feat(web): add account workspaces and signed content flows

web/src/core-bridge/worker/domainCrypto.test.ts

@@ -0,0 +1,19 @@
+import { describe, expect, it } from 'vitest';
+import { randomDomainKey, newObjectKey, unwrapObjectKey } from './domainCrypto';
+import { openJson, sealJson } from './accountCrypto';
+
+describe('channel data-domain object keys', () => {
+  it('uses random independent file keys and binds envelopes to channel, domain, epoch and object', async () => {
+    const domain = randomDomainKey();
+    const context = { spaceId: 'space', channelId: 'channel-a', domain: 'files' as const, epoch: 1, itemId: 'file-a' };
+    const a = await newObjectKey(domain, context); const b = await newObjectKey(domain, context);
+    expect(a.key.extractable).toBe(false); expect(a.envelope).not.toBe(b.envelope);
+    const ciphertext = await sealJson({ data: 'private file' }, a.key);
+    const recovered = await unwrapObjectKey(domain, a.envelope, context);
+    expect(await openJson(ciphertext, recovered)).toEqual({ data: 'private file' });
+    await expect(openJson(ciphertext, b.key)).rejects.toThrow();
+    await expect(unwrapObjectKey(randomDomainKey(), a.envelope, context)).rejects.toThrow();
+    for (const changed of [{ ...context, spaceId: 'other-space' }, { ...context, channelId: 'channel-b' }, { ...context, domain: 'chat' as const }, { ...context, epoch: 2 }, { ...context, itemId: 'file-b' }])
+      await expect(unwrapObjectKey(domain, a.envelope, changed)).rejects.toThrow();
+  });
+});