@blamejs/blamejs-shop 0.0.44

package/lib/vendor/blamejs/test/layer-0-primitives/csp-nonce.test.js

@@ -0,0 +1,401 @@
+"use strict";
+/**
+ * csp-nonce — per-request CSP nonce + render integration.
+ *
+ * Run standalone: `node test/layer-0-primitives/csp-nonce.test.js`
+ * Or via smoke:   `node test/smoke.js`
+ */
+
+var helpers = require("../helpers");
+var b     = helpers.b;
+var check = helpers.check;
+
+function _cspReq() {
+  var EE = require("node:events").EventEmitter;
+  var req = new EE();
+  req.method = "GET";
+  req.url = "/";
+  req.headers = {};
+  req.socket = { remoteAddress: "127.0.0.1" };
+  return req;
+}
+
+function _cspRes(initialCsp) {
+  var headers = {};
+  if (initialCsp) headers["content-security-policy"] = initialCsp;
+  return {
+    setHeader:    function (k, v) { headers[k.toLowerCase()] = v; },
+    getHeader:    function (k)    { return headers[k.toLowerCase()]; },
+    removeHeader: function (k)    { delete headers[k.toLowerCase()]; },
+    locals:       {},
+    _headers:     headers,
+  };
+}
+
+function testCspNonceSurface() {
+  check("b.middleware.cspNonce is a function",      typeof b.middleware.cspNonce === "function");
+  var raw = b.middleware._modules.cspNonce;
+  check("CspNonceError is a class",                 typeof raw.CspNonceError === "function");
+  check("DEFAULT_DIRECTIVES exposed",               Array.isArray(raw.DEFAULT_DIRECTIVES));
+  check("_injectNonce exposed for tests",           typeof raw._injectNonce === "function");
+}
+
+function testCspNonceParseSerialize() {
+  var raw = b.middleware._modules.cspNonce;
+  var parts = raw._parseCsp("default-src 'self'; script-src 'self'; img-src 'self' data:");
+  check("parse: 3 directives",                       parts.length === 3);
+  check("parse: directive name lowercased",          parts[0].name === "default-src");
+  check("parse: values captured",                    parts[2].values.length === 2);
+  var serialized = raw._serializeCsp(parts);
+  check("serialize: round-trips",
+        serialized.indexOf("default-src 'self'") !== -1 &&
+        serialized.indexOf("img-src 'self' data:") !== -1);
+}
+
+function testCspNonceInjectNonceIntoExisting() {
+  var raw = b.middleware._modules.cspNonce;
+  var before = "default-src 'self'; script-src 'self'; style-src 'self'";
+  var after = raw._injectNonce(before, "ABC123==", ["script-src", "style-src"], false);
+  check("inject: nonce on script-src",   after.indexOf("script-src 'self' 'nonce-ABC123=='") !== -1);
+  check("inject: nonce on style-src",    after.indexOf("style-src 'self' 'nonce-ABC123=='") !== -1);
+  check("inject: default-src untouched", after.indexOf("default-src 'self'") !== -1);
+}
+
+function testCspNonceInjectAddsMissingDirective() {
+  var raw = b.middleware._modules.cspNonce;
+  var before = "default-src 'self'";
+  var after = raw._injectNonce(before, "XYZ", ["script-src", "style-src"], false);
+  check("inject: missing script-src appended",  after.indexOf("script-src 'nonce-XYZ'") !== -1);
+  check("inject: missing style-src appended",   after.indexOf("style-src 'nonce-XYZ'") !== -1);
+}
+
+function testCspNonceInjectStrictDynamic() {
+  var raw = b.middleware._modules.cspNonce;
+  var after = raw._injectNonce("script-src 'self'", "T", ["script-src"], true);
+  check("inject: script-src gets strict-dynamic when opted in",
+        after.indexOf("'strict-dynamic'") !== -1);
+  var styleOnly = raw._injectNonce("style-src 'self'", "T", ["style-src"], true);
+  check("inject: style-src does NOT get strict-dynamic",
+        styleOnly.indexOf("'strict-dynamic'") === -1);
+}
+
+function testCspNonceInjectIdempotent() {
+  var raw = b.middleware._modules.cspNonce;
+  var once = raw._injectNonce("script-src 'self'", "N1", ["script-src"], false);
+  var twice = raw._injectNonce(once, "N1", ["script-src"], false);
+  var matches = twice.match(/'nonce-N1'/g) || [];
+  check("inject: re-running with same nonce doesn't duplicate", matches.length === 1);
+}
+
+function testCspNonceInjectBuildsFromScratch() {
+  var raw = b.middleware._modules.cspNonce;
+  var fresh = raw._injectNonce(undefined, "FRESH", ["script-src"], false);
+  check("inject: no existing CSP → built from scratch",
+        fresh.indexOf("default-src 'self'") !== -1 &&
+        fresh.indexOf("'nonce-FRESH'") !== -1);
+}
+
+async function testCspNonceMiddlewareSetsReqAndLocals() {
+  var mw = b.middleware.cspNonce({ always: true });
+  var req = _cspReq();
+  var res = _cspRes("script-src 'self'");
+  await new Promise(function (resolve) {
+    mw(req, res, function () { resolve(); });
+  });
+  check("middleware: req.cspNonce set",         typeof req.cspNonce === "string" && req.cspNonce.length > 0);
+  check("middleware: res.locals.cspNonce set",  res.locals.cspNonce === req.cspNonce);
+  check("middleware: CSP header patched with nonce",
+        res._headers["content-security-policy"].indexOf("'nonce-" + req.cspNonce + "'") !== -1);
+}
+
+async function testCspNonceMiddlewareCustomProperty() {
+  var mw = b.middleware.cspNonce({ always: true, property: "myNonce" });
+  var req = _cspReq();
+  var res = _cspRes("script-src 'self'");
+  await new Promise(function (resolve) { mw(req, res, function () { resolve(); }); });
+  check("custom property: req.myNonce set",     typeof req.myNonce === "string");
+  check("custom property: res.locals.myNonce set", res.locals.myNonce === req.myNonce);
+  check("custom property: req.cspNonce NOT set", req.cspNonce === undefined);
+}
+
+async function testCspNonceMiddlewareSkipsWhenNoCspAndNotAlways() {
+  var mw = b.middleware.cspNonce({});
+  var req = _cspReq();
+  var res = _cspRes(null);
+  await new Promise(function (resolve) { mw(req, res, function () { resolve(); }); });
+  check("no-CSP path: req.cspNonce still set",       typeof req.cspNonce === "string");
+  check("no-CSP path: no CSP header created",        res._headers["content-security-policy"] === undefined);
+}
+
+async function testCspNonceMiddlewareAlwaysCreatesCsp() {
+  var mw = b.middleware.cspNonce({ always: true });
+  var req = _cspReq();
+  var res = _cspRes(null);
+  await new Promise(function (resolve) { mw(req, res, function () { resolve(); }); });
+  check("always: CSP header created from scratch",
+        typeof res._headers["content-security-policy"] === "string" &&
+        res._headers["content-security-policy"].indexOf("'nonce-") !== -1);
+}
+
+async function testCspNonceMiddlewareNonceLengthDefault() {
+  var mw = b.middleware.cspNonce({ always: true });
+  var req = _cspReq();
+  var res = _cspRes(null);
+  await new Promise(function (resolve) { mw(req, res, function () { resolve(); }); });
+  check("default nonce length: ~24 chars",     req.cspNonce.length === 24);
+}
+
+async function testCspNonceMiddlewareCustomNonceLength() {
+  var mw = b.middleware.cspNonce({ always: true, nonceBytes: 32 });
+  var req = _cspReq();
+  var res = _cspRes(null);
+  await new Promise(function (resolve) { mw(req, res, function () { resolve(); }); });
+  check("custom nonce length: ~44 chars for 32 bytes",   req.cspNonce.length === 44);
+}
+
+async function testCspNonceUniquenessAcrossRequests() {
+  var mw = b.middleware.cspNonce({ always: true });
+  var seen = new Set();
+  for (var i = 0; i < 50; i++) {
+    var req = _cspReq();
+    var res = _cspRes(null);
+    await new Promise(function (resolve) { mw(req, res, function () { resolve(); }); });
+    seen.add(req.cspNonce);
+  }
+  check("uniqueness: 50 requests → 50 distinct nonces", seen.size === 50);
+}
+
+function testCspNonceConfigValidation() {
+  var threw;
+
+  threw = null;
+  try { b.middleware.cspNonce({ nonceBytes: 8 }); } catch (e) { threw = e; }
+  check("config: nonceBytes < 16 rejected", threw && threw.code === "csp-nonce/bad-nonce-bytes");
+
+  threw = null;
+  try { b.middleware.cspNonce({ directives: [""] }); } catch (e) { threw = e; }
+  check("config: empty directive rejected", threw && threw.code === "csp-nonce/bad-directive");
+
+  threw = null;
+  try { b.middleware.cspNonce({ directives: [123] }); } catch (e) { threw = e; }
+  check("config: non-string directive rejected", threw && threw.code === "csp-nonce/bad-directive");
+}
+
+async function testCspNonceLayeredOnSecurityHeaders() {
+  var sh = b.middleware.securityHeaders();
+  var nonce = b.middleware.cspNonce({});
+  var req = _cspReq();
+  var res = _cspRes(null);
+  await new Promise(function (resolve) {
+    sh(req, res, function () {
+      nonce(req, res, function () { resolve(); });
+    });
+  });
+  var csp = res._headers["content-security-policy"];
+  check("layered: security-headers default-src present",   csp.indexOf("default-src 'self'") !== -1);
+  check("layered: nonce injected on script-src",            csp.indexOf("'nonce-" + req.cspNonce + "'") !== -1);
+  check("layered: req.cspNonce available after both layers", typeof req.cspNonce === "string");
+}
+
+function testRenderHtmlAutoMergesResLocals() {
+  var stubEngine = {
+    render: function (viewName, data) {
+      return JSON.stringify({ view: viewName, data: data });
+    },
+  };
+  var r = b.render.create({ engine: stubEngine });
+  var captured = null;
+  var res = {
+    writableEnded: false,
+    locals: { cspNonce: "from-locals", requestId: "rid-1" },
+    writeHead: function (status, headers) { captured = { status: status, headers: headers }; },
+    end: function (body) { captured.body = body; },
+  };
+  r.html(res, "home", { user: "Alice" });
+  var rendered = JSON.parse(captured.body);
+  check("render.html: res.locals.cspNonce auto-merged into data",
+        rendered.data.cspNonce === "from-locals");
+  check("render.html: res.locals.requestId auto-merged",
+        rendered.data.requestId === "rid-1");
+  check("render.html: operator data preserved",
+        rendered.data.user === "Alice");
+}
+
+function testRenderHtmlOperatorDataOverridesLocals() {
+  var stubEngine = {
+    render: function (_v, data) { return JSON.stringify(data); },
+  };
+  var r = b.render.create({ engine: stubEngine });
+  var captured = null;
+  var res = {
+    writableEnded: false,
+    locals: { cspNonce: "locals-value" },
+    writeHead: function () {},
+    end: function (body) { captured = body; },
+  };
+  r.html(res, "view", { cspNonce: "operator-override" });
+  var rendered = JSON.parse(captured);
+  check("render.html: operator data wins on collision",
+        rendered.cspNonce === "operator-override");
+}
+
+// ---- Cacheable-render API: PLACEHOLDER + substitute() ----
+
+function testCspNoncePlaceholderIsPerInstanceRandom() {
+  var a = b.middleware.cspNonce();
+  var b1 = b.middleware.cspNonce();
+  check("placeholder is a non-empty string",   typeof a.PLACEHOLDER === "string" && a.PLACEHOLDER.length > 0);
+  check("placeholder differs across instances", a.PLACEHOLDER !== b1.PLACEHOLDER);
+  check("placeholder shape is recognizable",   /^__BLAMEJS_CSP_NONCE_[a-f0-9]+__$/.test(a.PLACEHOLDER));
+}
+
+function testCspNoncePlaceholderHonorsOperatorOverride() {
+  var pinned = "__OPERATOR_PINNED_TOKEN__";
+  var mw = b.middleware.cspNonce({ placeholder: pinned });
+  check("operator-pinned placeholder is used as-is", mw.PLACEHOLDER === pinned);
+}
+
+function testCspNoncePlaceholderInvalidTypeThrows() {
+  // Bad config → throw at create time so the operator's typo surfaces
+  // at app boot, not as silently-broken cache substitution three days
+  // later.
+  var threwOnNumber = null;
+  try { b.middleware.cspNonce({ placeholder: 42 }); }
+  catch (e) { threwOnNumber = e; }
+  check("placeholder: number throws CspNonceError",
+        threwOnNumber && threwOnNumber.code === "csp-nonce/bad-placeholder");
+
+  var threwOnEmpty = null;
+  try { b.middleware.cspNonce({ placeholder: "" }); }
+  catch (e) { threwOnEmpty = e; }
+  check("placeholder: empty string throws CspNonceError",
+        threwOnEmpty && threwOnEmpty.code === "csp-nonce/bad-placeholder");
+
+  var threwOnNull = null;
+  try { b.middleware.cspNonce({ placeholder: null }); }
+  catch (e) { threwOnNull = e; }
+  check("placeholder: null throws CspNonceError",
+        threwOnNull && threwOnNull.code === "csp-nonce/bad-placeholder");
+
+  // undefined / not-passed → silently use the default. NOT a throw.
+  var ok = b.middleware.cspNonce({ /* no placeholder */ });
+  check("placeholder: undefined uses the default (no throw)",
+        typeof ok.PLACEHOLDER === "string" && ok.PLACEHOLDER.length > 0);
+}
+
+function testCspNonceSubstituteReplacesPlaceholderWithReqNonce() {
+  var mw = b.middleware.cspNonce();
+  var html = '<script nonce="' + mw.PLACEHOLDER + '">x</script>' +
+             '<style nonce="' + mw.PLACEHOLDER + '">y</style>';
+  var req = { cspNonce: "real-nonce-abc" };
+  var out = mw.substitute(html, req);
+  check("substitute replaces every placeholder occurrence",
+        out === '<script nonce="real-nonce-abc">x</script><style nonce="real-nonce-abc">y</style>');
+}
+
+function testCspNonceSubstituteAcceptsRawNonceString() {
+  var mw = b.middleware.cspNonce();
+  var html = '<script nonce="' + mw.PLACEHOLDER + '">x</script>';
+  var out = mw.substitute(html, "literal-nonce-xyz");
+  check("substitute accepts a raw string nonce",
+        out === '<script nonce="literal-nonce-xyz">x</script>');
+}
+
+function testCspNonceSubstituteHonorsCustomProperty() {
+  var mw = b.middleware.cspNonce({ property: "myNonce" });
+  var html = '<script nonce="' + mw.PLACEHOLDER + '">x</script>';
+  var req = { myNonce: "custom-prop-nonce" };
+  var out = mw.substitute(html, req);
+  check("substitute reads from operator-supplied property",
+        out === '<script nonce="custom-prop-nonce">x</script>');
+}
+
+function testCspNonceSubstituteHandlesEmptyAndMissing() {
+  var mw = b.middleware.cspNonce();
+  check("substitute on empty html returns empty",          mw.substitute("", { cspNonce: "x" }) === "");
+  check("substitute on null html returns null",            mw.substitute(null, { cspNonce: "x" }) === null);
+  check("substitute with no placeholder returns input as-is",
+        mw.substitute("<p>no token</p>", { cspNonce: "x" }) === "<p>no token</p>");
+  var html = '<script nonce="' + mw.PLACEHOLDER + '">x</script>';
+  check("substitute with null req substitutes empty (so the placeholder doesn't leak)",
+        mw.substitute(html, null) === '<script nonce="">x</script>');
+}
+
+// Drives the middleware twice on the same cached HTML to confirm
+// each request gets its own nonce in BOTH the CSP header and the
+// substituted script tags. This is the canonical regression for the
+// cached-stale-nonce class of bug.
+async function testCspNonceCacheableRoundTripIntegration() {
+  var mw = b.middleware.cspNonce();
+  var cachedHtml =
+    '<head>' +
+    '  <script src="/a.js" nonce="' + mw.PLACEHOLDER + '"></script>' +
+    '  <script src="/b.js" nonce="' + mw.PLACEHOLDER + '"></script>' +
+    '</head>';
+
+  function _drive() {
+    return new Promise(function (resolve) {
+      var req = _cspReq();
+      var res = _cspRes("default-src 'self'");
+      mw(req, res, function () {
+        var rendered = mw.substitute(cachedHtml, req);
+        var headerCsp = res.getHeader("content-security-policy") || "";
+        var headerNonce = (headerCsp.match(/'nonce-([A-Za-z0-9+/=]+)'/) || [])[1] || null;
+        var nonceAttrs = rendered.match(/nonce="([^"]+)"/g) || [];
+        var scriptNonces = nonceAttrs.map(function (s) { return s.slice(7, -1); });
+        resolve({ headerNonce: headerNonce, scriptNonces: scriptNonces });
+      });
+    });
+  }
+
+  var r1 = await _drive();
+  var r2 = await _drive();
+
+  check("cache hit #1: header nonce present",            r1.headerNonce !== null);
+  check("cache hit #1: every script nonce matches header",
+        r1.scriptNonces.length === 2 &&
+        r1.scriptNonces.every(function (n) { return n === r1.headerNonce; }));
+  check("cache hit #2: header nonce rotated between requests",
+        r1.headerNonce !== r2.headerNonce);
+  check("cache hit #2: every script nonce matches the rotated header nonce",
+        r2.scriptNonces.length === 2 &&
+        r2.scriptNonces.every(function (n) { return n === r2.headerNonce; }));
+}
+
+async function run() {
+  testCspNonceSurface();
+  testCspNonceParseSerialize();
+  testCspNonceInjectNonceIntoExisting();
+  testCspNonceInjectAddsMissingDirective();
+  testCspNonceInjectStrictDynamic();
+  testCspNonceInjectIdempotent();
+  testCspNonceInjectBuildsFromScratch();
+  await testCspNonceMiddlewareSetsReqAndLocals();
+  await testCspNonceMiddlewareCustomProperty();
+  await testCspNonceMiddlewareSkipsWhenNoCspAndNotAlways();
+  await testCspNonceMiddlewareAlwaysCreatesCsp();
+  await testCspNonceMiddlewareNonceLengthDefault();
+  await testCspNonceMiddlewareCustomNonceLength();
+  await testCspNonceUniquenessAcrossRequests();
+  testCspNonceConfigValidation();
+  await testCspNonceLayeredOnSecurityHeaders();
+  testRenderHtmlAutoMergesResLocals();
+  testRenderHtmlOperatorDataOverridesLocals();
+  testCspNoncePlaceholderIsPerInstanceRandom();
+  testCspNoncePlaceholderHonorsOperatorOverride();
+  testCspNoncePlaceholderInvalidTypeThrows();
+  testCspNonceSubstituteReplacesPlaceholderWithReqNonce();
+  testCspNonceSubstituteAcceptsRawNonceString();
+  testCspNonceSubstituteHonorsCustomProperty();
+  testCspNonceSubstituteHandlesEmptyAndMissing();
+  await testCspNonceCacheableRoundTripIntegration();
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  run().then(
+    function () { console.log("OK — " + helpers.getChecks() + " checks passed"); },
+    function (e) { console.error("FAIL:", e.message); process.exit(1); }
+  );
+}

package/lib/vendor/blamejs/test/layer-0-primitives/csp-report.test.js

@@ -0,0 +1,34 @@
+"use strict";
+/**
+ * b.middleware.cspReport — Reporting-API endpoint for CSP / COEP /
+ * COOP / Permissions-Policy violations.
+ */
+
+var helpers = require("../helpers");
+var b      = helpers.b;
+var check  = helpers.check;
+
+async function run() {
+  var middleware = b.middleware.cspReport({});
+  check("middleware.cspReport returns a function", typeof middleware === "function");
+
+  var sent = {};
+  var req = { method: "GET", headers: {} };
+  var res = {
+    headersSent: false,
+    writeHead: function (s, h) { sent.status = s; sent.headers = h; },
+    end:       function () { sent.ended = true; },
+  };
+  await middleware(req, res, function () {});
+  check("middleware.cspReport: GET returns 405",
+    sent.status === 405 && sent.ended === true);
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  run().then(
+    function () { console.log("[csp-report] OK"); },
+    function (e) { console.error(e); process.exit(1); }
+  );
+}

package/lib/vendor/blamejs/test/layer-0-primitives/csv.test.js

@@ -0,0 +1,180 @@
+"use strict";
+/**
+ * b.csv — RFC 4180 parser + serializer with operator-friendly defaults.
+ */
+
+var helpers = require("../helpers");
+var b     = helpers.b;
+var check = helpers.check;
+
+async function run() {
+  // ---- Surface ----
+  check("b.csv namespace present",        typeof b.csv === "object");
+  check("b.csv.parse is fn",              typeof b.csv.parse === "function");
+  check("b.csv.stringify is fn",          typeof b.csv.stringify === "function");
+  check("b.csv.CsvError is class",        typeof b.csv.CsvError === "function");
+  check("b.parsers.csv removed",          typeof b.parsers.csv === "undefined");
+
+  // ---- parse: header mode (returns array of objects) ----
+  var p1 = b.csv.parse("a,b,c\n1,2,3\n4,5,6\n");
+  check("parse: header mode → 2 rows",     p1.length === 2);
+  check("parse: row 0 keyed by header",    p1[0].a === "1" && p1[0].b === "2" && p1[0].c === "3");
+  check("parse: row 1 keyed by header",    p1[1].a === "4");
+
+  // CRLF
+  var p2 = b.csv.parse("a,b\r\n1,2\r\n3,4\r\n");
+  check("parse: CRLF row terminators",     p2.length === 2 && p2[1].b === "4");
+
+  // No trailing newline
+  var p3 = b.csv.parse("a,b\n1,2");
+  check("parse: no trailing newline ok",   p3.length === 1 && p3[0].a === "1");
+
+  // BOM stripped
+  var p4 = b.csv.parse("a,b\n1,2\n");
+  check("parse: leading BOM consumed",     p4[0].a === "1");
+
+  // Buffer input + Uint8Array input
+  var p4b = b.csv.parse(Buffer.from("a,b\n1,2"));
+  check("parse: Buffer input accepted",    p4b[0].a === "1");
+  var p4u = b.csv.parse(new Uint8Array(Buffer.from("a,b\n1,2")));
+  check("parse: Uint8Array input accepted", p4u[0].a === "1");
+
+  // Quoted fields with embedded comma + escaped quote + newline
+  var quoted = "a,b\n\"hello, world\",\"he said \"\"hi\"\"\"\n\"line 1\nline 2\",x\n";
+  var p5 = b.csv.parse(quoted);
+  check("parse: quoted comma in field",     p5[0].a === "hello, world");
+  check("parse: escaped quote (\"\" → \")", p5[0].b === 'he said "hi"');
+  check("parse: embedded newline in quotes",p5[1].a === "line 1\nline 2");
+
+  // No-header mode (returns array of arrays)
+  var p6 = b.csv.parse("1,2,3\n4,5,6\n", { header: false });
+  check("parse: no-header returns array of arrays",
+        p6.length === 2 && p6[0][0] === "1" && p6[1][2] === "6");
+
+  // trim: true
+  var p6b = b.csv.parse("a,b\n  hi  , there\n", { trim: true });
+  check("parse: trim option strips cell whitespace",
+        p6b[0].a === "hi" && p6b[0].b === "there");
+
+  // ---- parse: validation ----
+  function rejects(label, fn, codeRe) {
+    var threw = null;
+    try { fn(); } catch (e) { threw = e; }
+    check("parse-validate: " + label,  threw && codeRe.test(threw.code || ""));
+  }
+  rejects("number input",              function () { b.csv.parse(42); }, /csv\/bad-input/);
+  rejects("multi-char delimiter",      function () { b.csv.parse("a,b\n1,2", { delimiter: ",," }); }, /csv\/bad-delimiter/);
+  rejects("CR delimiter",              function () { b.csv.parse("a,b", { delimiter: "\r" }); }, /csv\/bad-delimiter/);
+  rejects("delimiter same as quote",   function () { b.csv.parse("a,b", { delimiter: "\"" }); }, /csv\/bad-delimiter/);
+  rejects("over maxBytes",             function () { b.csv.parse("a,b\n", { maxBytes: 1 }); }, /csv\/too-large/);
+  rejects("over maxRows",              function () { b.csv.parse("a\n1\n2\n3\n4\n5\n", { header: false, maxRows: 3 }); }, /csv\/too-many-rows/);
+  rejects("over maxFieldBytes",        function () { b.csv.parse("a\n" + "x".repeat(20), { header: false, maxFieldBytes: 5 }); }, /csv\/field-too-large/);
+  rejects("unterminated quote",        function () { b.csv.parse("a,b\n\"unclosed,1\n2,3"); }, /csv\/unterminated-quote/);
+  rejects("bad onBadRow value",        function () { b.csv.parse("a,b\n1,2,3", { onBadRow: "panic" }); }, /csv\/bad-opt/);
+
+  // Row-length mismatch — throw vs skip
+  var threwRowMismatch = null;
+  try { b.csv.parse("a,b,c\n1,2\n"); } catch (e) { threwRowMismatch = e; }
+  check("parse: row-length mismatch throws by default",
+        threwRowMismatch && /csv\/row-length-mismatch/.test(threwRowMismatch.code));
+  var skipped = b.csv.parse("a,b,c\n1,2\n4,5,6\n", { onBadRow: "skip" });
+  check("parse: onBadRow=skip drops bad row",
+        skipped.length === 1 && skipped[0].a === "4");
+
+  // Custom delimiter (semicolon, tab)
+  var p7 = b.csv.parse("a;b\n1;2\n", { delimiter: ";" });
+  check("parse: semicolon delimiter",   p7[0].b === "2");
+  var p7b = b.csv.parse("a\tb\n1\t2\n", { delimiter: "\t" });
+  check("parse: TAB delimiter",         p7b[0].a === "1" && p7b[0].b === "2");
+
+  // ---- stringify (basic) ----
+  var s1 = b.csv.stringify([{ a: "1", b: "2" }, { a: "3", b: "4" }]);
+  check("stringify: emits header + rows",
+        s1.indexOf("a,b\r\n1,2\r\n3,4") === 0);
+
+  // Cells needing quoting
+  var s2 = b.csv.stringify([{ a: 'hello, "world"', b: "ok" }]);
+  check("stringify: quotes commas + escapes inner quotes",
+        s2.indexOf('"hello, ""world""",ok') !== -1);
+
+  // No-header
+  var s3 = b.csv.stringify([{ a: "1", b: "2" }], { header: false });
+  check("stringify: header=false skips header row",
+        s3.indexOf("a,b") === -1 && s3.indexOf("1,2") === 0);
+
+  // Explicit columns ordering
+  var s4 = b.csv.stringify([{ a: "1", b: "2", c: "3" }], { columns: ["c", "a"] });
+  check("stringify: explicit columns ordering",
+        s4.indexOf("c,a\r\n3,1") === 0);
+
+  // Array-of-arrays input (no header by default in this shape)
+  var s5 = b.csv.stringify([["x", "y"], ["1", "2"]], { header: false });
+  check("stringify: array-of-arrays",
+        s5.indexOf("x,y\r\n1,2") === 0);
+
+  // null / undefined → empty cell
+  var s6 = b.csv.stringify([{ a: null, b: undefined, c: "v" }]);
+  check("stringify: null/undef → empty",
+        /a,b,c\r\n,,v/.test(s6));
+
+  // Custom EOL
+  var s7 = b.csv.stringify([{ a: "1" }], { eol: "\n" });
+  check("stringify: \\n EOL",            s7 === "a\n1");
+
+  // alwaysQuote
+  var s8 = b.csv.stringify([{ a: "1", b: "2" }], { alwaysQuote: true });
+  check("stringify: alwaysQuote wraps every cell",
+        s8.indexOf("\"a\",\"b\"\r\n\"1\",\"2\"") === 0);
+
+  // ---- b.csv is for trusted-source-only emission ----
+  // RFC 4180 quoting is the only escape work b.csv performs. Cells from
+  // user-supplied input MUST go through b.guardCsv (which handles formula
+  // triggers, dangerous-function denylist, bidi / homoglyph / control /
+  // null / BOM / dialect threats). Confirm b.csv does not pretend to
+  // defend against formula injection itself.
+  var raw = b.csv.stringify([{ a: "=SUM(A1)" }]);
+  check("stringify: leaves =formula cell untouched (no false-confidence prefix)",
+        /^a\r\n=SUM\(A1\)/.test(raw));
+
+  // ---- Round-trip ----
+  var src = [
+    { name: "Alice",     email: "a@example.com", note: 'said "hi"' },
+    { name: "Bob, Jr.",  email: "b@example.com", note: "line1\nline2" },
+  ];
+  var written = b.csv.stringify(src);
+  var read = b.csv.parse(written);
+  check("round-trip: row count preserved",   read.length === 2);
+  check("round-trip: comma in name preserved",
+        read[1].name === "Bob, Jr.");
+  check("round-trip: embedded quote preserved",
+        read[0].note === 'said "hi"');
+  check("round-trip: embedded newline preserved",
+        read[1].note === "line1\nline2");
+
+  // Round-trip preserves cell content byte-for-byte (b.csv does no
+  // formula-injection mutation — that's b.guardCsv's responsibility).
+  var fz = b.csv.stringify([{ a: "=A1" }]);
+  var fzParsed = b.csv.parse(fz);
+  check("round-trip: cell content unchanged",  fzParsed[0].a === "=A1");
+
+  // ---- stringify validation ----
+  function rejectsS(label, fn, codeRe) {
+    var threw = null;
+    try { fn(); } catch (e) { threw = e; }
+    check("stringify-validate: " + label,  threw && codeRe.test(threw.code || ""));
+  }
+  rejectsS("non-array input",       function () { b.csv.stringify("nope"); }, /csv\/bad-input/);
+  rejectsS("non-object row",        function () { b.csv.stringify([42]); }, /csv\/bad-input/);
+  rejectsS("delim same as quote",   function () { b.csv.stringify([{ a: 1 }], { delimiter: "\"" }); }, /csv\/bad-delimiter/);
+  rejectsS("bad eol",               function () { b.csv.stringify([{ a: 1 }], { eol: "X" }); }, /csv\/bad-opt/);
+  check("stringify: empty array → empty string",   b.csv.stringify([]) === "");
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  run().then(
+    function () { console.log("OK — " + helpers.getChecks() + " checks passed"); },
+    function (e) { console.error("FAIL:", e && e.stack || e); process.exit(1); }
+  );
+}