@blamejs/blamejs-shop 0.4.68 → 0.4.70

package/lib/vendor/blamejs/test/layer-0-primitives/audit-verifybundle-tamper.test.js

@@ -37,6 +37,29 @@ var backupCrypto = require("../../lib/backup/crypto");
 
 var PASS = Buffer.from("operator-bundle-passphrase-not-secret");
 
+// Wire-form conversions mirroring audit-tools' _wireFormToRow /
+// _rowToWireForm (hex: prefix <-> Buffer) so a test can rebuild the exact
+// rows JSONL the verifier re-parses.
+function _wireToRow(wire) {
+  var out = {};
+  Object.keys(wire).forEach(function (k) {
+    var v = wire[k];
+    if (typeof v === "string" && v.indexOf("hex:") === 0) out[k] = Buffer.from(v.slice(4), "hex");
+    else out[k] = v;
+  });
+  return out;
+}
+function _rowToWire(row) {
+  var out = {};
+  Object.keys(row).forEach(function (k) {
+    var v = row[k];
+    if (Buffer.isBuffer(v)) out[k] = "hex:" + v.toString("hex");
+    else if (v === undefined) out[k] = null;
+    else out[k] = v;
+  });
+  return out;
+}
+
 async function _seedAuditRows(count) {
   b.audit.registerNamespace("test");
   for (var i = 0; i < count; i++) {
@@ -191,6 +214,105 @@ async function run() {
       r3.threw === false && r3.ok === false &&
       /signature/i.test(r3.reason || ""));
 
+    // ---- Tamper 4: anchor-rebind — fabricate the row slice but keep the
+    // GENUINE signed checkpoint. The checkpoint's atRowHash anchors the real
+    // chain; nothing in the bundle ties it to the fabricated rows. A verifier
+    // that only checks (signature valid + atMonotonicCounter >= lastCounter)
+    // reports a wholly fabricated archive as authentic — defeating the
+    // documented "tampering that recomputes hashes still fails checkpoint
+    // verification" guarantee. The fabricated chain is internally consistent
+    // (recomputed via b.auditChain.computeRowHash — no key needed), so it
+    // passes the chain walk + manifest first/last checks; only binding the
+    // signed atRowHash to the slice's anchored row catches it.
+    var t4 = path.join(dir, "bundles", "tamper-anchor-rebind");
+    _copyDir(cleanDir, t4);
+    var m4Path = path.join(t4, "manifest.json");
+    var m4 = JSON.parse(fs.readFileSync(m4Path, "utf8"));
+    var rows4Enc = fs.readFileSync(path.join(t4, "rows.enc"));
+    var rows4Plain = (await backupCrypto.decryptWithPassphrase(rows4Enc, PASS, m4.salts.rows)).toString("utf8");
+    var genuineWire = rows4Plain.split("\n").filter(function (l) { return l.length > 0; })
+      .map(function (l) { return JSON.parse(l); });
+    // Rebuild a fabricated, internally-consistent chain off the SAME
+    // predecessor + counters but with phantom actions that never happened.
+    // The row-hash preimage excludes prevHash/rowHash/nonce/fencingToken
+    // (mirrors audit-tools _verifyChainSlice), so the recompute matches the
+    // verifier's chain walk and only the signed atRowHash bind can catch it.
+    var prev4 = m4.range.predecessorRowHash;
+    var fabricatedWire = genuineWire.map(function (w) {
+      var row = _wireToRow(w);
+      row.action = "phantom.never.happened";
+      row.outcome = "success";
+      row.prevHash = prev4;
+      var fields = Object.assign({}, row);
+      delete fields.prevHash; delete fields.rowHash; delete fields.nonce; delete fields.fencingToken;
+      row.rowHash = b.auditChain.computeRowHash(prev4, fields, row.nonce);
+      prev4 = row.rowHash;
+      return _rowToWire(row);
+    });
+    check("tamper-anchor: fabricated last rowHash differs from the genuine anchor",
+      fabricatedWire[fabricatedWire.length - 1].rowHash !== m4.checkpoint.atRowHash);
+    var fabJsonl = fabricatedWire.map(function (w) { return JSON.stringify(w); }).join("\n") + "\n";
+    var fabEnc = await backupCrypto.encryptWithFreshSalt(fabJsonl, PASS);
+    fs.writeFileSync(path.join(t4, "rows.enc"), fabEnc.encrypted);
+    m4.salts.rows = fabEnc.salt;
+    m4.checksum.rowsSha3_512 = backupCrypto.checksum(fabEnc.encrypted);
+    m4.range.firstRowHash = fabricatedWire[0].rowHash;
+    m4.range.lastRowHash  = fabricatedWire[fabricatedWire.length - 1].rowHash;
+    // checkpoint.enc + manifest.checkpoint left GENUINE on purpose.
+    fs.writeFileSync(m4Path, JSON.stringify(m4));
+    var r4 = await _verify(t4);
+    check("tamper-anchor: fabricated archive is REJECTED (checkpoint not bound to slice)", r4.rejected === true);
+    check("tamper-anchor: failure points at the checkpoint anchor binding",
+      (!r4.threw && /anchor|atRowHash|checkpoint/i.test(r4.reason || "")) ||
+      (r4.threw && /anchor|atRowHash|checkpoint/i.test(r4.message || "")));
+
+    // ---- Regression: a LEGITIMATE partial archive whose covering checkpoint
+    // anchors a counter BEYOND the purgeable slice must still verify. The
+    // bundle carries the rows between the slice tip and the anchored counter
+    // as verification witnesses so the chain walks up to the signed atRowHash;
+    // purge still only touches the [first..lastCounter] slice. Driven through
+    // archive()'s injectable readers for determinism (no wall-clock gaps).
+    var fullDir = path.join(dir, "bundles", "archive-full10");
+    // Seed up to a tip of 10 and checkpoint THERE (the only checkpoint beyond
+    // counter 6), then snapshot all 10 rows + that checkpoint via a full
+    // archive so we can replay them through injected readers.
+    await _seedAuditRows(4);                 // counters 7..10 (6 already seeded)
+    var ckpt10 = await b.audit.checkpoint();
+    check("a checkpoint beyond the slice was anchored", Number(ckpt10.atMonotonicCounter) >= 10);
+    var full = await b.auditTools.archive({ before: Date.now() + 60000, out: fullDir, passphrase: PASS });
+    check("full archive carries >=10 rows", full.rowCount >= 10);
+    var fullM = JSON.parse(fs.readFileSync(path.join(fullDir, "manifest.json"), "utf8"));
+    var fullRowsPlain = (await backupCrypto.decryptWithPassphrase(
+      fs.readFileSync(path.join(fullDir, "rows.enc")), PASS, fullM.salts.rows)).toString("utf8");
+    var allRows = fullRowsPlain.split("\n").filter(function (l) { return l.length > 0; })
+      .map(function (l) { return _wireToRow(JSON.parse(l)); });
+    var fullCkptPlain = (await backupCrypto.decryptWithPassphrase(
+      fs.readFileSync(path.join(fullDir, "checkpoint.enc")), PASS, fullM.salts.checkpoint)).toString("utf8");
+    var genuineCkpt10 = _wireToRow(JSON.parse(fullCkptPlain));
+    var sliceLast = Number(allRows[5].monotonicCounter);   // 6th row's counter (purge boundary)
+    var partialDir = path.join(dir, "bundles", "archive-partial-witness");
+    var partial = await b.auditTools.archive({
+      before:     Date.now() + 60000,
+      out:        partialDir,
+      passphrase: PASS,
+      readRows: function (criteria) {
+        if (criteria.firstCounter != null) {
+          // witness request: rows (sliceLast .. anchorCounter]
+          return allRows.filter(function (r) {
+            var c = Number(r.monotonicCounter);
+            return c >= criteria.firstCounter && c <= criteria.lastCounter;
+          });
+        }
+        return allRows.slice(0, 6);   // purgeable slice = first 6 rows
+      },
+      readCoveringCheckpoint:  function () { return genuineCkpt10; },        // anchors counter 10
+      readPredecessorRowHash:  function () { return b.auditChain.ZERO_HASH; }, // slice starts at counter 1
+    });
+    check("partial archive purge range stops at the slice tip (witnesses excluded from purge range)",
+      Number(partial.range.lastCounter) === sliceLast);
+    var rp = await _verify(partialDir);
+    check("legit partial archive (anchor beyond slice) verifies via witness rows", rp.threw === false && rp.ok === true);
+
     console.log("OK — audit verifyBundle tamper-detection (" + helpers.getChecks() + " checks)");
   } finally {
     await teardownTestDb(dir);

package/lib/vendor/blamejs/test/layer-0-primitives/auth-bot-challenge.test.js

@@ -308,10 +308,47 @@ async function testEscalationFnInvoked() {
   check("escalationFn invoked when threshold crossed", escalated === 1);
 }
 
+// Concurrent failures on one key must not lose increments. A read-modify-
+// write over an async store races without per-key serialization: N parallel
+// recordFailure calls each read the same pre-write counter, so the failure
+// count lands at 1 and the gate never crosses its thresholds. The same N
+// calls run sequentially must reach the locked stage; the concurrent set
+// must reach the identical stage.
+async function testConcurrentFailuresDoNotLoseIncrements() {
+  var lockout = _fakeLockout();
+  var gate = b.authBotChallenge.create({
+    botGuard:     _fakeBotGuard("pass"),
+    lockout:      lockout,
+    sessionStore: _memoryStore(),
+    threshold:    2,
+    escalationThreshold: 4,
+    audit:        _captureAudit(),
+  });
+  var key = "race@example.com";
+
+  var results = await Promise.all([
+    gate.recordFailure(key),
+    gate.recordFailure(key),
+    gate.recordFailure(key),
+    gate.recordFailure(key),
+  ]);
+  // The serialized chain produces a strictly increasing failure count.
+  var failures = results.map(function (r) { return r.failures; }).sort(function (a, c) { return a - c; });
+  check("4 concurrent failures increment to 1..4 (no lost update)",
+    failures[0] === 1 && failures[1] === 2 && failures[2] === 3 && failures[3] === 4);
+  var locked = await gate.check(key);
+  check("4 concurrent failures reach the same locked stage as sequential",
+    locked.stage === "locked");
+  // The lockout subscriber sees every failure, not a collapsed single call.
+  check("lockout subscriber receives all 4 propagated failures",
+    lockout.calls.fail === 4);
+}
+
 async function run() {
   testSurface();
   testCreateRejectsBadOpts();
   await testStaircaseAdvances();
+  await testConcurrentFailuresDoNotLoseIncrements();
   await testMiddlewareChallengeFn();
   await testMiddlewareLockedReturns423();
   await testRecordSuccessClears();

package/lib/vendor/blamejs/test/layer-0-primitives/auth-jwt-defenses.test.js

@@ -291,7 +291,7 @@ function testPrmSignedMetadataEmits() {
 
 // -------- AUTH-22 — CIBA parseNotification lowercase only --------
 
-function testCibaParseNotificationLowercaseOnly() {
+async function testCibaParseNotificationLowercaseOnly() {
   // Lowercase-Authorization is what node:http delivers. Capital-A
   // fallback is now structurally removed. We exercise the rejection
   // path with no header at all — the lowercase-only path is still
@@ -306,7 +306,9 @@ function testCibaParseNotificationLowercaseOnly() {
     clientNotificationToken: "abc-token-very-long-and-opaque-enough-for-ciba-minimum-entropy-guard-padding",
   });
   var threw = null;
-  try { ciba.parseNotification({ headers: {} }, { body: {} }); }
+  // parseNotification is async (it verifies a pushed id_token) — the
+  // missing-bearer refusal surfaces as a rejection.
+  try { await ciba.parseNotification({ headers: {} }, { body: {} }); }
   catch (e) { threw = e; }
   check("AUTH-22 — parseNotification requires lowercase 'authorization' header",
         threw && /missing-bearer/.test(threw.code || ""));
@@ -340,7 +342,7 @@ async function run() {
   await testPasskeyExtensionsAllowlist();
   testPrmHttpsEnforced();
   testPrmSignedMetadataEmits();
-  testCibaParseNotificationLowercaseOnly();
+  await testCibaParseNotificationLowercaseOnly();
   testDpopMiddlewareShutdownExposed();
 }
 

package/lib/vendor/blamejs/test/layer-0-primitives/auth-lockout.test.js

@@ -208,6 +208,26 @@ async function testRecordFailureCounter() {
   check("check: bob is unaffected",        bob.locked === false && bob.attempts === 0);
 }
 
+// Concurrent failures on one key must each be counted. recordFailure reads
+// the counter from the async cache, increments, and writes it back; without
+// per-key serialization, N parallel calls all read the same pre-write value
+// and the counter lands at 1 — an attacker who fires attempts in parallel
+// stays under the lockout threshold forever.
+async function testConcurrentFailuresAllCounted() {
+  var lockout = b.auth.lockout.create({
+    cache: _newCache("ns-race"), namespace: "login", maxAttempts: 10,
+  });
+  await Promise.all([
+    lockout.recordFailure("eve"),
+    lockout.recordFailure("eve"),
+    lockout.recordFailure("eve"),
+    lockout.recordFailure("eve"),
+    lockout.recordFailure("eve"),
+  ]);
+  var state = await lockout.check("eve");
+  check("5 concurrent failures all counted (no lost update)", state.attempts === 5);
+}
+
 async function testNonMutatingCheck() {
   var lockout = b.auth.lockout.create({
     cache: _newCache("ns-nonmutating"), namespace: "login", maxAttempts: 5,
@@ -525,6 +545,7 @@ async function run() {
     testCreateRejectsBadOpts();
     await testKeyValidation();
     await testRecordFailureCounter();
+    await testConcurrentFailuresAllCounted();
     await testNonMutatingCheck();
     await testRecordSuccessClears();
     await testExponentialLadder();

package/lib/vendor/blamejs/test/layer-0-primitives/auth-status-list.test.js

@@ -0,0 +1,73 @@
+"use strict";
+// b.auth.statusList — IETF Token Status List (draft) revocation bitstring.
+//
+// B11: the relying-party read path (fromJwt().list.get) had NO bounds check —
+// _getAt over-reads the inflated buffer and returns 0 for an out-of-range index,
+// and status 0 = VALID. So a credential whose status_list index points PAST the
+// decoded list read as "not revoked": a fail-OPEN revocation bypass. create().get
+// already throws on a bad index; fromJwt().get must match (fail closed).
+//
+// RED on the buggy tree: fromJwt(...).list.get(size + N) returns 0 (valid).
+// GREEN after the fix: it throws status-list/bad-index.
+//
+// Also the first dedicated behavioral coverage for the primitive (was only an
+// export-presence check), driving the real create -> toJwt -> fromJwt path.
+
+var nodeCrypto = require("node:crypto");
+var helpers = require("../helpers");
+var b     = helpers.b;
+var check = helpers.check;
+
+async function run() {
+  check("b.auth.statusList.create is a function", typeof b.auth.statusList.create === "function");
+  check("b.auth.statusList.fromJwt is a function", typeof b.auth.statusList.fromJwt === "function");
+
+  // ML-DSA-87 is available on the Node 24 CI floor (SLH-DSA keygen is Node-26+).
+  var kp = nodeCrypto.generateKeyPairSync("ml-dsa-87");
+
+  var list = b.auth.statusList.create({ size: 64, bits: 1 });
+  list.set(5, 1);    // revoke index 5
+
+  // create()/get already fail closed on a bad index (control for the contract).
+  var createThrew = null;
+  try { list.get(64); } catch (e) { createThrew = e.code; }
+  check("create().get throws on an out-of-range index (fail closed)",
+        createThrew === "status-list/bad-index");
+
+  var token = await list.toJwt({
+    issuer: "https://issuer.example", subject: "https://issuer.example/sl/1",
+    privateKey: kp.privateKey, algorithm: "ML-DSA-87",
+  });
+  var parsed = await b.auth.statusList.fromJwt(token, {
+    publicKey: kp.publicKey, algorithms: ["ML-DSA-87"],
+    expectedIssuer: "https://issuer.example",
+  });
+
+  check("fromJwt round-trips the decoded list size", parsed.list.size === 64);
+  check("fromJwt: revoked index reads as revoked (status 1)", parsed.list.get(5) === 1);
+  check("fromJwt: an unset index reads as valid (status 0)", parsed.list.get(0) === 0);
+
+  // B11: the out-of-range read MUST fail closed, not read 0/valid.
+  var oobThrew = null, oobValue;
+  try { oobValue = parsed.list.get(parsed.list.size + 10); }
+  catch (e) { oobThrew = e.code; }
+  check("fromJwt().get throws on an out-of-range index (no fail-open revocation bypass)",
+        oobThrew === "status-list/bad-index");
+  check("fromJwt().get did NOT return a status for the out-of-range index",
+        oobValue === undefined);
+  // Negative + non-integer indices fail closed too.
+  var negThrew = null;
+  try { parsed.list.get(-1); } catch (e) { negThrew = e.code; }
+  check("fromJwt().get fails closed on a negative index", negThrew === "status-list/bad-index");
+  var fracThrew = null;
+  try { parsed.list.get(3.5); } catch (e) { fracThrew = e.code; }
+  check("fromJwt().get fails closed on a non-integer index", fracThrew === "status-list/bad-index");
+
+  console.log("OK — auth status-list (" + helpers.getChecks() + " checks)");
+}
+
+module.exports = { run: run };
+if (require.main === module) {
+  run().then(function () { process.exit(0); })
+       .catch(function (err) { process.exitCode = 1; throw err; });
+}

package/lib/vendor/blamejs/test/layer-0-primitives/bot-guard.test.js

@@ -91,12 +91,29 @@ function testOverridesAndSkips() {
   check("string blockedAgents pattern is refused", threw === "bot-guard/bad-pattern");
 }
 
+function testPeerGatedAuditIp() {
+  // Audit-attribution IP can be peer-gated so a forged X-Forwarded-For from a
+  // direct caller can't pollute it. Construction wiring + validation.
+  var okTrusted = true;
+  try { b.middleware.botGuard({ trustedProxies: ["10.0.0.0/8"] }); } catch (_e) { okTrusted = false; }
+  check("botGuard: trustedProxies accepted", okTrusted === true);
+
+  var okResolver = true;
+  try { b.middleware.botGuard({ clientIpResolver: function () { return "1.2.3.4"; } }); } catch (_e) { okResolver = false; }
+  check("botGuard: clientIpResolver accepted", okResolver === true);
+
+  var threwCidr = null;
+  try { b.middleware.botGuard({ trustedProxies: ["nope"] }); } catch (e) { threwCidr = e.code; }
+  check("botGuard: malformed trustedProxies CIDR refused", threwCidr === "bot-guard/bad-opt");
+}
+
 async function run() {
   testSurface();
   testSecFetchNeverBlocks();
   testBotsStillBlocked();
   testTagModeAdvisory();
   testOverridesAndSkips();
+  testPeerGatedAuditIp();
 }
 module.exports = { run: run };
 if (require.main === module) { run().then(function () { console.log("[bot-guard] OK — " + helpers.getChecks() + " checks passed"); }, function (e) { console.error("FAIL: " + helpers.formatErr(e)); process.exit(1); }); }

package/lib/vendor/blamejs/test/layer-0-primitives/break-glass.test.js

@@ -74,12 +74,26 @@ function testInitOptsValidation() {
   try { b.breakGlass.init({ now: 123 }); } catch (_e) { threwNow = true; }
   check("init: removed `now` opt throws", threwNow);
 
-  // trustProxy is still honored — default behavior unchanged.
+  // A bare trustProxy is refused — the grant IP pin would bind to a forgeable
+  // X-Forwarded-For. Operators declare peer-gating instead.
   var threwTrustProxy = false;
   try { b.breakGlass.init({ trustProxy: true }); } catch (_e) { threwTrustProxy = true; }
-  check("init: trustProxy still accepted", !threwTrustProxy);
+  check("init: bare trustProxy refused (spoofable IP pin)", threwTrustProxy);
 
-  // bare init() with no opts still works.
+  var threwTrusted = false;
+  try { b.breakGlass.init({ trustedProxies: ["10.0.0.0/8"] }); } catch (_e) { threwTrusted = true; }
+  check("init: trustedProxies accepted", !threwTrusted);
+
+  var threwResolver = false;
+  try { b.breakGlass.init({ clientIpResolver: function (rq) { return rq && rq.headers && rq.headers["true-client-ip"]; } }); }
+  catch (_e) { threwResolver = true; }
+  check("init: clientIpResolver accepted", !threwResolver);
+
+  var threwBadCidr = false;
+  try { b.breakGlass.init({ trustedProxies: ["nope"] }); } catch (_e) { threwBadCidr = true; }
+  check("init: malformed trustedProxies CIDR refused", threwBadCidr);
+
+  // bare init() with no opts still works (resolves the socket address).
   var threwBare = false;
   try { b.breakGlass.init(); } catch (_e) { threwBare = true; }
   check("init: no-opts init still works", !threwBare);
@@ -526,6 +540,50 @@ async function testIpPinEnforcement() {
   }
 }
 
+async function testIpPinPeerGated() {
+  // With trustedProxies, the grant IP pins to the real client behind the
+  // proxy — and a direct attacker forging X-Forwarded-For cannot satisfy it.
+  var tmpDir = _tmp();
+  await setupTestDb(tmpDir);
+  try {
+    b.breakGlass.init({ trustedProxies: ["10.0.0.0/8"] });
+    b.queue.init({ backends: { primary: { protocol: "local" } } });
+    var jid = await b.queue.enqueue("ip-pin-pg-q", { secret: "row-ip-pin-pg" });
+    await b.breakGlass.policy.set("_blamejs_jobs", {
+      columns: ["payload"], factors: ["totp"], maxRowsPerGrant: 5,
+      pinIp: true, sessionPin: false,
+    });
+    var totp = _validTotp();
+    // Mint behind the trusted proxy: peer 10.0.0.9 trusted → pin to the
+    // forwarded client 203.0.113.7, NOT the proxy address.
+    var grant = await b.breakGlass.grant({
+      req:    _fakeReq({ socket: { remoteAddress: "10.0.0.9" }, headers: { "x-forwarded-for": "203.0.113.7" } }),
+      table:  "_blamejs_jobs",
+      reason: "ip-pin peer-gated: minting behind trusted proxy for the real client",
+      factor: { type: "totp", code: totp.code, secret: totp.secret },
+    });
+
+    // Direct attacker forging the client IP via XFF (untrusted peer) → refused.
+    var threwSpoof = null;
+    try {
+      await b.breakGlass.unsealRow(grant, "_blamejs_jobs", jid.jobId,
+        { req: _fakeReq({ socket: { remoteAddress: "198.51.100.66" }, headers: { "x-forwarded-for": "203.0.113.7" } }) });
+    } catch (e) { threwSpoof = e; }
+    check("ip-pin peer-gated: forged XFF redeem refused",
+          threwSpoof && /breakglass\/grant-ip-mismatch/.test(threwSpoof.code));
+
+    // Legitimate redeem through the proxy → succeeds (resolves to 203.0.113.7).
+    var ok = await b.breakGlass.unsealRow(grant, "_blamejs_jobs", jid.jobId,
+      { req: _fakeReq({ socket: { remoteAddress: "10.0.0.9" }, headers: { "x-forwarded-for": "203.0.113.7" } }) });
+    check("ip-pin peer-gated: proxied redeem of real client succeeds",
+          ok && ok.payload && ok.payload.indexOf("row-ip-pin-pg") !== -1);
+
+    try { await b.queue.shutdown({ timeoutMs: 200 }); } catch (_e) {}
+  } finally {
+    await teardownTestDb(tmpDir);
+  }
+}
+
 async function testSessionPinEnforcement() {
   var tmpDir = _tmp();
   await setupTestDb(tmpDir);
@@ -1079,6 +1137,7 @@ async function run() {
   await testSweepExpiredGrants();
   // grant binding enforcement (IP / session pin + fail-closed) + TOTP replay
   await testIpPinEnforcement();
+  await testIpPinPeerGated();
   await testSessionPinEnforcement();
   await testIpPinFailClosedOnNullBinding();
   await testTotpReplayDefense();

package/lib/vendor/blamejs/test/layer-0-primitives/clear-site-data.test.js

@@ -61,6 +61,18 @@ function testUnknownTokenRefused() {
   try { b.middleware.clearSiteData({ types: ["bogus"] }); }
   catch (e) { threw = e instanceof TypeError && /unknown type/.test(e.message); }
   check("clearSiteData: unknown token refused at config-time", threw);
+
+  // B13: an Object.prototype member name must NOT pass the allowlist. A bracket
+  // lookup on the plain-object KNOWN_TYPES resolved inherited functions to
+  // truthy, so "toString" / "constructor" / "hasOwnProperty" slipped through and
+  // were emitted as bogus directives (prototype shadowing).
+  var csd = b.middleware._modules.clearSiteData;
+  ["toString", "constructor", "hasOwnProperty", "__proto__", "valueOf"].forEach(function (proto) {
+    var t2 = false;
+    try { csd.headerValue([proto]); }
+    catch (e) { t2 = e instanceof TypeError && /unknown type/.test(e.message); }
+    check("clearSiteData: prototype member '" + proto + "' refused (no proto-shadow)", t2);
+  });
 }
 
 function testEmptyArrayRefused() {

package/lib/vendor/blamejs/test/layer-0-primitives/cluster-storage.test.js

@@ -102,12 +102,52 @@ async function testTransactionRejectsBadArg() {
   check("tx: non-function arg rejected", threw && threw.code === "cluster-storage/bad-arg");
 }
 
+// A WITH (CTE) read must reach the caller's row set. The local-exec method
+// choice keyed on a leading "SELECT" mis-routed "WITH c AS (...) SELECT ..." to
+// .run(), which on node:sqlite returns only a changes count and SILENTLY DROPS
+// the rows — the caller saw an empty result. The classifier now resolves the
+// CTE's effective verb so the read uses .all().
+async function testCteReadReturnsRows() {
+  var tmp = fs.mkdtempSync(path.join(os.tmpdir(), "cs-cte-read-"));
+  try {
+    await setupTestDb(tmp, SCHEMA);
+    var cs = b.clusterStorage;
+    await cs.execute("INSERT INTO cs_tx_t (k, v) VALUES (?, ?)", ["a", 1]);
+    await cs.execute("INSERT INTO cs_tx_t (k, v) VALUES (?, ?)", ["b", 2]);
+
+    // Plain SELECT control — already worked.
+    var plain = await cs.execute("SELECT k, v FROM cs_tx_t ORDER BY k");
+    check("plain SELECT returns both rows", plain.rows.length === 2);
+
+    // CTE read — the regression. Was: rows.length === 0 (rows dropped by .run()).
+    var cte = await cs.execute(
+      "WITH picked AS (SELECT k, v FROM cs_tx_t WHERE v >= ?) SELECT k, v FROM picked ORDER BY k", [1]);
+    check("WITH (CTE) read returns rows (not silently dropped)", cte.rows.length === 2);
+    check("WITH (CTE) read returns the actual data", cte.rows[0].k === "a" && cte.rows[1].k === "b");
+
+    // executeOne over a CTE read resolves the single row too.
+    var one = await cs.executeOne(
+      "WITH t AS (SELECT COUNT(*) AS n FROM cs_tx_t) SELECT n FROM t");
+    check("executeOne over a CTE read resolves the row", one && one.n === 2);
+
+    // A WITH (CTE) write still applies its changes (not mis-read as a query).
+    await cs.execute(
+      "WITH src AS (SELECT 'c' AS k, 3 AS v) INSERT INTO cs_tx_t (k, v) SELECT k, v FROM src");
+    var after = await cs.executeOne("SELECT COUNT(*) AS n FROM cs_tx_t");
+    check("WITH (CTE) write persisted its row", after.n === 3);
+  } finally {
+    b.db._resetForTest();
+    await teardownTestDb(tmp);
+  }
+}
+
 async function run() {
   testSurface();
   await testTransactionCommits();
   await testTransactionRollsBackOnThrow();
   await testTransactionSerializesExecute();
   await testTransactionRejectsBadArg();
+  await testCteReadReturnsRows();
 }
 
 module.exports = { run: run };