@blamejs/blamejs-shop 0.5.12 → 0.5.13

package/lib/vendor/blamejs/test/layer-0-primitives/dsr.test.js

@@ -922,7 +922,20 @@ async function testDbStoreUpgradePath() {
         $p: JSON.stringify({ id: "DSR-LEGACY-1", status: "pending", subject: { email: "legacy@example.com" } }),
       });
 
-    // Constructing the store runs ensureSchema → reconciles the columns.
+    // Also seed an OVERSIZED legacy plaintext row: its payload cannot be
+    // re-sealed into the vaulted store (the sealed form exceeds b.sql's
+    // per-value ceiling). The backfill must SKIP it — leaving it un-migrated —
+    // rather than crash provisioning with a SqlBuilderError.
+    var bigLegacy = "x".repeat(C.BYTES.mib(50));
+    b.db.prepare("INSERT INTO dsr_tickets (id, type, status, subject_email, submitted_at, deadline_at, payload) " +
+      "VALUES ($id, $type, $status, $email, $sa, $da, $p)").run({
+        $id: "DSR-LEGACY-BIG", $type: "access", $status: "pending",
+        $email: "big@example.com", $sa: Date.now(), $da: Date.now() + 1000, $p: bigLegacy,
+      });
+    bigLegacy = null;   // release the big string promptly
+
+    // Constructing the store runs ensureSchema → reconciles the columns AND
+    // runs the legacy backfill (which must not crash on the oversized row).
     var h = _dbDsr();
     var cols = b.db.prepare("PRAGMA table_info(dsr_tickets)").all({});
     var names = cols.map(function (c) { return c.name; });
@@ -956,6 +969,21 @@ async function testDbStoreUpgradePath() {
           rawLegacy.subject_email_hash.length > 0);
     check("dbStore upgrade: legacy subject_email sealed at rest by backfill (now erasable)",
           rawLegacy && rawLegacy.subject_email !== "legacy@example.com");
+
+    // The oversized legacy row was migrated for FINDABILITY without crashing:
+    // its subject columns are sealed and its derived hash is populated (so
+    // list({ subject }) and the erasure purge see it — no un-erasable PII),
+    // while its over-cap payload is left plaintext (it cannot be sealed, but
+    // it is DB-encrypted at rest and removed when the row is erased).
+    var rawBig = b.db.prepare(
+      "SELECT subject_email, subject_email_hash, payload FROM dsr_tickets WHERE id = $id")
+      .all({ $id: "DSR-LEGACY-BIG" })[0];
+    check("dbStore upgrade: oversized legacy row hash populated (findable by subject lookup, erasable)",
+          rawBig && typeof rawBig.subject_email_hash === "string" && rawBig.subject_email_hash.length > 0);
+    check("dbStore upgrade: oversized legacy row subject sealed at rest",
+          rawBig && rawBig.subject_email !== "big@example.com");
+    check("dbStore upgrade: over-cap payload left plaintext (not sealed, but erasable via row delete)",
+          rawBig && typeof rawBig.payload === "string" && rawBig.payload.indexOf("vault:") !== 0);
   } finally {
     await teardownTestDb(tmpDir);
   }
@@ -1038,6 +1066,816 @@ async function testResealValidationAndStore() {
   }
 }
 
+// ---- create() adversarial validation ----
+
+async function testCreateBadSource() {
+  var threw = null;
+  try {
+    b.dsr.create({
+      ticketStore: b.dsr.memoryTicketStore(),
+      identityResolver: async function () { return { subjectId: "u" }; },
+      // second source has neither query nor erase → invalid
+      sources: [{ name: "ok", query: async function () { return []; } }, { name: "bad" }],
+    });
+  } catch (e) { threw = e; }
+  check("dsr.create: source missing query/erase → dsr/bad-source",
+        threw && threw.code === "dsr/bad-source");
+}
+
+function testCreateBadPosture() {
+  var threw = null;
+  try {
+    b.dsr.create({
+      ticketStore: b.dsr.memoryTicketStore(),
+      identityResolver: async function () { return { subjectId: "u" }; },
+      sources: [{ name: "x", query: async function () { return []; } }],
+      posture: 123,   // non-string posture
+    });
+  } catch (e) { threw = e; }
+  check("dsr.create: non-string posture → dsr/bad-posture",
+        threw && threw.code === "dsr/bad-posture");
+}
+
+function testCreateBadDefaultVerificationLevel() {
+  var threw = null;
+  try {
+    b.dsr.create({
+      ticketStore: b.dsr.memoryTicketStore(),
+      identityResolver: async function () { return { subjectId: "u" }; },
+      sources: [{ name: "x", query: async function () { return []; } }],
+      verificationLevel: "bogus",
+    });
+  } catch (e) { threw = e; }
+  check("dsr.create: invalid verificationLevel → dsr/bad-verification-level",
+        threw && threw.code === "dsr/bad-verification-level");
+}
+
+function testCreateBadMinVerificationByType() {
+  var threw = null;
+  try {
+    b.dsr.create({
+      ticketStore: b.dsr.memoryTicketStore(),
+      identityResolver: async function () { return { subjectId: "u" }; },
+      sources: [{ name: "x", query: async function () { return []; } }],
+      minVerificationByType: { erasure: "bogus-level" },
+    });
+  } catch (e) { threw = e; }
+  check("dsr.create: invalid minVerificationByType value → dsr/bad-min-verification",
+        threw && threw.code === "dsr/bad-min-verification");
+}
+
+// ---- submit() adversarial ----
+
+async function testSubmitBadInput() {
+  var dsr = _makeDsr();
+  var threwNull = null;
+  try { await dsr.submit(null); } catch (e) { threwNull = e; }
+  check("dsr.submit: null input → dsr/bad-submit",
+        threwNull && threwNull.code === "dsr/bad-submit");
+  var threwStr = null;
+  try { await dsr.submit("not-an-object"); } catch (e) { threwStr = e; }
+  check("dsr.submit: non-object input → dsr/bad-submit",
+        threwStr && threwStr.code === "dsr/bad-submit");
+}
+
+async function testSubmitIdentityResolverThrows() {
+  // Distinct from testSubmitIdentityResolverFails (resolver RETURNS null):
+  // here the resolver THROWS, exercising the reject-audit + wrap path.
+  var dsr = b.dsr.create({
+    ticketStore: b.dsr.memoryTicketStore(),
+    posture: "gdpr",
+    identityResolver: async function () { throw new Error("resolver backend down"); },
+    sources: [{ name: "x", query: async function () { return []; } }],
+  });
+  var threw = null;
+  try { await dsr.submit({ type: "access", subject: { email: "a@b.com" } }); }
+  catch (e) { threw = e; }
+  check("dsr.submit: identityResolver throw → dsr/identity-resolver-failed",
+        threw && threw.code === "dsr/identity-resolver-failed");
+  check("dsr.submit: identity-resolver error surfaced in message",
+        threw && /resolver backend down/.test(threw.message || ""));
+}
+
+async function testSubmitBadVerificationLevel() {
+  var dsr = _makeDsr();
+  var threw = null;
+  try {
+    await dsr.submit({
+      type: "access",
+      subject: { email: "alice@example.com" },
+      verificationLevel: "ultra",
+    });
+  } catch (e) { threw = e; }
+  check("dsr.submit: invalid verificationLevel → dsr/bad-verification-level",
+        threw && threw.code === "dsr/bad-verification-level");
+}
+
+// ---- process() adversarial / wrong-state ----
+
+async function testProcessAlreadyInProgress() {
+  // Drive a ticket into "in_progress" (the concurrent-processor guard state)
+  // via the store, then re-process → dsr/already-in-progress.
+  var store = b.dsr.memoryTicketStore();
+  var dsr = _makeDsr({ ticketStore: store });
+  var ticket = await dsr.submit({
+    type: "access", subject: { email: "alice@example.com" },
+  });
+  var t = await store.get(ticket.id);
+  t.status = "in_progress";
+  await store.update(ticket.id, t);
+  var threw = null;
+  try { await dsr.process(ticket.id); } catch (e) { threw = e; }
+  check("dsr.process: in_progress ticket → dsr/already-in-progress",
+        threw && threw.code === "dsr/already-in-progress");
+}
+
+async function testProcessBadVerificationLevel() {
+  var dsr = _makeDsr();
+  var ticket = await dsr.submit({
+    type: "access", subject: { email: "alice@example.com" },
+  });
+  var threw = null;
+  try { await dsr.process(ticket.id, { verificationLevel: "not-a-level" }); }
+  catch (e) { threw = e; }
+  check("dsr.process: invalid verificationLevel → dsr/bad-verification-level",
+        threw && threw.code === "dsr/bad-verification-level");
+}
+
+async function testProcessErasurePurgeFailure() {
+  // The erasure-completion purge is best-effort: a store.delete() failure
+  // must NOT unwind the completed erasure. Wrap the memory store so delete
+  // throws; the erasure still completes and the prior ticket survives.
+  var real = b.dsr.memoryTicketStore();
+  var store = {
+    insert: real.insert,
+    get:    real.get,
+    list:   real.list,
+    update: real.update,
+    delete: async function () { throw new Error("delete backend unreachable"); },
+  };
+  var dsr = _makeDsr({ ticketStore: store });
+  var prior = await dsr.submit({
+    type: "access", subject: { email: "alice@example.com" },
+  });
+  var erasure = await dsr.submit({
+    type: "erasure", subject: { email: "alice@example.com" },
+    verificationLevel: "secondary",
+  });
+  var result = await dsr.process(erasure.id, { verificationLevel: "secondary" });
+  check("dsr.process erasure: completes despite purge delete() failure",
+        result.status === "completed");
+  var priorStill = await store.get(prior.id);
+  check("dsr.process erasure: purge delete() failure leaves prior ticket intact",
+        priorStill && priorStill.id === prior.id);
+}
+
+async function testAuditDisabled() {
+  // audit:false disables emission — the _emitAudit early-return path. The
+  // workflow must still function end-to-end with the audit sink off.
+  var dsr = _makeDsr({ audit: false });
+  var ticket = await dsr.submit({
+    type: "access", subject: { email: "alice@example.com" },
+  });
+  var result = await dsr.process(ticket.id);
+  check("dsr audit:false: submit + process still complete",
+        result.status === "completed" && ticket.status === "pending");
+}
+
+async function testProcessQueryNonArrayRows() {
+  // rows = Array.isArray(rows) ? len : (rows ? 1 : 0). A source returning a
+  // truthy non-array counts as 1; a falsy return counts as 0.
+  var dsr = b.dsr.create({
+    ticketStore: b.dsr.memoryTicketStore(),
+    posture: "gdpr",
+    identityResolver: async function () { return { subjectId: "u" }; },
+    sources: [
+      { name: "objsrc",  query: async function () { return { single: true }; } },
+      { name: "nullsrc", query: async function () { return null; } },
+    ],
+  });
+  var ticket = await dsr.submit({ type: "access", subject: { email: "x" } });
+  var result = await dsr.process(ticket.id);
+  check("dsr.process: non-array truthy query counts as 1 row",
+        result.sourceResults[0].rows === 1);
+  check("dsr.process: falsy query counts as 0 rows",
+        result.sourceResults[1].rows === 0);
+}
+
+async function testProcessEraseResultShapes() {
+  // Erase-result normalization: { deleted: n } numeric count, {} → 0 with
+  // null deletedIds, and eraseExclusions falling back from the source spec.
+  var dsr = b.dsr.create({
+    ticketStore: b.dsr.memoryTicketStore(),
+    posture: "gdpr",
+    identityResolver: async function () { return { subjectId: "u" }; },
+    minVerificationByType: { erasure: "minimal" },
+    sources: [
+      { name: "countsrc", erase: async function () { return { deleted: 3 }; } },
+      { name: "emptysrc", erase: async function () { return {}; } },
+      { name: "exclsrc",  eraseExclusions: ["legal-hold"],
+        erase: async function () { return { deletedIds: [1] }; } },
+    ],
+  });
+  var ticket = await dsr.submit({ type: "erasure", subject: { email: "x" } });
+  var result = await dsr.process(ticket.id);
+  check("dsr.process erase: numeric { deleted } count honored",
+        result.sourceResults[0].deleted === 3);
+  check("dsr.process erase: empty erase result → 0 deleted, null deletedIds",
+        result.sourceResults[1].deleted === 0 && result.sourceResults[1].deletedIds === null);
+  check("dsr.process erase: exclusions fall back to source eraseExclusions",
+        Array.isArray(result.sourceResults[2].exclusions) &&
+        result.sourceResults[2].exclusions[0] === "legal-hold");
+  check("dsr.process erase: totalDeleted sums numeric + id-array counts",
+        result.result.totalDeleted === 4);
+}
+
+// ---- cancel / reject / get not-found + defaults ----
+
+async function testCancelNotFound() {
+  var dsr = _makeDsr();
+  var threw = null;
+  try { await dsr.cancel("DSR-DOES-NOT-EXIST"); } catch (e) { threw = e; }
+  check("dsr.cancel: unknown ticket → dsr/not-found",
+        threw && threw.code === "dsr/not-found");
+}
+
+async function testCancelWithoutActorReason() {
+  // cancel() with no opts → cancelledBy / cancelReason default to null; the
+  // subsequent receipt's cancelReason is null too.
+  var dsr = _makeDsr();
+  var ticket = await dsr.submit({
+    type: "access", subject: { email: "alice@example.com" },
+  });
+  var cancelled = await dsr.cancel(ticket.id);
+  check("dsr.cancel: no actor → cancelledBy null", cancelled.cancelledBy === null);
+  check("dsr.cancel: no reason → cancelReason null", cancelled.cancelReason === null);
+  var receipt = await dsr.buildReceipt(ticket.id);
+  check("dsr.buildReceipt: cancelled without reason → summary.cancelReason null",
+        receipt.status === "cancelled" && receipt.summary.cancelReason === null);
+}
+
+async function testRejectNotFound() {
+  var dsr = _makeDsr();
+  var threw = null;
+  try { await dsr.reject("DSR-DOES-NOT-EXIST", { reason: "no such ticket" }); }
+  catch (e) { threw = e; }
+  check("dsr.reject: unknown ticket → dsr/not-found",
+        threw && threw.code === "dsr/not-found");
+}
+
+async function testRejectTerminal() {
+  var dsr = _makeDsr();
+  var ticket = await dsr.submit({
+    type: "access", subject: { email: "alice@example.com" },
+  });
+  await dsr.process(ticket.id);   // → completed (terminal)
+  var threw = null;
+  try { await dsr.reject(ticket.id, { reason: "too late" }); }
+  catch (e) { threw = e; }
+  check("dsr.reject: terminal-state ticket → dsr/terminal-state",
+        threw && threw.code === "dsr/terminal-state");
+}
+
+async function testGetViaCoordinator() {
+  var dsr = _makeDsr();
+  var ticket = await dsr.submit({
+    type: "access", subject: { email: "alice@example.com" },
+  });
+  var got = await dsr.get(ticket.id);
+  check("dsr.get: coordinator returns the stored ticket",
+        got && got.id === ticket.id && got.status === "pending");
+  var missing = await dsr.get("DSR-NOPE");
+  check("dsr.get: unknown id → null", missing === null);
+}
+
+async function testListByStatusBadStatus() {
+  var dsr = _makeDsr();
+  var threw = null;
+  try { await dsr.listByStatus("made-up-status"); } catch (e) { threw = e; }
+  check("dsr.listByStatus: invalid status → dsr/bad-status",
+        threw && threw.code === "dsr/bad-status");
+}
+
+// ---- buildReceipt / buildPortabilityBundle adversarial ----
+
+async function testBuildReceiptNotFound() {
+  var dsr = _makeDsr();
+  var threw = null;
+  try { await dsr.buildReceipt("DSR-NOPE"); } catch (e) { threw = e; }
+  check("dsr.buildReceipt: unknown ticket → dsr/not-found",
+        threw && threw.code === "dsr/not-found");
+}
+
+async function testBuildReceiptExpired() {
+  var dsr = _makeDsr({ deadlineMs: 50 });
+  var ticket = await dsr.submit({
+    type: "access", subject: { email: "alice@example.com" },
+  });
+  var expired = await helpers.waitUntil(async function () {
+    var rv = await dsr.expireOverdue();
+    return rv.length >= 1 ? rv : false;
+  }, { label: "dsr.buildReceipt: expired-ticket sweep" });
+  check("dsr.buildReceipt expired: ticket collected", expired.length === 1);
+  var receipt = await dsr.buildReceipt(ticket.id);
+  check("dsr.buildReceipt: expired status echoed", receipt.status === "expired");
+  check("dsr.buildReceipt: expired summary carries deadlineAt",
+        receipt.summary.deadlineAt === ticket.deadlineAt);
+}
+
+function testPortabilityBadTicket() {
+  var dsr = _makeDsr();
+  var threwNull = null;
+  try { dsr.buildPortabilityBundle(null); } catch (e) { threwNull = e; }
+  check("dsr.buildPortabilityBundle: null ticket → dsr/bad-ticket",
+        threwNull && threwNull.code === "dsr/bad-ticket");
+  var threwNoType = null;
+  try { dsr.buildPortabilityBundle({ id: "x" }); } catch (e) { threwNoType = e; }
+  check("dsr.buildPortabilityBundle: ticket without type → dsr/bad-ticket",
+        threwNoType && threwNoType.code === "dsr/bad-ticket");
+}
+
+// ---- memoryTicketStore update-not-found + delete ----
+
+async function testMemoryStoreUpdateNotFoundAndDelete() {
+  var store = b.dsr.memoryTicketStore();
+  await store.insert({ id: "M1", subject: { email: "a" }, status: "pending" });
+  var threw = null;
+  try { await store.update("M-MISSING", { id: "M-MISSING", subject: {}, status: "pending" }); }
+  catch (e) { threw = e; }
+  check("memoryStore.update: missing id → dsr/ticket-not-found",
+        threw && threw.code === "dsr/ticket-not-found");
+
+  var removed = await store.delete("M1");
+  check("memoryStore.delete: existing id returns true", removed === true);
+  check("memoryStore.delete: row is gone", (await store.get("M1")) === null);
+  var removedMissing = await store.delete("M1");
+  check("memoryStore.delete: absent id returns false", removedMissing === false);
+}
+
+// ---- dbTicketStore adversarial + purge + status list + update-not-found ----
+
+async function testDbStoreBadTable() {
+  var tmpDir = _tmp();
+  await setupTestDb(tmpDir);
+  try {
+    var threw = null;
+    try { b.dsr.dbTicketStore({ db: b.db, table: "evil; DROP TABLE users" }); }
+    catch (e) { threw = e; }
+    check("dbTicketStore: non-identifier table → dsr/bad-table",
+          threw && threw.code === "dsr/bad-table");
+  } finally {
+    await teardownTestDb(tmpDir);
+  }
+}
+
+async function testDbStoreListByStatus() {
+  var tmpDir = _tmp();
+  await setupTestDb(tmpDir);
+  try {
+    var h = _dbDsr();
+    var t1 = await h.dsr.submit({ type: "access", subject: { email: "alice@example.com" } });
+    await h.dsr.process(t1.id);
+    await h.dsr.submit({ type: "access", subject: { email: "alice@example.com" } });
+    var pending = await h.store.list({ status: "pending" });
+    check("dbStore.list({status:pending}): 1 pending ticket",
+          pending.length === 1 && pending[0].status === "pending");
+    var completed = await h.store.list({ status: "completed" });
+    check("dbStore.list({status:completed}): 1 completed ticket",
+          completed.length === 1 && completed[0].status === "completed");
+    var all = await h.store.list();   // no filter → filter || {}
+    check("dbStore.list(): no filter returns every ticket", all.length === 2);
+  } finally {
+    await teardownTestDb(tmpDir);
+  }
+}
+
+async function testDbStoreUpdateNotFound() {
+  var tmpDir = _tmp();
+  await setupTestDb(tmpDir);
+  try {
+    var store = b.dsr.dbTicketStore({ db: b.db });
+    var ghost = {
+      id: "DSR-GHOST", type: "access", status: "pending",
+      subject: { subjectId: "u-x", email: "ghost@example.com", phone: null },
+      submittedAt: Date.now(), deadlineAt: Date.now() + C.TIME.minutes(1),
+      posture: "gdpr", verificationLevel: "minimal",
+    };
+    var threw = null;
+    try { await store.update("DSR-GHOST", ghost); } catch (e) { threw = e; }
+    check("dbStore.update: id absent (0 changes) → dsr/ticket-not-found",
+          threw && threw.code === "dsr/ticket-not-found");
+  } finally {
+    await teardownTestDb(tmpDir);
+  }
+}
+
+async function testDbStorePurgeExpired() {
+  var tmpDir = _tmp();
+  await setupTestDb(tmpDir);
+  try {
+    var store = b.dsr.dbTicketStore({ db: b.db });
+    var now = Date.now();
+    function _mk(id, status, retentionUntil) {
+      return {
+        id: id, type: "access", status: status,
+        subject: { subjectId: "u-" + id, email: id + "@example.com", phone: null },
+        submittedAt: now, deadlineAt: now, retentionUntil: retentionUntil,
+        posture: "gdpr", verificationLevel: "minimal",
+      };
+    }
+    // Terminal + retention already lapsed → purged.
+    await store.insert(_mk("PAST", "completed", now - C.TIME.days(1)));
+    // Terminal but retention still in the future → retained.
+    await store.insert(_mk("FUTURE", "cancelled", now + C.TIME.days(30)));
+    // Non-terminal (pending) with lapsed retention → not selected at all.
+    await store.insert(_mk("PENDING", "pending", now - C.TIME.days(1)));
+
+    var purged = await store.purgeExpired();   // default asOf = now
+    check("dbStore.purgeExpired(): removes only the lapsed terminal ticket",
+          purged === 1);
+    check("dbStore.purgeExpired(): lapsed terminal row gone",
+          (await store.get("PAST")) === null);
+    check("dbStore.purgeExpired(): future-retention terminal row survives",
+          (await store.get("FUTURE")) !== null);
+    check("dbStore.purgeExpired(): non-terminal pending row survives",
+          (await store.get("PENDING")) !== null);
+
+    // Explicit asOfMs far in the future now lapses the FUTURE ticket too.
+    var purged2 = await store.purgeExpired(now + C.TIME.days(60));
+    check("dbStore.purgeExpired(asOfMs): explicit cutoff lapses the future ticket",
+          purged2 === 1 && (await store.get("FUTURE")) === null);
+  } finally {
+    await teardownTestDb(tmpDir);
+  }
+}
+
+async function testDbStoreTicketTooLarge() {
+  var tmpDir = _tmp();
+  await setupTestDb(tmpDir);
+  try {
+    var store = b.dsr.dbTicketStore({ db: b.db });
+    // A serialized ticket above safeJson.ABSOLUTE_MAX_BYTES (64 MiB) is
+    // refused at write, so the store never holds a payload it could not read
+    // back through safeJson.parse's hard ceiling (write cap == read cap).
+    var oversized = "x".repeat(C.BYTES.mib(64));   // JSON wrapping pushes it over 64 MiB
+    var ticket = {
+      id: "DSR-TOO-BIG", type: "access", status: "pending",
+      subject: { subjectId: "u-1", email: "a@b.com", phone: null },
+      submittedAt: Date.now(), deadlineAt: Date.now() + C.TIME.minutes(1),
+      posture: "gdpr", verificationLevel: "minimal",
+      blob: oversized,
+    };
+    var threw = null;
+    try { await store.insert(ticket); } catch (e) { threw = e; }
+    oversized = null; ticket.blob = null;   // release the big string promptly
+    check("dbStore.insert: oversized ticket payload → dsr/ticket-too-large",
+          threw && threw.code === "dsr/ticket-too-large");
+
+    // A vaulted store AEAD-seals + base64-expands (~4/3) the payload before
+    // binding it, so a plaintext between the expansion-safe cap (~48 MiB) and
+    // the 64 MiB read ceiling would seal PAST b.sql's 64 MiB per-value cap. It
+    // must be refused here with the store's own dsr/ticket-too-large error,
+    // not surface as a SqlBuilderError (sql-builder/param-too-large) from the
+    // insert's b.sql path.
+    var nearMax = "x".repeat(C.BYTES.mib(50));   // > the ~48 MiB vaulted cap, < 64 MiB
+    var ticket2 = {
+      id: "DSR-SEAL-EXPAND", type: "access", status: "pending",
+      subject: { subjectId: "u-2", email: "b@c.com", phone: null },
+      submittedAt: Date.now(), deadlineAt: Date.now() + C.TIME.minutes(1),
+      posture: "gdpr", verificationLevel: "minimal",
+      blob: nearMax,
+    };
+    var threw2 = null;
+    try { await store.insert(ticket2); } catch (e) { threw2 = e; }
+    nearMax = null; ticket2.blob = null;   // release promptly
+    check("dbStore.insert: vaulted payload that seals past 64 MiB → dsr/ticket-too-large (not SqlBuilderError)",
+          threw2 && threw2.code === "dsr/ticket-too-large");
+  } finally {
+    await teardownTestDb(tmpDir);
+  }
+}
+
+// ---- reseal: real AAD-cell rotation + non-array store guard ----
+
+async function testResealRotatesAadCell() {
+  var cryptoField = require("../../lib/crypto-field");
+  var vaultAad = require("../../lib/vault-aad");
+  var tmpDir = _tmp();
+  await setupTestDb(tmpDir);
+  try {
+    // Constructing the store registers the dsr_tickets sealed-column schema
+    // with cryptoField (vault is initialized), so sealRow can AAD-seal a cell.
+    b.dsr.dbTicketStore({ db: b.db });
+    var sealed = cryptoField.sealRow("dsr_tickets", {
+      id: "RESEAL-1", subject_email: "rotate@example.com",
+    });
+    check("reseal fixture: subject_email is AAD-sealed",
+          vaultAad.isAadSealed(sealed.subject_email));
+    var origCell = sealed.subject_email;
+
+    var keys = b.vault.getKeysJson();
+    var puts = [];
+    var store = {
+      listAll:     function () { return [sealed]; },
+      putResealed: function (row) { puts.push(row); },
+    };
+    var rv = await b.dsr.reseal({ store: store, oldRootJson: keys, newRootJson: keys });
+    check("reseal: one AAD cell rotated + persisted",
+          rv.table === "dsr_tickets" && rv.resealed === 1 && puts.length === 1);
+    check("reseal: rotated cell re-encrypted (ciphertext changed)",
+          sealed.subject_email !== origCell && vaultAad.isAadSealed(sealed.subject_email));
+    var unsealed = cryptoField.unsealRow("dsr_tickets", {
+      id: "RESEAL-1", subject_email: sealed.subject_email,
+    });
+    check("reseal: rotated cell still unseals to the original plaintext",
+          unsealed.subject_email === "rotate@example.com");
+  } finally {
+    await teardownTestDb(tmpDir);
+  }
+}
+
+async function testResealListAllNonArray() {
+  var tmpDir = _tmp();
+  await setupTestDb(tmpDir);
+  try {
+    var keys = b.vault.getKeysJson();
+    var threw = null;
+    try {
+      await b.dsr.reseal({
+        oldRootJson: keys, newRootJson: keys,
+        store: { listAll: function () { return "not-an-array"; }, putResealed: function () {} },
+      });
+    } catch (e) { threw = e; }
+    check("reseal: store.listAll() returning a non-array → dsr/bad-reseal-store",
+          threw && threw.code === "dsr/bad-reseal-store");
+  } finally {
+    await teardownTestDb(tmpDir);
+  }
+}
+
+// ---- state-law DSR registry ----
+
+function testStateRules() {
+  var vcdpa = b.dsr.stateRules("vcdpa");
+  check("stateRules(vcdpa): responseDays 45", vcdpa && vcdpa.responseDays === 45);
+  check("stateRules(vcdpa): cureDays 30", vcdpa.cureDays === 30);
+  check("stateRules(vcdpa): profilingOptOut true", vcdpa.profilingOptOut === true);
+
+  var byAbbr = b.dsr.stateRules("va");   // 2-letter, case-insensitive
+  check("stateRules(VA abbrev): resolves to VA rule",
+        byAbbr && byAbbr.state === "VA" && byAbbr.posture === "vcdpa");
+
+  check("stateRules(unknown): null", b.dsr.stateRules("zz") === null);
+  check("stateRules(non-string): null", b.dsr.stateRules(123) === null);
+  check("stateRules(empty string): null", b.dsr.stateRules("") === null);
+}
+
+function testListStateRules() {
+  var all = b.dsr.listStateRules();
+  check("listStateRules: returns a non-empty array",
+        Array.isArray(all) && all.length > 0);
+  check("listStateRules: each entry carries posture + state + responseDays",
+        all.every(function (r) {
+          return typeof r.posture === "string" &&
+                 typeof r.state === "string" &&
+                 typeof r.responseDays === "number";
+        }));
+}
+
+// ---- additional default-branch / guard coverage ----
+
+function testCreateMoreValidation() {
+  var t1 = null;
+  try {
+    b.dsr.create({
+      ticketStore: null,   // !store side of _validateTicketStore
+      identityResolver: async function () { return { subjectId: "u" }; },
+      sources: [{ name: "x", query: async function () { return []; } }],
+    });
+  } catch (e) { t1 = e; }
+  check("dsr.create: null ticketStore → dsr/bad-store", t1 && t1.code === "dsr/bad-store");
+
+  var t2 = null;
+  try {
+    b.dsr.create({
+      ticketStore: b.dsr.memoryTicketStore(),
+      identityResolver: async function () { return { subjectId: "u" }; },
+      sources: [null],   // !s side of _validateSource
+    });
+  } catch (e) { t2 = e; }
+  check("dsr.create: null source → dsr/bad-source", t2 && t2.code === "dsr/bad-source");
+
+  var t3 = null;
+  try {
+    b.dsr.create({
+      ticketStore: b.dsr.memoryTicketStore(),
+      identityResolver: async function () { return { subjectId: "u" }; },
+      sources: [{ name: "", query: async function () { return []; } }],   // empty name
+    });
+  } catch (e) { t3 = e; }
+  check("dsr.create: empty source name → dsr/bad-source", t3 && t3.code === "dsr/bad-source");
+}
+
+async function testSubmitResolverThrowsEmptyMessage() {
+  // Resolver throws an Error with an empty message → (e && e.message) is
+  // falsy, so the audit metadata + wrapped-message path takes the String(e)
+  // fallback rather than the message branch.
+  var dsr = b.dsr.create({
+    ticketStore: b.dsr.memoryTicketStore(), posture: "gdpr",
+    identityResolver: async function () { throw new Error(""); },
+    sources: [{ name: "x", query: async function () { return []; } }],
+  });
+  var threw = null;
+  try { await dsr.submit({ type: "access", subject: { email: "a@b.com" } }); }
+  catch (e) { threw = e; }
+  check("dsr.submit: empty-message resolver throw → dsr/identity-resolver-failed",
+        threw && threw.code === "dsr/identity-resolver-failed");
+}
+
+async function testProcessSourceThrowsEmptyMessage() {
+  var dsr = b.dsr.create({
+    ticketStore: b.dsr.memoryTicketStore(), posture: "gdpr",
+    identityResolver: async function () { return { subjectId: "u" }; },
+    sources: [{ name: "boom", query: async function () { throw new Error(""); } }],
+  });
+  var ticket = await dsr.submit({ type: "access", subject: { email: "x" } });
+  var result = await dsr.process(ticket.id);
+  check("dsr.process: empty-message source throw recorded via String(e) fallback",
+        result.status === "partially_completed" &&
+        result.sourceResults[0].error === "Error");
+}
+
+async function testListBySubjectBadInput() {
+  var dsr = _makeDsr();
+  var r1 = await dsr.listBySubject(null);
+  var r2 = await dsr.listBySubject("not-an-object");
+  check("dsr.listBySubject: non-object subject → []",
+        Array.isArray(r1) && r1.length === 0 && Array.isArray(r2) && r2.length === 0);
+}
+
+async function testExpireOverdueNotPast() {
+  var dsr = _makeDsr({ deadlineMs: C.TIME.days(30) });
+  await dsr.submit({ type: "access", subject: { email: "alice@example.com" } });
+  var expired = await dsr.expireOverdue();
+  check("dsr.expireOverdue: pending ticket within deadline not swept",
+        expired.length === 0);
+}
+
+async function testReceiptSignerPartialResult() {
+  // Signer returns an object with none of issuer/algorithm/signature → each
+  // falls back to null.
+  var dsr = _makeDsr({ receiptSigner: async function () { return {}; } });
+  var ticket = await dsr.submit({
+    type: "access", subject: { email: "alice@example.com" },
+  });
+  await dsr.process(ticket.id);
+  var receipt = await dsr.buildReceipt(ticket.id);
+  check("dsr.buildReceipt: empty signer result → issuer/algorithm/signature null",
+        receipt.issuer === null && receipt.algorithm === null && receipt.signature === null);
+}
+
+async function testPortabilityCancelled() {
+  var dsr = _makeDsr();
+  var ticket = await dsr.submit({
+    type: "portability", subject: { email: "alice@example.com" },
+    verificationLevel: "secondary",
+  });
+  await dsr.cancel(ticket.id, { actor: "admin", reason: "withdrew" });
+  var cancelled = await dsr.get(ticket.id);
+  var threw = null;
+  try { dsr.buildPortabilityBundle(cancelled); } catch (e) { threw = e; }
+  check("dsr.buildPortabilityBundle: cancelled portability ticket → dsr/not-completed",
+        threw && threw.code === "dsr/not-completed");
+}
+
+async function testMemoryStoreListBySubjectId() {
+  var store = b.dsr.memoryTicketStore();
+  await store.insert({ id: "S1", subject: { subjectId: "u-1", email: "a@b.com" }, status: "pending" });
+  await store.insert({ id: "S2", subject: { subjectId: "u-2", email: "c@d.com" }, status: "pending" });
+  var byId = await store.list({ subject: { subjectId: "u-1" } });
+  check("memoryStore.list: filter by subjectId matches one row",
+        byId.length === 1 && byId[0].id === "S1");
+}
+
+// A subject filter that carries none of the store's indexable keys (email /
+// subjectId) — a phone-only subject, an empty subject, or one keyed only on
+// an alias — must match NOTHING, never every ticket. Fail-open here makes
+// listBySubject leak every subject's tickets (GDPR Art. 15 cross-subject
+// disclosure) and lets the erasure-completion purge delete them
+// (cross-subject destruction). Both ticket stores must fail closed.
+async function testMemoryStoreSubjectFilterFailClosed() {
+  var store = b.dsr.memoryTicketStore();
+  await store.insert({ id: "P1", subject: { phone: "+15550000001" }, status: "pending" });
+  await store.insert({ id: "P2", subject: { phone: "+15550000002" }, status: "pending" });
+
+  var phoneOnly = await store.list({ subject: { phone: "+15550000001" } });
+  check("memoryStore.list: phone-only subject filter matches nothing (fail-closed)",
+        phoneOnly.length === 0);
+
+  var emptySubj = await store.list({ subject: {} });
+  check("memoryStore.list: empty subject filter matches nothing (fail-closed)",
+        emptySubj.length === 0);
+
+  // Regression guard: an indexable key still matches, and the AND across
+  // both keys still holds.
+  await store.insert({ id: "P3", subject: { subjectId: "u-9", email: "e9@x.com" }, status: "pending" });
+  var byId = await store.list({ subject: { subjectId: "u-9" } });
+  check("memoryStore.list: indexable subjectId still matches after fail-closed guard",
+        byId.length === 1 && byId[0].id === "P3");
+}
+
+async function testMemoryStoreErasurePurgeScopedToSubject() {
+  // Two DIFFERENT phone-only subjects. Subject A's erasure-completion purge
+  // lists the store by A's subject and deletes the "other" tickets it finds.
+  // Because a phone-only subject is unindexable, the fail-open list returned
+  // EVERY ticket — so the purge wiped Subject B's data. B's ticket must
+  // survive A's erasure.
+  var store = b.dsr.memoryTicketStore();
+  var dsr = b.dsr.create({
+    ticketStore: store,
+    posture: "ccpa",
+    identityResolver: async function (input) { return { phone: input.phone }; },
+    sources: [{
+      name:  "users",
+      query: async function () { return []; },
+      erase: async function () { return { deletedIds: [] }; },
+    }],
+  });
+  var tB = await dsr.submit({ type: "access", subject: { phone: "+15550000002" } });
+  var tAerase = await dsr.submit({
+    type: "erasure", subject: { phone: "+15550000001" }, verificationLevel: "secondary",
+  });
+  await dsr.process(tAerase.id, { actor: "compliance@", verificationLevel: "secondary" });
+  var bStill = await store.get(tB.id);
+  check("dsr erasure purge: subject B's ticket survives subject A's erasure (no cross-subject delete)",
+        bStill !== null);
+}
+
+async function testDbStoreSubjectFilterFailClosed() {
+  var tmpDir = _tmp();
+  await setupTestDb(tmpDir);
+  try {
+    var store = b.dsr.dbTicketStore({ db: b.db });
+    var now = Date.now();
+    await store.insert({ id: "DB-P1", type: "access", status: "pending",
+      subject: { phone: "+15550000001" }, submittedAt: now, deadlineAt: now + 1000,
+      retentionUntil: now + 1000 });
+    await store.insert({ id: "DB-P2", type: "access", status: "pending",
+      subject: { phone: "+15550000002" }, submittedAt: now, deadlineAt: now + 1000,
+      retentionUntil: now + 1000 });
+
+    var phoneOnly = await store.list({ subject: { phone: "+15550000001" } });
+    check("dbStore.list: phone-only subject filter matches nothing (fail-closed)",
+          phoneOnly.length === 0);
+
+    var emptySubj = await store.list({ subject: {} });
+    check("dbStore.list: empty subject filter matches nothing (fail-closed)",
+          emptySubj.length === 0);
+
+    // Regression guard: an indexable subject still round-trips.
+    await store.insert({ id: "DB-U1", type: "access", status: "pending",
+      subject: { subjectId: "u-9", email: "e9@x.com" }, submittedAt: now,
+      deadlineAt: now + 1000, retentionUntil: now + 1000 });
+    var byEmail = await store.list({ subject: { email: "e9@x.com" } });
+    check("dbStore.list: indexable email still matches after fail-closed guard",
+          byEmail.length === 1 && byEmail[0].id === "DB-U1");
+  } finally {
+    await teardownTestDb(tmpDir);
+  }
+}
+
+function testDbStoreNoArgs() {
+  // dbTicketStore() with no opts → opts || {} → requireMethods refuses the
+  // absent db handle.
+  var threw = null;
+  try { b.dsr.dbTicketStore(); } catch (e) { threw = e; }
+  check("dbTicketStore: no opts → dsr/bad-db", threw && threw.code === "dsr/bad-db");
+}
+
+async function testResealNoArgsAndNonSealedRows() {
+  var tmpDir = _tmp();
+  await setupTestDb(tmpDir);
+  try {
+    var t1 = null;
+    try { await b.dsr.reseal(); } catch (e) { t1 = e; }
+    check("dsr.reseal: no args → dsr/bad-root", t1 && t1.code === "dsr/bad-root");
+
+    var keys = b.vault.getKeysJson();
+    var puts = [];
+    var rv = await b.dsr.reseal({
+      oldRootJson: keys, newRootJson: keys,
+      store: {
+        listAll:     function () { return [null, "str", { plain: 1 }]; },
+        putResealed: function (r) { puts.push(r); },
+      },
+    });
+    check("dsr.reseal: non-object / plaintext rows rotate nothing",
+          rv.resealed === 0 && puts.length === 0);
+  } finally {
+    await teardownTestDb(tmpDir);
+  }
+}
+
 // ---- Run all ----
 
 async function run() {
@@ -1092,15 +1930,77 @@ async function run() {
   await testReceiptWithSigner();
   await testReceiptSignerError();
 
+  // create() adversarial validation
+  await testCreateBadSource();
+  testCreateBadPosture();
+  testCreateBadDefaultVerificationLevel();
+  testCreateBadMinVerificationByType();
+
+  // submit() adversarial
+  await testSubmitBadInput();
+  await testSubmitIdentityResolverThrows();
+  await testSubmitBadVerificationLevel();
+
+  // process() adversarial / wrong-state
+  await testProcessAlreadyInProgress();
+  await testProcessBadVerificationLevel();
+  await testProcessErasurePurgeFailure();
+  await testAuditDisabled();
+  await testProcessQueryNonArrayRows();
+  await testProcessEraseResultShapes();
+
+  // cancel / reject / get not-found + defaults
+  await testCancelNotFound();
+  await testCancelWithoutActorReason();
+  await testRejectNotFound();
+  await testRejectTerminal();
+  await testGetViaCoordinator();
+  await testListByStatusBadStatus();
+
+  // buildReceipt / buildPortabilityBundle adversarial
+  await testBuildReceiptNotFound();
+  await testBuildReceiptExpired();
+  testPortabilityBadTicket();
+
+  // memoryTicketStore update-not-found + delete
+  await testMemoryStoreUpdateNotFoundAndDelete();
+
   // dbTicketStore at-rest sealing + erasure purge + upgrade path
   await testDbStoreSealsAtRest();
   await testDbStoreLargePayloadRoundTrips();
   await testDbStoreErasurePurgesPriorTickets();
   await testDbStoreUpgradePath();
   await testDbStoreFindsLegacyKeyedMacRows();
+  // dbTicketStore adversarial + purge + status list + update-not-found
+  await testDbStoreBadTable();
+  await testDbStoreListByStatus();
+  await testDbStoreUpdateNotFound();
+  await testDbStorePurgeExpired();
+  await testDbStoreTicketTooLarge();
   // AAD_ROTATION descriptor + reseal
   testAadRotationDescriptor();
   await testResealValidationAndStore();
+  await testResealRotatesAadCell();
+  await testResealListAllNonArray();
+
+  // additional default-branch / guard coverage
+  testCreateMoreValidation();
+  await testSubmitResolverThrowsEmptyMessage();
+  await testProcessSourceThrowsEmptyMessage();
+  await testListBySubjectBadInput();
+  await testExpireOverdueNotPast();
+  await testReceiptSignerPartialResult();
+  await testPortabilityCancelled();
+  await testMemoryStoreListBySubjectId();
+  await testMemoryStoreSubjectFilterFailClosed();
+  await testMemoryStoreErasurePurgeScopedToSubject();
+  await testDbStoreSubjectFilterFailClosed();
+  testDbStoreNoArgs();
+  await testResealNoArgsAndNonSealedRows();
+
+  // state-law DSR registry
+  testStateRules();
+  testListStateRules();
 }
 
 module.exports = { run: run };