wsemi 1.8.69 → 1.8.71

package/package.json

@@ -1,11 +1,11 @@
 {
   "name": "wsemi",
-  "version": "1.8.69",
+  "version": "1.8.71",
   "main": "dist/wsemi.umd.js",
   "dependencies": {
     "chokidar": "^5.0.0",
     "crypto-js": "^4.2.0",
-    "dayjs": "^1.11.21",
+    "dayjs": "^1.11.22",
     "decimal.js": "^10.6.0",
     "diff": "^9.0.0",
     "diff2html": "^3.4.56",

package/src/aes2str.mjs

@@ -10,15 +10,16 @@ import isbol from './isbol.mjs'
 
 
 /**
- * 一般字串轉AES字串
- * 使用AES-128-CBC加密，字串採用PKCS#7填充
+ * AES字串轉一般字串
+ * 為str2aes之解密函數，使用AES-128-CBC解密，字串採用PKCS#7填充
+ * str與base64須與加密時str2aes所用之設定相同，否則解不出原文而回傳空字串
  *
  * Unit Test: {@link https://github.com/yuda-lyu/wsemi/blob/master/test/aes2str.test.mjs Github}
  * @memberOf wsemi
- * @param {String} str 輸入一般字串
- * @param {String} key 輸入加密key
- * @param {Boolean} [base64=false] 輸入是否轉為base64字串，預設為false
- * @returns {String} 回傳經AES轉換後字串，採Hex/base64顯示
+ * @param {String} str 輸入AES加密字串，非有效字串時回傳空字串
+ * @param {String} key 輸入加密key，非有效字串時回傳空字串
+ * @param {Boolean} [base64=false] 輸入來源字串是否為base64格式，須與加密時str2aes所用之設定相同，非布林值時回退為false，預設為false
+ * @returns {String} 回傳經AES解密後字串，str或key非有效字串時回傳空字串
  * @example
  *
  * let str = '53616c7465645f5f47214797ac01bc03cceb69ebced4948501ab94ca9644a6dfd277456aead4432cb9c9d74c38c42c79'
@@ -36,8 +37,10 @@ function aes2str(str, key, base64 = false) {
     if (!isestr(key)) {
         return ''
     }
+
+    //check
     if (!isbol(base64)) {
-        return ''
+        base64 = false
     }
 
     let c = ''

package/src/execCli.mjs

@@ -302,6 +302,7 @@ function execCliOnce(command, args = [], opt = {}) {
         maxBuffer = 10 * 1024 * 1024,
         onStdout = undefined,
         onStderr = undefined,
+        env: envExtra = undefined,
     } = opt
 
     //validator
@@ -313,13 +314,31 @@ function execCliOnce(command, args = [], opt = {}) {
     //pm
     let pm = genPm()
 
+    //envSpawn, 併入process.env(同名以envExtra為準, 含PYTHONIOENCODING)
+    //每次attempt於此重新求值並僅作用於該次子進程, 不動本進程process.env, 故並行調用可各自帶不同值
+    let envSpawn = { ...process.env, PYTHONIOENCODING: 'utf-8' }
+    if (envExtra !== undefined) {
+        if (process.platform === 'win32') {
+            //Windows環境變數大小寫不敏感但JS物件敏感, 須先移除大小寫不同之同名既有鍵,
+            //否則呼叫端傳Path而process.env為PATH時兩鍵並存且Windows取原值, 注入靜默失效
+            //此刪除僅限win32: POSIX環境變數大小寫敏感, Path與PATH為兩個獨立變數, 誤刪即退化
+            let ks = Object.keys(envExtra).map((k) => k.toLowerCase())
+            for (let k of Object.keys(envSpawn)) {
+                if (ks.includes(k.toLowerCase())) {
+                    delete envSpawn[k]
+                }
+            }
+        }
+        envSpawn = { ...envSpawn, ...envExtra }
+    }
+
     //spawn
     let winSpawn = buildSpawnArgs(command, args)
     let proc = spawn(winSpawn.file, winSpawn.args, {
         cwd,
         stdio: ['pipe', 'pipe', 'pipe'],
         windowsHide: true, //執行的主程序若沒有主控台調用執行程序就不會有視窗, 但若通過pm2執行會有, 須設定windowsHide=true
-        env: { ...process.env, PYTHONIOENCODING: 'utf-8' },
+        env: envSpawn,
         ...winSpawn.opt,
     })
 
@@ -515,6 +534,7 @@ function execCliOnce(command, args = [], opt = {}) {
  * @param {Number} [opt.maxBuffer=10485760] 輸入stdout與stderr各自累積之最大字元數正整數，超過部分將不再累積，預設10485760(10MB)
  * @param {Function} [opt.onStdout=undefined] 輸入stdout串流回調函數，格式為(chunk)=>{}，預設undefined
  * @param {Function} [opt.onStderr=undefined] 輸入stderr串流回調函數，格式為(chunk)=>{}，預設undefined
+ * @param {Object} [opt.env=undefined] 輸入本次調用額外注入之環境變數物件，會併入process.env之後(同名以此為準，含PYTHONIOENCODING)，僅作用於該次子進程而不影響本進程之process.env，故並行調用可各自帶不同值；值為undefined代表移除該變數(可遮蔽繼承值)，值為null會成為字面字串'null'故建議勿傳；Windows下環境變數大小寫不敏感，同名不同大小寫(如Path與PATH)亦視為同名覆蓋，預設undefined代表不覆寫任何變數
  * @param {Number} [opt.maxRetries=0] 輸入失敗後最大重試次數非負整數，遇ENOENT(命令不存在)或exit code 2(參數錯誤)視為不可重試而立即中止，預設0
  * @param {Number} [opt.retryDelayMs=5000] 輸入重試間隔毫秒正整數，實際間隔為retryDelayMs乘以重試次數且上限15000ms，預設5000
  * @returns {Promise} 回傳Promise，resolve回傳結果物件，內含ok(是否成功布林值)、stdout(標準輸出字串)、stderr(標準錯誤字串)、code(離開碼)、error(錯誤訊息字串，成功時為空字串)、durationMs(耗時毫秒)、pid(子進程pid)、attempts(實際嘗試次數)
@@ -545,6 +565,10 @@ function execCliOnce(command, args = [], opt = {}) {
  *     console.log('r5', r5.ok, r5.error)
  *     // => r5 false TIMEOUT after 0.5s
  *
+ *     let r6 = await execCli(nodeBin, ['-e', 'process.stdout.write(process.env.API_KEY)'], { env: { API_KEY: 'KEY_A' } })
+ *     console.log('r6', r6.ok, r6.stdout, process.env.API_KEY)
+ *     // => r6 true KEY_A undefined (僅作用於該次子進程, 本進程process.env不受影響)
+ *
  * }
  * test()
  *     .catch((err) => {
@@ -597,6 +621,15 @@ async function execCli(command, args = [], opt = {}) {
         onceOpt.input = input
     }
 
+    //env: 逐次注入之環境變數物件, 無效回退預設undefined(未提供 = 不覆寫任何變數)
+    let env = get(onceOpt, 'env', null)
+    if (!isobj(env)) {
+        onceOpt.env = undefined
+    }
+    else {
+        onceOpt.env = env
+    }
+
     //validate: 驗證規則字串, 無效回退預設undefined(未提供 = 不驗證)
     //注意: validate亦可為自訂函數(buildValidator支援), 故先放行function不覆蓋
     let validate = get(onceOpt, 'validate', null)

package/src/index.mjs

@@ -387,6 +387,7 @@ export { default as str2b64 } from './str2b64.mjs'
 export { default as str2hint } from './str2hint.mjs'
 export { default as str2md5 } from './str2md5.mjs'
 export { default as str2obj } from './str2obj.mjs'
+export { default as str2sha } from './str2sha.mjs'
 export { default as str2sha512 } from './str2sha512.mjs'
 export { default as str2u8arr } from './str2u8arr.mjs'
 export { default as strCompare } from './strCompare.mjs'

package/src/obj2str.mjs

@@ -9,9 +9,9 @@ import isarr from './isarr.mjs'
  *
  * Unit Test: {@link https://github.com/yuda-lyu/wsemi/blob/master/test/obj2str.test.mjs Github}
  * @memberOf wsemi
- * @param {*} data 輸入任意資料
- * @param {String|Array} [ext='Uint8Array'] 輸入擴充數據種類字串或陣列，預設'Uint8Array'
- * @returns {String} 回傳base64字串
+ * @param {*} data 輸入任意資料，為undefined時回傳空字串
+ * @param {String|Array} [ext='Uint8Array'] 輸入擴充數據種類字串或陣列，非字串亦非陣列時回退為'Uint8Array'，預設'Uint8Array'
+ * @returns {String} 回傳轉換後字串，data為undefined或無法轉為JSON時回傳空字串
  * @example
  *
  * let o = {
@@ -34,7 +34,8 @@ function obj2str(data, ext = 'Uint8Array') {
         return ''
     }
 
-    //ext
+    //ext, 無效時回退預設值
+    //回退值須為陣列而非字串, 以與isstr分支轉出之型別一致, 否則後續ext.indexOf將由陣列比對變為字串子字串搜尋
     if (isstr(ext)) {
         ext = [ext]
     }
@@ -42,8 +43,7 @@ function obj2str(data, ext = 'Uint8Array') {
         //none
     }
     else {
-        //ext error
-        return ''
+        ext = ['Uint8Array']
     }
 
     //replacer

package/src/str2aes.mjs

@@ -16,10 +16,10 @@ import isbol from './isbol.mjs'
  *
  * Unit Test: {@link https://github.com/yuda-lyu/wsemi/blob/master/test/str2aes.test.mjs Github}
  * @memberOf wsemi
- * @param {String} str 輸入一般字串
- * @param {String} key 輸入加密key
- * @param {Boolean} [base64=false] 輸入是否轉為base64字串，預設為false
- * @returns {String} 回傳經AES轉換後字串，採Hex/base64顯示
+ * @param {String} str 輸入一般字串，非有效字串時回傳空字串
+ * @param {String} key 輸入加密key，非有效字串時回傳空字串
+ * @param {Boolean} [base64=false] 輸入是否轉為base64字串，非布林值時回退為false，預設為false
+ * @returns {String} 回傳經AES轉換後字串，採Hex/base64顯示，str或key非有效字串時回傳空字串
  * @example
  *
  * let str = 'test中文abcdefghijklmn'
@@ -62,8 +62,10 @@ function str2aes(str, key, base64 = false) {
     if (!isestr(key)) {
         return ''
     }
+
+    //check
     if (!isbol(base64)) {
-        return ''
+        base64 = false
     }
 
     let o = AES.encrypt(str, key)

package/src/str2md5.mjs

@@ -13,9 +13,9 @@ import isbol from './isbol.mjs'
  *
  * Unit Test: {@link https://github.com/yuda-lyu/wsemi/blob/master/test/str2md5.test.mjs Github}
  * @memberOf wsemi
- * @param {String} str 輸入一般字串
- * @param {Boolean} [base64=false] 輸入是否轉為base64字串，預設為false
- * @returns {String} 回傳經MD5轉換後字串
+ * @param {String} str 輸入一般字串，非有效字串時回傳空字串
+ * @param {Boolean} [base64=false] 輸入是否轉為base64字串，非布林值時回退為false，預設為false
+ * @returns {String} 回傳經MD5轉換後字串，str非有效字串時回傳空字串
  * @example
  *
  * console.log(str2md5('test中文'))
@@ -28,8 +28,10 @@ function str2md5(str, base64 = false) {
     if (!isestr(str)) {
         return ''
     }
+
+    //check
     if (!isbol(base64)) {
-        return ''
+        base64 = false
     }
 
     let o = MD5(str)

package/src/str2obj.mjs

@@ -9,8 +9,8 @@ import isarr from './isarr.mjs'
  * Unit Test: {@link https://github.com/yuda-lyu/wsemi/blob/master/test/str2obj.test.mjs Github}
  * @memberOf wsemi
  * @param {*} data 輸入任意資料
- * @param {String|Array} [ext='Uint8Array'] 輸入擴充數據種類字串或陣列，預設'Uint8Array'
- * @returns {String} 回傳base64字串
+ * @param {String|Array} [ext='Uint8Array'] 輸入擴充數據種類字串或陣列，非字串亦非陣列時回退為'Uint8Array'，預設'Uint8Array'
+ * @returns {Object} 回傳轉換後資料，data無法解析為JSON時回傳空物件
  * @example
  *
  * console.log(str2obj('{"a":"abc","b":12.3,"u8a":"[Uint8Array]::QmFz","u16a":{"0":11,"1":79,"2":6}}'))
@@ -32,7 +32,8 @@ import isarr from './isarr.mjs'
  */
 function str2obj(data, ext = 'Uint8Array') {
 
-    //ext
+    //ext, 無效時回退預設值
+    //回退值須為陣列而非字串, 以與isstr分支轉出之型別一致, 否則後續ext.indexOf將由陣列比對變為字串子字串搜尋
     if (isstr(ext)) {
         ext = [ext]
     }
@@ -40,8 +41,7 @@ function str2obj(data, ext = 'Uint8Array') {
         //none
     }
     else {
-        //ext error
-        return {}
+        ext = ['Uint8Array']
     }
 
     //replacer

package/src/str2sha.mjs

@@ -0,0 +1,120 @@
+import SHA1 from 'crypto-js/sha1.js'
+import SHA224 from 'crypto-js/sha224.js'
+import SHA256 from 'crypto-js/sha256.js'
+import SHA384 from 'crypto-js/sha384.js'
+import SHA512 from 'crypto-js/sha512.js'
+import encb64 from 'crypto-js/enc-base64.js'
+import enchex from 'crypto-js/enc-hex.js'
+import isbol from './isbol.mjs'
+import isestr from './isestr.mjs'
+import ispint from './ispint.mjs'
+import cint from './cint.mjs'
+import haskey from './haskey.mjs'
+
+
+//crypto-js沒有支援chunk或stream機制, 無法處理大量資料
+
+
+//kpSha, 可用之n與其對應之演算法, 即SHA-1與SHA-2系列(SHA-224/SHA-256/SHA-384/SHA-512)
+//n為演算法名稱之數字, 除SHA-1之1為版本號(實際輸出160位元)外, 其餘皆為輸出位元數
+//crypto-js雖另有SHA-3, 但其為獨立演算法族且輸出位元數與SHA-2重疊(如256), 併入將使n產生歧義故不納入
+let kpSha = {
+    1: SHA1,
+    224: SHA224,
+    256: SHA256,
+    384: SHA384,
+    512: SHA512,
+}
+
+
+/**
+ * 一般字串轉SHA字串
+ * Secure Hash Algorithm n位
+ *
+ * n僅可為1、224、256、384、512，分別對應SHA-1、SHA-224、SHA-256、SHA-384、SHA-512
+ * 其中SHA-1之1為演算法版本號而非輸出位元數(實際輸出160位元)，且已被證實可構造碰撞，僅適用於非資安用途之校驗
+ * n為其餘值時視為程式撰寫錯誤而擲出錯誤，非正整數擲出'n is not a positive integer'，正整數但不在可用範圍則擲出'invalid n[n]'
+ *
+ * Unit Test: {@link https://github.com/yuda-lyu/wsemi/blob/master/test/str2sha.test.mjs Github}
+ * @memberOf wsemi
+ * @param {String} str 輸入一般字串，非有效字串時回傳空字串
+ * @param {Number} n 輸入演算法位數，僅可為1、224、256、384、512，其餘一律擲出錯誤
+ * @param {Boolean} [base64=false] 輸入是否轉為base64字串，非布林值時回退為false，預設為false
+ * @returns {String} 回傳經SHA-n轉換後字串，str非有效字串時回傳空字串
+ * @example
+ *
+ * console.log(str2sha('test中文', 1))
+ * // => 'ecabf586cef0d3b11c56549433ad50b81110a836'
+ *
+ * console.log(str2sha('test中文', 224))
+ * // => 'c9b3eebeae6fe7e42cd9680475787a77e234bce0abb8d599d995b2a6'
+ *
+ * console.log(str2sha('test中文', 256))
+ * // => '8af7c7959618cc0900be74a52eee44aca05aeb72525864dc7ae25d31761beb65'
+ *
+ * console.log(str2sha('test中文', 384))
+ * // => '219ece10ffe81c179511d4ffa43a0c75bbee737acdd18ee11839a1def78a4e10c94186ef8483fce85d0589bcbddf632e'
+ *
+ * console.log(str2sha('test中文', 512))
+ * // => 'ab43333a01571e767a2eb15460c270fa123964c121b88c73e274a211d6e2cf98b10d89220e8d04e2fc573354da93400f3255e94d445dc956e177aa4201a4fc30'
+ *
+ * console.log(str2sha('test中文', 256, true))
+ * // => 'ivfHlZYYzAkAvnSlLu5ErKBa63JSWGTceuJdMXYb62U='
+ *
+ * try {
+ *     str2sha('test中文', 160) //160為SHA-1之輸出位元數而非其演算法名稱, 不可用
+ * }
+ * catch (err) {
+ *     console.log(err.message)
+ *     // => invalid n[160]
+ * }
+ *
+ * try {
+ *     str2sha('test中文', 'abc')
+ * }
+ * catch (err) {
+ *     console.log(err.message)
+ *     // => n is not a positive integer
+ * }
+ *
+ */
+function str2sha(str, n, base64 = false) {
+
+    //check
+    if (!isestr(str)) {
+        return ''
+    }
+
+    //check n, 須為正整數
+    //此檢核須置於haskey之前: haskey內部為key in obj而含原型鏈, 'toString'等鍵會誤判為存在
+    if (!ispint(n)) {
+        throw new Error(`n is not a positive integer`)
+    }
+    n = cint(n)
+
+    //check n, 須為kpSha內可用之n
+    if (!haskey(kpSha, n)) {
+        throw new Error(`invalid n[${n}]`)
+    }
+
+    //check
+    if (!isbol(base64)) {
+        base64 = false
+    }
+
+    let fnSha = kpSha[n]
+
+    let o = fnSha(str)
+    let c = ''
+    if (base64) {
+        c = o.toString(encb64)
+    }
+    else {
+        c = o.toString(enchex)
+    }
+
+    return c
+}
+
+
+export default str2sha

package/src/str2sha512.mjs

@@ -1,49 +1,29 @@
-import SHA512 from 'crypto-js/sha512.js'
-import encb64 from 'crypto-js/enc-base64.js'
-import enchex from 'crypto-js/enc-hex.js'
-import isestr from './isestr.mjs'
-import isbol from './isbol.mjs'
-
-
-//crypto-js沒有支援chunk或stream機制, 無法處理大量資料
-
-
-/**
- * 一般字串轉SHA512字串
- * Secure Hash Algorithm 512位
- *
- * Unit Test: {@link https://github.com/yuda-lyu/wsemi/blob/master/test/str2sha512.test.mjs Github}
- * @memberOf wsemi
- * @param {String} str 輸入一般字串
- * @param {Boolean} [base64=false] 輸入是否轉為base64字串，預設為false
- * @returns {String} 回傳經SHA512轉換後字串
- * @example
- *
- * console.log(str2sha512('test中文'))
- * // => 'ab43333a01571e767a2eb15460c270fa123964c121b88c73e274a211d6e2cf98b10d89220e8d04e2fc573354da93400f3255e94d445dc956e177aa4201a4fc30'
- *
- */
-function str2sha512(str, base64 = false) {
-
-    //check
-    if (!isestr(str)) {
-        return ''
-    }
-    if (!isbol(base64)) {
-        return ''
-    }
-
-    let o = SHA512(str)
-    let c = ''
-    if (base64) {
-        c = o.toString(encb64)
-    }
-    else {
-        c = o.toString(enchex)
-    }
-
-    return c
-}
-
-
-export default str2sha512
+import str2sha from './str2sha.mjs'
+
+
+//crypto-js沒有支援chunk或stream機制, 無法處理大量資料
+
+
+/**
+ * 一般字串轉SHA512字串
+ * Secure Hash Algorithm 512位
+ *
+ * 內部調用str2sha並固定n為512
+ *
+ * Unit Test: {@link https://github.com/yuda-lyu/wsemi/blob/master/test/str2sha512.test.mjs Github}
+ * @memberOf wsemi
+ * @param {String} str 輸入一般字串，非有效字串時回傳空字串
+ * @param {Boolean} [base64=false] 輸入是否轉為base64字串，非布林值時回退為false，預設為false
+ * @returns {String} 回傳經SHA512轉換後字串，str非有效字串時回傳空字串
+ * @example
+ *
+ * console.log(str2sha512('test中文'))
+ * // => 'ab43333a01571e767a2eb15460c270fa123964c121b88c73e274a211d6e2cf98b10d89220e8d04e2fc573354da93400f3255e94d445dc956e177aa4201a4fc30'
+ *
+ */
+function str2sha512(str, base64 = false) {
+    return str2sha(str, 512, base64)
+}
+
+
+export default str2sha512

package/test/aes2str.test.mjs

@@ -27,6 +27,22 @@ describe(`aes2str`, function() {
         assert.strict.deepStrictEqual(r, rr)
     })
 
+    it(`sould fallback base64 to false when base64 is an invalid type`, function() {
+        //base64非布林值時回退為false, 即視來源為hex, 結果須等同明確傳false
+        for (let v of ['', [], {}, null, 1]) {
+            let r = aes2str(o[1], key, v)
+            assert.strict.deepStrictEqual(r, str)
+        }
+    })
+
+    it(`should return '' when key is an invalid type`, function() {
+        assert.strict.deepStrictEqual(aes2str(o[1], ''), '')
+        assert.strict.deepStrictEqual(aes2str(o[1], []), '')
+        assert.strict.deepStrictEqual(aes2str(o[1], {}), '')
+        assert.strict.deepStrictEqual(aes2str(o[1], null), '')
+        assert.strict.deepStrictEqual(aes2str(o[1], undefined), '')
+    })
+
     it(`should return '' when input 12.34`, function() {
         let r = aes2str(12.34)
         let rr = ''

package/test/execCli.test.mjs

@@ -110,6 +110,86 @@ describe(`execCli`, function() {
         assert.strict.deepStrictEqual(cerr.includes('errmsg'), true)
     })
 
+    it(`should not change env behavior when opt.env is not provided`, async function() {
+        let r = await execCli(nodeBin, ['-e', 'process.stdout.write(String(process.env.ENVTEST_FOO))'])
+        assert.strict.deepStrictEqual(r.ok, true)
+        assert.strict.deepStrictEqual(r.stdout, 'undefined')
+    })
+
+    it(`should inject opt.env into child process`, async function() {
+        let r = await execCli(nodeBin, ['-e', 'process.stdout.write(process.env.ENVTEST_FOO)'], { env: { ENVTEST_FOO: 'BAR中文' } })
+        assert.strict.deepStrictEqual(r.ok, true)
+        assert.strict.deepStrictEqual(r.stdout, 'BAR中文')
+    })
+
+    it(`should not pollute parent process.env when opt.env is injected`, async function() {
+        await execCli(nodeBin, ['-e', 'process.stdout.write("ok")'], { env: { ENVTEST_FOO: 'BAR' } })
+        assert.strict.deepStrictEqual(process.env.ENVTEST_FOO, undefined)
+    })
+
+    it(`should keep inherited env vars when opt.env is injected`, async function() {
+        //注入不應清空繼承環境, 否則Windows下子進程連PATH都拿不到
+        let r = await execCli(nodeBin, ['-e', 'process.stdout.write(JSON.stringify(Object.keys(process.env).length > 3))'], { env: { ENVTEST_FOO: 'BAR' } })
+        assert.strict.deepStrictEqual(r.ok, true)
+        assert.strict.deepStrictEqual(r.stdout, 'true')
+    })
+
+    it(`should fallback to no injection when opt.env is not an object`, async function() {
+        let r = await execCli(nodeBin, ['-e', 'process.stdout.write("ok")'], { env: 'not-an-object' })
+        assert.strict.deepStrictEqual(r.ok, true)
+        assert.strict.deepStrictEqual(r.stdout, 'ok')
+    })
+
+    it(`should keep opt.env injection stable across parallel calls with retries`, async function() {
+        //3路並行各帶不同值, 以validate強制失敗走重試路徑, 用onStdout側錄每次attempt實得值
+        //改process.env之作法於重試階段(await delay之後)必被其他並行路污染, opt.env須全數正確
+        let seen = { A: [], B: [], C: [] }
+        await Promise.all(['A', 'B', 'C'].map((v) => execCli(
+            nodeBin, ['-e', 'process.stdout.write(process.env.ENVTEST_KEY)'],
+            {
+                env: { ENVTEST_KEY: v },
+                validate: () => false, //強制每次attempt失敗以觸發重試
+                maxRetries: 1,
+                retryDelayMs: 100,
+                onStdout: (chunk) => {
+                    seen[v].push(String(chunk).trim())
+                },
+            }
+        )))
+        // console.log('seen', JSON.stringify(seen))
+        //每路含重試共2次attempt, 實得值皆須等於該路自己的注入值
+        for (let v of ['A', 'B', 'C']) {
+            assert.strict.deepStrictEqual(seen[v].length >= 2, true)
+            assert.strict.deepStrictEqual(seen[v].every((s) => s === v), true)
+        }
+    })
+
+    it(`should treat undefined value in opt.env as removing the variable`, async function() {
+        //值為undefined代表移除該變數, 可遮蔽繼承值; 以PYTHONIOENCODING(execCli必注入)驗證
+        let sc = 'process.stdout.write(JSON.stringify("PYTHONIOENCODING" in process.env))'
+        let r1 = await execCli(nodeBin, ['-e', sc])
+        assert.strict.deepStrictEqual(r1.stdout, 'true')
+        let r2 = await execCli(nodeBin, ['-e', sc], { env: { PYTHONIOENCODING: undefined } })
+        assert.strict.deepStrictEqual(r2.stdout, 'false')
+    })
+
+    it(`should let opt.env override PYTHONIOENCODING`, async function() {
+        let r = await execCli(nodeBin, ['-e', 'process.stdout.write(process.env.PYTHONIOENCODING)'], { env: { PYTHONIOENCODING: 'ascii' } })
+        assert.strict.deepStrictEqual(r.ok, true)
+        assert.strict.deepStrictEqual(r.stdout, 'ascii')
+    })
+
+    if (process.platform === 'win32') {
+        it(`should override same-name env var with different case on Windows`, async function() {
+            //Windows環境變數大小寫不敏感: 呼叫端傳Path須能覆蓋繼承之PATH, 不可兩鍵並存致注入靜默失效
+            let sc = 'const ks=Object.keys(process.env).filter((k)=>k.toLowerCase()==="path");process.stdout.write(JSON.stringify(ks.map((k)=>process.env[k])))'
+            let r = await execCli(nodeBin, ['-e', sc], { env: { Path: 'C:\\envtest-injected' } })
+            // console.log('case r', JSON.stringify(r.stdout))
+            assert.strict.deepStrictEqual(r.ok, true)
+            assert.strict.deepStrictEqual(JSON.parse(r.stdout), ['C:\\envtest-injected'])
+        })
+    }
+
     it(`should pass validate 'nonempty' when stdout has content`, async function() {
         let r = await execCli(nodeBin, ['-e', 'process.stdout.write("abc")'], { validate: 'nonempty' })
         assert.strict.deepStrictEqual(r.ok, true)

package/test/obj2str.test.mjs

@@ -1,5 +1,6 @@
 import assert from 'assert'
 import obj2str from '../src/obj2str.mjs'
+import str2obj from '../src/str2obj.mjs'
 
 
 describe(`obj2str`, function() {
@@ -25,6 +26,27 @@ describe(`obj2str`, function() {
         assert.strict.deepStrictEqual(r, rr)
     })
 
+    it(`should fallback ext to 'Uint8Array' when ext is an invalid type`, function() {
+        //ext非字串亦非陣列時回退為預設之'Uint8Array', 結果須等同未給ext
+        for (let v of [null, undefined, 12.34, {}, true, NaN]) {
+            let r = obj2str(o, v)
+            assert.strict.deepStrictEqual(r, co1)
+        }
+    })
+
+    it(`should treat string ext the same as single-element array ext`, function() {
+        //回退值與isstr分支轉出之型別須一致, 皆為陣列, 故二者結果須相同
+        assert.strict.deepStrictEqual(obj2str(o, 'Uint8Array'), obj2str(o, ['Uint8Array']))
+        assert.strict.deepStrictEqual(obj2str(o, 'Uint16Array'), obj2str(o, ['Uint16Array']))
+    })
+
+    it(`should round-trip with str2obj under invalid ext`, function() {
+        //obj2str與str2obj須成對使用相同ext, 兩端對無效ext之回退一致才能正確往返
+        let c = obj2str(o, null)
+        let r = str2obj(c, null)
+        assert.strict.deepStrictEqual(r.u8a, o.u8a)
+    })
+
     it(`should return '[1,"3","abc"]' when input [1, '3', 'abc']`, function() {
         let r = obj2str([1, '3', 'abc'])
         let rr = '[1,"3","abc"]'

package/test/str2aes.test.mjs

@@ -18,6 +18,23 @@ describe(`str2aes`, function() {
         assert.strict.deepStrictEqual(r.length, rr)
     })
 
+    it(`sould fallback base64 to false when base64 is an invalid type`, function() {
+        //base64非布林值時回退為false, 即輸出hex(96字元), 而非base64(64字元)
+        //AES每次加密含隨機salt故密文不固定, 以長度辨別輸出格式
+        for (let v of ['', [], {}, null, 1]) {
+            let r = str2aes(str, key, v)
+            assert.strict.deepStrictEqual(r.length, 96)
+        }
+    })
+
+    it(`should return '' when key is an invalid type`, function() {
+        assert.strict.deepStrictEqual(str2aes(str, ''), '')
+        assert.strict.deepStrictEqual(str2aes(str, []), '')
+        assert.strict.deepStrictEqual(str2aes(str, {}), '')
+        assert.strict.deepStrictEqual(str2aes(str, null), '')
+        assert.strict.deepStrictEqual(str2aes(str, undefined), '')
+    })
+
     it(`should return '' when input 12.34`, function() {
         let r = str2aes(12.34)
         let rr = ''