alg: "ES256", privateKey: EC.privateKey });
+  var ok = await b.cwt.verify(cwt, { algorithms: ["ES256"], publicKey: EC.publicKey, expectedIssuer: "iss-A", expectedAudience: "svc-2" });
+  check("verify: matching iss + aud (array) accepted", ok.claims.iss === "iss-A");
+  var e1 = null;
+  try { await b.cwt.verify(cwt, { algorithms: ["ES256"], publicKey: EC.publicKey, expectedIssuer: "iss-B" }); } catch (e) { e1 = e; }
+  check("verify: issuer mismatch refused", e1 && e1.code === "cwt/issuer-mismatch");
+  var e2 = null;
+  try { await b.cwt.verify(cwt, { algorithms: ["ES256"], publicKey: EC.publicKey, expectedAudience: "svc-3" }); } catch (e) { e2 = e; }
+  check("verify: audience not in aud array refused", e2 && e2.code === "cwt/audience-mismatch");
+}
+
+async function testTaggedAndTamper() {
+  var tagged = await b.cwt.sign({ iss: "x" }, { alg: "ES256", privateKey: EC.privateKey, tagged: true });
+  check("sign: tagged wraps in CWT tag 61 (0xd8 0x3d)", tagged[0] === 0xd8 && tagged[1] === 0x3d);
+  var v = await b.cwt.verify(tagged, { algorithms: ["ES256"], publicKey: EC.publicKey });
+  check("verify: accepts tag-61-wrapped CWT", v.claims.iss === "x");
+
+  var cwt = await b.cwt.sign({ iss: "y" }, { alg: "ES256", privateKey: EC.privateKey });
+  var t = Buffer.from(cwt); t[t.length - 1] ^= 0xff;
+  var tampered = null;
+  try { await b.cwt.verify(t, { algorithms: ["ES256"], publicKey: EC.publicKey }); } catch (e) { tampered = e; }
+  check("verify: tampered token refused by the COSE signature check", tampered && tampered.code === "cose/bad-signature");
+}
+
+async function testRobustTagAndMalformedClaims() {
+  // Codex P1 on PR #185 — a non-minimal CBOR tag-61 encoding
+  // (0xd9 0x00 0x3d, the 2-byte-argument form) must still be unwrapped.
+  var bare = await b.cwt.sign({ iss: "x" }, { alg: "ES256", privateKey: EC.privateKey });
+  var nonMinimal = Buffer.concat([Buffer.from([0xd9, 0x00, 0x3d]), bare]);
+  var v = await b.cwt.verify(nonMinimal, { algorithms: ["ES256"], publicKey: EC.publicKey });
+  check("verify: non-minimal tag-61 encoding accepted (interop)", v.claims.iss === "x");
+
+  // Codex P2 on PR #185 — a present-but-non-numeric exp must be
+  // refused, not silently skipped (it would otherwise never expire).
+  var badExp = b.cbor.encode(new Map([[1, "iss-A"], [4, "whenever"]]));   // label 4 = exp, string value
+  var badToken = await b.cose.sign(badExp, { alg: "ES256", privateKey: EC.privateKey });
+  var e1 = null;
+  try { await b.cwt.verify(badToken, { algorithms: ["ES256"], publicKey: EC.publicKey }); } catch (e) { e1 = e; }
+  check("verify: malformed (non-numeric) exp refused", e1 && e1.code === "cwt/malformed-claim");
+
+  var badNbf = b.cbor.encode(new Map([[5, "soon"]]));   // label 5 = nbf
+  var badNbfToken = await b.cose.sign(badNbf, { alg: "ES256", privateKey: EC.privateKey });
+  var e2 = null;
+  try { await b.cwt.verify(badNbfToken, { algorithms: ["ES256"], publicKey: EC.publicKey }); } catch (e) { e2 = e; }
+  check("verify: malformed (non-numeric) nbf refused", e2 && e2.code === "cwt/malformed-claim");
+}
+
+async function testValidation() {
+  var bad = null;
+  try { await b.cwt.sign({ exp: "not-a-number" }, { alg: "ES256", privateKey: EC.privateKey }); } catch (e) { bad = e; }
+  check("sign: non-integer NumericDate refused", bad && bad.code === "cwt/bad-numeric-date");
+  var noAlg = null;
+  try { await b.cwt.verify(await b.cwt.sign({ iss: "z" }, { alg: "ES256", privateKey: EC.privateKey }), { publicKey: EC.publicKey }); } catch (e) { noAlg = e; }
+  check("verify: missing algorithms refused (delegated to cose)", noAlg !== null);
+  var badInput = null;
+  try { await b.cwt.verify("not-a-buffer", { algorithms: ["ES256"], publicKey: EC.publicKey }); } catch (e) { badInput = e; }
+  check("verify: non-buffer input refused", badInput && badInput.code === "cwt/bad-input");
+}
+
+async function run() {
+  testSurface();
+  await testRoundTrip();
+  await testTimeClaims();
+  await testIssuerAudience();
+  await testTaggedAndTamper();
+  await testRobustTagAndMalformedClaims();
+  await testValidation();
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  run().then(
+    function () { console.log("[cwt] OK — " + helpers.getChecks() + " checks passed"); },
+    function (e) { console.error("FAIL:", e && e.stack || e); process.exit(1); }
+  );
+}

package/lib/vendor/blamejs/test/layer-0-primitives/eat.test.js

@@ -0,0 +1,111 @@
+"use strict";
+/**
+ * Layer 0 — b.eat (RFC 9711 Entity Attestation Token) over b.cwt.
+ * Covers EAT claim-label mapping, the verifier-nonce freshness
+ * binding, debug-status policy, profile pinning, and that the
+ * signature / time checks delegate to b.cwt / b.cose.
+ */
+
+var b = require("../../index");
+var helpers = require("../helpers");
+var check = helpers.check;
+var nodeCrypto = require("node:crypto");
+
+var EC = nodeCrypto.generateKeyPairSync("ec", { namedCurve: "P-256" });
+function _now() { return Math.floor(Date.now() / 1000); }
+
+function testSurface() {
+  check("b.eat.sign exposed", typeof b.eat.sign === "function");
+  check("b.eat.verify exposed", typeof b.eat.verify === "function");
+  check("b.eat.CLAIM_LABELS has RFC 9711 keys", b.eat.CLAIM_LABELS.nonce === 10 && b.eat.CLAIM_LABELS.dbgstat === 263 && b.eat.CLAIM_LABELS.eat_profile === 265);
+  check("b.eat.DBGSTAT enum", b.eat.DBGSTAT["disabled-permanently"] === 3 && b.eat.DBGSTAT.enabled === 0);
+  check("b.eat.EatError exposed", typeof b.eat.EatError === "function");
+}
+
+async function testRoundTripAndLabels() {
+  var nonce = b.crypto.generateBytes(16);
+  var eat = await b.eat.sign(
+    { nonce: nonce, ueid: Buffer.from([1, 2, 3, 4]), oemid: Buffer.from("acme"), dbgstat: "disabled-permanently",
+      eat_profile: "https://example.com/eat/p1", iss: "device-ca", iat: _now() },
+    { alg: "ES256", privateKey: EC.privateKey });
+  var v = await b.eat.verify(eat, { algorithms: ["ES256"], publicKey: EC.publicKey, expectedNonce: nonce });
+  check("verify: friendly EAT claim names returned", Buffer.isBuffer(v.claims.ueid) && v.claims.eat_profile === "https://example.com/eat/p1");
+  check("verify: dbgstat decoded to enum name", v.claims.dbgstat === "disabled-permanently");
+  check("verify: standard claim (iss) still named", v.claims.iss === "device-ca");
+  check("verify: raw Map uses RFC 9711 integer labels", v.raw.get(10) !== undefined && v.raw.get(263) === 3 && v.raw.get(265) === "https://example.com/eat/p1");
+}
+
+async function testNonceBinding() {
+  var nonce = b.crypto.generateBytes(16);
+  var eat = await b.eat.sign({ nonce: nonce, ueid: Buffer.from([9]) }, { alg: "ES256", privateKey: EC.privateKey });
+  var ok = await b.eat.verify(eat, { algorithms: ["ES256"], publicKey: EC.publicKey, expectedNonce: nonce });
+  check("nonce: matching expectedNonce accepted", Buffer.isBuffer(ok.claims.nonce));
+  var mismatch = null;
+  try { await b.eat.verify(eat, { algorithms: ["ES256"], publicKey: EC.publicKey, expectedNonce: b.crypto.generateBytes(16) }); } catch (e) { mismatch = e; }
+  check("nonce: mismatch refused (replay/freshness defense)", mismatch && mismatch.code === "eat/nonce-mismatch");
+  // Token with no nonce but RP expects one → refused.
+  var noNonce = await b.eat.sign({ ueid: Buffer.from([1]) }, { alg: "ES256", privateKey: EC.privateKey });
+  var missing = null;
+  try { await b.eat.verify(noNonce, { algorithms: ["ES256"], publicKey: EC.publicKey, expectedNonce: nonce }); } catch (e) { missing = e; }
+  check("nonce: expectedNonce but no eat_nonce claim refused", missing && missing.code === "eat/nonce-missing");
+  // Array-of-nonces (multi-verifier) membership.
+  var multi = await b.eat.sign({ nonce: [b.crypto.generateBytes(16), nonce] }, { alg: "ES256", privateKey: EC.privateKey });
+  var m = await b.eat.verify(multi, { algorithms: ["ES256"], publicKey: EC.publicKey, expectedNonce: nonce });
+  check("nonce: array form matches when one entry equals expectedNonce", Array.isArray(m.claims.nonce));
+}
+
+async function testDebugStatusAndProfile() {
+  var enabled = await b.eat.sign({ dbgstat: "enabled" }, { alg: "ES256", privateKey: EC.privateKey });
+  var e1 = null;
+  try { await b.eat.verify(enabled, { algorithms: ["ES256"], publicKey: EC.publicKey, requireDebugDisabled: true }); } catch (e) { e1 = e; }
+  check("dbgstat: enabled refused under requireDebugDisabled", e1 && e1.code === "eat/debug-not-disabled");
+
+  var absent = await b.eat.sign({ ueid: Buffer.from([1]) }, { alg: "ES256", privateKey: EC.privateKey });
+  var e2 = null;
+  try { await b.eat.verify(absent, { algorithms: ["ES256"], publicKey: EC.publicKey, requireDebugDisabled: true }); } catch (e) { e2 = e; }
+  check("dbgstat: absent refused under requireDebugDisabled", e2 && e2.code === "eat/debug-not-disabled");
+
+  var disabled = await b.eat.sign({ dbgstat: "disabled-fully-and-permanently" }, { alg: "ES256", privateKey: EC.privateKey });
+  var ok = await b.eat.verify(disabled, { algorithms: ["ES256"], publicKey: EC.publicKey, requireDebugDisabled: true });
+  check("dbgstat: a disabled state passes", ok.claims.dbgstat === "disabled-fully-and-permanently");
+
+  var prof = await b.eat.sign({ eat_profile: "p-A" }, { alg: "ES256", privateKey: EC.privateKey });
+  var e3 = null;
+  try { await b.eat.verify(prof, { algorithms: ["ES256"], publicKey: EC.publicKey, expectedProfile: "p-B" }); } catch (e) { e3 = e; }
+  check("profile: expectedProfile mismatch refused", e3 && e3.code === "eat/profile-mismatch");
+}
+
+async function testValidationAndTamper() {
+  var bad = null;
+  try { await b.eat.sign({ dbgstat: "bogus" }, { alg: "ES256", privateKey: EC.privateKey }); } catch (e) { bad = e; }
+  check("sign: bad dbgstat enum refused", bad && bad.code === "eat/bad-dbgstat");
+
+  var eat = await b.eat.sign({ nonce: b.crypto.generateBytes(16) }, { alg: "ES256", privateKey: EC.privateKey });
+  var t = Buffer.from(eat); t[t.length - 1] ^= 0xff;
+  var tampered = null;
+  try { await b.eat.verify(t, { algorithms: ["ES256"], publicKey: EC.publicKey }); } catch (e) { tampered = e; }
+  check("verify: tampered token refused by COSE signature check", tampered && tampered.code === "cose/bad-signature");
+
+  // exp from the CWT layer still enforced through EAT.
+  var expired = await b.eat.sign({ exp: _now() - 3600, ueid: Buffer.from([1]) }, { alg: "ES256", privateKey: EC.privateKey });
+  var exp = null;
+  try { await b.eat.verify(expired, { algorithms: ["ES256"], publicKey: EC.publicKey }); } catch (e) { exp = e; }
+  check("verify: expired EAT refused (delegated to cwt)", exp && exp.code === "cwt/expired");
+}
+
+async function run() {
+  testSurface();
+  await testRoundTripAndLabels();
+  await testNonceBinding();
+  await testDebugStatusAndProfile();
+  await testValidationAndTamper();
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  run().then(
+    function () { console.log("[eat] OK — " + helpers.getChecks() + " checks passed"); },
+    function (e) { console.error("FAIL:", e && e.stack || e); process.exit(1); }
+  );
+}

package/lib/vendor/blamejs/test/layer-0-primitives/scitt.test.js

@@ -0,0 +1,158 @@
+"use strict";
+/**
+ * Layer 0 — b.scitt (SCITT signed statements) over b.cose.
+ * Covers the signed-statement round-trip, the integrity-protected
+ * CWT_Claims (iss/sub) binding, refusal of a bare COSE_Sign1 that
+ * carries no CWT_Claims, expected-issuer/subject enforcement, the
+ * reserved-claim guard, content-type media-type strings, and that the
+ * signature checks delegate to b.cose. Exercises the classical (ES256 /
+ * EdDSA) algorithms and the ML-DSA-87 PQC-forward path.
+ */
+
+var b = require("../../index");
+var helpers = require("../helpers");
+var check = helpers.check;
+var nodeCrypto = require("node:crypto");
+
+var EC = nodeCrypto.generateKeyPairSync("ec", { namedCurve: "P-256" });
+var ED = nodeCrypto.generateKeyPairSync("ed25519");
+var SBOM = Buffer.from('{"spdxVersion":"SPDX-2.3","name":"widget"}', "utf8");
+
+function testSurface() {
+  check("b.scitt.signStatement exposed", typeof b.scitt.signStatement === "function");
+  check("b.scitt.verifyStatement exposed", typeof b.scitt.verifyStatement === "function");
+  check("b.scitt.CWT_CLAIMS_LABEL is RFC 9597 label 15", b.scitt.CWT_CLAIMS_LABEL === 15);
+  check("b.scitt.ScittError exposed", typeof b.scitt.ScittError === "function");
+}
+
+async function testRoundTrip() {
+  var stmt = await b.scitt.signStatement(SBOM, {
+    alg: "ES256", privateKey: EC.privateKey,
+    issuer: "https://builder.example", subject: "pkg:npm/widget@1.2.3",
+    contentType: "application/spdx+json", claims: { 6: 1700000000 },
+  });
+  check("signed statement is bytes", Buffer.isBuffer(stmt));
+
+  var out = await b.scitt.verifyStatement(stmt, {
+    algorithms: ["ES256"], publicKey: EC.publicKey,
+    expectedIssuer: "https://builder.example", expectedSubject: "pkg:npm/widget@1.2.3",
+  });
+  check("verify: payload round-trips", out.payload.equals(SBOM));
+  check("verify: issuer extracted from CWT_Claims", out.issuer === "https://builder.example");
+  check("verify: subject extracted from CWT_Claims", out.subject === "pkg:npm/widget@1.2.3");
+  check("verify: extra CWT claim (iat) preserved", out.cwtClaims.get(6) === 1700000000);
+  check("verify: alg reported", out.alg === "ES256");
+  // Content type is a media-type STRING in the protected header (label 3).
+  check("verify: content-type media-type string in protected header", out.protectedHeaders.get(3) === "application/spdx+json");
+  // CWT_Claims live in the INTEGRITY-PROTECTED header (label 15), not unprotected.
+  check("verify: CWT_Claims is in the protected header", out.protectedHeaders.get(15) instanceof Map);
+}
+
+async function testIdentityBindingRefusals() {
+  var stmt = await b.scitt.signStatement(SBOM, {
+    alg: "ES256", privateKey: EC.privateKey, issuer: "iss-a", subject: "sub-a",
+  });
+
+  var e1 = null;
+  try {
+    await b.scitt.verifyStatement(stmt, { algorithms: ["ES256"], publicKey: EC.publicKey, expectedIssuer: "iss-b" });
+  } catch (e) { e1 = e; }
+  check("verify: issuer mismatch refused", e1 && e1.code === "scitt/issuer-mismatch");
+
+  var e2 = null;
+  try {
+    await b.scitt.verifyStatement(stmt, { algorithms: ["ES256"], publicKey: EC.publicKey, expectedSubject: "sub-b" });
+  } catch (e) { e2 = e; }
+  check("verify: subject mismatch refused", e2 && e2.code === "scitt/subject-mismatch");
+
+  // A bare COSE_Sign1 (no CWT_Claims header) is NOT a SCITT statement.
+  var bare = await b.cose.sign(SBOM, { alg: "ES256", privateKey: EC.privateKey });
+  var e3 = null;
+  try { await b.scitt.verifyStatement(bare, { algorithms: ["ES256"], publicKey: EC.publicKey }); } catch (e) { e3 = e; }
+  check("verify: bare COSE_Sign1 (no CWT_Claims) refused", e3 && e3.code === "scitt/missing-cwt-claims");
+}
+
+async function testSignRefusals() {
+  var refusals = [
+    ["missing issuer", { alg: "ES256", privateKey: EC.privateKey, subject: "s" }, "scitt/bad-issuer"],
+    ["empty issuer", { alg: "ES256", privateKey: EC.privateKey, issuer: "", subject: "s" }, "scitt/bad-issuer"],
+    ["missing subject", { alg: "ES256", privateKey: EC.privateKey, issuer: "i" }, "scitt/bad-subject"],
+    ["iss override via claims", { alg: "ES256", privateKey: EC.privateKey, issuer: "i", subject: "s", claims: { 1: "evil" } }, "scitt/reserved-claim"],
+    ["sub override via claims", { alg: "ES256", privateKey: EC.privateKey, issuer: "i", subject: "s", claims: { 2: "evil" } }, "scitt/reserved-claim"],
+    ["non-integer claim label", { alg: "ES256", privateKey: EC.privateKey, issuer: "i", subject: "s", claims: { 1.5: "x" } }, "scitt/bad-claim-label"],
+  ];
+  for (var i = 0; i < refusals.length; i++) {
+    var err = null;
+    try { await b.scitt.signStatement(SBOM, refusals[i][1]); } catch (e) { err = e; }
+    check("signStatement refuses: " + refusals[i][0], err && err.code === refusals[i][2]);
+  }
+}
+
+async function testTamperAndDelegation() {
+  var stmt = await b.scitt.signStatement(SBOM, {
+    alg: "ES256", privateKey: EC.privateKey, issuer: "i", subject: "s",
+  });
+
+  // Tampering the bytes fails the underlying COSE signature check.
+  var bad = Buffer.from(stmt); bad[bad.length - 1] ^= 0xff;
+  var t = null;
+  try { await b.scitt.verifyStatement(bad, { algorithms: ["ES256"], publicKey: EC.publicKey }); } catch (e) { t = e; }
+  check("verify: tampered statement refused by COSE signature", t && t.code === "cose/bad-signature");
+
+  // The algorithm allowlist is mandatory and delegated to b.cose.verify.
+  var a = null;
+  try { await b.scitt.verifyStatement(stmt, { algorithms: ["EdDSA"], publicKey: EC.publicKey }); } catch (e) { a = e; }
+  check("verify: alg outside allowlist refused (delegated to cose)", a && a.code === "cose/alg-not-allowed");
+}
+
+async function testEdDsaAndPqc() {
+  // EdDSA (final COSE id, interoperable today).
+  var s1 = await b.scitt.signStatement(SBOM, { alg: "EdDSA", privateKey: ED.privateKey, issuer: "i", subject: "s" });
+  var o1 = await b.scitt.verifyStatement(s1, { algorithms: ["EdDSA"], publicKey: ED.publicKey });
+  check("EdDSA: round-trips with iss/sub", o1.issuer === "i" && o1.subject === "s");
+
+  // ML-DSA-87 (PQC-forward) — skip gracefully if the runtime lacks it.
+  var mldsa = null;
+  try { mldsa = nodeCrypto.generateKeyPairSync("ml-dsa-87"); } catch (_e) { mldsa = null; }
+  if (mldsa) {
+    var s2 = await b.scitt.signStatement(SBOM, { alg: "ML-DSA-87", privateKey: mldsa.privateKey, issuer: "pqc-iss", subject: "pqc-sub" });
+    var o2 = await b.scitt.verifyStatement(s2, { algorithms: ["ML-DSA-87"], publicKey: mldsa.publicKey });
+    check("ML-DSA-87: round-trips with iss/sub", o2.issuer === "pqc-iss" && o2.subject === "pqc-sub");
+  } else {
+    check("ML-DSA-87: runtime lacks ml-dsa-87 — classical path covers the contract", true);
+  }
+}
+
+async function testExternalAadBinding() {
+  var aad = Buffer.from("registration-context", "utf8");
+  var stmt = await b.scitt.signStatement(SBOM, {
+    alg: "ES256", privateKey: EC.privateKey, issuer: "i", subject: "s", externalAad: aad,
+  });
+  var ok = await b.scitt.verifyStatement(stmt, { algorithms: ["ES256"], publicKey: EC.publicKey, externalAad: aad });
+  check("externalAad: matching context verifies", ok.subject === "s");
+
+  var mism = null;
+  try {
+    await b.scitt.verifyStatement(stmt, { algorithms: ["ES256"], publicKey: EC.publicKey, externalAad: Buffer.from("other") });
+  } catch (e) { mism = e; }
+  check("externalAad: mismatched context refused", mism && mism.code === "cose/bad-signature");
+}
+
+async function run() {
+  testSurface();
+  await testRoundTrip();
+  await testIdentityBindingRefusals();
+  await testSignRefusals();
+  await testTamperAndDelegation();
+  await testEdDsaAndPqc();
+  await testExternalAadBinding();
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  run().then(
+    function () { console.log("[scitt] OK — " + helpers.getChecks() + " checks passed"); },
+    function (e) { console.error("FAIL:", e && e.stack || e); process.exit(1); }
+  );
+}