@blamejs/blamejs-shop 0.3.12 → 0.3.13

package/lib/vendor/blamejs/scripts/release.js

@@ -88,16 +88,41 @@ function _bumpMinor(version) {
   return parts[0] + "." + (parts[1] + 1) + ".0";
 }
 
+// Quote a single argument for a Windows cmd.exe command line. Tokens
+// made only of safe characters pass through unquoted; anything else is
+// double-quoted with embedded quotes doubled.
+function _quoteWinArg(a) {
+  a = String(a);
+  if (/^[A-Za-z0-9_@.\-/:=]+$/.test(a)) return a;
+  return '"' + a.replace(/"/g, '""') + '"';
+}
+
 function _run(cmd, args, opts) {
   opts = opts || {};
-  var rv = childProcess.spawnSync(cmd, args, {
+  args = args || [];
+  var spawnCmd = cmd;
+  var spawnArgs = args;
+  var useShell = false;
+  if (_needsShell(cmd)) {
+    // Windows resolves npm / npx through .cmd shims that can only be
+    // launched via a shell (the CVE-2024-27980 mitigation refuses to
+    // spawn .cmd files without one). Node 26's DEP0190 deprecates
+    // pairing an args ARRAY with shell:true because the args would be
+    // concatenated onto the command line without escaping — a quoting /
+    // injection hazard. Build a single, explicitly-quoted command
+    // string and pass NO args array, which is the supported shape.
+    spawnCmd = [cmd].concat(args.map(_quoteWinArg)).join(" ");
+    spawnArgs = undefined;
+    useShell = true;
+  }
+  var rv = childProcess.spawnSync(spawnCmd, spawnArgs, {
     cwd:    opts.cwd   || ROOT,
     stdio:  opts.stdio || "inherit",
     env:    Object.assign({}, process.env, opts.env || {}),
-    shell:  _needsShell(cmd),
+    shell:  useShell,
   });
   if (rv.status !== 0 && !opts.allowFail) {
-    throw new Error("release: " + cmd + " " + (args || []).join(" ") +
+    throw new Error("release: " + cmd + " " + args.join(" ") +
                     " failed with status " + rv.status);
   }
   return rv;

package/lib/vendor/blamejs/test/layer-0-primitives/audit-tools-dual-control.test.js

@@ -0,0 +1,115 @@
+"use strict";
+/**
+ * b.auditTools.purge dual-control gate.
+ *
+ * When audit_log is placed under dual control, physically purging the
+ * audit chain requires a consumed m-of-n grant in addition to a
+ * verified archive and confirm:true — one operator must not be able to
+ * erase the tamper-evident chain alone. The grant's action is also
+ * bound, so a grant minted for a different operation can't be replayed
+ * against a purge.
+ */
+
+var helpers = require("../helpers");
+var b              = helpers.b;
+var check          = helpers.check;
+var fs             = helpers.fs;
+var os             = helpers.os;
+var path           = helpers.path;
+var setupTestDb    = helpers.setupTestDb;
+var teardownTestDb = helpers.teardownTestDb;
+
+var PASS = Buffer.from("operator-passphrase");
+var PURGE_ACTION = "auditTools.purge";
+
+async function _seedAuditRows(count) {
+  b.audit.registerNamespace("test");
+  for (var i = 0; i < count; i++) {
+    await b.audit.record({
+      actor: { userId: "u-" + i }, action: "test.seeded", outcome: "success", metadata: { i: i },
+    });
+  }
+}
+
+async function _expectCode(fn, code) {
+  var threw = null;
+  try { await fn(); } catch (e) { threw = e; }
+  return threw && threw.code === code;
+}
+
+async function run() {
+  var dir = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-at-dc-"));
+  try {
+    await setupTestDb(dir);
+    await _seedAuditRows(5);
+    await b.audit.checkpoint();
+
+    var out = path.join(dir, "bundles", "archive-dc");
+    await b.auditTools.archive({ before: Date.now() + 1000, out: out, passphrase: PASS });
+
+    // Simulate audit_log being under dual control (m-of-n). The gate
+    // override returns a gate descriptor for the audit_log table; the
+    // denial branches all fire before any chain mutation, so the same
+    // verified bundle is reused across them.
+    var sawTable = null;
+    var gate = function (table) { sawTable = table; return { m: 2, n: 3 }; };
+
+    // No grant → refused.
+    check("purge under dual control refuses without a grant",
+      await _expectCode(function () {
+        return b.auditTools.purge({ archive: out, passphrase: PASS, confirm: true, checkDualControlGate: gate });
+      }, "audit-tools/dual-control-required"));
+    check("gate was consulted for the audit_log table", sawTable === "audit_log");
+
+    // Grant not ready (not a consumed m-of-n grant) → refused.
+    check("purge refuses a not-ready grant",
+      await _expectCode(function () {
+        return b.auditTools.purge({
+          archive: out, passphrase: PASS, confirm: true, checkDualControlGate: gate,
+          dualControlGrant: { ready: false, action: PURGE_ACTION },
+        });
+      }, "audit-tools/dual-control-grant-not-ready"));
+
+    // Grant minted for a different action → refused (action binding).
+    check("purge refuses a grant bound to a different action",
+      await _expectCode(function () {
+        return b.auditTools.purge({
+          archive: out, passphrase: PASS, confirm: true, checkDualControlGate: gate,
+          dualControlGrant: { ready: true, action: "db.eraseHard" },
+        });
+      }, "audit-tools/dual-control-grant-mismatch"));
+
+    // Confirm the chain is still intact — no denial mutated it.
+    var beforeRows = await b.clusterStorage.executeAll("SELECT COUNT(*) as c FROM audit_log");
+    check("audit_log untouched by denied purges", Number(beforeRows[0].c) >= 5);
+
+    // Valid consumed grant for the purge action → proceeds.
+    var pres = await b.auditTools.purge({
+      archive: out, passphrase: PASS, confirm: true, checkDualControlGate: gate,
+      dualControlGrant: { ready: true, action: PURGE_ACTION },
+    });
+    check("purge with a valid grant succeeds", pres.purged === true);
+    check("purge reports dual-control was consumed", pres.dualControlConsumed === true);
+    check("purge deleted rows", pres.rowsDeleted > 0);
+
+    // No gate (audit_log not under dual control) → confirm + archive
+    // alone is sufficient (no grant required) — the gate is opt-in.
+    var noGateResult = b.auditTools.purge;
+    check("purge surface present", typeof noGateResult === "function");
+  } finally {
+    await teardownTestDb(dir);
+    try { fs.rmSync(dir, { recursive: true, force: true }); } catch (_e) {}
+  }
+
+  console.log("OK — audit-tools dual-control tests");
+}
+
+module.exports = { run: run };
+if (require.main === module) {
+  // Rethrow on failure so Node surfaces the error and exits non-zero,
+  // instead of logging the caught error object — a taint analyzer traces
+  // a logged error back to the test passphrase fixture (a non-secret
+  // constant) and raises a false clear-text-logging alert.
+  run().then(function () { process.exit(0); })
+       .catch(function (err) { process.exitCode = 1; throw err; });
+}

package/lib/vendor/blamejs/test/layer-0-primitives/codebase-patterns.test.js

@@ -309,6 +309,7 @@ var VALID_ALLOW_CLASSES = {
   "inline-require": 1,
   "inline-require-non-empty-string-validation": 1,
   "internal-binding-in-prose": 1,
+  "internal-narrative-comment": 1,
   "list-without-pagination": 1,
   "math-random-noncrypto": 1,
   "no-number-money-arithmetic": 1,
@@ -7951,6 +7952,101 @@ var KNOWN_ANTIPATTERNS = [
     reason: "Codex P1 on v0.11.4 PR #109 — b.audit.useStore({ record }) inlined await on operator-supplied callback. A stalled network call neither resolves nor rejects ⇒ b.audit.record() never returns, emit/safeEmit drains stall behind it; hot-path observability emission is supposed to be drop-silent on hangs. Defense: wrap every external-callback await in safeAsync.withTimeout. Detector catches future operator-supplied async hooks on the same shape (_externalStore / _userStore / _externalSink / _externalCb / _externalCallback / _externalHook).",
   },
 
+  {
+    // v0.14.7 — physically deleting audit-chain rows is a
+    // single-operator-can-erase-evidence risk. `auditTools.purge`
+    // (and the low-level `db.purgeAuditChain` it composes) MUST
+    // consult a dual-control gate — two distinct authorizers — before
+    // the destructive delete runs, so one compromised credential can't
+    // silently truncate the tamper-evident chain. The gate primitive
+    // is `db._checkDualControlGate(table)` (resolved at runtime); the
+    // purge path threads it via `_resolveDualControlGate(opts)` and
+    // refuses with `dual-control-required` when no grant is present.
+    //
+    // Detector: any lib/ call to `purgeAuditChain(` MUST appear in a
+    // file that also names the gate (`_checkDualControlGate` /
+    // `_resolveDualControlGate` / `dualControlGrant`). A new caller
+    // that physically deletes chain rows without routing through the
+    // gate trips here.
+    id: "audit-purge-without-dual-control-gate",
+    primitive: "auditTools.purge({ dualControlGrant }) / db.purgeAuditChain — physical audit-chain deletion MUST consult the dual-control gate (_checkDualControlGate / _resolveDualControlGate); one operator must not be able to erase the tamper-evident chain alone",
+    regex: /\bpurgeAuditChain\s*\(/,
+    requires: /_checkDualControlGate|_resolveDualControlGate|dualControlGrant/,
+    skipCommentLines: true,
+    allowlist: [],
+    reason: "v0.14.7 — audit-chain purge is irreversible and tamper-evidence-destroying. The discipline: the chain may only be truncated under a two-authorizer dual-control grant. db.js defines the gate (_checkDualControlGate) and audit-tools.js purge() resolves+enforces it (_resolveDualControlGate) before calling db().purgeAuditChain; both files satisfy the companion check. A future file that calls purgeAuditChain without naming the gate would let a single operator delete evidence — exactly the shape this blocks.",
+  },
+
+  {
+    // v0.14.7 — raw-SQL fragments passed to `whereRaw` / the
+    // WhereBuilder `.raw(sql, params)` escape hatch must parameterize
+    // values via the `params` array, NOT interpolate or concatenate
+    // them into the SQL string. `_assertRawNoStringLiteral` refuses an
+    // embedded `'...'` literal at runtime (unless the caller opts in
+    // with `allowLiterals`), but the static discipline is stronger:
+    // lib/ must never BUILD the raw SQL by `${...}` template
+    // interpolation or `"..." + value` string concatenation — that is
+    // the injection shape the bound-params API exists to prevent.
+    //
+    // Detector fires on a whereRaw/.raw call whose first argument is a
+    // template literal containing `${` or a string-concat expression.
+    // A no-arg `bodyParser.raw()` (different `.raw`) does not match —
+    // the regex requires an interpolated/concatenated string argument.
+    id: "whereraw-interpolated-or-concatenated-sql",
+    primitive: "whereRaw(sql, params) / qb.raw(sql, params) — pass values through the bound `params` array; never `${...}`-interpolate or `+`-concatenate them into the SQL string (that is the injection shape the params API prevents)",
+    regex: /(?:whereRaw|\.raw)\s*\(\s*(?:`[^`]*\$\{|["'][^"']*["']\s*\+|[A-Za-z_$][\w$]*\s*\+\s*["'`])/,
+    skipCommentLines: true,
+    allowlist: [],
+    reason: "v0.14.7 — b.db whereRaw / WhereBuilder.raw accept an operator SQL fragment plus a bound-params array. Concatenating or template-interpolating a value into the fragment defeats the placeholder binding and reintroduces SQL injection. lib/ has zero such call sites today; the detector keeps it that way (the runtime _assertRawNoStringLiteral gate is the operator-facing backstop, this is the framework-internal one). No-argument `.raw()` mountings (e.g. bodyParser.raw()) don't match — an interpolated/concatenated string argument is required.",
+  },
+
+  {
+    // v0.14.7 — equality-lookup ("derived") hashes for sealed columns
+    // must be computed through cryptoField._computeDerivedHash, which
+    // honours the per-table / per-column mode policy (salted-sha3 by
+    // default, hmac-shake256 opt-in keyed off vault.getDerivedHashMacKey).
+    // Hand-rolling `sha3Hash(vault.getDerivedHashSalt() + ns + value)`
+    // at a new site bypasses the keyed-MAC option AND the mode policy,
+    // and risks a static-salt regression if the salt source is changed
+    // for one caller but not the canonical helper.
+    //
+    // Detector: direct use of `getDerivedHashSalt().toString("hex") +`
+    // outside crypto-field.js (the canonical helper). The helper itself
+    // is allowlisted.
+    id: "derived-hash-handrolled-outside-crypto-field",
+    primitive: "cryptoField derived/lookup hashes — compute via _computeDerivedHash (honours salted-sha3 vs hmac-shake256 mode + vault.getDerivedHashMacKey); do not hand-roll sha3Hash(getDerivedHashSalt() + ns + value) at call sites",
+    regex: /getDerivedHashSalt\s*\(\s*\)\s*\.toString\s*\(\s*["']hex["']\s*\)\s*\+/,
+    skipCommentLines: true,
+    allowlist: [
+      // The canonical helper — _computeDerivedHash branches on mode here.
+      "lib/crypto-field.js",
+    ],
+    reason: "v0.14.7 — derived-hash equality lookups gained a keyed mode (hmac-shake256 off vault.getDerivedHashMacKey) alongside the salted-sha3 default. The mode decision lives in cryptoField._computeDerivedHash. A site that hand-derives the hash with getDerivedHashSalt() bypasses the keyed option and the per-column mode policy; only the canonical helper (crypto-field.js) may name the salt directly.",
+  },
+
+  {
+    // v0.14.7 — a `db.auth.failed` audit row must record WHICH
+    // relation the rejected credential attempted to reach
+    // (`attemptedTable`), so an operator triaging a credential-abuse
+    // event can scope blast radius without correlating to the raw SQL
+    // log. external-db extracts the target relation defensively
+    // (_extractTargetRelation) and stamps both resource.attemptedTable
+    // and the audit metadata. Emitting the auth-failure audit without
+    // it loses the forensic signal.
+    //
+    // Detector: an `action: "db.auth.failed"` audit emit MUST appear in
+    // a file that also names `attemptedTable`. The metric emitter
+    // (_emitMetric("db.auth.failed", ...)) uses a positional shape, not
+    // `action:`, so it doesn't match.
+    id: "db-auth-failed-audit-without-attempted-relation",
+    primitive: "db.auth.failed audit — stamp the attempted relation (attemptedTable, via _extractTargetRelation) on credential-rejection audit rows so blast radius is triageable without the raw SQL log",
+    regex: /action\s*:\s*["']db\.auth\.failed["']/,
+    requires: /attemptedTable/,
+    skipCommentLines: true,
+    allowlist: [],
+    reason: "v0.14.7 — external-db credential-rejection audits (SQLSTATE 28000 / 28P01 / 42501) now carry attemptedTable, the relation the rejected identity tried to touch, extracted defensively from the SQL. The detector requires any file emitting an action:'db.auth.failed' audit to also name attemptedTable so a future emitter can't drop the forensic field.",
+  },
+
 ];
 
 // @example placeholder detection lives in
@@ -10565,9 +10661,9 @@ function testPrimitiveReachability() {
 //               onDeny / problemDetails opts. A new deny-path
 //               middleware that hardcodes
 //               `res.writeHead(<4xx/5xx>, { "Content-Type": ... })`
-//               locks consumers out of the response shape — the
-//               integration-friction class that blocked downstream
-//               adoption (the rate-limit text/plain 429). ----
+//               locks consumers out of the response shape — which is
+//               what pinned rate-limit's 429 to text/plain before this
+//               convention existed. ----
 function testDenyPathComposesDenyResponse() {
   // class: deny-path-hardcoded-response
   var MW_ROOT = path.resolve(LIB_ROOT, "middleware");
@@ -10610,9 +10706,73 @@ function testDenyPathComposesDenyResponse() {
     violations);
 }
 
+// ---- Pattern: operator-facing source comments must describe the code,
+//               not the internal authoring process. These shapes are
+//               internal slice / bug / plan IDs, code-review-process
+//               residue (Codex P-levels, PR numbers), and dated
+//               decision parentheticals — none of which an operator
+//               reading the shipped source can map to anything in their
+//               own checkout. Genuinely operator-meaningful references
+//               (RFC / CVE / NIST / CWE, "since vX.Y.Z", established
+//               terse markers like D-M4 / AUTH-32) are NOT matched.
+//               Allowlist a false positive with `// allow:internal-
+//               narrative-comment`. ----
+function testNoInternalNarrativeComments() {
+  // class: internal-narrative-comment
+  var NARRATIVE = [
+    { re: /\b(?:SUBSTRATE|BUG|MAIL)-\d+\b/,        what: "internal slice/bug ID" },
+    { re: /\b(?:D-[MLH]\d+|AUTH-\d+|CRYPTO-\d+|SUPPLY-\d+)\b/, what: "internal domain/slice ID" },
+    { re: /\bCodex\s+P\d/,                          what: "code-review-process reference (Codex P#)" },
+    { re: /\bF-[A-Z]{2,}-\d+\b/,                    what: "internal feature/plan item ID" },
+    { re: /\bPR\s+#\d+\b/,                          what: "pull-request number (process residue)" },
+    { re: /\b[Aa]udit\s+\d{4}-\d{2}-\d{2}/,         what: "dated audit/decision residue" },
+    { re: /\bReported\s+\d{4}-\d{2}-\d{2}/,         what: "dated report residue" },
+    { re: /\bCore Rule\s+§\d/,                 what: "internal CLAUDE.md rule-number citation" },
+  ];
+  var files = _libFiles();
+  var bad = [];
+  var jsdocLineRe = /^\s*\*/;
+  for (var fi = 0; fi < files.length; fi++) {
+    var rel = _relPath(files[fi]);
+    var src = fs.readFileSync(files[fi], "utf8");
+    var lines = src.split("\n");
+    for (var li = 0; li < lines.length; li++) {
+      var line = lines[li];
+      // Scan the comment portion only: a ` * `-prefixed JSDoc line in
+      // full, or the text after a line's first `//`.
+      var comment = null;
+      if (jsdocLineRe.test(line)) {
+        comment = line;
+      } else {
+        var idx = line.indexOf("//");
+        if (idx !== -1) comment = line.slice(idx);
+      }
+      if (comment === null) continue;
+      for (var p = 0; p < NARRATIVE.length; p++) {
+        var m = comment.match(NARRATIVE[p].re);
+        if (m) {
+          bad.push({
+            file:    rel,
+            line:    li + 1,
+            content: NARRATIVE[p].what + ": `" + m[0] + "` in an operator-facing comment — " +
+                     "describe the change, not the internal process (strip the label / drop the " +
+                     "dated parenthetical / cite the public reason instead)",
+          });
+          break;
+        }
+      }
+    }
+  }
+  bad = _filterMarkers(bad, "internal-narrative-comment");
+  _report("operator-facing source comments must not carry internal-process narrative " +
+          "(slice / bug / plan IDs, Codex / PR references, dated decision parentheticals)",
+    bad);
+}
+
 async function run() {
   testPrimitiveReachability();
   testDenyPathComposesDenyResponse();
+  testNoInternalNarrativeComments();
   testNoOrphanAllowClass();
   testNoRawByteLiterals();
   testNoRawTimeLiterals();

package/lib/vendor/blamejs/test/layer-0-primitives/crypto-field-derived-hash.test.js

@@ -0,0 +1,102 @@
+"use strict";
+/**
+ * b.cryptoField derived-hash modes.
+ *
+ * Equality-lookup ("derived") hashes for sealed columns can be computed
+ * two ways:
+ *   - salted-sha3   (default) — SHA3-512 over a per-deployment salt.
+ *   - hmac-shake256 (opt-in)  — keyed MAC off vault.getDerivedHashMacKey,
+ *                               so the hash is unforgeable without the
+ *                               per-deployment MAC key.
+ *
+ * The mode is chosen per-table (derivedHashMode) or per-column
+ * (spec.mode). The decision lives in _computeDerivedHash; call sites
+ * must never hand-roll the hash.
+ */
+
+var helpers = require("../helpers");
+var b     = helpers.b;
+var check = helpers.check;
+var fs   = require("fs");
+var os   = require("os");
+var path = require("path");
+
+async function run() {
+  var dir = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-cf-dh-"));
+  await b.vault.init({ mode: "plaintext", dataDir: dir });
+
+  // ---- salted-sha3 is the default: SHA3-512 → 128 hex chars ----
+  b.cryptoField.registerTable("cf_dh_t1", {
+    sealedFields: ["email"],
+    derivedHashes: { emailHash: { from: "email" } },
+  });
+  var saltedH = b.cryptoField.lookupHash("cf_dh_t1", "email", "a@b.com").value;
+  check("salted-sha3 default is 128 hex (SHA3-512)", saltedH.length === 128);
+  check("salted-sha3 is deterministic",
+    saltedH === b.cryptoField.lookupHash("cf_dh_t1", "email", "a@b.com").value);
+
+  // ---- hmac-shake256 table mode: SHAKE256/32 → 64 hex chars ----
+  b.cryptoField.registerTable("cf_dh_t2", {
+    sealedFields: ["email"],
+    derivedHashes: { emailHash: { from: "email" } },
+    derivedHashMode: "hmac-shake256",
+  });
+  var keyedH = b.cryptoField.lookupHash("cf_dh_t2", "email", "a@b.com").value;
+  check("hmac-shake256 is 64 hex (SHAKE256/32)", keyedH.length === 64);
+  check("hmac-shake256 is deterministic",
+    keyedH === b.cryptoField.lookupHash("cf_dh_t2", "email", "a@b.com").value);
+  check("keyed hash differs from salted hash", keyedH !== saltedH);
+
+  // ---- per-column mode override on a salted-default table ----
+  b.cryptoField.registerTable("cf_dh_t3", {
+    sealedFields: ["ssn"],
+    derivedHashes: { ssnHash: { from: "ssn", mode: "hmac-shake256" } },
+  });
+  check("per-column hmac-shake256 override → 64 hex",
+    b.cryptoField.lookupHash("cf_dh_t3", "ssn", "x").value.length === 64);
+
+  // ---- MAC key surface: 32 bytes, per-deployment ----
+  var macKey = b.vault.getDerivedHashMacKey();
+  check("getDerivedHashMacKey is a 32-byte Buffer",
+    Buffer.isBuffer(macKey) && macKey.length === 32);
+
+  // A fresh deployment (new vault dir + MAC key) yields a different
+  // keyed hash for the same input — the keyed hash is bound to the MAC
+  // key, not just the input.
+  var dir2 = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-cf-dh2-"));
+  b.vault._resetForTest();
+  await b.vault.init({ mode: "plaintext", dataDir: dir2 });
+  b.cryptoField.registerTable("cf_dh_t2", {
+    sealedFields: ["email"],
+    derivedHashes: { emailHash: { from: "email" } },
+    derivedHashMode: "hmac-shake256",
+  });
+  var keyedH2 = b.cryptoField.lookupHash("cf_dh_t2", "email", "a@b.com").value;
+  check("new deployment MAC key → different keyed hash", keyedH2 !== keyedH);
+
+  // ---- input validation: unknown modes are rejected at registerTable ----
+  var badTableMode = false;
+  try { b.cryptoField.registerTable("cf_dh_bad", { derivedHashMode: "md5" }); }
+  catch (e) { badTableMode = /derivedHashMode must be/.test(e.message); }
+  check("bad derivedHashMode throws at registerTable", badTableMode);
+
+  var badColMode = false;
+  try {
+    b.cryptoField.registerTable("cf_dh_bad2", {
+      derivedHashes: { h: { from: "x", mode: "rot13" } },
+    });
+  } catch (e) { badColMode = /mode must be/.test(e.message); }
+  check("bad per-column mode throws at registerTable", badColMode);
+
+  console.log("OK — crypto-field derived-hash tests");
+}
+
+module.exports = { run: run };
+if (require.main === module) {
+  // Rethrow on failure so Node surfaces the error and exits non-zero,
+  // instead of logging the caught error object — a taint analyzer traces
+  // a logged error back to the test passphrase fixture (a non-secret
+  // constant) and raises a false clear-text-logging alert.
+  run().then(function () { process.exit(0); })
+       .catch(function (err) { process.exitCode = 1; throw err; });
+}

package/lib/vendor/blamejs/test/layer-0-primitives/db-column-gate.test.js

@@ -0,0 +1,150 @@
+"use strict";
+/**
+ * b.db column-membership gate + whereRaw string-literal refusal.
+ *
+ * Column gate: a Query may only reference columns the table declared in
+ * its schema. The default mode is "reject" (throw), so a typo'd or
+ * attacker-influenced column name fails closed rather than silently
+ * matching nothing (or, for a raw fragment, opening an injection path).
+ * Modes: reject (default) | warn (audit, allow) | off (no gate).
+ * .allowedColumns([...]) narrows further and is ALWAYS enforced.
+ *
+ * whereRaw / WhereBuilder.raw refuse an embedded string literal
+ * ('...') unless { allowLiterals: true } — every value must bind
+ * through the params array.
+ */
+
+var helpers = require("../helpers");
+var b     = helpers.b;
+var check = helpers.check;
+var fs   = helpers.fs;
+var os   = helpers.os;
+var path = helpers.path;
+
+var SCHEMA = [{
+  name: "things",
+  columns: {
+    _id:    "TEXT PRIMARY KEY",
+    name:   "TEXT",
+    status: "TEXT DEFAULT 'active'",
+  },
+  indexes: ["status"],
+}];
+
+async function initDb(tmpDir, columnGate) {
+  process.env.BLAMEJS_SKIP_NTP_CHECK = "1";
+  helpers.setTestPassphraseEnv();
+  b.cluster._resetForTest();
+  b.audit._resetForTest();
+  b.vault._resetForTest();
+  b.db._resetForTest();
+  await b.vault.init({ dataDir: tmpDir });
+  var opts = { dataDir: tmpDir, tmpDir: path.join(tmpDir, "tmpfs"), schema: SCHEMA };
+  if (columnGate !== undefined) opts.columnGate = columnGate;
+  await b.db.init(opts);
+}
+
+function threwMatching(fn, pattern) {
+  try { fn(); } catch (e) { return pattern.test(e.message) ? e : null; }
+  return null;
+}
+
+async function run() {
+  var tmp = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-colgate-"));
+
+  // ---- default mode is reject ----
+  await initDb(tmp);
+  b.db.from("things").insertOne({ _id: "t1", name: "a", status: "active" });
+
+  // declared columns pass
+  check("declared column where() passes",
+    b.db.from("things").where({ name: "a" }).first().status === "active");
+  check("declared column select() passes",
+    b.db.from("things").select(["name", "status"]).where({ _id: "t1" }).first().name === "a");
+
+  // undeclared column is rejected (fail-closed)
+  check("undeclared where() column rejected",
+    !!threwMatching(function () { b.db.from("things").where({ nope: 1 }); },
+      /not a declared column of 'things'/));
+  check("undeclared orderBy() column rejected",
+    !!threwMatching(function () { b.db.from("things").orderBy("bogus"); },
+      /not a declared column/));
+  check("undeclared select() column rejected",
+    !!threwMatching(function () { b.db.from("things").select(["ghost"]); },
+      /not a declared column/));
+
+  // ---- getDeclaredColumns ----
+  check("b.db.getDeclaredColumns is fn", typeof b.db.getDeclaredColumns === "function");
+  var declared = b.db.getDeclaredColumns("things");
+  check("getDeclaredColumns lists schema columns",
+    declared.indexOf("_id") !== -1 && declared.indexOf("name") !== -1 && declared.indexOf("status") !== -1);
+  check("getDeclaredColumns on unknown table → null",
+    b.db.getDeclaredColumns("no_such_table") === null);
+
+  // ---- allowedColumns() narrows + is always enforced ----
+  check("allowedColumns() allows a member",
+    b.db.from("things").allowedColumns(["name"]).where({ name: "a" }).first().name === "a");
+  check("allowedColumns() rejects a declared-but-not-allowed column",
+    !!threwMatching(function () {
+      b.db.from("things").allowedColumns(["name"]).where({ status: "active" });
+    }, /not in the allowedColumns\(\) set/));
+  check("allowedColumns([]) rejected (non-empty array required)",
+    !!threwMatching(function () { b.db.from("things").allowedColumns([]); },
+      /non-empty array/));
+
+  // ---- A5: whereRaw refuses embedded string literals ----
+  var litErr = threwMatching(function () { b.db.from("things").whereRaw("status = 'active'"); },
+    /string literal/);
+  check("whereRaw refuses embedded string literal", !!litErr);
+  check("whereRaw literal error code is sql/raw-literal", litErr && litErr.code === "sql/raw-literal");
+  check("whereRaw with bound params is accepted",
+    b.db.from("things").whereRaw("status = ?", ["active"]).first().name === "a");
+  check("whereRaw allowLiterals opt-in is accepted",
+    b.db.from("things").whereRaw("status = 'active'", [], { allowLiterals: true }).first().name === "a");
+
+  b.db.close();
+  fs.rmSync(tmp, { recursive: true, force: true });
+
+  // ---- warn mode: audited, not thrown ----
+  var tmp2 = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-colgate-warn-"));
+  await initDb(tmp2, "warn");
+  var warnThrew = false;
+  try { b.db.from("things").where({ nope: 1 }); } catch (_e) { warnThrew = true; }
+  check("warn mode does not throw on undeclared column", warnThrew === false);
+  b.db.close();
+  fs.rmSync(tmp2, { recursive: true, force: true });
+
+  // ---- off mode: no gate ----
+  var tmp3 = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-colgate-off-"));
+  await initDb(tmp3, "off");
+  var offThrew = false;
+  try { b.db.from("things").where({ nope: 1 }); } catch (_e) { offThrew = true; }
+  check("off mode does not gate undeclared column", offThrew === false);
+  b.db.close();
+  fs.rmSync(tmp3, { recursive: true, force: true });
+
+  // ---- bad columnGate value rejected at db.init ----
+  var tmp4 = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-colgate-bad-"));
+  var initThrew = false;
+  try { await initDb(tmp4, "loud"); } catch (e) { initThrew = /columnGate/.test(e.message); }
+  check("db.init rejects unknown columnGate mode", initThrew);
+  try { b.db.close(); } catch (_e) {}
+  fs.rmSync(tmp4, { recursive: true, force: true });
+
+  b.audit._resetForTest();
+  b.db._resetForTest();
+  b.vault._resetForTest();
+  b.cluster._resetForTest();
+
+  console.log("OK — db column-gate tests");
+}
+
+module.exports = { run: run };
+if (require.main === module) {
+  // Rethrow on failure so Node surfaces the error and exits non-zero,
+  // instead of logging the caught error object — a taint analyzer traces
+  // a logged error back to the test passphrase fixture (a non-secret
+  // constant) and raises a false clear-text-logging alert.
+  run().then(function () { process.exit(0); })
+       .catch(function (err) { process.exitCode = 1; throw err; });
+}