@nuggetslife/vc 0.1.0 → 0.3.0

package/test_interop_smoke.mjs

@@ -0,0 +1,388 @@
+#!/usr/bin/env node
+// Cross-stack BBS+ sign-verify smoke harness (Sprint 4 Phase D).
+//
+// Layered on top of the parity harness (test_interop.mjs): the parity gate
+// ensures frame + canonize byte-equality between V2 native and jsonld.js;
+// THIS gate ensures a full cryptographic round-trip across the two stacks.
+//
+// For each fixture × direction:
+//   1. V2 native sign  → @mattrglobal/jsonld-signatures-bbs verify
+//   2. @mattrglobal/jsonld-signatures-bbs sign  → V2 native verify
+// Both directions must succeed (verified: true) for the fixture to "pass smoke".
+//
+// Usage:
+//   node test_interop_smoke.mjs --check     (CI default; exits 1 on any
+//                                            non-allowlisted failure)
+//   node test_interop_smoke.mjs --report    (local triage; prints diagnostic
+//                                            per failure, always exits 0)
+//
+// Fixture subset rationale:
+//   The corpus is 9 fixtures across 6 families. After clientffi#69 (Phase E
+//   canonize_dispatch fix — mirror of the Phase A frame_native hotfix), the
+//   smoke harness covers all 9: caller-registered contexts now thread
+//   through the V2 BBS+ sign / verify chain, so OB v3 / EBSI / VP fixtures
+//   that reference spec-sourced (non-bundled) contexts can now round-trip.
+//
+//   Included (9):
+//     - w3c-vc-v1/permanent-resident-card    — canonical W3C VC v1 + BBS+
+//     - idv2/full-disclosure                 — Nuggets identity-v2 (post-#56)
+//     - nuggets/identity-v1                  — Nuggets identity-v1 (post-#63)
+//     - nuggets/kyb-v1                       — Nuggets kyb-v1 (post-#65)
+//     - vp/single-vc-wrap                    — VP wrapping a VC (post-#66)
+//     - openbadges-v3/basic-achievement      — OB v3 spec context
+//     - openbadges-v3/with-allowed-values    — OB v3 spec context
+//     - ebsi/diploma-simple                  — EBSI essif spec context
+//     - ebsi/diploma-elm                     — EBSI ELM (V2-pinned, see #61)
+//
+// Hardcoded BBS+ keypair: `did:example:489398593#test`, the same keypair
+// used by the existing test infrastructure (vc/js/test-data/keyPair.json,
+// matching vc/rs/src/jsonld/signatures/bbs/data/sample_data.rs::KEY_PAIR).
+
+import { readFileSync, existsSync, readdirSync } from 'node:fs';
+import { resolve, dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { createRequire } from 'node:module';
+import { ldSign, ldVerify } from './index.js';
+
+const require = createRequire(import.meta.url);
+const { Bls12381G2KeyPair } = require('@mattrglobal/bls12381-key-pair');
+const { BbsBlsSignature2020 } = require('@mattrglobal/jsonld-signatures-bbs');
+const jsigs = require('jsonld-signatures');
+const { extendContextLoader, purposes } = jsigs;
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const fixturesRoot = resolve(__dirname, 'test-fixtures', 'interop');
+
+const args = process.argv.slice(2);
+const checkMode = args.includes('--check');
+const reportMode = args.includes('--report');
+if (!checkMode && !reportMode) {
+  console.error('Usage: test_interop_smoke.mjs [--check | --report]');
+  process.exit(2);
+}
+
+const allowlistPath = resolve(__dirname, 'interop-smoke-allowlist.json');
+const allowlist = existsSync(allowlistPath)
+  ? JSON.parse(readFileSync(allowlistPath, 'utf8'))
+  : { expect_fail: [] };
+const expectFail = new Set((allowlist.expect_fail || []).map((e) => e.fixture));
+
+// All corpus fixtures included in the smoke gate — see header rationale.
+const SMOKE_FIXTURES = [
+  'w3c-vc-v1/permanent-resident-card',
+  'idv2/full-disclosure',
+  'nuggets/identity-v1',
+  'nuggets/kyb-v1',
+  'vp/single-vc-wrap',
+  'openbadges-v3/basic-achievement',
+  'openbadges-v3/with-allowed-values',
+  'ebsi/diploma-simple',
+  'ebsi/diploma-elm',
+];
+
+// BBS+ keypair — `did:example:489398593#test`. Single source of truth is
+// vc/js/test-data/keyPair.json, which mirrors
+// vc/rs/src/jsonld/signatures/bbs/data/sample_data.rs::KEY_PAIR. The on-disk
+// file omits `type` (consumed by other tests that don't need it); we patch
+// it in here so the BBS+ suites resolve the verification method correctly.
+const KEYPAIR_PATH = resolve(__dirname, 'test-data', 'keyPair.json');
+const KEYPAIR_JSON = {
+  ...JSON.parse(readFileSync(KEYPAIR_PATH, 'utf8')),
+  type: 'Bls12381G2Key2020',
+};
+
+const CONTROLLER_DOC = {
+  '@context': 'https://w3id.org/security/v2',
+  id: KEYPAIR_JSON.controller,
+  assertionMethod: [KEYPAIR_JSON.id],
+};
+
+// Load offline interop contexts the same way test_interop.mjs does.
+function loadOfflineContexts() {
+  const dir = join(fixturesRoot, '_contexts');
+  const out = {};
+  if (!existsSync(dir)) return out;
+  for (const f of readdirSync(dir)) {
+    if (!f.endsWith('.jsonld') && !f.endsWith('.json')) continue;
+    const doc = JSON.parse(readFileSync(join(dir, f), 'utf8'));
+    if (!doc.__url__) continue;
+    const url = doc.__url__;
+    const copy = JSON.parse(JSON.stringify(doc));
+    delete copy.__url__;
+    out[url] = copy;
+  }
+  return out;
+}
+
+// Augment with the contexts the BBS+ suites resolve at sign/verify time:
+// the keypair URL itself, the controller doc, and the JWS suite context the
+// `@mattrglobal/jsonld-signatures-bbs` `getVerificationMethod` framing pulls
+// in. `jsonld-signatures` already bundles `security/v1` + `security/v2`
+// (via its `extendContextLoader`), so we don't need to re-add those.
+function buildContexts(offline) {
+  const suiteContextPath = resolve(__dirname, 'test-data', 'suiteContext.json');
+  const suiteContext = JSON.parse(readFileSync(suiteContextPath, 'utf8'));
+  return {
+    ...offline,
+    [KEYPAIR_JSON.id]: KEYPAIR_JSON,
+    [KEYPAIR_JSON.controller]: CONTROLLER_DOC,
+    'https://w3id.org/security/suites/jws-2020/v1': suiteContext,
+  };
+}
+
+function buildJsigsLoader(contextMap) {
+  const loader = (url) => {
+    const doc = contextMap[url];
+    if (doc) return { contextUrl: null, document: doc, documentUrl: url };
+    throw new Error(`Smoke harness: unbundled context requested: ${url}`);
+  };
+  return extendContextLoader(loader);
+}
+
+// Strip an existing proof if present (some fixtures may carry one). For the
+// smoke harness we always sign fresh.
+function stripProof(doc) {
+  const copy = JSON.parse(JSON.stringify(doc));
+  delete copy.proof;
+  return copy;
+}
+
+// All current smoke fixtures are VCs — no wrapper unwrapping needed; we
+// just strip any incidental embedded proof before signing.
+function unwrapForSigning(_fixtureId, doc) {
+  return stripProof(doc);
+}
+
+// Some inputs don't carry the BBS+ context — V2 ldSign auto-adds it; we
+// ensure jsonld-signatures-bbs sees it the same way by injecting it before
+// calling sign. (The suite would otherwise call its own `ensureSuiteContext`
+// which mutates the input but produces an identical effect.)
+function ensureBbsContext(doc) {
+  const BBS_URL = 'https://w3id.org/security/bbs/v1';
+  const ctx = doc['@context'];
+  if (!ctx) {
+    doc['@context'] = [BBS_URL];
+    return doc;
+  }
+  if (Array.isArray(ctx)) {
+    if (!ctx.includes(BBS_URL)) doc['@context'] = [...ctx, BBS_URL];
+    return doc;
+  }
+  // string or object
+  doc['@context'] = [ctx, BBS_URL];
+  return doc;
+}
+
+async function v2Sign(input, contexts) {
+  return await ldSign({
+    document: input,
+    keyPair: KEYPAIR_JSON,
+    contexts,
+  });
+}
+
+async function v2Verify(signedDoc, contexts) {
+  return await ldVerify({
+    document: signedDoc,
+    contexts,
+  });
+}
+
+async function mattrSign(input, contexts) {
+  const keyPair = await Bls12381G2KeyPair.from({
+    id: KEYPAIR_JSON.id,
+    controller: KEYPAIR_JSON.controller,
+    publicKeyBase58: KEYPAIR_JSON.publicKeyBase58,
+    privateKeyBase58: KEYPAIR_JSON.privateKeyBase58,
+  });
+  const suite = new BbsBlsSignature2020({ key: keyPair });
+  const documentLoader = buildJsigsLoader(contexts);
+  // Mutate-safe: ensureBbsContext is applied before suite.sign so that
+  // expansion has the same vocabulary V2 ldSign would have used.
+  const docToSign = ensureBbsContext(JSON.parse(JSON.stringify(input)));
+  return await jsigs.sign(docToSign, {
+    suite,
+    purpose: new purposes.AssertionProofPurpose(),
+    documentLoader,
+  });
+}
+
+async function mattrVerify(signedDoc, contexts) {
+  const documentLoader = buildJsigsLoader(contexts);
+  const result = await jsigs.verify(signedDoc, {
+    suite: new BbsBlsSignature2020(),
+    purpose: new purposes.AssertionProofPurpose(),
+    documentLoader,
+  });
+  return result;
+}
+
+function summariseError(err) {
+  if (!err) return 'unknown';
+  if (typeof err === 'string') return err;
+  if (err.message) return err.message;
+  if (err.errors && err.errors.length) {
+    return err.errors.map((e) => e.message || String(e)).join('; ');
+  }
+  return String(err);
+}
+
+async function runDirection(directionId, signFn, verifyFn, input, contexts) {
+  let signed;
+  try {
+    signed = await signFn(input, contexts);
+  } catch (err) {
+    return { direction: directionId, status: 'error', stage: 'sign', error: summariseError(err) };
+  }
+  let verifyResult;
+  try {
+    verifyResult = await verifyFn(signed, contexts);
+  } catch (err) {
+    return { direction: directionId, status: 'error', stage: 'verify', error: summariseError(err) };
+  }
+  if (verifyResult && verifyResult.verified === true) {
+    return { direction: directionId, status: 'pass' };
+  }
+  return {
+    direction: directionId,
+    status: 'fail',
+    stage: 'verify',
+    error: summariseError(verifyResult && verifyResult.error),
+  };
+}
+
+async function runFixture(fixture, contexts) {
+  const inputPath = join(fixture.dir, 'input.jsonld');
+  if (!existsSync(inputPath)) {
+    return { id: fixture.id, status: 'skip', reason: 'missing input.jsonld' };
+  }
+  const raw = JSON.parse(readFileSync(inputPath, 'utf8'));
+  const input = unwrapForSigning(fixture.id, raw);
+
+  const v2ToMattr = await runDirection(
+    'v2->jsonld',
+    v2Sign,
+    mattrVerify,
+    input,
+    contexts,
+  );
+  const mattrToV2 = await runDirection(
+    'jsonld->v2',
+    mattrSign,
+    v2Verify,
+    input,
+    contexts,
+  );
+
+  const overall =
+    v2ToMattr.status === 'pass' && mattrToV2.status === 'pass'
+      ? 'pass'
+      : 'fail';
+
+  return {
+    id: fixture.id,
+    status: overall,
+    directions: { v2ToMattr, mattrToV2 },
+  };
+}
+
+async function main() {
+  const offline = loadOfflineContexts();
+  const contexts = buildContexts(offline);
+
+  const fixtures = SMOKE_FIXTURES.map((id) => ({
+    id,
+    dir: join(fixturesRoot, ...id.split('/')),
+  }));
+
+  const results = [];
+  for (const fx of fixtures) {
+    process.stderr.write(`  smoke ${fx.id}…\n`);
+    results.push(await runFixture(fx, contexts));
+  }
+
+  const pass = results.filter((r) => r.status === 'pass').length;
+  const fail = results.filter((r) => r.status === 'fail').length;
+  const skip = results.filter((r) => r.status === 'skip').length;
+
+  console.log(`\n========== INTEROP SMOKE ==========`);
+  console.log(`pass:  ${pass}`);
+  console.log(`fail:  ${fail}`);
+  console.log(`skip:  ${skip}`);
+
+  // Per-fixture results table
+  console.log(`\nfixture                                    | v2->jsonld | jsonld->v2 | overall`);
+  console.log(`-------------------------------------------+------------+------------+--------`);
+  for (const r of results) {
+    const v2j = r.directions ? r.directions.v2ToMattr.status : '-';
+    const jv2 = r.directions ? r.directions.mattrToV2.status : '-';
+    const id = r.id.padEnd(42);
+    console.log(`${id} | ${v2j.padEnd(10)} | ${jv2.padEnd(10)} | ${r.status}`);
+  }
+
+  const regressions = [];
+  const improvements = [];
+  const expectedFails = [];
+  const skips = [];
+  for (const r of results) {
+    if (r.status === 'pass') {
+      if (expectFail.has(r.id)) improvements.push(r);
+    } else if (r.status === 'fail') {
+      if (expectFail.has(r.id)) expectedFails.push(r);
+      else regressions.push(r);
+    } else if (r.status === 'skip') {
+      skips.push(r);
+    }
+  }
+
+  if (reportMode) {
+    for (const r of [...regressions, ...expectedFails]) {
+      console.log(`\n--- ${r.id} (${r.status}) ---`);
+      if (r.directions) {
+        for (const d of [r.directions.v2ToMattr, r.directions.mattrToV2]) {
+          if (d.status === 'pass') continue;
+          console.log(`  [${d.direction}] ${d.status} @ ${d.stage}: ${d.error}`);
+        }
+      }
+    }
+    console.log(
+      `\n[--report] ${regressions.length} divergence(s); ${expectedFails.length} expected-fail; ${improvements.length} improvement(s); ${skips.length} skip(s).`,
+    );
+    process.exit(0);
+  }
+
+  // --check mode
+  if (improvements.length) {
+    console.log(`\n${improvements.length} fixture(s) newly passing — please ratchet interop-smoke-allowlist.json:`);
+    for (const r of improvements) console.log(`  + ${r.id}`);
+    process.exit(1);
+  }
+  if (regressions.length) {
+    console.log(`\n${regressions.length} REGRESSION(S):`);
+    for (const r of regressions) {
+      console.log(`  - ${r.id}`);
+      if (r.directions) {
+        for (const d of [r.directions.v2ToMattr, r.directions.mattrToV2]) {
+          if (d.status === 'pass') continue;
+          console.log(`      [${d.direction}] ${d.status} @ ${d.stage}: ${d.error}`);
+        }
+      }
+    }
+    process.exit(1);
+  }
+  if (skips.length) {
+    console.log(`\n${skips.length} skipped fixture(s):`);
+    for (const r of skips) console.log(`  ! ${r.id}: ${r.reason}`);
+    process.exit(1);
+  }
+  console.log(
+    `\nAll smoke fixtures round-trip cleanly.${
+      expectedFails.length ? ' (' + expectedFails.length + ' tracked expect-fail.)' : ''
+    }`,
+  );
+}
+
+main().catch((e) => {
+  console.error(e);
+  process.exit(1);
+});

package/test_w3c_conformance.mjs

@@ -271,6 +271,7 @@ async function runFraming() {
     for (const entry of manifest.sequence) {
         const types = Array.isArray(entry['@type']) ? entry['@type'] : [entry['@type']];
         if (!types.includes('jld:PositiveEvaluationTest') && !types.includes('jld:NegativeEvaluationTest')) continue;
+        const isNegative = types.includes('jld:NegativeEvaluationTest');
         const id = entry['@id'];
         if (isDenied('frame', id)) continue;
         if (!isInCheckScope('frame', id)) continue;
@@ -292,11 +293,17 @@ async function runFraming() {
             const input = loadJson(inputPath);
             const frame = loadJson(framePath);
             const napiResult = await withTimeout(proc.frame(input, frame, callOpts), id);
+            // Negative tests: a returned result is a failure (the impl should
+            // have aborted with an "invalid frame" / "invalid @embed value"
+            // error per W3C Framing 1.1 §4 / §4.5).
+            if (isNegative) { record('frame', id, 'fail'); continue; }
             if (!expectPath || !existsSync(expectPath)) { record('frame', id, 'err'); continue; }
             const expected = loadJson(expectPath);
             record('frame', id, jsonEqual(napiResult, expected) ? 'pass' : 'fail');
         } catch (e) {
             const isTimeout = e && /^timeout:/.test(e.message || '');
+            // Negative tests: a thrown error IS the expected outcome.
+            if (isNegative && !isTimeout) { record('frame', id, 'pass'); continue; }
             record('frame', id, isTimeout ? 'err' : 'err');
         }
     }

package/tools/regen_expected.mjs

@@ -0,0 +1,108 @@
+#!/usr/bin/env node
+// Regenerate `expected.nq` for one or more interop fixtures using jsonld.js
+// (the third-party reference). The harness in `test_interop.mjs` then asserts
+// V2 native produces byte-equal output. Never hand-edit `expected.nq`.
+//
+// Usage:
+//   node tools/regen_expected.mjs <fixture-dir> [<fixture-dir>...]
+//   node tools/regen_expected.mjs --all
+//
+// Examples:
+//   node tools/regen_expected.mjs test-fixtures/interop/w3c-vc-v1/permanent-resident-card
+//   node tools/regen_expected.mjs --all
+
+import { readFileSync, writeFileSync, existsSync, readdirSync, statSync } from 'node:fs';
+import { resolve, dirname, join, relative } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import jsonld from 'jsonld';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const repoRoot = resolve(__dirname, '..');
+const fixturesRoot = resolve(repoRoot, 'test-fixtures', 'interop');
+
+const args = process.argv.slice(2);
+if (args.length === 0) {
+  console.error('Usage: regen_expected.mjs <fixture-dir>... | --all');
+  process.exit(2);
+}
+
+// Build the offline document loader from the fixtures' contexts. We don't
+// fetch anything from the network — every context referenced by a fixture
+// must resolve from the bundled `vc/js/test-fixtures/interop/_contexts/` dir
+// or from inline contexts (i.e. embedded `@context` objects).
+const contextDir = resolve(fixturesRoot, '_contexts');
+const offlineContexts = {};
+if (existsSync(contextDir)) {
+  for (const f of readdirSync(contextDir)) {
+    if (!f.endsWith('.jsonld') && !f.endsWith('.json')) continue;
+    const doc = JSON.parse(readFileSync(join(contextDir, f), 'utf8'));
+    const url = doc.__url__;
+    if (!url) {
+      console.error(`context ${f} missing __url__ marker`);
+      process.exit(2);
+    }
+    delete doc.__url__;
+    offlineContexts[url] = doc;
+  }
+}
+
+const documentLoader = async (url) => {
+  if (!offlineContexts[url]) {
+    throw new Error(`offline loader: unknown context ${url}`);
+  }
+  return { contextUrl: null, document: offlineContexts[url], documentUrl: url };
+};
+
+async function regen(fixtureDir) {
+  const inputPath = join(fixtureDir, 'input.jsonld');
+  const framePath = join(fixtureDir, 'frame.jsonld');
+  const expectedPath = join(fixtureDir, 'expected.nq');
+  if (!existsSync(inputPath) || !existsSync(framePath)) {
+    console.error(`skipping ${fixtureDir}: missing input.jsonld or frame.jsonld`);
+    return false;
+  }
+  const input = JSON.parse(readFileSync(inputPath, 'utf8'));
+  const frame = JSON.parse(readFileSync(framePath, 'utf8'));
+  const framed = await jsonld.frame(input, frame, { documentLoader });
+  const nquads = await jsonld.canonize(framed, {
+    algorithm: 'URDNA2015',
+    format: 'application/n-quads',
+    documentLoader,
+  });
+  // Normalize: LF, trailing newline, no BOM
+  const normalized = nquads.endsWith('\n') ? nquads : nquads + '\n';
+  writeFileSync(expectedPath, normalized, { encoding: 'utf8' });
+  console.log(`wrote ${relative(repoRoot, expectedPath)} (${normalized.length} bytes)`);
+  return true;
+}
+
+function discoverFixtureDirs(root) {
+  const out = [];
+  for (const family of readdirSync(root)) {
+    if (family.startsWith('_')) continue; // skip _contexts/
+    const familyDir = join(root, family);
+    if (!statSync(familyDir).isDirectory()) continue;
+    for (const name of readdirSync(familyDir)) {
+      const fixtureDir = join(familyDir, name);
+      if (!statSync(fixtureDir).isDirectory()) continue;
+      out.push(fixtureDir);
+    }
+  }
+  return out;
+}
+
+const targets = args[0] === '--all'
+  ? discoverFixtureDirs(fixturesRoot)
+  : args.map((a) => resolve(a));
+
+let ok = 0, skipped = 0, failed = 0;
+for (const dir of targets) {
+  try {
+    if (await regen(dir)) ok += 1; else skipped += 1;
+  } catch (err) {
+    failed += 1;
+    console.error(`failed ${dir}: ${err && err.message ? err.message : err}`);
+  }
+}
+console.log(`\nregenerated: ${ok}; skipped: ${skipped}; failed: ${failed}`);
+process.exit(failed > 0 ? 1 : 0);