@blamejs/blamejs-shop 0.0.44

package/lib/vendor/blamejs/test/layer-0-primitives/ddl-change-control.test.js

@@ -0,0 +1,184 @@
+"use strict";
+/**
+ * b.ddlChangeControl — formal DDL approval / change-control workflow.
+ */
+
+var helpers = require("../helpers");
+var b       = helpers.b;
+var check   = helpers.check;
+
+function _fakeAudit() {
+  var emitted = [];
+  return {
+    safeEmit: function (event) { emitted.push(event); },
+    _emitted: emitted,
+  };
+}
+
+function testSurface() {
+  check("ddlChangeControl.create is a function",
+        typeof b.ddlChangeControl.create === "function");
+  check("STATES.PROPOSED",  b.ddlChangeControl.STATES.PROPOSED  === "proposed");
+  check("STATES.APPROVED",  b.ddlChangeControl.STATES.APPROVED  === "approved");
+  check("frameworkError.DdlChangeControlError exposed",
+        typeof b.frameworkError.DdlChangeControlError === "function");
+  check("ddlChangeControl.DdlChangeControlError is fn",
+        typeof b.ddlChangeControl.DdlChangeControlError === "function");
+}
+
+async function testProposeApproveApply() {
+  var fakeAudit = _fakeAudit();
+  var ddl = b.ddlChangeControl.create({
+    audit:     fakeAudit,
+    approvers: 2,
+  });
+  var prop = await ddl.propose("ALTER TABLE x ADD COLUMN y TEXT", {
+    proposer: "alice",
+    reason:   "feature-A",
+  });
+  check("propose returns changeId + sqlHash",
+        typeof prop.changeId === "string" && typeof prop.sqlHash === "string");
+  check("ddl.change.proposed audit emitted",
+        fakeAudit._emitted.some(function (e) { return e.action === "ddl.change.proposed"; }));
+
+  var rv1 = await ddl.approve(prop.changeId, "bob");
+  check("first approval count = 1, threshold not met",
+        rv1.signaturesCount === 1 && rv1.thresholdMet === false);
+  var rv2 = await ddl.approve(prop.changeId, "carol");
+  check("second approval count = 2, threshold met",
+        rv2.signaturesCount === 2 && rv2.thresholdMet === true);
+
+  var ranSql = null;
+  var apply = await ddl.applyApproved(prop.changeId, async function (sql) {
+    ranSql = sql; return { ok: true };
+  });
+  check("applyApproved ran the SQL",
+        ranSql === "ALTER TABLE x ADD COLUMN y TEXT");
+  check("applyApproved returns result",
+        apply.result && apply.result.ok === true);
+  check("ddl.change.applied audit emitted",
+        fakeAudit._emitted.some(function (e) { return e.action === "ddl.change.applied"; }));
+}
+
+async function testInsufficientApprovals() {
+  var ddl = b.ddlChangeControl.create({
+    audit:     _fakeAudit(),
+    approvers: 2,
+  });
+  var prop = await ddl.propose("ALTER TABLE x ADD COLUMN y TEXT", {
+    proposer: "alice",
+  });
+  await ddl.approve(prop.changeId, "bob");
+  var threw = null;
+  try {
+    await ddl.applyApproved(prop.changeId, async function () { return null; });
+  } catch (e) { threw = e; }
+  check("insufficient approvals refuse apply",
+        threw && /insufficient-approvals/.test(threw.code || ""));
+}
+
+async function testSelfApprovalUnderPosture() {
+  var ddl = b.ddlChangeControl.create({
+    audit:     _fakeAudit(),
+    approvers: 2,
+    posture:   "sox-404",
+  });
+  var prop = await ddl.propose("ALTER TABLE x ADD y TEXT", { proposer: "alice" });
+  var threw = null;
+  try { await ddl.approve(prop.changeId, "alice"); } catch (e) { threw = e; }
+  check("self-approval denied under sox-404",
+        threw && /self-approval-denied/.test(threw.code || ""));
+}
+
+async function testDuplicateApproval() {
+  var ddl = b.ddlChangeControl.create({ audit: _fakeAudit(), approvers: 2 });
+  var prop = await ddl.propose("ALTER", { proposer: "p" });
+  await ddl.approve(prop.changeId, "bob");
+  var threw = null;
+  try { await ddl.approve(prop.changeId, "bob"); } catch (e) { threw = e; }
+  check("duplicate approval refused",
+        threw && /duplicate-approval/.test(threw.code || ""));
+}
+
+async function testRejectThenApply() {
+  var ddl = b.ddlChangeControl.create({ audit: _fakeAudit(), approvers: 1 });
+  var prop = await ddl.propose("ALTER", { proposer: "p" });
+  await ddl.reject(prop.changeId, "reviewer", "not safe");
+  var threw = null;
+  try {
+    await ddl.applyApproved(prop.changeId, async function () { return null; });
+  } catch (e) { threw = e; }
+  check("apply after reject refused",
+        threw && /already-rejected/.test(threw.code || ""));
+}
+
+function testWindowSpecParsing() {
+  var fakeAudit = _fakeAudit();
+  // Should parse:
+  var ddl1 = b.ddlChangeControl.create({
+    audit: fakeAudit, approvers: 1, windowSpec: "always",
+  });
+  check("always window OK", ddl1.windowSpec === "always");
+  var ddl2 = b.ddlChangeControl.create({
+    audit: fakeAudit, approvers: 1, windowSpec: "Mon-Fri 09:00-17:00 UTC",
+  });
+  check("Mon-Fri 09-17 window OK", ddl2.windowSpec === "Mon-Fri 09:00-17:00 UTC");
+
+  // Bad input throws
+  var threw = null;
+  try {
+    b.ddlChangeControl.create({
+      audit: fakeAudit, approvers: 1, windowSpec: "Mon 09:00-17:00 EST",
+    });
+  } catch (e) { threw = e; }
+  check("non-UTC window refused",
+        threw && /bad-window/.test(threw.code || ""));
+}
+
+async function testSqlTamperRefused() {
+  var ddl = b.ddlChangeControl.create({ audit: _fakeAudit(), approvers: 1 });
+  var prop = await ddl.propose("ALTER", { proposer: "p" });
+  await ddl.approve(prop.changeId, "bob");
+  // Tamper the stored SQL via b.ddlChangeControl get + manual edit:
+  // Without an exposed mutator, simulate by creating a second instance
+  // sharing a custom store and tampering directly.
+  var byId = new Map();
+  var customStore = {
+    get: function (id) { return byId.get(id) || null; },
+    put: function (id, c) { byId.set(id, c); },
+    list: function () { return Array.from(byId.values()); },
+  };
+  var ddl2 = b.ddlChangeControl.create({
+    audit: _fakeAudit(), approvers: 1, store: customStore,
+  });
+  var prop2 = await ddl2.propose("ORIGINAL", { proposer: "p" });
+  await ddl2.approve(prop2.changeId, "bob");
+  // Tamper:
+  var raw = customStore.get(prop2.changeId);
+  raw.sql = "EVIL";
+  customStore.put(prop2.changeId, raw);
+  var threw = null;
+  try {
+    await ddl2.applyApproved(prop2.changeId, async function () { return null; });
+  } catch (e) { threw = e; }
+  check("sql tamper refused",
+        threw && /sql-tampered/.test(threw.code || ""));
+}
+
+async function run() {
+  testSurface();
+  await testProposeApproveApply();
+  await testInsufficientApprovals();
+  await testSelfApprovalUnderPosture();
+  await testDuplicateApproval();
+  await testRejectThenApply();
+  testWindowSpecParsing();
+  await testSqlTamperRefused();
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  run().then(function () { console.log("OK"); })
+       .catch(function (e) { console.error(e.stack || e); process.exit(1); });
+}

package/lib/vendor/blamejs/test/layer-0-primitives/declare-row-policy.test.js

@@ -0,0 +1,203 @@
+"use strict";
+/**
+ * b.db.declareRowPolicy — declarative Postgres ROW LEVEL SECURITY
+ * migration spec.
+ *
+ * Tests cover input validation at declare() time, idempotent ENABLE-RLS guard,
+ * CREATE POLICY emission for each command + permissive shape, the
+ * Postgres-only fail-fast, and DROP POLICY on down().
+ */
+
+var helpers = require("../helpers");
+var b     = helpers.b;
+var check = helpers.check;
+
+function _fakeXdb(spec) {
+  spec = spec || {};
+  var captured = [];
+  return {
+    captured: captured,
+    query: async function (sql, params) {
+      captured.push({ sql: sql, params: (params || []).slice() });
+      if (/FROM pg_class/.test(sql)) {
+        if (spec.tableExists === false) return { rows: [], rowCount: 0 };
+        return {
+          rows: [{ relrowsecurity: !!spec.rlsAlreadyOn }],
+          rowCount: 1,
+        };
+      }
+      return { rows: [], rowCount: 0 };
+    },
+  };
+}
+
+function _fakeExternalDb(backendName, dialect) {
+  return {
+    listBackends: function () {
+      return [{ name: backendName, dialect: dialect || "postgres" }];
+    },
+  };
+}
+
+async function _expectThrow(label, fn, re) {
+  var threw = null;
+  try { await fn(); } catch (e) { threw = e; }
+  check(label, threw !== null && (re ? re.test(threw.code || "") : true));
+}
+
+async function run() {
+  // ---- input validation at declareRowPolicy() ----
+  await _expectThrow("rejects missing opts",
+    function () { b.db.declareRowPolicy(); },
+    /declare-row-policy\/bad-opts/);
+
+  await _expectThrow("rejects unknown opt",
+    function () { b.db.declareRowPolicy({ schema: "a", table: "b", name: "c", using: "1=1", bogus: 1 }); },
+    /declare-row-policy\/unknown-opt/);
+
+  await _expectThrow("rejects missing schema",
+    function () { b.db.declareRowPolicy({ table: "b", name: "c", using: "1=1" }); },
+    /declare-row-policy\/missing-opt/);
+
+  await _expectThrow("rejects missing table",
+    function () { b.db.declareRowPolicy({ schema: "a", name: "c", using: "1=1" }); },
+    /declare-row-policy\/missing-opt/);
+
+  await _expectThrow("rejects missing name",
+    function () { b.db.declareRowPolicy({ schema: "a", table: "b", using: "1=1" }); },
+    /declare-row-policy\/missing-opt/);
+
+  await _expectThrow("rejects missing using",
+    function () { b.db.declareRowPolicy({ schema: "a", table: "b", name: "c" }); },
+    /declare-row-policy\/missing-opt/);
+
+  await _expectThrow("rejects bad identifier in schema",
+    function () { b.db.declareRowPolicy({ schema: "bad name", table: "b", name: "c", using: "1=1" }); },
+    /declare-row-policy\/bad-identifier/);
+
+  await _expectThrow("rejects bad role identifier",
+    function () { b.db.declareRowPolicy({ schema: "a", table: "b", name: "c", role: "bad name", using: "1=1" }); },
+    /declare-row-policy\/bad-identifier/);
+
+  await _expectThrow("rejects unknown command",
+    function () { b.db.declareRowPolicy({ schema: "a", table: "b", name: "c", using: "1=1", command: "TRUNCATE" }); },
+    /declare-row-policy\/bad-command/);
+
+  await _expectThrow("rejects semicolon in using",
+    function () { b.db.declareRowPolicy({ schema: "a", table: "b", name: "c", using: "1=1; DROP TABLE x" }); },
+    /declare-row-policy\/bad-expression/);
+
+  await _expectThrow("rejects semicolon in withCheck",
+    function () { b.db.declareRowPolicy({ schema: "a", table: "b", name: "c", using: "1=1", withCheck: "1=1; DROP" }); },
+    /declare-row-policy\/bad-expression/);
+
+  await _expectThrow("rejects empty using",
+    function () { b.db.declareRowPolicy({ schema: "a", table: "b", name: "c", using: "" }); },
+    /declare-row-policy\/(missing-opt|empty-expression)/);
+
+  await _expectThrow("rejects non-boolean permissive",
+    function () { b.db.declareRowPolicy({ schema: "a", table: "b", name: "c", using: "1=1", permissive: "yes" }); },
+    /declare-row-policy\/bad-type/);
+
+  // ---- Migration shape ----
+  var mig = b.db.declareRowPolicy({
+    schema:    "public",
+    table:     "sessions",
+    name:      "tenant_isolation",
+    role:      "app_user",
+    using:     "tenant_id = current_setting('app.tenant_id')::uuid",
+    withCheck: "tenant_id = current_setting('app.tenant_id')::uuid",
+    command:   "ALL",
+  });
+  check("migration shape: target=externalDb",  mig.target === "externalDb");
+  check("migration shape: has up()",            typeof mig.up === "function");
+  check("migration shape: has down()",          typeof mig.down === "function");
+  check("migration shape: description includes policy id",
+    /declareRowPolicy public\.sessions\.tenant_isolation/.test(mig.description));
+
+  // ---- up() emits ENABLE RLS + CREATE POLICY when RLS not yet on ----
+  var xdb = _fakeXdb({ rlsAlreadyOn: false });
+  var ctx = { externalDb: _fakeExternalDb("main", "postgres"), backendName: "main" };
+  var result = await mig.up(xdb, ctx);
+  var sqls = xdb.captured.map(function (c) { return c.sql; });
+  check("up: ALTER TABLE ... ENABLE ROW LEVEL SECURITY emitted",
+    sqls.some(function (s) { return /ALTER TABLE "public"\."sessions" ENABLE ROW LEVEL SECURITY/.test(s); }));
+  check("up: CREATE POLICY emitted with quoted identifiers",
+    sqls.some(function (s) { return /CREATE POLICY "tenant_isolation" ON "public"\."sessions"/.test(s); }));
+  check("up: AS PERMISSIVE present (default)",
+    sqls.some(function (s) { return /AS PERMISSIVE/.test(s); }));
+  check("up: FOR ALL emitted",
+    sqls.some(function (s) { return /FOR ALL/.test(s); }));
+  check("up: TO \"app_user\" emitted",
+    sqls.some(function (s) { return /TO "app_user"/.test(s); }));
+  check("up: USING expression interpolated",
+    sqls.some(function (s) { return /USING \(tenant_id = current_setting/.test(s); }));
+  check("up: WITH CHECK emitted",
+    sqls.some(function (s) { return /WITH CHECK \(tenant_id/.test(s); }));
+  check("up: returns audit metadata",
+    result && result.policy === "public.sessions.tenant_isolation" && result.command === "ALL");
+
+  // ---- up() skips ALTER when RLS already on (idempotent) ----
+  var xdb2 = _fakeXdb({ rlsAlreadyOn: true });
+  var mig2 = b.db.declareRowPolicy({
+    schema: "public", table: "sessions", name: "p2",
+    using: "user_id = current_setting('app.user_id')::uuid",
+    command: "SELECT", permissive: false,
+  });
+  await mig2.up(xdb2, ctx);
+  var sqls2 = xdb2.captured.map(function (c) { return c.sql; });
+  check("idempotent: ALTER TABLE skipped when RLS already on",
+    !sqls2.some(function (s) { return /ALTER TABLE/.test(s); }));
+  check("RESTRICTIVE rendered when permissive=false",
+    sqls2.some(function (s) { return /AS RESTRICTIVE/.test(s); }));
+  check("FOR SELECT emitted",
+    sqls2.some(function (s) { return /FOR SELECT/.test(s); }));
+  check("no role omitted: no TO clause",
+    !sqls2.some(function (s) { return /^CREATE POLICY.* TO /.test(s); }));
+  check("no withCheck: clause omitted",
+    !sqls2.some(function (s) { return /WITH CHECK/.test(s); }));
+
+  // ---- table not found → throws ----
+  var xdb3 = _fakeXdb({ tableExists: false });
+  var threw3 = null;
+  try { await mig.up(xdb3, ctx); } catch (e) { threw3 = e; }
+  check("table-not-found: clear error",
+    threw3 && /declare-row-policy\/table-not-found/.test(threw3.code || ""));
+
+  // ---- down() drops policy ----
+  var xdb4 = _fakeXdb();
+  await mig.down(xdb4, ctx);
+  var sqls4 = xdb4.captured.map(function (c) { return c.sql; });
+  check("down: DROP POLICY IF EXISTS emitted",
+    sqls4.some(function (s) {
+      return /DROP POLICY IF EXISTS "tenant_isolation" ON "public"\."sessions"/.test(s);
+    }));
+
+  // ---- Postgres-only fail-fast ----
+  var ctxSqlite = { externalDb: _fakeExternalDb("main", "sqlite"), backendName: "main" };
+  var threwSqlite = null;
+  try { await mig.up(_fakeXdb(), ctxSqlite); } catch (e) { threwSqlite = e; }
+  check("non-postgres dialect: NOT_SUPPORTED on up",
+    threwSqlite && /declare-row-policy\/not-supported/.test(threwSqlite.code || ""));
+
+  var threwSqliteDown = null;
+  try { await mig.down(_fakeXdb(), ctxSqlite); } catch (e) { threwSqliteDown = e; }
+  check("non-postgres dialect: NOT_SUPPORTED on down",
+    threwSqliteDown && /declare-row-policy\/not-supported/.test(threwSqliteDown.code || ""));
+
+  // Unknown backend
+  var ctxUnknown = { externalDb: _fakeExternalDb("other", "postgres"), backendName: "missing" };
+  var threwUnknown = null;
+  try { await mig.up(_fakeXdb(), ctxUnknown); } catch (e) { threwUnknown = e; }
+  check("unknown backend: clear error",
+    threwUnknown && /declare-row-policy\/unknown-backend/.test(threwUnknown.code || ""));
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  run().then(
+    function () { console.log("OK — " + helpers.getChecks() + " checks passed"); },
+    function (e) { console.error("FAIL:", e && e.stack || e); process.exit(1); }
+  );
+}

package/lib/vendor/blamejs/test/layer-0-primitives/declare-view.test.js

@@ -0,0 +1,303 @@
+"use strict";
+/**
+ * b.db.declareView — declarative view + GRANT migration spec.
+ *
+ * These tests exercise the spec validation, source-column / role
+ * existence checks, and the SQL emitted to xdb. A fake xdb captures
+ * every query and returns canned results so we can assert behavior
+ * without standing up a real Postgres.
+ */
+
+var helpers = require("../helpers");
+var b     = helpers.b;
+var check = helpers.check;
+
+function _fakeXdb(spec) {
+  // spec.sourceColumns: array — what information_schema returns
+  // spec.existingRoles: array — what pg_roles returns
+  // spec.queryHook(sql, params): optional override for specific queries
+  spec = spec || {};
+  var captured = [];
+  return {
+    captured: captured,
+    query: async function (sql, params) {
+      captured.push({ sql: sql, params: (params || []).slice() });
+      if (spec.queryHook) {
+        var r = spec.queryHook(sql, params);
+        if (r !== undefined) return r;
+      }
+      if (/FROM information_schema\.columns/.test(sql)) {
+        var rows = (spec.sourceColumns || []).map(function (c) {
+          return { column_name: c };
+        });
+        return { rows: rows, rowCount: rows.length };
+      }
+      if (/FROM pg_roles/.test(sql)) {
+        var existing = (spec.existingRoles || []);
+        var asked = params || [];
+        var matched = asked.filter(function (a) { return existing.indexOf(a) !== -1; });
+        return {
+          rows: matched.map(function (r) { return { rolname: r }; }),
+          rowCount: matched.length,
+        };
+      }
+      // CREATE VIEW / GRANT / DROP VIEW etc.
+      return { rows: [], rowCount: 0 };
+    },
+  };
+}
+
+async function _expectThrow(label, fn, codeRe) {
+  var threw = null;
+  try { await fn(); } catch (e) { threw = e; }
+  check(label,
+    threw !== null && (codeRe ? codeRe.test(threw.code || "") : true));
+}
+
+async function run() {
+  // ---------- Input validation at declareView() time ----------
+
+  _expectThrow("rejects missing opts",
+    function () { b.db.declareView(); },
+    /declare-view\/bad-opts/);
+
+  _expectThrow("rejects unknown opt",
+    function () { b.db.declareView({ schema: "a", name: "b", source: "c", bogus: 1 }); },
+    /declare-view\/unknown-opt/);
+
+  _expectThrow("rejects missing schema",
+    function () { b.db.declareView({ name: "b", source: "c" }); },
+    /declare-view\/missing-opt/);
+
+  _expectThrow("rejects missing name",
+    function () { b.db.declareView({ schema: "a", source: "c" }); },
+    /declare-view\/missing-opt/);
+
+  _expectThrow("rejects missing source",
+    function () { b.db.declareView({ schema: "a", name: "b" }); },
+    /declare-view\/missing-opt/);
+
+  _expectThrow("rejects bad identifier in schema",
+    function () { b.db.declareView({ schema: "a; DROP TABLE", name: "b", source: "c.d" }); },
+    /declare-view\/bad-identifier/);
+
+  _expectThrow("rejects 3-segment source",
+    function () { b.db.declareView({ schema: "a", name: "b", source: "x.y.z" }); },
+    /declare-view\/bad-source/);
+
+  _expectThrow("rejects bad identifier in redactColumns",
+    function () {
+      b.db.declareView({ schema: "a", name: "b", source: "c.d",
+                         redactColumns: ["ok", "bad ident"] });
+    },
+    /declare-view\/bad-identifier/);
+
+  _expectThrow("rejects whereClause with semicolon",
+    function () {
+      b.db.declareView({ schema: "a", name: "b", source: "c.d",
+                         whereClause: "x = 1; DROP TABLE c.d" });
+    },
+    /declare-view\/bad-where/);
+
+  _expectThrow("rejects bad hashColumns shape",
+    function () {
+      b.db.declareView({ schema: "a", name: "b", source: "c.d",
+                         hashColumns: ["not-an-object"] });
+    },
+    /declare-view\/bad-type/);
+
+  // ---------- Spec parsing ----------
+
+  var spec1 = b.db.declareView({
+    schema: "analytics", name: "sessions",
+    source: "public.sessions",
+  })._spec;
+  check("parses 'schema.table' source",
+    spec1.source.schema === "public" && spec1.source.name === "sessions");
+
+  var spec2 = b.db.declareView({
+    schema: "analytics", name: "sessions",
+    source: ["public", "sessions"],
+  })._spec;
+  check("parses [schema, table] source",
+    spec2.source.schema === "public" && spec2.source.name === "sessions");
+
+  var spec3 = b.db.declareView({
+    schema: "analytics", name: "sessions",
+    source: "sessions",
+  })._spec;
+  check("defaults bare table source to 'public' schema",
+    spec3.source.schema === "public" && spec3.source.name === "sessions");
+
+  // ---------- Migration shape ----------
+
+  var mig = b.db.declareView({
+    schema: "analytics", name: "sessions",
+    source: "public.sessions",
+    redactColumns: ["ssn"],
+    grantTo: ["analytics_user"],
+  });
+  check("returns migration shape with target",
+    mig.target === "externalDb" &&
+    typeof mig.up === "function" &&
+    typeof mig.down === "function" &&
+    typeof mig.description === "string");
+
+  // ---------- Apply-time validation: source columns ----------
+
+  await _expectThrow("up() throws when source has no columns",
+    async function () {
+      var x = _fakeXdb({ sourceColumns: [] });
+      await mig.up(x);
+    },
+    /declare-view\/source-not-found/);
+
+  await _expectThrow("up() throws when redactColumn not on source",
+    async function () {
+      var m = b.db.declareView({
+        schema: "a", name: "v", source: "public.t",
+        redactColumns: ["nope"],
+      });
+      var x = _fakeXdb({ sourceColumns: ["id", "email"] });
+      await m.up(x);
+    },
+    /declare-view\/redact-not-in-source/);
+
+  await _expectThrow("up() throws when hashColumns key not on source",
+    async function () {
+      var m = b.db.declareView({
+        schema: "a", name: "v", source: "public.t",
+        hashColumns: { emailHash: "email" },
+      });
+      var x = _fakeXdb({ sourceColumns: ["id", "email"] });   // missing emailHash
+      await m.up(x);
+    },
+    /declare-view\/hash-key-not-in-source/);
+
+  await _expectThrow("up() throws when hashColumns value not on source",
+    async function () {
+      var m = b.db.declareView({
+        schema: "a", name: "v", source: "public.t",
+        hashColumns: { emailHash: "missing_email_col" },
+      });
+      var x = _fakeXdb({ sourceColumns: ["id", "emailHash"] });
+      await m.up(x);
+    },
+    /declare-view\/hash-source-not-in-source/);
+
+  await _expectThrow("up() throws when grantTo role missing in pg_roles",
+    async function () {
+      var m = b.db.declareView({
+        schema: "a", name: "v", source: "public.t",
+        grantTo: ["analytics_user"],
+      });
+      var x = _fakeXdb({ sourceColumns: ["id"], existingRoles: [] });
+      await m.up(x);
+    },
+    /declare-view\/role-not-found/);
+
+  await _expectThrow("up() throws when SELECT list collapses to zero columns",
+    async function () {
+      var m = b.db.declareView({
+        schema: "a", name: "v", source: "public.t",
+        redactColumns: ["a", "b"],
+      });
+      var x = _fakeXdb({ sourceColumns: ["a", "b"] });
+      await m.up(x);
+    },
+    /declare-view\/empty-select/);
+
+  // ---------- SELECT column list logic ----------
+
+  var mig2 = b.db.declareView({
+    schema: "analytics", name: "sessions",
+    source: "public.sessions",
+    redactColumns: ["ssn"],
+    sealedColumns: ["secrets_jsonb"],
+    hashColumns:   { emailHash: "email" },
+  });
+  var x2 = _fakeXdb({
+    sourceColumns: ["id", "email", "emailHash", "ssn", "secrets_jsonb", "createdAt"],
+    existingRoles: [],
+  });
+  var result2 = await mig2.up(x2);
+
+  check("SELECT drops redactColumns",
+    result2.selectedColumns.indexOf("ssn") === -1);
+  check("SELECT drops sealedColumns",
+    result2.selectedColumns.indexOf("secrets_jsonb") === -1);
+  check("SELECT drops hashColumns source plaintext",
+    result2.selectedColumns.indexOf("email") === -1);
+  check("SELECT keeps hashColumns hash output",
+    result2.selectedColumns.indexOf("emailHash") !== -1);
+  check("SELECT keeps non-redacted columns",
+    result2.selectedColumns.indexOf("id") !== -1 &&
+    result2.selectedColumns.indexOf("createdAt") !== -1);
+  check("returns audit metadata structure",
+    Array.isArray(result2.redactedColumns) &&
+    Array.isArray(result2.autoExcludedSealed) &&
+    typeof result2.hashedColumns === "object");
+
+  // ---------- Emitted SQL ----------
+
+  var createSql = x2.captured.find(function (q) { return /^CREATE VIEW/.test(q.sql); });
+  check("emits CREATE VIEW with quoted qualified name",
+    createSql && /CREATE VIEW "analytics"\."sessions"/.test(createSql.sql));
+  check("emits FROM with quoted qualified source",
+    createSql && /FROM "public"\."sessions"/.test(createSql.sql));
+  check("emits SELECT with quoted column list",
+    createSql && /SELECT "id", "emailHash", "createdAt"/.test(createSql.sql));
+
+  // ---------- whereClause ----------
+
+  var migWhere = b.db.declareView({
+    schema: "a", name: "v", source: "public.t",
+    whereClause: "deleted_at IS NULL",
+  });
+  var xWhere = _fakeXdb({ sourceColumns: ["id"] });
+  await migWhere.up(xWhere);
+  var createWhere = xWhere.captured.find(function (q) { return /^CREATE VIEW/.test(q.sql); });
+  check("whereClause appended to CREATE VIEW",
+    createWhere && /WHERE deleted_at IS NULL/.test(createWhere.sql));
+
+  // ---------- GRANT ----------
+
+  var migGrant = b.db.declareView({
+    schema: "a", name: "v", source: "public.t",
+    grantTo: ["analytics_user", "bi_user"],
+  });
+  var xGrant = _fakeXdb({
+    sourceColumns: ["id"],
+    existingRoles: ["analytics_user", "bi_user"],
+  });
+  await migGrant.up(xGrant);
+  var grantSql = xGrant.captured.find(function (q) { return /^GRANT SELECT/.test(q.sql); });
+  check("emits GRANT SELECT to all roles, quoted",
+    grantSql && /GRANT SELECT ON "a"\."v" TO "analytics_user", "bi_user"/.test(grantSql.sql));
+
+  // ---------- down() ----------
+
+  var xDown = _fakeXdb({ sourceColumns: [] });   // not used by down()
+  await mig.down(xDown);
+  var dropSql = xDown.captured.find(function (q) { return /^DROP VIEW/.test(q.sql); });
+  check("down() emits DROP VIEW IF EXISTS",
+    dropSql && /DROP VIEW IF EXISTS "analytics"\."sessions"/.test(dropSql.sql));
+
+  // ---------- backend opt passthrough ----------
+
+  var migBackend = b.db.declareView({
+    schema: "a", name: "v", source: "public.t",
+    backend: "pg-main",
+  });
+  check("backend opt forwards into migration spec",
+    migBackend.backend === "pg-main");
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  run().then(
+    function () { console.log("OK — " + helpers.getChecks() + " checks passed"); },
+    function (e) { console.error("FAIL:", e && e.stack || e); process.exit(1); }
+  );
+}