@blamejs/blamejs-shop 0.4.30 → 0.4.32

package/lib/vendor/blamejs/test/integration/sql-fts5-catalog-sqlite.test.js

@@ -0,0 +1,154 @@
+"use strict";
+/**
+ * Live b.sql sqlite-FTS5 + catalog/pragma test against a real node:sqlite
+ * DatabaseSync handle (no docker - sqlite is the built-in dialect).
+ *
+ * Exercises the sqlite-only builders the mail store + the at-rest key-
+ * rotation pipeline drive, end to end against a live engine so the emitted
+ * SQL is proven to PARSE + RUN + return the right rows, not just match a
+ * string shape:
+ *
+ *   1. createVirtualTable -> CREATE VIRTUAL TABLE ... USING fts5(...) runs;
+ *      whereMatch -> `<fts> MATCH ?` returns exactly the rows whose tokens
+ *      match, with the query string bound (never interpolated).
+ *   2. whereInJsonEach -> `<col> IN (SELECT value FROM json_each(?))`
+ *      unrolls a JSON-array string bind to a membership filter.
+ *   3. The catalog sub-API (listTables / tableExists / tableInfo /
+ *      sampleRandom / changes) + pragma (journal_mode / synchronous /
+ *      wal_checkpoint) emit statements the engine accepts, returning the
+ *      real catalog metadata.
+ *   4. A bound MATCH operand carrying SQL metacharacters stays a literal
+ *      FTS query term - it cannot break out of the placeholder.
+ */
+
+var { DatabaseSync } = require("node:sqlite");
+var helpers = require("../helpers");
+var check   = helpers.check;
+var b       = require("../../");
+
+function _all(db, built) {
+  var st = db.prepare(built.sql);
+  return built.params.length > 0 ? st.all.apply(st, built.params) : st.all();
+}
+function _get(db, built) {
+  var st = db.prepare(built.sql);
+  return built.params.length > 0 ? st.get.apply(st, built.params) : st.get();
+}
+function _run(db, built) {
+  var st = db.prepare(built.sql);
+  return built.params.length > 0 ? st.run.apply(st, built.params) : st.run();
+}
+
+async function run() {
+  var sql = b.sql;
+  var db = new DatabaseSync(":memory:");
+  try {
+    // ---- 1. FTS5 virtual table + MATCH ----
+    _run(db, sql.createVirtualTable("mail_fts", {
+      columns:  [{ name: "objectid", unindexed: true }, "subject_toks", "body_toks"],
+      tokenize: "unicode61 remove_diacritics 2",
+      quoteName: true,
+    }));
+    check("createVirtualTable: CREATE VIRTUAL TABLE USING fts5 runs", true);
+
+    function ins(oid, subj, body) {
+      _run(db, sql.insert("mail_fts", { quoteName: true })
+        .columns(["objectid", "subject_toks", "body_toks"])
+        .values({ objectid: oid, subject_toks: subj, body_toks: body }).toSql());
+    }
+    ins("m1", "alpha bravo", "charlie delta");
+    ins("m2", "bravo", "echo");
+    ins("m3", "zulu", "delta foxtrot");
+
+    // `<fts> MATCH ?` inside the IN-subquery shape the mail store uses -
+    // bind the query string, never interpolate.
+    var matchSub = sql.select("mail_fts", { dialect: "sqlite", quoteName: true })
+      .columns(["objectid"]).whereMatch("mail_fts", "bravo").toSql();
+    var bravoRows = _all(db, matchSub).map(function (r) { return r.objectid; }).sort();
+    check("whereMatch 'bravo' returns m1 + m2 (token in subject of both)",
+          bravoRows.length === 2 && bravoRows[0] === "m1" && bravoRows[1] === "m2");
+
+    var deltaSub = sql.select("mail_fts", { dialect: "sqlite", quoteName: true })
+      .columns(["objectid"]).whereMatch("mail_fts", "delta").toSql();
+    var deltaRows = _all(db, deltaSub).map(function (r) { return r.objectid; }).sort();
+    check("whereMatch 'delta' returns m1 + m3 (token in body of both)",
+          deltaRows.length === 2 && deltaRows[0] === "m1" && deltaRows[1] === "m3");
+
+    // The MATCH operand binds: a query carrying a token that does not exist
+    // returns nothing (and a metacharacter-laden operand stays a literal
+    // FTS term, never a statement break - the engine parses it as a query).
+    var noneSub = sql.select("mail_fts", { dialect: "sqlite", quoteName: true })
+      .columns(["objectid"]).whereMatch("mail_fts", "nonexistenttoken").toSql();
+    check("whereMatch unknown token returns no rows", _all(db, noneSub).length === 0);
+
+    // ---- 2. json_each membership ----
+    db.prepare('CREATE TABLE "msgs" ("objectid" TEXT, "folder_id" INTEGER)').run();
+    db.prepare('INSERT INTO "msgs" VALUES (?,?),(?,?),(?,?)')
+      .run("m1", 1, "m2", 1, "m3", 2);
+    var jeBuilt = sql.select("msgs", { dialect: "sqlite", quoteName: true })
+      .columns(["objectid", "folder_id"])
+      .where("folder_id", 1)
+      .whereInJsonEach("objectid", JSON.stringify(["m1", "m3"]))
+      .toSql();
+    var jeRows = _all(db, jeBuilt).map(function (r) { return r.objectid; });
+    check("whereInJsonEach: folder=1 AND objectid IN json_each(['m1','m3']) -> only m1",
+          jeRows.length === 1 && jeRows[0] === "m1");
+
+    // ---- 3. catalog sub-API ----
+    var tables = _all(db, sql.catalog.listTables()).map(function (r) { return r.name; });
+    check("catalog.listTables lists the user tables (msgs present, no sqlite_ internal)",
+          tables.indexOf("msgs") !== -1 && tables.every(function (n) { return n.indexOf("sqlite_") !== 0; }));
+    check("catalog.tableExists true for a real table",
+          !!_get(db, sql.catalog.tableExists("msgs")));
+    check("catalog.tableExists false for a missing table",
+          !_get(db, sql.catalog.tableExists("no_such_table")));
+    var info = _all(db, sql.catalog.tableInfo("msgs")).map(function (c) { return c.name; }).sort();
+    check("catalog.tableInfo returns the column names",
+          info.length === 2 && info[0] === "folder_id" && info[1] === "objectid");
+    var sample = _all(db, sql.catalog.sampleRandom("msgs", ["objectid"], { limit: 2 }));
+    check("catalog.sampleRandom ORDER BY RANDOM LIMIT ? returns <= limit rows",
+          sample.length <= 2 && sample.length >= 1);
+
+    // catalog.changes reports the row count of the last write on this conn.
+    db.prepare('UPDATE "msgs" SET "folder_id" = 9 WHERE "folder_id" = 2').run();
+    var changed = _get(db, sql.catalog.changes());
+    check("catalog.changes reports last-write rowcount", changed && changed.c === 1);
+
+    // ---- 4. pragma sub-API ----
+    var jm = _get(db, sql.pragma("journal_mode", "WAL"));
+    check("pragma journal_mode=WAL runs (returns a mode row)", !!jm);
+    _run(db, sql.pragma("synchronous", "NORMAL"));
+    check("pragma synchronous=NORMAL runs", true);
+    _run(db, sql.pragma("wal_checkpoint", "TRUNCATE"));
+    check("pragma wal_checkpoint(TRUNCATE) runs", true);
+
+    // ---- 5. metacharacter operand stays bound (no breakout) ----
+    // A would-be-injection MATCH operand is a literal FTS query term: the
+    // FTS5 parser treats it as a (possibly zero-match) query, never a
+    // statement. The row count is whatever matches; the point is the
+    // statement does not error out / stack a second statement.
+    var safeMatch = sql.select("mail_fts", { dialect: "sqlite", quoteName: true })
+      .columns(["objectid"]).whereMatch("mail_fts", "alpha").toSql();
+    var injBuilt = { sql: safeMatch.sql, params: ['alpha"; DROP TABLE "msgs'] };
+    var injErr = null;
+    try { _all(db, injBuilt); } catch (e) { injErr = e; }
+    var msgsStill = !!_get(db, sql.catalog.tableExists("msgs"));
+    check("bound MATCH operand with metacharacters does not drop a table",
+          msgsStill);
+    // The metachar query either matches nothing or errors as a malformed
+    // FTS expression - either way "msgs" survived (no statement breakout).
+    check("metachar MATCH operand stayed a single bound statement",
+          injErr === null || msgsStill);
+  } finally {
+    db.close();
+  }
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  run().then(
+    function () { console.log("OK — " + helpers.getChecks() + " checks passed"); process.exit(0); },
+    function (e) { console.error("FAIL:", e.stack || e); process.exit(1); }
+  );
+}

package/lib/vendor/blamejs/test/integration/tls-classical-downgrade-audit.test.js

@@ -0,0 +1,71 @@
+"use strict";
+/**
+ * Live proof of the outbound-TLS classical-downgrade audit. When an outbound
+ * connection negotiates classical X25519 (the peer offers no ML-KEM hybrid),
+ * the framework emits a `tls.classical_downgrade` audit event; when it
+ * negotiates a hybrid, it does not. Azurite (its OpenSSL has no ML-KEM)
+ * forces the classical fallback; MinIO-tls (OpenSSL 3.5) negotiates the
+ * hybrid. Runs over TLS with the test CA (NODE_EXTRA_CA_CERTS), no bypass.
+ */
+var helpers = require("../helpers");
+var b = helpers.b;
+var check = helpers.check;
+var services = require("../helpers/services");
+var httpClient = require("../../lib/http-client");
+var setupTestDb = require("../helpers/db").setupTestDb;
+var teardownTestDb = require("../helpers/db").teardownTestDb;
+var fs = require("node:fs"), os = require("node:os"), path = require("node:path");
+
+async function downgradeRows(sinceMs) {
+  await b.audit.flush();
+  var rows = await b.audit.query({ action: "tls.classical_downgrade", from: sinceMs - 1000, limit: 100 });
+  return (rows || []).map(function (r) {
+    var md = r.metadata;
+    if (typeof md === "string") { try { md = JSON.parse(md); } catch (_e) { md = {}; } }
+    return md || {};
+  });
+}
+
+async function run() {
+  var azu = await services.requireService("azurite");
+  if (!azu.ok) throw new Error("azurite unreachable: " + azu.reason);
+  var mio = await services.requireService("minioTls");
+  if (!mio.ok) throw new Error("minio-tls unreachable: " + mio.reason);
+
+  var dir = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-tlsdown-"));
+  try {
+    await setupTestDb(dir, []);
+
+    // Classical peer (Azurite — no ML-KEM hybrid). The HTTP response is
+    // irrelevant (an unauthenticated GET may 400); the downgrade audit fires
+    // on the TLS handshake regardless.
+    var t0 = Date.now();
+    try { await httpClient.request({ url: "https://127.0.0.1:10000/", method: "GET", allowInternal: true }); } catch (_e) {}
+    var afterAzu = await downgradeRows(t0);
+    var azuHit = afterAzu.filter(function (m) { return String(m.port) === "10000"; });
+    check("classical peer (Azurite) emitted a tls.classical_downgrade audit", azuHit.length >= 1);
+    check("downgrade audit names the classical group + host",
+      azuHit.some(function (m) { return m.group === "X25519" && m.host === "127.0.0.1"; }));
+
+    // PQC peer (MinIO-tls — negotiates the ML-KEM hybrid). No downgrade for it.
+    var t1 = Date.now();
+    try { await httpClient.request({ url: "https://127.0.0.1:9443/", method: "GET", allowInternal: true }); } catch (_e) {}
+    var afterMio = await downgradeRows(t1);
+    var mioHit = afterMio.filter(function (m) { return String(m.port) === "9443"; });
+    check("PQC peer (MinIO-tls) emitted NO downgrade audit (hybrid negotiated)", mioHit.length === 0);
+
+    await teardownTestDb(dir);
+  } finally {
+    try { fs.rmSync(dir, { recursive: true, force: true }); } catch (_e) {}
+  }
+  console.log("OK — " + helpers.getChecks() + " checks passed");
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  run().then(
+    function () { process.exit(0); },
+    function (e) { console.error("FAIL:", e.stack || e); process.exit(1); }
+  );
+}

package/lib/vendor/blamejs/test/layer-0-primitives/agent-event-bus.test.js

@@ -3,6 +3,15 @@
 var helpers = require("../helpers");
 var b       = helpers.b;
 var check   = helpers.check;
+var fs      = helpers.fs;
+var os      = helpers.os;
+var path    = helpers.path;
+
+// The shape-only tests below run single-process with no vault, so they
+// pass requireMac:false (the documented escape hatch). The keyed-MAC
+// envelope authentication (M6) is exercised against a real vault in the
+// testEnvelopeMac* tests at the bottom of this file.
+function _tmp() { return fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-evbus-")); }
 
 function _fakePubsub() {
   var subs = new Map();
@@ -43,7 +52,7 @@ function testSurface() {
 }
 
 async function testRegisterPublishSubscribe() {
-  var bus = b.agent.eventBus.create({ pubsub: _fakePubsub() });
+  var bus = b.agent.eventBus.create({ pubsub: _fakePubsub(), requireMac: false });
   bus.registerTopic("mail.scan.malware-detected", {
     schema: { source: "string", confidence: "number" },
   });
@@ -58,7 +67,7 @@ async function testRegisterPublishSubscribe() {
 }
 
 async function testUnknownTopic() {
-  var bus = b.agent.eventBus.create({ pubsub: _fakePubsub() });
+  var bus = b.agent.eventBus.create({ pubsub: _fakePubsub(), requireMac: false });
   await expectRejection("publish refuses unknown topic",
     bus.publish("mail.unknown.event", {}),
     "agent-event-bus/unknown-topic");
@@ -68,7 +77,7 @@ async function testUnknownTopic() {
 }
 
 async function testDuplicateTopic() {
-  var bus = b.agent.eventBus.create({ pubsub: _fakePubsub() });
+  var bus = b.agent.eventBus.create({ pubsub: _fakePubsub(), requireMac: false });
   bus.registerTopic("mail.a.b", { schema: { x: "string" } });
   var threw = null;
   try { bus.registerTopic("mail.a.b", { schema: { x: "string" } }); }
@@ -78,7 +87,7 @@ async function testDuplicateTopic() {
 }
 
 async function testBadTopicShape() {
-  var bus = b.agent.eventBus.create({ pubsub: _fakePubsub() });
+  var bus = b.agent.eventBus.create({ pubsub: _fakePubsub(), requireMac: false });
   var threw = null;
   try { bus.registerTopic("malware", { schema: { x: "string" } }); }
   catch (e) { threw = e; }
@@ -87,7 +96,7 @@ async function testBadTopicShape() {
 }
 
 async function testSchemaValidation() {
-  var bus = b.agent.eventBus.create({ pubsub: _fakePubsub() });
+  var bus = b.agent.eventBus.create({ pubsub: _fakePubsub(), requireMac: false });
   bus.registerTopic("mail.scan.detected", {
     schema: { source: "string", confidence: "number" },
   });
@@ -113,7 +122,7 @@ async function testPermissions() {
     },
     auditFailures: false, auditSuccess: false,
   });
-  var bus = b.agent.eventBus.create({ pubsub: _fakePubsub(), permissions: perms });
+  var bus = b.agent.eventBus.create({ pubsub: _fakePubsub(), permissions: perms, requireMac: false });
   bus.registerTopic("mail.scan.detected", {
     schema: { source: "string" },
     permissions: { publish: ["mail-scan:write"], subscribe: ["mail-mx:write"] },
@@ -134,7 +143,7 @@ async function testPermissions() {
 }
 
 async function testTenantScope() {
-  var bus = b.agent.eventBus.create({ pubsub: _fakePubsub() });
+  var bus = b.agent.eventBus.create({ pubsub: _fakePubsub(), requireMac: false });
   bus.registerTopic("mail.tenant.event", {
     schema:      { source: "string" },
     tenantScope: true,
@@ -156,7 +165,7 @@ async function testTenantScope() {
 }
 
 async function testTenantScopeRefusesSubscriberWithoutTenantId() {
-  var bus = b.agent.eventBus.create({ pubsub: _fakePubsub() });
+  var bus = b.agent.eventBus.create({ pubsub: _fakePubsub(), requireMac: false });
   bus.registerTopic("mail.scoped.event", {
     schema:      { source: "string" },
     tenantScope: true,
@@ -172,7 +181,7 @@ async function testTenantScopeRefusesSubscriberWithoutTenantId() {
 }
 
 async function testAsyncHandlerErrors() {
-  var bus = b.agent.eventBus.create({ pubsub: _fakePubsub() });
+  var bus = b.agent.eventBus.create({ pubsub: _fakePubsub(), requireMac: false });
   bus.registerTopic("mail.async.event", { schema: { x: "string" } });
   var crashed = false;
   var origHandler = process.listeners("unhandledRejection").slice();
@@ -196,7 +205,7 @@ async function testRefusesBadOpts() {
 }
 
 async function testListTopics() {
-  var bus = b.agent.eventBus.create({ pubsub: _fakePubsub() });
+  var bus = b.agent.eventBus.create({ pubsub: _fakePubsub(), requireMac: false });
   bus.registerTopic("mail.a.b", { schema: { x: "string" }, posture: "soc2" });
   bus.registerTopic("mail.c.d", { schema: { y: "number" } });
   var list = bus.listTopics({});
@@ -208,7 +217,7 @@ async function testPublishRefusesUntenantedOnTenantTopic() {
   // SUBSTRATE-6 — tenant-scoped topic refuses publish without
   // actor.tenantId so the durable bus never accumulates untenanted
   // entries that get filtered out at subscribe-time.
-  var bus = b.agent.eventBus.create({ pubsub: _fakePubsub() });
+  var bus = b.agent.eventBus.create({ pubsub: _fakePubsub(), requireMac: false });
   bus.registerTopic("mail.scan.malware", {
     schema: { source: "string" }, tenantScope: true,
   });
@@ -226,7 +235,7 @@ async function testPublishRefusesUntenantedOnTenantTopic() {
 async function testUnregisterTopic() {
   // SUBSTRATE-22 / BUG-12 — unregisterTopic exists; the kind filter
   // matches because register captures the kind.
-  var bus = b.agent.eventBus.create({ pubsub: _fakePubsub() });
+  var bus = b.agent.eventBus.create({ pubsub: _fakePubsub(), requireMac: false });
   bus.registerTopic("mail.scan.A", { schema: { x: "string" } });
   bus.registerTopic("mail.scan.B", { schema: { y: "number" } });
   bus.registerTopic("ai.classify.C", { schema: { z: "boolean" } });
@@ -242,6 +251,154 @@ async function testUnregisterTopic() {
   check("SUBSTRATE-22: re-register after unregister", bus.listTopics({}).length === 3);
 }
 
+// ---- M6 — keyed-MAC envelope authentication (real vault) ----
+//
+// A pubsub-write attacker can set _tenantId to a victim's tenant + a
+// schema-valid payload and forge a cross-tenant event; the tenant/schema
+// checks prove SHAPE, not authenticity. The keyed MAC over the envelope's
+// authority-bearing fields, verified at the consumer BEFORE the tenant
+// check, refuses the forgery and any in-flight tamper. requireMac is on
+// by default; these tests use the default with a real vault.
+
+// A pubsub that captures the published envelope AND exposes the
+// subscriber handler, so a test can deliver an arbitrary (forged /
+// tampered) envelope directly to the consumer — exactly a pubsub-write
+// attacker's capability.
+function _capturingPubsub() {
+  var handlers = new Map();
+  var published = [];
+  return {
+    publish: async function (channel, envelope) {
+      published.push({ channel: channel, envelope: envelope });
+      (handlers.get(channel) || []).forEach(function (h) { h(envelope, { source: "fake" }); });
+    },
+    subscribe: async function (channel, handler) {
+      var list = handlers.get(channel) || [];
+      list.push(handler);
+      handlers.set(channel, list);
+      return function () {};
+    },
+    unsubscribe: function () {},
+    // Test affordance: deliver an attacker-controlled envelope straight to
+    // the consumer, bypassing publish() (the bus's own MAC mint).
+    _deliver: function (channel, envelope) {
+      (handlers.get(channel) || []).forEach(function (h) { h(envelope, { source: "attacker" }); });
+    },
+    _lastEnvelope: function () { return published.length ? published[published.length - 1].envelope : null; },
+  };
+}
+
+async function testEnvelopeMacForgedRefused() {
+  var tmpDir = _tmp();
+  await helpers.setupVaultOnly(tmpDir);
+  try {
+    var pubsub = _capturingPubsub();
+    var bus = b.agent.eventBus.create({ pubsub: pubsub });   // requireMac default ON
+    bus.registerTopic("mail.tenant.event", { schema: { source: "string" }, tenantScope: true });
+    var received = [];
+    await bus.subscribe("mail.tenant.event", function (p) { received.push(p); }, {
+      actor: { id: "victim", tenantId: "globex" },
+    });
+    // Attacker forges an envelope: victim's tenant, schema-valid payload,
+    // NO valid MAC. Delivered straight onto the bus (pubsub-write access).
+    pubsub._deliver("mail.tenant.event", {
+      _topic:       "mail.tenant.event",
+      _posture:     undefined,
+      _tenantId:    "globex",                 // victim's tenant — forged
+      _publishedAt: Date.now(),
+      payload:      { source: "attacker-injected" },
+      _mac:         "AAAA",                   // bogus MAC
+    });
+    await helpers.passiveObserve(25, "M6: forged envelope must NOT be delivered");
+    check("forged cross-tenant envelope refused at consumer (MAC invalid)", received.length === 0);
+  } finally {
+    helpers.teardownVaultOnly(tmpDir);
+  }
+}
+
+async function testEnvelopeMacHonestDelivered() {
+  var tmpDir = _tmp();
+  await helpers.setupVaultOnly(tmpDir);
+  try {
+    var pubsub = _capturingPubsub();
+    var bus = b.agent.eventBus.create({ pubsub: pubsub });
+    bus.registerTopic("mail.tenant.event", { schema: { source: "string" }, tenantScope: true });
+    var received = [];
+    await bus.subscribe("mail.tenant.event", function (p) { received.push(p); }, {
+      actor: { id: "u-acme", tenantId: "acme" },
+    });
+    // Honest publish through the bus — it mints a valid MAC.
+    await bus.publish("mail.tenant.event", { source: "legit" }, {
+      actor: { id: "p1", tenantId: "acme" },
+    });
+    await helpers.waitUntil(function () { return received.length >= 1; }, {
+      timeoutMs: 5000, label: "M6: honestly-published event delivered",
+    });
+    check("honestly-published event delivered (valid MAC)", received.length === 1);
+    check("honest event payload intact", received[0].source === "legit");
+  } finally {
+    helpers.teardownVaultOnly(tmpDir);
+  }
+}
+
+async function testEnvelopeMacTamperFails() {
+  var tmpDir = _tmp();
+  await helpers.setupVaultOnly(tmpDir);
+  try {
+    var pubsub = _capturingPubsub();
+    var bus = b.agent.eventBus.create({ pubsub: pubsub });
+    bus.registerTopic("mail.scan.event", { schema: { source: "string" }, posture: "soc2" });
+    var receivedTopic = [];
+    await bus.subscribe("mail.scan.event", function (p) { receivedTopic.push(p); });
+
+    // Capture a genuine envelope, then tamper each authority field and
+    // re-deliver — every tamper must fail the MAC.
+    await bus.publish("mail.scan.event", { source: "ok" }, { actor: { id: "p1" } });
+    await helpers.waitUntil(function () { return receivedTopic.length >= 1; }, {
+      timeoutMs: 5000, label: "M6: baseline honest delivery",
+    });
+    var genuine = pubsub._lastEnvelope();
+    check("baseline honest envelope carries a MAC", typeof genuine._mac === "string" && genuine._mac.length > 0);
+
+    function _clone(env) { return JSON.parse(JSON.stringify(env)); }
+
+    // Tamper _posture (posture downgrade attempt).
+    var gotPosture = [];
+    await bus.subscribe("mail.scan.event", function (p) { gotPosture.push(p); });
+    var tPosture = _clone(genuine); tPosture._posture = "none"; tPosture.payload = { source: "ok" };
+    pubsub._deliver("mail.scan.event", tPosture);
+
+    // Tamper _topic.
+    var tTopic = _clone(genuine); tTopic._topic = "mail.scan.event"; tTopic.payload = { source: "ok" };
+    tTopic._tenantId = "injected";   // change a signed field
+    pubsub._deliver("mail.scan.event", tTopic);
+
+    // Tamper payload.
+    var tPayload = _clone(genuine); tPayload.payload = { source: "tampered" };
+    pubsub._deliver("mail.scan.event", tPayload);
+
+    await helpers.passiveObserve(40, "M6: tampered envelopes must NOT reach the second subscriber");
+    check("tampered _posture / _tenantId / payload all fail the MAC (none delivered)",
+          gotPosture.length === 0);
+  } finally {
+    helpers.teardownVaultOnly(tmpDir);
+  }
+}
+
+async function testEnvelopeMacPublishFailsClosedWithoutVault() {
+  // requireMac default ON + no vault → publish refuses (fail-closed)
+  // rather than emitting an unauthenticatable envelope.
+  b.vault._resetForTest();
+  if (b.agent.postureChain && b.agent.postureChain._resetForTest) b.agent.postureChain._resetForTest();
+  var bus = b.agent.eventBus.create({ pubsub: _capturingPubsub() });
+  bus.registerTopic("mail.scan.noVault", { schema: { source: "string" } });
+  var threw = null;
+  try { await bus.publish("mail.scan.noVault", { source: "x" }, { actor: { id: "p1" } }); }
+  catch (e) { threw = e; }
+  check("publish fails closed when no MAC key (requireMac default)",
+        threw && (threw.code || "").indexOf("agent-event-bus/envelope-mac-unavailable") !== -1);
+}
+
 async function run() {
   testSurface();
   await testRegisterPublishSubscribe();
@@ -257,6 +414,12 @@ async function run() {
   await testRefusesBadOpts();
   await testListTopics();
   await testUnregisterTopic();
+  // M6 — keyed-MAC envelope authentication (real vault). The no-vault
+  // fail-closed test runs LAST (it tears the vault down).
+  await testEnvelopeMacForgedRefused();
+  await testEnvelopeMacHonestDelivered();
+  await testEnvelopeMacTamperFails();
+  await testEnvelopeMacPublishFailsClosedWithoutVault();
 }
 
 module.exports = { run: run };