@blamejs/blamejs-shop 0.4.31 → 0.4.32

package/lib/vendor/blamejs/test/00-primitives.js

@@ -7510,6 +7510,53 @@ async function testOAuthVerifyIdTokenRoundTrip() {
     threw = null;
     try { await oa.verifyIdToken(wrongIss, {}); } catch (e) { threw = e; }
     check("verifyIdToken: wrong iss rejected",       threw && threw.code === "auth-oauth/iss-mismatch");
+
+    // #137 — skipExpCheck is ONLY valid for OIDC Back-Channel-Logout tokens
+    // (no exp claim per §2.4). A caller must NOT be able to disable exp
+    // validation on a regular ID token — that verifies an expired/replayed
+    // credential clean. The option is gated to tokens carrying the logout
+    // event claim, and even then bounded by an iat freshness floor.
+    var LOGOUT_EVENT = "http://schemas.openid.net/event/backchannel-logout";
+    threw = null;
+    try { await oa.verifyIdToken(expired, { skipExpCheck: true }); } catch (e) { threw = e; }
+    check("#137 verifyIdToken: skipExpCheck on a non-logout token is rejected",
+          threw && threw.code === "auth-oauth/skip-exp-check-not-allowed");
+
+    // A genuine logout token (events claim, recent iat, no exp) still verifies
+    // under skipExpCheck — the internal back-channel-logout path relies on it.
+    var freshLogout = _signRs256({
+      iss: issuerUrl, sub: "user-1", aud: clientId, iat: nowSec,
+      events: (function () { var e = {}; e[LOGOUT_EVENT] = {}; return e; })(),
+    }, { kid: "test-kid-1" }, kp.privateKey);
+    var logoutOk = await oa.verifyIdToken(freshLogout, { skipExpCheck: true, skipNonceCheck: true });
+    check("#137 verifyIdToken: a fresh logout token verifies under skipExpCheck",
+          logoutOk && logoutOk.claims && logoutOk.claims.sub === "user-1");
+
+    // A stale logout token (iat older than the freshness floor) is rejected —
+    // skipExpCheck removes exp, so iat is the only freshness bound.
+    var staleLogout = _signRs256({
+      iss: issuerUrl, sub: "user-1", aud: clientId, iat: nowSec - 86400,
+      events: (function () { var e = {}; e[LOGOUT_EVENT] = {}; return e; })(),
+    }, { kid: "test-kid-1" }, kp.privateKey);
+    threw = null;
+    try { await oa.verifyIdToken(staleLogout, { skipExpCheck: true, skipNonceCheck: true }); } catch (e) { threw = e; }
+    check("#137 verifyIdToken: a stale logout token is rejected on iat floor",
+          threw && threw.code === "auth-oauth/logout-token-stale");
+
+    // The iat floor must honor a configured maxAgeSec (back-channel-logout
+    // deployments can widen the replay window). A 10-min-old logout token is
+    // rejected under the 5-min default but accepted under maxAgeSec: 20 min.
+    var agedLogout = _signRs256({
+      iss: issuerUrl, sub: "user-1", aud: clientId, iat: nowSec - 600,
+      events: (function () { var e = {}; e[LOGOUT_EVENT] = {}; return e; })(),
+    }, { kid: "test-kid-1" }, kp.privateKey);
+    threw = null;
+    try { await oa.verifyIdToken(agedLogout, { skipExpCheck: true, skipNonceCheck: true }); } catch (e) { threw = e; }
+    check("#137 verifyIdToken: a 10-min-old logout token is stale under the 5-min default",
+          threw && threw.code === "auth-oauth/logout-token-stale");
+    var agedOk = await oa.verifyIdToken(agedLogout, { skipExpCheck: true, skipNonceCheck: true, maxAgeSec: 1200 });
+    check("#137 verifyIdToken: the configured maxAgeSec widens the iat freshness window",
+          agedOk && agedOk.claims && agedOk.claims.sub === "user-1");
   } finally { server.close(); }
 }
 
@@ -12418,6 +12465,74 @@ function testErrorsPageHookOptsRejectNonFunction() {
   check("renderHtml non-function throws at config time", threwHtml);
 }
 
+async function testErrorsPageAuditRedactsSecretsInStackAndReason() {
+  // CWE-532: a secret embedded in an exception message/stack (e.g. a
+  // database connection string a driver dropped into Error.message) must
+  // NOT be persisted verbatim in the tamper-evident audit chain. The 5xx
+  // audit emission goes through audit.safeEmit, whose b.redact.redact()
+  // pass scrubs connection-string / JWT / PEM / AWS-key shapes — including
+  // nested metadata.stack — before the record reaches the chain.
+  var tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-errpg-"));
+  try {
+    await setupTestDb(tmpDir);
+    // The default audit action is "request.error"; its namespace is not a
+    // framework namespace, so register it the way an operator would.
+    b.audit.registerNamespace("request");
+
+    var secret = "postgres://user:s3cr3t@db.internal/app";
+    var handler = b.errorPage.create({ mode: "prod" }); // audit on by default
+    var req = { method: "POST", url: "/api/widget", headers: { accept: "application/json" }, id: "req-redact-1" };
+    var res = _makeFakeRes();
+    // Generic Error → 500. Its message (and therefore its stack) carries
+    // the secret-shaped connection string.
+    handler(new Error("connect failed for " + secret), req, res);
+
+    // Response behavior is unchanged: 500 status, JSON body, and the
+    // generic message — the original (secret-bearing) message never
+    // reaches the client on an unclassified 500.
+    check("audit-redact: response is 500",            res.statusCode === 500);
+    check("audit-redact: response is JSON",           /application\/json/.test(res.headers["Content-Type"]));
+    var payload = JSON.parse(res.body);
+    check("audit-redact: response hides operator message", res.body.indexOf("s3cr3t") === -1);
+    check("audit-redact: response shows generic message",
+          payload.error.message === "Internal Server Error");
+
+    await b.audit.flush();
+    await helpers.waitUntil(async function () {
+      var rows = await b.audit.query({ action: "request.error" });
+      return rows.length >= 1;
+    }, { timeoutMs: 5000, label: "errors-page audit: request.error row persisted" });
+
+    var events = await b.audit.query({ action: "request.error" });
+    check("audit-redact: 5xx audit row persisted",    events.length === 1);
+
+    var row = events[0];
+    var meta = row.metadata;
+    if (typeof meta === "string") meta = JSON.parse(meta);
+
+    // The whole persisted row must be free of the secret — neither the
+    // nested metadata.stack nor the reason (original error message) may
+    // carry it verbatim.
+    var rowJson = JSON.stringify(row);
+    check("audit-redact: secret absent from full persisted row",
+          rowJson.indexOf("s3cr3t") === -1);
+    check("audit-redact: secret absent from metadata.stack",
+          !meta || typeof meta.stack !== "string" || meta.stack.indexOf("s3cr3t") === -1);
+    check("audit-redact: secret absent from reason",
+          typeof row.reason !== "string" || row.reason.indexOf("s3cr3t") === -1);
+    // The connection-string redactor leaves a marker so triage stays
+    // useful — confirm the field was scanned, not merely dropped.
+    check("audit-redact: stack carries the connection-string marker",
+          !!meta && typeof meta.stack === "string" &&
+          meta.stack.indexOf("[REDACTED-CONN-STRING]") !== -1);
+    // Non-secret triage fields survive redaction.
+    check("audit-redact: non-secret metadata preserved",
+          !!meta && meta.status === 500 && meta.method === "POST" && meta.url === "/api/widget");
+  } finally {
+    await teardownTestDb(tmpDir);
+  }
+}
+
 // ---- log ----
 //
 // Each test creates an instance with a captured-buffer destination so
@@ -18347,6 +18462,7 @@ async function run() {
   testErrorsPageJsonFormatterTakesOverBody();
   testErrorsPageRenderHtmlHook();
   testErrorsPageHookOptsRejectNonFunction();
+  await testErrorsPageAuditRedactsSecretsInStackAndReason();
   // log — structured JSON logging with request-id correlation
   testLogSurface();
   testLogEmitsJsonLineToStdout();
@@ -19048,6 +19164,7 @@ module.exports = {
   testErrorsPageJsonFormatterTakesOverBody:  testErrorsPageJsonFormatterTakesOverBody,
   testErrorsPageRenderHtmlHook:              testErrorsPageRenderHtmlHook,
   testErrorsPageHookOptsRejectNonFunction:   testErrorsPageHookOptsRejectNonFunction,
+  testErrorsPageAuditRedactsSecretsInStackAndReason: testErrorsPageAuditRedactsSecretsInStackAndReason,
   testLogSurface:                            testLogSurface,
   testLogEmitsJsonLineToStdout:              testLogEmitsJsonLineToStdout,
   testLogRoutesErrorAndFatalToStderr:        testLogRoutesErrorAndFatalToStderr,

package/lib/vendor/blamejs/test/10-state.js

@@ -372,9 +372,16 @@ async function testClusterProviderMysqlDialect() {
     check("mysql provider: emitted INSERT...ON DUPLICATE KEY",
           sqlSeen.some(function (e) { return /ON DUPLICATE KEY UPDATE/.test(e.sql); }));
     check("mysql provider: uses ? placeholders not $1",
-          sqlSeen.some(function (e) { return /VALUES\s*\(\s*'leader',\s*\?,/.test(e.sql); }));
+          sqlSeen.some(function (e) {
+            // The provider composes the upsert through b.sql, which binds
+            // every value (scope included) as a `?` rather than inlining
+            // the 'leader' literal — so the MySQL form is an all-`?` VALUES
+            // list with no Postgres `$1` numbering.
+            return /INSERT INTO _blamejs_leader[\s\S]*VALUES\s*\(\s*\?(?:\s*,\s*\?)*\s*\)/.test(e.sql) &&
+                   !/\$1/.test(e.sql);
+          }));
     check("mysql provider: gates fencingToken with IF(expiresAt < ?, ...)",
-          sqlSeen.some(function (e) { return /fencingToken = IF\(expiresAt < \?, fencingToken \+ 1, fencingToken\)/.test(e.sql); }));
+          sqlSeen.some(function (e) { return /`fencingToken` = IF\(`expiresAt` < \?, `fencingToken` \+ 1, `fencingToken`\)/.test(e.sql); }));
 
     // Second node blocked while A holds.
     var leaseB = await pB.acquireLease("node-B", b.constants.TIME.seconds(30));
@@ -558,20 +565,137 @@ function testFrameworkSchemaTableNameMapping() {
         b.frameworkSchema.tableName("custom_table") === "custom_table");
   check("LOCAL_TO_EXTERNAL is frozen",
         Object.isFrozen(b.frameworkSchema.LOCAL_TO_EXTERNAL));
+
+  // ---- Configurable table prefix ----
+  // Default prefix is byte-identical to the historical names.
+  check("getTablePrefix default is _blamejs_",
+        b.frameworkSchema.getTablePrefix() === "_blamejs_");
+  check("DEFAULT_TABLE_PREFIX is _blamejs_",
+        b.frameworkSchema.DEFAULT_TABLE_PREFIX === "_blamejs_");
+
+  // setTablePrefix throws config-time on a non-identifier prefix.
+  var threwEmpty = false;
+  try { b.frameworkSchema.setTablePrefix(""); }
+  catch (e) { threwEmpty = e.code === "framework-schema/invalid-prefix"; }
+  check("setTablePrefix('') throws invalid-prefix", threwEmpty);
+  var threwBad = false;
+  try { b.frameworkSchema.setTablePrefix("bad-prefix!"); }
+  catch (e) { threwBad = e.code === "framework-schema/invalid-prefix"; }
+  check("setTablePrefix('bad-prefix!') throws invalid-prefix", threwBad);
+  var threwType = false;
+  try { b.frameworkSchema.setTablePrefix(123); }
+  catch (e) { threwType = e.code === "framework-schema/invalid-prefix"; }
+  check("setTablePrefix(non-string) throws invalid-prefix", threwType);
+  // A bad prefix must not have mutated state.
+  check("getTablePrefix unchanged after rejected prefix",
+        b.frameworkSchema.getTablePrefix() === "_blamejs_");
+
+  // A valid prefix swaps the leading default across every framework name.
+  try {
+    b.frameworkSchema.setTablePrefix("acme_");
+    check("getTablePrefix reflects configured prefix",
+          b.frameworkSchema.getTablePrefix() === "acme_");
+    check("tableName('audit_log') honors configured prefix",
+          b.frameworkSchema.tableName("audit_log") === "acme_audit_log");
+    check("tableName('_blamejs_sessions') honors configured prefix",
+          b.frameworkSchema.tableName("_blamejs_sessions") === "acme_sessions");
+    check("tableName(unknown) still identity under configured prefix",
+          b.frameworkSchema.tableName("custom_table") === "custom_table");
+  } finally {
+    // Restore the default so the rest of the suite (and the running DB)
+    // see the historical names — this state is module-global.
+    b.frameworkSchema.setTablePrefix("_blamejs_");
+  }
+  check("getTablePrefix restored to default",
+        b.frameworkSchema.getTablePrefix() === "_blamejs_");
 }
 
-function testFrameworkSchemaInvalidDialect() {
-  // The throw can come either sync (config validation) or async (per-
-  // table execution). The .then(success, failure) handler covers both.
-  return b.frameworkSchema.ensureSchema({
-    externalDbBackend: "ops",
-    dialect:           "mysql",
-  }).then(function () {
-    check("ensureSchema mysql rejects sync or async — succeeded unexpectedly", false);
-  }, function (e) {
-    check("ensureSchema rejects unsupported dialect (mysql)",
-          e.code === "framework-schema/unsupported-dialect");
-  });
+// resolveTables rewrites bare framework table names to their prefixed
+// external form ONLY in cluster mode, and honors a configured tablePrefix
+// (set config-time). Proves _REWRITE_TABLE is prefix-aware (rebuilt when the
+// prefix changes), so cluster-mode DML targets the same prefixed tables the
+// DDL builders create — both the local-mapped names (audit_log) and the
+// already-`_blamejs_`-prefixed identity names (_blamejs_scheduler_ticks),
+// which only need rewriting under a custom prefix.
+async function testClusterStoragePrefixRewrite() {
+  var tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-clpfx-"));
+  var dbPath = path.join(tmpDir, "cluster.db");
+  var driver = _makeSqliteDriver(dbPath);
+  try {
+    b.externalDb.init({
+      backends: {
+        "ops": { connect: driver.connect, query: driver.query, close: driver.close },
+      },
+    });
+    b.cluster._resetForTest();
+    await b.cluster.init({
+      nodeId:            "pfx-node-1",
+      externalDbBackend: "ops",
+      dialect:           "sqlite",
+      leaseTtl:          b.constants.TIME.seconds(30),
+      heartbeatInterval: b.constants.TIME.seconds(10),
+    });
+
+    // Default prefix: local-mapped name rewrites to its _blamejs_ external;
+    // identity-mapped name passes through unchanged.
+    check("resolveTables rewrites audit_log under default prefix",
+          b.clusterStorage.resolveTables("SELECT id FROM audit_log WHERE n > ?") ===
+          "SELECT id FROM _blamejs_audit_log WHERE n > ?");
+    check("resolveTables leaves _blamejs_scheduler_ticks under default prefix",
+          b.clusterStorage.resolveTables("DELETE FROM _blamejs_scheduler_ticks") ===
+          "DELETE FROM _blamejs_scheduler_ticks");
+
+    // Custom prefix: BOTH the local-mapped and the identity-mapped names
+    // rewrite to <prefix>* so cluster DML matches the prefixed DDL. App
+    // tables are never rewritten.
+    try {
+      b.frameworkSchema.setTablePrefix("acme_");
+      check("resolveTables rewrites audit_log to the configured prefix",
+            b.clusterStorage.resolveTables("SELECT id FROM audit_log WHERE n > ?") ===
+            "SELECT id FROM acme_audit_log WHERE n > ?");
+      check("resolveTables rewrites identity name _blamejs_scheduler_ticks to the prefix",
+            b.clusterStorage.resolveTables("DELETE FROM _blamejs_scheduler_ticks") ===
+            "DELETE FROM acme_scheduler_ticks");
+      check("resolveTables leaves a non-framework table untouched under prefix",
+            b.clusterStorage.resolveTables("SELECT * FROM my_app_table") ===
+            "SELECT * FROM my_app_table");
+    } finally {
+      b.frameworkSchema.setTablePrefix("_blamejs_");
+    }
+  } finally {
+    try { await b.cluster.shutdown(); } catch (_e) {}
+    b.cluster._resetForTest();
+    try { await b.externalDb.shutdown(); } catch (_e) {}
+    driver._close();
+    fs.rmSync(tmpDir, { recursive: true, force: true });
+  }
+}
+
+async function testFrameworkSchemaInvalidDialect() {
+  // postgres, sqlite, and mysql are the supported dialects. A dialect
+  // outside that set is rejected at the config-validation gate with
+  // framework-schema/unsupported-dialect, BEFORE any backend dispatch — so
+  // an operator typo surfaces at boot. (The mysql DDL path itself is proven
+  // end-to-end against a live server in framework-schema-mysql.test.js.)
+  var unsupportedErr = null;
+  try {
+    await b.frameworkSchema.ensureSchema({ externalDbBackend: "ops", dialect: "oracle" });
+  } catch (e) { unsupportedErr = e; }
+  check("ensureSchema rejects an unsupported dialect at the config gate",
+        unsupportedErr !== null &&
+        unsupportedErr.code === "framework-schema/unsupported-dialect");
+
+  // mysql is now a SUPPORTED dialect, so it passes the dialect-validation
+  // gate — a mysql ensureSchema no longer fails with the unsupported-dialect
+  // code (it proceeds to backend dispatch; the live DDL is covered in the
+  // integration suite). Assert the gate no longer rejects it.
+  var mysqlErr = null;
+  try {
+    await b.frameworkSchema.ensureSchema({ externalDbBackend: "ops", dialect: "mysql" });
+  } catch (e) { mysqlErr = e; }
+  check("ensureSchema accepts mysql at the dialect gate (no unsupported-dialect rejection)",
+        mysqlErr === null ||
+        mysqlErr.code !== "framework-schema/unsupported-dialect");
 }
 
 // ---- run() ----
@@ -597,6 +721,7 @@ async function run() {
   // framework-schema (DDL emitter + table-name resolver)
   await testFrameworkSchemaEnsure();
   testFrameworkSchemaTableNameMapping();
+  await testClusterStoragePrefixRewrite();
   await testFrameworkSchemaInvalidDialect();
 }
 
@@ -618,5 +743,6 @@ module.exports = {
   testClusterInitAndRequireLeader:          testClusterInitAndRequireLeader,
   testFrameworkSchemaEnsure:                testFrameworkSchemaEnsure,
   testFrameworkSchemaTableNameMapping:      testFrameworkSchemaTableNameMapping,
+  testClusterStoragePrefixRewrite:          testClusterStoragePrefixRewrite,
   testFrameworkSchemaInvalidDialect:        testFrameworkSchemaInvalidDialect,
 };

package/lib/vendor/blamejs/test/20-db.js

@@ -46,7 +46,7 @@ async function testDbBasic() {
     var rawRow = rawStmt.get(inserted._id);
     check("on-disk email is sealed",     typeof rawRow.email === "string" && rawRow.email.startsWith("vault:"));
     check("on-disk name is sealed",      typeof rawRow.name === "string" && rawRow.name.startsWith("vault:"));
-    check("emailHash is computed",       typeof rawRow.emailHash === "string" && rawRow.emailHash.length === 128);
+    check("emailHash is computed",       typeof rawRow.emailHash === "string" && /^[0-9a-f]{32,}$/.test(rawRow.emailHash));
     check("emailHash is normalized",     rawRow.emailHash === b.db.hashFor("users", "email", "ALICE@example.com"));
 
     // Query via plain field name (sealed → translated to emailHash)
@@ -510,7 +510,8 @@ async function testEncryptedTmpfsCorruptionAutoRecovers() {
     // must be discarded and db.enc re-decrypted — boot must succeed.
     setTestPassphraseEnv();
     b.audit._resetForTest();
-    await b.db.init({ dataDir: tmpDir, tmpDir: path.join(tmpDir, "tmpfs"), schema: schema });
+    await b.db.init({ dataDir: tmpDir, tmpDir: path.join(tmpDir, "tmpfs"), schema: schema,
+      allowNonTmpfsTmpDir: true });   // .test-output scratch is not a tmpfs mount (v0.15.0 refusal opt-out)
     var row = b.db.prepare("SELECT v FROM recovery_t WHERE _id = ?").get("r1");
     check("corrupt tmpfs working copy auto-recovers from db.enc (no crash loop)",
           row && row.v === "survives");
@@ -583,6 +584,7 @@ async function testTmpfsLowSpaceRefusesWritesFailClear() {
     await b.db.init({
       dataDir: tmpDir, tmpDir: path.join(tmpDir, "tmpfs"), schema: schema,
       minFreeBytes: BYTES.mib(16), _statfsForTest: fakeStatfs,
+      allowNonTmpfsTmpDir: true,   // .test-output scratch is not a tmpfs mount (v0.15.0 refusal opt-out)
     });
     check("low-space test runs in encrypted mode", b.db.getMode() === "encrypted");
 
@@ -643,6 +645,66 @@ async function testExitHandlerRegisteredOnce() {
   check("exit handler registered once across init/close cycles (no listener leak)", added <= 1);
 }
 
+async function testEncryptedNonTmpfsTmpDirRefusedByDefault() {
+  // v0.15.0: encrypted mode REFUSES a tmpDir that does not resolve under a
+  // recognized tmpfs mount (a persistent-disk working copy leaks the
+  // decrypted DB into backups / forensic images). The documented opt-out
+  // is allowNonTmpfsTmpDir:true. The heuristic is Linux-only — on other
+  // platforms the gate emits a warning and does not throw, so the
+  // fail-closed assertion only runs on Linux. A repo-local .test-output
+  // path is provably outside /dev/shm /run/shm /run/user /tmp.
+  if (process.platform !== "linux") {
+    check("non-tmpfs tmpDir gate is Linux-only (skipped off-Linux)", true);
+    return;
+  }
+  var scratchBase = path.join(__dirname, "..", ".test-output");
+  fs.mkdirSync(scratchBase, { recursive: true });
+  var schema = [{ name: "tmpfs_gate_t", columns: { _id: "TEXT PRIMARY KEY", v: "TEXT" } }];
+
+  // --- default: refuse ---
+  var tmpDir = fs.mkdtempSync(path.join(scratchBase, "db-nontmpfs-refuse-"));
+  try {
+    process.env.BLAMEJS_SKIP_NTP_CHECK = "1";
+    setTestPassphraseEnv();
+    b.cluster._resetForTest();
+    b.audit._resetForTest();
+    b.vault._resetForTest();
+    b.db._resetForTest();
+    await b.vault.init({ dataDir: tmpDir });
+    var refuseErr = null;
+    try {
+      await b.db.init({ dataDir: tmpDir, tmpDir: path.join(tmpDir, "persist"), schema: schema });
+    } catch (e) { refuseErr = e; }
+    check("encrypted non-tmpfs tmpDir refused by default (fail-closed)",
+          refuseErr && refuseErr.code === "db/tmpdir-not-tmpfs");
+  } finally {
+    try { b.db._resetForTest(); } catch (_e) { /* best effort */ }
+    await teardownTestDb(tmpDir);
+  }
+
+  // --- documented opt-out: allowNonTmpfsTmpDir:true boots ---
+  var tmpDir2 = fs.mkdtempSync(path.join(scratchBase, "db-nontmpfs-allow-"));
+  try {
+    process.env.BLAMEJS_SKIP_NTP_CHECK = "1";
+    setTestPassphraseEnv();
+    b.cluster._resetForTest();
+    b.audit._resetForTest();
+    b.vault._resetForTest();
+    b.db._resetForTest();
+    await b.vault.init({ dataDir: tmpDir2 });
+    var allowErr = null;
+    try {
+      await b.db.init({ dataDir: tmpDir2, tmpDir: path.join(tmpDir2, "persist"),
+        schema: schema, allowNonTmpfsTmpDir: true });
+    } catch (e) { allowErr = e; }
+    check("allowNonTmpfsTmpDir:true opts out of the refusal (boots)", allowErr === null);
+    check("opt-out boot runs in encrypted mode", b.db.getMode() === "encrypted");
+  } finally {
+    try { b.db._resetForTest(); } catch (_e) { /* best effort */ }
+    await teardownTestDb(tmpDir2);
+  }
+}
+
 // ---- run() ----
 
 async function run() {
@@ -652,6 +714,7 @@ async function run() {
   await testEncryptedTmpfsCorruptionAutoRecovers();
   await testEncryptedCloseKeepsPlaintextWhenEncryptFails();
   await testTmpfsLowSpaceRefusesWritesFailClear();
+  await testEncryptedNonTmpfsTmpDirRefusedByDefault();
   await testExitHandlerRegisteredOnce();
   await testDbWriteOps();
   await testDbSealedWithoutDerived();

package/lib/vendor/blamejs/test/helpers/db.js

@@ -39,6 +39,12 @@ async function setupTestDb(tmpDir, schemaOverrides) {
   await b.db.init({
     dataDir: tmpDir,
     tmpDir:  path.join(tmpDir, "tmpfs"),
+    // Test scratch dir is a plain directory, not a real tmpfs mount, and may
+    // live under the repo-local .test-output (outside the /tmp heuristic) for
+    // tests that corrupt their working file in place. Encrypted mode now
+    // refuses a non-tmpfs tmpDir by default (v0.15.0); the fixture knowingly
+    // uses one, so opt out explicitly.
+    allowNonTmpfsTmpDir: true,
     schema:  schemaOverrides || [
       {
         name: "users",
@@ -82,6 +88,9 @@ async function setupTestDbForMW() {
   await b.db.init({
     dataDir: tmpDir,
     tmpDir:  path.join(tmpDir, "tmpfs"),
+    // Plain scratch directory, not a real tmpfs mount — opt out of the
+    // v0.15.0 encrypted-mode non-tmpfs refusal for the test fixture.
+    allowNonTmpfsTmpDir: true,
     schema:  [],
   });
   global._mwTmpDir = tmpDir;

package/lib/vendor/blamejs/test/helpers/drivers.js

@@ -118,18 +118,24 @@ function _makeFakeMysqlDriver() {
       var inLeader = /INSERT INTO _blamejs_leader/i.test(t) &&
                      /ON DUPLICATE KEY UPDATE/i.test(t);
       if (inLeader) {
-        // params: [nodeId, leaseId, acquiredAt, expiresAt, endpoint,
-        //          nowMs, nowMs, nowMs, nowMs, nowMs, nowMs]
+        // The provider composes this upsert through b.sql, which binds the
+        // VALUES list (scope first) then the ON DUPLICATE KEY UPDATE IF()
+        // params. Layout:
+        //   VALUES: [0]=scope 'leader', [1]=nodeId, [2]=leaseId,
+        //           [3]=acquiredAt, [4]=expiresAt, [5]=fencingToken(1),
+        //           [6]=endpoint
+        //   then the IF(expiresAt < ?, <new>, <old>) guards + proposed
+        //   values; every guard binds nowMs, the first at [7].
         var newRow = {
-          scope: "leader", nodeId: params[0], leaseId: params[1],
-          acquiredAt: params[2], expiresAt: params[3], endpoint: params[4],
+          scope: "leader", nodeId: params[1], leaseId: params[2],
+          acquiredAt: params[3], expiresAt: params[4], endpoint: params[6],
           fencingToken: 1,
         };
         var existing = rows._blamejs_leader;
         if (!existing) {
           rows._blamejs_leader = newRow;
         } else {
-          var nowPredicate = params[5];
+          var nowPredicate = params[7];
           if (existing.expiresAt < nowPredicate) {
             // Steal — IF() → use VALUES(*) for non-fencingToken cols,
             // bump fencingToken.
@@ -145,12 +151,15 @@ function _makeFakeMysqlDriver() {
         return { rows: [], affectedRows: 1 };
       }
 
-      // UPDATE _blamejs_leader SET expiresAt = ?, endpoint = ?
-      // WHERE scope='leader' AND nodeId=? AND leaseId=?
-      var renewMatch = /^UPDATE _blamejs_leader SET[\s\S]*expiresAt = \?[\s\S]*WHERE scope = 'leader' AND nodeId = \? AND leaseId = \?/i.test(t);
+      // UPDATE _blamejs_leader SET `expiresAt` = ?, `endpoint` = ?
+      // WHERE `scope` = ? AND `nodeId` = ? AND `leaseId` = ?  (renew).
+      // The provider composes this through b.sql: identifiers are
+      // backtick-quoted and the scope value binds (params[2]='leader')
+      // ahead of nodeId (params[3]) / leaseId (params[4]).
+      var renewMatch = /^UPDATE _blamejs_leader SET[\s\S]*`?expiresAt`? = \?[\s\S]*`?endpoint`? = \?[\s\S]*WHERE `?scope`? = \? AND `?nodeId`? = \? AND `?leaseId`? = \?/i.test(t);
       if (renewMatch) {
         var r = rows._blamejs_leader;
-        if (r && r.nodeId === params[2] && r.leaseId === params[3]) {
+        if (r && r.nodeId === params[3] && r.leaseId === params[4]) {
           r.expiresAt = params[0];
           r.endpoint  = params[1];
           return { rows: [], affectedRows: 1 };
@@ -158,18 +167,21 @@ function _makeFakeMysqlDriver() {
         return { rows: [], affectedRows: 0 };
       }
 
-      // UPDATE _blamejs_leader SET expiresAt = 0 WHERE ... (release)
-      var releaseMatch = /^UPDATE _blamejs_leader SET[\s\S]*expiresAt = 0/i.test(t);
+      // UPDATE _blamejs_leader SET `expiresAt` = ? WHERE ... (release).
+      // b.sql binds expiresAt=0 (params[0]) + scope (params[1]) + nodeId
+      // (params[2]) + leaseId (params[3]).
+      var releaseMatch = /^UPDATE _blamejs_leader SET[\s\S]*`?expiresAt`? = \?\s+WHERE/i.test(t);
       if (releaseMatch) {
         var rr = rows._blamejs_leader;
-        if (rr && rr.nodeId === params[0] && rr.leaseId === params[1]) {
-          rr.expiresAt = 0;
+        if (rr && rr.nodeId === params[2] && rr.leaseId === params[3]) {
+          rr.expiresAt = params[0];
         }
         return { rows: [], affectedRows: 1 };
       }
 
-      // SELECT FROM _blamejs_leader WHERE scope = 'leader'
-      if (/^SELECT[\s\S]+FROM _blamejs_leader WHERE scope = 'leader'/i.test(t)) {
+      // SELECT ... FROM _blamejs_leader WHERE `scope` = ?  (b.sql binds the
+      // scope value rather than inlining the 'leader' literal).
+      if (/^SELECT[\s\S]+FROM _blamejs_leader WHERE `?scope`? = (?:\?|'leader')/i.test(t)) {
         var rl = rows._blamejs_leader;
         if (!rl) return { rows: [], affectedRows: 0 };
         return { rows: [Object.assign({}, rl)], affectedRows: 1 };

package/lib/vendor/blamejs/test/helpers/services.js

@@ -135,6 +135,27 @@ var DEFAULTS = {
   mitmproxyV6:    "http://[::1]:8090",
   mitmproxyWebV6: "http://[::1]:8091",
   squidV6:        "http://[::1]:3128",
+
+  // ---- cloud-storage / telemetry / AWS emulators (test-CA TLS) ----
+  azurite:        "https://127.0.0.1:10000",      // Azure Blob (path-style)
+  azuriteV6:      "https://[::1]:10000",
+  gcs:            "https://127.0.0.1:4443",        // fake-gcs-server
+  gcsV6:          "https://[::1]:4443",
+  localstack:     "https://127.0.0.1:4566",        // CloudWatch Logs + SQS (Caddy-terminated)
+  localstackV6:   "https://[::1]:4566",
+  otelOtlp:       "https://127.0.0.1:4318",        // OTLP/HTTP receiver
+  otelOtlpV6:     "https://[::1]:4318",
+  otelHealth:     "http://127.0.0.1:13133/",        // OTel health_check extension
+  otelHealthV6:   "http://[::1]:13133/",
+  toxiproxy:      "http://127.0.0.1:8474",          // fault-injection API
+  toxiproxyV6:    "http://[::1]:8474",
+  toxiproxyRedis: "redis://127.0.0.1:16379",        // proxied redis
+  toxiproxyPg:    "postgres://blamejs:blamejs_test@127.0.0.1:15432/blamejs_test",
+
+  // ---- postgres streaming replica (hot standby) ----
+  postgresReplica:    "postgres://blamejs:blamejs_test@127.0.0.1:5433/blamejs_test",
+  postgresReplicaV6:  "postgres://blamejs:blamejs_test@[::1]:5433/blamejs_test",
+  postgresReplicaTls: "postgres://blamejs:blamejs_test@127.0.0.1:5433/blamejs_test?sslmode=require",
 };
 
 function _envOverride(name) {