@blamejs/blamejs-shop 0.4.69 → 0.4.71

package/lib/vendor/blamejs/test/layer-0-primitives/atomic-file-write-excl.test.js

@@ -0,0 +1,132 @@
+"use strict";
+/**
+ * b.atomicFile.writeExclSync — staged exclusive, symlink-refusing write
+ * (CWE-377 insecure temp / CWE-59 symlink follow).
+ *
+ * The non-renaming sibling of writeSync, for write→verify→rename flows
+ * (vault seal/unseal/rotate stage the bytes, re-read + decrypt-verify them,
+ * THEN rename into place). It must: write the bytes straight to the given
+ * path (no rename of its own), clear any stale leftover first, and refuse to
+ * follow a symlink pre-planted at the path — a bare writeFileSync would
+ * follow it (arbitrary write) or truncate a planted file.
+ *
+ * Coverage:
+ *   - round-trip (bytes land at the path verbatim, bytesWritten correct)
+ *   - a stale regular file at the path is cleared + replaced (retry-safe)
+ *   - invalid data type is refused (atomic-file/invalid-data)
+ *   - a symlink at the path is NOT followed: the link is removed and a fresh
+ *     regular file is created, the symlink's target left untouched (POSIX;
+ *     skipped where the platform lacks symlink privilege)
+ */
+
+var fs   = require("fs");
+var path = require("path");
+
+var helpers = require("../helpers");
+var b       = helpers.b;
+var check   = helpers.check;
+
+function _tmpDir() {
+  return b.testing.tempDir("atomicfile-writeexcl");
+}
+
+function testRoundTrips() {
+  var dir = _tmpDir();
+  try {
+    var p = path.join(dir.path, "staged.bin");
+    var payload = Buffer.from("staged bytes ✓ multibyte", "utf8");
+    var res = b.atomicFile.writeExclSync(p, payload, { fileMode: 0o600 });
+    check("writeExclSync: bytesWritten matches", res.bytesWritten === payload.length);
+    check("writeExclSync: file written at the path verbatim (no rename)",
+          fs.existsSync(p) && fs.readFileSync(p).equals(payload));
+  } finally {
+    dir.cleanup();
+  }
+}
+
+function testClearsStale() {
+  var dir = _tmpDir();
+  try {
+    var p = path.join(dir.path, "staged.bin");
+    // An aborted prior run left a stale staging file at the (predictable) path.
+    fs.writeFileSync(p, "STALE LEFTOVER FROM A CRASHED RUN", { mode: 0o600 });
+    var payload = Buffer.from("fresh", "utf8");
+    b.atomicFile.writeExclSync(p, payload, { fileMode: 0o600 });
+    check("writeExclSync: stale leftover cleared + replaced (retry-safe)",
+          fs.readFileSync(p).equals(payload));
+  } finally {
+    dir.cleanup();
+  }
+}
+
+function testInvalidDataRefused() {
+  var dir = _tmpDir();
+  try {
+    var p = path.join(dir.path, "nope.bin");
+    var code = null;
+    try { b.atomicFile.writeExclSync(p, { not: "bytes" }); }
+    catch (e) { code = e && e.code; }
+    check("writeExclSync: non-buffer/string data refused", code === "atomic-file/invalid-data");
+  } finally {
+    dir.cleanup();
+  }
+}
+
+function testSymlinkNotFollowed() {
+  var dir = _tmpDir();
+  try {
+    var victim = path.join(dir.path, "victim-secret.txt");
+    fs.writeFileSync(victim, "SECRET", { mode: 0o600 });
+    var staged = path.join(dir.path, "staged.tmp");
+
+    var symlinkOk = true;
+    try { fs.symlinkSync(victim, staged); }
+    catch (_e) { symlinkOk = false; }
+
+    if (!symlinkOk) {
+      check("writeExclSync: symlink case skipped (platform lacks symlink privilege)", true);
+      return;
+    }
+
+    var payload = Buffer.from("staged-not-through-the-link", "utf8");
+    b.atomicFile.writeExclSync(staged, payload, { fileMode: 0o600 });
+
+    // staged is now a regular file with the new bytes (the link was unlinked,
+    // then a fresh file created). O_NOFOLLOW would have failed the open if the
+    // link had survived. Take type + bytes from one no-follow fd (no race).
+    var fd = fs.openSync(staged, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW || 0));
+    try {
+      var st = fs.fstatSync(fd);
+      check("writeExclSync: path is a regular file after write",
+            st.isFile() && !st.isSymbolicLink());
+      var buf = Buffer.alloc(st.size);
+      var got = 0;
+      while (got < st.size) {
+        var n = fs.readSync(fd, buf, got, st.size - got, null);
+        if (n === 0) break;
+        got += n;
+      }
+      check("writeExclSync: path holds the new bytes", buf.equals(payload));
+    } finally {
+      fs.closeSync(fd);
+    }
+    check("writeExclSync: symlink target (victim) NOT written through",
+          fs.readFileSync(victim, "utf8") === "SECRET");
+  } finally {
+    dir.cleanup();
+  }
+}
+
+async function run() {
+  testRoundTrips();
+  testClearsStale();
+  testInvalidDataRefused();
+  testSymlinkNotFollowed();
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  run().then(function () { console.log("OK"); })
+       .catch(function (e) { console.error(e.stack || e); process.exit(1); });
+}

package/lib/vendor/blamejs/test/layer-0-primitives/atomic-file-write-stream.test.js

@@ -0,0 +1,181 @@
+"use strict";
+/**
+ * b.atomicFile.writeStream — streaming sibling of writeSync (CWE-377
+ * insecure temporary file / CWE-59 symlink follow).
+ *
+ * A plain fs.createWriteStream(dest) follows a symlink an attacker planted
+ * at `dest` (arbitrary write outside the intended tree) and leaves a
+ * half-written file at the canonical name if the source aborts mid-stream.
+ * writeStream stages the bytes into a CSPRNG-named sibling temp opened
+ * O_EXCL | O_NOFOLLOW, fsyncs, then atomically renames over `dest` — so the
+ * file appears at `dest` only after the full stream lands, and a symlink at
+ * `dest` is replaced by the rename rather than followed.
+ *
+ * Coverage:
+ *   - stream round-trip (exact bytes, bytesWritten, no orphan temp)
+ *   - a non-stream source is refused (atomic-file/invalid-source)
+ *   - maxBytes overflow rejects, writes NO file, leaves no orphan temp
+ *   - a source that errors mid-stream leaves NO file + no orphan temp
+ *   - a symlink at the destination is replaced by the rename, not followed
+ *     (POSIX only — Windows without symlink privilege skips that assertion)
+ */
+
+var fs   = require("fs");
+var path = require("path");
+var { Readable } = require("node:stream");
+
+var helpers = require("../helpers");
+var b       = helpers.b;
+var check   = helpers.check;
+
+function _tmpDir() {
+  return b.testing.tempDir("atomicfile-writestream");
+}
+
+function _orphans(dirPath, base) {
+  return fs.readdirSync(dirPath).filter(function (n) {
+    return n.indexOf(base + ".tmp-") === 0;
+  });
+}
+
+// A Readable that emits one chunk then errors — models an upstream that
+// aborts mid-transfer (dropped socket, decompression bomb tripwire, etc.).
+function _erroringSource() {
+  var emitted = false;
+  return new Readable({
+    read: function () {
+      if (!emitted) { emitted = true; this.push(Buffer.from("partial")); }
+      else { this.destroy(new Error("upstream aborted mid-stream")); }
+    },
+  });
+}
+
+async function testStreamRoundTrips() {
+  var dir = _tmpDir();
+  try {
+    var p = path.join(dir.path, "obj.bin");
+    var payload = Buffer.from("streamed payload ✓ with multibyte", "utf8");
+    var res = await b.atomicFile.writeStream(p, Readable.from([payload]), { fileMode: 0o600 });
+    check("writeStream: bytesWritten matches", res.bytesWritten === payload.length);
+    check("writeStream: dest exists",          fs.existsSync(p));
+    check("writeStream: content round-trips",  fs.readFileSync(p).equals(payload));
+    check("writeStream: no temp file leaked",  _orphans(dir.path, "obj.bin").length === 0);
+
+    // Chunked source reassembles in order.
+    var p2 = path.join(dir.path, "chunked.bin");
+    var chunks = [Buffer.from("aaa"), Buffer.from("bbb"), Buffer.from("ccc")];
+    var res2 = await b.atomicFile.writeStream(p2, Readable.from(chunks));
+    check("writeStream: chunked bytesWritten matches", res2.bytesWritten === 9);
+    check("writeStream: chunked content in order", fs.readFileSync(p2, "utf8") === "aaabbbccc");
+  } finally {
+    dir.cleanup();
+  }
+}
+
+async function testInvalidSourceRefused() {
+  var dir = _tmpDir();
+  try {
+    var p = path.join(dir.path, "nope.bin");
+    var code = null;
+    try { await b.atomicFile.writeStream(p, Buffer.from("not a stream")); }
+    catch (e) { code = e && e.code; }
+    check("writeStream: non-stream source refused", code === "atomic-file/invalid-source");
+    check("writeStream: nothing written for invalid source", !fs.existsSync(p));
+  } finally {
+    dir.cleanup();
+  }
+}
+
+async function testMaxBytesOverflow() {
+  var dir = _tmpDir();
+  try {
+    var p = path.join(dir.path, "toobig.bin");
+    var big = Buffer.alloc(1024, 0x41); // 1 KiB
+    var code = null;
+    try {
+      await b.atomicFile.writeStream(p, Readable.from([big]), { maxBytes: 16 });
+    } catch (e) { code = e && e.code; }
+    check("writeStream: overflow rejected with too-large", code === "atomic-file/too-large");
+    check("writeStream: overflow wrote NO file at dest", !fs.existsSync(p));
+    check("writeStream: overflow left no orphan temp", _orphans(dir.path, "toobig.bin").length === 0);
+  } finally {
+    dir.cleanup();
+  }
+}
+
+async function testMidStreamErrorLeavesNothing() {
+  var dir = _tmpDir();
+  try {
+    var p = path.join(dir.path, "aborted.bin");
+    var threw = false;
+    try { await b.atomicFile.writeStream(p, _erroringSource()); }
+    catch (_e) { threw = true; }
+    check("writeStream: mid-stream error propagates", threw);
+    check("writeStream: aborted stream wrote NO file at dest", !fs.existsSync(p));
+    check("writeStream: aborted stream left no orphan temp", _orphans(dir.path, "aborted.bin").length === 0);
+  } finally {
+    dir.cleanup();
+  }
+}
+
+async function testSymlinkAtDestinationReplacedNotFollowed() {
+  var dir = _tmpDir();
+  try {
+    var victim = path.join(dir.path, "outside-victim.bin");
+    fs.writeFileSync(victim, "DO NOT OVERWRITE", { mode: 0o600 });
+    var dest = path.join(dir.path, "dest-link.bin");
+
+    var symlinkOk = true;
+    try { fs.symlinkSync(victim, dest); }
+    catch (_e) { symlinkOk = false; }
+
+    if (!symlinkOk) {
+      check("writeStream: dest-symlink case skipped (platform lacks symlink privilege)", true);
+      return;
+    }
+
+    var payload = Buffer.from("fresh streamed contents", "utf8");
+    await b.atomicFile.writeStream(dest, Readable.from([payload]));
+
+    // Open ONE no-follow fd and take both the type check (fstat) and the
+    // bytes from it — no lstat-then-read race (CWE-367). O_NOFOLLOW makes the
+    // open fail if dest were still a symlink, so a successful open already
+    // proves the rename replaced the link with a regular file.
+    var destFd = fs.openSync(dest, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW || 0));
+    try {
+      var fst = fs.fstatSync(destFd);
+      check("writeStream: destination is a regular file after write",
+            fst.isFile() && !fst.isSymbolicLink());
+      var destBytes = Buffer.alloc(fst.size);
+      var got = 0;
+      while (got < fst.size) {
+        var n = fs.readSync(destFd, destBytes, got, fst.size - got, null);
+        if (n === 0) break;
+        got += n;
+      }
+      check("writeStream: destination holds the new bytes",
+            got === payload.length && destBytes.equals(payload));
+    } finally {
+      fs.closeSync(destFd);
+    }
+    check("writeStream: symlink target (victim) untouched",
+          fs.readFileSync(victim, "utf8") === "DO NOT OVERWRITE");
+  } finally {
+    dir.cleanup();
+  }
+}
+
+async function run() {
+  await testStreamRoundTrips();
+  await testInvalidSourceRefused();
+  await testMaxBytesOverflow();
+  await testMidStreamErrorLeavesNothing();
+  await testSymlinkAtDestinationReplacedNotFollowed();
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  run().then(function () { console.log("OK"); })
+       .catch(function (e) { console.error(e.stack || e); process.exit(1); });
+}

package/lib/vendor/blamejs/test/layer-0-primitives/audit-chain-corrupted-anchor.test.js

@@ -0,0 +1,65 @@
+"use strict";
+/**
+ * b.auditChain.verifyChain — a corrupted / tampered purge anchor must fail
+ * CLOSED with a clear { ok:false, reason }, not throw. The anchor's
+ * lastPurgedRowHash seeds prevHash; a non-128-hex value used to flow into
+ * computeRowHash, which throws "prevHash must be a 128-char hex" — turning a
+ * defensive verify into an uncaught exception. A non-numeric lastPurgedCounter
+ * (NaN) would skip nothing and surface as an opaque chain-break.
+ *
+ * Driven through a mock queryAllAsync (no DB) — the fix returns before the
+ * chain-rows query, so the rows mock is irrelevant.
+ */
+
+var helpers = require("../helpers");
+var b       = helpers.b;
+var check   = helpers.check;
+
+function _mockQuery(anchorRow) {
+  return function (sql /*, params */) {
+    if (typeof sql === "string" && sql.indexOf("purge_anchor") !== -1) {
+      return Promise.resolve(anchorRow ? [anchorRow] : []);
+    }
+    // Chain-rows query — a single plausible row (never reached on a corrupt
+    // anchor, but present so the non-corrupt branch could walk).
+    return Promise.resolve([]);
+  };
+}
+
+async function _verify(anchorRow) {
+  var threw = null, result = null;
+  try { result = await b.auditChain.verifyChain(_mockQuery(anchorRow), "audit_log", {}); }
+  catch (e) { threw = e; }
+  return { threw: threw, result: result };
+}
+
+async function run() {
+  // Non-hex lastPurgedRowHash → { ok:false, reason }, NOT a throw.
+  var bad1 = await _verify({ lastPurgedRowHash: "GARBAGE-not-hex", lastPurgedCounter: "5" });
+  check("corrupted anchor (non-hex hash) does not throw", bad1.threw === null);
+  check("corrupted anchor (non-hex hash) → ok:false", bad1.result && bad1.result.ok === false);
+  check("corrupted anchor → reason names the anchor",
+        bad1.result && /anchor/i.test(bad1.result.reason || ""));
+
+  // Wrong-length hex hash → also refused.
+  var bad2 = await _verify({ lastPurgedRowHash: "abcd", lastPurgedCounter: "1" });
+  check("corrupted anchor (short hash) → ok:false, no throw",
+        bad2.threw === null && bad2.result && bad2.result.ok === false);
+
+  // Non-numeric lastPurgedCounter → refused (NaN would skip nothing).
+  var validHash = b.auditChain.ZERO_HASH;
+  var bad3 = await _verify({ lastPurgedRowHash: validHash, lastPurgedCounter: "not-a-number" });
+  check("corrupted anchor (non-numeric counter) → ok:false, no throw",
+        bad3.threw === null && bad3.result && bad3.result.ok === false);
+
+  // No anchor at all (never purged) → verifies the (empty) chain fine, ok:true.
+  var none = await _verify(null);
+  check("no purge anchor → verifies cleanly (ok:true)", none.threw === null && none.result && none.result.ok === true);
+
+  console.log("[audit-chain-corrupted-anchor] OK — " + helpers.getChecks() + " checks passed");
+}
+
+module.exports = { run: run };
+if (require.main === module) {
+  run().then(function () {}, function (e) { console.error("FAIL: " + helpers.formatErr(e)); process.exit(1); });
+}

package/lib/vendor/blamejs/test/layer-0-primitives/audit-chain-incremental-verify.test.js

@@ -0,0 +1,83 @@
+"use strict";
+/**
+ * b.auditChain.verifyChain({ from, to }) — incremental audit-chain verify.
+ *
+ * verify() advertises from/to (start/end monotonicCounter) for "incremental
+ * verify after a known-good checkpoint", but verifyChain ignored them and always
+ * walked the whole chain. The fix scopes the walk to [from, to] and anchors
+ * `from` on the predecessor row's rowHash so the scoped chain math is correct.
+ * Security-critical: an in-range tamper MUST be caught; an out-of-range tamper is
+ * (correctly) out of scope for an incremental verify.
+ *
+ * Driven through a mock queryAllAsync over a synthetic, genuinely-chained set of
+ * rows (audit_log is append-only, so a real UPDATE can't forge a tamper).
+ */
+
+var helpers = require("../helpers");
+var b     = helpers.b;
+var check = helpers.check;
+
+var ac = b.auditChain;
+
+function _mkChain(n) {
+  var rows = [];
+  var prev = ac.ZERO_HASH;
+  for (var i = 1; i <= n; i++) {
+    var nonce = Buffer.alloc(16, i);
+    var fields = { monotonicCounter: i, action: "test.row", outcome: "success" };
+    var rowHash = ac.computeRowHash(prev, fields, nonce);
+    rows.push(Object.assign({}, fields, { prevHash: prev, rowHash: rowHash, nonce: nonce }));
+    prev = rowHash;
+  }
+  return rows;
+}
+
+function _mockQuery(chainRows) {
+  return function (sql) {
+    if (typeof sql === "string" && sql.indexOf("purge_anchor") !== -1) return Promise.resolve([]);
+    // Return a shallow copy so verifyChain's coerce/filter can't mutate ours.
+    return Promise.resolve(chainRows.map(function (r) { return Object.assign({}, r); }));
+  };
+}
+
+async function _verify(chainRows, opts) {
+  return await ac.verifyChain(_mockQuery(chainRows), "audit_log", opts || {});
+}
+
+async function run() {
+  var chain = _mkChain(6);
+
+  check("full verify of a clean chain → ok", (await _verify(chain)).ok === true);
+  // Incremental from a mid counter: must anchor on row 3's rowHash. A naive
+  // ZERO_HASH anchor would falsely report a prevHash break on row 4.
+  check("incremental {from:4} on clean chain → ok (predecessor-anchored)",
+        (await _verify(chain, { from: 4 })).ok === true);
+  check("bounded {to:3} on clean chain → ok", (await _verify(chain, { to: 3 })).ok === true);
+  check("windowed {from:3,to:5} on clean chain → ok", (await _verify(chain, { from: 3, to: 5 })).ok === true);
+
+  // Tamper row 5 (counter 5): flip a hashed field so its stored rowHash no
+  // longer matches the recompute.
+  var tampered = chain.map(function (r) { return Object.assign({}, r); });
+  tampered[4].outcome = "TAMPERED";   // counter 5
+
+  check("full verify catches the tamper", (await _verify(tampered)).ok === false);
+  check("incremental {from:4} catches in-range tamper (counter 5)",
+        (await _verify(tampered, { from: 4 })).ok === false);
+  // Counter 5 is below from=6 → out of scope for that incremental verify.
+  check("incremental {from:6} → ok (tamper at 5 out of scope)",
+        (await _verify(tampered, { from: 6 })).ok === true);
+  // Counter 5 is above to=4 → out of the window.
+  check("bounded {to:4} → ok (tamper at 5 above the window)",
+        (await _verify(tampered, { to: 4 })).ok === true);
+
+  // rowsVerified reflects the scoped count, not the whole chain.
+  var inc = await _verify(chain, { from: 4 });
+  check("incremental rowsVerified is the scoped count (3 rows: 4,5,6)", inc.rowsVerified === 3);
+
+  console.log("[audit-chain-incremental-verify] OK — " + helpers.getChecks() + " checks passed");
+}
+
+module.exports = { run: run };
+if (require.main === module) {
+  run().then(function () {}, function (e) { console.error("FAIL: " + helpers.formatErr(e)); process.exit(1); });
+}

package/lib/vendor/blamejs/test/layer-0-primitives/audit-daily-review.test.js

@@ -11,7 +11,15 @@ function _fakeAudit(rows) {
   var emitted = [];
   return {
     safeEmit: function (event) { emitted.push(event); },
-    query:    async function () { return rows.slice(); },
+    // Honor order + limit like the real audit.query so order/limit behavior is
+    // testable: sort by recordedAt (asc), flip on order:"desc", then slice.
+    query:    async function (criteria) {
+      criteria = criteria || {};
+      var out = rows.slice().sort(function (a, b) { return (a.recordedAt || 0) - (b.recordedAt || 0); });
+      if (criteria.order === "desc") out.reverse();
+      if (criteria.limit != null) out = out.slice(0, criteria.limit);
+      return out;
+    },
     _emitted: emitted,
   };
 }
@@ -124,6 +132,43 @@ async function testNotifyFailure() {
         }));
 }
 
+async function testCustomClassifyUnknownSeverityIncluded() {
+  // A custom classify() returning an UNKNOWN severity must not silently drop
+  // the event from the review — it is surfaced (fail safe) so a buggy classify
+  // can't hide flagged events. (Was: _severityAtLeast returned false on an
+  // unrecognized severity, dropping the hit.)
+  var rows = [{ action: "weird.event", outcome: "denied", recordedAt: Date.now() }];
+  var fakeAudit = _fakeAudit(rows);
+  var review = b.auditDailyReview.create({
+    audit:             fakeAudit,
+    severityThreshold: "warning",
+    notify:            null,
+    classify:          function () { return "totally-unknown-severity"; },
+  });
+  var summary = await review.run();
+  check("unknown-severity event surfaced, not silently dropped", summary.hitCount >= 1);
+}
+
+async function testQueryLimitKeepsNewest() {
+  // B5a: under a queryLimit cap the review must keep the NEWEST events (the
+  // actionable ones), not the oldest. An ascending+limit query would keep the
+  // oldest and silently drop the newest threshold-exceeding events.
+  var nowMs = Date.now();
+  var rows = [
+    { action: "test.old1",          outcome: "success", recordedAt: nowMs - 3000 },  // info (below warning)
+    { action: "test.old2",          outcome: "success", recordedAt: nowMs - 2000 },  // info
+    { action: "honeytoken.tripped", outcome: "denied",  recordedAt: nowMs - 100 },   // NEWEST → alert (>= warning)
+  ];
+  var fakeAudit = _fakeAudit(rows);
+  var review = b.auditDailyReview.create({
+    audit: fakeAudit, severityThreshold: "warning", notify: null, queryLimit: 2,
+  });
+  var summary = await review.run();
+  // Newest-2 kept (honeytoken alert + old2) → the alert is surfaced. With the
+  // old asc+limit behavior the oldest-2 (both info) survive → alert dropped → 0.
+  check("queryLimit keeps newest events (alert not dropped by cap)", summary.hitCount >= 1);
+}
+
 async function run() {
   testSurface();
   await testRunSummary();
@@ -131,6 +176,8 @@ async function run() {
   testPostureRequiresNotify();
   testBadSeverity();
   await testNotifyFailure();
+  await testCustomClassifyUnknownSeverityIncluded();
+  await testQueryLimitKeepsNewest();
 }
 
 module.exports = { run: run };

package/lib/vendor/blamejs/test/layer-0-primitives/audit-signing-key-rotation.test.js

@@ -151,9 +151,19 @@ async function run() {
     // both signatures valid under their own public key. This proves the
     // history is genuinely cross-key, so the verify path below is the real
     // test (not an artifact of identical keys).
-    var rows = await clusterStorage.executeAll(
-      "SELECT * FROM audit_checkpoints ORDER BY atMonotonicCounter ASC"
-    );
+    // Both checkpoint() calls above are awaited, but on a contended /
+    // virtualized filesystem (Windows CI) the just-committed checkpoint row can
+    // lag the immediate read-back. Poll for both to be visible (poll, don't
+    // sleep) before the exact-count assertion — a genuine missing checkpoint
+    // still fails via the waitUntil timeout, and a spurious extra row still
+    // fails the `=== 2` below, so this hardens the read without masking a bug.
+    var rows = [];
+    await helpers.waitUntil(async function () {
+      rows = await clusterStorage.executeAll(
+        "SELECT * FROM audit_checkpoints ORDER BY atMonotonicCounter ASC"
+      );
+      return rows.length >= 2;
+    }, { timeoutMs: 5000, label: "audit-keyrot: both checkpoints visible in audit_checkpoints" });
     check("two checkpoints are stored", rows.length === 2);
     var c1 = rows[0], c2 = rows[1];
     var p1 = _checkpointPayloadFor(c1);