draft: Priority 1 test files T-001 through T-010 in src/drafts/TEST-EXPANSION/

@@ -0,0 +1,130 @@1+// T-006: backup/import NFC raw-fallback decrypt (LV-1 / PCH-01-001 sibling)2+//3+// Why this test exists: backup.ts:96–111 and import.ts:96–111 both contain4+// the LV-1 "raw retry" pattern: if NFC-normalized decryption fails, retry5+// with the un-normalized password bytes. This fallback ensures users with6+// non-NFC-normalized passwords (common on some input methods) can still7+// restore old backups created before the LV-1 NFC-normalize fix.8+//9+// This decrypt path was never directly exercised — the gap was flagged in the10+// coverage analysis §4 as a data-loss risk on the disaster path (backup.ts11+// specifically is the canonical PCH-01-001 pattern source).12+13+import { describe, expect, it } from "vitest";14+import {15+  exportEntriesToPeachJson,16+  importEntriesFromPeachJson,17+  derivePeachExportKey,18+} from "../../shared/backup";19+import { decrypt, encrypt } from "../../background/aes";20+import type { VaultEntry } from "../../shared/types";21+22+// A password that is NOT in NFC form. U+0065 (e) + U+0301 (combining acute)23+// decomposes "é" into two code points. NFC would compose them into U+00E9.24+const NFD_PASSWORD = "café"; // NFD: "café" as e + combining acute25+const NFC_PASSWORD = "café";        // NFC: "café" as single é character26+27+// Check that the passwords are genuinely different as byte sequences28+if (NFD_PASSWORD === NFC_PASSWORD) {29+  throw new Error("Test assumption broken: NFD and NFC passwords are identical on this platform");30+}31+if (NFD_PASSWORD.normalize("NFC") !== NFC_PASSWORD) {32+  throw new Error("Test assumption broken: NFD normalize(NFC) !== NFC");33+}34+35+function sampleEntries(): VaultEntry[] {36+  return [37+    {38+      id: "test-entry-1",39+      type: "login",40+      title: "Test Site",41+      username: "[email protected]",42+      password: "correct-horse-battery",43+      url: "https://example.com",44+      createdAt: 1700000000000,45+      modifiedAt: 1700000000000,46+    },47+  ];48+}49+50+describe("T-006: backup/import NFC raw-fallback decrypt", () => {51+  // T-006a: normal path — export sealed with NFC password → import with NFC password.52+  // This is the standard post-LV-1 happy path.53+  it("T-006a: export sealed with NFC password → import with NFC password succeeds", async () => {54+    const envelope = await exportEntriesToPeachJson(sampleEntries(), NFC_PASSWORD);55+    const result = await importEntriesFromPeachJson(JSON.stringify(envelope), NFC_PASSWORD);56+    expect(result.entries).toHaveLength(1);57+    expect(result.entries[0].title).toBe("Test Site");58+  });59+60+  // T-006b: NFD-sealed export opened with NFC password — the raw fallback path.61+  // This simulates an old backup created before LV-1, where the password was62+  // stored/used in NFD form. The import must succeed via the raw fallback.63+  //64+  // Implementation note: exportEntriesToPeachJson always NFC-normalizes the65+  // passphrase (the LV-1 fix). To create a pre-LV-1 NFD-sealed backup we need66+  // to call derivePeachExportKey with { raw: true } directly.67+  it("T-006b: export sealed with NFD password (raw) → import with NFC password succeeds via fallback", async () => {68+    // Build the envelope manually using the raw (un-normalized) NFD password69+    const salt = crypto.getRandomValues(new Uint8Array(16));70+    const keyBytes = await derivePeachExportKey(NFD_PASSWORD, salt, { raw: true });71+    const inner = { entries: sampleEntries() };72+    const { nonce, ciphertext, tag } = await encrypt(keyBytes, JSON.stringify(inner));73+74+    function toHex(buf: Uint8Array): string {75+      return Array.from(buf).map(b => b.toString(16).padStart(2, "0")).join("");76+    }77+78+    const envelope = JSON.stringify({79+      version: 2,80+      type: "peach-export",81+      kdf: "PBKDF2-SHA256",82+      salt: toHex(salt),83+      nonce,84+      ciphertext,85+      tag,86+    });87+88+    // Importing with the NFC password should succeed via the raw fallback89+    const result = await importEntriesFromPeachJson(envelope, NFC_PASSWORD);90+    expect(result.entries).toHaveLength(1);91+    expect(result.entries[0].title).toBe("Test Site");92+  });93+94+  // T-006c: NFC-sealed export opened with NFD password.95+  // Passing an NFD password to the importer: the first attempt NFC-normalizes it96+  // (producing NFC), which matches the sealed key → success without needing fallback.97+  it("T-006c: export sealed with NFC password → import with NFD password succeeds", async () => {98+    const envelope = await exportEntriesToPeachJson(sampleEntries(), NFC_PASSWORD);99+    // The importer NFC-normalizes the passphrase on the first attempt,100+    // so NFD_PASSWORD.normalize("NFC") === NFC_PASSWORD → succeeds directly.101+    const result = await importEntriesFromPeachJson(JSON.stringify(envelope), NFD_PASSWORD);102+    expect(result.entries).toHaveLength(1);103+    expect(result.entries[0].title).toBe("Test Site");104+  });105+106+  // T-006d: completely wrong password → both NFC and raw attempts fail.107+  // The fallback must not open the vault with a wrong password.108+  it("T-006d: completely wrong password → fails (neither NFC nor raw match)", async () => {109+    const envelope = await exportEntriesToPeachJson(sampleEntries(), NFC_PASSWORD);110+    await expect(111+      importEntriesFromPeachJson(JSON.stringify(envelope), "wrong-password-entirely"),112+    ).rejects.toThrow(/INVALID_EXPORT_PASSWORD/);113+  });114+115+  // T-006e: explicit NFD vs NFC byte sequences produce the same decryption result.116+  // U+0065 U+0301 (NFD "é") vs U+00E9 (NFC "é") must both open a NFC-sealed vault.117+  // This is the canonical PCH-01-001 / LV-1 guarantee.118+  it("T-006e: NFD 'café' (e + combining acute) and NFC 'café' (single é) open the same vault", async () => {119+    const envelope = await exportEntriesToPeachJson(sampleEntries(), NFC_PASSWORD);120+    const envelopeStr = JSON.stringify(envelope);121+122+    // Both the NFC and NFD forms of the password must open the same vault.123+    const resultNfc = await importEntriesFromPeachJson(envelopeStr, NFC_PASSWORD);124+    const resultNfd = await importEntriesFromPeachJson(envelopeStr, NFD_PASSWORD);125+126+    expect(resultNfc.entries[0].title).toBe("Test Site");127+    expect(resultNfd.entries[0].title).toBe("Test Site");128+    expect(resultNfc.entries[0].password).toBe(resultNfd.entries[0].password);129+  });130+});

@@ -0,0 +1,242 @@1+// T-010: PCH-01-018 subnet-probe identity-leak integration2+//3+// Why this test exists: PCH-01-018 added a static-key pin check to the Noise4+// XX initiator that fires BEFORE msg3 is sent. msg3 contains the initiator's5+// long-term static public key (our sync identity). If the responder's static6+// doesn't match the expected paired-device key, the handshake must abort7+// WITHOUT ever transmitting msg3. The pin check is tested in isolation in8+// chirp-sync-transport.test.ts, but no integration test verifies the end-to-end9+// "wrong peer → no msg3" guarantee.10+//11+// Approach: wire noiseXXInitiator and noiseXXResponder together through12+// in-memory channels. The responder uses a DIFFERENT static keypair than13+// expected. We spy on the channel to confirm the initiator never sends a14+// third message (msg3 would be the initiator's encrypted static key).15+16+import { describe, expect, it } from "vitest";17+import { generateKeyPair } from "@stablelib/x25519";18+import {19+  noiseXXInitiator,20+  noiseXXResponder,21+} from "../../shared/noise-xx";22+23+// ---------------------------------------------------------------------------24+// In-memory bidirectional channel25+// ---------------------------------------------------------------------------26+27+interface Channel {28+  send: (msg: Uint8Array) => Promise<void>;29+  receive: () => Promise<Uint8Array>;30+}31+32+function createChannelPair(): { a: Channel; b: Channel } {33+  const aToB: Uint8Array[] = [];34+  const bToA: Uint8Array[] = [];35+  const aToBWaiters: Array<(v: Uint8Array) => void> = [];36+  const bToAWaiters: Array<(v: Uint8Array) => void> = [];37+38+  return {39+    a: {40+      send: async (msg) => {41+        const waiter = aToBWaiters.shift();42+        if (waiter) waiter(msg.slice());43+        else aToB.push(msg.slice());44+      },45+      receive: () => {46+        const msg = bToA.shift();47+        if (msg) return Promise.resolve(msg);48+        return new Promise((resolve) => bToAWaiters.push(resolve));49+      },50+    },51+    b: {52+      send: async (msg) => {53+        const waiter = bToAWaiters.shift();54+        if (waiter) waiter(msg.slice());55+        else bToA.push(msg.slice());56+      },57+      receive: () => {58+        const msg = aToB.shift();59+        if (msg) return Promise.resolve(msg);60+        return new Promise((resolve) => aToBWaiters.push(resolve));61+      },62+    },63+  };64+}65+66+function pubkeyToHex(key: Uint8Array): string {67+  return Array.from(key).map(b => b.toString(16).padStart(2, "0")).join("");68+}69+70+// ---------------------------------------------------------------------------71+// Tests72+// ---------------------------------------------------------------------------73+74+describe("T-010: PCH-01-018 subnet-probe identity-leak integration", () => {75+  // T-010a: the initiator aborts before msg3 when the responder's static76+  // doesn't match the expected paired-device key.77+  //78+  // Key assertion: the responder never receives a third message. msg1 and msg279+  // are exchanged (the Noise XX pre-msg3 handshake), but msg3 — which contains80+  // the initiator's long-term static — is never sent.81+  //82+  // Bug this catches: if verifyRemoteStatic is removed from noiseXXInitiator,83+  // the initiator would send msg3 (exposing our static key to an unknown peer)84+  // and the responder would complete the handshake.85+  it("T-010a: wrong-key responder → initiator aborts before msg3; initiator static not transmitted", async () => {86+    // Initiator (our extension's sync identity)87+    const initiatorKp = generateKeyPair();88+    // Responder (what we EXPECT to talk to)89+    const expectedResponderKp = generateKeyPair();90+    // Actual responder (a different device on the LAN — the attacker scenario)91+    const wrongResponderKp = generateKeyPair();92+93+    const expectedHex = pubkeyToHex(expectedResponderKp.publicKey);94+    const { a: initiatorChannel, b: responderChannel } = createChannelPair();95+96+    // Track how many messages the responder receives97+    let responderMsgCount = 0;98+    const wrappedResponderReceive = async (): Promise<Uint8Array> => {99+      const msg = await responderChannel.receive();100+      responderMsgCount++;101+      return msg;102+    };103+104+    // Run the responder in the background using the WRONG static key.105+    // It will send msg2 with its wrong static, then wait for msg3.106+    const responderPromise = noiseXXResponder(107+      wrongResponderKp.secretKey,108+      wrongResponderKp.publicKey,109+      responderChannel.send,110+      wrappedResponderReceive,111+    ).catch(() => { /* responder may error when msg3 never arrives */ });112+113+    // Run the initiator with a verifyRemoteStatic check against the EXPECTED key.114+    const initiatorPromise = noiseXXInitiator(115+      initiatorKp.secretKey,116+      initiatorKp.publicKey,117+      initiatorChannel.send,118+      initiatorChannel.receive,119+      (remoteStatic) => {120+        const hex = pubkeyToHex(remoteStatic);121+        if (hex !== expectedHex) {122+          throw new Error(123+            `PCH-01-018: unexpected peer static (got ${hex.slice(0, 8)}…, ` +124+            `expected ${expectedHex.slice(0, 8)}…)`,125+          );126+        }127+      },128+    );129+130+    // The initiator must throw (pin check failed), not succeed.131+    await expect(initiatorPromise).rejects.toThrow(/unexpected peer static|PCH-01-018/i);132+133+    // The responder received msg1 (the initiator's ephemeral) and sent msg2.134+    // After that the initiator aborts — msg3 is NEVER sent. The responder135+    // had its receive() called once (for msg1); it never receives msg3.136+    //137+    // responderMsgCount === 1: the responder only received msg1.138+    // If it were 2, the initiator sent msg3 — our static was leaked.139+    expect(responderMsgCount).toBe(1);140+141+    // Clean up the parked responder receive() promise.142+    responderChannel.send(new Uint8Array(0)).catch(() => {});143+    await responderPromise;144+  });145+146+  // T-010b: a correct-key responder allows the handshake to complete.147+  // This is the happy path — the pin check passes and msg3 is sent normally.148+  // Bug this catches: an overly-aggressive pin check that also rejects valid peers.149+  it("T-010b: correct-key responder → handshake proceeds to completion", async () => {150+    const initiatorKp = generateKeyPair();151+    const responderKp = generateKeyPair();152+    const expectedHex = pubkeyToHex(responderKp.publicKey);153+154+    const { a: initiatorChannel, b: responderChannel } = createChannelPair();155+156+    const responderPromise = noiseXXResponder(157+      responderKp.secretKey,158+      responderKp.publicKey,159+      responderChannel.send,160+      responderChannel.receive,161+    );162+163+    const initiatorPromise = noiseXXInitiator(164+      initiatorKp.secretKey,165+      initiatorKp.publicKey,166+      initiatorChannel.send,167+      initiatorChannel.receive,168+      (remoteStatic) => {169+        const hex = pubkeyToHex(remoteStatic);170+        if (hex !== expectedHex) {171+          throw new Error("unexpected peer");172+        }173+      },174+    );175+176+    const [initiatorSession, responderSession] = await Promise.all([177+      initiatorPromise,178+      responderPromise,179+    ]);180+181+    // Both sides get a session — handshake is complete.182+    expect(initiatorSession).toBeDefined();183+    expect(responderSession).toBeDefined();184+185+    // Verify the remote static visible to the initiator is the responder's key186+    expect(pubkeyToHex(initiatorSession.remoteStaticPublicKey)).toBe(expectedHex);187+  });188+189+  // T-010c: no response from the responder (simulate probe timeout).190+  // When the initiator's receive() never resolves, the handshake hangs.191+  // This test verifies the initiator's abort path works and no static is sent.192+  // In production, openChirpSyncSession wraps this in a connection timeout.193+  //194+  // Implementation note: we can't easily test a pure timeout here without195+  // fake timers and AbortController. This test instead verifies that the196+  // initiator does NOT emit msg3 before it hears msg2 — i.e., the handshake197+  // is sequential and the initiator never speculatively leaks its static.198+  it("T-010c: initiator sends only msg1 before receiving msg2 (no speculative msg3)", async () => {199+    const initiatorKp = generateKeyPair();200+    const expectedHex = pubkeyToHex(generateKeyPair().publicKey); // any valid hex201+202+    const sentMessages: Uint8Array[] = [];203+    let receiveCallCount = 0;204+205+    // A send spy that records messages206+    const mockSend = async (msg: Uint8Array) => {207+      sentMessages.push(msg.slice());208+    };209+210+    // A receive that hangs forever (simulates no peer response)211+    const mockReceive = (): Promise<Uint8Array> => {212+      receiveCallCount++;213+      return new Promise(() => { /* never resolves */ });214+    };215+216+    // Start the initiator — it will send msg1 and then wait for msg2.217+    const initiatorPromise = noiseXXInitiator(218+      initiatorKp.secretKey,219+      initiatorKp.publicKey,220+      mockSend,221+      mockReceive,222+      (remoteStatic) => {223+        const hex = pubkeyToHex(remoteStatic);224+        if (hex !== expectedHex) throw new Error("wrong peer");225+      },226+    );227+228+    // Give the event loop a tick to let the initiator send msg1.229+    await new Promise((r) => setTimeout(r, 10));230+231+    // At this point: msg1 has been sent (initiator's ephemeral), but msg2232+    // has not arrived. The initiator must NOT have sent msg3 (our static).233+    //234+    // msg1 = 32 bytes (ephemeral public key, no AEAD)235+    // msg3 = 48 + 16 bytes (encrypted static + encrypted empty payload)236+    expect(sentMessages).toHaveLength(1);237+    expect(sentMessages[0]).toHaveLength(32); // only msg1 (32-byte ephemeral)238+239+    // Clean up: the promise hangs; we don't await it.240+    initiatorPromise.catch(() => {});241+  });242+});

@@ -0,0 +1,245 @@1+// T-009: License Ed25519 signature verification2+//3+// Why this test exists: validateLicense in license.ts has no direct test.4+// The only coverage it gets is via "isPro gate" tests that trigger the5+// pro-gate behavior — they don't actually verify that the Ed25519 signature6+// is checked correctly. A broken or short-circuited verifier would accept7+// any forged license string without a test failing.8+//9+// Integration contract note: T-009a–c (crypto paths) require the production10+// validateLicense to be refactored with an injectable public key, OR to export11+// a validateLicenseWithKey(keyString, pubKeyHex) helper. In the current12+// codebase, PUBLIC_KEY_HEX is read by a private function; the test below13+// uses a local reimplementation with an injected test key so real Ed2551914+// crypto is exercised without the production key.15+// The structural checks (T-009d/e) test the real export directly.16+17+import { beforeAll, describe, expect, it } from "vitest";18+import { validateLicense } from "../../background/license";19+20+// ---------------------------------------------------------------------------21+// Base58 helpers (mirrored from license.ts for test use)22+// ---------------------------------------------------------------------------23+24+const BASE58_ALPHABET = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz";25+26+function base58Encode(bytes: Uint8Array): string {27+  let num = 0n;28+  for (const b of bytes) num = num * 256n + BigInt(b);29+  let out = "";30+  while (num > 0n) {31+    out = BASE58_ALPHABET[Number(num % 58n)] + out;32+    num = num / 58n;33+  }34+  for (const b of bytes) {35+    if (b !== 0) break;36+    out = "1" + out;37+  }38+  return out;39+}40+41+function bytesToHex(bytes: Uint8Array): string {42+  return Array.from(bytes).map(b => b.toString(16).padStart(2, "0")).join("");43+}44+45+function hexToBytes(hex: string): Uint8Array {46+  const out = new Uint8Array(hex.length / 2);47+  for (let i = 0; i < hex.length; i += 2) out[i / 2] = parseInt(hex.slice(i, i + 2), 16);48+  return out;49+}50+51+// ---------------------------------------------------------------------------52+// Test keypair and license builder53+// ---------------------------------------------------------------------------54+55+let testPrivKey: CryptoKey;56+let testPubKeyHex: string;57+58+// Build a valid 76-byte license blob: 12-byte payload + 64-byte Ed25519 sig.59+// payload: [0x01, 0x01, 0x01, days(4 bytes LE), 0x00×5]60+async function buildTestLicense(61+  privKey: CryptoKey,62+  opts: { tamperPayloadByte?: number; tamperSigByte?: number } = {},63+): Promise<string> {64+  const payload = new Uint8Array(12);65+  payload[0] = 0x01; // version66+  payload[1] = 0x01; // plan marker67+  payload[2] = 0x01; // variant marker68+  const issuedDays = Math.floor(Date.now() / (86400 * 1000));69+  new DataView(payload.buffer).setUint32(3, issuedDays, true);70+  // bytes 7–11: reserved zeros71+72+  if (opts.tamperPayloadByte !== undefined) {73+    payload[opts.tamperPayloadByte] ^= 0x01;74+  }75+76+  const sigBytes = new Uint8Array(77+    await crypto.subtle.sign("Ed25519", privKey, payload),78+  );79+80+  if (opts.tamperSigByte !== undefined) {81+    sigBytes[opts.tamperSigByte] ^= 0x01;82+  }83+84+  const blob = new Uint8Array(76);85+  blob.set(payload, 0);86+  blob.set(sigBytes, 12);87+88+  // Format as "PPK-AAAAA-BBBBB-CCCCC-DDDDD-EEEEE"89+  // The actual license format is 5 base58 groups; for testing we can use90+  // a single continuous base58 string split into 5 equal groups.91+  const b58 = base58Encode(blob);92+  // Pad to ensure we can split into 5 groups (actual production code joins them)93+  const chunk = Math.ceil(b58.length / 5);94+  const groups = Array.from({ length: 5 }, (_, i) => b58.slice(i * chunk, (i + 1) * chunk));95+  return "PPK-" + groups.join("-");96+}97+98+// validateLicense variant that uses a test public key instead of the production key.99+// This re-implements the license.ts logic with an injected key for test isolation.100+async function validateLicenseWithKey(101+  keyString: string,102+  pubKeyHex: string,103+): Promise<{ valid: boolean; plan: string }> {104+  const LICENSE_PREFIX = "PPK-";105+  if (!keyString || !keyString.trim().startsWith(LICENSE_PREFIX)) {106+    return { valid: false, plan: "free" };107+  }108+  try {109+    const withoutPrefix = keyString.trim().slice(LICENSE_PREFIX.length);110+    const groups = withoutPrefix.split("-");111+    if (groups.length !== 5) return { valid: false, plan: "free" };112+    const b58 = groups.join("");113+    // base58 decode114+    let num = 0n;115+    for (const char of b58) {116+      const idx = BASE58_ALPHABET.indexOf(char);117+      if (idx === -1) return { valid: false, plan: "free" };118+      num = num * 58n + BigInt(idx);119+    }120+    const hexStr = num.toString(16);121+    const paddedHex = hexStr.length % 2 ? "0" + hexStr : hexStr;122+    const decoded = new Uint8Array(paddedHex.length / 2);123+    for (let i = 0; i < paddedHex.length; i += 2) {124+      decoded[i / 2] = parseInt(paddedHex.slice(i, i + 2), 16);125+    }126+    if (decoded.length !== 76) return { valid: false, plan: "free" };127+128+    const payload = decoded.slice(0, 12);129+    const signature = decoded.slice(12, 76);130+131+    if (payload[0] !== 0x01 || payload[1] !== 0x01 || payload[2] !== 0x01) {132+      return { valid: false, plan: "free" };133+    }134+135+    const pubKey = await (crypto.subtle as Record<string, Function>).importKey(136+      "raw",137+      hexToBytes(pubKeyHex),138+      { name: "Ed25519" },139+      true,140+      ["verify"],141+    ) as CryptoKey;142+143+    const isValid = await (crypto.subtle as Record<string, Function>).verify(144+      "Ed25519",145+      pubKey,146+      signature,147+      payload,148+    ) as boolean;149+150+    return isValid ? { valid: true, plan: "pro" } : { valid: false, plan: "free" };151+  } catch {152+    return { valid: false, plan: "free" };153+  }154+}155+156+// ---------------------------------------------------------------------------157+// Tests158+// ---------------------------------------------------------------------------159+160+describe("T-009: License Ed25519 signature verification", () => {161+  beforeAll(async () => {162+    const kp = await crypto.subtle.generateKey(163+      "Ed25519",164+      true,165+      ["sign", "verify"],166+    );167+    testPrivKey = (kp as CryptoKeyPair).privateKey;168+    const rawPub = new Uint8Array(169+      await crypto.subtle.exportKey("raw", (kp as CryptoKeyPair).publicKey),170+    );171+    testPubKeyHex = bytesToHex(rawPub);172+  });173+174+  // T-009a: valid license payload + valid Ed25519 signature → verification succeeds.175+  // Bug this catches: a broken verifier (wrong algorithm, missing verify call,176+  // always-false return) would reject all licenses.177+  it("T-009a: valid license payload + valid Ed25519 signature → verification succeeds", async () => {178+    const license = await buildTestLicense(testPrivKey);179+    const result = await validateLicenseWithKey(license, testPubKeyHex);180+    expect(result.valid).toBe(true);181+    expect(result.plan).toBe("pro");182+  });183+184+  // T-009b: flipping the last byte of the signature invalidates it.185+  // Bug this catches: a verifier that doesn't call crypto.subtle.verify, or186+  // that ignores the result, would accept this tampered signature.187+  it("T-009b: tampered last byte of signature → verification fails", async () => {188+    const license = await buildTestLicense(testPrivKey, { tamperSigByte: 63 });189+    const result = await validateLicenseWithKey(license, testPubKeyHex);190+    expect(result.valid).toBe(false);191+  });192+193+  // T-009c: a single changed byte in the payload invalidates the signature.194+  // Bug this catches: a verifier that doesn't bind the signature to the payload195+  // would accept a payload with different data (e.g., injected plan byte).196+  it("T-009c: tampered payload byte → verification fails", async () => {197+    // Tamper byte 5 (part of the issuedDays field — always non-zero for recent dates)198+    const license = await buildTestLicense(testPrivKey, { tamperPayloadByte: 5 });199+    const result = await validateLicenseWithKey(license, testPubKeyHex);200+    // The signature was computed over the original payload; a changed payload201+    // produces a mismatch.202+    // Note: if the tampered byte happens to produce the same value (XOR 0x01 on 0x00203+    // changes to 0x01, but the odds of the verify still passing are astronomically small).204+    expect(result.valid).toBe(false);205+  });206+207+  // T-009d: wrong prefix — tests the real validateLicense export.208+  // The prefix check fires before any base58 decode or crypto, so this is209+  // safe to test against the production export.210+  it("T-009d: license without PPK- prefix → validation fails before signature check", async () => {211+    const result = await validateLicense("NOTPPK-AAAAA-BBBBB-CCCCC-DDDDD-EEEEE");212+    expect(result.valid).toBe(false);213+    expect(result.plan).toBe("free");214+  });215+216+  // T-009e: signature too short (truncated to < 64 bytes) — must be handled217+  // gracefully. This tests the 76-byte length check and the try/catch.218+  it("T-009e: signature too short (truncated blob) → handled gracefully, does not throw", async () => {219+    // Build a blob that's only 40 bytes (shorter than 76) and base58-encode it.220+    const short = new Uint8Array(40).fill(0x01);221+    const b58 = base58Encode(short);222+    const chunk = Math.ceil(b58.length / 5);223+    const groups = Array.from({ length: 5 }, (_, i) => b58.slice(i * chunk, (i + 1) * chunk));224+    const license = "PPK-" + groups.join("-");225+226+    const result = await validateLicense(license);227+    expect(result.valid).toBe(false);228+    expect(result.plan).toBe("free");229+  });230+231+  // T-009f: isPro returns true after a valid license is stored.232+  // This wires validateLicense to the chrome.storage path via getLicenseInfo.233+  // Integration contract: this test requires a chrome.storage mock.234+  // (Skipped in the current draft — add chrome mock via the vault test pattern.)235+  it.todo("T-009f: isPro returns true after valid license storage (requires chrome mock)");236+237+  // T-009g: isPro returns false after invalid license verification.238+  it.todo("T-009g: isPro returns false after invalid license (requires chrome mock)");239+240+  // T-009h: wrong group count (4 groups instead of 5) is caught before crypto.241+  it("T-009h: wrong group count → fails before crypto", async () => {242+    const result = await validateLicense("PPK-AAAA-BBBB-CCCC-DDDD");243+    expect(result.valid).toBe(false);244+  });245+});

@@ -0,0 +1,198 @@1+// T-008: PCH-01-016 batch-add canary/tag sanitization2+//3+// Why this test exists: the MV-6 import whitelist was applied to the4+// RESTORE_ENTRIES path (vault.restoreEntries) but the BATCH_ADD_ENTRIES5+// path was a separate code path that also called sanitizeEntryDraft.6+// PCH-01-016 added sanitizeCanary and sanitizeTags to sanitizeEntryDraft7+// so both entry-add paths apply the same sanitization. This is the actual8+// attacker-reachable bulk surface — a content-script XSS or a rogue extension9+// API caller could POST to BATCH_ADD_ENTRIES with a poisoned canary webhook10+// URL or unbounded tags. No test previously exercised this path.11+12+import { beforeEach, describe, expect, it, vi } from "vitest";13+14+type StorageShape = Record<string, unknown>;15+16+describe("T-008: PCH-01-016 batch-add canary/tag sanitization", () => {17+  let storage: StorageShape;18+  let vault: typeof import("../../background/vault");19+20+  beforeEach(async () => {21+    vi.resetModules();22+    storage = {};23+24+    const chromeMock = {25+      storage: {26+        local: {27+          get: vi.fn(async (key?: string | string[]) => {28+            if (!key) return storage;29+            if (typeof key === "string") return { [key]: storage[key] };30+            return (Array.isArray(key) ? key : [key]).reduce<StorageShape>(31+              (acc, k) => { acc[k] = storage[k]; return acc; },32+              {},33+            );34+          }),35+          set: vi.fn(async (next: StorageShape) => { Object.assign(storage, next); }),36+          remove: vi.fn(async (keys: string | string[]) => {37+            const ks = Array.isArray(keys) ? keys : [keys];38+            for (const k of ks) delete storage[k];39+          }),40+        },41+        session: {42+          get: vi.fn(async () => ({})),43+          set: vi.fn(async () => {}),44+          remove: vi.fn(async () => {}),45+        },46+      },47+      alarms: {48+        clear: vi.fn(),49+        create: vi.fn(),50+        onAlarm: { addListener: vi.fn() },51+      },52+      idle: {53+        setDetectionInterval: vi.fn(),54+        onStateChanged: { addListener: vi.fn() },55+      },56+    } as unknown as typeof chrome;57+58+    (globalThis as Record<string, unknown>).chrome = chromeMock;59+    vi.stubGlobal("fetch", vi.fn(async () => { throw new Error("no network"); }));60+61+    vault = await import("../../background/vault");62+    await vault.createVault("test-batch-sanitize-pass");63+  });64+65+  // T-008a: non-HTTPS canary webhook URL is stripped from the entry.66+  // The entry itself must be saved (canary stripped, not entry rejected).67+  // Bug this catches: a poisoned canary could exfiltrate entry titles to an68+  // attacker-controlled endpoint; HTTP (non-TLS) allows plaintext interception.69+  it("T-008a: non-HTTPS canary webhook stripped (entry saved, canary absent)", async () => {70+    const added = await vault.batchAddEntries([71+      {72+        type: "login",73+        title: "Canary Test",74+        username: "u",75+        password: "p",76+        url: "https://example.com",77+        canary: { webhookUrl: "http://attacker.example.com/steal" },78+      },79+    ]);80+81+    expect(added).toHaveLength(1);82+    expect(added[0].title).toBe("Canary Test");83+    // Bug this catches: non-HTTPS canary passes through and gets stored84+    expect(added[0].canary).toBeUndefined();85+  });86+87+  // T-008b: HTTPS canary webhook URL is preserved.88+  // This is the "legitimate canary" control case — HTTPS webhooks must work.89+  it("T-008b: HTTPS canary webhook URL is preserved", async () => {90+    const added = await vault.batchAddEntries([91+      {92+        type: "login",93+        title: "Legit Canary",94+        username: "u",95+        password: "p",96+        url: "https://example.com",97+        canary: { webhookUrl: "https://legit.example.com/notify" },98+      },99+    ]);100+101+    expect(added).toHaveLength(1);102+    expect(added[0].canary?.webhookUrl).toBe("https://legit.example.com/notify");103+  });104+105+  // T-008c: tags are capped at 255 items and each tag is capped at 256 chars.106+  // Bug this catches: unbounded tags could consume storage quota or cause UI107+  // rendering issues; server-side (sync) tags that exceed the codec cap could108+  // break Codex encode/decode.109+  it("T-008c: oversized tags array is capped at 255 items", async () => {110+    const massiveTags = Array.from({ length: 500 }, (_, i) => `tag-${i}`);111+    const added = await vault.batchAddEntries([112+      {113+        type: "login",114+        title: "Tag Test",115+        username: "u",116+        password: "p",117+        url: "https://example.com",118+        tags: massiveTags,119+      },120+    ]);121+122+    expect(added).toHaveLength(1);123+    expect(added[0].tags!.length).toBeLessThanOrEqual(255);124+  });125+126+  it("T-008c: individual tag exceeding 256 chars is truncated to 256 chars", async () => {127+    const longTag = "x".repeat(300);128+    const added = await vault.batchAddEntries([129+      {130+        type: "login",131+        title: "Long Tag Test",132+        username: "u",133+        password: "p",134+        url: "https://example.com",135+        tags: [longTag],136+      },137+    ]);138+139+    expect(added).toHaveLength(1);140+    expect(added[0].tags![0].length).toBeLessThanOrEqual(256);141+  });142+143+  // T-008d: __proto__ key in entry payload must not appear on the saved entry.144+  // Bug this catches: prototype pollution via imported entries; normalizeEntry145+  // whitelists only known fields so __proto__ should be dropped entirely.146+  it("T-008d: __proto__ key in payload is absent from the saved entry", async () => {147+    const maliciousDraft = {148+      type: "login" as const,149+      title: "Proto Test",150+      username: "u",151+      password: "p",152+      url: "https://example.com",153+      // TypeScript won't let us assign __proto__ directly, so cast154+      ...({ __proto__: { poisoned: true } } as object),155+    };156+157+    const added = await vault.batchAddEntries([maliciousDraft]);158+    expect(added).toHaveLength(1);159+    // Bug this catches: prototype pollution persists in the saved entry160+    expect((added[0] as Record<string, unknown>).poisoned).toBeUndefined();161+    expect(Object.getPrototypeOf(added[0])).toBe(Object.prototype);162+  });163+164+  // T-008e: passkey entry with missing credentialId is rejected.165+  // sanitizeEntryDraft validates the passkey sub-object; a passkey without a166+  // credentialId cannot be used for authentication and must not silently import167+  // as a broken credential.168+  it("T-008e: passkey entry missing credentialId is rejected (null from sanitizeEntryDraft)", async () => {169+    const added = await vault.batchAddEntries([170+      {171+        type: "login" as const,172+        title: "Bad Passkey",173+        username: "u",174+        password: "",175+        url: "https://example.com",176+        passkey: {177+          rpId: "example.com",178+          rpName: "Example",179+          credentialId: "", // empty — invalid180+          publicKeyCose: "a401020326",181+          privateKeyJwk: { kty: "EC", crv: "P-256" },182+          userHandle: "uh",183+          userName: "user",184+          userDisplayName: "User",185+          algorithm: -7 as const,186+          signCount: 0,187+          aaguid: "AAAAAAAAAAAAAAAAAAAAAA",188+          backupEligible: false,189+          backupState: false,190+          createdAt: Date.now(),191+        },192+      },193+    ]);194+195+    // The entry should be skipped (batchAddEntries silently drops invalid drafts)196+    expect(added).toHaveLength(0);197+  });198+});

@@ -0,0 +1,111 @@1+// T-007: MV-9 pdf.js sandbox flags regression test2+//3+// Why this test exists: MV-9 hardened the pdf.js getDocument call with four4+// security options (isEvalSupported:false, disableFontFace/Range/Stream:true)5+// to defend against CVE-2024-4367-class eval-via-font attacks and limit the6+// attack surface of a crafted PDF in the Codex restore path. No test asserts7+// these options are present. A refactor that silently removes or inverts any8+// flag re-exposes the attack surface with no test failure.9+10+import { beforeEach, describe, expect, it, vi } from "vitest";11+12+// ---------------------------------------------------------------------------13+// Mock pdfjs-dist before importing pdf-import.ts.14+// importCodexPDF uses a lazy `import("pdfjs-dist")` that is cached in a15+// module-level variable. vi.mock intercepts dynamic imports too, so the mock16+// is in place before any test runs.17+// ---------------------------------------------------------------------------18+19+const getDocumentMock = vi.fn();20+21+vi.mock("pdfjs-dist", () => ({22+  GlobalWorkerOptions: { workerSrc: "" },23+  getDocument: getDocumentMock,24+}));25+26+import { importCodexPDF } from "../../popup/codex/pdf-import";27+28+// A minimal File object that passes the size check (< MAX_PDF_BYTES = 25 MiB)29+// and has a non-zero size. importCodexPDF calls file.arrayBuffer() before30+// getDocument, so we need to return a valid ArrayBuffer.31+function makeFakeFile(bytes: Uint8Array = new Uint8Array([0x25, 0x50, 0x44, 0x46])): File {32+  return {33+    size: bytes.length,34+    name: "test.pdf",35+    arrayBuffer: async () => bytes.buffer,36+    type: "application/pdf",37+  } as unknown as File;38+}39+40+describe("T-007: MV-9 pdf.js sandbox flags", () => {41+  beforeEach(() => {42+    vi.clearAllMocks();43+44+    // Return a valid-looking pdf object that won't crash importCodexPDF.45+    // We only care about what getDocument was called WITH, not what it returns.46+    getDocumentMock.mockReturnValue({47+      promise: Promise.resolve({48+        numPages: 0,49+        getPage: vi.fn(),50+      }),51+    });52+  });53+54+  // T-007a: the four hardened options are all present and correct.55+  // Bug this catches: any one of these flags being removed or set to the wrong56+  // value re-opens the attack surface guarded by MV-9.57+  it("T-007a: getDocument called with all four MV-9 hardened options", async () => {58+    const file = makeFakeFile();59+    await importCodexPDF(file);60+61+    expect(getDocumentMock).toHaveBeenCalledOnce();62+    const callArgs = getDocumentMock.mock.calls[0][0] as Record<string, unknown>;63+64+    expect(callArgs.isEvalSupported).toBe(false);65+    expect(callArgs.disableFontFace).toBe(true);66+    expect(callArgs.disableRange).toBe(true);67+    expect(callArgs.disableStream).toBe(true);68+  });69+70+  // T-007b: none of the hardened flags are missing.71+  // An undefined flag is as dangerous as false/true in the wrong direction —72+  // pdf.js uses its own defaults when a flag is absent.73+  it("T-007b: hardened flags are explicitly set, not absent", async () => {74+    const file = makeFakeFile();75+    await importCodexPDF(file);76+77+    const callArgs = getDocumentMock.mock.calls[0][0] as Record<string, unknown>;78+79+    expect("isEvalSupported" in callArgs).toBe(true);80+    expect("disableFontFace" in callArgs).toBe(true);81+    expect("disableRange" in callArgs).toBe(true);82+    expect("disableStream" in callArgs).toBe(true);83+  });84+85+  // T-007c: hardened options do not break the import flow — PDF import still86+  // succeeds (or fails for PDF-content reasons, not for options reasons).87+  // This is a regression guard: the flags must not make the PDF importer crash.88+  it("T-007c: hardened options do not prevent getDocument from being called", async () => {89+    const file = makeFakeFile();90+    // We don't care whether the import succeeds (numPages=0 means no chunks91+    // found); we care that getDocument was actually called (not short-circuited92+    // due to the hardened options).93+    await importCodexPDF(file);94+95+    expect(getDocumentMock).toHaveBeenCalledOnce();96+  });97+98+  // T-007d: isEvalSupported must be false, not truthy.99+  // A refactor that accidentally passes isEvalSupported:true re-enables the100+  // eval path that CVE-2024-4367 exploited. The strictness of the check matters.101+  it("T-007d: isEvalSupported is strictly false, not just falsy", async () => {102+    const file = makeFakeFile();103+    await importCodexPDF(file);104+105+    const callArgs = getDocumentMock.mock.calls[0][0] as Record<string, unknown>;106+    expect(callArgs.isEvalSupported).toStrictEqual(false);107+    expect(callArgs.isEvalSupported).not.toBeUndefined();108+    expect(callArgs.isEvalSupported).not.toBeNull();109+    expect(callArgs.isEvalSupported).not.toBe(0);110+  });111+});

@@ -0,0 +1,257 @@1+// T-005: peachPayload declared-length decompression bomb (MV-4)2+//3+// Why this test exists: MV-4 added two guards in peachPayload.ts's section4+// parsing loop:5+//   1. length > MAX_DECLARED_LENGTH → throw BEFORE calling decompressZstd6+//   2. totalDecompressed > MAX_DECOMPRESSED_BYTES → throw BEFORE calling7+//      decompressZstd on the next section8+//9+// The existing decompression-bomb.test.ts only exercises the zstd output cap10+// (MAX_DECOMPRESSED_BYTES applied inside decompressZstd itself). It does NOT11+// test that the *declared-length* field check fires before decompression is12+// attempted. Without this test, the declared-length guard could be removed13+// (allowing a 100-byte section to claim a 100 GiB decompressed size) and no14+// existing test would fail — because if the zstd frame is honest the output15+// cap catches it, but the declared-length check is the FIRST line of defense16+// and exists to reject before even calling the decompressor.17+18+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";19+import { argon2id, blake3 } from "hash-wasm";20+21+// Spy on decompressZstd before it is imported by peachPayload.22+// vi.mock is hoisted to the top of the file so the spy is in place23+// before any module that imports decompressZstd is evaluated.24+vi.mock("../../crypto/zstd", async (importOriginal) => {25+  const mod = await importOriginal<typeof import("../../crypto/zstd")>();26+  return {27+    ...mod,28+    decompressZstd: vi.fn(mod.decompressZstd),29+  };30+});31+32+import { parsePayload } from "../../crypto/peachPayload";33+import { decompressZstd } from "../../crypto/zstd";34+import { IMPORT_LIMITS } from "../../shared/import-limits";35+36+// ---------------------------------------------------------------------------37+// Helpers38+// ---------------------------------------------------------------------------39+40+const PASSPHRASE = "test-bomb-passphrase";41+42+// Argon2id parameters must match peachPayload.ts exactly or decryption fails.43+const ARGON2_PARAMS = {44+  parallelism: 4,45+  iterations: 3,46+  memorySize: 65536, // 64 MiB47+  hashLength: 32,48+} as const;49+50+function concat(arrays: Uint8Array[]): Uint8Array {51+  const total = arrays.reduce((s, a) => s + a.length, 0);52+  const out = new Uint8Array(total);53+  let cursor = 0;54+  for (const a of arrays) { out.set(a, cursor); cursor += a.length; }55+  return out;56+}57+58+function hexToBytes(hex: string): Uint8Array {59+  const out = new Uint8Array(hex.length / 2);60+  for (let i = 0; i < hex.length; i += 2) {61+    out[i / 2] = parseInt(hex.slice(i, i + 2), 16);62+  }63+  return out;64+}65+66+/**67+ * Build a fully-encrypted peachPayload envelope whose section header68+ * declares `declaredLength` for the decompressed size. The compressed69+ * data is a minimal zstd frame so the structure parses, but the70+ * declared-length check fires first.71+ *72+ * By constructing the payload ourselves (using the same Argon2id KDF and73+ * AES-GCM as peachPayload.ts), we avoid mocking the crypto layer while74+ * still controlling the section header bytes.75+ */76+async function buildBombPayload(77+  passphrase: string,78+  declaredLength: number,79+  sectionCount = 1,80+): Promise<Uint8Array> {81+  const MAGIC = 0x50434853; // "PCHS"82+  const VERSION = 0x01;83+  const FORMAT_V3 = 0x03;84+  const SECTION_ENTRIES = 0x01;85+  const CHECKSUM_LEN = 4;86+87+  // A minimal zstd frame for a 1-byte input — real but tiny.88+  // This is what would be decompressed if the declared-length check didn't fire.89+  // zstd magic (4 bytes) + frame header + literal block.90+  // We use a known-valid zstd frame (from the zstd.test.ts pattern):91+  // compress(new Uint8Array([0x00])) produces a short frame.92+  // For test purposes, use a raw zstd frame for 1 zero byte.93+  const minimalCompressed = new Uint8Array([94+    0x28, 0xb5, 0x2f, 0xfd, // zstd magic95+    0x04, 0x00, 0x31, 0x00,  // frame header (content_size=1, single segment)96+    0x00, 0x01, 0x00, 0x00,  // block header (last block, raw, size 1)97+    0x00,                    // literal: one zero byte98+    0x3e, 0x4a, 0xa9, 0x83,  // content checksum99+  ]);100+101+  // Build section: type(1) + declared_length(4 LE) + compressed_length(4 LE) + data102+  const sections: Uint8Array[] = [];103+  for (let i = 0; i < sectionCount; i++) {104+    const sec = new Uint8Array(9 + minimalCompressed.length);105+    sec[0] = SECTION_ENTRIES;106+    new DataView(sec.buffer).setUint32(1, declaredLength, true);107+    new DataView(sec.buffer).setUint32(5, minimalCompressed.length, true);108+    sec.set(minimalCompressed, 9);109+    sections.push(sec);110+  }111+112+  // Build body: header(8) + sections113+  const header = new Uint8Array(8);114+  new DataView(header.buffer).setUint32(0, MAGIC, false);115+  header[4] = VERSION;116+  header[5] = sections.length;117+  const body = concat([header, ...sections]);118+119+  // BLAKE3 checksum (first 4 bytes of the 32-byte hash)120+  const checksumHex = await blake3(body, 32);121+  const checksum = hexToBytes(checksumHex).slice(0, CHECKSUM_LEN);122+123+  const inner = concat([body, checksum]);124+125+  // v3 format wrapper: [FORMAT_V3(1)][inner_len(4 LE)][inner]126+  const wrapper = new Uint8Array(5);127+  wrapper[0] = FORMAT_V3;128+  new DataView(wrapper.buffer).setUint32(1, inner.length, true);129+  const plaintext = concat([wrapper, inner]);130+131+  // Derive the encryption key (same Argon2id params as peachPayload.ts)132+  const salt = new Uint8Array(16).fill(0x42); // deterministic for tests133+  const nonce = new Uint8Array(12).fill(0x13);134+  const keyBytes = await argon2id({135+    password: passphrase.normalize("NFC"),136+    salt,137+    ...ARGON2_PARAMS,138+    outputType: "binary",139+  });140+141+  // AES-256-GCM encrypt142+  const cryptoKey = await crypto.subtle.importKey(143+    "raw",144+    keyBytes.buffer as ArrayBuffer,145+    { name: "AES-GCM", length: 256 },146+    false,147+    ["encrypt"],148+  );149+  const rawCt = new Uint8Array(150+    await crypto.subtle.encrypt(151+      { name: "AES-GCM", iv: nonce.buffer as ArrayBuffer, tagLength: 128 },152+      cryptoKey,153+      plaintext.buffer.slice(154+        plaintext.byteOffset,155+        plaintext.byteOffset + plaintext.byteLength,156+      ) as ArrayBuffer,157+    ),158+  );159+  // WebCrypto appends the 16-byte tag to the ciphertext.160+  // peachPayload's format: salt(16) + nonce(12) + ciphertext + tag(16)161+  const ciphertext = rawCt.slice(0, rawCt.length - 16);162+  const tag = rawCt.slice(rawCt.length - 16);163+  return concat([salt, nonce, ciphertext, tag]);164+}165+166+// ---------------------------------------------------------------------------167+// Tests168+// ---------------------------------------------------------------------------169+170+describe("T-005: peachPayload declared-length decompression bomb (MV-4)", () => {171+  beforeEach(() => {172+    vi.clearAllMocks();173+  });174+175+  afterEach(() => {176+    vi.clearAllMocks();177+  });178+179+  // T-005a: a single section declaring length > MAX_DECLARED_LENGTH must throw180+  // BEFORE decompressZstd is called. The spy on decompressZstd must not be181+  // invoked — the guard fires at the declared-length check, not at inflate time.182+  it("T-005a: declared length > MAX_DECLARED_LENGTH throws before decompressZstd", async () => {183+    const bombPayload = await buildBombPayload(184+      PASSPHRASE,185+      IMPORT_LIMITS.MAX_DECLARED_LENGTH + 1,186+    );187+188+    const decompress = decompressZstd as ReturnType<typeof vi.fn>;189+    decompress.mockClear();190+191+    await expect(parsePayload(bombPayload, PASSPHRASE)).rejects.toThrow(192+      /IMPORT_TOO_LARGE/,193+    );194+195+    // Bug this catches: if the declared-length check is removed, decompressZstd196+    // would be called and this assertion would fail.197+    expect(decompress).not.toHaveBeenCalled();198+  }, 30_000); // Argon2id is slow199+200+  // T-005b: multiple sections summing to > MAX_DECOMPRESSED_BYTES must reject201+  // even if each individual section is under MAX_DECLARED_LENGTH.202+  // We use 2 sections each declaring MAX_DECLARED_LENGTH/2 + 1 so the203+  // running total exceeds MAX_DECOMPRESSED_BYTES on the second section.204+  it("T-005b: cumulative section sum > MAX_DECOMPRESSED_BYTES throws before decompress", async () => {205+    const half = Math.floor(IMPORT_LIMITS.MAX_DECOMPRESSED_BYTES / 2) + 1;206+    const bombPayload = await buildBombPayload(PASSPHRASE, half, 2);207+208+    const decompress = decompressZstd as ReturnType<typeof vi.fn>;209+    decompress.mockClear();210+211+    await expect(parsePayload(bombPayload, PASSPHRASE)).rejects.toThrow(212+      /IMPORT_TOO_LARGE/,213+    );214+    // The first section is under the limit so decompressZstd MAY be called215+    // for section 0; the cumulative check fires on section 1.216+    // Key assertion: the throw comes from the cumulative guard, not zstd output.217+  }, 30_000);218+219+  // T-005c: a section declaring exactly MAX_DECLARED_LENGTH - 1 is at the220+  // boundary and must NOT throw on the declared-length check alone.221+  // (The actual decompression may fail for other reasons — zstd output cap,222+  // or decompressed size mismatch — but not on the declared-length guard.)223+  it("T-005c: declared length at MAX_DECLARED_LENGTH - 1 passes the declared-length check", async () => {224+    const justUnder = IMPORT_LIMITS.MAX_DECLARED_LENGTH - 1;225+    const bombPayload = await buildBombPayload(PASSPHRASE, justUnder);226+227+    // Should NOT throw IMPORT_TOO_LARGE for the declared-length reason;228+    // it may throw for SECTION_LENGTH_MISMATCH (the actual decompressed size229+    // differs from the claimed size), but that's a different guard.230+    await expect(parsePayload(bombPayload, PASSPHRASE)).rejects.toThrow(231+      /SECTION_LENGTH_MISMATCH|CHECKSUM|PAYLOAD_TOO_SHORT/,232+    );233+  }, 30_000);234+235+  // T-005d: the size check fires before AES-GCM authentication failure.236+  // (This is implicitly tested by T-005a: we decrypt successfully and THEN237+  // the size check fires. If the order were reversed, the AES-GCM tag would238+  // need to match before we could tamper with the payload, which is a239+  // contradiction. The actual order is: AES-GCM decrypt → declared-length check.)240+  // This test documents the ordering explicitly.241+  it("T-005d: AES-GCM decryption succeeds; bomb is rejected at the section-size guard", async () => {242+    const bombPayload = await buildBombPayload(243+      PASSPHRASE,244+      IMPORT_LIMITS.MAX_DECLARED_LENGTH + 1,245+    );246+247+    // The error must be IMPORT_TOO_LARGE (size guard), not INVALID_PASSPHRASE248+    // (auth tag failure). This confirms the payload decrypts successfully before249+    // the bomb is detected.250+    await expect(parsePayload(bombPayload, PASSPHRASE)).rejects.toThrow(251+      /IMPORT_TOO_LARGE/,252+    );253+    await expect(parsePayload(bombPayload, PASSPHRASE)).rejects.not.toThrow(254+      /INVALID_PASSPHRASE/,255+    );256+  }, 30_000);257+});