@serfab/cadre-host 0.10.0 → 0.11.0

package/src/update/__tests__/manifest.test.ts

@@ -1,128 +1,128 @@
-import { afterEach, beforeEach, describe, expect, it } from 'vitest';
-import { generateKeyPairSync, type KeyObject } from 'node:crypto';
-
-import { canonicalJson, signManifest, verifyManifest } from '../manifest.js';
-import type { UpdateManifest } from '../types.js';
-
-/** Generate a fresh Ed25519 keypair and surface the raw 32-byte public key. */
-function freshKeypair(): { publicKey: KeyObject; privateKey: KeyObject; publicRawB64: string } {
-  const { publicKey, privateKey } = generateKeyPairSync('ed25519');
-  // Extract the raw 32-byte public key from SPKI DER (strip the 12-byte header).
-  const spki = publicKey.export({ format: 'der', type: 'spki' });
-  const raw = spki.subarray(12);
-  return { publicKey, privateKey, publicRawB64: Buffer.from(raw).toString('base64') };
-}
-
-const sampleManifest: UpdateManifest = {
-  v: 1,
-  version: '0.7.0',
-  publishedAt: '2026-05-15T18:00:00.000Z',
-  channels: { npm: { package: '@serfab/cadre-host', tag: 'latest' } },
-  releaseNotesUrl: 'https://example.com/notes',
-  minPreviousVersion: '0.6.0',
-};
-
-describe('canonicalJson', () => {
-  it('sorts keys deterministically and omits whitespace', () => {
-    expect(canonicalJson({ b: 1, a: 2 })).toBe('{"a":2,"b":1}');
-    expect(canonicalJson({ outer: { z: 1, a: 2 }, top: true })).toBe('{"outer":{"a":2,"z":1},"top":true}');
-    expect(canonicalJson([3, 2, 1])).toBe('[3,2,1]');
-  });
-
-  it('omits undefined fields', () => {
-    expect(canonicalJson({ a: 1, b: undefined })).toBe('{"a":1}');
-  });
-});
-
-describe('verifyManifest', () => {
-  let kp: ReturnType<typeof freshKeypair>;
-
-  beforeEach(() => {
-    kp = freshKeypair();
-    process.env.CADRE_HOST_UPDATE_DEV_KEY = kp.publicRawB64;
-  });
-
-  afterEach(() => {
-    delete process.env.CADRE_HOST_UPDATE_DEV_KEY;
-  });
-
-  it('round-trips: sign + verify', () => {
-    const envelope = signManifest(sampleManifest, kp.privateKey);
-    const out = verifyManifest(envelope);
-    expect(out).toEqual(sampleManifest);
-  });
-
-  it('rejects a mutated payload (signature_invalid)', () => {
-    const envelope = signManifest(sampleManifest, kp.privateKey);
-    const tampered = { ...envelope, manifest: { ...envelope.manifest, version: '99.0.0' } };
-    expect(() => verifyManifest(tampered)).toThrow(/signature/i);
-  });
-
-  it('rejects a mutated signature (signature_invalid)', () => {
-    const envelope = signManifest(sampleManifest, kp.privateKey);
-    const sigBytes = Buffer.from(envelope.sig.slice('ed25519:'.length), 'base64');
-    sigBytes[0] ^= 0xff;
-    const tampered = { ...envelope, sig: `ed25519:${sigBytes.toString('base64')}` };
-    expect(() => verifyManifest(tampered)).toThrow(/signature/i);
-  });
-
-  it('rejects an envelope signed by a different key (signature_invalid)', () => {
-    const envelope = signManifest(sampleManifest, kp.privateKey);
-    // Swap the env-configured public key to a different fresh one.
-    const other = freshKeypair();
-    process.env.CADRE_HOST_UPDATE_DEV_KEY = other.publicRawB64;
-    expect(() => verifyManifest(envelope)).toThrow(/signature/i);
-  });
-
-  it('rejects malformed envelopes (manifest_invalid)', () => {
-    expect(() => verifyManifest(null)).toThrow(/malformed/);
-    expect(() => verifyManifest({})).toThrow(/malformed/);
-    expect(() => verifyManifest({ manifest: 'nope', sig: 'ed25519:AAAA' })).toThrow(/malformed/);
-  });
-
-  it('rejects manifests missing required fields (manifest_invalid)', () => {
-    const bad = { manifest: { v: 1, version: '0.7.0' }, sig: 'ed25519:AAAA' };
-    expect(() => verifyManifest(bad)).toThrow(/missing required fields/);
-  });
-
-  it('rejects unsupported signature schemes', () => {
-    const envelope = signManifest(sampleManifest, kp.privateKey);
-    const tampered = { ...envelope, sig: envelope.sig.replace('ed25519:', 'rsa:') };
-    expect(() => verifyManifest(tampered)).toThrow(/unsupported signature scheme/);
-  });
-
-  it('rejects non-semver manifest.version (manifest_invalid)', () => {
-    const envelope = signManifest(
-      { ...sampleManifest, version: 'not-a-semver' },
-      kp.privateKey,
-    );
-    expect(() => verifyManifest(envelope)).toThrow(/not a valid semver/i);
-  });
-
-  it('rejects non-semver minPreviousVersion (manifest_invalid)', () => {
-    const envelope = signManifest(
-      { ...sampleManifest, minPreviousVersion: '0.6' },
-      kp.privateKey,
-    );
-    expect(() => verifyManifest(envelope)).toThrow(/minPreviousVersion.*not a valid semver/i);
-  });
-
-  it('rejects publishedAt that is not a round-trippable ISO-8601 string', () => {
-    const envelope = signManifest(
-      { ...sampleManifest, publishedAt: 'sometime last week' },
-      kp.privateKey,
-    );
-    expect(() => verifyManifest(envelope)).toThrow(/publishedAt.*ISO-8601/i);
-  });
-
-  it('rejects an npm package name that fails the naming regex', () => {
-    const envelope = signManifest(
-      {
-        ...sampleManifest,
-        channels: { npm: { package: 'BAD CHARS!', tag: 'latest' } },
-      },
-      kp.privateKey,
-    );
-    expect(() => verifyManifest(envelope)).toThrow(/not a valid npm package name/);
-  });
-});
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { generateKeyPairSync, type KeyObject } from 'node:crypto';
+
+import { canonicalJson, signManifest, verifyManifest } from '../manifest.js';
+import type { UpdateManifest } from '../types.js';
+
+/** Generate a fresh Ed25519 keypair and surface the raw 32-byte public key. */
+function freshKeypair(): { publicKey: KeyObject; privateKey: KeyObject; publicRawB64: string } {
+  const { publicKey, privateKey } = generateKeyPairSync('ed25519');
+  // Extract the raw 32-byte public key from SPKI DER (strip the 12-byte header).
+  const spki = publicKey.export({ format: 'der', type: 'spki' });
+  const raw = spki.subarray(12);
+  return { publicKey, privateKey, publicRawB64: Buffer.from(raw).toString('base64') };
+}
+
+const sampleManifest: UpdateManifest = {
+  v: 1,
+  version: '0.7.0',
+  publishedAt: '2026-05-15T18:00:00.000Z',
+  channels: { npm: { package: '@serfab/cadre-host', tag: 'latest' } },
+  releaseNotesUrl: 'https://example.com/notes',
+  minPreviousVersion: '0.6.0',
+};
+
+describe('canonicalJson', () => {
+  it('sorts keys deterministically and omits whitespace', () => {
+    expect(canonicalJson({ b: 1, a: 2 })).toBe('{"a":2,"b":1}');
+    expect(canonicalJson({ outer: { z: 1, a: 2 }, top: true })).toBe('{"outer":{"a":2,"z":1},"top":true}');
+    expect(canonicalJson([3, 2, 1])).toBe('[3,2,1]');
+  });
+
+  it('omits undefined fields', () => {
+    expect(canonicalJson({ a: 1, b: undefined })).toBe('{"a":1}');
+  });
+});
+
+describe('verifyManifest', () => {
+  let kp: ReturnType<typeof freshKeypair>;
+
+  beforeEach(() => {
+    kp = freshKeypair();
+    process.env.CADRE_HOST_UPDATE_DEV_KEY = kp.publicRawB64;
+  });
+
+  afterEach(() => {
+    delete process.env.CADRE_HOST_UPDATE_DEV_KEY;
+  });
+
+  it('round-trips: sign + verify', () => {
+    const envelope = signManifest(sampleManifest, kp.privateKey);
+    const out = verifyManifest(envelope);
+    expect(out).toEqual(sampleManifest);
+  });
+
+  it('rejects a mutated payload (signature_invalid)', () => {
+    const envelope = signManifest(sampleManifest, kp.privateKey);
+    const tampered = { ...envelope, manifest: { ...envelope.manifest, version: '99.0.0' } };
+    expect(() => verifyManifest(tampered)).toThrow(/signature/i);
+  });
+
+  it('rejects a mutated signature (signature_invalid)', () => {
+    const envelope = signManifest(sampleManifest, kp.privateKey);
+    const sigBytes = Buffer.from(envelope.sig.slice('ed25519:'.length), 'base64');
+    sigBytes[0] ^= 0xff;
+    const tampered = { ...envelope, sig: `ed25519:${sigBytes.toString('base64')}` };
+    expect(() => verifyManifest(tampered)).toThrow(/signature/i);
+  });
+
+  it('rejects an envelope signed by a different key (signature_invalid)', () => {
+    const envelope = signManifest(sampleManifest, kp.privateKey);
+    // Swap the env-configured public key to a different fresh one.
+    const other = freshKeypair();
+    process.env.CADRE_HOST_UPDATE_DEV_KEY = other.publicRawB64;
+    expect(() => verifyManifest(envelope)).toThrow(/signature/i);
+  });
+
+  it('rejects malformed envelopes (manifest_invalid)', () => {
+    expect(() => verifyManifest(null)).toThrow(/malformed/);
+    expect(() => verifyManifest({})).toThrow(/malformed/);
+    expect(() => verifyManifest({ manifest: 'nope', sig: 'ed25519:AAAA' })).toThrow(/malformed/);
+  });
+
+  it('rejects manifests missing required fields (manifest_invalid)', () => {
+    const bad = { manifest: { v: 1, version: '0.7.0' }, sig: 'ed25519:AAAA' };
+    expect(() => verifyManifest(bad)).toThrow(/missing required fields/);
+  });
+
+  it('rejects unsupported signature schemes', () => {
+    const envelope = signManifest(sampleManifest, kp.privateKey);
+    const tampered = { ...envelope, sig: envelope.sig.replace('ed25519:', 'rsa:') };
+    expect(() => verifyManifest(tampered)).toThrow(/unsupported signature scheme/);
+  });
+
+  it('rejects non-semver manifest.version (manifest_invalid)', () => {
+    const envelope = signManifest(
+      { ...sampleManifest, version: 'not-a-semver' },
+      kp.privateKey,
+    );
+    expect(() => verifyManifest(envelope)).toThrow(/not a valid semver/i);
+  });
+
+  it('rejects non-semver minPreviousVersion (manifest_invalid)', () => {
+    const envelope = signManifest(
+      { ...sampleManifest, minPreviousVersion: '0.6' },
+      kp.privateKey,
+    );
+    expect(() => verifyManifest(envelope)).toThrow(/minPreviousVersion.*not a valid semver/i);
+  });
+
+  it('rejects publishedAt that is not a round-trippable ISO-8601 string', () => {
+    const envelope = signManifest(
+      { ...sampleManifest, publishedAt: 'sometime last week' },
+      kp.privateKey,
+    );
+    expect(() => verifyManifest(envelope)).toThrow(/publishedAt.*ISO-8601/i);
+  });
+
+  it('rejects an npm package name that fails the naming regex', () => {
+    const envelope = signManifest(
+      {
+        ...sampleManifest,
+        channels: { npm: { package: 'BAD CHARS!', tag: 'latest' } },
+      },
+      kp.privateKey,
+    );
+    expect(() => verifyManifest(envelope)).toThrow(/not a valid npm package name/);
+  });
+});

package/src/update/__tests__/release-key.test.ts

@@ -1,42 +1,42 @@
-import { afterEach, describe, expect, it } from 'vitest';
-import { generateKeyPairSync } from 'node:crypto';
-
-import { isPlaceholderReleaseKey } from '../release-key.js';
-
-function freshPublicRawB64(): string {
-  const { publicKey } = generateKeyPairSync('ed25519');
-  const raw = publicKey.export({ format: 'der', type: 'spki' }).subarray(12);
-  return Buffer.from(raw).toString('base64');
-}
-
-describe('isPlaceholderReleaseKey', () => {
-  afterEach(() => { delete process.env.CADRE_HOST_UPDATE_DEV_KEY; });
-
-  it('is true for an explicit all-zeros placeholder key', () => {
-    const allZeros = Buffer.alloc(32).toString('base64');
-    expect(isPlaceholderReleaseKey({ CADRE_HOST_UPDATE_DEV_KEY: allZeros })).toBe(true);
-  });
-
-  it('is false for the shipped embedded default (real key, no override)', () => {
-    delete process.env.CADRE_HOST_UPDATE_DEV_KEY;
-    expect(isPlaceholderReleaseKey()).toBe(false);
-  });
-
-  it('is false when a real key overrides via CADRE_HOST_UPDATE_DEV_KEY', () => {
-    process.env.CADRE_HOST_UPDATE_DEV_KEY = freshPublicRawB64();
-    expect(isPlaceholderReleaseKey()).toBe(false);
-  });
-
-  it('honors an explicit env argument over process.env', () => {
-    expect(isPlaceholderReleaseKey({ CADRE_HOST_UPDATE_DEV_KEY: freshPublicRawB64() })).toBe(false);
-    // no override in the explicit arg -> falls through to the real embedded default
-    expect(isPlaceholderReleaseKey({})).toBe(false);
-  });
-
-  it('is false for a key that does not decode to 32 bytes', () => {
-    // Not the all-zeros placeholder even though it is a degenerate key: the
-    // 32-byte length gate short-circuits before the all-zeros check.
-    const shortZeros = Buffer.alloc(16).toString('base64');
-    expect(isPlaceholderReleaseKey({ CADRE_HOST_UPDATE_DEV_KEY: shortZeros })).toBe(false);
-  });
-});
+import { afterEach, describe, expect, it } from 'vitest';
+import { generateKeyPairSync } from 'node:crypto';
+
+import { isPlaceholderReleaseKey } from '../release-key.js';
+
+function freshPublicRawB64(): string {
+  const { publicKey } = generateKeyPairSync('ed25519');
+  const raw = publicKey.export({ format: 'der', type: 'spki' }).subarray(12);
+  return Buffer.from(raw).toString('base64');
+}
+
+describe('isPlaceholderReleaseKey', () => {
+  afterEach(() => { delete process.env.CADRE_HOST_UPDATE_DEV_KEY; });
+
+  it('is true for an explicit all-zeros placeholder key', () => {
+    const allZeros = Buffer.alloc(32).toString('base64');
+    expect(isPlaceholderReleaseKey({ CADRE_HOST_UPDATE_DEV_KEY: allZeros })).toBe(true);
+  });
+
+  it('is false for the shipped embedded default (real key, no override)', () => {
+    delete process.env.CADRE_HOST_UPDATE_DEV_KEY;
+    expect(isPlaceholderReleaseKey()).toBe(false);
+  });
+
+  it('is false when a real key overrides via CADRE_HOST_UPDATE_DEV_KEY', () => {
+    process.env.CADRE_HOST_UPDATE_DEV_KEY = freshPublicRawB64();
+    expect(isPlaceholderReleaseKey()).toBe(false);
+  });
+
+  it('honors an explicit env argument over process.env', () => {
+    expect(isPlaceholderReleaseKey({ CADRE_HOST_UPDATE_DEV_KEY: freshPublicRawB64() })).toBe(false);
+    // no override in the explicit arg -> falls through to the real embedded default
+    expect(isPlaceholderReleaseKey({})).toBe(false);
+  });
+
+  it('is false for a key that does not decode to 32 bytes', () => {
+    // Not the all-zeros placeholder even though it is a degenerate key: the
+    // 32-byte length gate short-circuits before the all-zeros check.
+    const shortZeros = Buffer.alloc(16).toString('base64');
+    expect(isPlaceholderReleaseKey({ CADRE_HOST_UPDATE_DEV_KEY: shortZeros })).toBe(false);
+  });
+});

package/src/update/__tests__/sign.test.ts

@@ -1,78 +1,78 @@
-import { afterEach, describe, expect, it } from 'vitest';
-import { generateKeyPairSync, type KeyObject } from 'node:crypto';
-
-import { buildManifest, derivePublicKeyBase64, signAndSelfVerify, type ManifestFields } from '../sign.js';
-import { verifyManifest } from '../manifest.js';
-
-function freshKeypair(): { privateKey: KeyObject; publicRawB64: string } {
-  const { publicKey, privateKey } = generateKeyPairSync('ed25519');
-  const spki = publicKey.export({ format: 'der', type: 'spki' });
-  return { privateKey, publicRawB64: Buffer.from(spki.subarray(12)).toString('base64') };
-}
-
-const validFields: ManifestFields = {
-  version: '0.7.0',
-  package: '@serfab/cadre-host',
-  tag: 'latest',
-  publishedAt: '2026-05-15T18:00:00.000Z',
-  releaseNotesUrl: 'https://example.com/notes',
-  minPreviousVersion: '0.6.0',
-};
-
-describe('buildManifest', () => {
-  it('constructs a well-formed manifest from flat fields', () => {
-    expect(buildManifest(validFields)).toEqual({
-      v: 1,
-      version: '0.7.0',
-      publishedAt: '2026-05-15T18:00:00.000Z',
-      channels: { npm: { package: '@serfab/cadre-host', tag: 'latest' } },
-      releaseNotesUrl: 'https://example.com/notes',
-      minPreviousVersion: '0.6.0',
-    });
-  });
-
-  it('omits optional fields when not provided', () => {
-    const m = buildManifest({ version: '1.0.0', package: 'pkg', tag: 'latest', publishedAt: '2026-01-01T00:00:00.000Z' });
-    expect(m.releaseNotesUrl).toBeUndefined();
-    expect(m.minPreviousVersion).toBeUndefined();
-  });
-
-  it('rejects a bad semver version', () => {
-    expect(() => buildManifest({ ...validFields, version: 'not-semver' })).toThrow(/not a valid semver/i);
-  });
-
-  it('rejects a bad npm package name', () => {
-    expect(() => buildManifest({ ...validFields, package: 'BAD CHARS!' })).toThrow(/not a valid npm package name/i);
-  });
-
-  it('rejects a non-ISO publishedAt', () => {
-    expect(() => buildManifest({ ...validFields, publishedAt: 'last tuesday' })).toThrow(/ISO-8601/i);
-  });
-
-  it('rejects a bad minPreviousVersion', () => {
-    expect(() => buildManifest({ ...validFields, minPreviousVersion: '0.6' })).toThrow(/minPreviousVersion.*not a valid semver/i);
-  });
-});
-
-describe('signAndSelfVerify', () => {
-  afterEach(() => { delete process.env.CADRE_HOST_UPDATE_DEV_KEY; });
-
-  it('produces an envelope that verifies against the derived public key', () => {
-    const kp = freshKeypair();
-    const manifest = buildManifest(validFields);
-    const envelope = signAndSelfVerify(manifest, kp.privateKey);
-    // derivePublicKeyBase64 must agree with the independently-extracted raw key.
-    expect(derivePublicKeyBase64(kp.privateKey)).toBe(kp.publicRawB64);
-    // Independent verification against the derived key round-trips the manifest.
-    process.env.CADRE_HOST_UPDATE_DEV_KEY = kp.publicRawB64;
-    expect(verifyManifest(envelope)).toEqual(manifest);
-  });
-
-  it('the self-verify rejects verification against a different key', () => {
-    const kp = freshKeypair();
-    const other = freshKeypair();
-    const envelope = signAndSelfVerify(buildManifest(validFields), kp.privateKey);
-    process.env.CADRE_HOST_UPDATE_DEV_KEY = other.publicRawB64;
-    expect(() => verifyManifest(envelope)).toThrow(/signature/i);
-  });
-});
+import { afterEach, describe, expect, it } from 'vitest';
+import { generateKeyPairSync, type KeyObject } from 'node:crypto';
+
+import { buildManifest, derivePublicKeyBase64, signAndSelfVerify, type ManifestFields } from '../sign.js';
+import { verifyManifest } from '../manifest.js';
+
+function freshKeypair(): { privateKey: KeyObject; publicRawB64: string } {
+  const { publicKey, privateKey } = generateKeyPairSync('ed25519');
+  const spki = publicKey.export({ format: 'der', type: 'spki' });
+  return { privateKey, publicRawB64: Buffer.from(spki.subarray(12)).toString('base64') };
+}
+
+const validFields: ManifestFields = {
+  version: '0.7.0',
+  package: '@serfab/cadre-host',
+  tag: 'latest',
+  publishedAt: '2026-05-15T18:00:00.000Z',
+  releaseNotesUrl: 'https://example.com/notes',
+  minPreviousVersion: '0.6.0',
+};
+
+describe('buildManifest', () => {
+  it('constructs a well-formed manifest from flat fields', () => {
+    expect(buildManifest(validFields)).toEqual({
+      v: 1,
+      version: '0.7.0',
+      publishedAt: '2026-05-15T18:00:00.000Z',
+      channels: { npm: { package: '@serfab/cadre-host', tag: 'latest' } },
+      releaseNotesUrl: 'https://example.com/notes',
+      minPreviousVersion: '0.6.0',
+    });
+  });
+
+  it('omits optional fields when not provided', () => {
+    const m = buildManifest({ version: '1.0.0', package: 'pkg', tag: 'latest', publishedAt: '2026-01-01T00:00:00.000Z' });
+    expect(m.releaseNotesUrl).toBeUndefined();
+    expect(m.minPreviousVersion).toBeUndefined();
+  });
+
+  it('rejects a bad semver version', () => {
+    expect(() => buildManifest({ ...validFields, version: 'not-semver' })).toThrow(/not a valid semver/i);
+  });
+
+  it('rejects a bad npm package name', () => {
+    expect(() => buildManifest({ ...validFields, package: 'BAD CHARS!' })).toThrow(/not a valid npm package name/i);
+  });
+
+  it('rejects a non-ISO publishedAt', () => {
+    expect(() => buildManifest({ ...validFields, publishedAt: 'last tuesday' })).toThrow(/ISO-8601/i);
+  });
+
+  it('rejects a bad minPreviousVersion', () => {
+    expect(() => buildManifest({ ...validFields, minPreviousVersion: '0.6' })).toThrow(/minPreviousVersion.*not a valid semver/i);
+  });
+});
+
+describe('signAndSelfVerify', () => {
+  afterEach(() => { delete process.env.CADRE_HOST_UPDATE_DEV_KEY; });
+
+  it('produces an envelope that verifies against the derived public key', () => {
+    const kp = freshKeypair();
+    const manifest = buildManifest(validFields);
+    const envelope = signAndSelfVerify(manifest, kp.privateKey);
+    // derivePublicKeyBase64 must agree with the independently-extracted raw key.
+    expect(derivePublicKeyBase64(kp.privateKey)).toBe(kp.publicRawB64);
+    // Independent verification against the derived key round-trips the manifest.
+    process.env.CADRE_HOST_UPDATE_DEV_KEY = kp.publicRawB64;
+    expect(verifyManifest(envelope)).toEqual(manifest);
+  });
+
+  it('the self-verify rejects verification against a different key', () => {
+    const kp = freshKeypair();
+    const other = freshKeypair();
+    const envelope = signAndSelfVerify(buildManifest(validFields), kp.privateKey);
+    process.env.CADRE_HOST_UPDATE_DEV_KEY = other.publicRawB64;
+    expect(() => verifyManifest(envelope)).toThrow(/signature/i);
+  });
+});