@blamejs/blamejs-shop 0.4.30 → 0.4.32

package/lib/vendor/blamejs/test/layer-0-primitives/db-column-gate.test.js

@@ -29,9 +29,20 @@ var SCHEMA = [{
     status: "TEXT DEFAULT 'active'",
   },
   indexes: ["status"],
+}, {
+  // Residency-gate fixture table — `dataRegion` carries the per-row
+  // residency tag (plaintext, inspected before sealRow); `addr` is a
+  // region-bound column for the per-column gate.
+  name: "residents",
+  columns: {
+    _id:        "TEXT PRIMARY KEY",
+    name:       "TEXT",
+    dataRegion: "TEXT",
+    addr:       "TEXT",
+  },
 }];
 
-async function initDb(tmpDir, columnGate) {
+async function initDb(tmpDir, columnGate, dataResidency) {
   process.env.BLAMEJS_SKIP_NTP_CHECK = "1";
   helpers.setTestPassphraseEnv();
   b.cluster._resetForTest();
@@ -41,6 +52,7 @@ async function initDb(tmpDir, columnGate) {
   await b.vault.init({ dataDir: tmpDir });
   var opts = { dataDir: tmpDir, tmpDir: path.join(tmpDir, "tmpfs"), schema: SCHEMA };
   if (columnGate !== undefined) opts.columnGate = columnGate;
+  if (dataResidency !== undefined) opts.dataResidency = dataResidency;
   await b.db.init(opts);
 }
 
@@ -136,9 +148,176 @@ async function run() {
   b.vault._resetForTest();
   b.cluster._resetForTest();
 
+  // ---- per-row + per-column residency write gates via db.from(...) ----
+  await runRowResidencyGate();
+  await runColumnResidencyGate();
+  await runRowResidencyRegionGate();
+
   console.log("OK — db column-gate tests");
 }
 
+// Local per-row residency gate driven through db.from(table).insertOne /
+// .updateOne. The fixture's db has NO dataResidency region configured,
+// so the local-mismatch refusal can't fire here (the gate passes when no
+// region is set) — this covers the missing-tag / invalid-tag refusals,
+// the valid-tag success path (row written + readable back), and the
+// update matrix. Region-mismatch lives in runRowResidencyRegionGate.
+async function runRowResidencyGate() {
+  var tmp = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-rowresid-"));
+  await initDb(tmp);
+  b.cryptoField.clearResidencyForTest();
+  try {
+    b.cryptoField.declarePerRowResidency("residents", {
+      residencyColumn: "dataRegion",
+      allowedTags:     ["eu-west-1", "us-east-1", "global"],
+    });
+
+    // INSERT without the tag column → refused.
+    check("insert without residency tag refused",
+          insertCode("residents", { _id: "r-miss", name: "x" }) ===
+          "db-query/row-residency-tag-missing");
+
+    // INSERT with a tag outside allowedTags → refused.
+    check("insert with tag not in allowedTags refused",
+          insertCode("residents", { _id: "r-bad", name: "x", dataRegion: "ap-south-1" }) ===
+          "db-query/row-residency-tag-invalid");
+
+    // INSERT with a valid tag → row written AND readable back.
+    var ins = b.db.from("residents").insertOne({
+      _id: "r-ok", name: "alice", dataRegion: "eu-west-1",
+    });
+    check("insert with valid residency tag returns the row",
+          ins && ins._id === "r-ok" && ins.dataRegion === "eu-west-1");
+    var readBack = b.db.from("residents").where({ _id: "r-ok" }).first();
+    check("valid-tag row is readable back after insert",
+          readBack && readBack.name === "alice" && readBack.dataRegion === "eu-west-1");
+
+    // UPDATE that does NOT touch the residency column on a declared
+    // table → passes (not a transfer).
+    var updNonResidency = b.db.from("residents").where({ _id: "r-ok" }).updateOne({ name: "alice-2" });
+    check("update not touching residency column passes", updNonResidency === true);
+    check("non-residency update persisted",
+          b.db.from("residents").where({ _id: "r-ok" }).first().name === "alice-2");
+
+    // UPDATE that sets an out-of-allowlist tag → refused.
+    check("update to out-of-allowlist residency tag refused",
+          updateCode("residents", { _id: "r-ok" }, { dataRegion: "ap-south-1" }) ===
+          "db-query/row-residency-tag-invalid");
+
+    // UPDATE that explicitly NULLs the residency column → refused (the
+    // row must not be nullable into an untagged state — INSERT requires
+    // a tag, UPDATE must not clear it).
+    check("update clearing residency column to null refused",
+          updateCode("residents", { _id: "r-ok" }, { dataRegion: null }) ===
+          "db-query/row-residency-tag-missing");
+    check("residency tag intact after the refused null-update",
+          b.db.from("residents").where({ _id: "r-ok" }).first().dataRegion === "eu-west-1");
+  } finally {
+    b.cryptoField.clearResidencyForTest();
+    b.compliance.clear();
+    b.db.close();
+    fs.rmSync(tmp, { recursive: true, force: true });
+    b.audit._resetForTest();
+    b.db._resetForTest();
+    b.vault._resetForTest();
+    b.cluster._resetForTest();
+  }
+}
+
+// Per-column residency gate wiring through db.from(...).insertOne. The
+// fixture's db has a dataResidency region ("eu-west-1"); a column bound
+// to a different region ("us-east-1") refuses under a cross-border
+// regulated posture (gdpr) and passes (advisory) without a posture.
+async function runColumnResidencyGate() {
+  var tmp = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-colresid-"));
+  await initDb(tmp, undefined, { region: "eu-west-1" });
+  b.cryptoField.clearResidencyForTest();
+  try {
+    b.cryptoField.declareColumnResidency("residents", {
+      columnResidency: { addr: "us-east-1" },
+    });
+
+    // Without a posture → write passes (advisory only).
+    var insAdvisory = b.db.from("residents").insertOne({
+      _id: "c-advisory", name: "noposture", addr: "10 Main St",
+    });
+    check("column-residency mismatch without posture passes (advisory)",
+          insAdvisory && insAdvisory._id === "c-advisory");
+
+    // Under gdpr → mismatched column refused.
+    b.compliance.set("gdpr");
+    check("column-residency mismatch under gdpr refused",
+          insertCode("residents", { _id: "c-gdpr", name: "y", addr: "20 Main St" }) ===
+          "db-query/column-residency-mismatch");
+  } finally {
+    b.compliance.clear();
+    b.cryptoField.clearResidencyForTest();
+    b.db.close();
+    fs.rmSync(tmp, { recursive: true, force: true });
+    b.audit._resetForTest();
+    b.db._resetForTest();
+    b.vault._resetForTest();
+    b.cluster._resetForTest();
+  }
+}
+
+// Per-row residency region gate — the fixture supports a custom
+// dataResidency region, so this drives the cross-border local-mismatch
+// refusal: under gdpr a tag in allowedTags but OUTSIDE the deployment's
+// region set is refused; a tag inside the region set or "global" passes.
+async function runRowResidencyRegionGate() {
+  var tmp = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-rowresid-region-"));
+  await initDb(tmp, undefined, { region: "eu-west-1" });
+  b.cryptoField.clearResidencyForTest();
+  try {
+    b.cryptoField.declarePerRowResidency("residents", {
+      residencyColumn: "dataRegion",
+      allowedTags:     ["eu-west-1", "us-east-1", "global"],
+    });
+    b.compliance.set("gdpr");
+
+    // Tag in allowedTags but outside the deployment region → refused.
+    check("row tag outside deployment region under gdpr refused",
+          insertCode("residents", { _id: "rr-us", name: "u", dataRegion: "us-east-1" }) ===
+          "db-query/row-residency-local-mismatch");
+
+    // Tag matching the deployment region → passes.
+    var insEu = b.db.from("residents").insertOne({
+      _id: "rr-eu", name: "e", dataRegion: "eu-west-1",
+    });
+    check("row tag matching deployment region passes",
+          insEu && insEu._id === "rr-eu");
+
+    // "global" tag → passes any region.
+    var insGlobal = b.db.from("residents").insertOne({
+      _id: "rr-global", name: "g", dataRegion: "global",
+    });
+    check("row tag 'global' passes any region", insGlobal && insGlobal._id === "rr-global");
+  } finally {
+    b.compliance.clear();
+    b.cryptoField.clearResidencyForTest();
+    b.db.close();
+    fs.rmSync(tmp, { recursive: true, force: true });
+    b.audit._resetForTest();
+    b.db._resetForTest();
+    b.vault._resetForTest();
+    b.cluster._resetForTest();
+  }
+}
+
+// insertCode / updateCode — return the thrown error's .code when the
+// write refuses, else null. Compose the same chainable surface the gate
+// runs under, so the refusal is exercised end-to-end (not a unit call).
+function insertCode(table, row) {
+  try { b.db.from(table).insertOne(row); } catch (e) { return e && e.code; }
+  return null;
+}
+
+function updateCode(table, whereObj, changes) {
+  try { b.db.from(table).where(whereObj).updateOne(changes); } catch (e) { return e && e.code; }
+  return null;
+}
+
 module.exports = { run: run };
 if (require.main === module) {
   // Rethrow on failure so Node surfaces the error and exits non-zero,

package/lib/vendor/blamejs/test/layer-0-primitives/db-query-cross-schema.test.js

@@ -87,7 +87,8 @@ async function testSchemaQualifiedSelectShape() {
   new dbQuery.Query(db, "audit.events").where({ recordedAt: 1 }).count();
   check("count() emits COUNT(*) FROM \"audit\".\"events\"",
         db.prepared.some(function (s) {
-          return /SELECT COUNT\(\*\) AS n FROM "audit"\."events"/.test(s);
+          // b.sql quotes the aggregate alias by construction: AS "n".
+          return /SELECT COUNT\(\*\) AS "n" FROM "audit"\."events"/.test(s);
         }));
 }
 
@@ -109,7 +110,9 @@ async function testSchemaQualifiedInsertUpdateDelete() {
         }));
   check("updateOne sub-select uses qualified name",
         db.prepared.some(function (s) {
-          return /SELECT rowid FROM "audit"\."events"/.test(s);
+          // b.sql quotes the rowid pseudo-column by construction; the
+          // single-row idiom is "rowid" = (SELECT "rowid" FROM ...).
+          return /SELECT "rowid" FROM "audit"\."events"/.test(s);
         }));
 
   db.prepared.length = 0;

package/lib/vendor/blamejs/test/layer-0-primitives/db-query-sealed-field-in.test.js

@@ -0,0 +1,101 @@
+"use strict";
+// #141: a membership query on a SEALED column must work. db-query's sealed
+// field → derived-hash rewrite handled "=" (single value → keyed hash, with a
+// dual-read of the legacy digest across the v0.15.0 keyed-MAC flip) and "!=",
+// but for "IN" it passed the WHOLE candidate array to cryptoField.lookupHash
+// as if it were one plaintext — producing a single bogus hash, which the
+// later array-shape check then rejected with "where IN requires a non-empty
+// array". So b.db.from().whereIn("email", [...]) and
+// b.db.collection().find({ email: { $in: [...] } }) on a sealed column were
+// unusable: the documented derived-hash query path supported equality but not
+// membership. The fix maps EACH array element through lookupHash and builds
+// the combined IN-list (including each element's legacy digest for dual-read).
+//
+// RED on the buggy tree: whereIn / $in on a sealed field throws. GREEN after
+// the fix: both consumer paths return the matching rows, including legacy-
+// digested (un-migrated) rows.
+
+var helpers = require("../helpers");
+var b     = helpers.b;
+var check = helpers.check;
+var fs   = require("fs");
+var os   = require("os");
+var path = require("path");
+var { setupTestDb, teardownTestDb } = require("../helpers/db");
+
+function _insertSealed(id, email, name) {
+  var sealed = b.cryptoField.sealRow("users", { _id: id, email: email, name: name });
+  b.db.prepare(
+    'INSERT INTO "users" ("_id","email","emailHash","name") VALUES (?,?,?,?)'
+  ).run(sealed._id, sealed.email, sealed.emailHash, sealed.name);
+  return sealed;
+}
+
+async function run() {
+  var dir = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-sealed-in-"));
+  try {
+    await setupTestDb(dir);
+
+    var alice = "alice@example.com";
+    var bob   = "bob@example.com";
+    var carol = "carol@example.com";
+    _insertSealed("u-alice", alice, "Alice");
+    _insertSealed("u-bob",   bob,   "Bob");
+    _insertSealed("u-carol", carol, "Carol");
+
+    // ---- equality still works (the path that was never broken) ----
+    var eqRows = await b.db.from("users").where("email", alice).all();
+    check("sealed equality query still finds the row",
+          eqRows.length === 1 && eqRows[0]._id === "u-alice");
+
+    // ---- #141: whereIn on a sealed column (the real consumer path) ----
+    var inRows = await b.db.from("users").whereIn("email", [alice, bob]).all();
+    var inIds = inRows.map(function (r) { return r._id; }).sort();
+    check("#141 whereIn on a sealed column returns every matching row",
+          inIds.length === 2 && inIds[0] === "u-alice" && inIds[1] === "u-bob");
+    check("#141 whereIn on a sealed column excludes the non-listed row",
+          inIds.indexOf("u-carol") === -1);
+
+    // ---- #141: the collection $in consumer path (same root) ----
+    var coll = b.db.collection("users");
+    var collRows = coll.find({ email: { $in: [alice, carol] } });
+    var collIds = collRows.map(function (r) { return r._id; }).sort();
+    check("#141 collection.find $in on a sealed column returns every match",
+          collIds.length === 2 && collIds[0] === "u-alice" && collIds[1] === "u-carol");
+
+    // ---- #141: dual-read — a legacy-digested (un-migrated) row is found ----
+    // Forge a row carrying the pre-v0.15.0 salted digest, like the dual-read
+    // migrate test. whereIn must include the legacy digest per element.
+    var dave = "dave@example.com";
+    var lk = b.cryptoField.lookupHash("users", "email", dave);
+    var sealedDave = b.cryptoField.sealRow("users", { _id: "u-dave", email: dave, name: "Dave" });
+    sealedDave.emailHash = lk.legacyValue;   // pin the LEGACY digest
+    b.db.prepare(
+      'INSERT INTO "users" ("_id","email","emailHash","name") VALUES (?,?,?,?)'
+    ).run(sealedDave._id, sealedDave.email, sealedDave.emailHash, sealedDave.name);
+    var dualRows = await b.db.from("users").whereIn("email", [dave, bob]).all();
+    var dualIds = dualRows.map(function (r) { return r._id; }).sort();
+    check("#141 whereIn dual-reads the legacy digest (finds an un-migrated row)",
+          dualIds.indexOf("u-dave") !== -1 && dualIds.indexOf("u-bob") !== -1);
+
+    // ---- single-element membership ----
+    var oneRows = await b.db.from("users").whereIn("email", [carol]).all();
+    check("#141 single-element whereIn on a sealed column works",
+          oneRows.length === 1 && oneRows[0]._id === "u-carol");
+
+    // ---- regression: whereIn on a NON-sealed column is unchanged ----
+    var idRows = await b.db.from("users").whereIn("_id", ["u-alice", "u-bob"]).all();
+    check("non-sealed whereIn is unaffected",
+          idRows.map(function (r) { return r._id; }).sort().join(",") === "u-alice,u-bob");
+
+    console.log("OK — db-query sealed-field IN / $in tests");
+  } finally {
+    await teardownTestDb(dir);
+  }
+}
+
+module.exports = { run: run };
+if (require.main === module) {
+  run().then(function () { process.exit(0); })
+       .catch(function (err) { process.stderr.write(String(err && err.stack || err) + "\n"); process.exit(1); });
+}

package/lib/vendor/blamejs/test/layer-0-primitives/db-raw-residency-gate.test.js

@@ -0,0 +1,128 @@
+"use strict";
+/**
+ * b.db.runSql / b.db.prepare(...).run(...) — local per-row residency gate on
+ * the RAW execution path. _assertLocalResidency is wired only at the
+ * structured builder boundary (insertOne/updateOne). The raw paths
+ * b.db.runSql (execRaw) and b.db.prepare(sql).run(...) write a cross-border
+ * row straight to disk with NO residency check under a regulated posture.
+ * RED today: builder refuses (control), raw paths do not.
+ */
+
+var helpers = require("../helpers");
+var b     = helpers.b;
+var check = helpers.check;
+var fs   = helpers.fs;
+var os   = helpers.os;
+var path = helpers.path;
+
+var SCHEMA = [{
+  name: "residents",
+  columns: { _id: "TEXT PRIMARY KEY", name: "TEXT", dataRegion: "TEXT" },
+}];
+
+async function initDb(tmpDir) {
+  process.env.BLAMEJS_SKIP_NTP_CHECK = "1";
+  helpers.setTestPassphraseEnv();
+  b.cluster._resetForTest();
+  b.audit._resetForTest();
+  b.vault._resetForTest();
+  b.db._resetForTest();
+  await b.vault.init({ dataDir: tmpDir });
+  await b.db.init({
+    dataDir:       tmpDir,
+    tmpDir:        path.join(tmpDir, "tmpfs"),
+    schema:        SCHEMA,
+    dataResidency: { region: "eu-west-1" },
+  });
+}
+
+function codeOf(fn) {
+  try { fn(); } catch (e) { return (e && e.code) || (e && e.message) || "threw"; }
+  return null;
+}
+
+async function run() {
+  var tmp = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-raw-resid-"));
+  await initDb(tmp);
+  b.cryptoField.clearResidencyForTest();
+  try {
+    b.cryptoField.declarePerRowResidency("residents", {
+      residencyColumn: "dataRegion",
+      allowedTags:     ["eu-west-1", "us-east-1", "global"],
+    });
+    b.compliance.set("gdpr");
+
+    // CONTROL: the structured builder path refuses the cross-border tag.
+    check("control: db.from() builder refuses the cross-border tag",
+      codeOf(function () {
+        b.db.from("residents").insertOne({ _id: "ctl", name: "x", dataRegion: "us-east-1" });
+      }) === "db-query/row-residency-local-mismatch");
+
+    // RAW PATH 1: b.db.runSql (execRaw). RED today — no refusal.
+    var runSqlRefusedCode = codeOf(function () {
+      b.db.runSql(
+        "INSERT INTO \"residents\" (_id, name, dataRegion) VALUES ('raw-1', 'x', 'us-east-1')");
+    });
+    check("b.db.runSql cross-border write is refused (residency gate fires on the raw path)",
+      runSqlRefusedCode === "db-query/row-residency-local-mismatch");
+    check("b.db.runSql cross-border row did not persist (no us-east-1 row landed)",
+      b.db.from("residents").where({ _id: "raw-1" }).first() === null);
+
+    // RAW PATH 2: b.db.prepare(sql).run(...) — the seeders' consumer path.
+    var prepareRefusedCode = codeOf(function () {
+      b.db.prepare(
+        "INSERT INTO \"residents\" (_id, name, dataRegion) VALUES (?, ?, ?)")
+        .run("raw-2", "x", "us-east-1");
+    });
+    check("b.db.prepare().run() cross-border write is refused (residency gate fires)",
+      prepareRefusedCode === "db-query/row-residency-local-mismatch");
+    check("b.db.prepare().run() cross-border row did not persist",
+      b.db.from("residents").where({ _id: "raw-2" }).first() === null);
+
+    // An in-region raw write still succeeds (no over-rejection).
+    b.db.runSql(
+      "INSERT INTO \"residents\" (_id, name, dataRegion) VALUES ('raw-eu', 'y', 'eu-west-1')");
+    check("an in-region raw write still persists (gate does not over-reject)",
+      (b.db.from("residents").where({ _id: "raw-eu" }).first() || {}).dataRegion === "eu-west-1");
+
+    // RAW PATH 3: a SCHEMA-QUALIFIED table name must resolve to the table and
+    // still gate. SQLite accepts INSERT INTO main.residents; capturing only the
+    // "main" qualifier would skip the gate for the real target table.
+    var qualifiedRefusedCode = codeOf(function () {
+      b.db.runSql(
+        "INSERT INTO main.residents (_id, name, dataRegion) VALUES ('raw-q', 'x', 'us-east-1')");
+    });
+    check("qualified-name raw write is refused (main.residents resolves to residents)",
+      qualifiedRefusedCode === "db-query/row-residency-local-mismatch");
+    check("qualified-name cross-border row did not persist",
+      b.db.from("residents").where({ _id: "raw-q" }).first() === null);
+
+    // RAW PATH 4: an UPDATE whose SET value contains the word WHERE inside a
+    // quoted string must be parsed quote-aware, so the residency-column
+    // assignment after it is still seen and gated.
+    var quotedWhereRefusedCode = codeOf(function () {
+      b.db.runSql(
+        "UPDATE residents SET name='x WHERE y', dataRegion='us-east-1' WHERE _id='raw-eu'");
+    });
+    check("update with a quoted WHERE in a SET value is parsed quote-aware + refused",
+      quotedWhereRefusedCode === "db-query/row-residency-local-mismatch");
+    check("the quoted-WHERE update did not move the row cross-border",
+      (b.db.from("residents").where({ _id: "raw-eu" }).first() || {}).dataRegion === "eu-west-1");
+  } finally {
+    b.compliance.clear();
+    b.cryptoField.clearResidencyForTest();
+    b.db.close();
+    fs.rmSync(tmp, { recursive: true, force: true });
+    b.audit._resetForTest();
+    b.db._resetForTest();
+    b.vault._resetForTest();
+    b.cluster._resetForTest();
+  }
+  console.log("OK — db raw-path residency gate tests");
+}
+
+module.exports = { run: run };
+if (require.main === module) {
+  run().then(function () { process.exit(0); })
+       .catch(function (err) { process.exitCode = 1; throw err; });
+}

package/lib/vendor/blamejs/test/layer-0-primitives/db-schema-drift.test.js

@@ -1,13 +1,16 @@
 "use strict";
 /**
- * dbSchema.reconcile / reconcileTable — opt-in schema-drift detection.
+ * dbSchema.reconcile / reconcileTable — schema-drift detection.
  *
  * reconcile is additive-only (CREATE IF NOT EXISTS + ALTER ADD COLUMN);
  * it never drops columns. The onDrift opt adds detection of config-vs-
  * live divergence without changing that non-destructive contract:
  *
- *   - default (onDrift unset / "ignore") = pre-detection behavior; a
- *     live table with an extra column is tolerated silently.
+ *   - onDrift unset = posture-driven default (v0.15.0): "ignore" on an
+ *     unpinned / non-regulated deployment (back-compat); "refuse" when a
+ *     regulated compliance posture is globally pinned.
+ *   - "ignore" = tolerate a live table with an extra column silently
+ *     (the explicit opt-out under a regulated posture).
  *   - "warn"   = detect, never throw (report returned to the caller).
  *   - "refuse" = throw at boot on the first drifted table (strict-schema
  *     posture).
@@ -25,9 +28,10 @@ var os   = helpers.os;
 var path = helpers.path;
 var sqlite = require("node:sqlite");
 var dbSchema = require("../../lib/db-schema");
+var compliance = require("../../lib/compliance");
 
-function _openDb(tmpDir) {
-  return new sqlite.DatabaseSync(path.join(tmpDir, "drift.db"));
+function _openDb(tmpDir, name) {
+  return new sqlite.DatabaseSync(path.join(tmpDir, name || "drift.db"));
 }
 
 function _liveColumns(db, table) {
@@ -134,6 +138,35 @@ async function run() {
       /onDrift must be one of/));
   dbBad.close();
 
+  // ---- posture-driven default (v0.15.0): a regulated pinned posture
+  // flips the unset-onDrift default from "ignore" to "refuse"; an explicit
+  // onDrift always wins (including "ignore" to opt back out). ----
+  compliance._resetForTest();
+  try {
+    // Build a freshly-reconciled DB, then introduce out-of-band drift —
+    // all while UNPINNED so the clean setup never trips the default.
+    var dbPosture = _openDb(tmp, "drift-posture.db");
+    dbSchema.reconcile(dbPosture, SCHEMA);
+    dbSchema.runSql(dbPosture, 'ALTER TABLE "widgets" ADD COLUMN "posture_extra" TEXT');
+
+    // Unpinned: unset onDrift stays "ignore" — drift tolerated silently.
+    check("unpinned + unset onDrift tolerates drift (ignore default)",
+      threwMatching(function () { dbSchema.reconcile(dbPosture, SCHEMA); }, /.*/) === null);
+
+    // Pin a regulated posture: unset onDrift now refuses on the SAME drift.
+    compliance.set("gdpr");
+    check("regulated posture pinned + unset onDrift refuses drift (refuse default)",
+      !!threwMatching(function () { dbSchema.reconcile(dbPosture, SCHEMA); },
+        /schema drift on table 'widgets'/));
+    // Explicit opt-out: onDrift "ignore" tolerates drift even under the
+    // regulated posture (the documented escape hatch).
+    check("explicit onDrift:'ignore' opts out under a regulated posture",
+      threwMatching(function () { dbSchema.reconcile(dbPosture, SCHEMA, { onDrift: "ignore" }); }, /.*/) === null);
+    dbPosture.close();
+  } finally {
+    compliance._resetForTest();
+  }
+
   fs.rmSync(tmp, { recursive: true, force: true });
   console.log("OK — db schema-drift detection tests");
 }

package/lib/vendor/blamejs/test/layer-0-primitives/db-schema-reconcile-emittable.test.js

@@ -0,0 +1,127 @@
+"use strict";
+/**
+ * dbSchema.reconcileTable verbatim column-TYPE string — statement-emittable
+ * gate parity with b.sql.createTable. The TYPE string is concatenated
+ * verbatim into CREATE TABLE (db-schema.js:264) + ALTER TABLE ADD COLUMN
+ * (db-schema.js:271); neither concat routes through the catalog emittable
+ * gate b.sql.createTable got in v0.15.3 (#105). RED today: reconcileTable
+ * does NOT throw and the stacked DROP destroys the sentinel table.
+ */
+
+var helpers  = require("../helpers");
+var check    = helpers.check;
+var fs       = helpers.fs;
+var os       = helpers.os;
+var path     = helpers.path;
+var sqlite   = require("node:sqlite");
+var dbSchema = require("../../lib/db-schema");
+
+// Real NUL built from a code point — never a literal NUL typed into source.
+var NUL = String.fromCharCode(0);
+
+function _openDb(tmpDir, name) {
+  return new sqlite.DatabaseSync(path.join(tmpDir, name || "emit.db"));
+}
+
+function threwMatching(fn, pattern) {
+  try { fn(); } catch (e) { return pattern.test(e.message || "") ? e : null; }
+  return null;
+}
+
+function _sentinelAlive(db) {
+  return db.prepare(
+    "SELECT count(*) AS n FROM sqlite_master WHERE type='table' AND name='secrets'"
+  ).get().n === 1;
+}
+
+function _seedSentinel(db) {
+  dbSchema.runSql(db, "DROP TABLE IF EXISTS secrets");
+  dbSchema.runSql(db, "CREATE TABLE secrets (k TEXT)");
+  dbSchema.runSql(db, "INSERT INTO secrets VALUES ('topsecret')");
+}
+
+async function run() {
+  var tmp = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-reconcile-emit-"));
+
+  // ---- CREATE TABLE path: hostile TYPE stacks a DROP ----
+  var dbCreate = _openDb(tmp, "create.db");
+  _seedSentinel(dbCreate);
+  check("setup: sentinel 'secrets' table exists before reconcile",
+    _sentinelAlive(dbCreate));
+
+  var createErr = threwMatching(function () {
+    dbSchema.reconcileTable(dbCreate, {
+      name: "t_create",
+      columns: { id: "TEXT PRIMARY KEY", evil: "TEXT); DROP TABLE secrets; --" },
+    }, { onDrift: "ignore" });
+  }, /.*/);
+  // RED today: createErr === null (no throw). GREEN: the catalog gate refuses.
+  check("reconcileTable refuses a CREATE-path verbatim type that stacks a statement",
+    !!createErr);
+  // Load-bearing RED proof: the stacked DROP must NOT have executed.
+  check("reconcileTable did not let the stacked DROP destroy the sentinel table (CREATE path)",
+    _sentinelAlive(dbCreate));
+  dbCreate.close();
+
+  // ---- ADD COLUMN path: reconcile a table, then re-reconcile with a
+  // hostile new-column TYPE so the ALTER TABLE ADD COLUMN concat fires. ----
+  var dbAlter = _openDb(tmp, "alter.db");
+  _seedSentinel(dbAlter);
+  dbSchema.reconcileTable(dbAlter, {
+    name: "t_alter", columns: { id: "TEXT PRIMARY KEY" },
+  }, { onDrift: "ignore" });
+
+  var alterErr = threwMatching(function () {
+    dbSchema.reconcileTable(dbAlter, {
+      name: "t_alter",
+      columns: { id: "TEXT PRIMARY KEY", evil2: "TEXT); DROP TABLE secrets; --" },
+    }, { onDrift: "ignore" });
+  }, /.*/);
+  check("reconcileTable refuses an ADD-COLUMN verbatim type that stacks a statement",
+    !!alterErr);
+  check("reconcileTable did not let the stacked DROP destroy the sentinel table (ADD COLUMN path)",
+    _sentinelAlive(dbAlter));
+  dbAlter.close();
+
+  // ---- unbalanced-quote TYPE ----
+  var dbQuote = _openDb(tmp, "quote.db");
+  _seedSentinel(dbQuote);
+  check("reconcileTable refuses a verbatim type with an unbalanced quote",
+    !!threwMatching(function () {
+      dbSchema.reconcileTable(dbQuote, {
+        name: "t_quote", columns: { id: "TEXT PRIMARY KEY", c: "TEXT'" },
+      }, { onDrift: "ignore" });
+    }, /.*/));
+  dbQuote.close();
+
+  // ---- NUL byte in the TYPE string (built via String.fromCharCode(0)) ----
+  var dbNul = _openDb(tmp, "nul.db");
+  _seedSentinel(dbNul);
+  check("reconcileTable refuses a verbatim type carrying a NUL byte",
+    !!threwMatching(function () {
+      dbSchema.reconcileTable(dbNul, {
+        name: "t_nul", columns: { id: "TEXT PRIMARY KEY", c: "TEXT" + NUL + " DEFAULT x" },
+      }, { onDrift: "ignore" });
+    }, /.*/));
+  dbNul.close();
+
+  // ---- a legitimate verbatim type still reconciles (no over-rejection) ----
+  var dbOk = _openDb(tmp, "ok.db");
+  check("reconcileTable still allows a legitimate multi-word verbatim type",
+    threwMatching(function () {
+      dbSchema.reconcileTable(dbOk, {
+        name: "t_ok",
+        columns: { id: "TEXT PRIMARY KEY", n: "INTEGER NOT NULL DEFAULT 0", v: "VARCHAR(255)" },
+      }, { onDrift: "ignore" });
+    }, /.*/) === null);
+  dbOk.close();
+
+  fs.rmSync(tmp, { recursive: true, force: true });
+  console.log("OK — db-schema reconcileTable emittable-gate tests");
+}
+
+module.exports = { run: run };
+if (require.main === module) {
+  run().then(function () { process.exit(0); })
+       .catch(function (err) { process.exitCode = 1; throw err; });
+}