@blamejs/blamejs-shop 0.5.12 → 0.5.14

package/lib/vendor/blamejs/test/layer-0-primitives/cert.test.js

@@ -10,7 +10,7 @@
  *   - SNI callback (exact + wildcard + fallback)
  *   - manual refresh() with a mocked ACME client
  *   - audit emission on issue / renew / renew-failed
- *   - key escrow (encrypt-to-recipient via b.crypto.encryptEnvelope)
+ *   - key escrow (encrypt-to-recipient via b.crypto.encrypt)
  *
  * The live ACME path against an external CA isn't exercised here
  * (no test CA shipped in the framework); the issue/renew flow is
@@ -106,6 +106,30 @@ async function _selfSignedCert(domains, validityDays) {
   return { keyPem: keyPem, certPem: cert.toString("pem") };
 }
 
+async function _selfSignedCertNoSan(cn, validityDays) {
+  // Like _selfSignedCert but with NO SubjectAlternativeName extension —
+  // so the parsed cert's subjectAltName is undefined, exercising the
+  // `cert.subjectAltName || null` fallback in the manager's _certMeta.
+  var pki = require("../../lib/vendor/pki.cjs");
+  var x509 = pki.x509;
+  var keys = await crypto.webcrypto.subtle.generateKey(
+    { name: "ECDSA", namedCurve: "P-256" }, true, ["sign", "verify"]);
+  var now = new Date();
+  var cert = await x509.X509CertificateGenerator.createSelfSigned({
+    serialNumber:     "02",
+    name:             "CN=" + cn,
+    notBefore:        now,
+    notAfter:         new Date(now.getTime() + validityDays * 24 * 3600 * 1000),
+    signingAlgorithm: { name: "ECDSA", hash: "SHA-256" },
+    keys:             keys,
+    extensions:       [],
+  });
+  var pkcs8 = await crypto.webcrypto.subtle.exportKey("pkcs8", keys.privateKey);
+  var pkB64 = Buffer.from(pkcs8).toString("base64").match(/.{1,64}/g).join("\n");
+  var keyPem = "-----BEGIN PRIVATE KEY-----\n" + pkB64 + "\n-----END PRIVATE KEY-----\n";
+  return { keyPem: keyPem, certPem: cert.toString("pem") };
+}
+
 function _mockAcmeClient(pem) {
   // Fulfills the b.acme.create contract the cert manager calls into.
   // Every method returns synchronously-resolved promises with the
@@ -505,10 +529,9 @@ async function testKeyEscrow() {
   var vault = _ephemeralVault();
   var pem = await _selfSignedCert(["example.com"], 90);
 
-  // Generate an X25519 recipient for the escrow envelope. b.crypto's
-  // encryptEnvelope accepts the recipient public key as bytes.
-  var recipient = crypto.generateKeyPairSync("x25519");
-  var recipientPubBytes = recipient.publicKey.export({ type: "spki", format: "der" });
+  // Offline break-glass recipient — an ML-KEM-1024 (+ P-384 hybrid)
+  // keypair. b.crypto.encrypt seals the escrowed key to its public keys.
+  var recipientKp = b.crypto.generateEncryptionKeyPair();
 
   // Seed a fake cert so start() doesn't try to ACME.
   fs.mkdirSync(path.join(tmp, "main"), { recursive: true });
@@ -527,7 +550,7 @@ async function testKeyEscrow() {
       name:      "main",
       domains:   ["example.com"],
       challenge: { type: "http-01", provision: async function () {}, cleanup: async function () {} },
-      keyEscrow: { recipient: recipientPubBytes },
+      keyEscrow: { recipient: { publicKey: recipientKp.publicKey, ecPublicKey: recipientKp.ecPublicKey } },
     }],
     audit: false,
   });
@@ -741,6 +764,803 @@ async function testCorruptAccountKeyClearError() {
   try { await mgr.stop(); } catch (_e) {}
 }
 
+// ---- Shared fixtures for the issue / renewal / OCSP branch tests ----
+
+var GOOD_CHALLENGE = { type: "http-01", provision: async function () {}, cleanup: async function () {} };
+
+// Patch the acme module's `create` so the manager's internal
+// `_bootAcme` (require("./acme").create) returns an injected stub
+// instead of building a live RFC 8555 client. Returns a restore fn —
+// ALWAYS call it in a finally so module state isn't polluted for the
+// next test file sharing the process. This is collaborator injection,
+// not a network call: the stub fulfils the same contract cert.js calls.
+function _stubAcmeCreate(client) {
+  var acmeMod = require("../../lib/acme");
+  var orig = acmeMod.create;
+  acmeMod.create = function () { return client; };
+  return function restore() { acmeMod.create = orig; };
+}
+
+// Patch b.network.tls.ocsp.fetch (the OCSP responder call the manager
+// composes for stapling). The ocsp object itself is frozen, so swap the
+// whole object on the (writable) module property, preserving every other
+// method. Same injection discipline as _stubAcmeCreate.
+function _stubOcspFetch(fn) {
+  var nt = require("../../lib/network-tls");
+  var origOcsp = nt.ocsp;
+  var patched = {};
+  Object.keys(origOcsp).forEach(function (k) { patched[k] = origOcsp[k]; });
+  patched.fetch = fn;
+  nt.ocsp = patched;
+  return function restore() { nt.ocsp = origOcsp; };
+}
+
+// A flexible ACME stub. `opts` toggles the adversarial shapes each
+// branch test needs (auth already valid, CA offers no matching
+// challenge, ARI throws, a later retrieveCert throws).
+function _makeStubAcme(pem, opts) {
+  opts = opts || {};
+  var retrieveCalls = 0;
+  return {
+    fetchDirectory:      async function () { return {}; },
+    newAccount:          async function () { return { url: "mock://acct" }; },
+    newOrder:            async function (o) {
+      return {
+        url:            "mock://order/1",
+        status:         "pending",
+        authorizations: o.identifiers.map(function (id, i) { return "mock://auth/" + i; }),
+        finalize:       "mock://order/1/finalize",
+      };
+    },
+    fetchAuthorization:  async function (u) {
+      if (opts.authValid) {
+        return { url: u, status: "valid", identifier: { type: "dns", value: "a.example" }, challenges: [] };
+      }
+      var chs = opts.omitChallengeType
+        ? [{ type: "dns-01", url: u + "/d", token: "t", status: "pending" }]
+        : [
+            { type: "http-01",     url: u + "/h", token: "t", status: "pending" },
+            { type: "dns-01",      url: u + "/d", token: "t", status: "pending" },
+            { type: "tls-alpn-01", url: u + "/a", token: "t", status: "pending" },
+          ];
+      return { url: u, status: "pending", identifier: { type: "dns", value: "a.example" }, challenges: chs };
+    },
+    notifyChallengeReady:      async function () { return {}; },
+    waitForAuthorization:      async function (u) { return { url: u, status: "valid" }; },
+    keyAuthorization:          function (t) { return t + ".thumb"; },
+    tlsAlpn01KeyAuthorization: function (t) { return t + ".alpn"; },
+    buildCsr:                  function () { return "-----BEGIN CERTIFICATE REQUEST-----\nMOCK\n-----END CERTIFICATE REQUEST-----"; },
+    finalize:                  async function () { return { url: "mock://order/1", status: "valid" }; },
+    retrieveCert:              async function () {
+      retrieveCalls += 1;
+      if (opts.failRetrieveAfter && retrieveCalls > opts.failRetrieveAfter) {
+        if (Object.prototype.hasOwnProperty.call(opts, "retrieveThrowValue")) throw opts.retrieveThrowValue;
+        throw new Error("mock retrieveCert failed (network down)");
+      }
+      return pem;
+    },
+    renewIfDue:                async function () {
+      if (opts.onRenewIfDue) opts.onRenewIfDue();
+      if (opts.renewIfDueThrows) throw new Error("mock ARI renewalInfo fetch failed");
+      return { shouldRenew: !!opts.renewIfDueShould };
+    },
+  };
+}
+
+// ---- _positiveFiniteOrDefault — every rejection + null-defaults path ----
+
+function testPositiveFiniteOptRejections() {
+  var threw = function (fn) { try { fn(); return null; } catch (e) { return e; } };
+  function mk(extra) {
+    var base = {
+      storage: { type: "sealed-disk", rootDir: _tmpDir(), vault: _ephemeralVault() },
+      acme:    { directory: "https://example/", accountKey: "auto" },
+      certs:   [{ name: "m", domains: ["a.com"], challenge: GOOD_CHALLENGE }],
+      audit:   false,
+    };
+    return Object.assign(base, extra);
+  }
+
+  // Non-number → throw (typeof branch).
+  var eStr = threw(function () { b.cert.create(mk({ renew: { intervalMs: "soon" } })); });
+  check("renew.intervalMs non-number → cert/bad-renew-interval", eStr && eStr.code === "cert/bad-renew-interval");
+
+  // Non-finite (Infinity / NaN) → throw (isFinite branch).
+  var eInf = threw(function () { b.cert.create(mk({ ocsp: { refreshMs: Infinity } })); });
+  check("ocsp.refreshMs Infinity → cert/bad-ocsp-refresh", eInf && eInf.code === "cert/bad-ocsp-refresh");
+  var eNaN = threw(function () { b.cert.create(mk({ renew: { minDaysBeforeExpiry: NaN } })); });
+  check("renew.minDaysBeforeExpiry NaN → cert/bad-renew-window", eNaN && eNaN.code === "cert/bad-renew-window");
+
+  // Zero / negative → throw (<= 0 branch).
+  var eZero = threw(function () { b.cert.create(mk({ renew: { intervalMs: 0 } })); });
+  check("renew.intervalMs 0 → cert/bad-renew-interval", eZero && eZero.code === "cert/bad-renew-interval");
+  var eNeg = threw(function () { b.cert.create(mk({ ocsp: { refreshMs: -5 } })); });
+  check("ocsp.refreshMs negative → cert/bad-ocsp-refresh", eNeg && eNeg.code === "cert/bad-ocsp-refresh");
+
+  // Explicit null → falls back to the default (no throw): exercises the
+  // `value === null` short-circuit at the top of _positiveFiniteOrDefault.
+  var eNull = threw(function () { b.cert.create(mk({ renew: { intervalMs: null, minDaysBeforeExpiry: null }, ocsp: { refreshMs: null } })); });
+  check("null interval/window/refresh → default (no throw)", !eNull);
+}
+
+// ---- Manifest size + per-cert shape rejections (uncovered guard rows) ----
+
+function testManifestSizeAndShapeRejections() {
+  var threw = function (fn) { try { fn(); return null; } catch (e) { return e; } };
+  function mk(certs, extraStorage) {
+    return {
+      storage: Object.assign({ type: "sealed-disk", rootDir: _tmpDir(), vault: _ephemeralVault() }, extraStorage || {}),
+      acme:    { directory: "https://example/", accountKey: "auto" },
+      certs:   certs,
+      audit:   false,
+    };
+  }
+
+  // certs array over the manager cap.
+  var tooMany = [];
+  for (var i = 0; i < 1001; i += 1) {
+    tooMany.push({ name: "c" + i, domains: ["a.com"], challenge: GOOD_CHALLENGE });
+  }
+  var eManyCerts = threw(function () { b.cert.create(mk(tooMany)); });
+  check("certs over cap → cert/too-many-certs", eManyCerts && eManyCerts.code === "cert/too-many-certs");
+
+  // domains array over the per-cert cap.
+  var manyDomains = [];
+  for (var d = 0; d < 101; d += 1) { manyDomains.push("d" + d + ".example"); }
+  var eManyDomains = threw(function () { b.cert.create(mk([{ name: "m", domains: manyDomains, challenge: GOOD_CHALLENGE }])); });
+  check("domains over cap → cert/too-many-domains", eManyDomains && eManyDomains.code === "cert/too-many-domains");
+
+  // A non-string / empty domain entry.
+  var eBadDomain = threw(function () { b.cert.create(mk([{ name: "m", domains: ["ok.example", 123], challenge: GOOD_CHALLENGE }])); });
+  check("non-string domain entry → cert/bad-domain", eBadDomain && eBadDomain.code === "cert/bad-domain");
+  var eEmptyDomain = threw(function () { b.cert.create(mk([{ name: "m", domains: [""], challenge: GOOD_CHALLENGE }])); });
+  check("empty-string domain entry → cert/bad-domain", eEmptyDomain && eEmptyDomain.code === "cert/bad-domain");
+
+  // Missing / non-object challenge block.
+  var eNoChallenge = threw(function () { b.cert.create(mk([{ name: "m", domains: ["a.com"] }])); });
+  check("missing challenge block → cert/bad-challenge", eNoChallenge && eNoChallenge.code === "cert/bad-challenge");
+
+  // challenge present but provision/cleanup not both functions.
+  var eBadCbs = threw(function () {
+    b.cert.create(mk([{ name: "m", domains: ["a.com"], challenge: { type: "http-01", provision: "nope", cleanup: function () {} } }]));
+  });
+  check("non-function challenge callbacks → cert/bad-challenge-callbacks", eBadCbs && eBadCbs.code === "cert/bad-challenge-callbacks");
+
+  // keyAlg outside the allowed set.
+  var eBadAlg = threw(function () {
+    b.cert.create(mk([{ name: "m", domains: ["a.com"], keyAlg: "ecdsa-p521", challenge: GOOD_CHALLENGE }]));
+  });
+  check("unsupported keyAlg → cert/bad-key-alg", eBadAlg && eBadAlg.code === "cert/bad-key-alg");
+
+  // keyEscrow present but recipient is neither Buffer nor string.
+  var eBadEscrow = threw(function () {
+    b.cert.create(mk([{ name: "m", domains: ["a.com"], challenge: GOOD_CHALLENGE, keyEscrow: { recipient: 123 } }]));
+  });
+  check("keyEscrow recipient wrong type → cert/bad-key-escrow", eBadEscrow && eBadEscrow.code === "cert/bad-key-escrow");
+
+  // storage.type omitted → the `|| "sealed-disk"` default is taken and
+  // create() succeeds (constructs without throwing).
+  var eNoType = threw(function () {
+    b.cert.create({
+      storage: { rootDir: _tmpDir(), vault: _ephemeralVault() },
+      acme:    { directory: "https://example/", accountKey: "auto" },
+      certs:   [{ name: "m", domains: ["a.com"], challenge: GOOD_CHALLENGE }],
+      audit:   false,
+    });
+  });
+  check("omitted storage.type → default sealed-disk (no throw)", !eNoType);
+
+  // storage.vault omitted → falls back to b.vault.getDefaultStore()
+  // (the `opts.vault || vault().getDefaultStore()` default in the
+  // storage factory). create() must still succeed.
+  var eNoVault = threw(function () {
+    b.cert.create({
+      storage: { type: "sealed-disk", rootDir: _tmpDir() },
+      acme:    { directory: "https://example/", accountKey: "auto" },
+      certs:   [{ name: "m", domains: ["a.com"], challenge: GOOD_CHALLENGE }],
+      audit:   false,
+    });
+  });
+  check("omitted storage.vault → default store (no throw)", !eNoVault);
+}
+
+// ---- getContext / refresh error branches ----
+
+function testGetContextAndRefreshErrors() {
+  var tmp = _tmpDir();
+  var mgr = b.cert.create({
+    storage: { type: "sealed-disk", rootDir: tmp, vault: _ephemeralVault() },
+    acme:    { directory: "https://example/", accountKey: "auto" },
+    certs:   [{ name: "main", domains: ["example.com"], challenge: GOOD_CHALLENGE }],
+    audit:   false,
+  });
+
+  var threw = function (fn) { try { fn(); return null; } catch (e) { return e; } };
+
+  // Unknown name (not in the manifest).
+  var eUnknown = threw(function () { mgr.getContext("nope"); });
+  check("getContext unknown name → cert/unknown-name", eUnknown && eUnknown.code === "cert/unknown-name");
+
+  // Declared but not yet loaded (start() never ran).
+  var eNotLoaded = threw(function () { mgr.getContext("main"); });
+  check("getContext before start → cert/not-loaded", eNotLoaded && eNotLoaded.code === "cert/not-loaded");
+
+  // refresh() on an unknown name.
+  var eRefresh = null;
+  return mgr.refresh("nope").then(
+    function () { check("refresh unknown name → should reject", false); },
+    function (e) { eRefresh = e; check("refresh unknown name → cert/unknown-name", eRefresh && eRefresh.code === "cert/unknown-name"); }
+  );
+}
+
+// ---- sniCallback error paths: no context + createSecureContext throw ----
+
+async function testSniCallbackErrorPaths() {
+  // (a) No certs loaded at all → cb(cert/no-context).
+  var tmp = _tmpDir();
+  var mgr = b.cert.create({
+    storage: { type: "sealed-disk", rootDir: tmp, vault: _ephemeralVault() },
+    acme:    { directory: "https://example/", accountKey: "auto" },
+    certs:   [{ name: "main", domains: ["example.com"], challenge: GOOD_CHALLENGE }],
+    audit:   false,
+  });
+  var noCtxErr = await new Promise(function (resolve) {
+    mgr.sniCallback("anything.example", function (err) { resolve(err); });
+  });
+  check("sniCallback with nothing loaded → cert/no-context",
+    noCtxErr && noCtxErr.code === "cert/no-context");
+
+  // (b) A loaded context whose KEY is garbage → tls.createSecureContext
+  // throws and the callback receives that error (the try/catch tail).
+  var tmp2 = _tmpDir();
+  var vault = _ephemeralVault();
+  var pem = await _selfSignedCert(["bad.example"], 90);
+  fs.mkdirSync(path.join(tmp2, "bad"), { recursive: true });
+  fs.writeFileSync(path.join(tmp2, "bad", "cert.pem.sealed"), vault.seal(Buffer.from(pem.certPem)));
+  // Valid cert (so _certMeta parses + the context loads) but an
+  // unparseable private key, so createSecureContext rejects the pair.
+  fs.writeFileSync(path.join(tmp2, "bad", "key.pem.sealed"), vault.seal(Buffer.from("-----BEGIN PRIVATE KEY-----\nnot-a-real-key\n-----END PRIVATE KEY-----\n")));
+  fs.writeFileSync(path.join(tmp2, "bad", "meta.json"), JSON.stringify({
+    expiresAt: Date.now() + 90 * 86400000, issuedAt: Date.now(),
+    fingerprintSha256: "bad", subject: "CN=bad.example",
+    lastRenewedAt: Date.now(), keyAlg: "ecdsa-p256",
+  }));
+  var mgr2 = b.cert.create({
+    storage: { type: "sealed-disk", rootDir: tmp2, vault: vault },
+    acme:    { directory: "https://example/", accountKey: "auto" },
+    certs:   [{ name: "bad", domains: ["bad.example"], challenge: GOOD_CHALLENGE }],
+    audit:   false,
+  });
+  await mgr2.start();
+  var secCtxErr = await new Promise(function (resolve) {
+    mgr2.sniCallback("bad.example", function (err) { resolve(err); });
+  });
+  check("sniCallback with unparseable key → createSecureContext error forwarded", secCtxErr instanceof Error);
+  await mgr2.stop();
+}
+
+// ---- start() after stop() is refused ----
+
+async function testStartAfterStopRejects() {
+  var tmp = _tmpDir();
+  var mgr = b.cert.create({
+    storage: { type: "sealed-disk", rootDir: tmp, vault: _ephemeralVault() },
+    acme:    { directory: "https://example/", accountKey: "auto" },
+    certs:   [{ name: "main", domains: ["example.com"], challenge: GOOD_CHALLENGE }],
+    audit:   false,
+  });
+  await mgr.stop();   // flips the stopped latch without ever starting
+  var threw = null;
+  try { await mgr.start(); } catch (e) { threw = e; }
+  check("start() after stop() → cert/already-stopped", threw && threw.code === "cert/already-stopped");
+}
+
+// ---- Full ACME issue flow via an injected stub (no network) ----
+
+async function testIssueFlowHappyPath() {
+  await helpers.withTestTimeout("cert issue keyAlg matrix", async function () {
+    var tmp = _tmpDir();
+    var vault = _ephemeralVault();
+    var pem = await _selfSignedCert(["issued.example"], 90);
+
+    // Pre-seed a VALID sealed account JWK so _loadOrGenerateAccountKey
+    // takes its read-existing branch (not the generate branch).
+    var acctPair = crypto.generateKeyPairSync("ec", { namedCurve: "P-256" });
+    var acctJwk = acctPair.publicKey.export({ format: "jwk" });
+    acctJwk.privatePem = acctPair.privateKey.export({ type: "pkcs8", format: "pem" });
+    acctJwk.publicPem  = acctPair.publicKey.export({ type: "spki", format: "pem" });
+    fs.mkdirSync(path.join(tmp, "account"), { recursive: true });
+    fs.writeFileSync(path.join(tmp, "account", "jwk.json.sealed"), vault.seal(Buffer.from(JSON.stringify(acctJwk))));
+
+    var issued = [];
+    var restore = _stubAcmeCreate(_makeStubAcme(pem.certPem));
+    var mgr = b.cert.create({
+      storage: { type: "sealed-disk", rootDir: tmp, vault: vault },
+      acme:    { directory: "https://example/", contactEmail: "ops@example.com", accountKey: "auto" },
+      // One cert per keyAlg so every _generateLeafKeypair switch arm runs.
+      // The tls-alpn-01 cert exercises the RFC 8737 key-authorization
+      // branch; the last cert's cleanup throws to exercise the
+      // cleanup-failure drop-silent audit inside _issueCert.
+      certs: [
+        { name: "ec256",  domains: ["ec256.example"],  keyAlg: "ecdsa-p256", challenge: GOOD_CHALLENGE },
+        { name: "ec384",  domains: ["ec384.example"],  keyAlg: "ecdsa-p384", challenge: GOOD_CHALLENGE },
+        { name: "rsa2k",  domains: ["rsa2k.example"],  keyAlg: "rsa-2048",   challenge: { type: "dns-01", provision: async function () {}, cleanup: async function () {} } },
+        // rsa3k's cleanup throws an Error with an EMPTY message (so
+        // `cleanupErr.message` is falsy); rsa4k's throws an Error with a
+        // message. Together they cover both arms of the cleanup-failure
+        // audit's `(cleanupErr && cleanupErr.message) || String(cleanupErr)`.
+        { name: "rsa3k",  domains: ["rsa3k.example"],  keyAlg: "rsa-3072",   challenge: { type: "tls-alpn-01", provision: async function () {}, cleanup: async function () { throw new Error(""); } } },
+        { name: "rsa4k",  domains: ["rsa4k.example"],  keyAlg: "rsa-4096",   challenge: { type: "http-01", provision: async function () {}, cleanup: async function () { throw new Error("cleanup boom"); } } },
+      ],
+      ocsp:  { stapling: false },
+      audit: false,
+    });
+    mgr.on("cert.issued", function (ev) { issued.push(ev.name); });
+    try {
+      await mgr.start();
+      ["ec256", "ec384", "rsa2k", "rsa3k", "rsa4k"].forEach(function (n) {
+        var ctx = mgr.getContext(n);
+        check("issue: " + n + " context has the retrieved cert PEM",
+          ctx.cert.indexOf("BEGIN CERTIFICATE") !== -1);
+        check("issue: " + n + " context has a fingerprint",
+          typeof ctx.fingerprintSha256 === "string" && ctx.fingerprintSha256.length > 0);
+        // meta.json was persisted to disk by _persistCert.
+        check("issue: " + n + " meta.json persisted",
+          fs.existsSync(path.join(tmp, n, "meta.json")));
+      });
+      check("issue: cert.issued fired for every manifest cert", issued.length === 5);
+    } finally {
+      await mgr.stop();
+      restore();
+    }
+  }, { timeoutMs: 120000 });
+}
+
+async function testIssueNoMatchingChallenge() {
+  var tmp = _tmpDir();
+  var vault = _ephemeralVault();
+  var pem = await _selfSignedCert(["nomatch.example"], 90);
+  var restore = _stubAcmeCreate(_makeStubAcme(pem.certPem, { omitChallengeType: true }));
+  var mgr = b.cert.create({
+    storage: { type: "sealed-disk", rootDir: tmp, vault: vault },
+    acme:    { directory: "https://example/", accountKey: "auto" },
+    // Requests http-01 but the stubbed CA only offers dns-01.
+    certs:   [{ name: "m", domains: ["nomatch.example"], challenge: GOOD_CHALLENGE }],
+    ocsp:    { stapling: false },
+    audit:   false,
+  });
+  var threw = null;
+  try { await mgr.start(); } catch (e) { threw = e; }
+  finally { await mgr.stop(); restore(); }
+  check("issue: CA offers no matching challenge → cert/no-matching-challenge",
+    threw && threw.code === "cert/no-matching-challenge");
+}
+
+async function testIssueValidAuthSkipsProvision() {
+  var tmp = _tmpDir();
+  var vault = _ephemeralVault();
+  var pem = await _selfSignedCert(["already.example"], 90);
+  var provisioned = false;
+  var restore = _stubAcmeCreate(_makeStubAcme(pem.certPem, { authValid: true }));
+  var mgr = b.cert.create({
+    storage: { type: "sealed-disk", rootDir: tmp, vault: vault },
+    // A provided accountKey object (not "auto") — exercises the
+    // else-arm of `accountKey === "auto" || !accountKey` in _bootAcme
+    // (the manager uses the supplied key rather than generating one).
+    acme:    { directory: "https://example/", accountKey: { privatePem: "PRIV", publicPem: "PUB" } },
+    certs:   [{ name: "m", domains: ["already.example"],
+      challenge: { type: "http-01", provision: async function () { provisioned = true; }, cleanup: async function () {} } }],
+    ocsp:    { stapling: false },
+    audit:   false,
+  });
+  try {
+    await mgr.start();
+    // The authorization was already `valid`, so the manager skipped the
+    // challenge solve entirely (the `continue`) and still finalized.
+    check("issue: already-valid authorization skips provision", provisioned === false);
+    check("issue: already-valid authorization still yields a context",
+      mgr.getContext("m").cert.indexOf("BEGIN CERTIFICATE") !== -1);
+  } finally { await mgr.stop(); restore(); }
+}
+
+// Key escrow seals the renewed private key to the operator's offline
+// break-glass recipient (an ML-KEM-1024 keypair from
+// b.crypto.generateEncryptionKeyPair) via b.crypto.encrypt, writing
+// <name>/key.pem.escrow. The operator recovers it offline with
+// b.crypto.decrypt. Issue #446 — the prior implementation called a
+// nonexistent b.crypto.encryptEnvelope and threw on the first issue.
+async function testKeyEscrowSealsRecoverableEnvelope() {
+  var tmp = _tmpDir();
+  var vault = _ephemeralVault();
+  var pem = await _selfSignedCert(["escrow.example"], 90);
+  var kp = b.crypto.generateEncryptionKeyPair();
+  var restore = _stubAcmeCreate(_makeStubAcme(pem.certPem));
+  var mgr = b.cert.create({
+    storage: { type: "sealed-disk", rootDir: tmp, vault: vault },
+    acme:    { directory: "https://example/", accountKey: "auto" },
+    certs:   [{ name: "m", domains: ["escrow.example"], challenge: GOOD_CHALLENGE,
+      keyEscrow: { recipient: { publicKey: kp.publicKey, ecPublicKey: kp.ecPublicKey } } }],
+    ocsp:    { stapling: false },
+    audit:   false,
+  });
+  var threw = null;
+  try { await mgr.start(); } catch (e) { threw = e; }
+  finally { await mgr.stop(); restore(); }
+  check("keyEscrow write path no longer throws", threw === null);
+
+  var escrowPath = path.join(tmp, "m", "key.pem.escrow");
+  check("keyEscrow: escrow envelope written to <name>/key.pem.escrow",
+    fs.existsSync(escrowPath));
+
+  // Break-glass recovery: the offline operator decrypts the escrow with
+  // the recipient private key(s) and gets a usable private-key PEM back.
+  var envelope = fs.readFileSync(escrowPath, "utf8").trim();
+  var recovered = b.crypto.decrypt(envelope,
+    { privateKey: kp.privateKey, ecPrivateKey: kp.ecPrivateKey });
+  var recoveredPem = Buffer.isBuffer(recovered) ? recovered.toString("utf8") : recovered;
+  check("keyEscrow: recovered plaintext is a PEM private key",
+    /-----BEGIN [A-Z ]*PRIVATE KEY-----/.test(recoveredPem));
+
+  // An unrecognized recipient shape is refused at config time.
+  var badThrew = null;
+  try {
+    b.cert.create({
+      storage: { type: "sealed-disk", rootDir: _tmpDir(), vault: _ephemeralVault() },
+      acme:    { directory: "https://example/", accountKey: "auto" },
+      certs:   [{ name: "b", domains: ["b.example"], challenge: GOOD_CHALLENGE,
+        keyEscrow: { recipient: 123 } }],
+    });
+  } catch (e) { badThrew = e; }
+  check("keyEscrow: non-string / non-object recipient refused at config time",
+    badThrew && badThrew.code === "cert/bad-key-escrow");
+
+  // An object-form recipient with an empty publicKey is refused too: the
+  // object path must require a non-empty key like the string path does, or a
+  // "" key slips through config and fails deeper at b.crypto.encrypt time.
+  var emptyKeyThrew = null;
+  try {
+    b.cert.create({
+      storage: { type: "sealed-disk", rootDir: _tmpDir(), vault: _ephemeralVault() },
+      acme:    { directory: "https://example/", accountKey: "auto" },
+      certs:   [{ name: "c", domains: ["c.example"], challenge: GOOD_CHALLENGE,
+        keyEscrow: { recipient: { publicKey: "" } } }],
+    });
+  } catch (e) { emptyKeyThrew = e; }
+  check("keyEscrow: object recipient with empty publicKey refused at config time",
+    emptyKeyThrew && emptyKeyThrew.code === "cert/bad-key-escrow");
+
+  // A present-but-empty ecPublicKey (the optional P-384 hybrid leg) is refused
+  // too — an empty hybrid key must not silently downgrade to ML-KEM-only.
+  var emptyEcThrew = null;
+  try {
+    b.cert.create({
+      storage: { type: "sealed-disk", rootDir: _tmpDir(), vault: _ephemeralVault() },
+      acme:    { directory: "https://example/", accountKey: "auto" },
+      certs:   [{ name: "d", domains: ["d.example"], challenge: GOOD_CHALLENGE,
+        keyEscrow: { recipient: { publicKey: "ml-kem-pem", ecPublicKey: "" } } }],
+    });
+  } catch (e) { emptyEcThrew = e; }
+  check("keyEscrow: object recipient with empty ecPublicKey refused at config time",
+    emptyEcThrew && emptyEcThrew.code === "cert/bad-key-escrow");
+}
+
+// ---- Corrupt sealed cert that unseals but won't parse → re-issue ----
+
+async function testUnparseableSealedCertReissues() {
+  var tmp = _tmpDir();
+  var vault = _ephemeralVault();
+  var keyPem = (await _selfSignedCert(["parse.example"], 90)).keyPem;
+  var pem = await _selfSignedCert(["parse.example"], 90);
+
+  fs.mkdirSync(path.join(tmp, "main"), { recursive: true });
+  // Sealed blob unseals cleanly (XOR vault) but the plaintext is NOT a
+  // certificate, so _certMeta's X509Certificate parse throws and the
+  // manager routes to re-issue (distinct from an unseal failure).
+  fs.writeFileSync(path.join(tmp, "main", "cert.pem.sealed"), vault.seal(Buffer.from("this is definitely not a certificate")));
+  fs.writeFileSync(path.join(tmp, "main", "key.pem.sealed"),  vault.seal(Buffer.from(keyPem)));
+  fs.writeFileSync(path.join(tmp, "main", "meta.json"), JSON.stringify({
+    expiresAt: Date.now() + 90 * 86400000, issuedAt: Date.now(),
+    fingerprintSha256: "ff", subject: "CN=parse.example",
+    lastRenewedAt: Date.now(), keyAlg: "ecdsa-p256",
+  }));
+
+  var restore = _stubAcmeCreate(_makeStubAcme(pem.certPem));
+  var mgr = b.cert.create({
+    storage: { type: "sealed-disk", rootDir: tmp, vault: vault },
+    acme:    { directory: "https://example/", accountKey: "auto" },
+    certs:   [{ name: "main", domains: ["parse.example"], challenge: GOOD_CHALLENGE }],
+    ocsp:    { stapling: false },
+    audit:   false,
+  });
+  try {
+    await mgr.start();
+    check("unparseable sealed cert → re-issued to a valid context",
+      mgr.getContext("main").cert.indexOf("BEGIN CERTIFICATE") !== -1);
+  } finally { await mgr.stop(); restore(); }
+}
+
+// ---- readSealed returns a non-Buffer (string) unseal result ----
+
+async function testReadSealedStringUnseal() {
+  // A vault whose unseal returns a STRING (not a Buffer) — exercises
+  // readSealed's `Buffer.isBuffer(plain) ? plain : Buffer.from(plain)`
+  // else-arm. PEM is ASCII so the utf8 round-trip is lossless.
+  var key = crypto.randomBytes(32);
+  var stringVault = {
+    seal: function (buf) {
+      var out = Buffer.alloc(buf.length);
+      for (var i = 0; i < buf.length; i++) out[i] = buf[i] ^ key[i % key.length];
+      return out;
+    },
+    unseal: function (buf) {
+      var out = Buffer.alloc(buf.length);
+      for (var i = 0; i < buf.length; i++) out[i] = buf[i] ^ key[i % key.length];
+      return out.toString("utf8");
+    },
+  };
+  var tmp = _tmpDir();
+  var pem = await _selfSignedCert(["strvault.example"], 90);
+  fs.mkdirSync(path.join(tmp, "main"), { recursive: true });
+  fs.writeFileSync(path.join(tmp, "main", "cert.pem.sealed"), stringVault.seal(Buffer.from(pem.certPem)));
+  fs.writeFileSync(path.join(tmp, "main", "key.pem.sealed"),  stringVault.seal(Buffer.from(pem.keyPem)));
+  fs.writeFileSync(path.join(tmp, "main", "meta.json"), JSON.stringify({
+    expiresAt: Date.now() + 90 * 86400000, issuedAt: Date.now(),
+    fingerprintSha256: "ff", subject: "CN=strvault.example",
+    lastRenewedAt: Date.now(), keyAlg: "ecdsa-p256",
+  }));
+  var mgr = b.cert.create({
+    storage: { type: "sealed-disk", rootDir: tmp, vault: stringVault },
+    acme:    { directory: "https://example/", accountKey: "auto" },
+    certs:   [{ name: "main", domains: ["strvault.example"], challenge: GOOD_CHALLENGE }],
+    ocsp:    { stapling: false },
+    audit:   false,
+  });
+  try {
+    await mgr.start();
+    check("readSealed string unseal → context still loads cert PEM",
+      mgr.getContext("main").cert.indexOf("BEGIN CERTIFICATE") !== -1);
+  } finally { await mgr.stop(); }
+}
+
+// ---- Renewal scheduler: due cert renews successfully (+ ARI honored) ----
+
+async function testSchedulerRenewsDueCert() {
+  await helpers.withTestTimeout("scheduler renews due cert", async function () {
+    var tmp = _tmpDir();
+    var vault = _ephemeralVault();
+    var pem = await _selfSignedCert(["renew.example"], 90);
+    var renewed = [];
+    var restore = _stubAcmeCreate(_makeStubAcme(pem.certPem));   // renewIfDue → { shouldRenew:false }
+    var mgr = b.cert.create({
+      storage: { type: "sealed-disk", rootDir: tmp, vault: vault },
+      acme:    { directory: "https://example/", accountKey: "auto" },
+      certs:   [{ name: "main", domains: ["renew.example"], challenge: GOOD_CHALLENGE }],
+      // A huge renewal window forces every scheduler tick to treat the
+      // cert as due; a short interval makes the tick fire promptly.
+      renew:   { intervalMs: 30, minDaysBeforeExpiry: 100000 },
+      ocsp:    { stapling: false },
+      audit:   false,
+    });
+    mgr.on("cert.renewed", function (ev) { renewed.push(ev.name); });
+    try {
+      await mgr.start();   // initial issue (cert.issued), boots acmeClient so ARI runs
+      await helpers.waitUntil(function () { return renewed.length >= 1; },
+        { timeoutMs: 5000, label: "scheduler: cert.renewed fired" });
+      check("scheduler renews a due cert (ARI honored, time-based renew)", renewed.length >= 1);
+    } finally { await mgr.stop(); restore(); }
+  });
+}
+
+// ---- Renewal scheduler: renew failure + ARI-fetch failure both survive ----
+
+async function testSchedulerRenewFailureAndAriCatch() {
+  await helpers.withTestTimeout("scheduler renew failure", async function () {
+    var tmp = _tmpDir();
+    var vault = _ephemeralVault();
+    var pem = await _selfSignedCert(["fail.example"], 90);
+    var failures = [];
+    // First retrieveCert (during start's issue) succeeds; every later one
+    // throws → the scheduled renewal fails. renewIfDue always throws →
+    // the ARI try/catch fall-through is exercised too.
+    var restore = _stubAcmeCreate(_makeStubAcme(pem.certPem, { failRetrieveAfter: 1, renewIfDueThrows: true }));
+    var mgr = b.cert.create({
+      storage: { type: "sealed-disk", rootDir: tmp, vault: vault },
+      acme:    { directory: "https://example/", accountKey: "auto" },
+      certs:   [{ name: "main", domains: ["fail.example"], challenge: GOOD_CHALLENGE }],
+      renew:   { intervalMs: 30, minDaysBeforeExpiry: 100000 },
+      ocsp:    { stapling: false },
+      audit:   false,
+    });
+    mgr.on("cert.renew-failed", function (ev) { failures.push(ev); });
+    try {
+      await mgr.start();   // succeeds (issue #1), meta persisted, acmeClient booted
+      await helpers.waitUntil(function () { return failures.length >= 1; },
+        { timeoutMs: 5000, label: "scheduler: cert.renew-failed fired" });
+      check("scheduler: failed renewal emits cert.renew-failed (ARI throw survived)",
+        failures.length >= 1 && failures[0].name === "main" && failures[0].error);
+    } finally { await mgr.stop(); restore(); }
+
+    // Second manager: the renewal failure carries an EMPTY message, so
+    // the renew-failed audit's `(e && e.message) || String(e)` takes its
+    // String(e) fallback arm.
+    var tmp2 = _tmpDir();
+    var pem2 = await _selfSignedCert(["fail2.example"], 90);
+    var failures2 = [];
+    var restore2 = _stubAcmeCreate(_makeStubAcme(pem2.certPem, { failRetrieveAfter: 1, retrieveThrowValue: new Error("") }));
+    var mgr2 = b.cert.create({
+      storage: { type: "sealed-disk", rootDir: tmp2, vault: _ephemeralVault() },
+      acme:    { directory: "https://example/", accountKey: "auto" },
+      certs:   [{ name: "main", domains: ["fail2.example"], challenge: GOOD_CHALLENGE }],
+      renew:   { intervalMs: 30, minDaysBeforeExpiry: 100000 },
+      ocsp:    { stapling: false },
+      audit:   false,
+    });
+    mgr2.on("cert.renew-failed", function (ev) { failures2.push(ev); });
+    try {
+      await mgr2.start();
+      await helpers.waitUntil(function () { return failures2.length >= 1; },
+        { timeoutMs: 5000, label: "scheduler: cert.renew-failed (non-Error) fired" });
+      check("scheduler: empty-message renewal failure still emits cert.renew-failed",
+        failures2.length >= 1 && failures2[0].error instanceof Error && failures2[0].error.message === "");
+    } finally { await mgr2.stop(); restore2(); }
+  });
+}
+
+// ---- OCSP stapling refresh: success (staple cached) + responder failure ----
+
+async function testOcspStaplingRefresh() {
+  await helpers.withTestTimeout("ocsp stapling refresh", async function () {
+    var vault = _ephemeralVault();
+    // A two-cert chain (leaf + issuer) so _refreshOcspFor gets past the
+    // "no issuer in the served chain" (chain.length < 2) short-circuit.
+    var leaf   = await _selfSignedCert(["ocsp.example"], 90);
+    var issuer = await _selfSignedCert(["issuer.example"], 90);
+    var chainPem = leaf.certPem.trim() + "\n" + issuer.certPem.trim() + "\n";
+
+    function seed(dir) {
+      fs.mkdirSync(path.join(dir, "main"), { recursive: true });
+      fs.writeFileSync(path.join(dir, "main", "cert.pem.sealed"), vault.seal(Buffer.from(chainPem)));
+      fs.writeFileSync(path.join(dir, "main", "key.pem.sealed"),  vault.seal(Buffer.from(leaf.keyPem)));
+      fs.writeFileSync(path.join(dir, "main", "meta.json"), JSON.stringify({
+        expiresAt: Date.now() + 90 * 86400000, issuedAt: Date.now(),
+        fingerprintSha256: "ff", subject: "CN=ocsp.example",
+        lastRenewedAt: Date.now(), keyAlg: "ecdsa-p256",
+      }));
+    }
+    function mk(dir) {
+      return b.cert.create({
+        storage: { type: "sealed-disk", rootDir: dir, vault: vault },
+        acme:    { directory: "https://example/", accountKey: "auto" },
+        certs:   [{ name: "main", domains: ["ocsp.example"], challenge: GOOD_CHALLENGE }],
+        ocsp:    { stapling: true, refreshMs: 100000 },
+        audit:   false,
+      });
+    }
+
+    // (a) Responder returns a DER — the manager caches it on the context.
+    var tmpA = _tmpDir();
+    seed(tmpA);
+    var restoreA = _stubOcspFetch(async function (o) {
+      check("ocsp.fetch received leaf + issuer PEMs",
+        typeof o.leafPem === "string" && typeof o.issuerPem === "string" && o.leafPem !== o.issuerPem);
+      return { ocspDer: Buffer.from("mock-ocsp-der") };
+    });
+    var mgrA = mk(tmpA);
+    try {
+      await mgrA.start();   // OCSP initial refresh runs in the background
+      var staple = await helpers.waitUntil(function () {
+        var r = mgrA.getContext("main").ocspResponse;
+        return r ? r : false;
+      }, { timeoutMs: 5000, label: "ocsp: staple cached on context" });
+      check("ocsp: validated DER cached on getContext().ocspResponse",
+        Buffer.isBuffer(staple) && staple.toString() === "mock-ocsp-der");
+    } finally { await mgrA.stop(); restoreA(); }
+
+    // (b) Responder throws — the failure is swallowed (fail-soft) and the
+    // staple stays absent; the manager does not crash.
+    var tmpB = _tmpDir();
+    seed(tmpB);
+    var fetchCalls = 0;
+    var restoreB = _stubOcspFetch(async function () {
+      fetchCalls += 1;
+      throw new Error("mock OCSP responder unreachable");
+    });
+    var mgrB = mk(tmpB);
+    try {
+      await mgrB.start();
+      await helpers.waitUntil(function () { return fetchCalls >= 1; },
+        { timeoutMs: 5000, label: "ocsp: responder invoked" });
+      check("ocsp: responder failure is fail-soft (no staple, no crash)",
+        mgrB.getContext("main").ocspResponse === null);
+    } finally { await mgrB.stop(); restoreB(); }
+
+    // (c) Responder throws an Error with an EMPTY message — the
+    // refresh-failed audit's `(e && e.message) || String(e)` takes its
+    // String(e) fallback arm.
+    var tmpC = _tmpDir();
+    seed(tmpC);
+    var fetchCallsC = 0;
+    var restoreC = _stubOcspFetch(async function () { fetchCallsC += 1; throw new Error(""); });
+    var mgrC = mk(tmpC);
+    try {
+      await mgrC.start();
+      await helpers.waitUntil(function () { return fetchCallsC >= 1; },
+        { timeoutMs: 5000, label: "ocsp: empty-message responder invoked" });
+      check("ocsp: empty-message responder failure is also fail-soft",
+        mgrC.getContext("main").ocspResponse === null);
+    } finally { await mgrC.stop(); restoreC(); }
+  });
+}
+
+// ---- _certMeta with a cert that carries no SubjectAlternativeName ----
+
+async function testCertMetaNoSubjectAltName() {
+  // A cert with no SAN extension → the parsed subjectAltName is
+  // undefined and _certMeta falls back to null (the `|| null` arm).
+  var tmp = _tmpDir();
+  var vault = _ephemeralVault();
+  var pem = await _selfSignedCertNoSan("nosan.example", 90);
+  fs.mkdirSync(path.join(tmp, "main"), { recursive: true });
+  fs.writeFileSync(path.join(tmp, "main", "cert.pem.sealed"), vault.seal(Buffer.from(pem.certPem)));
+  fs.writeFileSync(path.join(tmp, "main", "key.pem.sealed"),  vault.seal(Buffer.from(pem.keyPem)));
+  fs.writeFileSync(path.join(tmp, "main", "meta.json"), JSON.stringify({
+    expiresAt: Date.now() + 90 * 86400000, issuedAt: Date.now(),
+    fingerprintSha256: "ff", subject: "CN=nosan.example",
+    lastRenewedAt: Date.now(), keyAlg: "ecdsa-p256",
+  }));
+  var mgr = b.cert.create({
+    storage: { type: "sealed-disk", rootDir: tmp, vault: vault },
+    acme:    { directory: "https://example/", accountKey: "auto" },
+    certs:   [{ name: "main", domains: ["nosan.example"], challenge: GOOD_CHALLENGE }],
+    ocsp:    { stapling: false },
+    audit:   false,
+  });
+  try {
+    await mgr.start();   // _ensureCert → _certMeta parses the no-SAN cert
+    check("no-SAN cert still loads a usable context",
+      mgr.getContext("main").cert.indexOf("BEGIN CERTIFICATE") !== -1);
+  } finally { await mgr.stop(); }
+}
+
+// ---- Renewal scheduler ARI-decision arms with a not-yet-due cert ----
+
+async function testSchedulerAriDecisionArms() {
+  await helpers.withTestTimeout("scheduler ARI decision arms", async function () {
+    // A freshly-issued cert is comfortably inside its validity window, so
+    // the time-based test says "not due". With the ACME client booted,
+    // each tick still consults ARI. Two managers cover both ARI verdicts:
+    // one where ARI forces a renew (shouldRenew := true), and one where
+    // ARI declines and the tick returns early at `if (!shouldRenew)`.
+    async function runOne(ariSays, label) {
+      var tmp = _tmpDir();
+      var pem = await _selfSignedCert([label + ".example"], 90);
+      var ariCalls = 0;
+      var restore = _stubAcmeCreate(_makeStubAcme(pem.certPem, {
+        renewIfDueShould: ariSays,
+        onRenewIfDue: function () { ariCalls += 1; },
+      }));
+      var mgr = b.cert.create({
+        storage: { type: "sealed-disk", rootDir: tmp, vault: _ephemeralVault() },
+        acme:    { directory: "https://example/", accountKey: "auto" },
+        certs:   [{ name: "main", domains: [label + ".example"], challenge: GOOD_CHALLENGE }],
+        // Default-ish 14-day window so the fresh 90-day cert is NOT
+        // time-due; the ARI verdict is the only lever this tick.
+        renew:   { intervalMs: 30, minDaysBeforeExpiry: 14 },
+        ocsp:    { stapling: false },
+        audit:   false,
+      });
+      try {
+        await mgr.start();   // issues → boots acmeClient so the ARI branch runs
+        await helpers.waitUntil(function () { return ariCalls >= 1; },
+          { timeoutMs: 5000, label: "scheduler: renewIfDue consulted (" + label + ")" });
+        check("scheduler consults ARI on a not-yet-due cert (" + label + ")", ariCalls >= 1);
+      } finally { await mgr.stop(); restore(); }
+    }
+    await runOne(true,  "ariforce");   // ARI true  → shouldRenew := true arm
+    await runOne(false, "aridecline"); // ARI false → `if (!shouldRenew) return` arm
+  });
+}
+
 async function run() {
   testSurface();
   testFactoryRefusesBadOpts();
@@ -754,6 +1574,23 @@ async function run() {
   await testCorruptSealedCertReissues();
   await testStaleMetaDoesNotServeExpiringCert();
   await testCorruptAccountKeyClearError();
+  // Error / adversarial / option-default branch coverage.
+  testPositiveFiniteOptRejections();
+  testManifestSizeAndShapeRejections();
+  await testGetContextAndRefreshErrors();
+  await testSniCallbackErrorPaths();
+  await testStartAfterStopRejects();
+  await testIssueFlowHappyPath();
+  await testIssueNoMatchingChallenge();
+  await testIssueValidAuthSkipsProvision();
+  await testKeyEscrowSealsRecoverableEnvelope();
+  await testUnparseableSealedCertReissues();
+  await testReadSealedStringUnseal();
+  await testCertMetaNoSubjectAltName();
+  await testSchedulerRenewsDueCert();
+  await testSchedulerRenewFailureAndAriCatch();
+  await testSchedulerAriDecisionArms();
+  await testOcspStaplingRefresh();
 }
 
 module.exports = { run: run };