@blamejs/blamejs-shop 0.4.56 → 0.4.57

package/lib/vendor/blamejs/test/layer-0-primitives/audit-sign-anchor.test.js

@@ -0,0 +1,88 @@
+"use strict";
+/**
+ * b.auditSign.anchor / verifyAnchor / verifyAnchorChain — the chain-checkpoint
+ * protocol lifted off the framework audit store so a consumer can anchor THEIR
+ * OWN hash chain with PQC signatures (#327).
+ *
+ * RED on the current tree: b.auditSign.anchor is undefined. Uses ml-dsa-65 (the
+ * fastest PQC keypair) so the per-run keygen stays cheap.
+ */
+
+var helpers = require("../helpers");
+var b     = helpers.b;
+var check = helpers.check;
+var fs   = require("fs");
+var os   = require("os");
+var path = require("path");
+
+async function run() {
+  var dir = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-anchor-"));
+  try {
+    b.auditSign._resetForTest();
+    await b.auditSign.init({ dataDir: dir, mode: "plaintext", algorithm: "ml-dsa-65" });
+    var as = b.auditSign;
+
+    check("anchor / verifyAnchor / verifyAnchorChain are exported",
+      typeof b.auditSign.anchor === "function" &&
+      typeof b.auditSign.verifyAnchor === "function" &&
+      typeof b.auditSign.verifyAnchorChain === "function");
+
+    var a1 = as.anchor({ counter: 1, tipHash: "h1" });
+    check("anchor returns a self-describing signed object",
+      a1 && typeof a1.signature === "string" && a1.tipHash === "h1" &&
+      a1.publicKeyFingerprint && a1.format === "blamejs-chain-anchor-v1");
+    check("a distinct format magic separates anchors from audit checkpoints",
+      a1.format !== "blamejs-audit-checkpoint-v1");
+
+    check("verifyAnchor accepts a clean anchor", as.verifyAnchor(a1).ok === true);
+
+    // A full-chain rewrite changes the tipHash — the signature catches it.
+    check("verifyAnchor rejects a tampered tipHash",
+      as.verifyAnchor(Object.assign({}, a1, { tipHash: "ffff" })).ok === false);
+    // A forged signature (truncated hex) fails closed.
+    check("verifyAnchor rejects malformed-hex signature",
+      as.verifyAnchor(Object.assign({}, a1, { signature: "zz" })).ok === false);
+    // An unknown signing key fails closed.
+    check("verifyAnchor rejects an unknown signing-key fingerprint",
+      as.verifyAnchor(Object.assign({}, a1, { publicKeyFingerprint: "deadbeef" })).ok === false);
+
+    var a2 = as.anchor({ counter: 2, tipHash: "h2", prevTipHash: "h1" });
+    // The linkage is SIGNED (#327 C2): tampering prevTipHash breaks the signature.
+    check("prevTipHash is bound into the signature (tampering it breaks verify)",
+      as.verifyAnchor(Object.assign({}, a2, { prevTipHash: "wrong" })).ok === false);
+
+    check("verifyAnchorChain accepts a linked, increasing sequence",
+      as.verifyAnchorChain([a1, a2]).ok === true && as.verifyAnchorChain([a1, a2]).anchorsVerified === 2);
+
+    // Truncation: a non-genesis anchor presented first (its prevTipHash has no
+    // predecessor) is a break.
+    var tr = as.verifyAnchorChain([a2]);
+    check("verifyAnchorChain catches a dropped predecessor", tr.ok === false && tr.breakAt === 0);
+
+    // A broken link (prevTipHash != prior tipHash) is caught.
+    var a3 = as.anchor({ counter: 3, tipHash: "h3", prevTipHash: "not-h2" });
+    var br = as.verifyAnchorChain([a1, a2, a3]);
+    check("verifyAnchorChain catches a broken link", br.ok === false && br.breakAt === 2);
+
+    // Non-monotonic counters are caught.
+    var lower = as.anchor({ counter: 1, tipHash: "h4", prevTipHash: "h2" });
+    check("verifyAnchorChain catches a non-increasing counter",
+      as.verifyAnchorChain([a1, a2, lower]).ok === false);
+
+    // requireLinkage:false admits unlinked anchors on the signature alone.
+    var u1 = as.anchor({ counter: 10, tipHash: "u1" });
+    var u2 = as.anchor({ counter: 11, tipHash: "u2" });
+    check("requireLinkage:false admits unlinked anchors",
+      as.verifyAnchorChain([u1, u2], { requireLinkage: false }).ok === true);
+
+    // Malformed tip throws a typed config-time error.
+    var threw = false;
+    try { as.anchor({ counter: 1 }); } catch (e) { threw = e.code === "ANCHOR_BAD_TIPHASH"; }
+    check("anchor throws a typed error on a malformed tip", threw);
+  } finally {
+    try { b.auditSign._resetForTest(); } catch (_e) { /* best-effort */ }
+    try { fs.rmSync(dir, { recursive: true, force: true }); } catch (_e) { /* best-effort */ }
+  }
+}
+
+module.exports = { run: run };

package/lib/vendor/blamejs/test/layer-0-primitives/audit-use-store.test.js

@@ -19,6 +19,8 @@ var fs             = helpers.fs;
 var os             = helpers.os;
 var path           = helpers.path;
 var check          = helpers.check;
+var waitUntil      = helpers.waitUntil;
+var passiveObserve = helpers.passiveObserve;
 var setupTestDb    = helpers.setupTestDb;
 var teardownTestDb = helpers.teardownTestDb;
 
@@ -228,9 +230,53 @@ async function testUnregisterPaths() {
   }
 }
 
+// ---- b.audit.namespaced — the drop-silent prefixed emitter every primitive
+// used to hand-roll as a private _emitAudit closure ----
+
+async function testNamespacedEmitter() {
+  var tmpDir = _tmp();
+  await setupTestDb(tmpDir);
+  try {
+    var captured = [];
+    b.audit.useStore({ record: async function (row) { captured.push(row); } });
+
+    check("b.audit.namespaced is a function", typeof b.audit.namespaced === "function");
+
+    function has(action) { return captured.some(function (r) { return r.action === action; }); }
+    function row(action) { return captured.find(function (r) { return r.action === action; }); }
+
+    // "auth" is a registered framework namespace; the emitter prefixes it.
+    // (Match by action — a setup-time boot row can land in the shadow store
+    // after useStore registers, so index 0 is not necessarily our emit.)
+    var emit = b.audit.namespaced("auth", undefined);
+    emit("login", "success", { src: "namespaced-test" });
+    await waitUntil(function () { return has("auth.login"); },
+      { timeoutMs: 5000, label: "namespaced: prefixed emit landed in chain" });
+    check("namespaced prefixes the action (auth + login → auth.login)", has("auth.login"));
+    check("namespaced carries the outcome", row("auth.login").outcome === "success");
+
+    // metadata omitted → defaults to {} (no throw, still emits).
+    emit("logout", "success");
+    await waitUntil(function () { return has("auth.logout"); },
+      { timeoutMs: 5000, label: "namespaced: default-metadata emit landed" });
+    check("namespaced defaults metadata when omitted", has("auth.logout"));
+
+    // auditFlag === false → the emitter is a no-op (nothing reaches the chain).
+    var off = b.audit.namespaced("auth", false);
+    off("blocked", "failure", { src: "should-not-emit" });
+    await passiveObserve(400, "namespaced(prefix, false): disabled emitter stays a no-op");
+    check("namespaced(prefix, false) emits nothing", !has("auth.blocked"));
+
+    b.audit.useStore(null);
+  } finally {
+    await teardownTestDb(tmpDir);
+  }
+}
+
 async function run() {
   testSurface();
   testUseStoreBadArg();
+  await testNamespacedEmitter();
   await testShadowReceivesRow();
   await testShadowSeesMonotonicCounters();
   await testShadowFailureIsDropSilent();
@@ -242,5 +288,13 @@ module.exports = { run: run };
 
 if (require.main === module) {
   run().then(function () { console.log("OK"); })
-       .catch(function (e) { console.error(e.stack || e); process.exit(1); });
+       .catch(function (e) {
+         // Log only the error class (not its message/stack): the crypto/db
+         // setup path is flagged as carrying passphrase-length-derived data,
+         // and logging error content derived from it is a clear-text-logging
+         // sink. The class name signals the failure; the non-zero exit makes
+         // it loud, and the smoke runner surfaces full detail via check().
+         console.error("FAIL: " + (e && e.name ? e.name : "error"));
+         process.exit(1);
+       });
 }

package/lib/vendor/blamejs/test/layer-0-primitives/backup-object-store-adapter.test.js

@@ -79,13 +79,13 @@ async function testObjectStoreAdapterRefusesBadClient() {
     b.backup.bundleAdapterStorage.objectStoreAdapter({});  // missing put/get/etc
   } catch (e) { refused = e; }
   check("objectStoreAdapter: missing methods refused upfront",
-    refused && /missing method/.test(refused.message || ""));
+    refused && refused.code === "backup/bad-adapter" && /must expose a \w+\(\) method/.test(refused.message || ""));
   var refused2 = null;
   try {
     b.backup.bundleAdapterStorage.objectStoreAdapter(null);
   } catch (e) { refused2 = e; }
   check("objectStoreAdapter: null client refused upfront",
-    refused2 && /client is required/.test(refused2.message || ""));
+    refused2 && refused2.code === "backup/bad-adapter" && /must be an object exposing/.test(refused2.message || ""));
 }
 
 async function testObjectStoreAdapterPagination() {

package/lib/vendor/blamejs/test/layer-0-primitives/bot-guard.test.js

@@ -99,4 +99,4 @@ async function run() {
   testOverridesAndSkips();
 }
 module.exports = { run: run };
-if (require.main === module) { run().then(function () { console.log("[bot-guard] OK — " + helpers.getChecks() + " checks passed"); }, function (e) { console.error("FAIL:", e && e.stack || e); process.exit(1); }); }
+if (require.main === module) { run().then(function () { console.log("[bot-guard] OK — " + helpers.getChecks() + " checks passed"); }, function (e) { console.error("FAIL: " + helpers.formatErr(e)); process.exit(1); }); }

package/lib/vendor/blamejs/test/layer-0-primitives/bounded-map.test.js

@@ -71,12 +71,141 @@ function testValidation() {
   check("bad policy → throws bad-policy", e && e.code === "bounded-map/bad-policy");
 }
 
+var getOrInsert = require("../../lib/bounded-map").getOrInsert;
+function _threw(fn) { try { fn(); return null; } catch (e) { return e; } }
+
+function testGetOrInsert() {
+  // get-or-insert: factory runs once, second call returns the cached value.
+  var m = new Map();
+  var calls = 0;
+  var v1 = getOrInsert(m, "a", function () { calls++; return [1]; });
+  var v2 = getOrInsert(m, "a", function () { calls++; return [2]; });
+  check("getOrInsert: returns cached value on 2nd call", v1 === v2);
+  check("getOrInsert: factory ran exactly once",         calls === 1);
+  check("getOrInsert: stored the value",                 m.get("a") === v1);
+
+  // cap path — at maxSize with an absent key, do NOT store; fire onFull.
+  var capped = new Map(); capped.set("x", 1); capped.set("y", 2);
+  var full = false;
+  var r = getOrInsert(capped, "z", function () { return 9; },
+    { maxSize: 2, onFull: function () { full = true; return "DROPPED"; } });
+  check("getOrInsert cap: absent key not stored at cap", !capped.has("z"));
+  check("getOrInsert cap: onFull fired",                 full === true);
+  check("getOrInsert cap: returns onFull result",        r === "DROPPED");
+  check("getOrInsert cap: existing key still returned",
+    getOrInsert(capped, "x", function () { return 99; }, { maxSize: 2 }) === 1);
+  // cap with no onFull → undefined.
+  check("getOrInsert cap: no onFull → undefined",
+    getOrInsert(capped, "w", function () { return 1; }, { maxSize: 2 }) === undefined);
+
+  // validation — every input checked, throws typed BoundedMapError.
+  check("getOrInsert: non-Map map throws bad-map",
+    (_threw(function () { getOrInsert({}, "k", function () { return 1; }); }) || {}).code === "bounded-map/bad-map");
+  check("getOrInsert: non-function factory throws bad-factory",
+    (_threw(function () { getOrInsert(new Map(), "k", 42); }) || {}).code === "bounded-map/bad-factory");
+  ["__NaN__", "__Infinity__", -1, 0, 1.5, "5"].forEach(function (bad) {
+    var v = bad === "__NaN__" ? NaN : (bad === "__Infinity__" ? Infinity : bad);
+    check("getOrInsert: maxSize " + String(bad) + " throws bad-max-size",
+      (_threw(function () { getOrInsert(new Map(), "k", function () { return 1; }, { maxSize: v }); }) || {}).code
+        === "bounded-map/bad-max-size");
+  });
+  check("getOrInsert: non-function onFull throws bad-on-full",
+    (_threw(function () { getOrInsert(new Map(), "k", function () { return 1; }, { maxSize: 1, onFull: 7 }); }) || {}).code
+      === "bounded-map/bad-on-full");
+}
+
+var requireAbsent  = require("../../lib/bounded-map").requireAbsent;
+var requirePresent = require("../../lib/bounded-map").requirePresent;
+
+function testRequireAbsent() {
+  // uniqueness guard: absent key → returns undefined, onConflict NOT called.
+  var m = new Map();
+  var conflicts = 0;
+  var r = requireAbsent(m, "k", function () { conflicts++; });
+  check("requireAbsent: absent → undefined",        r === undefined);
+  check("requireAbsent: absent → onConflict silent", conflicts === 0);
+  // present key → onConflict(key, existing) called, its result returned.
+  m.set("k", 42);
+  var seen = null;
+  var r2 = requireAbsent(m, "k", function (key, existing) { seen = key + "=" + existing; return "DUP"; });
+  check("requireAbsent: present → onConflict fired", seen === "k=42");
+  check("requireAbsent: present → returns onConflict result", r2 === "DUP");
+  // the canonical caller throws a typed error from onConflict.
+  check("requireAbsent: onConflict can throw",
+    (_threw(function () {
+      requireAbsent(m, "k", function () { throw new BoundedMapError("x/dup", "duplicate"); });
+    }) || {}).code === "x/dup");
+  // validation
+  check("requireAbsent: non-Map throws bad-map",
+    (_threw(function () { requireAbsent({}, "k", function () {}); }) || {}).code === "bounded-map/bad-map");
+  check("requireAbsent: non-function onConflict throws bad-on-conflict",
+    (_threw(function () { requireAbsent(new Map(), "k", 7); }) || {}).code === "bounded-map/bad-on-conflict");
+}
+
+function testRequirePresent() {
+  // existence guard: present key → returns the existing value, onMissing NOT called.
+  var m = new Map(); m.set("k", 99);
+  var missing = 0;
+  var v = requirePresent(m, "k", function () { missing++; });
+  check("requirePresent: present → returns value", v === 99);
+  check("requirePresent: present → onMissing silent", missing === 0);
+  // absent key → onMissing(key) called, its result returned.
+  var seen = null;
+  var r = requirePresent(m, "nope", function (key) { seen = key; return "MISS"; });
+  check("requirePresent: absent → onMissing fired", seen === "nope");
+  check("requirePresent: absent → returns onMissing result", r === "MISS");
+  check("requirePresent: onMissing can throw",
+    (_threw(function () {
+      requirePresent(m, "nope", function () { throw new BoundedMapError("x/nf", "not found"); });
+    }) || {}).code === "x/nf");
+  // validation
+  check("requirePresent: non-Map throws bad-map",
+    (_threw(function () { requirePresent({}, "k", function () {}); }) || {}).code === "bounded-map/bad-map");
+  check("requirePresent: non-function onMissing throws bad-on-missing",
+    (_threw(function () { requirePresent(new Map(), "k", 7); }) || {}).code === "bounded-map/bad-on-missing");
+}
+
+var requireAbsentMember = require("../../lib/bounded-map").requireAbsentMember;
+
+function testRequireAbsentMember() {
+  // Set-uniqueness guard: absent member → undefined, onConflict NOT called.
+  var s = new Set();
+  var conflicts = 0;
+  var r = requireAbsentMember(s, "k", function () { conflicts++; });
+  check("requireAbsentMember: absent → undefined",        r === undefined);
+  check("requireAbsentMember: absent → onConflict silent", conflicts === 0);
+  // present member → onConflict(key) called, its result returned.
+  s.add("k");
+  var seen = null;
+  var r2 = requireAbsentMember(s, "k", function (key) { seen = key; return "DUP"; });
+  check("requireAbsentMember: present → onConflict fired", seen === "k");
+  check("requireAbsentMember: present → returns onConflict result", r2 === "DUP");
+  // the canonical caller throws a typed duplicate/cycle error.
+  check("requireAbsentMember: onConflict can throw",
+    (_threw(function () {
+      requireAbsentMember(s, "k", function () { throw new BoundedMapError("x/dup", "duplicate"); });
+    }) || {}).code === "x/dup");
+  // works on any { has } view, including object identity in a Set.
+  var nodeA = {}, visited = new Set([nodeA]);
+  check("requireAbsentMember: object-identity membership (cycle use)",
+    requireAbsentMember(visited, nodeA, function () { return "CYCLE"; }) === "CYCLE");
+  // validation
+  check("requireAbsentMember: non-Set throws bad-set",
+    (_threw(function () { requireAbsentMember({}, "k", function () {}); }) || {}).code === "bounded-map/bad-set");
+  check("requireAbsentMember: non-function onConflict throws bad-on-conflict",
+    (_threw(function () { requireAbsentMember(new Set(), "k", 7); }) || {}).code === "bounded-map/bad-on-conflict");
+}
+
 function run() {
   testEvictOldest();
   testUpdateDoesNotGrowOrEvict();
   testRejectPolicy();
   testMapFacade();
   testValidation();
+  testGetOrInsert();
+  testRequireAbsent();
+  testRequirePresent();
+  testRequireAbsentMember();
 }
 
 module.exports = { run: run };

package/lib/vendor/blamejs/test/layer-0-primitives/chain-writer-multichain.test.js

@@ -0,0 +1,107 @@
+"use strict";
+/**
+ * b.chainWriter consumer-owned + multi-chain (chainKey) support, and
+ * b.auditChain.verifyChain / getChainTip per-partition scoping (#326).
+ *
+ * Drives the real consumer path: register an app table, build a keyed writer,
+ * append to two partitions, and verify each sub-chain independently. RED on the
+ * current tree (chainWriter.registerTable + the chainKey opt did not exist).
+ */
+
+var helpers = require("../helpers");
+var b     = helpers.b;
+var check = helpers.check;
+var setupTestDb = helpers.setupTestDb;
+var teardownTestDb = helpers.teardownTestDb;
+var fs   = require("fs");
+var os   = require("os");
+var path = require("path");
+
+var CONSUMER_SCHEMA = [{
+  name: "device_event_log",
+  columns: {
+    _id:              "TEXT PRIMARY KEY",
+    deviceId:         "TEXT NOT NULL",
+    monotonicCounter: "INTEGER NOT NULL",
+    recordedAt:       "INTEGER NOT NULL",
+    kind:             "TEXT",
+    payload:          "TEXT",
+    prevHash:         "TEXT",
+    rowHash:          "TEXT",
+    nonce:            "BLOB",
+    fencingToken:     "TEXT",
+  },
+  // A keyed chain's uniqueness is the composite (deviceId, monotonicCounter),
+  // never monotonicCounter alone (it restarts at 1 per key).
+  indexes: [{ name: "idx_dev_chain", columns: ["deviceId", "monotonicCounter"], unique: true }],
+  sealedFields: [],
+}];
+
+var COLS = ["_id", "deviceId", "monotonicCounter", "recordedAt", "kind", "payload",
+            "prevHash", "rowHash", "nonce", "fencingToken"];
+var HASHABLE = ["_id", "deviceId", "monotonicCounter", "recordedAt", "kind", "payload"];
+
+async function run() {
+  var tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-cwmc-"));
+  try {
+    await setupTestDb(tmpDir, CONSUMER_SCHEMA);
+    var queryAll = b.clusterStorage.executeAll;
+
+    // A consumer table must be registered before create() accepts it — the
+    // ALLOWED_CHAIN_TABLES allowlist is never bypassed.
+    check("create() refuses an unregistered consumer table",
+      (function () { try { b.chainWriter.create({ table: "device_event_log", columnsForInsert: COLS, hashableColumns: HASHABLE }); return false; } catch (_e) { return true; } })());
+
+    b.chainWriter.registerTable("device_event_log");
+    var w = b.chainWriter.create({
+      table: "device_event_log", chainKey: "deviceId",
+      columnsForInsert: COLS, hashableColumns: HASHABLE,
+    });
+    check("keyed writer exposes its chainKey", w.chainKey === "deviceId");
+
+    // Append to two independent partitions; counters restart per key.
+    var a1 = await w.append({ deviceId: "dev-A", kind: "boot", payload: "1" });
+    var a2 = await w.append({ deviceId: "dev-A", kind: "tick", payload: "2" });
+    var b1 = await w.append({ deviceId: "dev-B", kind: "boot", payload: "1" });
+    check("dev-A first row counter is 1", a1.monotonicCounter === 1);
+    check("dev-A second row counter is 2", a2.monotonicCounter === 2);
+    check("dev-B first row counter restarts at 1 (independent chain)", b1.monotonicCounter === 1);
+    check("dev-A row 2 links to row 1's rowHash (per-key tip)", a2.prevHash === a1.rowHash);
+    check("dev-B row 1 starts a fresh chain (ZERO_HASH prev)", b1.prevHash === b.auditChain.ZERO_HASH);
+
+    // A keyed writer fails closed on a missing partition key.
+    var threwKey = false;
+    try { await w.append({ kind: "no-device" }); } catch (e) { threwKey = /chain-writer/.test(e.code || ""); }
+    check("append refuses a row missing the chainKey", threwKey);
+
+    // verifyChain scopes per key: each sub-chain verifies clean independently.
+    var ok = await b.auditChain.verifyChain(queryAll, "device_event_log", { chainKey: "deviceId" });
+    check("verifyChain({chainKey}) reports ok across all partitions", ok.ok === true);
+    check("verifyChain counts both partitions", ok.chains === 2);
+    check("verifyChain totals every row across sub-chains", ok.rowsVerified === 3);
+
+    // getChainTip scoped to one partition returns that key's tip.
+    var tipA = await b.auditChain.getChainTip(b.clusterStorage.executeOne, "device_event_log",
+      { chainKey: "deviceId", keyValue: "dev-A" });
+    check("getChainTip({chainKey}) returns dev-A's tip (counter 2)", tipA.counter === 2 && tipA.prevHash === a2.rowHash);
+    var tipB = await b.auditChain.getChainTip(b.clusterStorage.executeOne, "device_event_log",
+      { chainKey: "deviceId", keyValue: "dev-B" });
+    check("getChainTip({chainKey}) returns dev-B's tip (counter 1)", tipB.counter === 1);
+
+    // Tamper a row in dev-A and confirm verify breaks on THAT key.
+    await b.clusterStorage.execute(
+      'UPDATE device_event_log SET payload = ? WHERE deviceId = ? AND monotonicCounter = ?',
+      ["tampered", "dev-A", 2]);
+    var bad = await b.auditChain.verifyChain(queryAll, "device_event_log", { chainKey: "deviceId" });
+    check("verifyChain detects a tampered row", bad.ok === false);
+    check("verifyChain reports the broken chainKey", bad.chainKey === "dev-A");
+
+    // maxChains fails closed when the partition fan-out exceeds the cap.
+    var capped = await b.auditChain.verifyChain(queryAll, "device_event_log", { chainKey: "deviceId", maxChains: 1 });
+    check("verifyChain fails closed past maxChains", capped.ok === false && /too many chains/.test(capped.reason));
+  } finally {
+    try { await teardownTestDb(tmpDir); } catch (_e) { /* best-effort */ }
+  }
+}
+
+module.exports = { run: run };

package/lib/vendor/blamejs/test/layer-0-primitives/cli-api-key.test.js

@@ -77,6 +77,18 @@ async function run() {
   // revoke takes the bare idHex (matches what `list` prints in the
   // first column).
 
+  // ---- issue with --expires-ms (the flag must actually set the expiry;
+  // it was a silent no-op when the CLI passed the wrong opt key) ----
+  var futureMs = 4102444800000;   // 2100-01-01T00:00:00Z, absolute unix ms
+  var ctxE = _captureCtx();
+  var cE = await cli.main(
+    ["api-key", "issue"].concat(base).concat([
+      "--owner-id", "carol", "--scopes", "users:read", "--expires-ms", String(futureMs),
+    ]), ctxE);
+  check("issue --expires-ms: returns 0", cE === 0);
+  check("issue --expires-ms: prints the expiry line (flag is not a no-op)",
+        /^expires:\s+2100-01-01T00:00:00/m.test(ctxE.out()));
+
   // ---- issue (missing --scopes) ----
   var ctx2 = _captureCtx();
   var c2 = await cli.main(