@noy-db/test-ceremony-conformance 0.7.0-pre.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 vLannaAi
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,75 @@
+# @noy-db/test-ceremony-conformance
+
+The `SlotRewrapCeremony` contract, published as an executable suite.
+
+```ts
+import { runCeremonyConformanceTests } from '@noy-db/test-ceremony-conformance'
+
+runCeremonyConformanceTests('my-method', {
+  method: 'my-method',
+  ceremony: () => myRewrapCeremony(secret),
+  oldSlot: () => makeMySlot(),
+  wrongMethodSlot: async () => ({ ...(await makeMySlot()), method: 'password' }),
+  unwrap: (opts) => openMyWrap(opts),   // optional — absence is REPORTED
+})
+```
+
+## What it checks
+
+When `rotateSecret` preserves a tier-2 slot it hands each ceremony a
+`SlotRewrapContext` and takes back `EnrollAuthenticatorOptions`, which hub
+persists atomically with the rotation. Six properties are the same for every
+method:
+
+1. the slot **id** survives
+2. the **method** survives
+3. the **effective wrap kind** survives
+4. a slot belonging to **another method is refused**
+5. a refusal **does not mutate** the context it was handed
+6. the wrap holds **`ctx.newDeks`**, not the stale set
+
+Method-specific behaviour stays in the package — PRF vs rawId fallback,
+password strength rules, credential cancellation. A conformance kit that grew
+those would stop being portable to a method nobody has written yet.
+
+## Two fixture rules that are not decoration
+
+**`wrongMethodSlot` must differ from `oldSlot` in `method` alone.** Enforced,
+and learned the hard way: the first version of the on-password fixture used a
+wrap-KEK slot for the refusal case, so deleting the method guard from the
+ceremony left the suite **green** — the `wrapKind` guard was rejecting it
+instead. Two differences means the case proves only that *something* refused.
+
+**`unwrap` is optional, and its absence is reported in the test name.** A kit
+that silently skipped its most valuable case would be the green-run-with-a-
+red-job-inside, in test form.
+
+## Why two bindings, not one
+
+`on-password` and `on-webauthn` both run it, and the second is what made the
+first correct.
+
+Case 3 originally asserted `out.wrapKind` directly. It passed against
+`on-password`, which **must** set that field. `wrapKind` is `?: 'kek'` on the
+wrap-KEK variant, so `on-webauthn` legally omits it — and the kit called that
+a failure. **A conformance suite written against one implementation encodes
+that implementation's incidental shape as the contract.**
+
+The same pass corrected a naming trap worth knowing: `wrapKind: 'kek'` names
+the *field the slot stores* (`wrapped_kek`), not the wrapped material. A
+WebAuthn slot wraps the keyring payload carrying `ctx.newDeks`, exactly as the
+wrap-DEKs path does. Reading freshness off the `wrapKind` name gets it
+backwards.
+
+## Mutation-checked
+
+Both bindings, against real defects introduced into real ceremonies:
+
+| mutation | on-password | on-webauthn |
+|---|---|---|
+| slot id not preserved | 1 fails | 1 fails |
+| method guard deleted | 2 fail | 2 fail |
+| wraps the wrong keys | 1 fails | — |
+
+The method-guard row is the one that matters: it fails **only** because the
+refusal fixture differs in one field. Before that rule it passed.

package/dist/index.d.ts

@@ -0,0 +1,42 @@
+import { SlotRewrapCeremony, KeyringAuthenticator, EnrollAuthenticatorOptions, EnclaveKey } from '@noy-db/hub/on';
+
+/** Everything an implementation must supply to be checked against the contract. */
+interface CeremonyFixture {
+    /** The method this ceremony handles — must equal what it preserves. */
+    readonly method: string;
+    /**
+     * A ready-to-run ceremony. Called once per case, so an implementation that
+     * captures a secret in a closure (all shipped ones do) is not shared
+     * between cases.
+     */
+    ceremony(): SlotRewrapCeremony;
+    /** A slot this ceremony accepts: right `method`, right `wrapKind`. */
+    oldSlot(): Promise<KeyringAuthenticator> | KeyringAuthenticator;
+    /**
+     * A slot this ceremony must REFUSE, differing from {@link oldSlot} in
+     * `method` and NOTHING ELSE — same `wrapKind` in particular.
+     *
+     * Required, because refusal cannot be observed from a ceremony's own slots.
+     * The single-difference rule is enforced below and was learned the hard
+     * way: a fixture whose wrong-method slot ALSO had a different `wrapKind`
+     * still threw, from the wrapKind guard, so deleting the method check
+     * changed nothing and the suite stayed green. Two differences means the
+     * case proves only that *something* rejected it.
+     */
+    wrongMethodSlot(): Promise<KeyringAuthenticator> | KeyringAuthenticator;
+    /**
+     * Re-open what the returned options wrapped, so the suite can prove the
+     * ceremony used `ctx.newDeks` rather than carrying the stale set forward.
+     * Only the method can do this, so it is optional — and its absence is
+     * REPORTED in the test name rather than passed over.
+     */
+    unwrap?(options: EnrollAuthenticatorOptions): Promise<Map<string, EnclaveKey>>;
+}
+/**
+ * Run the shared `SlotRewrapCeremony` contract against one implementation.
+ *
+ * @param name - shown in the suite title, e.g. `'on-password'`.
+ */
+declare function runCeremonyConformanceTests(name: string, fixture: CeremonyFixture): void;
+
+export { type CeremonyFixture, runCeremonyConformanceTests };

package/dist/index.js

@@ -0,0 +1,76 @@
+// src/index.ts
+import { describe, it, expect } from "vitest";
+async function makeKey() {
+  return globalThis.crypto.subtle.generateKey({ name: "AES-GCM", length: 256 }, true, [
+    "encrypt",
+    "decrypt"
+  ]);
+}
+async function makeContext(oldSlot) {
+  const newDeks = /* @__PURE__ */ new Map([
+    ["invoices", await makeKey()],
+    ["clients", await makeKey()]
+  ]);
+  return { newKek: await makeKey(), newDeks, oldSlot };
+}
+function runCeremonyConformanceTests(name, fixture) {
+  describe(`${name} \u2014 SlotRewrapCeremony conformance`, () => {
+    it("1. returns options that preserve the slot id", async () => {
+      const slot = await fixture.oldSlot();
+      const out = await fixture.ceremony()(await makeContext(slot));
+      expect(out.id).toBe(slot.id);
+    });
+    it("2. returns options that preserve the method", async () => {
+      const slot = await fixture.oldSlot();
+      const out = await fixture.ceremony()(await makeContext(slot));
+      expect(out.method).toBe(slot.method);
+      expect(out.method).toBe(fixture.method);
+    });
+    it("3. returns options that preserve the EFFECTIVE wrap kind", async () => {
+      const slot = await fixture.oldSlot();
+      const out = await fixture.ceremony()(await makeContext(slot));
+      expect(out.wrapKind ?? "kek").toBe(slot.wrapKind ?? "kek");
+    });
+    it("4. REFUSES a slot belonging to another method", async () => {
+      const slot = await fixture.oldSlot();
+      const other = await fixture.wrongMethodSlot();
+      expect(other.method).not.toBe(fixture.method);
+      expect(
+        other.wrapKind,
+        "wrongMethodSlot must differ from oldSlot in `method` alone \u2014 a second difference lets another guard absorb the case"
+      ).toBe(slot.wrapKind);
+      await expect(fixture.ceremony()(await makeContext(other))).rejects.toThrow();
+    });
+    it("5. refuses without mutating the context it was handed", async () => {
+      const other = await fixture.wrongMethodSlot();
+      const ctx = await makeContext(other);
+      const before = [...ctx.newDeks.keys()].sort();
+      await expect(fixture.ceremony()(ctx)).rejects.toThrow();
+      expect([...ctx.newDeks.keys()].sort()).toEqual(before);
+    });
+    const freshness = fixture.unwrap ? "6. wraps the NEW dek set, not the old one" : "6. SKIPPED \u2014 no `unwrap` in the fixture, so freshness is UNVERIFIED here";
+    it(freshness, async () => {
+      const unwrap = fixture.unwrap;
+      if (!unwrap) {
+        expect(unwrap).toBeUndefined();
+        return;
+      }
+      const slot = await fixture.oldSlot();
+      const ctx = await makeContext(slot);
+      const out = await fixture.ceremony()(ctx);
+      const wrapped = await unwrap(out);
+      expect([...wrapped.keys()].sort()).toEqual([...ctx.newDeks.keys()].sort());
+      for (const [collection, expected] of ctx.newDeks) {
+        const got = wrapped.get(collection);
+        expect(got, `${collection} missing from the rewrapped set`).toBeDefined();
+        const a = new Uint8Array(await globalThis.crypto.subtle.exportKey("raw", expected));
+        const b = new Uint8Array(await globalThis.crypto.subtle.exportKey("raw", got));
+        expect([...b], `${collection} was wrapped from the wrong key`).toEqual([...a]);
+      }
+    });
+  });
+}
+export {
+  runCeremonyConformanceTests
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["/**\n * **@noy-db/test-ceremony-conformance** — the `SlotRewrapCeremony` contract,\n * published as an executable suite.\n *\n * A `rotateSecret` that preserves a tier-2 slot hands each ceremony a\n * {@link SlotRewrapContext} and takes back `EnrollAuthenticatorOptions`, which\n * hub then persists atomically with the rotation. Everything hub validates\n * about that return value — and everything a ceremony must refuse — is the\n * same for every method. This is that shared half, so `on-password`,\n * `on-webauthn` and any third-party method answer the same questions.\n *\n * ## Why the fixture is not just a ceremony\n *\n * Two of the six properties are **unobservable from a single ceremony**:\n *\n *  - **Refusal.** \"Rejects a slot of another method\" needs a slot of another\n *    method. A ceremony handed only its own slots always succeeds, and a\n *    suite that only ever passes it valid input reports nothing about the\n *    guard hub relies on to prevent a slot-type swap mid-rotation.\n *  - **Freshness.** \"Wrapped `ctx.newDeks`, not the old set\" needs the wrap\n *    to be OPENED again, which only the method can do.\n *\n * So `wrongMethodSlot` is REQUIRED and `unwrap` is optional-but-reported: a\n * kit that quietly skipped its most valuable case would be the \"green run\n * with a red job inside\" in test form. When `unwrap` is absent the suite says\n * so in the test name, so a reader sees the hole in the output rather than\n * inferring coverage from a row count.\n *\n * ## What this suite does NOT cover\n *\n * Method-specific behaviour stays in the package: PRF vs rawId fallback,\n * password strength rules, credential cancellation. Those are real and tested\n * where they live. A conformance kit that grew them would stop being portable\n * to a method nobody has written yet.\n *\n * ## Why this binds `/on` rather than the root barrel\n *\n * Five types, and before `/on` existed they were scattered: three on `/team`,\n * and `KeyringAuthenticator` / `EnclaveKey` reachable only from the whole\n * library root. A third-party unlock method had to import all of\n * `@noy-db/hub` to name the signature of one ceremony.\n *\n * @packageDocumentation\n */\nimport { describe, it, expect } from 'vitest'\nimport type {\n  SlotRewrapCeremony,\n  SlotRewrapContext,\n  KeyringAuthenticator,\n  EnrollAuthenticatorOptions,\n  EnclaveKey,\n} from '@noy-db/hub/on'\n\n/** Everything an implementation must supply to be checked against the contract. */\nexport interface CeremonyFixture {\n  /** The method this ceremony handles — must equal what it preserves. */\n  readonly method: string\n  /**\n   * A ready-to-run ceremony. Called once per case, so an implementation that\n   * captures a secret in a closure (all shipped ones do) is not shared\n   * between cases.\n   */\n  ceremony(): SlotRewrapCeremony\n  /** A slot this ceremony accepts: right `method`, right `wrapKind`. */\n  oldSlot(): Promise<KeyringAuthenticator> | KeyringAuthenticator\n  /**\n   * A slot this ceremony must REFUSE, differing from {@link oldSlot} in\n   * `method` and NOTHING ELSE — same `wrapKind` in particular.\n   *\n   * Required, because refusal cannot be observed from a ceremony's own slots.\n   * The single-difference rule is enforced below and was learned the hard\n   * way: a fixture whose wrong-method slot ALSO had a different `wrapKind`\n   * still threw, from the wrapKind guard, so deleting the method check\n   * changed nothing and the suite stayed green. Two differences means the\n   * case proves only that *something* rejected it.\n   */\n  wrongMethodSlot(): Promise<KeyringAuthenticator> | KeyringAuthenticator\n  /**\n   * Re-open what the returned options wrapped, so the suite can prove the\n   * ceremony used `ctx.newDeks` rather than carrying the stale set forward.\n   * Only the method can do this, so it is optional — and its absence is\n   * REPORTED in the test name rather than passed over.\n   */\n  unwrap?(options: EnrollAuthenticatorOptions): Promise<Map<string, EnclaveKey>>\n}\n\nasync function makeKey(): Promise<EnclaveKey> {\n  return globalThis.crypto.subtle.generateKey({ name: 'AES-GCM', length: 256 }, true, [\n    'encrypt',\n    'decrypt',\n  ]) as Promise<EnclaveKey>\n}\n\n/** A context with a FRESH DEK set, which is the whole point of a rewrap. */\nasync function makeContext(oldSlot: KeyringAuthenticator): Promise<SlotRewrapContext> {\n  const newDeks = new Map<string, EnclaveKey>([\n    ['invoices', await makeKey()],\n    ['clients', await makeKey()],\n  ])\n  return { newKek: await makeKey(), newDeks, oldSlot }\n}\n\n/**\n * Run the shared `SlotRewrapCeremony` contract against one implementation.\n *\n * @param name - shown in the suite title, e.g. `'on-password'`.\n */\nexport function runCeremonyConformanceTests(name: string, fixture: CeremonyFixture): void {\n  describe(`${name} — SlotRewrapCeremony conformance`, () => {\n    it('1. returns options that preserve the slot id', async () => {\n      const slot = await fixture.oldSlot()\n      const out = await fixture.ceremony()(await makeContext(slot))\n      // Hub validates this itself and throws on mismatch. Asserted here too\n      // because a ceremony that gets it wrong should fail in ITS OWN suite,\n      // not in a rotation weeks later.\n      expect(out.id).toBe(slot.id)\n    })\n\n    it('2. returns options that preserve the method', async () => {\n      const slot = await fixture.oldSlot()\n      const out = await fixture.ceremony()(await makeContext(slot))\n      expect(out.method).toBe(slot.method)\n      expect(out.method).toBe(fixture.method)\n    })\n\n    it('3. returns options that preserve the EFFECTIVE wrap kind', async () => {\n      const slot = await fixture.oldSlot()\n      const out = await fixture.ceremony()(await makeContext(slot))\n      // Compared on the EFFECTIVE value, not the literal field. `wrapKind` is\n      // `?: 'kek'` on the wrap-KEK variant and a required `'deks'` on the\n      // other, so an absent field legally means 'kek' and hub persists it as\n      // such.\n      //\n      // The first version of this case asserted `out.wrapKind` directly. It\n      // passed — because on-password, the only binding at the time, MUST set\n      // the field explicitly. Wiring a second implementation is what exposed\n      // it: on-webauthn omits it, correctly, and the kit called that a\n      // failure. A conformance suite written against one implementation\n      // encodes that implementation's incidental shape as the contract.\n      //\n      // A wrap-KEK slot silently becoming wrap-DEKs (or the reverse) really\n      // does change what the slot can unlock — that is the property here, and\n      // it survives the correction.\n      expect(out.wrapKind ?? 'kek').toBe(slot.wrapKind ?? 'kek')\n    })\n\n    it('4. REFUSES a slot belonging to another method', async () => {\n      const slot = await fixture.oldSlot()\n      const other = await fixture.wrongMethodSlot()\n      expect(other.method).not.toBe(fixture.method)\n      // The fixture contract, asserted rather than trusted: if the refusal\n      // case differs in more than the method, a passing result does not say\n      // the METHOD guard works — some other guard may be doing the rejecting.\n      expect(\n        other.wrapKind,\n        'wrongMethodSlot must differ from oldSlot in `method` alone — a second difference lets another guard absorb the case',\n      ).toBe(slot.wrapKind)\n      await expect(fixture.ceremony()(await makeContext(other))).rejects.toThrow()\n    })\n\n    it('5. refuses without mutating the context it was handed', async () => {\n      const other = await fixture.wrongMethodSlot()\n      const ctx = await makeContext(other)\n      const before = [...ctx.newDeks.keys()].sort()\n      await expect(fixture.ceremony()(ctx)).rejects.toThrow()\n      // A ceremony that half-applies before validating leaves the caller\n      // holding a context it cannot safely retry with.\n      expect([...ctx.newDeks.keys()].sort()).toEqual(before)\n    })\n\n    const freshness = fixture.unwrap\n      ? '6. wraps the NEW dek set, not the old one'\n      : '6. SKIPPED — no `unwrap` in the fixture, so freshness is UNVERIFIED here'\n\n    it(freshness, async () => {\n      const unwrap = fixture.unwrap\n      if (!unwrap) {\n        // Deliberately passes, loudly. The alternative — omitting the case —\n        // makes an unverified property indistinguishable from a verified one.\n        expect(unwrap).toBeUndefined()\n        return\n      }\n      const slot = await fixture.oldSlot()\n      const ctx = await makeContext(slot)\n      const out = await fixture.ceremony()(ctx)\n      const wrapped = await unwrap(out)\n      expect([...wrapped.keys()].sort()).toEqual([...ctx.newDeks.keys()].sort())\n      for (const [collection, expected] of ctx.newDeks) {\n        const got = wrapped.get(collection)\n        expect(got, `${collection} missing from the rewrapped set`).toBeDefined()\n        // Compare the raw bytes: two AES keys are not `===`, and an\n        // identity check would pass on any key at all.\n        const a = new Uint8Array(await globalThis.crypto.subtle.exportKey('raw', expected))\n        const b = new Uint8Array(await globalThis.crypto.subtle.exportKey('raw', got!))\n        expect([...b], `${collection} was wrapped from the wrong key`).toEqual([...a])\n      }\n    })\n  })\n}\n"],"mappings":";AA4CA,SAAS,UAAU,IAAI,cAAc;AA0CrC,eAAe,UAA+B;AAC5C,SAAO,WAAW,OAAO,OAAO,YAAY,EAAE,MAAM,WAAW,QAAQ,IAAI,GAAG,MAAM;AAAA,IAClF;AAAA,IACA;AAAA,EACF,CAAC;AACH;AAGA,eAAe,YAAY,SAA2D;AACpF,QAAM,UAAU,oBAAI,IAAwB;AAAA,IAC1C,CAAC,YAAY,MAAM,QAAQ,CAAC;AAAA,IAC5B,CAAC,WAAW,MAAM,QAAQ,CAAC;AAAA,EAC7B,CAAC;AACD,SAAO,EAAE,QAAQ,MAAM,QAAQ,GAAG,SAAS,QAAQ;AACrD;AAOO,SAAS,4BAA4B,MAAc,SAAgC;AACxF,WAAS,GAAG,IAAI,0CAAqC,MAAM;AACzD,OAAG,gDAAgD,YAAY;AAC7D,YAAM,OAAO,MAAM,QAAQ,QAAQ;AACnC,YAAM,MAAM,MAAM,QAAQ,SAAS,EAAE,MAAM,YAAY,IAAI,CAAC;AAI5D,aAAO,IAAI,EAAE,EAAE,KAAK,KAAK,EAAE;AAAA,IAC7B,CAAC;AAED,OAAG,+CAA+C,YAAY;AAC5D,YAAM,OAAO,MAAM,QAAQ,QAAQ;AACnC,YAAM,MAAM,MAAM,QAAQ,SAAS,EAAE,MAAM,YAAY,IAAI,CAAC;AAC5D,aAAO,IAAI,MAAM,EAAE,KAAK,KAAK,MAAM;AACnC,aAAO,IAAI,MAAM,EAAE,KAAK,QAAQ,MAAM;AAAA,IACxC,CAAC;AAED,OAAG,4DAA4D,YAAY;AACzE,YAAM,OAAO,MAAM,QAAQ,QAAQ;AACnC,YAAM,MAAM,MAAM,QAAQ,SAAS,EAAE,MAAM,YAAY,IAAI,CAAC;AAgB5D,aAAO,IAAI,YAAY,KAAK,EAAE,KAAK,KAAK,YAAY,KAAK;AAAA,IAC3D,CAAC;AAED,OAAG,iDAAiD,YAAY;AAC9D,YAAM,OAAO,MAAM,QAAQ,QAAQ;AACnC,YAAM,QAAQ,MAAM,QAAQ,gBAAgB;AAC5C,aAAO,MAAM,MAAM,EAAE,IAAI,KAAK,QAAQ,MAAM;AAI5C;AAAA,QACE,MAAM;AAAA,QACN;AAAA,MACF,EAAE,KAAK,KAAK,QAAQ;AACpB,YAAM,OAAO,QAAQ,SAAS,EAAE,MAAM,YAAY,KAAK,CAAC,CAAC,EAAE,QAAQ,QAAQ;AAAA,IAC7E,CAAC;AAED,OAAG,yDAAyD,YAAY;AACtE,YAAM,QAAQ,MAAM,QAAQ,gBAAgB;AAC5C,YAAM,MAAM,MAAM,YAAY,KAAK;AACnC,YAAM,SAAS,CAAC,GAAG,IAAI,QAAQ,KAAK,CAAC,EAAE,KAAK;AAC5C,YAAM,OAAO,QAAQ,SAAS,EAAE,GAAG,CAAC,EAAE,QAAQ,QAAQ;AAGtD,aAAO,CAAC,GAAG,IAAI,QAAQ,KAAK,CAAC,EAAE,KAAK,CAAC,EAAE,QAAQ,MAAM;AAAA,IACvD,CAAC;AAED,UAAM,YAAY,QAAQ,SACtB,8CACA;AAEJ,OAAG,WAAW,YAAY;AACxB,YAAM,SAAS,QAAQ;AACvB,UAAI,CAAC,QAAQ;AAGX,eAAO,MAAM,EAAE,cAAc;AAC7B;AAAA,MACF;AACA,YAAM,OAAO,MAAM,QAAQ,QAAQ;AACnC,YAAM,MAAM,MAAM,YAAY,IAAI;AAClC,YAAM,MAAM,MAAM,QAAQ,SAAS,EAAE,GAAG;AACxC,YAAM,UAAU,MAAM,OAAO,GAAG;AAChC,aAAO,CAAC,GAAG,QAAQ,KAAK,CAAC,EAAE,KAAK,CAAC,EAAE,QAAQ,CAAC,GAAG,IAAI,QAAQ,KAAK,CAAC,EAAE,KAAK,CAAC;AACzE,iBAAW,CAAC,YAAY,QAAQ,KAAK,IAAI,SAAS;AAChD,cAAM,MAAM,QAAQ,IAAI,UAAU;AAClC,eAAO,KAAK,GAAG,UAAU,iCAAiC,EAAE,YAAY;AAGxE,cAAM,IAAI,IAAI,WAAW,MAAM,WAAW,OAAO,OAAO,UAAU,OAAO,QAAQ,CAAC;AAClF,cAAM,IAAI,IAAI,WAAW,MAAM,WAAW,OAAO,OAAO,UAAU,OAAO,GAAI,CAAC;AAC9E,eAAO,CAAC,GAAG,CAAC,GAAG,GAAG,UAAU,iCAAiC,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;AAAA,MAC/E;AAAA,IACF,CAAC;AAAA,EACH,CAAC;AACH;","names":[]}

package/package.json

@@ -0,0 +1,57 @@
+{
+  "name": "@noy-db/test-ceremony-conformance",
+  "version": "0.7.0-pre.0",
+  "description": "Parameterized contract tests for noy-db on-* slot ceremonies — the conformance suite every SlotRewrapCeremony must pass",
+  "license": "MIT",
+  "author": "vLannaAi <vicio@lanna.ai>",
+  "homepage": "https://github.com/vLannaAi/noy-db/tree/main/packages/test-ceremony-conformance#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/vLannaAi/noy-db.git",
+    "directory": "packages/test-ceremony-conformance"
+  },
+  "bugs": {
+    "url": "https://github.com/vLannaAi/noy-db/issues"
+  },
+  "type": "module",
+  "sideEffects": false,
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=22.0.0"
+  },
+  "peerDependencies": {
+    "vitest": "^3.0.0",
+    "@noy-db/hub": "0.7.0-pre.0"
+  },
+  "devDependencies": {
+    "vitest": "^3.0.0",
+    "@noy-db/hub": "0.7.0-pre.0"
+  },
+  "keywords": [
+    "noy-db",
+    "conformance",
+    "authenticator",
+    "keyring",
+    "testing"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsup",
+    "test": "vitest run --passWithNoTests",
+    "typecheck": "tsc --noEmit"
+  }
+}