@blamejs/blamejs-shop 0.2.15 → 0.2.18

package/lib/vendor/blamejs/test/layer-0-primitives/api-encrypt.test.js

@@ -90,6 +90,40 @@ async function testNonceStoreMemoryPurge() {
   store.close();
 }
 
+async function testNonceStoreMemoryCapacityFailsClosed() {
+  // A replay-protection store must bound its memory against a nonce flood,
+  // but must NOT evict a LIVE nonce to admit a new one — that reopens a
+  // replay window for the evicted nonce. So at capacity it fails CLOSED:
+  // the new (un-recordable) request is refused, not admitted unprotected.
+  var store = b.nonceStore.create({ backend: "memory", maxEntries: 3 });
+  var future = Date.now() + 60_000;
+  check("cap: first 3 live nonces admitted",
+        (await store.checkAndInsert("n1", future)) === true &&
+        (await store.checkAndInsert("n2", future)) === true &&
+        (await store.checkAndInsert("n3", future)) === true);
+  check("cap: store holds exactly maxEntries",   store._size() === 3);
+  // 4th distinct LIVE nonce — store is full of live entries, so fail closed.
+  check("cap: 4th live nonce fails closed (refused)",
+        (await store.checkAndInsert("n4", future)) === false);
+  check("cap: refused nonce was NOT stored",     store._size() === 3 && !(store._size() > 3));
+  check("cap: capacity rejection counted",       store._capacityRejects() >= 1);
+  // A previously-seen live nonce still reports as replay (not capacity).
+  check("cap: existing nonce still detected as replay",
+        (await store.checkAndInsert("n1", future)) === false);
+  store.close();
+
+  // When the ceiling is hit but EXPIRED entries exist, the inline purge
+  // reclaims room so a legitimate new nonce is admitted (not falsely
+  // refused). Fill with expired nonces, then a fresh one must succeed.
+  var store2 = b.nonceStore.create({ backend: "memory", maxEntries: 2 });
+  var past = Date.now() - 1000;
+  await store2.checkAndInsert("old1", past);
+  await store2.checkAndInsert("old2", past);
+  check("cap: full of EXPIRED entries → fresh nonce admitted (purge reclaims)",
+        (await store2.checkAndInsert("freshOne", Date.now() + 60_000)) === true);
+  store2.close();
+}
+
 async function testNonceStoreClusterBasics() {
   var tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-ns-"));
   try {
@@ -1030,6 +1064,7 @@ async function run() {
   await testNonceStoreMemoryBasics();
   await testNonceStoreMemoryRejectsBadInput();
   await testNonceStoreMemoryPurge();
+  await testNonceStoreMemoryCapacityFailsClosed();
   await testNonceStoreClusterBasics();
   await testNonceStoreCustomBackend();
   await testNonceStoreUnknownBackend();

package/lib/vendor/blamejs/test/layer-0-primitives/app-shutdown.test.js

@@ -275,6 +275,10 @@ async function testAppShutdownConfigValidation() {
   } catch (e) { threw = e; }
   check("create: bad-shaped phase rejected",   threw && threw.code === "app-shutdown/bad-phase");
 
+  threw = null;
+  try { b.appShutdown.create({ forceExitMarginMs: -1 }); } catch (e) { threw = e; }
+  check("create: bad forceExitMarginMs rejected", threw && threw.code === "app-shutdown/bad-force-exit-margin-ms");
+
   threw = null;
   var o = b.appShutdown.create({ phases: [] });
   try { o.addPhase({ name: "x" }); } catch (e) { threw = e; }
@@ -282,6 +286,65 @@ async function testAppShutdownConfigValidation() {
   o._resetForTest();
 }
 
+async function testAppShutdownWatchdogForcesExitOnHang() {
+  // A shutdown phase that never settles must NOT hold the process open
+  // until the supervisor SIGKILLs it (losing the final DB flush). When the
+  // operator delegates lifecycle via installSignalHandlers, a watchdog
+  // forces a clean exit graceMs + forceExitMarginMs after the signal so
+  // exit handlers (the DB re-encrypt) still run. Verified in a child
+  // process — the watchdog calls process.exit, which would kill the runner.
+  if (process.platform === "win32") {
+    // Node can't deliver SIGTERM to a JS handler on Windows (the OS
+    // terminates the process), so the graceful signal path the watchdog
+    // guards doesn't exist here. This defends a Linux-container SIGTERM
+    // deployment; the container smoke leg exercises it for real.
+    check("watchdog test skipped on win32 (no deliverable SIGTERM)", true);
+    return;
+  }
+  var cp = require("node:child_process");
+  var repoRoot = require("node:path").resolve(__dirname, "..", "..");
+  var script =
+    "var b = require(" + JSON.stringify(repoRoot) + ");" +
+    "b.appShutdown.create({" +
+    "  graceMs: 100, forceExitMarginMs: 150, installSignalHandlers: true," +
+    "  phases: [{ name: 'hang', run: function () { return new Promise(function () {}); } }]" +
+    "});" +
+    "setInterval(function () {}, 60000);" +     // keep the loop alive until the signal
+    "process.stdout.write('READY\\n');";
+  var child = cp.spawn(process.execPath, ["-e", script], { stdio: ["ignore", "pipe", "pipe"] });
+
+  // Single exit observer + bounded waits so a misbehaving child can never
+  // hang the test (it fails loudly via waitUntil's timeout instead).
+  var sentAt = null;
+  var exited = null;
+  var stderr = "";
+  child.stderr.on("data", function (d) { stderr += d.toString(); });
+  child.on("exit", function (code, signal) {
+    exited = { code: code, signal: signal, ms: sentAt === null ? 0 : Date.now() - sentAt };
+  });
+
+  var sawReady = false;
+  child.stdout.on("data", function (d) { if (d.toString().indexOf("READY") !== -1) sawReady = true; });
+  try {
+    await helpers.waitUntil(function () { return sawReady || exited !== null; },
+      { timeoutMs: 6000, label: "app-shutdown watchdog: child reached READY" });
+  } catch (_e) { /* fall through to the check below */ }
+  check("watchdog child reached READY (stderr: " + stderr.slice(0, 160).replace(/\n/g, " ") + ")",
+        sawReady && exited === null);
+  if (!sawReady || exited !== null) { try { child.kill("SIGKILL"); } catch (_e2) { /* gone */ } return; }
+
+  sentAt = Date.now();
+  child.kill("SIGTERM");
+  // The watchdog fires at graceMs(100) + forceExitMarginMs(150) = 250ms.
+  await helpers.waitUntil(function () { return exited !== null; },
+    { timeoutMs: 6000, label: "app-shutdown watchdog: child forced exit after SIGTERM" });
+  // It EXITS (not hangs) and does so on its own — a forced process.exit
+  // (numeric code, no kill signal), not because the OS killed it.
+  check("hung shutdown forced to exit by watchdog (not hung)", exited && exited.ms < 4000);
+  check("watchdog exit was a clean process.exit (not a kill signal)",
+        exited && exited.signal === null && typeof exited.code === "number");
+}
+
 async function run() {
   testAppShutdownSurface();
   await testAppShutdownEmpty();
@@ -299,6 +362,7 @@ async function run() {
   await testAppShutdownStandardPhasesOmitsAbsentComponents();
   await testAppShutdownSignalHandlersInstall();
   await testAppShutdownConfigValidation();
+  await testAppShutdownWatchdogForcesExitOnHang();
 }
 
 module.exports = { run: run };

package/lib/vendor/blamejs/test/layer-0-primitives/bounded-map.test.js

@@ -0,0 +1,87 @@
+"use strict";
+/**
+ * bounded-map — entry-count-capped Map facade.
+ *
+ * Run standalone: `node test/layer-0-primitives/bounded-map.test.js`
+ * Or via smoke:   `node test/smoke.js`
+ */
+
+var helpers = require("../helpers");
+var check   = helpers.check;
+var { boundedMap, BoundedMapError } = require("../../lib/bounded-map");
+
+function testEvictOldest() {
+  var evicted = [];
+  var m = boundedMap({ maxEntries: 3, onEvict: function (k, v) { evicted.push(k + "=" + v); } });
+  m.set("a", 1); m.set("b", 2); m.set("c", 3);
+  check("evict-oldest: at capacity, all present", m.size === 3 && m.has("a") && m.has("c"));
+  m.set("d", 4);
+  check("evict-oldest: size stays at cap",        m.size === 3);
+  check("evict-oldest: oldest (a) evicted",       !m.has("a") && m.has("d"));
+  m.set("e", 5);
+  check("evict-oldest: next oldest (b) evicted",  !m.has("b") && m.has("e"));
+  check("evict-oldest: onEvict fired for a,b",    evicted.join(",") === "a=1,b=2");
+}
+
+function testUpdateDoesNotGrowOrEvict() {
+  var evicted = [];
+  var m = boundedMap({ maxEntries: 2, onEvict: function (k) { evicted.push(k); } });
+  m.set("x", 1); m.set("y", 1);
+  var r = m.set("x", 99);   // update existing — must not evict y
+  check("update returns true",            r === true);
+  check("update keeps size at 2",         m.size === 2);
+  check("update did not evict",            m.has("y") && evicted.length === 0);
+  check("update changed the value",        m.get("x") === 99);
+}
+
+function testRejectPolicy() {
+  var m = boundedMap({ maxEntries: 2, policy: "reject" });
+  check("reject: first two stored",       m.set("a", 1) === true && m.set("b", 1) === true);
+  check("reject: third refused",          m.set("c", 1) === false);
+  check("reject: new key NOT stored",     !m.has("c") && m.size === 2);
+  check("reject: live entries untouched", m.has("a") && m.has("b"));
+  // Updating an existing key is still allowed at capacity (no growth).
+  check("reject: update existing allowed", m.set("a", 2) === true && m.get("a") === 2);
+}
+
+function testMapFacade() {
+  var m = boundedMap({ maxEntries: 10 });
+  m.set("k1", "v1"); m.set("k2", "v2");
+  check("get",    m.get("k1") === "v1");
+  check("has",    m.has("k2") && !m.has("nope"));
+  check("delete", m.delete("k1") === true && !m.has("k1") && m.size === 1);
+  var iter = [];
+  for (var e of m) iter.push(e[0] + "=" + e[1]);
+  check("iterable yields entries", iter.join(",") === "k2=v2");
+  var keys = []; var it = m.keys(); var n; while (!(n = it.next()).done) keys.push(n.value);
+  check("keys()", keys.join(",") === "k2");
+  var fe = []; m.forEach(function (v, k) { fe.push(k + "=" + v); });
+  check("forEach", fe.join(",") === "k2=v2");
+  m.clear();
+  check("clear", m.size === 0);
+}
+
+function testValidation() {
+  function threw(fn) { try { fn(); return null; } catch (e) { return e; } }
+  check("maxEntries 0 → throws",     threw(function () { boundedMap({ maxEntries: 0 }); }) instanceof BoundedMapError);
+  check("maxEntries -1 → throws",    threw(function () { boundedMap({ maxEntries: -1 }); }));
+  check("maxEntries 1.5 → throws",   threw(function () { boundedMap({ maxEntries: 1.5 }); }));
+  check("maxEntries missing → throws", threw(function () { boundedMap({}); }));
+  var e = threw(function () { boundedMap({ maxEntries: 5, policy: "nope" }); });
+  check("bad policy → throws bad-policy", e && e.code === "bounded-map/bad-policy");
+}
+
+function run() {
+  testEvictOldest();
+  testUpdateDoesNotGrowOrEvict();
+  testRejectPolicy();
+  testMapFacade();
+  testValidation();
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  try { run(); console.log("[bounded-map] OK — " + helpers.getChecks() + " checks passed"); }
+  catch (e) { console.error("FAIL:", e.stack || e); process.exit(1); }
+}

package/lib/vendor/blamejs/test/layer-0-primitives/cache.test.js

@@ -639,6 +639,52 @@ function _newCache(extra) {
   return b.cache.create(Object.assign({ namespace: "v411", backend: "memory" }, extra || {}));
 }
 
+async function testUpdateMemory() {
+  var c = _newCache({ namespace: "upd-mem" });
+  var r1 = await c.update("n", function (cur) { return { value: (cur || 0) + 1 }; });
+  await c.update("n", function (cur) { return { value: cur + 1 }; });
+  check("update memory: increments atomically", (await c.get("n")) === 2 && r1.value === 1);
+  var ab = await c.update("n", function () { return { abort: { why: "nope" } }; });
+  check("update memory: abort leaves value + returns aborted",
+        ab.aborted && ab.aborted.why === "nope" && (await c.get("n")) === 2);
+  var dl = await c.update("n", function () { return { delete: true }; });
+  check("update memory: delete removes the entry",
+        dl.deleted === true && (await c.get("n")) === undefined);
+  // update on an absent key sees null and may create.
+  var cr = await c.update("fresh", function (cur) { return { value: cur === null ? "created" : "x" }; });
+  check("update memory: absent key seen as null", cr.value === "created" && (await c.get("fresh")) === "created");
+  await c.close();
+}
+
+async function testUpdateClusterCas() {
+  var tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-cache-upd-"));
+  try {
+    await setupTestDb(tmpDir);
+    var c = b.cache.create({ namespace: "upd-clu", backend: "cluster", ttlMs: b.constants.TIME.minutes(5) });
+    await c.update("set", function (cur) { return { value: { items: (cur ? cur.items : []).concat("a") } }; });
+    await c.update("set", function (cur) { return { value: { items: cur.items.concat("b") } }; });
+    // Concurrent appends: the compare-and-set + retry must preserve BOTH
+    // (no lost update) — the cluster race the get/set version dropped.
+    await Promise.all([
+      c.update("set", function (cur) { return { value: { items: cur.items.concat("x") } }; }),
+      c.update("set", function (cur) { return { value: { items: cur.items.concat("y") } }; }),
+    ]);
+    var fin = await c.get("set");
+    check("update cluster: concurrent CAS loses no write", fin.items.length === 4);
+    check("update cluster: all appends present",
+          fin.items.indexOf("a") !== -1 && fin.items.indexOf("b") !== -1 &&
+          fin.items.indexOf("x") !== -1 && fin.items.indexOf("y") !== -1);
+    var ab = await c.update("set", function () { return { abort: { stop: 1 } }; });
+    check("update cluster: abort returns aborted + leaves value",
+          ab.aborted && ab.aborted.stop === 1 && (await c.get("set")).items.length === 4);
+    await c.update("set", function () { return { delete: true }; });
+    check("update cluster: delete removes the entry", (await c.get("set")) === undefined);
+    await c.close();
+  } finally {
+    await teardownTestDb(tmpDir);
+  }
+}
+
 async function testMaxBytesEvictsLru() {
   // Cache size budget: 30 bytes. Each entry ~12 bytes JSON ("aaaaaaaa" → 10).
   var c = _newCache({
@@ -847,6 +893,8 @@ async function run() {
   await testClusterBackendBasics();
   await testClusterNamespaceIsolation();
   await testClusterTtlExpiration();
+  await testUpdateMemory();
+  await testUpdateClusterCas();
 
   // v0.4.11
   await testValidationNewOpts();

package/lib/vendor/blamejs/test/layer-0-primitives/cert.test.js

@@ -49,6 +49,30 @@ function _ephemeralVault() {
   };
 }
 
+function _authVault() {
+  // Unlike the XOR _ephemeralVault (which silently produces garbage on a
+  // tampered blob), this unseal THROWS on corruption — mirroring the real
+  // XChaCha20-Poly1305 vault's authenticated decrypt. Needed to exercise
+  // the manager's corrupt-sealed-file recovery path, which keys off an
+  // unseal throw.
+  var key = crypto.randomBytes(32);
+  return {
+    seal: function (buf) {
+      var tag = crypto.createHmac("sha3-512", key).update(buf).digest();
+      return Buffer.concat([tag, Buffer.from(buf)]);
+    },
+    unseal: function (sealed) {
+      var tag = sealed.subarray(0, 64);
+      var body = sealed.subarray(64);
+      var expect = crypto.createHmac("sha3-512", key).update(body).digest();
+      if (tag.length !== expect.length || !crypto.timingSafeEqual(tag, expect)) {
+        throw new Error("vault: authentication tag mismatch");
+      }
+      return Buffer.from(body);
+    },
+  };
+}
+
 async function _selfSignedCert(domains, validityDays) {
   // Generate a parseable self-signed X.509 cert via the vendored
   // @peculiar/x509 bundle. The cert manager only parses cert PEM (to
@@ -529,6 +553,149 @@ function testAcmeBuildCsrRoundtrip() {
 
 // ---- Run ----
 
+// ---- Corrupt-sealed-state recovery (no boot crash loop) ----
+
+async function testCorruptSealedCertReissues() {
+  // A corrupt sealed cert/key is RECOVERABLE state — the CA re-issues. The
+  // manager must treat an unreadable sealed file like an absent one and
+  // re-issue, NOT let a raw unseal/decrypt error escape out of start(): on
+  // a managed restart the same corrupt file is read on every boot, so a
+  // throw here is an unrecoverable crash loop. (Same shape as the
+  // encrypted-DB tmpfs working-copy recovery.)
+  var tmp = _tmpDir();
+  var vault = _authVault();
+  var pem = await _selfSignedCert(["example.com"], 90);
+
+  fs.mkdirSync(path.join(tmp, "main"), { recursive: true });
+  // Cache-fresh cert + meta, so the ONLY reason start() would reach ACME
+  // is the corruption — not expiry.
+  fs.writeFileSync(path.join(tmp, "main", "cert.pem.sealed"), vault.seal(Buffer.from(pem.certPem)));
+  fs.writeFileSync(path.join(tmp, "main", "key.pem.sealed"),  vault.seal(Buffer.from(pem.keyPem)));
+  fs.writeFileSync(path.join(tmp, "main", "meta.json"), JSON.stringify({
+    expiresAt: Date.now() + 90 * 86400000, issuedAt: Date.now(),
+    fingerprintSha256: "ff", subject: "CN=example.com",
+    lastRenewedAt: Date.now(), keyAlg: "ecdsa-p256",
+  }));
+  // Corrupt the sealed cert in place so unseal throws an auth error.
+  var blob = fs.readFileSync(path.join(tmp, "main", "cert.pem.sealed"));
+  blob[blob.length - 1] ^= 0xff;
+  fs.writeFileSync(path.join(tmp, "main", "cert.pem.sealed"), blob);
+
+  var mgr = b.cert.create({
+    storage: { type: "sealed-disk", rootDir: tmp, vault: vault },
+    acme:    { directory: "https://example/", accountKey: "auto" },
+    certs:   [{ name: "main", domains: ["example.com"],
+      challenge: { type: "http-01", provision: async function () {}, cleanup: async function () {} } }],
+    audit: false,
+  });
+
+  var threw = null;
+  try { await mgr.start(); } catch (e) { threw = e; }
+  var msg = (threw && (threw.message || String(threw))) || "";
+  // With no reachable CA the re-issue fails with a NETWORK error — which
+  // proves start() recovered PAST the corrupt file (rather than crashing
+  // on the unseal error before it ever reached the issue path).
+  check("corrupt sealed cert → no raw unseal crash",
+    threw && !/authentication tag|unseal|decrypt|malformed/i.test(msg));
+  check("corrupt sealed cert → routed to ACME re-issue",
+    threw && /dns lookup|EAI_AGAIN|ENOTFOUND|getaddrinfo|failed|fetch/i.test(msg));
+  try { await mgr.stop(); } catch (_e) { /* never started cleanly */ }
+
+  // Corrupt meta.json (derived index) must ALSO route to re-issue, not
+  // throw cert/bad-meta out of start().
+  var tmp2 = _tmpDir();
+  var v2 = _authVault();
+  fs.mkdirSync(path.join(tmp2, "main"), { recursive: true });
+  fs.writeFileSync(path.join(tmp2, "main", "cert.pem.sealed"), v2.seal(Buffer.from(pem.certPem)));
+  fs.writeFileSync(path.join(tmp2, "main", "key.pem.sealed"),  v2.seal(Buffer.from(pem.keyPem)));
+  fs.writeFileSync(path.join(tmp2, "main", "meta.json"), "{ this is not json ");
+  var mgr2 = b.cert.create({
+    storage: { type: "sealed-disk", rootDir: tmp2, vault: v2 },
+    acme:    { directory: "https://example/", accountKey: "auto" },
+    certs:   [{ name: "main", domains: ["example.com"],
+      challenge: { type: "http-01", provision: async function () {}, cleanup: async function () {} } }],
+    audit: false,
+  });
+  var threw2 = null;
+  try { await mgr2.start(); } catch (e) { threw2 = e; }
+  // With a VALID sealed cert present, a corrupt meta.json is advisory:
+  // expiry + fingerprint are re-derived from the cert itself, so start()
+  // loads the cert cleanly — no cert/bad-meta throw, and no needless
+  // re-issue (a corrupt derived index must not force a network round-trip).
+  check("corrupt meta.json → no cert/bad-meta throw",
+    !threw2 || threw2.code !== "cert/bad-meta");
+  check("corrupt meta.json → cert still loads from the sealed cert",
+    !threw2 && mgr2.getContext("main") && typeof mgr2.getContext("main").cert === "string");
+  try { await mgr2.stop(); } catch (_e) {}
+}
+
+async function testStaleMetaDoesNotServeExpiringCert() {
+  // The renewal decision must trust the SEALED cert's own notAfter, not the
+  // plaintext meta.json index. A meta.expiresAt that disagrees with the cert
+  // — drifted, or tampered far-future over an actually-expiring cert — must
+  // NOT let start() short-circuit and serve a cert that is in fact due for
+  // renewal.
+  var tmp = _tmpDir();
+  var vault = _authVault();
+  var pem = await _selfSignedCert(["example.com"], 5);   // real notAfter ~5d out (< 14-day renew window)
+
+  fs.mkdirSync(path.join(tmp, "main"), { recursive: true });
+  fs.writeFileSync(path.join(tmp, "main", "cert.pem.sealed"), vault.seal(Buffer.from(pem.certPem)));
+  fs.writeFileSync(path.join(tmp, "main", "key.pem.sealed"),  vault.seal(Buffer.from(pem.keyPem)));
+  // meta claims a FAR-FUTURE expiry, disagreeing with the real cert.
+  fs.writeFileSync(path.join(tmp, "main", "meta.json"), JSON.stringify({
+    expiresAt: Date.now() + 90 * 86400000, issuedAt: Date.now(),
+    fingerprintSha256: "stale", subject: "CN=example.com",
+    lastRenewedAt: Date.now(), keyAlg: "ecdsa-p256",
+  }));
+
+  var mgr = b.cert.create({
+    storage: { type: "sealed-disk", rootDir: tmp, vault: vault },
+    acme:    { directory: "https://example/", accountKey: "auto" },
+    certs:   [{ name: "main", domains: ["example.com"],
+      challenge: { type: "http-01", provision: async function () {}, cleanup: async function () {} } }],
+    audit: false,
+  });
+  var threw = null;
+  try { await mgr.start(); } catch (e) { threw = e; }
+  var msg = (threw && (threw.message || String(threw))) || "";
+  // The real cert is inside the 14-day renewal window, so start() must
+  // attempt renewal (network-fail here) rather than trusting the stale
+  // far-future meta and serving the expiring cert.
+  check("stale far-future meta does not skip renewal of an expiring cert",
+        threw && /dns lookup|EAI_AGAIN|ENOTFOUND|getaddrinfo|failed|fetch/i.test(msg));
+  try { await mgr.stop(); } catch (_e) {}
+}
+
+async function testCorruptAccountKeyClearError() {
+  // The ACME account key binds order history, so a corrupt one is NOT
+  // auto-regenerated (that would silently abandon the account). It must
+  // fail with an actionable cert/account-key-unreadable error, not a raw
+  // decrypt throw.
+  var tmp = _tmpDir();
+  var vault = _authVault();
+  fs.mkdirSync(path.join(tmp, "account"), { recursive: true });
+  // A well-formed sealed account key, then corrupted so unseal throws.
+  var realJwk = JSON.stringify({ kty: "EC", crv: "P-256", x: "a", y: "b",
+    privatePem: "p", publicPem: "q" });
+  var sealed = vault.seal(Buffer.from(realJwk));
+  sealed[sealed.length - 1] ^= 0xff;
+  fs.writeFileSync(path.join(tmp, "account", "jwk.json.sealed"), sealed);
+
+  var mgr = b.cert.create({
+    storage: { type: "sealed-disk", rootDir: tmp, vault: vault },
+    acme:    { directory: "https://example/", accountKey: "auto" },
+    certs:   [{ name: "main", domains: ["example.com"],
+      challenge: { type: "http-01", provision: async function () {}, cleanup: async function () {} } }],
+    audit: false,
+  });
+  var threw = null;
+  try { await mgr.start(); } catch (e) { threw = e; }
+  check("corrupt account key → actionable cert/account-key-unreadable",
+    threw && threw.code === "cert/account-key-unreadable");
+  try { await mgr.stop(); } catch (_e) {}
+}
+
 async function run() {
   testSurface();
   testFactoryRefusesBadOpts();
@@ -538,6 +705,9 @@ async function run() {
   await testRefreshForcesIssue();
   await testKeyEscrow();
   testAcmeBuildCsrRoundtrip();
+  await testCorruptSealedCertReissues();
+  await testStaleMetaDoesNotServeExpiringCert();
+  await testCorruptAccountKeyClearError();
 }
 
 module.exports = { run: run };

package/lib/vendor/blamejs/test/layer-0-primitives/cluster-storage.test.js

@@ -0,0 +1,125 @@
+"use strict";
+/**
+ * cluster-storage — cluster-aware framework-state SQL dispatch.
+ *
+ * Focus: the transaction() primitive (added v0.13.38) — atomic commit,
+ * rollback-on-throw, and single-node serialization so a concurrent
+ * execute() can't interleave a statement into an open transaction on the
+ * shared SQLite connection.
+ *
+ * Run standalone: `node test/layer-0-primitives/cluster-storage.test.js`
+ * Or via smoke:   `node test/smoke.js`
+ */
+
+var fs      = require("node:fs");
+var os      = require("node:os");
+var path    = require("node:path");
+var helpers = require("../helpers");
+var b       = helpers.b;
+var check   = helpers.check;
+var setupTestDb    = helpers.setupTestDb;
+var teardownTestDb = helpers.teardownTestDb;
+
+var SCHEMA = [{ name: "cs_tx_t", columns: { k: "TEXT PRIMARY KEY", v: "INTEGER" } }];
+
+function testSurface() {
+  check("clusterStorage namespace",      typeof b.clusterStorage === "object");
+  check("clusterStorage.transaction fn", typeof b.clusterStorage.transaction === "function");
+}
+
+async function testTransactionCommits() {
+  var tmp = fs.mkdtempSync(path.join(os.tmpdir(), "cs-tx-commit-"));
+  try {
+    await setupTestDb(tmp, SCHEMA);
+    var cs = b.clusterStorage;
+    await cs.transaction(async function (tx) {
+      await tx.execute("INSERT INTO cs_tx_t (k, v) VALUES (?, ?)", ["a", 1]);
+      await tx.execute("INSERT INTO cs_tx_t (k, v) VALUES (?, ?)", ["b", 2]);
+      var seen = await tx.executeOne("SELECT COUNT(*) AS n FROM cs_tx_t");
+      check("tx: rows visible inside the transaction", seen.n === 2);
+    });
+    var after = await cs.executeOne("SELECT COUNT(*) AS n FROM cs_tx_t");
+    check("tx: commit persisted both rows", after.n === 2);
+  } finally {
+    b.db._resetForTest();
+    await teardownTestDb(tmp);
+  }
+}
+
+async function testTransactionRollsBackOnThrow() {
+  var tmp = fs.mkdtempSync(path.join(os.tmpdir(), "cs-tx-rollback-"));
+  try {
+    await setupTestDb(tmp, SCHEMA);
+    var cs = b.clusterStorage;
+    await cs.execute("INSERT INTO cs_tx_t (k, v) VALUES (?, ?)", ["keep", 1]);
+    var threw = null;
+    try {
+      await cs.transaction(async function (tx) {
+        await tx.execute("INSERT INTO cs_tx_t (k, v) VALUES (?, ?)", ["gone", 2]);
+        throw new Error("boom");
+      });
+    } catch (e) { threw = e; }
+    check("tx: throw propagates to caller",       threw && threw.message === "boom");
+    var rows = await cs.executeAll("SELECT k FROM cs_tx_t ORDER BY k");
+    check("tx: rolled-back row absent",            rows.length === 1 && rows[0].k === "keep");
+  } finally {
+    b.db._resetForTest();
+    await teardownTestDb(tmp);
+  }
+}
+
+async function testTransactionSerializesExecute() {
+  // A concurrent execute() must NOT interleave a statement into an open
+  // single-node transaction on the shared connection — it waits until the
+  // transaction commits.
+  var tmp = fs.mkdtempSync(path.join(os.tmpdir(), "cs-tx-serial-"));
+  try {
+    await setupTestDb(tmp, SCHEMA);
+    var cs = b.clusterStorage;
+    var order = [];
+    var txP = cs.transaction(async function (tx) {
+      order.push("tx-begin");
+      await tx.execute("INSERT INTO cs_tx_t (k, v) VALUES (?, ?)", ["d", 4]);
+      await helpers.passiveObserve(40, "cluster-storage tx: hold the transaction open");
+      order.push("tx-end");
+    });
+    var exP = cs.execute("INSERT INTO cs_tx_t (k, v) VALUES (?, ?)", ["e", 5])
+      .then(function () { order.push("exec-done"); });
+    await Promise.all([txP, exP]);
+    check("tx: concurrent execute waited for commit (no mid-tx interleave)",
+          order.join(",") === "tx-begin,tx-end,exec-done");
+    var n = await cs.executeOne("SELECT COUNT(*) AS n FROM cs_tx_t");
+    check("tx: both writes landed", n.n === 2);
+  } finally {
+    b.db._resetForTest();
+    await teardownTestDb(tmp);
+  }
+}
+
+async function testTransactionRejectsBadArg() {
+  var threw = null;
+  try { await b.clusterStorage.transaction("not-a-fn"); } catch (e) { threw = e; }
+  check("tx: non-function arg rejected", threw && threw.code === "cluster-storage/bad-arg");
+}
+
+async function run() {
+  testSurface();
+  await testTransactionCommits();
+  await testTransactionRollsBackOnThrow();
+  await testTransactionSerializesExecute();
+  await testTransactionRejectsBadArg();
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  run().then(
+    function () { console.log("[cluster-storage] OK — " + helpers.getChecks() + " checks passed"); },
+    // Rethrow rather than console.error(e.stack): this test seeds a vault
+    // passphrase via setupTestDb, and logging the error object trips
+    // CodeQL's clear-text-logging taint (passphrase -> error -> log). The
+    // rethrow lets Node print the uncaught error + stack itself and exit
+    // non-zero, with no logging sink for the taint to reach.
+    function (e) { process.exitCode = 1; throw e; }
+  );
+}