@blamejs/blamejs-shop 0.0.127 → 0.0.129

package/lib/vendor/blamejs/test/layer-0-primitives/cose.test.js

@@ -18,9 +18,62 @@ var ML = nodeCrypto.generateKeyPairSync("ml-dsa-87");
 function testSurface() {
   check("b.cose.sign exposed", typeof b.cose.sign === "function");
   check("b.cose.verify exposed", typeof b.cose.verify === "function");
+  check("b.cose.encrypt0 exposed", typeof b.cose.encrypt0 === "function");
+  check("b.cose.decrypt0 exposed", typeof b.cose.decrypt0 === "function");
   check("b.cose.ALGORITHMS exposes COSE alg ids", b.cose.ALGORITHMS["ES256"] === -7 && b.cose.ALGORITHMS["ML-DSA-87"] === -50);
+  check("b.cose.AEAD_ALGORITHMS exposes AEAD ids", b.cose.AEAD_ALGORITHMS["ChaCha20-Poly1305"] === 24 && b.cose.AEAD_ALGORITHMS["A256GCM"] === 3);
   check("b.cose.COSE_SIGN1_TAG is 18", b.cose.COSE_SIGN1_TAG === 18);
-  check("b.cose.CborError-style CoseError exposed", typeof b.cose.CoseError === "function");
+  check("b.cose.COSE_ENCRYPT0_TAG is 16", b.cose.COSE_ENCRYPT0_TAG === 16);
+  check("b.cose.CoseError exposed", typeof b.cose.CoseError === "function");
+}
+
+function testEncrypt0() {
+  var key = b.crypto.generateBytes(32);
+  var enc = b.cose.encrypt0(Buffer.from("secret-payload"), { alg: "ChaCha20-Poly1305", key: key });
+  check("encrypt0: tagged COSE_Encrypt0 (tag 16 → 0xd0)", enc[0] === 0xd0);
+  var d = b.cose.decrypt0(enc, { key: key, algorithms: ["ChaCha20-Poly1305"] });
+  check("encrypt0: round-trips plaintext + alg", d.plaintext.toString() === "secret-payload" && d.alg === "ChaCha20-Poly1305");
+
+  var wrongKey = null;
+  try { b.cose.decrypt0(enc, { key: b.crypto.generateBytes(32), algorithms: ["ChaCha20-Poly1305"] }); } catch (e) { wrongKey = e; }
+  check("decrypt0: wrong key refused", wrongKey && wrongKey.code === "cose/decrypt-failed");
+
+  var t = Buffer.from(enc); t[t.length - 1] ^= 0xff;
+  var tampered = null;
+  try { b.cose.decrypt0(t, { key: key, algorithms: ["ChaCha20-Poly1305"] }); } catch (e) { tampered = e; }
+  check("decrypt0: tampered ciphertext refused", tampered && tampered.code === "cose/decrypt-failed");
+
+  var notAllowed = null;
+  try { b.cose.decrypt0(enc, { key: key, algorithms: ["A256GCM"] }); } catch (e) { notAllowed = e; }
+  check("decrypt0: alg not in allowlist refused", notAllowed && notAllowed.code === "cose/alg-not-allowed");
+
+  // A256GCM opt-in round-trip.
+  var encG = b.cose.encrypt0(Buffer.from("g"), { alg: "A256GCM", key: key });
+  check("encrypt0: A256GCM round-trip", b.cose.decrypt0(encG, { key: key, algorithms: ["A256GCM"] }).plaintext.toString() === "g");
+
+  // external_aad must match.
+  var encA = b.cose.encrypt0(Buffer.from("z"), { key: key, externalAad: Buffer.from("ctx-A") });
+  var aadMismatch = null;
+  try { b.cose.decrypt0(encA, { key: key, algorithms: ["ChaCha20-Poly1305"], externalAad: Buffer.from("ctx-B") }); } catch (e) { aadMismatch = e; }
+  check("decrypt0: external_aad mismatch refused", aadMismatch && aadMismatch.code === "cose/decrypt-failed");
+
+  // Key-length + algorithms-required validation.
+  var badKey = null;
+  try { b.cose.encrypt0(Buffer.from("x"), { alg: "A128GCM", key: key }); } catch (e) { badKey = e; }   // 32-byte key for A128GCM (needs 16)
+  check("encrypt0: wrong key length refused", badKey && badKey.code === "cose/bad-key");
+  var noAlgs = null;
+  try { b.cose.decrypt0(enc, { key: key }); } catch (e) { noAlgs = e; }
+  check("decrypt0: missing algorithms refused", noAlgs && noAlgs.code === "cose/algorithms-required");
+
+  // Codex P2 on PR #187 — an unprotectedHeaders override of label 5
+  // (IV) would emit a token whose stored IV disagrees with the AEAD
+  // IV (undecryptable); it must be refused.
+  var ivOverride = null;
+  try { b.cose.encrypt0(Buffer.from("x"), { key: key, unprotectedHeaders: { 5: Buffer.alloc(12) } }); } catch (e) { ivOverride = e; }
+  check("encrypt0: unprotectedHeaders IV override (label 5) refused", ivOverride && ivOverride.code === "cose/reserved-header");
+  // A non-IV unprotected header is still allowed + surfaced.
+  var withHdr = b.cose.encrypt0(Buffer.from("x"), { key: key, unprotectedHeaders: { 4: Buffer.from("kid-1") } });
+  check("encrypt0: non-IV unprotected header preserved", b.cose.decrypt0(withHdr, { key: key, algorithms: ["ChaCha20-Poly1305"] }).unprotectedHeaders.get(4).toString() === "kid-1");
 }
 
 async function testClassicalUseableToday() {
@@ -35,6 +88,34 @@ async function testClassicalUseableToday() {
   check("EdDSA: round-trips (string payload → bstr)", (await b.cose.verify(sed, { algorithms: ["EdDSA"], publicKey: ED.publicKey })).payload.toString() === "msg");
 }
 
+async function testProtectedHeaders() {
+  // Extra integrity-protected headers (numeric labels) ride in the
+  // protected map and are covered by the signature — a CWT_Claims map
+  // (label 15) is the SCITT case.
+  var cwtClaims = new Map([[1, "iss.example"], [2, "subject-id"]]);
+  var s = await b.cose.sign(Buffer.from("artifact"), {
+    alg: "ES256", privateKey: EC.privateKey,
+    protectedHeaders: { 15: cwtClaims }, contentType: "application/spdx+json",
+  });
+  var v = await b.cose.verify(s, { algorithms: ["ES256"], publicKey: EC.publicKey });
+  check("protectedHeaders: label 15 (CWT_Claims) in protected map", v.protectedHeaders.get(15) instanceof Map && v.protectedHeaders.get(15).get(1) === "iss.example");
+  check("protectedHeaders: string content-type (label 3) preserved", v.protectedHeaders.get(3) === "application/spdx+json");
+
+  // alg (label 1) is reserved — protectedHeaders cannot override it.
+  var reserved = null;
+  try {
+    await b.cose.sign(Buffer.from("x"), { alg: "ES256", privateKey: EC.privateKey, protectedHeaders: { 1: -7 } });
+  } catch (e) { reserved = e; }
+  check("protectedHeaders: setting label 1 (alg) refused", reserved && reserved.code === "cose/reserved-header");
+
+  // A protected-header object accepts a Map too (integer keys preserved).
+  var sMap = await b.cose.sign(Buffer.from("y"), {
+    alg: "ES256", privateKey: EC.privateKey, protectedHeaders: new Map([[15, cwtClaims]]),
+  });
+  var vMap = await b.cose.verify(sMap, { algorithms: ["ES256"], publicKey: EC.publicKey });
+  check("protectedHeaders: Map input round-trips", vMap.protectedHeaders.get(15).get(2) === "subject-id");
+}
+
 async function testPqcForward() {
   var s = await b.cose.sign(Buffer.from("pqc"), { alg: "ML-DSA-87", privateKey: ML.privateKey });
   var v = await b.cose.verify(s, { algorithms: ["ML-DSA-87"], publicKey: ML.publicKey });
@@ -113,7 +194,9 @@ async function testValidation() {
 
 async function run() {
   testSurface();
+  testEncrypt0();
   await testClassicalUseableToday();
+  await testProtectedHeaders();
   await testPqcForward();
   await testTamperAndAllowlist();
   await testCritBypassDefense();

package/lib/vendor/blamejs/test/layer-0-primitives/cwt.test.js

@@ -0,0 +1,137 @@
+"use strict";
+/**
+ * Layer 0 — b.cwt (RFC 8392 CBOR Web Token) = COSE_Sign1 over a CBOR
+ * claims map. Composes b.cose (signature + alg allowlist) + b.cbor.
+ * Covers round-trip + standard-claim mapping + exp/nbf/iss/aud
+ * enforcement + tag-61 + tamper (delegated to cose).
+ */
+
+var b = require("../../index");
+var helpers = require("../helpers");
+var check = helpers.check;
+var nodeCrypto = require("node:crypto");
+
+var EC = nodeCrypto.generateKeyPairSync("ec", { namedCurve: "P-256" });
+function _now() { return Math.floor(Date.now() / 1000); }
+
+function testSurface() {
+  check("b.cwt.sign exposed", typeof b.cwt.sign === "function");
+  check("b.cwt.verify exposed", typeof b.cwt.verify === "function");
+  check("b.cwt.CLAIM_LABELS maps standard claims", b.cwt.CLAIM_LABELS.iss === 1 && b.cwt.CLAIM_LABELS.exp === 4 && b.cwt.CLAIM_LABELS.cti === 7);
+  check("b.cwt.CwtError exposed", typeof b.cwt.CwtError === "function");
+}
+
+async function testRoundTrip() {
+  var now = _now();
+  var cwt = await b.cwt.sign(
+    { iss: "issuer.example", sub: "dev-42", aud: "svc", exp: now + 3600, nbf: now - 10, iat: now, scope: "telemetry" },
+    { alg: "ES256", privateKey: EC.privateKey, kid: "k1" });
+  check("sign: produces a COSE_Sign1 (tag 18 → 0xd2)", cwt[0] === 0xd2);
+  var v = await b.cwt.verify(cwt, { algorithms: ["ES256"], publicKey: EC.publicKey });
+  check("verify: standard claims mapped back to names", v.claims.iss === "issuer.example" && v.claims.sub === "dev-42" && v.claims.exp === now + 3600);
+  check("verify: custom claim preserved", v.claims.scope === "telemetry");
+  check("verify: raw Map uses integer labels", v.raw.get(1) === "issuer.example" && v.raw.get(4) === now + 3600);
+  check("verify: alg surfaced", v.alg === "ES256");
+}
+
+async function testTimeClaims() {
+  var now = _now();
+  var expired = await b.cwt.sign({ exp: now - 3600 }, { alg: "ES256", privateKey: EC.privateKey });
+  var e1 = null;
+  try { await b.cwt.verify(expired, { algorithms: ["ES256"], publicKey: EC.publicKey }); } catch (e) { e1 = e; }
+  check("verify: expired token refused", e1 && e1.code === "cwt/expired");
+
+  var future = await b.cwt.sign({ nbf: now + 3600 }, { alg: "ES256", privateKey: EC.privateKey });
+  var e2 = null;
+  try { await b.cwt.verify(future, { algorithms: ["ES256"], publicKey: EC.publicKey }); } catch (e) { e2 = e; }
+  check("verify: not-yet-valid (nbf) token refused", e2 && e2.code === "cwt/not-yet-valid");
+
+  // Clock skew tolerance: exp 30s in the past passes with 60s skew.
+  var justExpired = await b.cwt.sign({ exp: now - 30 }, { alg: "ES256", privateKey: EC.privateKey });
+  var skewOk = await b.cwt.verify(justExpired, { algorithms: ["ES256"], publicKey: EC.publicKey, clockSkewSec: 60 });
+  check("verify: clock skew tolerates marginally-expired exp", skewOk.claims.exp === now - 30);
+
+  // now override (testing): a token valid in the future verifies if now is advanced.
+  var fut = await b.cwt.sign({ nbf: now + 100, exp: now + 200 }, { alg: "ES256", privateKey: EC.privateKey });
+  var adv = await b.cwt.verify(fut, { algorithms: ["ES256"], publicKey: EC.publicKey, now: (now + 150) * 1000 });
+  check("verify: now override advances the clock", adv.claims.nbf === now + 100);
+}
+
+async function testIssuerAudience() {
+  var cwt = await b.cwt.sign({ iss: "iss-A", aud: ["svc-1", "svc-2"] }, { alg: "ES256", privateKey: EC.privateKey });
+  var ok = await b.cwt.verify(cwt, { algorithms: ["ES256"], publicKey: EC.publicKey, expectedIssuer: "iss-A", expectedAudience: "svc-2" });
+  check("verify: matching iss + aud (array) accepted", ok.claims.iss === "iss-A");
+  var e1 = null;
+  try { await b.cwt.verify(cwt, { algorithms: ["ES256"], publicKey: EC.publicKey, expectedIssuer: "iss-B" }); } catch (e) { e1 = e; }
+  check("verify: issuer mismatch refused", e1 && e1.code === "cwt/issuer-mismatch");
+  var e2 = null;
+  try { await b.cwt.verify(cwt, { algorithms: ["ES256"], publicKey: EC.publicKey, expectedAudience: "svc-3" }); } catch (e) { e2 = e; }
+  check("verify: audience not in aud array refused", e2 && e2.code === "cwt/audience-mismatch");
+}
+
+async function testTaggedAndTamper() {
+  var tagged = await b.cwt.sign({ iss: "x" }, { alg: "ES256", privateKey: EC.privateKey, tagged: true });
+  check("sign: tagged wraps in CWT tag 61 (0xd8 0x3d)", tagged[0] === 0xd8 && tagged[1] === 0x3d);
+  var v = await b.cwt.verify(tagged, { algorithms: ["ES256"], publicKey: EC.publicKey });
+  check("verify: accepts tag-61-wrapped CWT", v.claims.iss === "x");
+
+  var cwt = await b.cwt.sign({ iss: "y" }, { alg: "ES256", privateKey: EC.privateKey });
+  var t = Buffer.from(cwt); t[t.length - 1] ^= 0xff;
+  var tampered = null;
+  try { await b.cwt.verify(t, { algorithms: ["ES256"], publicKey: EC.publicKey }); } catch (e) { tampered = e; }
+  check("verify: tampered token refused by the COSE signature check", tampered && tampered.code === "cose/bad-signature");
+}
+
+async function testRobustTagAndMalformedClaims() {
+  // Codex P1 on PR #185 — a non-minimal CBOR tag-61 encoding
+  // (0xd9 0x00 0x3d, the 2-byte-argument form) must still be unwrapped.
+  var bare = await b.cwt.sign({ iss: "x" }, { alg: "ES256", privateKey: EC.privateKey });
+  var nonMinimal = Buffer.concat([Buffer.from([0xd9, 0x00, 0x3d]), bare]);
+  var v = await b.cwt.verify(nonMinimal, { algorithms: ["ES256"], publicKey: EC.publicKey });
+  check("verify: non-minimal tag-61 encoding accepted (interop)", v.claims.iss === "x");
+
+  // Codex P2 on PR #185 — a present-but-non-numeric exp must be
+  // refused, not silently skipped (it would otherwise never expire).
+  var badExp = b.cbor.encode(new Map([[1, "iss-A"], [4, "whenever"]]));   // label 4 = exp, string value
+  var badToken = await b.cose.sign(badExp, { alg: "ES256", privateKey: EC.privateKey });
+  var e1 = null;
+  try { await b.cwt.verify(badToken, { algorithms: ["ES256"], publicKey: EC.publicKey }); } catch (e) { e1 = e; }
+  check("verify: malformed (non-numeric) exp refused", e1 && e1.code === "cwt/malformed-claim");
+
+  var badNbf = b.cbor.encode(new Map([[5, "soon"]]));   // label 5 = nbf
+  var badNbfToken = await b.cose.sign(badNbf, { alg: "ES256", privateKey: EC.privateKey });
+  var e2 = null;
+  try { await b.cwt.verify(badNbfToken, { algorithms: ["ES256"], publicKey: EC.publicKey }); } catch (e) { e2 = e; }
+  check("verify: malformed (non-numeric) nbf refused", e2 && e2.code === "cwt/malformed-claim");
+}
+
+async function testValidation() {
+  var bad = null;
+  try { await b.cwt.sign({ exp: "not-a-number" }, { alg: "ES256", privateKey: EC.privateKey }); } catch (e) { bad = e; }
+  check("sign: non-integer NumericDate refused", bad && bad.code === "cwt/bad-numeric-date");
+  var noAlg = null;
+  try { await b.cwt.verify(await b.cwt.sign({ iss: "z" }, { alg: "ES256", privateKey: EC.privateKey }), { publicKey: EC.publicKey }); } catch (e) { noAlg = e; }
+  check("verify: missing algorithms refused (delegated to cose)", noAlg !== null);
+  var badInput = null;
+  try { await b.cwt.verify("not-a-buffer", { algorithms: ["ES256"], publicKey: EC.publicKey }); } catch (e) { badInput = e; }
+  check("verify: non-buffer input refused", badInput && badInput.code === "cwt/bad-input");
+}
+
+async function run() {
+  testSurface();
+  await testRoundTrip();
+  await testTimeClaims();
+  await testIssuerAudience();
+  await testTaggedAndTamper();
+  await testRobustTagAndMalformedClaims();
+  await testValidation();
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  run().then(
+    function () { console.log("[cwt] OK — " + helpers.getChecks() + " checks passed"); },
+    function (e) { console.error("FAIL:", e && e.stack || e); process.exit(1); }
+  );
+}

package/lib/vendor/blamejs/test/layer-0-primitives/eat.test.js

@@ -0,0 +1,111 @@
+"use strict";
+/**
+ * Layer 0 — b.eat (RFC 9711 Entity Attestation Token) over b.cwt.
+ * Covers EAT claim-label mapping, the verifier-nonce freshness
+ * binding, debug-status policy, profile pinning, and that the
+ * signature / time checks delegate to b.cwt / b.cose.
+ */
+
+var b = require("../../index");
+var helpers = require("../helpers");
+var check = helpers.check;
+var nodeCrypto = require("node:crypto");
+
+var EC = nodeCrypto.generateKeyPairSync("ec", { namedCurve: "P-256" });
+function _now() { return Math.floor(Date.now() / 1000); }
+
+function testSurface() {
+  check("b.eat.sign exposed", typeof b.eat.sign === "function");
+  check("b.eat.verify exposed", typeof b.eat.verify === "function");
+  check("b.eat.CLAIM_LABELS has RFC 9711 keys", b.eat.CLAIM_LABELS.nonce === 10 && b.eat.CLAIM_LABELS.dbgstat === 263 && b.eat.CLAIM_LABELS.eat_profile === 265);
+  check("b.eat.DBGSTAT enum", b.eat.DBGSTAT["disabled-permanently"] === 3 && b.eat.DBGSTAT.enabled === 0);
+  check("b.eat.EatError exposed", typeof b.eat.EatError === "function");
+}
+
+async function testRoundTripAndLabels() {
+  var nonce = b.crypto.generateBytes(16);
+  var eat = await b.eat.sign(
+    { nonce: nonce, ueid: Buffer.from([1, 2, 3, 4]), oemid: Buffer.from("acme"), dbgstat: "disabled-permanently",
+      eat_profile: "https://example.com/eat/p1", iss: "device-ca", iat: _now() },
+    { alg: "ES256", privateKey: EC.privateKey });
+  var v = await b.eat.verify(eat, { algorithms: ["ES256"], publicKey: EC.publicKey, expectedNonce: nonce });
+  check("verify: friendly EAT claim names returned", Buffer.isBuffer(v.claims.ueid) && v.claims.eat_profile === "https://example.com/eat/p1");
+  check("verify: dbgstat decoded to enum name", v.claims.dbgstat === "disabled-permanently");
+  check("verify: standard claim (iss) still named", v.claims.iss === "device-ca");
+  check("verify: raw Map uses RFC 9711 integer labels", v.raw.get(10) !== undefined && v.raw.get(263) === 3 && v.raw.get(265) === "https://example.com/eat/p1");
+}
+
+async function testNonceBinding() {
+  var nonce = b.crypto.generateBytes(16);
+  var eat = await b.eat.sign({ nonce: nonce, ueid: Buffer.from([9]) }, { alg: "ES256", privateKey: EC.privateKey });
+  var ok = await b.eat.verify(eat, { algorithms: ["ES256"], publicKey: EC.publicKey, expectedNonce: nonce });
+  check("nonce: matching expectedNonce accepted", Buffer.isBuffer(ok.claims.nonce));
+  var mismatch = null;
+  try { await b.eat.verify(eat, { algorithms: ["ES256"], publicKey: EC.publicKey, expectedNonce: b.crypto.generateBytes(16) }); } catch (e) { mismatch = e; }
+  check("nonce: mismatch refused (replay/freshness defense)", mismatch && mismatch.code === "eat/nonce-mismatch");
+  // Token with no nonce but RP expects one → refused.
+  var noNonce = await b.eat.sign({ ueid: Buffer.from([1]) }, { alg: "ES256", privateKey: EC.privateKey });
+  var missing = null;
+  try { await b.eat.verify(noNonce, { algorithms: ["ES256"], publicKey: EC.publicKey, expectedNonce: nonce }); } catch (e) { missing = e; }
+  check("nonce: expectedNonce but no eat_nonce claim refused", missing && missing.code === "eat/nonce-missing");
+  // Array-of-nonces (multi-verifier) membership.
+  var multi = await b.eat.sign({ nonce: [b.crypto.generateBytes(16), nonce] }, { alg: "ES256", privateKey: EC.privateKey });
+  var m = await b.eat.verify(multi, { algorithms: ["ES256"], publicKey: EC.publicKey, expectedNonce: nonce });
+  check("nonce: array form matches when one entry equals expectedNonce", Array.isArray(m.claims.nonce));
+}
+
+async function testDebugStatusAndProfile() {
+  var enabled = await b.eat.sign({ dbgstat: "enabled" }, { alg: "ES256", privateKey: EC.privateKey });
+  var e1 = null;
+  try { await b.eat.verify(enabled, { algorithms: ["ES256"], publicKey: EC.publicKey, requireDebugDisabled: true }); } catch (e) { e1 = e; }
+  check("dbgstat: enabled refused under requireDebugDisabled", e1 && e1.code === "eat/debug-not-disabled");
+
+  var absent = await b.eat.sign({ ueid: Buffer.from([1]) }, { alg: "ES256", privateKey: EC.privateKey });
+  var e2 = null;
+  try { await b.eat.verify(absent, { algorithms: ["ES256"], publicKey: EC.publicKey, requireDebugDisabled: true }); } catch (e) { e2 = e; }
+  check("dbgstat: absent refused under requireDebugDisabled", e2 && e2.code === "eat/debug-not-disabled");
+
+  var disabled = await b.eat.sign({ dbgstat: "disabled-fully-and-permanently" }, { alg: "ES256", privateKey: EC.privateKey });
+  var ok = await b.eat.verify(disabled, { algorithms: ["ES256"], publicKey: EC.publicKey, requireDebugDisabled: true });
+  check("dbgstat: a disabled state passes", ok.claims.dbgstat === "disabled-fully-and-permanently");
+
+  var prof = await b.eat.sign({ eat_profile: "p-A" }, { alg: "ES256", privateKey: EC.privateKey });
+  var e3 = null;
+  try { await b.eat.verify(prof, { algorithms: ["ES256"], publicKey: EC.publicKey, expectedProfile: "p-B" }); } catch (e) { e3 = e; }
+  check("profile: expectedProfile mismatch refused", e3 && e3.code === "eat/profile-mismatch");
+}
+
+async function testValidationAndTamper() {
+  var bad = null;
+  try { await b.eat.sign({ dbgstat: "bogus" }, { alg: "ES256", privateKey: EC.privateKey }); } catch (e) { bad = e; }
+  check("sign: bad dbgstat enum refused", bad && bad.code === "eat/bad-dbgstat");
+
+  var eat = await b.eat.sign({ nonce: b.crypto.generateBytes(16) }, { alg: "ES256", privateKey: EC.privateKey });
+  var t = Buffer.from(eat); t[t.length - 1] ^= 0xff;
+  var tampered = null;
+  try { await b.eat.verify(t, { algorithms: ["ES256"], publicKey: EC.publicKey }); } catch (e) { tampered = e; }
+  check("verify: tampered token refused by COSE signature check", tampered && tampered.code === "cose/bad-signature");
+
+  // exp from the CWT layer still enforced through EAT.
+  var expired = await b.eat.sign({ exp: _now() - 3600, ueid: Buffer.from([1]) }, { alg: "ES256", privateKey: EC.privateKey });
+  var exp = null;
+  try { await b.eat.verify(expired, { algorithms: ["ES256"], publicKey: EC.publicKey }); } catch (e) { exp = e; }
+  check("verify: expired EAT refused (delegated to cwt)", exp && exp.code === "cwt/expired");
+}
+
+async function run() {
+  testSurface();
+  await testRoundTripAndLabels();
+  await testNonceBinding();
+  await testDebugStatusAndProfile();
+  await testValidationAndTamper();
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  run().then(
+    function () { console.log("[eat] OK — " + helpers.getChecks() + " checks passed"); },
+    function (e) { console.error("FAIL:", e && e.stack || e); process.exit(1); }
+  );
+}

package/lib/vendor/blamejs/test/layer-0-primitives/mdoc.test.js

@@ -0,0 +1,230 @@
+"use strict";
+/**
+ * Layer 0 — b.mdoc (ISO 18013-5 mdoc / mDL issuer-data verification).
+ * A pure-node mock issuer builds an IssuerSigned structure (COSE_Sign1
+ * IssuerAuth over a Tag-24 MobileSecurityObject, with the signer cert in
+ * the x5chain header) so the verifier's full path is exercised: COSE
+ * signature, MSO validity window, per-element digest matching against
+ * the MSO, selective disclosure, and the tamper / expiry / docType /
+ * malformed-validity refusal paths. The trust core (COSE_Sign1 + CBOR)
+ * is the framework's tested b.cose / b.cbor substrate.
+ */
+
+var b = require("../../index");
+var helpers = require("../helpers");
+var check = helpers.check;
+var asn1 = require("../../lib/asn1-der");
+var cbor = b.cbor;
+var nodeCrypto = require("node:crypto");
+
+var NS = "org.iso.18013.5.1";
+var DOCTYPE = "org.iso.18013.5.1.mDL";
+
+function _algId(oid, withNull) {
+  return withNull ? asn1.writeSequence([asn1.writeOid(oid), asn1.writeNull()]) : asn1.writeSequence([asn1.writeOid(oid)]);
+}
+function _name(cn) {
+  return asn1.writeSequence([asn1.writeSet([asn1.writeSequence([asn1.writeOid("2.5.4.3"), asn1.writeUtf8String(cn)])])]);
+}
+function _utc(d) { return asn1.writeNode(0x17, Buffer.from(d.toISOString().replace(/[-:T]/g, "").slice(2, 14) + "Z", "ascii")); }
+
+// Minimal self-signed EC cert (mdoc issuer-data verify reads the key,
+// not an EKU). Returns { certDer, key, pem }.
+function _makeCert(cn) {
+  var kp = nodeCrypto.generateKeyPairSync("ec", { namedCurve: "P-256" });
+  var spki = kp.publicKey.export({ type: "spki", format: "der" });
+  var sa = _algId("1.2.840.10045.4.3.2", false);
+  var nm = _name(cn || "mDL Issuer");
+  var now = Date.now();
+  var tbs = asn1.writeSequence([
+    asn1.writeContextExplicit(0, asn1.writeInteger(Buffer.from([2]))),
+    asn1.writeInteger(Buffer.from([0x2a])), sa, nm,
+    asn1.writeSequence([_utc(new Date(now - 86400000)), _utc(new Date(now + 86400000 * 3650))]),
+    nm, spki,
+  ]);
+  var certDer = asn1.writeSequence([tbs, sa, asn1.writeBitString(nodeCrypto.sign("sha256", tbs, kp.privateKey), 0)]);
+  return { certDer: certDer, key: kp.privateKey, pem: new nodeCrypto.X509Certificate(certDer).toString() };
+}
+
+// Build an IssuerSigned (CBOR bytes). opts: { elements, validFrom,
+// validUntil, docType, digestAlg } — defaults are a valid mDL.
+async function _makeMdoc(cert, opts) {
+  opts = opts || {};
+  var elements = opts.elements || [["family_name", "Doe"], ["age_over_18", true], ["given_name", "Jane"]];
+  var digestNode = opts.digestNode || "sha256";
+  var digestAlg = opts.digestAlg || "SHA-256";
+  var now = Date.now();
+  var items = [];
+  var digests = new Map();
+  elements.forEach(function (el, i) {
+    var inner = cbor.encode(new Map([
+      ["digestID", i], ["random", nodeCrypto.randomBytes(32)],
+      ["elementIdentifier", el[0]], ["elementValue", el[1]],
+    ]));
+    items.push(new cbor.Tag(24, inner));
+    digests.set(i, nodeCrypto.createHash(digestNode).update(cbor.encode(new cbor.Tag(24, inner))).digest());
+  });
+  var validFromMs = opts.validFrom != null ? opts.validFrom : now - 86400000;
+  var validUntilMs = opts.validUntil != null ? opts.validUntil : now + 86400000 * 3650;
+  var validUntilTag = opts.validUntilRaw !== undefined ? opts.validUntilRaw : new cbor.Tag(0, new Date(validUntilMs).toISOString());
+  var mso = new Map([
+    ["version", "1.0"], ["digestAlgorithm", digestAlg], ["docType", opts.docType || DOCTYPE],
+    ["valueDigests", new Map([[NS, digests]])],
+    ["validityInfo", new Map([
+      ["signed", new cbor.Tag(0, new Date(now).toISOString())],
+      ["validFrom", new cbor.Tag(0, new Date(validFromMs).toISOString())],
+      ["validUntil", validUntilTag],
+    ])],
+  ]);
+  var payload = cbor.encode(new cbor.Tag(24, cbor.encode(mso)));
+  var signed = await b.cose.sign(payload, { alg: opts.alg || "ES256", privateKey: cert.key, unprotectedHeaders: { 33: cert.certDer } });
+  var issuerAuth = cbor.decode(signed, { allowedTags: [18, 24] }).value;
+  return cbor.encode(new Map([["nameSpaces", new Map([[NS, items]])], ["issuerAuth", issuerAuth]]));
+}
+
+function testSurface() {
+  check("b.mdoc.verifyIssuerSigned is a function", typeof b.mdoc.verifyIssuerSigned === "function");
+  check("b.mdoc.DIGEST_ALGS has SHA-256", b.mdoc.DIGEST_ALGS["SHA-256"] === "sha256");
+  check("b.mdoc.MdocError is a class", typeof b.mdoc.MdocError === "function");
+}
+
+async function testRoundTrip() {
+  var cert = _makeCert();
+  var mdoc = await _makeMdoc(cert);
+  var out = await b.mdoc.verifyIssuerSigned(mdoc, { algorithms: ["ES256"], expectedDocType: DOCTYPE });
+  check("verify: docType", out.docType === DOCTYPE);
+  check("verify: alg reported", out.alg === "ES256");
+  check("verify: digestAlgorithm", out.digestAlgorithm === "SHA-256");
+  check("verify: disclosed elements extracted", out.namespaces[NS].family_name === "Doe" && out.namespaces[NS].age_over_18 === true && out.namespaces[NS].given_name === "Jane");
+  check("verify: validityInfo dates returned", out.validityInfo.validUntil instanceof Date);
+  check("verify: signerCert PEM returned", /BEGIN CERTIFICATE/.test(out.signerCert));
+
+  // chain verify against the self-signed issuer as anchor
+  var ok = await b.mdoc.verifyIssuerSigned(mdoc, { algorithms: ["ES256"], trustAnchorsPem: cert.pem });
+  check("verify: chain to issuer anchor (string)", ok.docType === DOCTYPE);
+}
+
+async function testDigestAndSignatureRefusals() {
+  var cert = _makeCert();
+  var mdoc = await _makeMdoc(cert);
+
+  // Tamper a disclosed element's value: re-pack one IssuerSignedItem
+  // with a changed value but keep the MSO digest → digest mismatch.
+  var top = cbor.decode(mdoc, { allowedTags: [0, 1, 24, 1004] });
+  var items = top.get("nameSpaces").get(NS);
+  var inner0 = cbor.decode(items[0].value, { allowedTags: [0, 1, 24, 1004] });
+  inner0.set("elementValue", "Tampered");
+  items[0] = new cbor.Tag(24, cbor.encode(inner0));
+  var tampered = cbor.encode(top);
+  var e1 = null;
+  try { await b.mdoc.verifyIssuerSigned(tampered, { algorithms: ["ES256"] }); } catch (e) { e1 = e; }
+  check("verify: tampered element refused (digest-mismatch)", e1 && e1.code === "mdoc/digest-mismatch");
+
+  // Tamper the COSE signature deterministically (flip a byte in the
+  // issuerAuth signature element) → bad-signature.
+  var top2 = cbor.decode(mdoc, { allowedTags: [0, 1, 24, 1004] });
+  var ia = top2.get("issuerAuth");
+  ia[3] = Buffer.from(ia[3]); ia[3][0] ^= 0xff;
+  var bad = cbor.encode(top2);
+  var e2 = null;
+  try { await b.mdoc.verifyIssuerSigned(bad, { algorithms: ["ES256"] }); } catch (e) { e2 = e; }
+  check("verify: tampered COSE signature refused", e2 && e2.code === "cose/bad-signature");
+
+  // A malformed x5chain certificate surfaces a clean error (not raw OpenSSL).
+  var top3 = cbor.decode(mdoc, { allowedTags: [0, 1, 24, 1004] });
+  top3.get("issuerAuth")[1].set(33, Buffer.from([0x30, 0x03, 0x02, 0x01, 0x01]));
+  var e6 = null;
+  try { await b.mdoc.verifyIssuerSigned(cbor.encode(top3), { algorithms: ["ES256"] }); } catch (e) { e6 = e; }
+  check("verify: malformed x5chain cert refused cleanly", e6 && e6.code === "mdoc/bad-cert");
+
+  // alg outside allowlist
+  var e3 = null;
+  try { await b.mdoc.verifyIssuerSigned(mdoc, { algorithms: ["EdDSA"] }); } catch (e) { e3 = e; }
+  check("verify: alg outside allowlist refused", e3 && (e3.code === "cose/alg-not-allowed"));
+}
+
+async function testValidityAndDocType() {
+  var cert = _makeCert();
+
+  // expired (valid window 10 days ago .. 1 day ago)
+  var expired = await _makeMdoc(cert, { validFrom: Date.now() - 86400000 * 10, validUntil: Date.now() - 86400000 });
+  var e1 = null;
+  try { await b.mdoc.verifyIssuerSigned(expired, { algorithms: ["ES256"] }); } catch (e) { e1 = e; }
+  check("verify: expired credential refused", e1 && e1.code === "mdoc/expired");
+
+  // not yet valid
+  var future = await _makeMdoc(cert, { validFrom: Date.now() + 86400000 * 30 });
+  var e2 = null;
+  try { await b.mdoc.verifyIssuerSigned(future, { algorithms: ["ES256"] }); } catch (e) { e2 = e; }
+  check("verify: not-yet-valid credential refused", e2 && e2.code === "mdoc/not-yet-valid");
+
+  // opts.at within window accepts an otherwise-expired credential
+  var ok = await b.mdoc.verifyIssuerSigned(expired, { algorithms: ["ES256"], at: new Date(Date.now() - 86400000 * 2) });
+  check("verify: opts.at within window accepts", ok.docType === DOCTYPE);
+
+  // docType mismatch
+  var e3 = null;
+  try { await b.mdoc.verifyIssuerSigned(await _makeMdoc(cert), { algorithms: ["ES256"], expectedDocType: "org.iso.18013.5.1.photoID" }); } catch (e) { e3 = e; }
+  check("verify: docType mismatch refused", e3 && e3.code === "mdoc/doctype-mismatch");
+
+  // malformed validUntil (a non-date) fails closed
+  var badValidity = await _makeMdoc(cert, { validUntilRaw: new cbor.Tag(0, "not-a-date") });
+  var e4 = null;
+  try { await b.mdoc.verifyIssuerSigned(badValidity, { algorithms: ["ES256"] }); } catch (e) { e4 = e; }
+  check("verify: malformed validUntil refused (fail closed)", e4 && e4.code === "mdoc/bad-validity");
+
+  // invalid opts.at refused (lesson carried from b.tsa / b.vc)
+  var e5 = null;
+  try { await b.mdoc.verifyIssuerSigned(await _makeMdoc(cert), { algorithms: ["ES256"], at: new Date("nope") }); } catch (e) { e5 = e; }
+  check("verify: invalid opts.at refused", e5 && e5.code === "mdoc/bad-at");
+
+  // Two signed IssuerSignedItems with the same elementIdentifier (each
+  // with a valid MSO digest) is ambiguous → fail closed, not last-wins.
+  var dup = await _makeMdoc(cert, { elements: [["family_name", "Doe"], ["family_name", "Roe"]] });
+  var e6 = null;
+  try { await b.mdoc.verifyIssuerSigned(dup, { algorithms: ["ES256"] }); } catch (e) { e6 = e; }
+  check("verify: duplicate elementIdentifier refused", e6 && e6.code === "mdoc/duplicate-element");
+}
+
+async function testChainAndInputGuards() {
+  var cert = _makeCert();
+  var mdoc = await _makeMdoc(cert);
+
+  // unrelated anchor → untrusted
+  var other = _makeCert("Unrelated Root");
+  var e1 = null;
+  try { await b.mdoc.verifyIssuerSigned(mdoc, { algorithms: ["ES256"], trustAnchorsPem: [other.pem] }); } catch (e) { e1 = e; }
+  check("verify: unrelated anchor refused", e1 && e1.code === "mdoc/untrusted-chain");
+
+  // empty trust-anchor shape refused (no fail-open)
+  var e2 = null;
+  try { await b.mdoc.verifyIssuerSigned(mdoc, { algorithms: ["ES256"], trustAnchorsPem: [] }); } catch (e) { e2 = e; }
+  check("verify: empty trustAnchorsPem refused", e2 && e2.code === "mdoc/bad-trust-anchors");
+
+  // garbage input → not CBOR / malformed
+  var e3 = null;
+  try { await b.mdoc.verifyIssuerSigned(Buffer.from([0x00, 0x01]), { algorithms: ["ES256"] }); } catch (e) { e3 = e; }
+  check("verify: garbage input refused", e3 && (e3.code === "mdoc/malformed" || e3.code === "mdoc/bad-input" || /cbor/.test(e3.code || "")));
+
+  // missing algorithms
+  var e4 = null;
+  try { await b.mdoc.verifyIssuerSigned(mdoc, {}); } catch (e) { e4 = e; }
+  check("verify: missing algorithms refused", e4 && e4.code === "mdoc/algorithms-required");
+}
+
+async function run() {
+  testSurface();
+  await testRoundTrip();
+  await testDigestAndSignatureRefusals();
+  await testValidityAndDocType();
+  await testChainAndInputGuards();
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  run().then(
+    function () { console.log("[mdoc] OK — " + helpers.getChecks() + " checks passed"); },
+    function (e) { console.error("FAIL:", e && e.stack || e); process.exit(1); }
+  );
+}