@blamejs/blamejs-shop 0.0.44

package/lib/vendor/blamejs/bench/run.js

@@ -0,0 +1,140 @@
+"use strict";
+// bench/run.js — discovers bench/*.bench.js files, runs every entry,
+// emits a flat JSON record to bench/baseline.json (or --out <path>).
+//
+// Usage:
+//   node bench/run.js                       run all, print to stderr, write JSON
+//   node bench/run.js --filter <substring>  run only matching benches
+//   node bench/run.js --out <path>          write to a different JSON file
+//   node bench/run.js --compare             compare against bench/baseline.json
+//                                           and exit non-zero on regression
+//   node bench/run.js --warmup <n>          override warmup iters per bench
+//   node bench/run.js --runMs <n>           override per-bench run duration
+
+var fs = require("node:fs");
+var os = require("node:os");
+var path = require("node:path");
+
+var harness = require("./_helpers");
+
+var ROOT     = path.resolve(__dirname, "..");
+var BENCH_DIR = __dirname;
+var DEFAULT_OUT = path.join(BENCH_DIR, "baseline.json");
+var REGRESS_THRESHOLD = 0.30; // 30% slowdown trips the gate
+
+function _parseArgs(argv) {
+  var out = { filter: null, outPath: DEFAULT_OUT, compare: false, warmup: null, runMs: null };
+  for (var i = 0; i < argv.length; i++) {
+    var a = argv[i];
+    if (a === "--filter")  out.filter  = argv[++i] || null;
+    else if (a === "--out")     out.outPath = argv[++i] || DEFAULT_OUT;
+    else if (a === "--compare") out.compare = true;
+    else if (a === "--warmup")  out.warmup  = Number(argv[++i]);
+    else if (a === "--runMs")   out.runMs   = Number(argv[++i]);
+  }
+  return out;
+}
+
+function _discover() {
+  return fs.readdirSync(BENCH_DIR)
+    .filter(function (f) { return f.endsWith(".bench.js"); })
+    .sort()
+    .map(function (f) { return path.join(BENCH_DIR, f); });
+}
+
+function _machineInfo() {
+  var cpus = os.cpus();
+  return {
+    platform:   process.platform,
+    arch:       process.arch,
+    node:       process.version,
+    cpuModel:   cpus[0] ? cpus[0].model : "unknown",
+    cpuCount:   cpus.length,
+    totalMemMB: Math.round(os.totalmem() / 1024 / 1024),
+  };
+}
+
+function _runFile(filePath, opts, args) {
+  var mod = require(filePath);
+  if (!mod || !mod.benchmarks || typeof mod.benchmarks !== "object") {
+    process.stderr.write("[bench] " + filePath + ": no benchmarks export, skipped\n");
+    return [];
+  }
+  var rows = [];
+  Object.keys(mod.benchmarks).forEach(function (label) {
+    var fullLabel = mod.name + " / " + label;
+    if (args.filter && fullLabel.indexOf(args.filter) < 0) return;
+    var fn = mod.benchmarks[label];
+    var result = harness.bench(fn, opts);
+    rows.push({ label: fullLabel, result: result });
+    process.stderr.write(harness.format(fullLabel, result) + "\n");
+  });
+  return rows;
+}
+
+function _compareAgainstBaseline(current, baselinePath) {
+  if (!fs.existsSync(baselinePath)) {
+    process.stderr.write("[bench] no baseline at " + baselinePath + "; nothing to compare\n");
+    return 0;
+  }
+  var baseline = JSON.parse(fs.readFileSync(baselinePath, "utf8"));
+  var bMap = {};
+  baseline.results.forEach(function (r) { bMap[r.label] = r.result; });
+
+  var regressed = [];
+  process.stderr.write("\n=== compare vs " + baselinePath + " ===\n");
+  current.results.forEach(function (r) {
+    var b = bMap[r.label];
+    if (!b) {
+      process.stderr.write(r.label.padEnd(48) + "  NEW (no baseline entry)\n");
+      return;
+    }
+    var deltaP50 = (r.result.p50ns - b.p50ns) / b.p50ns;
+    var deltaOps = (r.result.opsPerSec - b.opsPerSec) / b.opsPerSec;
+    var sign = deltaP50 >= 0 ? "+" : "";
+    process.stderr.write(r.label.padEnd(48) +
+      "  p50: " + sign + (deltaP50 * 100).toFixed(1).padStart(7) + "%" +
+      "   ops: " + (deltaOps >= 0 ? "+" : "") + (deltaOps * 100).toFixed(1).padStart(7) + "%\n");
+    if (deltaP50 > REGRESS_THRESHOLD) regressed.push(r.label + " (+" + (deltaP50 * 100).toFixed(1) + "% p50)");
+  });
+  if (regressed.length > 0) {
+    process.stderr.write("\nREGRESSION (>" + (REGRESS_THRESHOLD * 100) + "% p50 slowdown):\n");
+    regressed.forEach(function (r) { process.stderr.write("  " + r + "\n"); });
+    return 1;
+  }
+  process.stderr.write("\nno regressions vs baseline (>" + (REGRESS_THRESHOLD * 100) + "% p50)\n");
+  return 0;
+}
+
+function main() {
+  var args = _parseArgs(process.argv.slice(2));
+  var benchOpts = {};
+  if (args.warmup) benchOpts.warmupIters = args.warmup;
+  if (args.runMs)  benchOpts.runMs       = args.runMs;
+
+  var allRows = [];
+  _discover().forEach(function (f) {
+    allRows = allRows.concat(_runFile(f, benchOpts, args));
+  });
+
+  var record = {
+    schemaVersion: 1,
+    machine:       _machineInfo(),
+    recordedAt:    new Date().toISOString(),
+    benchOpts:     {
+      warmupIters: benchOpts.warmupIters || null,
+      runMs:       benchOpts.runMs       || null,
+    },
+    results:       allRows,
+  };
+
+  if (args.compare) {
+    var rc = _compareAgainstBaseline(record, args.outPath);
+    process.exit(rc);
+  }
+
+  fs.writeFileSync(args.outPath, JSON.stringify(record, null, 2) + "\n", "utf8");
+  process.stderr.write("\n[bench] wrote " + path.relative(ROOT, args.outPath) + " (" + allRows.length + " benchmarks)\n");
+}
+
+main();

package/lib/vendor/blamejs/bench/safe-json.bench.js

@@ -0,0 +1,31 @@
+"use strict";
+// bench safe-json — stringify + parse for a small + medium payload.
+
+var safeJson = require("../lib/safe-json");
+
+var smallObj = { id: "abc-123", count: 42, ok: true, tags: ["a", "b", "c"] };
+var smallStr = safeJson.stringify(smallObj);
+
+var mediumObj = {
+  id: "user-9k2x",
+  email: "robert@example.com",
+  roles: ["admin", "editor", "viewer"],
+  metadata: {
+    createdAt: "2026-04-29T12:00:00Z",
+    lastSeen:  "2026-04-29T15:32:11Z",
+    flags:     { betaTester: true, mfaEnabled: false, theme: "dark" },
+    counters:  { logins: 142, posts: 27, comments: 384 },
+  },
+  tags: Array.from({ length: 20 }, function (_, i) { return "tag-" + i; }),
+};
+var mediumStr = safeJson.stringify(mediumObj);
+
+module.exports = {
+  name: "safe-json",
+  benchmarks: {
+    "stringify small (4 keys)":      function () { safeJson.stringify(smallObj); },
+    "parse small (4 keys)":          function () { safeJson.parse(smallStr); },
+    "stringify medium (nested + 20 tags)": function () { safeJson.stringify(mediumObj); },
+    "parse medium (nested + 20 tags)":     function () { safeJson.parse(mediumStr); },
+  },
+};

package/lib/vendor/blamejs/bin/blamejs.js

@@ -0,0 +1,13 @@
+#!/usr/bin/env node
+"use strict";
+// Thin entrypoint — all dispatch logic lives in lib/cli.js so it can
+// be driven from tests without spawning a child process.
+var cli = require("../lib/cli");
+
+cli.main(process.argv.slice(2)).then(
+  function (code) { process.exit(typeof code === "number" ? code : 0); },
+  function (err) {
+    process.stderr.write("blamejs: " + ((err && err.stack) || String(err)) + "\n");
+    process.exit(1);
+  }
+);

package/lib/vendor/blamejs/docker/caddy/Caddyfile

@@ -0,0 +1,46 @@
+# Caddy config — auto-TLS reverse proxy with HTTP/3 and PQC-hybrid groups.
+# Caddy 2.8+ ships with X25519MLKEM768 enabled by default in TLS 1.3.
+#
+# Used for:
+#   - Reverse-proxying to mailpit's web UI on a TLS endpoint
+#   - Demonstrating ACME-issued certs (against step-ca, when added)
+#   - Exercising the framework's HTTP client against modern PQC TLS
+
+{
+	auto_https off
+	servers {
+		protocols h1 h2 h3
+	}
+}
+
+# HTTPS listener with our generated cert.
+:443 {
+	tls /certs/caddy.crt /certs/caddy.key
+
+	# Reverse-proxy mailpit's web UI under /mail/.
+	handle_path /mail/* {
+		reverse_proxy mailpit:8025
+	}
+
+	# Reverse-proxy minio's S3 API under /s3/.
+	handle_path /s3/* {
+		reverse_proxy minio:9000
+	}
+
+	# Health endpoint for the host-side checker.
+	handle /healthz {
+		respond "ok" 200
+	}
+
+	# Default — display a small landing page so tests confirming
+	# the proxy responds get something sensible.
+	handle {
+		respond "blamejs-test-caddy" 200
+	}
+}
+
+# Plain HTTP listener for tests that don't need TLS.
+:80 {
+	respond /healthz "ok" 200
+	respond "blamejs-test-caddy (http)" 200
+}

package/lib/vendor/blamejs/docker/coredns/Corefile

@@ -0,0 +1,37 @@
+# CoreDNS config — exposes plain DNS (53/udp+tcp), DoT (853/tcp),
+# and DoH (8053/tcp) so blamejs's lib/network-dns.js can be exercised
+# against all three modes with the framework's PQC-first TLS posture.
+#
+# Upstream: 1.1.1.1 + 9.9.9.9 over DoT, so the test resolver itself
+# never leaks plain DNS.
+
+. {
+    bind 0.0.0.0 ::
+    forward . tls://1.1.1.1 tls://9.9.9.9 {
+        tls_servername cloudflare-dns.com
+    }
+    cache 300
+    errors
+    health :8054
+    ready :8055
+}
+
+tls://. {
+    bind 0.0.0.0 ::
+    tls /certs/coredns.crt /certs/coredns.key
+    forward . tls://1.1.1.1 tls://9.9.9.9 {
+        tls_servername cloudflare-dns.com
+    }
+    cache 300
+    errors
+}
+
+https://. {
+    bind 0.0.0.0 ::
+    tls /certs/coredns.crt /certs/coredns.key
+    forward . tls://1.1.1.1 tls://9.9.9.9 {
+        tls_servername cloudflare-dns.com
+    }
+    cache 300
+    errors
+}

package/lib/vendor/blamejs/docker/haproxy/haproxy.cfg

@@ -0,0 +1,52 @@
+# HAProxy config — TLS-terminating reverse proxy in front of redis,
+# postgres, and minio so blamejs's clients can be exercised through
+# a real proxy hop (X-Forwarded-For, PROXY protocol, TLS termination).
+#
+# Listeners:
+#   8443 — HTTPS reverse proxy → caddy:80
+#   6380 — TLS-pass-through to redis-tls (testing TLS-passthrough vs
+#          TLS-termination paths in the framework's redis-client)
+
+global
+  log stdout format raw local0
+  maxconn 4096
+  ssl-default-bind-options ssl-min-ver TLSv1.3 no-tls-tickets
+  ssl-default-bind-ciphersuites TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA384
+  # Hybrid-PQC group preference. HAProxy 3.x linked against OpenSSL
+  # 3.5+ honours this; older builds ignore the unknown group.
+  ssl-default-bind-curves X25519MLKEM768:X25519:secp384r1
+
+defaults
+  log     global
+  mode    http
+  option  httplog
+  option  dontlognull
+  timeout connect 5s
+  timeout client  60s
+  timeout server  60s
+
+frontend stats
+  bind 0.0.0.0:8404
+  bind :::8404
+  mode http
+  stats enable
+  stats uri /stats
+  stats refresh 10s
+
+frontend https_in
+  bind 0.0.0.0:8443 ssl crt /certs/haproxy.combined.pem
+  bind :::8443       ssl crt /certs/haproxy.combined.pem
+  default_backend caddy_back
+  http-request set-header X-Forwarded-Proto https
+  http-request set-header X-Forwarded-Port  8443
+
+backend caddy_back
+  server caddy caddy:80 check inter 10s
+
+# TCP-mode TLS-passthrough listener for raw protocol clients.
+listen redis_passthrough
+  bind 0.0.0.0:6390
+  bind :::6390
+  mode tcp
+  option tcplog
+  server redis_tls redis:6380 check

package/lib/vendor/blamejs/docker/init/generate-certs.sh

@@ -0,0 +1,118 @@
+#!/bin/sh
+# One-shot cert generator. Runs in a tiny alpine + openssl container at
+# stack startup, populates /certs with a self-signed Ed25519 CA plus
+# per-service leaf certs. Idempotent — re-runs short-circuit if /certs/ca.crt
+# already exists.
+#
+# Why Ed25519: it's the closest to the framework's PQC-first posture
+# that the external services in this stack actually accept. ML-DSA / SLH-DSA
+# certs are not yet supported by any of these servers. When server-side
+# PQC certs land we'll regenerate. The CA's signature alg is NOT what
+# determines TLS handshake KEM — that's negotiated from the cipher/groups
+# on each connection. Where the server supports it we still negotiate
+# X25519MLKEM768 hybrid (Caddy, recent OpenSSL builds).
+
+set -eu
+
+CERT_DIR="${CERT_DIR:-/certs}"
+DAYS="${DAYS:-3650}"
+
+if [ -f "$CERT_DIR/ca.crt" ] && [ -f "$CERT_DIR/.complete" ]; then
+  echo "[pki-init] /certs/ca.crt already present — skipping regen"
+  exit 0
+fi
+
+mkdir -p "$CERT_DIR"
+cd "$CERT_DIR"
+
+# Preserve an existing CA across .complete-only resets so that
+# already-issued leaves keep chaining. Only generate a new CA when none
+# is present.
+if [ -f "$CERT_DIR/ca.crt" ] && [ -f "$CERT_DIR/ca.key" ]; then
+  echo "[pki-init] reusing existing CA (ca.crt + ca.key present)"
+else
+  echo "[pki-init] generating Ed25519 CA..."
+  openssl genpkey -algorithm ED25519 -out ca.key
+  openssl req -x509 -new -key ca.key -out ca.crt -days "$DAYS" \
+    -subj "/CN=blamejs-test-ca/O=blamejs-test/C=US"
+fi
+
+# Service list — each gets a leaf cert covering the docker-network
+# hostname, the host-bind 127.0.0.1 / [::1], and localhost.
+SERVICES="redis postgres mysql mongo minio rabbitmq nats syslog mailpit haproxy caddy nginx mitmproxy squid coredns"
+
+for SVC in $SERVICES; do
+  if [ -f "$CERT_DIR/$SVC.crt" ]; then
+    echo "[pki-init] $SVC.crt exists — skipping"
+    continue
+  fi
+  echo "[pki-init] issuing leaf cert for $SVC..."
+
+  # syslog-ng's TLS module in this image doesn't accept Ed25519 server
+  # certs cleanly (handshake aborts before ClientHello completes); fall
+  # back to ECDSA P-256 just for that fixture. All other services serve
+  # Ed25519 leaves and the framework's TLS client verifies them OK.
+  if [ "$SVC" = "syslog" ]; then
+    openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:P-256 -out "$SVC.key"
+  else
+    openssl genpkey -algorithm ED25519 -out "$SVC.key"
+  fi
+
+  cat > "/tmp/$SVC.cnf" <<EOF
+[req]
+distinguished_name = req_dn
+req_extensions     = v3_req
+prompt             = no
+
+[req_dn]
+CN = $SVC
+
+[v3_req]
+basicConstraints     = CA:FALSE
+keyUsage             = critical, digitalSignature, keyEncipherment, keyAgreement
+extendedKeyUsage     = serverAuth, clientAuth
+subjectAltName       = @alt
+
+[alt]
+DNS.1 = $SVC
+DNS.2 = blamejs-test-$SVC
+DNS.3 = localhost
+IP.1  = 127.0.0.1
+IP.2  = ::1
+EOF
+
+  openssl req -new -key "$SVC.key" -out "$SVC.csr" -config "/tmp/$SVC.cnf"
+  openssl x509 -req -in "$SVC.csr" -CA ca.crt -CAkey ca.key \
+    -CAcreateserial -out "$SVC.crt" -days "$DAYS" \
+    -extensions v3_req -extfile "/tmp/$SVC.cnf"
+  rm -f "$SVC.csr" "/tmp/$SVC.cnf"
+
+  cat "$SVC.crt" "$SVC.key" > "$SVC.combined.pem"
+
+  openssl pkcs12 -export -in "$SVC.crt" -inkey "$SVC.key" \
+    -CAfile ca.crt -name "$SVC" -out "$SVC.p12" \
+    -passout pass:blamejs_test
+done
+
+# MinIO expects public.crt + private.key + CAs/ca.crt under a single
+# certs dir. Lay that out so its --certs-dir flag has what it needs.
+mkdir -p "$CERT_DIR/minio/CAs"
+cp "$CERT_DIR/minio.crt" "$CERT_DIR/minio/public.crt"
+cp "$CERT_DIR/minio.key" "$CERT_DIR/minio/private.key"
+cp "$CERT_DIR/ca.crt"    "$CERT_DIR/minio/CAs/ca.crt"
+chmod 644 "$CERT_DIR/minio/public.crt" "$CERT_DIR/minio/private.key" "$CERT_DIR/minio/CAs/ca.crt"
+
+if [ ! -f "$CERT_DIR/dhparams.pem" ]; then
+  echo "[pki-init] generating 2048-bit DH params (one-time, ~10s)..."
+  openssl dhparam -out dhparams.pem 2048
+fi
+
+# World-readable so non-root services can bind their TLS listeners.
+# These are TEST CERTS only — the keys are in a docker volume on the
+# operator's machine and never leave it.
+chmod 644 "$CERT_DIR"/*.key "$CERT_DIR"/*.combined.pem 2>/dev/null || true
+
+touch "$CERT_DIR/.complete"
+# find -maxdepth/-mindepth 1 lists immediate children (files + dirs)
+# safely; ls + wc -l is fragile on filenames with newlines.
+echo "[pki-init] done — $(find "$CERT_DIR" -maxdepth 1 -mindepth 1 | wc -l) files in $CERT_DIR"

package/lib/vendor/blamejs/docker/keycloak/realm-blamejs-test.json

@@ -0,0 +1,87 @@
+{
+  "realm": "blamejs-test",
+  "enabled": true,
+  "sslRequired": "none",
+  "registrationAllowed": false,
+  "loginWithEmailAllowed": true,
+  "duplicateEmailsAllowed": false,
+  "resetPasswordAllowed": false,
+  "editUsernameAllowed": false,
+  "bruteForceProtected": false,
+  "accessTokenLifespan": 600,
+  "refreshTokenMaxReuse": 0,
+  "ssoSessionIdleTimeout": 1800,
+  "ssoSessionMaxLifespan": 36000,
+
+  "users": [
+    {
+      "username": "alice",
+      "email": "alice@example.com",
+      "firstName": "Alice",
+      "lastName": "Tester",
+      "enabled": true,
+      "emailVerified": true,
+      "credentials": [
+        { "type": "password", "value": "blamejs-test-password", "temporary": false }
+      ],
+      "realmRoles": ["default-roles-blamejs-test"]
+    }
+  ],
+
+  "clients": [
+    {
+      "clientId": "blamejs-rp-oidc",
+      "name": "blamejs OIDC RP (integration test)",
+      "enabled": true,
+      "protocol": "openid-connect",
+      "publicClient": false,
+      "secret": "blamejs-test-rp-secret",
+      "standardFlowEnabled": true,
+      "directAccessGrantsEnabled": true,
+      "serviceAccountsEnabled": false,
+      "redirectUris": [
+        "http://127.0.0.1:18099/callback",
+        "http://[::1]:18099/callback",
+        "https://127.0.0.1:18099/callback"
+      ],
+      "webOrigins": ["+"],
+      "frontchannelLogout": true,
+      "attributes": {
+        "frontchannel.logout.url":              "http://127.0.0.1:18099/oidc/frontchannel-logout",
+        "backchannel.logout.url":               "http://127.0.0.1:18099/oidc/backchannel-logout",
+        "backchannel.logout.session.required":  "true",
+        "backchannel.logout.revoke.offline.tokens": "false",
+        "post.logout.redirect.uris":            "http://127.0.0.1:18099/post-logout##http://[::1]:18099/post-logout",
+        "pkce.code.challenge.method":           "S256",
+        "use.refresh.tokens":                   "true",
+        "tls.client.certificate.bound.access.tokens": "false"
+      },
+      "defaultClientScopes": ["web-origins", "profile", "roles", "email"],
+      "optionalClientScopes": ["address", "phone", "offline_access"]
+    },
+    {
+      "clientId": "https://sp.blamejs-test.example",
+      "name": "blamejs SAML SP (integration test)",
+      "description": "SP entityID for the integration test. Keycloak's SAML response signs the assertion using the realm's RSA-SHA256 key.",
+      "enabled": true,
+      "protocol": "saml",
+      "publicClient": true,
+      "redirectUris": [
+        "http://127.0.0.1:18099/saml/acs"
+      ],
+      "frontchannelLogout": false,
+      "attributes": {
+        "saml.assertion.signature":            "true",
+        "saml.server.signature":               "false",
+        "saml.signature.algorithm":            "RSA_SHA256",
+        "saml.client.signature":               "false",
+        "saml.encrypt":                        "false",
+        "saml.force.post.binding":             "true",
+        "saml_assertion_consumer_url_post":    "http://127.0.0.1:18099/saml/acs",
+        "saml_name_id_format":                 "username",
+        "saml.authnstatement":                 "true"
+      },
+      "defaultClientScopes": ["role_list"]
+    }
+  ]
+}

package/lib/vendor/blamejs/docker/mitmproxy/config.yaml

@@ -0,0 +1,16 @@
+# mitmproxy options — used in interactive web mode for manual TLS
+# inspection during integration test debugging. Tests programmatically
+# drive scenarios through the proxy via mitmproxy's HTTP API on :8081.
+#
+# Default upstream-cert behaviour is fine; we only override knobs that
+# matter for "no warnings or errors": disable the on-disk cert cache
+# warning by pointing it explicitly at a writable path, and silence the
+# update-check noise.
+
+confdir: /home/mitmproxy/.mitmproxy
+ssl_insecure: true
+web_host: 0.0.0.0
+listen_host: 0.0.0.0
+listen_port: 8080
+web_port: 8081
+upstream_cert: true

package/lib/vendor/blamejs/docker/mongo/init-tls.sh

@@ -0,0 +1,17 @@
+#!/bin/sh
+# MongoDB needs the cert + key concatenated into a single PEM file
+# and readable by the mongodb user. Copy from the cert volume into
+# a writable location and chown.
+set -eu
+mkdir -p /etc/mongo-tls
+cp /certs/mongo.combined.pem /etc/mongo-tls/server.pem
+cp /certs/ca.crt /etc/mongo-tls/ca.pem
+chmod 600 /etc/mongo-tls/server.pem
+chmod 644 /etc/mongo-tls/ca.pem
+# mongo container runs as `mongodb` user; chown if the user exists.
+# Plain if/then/else — the `&& X || true` shorthand trips SC2015 because
+# X failing would let the `|| true` fire as if `id` had failed, which is
+# not what we want here.
+if id mongodb >/dev/null 2>&1; then
+  chown mongodb:mongodb /etc/mongo-tls/*
+fi

package/lib/vendor/blamejs/docker/mysql/my.cnf

@@ -0,0 +1,12 @@
+# MySQL config for blamejs integration testing.
+# Both plain and TLS connections accepted; TLS opt-in via client
+# require_secure_transport is OFF so plain still works.
+
+[mysqld]
+ssl-ca   = /certs/ca.crt
+ssl-cert = /certs/mysql.crt
+ssl-key  = /certs/mysql.key
+require_secure_transport = OFF
+tls_version = TLSv1.3
+default_authentication_plugin = caching_sha2_password
+bind-address = 0.0.0.0

package/lib/vendor/blamejs/docker/nats/nats.conf

@@ -0,0 +1,33 @@
+# NATS config for blamejs integration testing.
+# Listens on BOTH plain (4222) and TLS (4223) ports.
+# JetStream enabled. Monitoring on 8222.
+#
+# PQC posture: NATS is Go-based; if the underlying Go runtime is 1.24+
+# the TLS stack offers X25519MLKEM768 hybrid by default. Curve_preferences
+# below requests it explicitly so older runtimes that ignore unknown
+# groups still negotiate a safe classical fallback.
+
+port: 4222
+http_port: 8222
+server_name: blamejs-test-nats
+
+jetstream {
+  store_dir: "/data/jetstream"
+}
+
+tls {
+  cert_file:  "/certs/nats.crt"
+  key_file:   "/certs/nats.key"
+  ca_file:    "/certs/ca.crt"
+  verify:     false
+  # NATS uses Go's TLS stack defaults for curve negotiation. Go 1.24+
+  # automatically offers X25519MLKEM768 hybrid in TLS 1.3 handshakes
+  # without explicit configuration; older Go falls back to X25519/P256.
+  # Explicit curve_preferences here would lock us out of hybrid PQC
+  # whenever the runtime supports it, so we leave them at default.
+}
+
+# Note: "tls" block above applies to the main port. NATS doesn't expose
+# a separate "tls_port" — clients negotiate TLS on the main port via
+# the INFO/CONNECT handshake. The integration tests therefore use the
+# same 4222 endpoint with tls=true vs tls=false on the client side.

package/lib/vendor/blamejs/docker/postgres/init-tls.sh

@@ -0,0 +1,17 @@
+#!/bin/sh
+# Postgres pre-start hook — runs on EVERY container start (via the
+# entrypoint override in docker-compose.test.yml), not just initdb.
+# Copies certs from the read-only mount into a postgres-user-owned
+# location with the strict 0600 perms the server demands.
+
+set -eu
+
+mkdir -p /var/lib/postgresql/certs
+cp /certs/postgres.crt /var/lib/postgresql/certs/server.crt
+cp /certs/postgres.key /var/lib/postgresql/certs/server.key
+cp /certs/ca.crt       /var/lib/postgresql/certs/root.crt
+chown -R postgres:postgres /var/lib/postgresql/certs
+chmod 600 /var/lib/postgresql/certs/server.key
+chmod 644 /var/lib/postgresql/certs/server.crt /var/lib/postgresql/certs/root.crt
+
+echo "[postgres-init-tls] certs ready at /var/lib/postgresql/certs/"

package/lib/vendor/blamejs/docker/postgres/postgresql.conf

@@ -0,0 +1,18 @@
+# Minimal Postgres config. Listens on 5432, accepts BOTH plain and TLS
+# connections; client picks via sslmode=require/disable/prefer.
+# Cert paths point at the post-init location populated by init-tls.sh
+# (where the keys are chowned to the postgres user with 0600 perms —
+# postgres refuses to start with looser perms).
+
+listen_addresses = '*'
+
+ssl = on
+ssl_cert_file = '/var/lib/postgresql/certs/server.crt'
+ssl_key_file  = '/var/lib/postgresql/certs/server.key'
+ssl_ca_file   = '/var/lib/postgresql/certs/root.crt'
+
+# Modern TLS only. ssl_ciphers controls TLS 1.2 cipher list; TLS 1.3
+# cipher suites (which is what we actually negotiate at min_protocol=1.3)
+# are picked from OpenSSL defaults. Setting ssl_ciphers to TLS 1.3 names
+# trips a startup validation error in postgres 18, so leave at default.
+ssl_min_protocol_version = 'TLSv1.3'

package/lib/vendor/blamejs/docker/rabbitmq/rabbitmq.conf

@@ -0,0 +1,18 @@
+# RabbitMQ config — exposes both plain AMQP (5672) and AMQPS (5671)
+# listeners. Default user is the env-var override blamejs/blamejs_test
+# from the compose file.
+
+listeners.tcp.default = 5672
+
+listeners.ssl.default            = 5671
+ssl_options.cacertfile           = /certs/ca.crt
+ssl_options.certfile              = /certs/rabbitmq.crt
+ssl_options.keyfile               = /certs/rabbitmq.key
+ssl_options.verify                = verify_none
+ssl_options.fail_if_no_peer_cert = false
+ssl_options.versions.1            = tlsv1.3
+
+management.tcp.port = 15672
+
+# Quiet boot — keep noise out of test output.
+log.console.level = warning