@blamejs/blamejs-shop 0.5.12 → 0.5.14

package/lib/vendor/blamejs/test/layer-0-primitives/network.test.js

@@ -148,6 +148,38 @@ async function run() {
     _throws(function () { network.socket.setDefaultLinger({ enable: true }); }, "socket/linger-not-supported"));
   _resetAll();
 
+  // ---- Socket applyToSocket (per-socket default tuner) ----
+  // After _resetAll the SOCKET_DEFAULTS are back to noDelay:true /
+  // keepAlive:true / initialDelay:0. applyToSocket pushes those onto a
+  // freshly-created socket and returns the same socket.
+  var applied2 = [];
+  var spySocket = {
+    setNoDelay:   function (v) { applied2.push(["noDelay", v]); },
+    setKeepAlive: function (enable, delay) { applied2.push(["keepAlive", enable, delay]); },
+  };
+  var ret = b.network.socket.applyToSocket(spySocket);
+  check("applyToSocket returns the same socket", ret === spySocket);
+  check("applyToSocket applies TCP_NODELAY default (true)",
+    applied2.some(function (c) { return c[0] === "noDelay" && c[1] === true; }));
+  check("applyToSocket applies SO_KEEPALIVE default (true, 0)",
+    applied2.some(function (c) { return c[0] === "keepAlive" && c[1] === true && c[2] === 0; }));
+  // Best-effort: a socket lacking the setter methods is returned untouched.
+  var bareSock = { destroyed: true };
+  check("applyToSocket tolerates a socket without setters",
+    b.network.socket.applyToSocket(bareSock) === bareSock);
+  // Best-effort: a setter that throws is swallowed; the socket is still returned.
+  var throwingSock = { setNoDelay: function () { throw new Error("errored socket"); } };
+  check("applyToSocket swallows a throwing setter",
+    b.network.socket.applyToSocket(throwingSock) === throwingSock);
+  // null / undefined pass straight through.
+  check("applyToSocket returns null unchanged", b.network.socket.applyToSocket(null) === null);
+  // Real net.Socket round-trip — never connected, destroyed immediately.
+  var realSock = new (require("node:net").Socket)();
+  check("applyToSocket returns a real net.Socket unchanged",
+    b.network.socket.applyToSocket(realSock) === realSock);
+  realSock.destroy();
+  _resetAll();
+
   // ---- TLS trust-store lifecycle (remove / clear / purgeExpired) ----
   var pemA = await _makeRealCaPem();
   var pemB = await _makeRealCaPem();

package/lib/vendor/blamejs/test/layer-0-primitives/nonce-store-enforce-replay-nonboolean.test.js

@@ -0,0 +1,81 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+/**
+ * b.nonceStore.enforceReplay — fail CLOSED on any non-truthy checkAndInsert
+ * return, not only a literal `false`.
+ *
+ * enforceReplay is the shared anti-replay helper b.auth.jwt.verify and
+ * b.auth.dpop route their replay defense through. The nonce-store docstring
+ * recommends fronting it with "Redis SETNX, Memcached add" backends — but
+ * those return a NON-`false` falsy value on a duplicate:
+ *
+ *   - node-redis `SET key val NX`  → "OK" on insert, `null` on existing key
+ *   - the SETNX command / SQL INSERT → 1 on insert, 0 on existing row
+ *
+ * A replay therefore surfaces to enforceReplay as `null` / `0`, neither of
+ * which is `=== false`. An exact-literal compare admits the replayed token
+ * (fail OPEN) — the exact class the framework already fixed at every inline
+ * consumer (oauth.js `!inserted`, api-encrypt `!freshNonce`,
+ * graphql-federation `!fresh`, webhook `!fresh`) but missed in the shared
+ * helper. enforceReplay must refuse unless checkAndInsert positively confirms
+ * the jti was first-seen (a truthy result).
+ */
+
+var helpers = require("../helpers");
+var b     = helpers.b;
+var check = helpers.check;
+
+function RErr(code, message) { this.code = code; this.message = message; }
+
+// A store whose checkAndInsert reports fresh via `freshVal` and replay via
+// `replayVal` — models the recommended Redis-SETNX / SQL-INSERT backends.
+function _shapedStore(freshVal, replayVal) {
+  var seen = Object.create(null);
+  return {
+    checkAndInsert: function (nonce) {
+      if (Object.prototype.hasOwnProperty.call(seen, nonce)) return Promise.resolve(replayVal);
+      seen[nonce] = true;
+      return Promise.resolve(freshVal);
+    },
+  };
+}
+
+async function _firstPassesThenReplayRefused(store, label) {
+  var ropts = { errorClass: RErr, storeFailedCode: "x/store-failed", replayCode: "x/replay", tokenLabel: "token" };
+  var exp = Date.now() + 60000;
+
+  // First sighting must pass (truthy fresh value → no throw).
+  var firstThrew = false;
+  try { await b.nonceStore.enforceReplay(store, "jti-A", exp, ropts); }
+  catch (_e) { firstThrew = true; }
+  check(label + ": first use of a jti passes (truthy fresh admitted)", firstThrew === false);
+
+  // Second sighting is a REPLAY. Store signals it via a non-`false` falsy
+  // value; enforceReplay MUST refuse it (fail closed).
+  var replayErr = null;
+  try { await b.nonceStore.enforceReplay(store, "jti-A", exp, ropts); }
+  catch (e) { replayErr = e; }
+  check(label + ": replay refused with the replay code (fail closed, not fail open)",
+    replayErr instanceof RErr && replayErr.code === "x/replay");
+}
+
+async function run() {
+  // node-redis `SET ... NX` shape: "OK" on insert, null on existing key.
+  await _firstPassesThenReplayRefused(_shapedStore("OK", null), "redis SET NX (OK/null)");
+
+  // SETNX command / SQL INSERT ... ON CONFLICT shape: 1 on insert, 0 on dup.
+  await _firstPassesThenReplayRefused(_shapedStore(1, 0), "setnx / sql insert (1/0)");
+
+  // A store that returns undefined on a duplicate (a lax adapter) must also
+  // fail closed rather than admit the replay.
+  await _firstPassesThenReplayRefused(_shapedStore(true, undefined), "lax adapter (true/undefined)");
+
+  // The canonical b.nonceStore contract (strict boolean) still works.
+  await _firstPassesThenReplayRefused(_shapedStore(true, false), "canonical boolean (true/false)");
+
+  console.log("OK — nonce-store enforceReplay non-boolean fail-closed tests");
+}
+
+module.exports = { run: run };
+if (require.main === module) run().catch(function (e) { console.error(e); process.exit(1); });

package/lib/vendor/blamejs/test/layer-0-primitives/ntp-check.test.js

@@ -0,0 +1,122 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+/**
+ * ntpCheck.monitor — periodic clock-drift monitor.
+ *
+ * Drives b.ntpCheck.monitor against a LOCAL (loopback-only) SNTP
+ * responder that echoes the request's origin cookie and reports a large
+ * positive drift, so a real tick runs bootCheck → checkDrift →
+ * querySingle end-to-end and crosses the fatal threshold. No packets
+ * leave the host. Asserts the advertised surface: the onDrift hook fires,
+ * the audit events (`system.ntp.checked` + `system.ntp.drift_fatal`) are
+ * emitted, and stop() halts further ticks.
+ *
+ * Run standalone: `node test/layer-0-primitives/ntp-check.test.js`
+ * Or via smoke:   `node test/smoke.js`
+ */
+
+var dgram = require("node:dgram");
+
+var helpers = require("../helpers");
+var b     = helpers.b;
+var check = helpers.check;
+
+// NTP epoch (1900) → Unix epoch (1970) offset in seconds.
+var NTP_TO_UNIX_OFFSET_SECONDS = 2208988800;
+
+// Stand up a loopback SNTP responder that replies to every request with a
+// synchronized-server packet echoing the client's origin cookie and a
+// transmit timestamp ~100s in the future (a fatal-magnitude drift).
+function _startFakeNtpServer() {
+  var srv = dgram.createSocket("udp4");
+  srv.on("message", function (msg, rinfo) {
+    var reply = Buffer.alloc(48);
+    reply[0] = 0x24;                 // LI=0, VN=4, Mode=4 (server)
+    reply[1] = 1;                    // stratum 1 (synchronized)
+    msg.copy(reply, 24, 40, 48);     // Originate = the request's Transmit Timestamp (cookie echo)
+    var serverSec = Math.floor((Date.now() + 100000) / 1000) + NTP_TO_UNIX_OFFSET_SECONDS;
+    reply.writeUInt32BE(serverSec, 40);
+    reply.writeUInt32BE(0, 44);
+    try { srv.send(reply, 0, reply.length, rinfo.port, rinfo.address); } catch (_e) { /* closing */ }
+  });
+  return new Promise(function (resolve) {
+    srv.bind(0, "127.0.0.1", function () { resolve({ srv: srv, port: srv.address().port }); });
+  });
+}
+
+function testMonitorRejectsBadInterval() {
+  var t1 = null;
+  try { b.ntpCheck.monitor({ intervalMs: -1 }); } catch (e) { t1 = e; }
+  check("ntpCheck.monitor rejects non-positive intervalMs", t1 instanceof TypeError);
+  var t2 = null;
+  try { b.ntpCheck.monitor({ intervalMs: "soon" }); } catch (e) { t2 = e; }
+  check("ntpCheck.monitor rejects non-number intervalMs", t2 instanceof TypeError);
+}
+
+async function testMonitorFiresOnDriftAndAudits() {
+  b.ntpCheck._resetThresholdsForTest();
+  var fake = await _startFakeNtpServer();
+
+  var auditEvents  = [];
+  var realSafeEmit = b.audit.safeEmit;
+  b.audit.safeEmit = function (ev) { auditEvents.push(ev); };
+
+  var drifts = [];
+  var mon = b.ntpCheck.monitor({
+    intervalMs:   40,
+    servers:      ["127.0.0.1"],
+    port:         fake.port,
+    timeoutMs:    3000,
+    driftWarnMs:  2000,
+    driftFatalMs: 30000,
+    audit:        true,
+    onDrift:      function (r) { drifts.push(r); },
+  });
+  try {
+    await helpers.waitUntil(function () { return drifts.length >= 1; },
+      { timeoutMs: 6000, label: "ntpCheck.monitor: onDrift fired on fatal drift" });
+    var r0 = drifts[0];
+    check("monitor onDrift severity is fatal for +100s drift", r0.severity === "fatal");
+    check("monitor onDrift reports the queried server",        r0.server === "127.0.0.1");
+    check("monitor onDrift driftMs is large-positive",         r0.driftMs > 30000);
+
+    await helpers.waitUntil(function () {
+      return auditEvents.some(function (e) { return e.action === "system.ntp.drift_fatal"; });
+    }, { timeoutMs: 6000, label: "ntpCheck.monitor: system.ntp.drift_fatal emitted" });
+    check("monitor emits system.ntp.checked each tick",
+          auditEvents.some(function (e) { return e.action === "system.ntp.checked"; }));
+    check("monitor system.ntp.checked outcome is fail on fatal drift",
+          auditEvents.some(function (e) { return e.action === "system.ntp.checked" && e.outcome === "fail"; }));
+    var fatal = auditEvents.find(function (e) { return e.action === "system.ntp.drift_fatal"; });
+    check("monitor drift_fatal audit carries driftMs metadata",
+          fatal && fatal.metadata && typeof fatal.metadata.driftMs === "number");
+
+    // stop() halts the ticker — over a 10-interval window a running monitor
+    // would fire ~10 more onDrifts; a stopped one fires at most one straggler
+    // (a tick already in-flight past the stopped-guard when stop() ran).
+    mon.stop();
+    var before = drifts.length;
+    await helpers.passiveObserve(400, "ntpCheck.monitor: no ticks after stop()");
+    check("monitor stop() halts further ticks", drifts.length - before <= 1);
+  } finally {
+    mon.stop();
+    b.audit.safeEmit = realSafeEmit;
+    await new Promise(function (resolve) { fake.srv.close(resolve); });
+    b.ntpCheck._resetThresholdsForTest();
+  }
+}
+
+async function run() {
+  testMonitorRejectsBadInterval();
+  await testMonitorFiresOnDriftAndAudits();
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  run().then(
+    function () { console.log("[ntp-check] OK — " + helpers.getChecks() + " checks passed"); },
+    function (e) { console.error("FAIL:", e); process.exit(1); }
+  );
+}

package/lib/vendor/blamejs/test/layer-0-primitives/observability-tracing.test.js

@@ -16,6 +16,63 @@ var helpers = require("../helpers");
 var b = helpers.b;
 var check = helpers.check;
 
+var otlpEx = require("../../lib/observability-otlp-exporter");
+
+// Minimal pre-OTLP span object (the shape b.observability.tracer's
+// span.toJSON() produces). Overrides let each edge-case test perturb
+// exactly one field without re-declaring the whole record.
+function _mkSpan(overrides) {
+  var s = {
+    traceId:           "0123456789abcdef0123456789abcdef",
+    spanId:            "0123456789abcdef",
+    parentSpanId:      "",
+    name:              "op",
+    kind:              "internal",
+    startTimeUnixNano: "100",
+    endTimeUnixNano:   "200",
+    attributes:        {},
+    events:            [],
+    status:            { code: "ok", message: "" },
+    droppedAttributesCount: 0,
+    droppedEventsCount:     0,
+  };
+  if (overrides) { for (var k in overrides) { s[k] = overrides[k]; } }
+  return s;
+}
+
+// Walk the top-level fields of a protobuf message, returning
+// [ [fieldNumber, wireType], ... ] in emission order. Skips each
+// field's payload by its wire type so the walk stays aligned. Used to
+// assert the Span message emits dropped_links_count at field 14 and
+// Status (a length-delimited message) at field 15 — never a bare varint
+// on the Status field number.
+function _scanTopLevelProtoFields(buf) {
+  var fields = [];
+  var i = 0;
+  function readVarint() {
+    var shift = 0, result = 0;
+    while (i < buf.length) {
+      var byte = buf[i++];
+      result += (byte & 0x7f) * Math.pow(2, shift);
+      if ((byte & 0x80) === 0) break;
+      shift += 7;
+    }
+    return result;
+  }
+  while (i < buf.length) {
+    var tag = readVarint();
+    var field = Math.floor(tag / 8);
+    var wire = tag & 7;
+    fields.push([field, wire]);
+    if (wire === 0) { readVarint(); }
+    else if (wire === 1) { i += 8; }
+    else if (wire === 2) { var len = readVarint(); i += len; }
+    else if (wire === 5) { i += 4; }
+    else break;
+  }
+  return fields;
+}
+
 // ---- Tracestate ----
 
 function testTracestateParse() {
@@ -666,6 +723,308 @@ function testTracerToJSONIsImmutable() {
         json2.attributes.foo === "bar");
 }
 
+// ---- OTLP builder: attribute type coercion (JSON path) ----
+
+function testOtlpAttrValueCoercion() {
+  b.observability.setRedactor(null);   // default redactor — non-sensitive keys pass through
+  var out = otlpEx._attrToOtlp({
+    s:   "x",
+    i:   42,
+    d:   1.5,
+    bt:  true,
+    bf:  false,
+    arr: [1, "two", true],
+    obj: { a: 1 },
+  });
+  var by = {};
+  for (var j = 0; j < out.length; j++) { by[out[j].key] = out[j].value; }
+  check("otlp.attr: string → stringValue",  by.s && by.s.stringValue === "x");
+  check("otlp.attr: integer → intValue string", by.i && by.i.intValue === "42");
+  check("otlp.attr: float → doubleValue",   by.d && by.d.doubleValue === 1.5);
+  check("otlp.attr: true → boolValue",      by.bt && by.bt.boolValue === true);
+  check("otlp.attr: false → boolValue",     by.bf && by.bf.boolValue === false);
+  check("otlp.attr: array → arrayValue.values length",
+        by.arr && by.arr.arrayValue && by.arr.arrayValue.values.length === 3);
+  check("otlp.attr: array element types preserved",
+        by.arr.arrayValue.values[0].intValue === "1" &&
+        by.arr.arrayValue.values[1].stringValue === "two" &&
+        by.arr.arrayValue.values[2].boolValue === true);
+  check("otlp.attr: plain object → String() coercion",
+        by.obj && by.obj.stringValue === "[object Object]");
+}
+
+function testOtlpAttrNonObjectInputs() {
+  // _attrToOtlp tolerates a non-object attribute bag (a malformed span
+  // that carries a scalar / null where a map is expected) → empty array,
+  // never a throw.
+  check("otlp.attr: null attrs → []",      otlpEx._attrToOtlp(null).length === 0);
+  check("otlp.attr: undefined attrs → []", otlpEx._attrToOtlp(undefined).length === 0);
+  check("otlp.attr: string attrs → []",    otlpEx._attrToOtlp("nope").length === 0);
+  check("otlp.attr: number attrs → []",    otlpEx._attrToOtlp(42).length === 0);
+}
+
+// ---- OTLP builder: span defaulting / fallbacks (JSON path) ----
+
+function testOtlpSpanToOtlpDefaults() {
+  // Unknown kind → SPAN_KIND_INTERNAL (1); missing endTime → startTime;
+  // missing status → { code: 0, message: "" }; undefined events → [].
+  var s = otlpEx._spanToOtlp({
+    traceId:           "aa",
+    spanId:            "bb",
+    name:              "op",
+    kind:              "bogus-kind",
+    startTimeUnixNano: "500",
+    // endTimeUnixNano, status, events, parentSpanId, attributes omitted
+  });
+  check("otlp.span: unknown kind falls back to internal(1)", s.kind === 1);
+  check("otlp.span: missing endTime falls back to startTime",
+        s.endTimeUnixNano === "500");
+  check("otlp.span: missing status → code 0",   s.status.code === 0);
+  check("otlp.span: missing status → empty msg", s.status.message === "");
+  check("otlp.span: missing parentSpanId → ''",  s.parentSpanId === "");
+  check("otlp.span: undefined events → []",      Array.isArray(s.events) && s.events.length === 0);
+  check("otlp.span: undefined attributes → []",  Array.isArray(s.attributes) && s.attributes.length === 0);
+
+  // Named kind maps through, status code maps through, events map through.
+  var s2 = otlpEx._spanToOtlp(_mkSpan({
+    kind:   "server",
+    status: { code: "error", message: "boom" },
+    events: [{ name: "ev", timeUnixNano: "5", attributes: { k: "v" } }],
+    droppedEventsCount: 3,
+  }));
+  check("otlp.span: server kind → 2", s2.kind === 2);
+  check("otlp.span: error status → 2", s2.status.code === 2);
+  check("otlp.span: status message preserved", s2.status.message === "boom");
+  check("otlp.span: event mapped with name + attrs",
+        s2.events.length === 1 && s2.events[0].name === "ev" &&
+        s2.events[0].attributes[0].key === "k");
+  check("otlp.span: droppedEventsCount preserved", s2.droppedEventsCount === 3);
+}
+
+// ---- OTLP builder: resource bundling / batching edges ----
+
+function testOtlpBundleEmptyAndGrouping() {
+  check("otlp.bundle: empty batch → empty resourceSpans",
+        otlpEx._bundleSpans([]).resourceSpans.length === 0);
+
+  // Two spans, distinct resource attrs → two resourceSpans entries.
+  var multi = otlpEx._bundleSpans([
+    _mkSpan({ resource: { "service.name": "alpha" } }),
+    _mkSpan({ resource: { "service.name": "beta" } }),
+  ]);
+  check("otlp.bundle: distinct resources split into 2 envelopes",
+        multi.resourceSpans.length === 2);
+  check("otlp.bundle: resource attributes emitted as KeyValue array",
+        Array.isArray(multi.resourceSpans[0].resource.attributes) &&
+        multi.resourceSpans[0].resource.attributes[0].key === "service.name");
+
+  // Two spans, SAME resource → one envelope holding both spans.
+  var grouped = otlpEx._bundleSpans([
+    _mkSpan({ resource: { "service.name": "same" }, name: "a" }),
+    _mkSpan({ resource: { "service.name": "same" }, name: "b" }),
+  ]);
+  check("otlp.bundle: shared resource groups into 1 envelope",
+        grouped.resourceSpans.length === 1);
+  check("otlp.bundle: grouped envelope holds both spans",
+        grouped.resourceSpans[0].scopeSpans[0].spans.length === 2);
+
+  // Missing scope → default blamejs scope name, empty version string.
+  var noScope = otlpEx._bundleSpans([_mkSpan({})]);
+  var scope = noScope.resourceSpans[0].scopeSpans[0].scope;
+  check("otlp.bundle: default scope name", scope.name === "blamejs");
+  check("otlp.bundle: default scope version → ''", scope.version === "");
+}
+
+// ---- OTLP builder: protobuf wire-format edges ----
+
+function testOtlpProtobufSpanFieldLayout() {
+  // Span-message top-level field layout regression guard. Status is proto
+  // field 15 (a length-delimited message); dropped_attributes_count is 10,
+  // dropped_events_count is 12, dropped_links_count is 14. The encoder must
+  // never place a bare varint on the Status field number 15 — that would
+  // corrupt the Status message for a strict OTLP protobuf collector. (The
+  // hardcoded dropped_links_count is 0 and proto3 omits it from the wire, so
+  // both field 14 and a stray field-15 varint are absent today; this asserts
+  // the invariant so a future non-zero placeholder can't regress onto 15.)
+  var buf = otlpEx._spanToProto(_mkSpan({
+    droppedAttributesCount: 3,   // → field 10 emits (non-zero)
+    droppedEventsCount:     2,   // → field 12 emits (non-zero)
+  }));
+  check("otlp.proto: span encodes to a non-empty Buffer",
+        Buffer.isBuffer(buf) && buf.length > 0);
+  var fields = _scanTopLevelProtoFields(buf);
+  function has(field, wire) {
+    return fields.some(function (f) { return f[0] === field && f[1] === wire; });
+  }
+  check("otlp.proto: dropped_attributes_count at field 10 (varint)", has(10, 0));
+  check("otlp.proto: dropped_events_count at field 12 (varint)",     has(12, 0));
+  check("otlp.proto: no bare varint on Status field 15", !has(15, 0));
+  check("otlp.proto: Status at field 15 as length-delimited message", has(15, 2));
+}
+
+function testOtlpProtobufMalformedHexIds() {
+  // Malformed inbound trace/span ids (odd length, non-hex chars, empty)
+  // must not crash the encoder — _hexToBytes drops to empty bytes.
+  var buf = otlpEx._spanToProto(_mkSpan({
+    traceId:      "abc",              // odd length → empty
+    spanId:       "zzzzzzzzzzzzzzzz", // non-hex → empty
+    parentSpanId: "",                 // empty → empty
+  }));
+  check("otlp.proto: malformed ids encode without throwing",
+        Buffer.isBuffer(buf) && buf.length > 0);
+}
+
+function testOtlpProtobufAnyValueDepthCap() {
+  // A deeply nested array attribute must not blow the stack / recurse
+  // past MAX_ANYVALUE_DEPTH — the encoder caps descent and emits empty.
+  var deep = 0;
+  for (var d = 0; d < 130; d++) { deep = [deep]; }
+  var buf = otlpEx._spanToProto(_mkSpan({ attributes: { nested: deep } }));
+  check("otlp.proto: deep-nested array attribute encodes without crashing",
+        Buffer.isBuffer(buf) && buf.length > 0);
+}
+
+// ---- OTLP exporter: create() option validation ----
+
+function testOtlpCreateEncodingValidation() {
+  function code(fn) { try { fn(); } catch (e) { return e.code; } return null; }
+  check("otlp.create: bogus encoding rejected",
+        code(function () {
+          otlpEx.create({ endpoint: "https://c.invalid/v1/traces", encoding: "xml", fetchImpl: function () {} });
+        }) === "otlp/bad-encoding");
+  // http/protobuf is a documented alias for protobuf — constructs fine.
+  var ex = otlpEx.create({
+    endpoint: "https://c.invalid/v1/traces",
+    encoding: "http/protobuf",
+    fetchImpl: function () {},
+    flushIntervalMs: 0,
+  });
+  check("otlp.create: http/protobuf alias constructs", typeof ex.flush === "function");
+}
+
+function testOtlpCreateFetchImplValidation() {
+  var threw = false, codeVal = null;
+  try {
+    otlpEx.create({ endpoint: "https://c.invalid/v1/traces", fetchImpl: 42 });
+  } catch (e) { threw = true; codeVal = e.code; }
+  check("otlp.create: non-function fetchImpl rejected", threw && codeVal === "otlp/no-fetch");
+}
+
+function testOtlpCreateNumericOptValidation() {
+  function code(fn) { try { fn(); } catch (e) { return e.code; } return null; }
+  var base = { endpoint: "https://c.invalid/v1/traces", fetchImpl: function () {}, flushIntervalMs: 0 };
+  check("otlp.create: negative batchSize rejected",
+        code(function () { otlpEx.create(Object.assign({}, base, { batchSize: -5 })); }) === "otlp/bad-opts");
+  check("otlp.create: non-numeric batchSize rejected",
+        code(function () { otlpEx.create(Object.assign({}, base, { batchSize: "big" })); }) === "otlp/bad-opts");
+  check("otlp.create: zero maxAttempts rejected",
+        code(function () { otlpEx.create(Object.assign({}, base, { maxAttempts: 0 })); }) === "otlp/bad-opts");
+  check("otlp.create: infinite maxQueueSize rejected",
+        code(function () { otlpEx.create(Object.assign({}, base, { maxQueueSize: Infinity })); }) === "otlp/bad-opts");
+}
+
+// ---- OTLP exporter: queue / flush / retry behaviour (injected transport) ----
+
+function _mkExporter(fetchImpl, extra) {
+  return otlpEx.create(Object.assign({
+    endpoint:         "http://localhost:4318/v1/traces",
+    allowedProtocols: b.safeUrl.ALLOW_HTTP_ALL,
+    fetchImpl:        fetchImpl,
+    batchSize:        100,   // large → queue() never auto-flushes; we flush explicitly
+    flushIntervalMs:  0,     // no ticker
+  }, extra || {}));
+}
+
+async function testOtlpFlushEmptyQueue() {
+  var ex = _mkExporter(function () { throw new Error("must not post on empty queue"); });
+  var r = await ex.flush();
+  check("otlp.flush: empty queue → sent 0", r.sent === 0);
+  await ex.shutdown();
+}
+
+async function testOtlpPostPermanent4xx() {
+  var attempts = 0;
+  var ex = _mkExporter(function () {
+    attempts += 1;
+    return Promise.resolve({ ok: false, status: 400 });   // permanent, non-retryable
+  }, { backoffInitialMs: 1 });
+  ex.queue(_mkSpan({}));
+  var r = await ex.flush();
+  check("otlp.post: 400 not retried (single attempt)", attempts === 1);
+  check("otlp.post: 400 batch dropped", r.dropped === 1 && r.sent === 0);
+  check("otlp.stats: droppedExportFailed incremented", ex.stats().droppedExportFailed === 1);
+  await ex.shutdown();
+}
+
+async function testOtlpPostRetryable429() {
+  var attempts = 0;
+  var ex = _mkExporter(function () {
+    attempts += 1;
+    if (attempts === 1) return Promise.resolve({ ok: false, status: 429 });   // retryable
+    return Promise.resolve({ ok: true, status: 200 });
+  }, { backoffInitialMs: 1 });
+  ex.queue(_mkSpan({}));
+  var r = await ex.flush();
+  check("otlp.post: 429 retried then succeeded", attempts === 2 && r.sent === 1);
+  await ex.shutdown();
+}
+
+async function testOtlpPostNetworkErrorExhausts() {
+  var attempts = 0;
+  var ex = _mkExporter(function () {
+    attempts += 1;
+    return Promise.reject(new Error("ECONNREFUSED"));
+  }, { backoffInitialMs: 1, maxAttempts: 2 });
+  ex.queue(_mkSpan({}));
+  var r = await ex.flush();
+  check("otlp.post: network error retried to maxAttempts", attempts === 2);
+  check("otlp.post: exhausted network error drops batch", r.dropped === 1 && r.sent === 0);
+  check("otlp.stats: network drop counted", ex.stats().droppedExportFailed === 1);
+  await ex.shutdown();
+}
+
+function testOtlpQueueOverflowDropsOldest() {
+  var ex = _mkExporter(function () { return Promise.resolve({ ok: true, status: 200 }); },
+    { maxQueueSize: 2 });
+  ex.queue(_mkSpan({ name: "one" }));
+  ex.queue(_mkSpan({ name: "two" }));
+  ex.queue(_mkSpan({ name: "three" }));   // overflow → drop oldest
+  var st = ex.stats();
+  check("otlp.queue: overflow capped at maxQueueSize", st.queueLength === 2);
+  check("otlp.queue: overflow drop counted", st.droppedQueueOverflow === 1);
+}
+
+function testOtlpQueueGarbageAndStopping() {
+  var ex = _mkExporter(function () { return Promise.resolve({ ok: true, status: 200 }); });
+  ex.queue(null);
+  ex.queue(42);
+  ex.queue("not-a-span");
+  check("otlp.queue: non-object spans ignored", ex.stats().queueLength === 0);
+}
+
+async function testOtlpQueueAfterShutdown() {
+  var ex = _mkExporter(function () { return Promise.resolve({ ok: true, status: 200 }); });
+  await ex.shutdown();                    // sets stopping
+  ex.queue(_mkSpan({}));                  // must be dropped, not queued
+  var st = ex.stats();
+  check("otlp.queue: post-shutdown span not queued", st.queueLength === 0);
+  check("otlp.queue: post-shutdown span counted as export-failed drop",
+        st.droppedExportFailed >= 1);
+}
+
+async function testOtlpFlushProtobufBodyIsBuffer() {
+  var bodies = [];
+  var ex = _mkExporter(function (url, init) {
+    bodies.push(init.body);
+    return Promise.resolve({ ok: true, status: 200 });
+  }, { encoding: "protobuf" });
+  ex.queue(_mkSpan({ attributes: { retry: -7 } }));   // negative int64 through proto path
+  var r = await ex.flush();
+  check("otlp.flush: protobuf batch sent", r.sent === 1);
+  check("otlp.flush: protobuf body is a Buffer", Buffer.isBuffer(bodies[0]) && bodies[0].length > 0);
+  await ex.shutdown();
+}
+
 // ---- Run all ----
 
 async function run() {
@@ -699,6 +1058,25 @@ async function run() {
   testTracerToJSONIsImmutable();
   testTraceLogCorrelationRejectsAuditOpt();
   testTracerRejectsAuditOpt();
+  // OTLP wire-format builder edges
+  testOtlpAttrValueCoercion();
+  testOtlpAttrNonObjectInputs();
+  testOtlpSpanToOtlpDefaults();
+  testOtlpBundleEmptyAndGrouping();
+  testOtlpProtobufSpanFieldLayout();
+  testOtlpProtobufMalformedHexIds();
+  testOtlpProtobufAnyValueDepthCap();
+  testOtlpCreateEncodingValidation();
+  testOtlpCreateFetchImplValidation();
+  testOtlpCreateNumericOptValidation();
+  await testOtlpFlushEmptyQueue();
+  await testOtlpPostPermanent4xx();
+  await testOtlpPostRetryable429();
+  await testOtlpPostNetworkErrorExhausts();
+  testOtlpQueueOverflowDropsOldest();
+  testOtlpQueueGarbageAndStopping();
+  await testOtlpQueueAfterShutdown();
+  await testOtlpFlushProtobufBodyIsBuffer();
 }
 
 module.exports = { run: run };