@blamejs/blamejs-shop 0.0.44

package/lib/vendor/blamejs/test/layer-0-primitives/cli-helpers.test.js

@@ -0,0 +1,145 @@
+"use strict";
+
+var helpers = require("../helpers");
+var check = helpers.check;
+var b = require("../../");
+
+function _captureCtx(env) {
+  var stdout = [];
+  var stderr = [];
+  return {
+    stdout: { write: function (s) { stdout.push(String(s)); } },
+    stderr: { write: function (s) { stderr.push(String(s)); } },
+    env:    env || {},
+    cwd:    process.cwd(),
+    out:    function () { return stdout.join(""); },
+    err:    function () { return stderr.join(""); },
+  };
+}
+
+function run() {
+  // ---- makeReporter contract ----
+  var ctx = _captureCtx();
+  var report = b.cliHelpers.makeReporter(ctx, "blamejs my-tool issue");
+
+  check("ok(message): writes to stdout, returns 0",
+        report.ok("done") === 0 && /^done\n$/.test(ctx.out()));
+
+  ctx = _captureCtx();
+  report = b.cliHelpers.makeReporter(ctx, "blamejs my-tool issue");
+  check("ok(undefined): returns 0, writes nothing",
+        report.ok() === 0 && ctx.out() === "");
+
+  ctx = _captureCtx();
+  report = b.cliHelpers.makeReporter(ctx, "blamejs my-tool issue");
+  check("error(message): writes prefix + message to stderr, returns 1",
+        report.error("kaboom") === 1 &&
+        /^blamejs my-tool issue: kaboom\n$/.test(ctx.err()));
+
+  ctx = _captureCtx();
+  report = b.cliHelpers.makeReporter(ctx, "blamejs my-tool issue");
+  check("error(message, 2): returns custom exit code",
+        report.error("missing arg", 2) === 2);
+
+  ctx = _captureCtx();
+  report = b.cliHelpers.makeReporter(ctx, "blamejs my-tool issue");
+  check("usage(USAGE): writes to stderr, returns 2",
+        report.usage("Usage: blamejs my-tool ...") === 2 &&
+        /^Usage: blamejs my-tool \.\.\.\n$/.test(ctx.err()));
+
+  ctx = _captureCtx();
+  report = b.cliHelpers.makeReporter(ctx, "blamejs my-tool issue");
+  check("helpStdout(USAGE): writes to stdout, returns 0",
+        report.helpStdout("Usage: ...") === 0 && /^Usage: \.\.\.\n$/.test(ctx.out()));
+
+  // ---- makeReporter validation ----
+  var threwOnNoCtx = null;
+  try { b.cliHelpers.makeReporter(null, "x"); }
+  catch (e) { threwOnNoCtx = e; }
+  check("makeReporter: throws when ctx is missing",
+        !!threwOnNoCtx && /ctx is required/.test(threwOnNoCtx.message));
+
+  var threwOnNoPrefix = null;
+  try { b.cliHelpers.makeReporter({}, ""); }
+  catch (e) { threwOnNoPrefix = e; }
+  check("makeReporter: throws when prefix is empty",
+        !!threwOnNoPrefix && /prefix is required/.test(threwOnNoPrefix.message));
+
+  // ---- resolvePassphrase ----
+  var fromFlag = b.cliHelpers.resolvePassphrase(
+    { flags: { passphrase: "from-flag" } },
+    _captureCtx({ MY_PP: "from-env" }),
+    { flag: "passphrase", envVar: "MY_PP" });
+  check("resolvePassphrase: --flag wins",
+        Buffer.isBuffer(fromFlag) && fromFlag.toString("utf8") === "from-flag");
+
+  var fromEnv = b.cliHelpers.resolvePassphrase(
+    { flags: {} },
+    _captureCtx({ MY_PP: "from-env" }),
+    { flag: "passphrase", envVar: "MY_PP" });
+  check("resolvePassphrase: env-var fallback",
+        Buffer.isBuffer(fromEnv) && fromEnv.toString("utf8") === "from-env");
+
+  var nullPp = b.cliHelpers.resolvePassphrase(
+    { flags: {} },
+    _captureCtx({}),
+    { flag: "passphrase", envVar: "MY_PP" });
+  check("resolvePassphrase: returns null when neither source set",
+        nullPp === null);
+
+  var threwOnUnknownKey = null;
+  try {
+    b.cliHelpers.resolvePassphrase(
+      { flags: {} }, _captureCtx({}),
+      { flag: "p", envVar: "E", typo: true });
+  } catch (e) { threwOnUnknownKey = e; }
+  check("resolvePassphrase: validateOpts catches typo'd key",
+        !!threwOnUnknownKey && /unknown option 'typo'/.test(threwOnUnknownKey.message));
+
+  var threwOnNoFlag = null;
+  try {
+    b.cliHelpers.resolvePassphrase({ flags: {} }, _captureCtx({}), { flag: "" });
+  } catch (e) { threwOnNoFlag = e; }
+  check("resolvePassphrase: throws when opts.flag missing",
+        !!threwOnNoFlag && /opts\.flag is required/.test(threwOnNoFlag.message));
+
+  // ---- bootApp validation (without actually booting; that's covered by
+  //      cli-vault, cli-backup, cli-api-key tests) ----
+  var threwBootUnknownKey = null;
+  return b.cliHelpers.bootApp({ dataDir: "/tmp/x", typo: true }).then(
+    function () { /* should not resolve */ },
+    function (e) { threwBootUnknownKey = e; }
+  ).then(function () {
+    check("bootApp: validateOpts catches typo'd key at boot",
+          !!threwBootUnknownKey && /unknown option 'typo'/.test(threwBootUnknownKey.message));
+
+    var threwBootBadMode = null;
+    return b.cliHelpers.bootApp({ dataDir: "/tmp/x", vaultMode: "yolo" }).then(
+      function () {},
+      function (e) { threwBootBadMode = e; }
+    ).then(function () {
+      check("bootApp: vaultMode must be 'wrapped' or 'plaintext'",
+            !!threwBootBadMode && /vaultMode must be/.test(threwBootBadMode.message));
+
+      var threwBootNoPP = null;
+      return b.cliHelpers.bootApp({
+        dataDir: "/tmp/x", vaultMode: "wrapped", env: {},
+      }).then(
+        function () {},
+        function (e) { threwBootNoPP = e; }
+      ).then(function () {
+        check("bootApp: wrapped mode demands BLAMEJS_VAULT_PASSPHRASE",
+              !!threwBootNoPP && /BLAMEJS_VAULT_PASSPHRASE/.test(threwBootNoPP.message));
+      });
+    });
+  });
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  run().then(
+    function () { console.log("OK — " + helpers.getChecks() + " checks passed"); },
+    function (e) { console.error("FAIL:", e.stack || e); process.exit(1); }
+  );
+}

package/lib/vendor/blamejs/test/layer-0-primitives/cli-mtls.test.js

@@ -0,0 +1,133 @@
+"use strict";
+
+var fs = require("node:fs");
+var os = require("node:os");
+var path = require("node:path");
+var helpers = require("../helpers");
+var check = helpers.check;
+var cli = require("../../lib/cli");
+
+function _tmpDir(prefix) {
+  return fs.mkdtempSync(path.join(os.tmpdir(), prefix + "-"));
+}
+
+function _captureCtx() {
+  var stdout = [];
+  var stderr = [];
+  return {
+    stdout: { write: function (s) { stdout.push(String(s)); } },
+    stderr: { write: function (s) { stderr.push(String(s)); } },
+    env:    {},
+    cwd:    process.cwd(),
+    out:    function () { return stdout.join(""); },
+    err:    function () { return stderr.join(""); },
+  };
+}
+
+async function run() {
+  var dataDir = _tmpDir("blamejs-cli-mtls");
+  var base = ["--data-dir", dataDir, "--vault-mode", "plaintext"];
+
+  // ---- arg validation up front ----
+  var ctxA = _captureCtx();
+  var cA = await cli.main(["mtls"], ctxA);
+  check("no subcommand: usage on stderr, returns 2",
+        cA === 2 && /Usage: blamejs mtls/.test(ctxA.err()));
+
+  var ctxB = _captureCtx();
+  var cB = await cli.main(["mtls", "frobnicate"], ctxB);
+  check("unknown subcommand: returns 2",
+        cB === 2 && /unknown subcommand/.test(ctxB.err()));
+
+  var ctxC = _captureCtx();
+  var cC = await cli.main(["help", "mtls"], ctxC);
+  check("help mtls: prints MTLS_USAGE",
+        cC === 0 && /Usage: blamejs mtls/.test(ctxC.out()));
+
+  var ctxD = _captureCtx();
+  var cD = await cli.main(["mtls", "status"], ctxD);
+  check("status without --data-dir: returns 2",
+        cD === 2 && /--data-dir/.test(ctxD.err()));
+
+  // ---- status against a fresh data-dir (no CA on disk) ----
+  var ctx1 = _captureCtx();
+  var c1 = await cli.main(["mtls", "status"].concat(base), ctx1);
+  check("status (no CA): returns 0",                 c1 === 0);
+  check("status (no CA): announces 'CA exists: no'", /CA exists:\s+no/.test(ctx1.out()));
+  check("status (no CA): hints at init",             /run 'blamejs mtls init'/.test(ctx1.out()));
+
+  // ---- show-cert against a fresh data-dir errors clearly ----
+  var ctx2 = _captureCtx();
+  var c2 = await cli.main(["mtls", "show-cert"].concat(base), ctx2);
+  check("show-cert (no CA): non-zero",                c2 !== 0);
+  check("show-cert (no CA): points at the missing path",
+        /no CA on disk/.test(ctx2.err()));
+
+  // ---- init: bundled engine generates a real CA ----
+  var ctx3 = _captureCtx();
+  var c3 = await cli.main(["mtls", "init"].concat(base), ctx3);
+  check("init: returns 0",                            c3 === 0);
+  check("init: announces ca-cert path",                /ca-cert:/.test(ctx3.out()));
+  check("init: announces ca-key path",                 /ca-key:/.test(ctx3.out()));
+  check("init: ca.crt written to data-dir",
+        fs.existsSync(path.join(dataDir, "ca.crt")));
+
+  // ---- issue: --subject required ----
+  var ctx4 = _captureCtx();
+  var c4 = await cli.main(["mtls", "issue"].concat(base), ctx4);
+  check("issue without --subject: returns 2",
+        c4 === 2 && /--subject/.test(ctx4.err()));
+
+  // ---- issue: bundled engine signs a leaf cert ----
+  var ctx5 = _captureCtx();
+  var c5 = await cli.main(["mtls", "issue"].concat(base).concat(["--subject", "client-1"]), ctx5);
+  check("issue with --subject: returns 0",            c5 === 0);
+  check("issue: prints leaf certificate PEM",          /BEGIN CERTIFICATE/.test(ctx5.out()));
+  check("issue: prints leaf private key PEM",          /BEGIN PRIVATE KEY/.test(ctx5.out()));
+
+  // ---- issue-p12 demands both --subject and --password ----
+  var ctx6 = _captureCtx();
+  var c6 = await cli.main(["mtls", "issue-p12"].concat(base).concat(["--subject", "x"]), ctx6);
+  check("issue-p12 without --password: returns 2",
+        c6 === 2 && /--password/.test(ctx6.err()));
+
+  // ---- issue-p12: bundled engine packages a P12 ----
+  var p12Out = path.join(dataDir, "client.p12");
+  var ctx6b = _captureCtx();
+  var c6b = await cli.main(
+    ["mtls", "issue-p12"].concat(base).concat([
+      "--subject", "client-2",
+      "--password", "p12-passphrase-xyz",
+      "--out", p12Out,
+    ]), ctx6b);
+  check("issue-p12 with --subject + --password + --out: returns 0", c6b === 0);
+  check("issue-p12: writes the bundle to --out",                    fs.existsSync(p12Out));
+  if (fs.existsSync(p12Out)) {
+    var p12Buf = fs.readFileSync(p12Out);
+    check("issue-p12: file is a non-trivial ASN.1 SEQUENCE",
+          p12Buf.length > 1000 && p12Buf[0] === 0x30);
+  }
+
+  // ---- bad --vault-mode ----
+  var ctx7 = _captureCtx();
+  var c7 = await cli.main(["mtls", "status", "--data-dir", dataDir, "--vault-mode", "yolo"], ctx7);
+  check("bad --vault-mode: returns 2",
+        c7 === 2 && /--vault-mode/.test(ctx7.err()));
+
+  // ---- bad --sealed-mode ----
+  var ctx8 = _captureCtx();
+  var c8 = await cli.main(["mtls", "status"].concat(base).concat(["--sealed-mode", "yolo"]), ctx8);
+  check("bad --sealed-mode: returns 2",
+        c8 === 2 && /--sealed-mode/.test(ctx8.err()));
+
+  fs.rmSync(dataDir, { recursive: true, force: true });
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  run().then(
+    function () { console.log("OK — " + helpers.getChecks() + " checks passed"); },
+    function (e) { console.error("FAIL:", e.stack || e); process.exit(1); }
+  );
+}

package/lib/vendor/blamejs/test/layer-0-primitives/cli-password.test.js

@@ -0,0 +1,97 @@
+"use strict";
+
+var helpers = require("../helpers");
+var check = helpers.check;
+var cli = require("../../lib/cli");
+
+function _captureCtx() {
+  var stdout = [];
+  var stderr = [];
+  return {
+    stdout: { write: function (s) { stdout.push(String(s)); } },
+    stderr: { write: function (s) { stderr.push(String(s)); } },
+    env:    {},
+    cwd:    process.cwd(),
+    out:    function () { return stdout.join(""); },
+    err:    function () { return stderr.join(""); },
+  };
+}
+
+async function run() {
+  // ---- help ----
+  var ctxHelp = _captureCtx();
+  var rcHelp = await cli.main(["password", "--help"], ctxHelp);
+  check("help: exit 0",                       rcHelp === 0);
+  check("help: lists check + profiles",       /check/.test(ctxHelp.out()) && /pci-4\.0/.test(ctxHelp.out()));
+
+  // ---- check: rejects common password ----
+  var ctxBad = _captureCtx();
+  var rcBad = await cli.main(["password", "check", "--plaintext", "password"], ctxBad);
+  check("check 'password': exit 1",           rcBad === 1);
+  check("check 'password': REJECTED + code",  /REJECTED:\s+policy\/forbidden-common/.test(ctxBad.out()));
+
+  // ---- check: too-short rejected ----
+  var ctxShort = _captureCtx();
+  var rcShort = await cli.main(["password", "check", "--plaintext", "abc"], ctxShort);
+  check("check 'abc': exit 1",                rcShort === 1);
+  check("check 'abc': too-short code",        /policy\/too-short/.test(ctxShort.out()));
+
+  // ---- check: respects --min-length override ----
+  var ctxMin = _captureCtx();
+  var rcMin = await cli.main(
+    ["password", "check", "--plaintext", "0123456789ab", "--min-length", "16"], ctxMin);
+  check("check with --min-length 16: exit 1", rcMin === 1);
+  check("check with --min-length 16: too-short code", /policy\/too-short/.test(ctxMin.out()));
+
+  // ---- check: passes a strong unique password ----
+  var ctxOk = _captureCtx();
+  var rcOk = await cli.main(
+    ["password", "check", "--plaintext", "horse-staple-correct-battery-9281!"], ctxOk);
+  check("check strong: exit 0",               rcOk === 0);
+  check("check strong: prints 'ok'",          /\bok\b/.test(ctxOk.out()));
+
+  // ---- check: context substring rejection ----
+  var ctxCtx = _captureCtx();
+  var rcCtx = await cli.main(
+    ["password", "check", "--plaintext", "alice-loves-cats-9281!", "--username", "alice"], ctxCtx);
+  check("check with context.username match: exit 1", rcCtx === 1);
+  check("check with context.username match: contains-context code",
+        /policy\/contains-context/.test(ctxCtx.out()));
+
+  // ---- check: --json output is valid JSON ----
+  var ctxJson = _captureCtx();
+  var rcJson = await cli.main(
+    ["password", "check", "--plaintext", "password", "--json"], ctxJson);
+  check("check --json: exit 1",               rcJson === 1);
+  var parsed = null;
+  try { parsed = JSON.parse(ctxJson.out().trim()); }
+  catch (_e) { /* leave null */ }
+  check("check --json: valid JSON",           parsed !== null && parsed.ok === false);
+  check("check --json: includes code",        parsed && /policy\/forbidden-common/.test(parsed.code));
+
+  // ---- check: --profile pci-4.0 enforces 12-char minimum ----
+  var ctxPci = _captureCtx();
+  var rcPci = await cli.main(
+    ["password", "check", "--plaintext", "Sh0rt-pass!", "--profile", "pci-4.0"], ctxPci);
+  check("check pci-4.0 short: exit 1",        rcPci === 1);
+  check("check pci-4.0 short: too-short",     /policy\/too-short/.test(ctxPci.out()));
+
+  // ---- check: missing --plaintext returns 2 ----
+  var ctxMissing = _captureCtx();
+  var rcMissing = await cli.main(["password", "check"], ctxMissing);
+  check("check missing --plaintext → exit 2", rcMissing === 2);
+
+  // ---- unknown subcommand ----
+  var ctxUnk = _captureCtx();
+  var rcUnk = await cli.main(["password", "audit"], ctxUnk);
+  check("unknown subcommand → exit 2",        rcUnk === 2);
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  run().then(
+    function () { console.log("[cli-password] OK"); },
+    function (e) { console.error(e); process.exit(1); }
+  );
+}

package/lib/vendor/blamejs/test/layer-0-primitives/cli-restore.test.js

@@ -0,0 +1,160 @@
+"use strict";
+
+var fs = require("node:fs");
+var os = require("node:os");
+var path = require("node:path");
+var helpers = require("../helpers");
+var check = helpers.check;
+var cli = require("../../lib/cli");
+var b = require("../../");
+
+function _tmpDir(prefix) {
+  return fs.mkdtempSync(path.join(os.tmpdir(), prefix + "-"));
+}
+
+function _captureCtx() {
+  var stdout = [];
+  var stderr = [];
+  return {
+    stdout: { write: function (s) { stdout.push(String(s)); } },
+    stderr: { write: function (s) { stderr.push(String(s)); } },
+    env:    {},
+    cwd:    process.cwd(),
+    out:    function () { return stdout.join(""); },
+    err:    function () { return stderr.join(""); },
+  };
+}
+
+async function _buildFixtureBundle(passphrase) {
+  var dataDir = _tmpDir("blamejs-cli-restore-data");
+  if (typeof b.vault._resetForTest === "function") b.vault._resetForTest();
+  await b.vault.init({ dataDir: dataDir, mode: "plaintext" });
+  fs.writeFileSync(path.join(dataDir, "hello.txt"), "world\n");
+
+  var bundleRoot = _tmpDir("blamejs-cli-restore-bundles");
+  var storage = b.backup.diskStorage({ root: bundleRoot });
+  var backup = b.backup.create({
+    dataDir:       dataDir,
+    storage:       storage,
+    passphrase:    Buffer.from(passphrase, "utf8"),
+    files:         [{ relativePath: "hello.txt", kind: "plaintext" }],
+    vaultKeyJson:  b.vault.getKeysJson(),
+  });
+  var result = await backup.run();
+  if (typeof b.vault._resetForTest === "function") b.vault._resetForTest();
+  return {
+    dataDir:    dataDir,
+    bundleRoot: bundleRoot,
+    bundleId:   result.bundleId,
+    bundleDir:  path.join(bundleRoot, result.bundleId),
+  };
+}
+
+async function run() {
+  var fx = await _buildFixtureBundle("the-fixture-passphrase");
+
+  // ---- list ----
+  var ctx1 = _captureCtx();
+  var c1 = await cli.main(["restore", "list", "--storage-root", fx.bundleRoot], ctx1);
+  check("list: returns 0",                       c1 === 0);
+  check("list: enumerates the fixture bundle",   ctx1.out().indexOf(fx.bundleId) !== -1);
+
+  // ---- inspect (--bundle <dir>) ----
+  var ctx2 = _captureCtx();
+  var c2 = await cli.main(["restore", "inspect", "--bundle", fx.bundleDir], ctx2);
+  check("inspect: returns 0",                    c2 === 0);
+  check("inspect: reports manifest version",     /^manifest:\s+v/m.test(ctx2.out()));
+  check("inspect: reports file count",           /^files:\s+1/m.test(ctx2.out()));
+
+  // ---- inspect (--storage-root + --bundle-id) ----
+  var ctx3 = _captureCtx();
+  var c3 = await cli.main(
+    ["restore", "inspect", "--storage-root", fx.bundleRoot, "--bundle-id", fx.bundleId],
+    ctx3);
+  check("inspect: alternative selector form",    c3 === 0 && /files:/.test(ctx3.out()));
+
+  // ---- apply: live restore into a fresh data dir ----
+  var liveDataDir = path.join(_tmpDir("blamejs-cli-restore-live"), "data");
+  fs.mkdirSync(liveDataDir, { recursive: true });
+  fs.writeFileSync(path.join(liveDataDir, "old.txt"), "discard-me\n");
+  var ctx4 = _captureCtx();
+  var c4 = await cli.main(
+    ["restore", "apply",
+     "--data-dir",   liveDataDir,
+     "--bundle",     fx.bundleDir,
+     "--passphrase", "the-fixture-passphrase"], ctx4);
+  check("apply: returns 0",                      c4 === 0);
+  check("apply: restored file landed",           fs.existsSync(path.join(liveDataDir, "hello.txt")));
+  check("apply: restored bytes round-trip",
+        fs.readFileSync(path.join(liveDataDir, "hello.txt"), "utf8") === "world\n");
+  check("apply: pre-restore content preserved in rollback",
+        !fs.existsSync(path.join(liveDataDir, "old.txt")));
+
+  // ---- list-rollbacks ----
+  var ctx5 = _captureCtx();
+  var c5 = await cli.main(
+    ["restore", "list-rollbacks", "--data-dir", liveDataDir], ctx5);
+  check("list-rollbacks: returns 0",             c5 === 0);
+  check("list-rollbacks: enumerates one point",  /rollback points at .* 1/.test(ctx5.out()) ||
+                                                 ctx5.out().indexOf("rollback") !== -1);
+
+  // ---- rollback ----
+  var ctx6 = _captureCtx();
+  var c6 = await cli.main(
+    ["restore", "rollback", "--data-dir", liveDataDir], ctx6);
+  check("rollback: returns 0",                   c6 === 0);
+  check("rollback: pre-restore file restored",   fs.existsSync(path.join(liveDataDir, "old.txt")));
+  check("rollback: bundle file gone",            !fs.existsSync(path.join(liveDataDir, "hello.txt")));
+
+  // ---- env-var passphrase fallback ----
+  var liveDataDir2 = path.join(_tmpDir("blamejs-cli-restore-live2"), "data");
+  fs.mkdirSync(liveDataDir2, { recursive: true });
+  var ctx7 = _captureCtx();
+  ctx7.env = { BLAMEJS_BACKUP_PASSPHRASE: "the-fixture-passphrase" };
+  var c7 = await cli.main(
+    ["restore", "apply",
+     "--data-dir", liveDataDir2,
+     "--bundle",   fx.bundleDir], ctx7);
+  check("apply: passphrase from BLAMEJS_BACKUP_PASSPHRASE", c7 === 0);
+
+  // ---- arg validation ----
+  var ctx8 = _captureCtx();
+  var c8 = await cli.main(["restore"], ctx8);
+  check("no subcommand: usage on stderr, returns 2",
+        c8 === 2 && /Usage: blamejs restore/.test(ctx8.err()));
+
+  var ctx9 = _captureCtx();
+  var c9 = await cli.main(["restore", "frobnicate"], ctx9);
+  check("unknown subcommand: returns 2",
+        c9 === 2 && /unknown subcommand/.test(ctx9.err()));
+
+  var ctx10 = _captureCtx();
+  var c10 = await cli.main(["restore", "apply", "--data-dir", "/tmp/x", "--bundle", fx.bundleDir], ctx10);
+  check("apply: missing passphrase returns 2",
+        c10 === 2 && /passphrase/i.test(ctx10.err()));
+
+  var ctx11 = _captureCtx();
+  var c11 = await cli.main(["restore", "inspect"], ctx11);
+  check("inspect: missing bundle selector returns 2",
+        c11 === 2 && /bundle/i.test(ctx11.err()));
+
+  var ctx12 = _captureCtx();
+  var c12 = await cli.main(["help", "restore"], ctx12);
+  check("help restore: prints RESTORE_USAGE",
+        c12 === 0 && /Usage: blamejs restore/.test(ctx12.out()));
+
+  // ---- cleanup ----
+  fs.rmSync(fx.dataDir,    { recursive: true, force: true });
+  fs.rmSync(fx.bundleRoot, { recursive: true, force: true });
+  fs.rmSync(liveDataDir,   { recursive: true, force: true });
+  fs.rmSync(liveDataDir2,  { recursive: true, force: true });
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  run().then(
+    function () { console.log("OK — " + helpers.getChecks() + " checks passed"); },
+    function (e) { console.error("FAIL:", e.stack || e); process.exit(1); }
+  );
+}

package/lib/vendor/blamejs/test/layer-0-primitives/cli-retention.test.js

@@ -0,0 +1,84 @@
+"use strict";
+
+var fs = require("node:fs");
+var os = require("node:os");
+var path = require("node:path");
+var helpers = require("../helpers");
+var check = helpers.check;
+var cli = require("../../lib/cli");
+
+function _tmpDir(prefix) {
+  return fs.mkdtempSync(path.join(os.tmpdir(), prefix + "-"));
+}
+
+function _captureCtx() {
+  var stdout = [], stderr = [];
+  return {
+    stdout: { write: function (s) { stdout.push(String(s)); } },
+    stderr: { write: function (s) { stderr.push(String(s)); } },
+    env:    Object.assign({}, process.env),
+    cwd:    process.cwd(),
+    out:    function () { return stdout.join(""); },
+    err:    function () { return stderr.join(""); },
+  };
+}
+
+async function run() {
+  // ---- help ----
+  var ctxHelp = _captureCtx();
+  var rcHelp = await cli.main(["retention", "--help"], ctxHelp);
+  check("help: exit 0",                              rcHelp === 0);
+  check("help: lists preview + run subcommands",     /preview/.test(ctxHelp.out()) && /\brun\b/.test(ctxHelp.out()));
+
+  // ---- arg validation ----
+  var dataDir = _tmpDir("blamejs-cli-retention");
+  var ctxNoTable = _captureCtx();
+  var rcNoTable = await cli.main(
+    ["retention", "preview", "--data-dir", dataDir, "--age-field", "createdAt",
+     "--ttl-ms", "1000", "--vault-mode", "plaintext"], ctxNoTable);
+  check("preview without --table: exit 2",           rcNoTable === 2);
+
+  var ctxNoAge = _captureCtx();
+  var rcNoAge = await cli.main(
+    ["retention", "preview", "--data-dir", dataDir, "--table", "users",
+     "--ttl-ms", "1000", "--vault-mode", "plaintext"], ctxNoAge);
+  check("preview without --age-field: exit 2",       rcNoAge === 2);
+
+  var ctxBadTtl = _captureCtx();
+  var rcBadTtl = await cli.main(
+    ["retention", "preview", "--data-dir", dataDir, "--table", "users",
+     "--age-field", "createdAt", "--ttl-ms", "-100", "--vault-mode", "plaintext"], ctxBadTtl);
+  check("preview with negative --ttl-ms: exit 2",    rcBadTtl === 2);
+
+  var ctxBadAction = _captureCtx();
+  var rcBadAction = await cli.main(
+    ["retention", "preview", "--data-dir", dataDir, "--table", "users",
+     "--age-field", "createdAt", "--ttl-ms", "1000", "--action", "shred",
+     "--vault-mode", "plaintext"], ctxBadAction);
+  check("preview with invalid --action: exit 2",     rcBadAction === 2);
+
+  var ctxSoftNoField = _captureCtx();
+  var rcSoftNoField = await cli.main(
+    ["retention", "preview", "--data-dir", dataDir, "--table", "users",
+     "--age-field", "createdAt", "--ttl-ms", "1000", "--action", "soft-delete",
+     "--vault-mode", "plaintext"], ctxSoftNoField);
+  check("preview soft-delete without --soft-delete-field: exit 2",
+        rcSoftNoField === 2);
+
+  // ---- unknown subcommand ----
+  var ctxBad = _captureCtx();
+  var rcBad = await cli.main(["retention", "list"], ctxBad);
+  check("unknown subcommand → exit 2",              rcBad === 2);
+
+  // ---- cleanup ----
+  try { fs.rmSync(dataDir, { recursive: true, force: true }); } catch (_e) {}
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  run().then(
+    function () { console.log("[cli-retention] OK"); },
+    function (e) { console.error(e); process.exit(1); }
+  );
+}