@blamejs/blamejs-shop 0.4.85 → 0.4.87

package/lib/vendor/blamejs/test/layer-0-primitives/saml-subjectconfirmation-notbefore.test.js

@@ -0,0 +1,238 @@
+"use strict";
+/**
+ * b.auth.saml.sp.verifyResponse — Bearer SubjectConfirmationData
+ * NotBefore must fail closed when present-but-unparseable.
+ *
+ * SAML 2.0 Web Browser SSO Profile §4.1.4.2: a Bearer
+ * SubjectConfirmationData MAY carry a `NotBefore` bounding the start of
+ * its validity window. When NotBefore is PRESENT, the verifier must
+ * honor it. A NotBefore that cannot be parsed (Date.parse → NaN) is an
+ * IdP error or a tampered attribute — it cannot establish that the
+ * confirmation has begun, so it must NOT be silently dropped, leaving
+ * the SCD accepted. It must fail closed (the confirmation is skipped,
+ * the verifier tries the next one, and an assertion with no other valid
+ * confirmation is refused) — mirroring the NotOnOrAfter line just above
+ * and the already-hardened Conditions block.
+ *
+ * These tests drive the shipped consumer path:
+ *   sp = b.auth.saml.sp.create({ ... }); sp.verifyResponse(b64, vopts).
+ * They mint a self-signed RSA IdP cert, build a genuinely XMLDSig-
+ * signed SAML Response (digest + SignatureValue computed through the
+ * framework's own b.xmlC14n so the verifier's recomputation matches),
+ * and vary ONLY the SubjectConfirmationData's NotBefore between the
+ * accepted and refused cases.
+ */
+
+var helpers    = require("../helpers");
+var check      = helpers.check;
+var b          = helpers.b;
+var nodeCrypto = require("node:crypto");
+var c14n       = require("../../lib/xml-c14n");
+
+var DS  = "http://www.w3.org/2000/09/xmldsig#";
+var EXC = "http://www.w3.org/2001/10/xml-exc-c14n#";
+
+var IDP_ENTITY_ID = "https://idp.example";
+var SP_ENTITY_ID  = "https://sp.example";
+var ACS_URL       = "https://sp.example/saml/acs";
+
+// Mint a self-signed RSA cert via the vendored @peculiar/x509 bundle.
+// verifyResponse parses idpCertPem with nodeCrypto.createPublicKey and
+// verifies an rsa-sha256 PKCS1 signature, so a real RSA cert + matching
+// private key is required — there is no test bypass of the signature
+// check.
+async function _mintRsaCert(cn) {
+  var pki  = require("../../lib/vendor/pki.cjs");
+  var x509 = pki.x509;
+  var keys = await nodeCrypto.webcrypto.subtle.generateKey(
+    { name: "RSASSA-PKCS1-v1_5", modulusLength: 2048,                                           // allow:raw-byte-literal — RFC 8301 §3.1 RSA bit floor
+      publicExponent: new Uint8Array([1, 0, 1]), hash: "SHA-256" },
+    true, ["sign", "verify"]);
+  var now = new Date();
+  var cert = await x509.X509CertificateGenerator.createSelfSigned({
+    serialNumber:     "01",
+    name:             "CN=" + cn,
+    notBefore:        now,
+    notAfter:         new Date(now.getTime() + 365 * 24 * 3600 * 1000),                         // allow:raw-time-literal — 1y fixture validity
+    signingAlgorithm: { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" },
+    keys:             keys,
+  });
+  var pkcs8 = await nodeCrypto.webcrypto.subtle.exportKey("pkcs8", keys.privateKey);
+  var keyPem = "-----BEGIN PRIVATE KEY-----\n" +
+    Buffer.from(pkcs8).toString("base64").match(/.{1,64}/g).join("\n") +
+    "\n-----END PRIVATE KEY-----\n";
+  return { certPem: cert.toString("pem"), keyPem: keyPem };
+}
+
+function _isoFromNow(ms) { return new Date(Date.now() + ms).toISOString(); }
+
+// Build a SAML Response with an Assertion-level enveloped XMLDSig
+// signature. The Assertion's Signature child is stripped before the
+// digest (the enveloped-signature transform), and both the digest and
+// the SignedInfo are canonicalized through b.xmlC14n so the values
+// match exactly what verifyResponse recomputes.
+function _buildSignedResponse(idp, parts) {
+  var assertionId  = "_assertion-" + parts.tag;
+  var responseId   = "_response-" + parts.tag;
+  var issueInstant = _isoFromNow(0);
+  var subjectConfirmation =
+    "<saml:SubjectConfirmation Method=\"" + parts.method + "\">" +
+    parts.scd +
+    "</saml:SubjectConfirmation>";
+
+  var assertionInner =
+    "<saml:Issuer>" + IDP_ENTITY_ID + "</saml:Issuer>" +
+    "SIGNATURE_PLACEHOLDER" +
+    "<saml:Subject>" +
+    "<saml:NameID Format=\"urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress\">" +
+    parts.nameId + "</saml:NameID>" +
+    subjectConfirmation +
+    "</saml:Subject>" +
+    (parts.conditions !== undefined ? parts.conditions :
+      "<saml:Conditions NotBefore=\"" + _isoFromNow(-5 * 60 * 1000) +                            // allow:raw-time-literal — 5m skew window
+      "\" NotOnOrAfter=\"" + _isoFromNow(5 * 60 * 1000) + "\">" +                                // allow:raw-time-literal — 5m skew window
+      "<saml:AudienceRestriction><saml:Audience>" + SP_ENTITY_ID +
+      "</saml:Audience></saml:AudienceRestriction>" +
+      "</saml:Conditions>") +
+    "<saml:AuthnStatement SessionIndex=\"_sess-1\" AuthnInstant=\"" + issueInstant + "\">" +
+    "<saml:AuthnContext><saml:AuthnContextClassRef>" +
+    "urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport" +
+    "</saml:AuthnContextClassRef></saml:AuthnContext></saml:AuthnStatement>";
+
+  var assertionOpen =
+    "<saml:Assertion xmlns:saml=\"urn:oasis:names:tc:SAML:2.0:assertion\" " +
+    "ID=\"" + assertionId + "\" Version=\"2.0\" IssueInstant=\"" + issueInstant + "\">";
+  var assertionClose = "</saml:Assertion>";
+
+  // Digest the assertion with no Signature child (enveloped-signature
+  // transform output), canonicalized through b.xmlC14n.
+  var assertionNoSig = assertionOpen +
+    assertionInner.replace("SIGNATURE_PLACEHOLDER", "") + assertionClose;
+  var digest = nodeCrypto.createHash("sha256")
+    .update(c14n.canonicalize(assertionNoSig)).digest("base64");
+
+  var signedInfo =
+    "<ds:SignedInfo xmlns:ds=\"" + DS + "\">" +
+    "<ds:CanonicalizationMethod Algorithm=\"" + EXC + "\"></ds:CanonicalizationMethod>" +
+    "<ds:SignatureMethod Algorithm=\"http://www.w3.org/2001/04/xmldsig-more#rsa-sha256\"></ds:SignatureMethod>" +
+    "<ds:Reference URI=\"#" + assertionId + "\">" +
+    "<ds:Transforms>" +
+    "<ds:Transform Algorithm=\"http://www.w3.org/2000/09/xmldsig#enveloped-signature\"></ds:Transform>" +
+    "<ds:Transform Algorithm=\"" + EXC + "\"></ds:Transform>" +
+    "</ds:Transforms>" +
+    "<ds:DigestMethod Algorithm=\"http://www.w3.org/2001/04/xmlenc#sha256\"></ds:DigestMethod>" +
+    "<ds:DigestValue>" + digest + "</ds:DigestValue>" +
+    "</ds:Reference>" +
+    "</ds:SignedInfo>";
+  var priv = nodeCrypto.createPrivateKey({ key: idp.keyPem, format: "pem" });
+  var sigValue = nodeCrypto.sign("sha256", c14n.canonicalize(signedInfo),
+    { key: priv, padding: nodeCrypto.constants.RSA_PKCS1_PADDING }).toString("base64");
+
+  var signatureXml =
+    "<ds:Signature xmlns:ds=\"" + DS + "\">" + signedInfo +
+    "<ds:SignatureValue>" + sigValue + "</ds:SignatureValue></ds:Signature>";
+  var assertionFull = assertionOpen +
+    assertionInner.replace("SIGNATURE_PLACEHOLDER", signatureXml) + assertionClose;
+
+  var response =
+    "<samlp:Response xmlns:samlp=\"urn:oasis:names:tc:SAML:2.0:protocol\" " +
+    "xmlns:saml=\"urn:oasis:names:tc:SAML:2.0:assertion\" " +
+    "ID=\"" + responseId + "\" Version=\"2.0\" IssueInstant=\"" + issueInstant + "\" " +
+    "Destination=\"" + ACS_URL + "\">" +
+    "<saml:Issuer>" + IDP_ENTITY_ID + "</saml:Issuer>" +
+    "<samlp:Status><samlp:StatusCode Value=\"urn:oasis:names:tc:SAML:2.0:status:Success\"/></samlp:Status>" +
+    assertionFull + "</samlp:Response>";
+
+  return Buffer.from(response, "utf8").toString("base64");
+}
+
+function _bearerScd(notBeforeAttr, inResponseTo) {
+  return "<saml:SubjectConfirmationData" +
+    " NotOnOrAfter=\"" + _isoFromNow(5 * 60 * 1000) + "\"" +                                      // allow:raw-time-literal — 5m future, otherwise-valid window
+    notBeforeAttr +
+    " Recipient=\"" + ACS_URL + "\"" +
+    " InResponseTo=\"" + inResponseTo + "\"/>";
+}
+
+function _newSp(idp) {
+  return b.auth.saml.sp.create({
+    entityId:                    SP_ENTITY_ID,
+    assertionConsumerServiceUrl: ACS_URL,
+    idpEntityId:                 IDP_ENTITY_ID,
+    idpSsoUrl:                   "https://idp.example/sso",
+    idpCertPem:                  idp.certPem,
+  });
+}
+
+function _verifyThrows(sp, b64, vopts) {
+  try { sp.verifyResponse(b64, vopts); return null; }
+  catch (e) { return e.code || e.message; }
+}
+
+// Case 1 — a past (already-valid) NotBefore succeeds. Proves the signer
+// + harness are correct and the fail-closed fix does not break the happy
+// path (an otherwise-acceptable confirmation that has begun).
+async function testBearerPastNotBeforeAccepted() {
+  var idp = await _mintRsaCert("idp.example");
+  var sp  = _newSp(idp);
+  var inResponseTo = "_req-past-nb";
+  var b64 = _buildSignedResponse(idp, {
+    tag:    "bearer-past-nb",
+    method: "urn:oasis:names:tc:SAML:2.0:cm:bearer",
+    nameId: "alice@example.com",
+    scd:    _bearerScd(" NotBefore=\"" + _isoFromNow(-5 * 60 * 1000) + "\"", inResponseTo),       // allow:raw-time-literal — 5m past, already valid
+  });
+  var info = sp.verifyResponse(b64, { expectedInResponseTo: inResponseTo });
+  check("Bearer with past NotBefore verifies",           info && typeof info === "object");
+  check("Bearer past NotBefore: nameId returned",        info.nameId === "alice@example.com");
+}
+
+// Case 2 — a NotBefore in the FUTURE (not yet valid) must be refused.
+// This path already fails closed on the unfixed tree (isFinite(nb) is
+// true and nb > now), so it is the harness-correctness control proving
+// the not-yet-valid axis is enforced at all.
+async function testBearerFutureNotBeforeRefused() {
+  var idp = await _mintRsaCert("idp.example");
+  var sp  = _newSp(idp);
+  var inResponseTo = "_req-future-nb";
+  var b64 = _buildSignedResponse(idp, {
+    tag:    "bearer-future-nb",
+    method: "urn:oasis:names:tc:SAML:2.0:cm:bearer",
+    nameId: "alice@example.com",
+    scd:    _bearerScd(" NotBefore=\"" + _isoFromNow(60 * 60 * 1000) + "\"", inResponseTo),       // allow:raw-time-literal — 1h future, not yet valid
+  });
+  check("Bearer with future NotBefore is refused (not yet valid)",
+    _verifyThrows(sp, b64, { expectedInResponseTo: inResponseTo }) === "auth-saml/no-valid-confirmation");
+}
+
+// Case 3 — the RED case: a Bearer SubjectConfirmationData with a
+// present-but-UNPARSEABLE NotBefore. On the unfixed tree `isFinite(nb)`
+// is false, so the `&&`-guarded not-yet-valid check is skipped and the
+// SCD is wrongly ACCEPTED. It must fail closed: an unparseable NotBefore
+// cannot establish that the confirmation has begun, so the SCD is
+// skipped and the assertion (with no other valid confirmation) refused.
+async function testBearerUnparseableNotBeforeRefused() {
+  var idp = await _mintRsaCert("idp.example");
+  var sp  = _newSp(idp);
+  var inResponseTo = "_req-bad-nb";
+  var b64 = _buildSignedResponse(idp, {
+    tag:    "bearer-bad-nb",
+    method: "urn:oasis:names:tc:SAML:2.0:cm:bearer",
+    nameId: "alice@example.com",
+    scd:    _bearerScd(" NotBefore=\"not-a-date\"", inResponseTo),
+  });
+  check("Bearer unparseable NotBefore is refused (fail-closed)",
+    _verifyThrows(sp, b64, { expectedInResponseTo: inResponseTo }) === "auth-saml/no-valid-confirmation");
+}
+
+async function run() {
+  await testBearerPastNotBeforeAccepted();
+  await testBearerFutureNotBeforeRefused();
+  await testBearerUnparseableNotBeforeRefused();
+}
+
+if (require.main === module) {
+  run().then(function () { process.exit(0); })
+       .catch(function (e) { console.error(e); process.exit(1); });
+}
+module.exports = { run: run };

package/lib/vendor/blamejs/test/layer-0-primitives/session-destroy-all-store-backed.test.js

@@ -0,0 +1,128 @@
+"use strict";
+/**
+ * b.session.destroyAllForUser must succeed for a store-backed-only consumer
+ * (b.session.useStore) that never called b.db.init() (#340).
+ *
+ * A store-backed-only deployment points session data at an isolated localDbThin
+ * file and registers the _blamejs_sessions sealed/derived-hash schema directly
+ * (so sealRow / lookupHash work) WITHOUT initializing the framework db. Every
+ * revoke-all path — logout-everywhere, suspend, delete, role change — calls
+ * destroyAllForUser, which deletes the store rows and then raises the stateless
+ * valid-from boundary via bump(). The boundary table lives in the framework db,
+ * so an uninitialized db threw db/not-initialized (a regression: worked in
+ * 0.15.11, broke when bump() was added) and 500'd the revoke even though the
+ * store rows were already deleted.
+ *
+ * RED on the pre-fix tree: destroyAllForUser throws (db/not-initialized rewrapped
+ * to MISCONFIGURED). GREEN: it resolves AND the stateless valid-from boundary is
+ * honored (routed through the configured store), so b.session.check revokes a
+ * token issued before the boundary.
+ *
+ * Drives the real consumer path through the public b.session surface — no db.init.
+ */
+
+var helpers = require("../helpers");
+var b     = helpers.b;
+var check = helpers.check;
+var setupVaultOnly    = helpers.setupVaultOnly;
+var teardownVaultOnly = helpers.teardownVaultOnly;
+var fs   = require("fs");
+var os   = require("os");
+var path = require("path");
+
+// Mirror the framework's _blamejs_sessions sealed/derived schema (db.js
+// FRAMEWORK_SCHEMA) so sealRow / lookupHash work without b.db.init().
+function _registerSessionSchema() {
+  b.cryptoField.registerTable("_blamejs_sessions", {
+    sealedFields:  ["userId", "data"],
+    derivedHashes: { userIdHash: { from: "userId" } },
+  });
+}
+
+async function run() {
+  var tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-das-"));
+  var storeFile = path.join(tmpDir, "sessions.db");
+  var store = null;
+  try {
+    // Vault only — NO b.db.init(). This is the store-backed-only deployment.
+    await setupVaultOnly(tmpDir);
+    b.cluster._resetForTest();
+    b.session._resetForTest();
+    b.cryptoField.clearForTest();
+    _registerSessionSchema();
+
+    store = b.session.stores.localDbThin({ file: storeFile, audit: false });
+    b.session.useStore(store);
+
+    var s = b.session;
+    var uid = "user-340";
+
+    // Create a real store-backed session so destroyAllForUser has a row to
+    // delete (drives sealRow + the store INSERT — the shipped consumer path).
+    var created = await s.create({ userId: uid });
+    check("create returns a sealed cookie token", typeof created.token === "string" && created.token.length > 0);
+
+    // A token issued NOW (before any revoke) is valid against the boundary.
+    var iatBefore = Date.now();
+    check("a token issued before any revoke passes session.check",
+      (await s.check(uid, iatBefore)) === true);
+    check("a fresh subject's valid-from boundary is 0", (await s.validFrom(uid)) === 0);
+
+    // The bug: destroyAllForUser deletes the store rows, then bump() routes the
+    // valid-from upsert to the framework db (uninitialized) and throws. With the
+    // fix it falls back to the configured store and resolves.
+    var revoked = null;
+    var threw = null;
+    try {
+      revoked = await s.destroyAllForUser(uid);
+    } catch (e) {
+      threw = e;
+    }
+    check("destroyAllForUser resolves for a store-backed-only consumer (no db.init)",
+      threw === null);
+    if (threw) {
+      check("  (pre-fix would throw db/not-initialized → MISCONFIGURED): " +
+        (threw.code || threw.message), false);
+    }
+    check("destroyAllForUser reports the deleted store-row count",
+      typeof revoked === "number" && revoked >= 1);
+
+    // The stateless valid-from boundary was actually raised (routed through the
+    // store), not silently dropped — a token issued before it is now revoked.
+    var boundary = await s.validFrom(uid);
+    check("the stateless valid-from boundary was raised (honored, not dropped)",
+      typeof boundary === "number" && boundary >= iatBefore);
+    check("a token issued BEFORE the revoke now fails session.check",
+      (await s.check(uid, iatBefore - 1000)) === false);
+    check("a token issued AFTER the boundary still passes session.check",
+      (await s.check(uid, boundary + 5000)) === true);
+
+    // Monotonicity still holds through the store backend.
+    var lower = await s.bump(uid, { epochMs: boundary - 5000 });
+    check("a lower-epoch bump is a monotonic no-op through the store",
+      lower === boundary);
+
+    // With NEITHER a framework db NOR a store, bump still fails closed (the
+    // boundary is never silently dropped — a real misconfiguration propagates).
+    b.session.useStore(null);
+    var threwNoStorage = null;
+    try {
+      await s.bump("user-no-storage");
+    } catch (e) { threwNoStorage = e; }
+    check("bump fails closed when neither a framework db nor a store exists",
+      threwNoStorage !== null);
+  } finally {
+    try { if (store && store.close) store.close(); } catch (_e) { /* best-effort */ }
+    b.session.useStore(null);
+    b.session._resetForTest();
+    b.cryptoField.clearForTest();
+    try { teardownVaultOnly(tmpDir); } catch (_e) { /* best-effort */ }
+    try { fs.rmSync(tmpDir, { recursive: true, force: true }); } catch (_e) { /* best-effort */ }
+  }
+}
+
+module.exports = { run: run };
+if (require.main === module) {
+  run().then(function () { console.log("OK"); })
+       .catch(function (e) { console.error(e && e.stack ? e.stack : e); process.exit(1); });
+}

package/lib/vendor/blamejs/test/layer-0-primitives/session-device-binding-ipv6-canonical-and-no-store.test.js

@@ -0,0 +1,202 @@
+"use strict";
+/**
+ * b.sessionDeviceBinding — two regressions:
+ *
+ *   (A) IPv6 prefix masking masked the client IP by textual ':'-group slicing
+ *       with no canonical normalization, so a `::`-shorthand address and its
+ *       fully-expanded equivalent (2001:db8::1 vs 2001:db8:0:0:0:0:0:1), or a
+ *       leading-zero-folded group, hashed to DIFFERENT device fingerprints.
+ *       A roaming user whose proxy reports the address in a different textual
+ *       form on the next request was logged out on a FALSE drift.
+ *
+ *   (B) #330 — create() refused to construct without a store, so the stateless,
+ *       store-free fingerprint() (the soft device-binding building block for
+ *       self-validating tokens) was unreachable through create(). The static
+ *       b.sessionDeviceBinding.fingerprint(req, opts) and a no-store instance
+ *       whose fingerprint() works (while bind/verify throw a clear "no store")
+ *       both make it reachable.
+ *
+ * Run standalone:
+ *   node test/layer-0-primitives/session-device-binding-ipv6-canonical-and-no-store.test.js
+ * Or via smoke:
+ *   node test/smoke.js
+ */
+
+var helpers = require("../helpers");
+var b       = helpers.b;
+var check   = helpers.check;
+
+function _memoryStore() {
+  var data = new Map();
+  return {
+    data: data,
+    get:  function (k) { return Promise.resolve(data.get(k)); },
+    set:  function (k, v) { data.set(k, v); return Promise.resolve(); },
+    del:  function (k) { data.delete(k); return Promise.resolve(); },
+  };
+}
+
+function _req(remoteAddress) {
+  return {
+    url: "/x",
+    method: "GET",
+    headers: {
+      "user-agent":      "Mozilla/5.0 (Macintosh; Intel)",
+      "accept-language": "en-US,en;q=0.9",
+      "accept-encoding": "gzip, br",
+    },
+    socket: { remoteAddress: remoteAddress },
+  };
+}
+
+// Two textually-different but semantically-IDENTICAL IPv6 forms of the same
+// address. A canonical masker must collapse them to one fingerprint bucket.
+var IPV6_SHORTHAND = "2001:db8::1";
+var IPV6_EXPANDED  = "2001:db8:0:0:0:0:0:1";
+// Leading-zero fold: 2001:0db8 vs 2001:db8 are the same group value.
+var IPV6_LEADING_ZEROS = "2001:0db8::1";
+
+// (A) Static fingerprint — equivalent IPv6 forms must hash identically.
+function testStaticFingerprintCanonicalIpv6() {
+  var fpShort    = b.sessionDeviceBinding.fingerprint(_req(IPV6_SHORTHAND));
+  var fpExpanded = b.sessionDeviceBinding.fingerprint(_req(IPV6_EXPANDED));
+  var fpLeading  = b.sessionDeviceBinding.fingerprint(_req(IPV6_LEADING_ZEROS));
+  check("(A) static fp: :: shorthand == fully expanded",
+    fpShort.equals(fpExpanded));
+  check("(A) static fp: :: shorthand == leading-zero form",
+    fpShort.equals(fpLeading));
+  // Sanity: a genuinely different /64 still diverges (the mask still binds).
+  var fpOther = b.sessionDeviceBinding.fingerprint(_req("2001:db9::1"));
+  check("(A) static fp: different /64 still diverges", !fpShort.equals(fpOther));
+}
+
+// (A) Real consumer path — bind() with one textual form, verify() with the
+// equivalent form, on the shipped instance API. Must NOT drift.
+async function testVerifyCanonicalIpv6AcrossForms() {
+  var binding = b.sessionDeviceBinding.create({ bindingStore: _memoryStore() });
+  var token = "tok_v6";
+  await binding.bind(token, _req(IPV6_SHORTHAND));
+
+  var verdict = await binding.verify(token, _req(IPV6_EXPANDED));
+  check("(A) verify ok: bind(::) then verify(expanded)", verdict.ok === true);
+
+  var verdict2 = await binding.verify(token, _req(IPV6_LEADING_ZEROS));
+  check("(A) verify ok: bind(::) then verify(leading-zeros)", verdict2.ok === true);
+
+  // A different /64 IPv6 still drifts (the prefix check is alive, not disabled).
+  var drift = await binding.verify(token, _req("2001:db9::1"));
+  check("(A) verify drift: bind(2001:db8::) then verify(2001:db9::)",
+    drift.ok === false && drift.reason === "drift");
+}
+
+// (A) The documented `ipPrefixBits: { v4: 0, v6: 0 }` skip-the-IP escape hatch
+// must still skip masking entirely (so a mobile client that switches networks
+// is not logged out).
+async function testIpPrefixBitsZeroSkipsIp() {
+  var binding = b.sessionDeviceBinding.create({
+    bindingStore: _memoryStore(),
+    ipPrefixBits: { v4: 0, v6: 0 },
+  });
+  var token = "tok_skip";
+  await binding.bind(token, _req("2001:db8::1"));
+  var across = await binding.verify(token, _req("2001:dead:beef::99"));
+  check("(A) ipPrefixBits 0/0: unrelated IPv6 still ok (IP skipped)",
+    across.ok === true);
+  var binding4 = b.sessionDeviceBinding.create({
+    bindingStore: _memoryStore(),
+    ipPrefixBits: { v4: 0, v6: 0 },
+  });
+  await binding4.bind("t4", _req("198.51.100.1"));
+  var across4 = await binding4.verify("t4", _req("203.0.113.200"));
+  check("(A) ipPrefixBits 0/0: unrelated IPv4 still ok (IP skipped)",
+    across4.ok === true);
+}
+
+// (B) #330 — a no-store create() returns an instance whose fingerprint() is
+// usable (pure, no store), while bind/verify/unbind throw a clear "no store
+// configured" error. No fabricated no-op store.
+async function testNoStoreInstanceFingerprintReachable() {
+  var binding = b.sessionDeviceBinding.create({});  // no store, no storeInSession
+  check("(B) no-store create() returns an object", binding && typeof binding === "object");
+
+  var fp = binding.fingerprint(_req("2001:db8::1"));
+  check("(B) no-store instance fingerprint() returns a 32-byte Buffer",
+    Buffer.isBuffer(fp) && fp.length === 32);
+
+  // It must match the static stateless digest for the same shape (one algorithm).
+  var staticFp = b.sessionDeviceBinding.fingerprint(_req("2001:db8::1"));
+  check("(B) no-store instance fingerprint() == static fingerprint()",
+    fp.equals(staticFp));
+
+  var bindThrew = false;
+  try { await binding.bind("t", _req("2001:db8::1")); }
+  catch (e) { bindThrew = e && e.code === "session-device-binding/no-store"; }
+  check("(B) no-store bind() throws no-store error", bindThrew);
+
+  var verifyThrew = false;
+  try { await binding.verify("t", _req("2001:db8::1")); }
+  catch (e) { verifyThrew = e && e.code === "session-device-binding/no-store"; }
+  check("(B) no-store verify() throws no-store error", verifyThrew);
+
+  var unbindThrew = false;
+  try { await binding.unbind("t"); }
+  catch (e) { unbindThrew = e && e.code === "session-device-binding/no-store"; }
+  check("(B) no-store unbind() throws no-store error", unbindThrew);
+}
+
+// (B) #330 — the static stateless entry point works with no create() at all.
+function testStaticFingerprintNoStore() {
+  check("(B) b.sessionDeviceBinding.fingerprint is a function",
+    typeof b.sessionDeviceBinding.fingerprint === "function");
+  var fp = b.sessionDeviceBinding.fingerprint(_req("203.0.113.7"));
+  check("(B) static fingerprint() returns a 32-byte Buffer with no store",
+    Buffer.isBuffer(fp) && fp.length === 32);
+}
+
+// Codex P2 (#362): routing the IP mask through requestHelpers.ipPrefix must
+// PRESERVE the configured prefix width, not silently force the helper's bare
+// /24 + /64 default. The device-binding IPv6 default is /48; a client roaming
+// within its /48 allocation but across a different /64 must NOT drift. (RED
+// when ipPrefix ignores the width and buckets at /64.)
+async function testConfiguredV6PrefixWidthPreserved() {
+  // Default instance (v6 = /48): same /48, DIFFERENT /64 -> same fingerprint.
+  var inst = b.sessionDeviceBinding.create({ bindingStore: _memoryStore() });
+  var fpA = inst.fingerprint(_req("2001:db8:0:1::5"));
+  var fpB = inst.fingerprint(_req("2001:db8:0:2::9"));     // same /48, different /64
+  check("(P2) default v6=/48: same /48 different /64 -> same fp (not /64)", fpA.equals(fpB));
+  var fpC = inst.fingerprint(_req("2001:db8:1::5"));        // different /48
+  check("(P2) default v6=/48: different /48 still diverges", !fpA.equals(fpC));
+
+  // Configured wider bucket (v6 = /32): same /32, different /48 -> same fp.
+  var wide = b.sessionDeviceBinding.create({ bindingStore: _memoryStore(), ipPrefixBits: { v6: 32 } });
+  var wA = wide.fingerprint(_req("2001:db8:1::1"));
+  var wB = wide.fingerprint(_req("2001:db8:99::1"));        // same /32, different /48
+  check("(P2) configured v6=/32: same /32 different /48 -> same fp (width honored)", wA.equals(wB));
+
+  // Configured tighter bucket (v6 = /64): same /48 different /64 -> DIVERGES.
+  var tight = b.sessionDeviceBinding.create({ bindingStore: _memoryStore(), ipPrefixBits: { v6: 64 } });
+  var tA = tight.fingerprint(_req("2001:db8:0:1::5"));
+  var tB = tight.fingerprint(_req("2001:db8:0:2::9"));      // same /48, different /64
+  check("(P2) configured v6=/64: same /48 different /64 -> diverges (width honored)", !tA.equals(tB));
+}
+
+async function run() {
+  testStaticFingerprintCanonicalIpv6();
+  await testVerifyCanonicalIpv6AcrossForms();
+  await testIpPrefixBitsZeroSkipsIp();
+  await testConfiguredV6PrefixWidthPreserved();
+  await testNoStoreInstanceFingerprintReachable();
+  testStaticFingerprintNoStore();
+}
+
+if (require.main === module) {
+  run().then(function () {
+    console.log("OK session-device-binding-ipv6-canonical-and-no-store — "
+      + helpers.getChecks() + " checks");
+  }).catch(function (e) {
+    console.error("FAIL:", e && e.stack || e);
+    process.exit(1);
+  });
+}
+
+module.exports = { run: run };

package/lib/vendor/blamejs/test/layer-0-primitives/session-device-binding.test.js

@@ -59,16 +59,25 @@ function testSurface() {
         typeof b.sessionDeviceBinding.SessionDeviceBindingError === "function");
 }
 
-function testCreateRejectsBadOpts() {
+async function testCreateRejectsBadOpts() {
   var threw;
 
-  threw = false;
-  try { b.sessionDeviceBinding.create(); } catch (_e) { threw = true; }
-  check("create() rejects empty opts", threw);
-
-  threw = false;
-  try { b.sessionDeviceBinding.create({}); } catch (_e) { threw = true; }
-  check("create() requires bindingStore or storeInSession", threw);
+  // #330 — a no-store create() (no opts, or {} with neither bindingStore nor
+  // storeInSession) now returns an INSTANCE whose stateless fingerprint() works
+  // (the soft device-binding building block for self-validating tokens), while
+  // the persisted bind()/verify()/unbind() lifecycle throws a clear
+  // "no store configured" — instead of refusing to construct at all.
+  var noStore = b.sessionDeviceBinding.create();
+  check("create() with no opts returns a no-store instance", noStore && typeof noStore.fingerprint === "function");
+  var noStoreFp = noStore.fingerprint(_mockReq());
+  check("no-store instance fingerprint(req) returns a digest", Buffer.isBuffer(noStoreFp) && noStoreFp.length > 0);
+  var noStore2 = b.sessionDeviceBinding.create({});
+  check("create({}) returns a no-store instance", noStore2 && typeof noStore2.fingerprint === "function");
+  // bind() is async, so the no-store guard surfaces as a rejection.
+  var bindErr = null;
+  try { await noStore2.bind("tok_x", _mockReq()); } catch (e) { bindErr = e; }
+  check("no-store bind() fails closed with session-device-binding/no-store",
+        bindErr && bindErr.code === "session-device-binding/no-store");
 
   threw = false;
   try {
@@ -242,7 +251,7 @@ function testNamespaceFingerprint() {
 async function run() {
   testSurface();
   testNamespaceFingerprint();
-  testCreateRejectsBadOpts();
+  await testCreateRejectsBadOpts();
   await testBindAndVerifyHappyPath();
   await testVerifyDriftRefuses();
   await testVerifyMissingBindRefuses();