cabloy 5.1.206 → 5.1.207

package/vona/packages-vona/vona-core/src/lib/framework/start.test.ts

@@ -0,0 +1,127 @@
+import assert from 'node:assert/strict';
+import { spawnSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { mkdir, mkdtemp, readFile, realpath, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+import { test } from 'node:test';
+
+const startUrl = new URL('./start.ts', import.meta.url).href;
+
+// Execute Start's real lifecycle with only its imported collaborators mocked. No application,
+// environment files, database/Redis connections, or server listeners are created.
+const lifecycleSource = `
+  import assert from 'node:assert/strict';
+  import { readFile } from 'node:fs/promises';
+  import { registerHooks } from 'node:module';
+  const startUrl = ${JSON.stringify(startUrl)};
+  const mocks = {
+    '../../types/index.ts': 'export const EnumAppEvent = { AppStartError: "error", AppStarted: "started" };',
+    '../core/isolationGuard.ts': 'export function assertIsolatedTestConfig() {}',
+    '../core/testClaim.ts': 'export function registerTestClaimResourceInventory() {}',
+    '../module/loader.ts': 'export class ModuleLoader { async execute() { await globalThis.phase("Load"); } }',
+    '../utils/util.ts': 'export function deepExtend(target, source) { Object.assign(target, source); }',
+  };
+  registerHooks({
+    resolve(specifier, context, nextResolve) {
+      if (context.parentURL === startUrl && mocks[specifier]) {
+        return { url: 'data:text/javascript,' + encodeURIComponent(mocks[specifier]), shortCircuit: true };
+      }
+      return nextResolve(specifier, context);
+    },
+  });
+  const { Start } = await import(startUrl);
+  const [projectPath, lockPath, lockContents, failingPhase] = process.argv.slice(1);
+  const phases = [];
+  const events = [];
+  const failure = new Error(failingPhase);
+  globalThis.phase = async phase => {
+    assert.equal(await readFile(lockPath, 'utf8'), lockContents);
+    phases.push(phase);
+    if (phase === failingPhase) throw failure;
+  };
+  const config = {
+    database: { testDatabase: true },
+    server: { keys: ['test-key'], subdomainOffset: 2 },
+    proxy: { enable: false, ipHeaders: 'X-Forwarded-For', maxIpsCount: 0 },
+  };
+  const app = {
+    projectPath,
+    name: 'app',
+    meta: { env: { META_MODE: 'dev' } },
+    options: { async config() {
+      await globalThis.phase('Config');
+      return { default: [() => config] };
+    } },
+    bean: { _newBean: Bean => new Bean() },
+    util: { async monkeyModule(_appMonkey, _modulesMonkey, _forward, hook) {
+      await globalThis.phase(hook.slice(3));
+    } },
+    emit(event, error) {
+      events.push({ event, error, phases: [...phases] });
+    },
+  };
+  const start = new Start(app);
+  const order = ['Config', 'Load', 'Start', 'Ready', 'Started'];
+  if (failingPhase) {
+    await assert.rejects(start.start(), error => error === failure);
+    assert.equal(app.meta.appStartError, failure);
+    assert.deepEqual(phases, order.slice(0, order.indexOf(failingPhase) + 1));
+    assert.equal(events.at(-1).event, 'error');
+    assert.equal(events.at(-1).error, failure);
+    assert.deepEqual(events.at(-1).phases, phases);
+  } else {
+    await start.start();
+    assert.deepEqual(phases, order);
+    assert.equal(app.meta.appStartError, undefined);
+  }
+  const reachesStarted = !failingPhase || failingPhase === 'Started';
+  assert.equal(app.meta.appStarted, reachesStarted ? true : undefined);
+  const reachesReady = reachesStarted || failingPhase === 'Ready';
+  assert.equal(app.meta.appReady, reachesReady ? true : undefined);
+  if (reachesReady) assert.deepEqual(app.meta.appReadyInstances, {});
+  assert.deepEqual(events.map(item => item.event), [
+    ...(reachesStarted ? ['started'] : []),
+    ...(failingPhase ? ['error'] : []),
+  ]);
+  if (reachesStarted) {
+    assert.deepEqual(events[0].phases, ['Config', 'Load', 'Start', 'Ready']);
+  }
+  assert.equal(await readFile(lockPath, 'utf8'), lockContents);
+  console.log('verified');
+`;
+
+for (const failingPhase of ['', 'Config', 'Load', 'Start', 'Ready', 'Started']) {
+  test(`Start ignores the legacy preparation lock on ${failingPhase ? `${failingPhase} failure` : 'success'}`, async () => {
+    const root = await mkdtemp(path.join(await realpath(tmpdir()), 'vona-start-'));
+    try {
+      const identity = createHash('sha256')
+        .update(JSON.stringify([root, 'app']))
+        .digest('hex');
+      const lockPath = path.join(root, '.app', 'dev-database-preparation', `${identity}.lock`);
+      const lockContents = `${JSON.stringify({ token: 'legacy-owner', pid: process.pid })}\n`;
+      await mkdir(path.dirname(lockPath), { recursive: true });
+      await writeFile(lockPath, lockContents);
+      const result = spawnSync(
+        process.execPath,
+        [
+          '--input-type=module',
+          '--eval',
+          lifecycleSource,
+          root,
+          lockPath,
+          lockContents,
+          failingPhase,
+        ],
+        { encoding: 'utf8', timeout: 5_000 },
+      );
+      assert.ifError(result.error);
+      assert.equal(result.signal, null, result.stderr);
+      assert.equal(result.status, 0, result.stderr);
+      assert.equal(result.stdout.trim(), 'verified');
+      assert.equal(await readFile(lockPath, 'utf8'), lockContents);
+    } finally {
+      await rm(root, { recursive: true, force: true });
+    }
+  });
+}

package/vona/packages-vona/vona-mock/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-mock",
-  "version": "6.1.44",
+  "version": "6.1.45",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "vona mock",
   "keywords": [

package/vona/src/suite-vendor/a-vona/modules/a-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-a-core",
-  "version": "5.1.58",
+  "version": "5.1.59",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "keywords": [

package/vona/src/suite-vendor/a-vona/modules/a-redis/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-a-redis",
-  "version": "5.1.17",
+  "version": "5.1.18",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "keywords": [

package/vona/src/suite-vendor/a-vona/modules/a-redis/src/service/redis.ts

@@ -1,67 +1,102 @@
 import type { Redis } from 'ioredis';
 
-import { BeanBase, resolveTestRunId } from 'vona';
+import { assertTestAppIdentity, BeanBase } from 'vona';
 import { Service } from 'vona-module-a-bean';
 
 import type { IRedisClientRecord } from '../types/redis.ts';
 
 import { getRedisClientKeyPrefix, prepareRedisClientKeyPrefix } from '../lib/redis.ts';
 
+interface RedisCleanupTarget {
+  redis: Redis;
+  expectedPrefix: string;
+  keyPrefix: string | undefined;
+}
+
 @Service()
 export class ServiceRedis extends BeanBase {
   async clearAllData() {
     const app = this.app;
-    // clear keys
-    await this._clearRedisKeys(
-      app.bean.redis.get('queue'),
-      getRedisClientKeyPrefix('bull', app),
-      true,
+    const isolated = assertTestAppIdentity(
+      app.meta.env.META_MODE,
+      app.meta.env.VONA_TEST_RUN_ID,
+      app.name,
     );
-    // broadcast channel has subscribed
-    // await _clearRedisKeys(app.redis.get('broadcast'), `${getRedisClientKeyPrefix('broadcast', app)}*`);
-    for (const _clientName in app.config.redis.clients) {
+    if (isolated && app.config.redis.base.keyPrefix !== undefined) {
+      throw new Error('Isolated test cannot inherit a Redis base keyPrefix');
+    }
+
+    // Prepare every target before looking up keys or deleting anything.
+    const targets = [this._prepareCleanupTarget('queue', Boolean(isolated))];
+    for (const _clientName of Object.keys(app.config.redis.clients)) {
       const clientName = _clientName as keyof IRedisClientRecord;
+      // Broadcast carries subscriptions, not cleanup keys.
       if (['queue', 'broadcast'].includes(clientName)) continue;
-      if (clientName.startsWith('redlock')) {
-        await this._clearRedisKeys(
-          app.bean.redis.get(clientName),
-          getRedisClientKeyPrefix('redlock', app),
-          true,
-        );
-      } else {
-        const client = app.config.redis.clients[clientName];
-        const keyPrefix = prepareRedisClientKeyPrefix(client.keyPrefix, clientName, this.app);
-        await this._clearRedisKeys(app.bean.redis.get(clientName), keyPrefix!);
+      targets.push(this._prepareCleanupTarget(clientName, Boolean(isolated)));
+    }
+
+    // KEYS returns full keys even for prefixed clients. Validate the complete
+    // lookup result for every target before issuing the first DEL.
+    const deletions: { redis: Redis; keys: string[] }[] = [];
+    for (const { redis, expectedPrefix, keyPrefix } of targets) {
+      const fullKeys = await redis.keys(`${expectedPrefix}*`);
+      if (
+        !Array.isArray(fullKeys) ||
+        fullKeys.some(key => typeof key !== 'string' || !key.startsWith(expectedPrefix))
+      ) {
+        throw new Error('Redis cleanup lookup returned a key outside the owned prefix');
       }
+      deletions.push({
+        redis,
+        keys: fullKeys.map(key => (keyPrefix ? key.substring(keyPrefix.length) : key)),
+      });
+    }
+    for (const { redis, keys } of deletions) {
+      if (keys.length > 0) await redis.del(keys);
     }
   }
 
-  private async _clearRedisKeys(redis: Redis, expectedPrefix: string, unprefixedClient = false) {
-    if (!redis) return;
-    const isolated = resolveTestRunId(
-      this.app.meta.env.META_MODE,
-      this.app.meta.env.VONA_TEST_RUN_ID,
+  private _prepareCleanupTarget(
+    clientName: keyof IRedisClientRecord,
+    isolated: boolean,
+  ): RedisCleanupTarget {
+    const app = this.app;
+    const configClient = app.config.redis.clients[clientName];
+    if (!configClient) throw new Error(`Redis cleanup client is not configured: ${clientName}`);
+    if (isolated && ('sentinels' in configClient || 'nodes' in configClient)) {
+      throw new Error(`Isolated test cannot use a Redis sentinel or cluster client: ${clientName}`);
+    }
+    const unprefixedClient = clientName === 'queue' || clientName.startsWith('redlock');
+    const frameworkPrefix = getRedisClientKeyPrefix(
+      clientName === 'queue' ? 'bull' : unprefixedClient ? 'redlock' : clientName,
+      app,
     );
-    const keyPrefix = redis.options.keyPrefix;
-    if (isolated) {
-      if (!expectedPrefix.includes(this.app.name) || !expectedPrefix.endsWith(':')) {
-        throw new Error('Isolated test Redis cleanup prefix does not belong to this run');
-      }
-      if (unprefixedClient ? Boolean(keyPrefix) : keyPrefix !== expectedPrefix) {
-        throw new Error('Isolated test Redis cleanup uses an unexpected client prefix');
-      }
+    const configuredPrefix = prepareRedisClientKeyPrefix(configClient.keyPrefix, clientName, app);
+    const expectedPrefix = unprefixedClient ? frameworkPrefix : configuredPrefix;
+    if (
+      !app.name ||
+      typeof expectedPrefix !== 'string' ||
+      !expectedPrefix.startsWith(frameworkPrefix) ||
+      !expectedPrefix.endsWith(':') ||
+      /[*?[\]\\]/.test(expectedPrefix) ||
+      Array.from(expectedPrefix).some(
+        char => char.charCodeAt(0) <= 32 || char.charCodeAt(0) === 127,
+      )
+    ) {
+      throw new Error(`Redis cleanup prefix does not belong to this app: ${clientName}`);
     }
-    const keys = await redis.keys(`${expectedPrefix}*`);
-    const keysDel: string[] = [];
-    for (const fullKey of keys) {
-      if (isolated && !fullKey.startsWith(expectedPrefix)) {
-        throw new Error('Isolated test Redis lookup returned a key outside the owned prefix');
-      }
-      const key = keyPrefix ? fullKey.substring(keyPrefix.length) : fullKey;
-      keysDel.push(key);
+    // Custom prefixes may narrow the framework namespace, never widen it.
+    if (unprefixedClient && configuredPrefix !== undefined && configuredPrefix !== '') {
+      throw new Error(`Redis cleanup requires an unprefixed client: ${clientName}`);
     }
-    if (keysDel.length > 0) {
-      await redis.del(keysDel);
+    const redis = app.bean.redis.get(clientName);
+    if (!redis?.options) throw new Error(`Redis cleanup client is unavailable: ${clientName}`);
+    const keyPrefix = redis.options.keyPrefix;
+    if (
+      unprefixedClient ? keyPrefix !== undefined && keyPrefix !== '' : keyPrefix !== expectedPrefix
+    ) {
+      throw new Error(`Redis cleanup uses an unexpected client prefix: ${clientName}`);
     }
+    return { redis, expectedPrefix, keyPrefix };
   }
 }

package/vona/src/suite-vendor/a-vona/modules/a-redis/test/redisCleanup.test.ts

@@ -0,0 +1,378 @@
+import type { VonaApplication } from 'vona';
+
+import assert from 'node:assert/strict';
+import { execFile } from 'node:child_process';
+import { registerHooks } from 'node:module';
+import { describe, it } from 'node:test';
+import { fileURLToPath } from 'node:url';
+import { promisify } from 'node:util';
+
+import { getRedisClientKeyPrefix } from '../src/lib/redis.ts';
+
+// Only bypass bean registration; exercise the real service and prefix helpers
+// with object mocks, without loading an app or connecting to Redis.
+const serviceUrl = new URL('../src/service/redis.ts', import.meta.url).href;
+const hooks = registerHooks({
+  resolve(specifier, context, nextResolve) {
+    if (context.parentURL === serviceUrl && specifier === 'vona-module-a-bean') {
+      return {
+        url: 'data:text/javascript,export function Service() { return () => {}; }',
+        shortCircuit: true,
+      };
+    }
+    return nextResolve(specifier, context);
+  },
+});
+const { ServiceRedis } = await import('../src/service/redis.ts');
+hooks.deregister();
+
+const runId = '20261014010203-a1b2c3d4';
+const prefixedClients = ['default', 'cache', 'io', 'summer', 'model', 'worker', 'limiter'];
+const clientNames = ['queue', 'broadcast', 'redlock', 'redlockPeer', ...prefixedClients];
+
+type ClientConfig = {
+  keyPrefix?: string | true;
+  sentinels?: unknown[];
+  nodes?: unknown[];
+};
+
+function createFixture(mode = 'dev', isolated = false) {
+  const name = isolated ? `cabtest${runId}` : 'cleanup-app';
+  const config = {
+    meta: { mode },
+    redis: {
+      base: {} as { keyPrefix?: string },
+      clients: Object.fromEntries(
+        clientNames.map(clientName => [
+          clientName,
+          prefixedClients.includes(clientName) ? { keyPrefix: true } : {},
+        ]),
+      ) as Record<string, ClientConfig>,
+    },
+  };
+  const calls: { clientName: string; command: string; keys: string[] }[] = [];
+  const store = new Set<string>();
+  const clients: Record<
+    string,
+    {
+      options: { keyPrefix?: string };
+      keys: (pattern: string) => Promise<string[]>;
+      del: (keys: string[]) => Promise<number>;
+    }
+  > = {};
+  const app = {
+    name,
+    meta: { env: { META_MODE: mode, VONA_TEST_RUN_ID: isolated ? runId : undefined } },
+    config,
+    bean: {
+      redis: {
+        get(clientName: string) {
+          if (clientName === 'broadcast') {
+            throw new Error('Cleanup must not access the subscribed broadcast client');
+          }
+          return clients[clientName];
+        },
+      },
+    },
+  } as unknown as VonaApplication;
+  const prefix = (clientName: string) => getRedisClientKeyPrefix(clientName, app);
+  for (const clientName of clientNames) {
+    const keyPrefix = prefixedClients.includes(clientName) ? prefix(clientName) : undefined;
+    const client = {
+      options: { keyPrefix },
+      async keys(pattern: string) {
+        calls.push({ clientName, command: 'keys', keys: [pattern] });
+        assert.equal(pattern.endsWith('*'), true);
+        assert.equal(/[?[\]\\*]/.test(pattern.slice(0, -1)), false);
+        return [...store].filter(key => key.startsWith(pattern.slice(0, -1)));
+      },
+      async del(keys: string[]) {
+        calls.push({ clientName, command: 'del', keys });
+        for (const key of keys) store.delete(`${client.options.keyPrefix ?? ''}${key}`);
+        return keys.length;
+      },
+    };
+    clients[clientName] = client;
+  }
+  const service = Object.create(ServiceRedis.prototype) as InstanceType<typeof ServiceRedis>;
+  Object.defineProperty(service, 'app', { value: app });
+  return { app, service, config, clients, store, calls, prefix };
+}
+
+function addOwnedKeys(fixture: ReturnType<typeof createFixture>) {
+  for (const category of ['bull', 'redlock', ...prefixedClients]) {
+    fixture.store.add(`${fixture.prefix(category)}record`);
+  }
+}
+
+async function assertNoDeletion(
+  fixture: ReturnType<typeof createFixture>,
+  error: RegExp,
+  noLookup = true,
+) {
+  const before = [...fixture.store];
+  await assert.rejects(fixture.service.clearAllData(), error);
+  assert.deepEqual([...fixture.store], before);
+  assert.equal(
+    fixture.calls.some(call => call.command === 'del'),
+    false,
+  );
+  if (noLookup) assert.deepEqual(fixture.calls, []);
+}
+
+describe('Redis clearAllData ownership', () => {
+  // resolveTestRunId defaults an undefined fixture ID to the process ID. Under
+  // the isolated app runner, execute ordinary-app fixtures in their own pure
+  // process rather than mutating the runner's process-global environment.
+  if (process.env.VONA_TEST_RUN_ID !== undefined) {
+    it('runs ordinary-app ownership cases without inheriting the isolated runner ID', async () => {
+      const loader = import.meta.resolve('ts-node-maintained/esm');
+      const projectRoot = new URL('../../../../../../', import.meta.url);
+      const registerSource = `import { register } from 'node:module'; register(${JSON.stringify(loader)}, ${JSON.stringify(projectRoot.href)});`;
+      const env = Object.fromEntries(Object.entries(process.env)) as NodeJS.ProcessEnv;
+      delete env.VONA_TEST_RUN_ID;
+      delete env.NODE_TEST_CONTEXT;
+      env.TS_NODE_PROJECT = fileURLToPath(new URL('tsconfig.json', projectRoot));
+      const { stdout } = await promisify(execFile)(
+        process.execPath,
+        [
+          '--import',
+          `data:text/javascript,${encodeURIComponent(registerSource)}`,
+          '--test',
+          '--test-reporter=tap',
+          '--test-name-pattern=Redis clearAllData ownership',
+          fileURLToPath(import.meta.url),
+        ],
+        { env, timeout: 30_000 },
+      );
+      assert.match(stdout, /# fail 0\b/);
+      assert.match(stdout, /# pass 35\b/);
+    });
+    return;
+  }
+
+  for (const mode of ['dev', 'test', 'prod']) {
+    it(`cleans every category without touching other apps or broadcast in ${mode}`, async () => {
+      const fixture = createFixture(mode);
+      addOwnedKeys(fixture);
+      const preserved = [
+        `${fixture.prefix('broadcast')}subscription`,
+        'unprefixed-global-key',
+        ...['bull', 'redlock', ...prefixedClients].flatMap(category => [
+          `${category}_other-app${mode === 'prod' ? '' : '_local'}:record`,
+          `${category}_cleanup-app-sibling${mode === 'prod' ? '' : '_local'}:record`,
+          `${category}_cleanup-app${mode === 'prod' ? '_local' : ''}:record`,
+        ]),
+      ];
+      for (const key of preserved) fixture.store.add(key);
+
+      await fixture.service.clearAllData();
+
+      assert.deepEqual([...fixture.store].toSorted(), preserved.toSorted());
+      assert.deepEqual(
+        fixture.calls.filter(call => call.command === 'keys').map(call => call.clientName),
+        clientNames.filter(clientName => clientName !== 'broadcast'),
+      );
+      const firstDelete = fixture.calls.findIndex(call => call.command === 'del');
+      assert.equal(firstDelete, clientNames.length - 1);
+      for (const clientName of prefixedClients) {
+        assert.deepEqual(
+          fixture.calls.find(call => call.clientName === clientName && call.command === 'del')
+            ?.keys,
+          ['record'],
+        );
+      }
+      assert.deepEqual(
+        fixture.calls.find(call => call.clientName === 'queue' && call.command === 'del')?.keys,
+        [`${fixture.prefix('bull')}record`],
+      );
+      assert.deepEqual(
+        fixture.calls.find(call => call.clientName === 'redlock' && call.command === 'del')?.keys,
+        [`${fixture.prefix('redlock')}record`],
+      );
+    });
+  }
+
+  it('allows only bounded custom nesting and strips the complete client prefix for DEL', async () => {
+    const fixture = createFixture();
+    const prefix = `${fixture.prefix('cache')}nested:deeper:`;
+    fixture.config.redis.clients.cache.keyPrefix = prefix;
+    fixture.clients.cache.options.keyPrefix = prefix;
+    fixture.store.add(`${prefix}record`);
+    fixture.store.add(`${fixture.prefix('cache')}outside-custom-namespace`);
+    fixture.store.add(`${fixture.prefix('cache')}nested:deeper-sibling:record`);
+
+    await fixture.service.clearAllData();
+
+    assert.deepEqual(
+      fixture.calls.filter(call => call.command === 'del'),
+      [{ clientName: 'cache', command: 'del', keys: ['record'] }],
+    );
+    assert.deepEqual(
+      [...fixture.store],
+      [
+        `${fixture.prefix('cache')}outside-custom-namespace`,
+        `${fixture.prefix('cache')}nested:deeper-sibling:record`,
+      ],
+    );
+  });
+
+  it('does not DEL when all owned lookups are empty', async () => {
+    const fixture = createFixture();
+    fixture.store.add('cache_other-app_local:record');
+    await fixture.service.clearAllData();
+    assert.equal(
+      fixture.calls.some(call => call.command === 'del'),
+      false,
+    );
+    assert.deepEqual([...fixture.store], ['cache_other-app_local:record']);
+  });
+
+  for (const keyPrefix of [
+    undefined,
+    '',
+    '*',
+    'undefined',
+    'worker_other-app_local:',
+    'worker_cleanup-app_local',
+    'worker_cleanup-app_local-sibling:',
+    'worker_cleanup-app_local:unbounded',
+    'worker_cleanup-app_local:*:',
+    'worker_cleanup-app_local:?:',
+    'worker_cleanup-app_local:[ab]:',
+    'worker_cleanup-app_local:back\\slash:',
+    'worker_cleanup-app_local:\n:',
+  ]) {
+    it(`rejects unsafe later configured prefixes before any lookup (${JSON.stringify(keyPrefix)})`, async () => {
+      const fixture = createFixture();
+      addOwnedKeys(fixture);
+      fixture.config.redis.clients.worker.keyPrefix = keyPrefix;
+      fixture.clients.worker.options.keyPrefix = keyPrefix;
+      await assertNoDeletion(fixture, /prefix does not belong to this app/);
+    });
+  }
+
+  for (const keyPrefix of [
+    undefined,
+    '',
+    'worker_other-app_local:',
+    'worker_cleanup-app_local:nested:',
+  ]) {
+    it(`rejects config/actual-client prefix drift before any lookup (${JSON.stringify(keyPrefix)})`, async () => {
+      const fixture = createFixture();
+      addOwnedKeys(fixture);
+      fixture.clients.worker.options.keyPrefix = keyPrefix;
+      await assertNoDeletion(fixture, /unexpected client prefix/);
+    });
+  }
+
+  it('rejects a configured custom prefix when the actual client still uses the framework prefix', async () => {
+    const fixture = createFixture();
+    addOwnedKeys(fixture);
+    fixture.config.redis.clients.worker.keyPrefix = `${fixture.prefix('worker')}nested:`;
+    await assertNoDeletion(fixture, /unexpected client prefix/);
+  });
+
+  for (const clientName of ['queue', 'redlock', 'redlockPeer']) {
+    it(`rejects prefixed special client configuration for ${clientName}`, async () => {
+      const fixture = createFixture();
+      addOwnedKeys(fixture);
+      fixture.config.redis.clients[clientName].keyPrefix = true;
+      await assertNoDeletion(fixture, /requires an unprefixed client/);
+    });
+
+    it(`rejects an unexpected actual keyPrefix for ${clientName}`, async () => {
+      const fixture = createFixture();
+      addOwnedKeys(fixture);
+      fixture.clients[clientName].options.keyPrefix = 'foreign:';
+      await assertNoDeletion(fixture, /unexpected client prefix/);
+    });
+  }
+
+  it('rejects an unavailable later client without deleting already prepared categories', async () => {
+    const fixture = createFixture();
+    addOwnedKeys(fixture);
+    delete fixture.clients.worker;
+    await assertNoDeletion(fixture, /client is unavailable/);
+  });
+
+  for (const clientName of ['queue', 'redlockPeer', 'worker']) {
+    it(`validates all fetched full keys before DEL when ${clientName} returns a foreign key`, async () => {
+      const fixture = createFixture();
+      addOwnedKeys(fixture);
+      const originalKeys = fixture.clients[clientName].keys;
+      fixture.clients[clientName].keys = async pattern => [
+        ...(await originalKeys(pattern)),
+        'worker_other-app_local:record',
+      ];
+      await assertNoDeletion(fixture, /key outside the owned prefix/, false);
+    });
+  }
+
+  it('does not delete earlier fetched keys when a later lookup fails', async () => {
+    const fixture = createFixture();
+    addOwnedKeys(fixture);
+    fixture.clients.worker.keys = async () => {
+      throw new Error('mock lookup failure');
+    };
+    await assertNoDeletion(fixture, /mock lookup failure/, false);
+  });
+
+  it('rejects unsafe app identities before looking up any keys', async () => {
+    const fixture = createFixture();
+    Object.defineProperty(fixture.app, 'name', { value: 'cleanup*app' });
+    await assertNoDeletion(fixture, /prefix does not belong to this app/);
+  });
+});
+
+describe('isolated Redis cleanup', () => {
+  it('cleans the full run namespace while preserving sibling runs', async () => {
+    const fixture = createFixture('test', true);
+    addOwnedKeys(fixture);
+    const sibling = 'bull_cabtest20261014010203-d4e5f6a7_local:record';
+    fixture.store.add(sibling);
+    await fixture.service.clearAllData();
+    assert.deepEqual([...fixture.store], [sibling]);
+  });
+
+  it('rejects a run/app identity mismatch before cleanup', async () => {
+    const fixture = createFixture('test', true);
+    addOwnedKeys(fixture);
+    Object.defineProperty(fixture.app, 'name', { value: 'cleanup-app' });
+    await assertNoDeletion(fixture, /APP_NAME does not match its run ID/);
+  });
+
+  it('keeps the strict framework-managed prefix requirement even for bounded custom nesting', async () => {
+    const fixture = createFixture('test', true);
+    addOwnedKeys(fixture);
+    const prefix = `${fixture.prefix('worker')}nested:`;
+    fixture.config.redis.clients.worker.keyPrefix = prefix;
+    fixture.clients.worker.options.keyPrefix = prefix;
+    await assertNoDeletion(fixture, /requires a framework-managed Redis prefix/);
+  });
+
+  it('rejects inherited base prefixes before cleanup', async () => {
+    const fixture = createFixture('test', true);
+    addOwnedKeys(fixture);
+    fixture.config.redis.base.keyPrefix = 'foreign:';
+    await assertNoDeletion(fixture, /cannot inherit a Redis base keyPrefix/);
+  });
+
+  for (const clientName of ['queue', 'redlockPeer']) {
+    it(`retains the isolated undefined configured prefix rule for ${clientName}`, async () => {
+      const fixture = createFixture('test', true);
+      addOwnedKeys(fixture);
+      fixture.config.redis.clients[clientName].keyPrefix = '';
+      await assertNoDeletion(fixture, /requires a framework-managed Redis prefix/);
+    });
+  }
+
+  for (const property of ['sentinels', 'nodes'] as const) {
+    it(`rejects isolated ${property} clients before cleanup`, async () => {
+      const fixture = createFixture('test', true);
+      addOwnedKeys(fixture);
+      fixture.config.redis.clients.worker[property] = [];
+      await assertNoDeletion(fixture, /cannot use a Redis sentinel or cluster client/);
+    });
+  }
+});