@imagina-build/ias-cli 0.0.0 → 0.1.0

package/shared/vault/vectors.mjs

@@ -0,0 +1,720 @@
+// The test vectors of the vault (vault/test-vectors, docs/technical/vault.md §8), shared by node:test, the PHP validation of the
+// server and the runner. ias-vault-1 (unsigned, only for the tests) is at the top of the folder and ias-vault-2 (signed
+// by the team) in test-vectors/ias-vault-2. Every random byte comes from a label, so they are the same on every machine:
+//   node packages/shared/vault/vectors.mjs   writes them again; the tests fail if the files differ from buildVectors().
+// The keys here are test keys, public on purpose: never use them for anything else.
+import { Buffer } from 'node:buffer';
+import { createHash, createPrivateKey, createPublicKey, diffieHellman, sign } from 'node:crypto';
+import { mkdirSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import process from 'node:process';
+import { fileURLToPath } from 'node:url';
+import {
+  FORMAT_1,
+  FORMAT_2,
+  LIMITS,
+  RUNNERS_FORMAT,
+  associatedData,
+  decode,
+  digest,
+  encode,
+  encodePlaintext,
+  open,
+  publicRecipient,
+  recipientFromPrivateKey,
+  removeRecipient,
+  rewrap,
+  runnerListText,
+  seal,
+  signRunnerList,
+  signedText,
+  signingKeyFromPrivateKey,
+  validateEnvelope,
+  validatePlaintext,
+  validateRunnerList,
+  verifyRunnerList,
+  wrapKey,
+  PLAINTEXT_TYPES,
+} from './index.mjs';
+import { approverVectors } from './approvers-vectors.mjs';
+
+export const VECTORS_DIR = join(dirname(fileURLToPath(import.meta.url)), 'test-vectors');
+
+/** `n` (≤ 32) bytes that depend only on `label` and the format. */
+const bytesOf = (format) => (label, n) => createHash('sha256').update(`${format} test vector\n${label}`, 'utf8').digest().subarray(0, n);
+const bytes = bytesOf(FORMAT_1);
+const bytes2 = bytesOf(FORMAT_2);
+
+/** A random source that hands out `values` in order, and fails if they run out or a size does not match. */
+export function queue(values) {
+  const pending = values.map((value) => (typeof value === 'string' ? decode(value) : value));
+  return (n) => {
+    const next = pending.shift();
+    if (!next || next.length !== n) throw new Error(`the vector expected ${next ? next.length : 'no more'} random bytes, not ${n}`);
+    return next;
+  };
+}
+
+/** The values a seal or a rewrap takes from its random source, labelled, in the order it takes them (docs/technical/vault.md §4). */
+export function randomOrder({ dataKey, dataIv, wraps }) {
+  return [...(dataKey ? [dataKey, dataIv] : []), ...wraps.flatMap((wrap) => [wrap.ephemeralPrivateKey, wrap.iv])];
+}
+
+const KEYS = [
+  ['recovery', 'recovery'],
+  ['runner-a', 'runner'],
+  ['runner-b', 'runner'],
+  ['outsider', 'runner'],
+];
+
+/** The recipient keys of both formats: the same four, made from ias-vault-1 labels. */
+function keys() {
+  return Object.fromEntries(KEYS.map(([name, kind]) => [name, recipientFromPrivateKey(encode(bytes(`key ${name}`, 32)), kind)]));
+}
+
+/** The team's signing key and another team's, which the server has never registered. */
+function signingKeys() {
+  return Object.fromEntries(['team', 'other-team'].map((name) => [name, signingKeyFromPrivateKey(encode(bytes2(`signing key ${name}`, 32)))]));
+}
+
+/** The X25519 secret and wrap key of a wrap, worked out here again from the raw keys, for other implementations. */
+function intermediate(wrap, ephemeralPrivateKey, recipientPublicKey, credential, format) {
+  const privateKey = createPrivateKey({ key: Buffer.concat([Buffer.from('302e020100300506032b656e04220420', 'hex'), decode(ephemeralPrivateKey)]), format: 'der', type: 'pkcs8' });
+  const publicKey = createPublicKey({ key: Buffer.concat([Buffer.from('302a300506032b656e032100', 'hex'), decode(recipientPublicKey)]), format: 'der', type: 'spki' });
+  const shared = diffieHellman({ privateKey, publicKey });
+  return {
+    kid: wrap.kid,
+    ephemeralPrivateKey,
+    iv: wrap.iv,
+    sharedSecret: encode(shared),
+    hkdfSalt: encode(Buffer.concat([decode(wrap.epk), decode(recipientPublicKey)])),
+    wrapKey: encode(wrapKey(shared, decode(wrap.epk), decode(recipientPublicKey), format)),
+    aad: associatedData(credential, wrap.kid, format).toString('utf8'),
+  };
+}
+
+/** What each test key gets from an envelope: the plaintext, or the code of the error. */
+function outcomes(envelope, all, openOptions) {
+  return Object.fromEntries(
+    Object.entries(all).map(([name, key]) => {
+      try {
+        return [name, { plaintext: encode(open(envelope, key.privateKey, openOptions)) }];
+      } catch (error) {
+        return [name, { error: error.code }];
+      }
+    }),
+  );
+}
+
+const ALPHABET = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_';
+
+/** The same bytes in non-canonical base64url: the lowest bit of the last character, which no byte uses, set. */
+const strayBit = (text) => `${text.slice(0, -1)}${ALPHABET[ALPHABET.indexOf(text.at(-1)) | 1]}`;
+
+/** Copies `envelope` and lets `change` alter the copy. */
+const altered = (envelope, change) => {
+  const copy = structuredClone(envelope);
+  change(copy);
+  return copy;
+};
+
+/** base64url text with one bit of its byte at `index` (the last one by default) flipped. */
+const flip = (text, index = -1) => {
+  const raw = decode(text);
+  raw[(raw.length + index) % raw.length] ^= 1;
+  return encode(raw);
+};
+
+// =====================================================================================================================
+// ias-vault-1 (test-vectors/*.json). Unchanged since 20 Oct 2026: the tests prove the files still come out the same.
+
+const V1 = { formats: [FORMAT_1] };
+
+function sealed(all) {
+  const cases = [
+    {
+      name: 'text-for-recovery-and-runner-a',
+      description: 'A UTF-8 plaintext sealed for the recovery key and runner-a.',
+      credential: { id: '0d5e6c9a-4b8f-4c1e-9a3d-2f7b8e1c6a40', type: 'ios-distribution-certificate', version: 1 },
+      plaintext: Buffer.from('ias-vault-1 test vector: not a real secret', 'utf8'),
+      recipients: ['recovery', 'runner-a'],
+    },
+    {
+      name: 'binary-for-recovery',
+      description: 'Every byte value once, sealed for the recovery key only, as version 3 of another credential.',
+      credential: { id: 'android-upload-key', type: 'android-keystore', version: 3 },
+      plaintext: Buffer.from(Array.from({ length: 256 }, (_, index) => index)),
+      recipients: ['recovery'],
+    },
+    {
+      name: 'same-credential-other-data-key',
+      description: 'The credential of the first case sealed again with another data key, for runner-a and the recovery key. Its runner-a wrap is the one moved in tampered.json (wrap-of-other-envelope).',
+      credential: { id: '0d5e6c9a-4b8f-4c1e-9a3d-2f7b8e1c6a40', type: 'ios-distribution-certificate', version: 1 },
+      plaintext: Buffer.from('ias-vault-1 test vector: another plaintext', 'utf8'),
+      recipients: ['runner-a', 'recovery'],
+    },
+  ];
+  return cases.map(({ name, description, credential, plaintext, recipients }) => {
+    const random = {
+      dataKey: encode(bytes(`${name} data key`, 32)),
+      dataIv: encode(bytes(`${name} data iv`, 12)),
+      wraps: recipients.map((recipient) => ({ ephemeralPrivateKey: encode(bytes(`${name} ephemeral ${recipient}`, 32)), iv: encode(bytes(`${name} wrap iv ${recipient}`, 12)) })),
+    };
+    const envelope = seal(plaintext, { format: FORMAT_1, credential, recipients: recipients.map((recipient) => publicRecipient(all[recipient])), random: queue(randomOrder(random)) });
+    return {
+      name,
+      description,
+      plaintext: encode(plaintext),
+      credential,
+      recipients,
+      random,
+      aad: associatedData(credential, undefined, FORMAT_1).toString('utf8'),
+      wraps: envelope.recipients.map((wrap, index) => intermediate(wrap, random.wraps[index].ephemeralPrivateKey, all[recipients[index]].publicKey, credential, FORMAT_1)),
+      envelope,
+      digest: digest(envelope, V1),
+      opens: outcomes(envelope, all, V1),
+    };
+  });
+}
+
+function changes(sealedCases, all) {
+  const [first] = sealedCases;
+  const grantRandom = { wraps: [{ ephemeralPrivateKey: encode(bytes('grant ephemeral runner-b', 32)), iv: encode(bytes('grant wrap iv runner-b', 12)) }] };
+  const granted = rewrap(first.envelope, all.recovery.privateKey, [publicRecipient(all['runner-b']), publicRecipient(all['runner-a'])], { ...V1, random: queue(randomOrder(grantRandom)) });
+  const revoked = removeRecipient(granted, all['runner-a'].kid, V1);
+  return [
+    {
+      name: 'grant-runner-b',
+      description: 'ias vault grant: the recovery key opens the first case and wraps its data key for runner-b. runner-a is already a recipient and keeps its wrap.',
+      operation: 'rewrap',
+      from: first.name,
+      opener: 'recovery',
+      add: ['runner-b', 'runner-a'],
+      random: grantRandom,
+      wraps: [intermediate(granted.recipients[2], grantRandom.wraps[0].ephemeralPrivateKey, all['runner-b'].publicKey, first.credential, FORMAT_1)],
+      envelope: granted,
+      digest: digest(granted, V1),
+      opens: outcomes(granted, all, V1),
+    },
+    {
+      name: 'revoke-runner-a',
+      description: 'Revoking runner-a removes its wrap from the previous case; the data and the other wraps do not change.',
+      operation: 'remove',
+      from: 'grant-runner-b',
+      remove: 'runner-a',
+      envelope: revoked,
+      digest: digest(revoked, V1),
+      opens: outcomes(revoked, all, V1),
+    },
+  ];
+}
+
+function malformed(base) {
+  const wrap = base.recipients[0];
+  const cases = [
+    ['not-json', 'json', 'The text is not JSON.', { json: '{"format":"ias-vault-1",' }],
+    ['array', 'envelope', 'A JSON array instead of an object.', { envelope: [base] }],
+    ['null', 'envelope', 'JSON null.', { envelope: null }],
+    ['missing-recipients', 'envelope.fields', 'No recipients field.', { envelope: altered(base, (e) => delete e.recipients) }],
+    ['extra-field', 'envelope.fields', 'A field the format does not have (metadata goes beside the envelope, never inside).', { envelope: altered(base, (e) => (e.metadata = { team: 'ABCDE12345' })) }],
+    ['other-format', 'format', 'A format this version does not know.', { envelope: altered(base, (e) => (e.format = 'ias-vault-2')) }],
+    ['credential-string', 'credential', 'The credential is a string.', { envelope: altered(base, (e) => (e.credential = e.credential.id)) }],
+    ['credential-extra-field', 'credential', 'The credential has a field besides id, type and version.', { envelope: altered(base, (e) => (e.credential.application = 'jscheduler')) }],
+    ['credential-id-empty', 'credential.id', 'An empty credential id.', { envelope: altered(base, (e) => (e.credential.id = '')) }],
+    ['credential-id-newline', 'credential.id', 'A newline in the credential id, which would let it forge the associated data.', { envelope: altered(base, (e) => (e.credential.id = `${e.credential.id}\nwrap`)) }],
+    ['credential-id-too-long', 'credential.id', 'A credential id of 129 characters.', { envelope: altered(base, (e) => (e.credential.id = 'a'.repeat(129))) }],
+    ['credential-type-uppercase', 'credential.type', 'Upper case in the type.', { envelope: altered(base, (e) => (e.credential.type = 'iOS-distribution-certificate')) }],
+    ['credential-version-zero', 'credential.version', 'Version 0.', { envelope: altered(base, (e) => (e.credential.version = 0)) }],
+    ['credential-version-string', 'credential.version', 'The version as a string.', { envelope: altered(base, (e) => (e.credential.version = '1')) }],
+    ['credential-version-fraction', 'credential.version', 'A fractional version.', { envelope: altered(base, (e) => (e.credential.version = 1.5)) }],
+    ['credential-version-too-big', 'credential.version', 'A version above 2147483647.', { envelope: altered(base, (e) => (e.credential.version = LIMITS.version + 1)) }],
+    ['data-tag-field', 'data', 'The tag apart: in ias-vault-1 it is the last 16 bytes of ct.', { envelope: altered(base, (e) => (e.data.tag = encode(decode(e.data.ct).subarray(-16)))) }],
+    ['data-iv-16-bytes', 'data.iv', 'A 16-byte IV.', { envelope: altered(base, (e) => (e.data.iv = encode(bytes('iv 16', 16)))) }],
+    ['data-iv-padded', 'data.iv', 'Padding (=) after the base64url.', { envelope: altered(base, (e) => (e.data.iv = `${e.data.iv}=`)) }],
+    ['data-iv-standard-base64', 'data.iv', 'Standard base64 (+ and /) instead of base64url.', { envelope: altered(base, (e) => (e.data.iv = '+/+/+/+/+/+/+/+/')) }],
+    ['data-ct-tag-only', 'data.ct', 'Only 16 bytes: a tag with no ciphertext (the plaintext is never empty).', { envelope: altered(base, (e) => (e.data.ct = encode(decode(e.data.ct).subarray(-16)))) }],
+    ['recipients-empty', 'recipients', 'No recipients.', { envelope: altered(base, (e) => (e.recipients = [])) }],
+    ['recipients-object', 'recipients', 'Recipients as an object keyed by kid.', { envelope: altered(base, (e) => (e.recipients = Object.fromEntries(e.recipients.map((r) => [r.kid, r])))) }],
+    ['recipients-too-many', 'recipients', `${LIMITS.recipients + 1} recipients.`, { envelope: altered(base, (e) => (e.recipients = Array.from({ length: LIMITS.recipients + 1 }, (_, index) => ({ ...wrap, kid: encode(bytes(`kid ${index}`, 32)) })))) }],
+    ['recipient-missing-iv', 'recipient', 'A wrap without iv.', { envelope: altered(base, (e) => delete e.recipients[1].iv) }],
+    ['recipient-kind-field', 'recipient', 'A wrap that says what kind of recipient it is: the server knows that from the kid, the envelope does not carry it.', { envelope: altered(base, (e) => (e.recipients[0].kind = 'recovery')) }],
+    ['recipient-kid-31-bytes', 'recipient.kid', 'A 31-byte kid.', { envelope: altered(base, (e) => (e.recipients[0].kid = encode(decode(e.recipients[0].kid).subarray(1)))) }],
+    ['recipient-kid-hex', 'recipient.kid', 'The kid in hex instead of base64url.', { envelope: altered(base, (e) => (e.recipients[0].kid = decode(e.recipients[0].kid).toString('hex'))) }],
+    ['recipient-kid-stray-bits', 'recipient.kid', 'Non-canonical base64url: the last character of the 43 carries a bit beyond the 32 bytes it encodes, so two texts would give the same kid.', { envelope: altered(base, (e) => (e.recipients[0].kid = strayBit(e.recipients[0].kid))) }],
+    ['recipient-epk-33-bytes', 'recipient.epk', 'A 33-byte ephemeral key.', { envelope: altered(base, (e) => (e.recipients[1].epk = encode(Buffer.concat([decode(e.recipients[1].epk), Buffer.from([0])])))) }],
+    ['recipient-iv-empty', 'recipient.iv', 'An empty wrap IV.', { envelope: altered(base, (e) => (e.recipients[1].iv = '')) }],
+    ['recipient-wk-without-tag', 'recipient.wk', 'The wrapped key without its 16-byte tag (32 bytes instead of 48).', { envelope: altered(base, (e) => (e.recipients[1].wk = encode(decode(e.recipients[1].wk).subarray(0, 32)))) }],
+    ['recipient-duplicate', 'recipient.duplicate', 'The same kid twice.', { envelope: altered(base, (e) => e.recipients.push(structuredClone(e.recipients[1]))) }],
+  ];
+  return cases.map(([name, code, description, value]) => {
+    const result = validateEnvelope('json' in value ? value.json : value.envelope, V1);
+    if (result.valid || result.code !== code) throw new Error(`malformed vector ${name} gives ${result.valid ? 'valid' : result.code}, not ${code}`);
+    return { name, code, description, ...value };
+  });
+}
+
+function tampered(sealedCases, changed, all) {
+  const [first, , other] = sealedCases;
+  const base = first.envelope;
+  const runnerA = all['runner-a'].kid;
+  const fromOther = other.envelope.recipients.find((wrap) => wrap.kid === runnerA);
+  const fromOtherCredential = sealedCases[1].envelope.recipients[0];
+  const cases = [
+    ['ciphertext-bit', 'One bit of the first byte of data.ct flipped.', 'decrypt-failed', altered(base, (e) => (e.data.ct = flip(e.data.ct, 0)))],
+    ['tag-bit', 'One bit of the tag (the last byte of data.ct) flipped.', 'decrypt-failed', altered(base, (e) => (e.data.ct = flip(e.data.ct)))],
+    ['data-iv', 'Another data IV.', 'decrypt-failed', altered(base, (e) => (e.data.iv = encode(bytes('tampered data iv', 12))))],
+    ['ciphertext-of-other-envelope', 'The data of the other envelope of the same credential, under the wraps of this one.', 'decrypt-failed', altered(base, (e) => (e.data = structuredClone(other.envelope.data)))],
+    ['credential-version', 'The version raised from 1 to 2: every wrap was made for version 1.', 'unwrap-failed', altered(base, (e) => (e.credential.version = 2))],
+    ['credential-id', 'Another credential id.', 'unwrap-failed', altered(base, (e) => (e.credential.id = 'ffffffff-4b8f-4c1e-9a3d-2f7b8e1c6a40'))],
+    ['credential-type', 'Another credential type.', 'unwrap-failed', altered(base, (e) => (e.credential.type = 'ios-provisioning-profile'))],
+    ['kids-swapped', 'The kids of the recovery and runner-a wraps exchanged: runner-a finds the recovery wrap under its kid.', 'unwrap-failed', altered(base, (e) => ([e.recipients[0].kid, e.recipients[1].kid] = [e.recipients[1].kid, e.recipients[0].kid]))],
+    ['wrap-of-other-recipient', 'The recovery wrap copied under the kid of runner-a, in place of its own.', 'unwrap-failed', altered(base, (e) => (e.recipients[1] = { ...e.recipients[0], kid: runnerA }))],
+    ['wrap-of-other-credential', 'A recovery wrap of another credential, put under runner-a.', 'unwrap-failed', altered(base, (e) => (e.recipients[1] = { ...fromOtherCredential, kid: runnerA }))],
+    ['wrap-of-other-envelope', 'The runner-a wrap of another envelope of the same credential in place of its own: it opens, but its data key does not open this data.', 'decrypt-failed', altered(base, (e) => (e.recipients[1] = structuredClone(fromOther)))],
+    ['wrapped-key-bit', 'One bit of the runner-a wrapped key flipped.', 'unwrap-failed', altered(base, (e) => (e.recipients[1].wk = flip(e.recipients[1].wk)))],
+    ['wrap-iv', 'Another IV in the runner-a wrap.', 'unwrap-failed', altered(base, (e) => (e.recipients[1].iv = encode(bytes('tampered wrap iv', 12))))],
+    ['ephemeral-key', 'Another (valid) ephemeral public key in the runner-a wrap.', 'unwrap-failed', altered(base, (e) => (e.recipients[1].epk = all.outsider.publicKey))],
+    ['ephemeral-key-zero', 'An all-zero ephemeral key in the runner-a wrap: a low-order point whose X25519 secret is zero.', 'unwrap-failed', altered(base, (e) => (e.recipients[1].epk = encode(Buffer.alloc(32))))],
+    ['runner-a-removed', 'The runner-a wrap removed.', 'not-a-recipient', altered(base, (e) => (e.recipients = e.recipients.filter((wrap) => wrap.kid !== runnerA)))],
+  ];
+  const result = cases.map(([name, description, error, envelope]) => ({ name, description, key: 'runner-a', error, envelope }));
+  result.push({ name: 'outsider', description: 'A valid envelope opened with a key that is not a recipient.', key: 'outsider', error: 'not-a-recipient', envelope: base });
+  result.push({ name: 'revoked-runner-a', description: 'runner-a after its revocation (sealed.json, revoke-runner-a).', key: 'runner-a', error: 'not-a-recipient', envelope: changed[1].envelope });
+  result.push({ name: 'recovery-after-version-change', description: 'The recovery key also refuses the envelope whose version was raised.', key: 'recovery', error: 'unwrap-failed', envelope: result.find((entry) => entry.name === 'credential-version').envelope });
+  for (const entry of result) {
+    const shape = validateEnvelope(entry.envelope, V1);
+    if (!shape.valid) throw new Error(`tampered vector ${entry.name} is not well formed: ${shape.code}`);
+    try {
+      open(entry.envelope, all[entry.key].privateKey, V1);
+      throw new Error(`tampered vector ${entry.name} opens`);
+    } catch (error) {
+      if (error.code !== entry.error) throw new Error(`tampered vector ${entry.name} fails with ${error.code ?? error.message}, not ${entry.error}`);
+    }
+  }
+  return result;
+}
+
+function vectors1(all) {
+  const sealedCases = sealed(all);
+  const changed = changes(sealedCases, all);
+  const header = (description) => ({ format: FORMAT_1, description, warning: 'Test vectors: the keys are public. Never use them for anything else.' });
+  return {
+    'keys.json': {
+      ...header('The test recipients. kid is the base64url SHA-256 of the raw 32-byte public key; privateKey is the raw 32-byte X25519 private key in base64url.'),
+      keys: all,
+    },
+    'sealed.json': {
+      ...header('Envelopes made with injected randomness: an implementation must produce the same envelope from the same inputs, and every key in keys.json must get the outcome in opens. changes are a grant (rewrap) and a revocation on top of the first case.'),
+      cases: sealedCases,
+      changes: changed,
+    },
+    'malformed.json': {
+      ...header('Envelopes the server must reject before storing them: each one breaks one rule of docs/technical/vault.md §5, and code is the first problem found. A case has json (text to parse) or envelope (a parsed value).'),
+      base: 'sealed.json, text-for-recovery-and-runner-a',
+      cases: malformed(sealedCases[0].envelope),
+    },
+    'tampered.json': {
+      ...header('Well-formed envelopes that were altered: the server accepts their shape (it cannot tell), and opening them with key must fail with error.'),
+      base: 'sealed.json, text-for-recovery-and-runner-a',
+      cases: tampered(sealedCases, changed, all),
+    },
+  };
+}
+
+// =====================================================================================================================
+// ias-vault-2 (test-vectors/ias-vault-2/*.json): signed by the team.
+
+/** Fake files: bytes from a label, never real material. */
+const fakeFile = (label, n = 32) => Buffer.concat([Buffer.from(`not a real ${label}: `, 'utf8'), bytes2(`file ${label}`, Math.min(n, 32))]);
+
+/** A fake .p8: a PEM block around fake bytes, as the file would look. */
+const fakeP8 = (label) => Buffer.from(`-----BEGIN PRIVATE KEY-----\n${bytes2(`p8 ${label}`, 32).toString('base64')}\n-----END PRIVATE KEY-----\n`, 'utf8');
+
+/** One plaintext of each type, as `ias credentials import` and `ias env set` write them. Files are fake. */
+const PLAINTEXT_EXAMPLES = {
+  apple_distribution_certificate: { p12: fakeFile('p12'), password: 'not-a-real-p12-password' },
+  apple_provisioning_profile: { application: 'jscheduler', mobileprovision: fakeFile('mobileprovision') },
+  android_upload_keystore: { application: 'jscheduler', keystore: fakeFile('keystore'), store_password: 'not-a-real-store-password', key_alias: 'upload', key_password: 'not-a-real-key-password' },
+  apns_key: { p8: fakeP8('apns'), key_id: 'ABCDE12345', team_id: 'CF798UCN8C' },
+  asc_api_key: { p8: fakeP8('asc'), key_id: 'FGHIJ67890', issuer_id: '6a1b2c3d-4e5f-4a6b-8c7d-9e0f1a2b3c4d' },
+  google_service_account: { application: 'jscheduler', json: Buffer.from('{"type":"service_account","project_id":"not-a-real-project"}\n', 'utf8') },
+  environment_variable: { application: 'jscheduler', environment: 'production', name: 'SENTRY_AUTH_TOKEN', value: 'not-a-real-sentry-token' },
+};
+
+const content = (plaintext) => JSON.parse(plaintext.toString('utf8'));
+
+function sealed2(all, signing) {
+  const cases = [
+    {
+      name: 'keystore-for-recovery-and-runner-a',
+      description: 'An upload keystore of jscheduler (fake), sealed for the recovery key and runner-a and signed by the team.',
+      credential: { id: '00000000-0000-4000-8000-00000000e001', type: 'android_upload_keystore', version: 1 },
+      plaintext: encodePlaintext('android_upload_keystore', PLAINTEXT_EXAMPLES.android_upload_keystore),
+      recipients: ['recovery', 'runner-a'],
+    },
+    {
+      name: 'variable-for-recovery',
+      description: 'A secret environment variable (fake), sealed for the recovery key only, as ias env set does while there are no runners.',
+      credential: { id: '00000000-0000-4000-8000-00000000f002', type: 'environment_variable', version: 1 },
+      plaintext: encodePlaintext('environment_variable', PLAINTEXT_EXAMPLES.environment_variable),
+      recipients: ['recovery'],
+    },
+    {
+      name: 'certificate-version-2-for-three',
+      description: 'Version 2 of a distribution certificate of the team (fake), for the recovery key, runner-a and runner-b.',
+      credential: { id: '00000000-0000-4000-8000-00000000e010', type: 'apple_distribution_certificate', version: 2 },
+      plaintext: encodePlaintext('apple_distribution_certificate', PLAINTEXT_EXAMPLES.apple_distribution_certificate),
+      recipients: ['recovery', 'runner-a', 'runner-b'],
+    },
+    {
+      name: 'same-credential-other-data-key',
+      description: 'The credential of the first case sealed again with another data key, for runner-a and the recovery key. tampered.json moves its pieces into the first case.',
+      credential: { id: '00000000-0000-4000-8000-00000000e001', type: 'android_upload_keystore', version: 1 },
+      plaintext: encodePlaintext('android_upload_keystore', { ...PLAINTEXT_EXAMPLES.android_upload_keystore, keystore: fakeFile('other keystore') }),
+      recipients: ['runner-a', 'recovery'],
+    },
+  ];
+  const opening = { signedBy: signing.team.publicKey };
+  return cases.map(({ name, description, credential, plaintext, recipients }) => {
+    const random = {
+      dataKey: encode(bytes2(`${name} data key`, 32)),
+      dataIv: encode(bytes2(`${name} data iv`, 12)),
+      wraps: recipients.map((recipient) => ({ ephemeralPrivateKey: encode(bytes2(`${name} ephemeral ${recipient}`, 32)), iv: encode(bytes2(`${name} wrap iv ${recipient}`, 12)) })),
+    };
+    const envelope = seal(plaintext, { credential, recipients: recipients.map((recipient) => publicRecipient(all[recipient])), signingKey: signing.team.privateKey, random: queue(randomOrder(random)) });
+    return {
+      name,
+      description,
+      plaintext: encode(plaintext),
+      content: content(plaintext),
+      credential,
+      recipients,
+      signer: 'team',
+      random,
+      aad: associatedData(credential).toString('utf8'),
+      wraps: envelope.recipients.map((wrap, index) => intermediate(wrap, random.wraps[index].ephemeralPrivateKey, all[recipients[index]].publicKey, credential, FORMAT_2)),
+      signedText: signedText(envelope, signing.team.kid).toString('utf8'),
+      envelope,
+      digest: digest(envelope),
+      opens: outcomes(envelope, all, opening),
+    };
+  });
+}
+
+function changes2(sealedCases, all, signing) {
+  const [first] = sealedCases;
+  const opening = { signedBy: signing.team.publicKey };
+  const grantRandom = { wraps: [{ ephemeralPrivateKey: encode(bytes2('grant ephemeral runner-b', 32)), iv: encode(bytes2('grant wrap iv runner-b', 12)) }] };
+  const granted = rewrap(first.envelope, all.recovery.privateKey, [publicRecipient(all['runner-b']), publicRecipient(all['runner-a'])], { signingKey: signing.team.privateKey, random: queue(randomOrder(grantRandom)) });
+  const revoked = removeRecipient(granted, all['runner-a'].kid, { signingKey: signing.team.privateKey });
+  return [
+    {
+      name: 'grant-runner-b',
+      description: 'ias vault grant: the recovery key opens the first case, wraps its data key for runner-b and the team signs the envelope again. runner-a is already a recipient and keeps its wrap.',
+      operation: 'rewrap',
+      from: first.name,
+      opener: 'recovery',
+      add: ['runner-b', 'runner-a'],
+      signer: 'team',
+      random: grantRandom,
+      wraps: [intermediate(granted.recipients[2], grantRandom.wraps[0].ephemeralPrivateKey, all['runner-b'].publicKey, first.credential, FORMAT_2)],
+      signedText: signedText(granted, signing.team.kid).toString('utf8'),
+      envelope: granted,
+      digest: digest(granted),
+      opens: outcomes(granted, all, opening),
+    },
+    {
+      name: 'revoke-runner-a',
+      description: 'ias vault revoke: the wrap of runner-a removed from the previous case and the envelope signed again. The data and the other wraps do not change; the signature does.',
+      operation: 'remove',
+      from: 'grant-runner-b',
+      remove: 'runner-a',
+      signer: 'team',
+      signedText: signedText(revoked, signing.team.kid).toString('utf8'),
+      envelope: revoked,
+      digest: digest(revoked),
+      opens: outcomes(revoked, all, opening),
+    },
+  ];
+}
+
+/** `envelope` signed again with `key` (another team's key, or the team's after a change), its kid as `kid`. */
+function resigned(envelope, key, kid = key.kid) {
+  const { signature, ...rest } = envelope;
+  return { ...rest, signature: { kid, sig: signWith(key, signedText(rest, kid)) } };
+}
+
+/** An Ed25519 signature of `text` with `key`, whatever it signs: what an insider, or a bug, could sign. */
+function signWith(key, text) {
+  const object = createPrivateKey({ key: Buffer.concat([Buffer.from('302e020100300506032b657004220420', 'hex'), decode(key.privateKey)]), format: 'der', type: 'pkcs8' });
+  return encode(sign(null, text, object));
+}
+
+function malformed2(sealedCases, v1Envelope, all, signing) {
+  const base = sealedCases[0].envelope;
+  const wrap = base.recipients[0];
+  const forRunnerOnly = seal(encodePlaintext('google_service_account', PLAINTEXT_EXAMPLES.google_service_account), {
+    credential: { id: '00000000-0000-4000-8000-00000000e020', type: 'google_service_account', version: 1 },
+    recipients: [publicRecipient(all['runner-a'])],
+    signingKey: signing.team.privateKey,
+    random: queue([bytes2('runner only data key', 32), bytes2('runner only data iv', 12), bytes2('runner only ephemeral', 32), bytes2('runner only wrap iv', 12)]),
+  });
+  const team = signing.team.kid;
+  const required = { requiredKids: [all.recovery.kid] };
+  const cases = [
+    ['not-json', 'json', 'The text is not JSON.', { json: '{"format":"ias-vault-2",' }],
+    ['array', 'envelope', 'A JSON array instead of an object.', { envelope: [base] }],
+    ['null', 'envelope', 'JSON null.', { envelope: null }],
+    ['v1-envelope', 'format', 'A well-formed ias-vault-1 envelope (../sealed.json, text-for-recovery-and-runner-a): unsigned, so the server does not take it.', { envelope: v1Envelope }],
+    ['stripped-to-v1', 'format', 'The first case with its signature removed and its format turned into ias-vault-1, to pass as unsigned. It would not open as ias-vault-1 either: every derivation starts with the format.', { envelope: altered(base, (e) => { e.format = FORMAT_1; delete e.signature; }) }],
+    ['unknown-format', 'format', 'A format nobody knows yet.', { envelope: altered(base, (e) => (e.format = 'ias-vault-3')) }],
+    ['missing-signature', 'envelope.fields', 'No signature: an ias-vault-2 envelope always carries the team\'s.', { envelope: altered(base, (e) => delete e.signature) }],
+    ['missing-recipients', 'envelope.fields', 'No recipients field.', { envelope: altered(base, (e) => delete e.recipients) }],
+    ['extra-field', 'envelope.fields', 'A field the format does not have (metadata goes beside the envelope, never inside).', { envelope: altered(base, (e) => (e.metadata = { alias: 'upload' })) }],
+    ['credential-extra-field', 'credential', 'The credential has a field besides id, type and version.', { envelope: altered(base, (e) => (e.credential.application = 'jscheduler')) }],
+    ['credential-id-newline', 'credential.id', 'A newline in the credential id, which would let it forge the associated data and the signed text.', { envelope: altered(base, (e) => (e.credential.id = `${e.credential.id}\nwrap`)) }],
+    ['credential-type-hyphen', 'credential.type', 'The type with hyphens, as in ias-vault-1: in ias-vault-2 it is the name of the management API, with underscores.', { envelope: altered(base, (e) => (e.credential.type = 'android-upload-keystore')) }],
+    ['credential-type-uppercase', 'credential.type', 'Upper case in the type.', { envelope: altered(base, (e) => (e.credential.type = 'Android_upload_keystore')) }],
+    ['credential-version-zero', 'credential.version', 'Version 0.', { envelope: altered(base, (e) => (e.credential.version = 0)) }],
+    ['credential-version-string', 'credential.version', 'The version as a string.', { envelope: altered(base, (e) => (e.credential.version = '1')) }],
+    ['credential-version-fraction', 'credential.version', 'A fractional version.', { envelope: altered(base, (e) => (e.credential.version = 1.5)) }],
+    ['data-tag-field', 'data', 'The tag apart: it is the last 16 bytes of ct.', { envelope: altered(base, (e) => (e.data.tag = encode(decode(e.data.ct).subarray(-16)))) }],
+    ['data-iv-padded', 'data.iv', 'Padding (=) after the base64url.', { envelope: altered(base, (e) => (e.data.iv = `${e.data.iv}=`)) }],
+    ['data-ct-tag-only', 'data.ct', 'Only 16 bytes: a tag with no ciphertext.', { envelope: altered(base, (e) => (e.data.ct = encode(decode(e.data.ct).subarray(-16)))) }],
+    ['recipients-empty', 'recipients', 'No recipients.', { envelope: altered(base, (e) => (e.recipients = [])) }],
+    ['recipients-too-many', 'recipients', `${LIMITS.recipients + 1} recipients.`, { envelope: altered(base, (e) => (e.recipients = Array.from({ length: LIMITS.recipients + 1 }, (_, index) => ({ ...wrap, kid: encode(bytes2(`kid ${index}`, 32)) })))) }],
+    ['recipient-kind-field', 'recipient', 'A wrap that says what kind of recipient it is.', { envelope: altered(base, (e) => (e.recipients[0].kind = 'recovery')) }],
+    ['recipient-kid-stray-bits', 'recipient.kid', 'Non-canonical base64url in a kid.', { envelope: altered(base, (e) => (e.recipients[0].kid = strayBit(e.recipients[0].kid))) }],
+    ['recipient-wk-without-tag', 'recipient.wk', 'The wrapped key without its 16-byte tag.', { envelope: altered(base, (e) => (e.recipients[1].wk = encode(decode(e.recipients[1].wk).subarray(0, 32)))) }],
+    ['recipient-duplicate', 'recipient.duplicate', 'The same kid twice.', { envelope: altered(base, (e) => e.recipients.push(structuredClone(e.recipients[1]))) }],
+    ['signature-null', 'signature', 'The signature is null.', { envelope: altered(base, (e) => (e.signature = null)) }],
+    ['signature-string', 'signature', 'The signature as a bare string, without its kid.', { envelope: altered(base, (e) => (e.signature = e.signature.sig)) }],
+    ['signature-array', 'signature', 'The signature as a list.', { envelope: altered(base, (e) => (e.signature = [e.signature])) }],
+    ['signature-extra-field', 'signature', 'A field besides kid and sig: the algorithm is always Ed25519, it is not said.', { envelope: altered(base, (e) => (e.signature.alg = 'Ed25519')) }],
+    ['signature-missing-kid', 'signature', 'A signature without its kid.', { envelope: altered(base, (e) => delete e.signature.kid) }],
+    ['signature-kid-31-bytes', 'signature.kid', 'A 31-byte signing kid.', { envelope: altered(base, (e) => (e.signature.kid = encode(decode(e.signature.kid).subarray(1)))) }],
+    ['signature-kid-padded', 'signature.kid', 'Padding (=) after the signing kid.', { envelope: altered(base, (e) => (e.signature.kid = `${e.signature.kid}=`)) }],
+    ['signature-sig-empty', 'signature.sig', 'An empty signature.', { envelope: altered(base, (e) => (e.signature.sig = '')) }],
+    ['signature-sig-63-bytes', 'signature.sig', 'A signature of 63 bytes instead of 64.', { envelope: altered(base, (e) => (e.signature.sig = encode(decode(e.signature.sig).subarray(1)))) }],
+    ['signature-sig-65-bytes', 'signature.sig', 'A signature of 65 bytes instead of 64.', { envelope: altered(base, (e) => (e.signature.sig = encode(Buffer.concat([decode(e.signature.sig), Buffer.from([0])])))) }],
+    ['signature-sig-stray-bits', 'signature.sig', 'Non-canonical base64url: the last of the 86 characters carries bits beyond the 64 bytes.', { envelope: altered(base, (e) => (e.signature.sig = strayBit(e.signature.sig))) }],
+    ['signature-sig-standard-base64', 'signature.sig', 'The signature in standard base64, with + and / and padding.', { envelope: altered(base, (e) => (e.signature.sig = decode(e.signature.sig).toString('base64'))) }],
+    ['signature-sig-hex', 'signature.sig', 'The signature in hex (128 characters) instead of base64url.', { envelope: altered(base, (e) => (e.signature.sig = decode(e.signature.sig).toString('hex'))) }],
+    ['recovery-key-missing', 'recipient.missing', 'A well-signed envelope sealed for runner-a only: the server requires the recovery key (options.requiredKids), or nobody could grant it to another runner. The API answers recovery_key_missing.', { envelope: forRunnerOnly, options: required }],
+    ['signed-by-another-key', 'signature.unknown', 'The first case signed, correctly, by another team\'s key (other-team) with its own kid. The server takes only its registered key (options.signingKid) and the API answers signature_key_unknown; the runner refuses it the same way, with the key it pinned.', { envelope: resigned(base, signing['other-team']), options: { signingKid: team } }],
+    ['signature-kid-of-a-recipient', 'signature.unknown', 'The kid of the signature replaced by the recovery key\'s kid: a recipient kid is not a signing key.', { envelope: altered(base, (e) => (e.signature.kid = all.recovery.kid)), options: { signingKid: team } }],
+  ];
+  return cases.map(([name, code, description, value]) => {
+    const result = validateEnvelope('json' in value ? value.json : value.envelope, value.options ?? {});
+    if (result.valid || result.code !== code) throw new Error(`malformed vector ${name} gives ${result.valid ? 'valid' : result.code}, not ${code}`);
+    return { name, code, description, ...value };
+  });
+}
+
+function tampered2(sealedCases, changed, all, signing) {
+  const [first, , , other] = sealedCases;
+  const base = first.envelope;
+  const runnerA = all['runner-a'].kid;
+  const fromOther = other.envelope.recipients.find((wrap) => wrap.kid === runnerA);
+  const team = signing.team;
+  /** Altered, then signed again by the team: the signature verifies and the encryption still refuses it. */
+  const teamSigned = (envelope) => resigned(envelope, team);
+  const bySomeoneElse = seal(encodePlaintext('android_upload_keystore', { ...PLAINTEXT_EXAMPLES.android_upload_keystore, keystore: fakeFile('keystore of an attacker') }), {
+    credential: first.credential,
+    recipients: [publicRecipient(all.recovery), publicRecipient(all['runner-a'])],
+    signingKey: signing['other-team'].privateKey,
+    random: queue([bytes2('attacker data key', 32), bytes2('attacker data iv', 12), bytes2('attacker ephemeral recovery', 32), bytes2('attacker wrap iv recovery', 12), bytes2('attacker ephemeral runner-a', 32), bytes2('attacker wrap iv runner-a', 12)]),
+  });
+  const unsigned = 'signature-invalid';
+  const cases = [
+    ['ciphertext-bit', 'One bit of the first byte of data.ct flipped.', 'runner-a', unsigned, altered(base, (e) => (e.data.ct = flip(e.data.ct, 0)))],
+    ['tag-bit', 'One bit of the tag (the last byte of data.ct) flipped.', 'runner-a', unsigned, altered(base, (e) => (e.data.ct = flip(e.data.ct)))],
+    ['data-iv', 'Another data IV.', 'runner-a', unsigned, altered(base, (e) => (e.data.iv = encode(bytes2('tampered data iv', 12))))],
+    ['ciphertext-of-other-envelope', 'The data of the other envelope of the same credential, under the wraps of this one.', 'runner-a', unsigned, altered(base, (e) => (e.data = structuredClone(other.envelope.data)))],
+    ['credential-version', 'The version raised from 1 to 2.', 'runner-a', unsigned, altered(base, (e) => (e.credential.version = 2))],
+    ['credential-id', 'Another credential id.', 'runner-a', unsigned, altered(base, (e) => (e.credential.id = '00000000-0000-4000-8000-0000000000ff'))],
+    ['credential-type', 'Another credential type.', 'runner-a', unsigned, altered(base, (e) => (e.credential.type = 'google_service_account'))],
+    ['kids-swapped', 'The kids of the recovery and runner-a wraps exchanged.', 'runner-a', unsigned, altered(base, (e) => ([e.recipients[0].kid, e.recipients[1].kid] = [e.recipients[1].kid, e.recipients[0].kid]))],
+    ['wraps-reordered', 'The two wraps, intact, in the other order: each still opens for its key, but the signature covers the order of the list.', 'runner-a', unsigned, altered(base, (e) => e.recipients.reverse())],
+    ['wrap-of-other-recipient', 'The recovery wrap copied under the kid of runner-a, in place of its own.', 'runner-a', unsigned, altered(base, (e) => (e.recipients[1] = { ...e.recipients[0], kid: runnerA }))],
+    ['wrap-of-other-envelope', 'The runner-a wrap of another envelope of the same credential in place of its own.', 'runner-a', unsigned, altered(base, (e) => (e.recipients[1] = structuredClone(fromOther)))],
+    ['wrapped-key-bit', 'One bit of the runner-a wrapped key flipped.', 'runner-a', unsigned, altered(base, (e) => (e.recipients[1].wk = flip(e.recipients[1].wk)))],
+    ['wrap-iv', 'Another IV in the runner-a wrap.', 'runner-a', unsigned, altered(base, (e) => (e.recipients[1].iv = encode(bytes2('tampered wrap iv', 12))))],
+    ['ephemeral-key', 'Another (valid) ephemeral public key in the runner-a wrap.', 'runner-a', unsigned, altered(base, (e) => (e.recipients[1].epk = all.outsider.publicKey))],
+    ['wrap-removed-by-the-server', 'The runner-a wrap removed without signing again, as a server would do it: the recovery key no longer trusts the envelope. Removing a wrap is ias vault revoke, which signs again (sealed.json, revoke-runner-a).', 'recovery', unsigned, altered(base, (e) => (e.recipients = e.recipients.filter((wrap) => wrap.kid !== runnerA)))],
+    ['wrap-added-by-the-server', 'A wrap for outsider added without signing (a copy of runner-a\'s under its kid), as a server that wanted to grant itself would do: the signature no longer verifies.', 'outsider', unsigned, altered(base, (e) => e.recipients.push({ ...e.recipients[1], kid: all.outsider.kid }))],
+    ['signature-bit', 'One bit of the signature flipped.', 'runner-a', unsigned, altered(base, (e) => (e.signature.sig = flip(e.signature.sig, 0)))],
+    ['signature-of-other-envelope', 'The signature of the other envelope of the same credential.', 'runner-a', unsigned, altered(base, (e) => (e.signature = structuredClone(other.envelope.signature)))],
+    ['forged-under-the-team-kid', 'The first case signed by another key but with the kid of the team: the server sees its registered kid and takes it; the runner checks the signature and refuses it.', 'runner-a', unsigned, resigned(base, signing['other-team'], team.kid)],
+    ['sealed-by-someone-else', 'docs/technical/vault.md §11: someone with the public keys (a compromised server) seals its own keystore for the recovery key and runner-a, under the id of the first case, and signs it with its own key under the team\'s kid. Well formed, sealed for registered keys, the registered signing kid: only the runner\'s check of the signature stops it.', 'runner-a', unsigned, { ...bySomeoneElse, signature: { kid: team.kid, sig: bySomeoneElse.signature.sig } }],
+    ['signed-again-after-version-change', 'The version raised and the envelope signed again by the team (a bug, or the team key in the wrong hands): the signature verifies, and every wrap still refuses another version.', 'runner-a', 'unwrap-failed', teamSigned(altered(base, (e) => (e.credential.version = 2)))],
+    ['signed-again-after-ciphertext-bit', 'One bit of data.ct flipped and the envelope signed again by the team: the data does not authenticate.', 'runner-a', 'decrypt-failed', teamSigned(altered(base, (e) => (e.data.ct = flip(e.data.ct, 0))))],
+    ['signed-again-with-wrap-of-other-envelope', 'The runner-a wrap of another envelope, signed again by the team: it opens, but its data key does not open this data.', 'runner-a', 'decrypt-failed', teamSigned(altered(base, (e) => (e.recipients[1] = structuredClone(fromOther))))],
+    ['signed-again-with-kids-swapped', 'The kids of the two wraps exchanged and signed again by the team.', 'runner-a', 'unwrap-failed', teamSigned(altered(base, (e) => ([e.recipients[0].kid, e.recipients[1].kid] = [e.recipients[1].kid, e.recipients[0].kid])))],
+    ['signed-again-with-ephemeral-key-zero', 'An all-zero ephemeral key in the runner-a wrap, signed again by the team.', 'runner-a', 'unwrap-failed', teamSigned(altered(base, (e) => (e.recipients[1].epk = encode(Buffer.alloc(32)))))],
+  ];
+  const result = cases.map(([name, description, key, error, envelope]) => ({ name, description, key, error, envelope }));
+  result.push({ name: 'outsider', description: 'A valid envelope opened with a key that is not a recipient.', key: 'outsider', error: 'not-a-recipient', envelope: base });
+  result.push({ name: 'revoked-runner-a', description: 'runner-a after its revocation (sealed.json, revoke-runner-a).', key: 'runner-a', error: 'not-a-recipient', envelope: changed[1].envelope });
+  const server = { requiredKids: [all.recovery.kid], signingKid: team.kid };
+  for (const entry of result) {
+    const shape = validateEnvelope(entry.envelope, server);
+    if (!shape.valid) throw new Error(`tampered vector ${entry.name} is not well formed: ${shape.code}`);
+    try {
+      open(entry.envelope, all[entry.key].privateKey, { signedBy: team.publicKey });
+      throw new Error(`tampered vector ${entry.name} opens`);
+    } catch (error) {
+      if (error.code !== entry.error) throw new Error(`tampered vector ${entry.name} fails with ${error.code ?? error.message}, not ${entry.error}`);
+    }
+  }
+  return result;
+}
+
+function runnerLists(all, signing) {
+  const team = signing.team;
+  const listOf = (serial, names) => signRunnerList({ serial, runners: names.map((name) => publicRecipient(all[name])) }, team.privateKey);
+  const steps = [
+    ['first-runner', 'runner-a is authorised: the first list.', 1, ['runner-a']],
+    ['second-runner', 'runner-b is authorised too.', 2, ['runner-a', 'runner-b']],
+    ['runner-a-revoked', 'runner-a is revoked: the list goes on without it, with a higher serial.', 3, ['runner-b']],
+    ['empty', 'Every runner revoked: an empty list is still signed.', 4, []],
+  ];
+  const lists = steps.map(([name, description, serial, names]) => {
+    const list = listOf(serial, names);
+    return { name, description, runners: names, signedText: runnerListText(list, team.kid).toString('utf8'), list, verified: verifyRunnerList(list, team.publicKey) };
+  });
+  const base = lists[1].list;
+  const malformedCases = [
+    ['array', 'runners', 'A list instead of an object.', [base]],
+    ['other-format', 'runners.format', 'Another format.', altered(base, (l) => (l.format = 'ias-vault-1/runners'))],
+    ['missing-signature', 'runners.fields', 'No signature.', altered(base, (l) => delete l.signature)],
+    ['extra-field', 'runners.fields', 'A field besides format, serial, runners and signature.', altered(base, (l) => (l.issued_at = '2026-10-21T10:00:00+00:00'))],
+    ['serial-zero', 'runners.serial', 'Serial 0.', altered(base, (l) => (l.serial = 0))],
+    ['serial-string', 'runners.serial', 'The serial as a string.', altered(base, (l) => (l.serial = '2'))],
+    ['runners-object', 'runners.list', 'The runners as an object keyed by kid.', altered(base, (l) => (l.runners = Object.fromEntries(l.runners.map((r) => [r.kid, r]))))],
+    ['runner-name-field', 'runner', 'A runner with a name: names are the server\'s, the list is only keys.', altered(base, (l) => (l.runners[0].name = 'Mac mini'))],
+    ['runner-kid-padded', 'runner.kid', 'Padding after a kid.', altered(base, (l) => (l.runners[0].kid = `${l.runners[0].kid}=`))],
+    ['runner-public-key-31-bytes', 'runner.public_key', 'A 31-byte public key.', altered(base, (l) => (l.runners[0].public_key = encode(decode(l.runners[0].public_key).subarray(1))))],
+    ['runner-kid-of-other-key', 'runner.key', 'The kid of runner-b beside the public key of runner-a.', altered(base, (l) => (l.runners[0].kid = l.runners[1].kid))],
+    ['runner-duplicate', 'runner.duplicate', 'The same runner twice.', altered(base, (l) => l.runners.push(structuredClone(l.runners[0])))],
+    ['signature-sig-63-bytes', 'signature.sig', 'A 63-byte signature.', altered(base, (l) => (l.signature.sig = encode(decode(l.signature.sig).subarray(1))))],
+    ['signed-by-another-key', 'signature.unknown', 'The list signed by another team\'s key with its own kid (options.signingKid is the team\'s).', signRunnerList({ serial: 2, runners: [publicRecipient(all['runner-a']), publicRecipient(all.outsider)] }, signing['other-team'].privateKey), { signingKid: team.kid }],
+  ].map(([name, code, description, list, options]) => {
+    const result = validateRunnerList(list, options ?? {});
+    if (result.valid || result.code !== code) throw new Error(`malformed runner list ${name} gives ${result.valid ? 'valid' : result.code}, not ${code}`);
+    return { name, code, description, list, ...(options ? { options } : {}) };
+  });
+  const tamperedCases = [
+    ['runner-added-by-the-server', 'outsider added by the server without signing: the CLI must never seal for it.', altered(base, (l) => l.runners.push({ kid: all.outsider.kid, public_key: all.outsider.publicKey }))],
+    ['runner-removed-without-signing', 'runner-b removed without signing.', altered(base, (l) => l.runners.pop())],
+    ['serial-raised', 'The serial raised without signing.', altered(base, (l) => (l.serial = 9))],
+    ['runners-reordered', 'The two runners in the other order.', altered(base, (l) => l.runners.reverse())],
+    ['forged-under-the-team-kid', 'The list with outsider signed by another key under the team\'s kid.', (() => {
+      const forged = signRunnerList({ serial: 3, runners: [publicRecipient(all['runner-a']), publicRecipient(all.outsider)] }, signing['other-team'].privateKey);
+      return { ...forged, signature: { kid: team.kid, sig: forged.signature.sig } };
+    })()],
+  ].map(([name, description, list]) => {
+    if (!validateRunnerList(list, { signingKid: team.kid }).valid) throw new Error(`tampered runner list ${name} is not well formed`);
+    try {
+      verifyRunnerList(list, team.publicKey);
+      throw new Error(`tampered runner list ${name} verifies`);
+    } catch (error) {
+      if (error.code !== 'signature-invalid') throw new Error(`tampered runner list ${name} fails with ${error.code ?? error.message}`);
+    }
+    return { name, description, error: 'signature-invalid', list };
+  });
+  return { lists, malformed: malformedCases, tampered: tamperedCases };
+}
+
+function plaintexts() {
+  const good = Object.entries(PLAINTEXT_EXAMPLES).map(([type, fields]) => {
+    const plaintext = encodePlaintext(type, fields);
+    return { type, scope: PLAINTEXT_TYPES[type].scope, text: plaintext.toString('utf8'), plaintext: encode(plaintext) };
+  });
+  const keystore = JSON.parse(good.find((entry) => entry.type === 'android_upload_keystore').text);
+  const variable = JSON.parse(good.find((entry) => entry.type === 'environment_variable').text);
+  const asc = JSON.parse(good.find((entry) => entry.type === 'asc_api_key').text);
+  const text = (value) => JSON.stringify(value);
+  const bad = [
+    ['not-json', 'android_upload_keystore', 'plaintext.json', 'Not JSON.', { text: '{"type":"android_upload_keystore",' }],
+    ['not-utf-8', 'android_upload_keystore', 'plaintext.json', 'Bytes that are not UTF-8.', { plaintext: encode(Buffer.from([0x7b, 0xff, 0x7d])) }],
+    ['array', 'android_upload_keystore', 'plaintext.json', 'A JSON list.', { text: text([keystore]) }],
+    ['missing-field', 'android_upload_keystore', 'plaintext.fields', 'Without key_password.', { text: text({ ...keystore, key_password: undefined }) }],
+    ['extra-field', 'android_upload_keystore', 'plaintext.fields', 'A field the type does not have.', { text: text({ ...keystore, sha256: 'AA' }) }],
+    ['other-type', 'android_upload_keystore', 'plaintext.type', 'The fields of a keystore under another type field.', { text: text({ ...keystore, type: 'apple_provisioning_profile' }) }],
+    ['file-empty', 'android_upload_keystore', 'plaintext.keystore', 'An empty keystore.', { text: text({ ...keystore, keystore: '' }) }],
+    ['file-standard-base64', 'android_upload_keystore', 'plaintext.keystore', 'The keystore in standard base64 with padding.', { text: text({ ...keystore, keystore: Buffer.from(keystore.keystore, 'base64url').toString('base64') }) }],
+    ['password-number', 'android_upload_keystore', 'plaintext.store_password', 'A password that is a number.', { text: text({ ...keystore, store_password: 123456 }) }],
+    ['application-uppercase', 'android_upload_keystore', 'plaintext.application', 'An application code in capitals.', { text: text({ ...keystore, application: 'jScheduler' }) }],
+    ['variable-expo-public', 'environment_variable', 'plaintext.name', 'An EXPO_PUBLIC_ variable: those are always plain, never sealed.', { text: text({ ...variable, name: 'EXPO_PUBLIC_API_KEY' }) }],
+    ['variable-environment', 'environment_variable', 'plaintext.environment', 'An environment that is not one of the three.', { text: text({ ...variable, environment: 'staging' }) }],
+    ['asc-issuer', 'asc_api_key', 'plaintext.issuer_id', 'An issuer id that is not a UUID.', { text: text({ ...asc, issuer_id: 'not-a-uuid' }) }],
+    ['unknown-type', 'build_secret', 'plaintext.type', 'A type without a plaintext.', { text: text({ type: 'build_secret', value: 'x' }) }],
+  ].map(([name, type, code, description, value]) => {
+    const raw = 'text' in value ? Buffer.from(value.text, 'utf8') : decode(value.plaintext);
+    const result = validatePlaintext(type, raw);
+    if (result.valid || result.code !== code) throw new Error(`bad plaintext ${name} gives ${result.valid ? 'valid' : result.code}, not ${code}`);
+    return { name, type, code, description, ...value };
+  });
+  return { good, bad };
+}
+
+function vectors2(all) {
+  const signing = signingKeys();
+  const sealedCases = sealed2(all, signing);
+  const changed = changes2(sealedCases, all, signing);
+  const v1Envelope = sealed(all)[0].envelope;
+  const header = (description) => ({ format: FORMAT_2, description, warning: 'Test vectors: the keys are public. Never use them for anything else.' });
+  const runners = runnerLists(all, signing);
+  const plain = plaintexts();
+  return {
+    'ias-vault-2/keys.json': {
+      ...header('The test keys of ias-vault-2. recipients are the X25519 keys of ../keys.json (the same four). signing are Ed25519 keys: team is the team\'s, registered on the server and pinned by the runners; other-team is someone else\'s. privateKey is the 32-byte Ed25519 seed in base64url, publicKey the raw 32-byte public key and kid its base64url SHA-256, as for recipients.'),
+      recipients: all,
+      signing,
+    },
+    'ias-vault-2/sealed.json': {
+      ...header('Envelopes made with injected randomness and signed by the team (Ed25519 is deterministic): an implementation must produce the same envelope from the same inputs, signedText is what the signature covers, and every key gets the outcome in opens when it checks the signature against the team key. changes are a grant (rewrap) and a revocation on top of the first case, each signed again.'),
+      server: { formats: [FORMAT_2], requiredKids: [all.recovery.kid], signingKid: signing.team.kid },
+      cases: sealedCases,
+      changes: changed,
+    },
+    'ias-vault-2/malformed.json': {
+      ...header('Envelopes the server must reject before storing them: each one breaks one rule of docs/technical/vault.md §6, and code is the first problem found. A case has json (text to parse) or envelope (a parsed value), and options when the rule needs them: requiredKids (the recovery key) or signingKid (the registered signing key).'),
+      base: 'sealed.json, keystore-for-recovery-and-runner-a',
+      cases: malformed2(sealedCases, v1Envelope, all, signing),
+    },
+    'ias-vault-2/tampered.json': {
+      ...header('Well-formed envelopes that were altered. The server accepts their shape with its options (server: requiredKids and signingKid), because it does not verify signatures; opening them with key, checking the signature against the team key, must fail with error. Most fail at the signature (signature-invalid); the ones signed again by the team show that the encryption still binds everything.'),
+      base: 'sealed.json, keystore-for-recovery-and-runner-a',
+      server: { formats: [FORMAT_2], requiredKids: [all.recovery.kid], signingKid: signing.team.kid },
+      cases: tampered2(sealedCases, changed, all, signing),
+    },
+    'ias-vault-2/runners.json': {
+      ...header(`The list of authorised runners (${RUNNERS_FORMAT}), signed by the team: lists are good ones, each with its signedText and the runners it gives; malformed must be rejected with code (validateRunnerList); tampered are well formed but their signature does not verify.`),
+      ...runners,
+    },
+    'ias-vault-2/approvers.json': approverVectors(signing),
+    'ias-vault-2/plaintexts.json': {
+      ...header('What an envelope holds for each credential type (docs/technical/vault.md §3.5): good has one plaintext per type, with fake files; bad must be refused with code by validatePlaintext(type, bytes). text is the UTF-8 of the plaintext; plaintext, its bytes in base64url.'),
+      ...plain,
+    },
+  };
+}
+
+/** Every vector file, by its path inside test-vectors, as the JSON value it holds. */
+export function buildVectors() {
+  const all = keys();
+  return { ...vectors1(all), ...vectors2(all) };
+}
+
+export const serialize = (value) => `${JSON.stringify(value, null, 2)}\n`;
+
+if (process.argv[1] && fileURLToPath(import.meta.url) === process.argv[1]) {
+  for (const [name, value] of Object.entries(buildVectors())) {
+    const path = join(VECTORS_DIR, name);
+    mkdirSync(dirname(path), { recursive: true });
+    writeFileSync(path, serialize(value));
+    console.log(`wrote ${path}`);
+  }
+}