@blamejs/blamejs-shop 0.4.87 → 0.4.88

package/lib/vendor/blamejs/oss-fuzz/projects/blamejs/Dockerfile

@@ -5,6 +5,11 @@
 # and open a PR there. See `oss-fuzz/projects/blamejs/README.md` in
 # this repo for the full submission procedure.
 
+# The base-builder is intentionally NOT digest-pinned here (unlike the
+# .clusterfuzzlite/ copy): OSS-Fuzz's build infra expects projects to track
+# the latest base-builder so the fuzzing toolchain stays current, and a digest
+# pin in the upstream-submission template would diverge from that convention.
+# This is a CI-only fuzzing image, never deployed.
 FROM gcr.io/oss-fuzz-base/base-builder-javascript
 
 # Clone the framework into the build context. OSS-Fuzz builds against

package/lib/vendor/blamejs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.15.16",
+  "version": "0.15.19",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/lib/vendor/blamejs/release-notes/v0.15.17.json

@@ -0,0 +1,52 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.15.17",
+  "date": "2026-06-22",
+  "headline": "The job queue runs on a Postgres or MySQL cluster backend, and a set of correctness and confidentiality fixes land for encrypted-API rejections, flow-job ordering, the self-update signature verifier, and bounded file reads",
+  "summary": "The local job queue's lease path is now dialect-aware, so the queue works when its store is a Postgres or MySQL cluster backend rather than only single-node SQLite. The previous lease was a single SQLite-only statement: it double-quoted identifiers (which MySQL reads as string literals), updated a table named in its own subquery (MySQL error 1093), and used RETURNING (which MySQL rejects), so the first enqueue or lease against a cluster backend failed outright. The lease now resolves the active backend dialect and composes per-dialect SQL — a transactional SELECT ... FOR UPDATE SKIP LOCKED claim over the head of the queue followed by a guarded UPDATE against a literal id list, returning the claimed rows via RETURNING on Postgres and a re-select on MySQL — with backtick (MySQL) or double-quote (Postgres) identifier quoting, mirroring the framework's outbox claim. enqueue, lease, complete, fail, sweep, and dead-letter all run against the cluster backend, verified end-to-end against live MySQL and Postgres. Alongside the queue work: a request rejected on an established encrypted-API session is now returned inside the session envelope instead of leaking the rejection reason in cleartext; a flow child that declares dependencies can no longer be leased before those dependencies run during the brief window of the two-pass flow enqueue; the standalone self-update verifier classifies an ECDSA signature's encoding by its ASN.1 structure rather than its byte length and fails closed on an indeterminate shape; the self-update poller surfaces each asset's content digest; and the bounded synchronous file reader routes every failure branch through its typed error mapper.",
+  "sections": [
+    {
+      "heading": "Fixed",
+      "items": [
+        {
+          "title": "The job queue's lease runs dialect-correct SQL on a Postgres or MySQL cluster backend",
+          "body": "When the queue's store is a cluster backend, the lease previously failed at the first enqueue or claim: it was composed as one SQLite-only statement that double-quoted column identifiers (a syntax error on MySQL, which treats double quotes as string literals), updated the jobs table from a subquery that named the same table (MySQL error 1093), and relied on RETURNING (which MySQL does not support). The lease now resolves the active backend dialect and builds per-dialect SQL — a transactional SELECT ... FOR UPDATE SKIP LOCKED over the head of the queue, then a guarded UPDATE ... WHERE status = 'pending' AND id IN (...) with a literal id list (no self-referencing subquery), reading the claimed rows back via RETURNING on Postgres and a re-select by id on MySQL — and quotes identifiers with backticks on MySQL and double quotes on Postgres. enqueue, lease, complete, fail, sweep, and the dead-letter operations now work against a cluster backend, with sealed-at-rest job payloads round-tripping correctly; single-node SQLite continues to use the original single-statement claim. The behavior is verified end-to-end against live MySQL and Postgres."
+        },
+        {
+          "title": "Encrypted-API rejections that would disclose session state ride the session envelope",
+          "body": "On a per-session encrypted API channel, a rejection that reveals session state — an expired or rotated session, or a request admitted past the replay gate whose ciphertext then failed authentication — returned its reason as cleartext JSON, disclosing which check failed to a network observer of an otherwise-encrypted channel. Those rejections are now encrypted inside the session envelope under the response counter the server persists for them. The generic 'rejected' refusals that carry no session-lifecycle detail (a stale or duplicate request counter) stay plaintext: they reveal nothing a 400 status does not, and encrypting them would consume a response counter the server does not persist on those paths — desyncing the session's monotonic counter and bricking it for the next genuine request. Pre-session handshake failures (a malformed bootstrap, a stale timestamp, an unknown session) also remain plaintext, since no key exists yet to encrypt under."
+        },
+        {
+          "title": "A flow child with dependencies can no longer be leased before its dependencies",
+          "body": "b.queue.enqueueFlow inserts a flow's children in two passes (the second resolves dependency names to the sibling job ids assigned in the first). The first pass previously enqueued every child as immediately leaseable and relied on the second pass to park the dependency-bearing children, leaving a window in which a consumer polling between the two passes could lease a child before the jobs it depends on had run. A dependency-bearing child is now parked at enqueue time on the first pass, so it is never leaseable in that window; the second pass only rewrites its dependency names to the resolved job ids. Children with no dependencies remain immediately leaseable."
+        },
+        {
+          "title": "The self-update poller carries each asset's content digest",
+          "body": "b.selfUpdate.poll() now includes the content digest for each asset and its detached signature in the result it returns, so a caller can verify a downloaded asset against the digest advertised by the release feed."
+        },
+        {
+          "title": "Bounded file reads always return the typed error shape",
+          "body": "The bounded synchronous file reader could surface an unmapped error on a few failure branches — a refused symlink whose target had since been removed, a short read, an integrity mismatch — rather than the typed error its callers expect. Every failure branch now passes through the reader's error mapper, so a caller always receives the documented error kind."
+        }
+      ]
+    },
+    {
+      "heading": "Changed",
+      "items": [
+        {
+          "title": "Bundled Public Suffix List refreshed to current upstream",
+          "body": "The vendored Mozilla Public Suffix List — which b.publicSuffix uses to derive organizational domains for DMARC (psd= / np=), BIMI, cookie-scope checks, and same-site policy — is refreshed to the latest upstream revision. Domain classification reflects recent additions and removals to the list."
+        }
+      ]
+    },
+    {
+      "heading": "Security",
+      "items": [
+        {
+          "title": "The standalone self-update verifier detects ECDSA signature encoding by structure",
+          "body": "The standalone update-signature verifier inferred whether an ECDSA signature was DER- or IEEE-P1363-encoded from its byte length — a heuristic two distinct encodings can collide on, which could lead a valid-but-misclassified signature to be parsed under the wrong scheme. It now parses the signature's ASN.1 structure to classify the encoding and fails closed on an indeterminate shape rather than guessing."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/release-notes/v0.15.18.json

@@ -0,0 +1,49 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.15.18",
+  "date": "2026-06-22",
+  "headline": "OCSP response-freshness enforcement is restored, DPoP request-URI reconstruction peer-gates forwarded headers, and container/tool supply-chain pinning is tightened",
+  "summary": "Three hardening fixes. The stapled-OCSP evaluator parsed each response's thisUpdate / nextUpdate with Date.parse, but those fields are already numeric (unix-ms), so Date.parse returned NaN — the freshness guard then rejected every signature-valid response, fresh or stale, with a misleading \"missing thisUpdate\", and the real future-dated / past-nextUpdate window checks (RFC 6960 §4.2.2.1) were unreachable dead code. b.network.tls.ocsp.evaluate / requireGood now read the numeric fields directly: a stale or future-dated response is refused and a fresh \"good\" response is accepted, so OCSP stapling validation works again. b.middleware.dpop reconstructed the absolute request URI — the cryptographically-bound htu — trusting X-Forwarded-Proto / X-Forwarded-Host from any caller whenever trustForwardedHeaders was set, so a direct attacker could forge the scheme or authority and make a proof signed for one origin validate against another; both now resolve through the peer-gated b.requestHelpers.trustedProtocol / trustedHost (honored only from a declared trusted-proxy peer), matching csrf-protect / security-headers / cors, and the bare trustForwardedHeaders boolean is refused. The supply-chain pass pins the wiki container and ClusterFuzzLite fuzz base images to digests (Dependabot keeps them current) and the npm-publish bundle tools to exact versions.",
+  "sections": [
+    {
+      "heading": "Security",
+      "items": [
+        {
+          "title": "OCSP response-freshness enforcement restored (RFC 6960 §4.2.2.1)",
+          "body": "The stapled-OCSP evaluator computed thisUpdate / nextUpdate via Date.parse(), but the parser hands those fields back as unix-ms NUMBERS (Date.UTC(...)). Date.parse() coerces its argument to a string and a bare-integer string is not a recognized date, so the result was always NaN: the !isFinite guard then rejected every signature-valid response — fresh OR stale — with a misleading \"missing thisUpdate\", and the genuine staleness checks (future-dated thisUpdate, past nextUpdate) sat behind it as unreachable dead code, with the stale-rejection branch latently fail-open. b.network.tls.ocsp.evaluate / requireGood now read the numeric fields directly: a stale (past-nextUpdate) or future-dated response is refused, and a fresh \"good\" response is accepted — OCSP stapling validation, and its replay defense, work again."
+        },
+        {
+          "title": "DPoP htu reconstruction peer-gates X-Forwarded-Proto and X-Forwarded-Host",
+          "body": "b.middleware.dpop rebuilds the absolute request URI (scheme + authority + path) that the proof's cryptographically-bound htu claim (RFC 9449 §4.3) is verified against. When the legacy trustForwardedHeaders: true was set it derived the scheme and host from X-Forwarded-Proto / X-Forwarded-Host trusted from ANY caller, with no immediate-peer check — a direct attacker could forge X-Forwarded-Proto: https or a victim X-Forwarded-Host and make a proof signed for one origin validate against another (htu confusion). Both now resolve through the peer-gated b.requestHelpers.trustedProtocol / trustedHost, which honor the forwarded headers only when the immediate connection is a declared trusted proxy — the same fail-closed model csrf-protect (Secure cookie), security-headers (HSTS), cors (same-origin), and bot-guard (secure context) already use. A codebase-patterns detector now flags any further middleware that reads X-Forwarded-Proto / -Host directly for a scheme/authority decision."
+        }
+      ]
+    },
+    {
+      "heading": "Added",
+      "items": [
+        {
+          "title": "b.requestHelpers.requestHost and b.requestHelpers.trustedHost",
+          "body": "Peer-gated request-authority resolvers — the host companions to requestProtocol / trustedProtocol. trustedHost(opts) returns { resolve(req) => string|null, peerGated }: with trustedProxies (CIDRs) X-Forwarded-Host is honored only from a trusted-proxy peer; with hostResolver(req) the operator owns it; with neither, only the request's own Host header is used and a forged X-Forwarded-Host is ignored. requestHost(req, opts?) is the low-level resolver (default Host-only; a peer predicate gates the forwarded header). For reconstructing an absolute request URL (a DPoP htu, an origin/issuer string, a redirect base) behind a proxy without trusting a forgeable header."
+        }
+      ]
+    },
+    {
+      "heading": "Changed",
+      "items": [
+        {
+          "title": "Container and bundle-tool supply-chain pinning tightened",
+          "body": "The wiki container's base images (cgr.dev/chainguard/node runtime + builder stages) and the ClusterFuzzLite fuzz base (gcr.io/oss-fuzz-base/base-builder-javascript) are pinned to image digests; Dependabot's docker ecosystem keeps both current, so the pin is reproducible without freezing CVE patches. The npm-publish workflow's bundle tools (esbuild, postject) are pinned to exact versions, matching CI. The OSS-Fuzz project-submission Dockerfile is intentionally left tracking the upstream base-builder, per OSS-Fuzz convention."
+        }
+      ]
+    },
+    {
+      "heading": "Migration",
+      "items": [
+        {
+          "title": "DPoP: trustForwardedHeaders is replaced by trustedProxies",
+          "body": "b.middleware.dpop no longer honors the bare trustForwardedHeaders: true boolean — it trusted forgeable X-Forwarded-Proto / X-Forwarded-Host from any caller. Behind a reverse proxy, declare your proxy CIDRs via trustedProxies: [\"10.0.0.0/8\", …] (peer-gates both headers for the htu reconstruction), or own the reconstruction via protocolResolver(req) / hostResolver(req) / getHtu(req). A bare trustForwardedHeaders: true now throws at create() with that guidance. Apps not behind a proxy need no change — the default already derives the scheme from the TLS socket and the host from the request's Host header."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/release-notes/v0.15.19.json

@@ -0,0 +1,18 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.15.19",
+  "date": "2026-06-22",
+  "headline": "Restores the wiki container build by keeping its base image on the continuously-patched rolling tag",
+  "summary": "A follow-up to 0.15.18. The framework code is unchanged from 0.15.18 — this patch reverts one part of that release's supply-chain pass: the example wiki container's Chainguard base images had been pinned to specific digests, but Chainguard rebuilds those images continuously to ship CVE fixes, so the frozen digest fell behind an upstream fix within hours and the container's Trivy CRITICAL/HIGH release gate rejected the build (a fixed npm/undici denial-of-service the rolling tag already carried). For a deployed, Trivy-gated image, tracking the rolling, always-patched tag is the correct posture; the wiki Dockerfile is back on it. The ClusterFuzzLite fuzz base (not deployed, not release-gated) stays digest-pinned with Dependabot keeping it current.",
+  "sections": [
+    {
+      "heading": "Fixed",
+      "items": [
+        {
+          "title": "Wiki container builds again on a continuously-patched base",
+          "body": "0.15.18 digest-pinned the example wiki container's Chainguard base images (runtime + builder). Because Chainguard rebuilds those images continuously to ship CVE fixes, the pinned digest went stale within hours and the container's Trivy CRITICAL/HIGH release gate rejected the build over an already-fixed npm/undici DoS (CVE-2026-12151) the rolling tag carried. The wiki Dockerfile tracks the rolling tag again, so the deployed image is always CVE-current and the build passes the release gate. To keep the Trivy-scanned image identical to the multi-arch image that is published (they are built separately), the release workflow resolves the rolling tag to a digest once at build time and feeds it to both builds via build-args — scan-equals-publish without a committed pin that goes stale. (This trades the OSSF Scorecard PinnedDependencies signal for CVE currency on a deployed, gate-scanned image — the right call here; the non-deployed ClusterFuzzLite fuzz base remains digest-pinned with Dependabot bumping it.) The framework package itself is identical to 0.15.18."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/scripts/check-vendor-currency.js

@@ -201,12 +201,36 @@ function _httpGetText(url, redirectsLeft) {
 // or throws when neither side yields a comparable identifier (the
 // caller maps that to "registry-error" so an upstream-format change
 // surfaces loudly instead of silently passing the gate).
+// Parse a "YYYY-MM-DD_HH-MM-SS_UTC" version header (the PSL's) into ms, or
+// null when it isn't that timestamp shape.
+function _parseVersionTs(v) {
+  var m = String(v || "").match(/^(\d{4})-(\d{2})-(\d{2})_(\d{2})-(\d{2})-(\d{2})_UTC$/);
+  if (!m) return null;
+  return Date.UTC(+m[1], +m[2] - 1, +m[3], +m[4], +m[5], +m[6]);
+}
+
 function _classifyContentCurrency(upstreamText, localText, special) {
   function pick(text, re) { var m = re && text.match(re); return (m && m[1]) || null; }
   var uCommit = pick(upstreamText, special.commitRe);
   var lCommit = pick(localText,    special.commitRe);
   var uVer    = pick(upstreamText, special.versionRe);
   var lVer    = pick(localText,    special.versionRe);
+  // Timestamp-versioned source (the PSL ships `// VERSION: <ts>`): "stale"
+  // means our bundle is genuinely BEHIND upstream, not merely different.
+  // publicsuffix.org is CDN-served and different edges can return an OLDER
+  // cached copy than the one we vendored; an exact commit/version inequality
+  // would then mis-flag our (newer) bundle as stale and fail the release gate
+  // non-deterministically. When both sides carry a parseable VERSION
+  // timestamp, compare them directionally — only a bundle older than upstream
+  // is stale; newer-or-equal is current. (The COMMIT remains the displayed
+  // identifier but cannot order two revisions, so it is not the staleness
+  // basis here.)
+  var uTs = _parseVersionTs(uVer);
+  var lTs = _parseVersionTs(lVer);
+  if (uTs !== null && lTs !== null) {
+    return { stale: lTs < uTs, basis: "version-timestamp", upstreamId: uVer, localId: lVer,
+             upstreamVersion: uVer, localVersion: lVer };
+  }
   if (uCommit && lCommit) {
     return { stale: uCommit !== lCommit, basis: "commit", upstreamId: uCommit, localId: lCommit,
              upstreamVersion: uVer, localVersion: lVer };

package/lib/vendor/blamejs/test/integration/queue-cluster-mysql.test.js

@@ -0,0 +1,419 @@
+"use strict";
+/**
+ * Live MySQL coverage for the queue-local CLUSTER lease path — the dialect-
+ * aware enqueue + the transactional FOR UPDATE SKIP LOCKED claim that only
+ * runs when the queue's store is a postgres/mysql cluster backend. Host smoke
+ * exercises ONLY the sqlite single-statement RETURNING path; nothing proved
+ * the b.sql the cluster path emits is MySQL-valid until this file. The three
+ * MySQL-specific traps the lease reshape exists to clear:
+ *
+ *   - identifier quoting: b.sql must emit BACKTICK-quoted camelCase columns
+ *     (`queueName`, `availableAt`, …), not the double-quotes MySQL reads as
+ *     string literals (the pre-reshape builders defaulted to the sqlite
+ *     dialect → "queueName" → ERROR 1064 on the very first enqueue);
+ *   - no RETURNING: MySQL rejects `UPDATE … RETURNING`, so the lease re-SELECTs
+ *     the claimed rows by their locked ids instead;
+ *   - no self-referencing subquery UPDATE: the guarded UPDATE binds a LITERAL
+ *     id list (`_id IN (?, ?)`) rather than updating a table named in its own
+ *     subquery (MySQL ERROR 1093).
+ *
+ * Driven through the REAL queue-local consumer surface (the backend factory
+ * b.queue.init wires): enqueue / lease / complete / fail / sweepExpired /
+ * dlqList against a real MySQL 8 server. RED before the dialect reshape (the
+ * first enqueue throws 1064); GREEN after.
+ *
+ * HARNESS LIMIT — read before extending: the "driver" is the stateless
+ * docker-exec mysql shim shared with data-layer-cluster-mysql (every query()
+ * is a fresh `mysql -e`, so BEGIN / the body / COMMIT and FOR UPDATE SKIP
+ * LOCKED each land on a SEPARATE connection — the transaction is non-atomic
+ * and the row lock does not hold). This file therefore validates DIALECT
+ * CORRECTNESS of the cluster lease SQL, NOT lock-based double-lease
+ * prevention; the latter is covered by the sqlite single-writer path and by
+ * outbox._claimBatch (the canonical competing-consumer claim this mirrors)
+ * against a pooled driver. Do not add a concurrent-double-lease assertion
+ * here — it cannot be made meaningful on the stateless shim.
+ *
+ * RUN: node scripts/test-integration.js --skip-service-check queue-cluster-mysql
+ */
+
+var execFileSync = require("node:child_process").execFileSync;
+var fs       = require("node:fs");
+var os       = require("node:os");
+var path     = require("node:path");
+var helpers  = require("../helpers");
+var check    = helpers.check;
+var services = require("../helpers/services");
+var b = require("../../");
+var queueLocal = require("../../lib/queue-local");
+
+var CONTAINER = "blamejs-test-mysql";
+var DB_NAME   = "blamejs_queue_cluster_test";
+
+// ---- one-shot mysql (setup / teardown / out-of-band assertions) ----
+function _mysqlRoot(sql, dbName) {
+  var args = ["exec", "-i", CONTAINER, "mysql", "-uroot", "-pblamejs_test_root", "--batch", "--raw"];
+  if (dbName) args.push(dbName);
+  args.push("-e", sql);
+  return execFileSync("docker", args, { stdio: ["pipe", "pipe", "pipe"] }).toString("utf8");
+}
+
+// ---- docker-exec mysql driver (faithful to a text-protocol driver) ----
+// Identical contract to data-layer-cluster-mysql's shim: ROW_COUNT() is read
+// in the SAME invocation as the DML so affectedRows is connection-consistent.
+function _makeDockerMysqlDriver() {
+  return {
+    connect: async function () { return { id: 1 }; },
+    query: async function (_client, sql, params) {
+      params = params || [];
+      var bound = _bindParams(sql, params);
+      var t = bound.trim();
+      if (/^(CREATE|ALTER|INSERT|UPDATE|DELETE|DROP|REPLACE|TRUNCATE|BEGIN|START|COMMIT|ROLLBACK)\b/i.test(t)) {
+        // Transaction-control statements (BEGIN/COMMIT/ROLLBACK) are no-ops on
+        // the stateless shim — run them but don't read ROW_COUNT().
+        if (/^(BEGIN|START|COMMIT|ROLLBACK)\b/i.test(t)) { _exec(bound.replace(/;\s*$/, "")); return { rows: [], affectedRows: 0, rowCount: 0 }; }
+        var stmt = bound.replace(/;\s*$/, "");
+        var ar = _exec(stmt + "; SELECT ROW_COUNT() AS n");
+        var parsed = _parseBatch(ar);
+        var n = parsed.rows[0] ? Number(parsed.rows[0].n) : 0;
+        if (!isFinite(n) || n < 0) n = 0;
+        return { rows: [], affectedRows: n, rowCount: n };
+      }
+      var out = _exec(bound);
+      var parsedSel = _parseBatch(out);
+      return { rows: parsedSel.rows, rowCount: parsedSel.rows.length };
+    },
+    close: async function () { /* no-op */ },
+    dialect: "mysql",
+  };
+}
+
+function _exec(sql) {
+  try {
+    return execFileSync("docker",
+      ["exec", "-i", CONTAINER, "mysql", "-uroot", "-pblamejs_test_root",
+       "--batch", "--raw", DB_NAME, "-e", sql],
+      { stdio: ["pipe", "pipe", "pipe"] }).toString("utf8");
+  } catch (e) {
+    var msg = e.stderr ? e.stderr.toString("utf8") : (e.message || String(e));
+    var errLine = (msg.split(/\r?\n/).filter(function (l) {
+      return /ERROR \d+/.test(l);
+    })[0]) || msg.trim();
+    var err = new Error(errLine.trim());
+    var m = /ERROR (\d+) \(([0-9A-Za-z]{5})\)/.exec(msg);
+    if (m) { err.errno = Number(m[1]); err.code = m[2]; err.sqlState = m[2]; }
+    throw err;
+  }
+}
+
+function _bindParams(sql, params) {
+  var i = 0;
+  return sql.replace(/\?/g, function () {
+    if (i >= params.length) throw new Error("placeholder/param count mismatch");
+    var p = params[i++];
+    if (p === null || p === undefined) return "NULL";
+    if (typeof p === "number") return String(p);
+    if (typeof p === "boolean") return p ? "1" : "0";
+    return "'" + String(p).replace(/\\/g, "\\\\").replace(/'/g, "''") + "'";
+  });
+}
+
+function _parseBatch(out) {
+  var lines = out.split(/\r?\n/).filter(function (l) { return l.length > 0; });
+  if (lines.length < 1) return { rows: [] };
+  var headers = lines[0].split("\t");
+  var rows = [];
+  for (var i = 1; i < lines.length; i++) {
+    var cells = lines[i].split("\t");
+    var row = {};
+    for (var j = 0; j < headers.length; j++) {
+      var v = cells[j];
+      row[headers[j]] = (v === "NULL" || v === undefined) ? null : v;
+    }
+    rows.push(row);
+  }
+  return { rows: rows };
+}
+
+function _countMysql(table, whereClause) {
+  var sql = "SELECT count(*) AS n FROM " + table +
+    (whereClause ? " WHERE " + whereClause : "");
+  var out = _mysqlRoot(sql, DB_NAME);
+  var parsed = _parseBatch(out);
+  return parsed.rows[0] ? Number(parsed.rows[0].n) : 0;
+}
+
+// One out-of-band column read for a single job row.
+function _jobCol(jobId, col) {
+  var out = _mysqlRoot(
+    "SELECT `" + col + "` AS v FROM `_blamejs_jobs` WHERE `_id` = '" +
+      jobId.replace(/'/g, "''") + "'", DB_NAME);
+  var parsed = _parseBatch(out);
+  return parsed.rows[0] ? parsed.rows[0].v : null;
+}
+
+var OWNED_TABLES = [
+  "_blamejs_jobs",
+  "_blamejs_cluster_state",
+  "_blamejs_leader",
+  "_blamejs_audit_tip",
+  "_blamejs_consent_tip",
+];
+
+function _ensureTipTables() {
+  _mysqlRoot(
+    "CREATE TABLE IF NOT EXISTS `_blamejs_audit_tip` (" +
+    "  `scope` VARCHAR(64) PRIMARY KEY," +
+    "  `atMonotonicCounter` BIGINT NOT NULL DEFAULT 0," +
+    "  `rowHash` TEXT," +
+    "  `signedAt` TEXT," +
+    "  `fencingToken` BIGINT NOT NULL DEFAULT 0)", DB_NAME);
+  _mysqlRoot(
+    "CREATE TABLE IF NOT EXISTS `_blamejs_consent_tip` (" +
+    "  `scope` VARCHAR(64) PRIMARY KEY," +
+    "  `atMonotonicCounter` BIGINT NOT NULL DEFAULT 0," +
+    "  `rowHash` TEXT," +
+    "  `signedAt` TEXT," +
+    "  `fencingToken` BIGINT NOT NULL DEFAULT 0)", DB_NAME);
+}
+
+// The jobs table, backtick-quoted camelCase columns matching JOB_COLS in
+// queue-local. BIGINT holds the unix-ms timestamps AND the flow-blocked
+// sentinel (Number.MAX_SAFE_INTEGER = 9.007e15, well inside BIGINT range).
+function _createJobsTable() {
+  _mysqlRoot("DROP TABLE IF EXISTS `_blamejs_jobs`", DB_NAME);
+  _mysqlRoot(
+    "CREATE TABLE `_blamejs_jobs` (" +
+    "  `_id`            VARCHAR(64) PRIMARY KEY," +
+    "  `queueName`      VARCHAR(255) NOT NULL," +
+    "  `payload`        LONGTEXT," +
+    "  `status`         VARCHAR(32) NOT NULL," +
+    "  `enqueuedAt`     BIGINT NOT NULL," +
+    "  `availableAt`    BIGINT NOT NULL," +
+    "  `leasedAt`       BIGINT," +
+    "  `leaseExpiresAt` BIGINT," +
+    "  `attempts`       BIGINT NOT NULL DEFAULT 0," +
+    "  `maxAttempts`    BIGINT NOT NULL DEFAULT 5," +
+    "  `lastError`      LONGTEXT," +
+    "  `finishedAt`     BIGINT," +
+    "  `traceId`        VARCHAR(255)," +
+    "  `classification` VARCHAR(255)," +
+    "  `priority`       BIGINT NOT NULL DEFAULT 0," +
+    "  `repeatCron`     VARCHAR(255)," +
+    "  `repeatTimezone` VARCHAR(255)," +
+    "  `flowId`         VARCHAR(255)," +
+    "  `flowChildName`  VARCHAR(255)," +
+    "  `dependsOn`      LONGTEXT," +
+    "  KEY `lease_idx` (`queueName`, `status`, `availableAt`)" +
+    ")", DB_NAME);
+}
+
+function _dropOwned() {
+  for (var i = 0; i < OWNED_TABLES.length; i++) {
+    try { _mysqlRoot("DROP TABLE IF EXISTS `" + OWNED_TABLES[i] + "`", DB_NAME); } catch (_e) {}
+  }
+}
+
+async function run() {
+  var svc = await services.requireService("mysql");
+  if (!svc.ok) throw new Error("mysql unreachable: " + svc.reason);
+
+  _mysqlRoot("CREATE DATABASE IF NOT EXISTS " + DB_NAME);
+  _dropOwned();
+
+  var driver = _makeDockerMysqlDriver();
+  b.cluster._resetForTest();
+  b.externalDb._resetForTest();
+  b.db._resetForTest();   // clears the cryptoField table registry between runs
+  b.externalDb.init({
+    backends: {
+      ops: {
+        connect: driver.connect, query: driver.query, close: driver.close,
+        dialect: "mysql",
+      },
+    },
+  });
+
+  var vaultDir = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-q-cl-my-"));
+  await helpers.setupVaultOnly(vaultDir);
+  // Re-register the _blamejs_jobs sealed-column map (payload + lastError):
+  // db._resetForTest cleared the cryptoField registry, and no db.init runs in
+  // this standalone process, so seal-at-rest would silently pass through
+  // without it. This proves the cluster path seals + unseals on MySQL too.
+  queueLocal._ensureSealTable();
+
+  _ensureTipTables();
+  _createJobsTable();
+
+  await b.cluster.init({
+    nodeId:            "queue-node-my",
+    role:              "leader",
+    leaseTtl:          b.constants.TIME.seconds(60),
+    heartbeatInterval: b.constants.TIME.seconds(20),
+    externalDbBackend: "ops",
+    dialect:           "mysql",
+  });
+
+  try {
+    check("queue-cluster (mysql): cluster mode routes the queue store to MySQL",
+          b.cluster.isClusterMode() === true && b.clusterStorage.dialect() === "mysql");
+
+    var q = queueLocal.create({});   // default store = clusterStorage → external "ops" (MySQL)
+
+    await _proveEnqueueAndClusterLease(q);
+    await _proveComplete(q);
+    await _proveFailRetryThenFinalDlq(q);
+    await _proveSweepExpired(q);
+    await _proveDelayedNotLeased(q);
+  } finally {
+    try { await b.cluster.shutdown(); } catch (_e) {}
+    b.cluster._resetForTest();
+    try { await b.externalDb.shutdown(); } catch (_e) {}
+    b.externalDb._resetForTest();
+    try { helpers.teardownVaultOnly(vaultDir); } catch (_e) {}
+    _dropOwned();
+  }
+}
+
+// ======================================================================
+// 1. enqueue (dialect INSERT) + the transactional cluster lease — the #35
+//    headline. Three jobs, distinct priorities; lease(2) must hand back the
+//    two highest-priority head-of-queue jobs in order, flip them inflight,
+//    increment attempts, and round-trip the sealed payload — all through
+//    MySQL-valid SQL (backticks, no RETURNING, literal id-list UPDATE).
+// ======================================================================
+async function _proveEnqueueAndClusterLease(q) {
+  var Q = "q-claim";
+  await q.enqueue(Q, { job: "low" },  { priority: 0 });
+  await q.enqueue(Q, { job: "high" }, { priority: 10 });
+  await q.enqueue(Q, { job: "mid" },  { priority: 5 });
+
+  check("enqueue (mysql): three INSERTs landed (backtick-quoted camelCase, no 1064)",
+        _countMysql("`_blamejs_jobs`", "`queueName` = 'q-claim'") === 3);
+  check("enqueue (mysql): all three start pending",
+        _countMysql("`_blamejs_jobs`", "`queueName` = 'q-claim' AND `status` = 'pending'") === 3);
+  check("enqueue (mysql): the sealed payload is NOT stored in cleartext",
+        _countMysql("`_blamejs_jobs`", "`queueName` = 'q-claim' AND `payload` LIKE '%\"job\"%'") === 0);
+
+  var leased = await q.lease(Q, b.constants.TIME.seconds(30), 2);
+  check("cluster-lease (mysql): leased exactly 2 (FOR UPDATE SKIP LOCKED + guarded UPDATE ran)",
+        Array.isArray(leased) && leased.length === 2);
+  // The ORDER BY priority desc in the candidate SELECT governs WHICH rows are
+  // claimed (the two highest-priority head-of-queue jobs), not the order of
+  // the returned array — the MySQL readback re-SELECT is not itself ordered
+  // (nor is RETURNING on PG/sqlite). Assert the claimed SET, and separately
+  // that the low-priority job is left behind (the priority guarantee).
+  var leasedJobs = leased.map(function (l) { return l.payload && l.payload.job; });
+  check("cluster-lease (mysql): the two HIGHEST-priority jobs were claimed (high + mid)",
+        leasedJobs.indexOf("high") !== -1 && leasedJobs.indexOf("mid") !== -1 &&
+        leasedJobs.indexOf("low") === -1);
+  check("cluster-lease (mysql): both sealed payloads round-tripped through unseal to objects",
+        leased[0].payload && typeof leased[0].payload.job === "string" &&
+        leased[1].payload && typeof leased[1].payload.job === "string");
+  check("cluster-lease (mysql): leased rows report attempts incremented to 1",
+        leased[0].attempts === 1 && leased[1].attempts === 1);
+  check("cluster-lease (mysql): the two leased rows flipped to inflight on the server",
+        _countMysql("`_blamejs_jobs`", "`queueName` = 'q-claim' AND `status` = 'inflight'") === 2);
+  check("cluster-lease (mysql): the un-leased low-priority job stays pending",
+        _countMysql("`_blamejs_jobs`", "`queueName` = 'q-claim' AND `status` = 'pending'") === 1);
+  check("cluster-lease (mysql): server-side attempts column incremented to 1",
+        Number(_jobCol(leased[0].jobId, "attempts")) === 1);
+
+  // stash the leased ids for the next sections
+  _proveEnqueueAndClusterLease._leased = leased;
+}
+
+// ======================================================================
+// 2. complete() — SELECT-then-guarded-UPDATE pair, both dialect-routed.
+// ======================================================================
+async function _proveComplete(q) {
+  var leased = _proveEnqueueAndClusterLease._leased;
+  var high = leased[0];
+  var ok = await q.complete(high.jobId);
+  check("complete (mysql): inflight→done flip returned true", ok === true);
+  check("complete (mysql): status is done with finishedAt set on the server",
+        _jobCol(high.jobId, "status") === "done" && _jobCol(high.jobId, "finishedAt") !== null);
+
+  var again = await q.complete(high.jobId);
+  check("complete (mysql): a second complete() on the done row no-ops (status guard)",
+        again === false);
+}
+
+// ======================================================================
+// 3. fail() — retry CASE branch (attempts < maxAttempts → pending) and the
+//    final-failure branch (→ failed, surfaced via dlqList with the sealed
+//    lastError decrypted). The CASE-expression UPDATE is the cross-dialect
+//    no-transaction fail path; prove it is MySQL-valid + correct.
+// ======================================================================
+async function _proveFailRetryThenFinalDlq(q) {
+  // --- retry branch: the 'mid' job (attempts 1, maxAttempts default 5) ---
+  var mid = _proveEnqueueAndClusterLease._leased[1];
+  var retried = await q.fail(mid.jobId, "transient blip", { retryDelayMs: 0 });
+  check("fail-retry (mysql): inflight→pending retry returned true", retried === true);
+  check("fail-retry (mysql): retried job is pending again (attempts 1 < max 5)",
+        _jobCol(mid.jobId, "status") === "pending");
+  check("fail-retry (mysql): lastError is sealed, not cleartext on the server",
+        _jobCol(mid.jobId, "lastError") !== null &&
+        !/transient blip/.test(String(_jobCol(mid.jobId, "lastError"))));
+
+  // the retried job + the still-pending low job are both leasable again
+  var released = await q.lease("q-claim", b.constants.TIME.seconds(30), 5);
+  check("fail-retry (mysql): the retried job re-enters the lease set",
+        released.length === 2);
+
+  // --- final-failure branch: a fresh queue, maxAttempts 1 ---
+  var FQ = "q-final";
+  await q.enqueue(FQ, { job: "doomed" }, { maxAttempts: 1 });
+  var fl = await q.lease(FQ, b.constants.TIME.seconds(30), 1);
+  check("fail-final (mysql): the doomed job leased (attempts→1 == maxAttempts)",
+        fl.length === 1 && fl[0].attempts === 1);
+  var finalFail = await q.fail(fl[0].jobId, "fatal error", { retryDelayMs: 0 });
+  check("fail-final (mysql): the exhausted job's fail returned true", finalFail === true);
+  check("fail-final (mysql): exhausted job moved to failed (DLQ) on the server",
+        _jobCol(fl[0].jobId, "status") === "failed" && _jobCol(fl[0].jobId, "finishedAt") !== null);
+  check("fail-final (mysql): dlqSize counts the failed job",
+        (await q.dlqSize(FQ)) === 1);
+  var dlq = await q.dlqList(FQ);
+  check("fail-final (mysql): dlqList unseals lastError back to cleartext",
+        dlq.length === 1 && dlq[0].lastError === "fatal error" &&
+        dlq[0].payload && dlq[0].payload.job === "doomed");
+}
+
+// ======================================================================
+// 4. sweepExpired() — a lease whose expiry has passed returns to pending.
+//    Single dialect-routed UPDATE with a leaseExpiresAt < now guard.
+// ======================================================================
+async function _proveSweepExpired(q) {
+  var SQ = "q-sweep";
+  await q.enqueue(SQ, { job: "sweepable" });
+  var leased = await q.lease(SQ, 1, 1);   // leaseExpiresAt = now + 1ms
+  check("sweep (mysql): job leased before sweep", leased.length === 1);
+  await helpers.passiveObserve(30, "queue-cluster (mysql): lease ms window elapses before sweep");
+  var swept = await q.sweepExpired();
+  check("sweep (mysql): sweepExpired re-queued at least the expired lease",
+        swept >= 1);
+  check("sweep (mysql): the swept job is pending again with leaseExpiresAt cleared",
+        _jobCol(leased[0].jobId, "status") === "pending" &&
+        _jobCol(leased[0].jobId, "leaseExpiresAt") === null);
+}
+
+// ======================================================================
+// 5. a job scheduled in the future is NOT leasable (availableAt > now guard
+//    in the head-of-queue SELECT), but still counts toward size().
+// ======================================================================
+async function _proveDelayedNotLeased(q) {
+  var DQ = "q-delay";
+  await q.enqueue(DQ, { job: "later" }, { availableAt: Date.now() + b.constants.TIME.minutes(5) });
+  var leased = await q.lease(DQ, b.constants.TIME.seconds(30), 5);
+  check("delay (mysql): a future-availableAt job is not leased", leased.length === 0);
+  check("delay (mysql): the future job still counts toward size()",
+        (await q.size(DQ)) === 1);
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  run().then(
+    function () { console.log("OK — " + helpers.getChecks() + " checks passed"); process.exit(0); },
+    function (e) { console.error("FAIL:", e.stack || e); process.exit(1); }
+  );
+}