@blamejs/blamejs-shop 0.4.30 → 0.4.32

package/lib/vendor/blamejs/test/layer-0-primitives/azure-blob-key-encoding.test.js

@@ -0,0 +1,121 @@
+"use strict";
+/**
+ * azure-blob — blob key percent-encoding.
+ *
+ * Blob names are interpolated into the request URL path. A key with
+ * reserved characters (`?` / `#` / space) MUST be percent-encoded, or
+ * the `?` starts the query string / `#` starts the fragment (truncating
+ * the path → wrong object or container root) and spaces / control bytes
+ * corrupt the request line (CWE-20). `/` separators are preserved
+ * (blob names are hierarchical virtual directories). A null byte is
+ * refused. We assert the on-the-wire request line by recording the URL
+ * the production adapter actually sends to a mock HTTP server.
+ */
+var http = require("node:http");
+var helpers = require("../helpers");
+var check = helpers.check;
+var b = helpers.b;
+var azure = require("../../lib/object-store/azure-blob");
+
+function listenRecording() {
+  return new Promise(function (resolve) {
+    var requests = [];
+    var server = http.createServer(function (req, res) {
+      requests.push({ method: req.method, url: req.url });
+      res.statusCode = 200;
+      res.setHeader("etag", "\"mock-etag\"");
+      res.end();
+    });
+    server.listen(0, "127.0.0.1", function () {
+      resolve({
+        port:     server.address().port,
+        requests: requests,
+        close:    function () { return new Promise(function (r) { server.close(r); }); },
+      });
+    });
+  });
+}
+
+function _client(port) {
+  var key = Buffer.from("test-shared-key-32-bytes-padded__", "utf8").toString("base64");
+  return azure.create({
+    accountName:      "blamejstest",
+    accountKey:       key,
+    container:        "cont",
+    endpoint:         "http://127.0.0.1:" + port,
+    allowedProtocols: b.safeUrl.ALLOW_HTTP_ALL,
+    allowInternal:    true,
+    timeoutMs:        5000,
+  });
+}
+
+async function run() {
+  var srv = await listenRecording();
+  try {
+    var c = _client(srv.port);
+
+    // Each tuple: [rawKey, expectedRequestPath]. The mock records req.url
+    // (path + query). The container is "cont".
+    var cases = [
+      ["a b.txt",            "/cont/a%20b.txt"],
+      ["with?q.txt",         "/cont/with%3Fq.txt"],
+      ["with#h.txt",         "/cont/with%23h.txt"],
+      ["dir/sub dir/f.txt",  "/cont/dir/sub%20dir/f.txt"],
+      ["a+b&c.txt",          "/cont/a%2Bb%26c.txt"],
+      ["plain.txt",          "/cont/plain.txt"],
+    ];
+
+    for (var i = 0; i < cases.length; i++) {
+      var raw = cases[i][0];
+      var expected = cases[i][1];
+      srv.requests.length = 0;
+      await c.put(raw, Buffer.from("body", "utf8"), { contentType: "text/plain" });
+      var sent = srv.requests.length === 1 ? srv.requests[0].url : "(no request)";
+      check("put key " + JSON.stringify(raw) + " → encoded path " + JSON.stringify(expected),
+            sent === expected);
+    }
+
+    // get() must encode the same way (the path is what the server matches).
+    srv.requests.length = 0;
+    await c.get("with?q.txt");
+    check("get key with '?' uses the encoded path",
+          srv.requests.length === 1 && srv.requests[0].url === "/cont/with%3Fq.txt");
+
+    // A reserved char must NOT leak into the query string — the `?` is
+    // encoded, so the recorded URL has no real query separator.
+    srv.requests.length = 0;
+    await c.head("q?inject=1.txt");
+    check("reserved '?' does not start a query string",
+          srv.requests.length === 1 &&
+          srv.requests[0].url === "/cont/q%3Finject%3D1.txt" &&
+          srv.requests[0].url.indexOf("?") === -1);
+
+    // Null byte refused (CWE-20 hostile key) before any request.
+    srv.requests.length = 0;
+    var threwNull = false;
+    try { await c.put("bad" + String.fromCharCode(0) + "key.txt", Buffer.from("x", "utf8")); }
+    catch (e) { threwNull = e && e.code === "INVALID_KEY"; }
+    check("null-byte key refused with INVALID_KEY", threwNull);
+    check("null-byte key sends no request", srv.requests.length === 0);
+
+    // Presigned URL encodes the key in the PATH while the SAS signature
+    // is computed over the raw resource — the returned URL must carry the
+    // encoded path AND the SAS query params.
+    var pre = c.presignedDownloadUrl({ key: "a b?c.txt", expiresIn: 300 });
+    check("presigned URL encodes the key path",
+          pre.url.indexOf("/cont/a%20b%3Fc.txt") !== -1);
+    check("presigned URL still carries the SAS signature",
+          pre.url.indexOf("sig=") !== -1 && pre.url.indexOf("se=") !== -1);
+  } finally {
+    await srv.close();
+  }
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  run().then(
+    function () { console.log("OK — " + helpers.getChecks() + " checks passed"); },
+    function (e) { console.error("FAIL:", e.stack || e); process.exit(1); }
+  );
+}

package/lib/vendor/blamejs/test/layer-0-primitives/backup-residency-posture.test.js

@@ -0,0 +1,168 @@
+"use strict";
+/**
+ * b.backup.create — residency posture enforcement.
+ *
+ * The backup-create residency gate (lib/backup/index.js) is advertised to
+ * refuse a cross-border destination under a regulated posture, advise on an
+ * undeclared destination, and (the real bug) is blind to per-row residency
+ * tags: a deployment whose region is EU but which holds per-row us-east-1
+ * rows backs up to an EU destination with no warning about the US rows.
+ */
+
+var helpers = require("../helpers");
+var b     = helpers.b;
+var check = helpers.check;
+var fs   = helpers.fs;
+var os   = helpers.os;
+var path = helpers.path;
+
+// Capture audit.safeEmit events by call-through wrapping (same spy shape the
+// erase-posture-vacuum test uses for vacuumAfterErase). The backup gate emits
+// via b.audit.safeEmit, so wrapping it records the advisory.
+function captureAudit() {
+  var events = [];
+  var real = b.audit.safeEmit;
+  b.audit.safeEmit = function (ev) {
+    try { events.push(ev); } catch (_e) { /* ignore */ }
+    return real.call(b.audit, ev);
+  };
+  return { events: events, restore: function () { b.audit.safeEmit = real; } };
+}
+
+async function initDbWithRegion(tmpDir, region) {
+  process.env.BLAMEJS_SKIP_NTP_CHECK = "1";
+  helpers.setTestPassphraseEnv();
+  b.cluster._resetForTest();
+  b.audit._resetForTest();
+  b.vault._resetForTest();
+  b.db._resetForTest();
+  await b.vault.init({ dataDir: tmpDir });
+  await b.db.init({
+    dataDir:       tmpDir,
+    tmpDir:        path.join(tmpDir, "tmpfs"),
+    dataResidency: { region: region, allowedStorageRegions: ["us-east-1", "global"] },
+    schema: [{
+      name: "residents",
+      columns: { _id: "TEXT PRIMARY KEY", name: "TEXT", dataRegion: "TEXT" },
+    }],
+  });
+}
+
+// Minimal valid backup opts that reach the residency block in create()
+// (dataDir exists, storage/passphrase/files/vaultKeyJson present).
+function backupOpts(dataDir, root, extra) {
+  fs.writeFileSync(path.join(dataDir, "db.enc"), Buffer.from([1, 2, 3]));
+  fs.writeFileSync(path.join(dataDir, "db.key.enc"), Buffer.from([4, 5, 6]));
+  var opts = {
+    dataDir:      dataDir,
+    storage:      b.backup.diskStorage({ root: root }),
+    passphrase:   Buffer.from("operator-backup-passphrase-not-secret"),
+    files: [
+      { relativePath: "db.enc",     kind: "raw", required: true },
+      { relativePath: "db.key.enc", kind: "raw", required: true },
+    ],
+    vaultKeyJson: '{"version":1,"kid":"k1"}',
+  };
+  if (extra) for (var k in extra) opts[k] = extra[k];
+  return opts;
+}
+
+function createCode(opts) {
+  try { b.backup.create(opts); } catch (e) { return e && e.code; }
+  return null;
+}
+
+async function run() {
+  var tmp  = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-backupresid-"));
+  var data = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-backupresid-data-"));
+  var root = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-backupresid-root-"));
+  await initDbWithRegion(tmp, "eu-west-1");
+  b.compliance.clear();
+  b.compliance.set("gdpr");
+  try {
+    // ---- Case 1: MISMATCH-REFUSAL (advertised, never tested to throw) ----
+    check("gdpr + eu-west-1 db + us-east-1 destination → backup/residency-mismatch",
+          createCode(backupOpts(data, root, { residencyTag: "us-east-1" })) ===
+          "backup/residency-mismatch");
+    // The allowCrossBorder override path must SUCCEED.
+    var okOverride = null;
+    try {
+      okOverride = b.backup.create(backupOpts(data, root, {
+        residencyTag: "us-east-1", allowCrossBorder: true,
+        legalBasis: "EU SCCs 2021/914",
+      }));
+    } catch (_e) { okOverride = null; }
+    check("allowCrossBorder + legalBasis override creates the engine",
+          okOverride && typeof okOverride.run === "function");
+
+    // ---- Case 2: UNDECLARED-ADVISORY (advertised, never tested to emit) ----
+    var cap = captureAudit();
+    try {
+      var engNoTag = b.backup.create(backupOpts(data, root, {}));   // no residencyTag
+      check("undeclared residencyTag does NOT throw (advisory, not refusal)",
+            engNoTag && typeof engNoTag.run === "function");
+    } finally { cap.restore(); }
+    check("undeclared residency under gdpr emits backup.residency_undeclared advisory",
+          cap.events.some(function (e) { return e && e.action === "backup.residency_undeclared"; }));
+
+    // ---- Case 3: PER-ROW BLINDNESS (the real bug — RED today) ----
+    // The deployment region is eu-west-1, but a per-row residency-tagged
+    // table admits a us-east-1 row (us-east-1 is in allowedStorageRegions).
+    // Backing up to an eu-west-1 destination must warn/refuse about the US
+    // rows — today it passes silently because the gate only sees the
+    // deployment-level region (eu-west-1 == residencyTag eu-west-1 → clean).
+    b.cryptoField.clearResidencyForTest();
+    b.cryptoField.declarePerRowResidency("residents", {
+      residencyColumn: "dataRegion",
+      allowedTags:     ["eu-west-1", "us-east-1", "global"],
+    });
+    // The backup advisory reads its table set from this enumerator — assert it
+    // directly so the deployment-wide view the gate depends on is covered.
+    var declared = b.cryptoField.listPerRowResidency();
+    check("listPerRowResidency enumerates the declared table",
+          declared.length === 1 && declared[0].table === "residents" &&
+          declared[0].residencyColumn === "dataRegion" &&
+          declared[0].allowedTags.indexOf("us-east-1") !== -1);
+    b.db.from("residents").insertOne({ _id: "row-us", name: "u", dataRegion: "us-east-1" });
+    b.db.from("residents").insertOne({ _id: "row-eu", name: "e", dataRegion: "eu-west-1" });
+
+    var cap2 = captureAudit();
+    var sawPerRowAdvisory = false;
+    var threwPerRow = null;
+    try {
+      b.backup.create(backupOpts(data, root, { residencyTag: "eu-west-1" }));
+    } catch (e) { threwPerRow = e; }
+    finally {
+      sawPerRowAdvisory = cap2.events.some(function (e) {
+        return e && typeof e.action === "string" &&
+          /backup\.residency/.test(e.action) &&
+          e.metadata && (e.metadata.scope === "per-row" ||
+            /per[-_]?row|row[-_]?tag/.test(JSON.stringify(e.metadata)));
+      });
+      cap2.restore();
+    }
+    // RED: the US rows must be surfaced — either a per-row cross-border
+    // advisory is emitted, or create() refuses. Today neither happens.
+    check("per-row us-east-1 rows under an EU destination trigger a cross-border advisory or refusal",
+          sawPerRowAdvisory === true ||
+          (threwPerRow && threwPerRow.code === "backup/residency-mismatch"));
+  } finally {
+    b.cryptoField.clearResidencyForTest();
+    b.compliance.clear();
+    try { b.db.close(); } catch (_e) {}
+    b.audit._resetForTest();
+    b.db._resetForTest();
+    b.vault._resetForTest();
+    b.cluster._resetForTest();
+    fs.rmSync(tmp,  { recursive: true, force: true });
+    fs.rmSync(data, { recursive: true, force: true });
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+  console.log("OK — backup residency posture tests");
+}
+
+module.exports = { run: run };
+if (require.main === module) {
+  run().then(function () { process.exit(0); })
+       .catch(function (err) { process.exitCode = 1; throw err; });
+}

package/lib/vendor/blamejs/test/layer-0-primitives/backup-scheduletest-drill.test.js

@@ -0,0 +1,318 @@
+"use strict";
+/**
+ * b.backup.scheduleTest — HIPAA §164.308(a)(7)(ii)(D) restore-drill.
+ *
+ * The drill is the regulator-facing proof that a backup is RESTORABLE,
+ * not merely that bytes landed in storage. The framework advertises that
+ * scheduleTest:
+ *   (1) restores the latest bundle into an operator staging dir,
+ *   (2) verifies the bundle manifest's SLH-DSA / ML-DSA signature,
+ *   (3) hands the restored bundle + parsed manifest to the operator
+ *       verify callback, and
+ *   (4) records a pass/fail result in the signed audit chain
+ *       (backup.test.passed / backup.test.failed).
+ *
+ * This drives the real drill end-to-end against a real sealed-at-rest
+ * data dir + signed audit chain + local diskStorage backend, then drives
+ * a FAILING drill (tampered manifest signature) and asserts it reports
+ * failure rather than a false pass.
+ *
+ * Two dispatch paths are exercised:
+ *   - the closure scheduleTest builds (captured + awaited directly so we
+ *     observe completion deterministically), and
+ *   - the genuine b.scheduler dispatch (instance._fireOnce → drill runs).
+ */
+
+var fs   = require("fs");
+var os   = require("os");
+var path = require("path");
+
+var helpers = require("../helpers");
+var check   = helpers.check;
+var b       = helpers.b;
+var waitUntil = helpers.waitUntil;
+var { setupTestDb, teardownTestDb } = require("../helpers/db");
+
+// audit_log stores metadata as a JSON string column; query() returns it
+// as-is. Parse it for field assertions.
+function _meta(row) {
+  if (row && typeof row.metadata === "string") {
+    try { return JSON.parse(row.metadata); } catch (_e) { return {}; }
+  }
+  return (row && row.metadata) || {};
+}
+
+// A scheduler stand-in whose create() returns a fake whose schedule()
+// captures the spec.run closure. This lets us AWAIT the exact drill
+// closure scheduleTest registers (the full restore+verify+audit body)
+// to completion — the real scheduler's fire path is fire-and-forget.
+function _makeCapturingScheduler() {
+  var captured = { specs: [] };
+  return {
+    captured: captured,
+    create: function () {
+      return {
+        schedule: function (spec) {
+          captured.specs.push(spec);
+          return spec;
+        },
+        start: function () {},
+        stop:  function () {},
+      };
+    },
+  };
+}
+
+function _seedSealedDataDir() {
+  // Real bytes resembling the framework's encrypted-at-rest layout —
+  // an opaque db envelope + the sealed DEK. The drill restores + the
+  // operator verify hook confirms the restored bytes round-trip.
+  var dataDir = fs.mkdtempSync(path.join(os.tmpdir(), "drill-data-"));
+  var dbEnc  = Buffer.from("ENVELOPE-" + b.crypto.generateToken(48), "utf8");
+  var keyEnc = Buffer.from("SEALED-DEK-" + b.crypto.generateToken(32), "utf8");
+  fs.writeFileSync(path.join(dataDir, "db.enc"), dbEnc);
+  fs.writeFileSync(path.join(dataDir, "db.key.enc"), keyEnc);
+  return { dataDir: dataDir, dbEnc: dbEnc, keyEnc: keyEnc };
+}
+
+async function main() {
+  var tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "drill-fw-"));
+  await setupTestDb(tmpDir);
+
+  var seeded = _seedSealedDataDir();
+  var storageRoot = fs.mkdtempSync(path.join(os.tmpdir(), "drill-store-"));
+  var restoreRoot = fs.mkdtempSync(path.join(os.tmpdir(), "drill-restore-"));
+
+  var storage = b.backup.diskStorage({ root: storageRoot });
+  var capSched = _makeCapturingScheduler();
+
+  var engine = b.backup.create({
+    dataDir:    seeded.dataDir,
+    storage:    storage,
+    passphrase: Buffer.from("operator-backup-passphrase-256bit-entropy-here"),
+    files: [
+      { relativePath: "db.enc",     kind: "raw", required: true },
+      { relativePath: "db.key.enc", kind: "raw", required: true },
+    ],
+    vaultKeyJson: '{"version":1,"kid":"k1"}',
+    scheduler:    capSched,
+  });
+
+  // ---- Produce a real, signed backup bundle --------------------------
+  var runSummary = await engine.run({ metadata: { reason: "drill-fixture" } });
+  check("backup.run produced a bundle id", typeof runSummary.bundleId === "string" && runSummary.bundleId.length > 0);
+  var bundles = await engine.list();
+  check("one bundle is in storage after run", bundles.length === 1);
+
+  // Sanity: the stored bundle's manifest is genuinely signed (the drill's
+  // signature-verify step is only meaningful if there is a signature).
+  var storedBundleId = bundles[0].bundleId;
+  var manifestOnDisk = JSON.parse(
+    fs.readFileSync(path.join(storageRoot, storedBundleId, "manifest.json"), "utf8"));
+  check("stored manifest carries a signature block",
+    manifestOnDisk.signature && typeof manifestOnDisk.signature.value === "string" &&
+    manifestOnDisk.signature.value.length > 0);
+  var signedFingerprint = manifestOnDisk.signature.fingerprint;
+
+  // =====================================================================
+  // PART 1 — PASSING DRILL via the captured closure (awaited to done)
+  // =====================================================================
+  var verifyCall = null;
+  var notifyCalls = [];
+  var schedResult = engine.scheduleTest({
+    cron:      "0 3 * * 0",
+    restoreTo: restoreRoot,
+    posture:   "hipaa",
+    verify: async function (ctx) {
+      // Operator-side verification: confirm the restored payload matches
+      // the original sealed bytes AND the framework handed us a parsed,
+      // signature-verified manifest + the outDir it restored into.
+      verifyCall = {
+        outDir:          ctx.outDir,
+        bundleId:        ctx.bundleId,
+        sigFingerprint:  ctx.sigFingerprint,
+        manifestVersion: ctx.manifest && ctx.manifest.version,
+        dbEncMatch:      false,
+        keyEncMatch:     false,
+        outDirExists:    fs.existsSync(ctx.outDir),
+      };
+      // The bundle stores ENCRYPTED file bytes under files/; decrypt-on-
+      // restore is the backup-crypto layer's job and is exercised by the
+      // bundle tests. Here the drill's contract is "restored bundle is
+      // present + manifest verifies"; the operator hook proves the bundle
+      // dir + manifest are real by reading back the manifest's file list
+      // and confirming the encrypted blobs exist on disk.
+      var allBlobsPresent = ctx.manifest.files.every(function (f) {
+        return fs.existsSync(path.join(ctx.outDir, f.encryptedPath));
+      });
+      verifyCall.allBlobsPresent = allBlobsPresent;
+      // Confirm the manifest describes the two files we backed up.
+      var rels = ctx.manifest.files.map(function (f) { return f.relativePath; }).sort();
+      verifyCall.dbEncMatch  = rels.indexOf("db.enc") !== -1;
+      verifyCall.keyEncMatch = rels.indexOf("db.key.enc") !== -1;
+      return true;
+    },
+    notify: async function (info) { notifyCalls.push(info); },
+  });
+
+  check("scheduleTest returned an instance handle",
+    schedResult && typeof schedResult.name === "string" && schedResult.instance);
+  check("scheduleTest registered exactly one scheduler task",
+    capSched.captured.specs.length === 1);
+  var drillSpec = capSched.captured.specs[0];
+  check("the registered task carries the operator cron",
+    drillSpec.cron === "0 3 * * 0");
+  check("the registered task carries an async run closure",
+    typeof drillSpec.run === "function");
+
+  // Fire the real drill closure and await it to completion.
+  await drillSpec.run();
+
+  check("(1) drill restored the bundle into a staging dir under restoreTo",
+    verifyCall !== null && verifyCall.outDirExists === true &&
+    verifyCall.outDir.indexOf(restoreRoot) === 0);
+  check("(1b) restored staging dir carried the encrypted file blobs",
+    verifyCall.allBlobsPresent === true);
+  check("(2) drill verified the manifest signature before calling verify (fingerprint passed through)",
+    verifyCall.sigFingerprint === signedFingerprint &&
+    typeof verifyCall.sigFingerprint === "string" && verifyCall.sigFingerprint.length > 0);
+  check("(3) drill handed the operator a parsed manifest covering the backed-up files",
+    verifyCall.manifestVersion === 1 && verifyCall.dbEncMatch && verifyCall.keyEncMatch);
+  check("(3b) drill targeted the newest stored bundle",
+    verifyCall.bundleId === storedBundleId);
+
+  // (4) pass/fail recorded in the signed audit chain.
+  await b.audit.flush();
+  var passRows = await b.audit.query({ action: "backup.test.passed" });
+  check("(4) drill emitted exactly one backup.test.passed audit row", passRows.length === 1);
+  var passMeta = _meta(passRows[0]);
+  check("(4b) passed row records the bundle id + posture + fingerprint",
+    passMeta.bundleId === storedBundleId &&
+    passMeta.posture === "hipaa" &&
+    passMeta.fingerprint === signedFingerprint);
+  check("(4c) passed row outcome is success", passRows[0].outcome === "success");
+
+  check("notify hook fired with success outcome on a passing drill",
+    notifyCalls.length === 1 && notifyCalls[0].outcome === "success" &&
+    notifyCalls[0].bundleId === storedBundleId);
+
+  // The drill cleans staging by default — confirm it didn't leave the
+  // restore dir behind (regulator drills must not accumulate plaintext-
+  // restored bundles).
+  check("drill cleaned its staging dir after a passing run",
+    !fs.existsSync(verifyCall.outDir));
+
+  // =====================================================================
+  // PART 2 — PASSING DRILL via the GENUINE scheduler dispatch path
+  // =====================================================================
+  // Re-run the drill through a real b.scheduler instance + its _fireOnce
+  // test hook so the genuine schedule()/fire path is exercised, not just
+  // the captured closure.
+  b.scheduler._resetForTest && b.scheduler._resetForTest();
+  var realVerifyHit = false;
+  var realEngine = b.backup.create({
+    dataDir:    seeded.dataDir,
+    storage:    storage,
+    passphrase: Buffer.from("operator-backup-passphrase-256bit-entropy-here"),
+    files: [
+      { relativePath: "db.enc",     kind: "raw", required: true },
+      { relativePath: "db.key.enc", kind: "raw", required: true },
+    ],
+    vaultKeyJson: '{"version":1,"kid":"k1"}',
+    scheduler:    b.scheduler,
+  });
+  var realDrill = realEngine.scheduleTest({
+    name:      "drill.real.path",
+    cron:      "0 4 * * 0",
+    restoreTo: restoreRoot,
+    posture:   "hipaa",
+    verify: async function (ctx) {
+      realVerifyHit = ctx && typeof ctx.outDir === "string" &&
+        ctx.sigFingerprint === signedFingerprint;
+      return true;
+    },
+  });
+  // Fire via the real scheduler dispatch. _fireOnce is fire-and-forget;
+  // wait for the drill's audit row to appear.
+  realDrill.instance._fireOnce("drill.real.path");
+  await waitUntil(async function () {
+    await b.audit.flush();
+    var rows = await b.audit.query({ action: "backup.test.passed" });
+    return rows.length >= 2;
+  }, { timeoutMs: 5000, label: "real-scheduler drill: backup.test.passed lands" });
+  check("genuine scheduler dispatch ran the drill verify hook", realVerifyHit === true);
+
+  // =====================================================================
+  // PART 3 — FAILING DRILL: tamper the stored bundle's manifest signature
+  // =====================================================================
+  // Flip a byte in the signature value of the stored manifest so the
+  // signature no longer verifies. The drill MUST report failure — not a
+  // false pass — and MUST NOT call the operator verify hook (verification
+  // gates the hand-off).
+  var manifestPath = path.join(storageRoot, storedBundleId, "manifest.json");
+  var tampered = JSON.parse(fs.readFileSync(manifestPath, "utf8"));
+  var sigBuf = Buffer.from(tampered.signature.value, "base64");
+  sigBuf[0] = sigBuf[0] ^ 0xff;           // corrupt the first signature byte
+  tampered.signature.value = sigBuf.toString("base64");
+  fs.writeFileSync(manifestPath, JSON.stringify(tampered, null, 2) + "\n");
+
+  var failVerifyCalled = false;
+  var failNotify = [];
+  var capSched2 = _makeCapturingScheduler();
+  var failEngine = b.backup.create({
+    dataDir:    seeded.dataDir,
+    storage:    storage,
+    passphrase: Buffer.from("operator-backup-passphrase-256bit-entropy-here"),
+    files: [
+      { relativePath: "db.enc",     kind: "raw", required: true },
+      { relativePath: "db.key.enc", kind: "raw", required: true },
+    ],
+    vaultKeyJson: '{"version":1,"kid":"k1"}',
+    scheduler:    capSched2,
+  });
+  failEngine.scheduleTest({
+    cron:      "0 5 * * 0",
+    restoreTo: restoreRoot,
+    posture:   "hipaa",
+    verify: async function () { failVerifyCalled = true; return true; },
+    notify: async function (info) { failNotify.push(info); },
+  });
+  await capSched2.captured.specs[0].run();
+
+  check("tampered-signature drill did NOT call the operator verify hook (verify gates hand-off)",
+    failVerifyCalled === false);
+
+  await b.audit.flush();
+  var failRows = await b.audit.query({ action: "backup.test.failed" });
+  check("failing drill emitted a backup.test.failed audit row (no false pass)",
+    failRows.length === 1);
+  check("failed row outcome is failure", failRows[0].outcome === "failure");
+  var failMeta = _meta(failRows[0]);
+  check("failed row reason names the signature failure",
+    typeof failMeta.reason === "string" && /signature/i.test(failMeta.reason));
+
+  // Critically: the passing-row count must NOT have grown — a tampered
+  // bundle must never be recorded as a passed drill.
+  var passRowsAfterTamper = await b.audit.query({ action: "backup.test.passed" });
+  check("tampering did not produce an additional backup.test.passed row",
+    passRowsAfterTamper.length === 2);
+
+  check("notify hook fired with failure outcome on the tampered drill",
+    failNotify.length === 1 && failNotify[0].outcome === "failure" &&
+    /signature/i.test(failNotify[0].reason || ""));
+
+  // ---- cleanup -------------------------------------------------------
+  await teardownTestDb(tmpDir);
+  try { fs.rmSync(seeded.dataDir, { recursive: true, force: true }); } catch (_e) {}
+  try { fs.rmSync(storageRoot, { recursive: true, force: true }); } catch (_e) {}
+  try { fs.rmSync(restoreRoot, { recursive: true, force: true }); } catch (_e) {}
+
+  // check() throws on the first failed assertion, so reaching here means
+  // every assertion passed.
+  console.log("backup-scheduletest-drill: OK — " + helpers.getChecks() + " checks passed");
+}
+
+main().catch(function (e) {
+  console.error("FAIL: backup-scheduletest-drill threw:", e && e.stack || e);
+  process.exitCode = 1;
+});