@blamejs/blamejs-shop 0.5.12 → 0.5.13

package/lib/vendor/blamejs/test/layer-0-primitives/crypto-spki-pin.test.js

@@ -0,0 +1,183 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+/**
+ * b.crypto.spkiPin / b.crypto.spkiPinVerifier — RFC 7469 (HPKP §2.4)
+ * SubjectPublicKeyInfo pinning.
+ *
+ * The pin is base64(SHA-256(SPKI DER)) — the interop wire form browsers,
+ * curl `--pinnedpubkey`, and other pinning tooling render. Distinct from
+ * `b.crypto.hashCertFingerprint`, which is SHA3-512 over the WHOLE cert:
+ * an SPKI pin survives certificate reissue on the same key, a whole-cert
+ * fingerprint does not.
+ *
+ * Reuses the in-tree self-signed cert builder from crypto.test.js so the
+ * SPKI bytes come from a real X.509 cert rather than a synthetic fixture.
+ *
+ * Run standalone: `node test/layer-0-primitives/crypto-spki-pin.test.js`
+ * Or via smoke:   `node test/smoke.js`
+ */
+
+var helpers    = require("../helpers");
+var b          = helpers.b;
+var check      = helpers.check;
+var nodeCrypto = require("node:crypto");
+
+var _makeEcCert = require("./crypto.test.js")._makeEcCert;
+
+// Peer-cert object in the shape Node hands `checkServerIdentity`: the
+// detailed cert carries `.subject`, `.subjectaltname`, and `.raw` (DER).
+function _peerCertObject(fixture, cn, san) {
+  return {
+    subject:        { CN: cn },
+    subjectaltname: san,
+    raw:            fixture.certDer,
+  };
+}
+
+function testSpkiPinShape() {
+  var fixture = _makeEcCert("pin-shape.example", "P-256");
+  var pin = b.crypto.spkiPin(fixture.certDer);
+  check("spkiPin returns { sha256, b64, hex }",
+        pin && typeof pin.sha256 === "string" &&
+        typeof pin.b64 === "string" && typeof pin.hex === "string");
+  // SHA-256 = 32 bytes → 44 base64 chars (43 data + 1 '=' pad).
+  check("spkiPin.sha256 is 'sha256/<44-char base64>'",
+        /^sha256\/[A-Za-z0-9+/]{43}=$/.test(pin.sha256));
+  check("spkiPin.b64 is the 44-char base64 body",
+        pin.b64.length === 44 && pin.sha256 === "sha256/" + pin.b64);
+  // SHA-256 = 32 bytes → 64 lowercase-hex chars.
+  check("spkiPin.hex is 64 lowercase-hex chars",
+        /^[0-9a-f]{64}$/.test(pin.hex));
+}
+
+function testSpkiPinKnownAnswer() {
+  var fixture = _makeEcCert("pin-kat.example", "P-384");
+  // Independently derive the pin: extract SPKI DER, SHA-256, base64.
+  var spkiDer = new nodeCrypto.X509Certificate(fixture.certDer)
+    .publicKey.export({ type: "spki", format: "der" });
+  var expB64 = nodeCrypto.createHash("sha256").update(spkiDer).digest("base64");
+  var expHex = nodeCrypto.createHash("sha256").update(spkiDer).digest("hex");
+  var pin = b.crypto.spkiPin(fixture.certDer);
+  check("spkiPin.b64 matches independent SHA-256(SPKI) KAT", pin.b64 === expB64);
+  check("spkiPin.sha256 matches 'sha256/' + KAT", pin.sha256 === "sha256/" + expB64);
+  check("spkiPin.hex matches independent hex KAT", pin.hex === expHex);
+}
+
+function testSpkiPinPemDerAgreement() {
+  var fixture = _makeEcCert("pin-pemder.example", "P-256");
+  var fromDer = b.crypto.spkiPin(fixture.certDer);
+  var fromPem = b.crypto.spkiPin(fixture.pem);
+  check("spkiPin(DER) === spkiPin(PEM)", fromDer.sha256 === fromPem.sha256);
+}
+
+function testSpkiPinBadInput() {
+  var threw = null;
+  try { b.crypto.spkiPin(42); } catch (e) { threw = e; }
+  check("spkiPin rejects non-Buffer/non-string input", threw instanceof TypeError);
+}
+
+function testVerifierMatchingCert() {
+  var fixture = _makeEcCert("verify-ok.example", "P-256");
+  var correctPin = b.crypto.spkiPin(fixture.certDer).sha256;
+  // RFC 7469 requires a backup pin — supply a second, non-matching one.
+  var backupPin = b.crypto.spkiPin(_makeEcCert("backup.example", "P-256").certDer).sha256;
+  var verify = b.crypto.spkiPinVerifier({ pins: [correctPin, backupPin] });
+  var certObj = _peerCertObject(fixture, "verify-ok.example", "DNS:verify-ok.example");
+  check("verifier: undefined for matching pin + matching hostname",
+        verify("verify-ok.example", certObj) === undefined);
+}
+
+function testVerifierNonMatchingPin() {
+  var fixture = _makeEcCert("verify-badpin.example", "P-256");
+  // Two pins, neither derived from this cert.
+  var wrong1 = b.crypto.spkiPin(_makeEcCert("other-1.example", "P-256").certDer).sha256;
+  var wrong2 = b.crypto.spkiPin(_makeEcCert("other-2.example", "P-256").certDer).sha256;
+  var verify = b.crypto.spkiPinVerifier({ pins: [wrong1, wrong2] });
+  var certObj = _peerCertObject(fixture, "verify-badpin.example", "DNS:verify-badpin.example");
+  var res = verify("verify-badpin.example", certObj);
+  check("verifier: Error when peer pin matches no configured pin",
+        res instanceof Error && res.code === "crypto/spki-pin-mismatch");
+}
+
+function testVerifierHostnameMismatchWinsOverPin() {
+  var fixture = _makeEcCert("verify-host.example", "P-256");
+  var correctPin = b.crypto.spkiPin(fixture.certDer).sha256;
+  var backupPin = b.crypto.spkiPin(_makeEcCert("backup2.example", "P-256").certDer).sha256;
+  var verify = b.crypto.spkiPinVerifier({ pins: [correctPin, backupPin] });
+  // Cert SAN is for verify-host.example, but we ask the verifier about a
+  // different host — the identity (hostname/SAN) check must refuse FIRST,
+  // even though the SPKI pin itself would match.
+  var certObj = _peerCertObject(fixture, "verify-host.example", "DNS:verify-host.example");
+  var res = verify("wrong-host.example", certObj);
+  check("verifier: hostname/SAN error precedes the pin match",
+        res instanceof Error &&
+        typeof res.code === "string" && res.code.indexOf("tls/pkix") === 0);
+}
+
+function testVerifierHostnameOptOverride() {
+  var fixture = _makeEcCert("verify-opt.example", "P-256");
+  var correctPin = b.crypto.spkiPin(fixture.certDer).sha256;
+  var backupPin = b.crypto.spkiPin(_makeEcCert("backup3.example", "P-256").certDer).sha256;
+  // opts.hostname pins the expected name; the host argument Node supplies
+  // is ignored in favour of it.
+  var verify = b.crypto.spkiPinVerifier({
+    pins:     [correctPin, backupPin],
+    hostname: "verify-opt.example",
+  });
+  var certObj = _peerCertObject(fixture, "verify-opt.example", "DNS:verify-opt.example");
+  check("verifier: opts.hostname override accepts a matching cert",
+        verify("ignored-by-override.example", certObj) === undefined);
+}
+
+function testVerifierBadOpts() {
+  var t1 = null;
+  try { b.crypto.spkiPinVerifier(); } catch (e) { t1 = e; }
+  check("spkiPinVerifier: requires opts", t1 instanceof TypeError);
+
+  var t2 = null;
+  try { b.crypto.spkiPinVerifier({ pins: "sha256/x" }); } catch (e) { t2 = e; }
+  check("spkiPinVerifier: pins must be an array", t2 instanceof TypeError);
+
+  var t3 = null;
+  try { b.crypto.spkiPinVerifier({ pins: ["sha256/" + "A".repeat(43) + "="] }); }
+  catch (e) { t3 = e; }
+  check("spkiPinVerifier: refuses a single pin (RFC 7469 backup pin required)",
+        t3 instanceof TypeError);
+
+  // Two IDENTICAL pins are not a backup — the same key repeated passes a
+  // length-only check but leaves the endpoint with no rotation key.
+  var t3dup = null;
+  try {
+    var samePin = "sha256/" + "A".repeat(43) + "=";
+    b.crypto.spkiPinVerifier({ pins: [samePin, samePin] });
+  } catch (e) { t3dup = e; }
+  check("spkiPinVerifier: refuses two duplicate pins (no distinct backup key)",
+        t3dup instanceof TypeError);
+
+  var t4 = null;
+  try {
+    b.crypto.spkiPinVerifier({ pins: ["not-a-pin", "sha256/" + "A".repeat(43) + "="] });
+  } catch (e) { t4 = e; }
+  check("spkiPinVerifier: refuses a pin missing the 'sha256/' prefix",
+        t4 instanceof TypeError);
+}
+
+function run() {
+  testSpkiPinShape();
+  testSpkiPinKnownAnswer();
+  testSpkiPinPemDerAgreement();
+  testSpkiPinBadInput();
+  testVerifierMatchingCert();
+  testVerifierNonMatchingPin();
+  testVerifierHostnameMismatchWinsOverPin();
+  testVerifierHostnameOptOverride();
+  testVerifierBadOpts();
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  try { run(); console.log("[crypto-spki-pin] OK"); }
+  catch (e) { console.error(e); process.exit(1); }
+}

package/lib/vendor/blamejs/test/layer-0-primitives/crypto-xwing.test.js

@@ -21,6 +21,13 @@ function code(fn) { try { fn(); return "NO-THROW"; } catch (e) { return e.code;
 
 var x = b.crypto.xwing;
 
+// Wire widths (bytes) fixed by draft-connolly-cfrg-xwing-kem, mirrored here so
+// the low-order-point test can index the X25519 ephemeral inside the ciphertext.
+var ML_KEM_PK = 1184;
+var ML_KEM_CT = 1088;
+var X25519_LEN = 32;
+var SS_LEN = 32;
+
 function testSurface() {
   check("xwing.keygen is fn",       typeof x.keygen === "function");
   check("xwing.encapsulate is fn",  typeof x.encapsulate === "function");
@@ -109,6 +116,46 @@ function testErrors() {
   check("decapsulate rejects a short ct",     code(function () { x.decapsulate(kp.secretKey, Buffer.alloc(100)); }) === "xwing/bad-ciphertext");
 }
 
+// draft-connolly-cfrg-xwing-kem section 5.1 uses X25519 as specified in RFC
+// 7748 WITHOUT the RFC 7748 section 6.1 all-zero-output abort: decapsulation is
+// uniform implicit-rejection and never signals ciphertext validity by throwing.
+// A low-order X25519 ephemeral in ctX (all-zero, 1, or a small-subgroup point)
+// yields an all-zero X25519 shared secret that flows through the combiner, and
+// the ML-KEM-768 leg still protects the result. The framework's X25519 runs
+// through OpenSSL, which aborts on the all-zero derivation, so a hostile ctX
+// must NOT surface that raw error out of decapsulate/encapsulate.
+function testLowOrderX25519NoThrow() {
+  var kp = x.keygen();
+  var enc = x.encapsulate(kp.publicKey);
+  // A few X25519 points that drive the Montgomery ladder to the all-zero
+  // shared secret (the identity + order-8 small-subgroup points, RFC 7748).
+  var lowOrder = [
+    Buffer.alloc(X25519_LEN, 0x00),
+    Buffer.from("0100000000000000000000000000000000000000000000000000000000000000", "hex"),
+    Buffer.from("e0eb7a7c3b41b8ae1656e3faf19fc46ada098deb9c32b1fd866205165f49b800", "hex"),
+    Buffer.from("5f9c95bca3508c24b1d0b1559c83ef5b04445cc4581c8e86d8224eddd09f1157", "hex"),
+  ];
+  lowOrder.forEach(function (lp, i) {
+    var bad = Buffer.from(enc.ciphertext);
+    lp.copy(bad, ML_KEM_CT); // overwrite the trailing 32-byte X25519 ephemeral
+    var ss;
+    var threw = code(function () { ss = x.decapsulate(kp.secretKey, bad); });
+    check("decapsulate does not throw on a low-order X25519 ephemeral #" + i, threw === "NO-THROW");
+    check("decapsulate still yields a 32-byte secret #" + i, Buffer.isBuffer(ss) && ss.length === SS_LEN);
+    check("low-order ctX yields an implicit-rejection secret (differs from good) #" + i, !ss.equals(enc.sharedSecret));
+  });
+
+  // Encapsulate to a public key whose X25519 half is a low-order point must
+  // not surface the raw OpenSSL derivation error either (same X25519 seam).
+  var badPk = Buffer.from(kp.publicKey);
+  Buffer.alloc(X25519_LEN, 0x00).copy(badPk, ML_KEM_PK);
+  var out;
+  var encThrew = code(function () { out = x.encapsulate(badPk); });
+  check("encapsulate does not throw on a low-order X25519 recipient key", encThrew === "NO-THROW");
+  check("encapsulate to low-order key still returns the wire shape",
+    out && out.ciphertext.length === 1120 && out.sharedSecret.length === SS_LEN);
+}
+
 async function run() {
   testSurface();
   testCombinerKAT();
@@ -117,6 +164,7 @@ async function run() {
   testDeterminism();
   testImplicitRejection();
   testErrors();
+  testLowOrderX25519NoThrow();
 }
 module.exports = { run: run };
 if (require.main === module) { run().then(function () { console.log("[crypto-xwing] OK — " + helpers.getChecks() + " checks passed"); }, function (e) { console.error("FAIL:", e && e.stack || e); process.exit(1); }); }

package/lib/vendor/blamejs/test/layer-0-primitives/crypto.test.js

@@ -0,0 +1,345 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+/**
+ * Core b.crypto surface without a dedicated sub-domain file:
+ *   - hmacSha3 / kdf / sri  — keyed integrity, SHAKE256 derivation, W3C SRI.
+ *   - hashCertFingerprint / isCertRevoked — peer-cert pinning + deny lists.
+ *   - encryptEnvelopeAsCertPeer / decryptEnvelopeAsCertPeer — cert-bound
+ *     envelope round trip against real P-384 cert + ML-KEM-1024 material.
+ *
+ * The cert-peer + fingerprint + revocation cases share one in-tree ASN.1
+ * DER self-signed cert whose SubjectPublicKeyInfo carries a P-384 ECDH
+ * public key — the exact shape `encryptEnvelopeAsCertPeer` extracts.
+ *
+ * Run standalone: `node test/layer-0-primitives/crypto.test.js`
+ * Or via smoke:   `node test/smoke.js`
+ */
+
+var helpers    = require("../helpers");
+var b          = helpers.b;
+var check      = helpers.check;
+var asn1       = require("../../lib/asn1-der");
+var nodeCrypto = require("node:crypto");
+
+// ---- In-tree self-signed cert builder (mirrors content-credentials.test.js
+// but keyed on an EC curve so the SPKI carries an ECDH public key). Node's
+// X509Certificate only parses — it never verifies the signature — so an
+// ECDSA self-signature over the TBS is enough for `.publicKey` extraction.
+function _utcTime(d) {
+  var s = d.toISOString().replace(/[-:T]/g, "").slice(2, 14) + "Z";
+  return asn1.writeNode(0x17, Buffer.from(s, "ascii"));
+}
+function _certName(cn) {
+  return asn1.writeSequence([
+    asn1.writeSet([
+      asn1.writeSequence([asn1.writeOid("2.5.4.3"), asn1.writeUtf8String(cn)]),
+    ]),
+  ]);
+}
+// Build a self-signed X.509 cert for `cn` over `namedCurve`. Returns the
+// DER bytes, the matching EC private key (KeyObject), and the parsed PEM.
+function _makeEcCert(cn, namedCurve) {
+  var kp = nodeCrypto.generateKeyPairSync("ec", { namedCurve: namedCurve });
+  var spki = kp.publicKey.export({ type: "spki", format: "der" });
+  var name = _certName(cn);
+  var version = asn1.writeContextExplicit(0, asn1.writeInteger(Buffer.from([2])));
+  var serial = asn1.writeInteger(Buffer.from([0x2c]));
+  // ecdsa-with-SHA384 (1.2.840.10045.4.3.3) — ECDSA AlgorithmIdentifiers
+  // carry no parameters (not even NULL).
+  var sigAlgId = asn1.writeSequence([asn1.writeOid("1.2.840.10045.4.3.3")]);
+  var now = Date.now();
+  var validity = asn1.writeSequence([
+    _utcTime(new Date(now - 86400000)),
+    _utcTime(new Date(now + 86400000 * 3650)),
+  ]);
+  var tbs = asn1.writeSequence([version, serial, sigAlgId, name, validity, name, spki]);
+  var sig = nodeCrypto.sign("sha384", tbs, kp.privateKey);
+  var certDer = asn1.writeSequence([tbs, sigAlgId, asn1.writeBitString(sig, 0)]);
+  return {
+    certDer:      certDer,
+    ecPrivateKey: kp.privateKey,
+    ecPrivatePem: kp.privateKey.export({ type: "pkcs8", format: "pem" }),
+    pem:          new nodeCrypto.X509Certificate(certDer).toString(),
+  };
+}
+
+function testHmacSha3() {
+  // HMAC-SHA3-512 = 64 bytes = 128 lowercase-hex chars.
+  var tag = b.crypto.hmacSha3("shared-secret", "POST /webhook|123");
+  check("hmacSha3 returns 128 hex chars", tag.length === 128 && /^[0-9a-f]+$/.test(tag));
+
+  // Known answer against an independent HMAC-SHA3-512 computation.
+  var expected = nodeCrypto.createHmac("sha3-512", "shared-secret")
+    .update("POST /webhook|123").digest("hex");
+  check("hmacSha3 matches HMAC-SHA3-512 KAT", tag === expected);
+
+  // Deterministic — same (key, data) → same tag.
+  var det1 = b.crypto.hmacSha3("k", "d");
+  var det2 = b.crypto.hmacSha3("k", "d");
+  check("hmacSha3 is deterministic", det1 === det2);
+
+  // Keyed difference — a different key over identical data diverges.
+  check("hmacSha3 diverges on key change",
+    b.crypto.hmacSha3("key-a", "d") !== b.crypto.hmacSha3("key-b", "d"));
+
+  // Data difference — same key over different data diverges.
+  check("hmacSha3 diverges on data change",
+    b.crypto.hmacSha3("k", "data-a") !== b.crypto.hmacSha3("k", "data-b"));
+}
+
+function testKdf() {
+  var seed = Buffer.from("master-secret|session-42", "utf8");
+
+  // Exact requested output length (SHAKE256 XOF — arbitrary length).
+  var k32 = b.crypto.kdf(seed, 32);
+  var k64 = b.crypto.kdf(seed, 64);
+  check("kdf honours outputLength 32", Buffer.isBuffer(k32) && k32.length === 32);
+  check("kdf honours outputLength 64", Buffer.isBuffer(k64) && k64.length === 64);
+
+  // Known answer against an independent SHAKE256 computation.
+  var expected = nodeCrypto.createHash("shake256", { outputLength: 32 })
+    .update(seed).digest();
+  check("kdf matches SHAKE256 KAT", Buffer.compare(k32, expected) === 0);
+
+  // Determinism — same (input, length) → identical key.
+  var kdet1 = b.crypto.kdf(seed, 32);
+  var kdet2 = b.crypto.kdf(seed, 32);
+  check("kdf is deterministic", Buffer.compare(kdet1, kdet2) === 0);
+
+  // Different input → different key (the "different salt" case: kdf's only
+  // domain-separation lever is the input, since it takes no explicit salt).
+  var other = b.crypto.kdf(Buffer.from("master-secret|session-99", "utf8"), 32);
+  check("kdf diverges on input change", Buffer.compare(k32, other) !== 0);
+
+  // XOF prefix property — the 32-byte output is the prefix of the 64-byte
+  // output for the same input (SHAKE256 is a stream, not a fresh hash).
+  check("kdf shorter output prefixes the longer", Buffer.compare(k32, k64.subarray(0, 32)) === 0);
+}
+
+function testSri() {
+  // W3C SRI 1.0 attribute string: "<alg>-<base64>". Known answer against an
+  // independent SHA-384 base64 computation.
+  var payload = Buffer.from("alert(1);", "utf8");
+  var attr = b.crypto.sri(payload, { algorithm: "sha384" });
+  var expB64 = nodeCrypto.createHash("sha384").update(payload).digest("base64");
+  check("sri sha384 matches known answer", attr === "sha384-" + expB64);
+
+  // RFC/W3C integrity format: alg token + base64 body (with optional padding).
+  check("sri emits W3C integrity format", /^sha(256|384|512)-[A-Za-z0-9+/]+={0,2}$/.test(attr));
+  check("sri base64 body decodes to 48 bytes (sha384)",
+    Buffer.from(attr.slice("sha384-".length), "base64").length === 48);
+
+  // Default algorithm is sha384.
+  check("sri default algorithm is sha384", b.crypto.sri("x").indexOf("sha384-") === 0);
+
+  // string and Buffer inputs agree; Uint8Array accepted.
+  check("sri string and Buffer agree",
+    b.crypto.sri("alert(1);", { algorithm: "sha384" }) === attr);
+  check("sri accepts Uint8Array",
+    b.crypto.sri(new Uint8Array(payload), { algorithm: "sha384" }) === attr);
+
+  // sha256 / sha512 emit the correct token + digest length.
+  var s256 = b.crypto.sri(payload, { algorithm: "sha256" });
+  var s512 = b.crypto.sri(payload, { algorithm: "sha512" });
+  check("sri sha256 token + 32-byte digest",
+    s256.indexOf("sha256-") === 0 && Buffer.from(s256.slice(7), "base64").length === 32);
+  check("sri sha512 token + 64-byte digest",
+    s512.indexOf("sha512-") === 0 && Buffer.from(s512.slice(7), "base64").length === 64);
+
+  // Array input → space-separated multi-integrity per W3C §3.3.
+  var multi = b.crypto.sri(["payload-a", "payload-b"], { algorithm: "sha512" });
+  var tokens = multi.split(" ");
+  check("sri array emits one token per element", tokens.length === 2);
+  check("sri array tokens are each valid integrity strings",
+    tokens[0] === b.crypto.sri("payload-a", { algorithm: "sha512" }) &&
+    tokens[1] === b.crypto.sri("payload-b", { algorithm: "sha512" }));
+
+  // Unsupported algorithm throws (config-time entry-tier).
+  var threwAlg = false;
+  try { b.crypto.sri(payload, { algorithm: "sha1" }); }
+  catch (e) { threwAlg = /unsupported algorithm/.test(e.message); }
+  check("sri refuses unsupported algorithm", threwAlg);
+
+  // Non-Buffer/string/Uint8Array content throws.
+  var threwType = false;
+  try { b.crypto.sri(42, { algorithm: "sha384" }); }
+  catch (e) { threwType = /content must be/.test(e.message); }
+  check("sri refuses non-byte content", threwType);
+}
+
+function testCertFingerprint() {
+  var cert = _makeEcCert("fp.example", "P-384");
+
+  // Accepts a PEM string (the shape the @example documents) — this path was
+  // silently broken before the safeBuffer()-call fix and threw a TypeError.
+  var fp = b.crypto.hashCertFingerprint(cert.pem);
+  check("hashCertFingerprint hex is 128 chars (SHA3-512)",
+    typeof fp.hex === "string" && fp.hex.length === 128 && /^[0-9a-f]+$/.test(fp.hex));
+  check("hashCertFingerprint colon form has 64 groups",
+    fp.colon.split(":").length === 64);
+  check("hashCertFingerprint colon form is uppercase hex pairs",
+    /^[0-9A-F]{2}(:[0-9A-F]{2}){63}$/.test(fp.colon));
+
+  // DER (Buffer) and PEM of the same cert produce identical fingerprints.
+  var fpDer = b.crypto.hashCertFingerprint(cert.certDer);
+  check("hashCertFingerprint PEM and DER agree", fpDer.hex === fp.hex);
+
+  // Known answer against an independent SHA3-512 over the DER bytes.
+  var direct = nodeCrypto.createHash("sha3-512").update(cert.certDer).digest("hex");
+  check("hashCertFingerprint matches SHA3-512(DER) KAT", fp.hex === direct);
+
+  // Non-Buffer / non-string input throws.
+  var threwType = false;
+  try { b.crypto.hashCertFingerprint(42); }
+  catch (e) { threwType = e instanceof TypeError; }
+  check("hashCertFingerprint refuses non-Buffer/non-string", threwType);
+
+  // PEM without BEGIN/END markers throws.
+  var threwMarker = false;
+  try { b.crypto.hashCertFingerprint("not a pem at all"); }
+  catch (e) { threwMarker = e instanceof TypeError && /BEGIN\/END/.test(e.message); }
+  check("hashCertFingerprint refuses markerless PEM", threwMarker);
+}
+
+function testCertRevoked() {
+  var cert  = _makeEcCert("revoked.example", "P-384");
+  var other = _makeEcCert("other.example", "P-384");
+  var fp = b.crypto.hashCertFingerprint(cert.pem);
+
+  // A cert whose fingerprint (colon form) is on the deny list → revoked.
+  check("isCertRevoked true when colon fingerprint on deny list",
+    b.crypto.isCertRevoked(cert.pem, [fp.colon]) === true);
+
+  // Lowercase-hex deny entry also matches.
+  check("isCertRevoked true when hex fingerprint on deny list",
+    b.crypto.isCertRevoked(cert.pem, [fp.hex]) === true);
+
+  // A deny list carrying only an unrelated cert's fingerprint → not revoked.
+  var otherFp = b.crypto.hashCertFingerprint(other.pem);
+  check("isCertRevoked false when only another cert is denied",
+    b.crypto.isCertRevoked(cert.pem, [otherFp.colon, otherFp.hex]) === false);
+
+  // Empty deny list → not revoked.
+  check("isCertRevoked false on empty deny list",
+    b.crypto.isCertRevoked(cert.pem, []) === false);
+
+  // Match survives a deny list where the hit is not the first entry.
+  check("isCertRevoked scans the whole deny list",
+    b.crypto.isCertRevoked(cert.pem, ["DEADBEEF", "", fp.hex]) === true);
+
+  // Non-array deny list throws (entry-tier).
+  var threw = false;
+  try { b.crypto.isCertRevoked(cert.pem, "not-an-array"); }
+  catch (e) { threw = e instanceof TypeError; }
+  check("isCertRevoked refuses non-array deny list", threw);
+}
+
+function testCertPeerEnvelopeRoundTrip() {
+  // The recipient peer owns: a TLS cert carrying its P-384 ECDH pubkey, and
+  // an ML-KEM-1024 keypair (publishes the pubkey, keeps the secret).
+  var kem  = b.crypto.generateEncryptionKeyPair();  // ML-KEM-1024 + P-384 bundle; use the KEM half
+  var cert = _makeEcCert("peer.example", "P-384");
+
+  var sealed = b.crypto.encryptEnvelopeAsCertPeer("cross-peer payload", {
+    peerCertDer:   cert.certDer,
+    peerKemPubkey: kem.publicKey,
+  });
+  check("encryptEnvelopeAsCertPeer returns a base64 envelope string",
+    typeof sealed === "string" && sealed.length > 0);
+
+  // Receive side with the EC private key as a KeyObject.
+  var openedKo = b.crypto.decryptEnvelopeAsCertPeer(sealed, {
+    certPrivateKey: cert.ecPrivateKey,
+    kemSecret:      kem.privateKey,
+  });
+  check("decryptEnvelopeAsCertPeer round-trips with KeyObject cert key",
+    openedKo === "cross-peer payload");
+
+  // Receive side with the EC private key as a PEM string.
+  var openedPem = b.crypto.decryptEnvelopeAsCertPeer(sealed, {
+    certPrivateKey: cert.ecPrivatePem,
+    kemSecret:      kem.privateKey,
+  });
+  check("decryptEnvelopeAsCertPeer round-trips with PEM cert key",
+    openedPem === "cross-peer payload");
+
+  // Wrong recipient (fresh unrelated ML-KEM secret) cannot open it.
+  var wrongKem = b.crypto.generateEncryptionKeyPair();
+  var threwWrong = false;
+  try {
+    b.crypto.decryptEnvelopeAsCertPeer(sealed, {
+      certPrivateKey: cert.ecPrivateKey,
+      kemSecret:      wrongKem.privateKey,
+    });
+  } catch (_e) { threwWrong = true; }
+  check("decryptEnvelopeAsCertPeer refuses a mismatched KEM secret", threwWrong);
+}
+
+function testCertPeerEnvelopeValidation() {
+  var kem  = b.crypto.generateEncryptionKeyPair();
+  var cert = _makeEcCert("peer.example", "P-384");
+
+  // A cert whose key is not ECDH P-384 is refused with a specific code.
+  var p256 = _makeEcCert("p256.example", "P-256");
+  var threwCurve;
+  try {
+    b.crypto.encryptEnvelopeAsCertPeer("x", { peerCertDer: p256.certDer, peerKemPubkey: kem.publicKey });
+  } catch (e) { threwCurve = e; }
+  check("encryptEnvelopeAsCertPeer rejects non-P-384 cert key",
+    threwCurve && threwCurve.code === "crypto/cert-key-not-ecdh-p384");
+
+  // Missing peerCertDer / peerKemPubkey carry their documented codes.
+  var missCert;
+  try { b.crypto.encryptEnvelopeAsCertPeer("x", { peerKemPubkey: kem.publicKey }); }
+  catch (e) { missCert = e; }
+  check("encryptEnvelopeAsCertPeer flags missing peerCertDer",
+    missCert && missCert.code === "crypto/peer-cert-missing");
+
+  var missKem;
+  try { b.crypto.encryptEnvelopeAsCertPeer("x", { peerCertDer: cert.certDer, peerKemPubkey: "" }); }
+  catch (e) { missKem = e; }
+  check("encryptEnvelopeAsCertPeer flags empty peerKemPubkey",
+    missKem && missKem.code === "crypto/peer-kem-pubkey-missing");
+
+  // Decrypt side: missing keys + wrong-shape / wrong-curve cert private key.
+  var missCertPriv;
+  try { b.crypto.decryptEnvelopeAsCertPeer("AAAA", { kemSecret: kem.privateKey }); }
+  catch (e) { missCertPriv = e; }
+  check("decryptEnvelopeAsCertPeer flags missing certPrivateKey",
+    missCertPriv && missCertPriv.code === "crypto/cert-private-key-missing");
+
+  var badShape;
+  try { b.crypto.decryptEnvelopeAsCertPeer("AAAA", { certPrivateKey: 42, kemSecret: kem.privateKey }); }
+  catch (e) { badShape = e; }
+  check("decryptEnvelopeAsCertPeer flags bad-shape certPrivateKey",
+    badShape && badShape.code === "crypto/cert-private-key-bad-shape");
+
+  // A P-256 KeyObject as certPrivateKey is refused (wrong curve).
+  var p256Key = nodeCrypto.generateKeyPairSync("ec", { namedCurve: "P-256" }).privateKey;
+  var wrongCurveKey;
+  try { b.crypto.decryptEnvelopeAsCertPeer("AAAA", { certPrivateKey: p256Key, kemSecret: kem.privateKey }); }
+  catch (e) { wrongCurveKey = e; }
+  check("decryptEnvelopeAsCertPeer rejects non-P-384 KeyObject cert key",
+    wrongCurveKey && wrongCurveKey.code === "crypto/cert-key-not-ecdh-p384");
+}
+
+function run() {
+  testHmacSha3();
+  testKdf();
+  testSri();
+  testCertFingerprint();
+  testCertRevoked();
+  testCertPeerEnvelopeRoundTrip();
+  testCertPeerEnvelopeValidation();
+}
+
+// _makeEcCert is shared with crypto-spki-pin.test.js so the SPKI-pin
+// suite reuses the same in-tree self-signed cert builder rather than
+// rolling its own ASN.1 fixture.
+module.exports = { run: run, _makeEcCert: _makeEcCert };
+
+if (require.main === module) {
+  try { run(); console.log("[crypto] OK"); }
+  catch (e) { console.error(e); process.exit(1); }
+}

package/lib/vendor/blamejs/test/layer-0-primitives/csp-report.test.js

@@ -40,6 +40,7 @@ async function run() {
   testOnRejectRejectsNonFunction();
   await testValidPostReachesOnReport();
   await testOversizedPostRefused();
+  await testReportCountCapped();
   await testAuditDefaultEmitsViolationRow();
   await testAuditFalseSuppressesViolationRow();
   testMaxBytesGarbageThrowsAtCreate();
@@ -164,6 +165,63 @@ async function testOversizedPostRefused() {
         rejected !== null && rejected.reason === "payload-too-large");
 }
 
+// A single POST batches multiple reports. The byte cap bounds the body,
+// not the count — a 64 KiB body of tiny report objects is ~1600 reports,
+// and the endpoint drove one audit-chain append + one onReport hook per
+// entry, so an unauthenticated caller could force ~1600x work per request.
+// The batch length is now capped independently: an over-cap batch is
+// refused whole (413 + onReject "too-many-reports") with ZERO reports
+// processed; a batch at the cap still processes end-to-end.
+async function testReportCountCapped() {
+  // Over the default cap (100): refused whole, nothing processed.
+  var processedOver = 0, rejectedOver = null;
+  var resOver = _capRes();
+  var mwOver = b.middleware.cspReport({
+    audit:    false,
+    onReport: function () { processedOver += 1; },
+    onReject: function (req, res, info) { rejectedOver = info; },
+  });
+  var over = [];
+  for (var i = 0; i < 150; i += 1) {
+    over.push({ type: "csp-violation", body: { effectiveDirective: "script-src" } });
+  }
+  await mwOver(_bodyReq("POST", { "content-type": "application/reports+json" }, JSON.stringify(over)),
+               resOver, function () {});
+  check("cspReport: over-cap batch refused with 413",
+        resOver._sent.status === 413 && resOver._sent.ended === true);
+  check("cspReport: over-cap batch processes zero reports (no per-entry audit/hook amplification)",
+        processedOver === 0);
+  check("cspReport: over-cap batch fires onReject too-many-reports",
+        rejectedOver !== null && rejectedOver.status === 413 && rejectedOver.reason === "too-many-reports");
+
+  // A custom lower cap is honored, and a batch at exactly the cap still
+  // processes every report (the cap is inclusive).
+  var processedAt = 0;
+  var resAt = _capRes();
+  var mwAt = b.middleware.cspReport({
+    audit:      false,
+    maxReports: 5,
+    onReport:   function () { processedAt += 1; },
+  });
+  var atCap = [];
+  for (var j = 0; j < 5; j += 1) {
+    atCap.push({ type: "csp-violation", body: { effectiveDirective: "img-src" } });
+  }
+  await mwAt(_bodyReq("POST", { "content-type": "application/reports+json" }, JSON.stringify(atCap)),
+             resAt, function () {});
+  check("cspReport: batch at the cap processes every report",
+        resAt._sent.status === 204 && processedAt === 5);
+
+  // maxReports garbage throws at create() (config-time entry-point tier),
+  // matching the sibling maxBytes contract.
+  var badThrew = false;
+  try { b.middleware.cspReport({ maxReports: 0 }); } catch (_e) { badThrew = true; }
+  check("cspReport: maxReports:0 throws at create", badThrew);
+  var negThrew = false;
+  try { b.middleware.cspReport({ maxReports: -3 }); } catch (_e) { negThrew = true; }
+  check("cspReport: maxReports:-3 throws at create", negThrew);
+}
+
 // onReject surfaces the otherwise-empty-bodied 405 / 413 / 400 refusals
 // to the operator (W3C Reporting API §3.1 — the browser ignores the
 // rejection body, so onReject is the only signal a metrics sink gets).