@blamejs/blamejs-shop 0.2.9 → 0.2.11

package/lib/vendor/blamejs/test/layer-0-primitives/archive-wrap.test.js

@@ -82,13 +82,56 @@ async function testWrapRequiresRecipient() {
     refused && /no-recipient/.test(refused.code || refused.message));
 }
 
-async function testTenantStrategyDeferred() {
-  var refused = null;
+async function testTenantStrategyRoundTrip() {
+  var tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-aw-tenant-"));
   try {
-    b.archive.wrap(Buffer.from("bytes"), { recipient: "tenant", tenantId: "alpha" });
-  } catch (e) { refused = e; }
-  check("archive.wrap: tenant strategy deferred to v0.12.11 with explicit message",
-    refused && /tenant-strategy-deferred/.test(refused.code || refused.message));
+    await helpers.setupVaultOnly(tmpDir);
+    var src = Buffer.from("per-tenant sealed archive bytes ".repeat(40));
+
+    // wrap → unwrap round-trips for the same tenant, no key-pair managed.
+    var sealed = b.archive.wrap(src, { recipient: "tenant", tenantId: "alpha" });
+    check("archive.wrap tenant: BAWRP magic",
+      sealed.slice(0, 5).toString("ascii") === "BAWRP");
+    check("archive.wrap tenant: version byte is 0x02 (tenant)",
+      sealed[5] === 0x02);
+    var recovered = b.archive.unwrap(sealed, { recipient: "tenant", tenantId: "alpha" });
+    check("archive.wrap tenant: round-trips losslessly", recovered.equals(src));
+    // recipient may be omitted on unwrap (version byte selects the path).
+    var recovered2 = b.archive.unwrap(sealed, { tenantId: "alpha" });
+    check("archive.wrap tenant: unwrap works with tenantId alone", recovered2.equals(src));
+
+    // Cross-tenant isolation — a different tenant's derived key (and AAD)
+    // cannot open tenant alpha's envelope.
+    var crossErr = null;
+    try { b.archive.unwrap(sealed, { recipient: "tenant", tenantId: "beta" }); }
+    catch (e) { crossErr = e; }
+    check("archive.wrap tenant: another tenant cannot decrypt",
+      crossErr && /decrypt-failed/.test(crossErr.code || crossErr.message));
+
+    // Missing tenantId on wrap throws a clear config error.
+    var noIdErr = null;
+    try { b.archive.wrap(src, { recipient: "tenant" }); }
+    catch (e) { noIdErr = e; }
+    check("archive.wrap tenant: missing tenantId throws no-tenant-id",
+      noIdErr && /no-tenant-id/.test(noIdErr.code || noIdErr.message));
+
+    // Passing a key-pair recipient to a tenant envelope is refused.
+    var mismatchErr = null;
+    try { b.archive.unwrap(sealed, { recipient: { privateKey: "x", ecPrivateKey: "y" } }); }
+    catch (e) { mismatchErr = e; }
+    check("archive.wrap tenant: key-pair recipient on tenant envelope refused",
+      mismatchErr && /recipient-mismatch/.test(mismatchErr.code || mismatchErr.message));
+
+    // Determinism — re-wrapping the same bytes for the same tenant yields
+    // a DIFFERENT envelope (fresh nonce) that still opens to the same plaintext.
+    var sealed2 = b.archive.wrap(src, { recipient: "tenant", tenantId: "alpha" });
+    check("archive.wrap tenant: fresh nonce per wrap (envelopes differ)",
+      !sealed2.equals(sealed));
+    check("archive.wrap tenant: second envelope also round-trips",
+      b.archive.unwrap(sealed2, { tenantId: "alpha" }).equals(src));
+  } finally {
+    helpers.teardownVaultOnly(tmpDir);
+  }
 }
 
 async function testBackupRecipientRoundTrip() {
@@ -159,7 +202,7 @@ async function run() {
   await testWrapRefusesWrongKey();
   await testWrapRefusesPartialStaticRecipient();
   await testWrapRequiresRecipient();
-  await testTenantStrategyDeferred();
+  await testTenantStrategyRoundTrip();
   await testBackupRecipientRoundTrip();
   await testBackupRecipientStrategyRequiresKeys();
   await testBackupRecipientDirectoryRefused();

package/lib/vendor/blamejs/test/layer-0-primitives/codebase-patterns.test.js

@@ -2387,6 +2387,16 @@ async function testNoDuplicateCodeBlocks() {
       ],
       reason: "v0.12.48 / v0.12.51 / v0.12.52 / v0.12.53 / v0.13.x — Buffer-coercion guard (`if (Buffer.isBuffer(x)) return x; if (x instanceof Uint8Array) return Buffer.from(x); ...`) repeats across byte-string-consuming primitives. The throw-on-unknown variants (cose / mdoc / dnssec / dane / tsa) each raise a MODULE-LOCAL typed error code naming the local argument; the JSON-fallback variants (eat._toBuf serializing a CBOR/EAT claims payload, worm._toBytes serializing a record to hash) instead JSON.stringify a non-bytes value. The duplicated prefix is the symptom; the cause is that JS can't throw a caller-namespaced ErrorClass (or choose the domain's serialization) without the local closure. Same documented exception as the v0.12.7 require-non-empty-string cluster — the per-domain error code / serialization is the divergence the dup detector can't see.",
     },
+    {
+      mode:  "family-subset",
+      files: [
+        "lib/cose.js:importKey",
+        "lib/cose.js:exportKey",
+        "lib/did.js:_jwkToKey",
+        "lib/network-dnssec.js:_jwkKey",
+      ],
+      reason: "v0.13.20 — EC/OKP JWK-coordinate handling (`kty` + `crv` switch over P-256/P-384/P-521 + Ed25519, base64url x/y, `createPublicKey({ format: 'jwk' })`) is coincidentally similar across three unrelated wire formats: cose.importKey/exportKey map a COSE_Key (RFC 9052 §7 — INTEGER crv ids -1/-2/-3 and labels) to/from a KeyObject; did._jwkToKey resolves a W3C DID verification method's JWK; network-dnssec._jwkKey reconstructs a DNSKEY's public key. The curve identifiers, the surrounding map shape, and the direction (import builds a key from a map, export emits a map from a key) all differ per spec — extracting a shared helper would couple three independent standards on a syntactic accident. The shingle is the JWK-coordinate idiom, not behaviour; same documented exception as the v0.12.40 signature-verify-preamble cluster.",
+    },
     {
       mode:  "family-subset",
       files: [

package/lib/vendor/blamejs/test/layer-0-primitives/cose.test.js

@@ -247,6 +247,47 @@ async function testImportKey() {
   check("importKey: secp256k1 refused (no ES256K binding)", secpBad && secpBad.code === "cose/unsupported-key");
 }
 
+async function testExportKey() {
+  // EC2 P-256 → COSE_Key bytes → decode → importKey round-trips, and
+  // the re-imported key verifies a COSE_Sign1 the original signed.
+  var bytes = b.cose.exportKey(EC.publicKey, { alg: "ES256", kid: "key-1" });
+  check("exportKey: returns CBOR bytes", Buffer.isBuffer(bytes));
+  var map = b.cbor.decode(bytes);
+  check("exportKey: kty=EC2 (2)", map.get(1) === 2);
+  check("exportKey: crv=P-256 (1)", map.get(-1) === 1);
+  check("exportKey: x matches the JWK", map.get(-2).toString("base64url") === EC.publicKey.export({ format: "jwk" }).x);
+  check("exportKey: alg label 3 = ES256 (-7)", map.get(3) === -7);
+  check("exportKey: kid label 2 = 'key-1'", Buffer.isBuffer(map.get(2)) && map.get(2).toString("utf8") === "key-1");
+  var reimported = b.cose.importKey(map);
+  var att = await b.cose.sign(Buffer.from("rt"), { alg: "ES256", privateKey: EC.privateKey });
+  check("exportKey → importKey: round-trips for verification",
+    (await b.cose.verify(att, { algorithms: ["ES256"], publicKey: reimported })).payload.toString() === "rt");
+
+  // OKP Ed25519 round-trip.
+  var edBytes = b.cose.exportKey(ED.publicKey);
+  var edMap = b.cbor.decode(edBytes);
+  check("exportKey: OKP kty=1 + crv Ed25519 (6)", edMap.get(1) === 1 && edMap.get(-1) === 6);
+  check("exportKey: OKP re-imports to ed25519",
+    b.cose.importKey(edMap).asymmetricKeyType === "ed25519");
+
+  // A private key exports its PUBLIC half (never the secret).
+  var fromPriv = b.cbor.decode(b.cose.exportKey(EC.privateKey));
+  check("exportKey: private key exports the public coordinates",
+    fromPriv.get(-2).toString("base64url") === EC.publicKey.export({ format: "jwk" }).x);
+
+  // Unsupported curve / key type / bad opts refused.
+  var k1 = nodeCrypto.generateKeyPairSync("ec", { namedCurve: "secp256k1" });
+  var secpBad = null;
+  try { b.cose.exportKey(k1.publicKey); } catch (e) { secpBad = e; }
+  check("exportKey: secp256k1 refused", secpBad && secpBad.code === "cose/unsupported-key");
+  var notKey = null;
+  try { b.cose.exportKey({ not: "a key" }); } catch (e) { notKey = e; }
+  check("exportKey: non-KeyObject refused", notKey && notKey.code === "cose/bad-key");
+  var badAlg = null;
+  try { b.cose.exportKey(EC.publicKey, { alg: "NOPE" }); } catch (e) { badAlg = e; }
+  check("exportKey: unknown alg refused", badAlg && badAlg.code === "cose/unknown-alg");
+}
+
 async function run() {
   testSurface();
   testEncrypt0();
@@ -258,6 +299,7 @@ async function run() {
   await testValidation();
   await testDetachedPayload();
   await testImportKey();
+  await testExportKey();
   testMac0();
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/blamejs-shop",
-  "version": "0.2.9",
+  "version": "0.2.11",
   "description": "Open-source framework built on blamejs. Vendored stack, zero npm runtime deps, PQC-first crypto, security-on by default.",
   "main": "lib/index.js",
   "scripts": {