[Init] Initial commit - NetMesh terminal manager

electron/plugins/database.test.cjs

@@ -0,0 +1,835 @@
+"use strict";
+
+const assert = require("node:assert/strict");
+const fs = require("node:fs");
+const os = require("node:os");
+const path = require("node:path");
+const test = require("node:test");
+const { DatabaseSync } = require("node:sqlite");
+
+const {
+  MAX_SECURITY_AUDIT_DETAILS_BYTES,
+  PluginDatabase,
+  SCHEMA_VERSION,
+} = require("./database.cjs");
+
+function createDatabase(context, clock = () => 1_000) {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), "netcatty-plugin-db-"));
+  context.after(() => fs.rmSync(root, { recursive: true, force: true }));
+  return new PluginDatabase(path.join(root, "plugins.sqlite"), { clock });
+}
+
+function manifest(id = "com.example.test", version = "1.0.0") {
+  return {
+    manifestVersion: 1,
+    id,
+    name: "test",
+    version,
+    publisher: "example",
+    engines: { netcatty: ">=0.0.0", api: ">=0.1.0-internal <0.2.0" },
+    main: { browser: "dist/index.js" },
+  };
+}
+
+test("plugin database initializes atomically and rejects newer schemas", (context) => {
+  const database = createDatabase(context);
+  assert.equal(database.db.prepare("PRAGMA user_version").get().user_version, SCHEMA_VERSION);
+  assert.equal(database.db.prepare("PRAGMA foreign_keys").get().foreign_keys, 1);
+  database.close();
+
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), "netcatty-plugin-newer-db-"));
+  context.after(() => fs.rmSync(root, { recursive: true, force: true }));
+  const file = path.join(root, "plugins.sqlite");
+  const newer = new DatabaseSync(file);
+  newer.exec("PRAGMA user_version = 99");
+  newer.close();
+  assert.throws(() => new PluginDatabase(file), /newer than supported/);
+});
+
+test("obsolete unpublished v1 layouts fail with an explicit reset instruction", (context) => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), "netcatty-plugin-obsolete-db-"));
+  context.after(() => fs.rmSync(root, { recursive: true, force: true }));
+  const file = path.join(root, "plugins.sqlite");
+  const obsolete = new DatabaseSync(file);
+  obsolete.exec("CREATE TABLE plugins(id TEXT PRIMARY KEY); PRAGMA user_version = 1");
+  obsolete.close();
+  assert.throws(
+    () => new PluginDatabase(file),
+    /reset userData\/plugins\/plugins\.sqlite/,
+  );
+});
+
+test("complete schema-1 databases migrate in place to schema 3 with sidecar and binding tables", (context) => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), "netcatty-plugin-v1-migrate-"));
+  context.after(() => fs.rmSync(root, { recursive: true, force: true }));
+  const file = path.join(root, "plugins.sqlite");
+  const v1 = new DatabaseSync(file);
+  // Full pre-sidecar schema-1 layout (all tables except plugin_sync_sidecars).
+  v1.exec(`
+    PRAGMA foreign_keys = ON;
+    CREATE TABLE plugins (
+      id TEXT PRIMARY KEY,
+      enabled INTEGER NOT NULL DEFAULT 0 CHECK (enabled IN (0, 1)),
+      active_version TEXT,
+      installed_at INTEGER NOT NULL,
+      updated_at INTEGER NOT NULL
+    );
+    CREATE TABLE plugin_versions (
+      plugin_id TEXT NOT NULL REFERENCES plugins(id) ON DELETE CASCADE,
+      version TEXT NOT NULL,
+      manifest_json TEXT NOT NULL,
+      archive_sha256 TEXT NOT NULL,
+      package_relative_path TEXT NOT NULL,
+      installed_at INTEGER NOT NULL,
+      PRIMARY KEY (plugin_id, version)
+    );
+    CREATE TABLE plugin_runtime_state (
+      plugin_id TEXT NOT NULL,
+      plugin_version TEXT NOT NULL,
+      status TEXT NOT NULL DEFAULT 'stopped',
+      runtime_kind TEXT,
+      last_error TEXT,
+      quarantined_at INTEGER,
+      updated_at INTEGER NOT NULL,
+      PRIMARY KEY (plugin_id, plugin_version),
+      FOREIGN KEY (plugin_id, plugin_version)
+        REFERENCES plugin_versions(plugin_id, version) ON DELETE CASCADE
+    );
+    CREATE TABLE plugin_crashes (
+      plugin_id TEXT NOT NULL,
+      plugin_version TEXT NOT NULL,
+      crashed_at INTEGER NOT NULL,
+      FOREIGN KEY (plugin_id, plugin_version)
+        REFERENCES plugin_versions(plugin_id, version) ON DELETE CASCADE
+    );
+    CREATE TABLE plugin_kv (
+      plugin_id TEXT NOT NULL REFERENCES plugins(id) ON DELETE CASCADE,
+      key TEXT NOT NULL,
+      value_json TEXT NOT NULL,
+      updated_at INTEGER NOT NULL,
+      PRIMARY KEY (plugin_id, key)
+    );
+    CREATE TABLE plugin_settings (
+      plugin_id TEXT NOT NULL,
+      setting_id TEXT NOT NULL,
+      scope TEXT NOT NULL CHECK (scope IN ('application', 'workspace', 'host', 'session', 'device')),
+      scope_id TEXT NOT NULL,
+      value_json TEXT NOT NULL,
+      updated_at INTEGER NOT NULL,
+      PRIMARY KEY (plugin_id, setting_id, scope, scope_id)
+    );
+    CREATE TABLE plugin_view_state (
+      plugin_id TEXT NOT NULL,
+      view_id TEXT NOT NULL,
+      scope_id TEXT NOT NULL,
+      state_json TEXT NOT NULL,
+      updated_at INTEGER NOT NULL,
+      PRIMARY KEY (plugin_id, view_id, scope_id)
+    );
+    CREATE TABLE plugin_permission_grants (
+      plugin_id TEXT NOT NULL,
+      permission TEXT NOT NULL,
+      resource TEXT NOT NULL,
+      resource_kind TEXT NOT NULL CHECK (resource_kind IN ('exact', 'directory')),
+      declaration_hash TEXT NOT NULL,
+      granted_at INTEGER NOT NULL,
+      PRIMARY KEY (plugin_id, permission, resource)
+    );
+    CREATE TABLE plugin_secrets (
+      plugin_id TEXT NOT NULL,
+      key TEXT NOT NULL,
+      secret_ref TEXT NOT NULL UNIQUE,
+      ciphertext BLOB NOT NULL,
+      created_at INTEGER NOT NULL,
+      updated_at INTEGER NOT NULL,
+      PRIMARY KEY (plugin_id, key)
+    );
+    CREATE TABLE plugin_security_audit (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      plugin_id TEXT NOT NULL,
+      event TEXT NOT NULL,
+      details_json TEXT NOT NULL,
+      created_at INTEGER NOT NULL
+    );
+    PRAGMA user_version = 1;
+  `);
+  v1.prepare(
+    "INSERT INTO plugins(id, enabled, active_version, installed_at, updated_at) VALUES (?, 1, ?, 1, 1)",
+  ).run("com.example.v1", "1.0.0");
+  v1.close();
+
+  const database = new PluginDatabase(file);
+  assert.equal(database.db.prepare("PRAGMA user_version").get().user_version, SCHEMA_VERSION);
+  assert.deepEqual(
+    database.db.prepare("PRAGMA table_info(plugin_sync_sidecars)").all().map(({ name }) => name),
+    ["plugin_id", "kind", "key", "value_json", "updated_at"],
+  );
+  assert.deepEqual(
+    database.db.prepare("PRAGMA table_info(plugin_sync_provider_bindings)").all().map(({ name }) => name),
+    ["provider_id", "plugin_id", "created_at", "updated_at"],
+  );
+  // Existing rows survive the in-place migration.
+  assert.equal(database.db.prepare("SELECT id FROM plugins").get().id, "com.example.v1");
+  database.setSyncSidecar("com.example.v1", "settings", "theme\0application\0application", "dark", 2);
+  assert.equal(
+    database.getSyncSidecar("com.example.v1", "settings", "theme\0application\0application")?.value,
+    "dark",
+  );
+  database.upsertSyncProviderBinding("com.example.v1.sync", "com.example.v1");
+  assert.equal(database.getSyncProviderBinding("com.example.v1.sync")?.pluginId, "com.example.v1");
+  database.close();
+});
+
+test("initial schema scopes runtime and crash state to immutable plugin versions", (context) => {
+  const database = createDatabase(context);
+  assert.deepEqual(
+    database.db.prepare("PRAGMA table_info(plugin_crashes)").all().map(({ name }) => name),
+    ["plugin_id", "plugin_version", "crashed_at"],
+  );
+  assert.deepEqual(
+    database.db.prepare("PRAGMA table_info(plugin_runtime_state)").all().map(({ name }) => name),
+    [
+      "plugin_id",
+      "plugin_version",
+      "status",
+      "runtime_kind",
+      "last_error",
+      "quarantined_at",
+      "updated_at",
+    ],
+  );
+  assert.deepEqual(
+    database.db.prepare("PRAGMA table_info(plugin_permission_grants)").all().map(({ name }) => name),
+    ["plugin_id", "permission", "resource", "resource_kind", "declaration_hash", "granted_at"],
+  );
+  assert.deepEqual(
+    database.db.prepare("PRAGMA table_info(plugin_secrets)").all().map(({ name }) => name),
+    ["plugin_id", "key", "secret_ref", "ciphertext", "created_at", "updated_at"],
+  );
+  assert.deepEqual(
+    database.db.prepare("PRAGMA table_info(plugin_settings)").all().map(({ name }) => name),
+    ["plugin_id", "setting_id", "scope", "scope_id", "value_json", "updated_at"],
+  );
+  assert.deepEqual(
+    database.db.prepare("PRAGMA table_info(plugin_view_state)").all().map(({ name }) => name),
+    ["plugin_id", "view_id", "scope_id", "state_json", "updated_at"],
+  );
+  assert.deepEqual(
+    database.db.prepare("PRAGMA table_info(plugin_sync_sidecars)").all().map(({ name }) => name),
+    ["plugin_id", "kind", "key", "value_json", "updated_at"],
+  );
+  assert.deepEqual(
+    database.db.prepare("PRAGMA table_info(plugin_sync_provider_bindings)").all().map(({ name }) => name),
+    ["provider_id", "plugin_id", "created_at", "updated_at"],
+  );
+  assert.deepEqual(database.db.prepare("PRAGMA foreign_key_list(plugin_settings)").all(), []);
+  assert.deepEqual(database.db.prepare("PRAGMA foreign_key_list(plugin_view_state)").all(), []);
+  assert.deepEqual(database.db.prepare("PRAGMA foreign_key_list(plugin_sync_sidecars)").all(), []);
+  database.close();
+});
+
+test("user-owned security records survive package uninstall in the complete v1 schema", (context) => {
+  const database = createDatabase(context);
+  const pluginManifest = manifest();
+  database.installVersion({
+    pluginId: pluginManifest.id,
+    version: pluginManifest.version,
+    manifest: pluginManifest,
+    archiveSha256: "a".repeat(64),
+    packageRelativePath: `${pluginManifest.id}/${pluginManifest.version}/package`,
+  });
+  database.upsertPermissionGrant({
+    pluginId: pluginManifest.id,
+    permission: "network",
+    resource: "https://example.com",
+    resourceKind: "exact",
+    declarationHash: "b".repeat(64),
+  });
+  database.upsertSecret({
+    pluginId: pluginManifest.id,
+    key: "api-key",
+    secretRef: "secret-reference-0000000000000000",
+    ciphertext: Buffer.from("encrypted"),
+  });
+  database.recordSecurityAudit(pluginManifest.id, "permission.granted", { permission: "network" });
+
+  database.removePlugin(pluginManifest.id);
+
+  assert.equal(database.getActivePlugin(pluginManifest.id), null);
+  assert.deepEqual(database.listPermissionGrants(pluginManifest.id).map((grant) => ({
+    resource: grant.resource,
+    resourceKind: grant.resourceKind,
+  })), [{ resource: "https://example.com", resourceKind: "exact" }]);
+  assert.equal(database.getSecretByKey(pluginManifest.id, "api-key").secretRef, "secret-reference-0000000000000000");
+  assert.deepEqual(database.listSecurityAudit(pluginManifest.id)[0].details, { permission: "network" });
+  database.close();
+});
+
+test("security audit details are bounded and oversized records retain only a digest", (context) => {
+  const database = createDatabase(context);
+  database.recordSecurityAudit("com.example.test", "permission.denied", {
+    untrusted: "x".repeat(MAX_SECURITY_AUDIT_DETAILS_BYTES + 1),
+  });
+  const record = database.listSecurityAudit("com.example.test")[0];
+  assert.equal(record.details.truncated, true);
+  assert.match(record.details.sha256, /^[a-f0-9]{64}$/u);
+  assert.equal(Object.hasOwn(record.details, "untrusted"), false);
+  database.close();
+});
+
+test("version activation and namespaced key/value writes are transactional", (context) => {
+  const database = createDatabase(context);
+  const pluginManifest = manifest();
+  database.installVersion({
+    pluginId: pluginManifest.id,
+    version: pluginManifest.version,
+    manifest: pluginManifest,
+    archiveSha256: "a".repeat(64),
+    packageRelativePath: "com.example.test/1.0.0/package",
+  }, { enable: true });
+
+  const installed = database.getActivePlugin(pluginManifest.id);
+  assert.equal(installed.enabled, true);
+  assert.equal(installed.activeVersion, "1.0.0");
+  assert.deepEqual(installed.manifest, pluginManifest);
+
+  database.setValue(pluginManifest.id, "greeting", { text: "hello" });
+  database.setValue(pluginManifest.id, "count", 2);
+  assert.deepEqual(database.getValue(pluginManifest.id, "greeting"), { text: "hello" });
+  assert.deepEqual(database.listKeys(pluginManifest.id), ["count", "greeting"]);
+  database.deleteValue(pluginManifest.id, "count");
+  assert.equal(database.getValue(pluginManifest.id, "count"), undefined);
+  database.close();
+});
+
+test("database transactions reject async callbacks before committing", (context) => {
+  const database = createDatabase(context);
+  assert.throws(() => database.transaction(async () => {
+    database.db.prepare(`
+      INSERT INTO plugins(id, enabled, active_version, installed_at, updated_at)
+      VALUES ('com.example.async', 0, NULL, 1, 1)
+    `).run();
+  }), /must be synchronous/);
+  assert.equal(database.getActivePlugin("com.example.async"), null);
+  database.close();
+});
+
+test("recovered versions can atomically replace an enabled version while staying disabled", (context) => {
+  const database = createDatabase(context);
+  const first = manifest();
+  database.installVersion({
+    pluginId: first.id,
+    version: first.version,
+    manifest: first,
+    archiveSha256: "a".repeat(64),
+    packageRelativePath: `${first.id}/${first.version}/package`,
+  }, { enable: true });
+  const second = manifest(first.id, "2.0.0");
+  database.installVersion({
+    pluginId: second.id,
+    version: second.version,
+    manifest: second,
+    archiveSha256: "b".repeat(64),
+    packageRelativePath: `${second.id}/${second.version}/package`,
+  }, { forceDisabled: true });
+
+  const recovered = database.getActivePlugin(first.id);
+  assert.equal(recovered.activeVersion, "2.0.0");
+  assert.equal(recovered.enabled, false);
+  assert.throws(() => database.installVersion({
+    pluginId: second.id,
+    version: second.version,
+    manifest: second,
+    archiveSha256: "b".repeat(64),
+    packageRelativePath: `${second.id}/${second.version}/package`,
+  }, { enable: true, forceDisabled: true }), /cannot be enabled and force-disabled/);
+  database.close();
+});
+
+test("active version rollback is compare-and-set and keeps version state isolated", (context) => {
+  const database = createDatabase(context);
+  const first = manifest();
+  const second = manifest(first.id, "2.0.0");
+  for (const [pluginManifest, archive] of [[first, "a"], [second, "b"]]) {
+    database.installVersion({
+      pluginId: pluginManifest.id,
+      version: pluginManifest.version,
+      manifest: pluginManifest,
+      archiveSha256: archive.repeat(64),
+      packageRelativePath: `${pluginManifest.id}/${pluginManifest.version}/package`,
+    }, { enable: true });
+  }
+  database.setRuntimeState(first.id, "error", {
+    pluginVersion: second.version,
+    error: "new version failed",
+  });
+
+  const restored = database.setActiveVersion(first.id, first.version, {
+    enabled: true,
+    expectedActiveVersion: second.version,
+  });
+  assert.equal(restored.activeVersion, first.version);
+  assert.equal(restored.enabled, true);
+  assert.equal(restored.runtime.status, "stopped");
+  assert.equal(database.getVersion(first.id, second.version).version, second.version);
+  assert.throws(() => database.setActiveVersion(first.id, second.version, {
+    enabled: true,
+    expectedActiveVersion: "3.0.0",
+  }), /changed before it could be restored/);
+  assert.throws(() => database.setActiveVersion(first.id, "9.0.0"), /version is not installed/);
+  database.close();
+});
+
+test("three crashes inside five minutes quarantine until explicit recovery", (context) => {
+  let now = 10_000;
+  const database = createDatabase(context, () => now);
+  const pluginManifest = manifest();
+  database.installVersion({
+    pluginId: pluginManifest.id,
+    version: pluginManifest.version,
+    manifest: pluginManifest,
+    archiveSha256: "a".repeat(64),
+    packageRelativePath: "com.example.test/1.0.0/package",
+  });
+
+  assert.deepEqual(database.recordCrash(pluginManifest.id, pluginManifest.version, 300_000, 3), {
+    count: 1, quarantined: false, quarantinedAt: null,
+  });
+  now += 1_000;
+  assert.equal(database.recordCrash(pluginManifest.id, pluginManifest.version, 300_000, 3).quarantined, false);
+  now += 1_000;
+  assert.equal(database.recordCrash(pluginManifest.id, pluginManifest.version, 300_000, 3).quarantined, true);
+  assert.equal(database.getActivePlugin(pluginManifest.id).runtime.status, "quarantined");
+
+  database.clearQuarantine(pluginManifest.id);
+  assert.equal(database.getActivePlugin(pluginManifest.id).runtime.quarantinedAt, null);
+  assert.equal(database.getActivePlugin(pluginManifest.id).runtime.status, "stopped");
+  database.close();
+});
+
+test("activating a new version resets runtime quarantine without forgiving the same version", (context) => {
+  const database = createDatabase(context);
+  const first = manifest();
+  database.installVersion({
+    pluginId: first.id,
+    version: first.version,
+    manifest: first,
+    archiveSha256: "a".repeat(64),
+    packageRelativePath: `${first.id}/${first.version}/package`,
+  }, { enable: true });
+  for (let attempt = 0; attempt < 3; attempt += 1) {
+    database.recordCrash(first.id, first.version, 300_000, 3);
+  }
+  assert.equal(database.getActivePlugin(first.id).runtime.status, "quarantined");
+
+  database.installVersion({
+    pluginId: first.id,
+    version: first.version,
+    manifest: first,
+    archiveSha256: "a".repeat(64),
+    packageRelativePath: `${first.id}/${first.version}/package`,
+  });
+  assert.equal(database.getActivePlugin(first.id).runtime.status, "quarantined");
+
+  const second = manifest(first.id, "2.0.0");
+  database.installVersion({
+    pluginId: second.id,
+    version: second.version,
+    manifest: second,
+    archiveSha256: "b".repeat(64),
+    packageRelativePath: `${second.id}/${second.version}/package`,
+  });
+  const active = database.getActivePlugin(first.id);
+  assert.equal(active.activeVersion, "2.0.0");
+  assert.equal(active.runtime.status, "stopped");
+  assert.equal(active.runtime.lastError, null);
+  assert.equal(active.runtime.quarantinedAt, null);
+  assert.deepEqual(database.recordCrash(second.id, second.version, 300_000, 3), {
+    count: 1,
+    quarantined: false,
+    quarantinedAt: null,
+  });
+  assert.deepEqual(database.recordCrash(first.id, first.version, 300_000, 3), {
+    count: 4,
+    quarantined: true,
+    quarantinedAt: 1_000,
+  });
+  database.clearQuarantine(second.id);
+  assert.equal(Number(database.db.prepare(`
+    SELECT COUNT(*) AS count FROM plugin_crashes
+    WHERE plugin_id = ? AND plugin_version = ?
+  `).get(first.id, first.version).count), 4);
+  assert.equal(Number(database.db.prepare(`
+    SELECT COUNT(*) AS count FROM plugin_crashes
+    WHERE plugin_id = ? AND plugin_version = ?
+  `).get(second.id, second.version).count), 0);
+  database.installVersion({
+    pluginId: first.id,
+    version: first.version,
+    manifest: first,
+    archiveSha256: "a".repeat(64),
+    packageRelativePath: `${first.id}/${first.version}/package`,
+  });
+  assert.equal(database.getActivePlugin(first.id).runtime.status, "quarantined");
+  assert.equal(database.getActivePlugin(first.id).runtime.quarantinedAt, 1_000);
+  database.close();
+});
+
+test("schema upgrade backfills bindings from legacy sync-provider-map secrets", (context) => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), "netcatty-plugin-v2-backfill-"));
+  context.after(() => fs.rmSync(root, { recursive: true, force: true }));
+  const file = path.join(root, "plugins.sqlite");
+  // Bootstrap a schema-2 DB then open with PluginDatabase to migrate to v3.
+  const seed = new PluginDatabase(file);
+  // Force downgrade-like state: empty bindings + a legacy map secret row.
+  seed.db.exec("DELETE FROM plugin_sync_provider_bindings");
+  const now = Date.now();
+  seed.db.prepare(`
+    INSERT INTO plugin_secrets(plugin_id, key, secret_ref, ciphertext, created_at, updated_at)
+    VALUES (?, ?, ?, ?, ?, ?)
+  `).run(
+    "com.example",
+    "sync-provider-map:com.example.sync",
+    "ref-legacy-map",
+    Buffer.from("sealed"),
+    now,
+    now,
+  );
+  seed.db.prepare(`
+    INSERT INTO plugin_secrets(plugin_id, key, secret_ref, ciphertext, created_at, updated_at)
+    VALUES (?, ?, ?, ?, ?, ?)
+  `).run(
+    "com.example",
+    "sync-credential",
+    "ref-cred",
+    Buffer.from("sealed-cred"),
+    now,
+    now,
+  );
+  seed.close();
+
+  const database = new PluginDatabase(file);
+  // Constructor no longer promotes; hostService seeds after package recovery.
+  assert.equal(database.backfillSyncProviderBindingsFromLegacySecrets(), 1);
+  assert.equal(database.getSyncProviderBinding("com.example.sync")?.pluginId, "com.example");
+  // Consumed map marker so later unbind + reopen cannot re-promote.
+  assert.equal(
+    database.getSecretByKey("com.example", "sync-provider-map:com.example.sync"),
+    null,
+    "promoted map markers must be deleted",
+  );
+  assert.ok(database.getSecretByKey("com.example", "sync-credential"));
+  database.close();
+});
+
+test("legacy map backfill does not overwrite an existing host binding", (context) => {
+  const database = createDatabase(context);
+  const now = Date.now();
+  // Correct owner already bound.
+  database.upsertSyncProviderBinding("com.example.sync.foo", "com.example.sync");
+  // Stale parent leftover map secret that would steal ownership if upserted.
+  database.db.prepare(`
+    INSERT INTO plugin_secrets(plugin_id, key, secret_ref, ciphertext, created_at, updated_at)
+    VALUES (?, ?, ?, ?, ?, ?)
+  `).run(
+    "com.example",
+    "sync-provider-map:com.example.sync.foo",
+    "ref-stale-parent-map",
+    Buffer.from("sealed"),
+    now,
+    now,
+  );
+  const promoted = database.backfillSyncProviderBindingsFromLegacySecrets();
+  assert.equal(promoted, 0, "must not promote over an existing binding");
+  assert.equal(
+    database.getSyncProviderBinding("com.example.sync.foo")?.pluginId,
+    "com.example.sync",
+    "existing binding must be preserved",
+  );
+  // Skipped promote leaves non-winning map rows in place (only winners are consumed).
+  assert.ok(
+    database.getSecretByKey("com.example", "sync-provider-map:com.example.sync.foo"),
+    "non-promoted leftover map rows stay until unbind consumes them",
+  );
+  database.close();
+});
+
+test("legacy map backfill skips when no candidate holds sync credentials", (context) => {
+  const database = createDatabase(context);
+  const now = Date.now();
+  // Map-only leftovers: longest namespace must not invent ownership without
+  // sync-credential* evidence (parent may be the true owner later).
+  for (const [pluginId, key] of [
+    ["com.example", "sync-provider-map:com.example.sync.foo"],
+    ["com.example.sync", "sync-provider-map:com.example.sync.foo"],
+  ]) {
+    database.db.prepare(`
+      INSERT INTO plugin_secrets(plugin_id, key, secret_ref, ciphertext, created_at, updated_at)
+      VALUES (?, ?, ?, ?, ?, ?)
+    `).run(pluginId, key, `ref-${pluginId}`, Buffer.from("sealed"), now, now);
+  }
+  const promoted = database.backfillSyncProviderBindingsFromLegacySecrets();
+  assert.equal(promoted, 0, "map-only candidates must not bind without credentials");
+  assert.equal(database.getSyncProviderBinding("com.example.sync.foo"), null);
+  // Unbound maps stay so a later credential-backed promote or live put can resolve.
+  assert.ok(database.getSecretByKey("com.example", "sync-provider-map:com.example.sync.foo"));
+  assert.ok(database.getSecretByKey("com.example.sync", "sync-provider-map:com.example.sync.foo"));
+  database.close();
+});
+
+test("legacy map backfill binds sole credential-backed owner when maps conflict", (context) => {
+  const database = createDatabase(context);
+  const now = Date.now();
+  // Parent has leftover map only; nested owner still holds credentials.
+  for (const [pluginId, key, ciphertext] of [
+    ["com.example", "sync-provider-map:com.example.sync.foo", "map-parent"],
+    ["com.example.sync", "sync-provider-map:com.example.sync.foo", "map-nested"],
+    ["com.example.sync", "sync-credential", "real-secret"],
+  ]) {
+    database.db.prepare(`
+      INSERT INTO plugin_secrets(plugin_id, key, secret_ref, ciphertext, created_at, updated_at)
+      VALUES (?, ?, ?, ?, ?, ?)
+    `).run(pluginId, key, `ref-${pluginId}-${key}`, Buffer.from(ciphertext), now, now);
+  }
+  const promoted = database.backfillSyncProviderBindingsFromLegacySecrets();
+  assert.equal(promoted, 1);
+  assert.equal(
+    database.getSyncProviderBinding("com.example.sync.foo")?.pluginId,
+    "com.example.sync",
+    "sole credential-backed owner must win over map-only parent",
+  );
+  // All candidate map markers for the promoted provider are consumed.
+  assert.equal(database.getSecretByKey("com.example", "sync-provider-map:com.example.sync.foo"), null);
+  assert.equal(database.getSecretByKey("com.example.sync", "sync-provider-map:com.example.sync.foo"), null);
+  assert.ok(database.getSecretByKey("com.example.sync", "sync-credential"));
+  database.close();
+});
+
+test("legacy map backfill does not let longest map override credential-backed parent", (context) => {
+  const database = createDatabase(context);
+  const now = Date.now();
+  // True owner is the shorter parent (still has credentials). Nested plugin has
+  // only a stale map row - longest map alone must not steal the binding.
+  for (const [pluginId, key, ciphertext] of [
+    ["com.example", "sync-provider-map:com.example.sync.foo", "map-parent"],
+    ["com.example", "sync-credential", "parent-secret"],
+    ["com.example.sync", "sync-provider-map:com.example.sync.foo", "map-nested"],
+  ]) {
+    database.db.prepare(`
+      INSERT INTO plugin_secrets(plugin_id, key, secret_ref, ciphertext, created_at, updated_at)
+      VALUES (?, ?, ?, ?, ?, ?)
+    `).run(pluginId, key, `ref-${pluginId}-${key}`, Buffer.from(ciphertext), now, now);
+  }
+  const promoted = database.backfillSyncProviderBindingsFromLegacySecrets();
+  assert.equal(promoted, 1);
+  assert.equal(
+    database.getSyncProviderBinding("com.example.sync.foo")?.pluginId,
+    "com.example",
+    "credential-backed parent must win over longer map-only nested id",
+  );
+  assert.equal(database.getSecretByKey("com.example", "sync-provider-map:com.example.sync.foo"), null);
+  assert.equal(database.getSecretByKey("com.example.sync", "sync-provider-map:com.example.sync.foo"), null);
+  assert.ok(database.getSecretByKey("com.example", "sync-credential"));
+  database.close();
+});
+
+test("legacy map backfill skips when multiple credential-backed candidates exist", (context) => {
+  const database = createDatabase(context);
+  const now = Date.now();
+  // Both parent and nested hold credentials + map for the same provider.
+  // Longest pluginId is not a reliable owner signal — the shorter parent may
+  // be the legitimate owner — so leave unbound rather than guessing.
+  for (const [pluginId, key, ciphertext] of [
+    ["com.example", "sync-provider-map:com.example.sync.foo", "map-parent"],
+    ["com.example", "sync-credential", "parent-secret"],
+    ["com.example.sync", "sync-provider-map:com.example.sync.foo", "map-nested"],
+    ["com.example.sync", "sync-credential", "nested-secret"],
+  ]) {
+    database.db.prepare(`
+      INSERT INTO plugin_secrets(plugin_id, key, secret_ref, ciphertext, created_at, updated_at)
+      VALUES (?, ?, ?, ?, ?, ?)
+    `).run(pluginId, key, `ref-${pluginId}-${key}`, Buffer.from(ciphertext), now, now);
+  }
+  const promoted = database.backfillSyncProviderBindingsFromLegacySecrets();
+  assert.equal(promoted, 0, "ambiguous credential-backed candidates must not auto-bind");
+  assert.equal(database.getSyncProviderBinding("com.example.sync.foo"), null);
+  // Maps stay so a live put / explicit bind can resolve ownership later.
+  assert.ok(database.getSecretByKey("com.example", "sync-provider-map:com.example.sync.foo"));
+  assert.ok(database.getSecretByKey("com.example.sync", "sync-provider-map:com.example.sync.foo"));
+  assert.ok(database.getSecretByKey("com.example", "sync-credential"));
+  assert.ok(database.getSecretByKey("com.example.sync", "sync-credential"));
+  database.close();
+});
+
+test("legacy map backfill still consumes maps after unbind tombstone blocks promote", (context) => {
+  // Verify prior fix: explicit unbind tombstone blocks re-promote; maps may remain
+  // until unbind/delete paths consume them (backfill itself skips and does not
+  // delete when promote is blocked).
+  const database = createDatabase(context);
+  const now = Date.now();
+  database.upsertSyncProviderBinding("com.example.sync.foo", "");
+  database.db.prepare(`
+    INSERT INTO plugin_secrets(plugin_id, key, secret_ref, ciphertext, created_at, updated_at)
+    VALUES (?, ?, ?, ?, ?, ?)
+  `).run(
+    "com.example",
+    "sync-provider-map:com.example.sync.foo",
+    "ref-tombstone-map",
+    Buffer.from("sealed"),
+    now,
+    now,
+  );
+  database.db.prepare(`
+    INSERT INTO plugin_secrets(plugin_id, key, secret_ref, ciphertext, created_at, updated_at)
+    VALUES (?, ?, ?, ?, ?, ?)
+  `).run(
+    "com.example",
+    "sync-credential",
+    "ref-cred",
+    Buffer.from("secret"),
+    now,
+    now,
+  );
+  assert.equal(database.backfillSyncProviderBindingsFromLegacySecrets(), 0);
+  assert.equal(
+    database.getSyncProviderBinding("com.example.sync.foo")?.pluginId,
+    "",
+    "unbind tombstone must block credential-backed map promote",
+  );
+  // Map row stays; disconnect/unbind consumption is responsible for cleanup.
+  assert.ok(
+    database.getSecretByKey("com.example", "sync-provider-map:com.example.sync.foo"),
+    "skipped promote leaves map markers for unbind to consume",
+  );
+  database.close();
+});
+
+test("legacy map backfill deletes promoted map markers so unbind cannot resurrect", (context) => {
+  const database = createDatabase(context);
+  const now = Date.now();
+  database.db.prepare(`
+    INSERT INTO plugin_secrets(plugin_id, key, secret_ref, ciphertext, created_at, updated_at)
+    VALUES (?, ?, ?, ?, ?, ?)
+  `).run(
+    "com.example",
+    "sync-provider-map:com.example.custom",
+    "ref-plugin-owned",
+    Buffer.from("plugin-owned-payload"),
+    now,
+    now,
+  );
+  // Credential evidence required to promote; non-map secrets must survive map consume.
+  database.db.prepare(`
+    INSERT INTO plugin_secrets(plugin_id, key, secret_ref, ciphertext, created_at, updated_at)
+    VALUES (?, ?, ?, ?, ?, ?)
+  `).run(
+    "com.example",
+    "sync-credential",
+    "ref-cred-keep",
+    Buffer.from("cred"),
+    now,
+    now,
+  );
+  assert.equal(database.backfillSyncProviderBindingsFromLegacySecrets(), 1);
+  assert.equal(database.getSyncProviderBinding("com.example.custom")?.pluginId, "com.example");
+  assert.equal(
+    database.getSecretByKey("com.example", "sync-provider-map:com.example.custom"),
+    null,
+    "promoted map markers must be deleted to stop post-unbind resurrection",
+  );
+  assert.ok(database.getSecretByKey("com.example", "sync-credential"));
+  database.close();
+});
+
+test("legacy map backfill does not resurrect after explicit unbind tombstone", (context) => {
+  const database = createDatabase(context);
+  const now = Date.now();
+  // Pre-seed a leftover map after an explicit empty-plugin_id unbind tombstone.
+  database.upsertSyncProviderBinding("com.example.sync", "");
+  database.db.prepare(`
+    INSERT INTO plugin_secrets(plugin_id, key, secret_ref, ciphertext, created_at, updated_at)
+    VALUES (?, ?, ?, ?, ?, ?)
+  `).run(
+    "com.example",
+    "sync-provider-map:com.example.sync",
+    "ref-leftover-map",
+    Buffer.from("sealed"),
+    now,
+    now,
+  );
+  assert.equal(database.backfillSyncProviderBindingsFromLegacySecrets(), 0);
+  assert.equal(
+    database.getSyncProviderBinding("com.example.sync")?.pluginId,
+    "",
+    "empty-plugin_id unbind tombstone must block re-promotion",
+  );
+  database.close();
+});
+
+
+test("listInstalledVersions includes inactive package manifests", (context) => {
+  const database = createDatabase(context);
+  const now = Date.now();
+  // Install two versions under one plugin id via raw rows if helpers are heavy.
+  database.db.prepare(`
+    INSERT INTO plugins(id, enabled, active_version, installed_at, updated_at)
+    VALUES (?, 1, ?, ?, ?)
+  `).run("com.example", "2.0.0", now, now);
+  for (const [version, providerId] of [
+    ["1.0.0", "com.example.legacy-sync"],
+    ["2.0.0", "com.example.sync"],
+  ]) {
+    database.db.prepare(`
+      INSERT INTO plugin_versions(
+        plugin_id, version, manifest_json, archive_sha256, package_relative_path, installed_at
+      ) VALUES (?, ?, ?, ?, ?, ?)
+    `).run(
+      "com.example",
+      version,
+      JSON.stringify({
+        id: "com.example",
+        version,
+        contributes: { providers: [{ id: providerId, kind: "sync", label: providerId }] },
+      }),
+      "a".repeat(64),
+      `com.example/${version}/package`,
+      now,
+    );
+  }
+  const versions = database.listInstalledVersions();
+  assert.equal(versions.length, 2);
+  const providerIds = new Set();
+  for (const v of versions) {
+    for (const p of v.manifest?.contributes?.providers ?? []) {
+      if (p.kind === "sync") providerIds.add(p.id);
+    }
+  }
+  assert.ok(providerIds.has("com.example.legacy-sync"));
+  assert.ok(providerIds.has("com.example.sync"));
+  // Active list only has 2.0.0
+  assert.equal(database.listPlugins()[0]?.activeVersion, "2.0.0");
+  database.close();
+});
+
+test("inferPluginIdForSyncProvider never guesses from credential key prefixes", (context) => {
+  const database = createDatabase(context);
+  const now = Date.now();
+  for (const [pluginId, key] of [
+    ["com.example", "sync-credential"],
+    ["com.example.backup", "sync-credential"],
+    ["com.other", "sync-credential"],
+    ["com.example.sync", "sync-credential"],
+  ]) {
+    database.db.prepare(`
+      INSERT INTO plugin_secrets(plugin_id, key, secret_ref, ciphertext, created_at, updated_at)
+      VALUES (?, ?, ?, ?, ?, ?)
+    `).run(pluginId, key, `ref-${pluginId}`, Buffer.from("x"), now, now);
+  }
+  // Parent prefix alone is not enough: a removed plugin may have owned
+  // com.example.backup.sync while only com.example still has credentials.
+  assert.equal(database.inferPluginIdForSyncProvider("com.example.backup.sync"), undefined);
+  assert.equal(database.inferPluginIdForSyncProvider("com.example.sync"), undefined);
+  assert.equal(database.inferPluginIdForSyncProvider("com.other.cloud"), undefined);
+  assert.equal(database.inferPluginIdForSyncProvider("com.missing.sync"), undefined);
+  database.close();
+});