@blamejs/blamejs-shop 0.3.40 → 0.3.42

package/lib/vendor/blamejs/test/layer-0-primitives/content-credentials.test.js

@@ -1,11 +1,122 @@
 "use strict";
 /**
- * b.contentCredentials — SB-942 / AB-853 / C2PA manifest builder.
+ * b.contentCredentials — SB-942 / AB-853 / C2PA manifest builder, the
+ * COSE_Sign1 interop wrapper with its RFC 3161 sigTst2 countersignature,
+ * and the CAWG identity assertion.
  */
 
 var helpers = require("../helpers");
 var b     = helpers.b;
 var check = helpers.check;
+var asn1  = require("../../lib/asn1-der");
+var nodeCrypto = require("node:crypto");
+
+// ---- RFC 3161 token-mint helpers (mock TSA, in-tree ASN.1 DER) ----
+// Mirrors test/layer-0-primitives/tsa.test.js so the sigTst2
+// countersignature round-trip exercises a real-shaped timestamp token
+// (CMS SignedData over a TSTInfo) with full control over the imprint.
+var ID_CT_TST_INFO = "1.2.840.113549.1.9.16.1.4";
+var ID_KP_TIMESTAMPING = "1.3.6.1.5.5.7.3.8";
+var OID_CONTENT_TYPE_ATTR = "1.2.840.113549.1.9.3";
+var OID_MESSAGE_DIGEST_ATTR = "1.2.840.113549.1.9.4";
+var OID_SIGNED_DATA = "1.2.840.113549.1.7.2";
+var OID_SHA512 = "2.16.840.1.101.3.4.2.3";
+var OID_RSA_ENCRYPTION = "1.2.840.113549.1.1.1";
+
+function _utcTime(d) { var s = d.toISOString().replace(/[-:T]/g, "").slice(2, 14) + "Z"; return asn1.writeNode(0x17, Buffer.from(s, "ascii")); }
+function _genTime(d) { var s = d.toISOString().replace(/[-:T]/g, "").slice(0, 14) + "Z"; return asn1.writeNode(0x18, Buffer.from(s, "ascii")); }
+function _algId(oid, n) { return n ? asn1.writeSequence([asn1.writeOid(oid), asn1.writeNull()]) : asn1.writeSequence([asn1.writeOid(oid)]); }
+function _certName(cn) { return asn1.writeSequence([asn1.writeSet([asn1.writeSequence([asn1.writeOid("2.5.4.3"), asn1.writeUtf8String(cn)])])]); }
+
+function _makeTsaCert() {
+  var kp = nodeCrypto.generateKeyPairSync("rsa", { modulusLength: 2048 });
+  var spki = kp.publicKey.export({ type: "spki", format: "der" });
+  var version = asn1.writeContextExplicit(0, asn1.writeInteger(Buffer.from([2])));
+  var serial = asn1.writeInteger(Buffer.from([0x2a]));
+  var sigAlgId = _algId("1.2.840.113549.1.1.11", true);
+  var name = _certName("Test TSA");
+  var now = Date.now();
+  var validity = asn1.writeSequence([_utcTime(new Date(now - 86400000)), _utcTime(new Date(now + 86400000 * 3650))]);
+  var ekuChildren = [asn1.writeOid("2.5.29.37"), asn1.writeBoolean(true),
+    asn1.writeOctetString(asn1.writeSequence([asn1.writeOid(ID_KP_TIMESTAMPING)]))];
+  var exts = [asn1.writeSequence(ekuChildren)];
+  var children = [version, serial, sigAlgId, name, validity, name, spki, asn1.writeContextExplicit(3, asn1.writeSequence(exts))];
+  var tbs = asn1.writeSequence(children);
+  var tbsSig = nodeCrypto.sign("sha256", tbs, kp.privateKey);
+  var certDer = asn1.writeSequence([tbs, sigAlgId, asn1.writeBitString(tbsSig, 0)]);
+  return { certDer: certDer, key: kp.privateKey, serial: Buffer.from([0x2a]), issuer: name };
+}
+
+// Build an X.509 cert for `cn`, signed by `issuer` ({ name, key }) or
+// self-signed (issuer null). Used to assemble a real [leaf, intermediate,
+// root] chain so the identity-assertion chain walk is exercised through
+// an intermediate CA, not only a direct-root / self-signed leaf.
+function _makeCert(cn, issuer) {
+  var kp = nodeCrypto.generateKeyPairSync("rsa", { modulusLength: 2048 });
+  var spki = kp.publicKey.export({ type: "spki", format: "der" });
+  var subjName  = _certName(cn);
+  var issuerName = issuer ? issuer.name : subjName;
+  var issuerKey  = issuer ? issuer.key  : kp.privateKey;
+  var sigAlgId = _algId("1.2.840.113549.1.1.11", true);
+  var version = asn1.writeContextExplicit(0, asn1.writeInteger(Buffer.from([2])));
+  var serial = asn1.writeInteger(Buffer.from([0x2b]));
+  var now = Date.now();
+  var validity = asn1.writeSequence([_utcTime(new Date(now - 86400000)), _utcTime(new Date(now + 86400000 * 3650))]);
+  var tbs = asn1.writeSequence([version, serial, sigAlgId, issuerName, validity, subjName, spki]);
+  var tbsSig = nodeCrypto.sign("sha256", tbs, issuerKey);
+  var certDer = asn1.writeSequence([tbs, sigAlgId, asn1.writeBitString(tbsSig, 0)]);
+  return { name: subjName, key: kp.privateKey, pem: new nodeCrypto.X509Certificate(certDer).toString() };
+}
+
+function _makeTsToken(o) {
+  var tstChildren = [
+    asn1.writeInteger(Buffer.from([1])),
+    asn1.writeOid("1.2.3.4.1"),
+    asn1.writeSequence([_algId(OID_SHA512, true), asn1.writeOctetString(o.imprintHash)]),
+    asn1.writeInteger(Buffer.from([0x05])),
+    _genTime(new Date()),
+  ];
+  if (o.nonce) tstChildren.push(asn1.writeInteger(o.nonce));
+  var tstInfo = asn1.writeSequence(tstChildren);
+  var msgDigest = nodeCrypto.createHash("sha512").update(tstInfo).digest();
+  var ctAttr = asn1.writeSequence([asn1.writeOid(OID_CONTENT_TYPE_ATTR), asn1.writeSet([asn1.writeOid(ID_CT_TST_INFO)])]);
+  var mdAttr = asn1.writeSequence([asn1.writeOid(OID_MESSAGE_DIGEST_ATTR), asn1.writeSet([asn1.writeOctetString(msgDigest)])]);
+  var signedSet = asn1.writeSet([ctAttr, mdAttr]);
+  var sig = nodeCrypto.sign("sha512", signedSet, o.key);
+  var signedAttrsImplicit = Buffer.concat([Buffer.from([0xa0]), signedSet.slice(1)]);
+  var sid = asn1.writeSequence([o.issuer, asn1.writeInteger(o.serial)]);
+  var signerInfo = asn1.writeSequence([
+    asn1.writeInteger(Buffer.from([1])), sid, _algId(OID_SHA512, true), signedAttrsImplicit,
+    _algId(OID_RSA_ENCRYPTION, true), asn1.writeOctetString(sig),
+  ]);
+  var encap = asn1.writeSequence([asn1.writeOid(ID_CT_TST_INFO), asn1.writeContextExplicit(0, asn1.writeOctetString(tstInfo))]);
+  var certsField = asn1.writeContextImplicit(0, o.certDer, { constructed: true });
+  var signedData = asn1.writeSequence([
+    asn1.writeInteger(Buffer.from([3])), asn1.writeSet([_algId(OID_SHA512, true)]),
+    encap, certsField, asn1.writeSet([signerInfo]),
+  ]);
+  return asn1.writeSequence([asn1.writeOid(OID_SIGNED_DATA), asn1.writeContextExplicit(0, signedData)]);
+}
+
+// Drive a full signCose request→TSA→attach→verify round trip and return
+// { attached, verifyResult, anchorPem, nonce }.
+function _timestampedRoundTrip(manifest, pair) {
+  var req = b.contentCredentials.signCose(manifest, {
+    privateKeyPem: pair.privateKey, alg: "ml-dsa-87", timestamp: {}, audit: false,
+  });
+  var digest = nodeCrypto.createHash("sha512").update(req.timestampRequest.toBeSigned).digest();
+  var cert = _makeTsaCert();
+  var token = _makeTsToken({
+    certDer: cert.certDer, key: cert.key, issuer: cert.issuer, serial: cert.serial,
+    imprintHash: digest, nonce: req.timestampRequest.nonce,
+  });
+  var attached = b.contentCredentials.signCose(manifest, {
+    privateKeyPem: pair.privateKey, alg: "ml-dsa-87",
+    timestamp: { token: token, signature: req.timestampRequest.signature }, audit: false,
+  });
+  var anchorPem = new nodeCrypto.X509Certificate(cert.certDer).toString();
+  return { req: req, attached: attached, cert: cert, token: token, anchorPem: anchorPem };
+}
 
 async function run() {
   check("build is fn",    typeof b.contentCredentials.build === "function");
@@ -79,16 +190,192 @@ async function run() {
   var cose = b.contentCredentials.signCose(manifest2, {
     privateKeyPem: pair.privateKey,
     alg:           "ml-dsa-87",
+    timestamp:     false,
+    timestampOptOutReason: "interop fixture — no TSA in this test",
   });
   check("signCose: returns coseSign1 Buffer",  Buffer.isBuffer(cose.coseSign1));
   check("signCose: alg echoed",                cose.alg === "ml-dsa-87");
   check("signCose: CBOR tag 18 (COSE_Sign1)",  cose.coseSign1[0] === 0xD2);
   check("signCose: array of 4 elements",       cose.coseSign1[1] === 0x84);
+  check("signCose: not timestamped on opt-out", cose.timestamped === false);
 
   threw = null;
-  try { b.contentCredentials.signCose(manifest2, { privateKeyPem: pair.privateKey, alg: "unknown" }); }
+  try { b.contentCredentials.signCose(manifest2, { privateKeyPem: pair.privateKey, alg: "unknown", timestamp: false, timestampOptOutReason: "x" }); }
   catch (e) { threw = e; }
   check("signCose: unknown alg refused",       threw && threw.code === "content-credentials/bad-alg");
+
+  // ---- v0.14.11: sigTst2 timestamp + verifyCose fail-closed ----
+  check("verifyCose is fn", typeof b.contentCredentials.verifyCose === "function");
+
+  // Timestamping is fail-closed: a missing timestamp opt THROWS.
+  threw = null;
+  try { b.contentCredentials.signCose(manifest2, { privateKeyPem: pair.privateKey, alg: "ml-dsa-87" }); }
+  catch (e) { threw = e; }
+  check("signCose: missing timestamp opt refused", threw && threw.code === "content-credentials/timestamp-required");
+
+  // Explicit opt-out requires a recorded reason.
+  threw = null;
+  try { b.contentCredentials.signCose(manifest2, { privateKeyPem: pair.privateKey, alg: "ml-dsa-87", timestamp: false }); }
+  catch (e) { threw = e; }
+  check("signCose: timestamp:false without reason refused", threw && threw.code === "TIMESTAMP_OPT_OUT_NO_REASON");
+
+  // Request-builder mode returns a TSA query + the signature to re-pin.
+  var reqOnly = b.contentCredentials.signCose(manifest2, {
+    privateKeyPem: pair.privateKey, alg: "ml-dsa-87", timestamp: {}, audit: false,
+  });
+  check("signCose request mode: not timestamped yet", reqOnly.timestamped === false);
+  check("signCose request mode: returns DER request",  Buffer.isBuffer(reqOnly.timestampRequest.der));
+  check("signCose request mode: returns signature to re-pin", typeof reqOnly.timestampRequest.signature === "string");
+  check("signCose request mode: hashAlg default SHA-512", reqOnly.timestampRequest.hashAlg === "SHA-512");
+
+  // Bad hashAlg refused.
+  threw = null;
+  try { b.contentCredentials.signCose(manifest2, { privateKeyPem: pair.privateKey, alg: "ml-dsa-87", timestamp: { hashAlg: "MD5" } }); }
+  catch (e) { threw = e; }
+  check("signCose: bad timestamp hashAlg refused", threw && threw.code === "content-credentials/bad-tst-hash");
+
+  // Full round trip: request → mint token → attach → verify (timestamp valid).
+  var rt = _timestampedRoundTrip(manifest2, pair);
+  check("signCose attach mode: timestamped", rt.attached.timestamped === true);
+  check("signCose attach mode: sigTst2 present grows the COSE bytes", rt.attached.coseSign1.length > cose.coseSign1.length);
+
+  var v3 = b.contentCredentials.verifyCose(rt.attached.coseSign1, pair.publicKey, {
+    timestampNonce: rt.req.timestampRequest.nonce, timestampTrustAnchorsPem: [rt.anchorPem], audit: false,
+  });
+  check("verifyCose: signature valid", v3.valid === true);
+  check("verifyCose: timestamp valid (routed through tsa.verifyToken)", v3.timestamp && v3.timestamp.valid === true);
+  check("verifyCose: timestamp genTime is a Date", v3.timestamp.genTime instanceof Date);
+  check("verifyCose: alg surfaced", v3.alg === "ml-dsa-87");
+  check("verifyCose: claims recovered", v3.claims && v3.claims.content && v3.claims.content.id === "img-002");
+
+  // verifyCose NEVER throws — bad inputs return { valid:false }.
+  var vNoBuf = b.contentCredentials.verifyCose("not a buffer", pair.publicKey, { audit: false });
+  check("verifyCose: non-buffer fails closed (no throw)", vNoBuf.valid === false && vNoBuf.reason === "cose-not-buffer");
+  var vNoKey = b.contentCredentials.verifyCose(rt.attached.coseSign1, "", { audit: false });
+  check("verifyCose: missing key fails closed", vNoKey.valid === false && vNoKey.reason === "public-key-required");
+
+  // requireTimestamp default true refuses a token-less COSE_Sign1.
+  var vReq = b.contentCredentials.verifyCose(cose.coseSign1, pair.publicKey, { audit: false });
+  check("verifyCose: token-less refused by default", vReq.valid === false && vReq.reason === "timestamp-required");
+  var vReqOff = b.contentCredentials.verifyCose(cose.coseSign1, pair.publicKey, { requireTimestamp: false, audit: false });
+  check("verifyCose: requireTimestamp:false accepts token-less", vReqOff.valid === true);
+
+  // Tampered payload byte → signature mismatch, fail-closed.
+  var tamperedCose = Buffer.from(rt.attached.coseSign1); tamperedCose[tamperedCose.length - 3] ^= 0xff;
+  var vTamper = b.contentCredentials.verifyCose(tamperedCose, pair.publicKey, { audit: false });
+  check("verifyCose: tampered token fails closed", vTamper.valid === false);
+
+  // Wrong nonce on an otherwise-valid token → tsa-derived timestamp failure,
+  // surfaced as a fail-closed verdict (NOT a throw, NOT a chain-only pass).
+  var vNonce = b.contentCredentials.verifyCose(rt.attached.coseSign1, pair.publicKey, {
+    timestampNonce: nodeCrypto.randomBytes(8), audit: false,
+  });
+  check("verifyCose: wrong timestamp nonce fails closed via tsa.verifyToken",
+    vNonce.valid === false && /^timestamp-invalid:/.test(vNonce.reason));
+
+  // A cryptographically valid COSE_Sign1 over a payload that is NOT a
+  // complete SB-942 manifest must NOT verify as a content credential —
+  // verifyCose re-runs the required-field gate that verify() applies.
+  var partialCose = b.contentCredentials.signCose({ provider: { name: "x" }, content: { id: "y" } }, {
+    privateKeyPem: pair.privateKey, alg: "ml-dsa-87",
+    timestamp: false, timestampOptOutReason: "test fixture", audit: false,
+  });
+  var vPartial = b.contentCredentials.verifyCose(partialCose.coseSign1, pair.publicKey, {
+    requireTimestamp: false, audit: false,
+  });
+  check("verifyCose: incomplete manifest rejected (missing-required)",
+    vPartial.valid === false && vPartial.reason.indexOf("missing-required") === 0);
+
+  // ---- v0.14.11: CAWG identity assertion ----
+  check("attachIdentityAssertion is fn", typeof b.contentCredentials.attachIdentityAssertion === "function");
+  check("verifyIdentityAssertion is fn", typeof b.contentCredentials.verifyIdentityAssertion === "function");
+
+  var orgPair = b.crypto.generateSigningKeyPair("ml-dsa-87");
+  var refs = [{ label: "c2pa.actions", data: { action: "c2pa.created" } }];
+  var ia = b.contentCredentials.attachIdentityAssertion({
+    binding: "x509",
+    subject: { name: "Acme Newsroom", org: "Acme Media", id: "acme-001" },
+    referencedAssertions: refs,
+    privateKeyPem: orgPair.privateKey,
+    audit: false,
+  });
+  check("attachIdentityAssertion: v1.2 envelope", ia.type === "cawg.identity" && ia.version === "1.2");
+  check("attachIdentityAssertion: hash-binds referenced assertions", ia.signer_payload.referenced_assertions.length === 1);
+  check("attachIdentityAssertion: assertion is hash-bound (sha3-512)", ia.signer_payload.referenced_assertions[0].alg === "sha3-512");
+  check("attachIdentityAssertion: base64 signature", typeof ia.signature === "string" && ia.signature.length > 0);
+
+  // Self-asserted (no trust anchor) → valid signature, but verified:false.
+  var iaSelf = b.contentCredentials.verifyIdentityAssertion(ia, orgPair.publicKey, { referencedAssertions: refs, audit: false });
+  check("verifyIdentityAssertion: self-asserted valid", iaSelf.valid === true);
+  check("verifyIdentityAssertion: self-asserted NOT verified (no anchor)", iaSelf.verified === false && iaSelf.reason === "no-trust-anchor");
+
+  // x509 chained to a supplied trust anchor → verified:true. Reuse the
+  // mock TSA cert as a self-signed leaf==anchor.
+  var orgCert = _makeTsaCert();
+  var orgPem = new nodeCrypto.X509Certificate(orgCert.certDer).toString();
+  var iaTrusted = b.contentCredentials.verifyIdentityAssertion(ia, orgPair.publicKey, {
+    referencedAssertions: refs, identityCertChainPem: orgPem, identityTrustAnchorsPem: orgPem, audit: false,
+  });
+  check("verifyIdentityAssertion: x509 chained → verified", iaTrusted.valid === true && iaTrusted.verified === true);
+
+  // x509 chain through an INTERMEDIATE CA: chain [leaf, intermediate]
+  // with the root as the trust anchor must verify — the chain walk uses
+  // chain[1..], not only a direct leaf-vs-anchor test.
+  var caRoot  = _makeCert("CAWG Test Root", null);
+  var caInter = _makeCert("CAWG Test Intermediate", { name: caRoot.name, key: caRoot.key });
+  var caLeaf  = _makeCert("Acme Newsroom Leaf", { name: caInter.name, key: caInter.key });
+  var iaChain = b.contentCredentials.verifyIdentityAssertion(ia, orgPair.publicKey, {
+    referencedAssertions: refs,
+    identityCertChainPem: [caLeaf.pem, caInter.pem],
+    identityTrustAnchorsPem: caRoot.pem, audit: false,
+  });
+  check("verifyIdentityAssertion: [leaf,intermediate]→root anchor verified (walks intermediates)",
+    iaChain.valid === true && iaChain.verified === true);
+  // The same chain against an unrelated anchor must NOT verify.
+  var caRogue = _makeCert("Rogue Root", null);
+  var iaWrongAnchor = b.contentCredentials.verifyIdentityAssertion(ia, orgPair.publicKey, {
+    referencedAssertions: refs,
+    identityCertChainPem: [caLeaf.pem, caInter.pem],
+    identityTrustAnchorsPem: caRogue.pem, audit: false,
+  });
+  check("verifyIdentityAssertion: chain to unrelated anchor → not verified",
+    iaWrongAnchor.verified === false);
+
+  // Transplanted referenced assertions → fail closed.
+  var iaTransplant = b.contentCredentials.verifyIdentityAssertion(ia, orgPair.publicKey, {
+    referencedAssertions: [{ label: "x", data: { other: 1 } }], audit: false,
+  });
+  check("verifyIdentityAssertion: transplanted assertions fail closed",
+    iaTransplant.valid === false && iaTransplant.reason === "assertion-hash-mismatch");
+
+  // Aggregator path is never verified:true even with an anchor.
+  var iaAgg = b.contentCredentials.attachIdentityAssertion({
+    binding: "identity-claims-aggregator", subject: { name: "Jane Doe" },
+    referencedAssertions: refs, privateKeyPem: orgPair.privateKey, audit: false,
+  });
+  var iaAggV = b.contentCredentials.verifyIdentityAssertion(iaAgg, orgPair.publicKey, {
+    referencedAssertions: refs, identityTrustAnchorsPem: orgPem, audit: false,
+  });
+  check("verifyIdentityAssertion: aggregator path never verified:true",
+    iaAggV.valid === true && iaAggV.verified === false && iaAggV.reason === "aggregator-self-asserted");
+
+  // Wrong key → signature mismatch, fail closed (no throw).
+  var otherPair = b.crypto.generateSigningKeyPair("ml-dsa-87");
+  var iaWrongKey = b.contentCredentials.verifyIdentityAssertion(ia, otherPair.publicKey, { referencedAssertions: refs, audit: false });
+  check("verifyIdentityAssertion: wrong key fails closed", iaWrongKey.valid === false && iaWrongKey.reason === "signature-mismatch");
+
+  // Bad binding refused at config time.
+  threw = null;
+  try { b.contentCredentials.attachIdentityAssertion({ binding: "made-up", subject: { name: "x" }, referencedAssertions: refs, privateKeyPem: orgPair.privateKey }); }
+  catch (e) { threw = e; }
+  check("attachIdentityAssertion: bad binding refused", threw && threw.code === "content-credentials/bad-identity-binding");
 }
 
 module.exports = { run: run };
+
+if (require.main === module) {
+  run().then(
+    function () { console.log("[content-credentials] OK — " + helpers.getChecks() + " checks passed"); },
+    function (e) { console.error("FAIL:", (e && e.stack) || e); process.exit(1); }
+  );
+}

package/lib/vendor/blamejs/test/layer-0-primitives/federation-vc-suite.test.js

@@ -213,6 +213,28 @@ function testDcqlMatch() {
   try { b.auth.oid4vp.matchDcql([], { credentials: [] }); }
   catch (e) { threw = /non-empty array/.test(e.message); }
   check("DCQL: empty credentials array refused",      threw);
+
+  // ---- null path-segment = array wildcard (OpenID4VP 1.0 §7.1.1) ----
+  function _dcqlValid(path, claimsObj, values) {
+    var q = { credentials: [{ id: "c", format: "vc+sd-jwt",
+      claims: [values ? { path: path, values: values } : { path: path }] }] };
+    return b.auth.oid4vp.matchDcql([{ id: "c", format: "vc+sd-jwt", claims: claimsObj }], q).valid;
+  }
+  var degrees = { degrees: [{ type: "BachelorDegree" }, { type: "MasterDegree" }] };
+  check("DCQL null: any-element type matches",          _dcqlValid(["degrees", null, "type"], degrees));
+  check("DCQL null: value-match on any element (hit)",  _dcqlValid(["degrees", null, "type"], degrees, ["MasterDegree"]));
+  check("DCQL null: value-match on any element (miss)", !_dcqlValid(["degrees", null, "type"], degrees, ["PhD"]));
+  // null on a non-array node → clean non-match, never throws (holder data, not config)
+  var threwNull = false; var nullNonArray = true;
+  try { nullNonArray = _dcqlValid(["degrees", null], { degrees: "not-an-array" }); }
+  catch (_e) { threwNull = true; }
+  check("DCQL null on non-array does not throw",        !threwNull);
+  check("DCQL null on non-array is a non-match",        !nullNonArray);
+  // null at the leaf → match iff the array holds any defined element
+  check("DCQL null at leaf matches non-empty array",    _dcqlValid(["tags", null], { tags: ["a", "b"] }));
+  check("DCQL null at leaf misses empty array",         !_dcqlValid(["tags", null], { tags: [] }));
+  // nested null wildcards recurse to arbitrary depth
+  check("DCQL nested null wildcards match",             _dcqlValid(["a", null, "b", null], { a: [{ b: [1, 2] }] }));
 }
 
 // ---- OID4VCI issuer config -------------------------------------------

package/lib/vendor/blamejs/test/layer-0-primitives/mail-srs.test.js

@@ -133,6 +133,66 @@ function testLocalPartWithEquals() {
         srs.reverse(rw) === "foo=bar@bob.com");
 }
 
+function testSrs1DoubleForward() {
+  // Two distinct forwarders with distinct secrets.
+  var srsA = b.mail.srs.create({ secret: b.crypto.generateToken(32), forwarderDomain: "fwd1.example" });
+  var srsB = b.mail.srs.create({ secret: b.crypto.generateToken(32), forwarderDomain: "fwd2.example" });
+
+  // Hop 1: alice@bob.com → fwd1 (SRS0).
+  var rw0 = srsA.rewrite("alice@bob.com");
+  check("srs1: first hop is SRS0 at fwd1", rw0.startsWith("SRS0=") && rw0.endsWith("@fwd1.example"));
+
+  // Hop 2: fwd2 chains the already-SRS0 address as SRS1.
+  var rw1 = srsB.srs1Rewrite(rw0);
+  check("srs1: produces SRS1=",                rw1.startsWith("SRS1="));
+  check("srs1: ends at this forwarder (fwd2)", rw1.endsWith("@fwd2.example"));
+  check("srs1: embeds the SRS0 originator",    rw1.indexOf("fwd1.example") !== -1);
+  check("srs1: has '==' separator",            rw1.indexOf("==") > 0);
+
+  // reverse() at fwd2 unwraps exactly one hop → the originator's SRS0 (== rw0).
+  var back = srsB.reverse(rw1);
+  check("srs1: reverse unwraps one hop to the originator SRS0", back === rw0);
+  // fwd1 then reverses that SRS0 → original sender (full chain).
+  check("srs1: two-hop chain recovers the original sender", srsA.reverse(back) === "alice@bob.com");
+
+  // Tampered SRS1 tag → bad-tag.
+  var tampered = "SRS1=ZZZZ=" + rw1.slice(rw1.indexOf("=", 5) + 1);
+  var threwTag = null;
+  try { srsB.reverse(tampered); } catch (e) { threwTag = e; }
+  check("srs1: tampered tag refused", threwTag && /srs\/bad-tag/.test(threwTag.code || ""));
+
+  // rw1 is addressed to fwd2; fwd1 reversing it → wrong-forwarder.
+  var threwFwd = null;
+  try { srsA.reverse(rw1); } catch (e) { threwFwd = e; }
+  check("srs1: bounce at the wrong forwarder refused", threwFwd && /srs\/wrong-forwarder/.test(threwFwd.code || ""));
+
+  // srs1Rewrite on a plain (non-SRS) address → not-srs0.
+  var threwPlain = null;
+  try { srsB.srs1Rewrite("alice@bob.com"); } catch (e) { threwPlain = e; }
+  check("srs1Rewrite: plain address refused", threwPlain && /srs\/not-srs0/.test(threwPlain.code || ""));
+
+  // srs1Rewrite empty / no-@ → bad-address.
+  var threwEmpty = null;
+  try { srsB.srs1Rewrite(""); } catch (e) { threwEmpty = e; }
+  check("srs1Rewrite: empty refused", threwEmpty && /srs\/bad-address/.test(threwEmpty.code || ""));
+
+  // reverse of a malformed SRS1 (no '==' separator) → malformed.
+  var threwMal = null;
+  try { srsB.reverse("SRS1=abc@fwd2.example"); } catch (e) { threwMal = e; }
+  check("srs1: malformed (no '==') refused", threwMal && /srs\/malformed/.test(threwMal.code || ""));
+
+  // Third hop: fwd3 re-wraps fwd2's SRS1. The bounce target stays the
+  // SRS0 originator (fwd1), so it still routes straight back, never to
+  // the intermediate fwd2.
+  var srsC = b.mail.srs.create({ secret: b.crypto.generateToken(32), forwarderDomain: "fwd3.example" });
+  var rw2 = srsC.srs1Rewrite(rw1);
+  check("srs1: third hop is SRS1 at fwd3",                rw2.startsWith("SRS1=") && rw2.endsWith("@fwd3.example"));
+  check("srs1: third hop keeps the originator (fwd1)",    rw2.indexOf("fwd1.example") !== -1);
+  var back2 = srsC.reverse(rw2);
+  check("srs1: third hop unwraps straight back to the originator SRS0", back2 === rw0);
+  check("srs1: full three-hop chain recovers the original sender",      srsA.reverse(back2) === "alice@bob.com");
+}
+
 async function run() {
   testSurface();
   testRoundTrip();
@@ -142,6 +202,7 @@ async function run() {
   testBadShape();
   testForwarderDomainBinding();
   testLocalPartWithEquals();
+  testSrs1DoubleForward();
 }
 
 module.exports = { run: run };

package/lib/vendor/blamejs/test/layer-0-primitives/privacy-vendor-review.test.js

@@ -0,0 +1,69 @@
+"use strict";
+// b.privacy.vendorReview + b.privacy.listVendorReviewClauses — FERPA / SOPIPA
+// EdTech vendor-review attestation builder (pure; no DB).
+
+var helpers = require("../helpers");
+var b       = helpers.b;
+var check   = helpers.check;
+
+var ALL_TRUE = {
+  educationalPurposeOnly: true, noTargetedAdvertising: true, noCommercialProfiling: true,
+  noSaleOfStudentData:    true, securitySafeguards:    true, deletionOnRequest:     true,
+  subProcessorsCurrent:   true, breachNotification:    true, schoolOfficialDesignation: true,
+};
+
+function run() {
+  check("vendorReview is a function",               typeof b.privacy.vendorReview === "function");
+  check("listVendorReviewClauses is a function",    typeof b.privacy.listVendorReviewClauses === "function");
+  check("PrivacyError exposed on b.frameworkError", typeof b.frameworkError.PrivacyError === "function");
+  check("b.privacy.PrivacyError is the same constructor",
+        b.privacy.PrivacyError === b.frameworkError.PrivacyError);
+
+  var clauses = b.privacy.listVendorReviewClauses();
+  check("clauses: frozen array",                    Array.isArray(clauses) && Object.isFrozen(clauses));
+  check("clauses: >= 9 entries",                    clauses.length >= 9);
+  check("clauses: each has id + citation + required boolean",
+        clauses.every(function (c) { return typeof c.id === "string" && typeof c.citation === "string" && typeof c.required === "boolean"; }));
+  check("clauses: educationalPurposeOnly is required",
+        clauses.some(function (c) { return c.id === "educationalPurposeOnly" && c.required === true; }));
+
+  // All required clauses true → attested, no gaps, 365-day next review clock.
+  var reviewedAt = 1700000000000;
+  var ok = b.privacy.vendorReview({ vendorName: "Acme LMS", reviewedAt: reviewedAt, clauses: ALL_TRUE });
+  check("vendorReview: attested when all required true", ok.attested === true);
+  check("vendorReview: no gaps",                         ok.gaps.length === 0);
+  check("vendorReview: nextReviewDueAt = reviewedAt + 365 days",
+        ok.nextReviewDueAt === reviewedAt + b.constants.TIME.days(365));
+  check("vendorReview: report frozen",                   Object.isFrozen(ok));
+  check("vendorReview: vendorName carried",              ok.vendorName === "Acme LMS");
+  check("vendorReview: coversPeriod is the prior year",  ok.coversPeriod.to === reviewedAt && ok.coversPeriod.from === reviewedAt - b.constants.TIME.days(365));
+
+  // One required clause false → not attested + the gap is named.
+  var partial = Object.assign({}, ALL_TRUE, { noSaleOfStudentData: false });
+  var gap = b.privacy.vendorReview({ vendorName: "Acme", reviewedAt: reviewedAt, clauses: partial });
+  check("vendorReview: not attested on a required gap",  gap.attested === false);
+  check("vendorReview: gap names the failed clause",     gap.gaps.indexOf("noSaleOfStudentData") !== -1);
+
+  // The one optional clause omitted still attests.
+  check("vendorReview: optional clause omitted still attests",
+        b.privacy.vendorReview({ vendorName: "A", reviewedAt: reviewedAt, clauses: ALL_TRUE }).attested === true);
+
+  // Config-time throws (rule §5 — entry-point tier).
+  function expectCode(label, fn, code) {
+    var threw = null;
+    try { fn(); } catch (e) { threw = e; }
+    check(label, threw && (threw.code || "") === code);
+  }
+  expectCode("missing vendorName throws",
+             function () { b.privacy.vendorReview({ reviewedAt: reviewedAt, clauses: ALL_TRUE }); }, "privacy/bad-vendor");
+  expectCode("non-boolean clause value throws",
+             function () { b.privacy.vendorReview({ vendorName: "A", reviewedAt: reviewedAt, clauses: { noSaleOfStudentData: "yes" } }); }, "privacy/bad-clause-value");
+  expectCode("unknown clause key throws",
+             function () { b.privacy.vendorReview({ vendorName: "A", reviewedAt: reviewedAt, clauses: { bogusClause: true } }); }, "privacy/unknown-clause");
+  expectCode("missing reviewedAt throws",
+             function () { b.privacy.vendorReview({ vendorName: "A", clauses: ALL_TRUE }); }, "privacy/bad-reviewed-at");
+  expectCode("non-object opts throws",
+             function () { b.privacy.vendorReview("nope"); }, "privacy/bad-opts");
+}
+
+module.exports = { run: run };

package/lib/vendor/blamejs/test/layer-0-primitives/vault-rotate-aad.test.js

@@ -0,0 +1,158 @@
+"use strict";
+/**
+ * b.vaultRotate.rotate — AAD round-trip.
+ *
+ * Regression for the vault-key rotation orphaning class: a keypair
+ * rotation must re-seal, old-root -> new-root,
+ *   - vault.aad: data cells (registerTable({ aad: true })),
+ *   - the AAD-bound db.key.enc (deployment-context sealed master key), and
+ *   - the AAD-bound db.enc envelope (_dbEncAad(dataDir)),
+ * so the rotated data dir opens and decrypts under the NEW keypair and no
+ * longer under the old one. Before this fix rotate re-sealed only plain
+ * `vault:` cells, threw `bad-dbkey` on the AAD-sealed master key, and read
+ * db.enc with no AAD — silently orphaning AAD cells while reporting ok.
+ */
+
+var helpers = require("../helpers");
+var b      = helpers.b;
+var fs     = helpers.fs;
+var os     = helpers.os;
+var path   = helpers.path;
+var check  = helpers.check;
+
+var SECRETS_SCHEMA = [{
+  name:          "secrets",
+  columns:       { _id: "TEXT PRIMARY KEY", tenantId: "TEXT", secret: "TEXT" },
+  sealedFields:  ["secret"],
+  aad:           true,
+  rowIdField:    "_id",
+  schemaVersion: "1",
+}];
+
+// Discover every lib module that declares an external AAD_ROTATION descriptor
+// by reading its actual export, so the gate-coverage assertion can't drift as
+// modules are added. backend:"external" means the store lives outside db.enc
+// (an operator-supplied backend) and the rotation pipeline can only refuse and
+// point at the module's reseal hook — so every such module MUST be reachable
+// from rotate's EXTERNAL_AAD_MODULE_LOADERS or a rotation silently orphans it.
+function _discoverExternalAadTables() {
+  var libDir = path.join(__dirname, "..", "..", "lib");
+  var files = [];
+  fs.readdirSync(libDir).forEach(function (name) {
+    var full = path.join(libDir, name);
+    if (fs.statSync(full).isDirectory()) {
+      fs.readdirSync(full).forEach(function (n2) { if (n2.slice(-3) === ".js") files.push(path.join(full, n2)); });
+    } else if (name.slice(-3) === ".js") { files.push(full); }
+  });
+  var tables = [];
+  files.forEach(function (f) {
+    if (f.replace(/\\/g, "/").indexOf("/vault/rotate.js") !== -1) return;   // the gate consumes; it doesn't declare
+    var src = fs.readFileSync(f, "utf8");
+    if (src.indexOf("AAD_ROTATION") === -1 || src.indexOf("\"external\"") === -1) return;
+    var mod;
+    try { mod = require(f); } catch (_e) { return; }
+    var desc = mod && mod.AAD_ROTATION;
+    if (!desc) return;
+    (Array.isArray(desc) ? desc : [desc]).forEach(function (d) {
+      if (d && d.backend === "external" && d.table) tables.push(d.table);
+    });
+  });
+  return tables;
+}
+
+async function _reset() {
+  process.env.BLAMEJS_SKIP_NTP_CHECK = "1";
+  b.cluster._resetForTest();
+  b.audit._resetForTest();
+  b.vault._resetForTest();
+  b.db._resetForTest();
+}
+
+async function run() {
+  // Gate-coverage invariant: rotate's external-AAD gate must name every
+  // external AAD_ROTATION table any lib module declares. A module that ships
+  // the descriptor but isn't wired into EXTERNAL_AAD_MODULE_LOADERS would let
+  // rotate() succeed with no acknowledgement, orphaning that store under the
+  // retired root (the archive-wrap:tenant-blobs gap caught on PR #293).
+  var declaredExternal = _discoverExternalAadTables();
+  var gatedExternal    = b.vaultRotate._externalAadTables();
+  check("found the external AAD_ROTATION modules (idempotency/orchestrator/tenant/snapshot/archive-wrap)",
+    declaredExternal.length >= 6);
+  var ungated = declaredExternal.filter(function (t) { return gatedExternal.indexOf(t) === -1; });
+  check("rotate's external-AAD gate covers every declared external AAD_ROTATION table (ungated: " + ungated.join(", ") + ")",
+    ungated.length === 0);
+
+  var dirNew  = fs.mkdtempSync(path.join(os.tmpdir(), "vr-new-"));
+  var dirA    = fs.mkdtempSync(path.join(os.tmpdir(), "vr-a-"));
+  var staging = path.join(os.tmpdir(), "vr-stg-" + process.pid + "-" + Date.now());
+
+  try {
+    // 1. A fresh, distinct keypair to rotate INTO.
+    await _reset();
+    await b.vault.init({ dataDir: dirNew, mode: "plaintext" });
+    var newKeys = JSON.parse(b.vault.getKeysJson());
+    b.vault._resetForTest();
+
+    // 2. The live deployment: vault + encrypted db + an AAD-bound table
+    //    carrying one sealed row.
+    await _reset();
+    await b.vault.init({ dataDir: dirA, mode: "plaintext" });
+    var oldKeys = JSON.parse(b.vault.getKeysJson());
+    check("old and new keypairs differ", JSON.stringify(oldKeys) !== JSON.stringify(newKeys));
+    await b.db.init({ dataDir: dirA, tmpDir: path.join(dirA, "tmpfs"), atRest: "encrypted", auditSigning: false, frameworkTables: false, schema: SECRETS_SCHEMA });
+
+    var sealed = b.cryptoField.sealRow("secrets", { _id: "sec-1", tenantId: "t1", secret: "top-secret-value" });
+    check("AAD seal produced a vault.aad: cell (db.init honored aad:true)",
+      typeof sealed.secret === "string" && sealed.secret.indexOf("vault.aad:") === 0);
+    b.db.from("secrets").insertOne(sealed);
+    await b.db.flushToDisk();
+    await b.db.close();
+
+    // Detect-and-refuse: without acknowledging the external-AAD agent
+    // stores, rotate must refuse rather than silently orphan them.
+    var refused = null;
+    try {
+      await b.vaultRotate.rotate({ dataDir: dirA, stagingDir: staging + "-x", oldKeys: oldKeys, newKeys: newKeys, mode: "plaintext" });
+    } catch (e) { refused = e; }
+    check("rotate refuses unacknowledged external-AAD stores",
+      !!refused && refused.code === "vault-rotate/external-aad-unresealed");
+
+    // 3. Rotate the keypair old -> new.
+    // externalAadResealed: true acknowledges the operator-supplied agent
+    // stores (idempotency/orchestrator/tenant/snapshot) are handled via
+    // their own reseal hooks — this deployment uses none of them.
+    var result = await b.vaultRotate.rotate({
+      dataDir: dirA, stagingDir: staging, oldKeys: oldKeys, newKeys: newKeys, mode: "plaintext",
+      externalAadResealed: true,
+    });
+    // rotate's own round-trip verify decrypts the staged db.enc with the
+    // new keypair and (with oldKeys supplied) regression-checks the old —
+    // so ok===true means the AAD cell + db.key.enc + db.enc all rotated.
+    check("rotate internal verify ok (AAD cells decrypt under new root, old rejected)",
+      !!result.verifyResult && result.verifyResult.ok === true);
+    check("rotate processed the sealed row", result.totalRowsProcessed >= 1);
+
+    // 4. Swap staging -> dataDir and re-open under the NEW keypair: proves
+    //    db.init's AAD-first open of the rotated db.enc + db.key.enc works
+    //    and the data cell decrypts end-to-end.
+    ["db.enc", "db.key.enc", "vault.key"].forEach(function (f) {
+      var s = path.join(staging, f);
+      if (fs.existsSync(s)) fs.copyFileSync(s, path.join(dirA, f));
+    });
+    try { fs.rmSync(path.join(dirA, "tmpfs"), { recursive: true, force: true }); } catch (_e) { /* fresh decrypt */ }
+
+    await _reset();
+    await b.vault.init({ dataDir: dirA, mode: "plaintext" });
+    check("vault now live under the NEW keypair", JSON.stringify(JSON.parse(b.vault.getKeysJson())) === JSON.stringify(newKeys));
+    await b.db.init({ dataDir: dirA, tmpDir: path.join(dirA, "tmpfs"), atRest: "encrypted", auditSigning: false, frameworkTables: false, schema: SECRETS_SCHEMA });
+
+    var got = b.cryptoField.unsealRow("secrets", b.db.from("secrets").where({ _id: "sec-1" }).first());
+    check("AAD cell decrypts after rotation under the new keypair", !!got && got.secret === "top-secret-value");
+    await b.db.close();
+  } finally {
+    await _reset();
+    [dirNew, dirA, staging].forEach(function (d) { try { fs.rmSync(d, { recursive: true, force: true }); } catch (_e) { /* cleanup */ } });
+  }
+}
+
+module.exports = { run: run };