@blamejs/blamejs-shop 0.5.12 → 0.5.13

package/lib/vendor/blamejs/test/layer-0-primitives/api-encrypt.test.js

@@ -1505,6 +1505,868 @@ async function testApiEncryptEnvelopeMetadataAadBound() {
   check("aad: genuine response still decrypts after refused forgery", plain.ok === 1);
 }
 
+// ---- error / adversarial / option-default branch coverage ----
+
+// A per-request bodyReq carrying a preset, already-parsed body.
+function _encReq(headers, body) {
+  var req = _bodyReq("POST", headers || { "content-type": "application/json" }, "");
+  req.body = body;
+  return req;
+}
+
+// A session store whose get() re-shapes the stored sessionKey through
+// `transform` — models an operator store that JSON/base64-serialised the
+// key (or a corrupt one). set() keeps a shallow copy so the bootstrap
+// write persists a real Buffer; the reshape only bites on the subsequent
+// get(), exercising the middleware's key-coercion branches.
+function _coercingSessionStore(transform) {
+  var rows = new Map();
+  return {
+    get: async function (sid) {
+      var row = rows.get(sid);
+      if (!row) return null;
+      var copy = Object.assign({}, row);
+      copy.sessionKey = transform(row.sessionKey);
+      return copy;
+    },
+    set: async function (sid, row) { rows.set(sid, Object.assign({}, row)); },
+    delete: async function (sid) { rows.delete(sid); },
+  };
+}
+
+async function testApiEncryptKeypairNonObjectAndMissingFields() {
+  // _validateKeypair's non-object guard (a keypairs entry that isn't an
+  // object at all) and the publicKey/privateKey-missing guard — distinct
+  // from the ecPublicKey guard the existing suite already trips.
+  var threw = null;
+  try { b.middleware.apiEncrypt({ keypairs: [null] }); } catch (e) { threw = e; }
+  check("keypairs entry that is null rejected", threw && threw.code === "INVALID_KEYPAIR");
+  threw = null;
+  try { b.middleware.apiEncrypt({ keypair: "not-an-object" }); } catch (e) { threw = e; }
+  check("keypair that is a string rejected", threw && threw.code === "INVALID_KEYPAIR");
+  threw = null;
+  try { b.middleware.apiEncrypt({ keypair: {} }); } catch (e) { threw = e; }
+  check("keypair missing publicKey/privateKey rejected",
+        threw && threw.code === "INVALID_KEYPAIR" && /publicKey \+ \.privateKey/.test(threw.message));
+  // create() with no args at all — the `opts || {}` default plus the
+  // no-keypair-provided throw.
+  threw = null;
+  try { b.middleware.apiEncrypt(); } catch (e) { threw = e; }
+  check("apiEncrypt() with no args rejected (missing keypair)",
+        threw && threw.code === "INVALID_KEYPAIR");
+  // client()/httpClient() with no args — the `opts || {}` default plus
+  // the missing-pubkey throw.
+  threw = null;
+  try { b.middleware.apiEncrypt.client(); } catch (e) { threw = e; }
+  check("apiEncrypt.client() with no args rejected", threw && threw.code === "CLIENT_INVALID_PUBKEY");
+  threw = null;
+  try { b.httpClient.encrypted(); } catch (e) { threw = e; }
+  check("httpClient.encrypted() with no args rejected", threw && threw.code === "CLIENT_INVALID_PUBKEY");
+}
+
+async function testApiEncryptCreateOptionDefaultsTaken() {
+  // The numeric-value branches of the maxDecryptedBytes / pruneIntervalMs
+  // ternaries (operator overrides the framework default) plus a custom
+  // keying value that builds cleanly.
+  var keypair = _serverKeypair();
+  var mw = b.middleware.apiEncrypt({
+    keypair:           keypair,
+    audit:             false,
+    maxDecryptedBytes: b.constants.BYTES.mib(8),
+    pruneIntervalMs:   b.constants.TIME.seconds(45),
+  });
+  check("create() accepts numeric maxDecryptedBytes + pruneIntervalMs override",
+        typeof mw === "function");
+  mw.close();
+}
+
+async function testApiEncryptContentTypeHeaderVariants() {
+  var keypair = _serverKeypair();
+  var mw = b.middleware.apiEncrypt({ keypair: keypair, audit: false });
+
+  // A request with NO Content-Type header at all — the content-type
+  // filter cannot match, so the middleware treats it as a public route
+  // and passes it straight through.
+  var reqNoCt = _bodyReq("POST", {}, "");
+  reqNoCt.body = { plain: true };
+  var resNoCt = _mkRes();
+  var passedNoCt = false;
+  await mw(reqNoCt, resNoCt, function () { passedNoCt = true; });
+  check("missing Content-Type header bypasses middleware", passedNoCt === true);
+  check("missing Content-Type: body untouched", reqNoCt.body.plain === true);
+
+  // A request whose header key is capitalised "Content-Type" (not the
+  // lowercased form) still matches — the middleware reads both cases.
+  var clientCtx = b.middleware.apiEncrypt.client({ pubkey: keypair });
+  var call = clientCtx.encryptRequest({ cased: "header" });
+  var reqCap = _bodyReq("POST", { "Content-Type": "application/json" }, "");
+  reqCap.body = call.body;
+  var resCap = _mkRes();
+  var finCap = _newFinish(resCap);
+  var casedRan = false;
+  await mw(reqCap, resCap, function () {
+    casedRan = true;
+    check("capitalised Content-Type: body decrypted", reqCap.body.cased === "header");
+    resCap.json({ ok: true });
+  });
+  await finCap;
+  check("capitalised Content-Type header matched the filter", casedRan === true);
+  mw.close();
+}
+
+async function testApiEncryptBodyShapeGuards() {
+  var keypair = _serverKeypair();
+  var mw = b.middleware.apiEncrypt({ keypair: keypair, audit: false });
+
+  // req.body is null on a JSON request — the object-shape guard refuses
+  // it before any crypto with the "required" (not "rejected") body.
+  var reqNull = _encReq(null, null);
+  var resNull = _mkRes();
+  var finNull = _newFinish(resNull);
+  await mw(reqNull, resNull, function () { check("null body must not reach next", false); });
+  await finNull;
+  check("null body: 400 encrypted-payload-required",
+        resNull._endedStatus === 400 && /encrypted-payload-required/.test(resNull._captured));
+
+  // req.body is a bare string (not an object) — same guard.
+  var reqStr = _encReq(null, "raw-string-body");
+  var resStr = _mkRes();
+  var finStr = _newFinish(resStr);
+  await mw(reqStr, resStr, function () { check("string body must not reach next", false); });
+  await finStr;
+  check("string body: 400 encrypted-payload-required",
+        resStr._endedStatus === 400 && /encrypted-payload-required/.test(resStr._captured));
+
+  // _writeRejection's defensive guards: a res with headersSent already
+  // true, and a res with no writeHead, both short-circuit without writing
+  // (no throw, next never called). Not awaited on finish — these res
+  // objects never emit it by design.
+  var nextRan = false;
+  var reqA = _encReq(null, null);
+  await mw(reqA, { headersSent: true, writeHead: function () {}, end: function () {} },
+          function () { nextRan = true; });
+  check("_writeRejection: headersSent short-circuits, next not called", nextRan === false);
+  nextRan = false;
+  var reqB = _encReq(null, null);
+  await mw(reqB, { headersSent: false }, function () { nextRan = true; });
+  check("_writeRejection: missing writeHead short-circuits, next not called", nextRan === false);
+
+  // A rejected request that carries neither pathname nor url — the
+  // failure-metadata path falls back to "/" for the audited path.
+  var reqNoUrl = _encReq(null, null);
+  delete reqNoUrl.url;
+  var resNoUrl = _mkRes();
+  var finNoUrl = _newFinish(resNoUrl);
+  await mw(reqNoUrl, resNoUrl, function () { check("no-url null body must not reach next", false); });
+  await finNoUrl;
+  check("no-url null body: 400 encrypted-payload-required",
+        resNoUrl._endedStatus === 400 && /encrypted-payload-required/.test(resNoUrl._captured));
+  mw.close();
+}
+
+async function testApiEncryptPerRequestNoEkFallsThroughToShapeReject() {
+  // A body with a valid _ct/_ts but NO _ek/_nonce in per-request mode
+  // falls to the terminal shape-rejection else-branch (neither a
+  // bootstrap nor a per-session subsequent request).
+  var keypair = _serverKeypair();
+  var mw = b.middleware.apiEncrypt({ keypair: keypair, audit: false });
+  var req = _encReq(null, {
+    _ct: Buffer.from("no-ek-here").toString("base64"),
+    _ts: Date.now(),
+  });
+  var res = _mkRes();
+  var fin = _newFinish(res);
+  await mw(req, res, function () { check("no-_ek body must not reach next", false); });
+  await fin;
+  check("no-_ek per-request body: 400 encrypted-payload-required",
+        res._endedStatus === 400 && /encrypted-payload-required/.test(res._captured));
+  mw.close();
+}
+
+async function testApiEncryptNonceStoreErrorOnBootstrap() {
+  // The bootstrap nonce claim throwing (store outage) surfaces a 500
+  // nonce-store-unavailable, distinct from the 400 replay refusal.
+  var keypair = _serverKeypair();
+  var errStore = {
+    checkAndInsert: function () { return Promise.reject(new Error("nonce backend down")); },
+    purgeExpired:   function () { return Promise.resolve(0); },
+    close:          function () {},
+  };
+  var mw = b.middleware.apiEncrypt({ keypair: keypair, audit: false, nonceStore: errStore });
+  var clientCtx = b.middleware.apiEncrypt.client({ pubkey: keypair });
+  var call = clientCtx.encryptRequest({ x: 1 });
+  var req = _encReq(null, call.body);
+  var res = _mkRes();
+  var fin = _newFinish(res);
+  await mw(req, res, function () { check("nonce-store outage must not reach next", false); });
+  await fin;
+  check("nonce-store outage: 500", res._endedStatus === 500);
+  check("nonce-store outage: nonce-store-unavailable body",
+        /nonce-store-unavailable/.test(res._captured));
+  mw.close();
+}
+
+async function testApiEncryptPruneFailureIsSwallowed() {
+  // A successful request triggers _maybePrune (lastPruneAt starts at 0);
+  // a rejecting purgeExpired must be caught and logged, never crash the
+  // request that already succeeded.
+  var keypair = _serverKeypair();
+  var pruneCalls = 0;
+  var flakyStore = {
+    checkAndInsert: function () { return Promise.resolve(true); },
+    purgeExpired:   function () { pruneCalls++; return Promise.reject(new Error("prune backend down")); },
+    close:          function () {},
+  };
+  var mw = b.middleware.apiEncrypt({ keypair: keypair, audit: false, nonceStore: flakyStore });
+  var clientCtx = b.middleware.apiEncrypt.client({ pubkey: keypair });
+  var call = clientCtx.encryptRequest({ x: 1 });
+  var req = _encReq(null, call.body);
+  var res = _mkRes();
+  var fin = _newFinish(res);
+  var reached = false;
+  await mw(req, res, function () { reached = true; res.json({ ok: true }); });
+  await fin;
+  // Let the rejected purgeExpired().catch microtask settle.
+  await helpers.waitUntil(function () { return pruneCalls >= 1; },
+    { timeoutMs: 5000, label: "prune-failure: purgeExpired invoked" });
+  check("prune failure: request still succeeded (200)", reached && res._endedStatus === 200);
+  check("prune failure: purgeExpired was attempted", pruneCalls === 1);
+  mw.close();
+}
+
+async function testApiEncryptResponseEncodeFallbackAndFailure() {
+  var keypair = _serverKeypair();
+  var mw = b.middleware.apiEncrypt({ keypair: keypair, audit: false });
+  var clientCtx = b.middleware.apiEncrypt.client({ pubkey: keypair });
+
+  // Fallback: a res that never had res.json installed. The wrapped
+  // res.json falls back to writeHead + end directly, still emitting the
+  // encrypted envelope.
+  var call1 = clientCtx.encryptRequest({ x: 1 });
+  var rawRes = helpers._bodyRes();                 // NO .json method
+  var req1 = _encReq(null, call1.body);
+  var fin1 = _newFinish(rawRes);
+  await mw(req1, rawRes, function () { rawRes.json({ fell: "back" }); });
+  await fin1;
+  check("res.json fallback: 200 written directly", rawRes._endedStatus === 200);
+  var env = JSON.parse(rawRes._captured);
+  check("res.json fallback: emitted an encrypted envelope", typeof env._ct === "string");
+  var plain1 = call1.decryptResponse(env);
+  check("res.json fallback: envelope decrypts", plain1.fell === "back");
+
+  // Failure: encrypting an un-serialisable (circular) response body throws
+  // inside the wrap; the middleware writes a 500 response-encryption-failed
+  // rather than hanging the request.
+  var call2 = clientCtx.encryptRequest({ x: 2 });
+  var req2 = _encReq(null, call2.body);
+  var res2 = _mkRes();
+  var fin2 = _newFinish(res2);
+  await mw(req2, res2, function () {
+    var circular = {};
+    circular.self = circular;
+    res2.json(circular);
+  });
+  await fin2;
+  check("res.json encrypt failure: 500", res2._endedStatus === 500);
+  check("res.json encrypt failure: response-encryption-failed body",
+        /response-encryption-failed/.test(res2._captured));
+  mw.close();
+}
+
+async function testApiEncryptPerSessionBootstrapInvalidSidAndCtr() {
+  var keypair = _serverKeypair();
+  var mw = b.middleware.apiEncrypt({ keypair: keypair, audit: false, keying: "per-session" });
+
+  // Bootstrap envelope (valid _ek/_nonce) but a malformed _sid — refused
+  // after the KEM decrypt, before any session row is written.
+  var c1 = b.middleware.apiEncrypt.client({ pubkey: keypair, keying: "per-session" });
+  var boot1 = c1.encryptRequest({ n: 1 });
+  boot1.body._sid = "not-a-uuid";
+  var req1 = _encReq(null, boot1.body);
+  var res1 = _mkRes();
+  var fin1 = _newFinish(res1);
+  await mw(req1, res1, function () { check("bad-sid bootstrap must not reach next", false); });
+  await fin1;
+  check("per-session bootstrap bad _sid: 400 required",
+        res1._endedStatus === 400 && /encrypted-payload-required/.test(res1._captured));
+
+  // Bootstrap with a valid _sid but a negative _ctr — refused at the
+  // non-negative-int guard.
+  var c2 = b.middleware.apiEncrypt.client({ pubkey: keypair, keying: "per-session" });
+  var boot2 = c2.encryptRequest({ n: 2 });
+  boot2.body._ctr = -1;
+  var req2 = _encReq(null, boot2.body);
+  var res2 = _mkRes();
+  var fin2 = _newFinish(res2);
+  await mw(req2, res2, function () { check("bad-ctr bootstrap must not reach next", false); });
+  await fin2;
+  check("per-session bootstrap negative _ctr: 400 required",
+        res2._endedStatus === 400 && /encrypted-payload-required/.test(res2._captured));
+  mw.close();
+}
+
+async function testApiEncryptPerSessionBootstrapStoreSetError() {
+  // The session-row write failing during bootstrap surfaces a 500
+  // session-store-unavailable (distinct from the nonce path).
+  var keypair = _serverKeypair();
+  var failStore = {
+    get:    async function () { return null; },
+    set:    async function () { throw new Error("session backend write rejected"); },
+    delete: async function () {},
+  };
+  var mw = b.middleware.apiEncrypt({
+    keypair: keypair, audit: false, keying: "per-session", sessionStore: failStore,
+  });
+  var clientCtx = b.middleware.apiEncrypt.client({ pubkey: keypair, keying: "per-session" });
+  var boot = clientCtx.encryptRequest({ n: 1 });
+  var req = _encReq(null, boot.body);
+  var res = _mkRes();
+  var fin = _newFinish(res);
+  await mw(req, res, function () { check("session write failure must not reach next", false); });
+  await fin;
+  check("per-session bootstrap set() failure: 500", res._endedStatus === 500);
+  check("per-session bootstrap set() failure: session-store-unavailable",
+        /session-store-unavailable/.test(res._captured));
+  mw.close();
+}
+
+async function testApiEncryptPerSessionSubsequentInvalidSidAndCtr() {
+  var keypair = _serverKeypair();
+  var mw = b.middleware.apiEncrypt({ keypair: keypair, audit: false, keying: "per-session" });
+
+  // Subsequent-shape request (no _ek/_nonce) with a string _sid that is
+  // not a valid UUID.
+  var reqBadSid = _encReq(null, {
+    _ct: Buffer.from("x").toString("base64"),
+    _ts: Date.now(),
+    _sid: "totally-bogus-sid",
+    _ctr: 5,
+  });
+  var resBadSid = _mkRes();
+  var finBadSid = _newFinish(resBadSid);
+  await mw(reqBadSid, resBadSid, function () { check("bad-sid subsequent must not reach next", false); });
+  await finBadSid;
+  check("per-session subsequent bad _sid: 400 required",
+        resBadSid._endedStatus === 400 && /encrypted-payload-required/.test(resBadSid._captured));
+
+  // Subsequent-shape request with a valid UUID _sid but a negative _ctr
+  // (a number, so it enters the subsequent branch, then fails the guard).
+  var reqBadCtr = _encReq(null, {
+    _ct: Buffer.from("x").toString("base64"),
+    _ts: Date.now(),
+    _sid: "12345678-1234-4234-8234-123456789012",
+    _ctr: -3,
+  });
+  var resBadCtr = _mkRes();
+  var finBadCtr = _newFinish(resBadCtr);
+  await mw(reqBadCtr, resBadCtr, function () { check("bad-ctr subsequent must not reach next", false); });
+  await finBadCtr;
+  check("per-session subsequent negative _ctr: 400 required",
+        resBadCtr._endedStatus === 400 && /encrypted-payload-required/.test(resBadCtr._captured));
+  mw.close();
+}
+
+async function testApiEncryptPerSessionSubsequentGetError() {
+  // A store whose get() throws on the subsequent request surfaces a 500
+  // session-store-unavailable. Bootstrap uses set() (which succeeds), so
+  // only the follow-up read trips the outage.
+  var keypair = _serverKeypair();
+  var rows = new Map();
+  var getThrows = false;
+  var partialStore = {
+    get: async function (sid) { if (getThrows) throw new Error("session read outage"); return rows.get(sid) || null; },
+    set: async function (sid, row) { rows.set(sid, row); },
+    delete: async function (sid) { rows.delete(sid); },
+  };
+  var mw = b.middleware.apiEncrypt({
+    keypair: keypair, audit: false, keying: "per-session", sessionStore: partialStore,
+  });
+  var clientCtx = b.middleware.apiEncrypt.client({ pubkey: keypair, keying: "per-session" });
+
+  var boot = clientCtx.encryptRequest({ n: 1 });
+  var req1 = _encReq(null, boot.body);
+  var res1 = _mkRes();
+  var fin1 = _newFinish(res1);
+  await mw(req1, res1, function () { res1.json({ ok: 1 }); });
+  await fin1;
+  check("get-outage: bootstrap 200", res1._endedStatus === 200);
+
+  getThrows = true;
+  var second = clientCtx.encryptRequest({ n: 2 });
+  var req2 = _encReq(null, second.body);
+  var res2 = _mkRes();
+  var fin2 = _newFinish(res2);
+  await mw(req2, res2, function () { check("get outage must not reach next", false); });
+  await fin2;
+  check("per-session subsequent get() outage: 500", res2._endedStatus === 500);
+  check("per-session subsequent get() outage: session-store-unavailable",
+        /session-store-unavailable/.test(res2._captured));
+  mw.close();
+}
+
+async function testApiEncryptPerSessionKeyCoercionVariants() {
+  var keypair = _serverKeypair();
+
+  // Variant A: store hands back the session key as a base64 STRING.
+  await _runCoercionVariant(keypair,
+    function (k) { return Buffer.isBuffer(k) ? k.toString("base64") : k; },
+    200, "base64-string session key coerced back to Buffer");
+
+  // Variant B: store hands back a plain Uint8Array (not a Buffer).
+  await _runCoercionVariant(keypair,
+    function (k) { return Buffer.isBuffer(k) ? Uint8Array.from(k) : k; },
+    200, "Uint8Array session key coerced back to Buffer");
+
+  // Variant C: store hands back a garbage value (a number) — the key
+  // fails the 32-byte Buffer validity gate → 500 session-store-unavailable.
+  await _runCoercionVariant(keypair,
+    function () { return 42; },
+    500, "un-coercible session key rejected");
+}
+
+async function _runCoercionVariant(keypair, transform, expectedStatus, label) {
+  var store = _coercingSessionStore(transform);
+  var mw = b.middleware.apiEncrypt({
+    keypair: keypair, audit: false, keying: "per-session", sessionStore: store,
+  });
+  var clientCtx = b.middleware.apiEncrypt.client({ pubkey: keypair, keying: "per-session" });
+
+  var boot = clientCtx.encryptRequest({ n: 1 });
+  var req1 = _encReq(null, boot.body);
+  var res1 = _mkRes();
+  var fin1 = _newFinish(res1);
+  await mw(req1, res1, function () { res1.json({ ok: 1 }); });
+  await fin1;
+  check("coercion(" + label + "): bootstrap 200", res1._endedStatus === 200);
+
+  var second = clientCtx.encryptRequest({ n: 2 });
+  var req2 = _encReq(null, second.body);
+  var res2 = _mkRes();
+  var fin2 = _newFinish(res2);
+  var reached = false;
+  await mw(req2, res2, function () { reached = true; res2.json({ ok: 2 }); });
+  await fin2;
+  check("coercion(" + label + "): subsequent status " + expectedStatus,
+        res2._endedStatus === expectedStatus);
+  if (expectedStatus === 200) {
+    check("coercion(" + label + "): reached handler + decrypts",
+          reached && second.decryptResponse(JSON.parse(res2._captured)).ok === 2);
+  } else {
+    check("coercion(" + label + "): did not reach handler", reached === false);
+    check("coercion(" + label + "): session-store-unavailable",
+          /session-store-unavailable/.test(res2._captured));
+  }
+  mw.close();
+}
+
+async function testApiEncryptPerSessionExpiredRowEncryptedRejection() {
+  // With a store that does NOT self-evict past-TTL rows (a real cluster
+  // store returns the row and lets the server decide), the middleware
+  // resolves the session, keys the channel, THEN refuses on expiry — so
+  // the rejection rides the session envelope (encrypted), not cleartext.
+  var keypair = _serverKeypair();
+  var store = _clusterStyleSessionStore();
+  var mw = b.middleware.apiEncrypt({
+    keypair: keypair, audit: false, keying: "per-session",
+    sessionStore: store, sessionTtlMs: 1,
+  });
+  var clientCtx = b.middleware.apiEncrypt.client({ pubkey: keypair, keying: "per-session" });
+
+  var boot = clientCtx.encryptRequest({ n: 1 });
+  var req1 = _encReq(null, boot.body);
+  var res1 = _mkRes();
+  var fin1 = _newFinish(res1);
+  await mw(req1, res1, function () { res1.json({ ok: 1 }); });
+  await fin1;
+  check("expired-row: bootstrap 200", res1._endedStatus === 200);
+
+  await helpers.passiveObserve(20, "apiEncrypt: cluster-style row past sessionTtlMs=1");
+
+  var second = clientCtx.encryptRequest({ n: 2 });
+  var req2 = _encReq(null, second.body);
+  var res2 = _mkRes();
+  var fin2 = _newFinish(res2);
+  await mw(req2, res2, function () { check("expired session must not reach next", false); });
+  await fin2;
+  check("expired-row: 401", res2._endedStatus === 401);
+  check("expired-row: rejection is an encrypted envelope (reason not leaked cleartext)",
+        _isEncryptedEnvelope(res2._captured));
+  mw.close();
+}
+
+// A cluster-shaped store (returns rows regardless of TTL) whose delete()
+// always throws — models a store whose eviction write fails. The
+// middleware's expiry / rotation evictions are best-effort, so a throwing
+// delete must not change the refusal outcome.
+function _deleteThrowingSessionStore() {
+  var rows = Object.create(null);
+  return {
+    get: async function (sid) {
+      await Promise.resolve();
+      var raw = rows[sid];
+      return raw === undefined ? null : JSON.parse(raw);
+    },
+    set: async function (sid, row) { await Promise.resolve(); rows[sid] = JSON.stringify(row); },
+    delete: async function () { await Promise.resolve(); throw new Error("delete backend down"); },
+  };
+}
+
+async function testApiEncryptPerSessionEvictionDeleteBestEffort() {
+  var keypair = _serverKeypair();
+
+  // Expiry: the past-TTL row's best-effort delete throws; the request is
+  // still refused 401 (encrypted envelope), the throw swallowed.
+  var expStore = _deleteThrowingSessionStore();
+  var mwExp = b.middleware.apiEncrypt({
+    keypair: keypair, audit: false, keying: "per-session",
+    sessionStore: expStore, sessionTtlMs: 1,
+  });
+  var cExp = b.middleware.apiEncrypt.client({ pubkey: keypair, keying: "per-session" });
+  var bootE = cExp.encryptRequest({ n: 1 });
+  var reqE1 = _encReq(null, bootE.body);
+  var resE1 = _mkRes();
+  var finE1 = _newFinish(resE1);
+  await mwExp(reqE1, resE1, function () { resE1.json({ ok: 1 }); });
+  await finE1;
+  await helpers.passiveObserve(20, "apiEncrypt: delete-throwing store row past sessionTtlMs=1");
+  var secondE = cExp.encryptRequest({ n: 2 });
+  var reqE2 = _encReq(null, secondE.body);
+  var resE2 = _mkRes();
+  var finE2 = _newFinish(resE2);
+  await mwExp(reqE2, resE2, function () { check("expiry w/ failing delete must not reach next", false); });
+  await finE2;
+  check("eviction-delete: expiry still 401 despite failing delete",
+        resE2._endedStatus === 401 && _isEncryptedEnvelope(resE2._captured));
+  mwExp.close();
+
+  // Rotation: the max-responses eviction's best-effort delete throws; the
+  // request is still refused 401 rotation-required (encrypted envelope).
+  var rotStore = _deleteThrowingSessionStore();
+  var mwRot = b.middleware.apiEncrypt({
+    keypair: keypair, audit: false, keying: "per-session",
+    sessionStore: rotStore, sessionMaxResponses: 1,
+  });
+  var cRot = b.middleware.apiEncrypt.client({ pubkey: keypair, keying: "per-session" });
+  var bootR = cRot.encryptRequest({ n: 1 });
+  var reqR1 = _encReq(null, bootR.body);
+  var resR1 = _mkRes();
+  var finR1 = _newFinish(resR1);
+  await mwRot(reqR1, resR1, function () { resR1.json({ ok: 1 }); });
+  await finR1;
+  var secondR = cRot.encryptRequest({ n: 2 });
+  var reqR2 = _encReq(null, secondR.body);
+  var resR2 = _mkRes();
+  var finR2 = _newFinish(resR2);
+  await mwRot(reqR2, resR2, function () { check("rotation w/ failing delete must not reach next", false); });
+  await finR2;
+  check("eviction-delete: rotation still 401 despite failing delete",
+        resR2._endedStatus === 401 && _isEncryptedEnvelope(resR2._captured));
+  mwRot.close();
+}
+
+async function testApiEncryptPerSessionCtrClaimStoreError() {
+  // The atomic (sid, ctr) claim throwing on the subsequent request
+  // surfaces a 500 nonce-store-unavailable — the claim uses the same
+  // nonceStore as the bootstrap, so only the "ctr:" key path fails here.
+  var keypair = _serverKeypair();
+  var inner = b.nonceStore.create({ backend: "memory" });
+  var claimStore = {
+    checkAndInsert: function (key, expireAt) {
+      if (/^ctr:/.test(key)) return Promise.reject(new Error("claim backend down"));
+      return inner.checkAndInsert(key, expireAt);
+    },
+    purgeExpired: function () { return inner.purgeExpired(); },
+    close:        function () { return inner.close(); },
+  };
+  var mw = b.middleware.apiEncrypt({
+    keypair: keypair, audit: false, keying: "per-session", nonceStore: claimStore,
+  });
+  var clientCtx = b.middleware.apiEncrypt.client({ pubkey: keypair, keying: "per-session" });
+
+  var boot = clientCtx.encryptRequest({ n: 1 });
+  var req1 = _encReq(null, boot.body);
+  var res1 = _mkRes();
+  var fin1 = _newFinish(res1);
+  await mw(req1, res1, function () { res1.json({ ok: 1 }); });
+  await fin1;
+  check("ctr-claim-outage: bootstrap 200", res1._endedStatus === 200);
+
+  var second = clientCtx.encryptRequest({ n: 2 });
+  var req2 = _encReq(null, second.body);
+  var res2 = _mkRes();
+  var fin2 = _newFinish(res2);
+  await mw(req2, res2, function () { check("ctr-claim outage must not reach next", false); });
+  await fin2;
+  check("ctr-claim-outage: 500", res2._endedStatus === 500);
+  // The claim gate fires AFTER the session channel is keyed, so the
+  // rejection rides the session envelope (encrypted) — the store-outage
+  // reason never travels in cleartext. Decrypting it recovers the reason.
+  check("ctr-claim-outage: rejection is an encrypted envelope", _isEncryptedEnvelope(res2._captured));
+  var decoded = second.decryptResponse(JSON.parse(res2._captured));
+  check("ctr-claim-outage: decrypted reason is nonce-store-unavailable",
+        decoded && decoded.error === "nonce-store-unavailable");
+  mw.close();
+}
+
+async function testApiEncryptSessionCreatedAuditEmitted() {
+  // Per-session bootstrap with audit ON drives the session.created event
+  // through _emitSessionAudit's safeEmit path (the branch the audit:false
+  // suite skips). The audit is drop-silent best-effort, so the observable
+  // contract is that emitting it never disturbs the request: the bootstrap
+  // still returns 200 and the response still decrypts.
+  var tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-ae-"));
+  try {
+    await setupTestDb(tmpDir);
+    var keypair = _serverKeypair();
+    var mw = b.middleware.apiEncrypt({ keypair: keypair, keying: "per-session" });  // audit defaults ON
+    var clientCtx = b.middleware.apiEncrypt.client({ pubkey: keypair, keying: "per-session" });
+    var boot = clientCtx.encryptRequest({ n: 1 });
+    var req = _encReq(null, boot.body);
+    var res = _mkRes();
+    var fin = _newFinish(res);
+    await mw(req, res, function () { res.json({ ok: 1 }); });
+    await fin;
+    check("session-audit: audited bootstrap still returns 200", res._endedStatus === 200);
+    var plain = boot.decryptResponse(JSON.parse(res._captured));
+    check("session-audit: audited bootstrap response still decrypts", plain.ok === 1);
+    await b.audit.flush();
+    mw.close();
+  } finally {
+    await teardownTestDb(tmpDir);
+  }
+}
+
+async function testApiEncryptPublishPublicKeyNoJsonRes() {
+  // publishPublicKey's raw-write fallback when the res has no res.json.
+  var keypair = _serverKeypair();
+  var mw = b.middleware.apiEncrypt({ keypair: keypair, audit: false });
+  var handler = mw.publishPublicKey();
+  var res = helpers._bodyRes();                    // NO .json method
+  handler(_bodyReq("GET", {}, ""), res);
+  var body = JSON.parse(res._captured);
+  check("publishPublicKey no-json res: wrote 200", res._endedStatus === 200);
+  check("publishPublicKey no-json res: publicKey present", body.publicKey === keypair.publicKey);
+  mw.close();
+}
+
+async function testApiEncryptClientRejectsBadKeying() {
+  var keypair = _serverKeypair();
+  var threw = null;
+  try { b.middleware.apiEncrypt.client({ pubkey: keypair, keying: "hourly" }); }
+  catch (e) { threw = e; }
+  check("client rejects bogus keying value", threw && threw.code === "CLIENT_BAD_OPT");
+}
+
+async function testApiEncryptClientResponseShapeSidCtrGuards() {
+  var keypair = _serverKeypair();
+  var clientCtx = b.middleware.apiEncrypt.client({ pubkey: keypair, keying: "per-session" });
+  // Open a session so perSessionSid is populated.
+  var boot = clientCtx.encryptRequest({ n: 1 });
+  var sid = boot.body._sid;
+
+  var threw = null;
+  try { boot.decryptResponse({ _sid: sid, _ctr: 1 }); } catch (e) { threw = e; }  // no _ct
+  check("client per-session response missing _ct: CLIENT_RESPONSE_SHAPE",
+        threw && threw.code === "CLIENT_RESPONSE_SHAPE");
+
+  threw = null;
+  try {
+    boot.decryptResponse({ _ct: Buffer.from("x").toString("base64"),
+                           _sid: "00000000-0000-4000-8000-000000000000", _ctr: 1 });
+  } catch (e) { threw = e; }
+  check("client per-session response wrong _sid: CLIENT_RESPONSE_SID",
+        threw && threw.code === "CLIENT_RESPONSE_SID");
+
+  threw = null;
+  try {
+    boot.decryptResponse({ _ct: Buffer.from("x").toString("base64"), _sid: sid, _ctr: "nope" });
+  } catch (e) { threw = e; }
+  check("client per-session response non-numeric _ctr: CLIENT_RESPONSE_REPLAY",
+        threw && threw.code === "CLIENT_RESPONSE_REPLAY");
+}
+
+async function testApiEncryptPerRequestClientRejectsTamperedResponse() {
+  // Per-request client: a response whose _ct is well-formed base64 but
+  // fails authenticated decryption is refused typed.
+  var keypair = _serverKeypair();
+  var clientCtx = b.middleware.apiEncrypt.client({ pubkey: keypair });
+  clientCtx.encryptRequest({ x: 1 });              // establishes the per-request session key
+  var call = clientCtx.encryptRequest({ x: 2 });
+  var threw = null;
+  try {
+    call.decryptResponse({ _ct: b.crypto.generateBytes(64).toString("base64") });
+  } catch (e) { threw = e; }
+  check("per-request client: garbage response ciphertext refused typed",
+        threw && threw.code === "CLIENT_RESPONSE_TAMPERED");
+}
+
+async function testApiEncryptClientNullPayloadDefaults() {
+  // encryptRequest() with no argument defaults the payload to null in
+  // both keying modes (the `payload === undefined` branch).
+  var keypair = _serverKeypair();
+  var perReq = b.middleware.apiEncrypt.client({ pubkey: keypair });
+  var r1 = perReq.encryptRequest();
+  check("per-request encryptRequest() with no payload builds a body", typeof r1.body._ct === "string");
+
+  var perSess = b.middleware.apiEncrypt.client({ pubkey: keypair, keying: "per-session" });
+  var r2 = perSess.encryptRequest();
+  check("per-session encryptRequest() with no payload builds a bootstrap body",
+        typeof r2.body._ek === "string" && r2.body._ctr === 1);
+}
+
+async function testApiEncryptHttpClientOptionValidation() {
+  var keypair = _serverKeypair();
+
+  // Bad responseMode at create time.
+  var threw = null;
+  try { b.httpClient.encrypted({ pubkey: keypair, responseMode: "swallow" }); }
+  catch (e) { threw = e; }
+  check("httpClient.encrypted: bad responseMode default rejected", threw && threw.code === "CLIENT_BAD_OPT");
+
+  // maxDecryptedBytes + keying overrides build cleanly (the non-default
+  // ternary branches).
+  var enc = b.httpClient.encrypted({
+    pubkey: keypair, baseUrl: "http://127.0.0.1:1",
+    maxDecryptedBytes: b.constants.BYTES.mib(2), keying: "per-request",
+  });
+  check("httpClient.encrypted: numeric maxDecryptedBytes + keying build", typeof enc.request === "function");
+
+  // Bad per-call responseMode override is rejected before any network I/O.
+  threw = null;
+  try { await enc.request({ url: "http://127.0.0.1:1/x", responseMode: "swallow" }); }
+  catch (e) { threw = e; }
+  check("httpClient.encrypted.request: bad per-call responseMode rejected",
+        threw && threw.code === "CLIENT_BAD_OPT");
+
+  // request() with no args at all resolves through `reqOpts || {}` into the
+  // url-required throw.
+  threw = null;
+  try { await enc.request(); } catch (e) { threw = e; }
+  check("httpClient.encrypted.request(): no args rejected (url required)",
+        threw && threw.code === "CLIENT_INVALID_URL");
+}
+
+async function testApiEncryptHttpClientUrlFormsAndBodyless() {
+  // Live round trip exercising _resolveUrl's absolute-url branch and its
+  // leading-slash normalisation, plus a body-less request (the `body
+  // !== undefined ? body : null` default).
+  var http = require("http");
+  var keypair = _serverKeypair();
+  var mw = b.middleware.apiEncrypt({ keypair: keypair, audit: false });
+  var server = http.createServer(function (req, res) {
+    res.json = function (data) {
+      res.writeHead(res.statusCode || 200, { "Content-Type": "application/json" });
+      res.end(JSON.stringify(data));
+    };
+    req.pathname = req.url.split("?")[0];
+    var chunks = [];
+    req.on("data", function (c) { chunks.push(c); });
+    req.on("end", function () {
+      try { req.body = JSON.parse(Buffer.concat(chunks).toString("utf8")); }
+      catch (_e) { req.body = null; }
+      mw(req, res, function () { res.json({ echo: req.body, at: req.pathname }); });
+    });
+  });
+  var port = await helpers.listenOnRandomPort(server);
+  try {
+    var common = { allowedProtocols: b.safeUrl.ALLOW_HTTP_ALL, allowInternal: true };
+
+    // Absolute url form (no baseUrl needed).
+    var encAbs = b.httpClient.encrypted({ pubkey: keypair, method: "POST" });
+    var respAbs = await encAbs.request(Object.assign(
+      { url: "http://127.0.0.1:" + port + "/api/abs", body: { via: "url" } }, common));
+    check("httpClient url form: 200 + decrypted echo",
+          respAbs.statusCode === 200 && respAbs.body.echo.via === "url" && respAbs.body.at === "/api/abs");
+
+    // path WITHOUT a leading slash, resolved against baseUrl; also body-less.
+    var encPath = b.httpClient.encrypted({
+      pubkey: keypair, baseUrl: "http://127.0.0.1:" + port, method: "POST",
+    });
+    var respPath = await encPath.request(Object.assign({ path: "api/noslash" }, common));
+    check("httpClient no-leading-slash path: 200 at normalised /api/noslash",
+          respPath.statusCode === 200 && respPath.body.at === "/api/noslash");
+    check("httpClient body-less request: echo is null", respPath.body.echo === null);
+  } finally {
+    server.close();
+    mw.close();
+  }
+}
+
+async function testApiEncryptHttpClientEmptyAndNonJsonBodies() {
+  // The httpClient response decoder's empty-body short-circuit (→ null)
+  // and its non-JSON-body guard (→ CLIENT_RESPONSE_NOT_JSON). The server
+  // replies directly (bypassing the middleware) to shape each case.
+  var http = require("http");
+  var keypair = _serverKeypair();
+  var server = http.createServer(function (req, res) {
+    req.on("data", function () {});
+    req.on("end", function () {
+      if (/empty/.test(req.url)) { res.writeHead(204); res.end(); return; }
+      res.writeHead(200, { "Content-Type": "text/plain" });
+      res.end("<<< this is not json >>>");
+    });
+  });
+  var port = await helpers.listenOnRandomPort(server);
+  try {
+    var common = { allowedProtocols: b.safeUrl.ALLOW_HTTP_ALL, allowInternal: true };
+    var enc = b.httpClient.encrypted({
+      pubkey: keypair, baseUrl: "http://127.0.0.1:" + port, method: "POST",
+    });
+
+    var empty = await enc.request(Object.assign({ path: "/empty", body: { x: 1 } }, common));
+    check("httpClient empty (204) body: statusCode 204", empty.statusCode === 204);
+    check("httpClient empty (204) body: body is null", empty.body === null);
+
+    var threw = null;
+    try { await enc.request(Object.assign({ path: "/junk", body: { x: 1 } }, common)); }
+    catch (e) { threw = e; }
+    check("httpClient non-JSON body: CLIENT_RESPONSE_NOT_JSON",
+          threw && threw.code === "CLIENT_RESPONSE_NOT_JSON");
+  } finally {
+    server.close();
+  }
+}
+
+async function testApiEncryptCloseReleasesSessionStore() {
+  // mw.close() closes an in-mode default session store too (the
+  // sessionStore-present branch of close()).
+  var keypair = _serverKeypair();
+  var mw = b.middleware.apiEncrypt({ keypair: keypair, audit: false, keying: "per-session" });
+  check("per-session mw exposes a default sessionStore", mw.sessionStore && typeof mw.sessionStore.close === "function");
+  var clientCtx = b.middleware.apiEncrypt.client({ pubkey: keypair, keying: "per-session" });
+  var boot = clientCtx.encryptRequest({ n: 1 });
+  var req = _encReq(null, boot.body);
+  var res = _mkRes();
+  var fin = _newFinish(res);
+  await mw(req, res, function () { res.json({ ok: 1 }); });
+  await fin;
+  check("per-session default store holds the row before close", mw.sessionStore.size() === 1);
+  mw.close();
+  check("mw.close() clears the default session store", mw.sessionStore.size() === 0);
+}
+
+async function testApiEncryptDefaultSessionStorePurgeExpired() {
+  // The default session store's purgeExpired() sweep — reachable via the
+  // exposed handle (the middleware itself relies on TTL-on-get, but the
+  // store advertises purgeExpired for operator dashboards).
+  var keypair = _serverKeypair();
+  var mw = b.middleware.apiEncrypt({
+    keypair: keypair, audit: false, keying: "per-session", sessionTtlMs: 1,
+  });
+  var clientCtx = b.middleware.apiEncrypt.client({ pubkey: keypair, keying: "per-session" });
+  var boot = clientCtx.encryptRequest({ n: 1 });
+  var req = _encReq(null, boot.body);
+  var res = _mkRes();
+  var fin = _newFinish(res);
+  await mw(req, res, function () { res.json({ ok: 1 }); });
+  await fin;
+  await helpers.passiveObserve(20, "apiEncrypt: default session row past sessionTtlMs=1");
+  var purged = mw.sessionStore.purgeExpired();
+  check("default session store purgeExpired reclaims the expired row", purged === 1);
+  check("default session store empty after purge", mw.sessionStore.size() === 0);
+  mw.close();
+}
+
 async function run() {
   await testNonceStoreSurface();
   await testNonceStoreMemoryBasics();
@@ -1558,6 +2420,35 @@ async function run() {
   await testApiEncryptPerSessionSessionInfo();
   await testApiEncryptPerSessionResetRotates();
   await testApiEncryptObservabilityCounters();
+
+  // error / adversarial / option-default branch coverage
+  await testApiEncryptKeypairNonObjectAndMissingFields();
+  await testApiEncryptCreateOptionDefaultsTaken();
+  await testApiEncryptContentTypeHeaderVariants();
+  await testApiEncryptBodyShapeGuards();
+  await testApiEncryptPerRequestNoEkFallsThroughToShapeReject();
+  await testApiEncryptNonceStoreErrorOnBootstrap();
+  await testApiEncryptPruneFailureIsSwallowed();
+  await testApiEncryptResponseEncodeFallbackAndFailure();
+  await testApiEncryptPerSessionBootstrapInvalidSidAndCtr();
+  await testApiEncryptPerSessionBootstrapStoreSetError();
+  await testApiEncryptPerSessionSubsequentInvalidSidAndCtr();
+  await testApiEncryptPerSessionSubsequentGetError();
+  await testApiEncryptPerSessionKeyCoercionVariants();
+  await testApiEncryptPerSessionExpiredRowEncryptedRejection();
+  await testApiEncryptPerSessionEvictionDeleteBestEffort();
+  await testApiEncryptPerSessionCtrClaimStoreError();
+  await testApiEncryptSessionCreatedAuditEmitted();
+  await testApiEncryptPublishPublicKeyNoJsonRes();
+  await testApiEncryptClientRejectsBadKeying();
+  await testApiEncryptClientResponseShapeSidCtrGuards();
+  await testApiEncryptPerRequestClientRejectsTamperedResponse();
+  await testApiEncryptClientNullPayloadDefaults();
+  await testApiEncryptHttpClientOptionValidation();
+  await testApiEncryptHttpClientUrlFormsAndBodyless();
+  await testApiEncryptHttpClientEmptyAndNonJsonBodies();
+  await testApiEncryptCloseReleasesSessionStore();
+  await testApiEncryptDefaultSessionStorePurgeExpired();
 }
 
 // #355 — b.httpClient.encrypted must forward timeoutMs (overall wall-clock cap),