@blamejs/blamejs-shop 0.1.29 → 0.1.30

package/lib/vendor/blamejs/lib/totp.js

@@ -61,6 +61,7 @@
  */
 var nodeCrypto = require("node:crypto");
 var C = require("./constants");
+var base32 = require("./base32");
 var { generateBytes, generateToken, timingSafeEqual } = require("./crypto");
 var { AuthError } = require("./framework-error");
 
@@ -84,45 +85,23 @@ var DEFAULT_SECRET_BYTES = C.BYTES.bytes(128);
 var MIN_SECRET_BYTES     = 20;
 // HOTP counter is an 8-byte big-endian field per RFC 4226 §5.1.
 var HOTP_COUNTER_BYTES   = C.BYTES.bytes(8);
-// Base32 (RFC 4648) packs 5 bits per char; bit + byte widths used by the
-// encoder/decoder below. Routed through C.BYTES so every byte literal in
-// the file lives behind the same helper.
-var BITS_PER_BYTE        = C.BYTES.bytes(8);
 
 // ---- Base32 (RFC 4648, no padding — TOTP convention) ----
-
-var BASE32 = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
+// Composes b.base32: secrets are emitted unpadded and parsed leniently
+// (case-insensitive, ignoring the spaces / dashes humans add when copying
+// a key). An invalid character is surfaced as the TOTP-specific error code.
 
 function _base32Encode(buf) {
-  var bits = "";
-  for (var i = 0; i < buf.length; i++) {
-    bits += buf[i].toString(2).padStart(BITS_PER_BYTE, "0");
-  }
-  var out = "";
-  for (var j = 0; j < bits.length; j += 5) {
-    var chunk = bits.substring(j, j + 5).padEnd(5, "0");
-    out += BASE32[parseInt(chunk, 2)];
-  }
-  return out;
+  return base32.encode(buf, { padding: false });
 }
 
 function _base32Decode(str) {
-  var bits = "";
-  for (var i = 0; i < str.length; i++) {
-    var c = str[i].toUpperCase();
-    if (c === "=" || c === " " || c === "-") continue;     // spaces + dashes + padding
-    var idx = BASE32.indexOf(c);
-    if (idx === -1) {
-      throw new AuthError("auth-totp/bad-secret",
-        "secret contains invalid base32 character: '" + str[i] + "'");
-    }
-    bits += idx.toString(2).padStart(5, "0");
-  }
-  var bytes = [];
-  for (var j = 0; j + BITS_PER_BYTE <= bits.length; j += BITS_PER_BYTE) {
-    bytes.push(parseInt(bits.substring(j, j + BITS_PER_BYTE), 2));
+  try {
+    return base32.decode(str, { loose: true });
+  } catch (e) {
+    throw new AuthError("auth-totp/bad-secret",
+      "secret contains invalid base32 character" + (e && e.message ? ": " + e.message : ""));
   }
-  return Buffer.from(bytes);
 }
 
 // ---- Core HOTP (RFC 4226 §5.3) ----

package/lib/vendor/blamejs/lib/uri-template.js

@@ -0,0 +1,286 @@
+"use strict";
+/**
+ * @module b.uriTemplate
+ * @nav    HTTP
+ * @title  URI Templates
+ *
+ * @intro
+ *   Expand <a href="https://www.rfc-editor.org/rfc/rfc6570">RFC 6570</a> URI
+ *   Templates — the <code>{var}</code> syntax that OpenAPI links, HAL
+ *   <code>_links</code>, and hypermedia API clients use to turn a template
+ *   plus a set of variables into a concrete URI. The full Level 4 grammar
+ *   is supported: every operator (<code>{+var}</code> reserved,
+ *   <code>{#var}</code> fragment, <code>{.var}</code> label,
+ *   <code>{/var}</code> path, <code>{;var}</code> path-style parameters,
+ *   <code>{?var}</code> query, <code>{&amp;var}</code> query continuation),
+ *   the <code>{var:3}</code> prefix modifier, and the <code>{var*}</code>
+ *   explode modifier for lists and associative arrays.
+ *
+ *   <code>expand(template, vars)</code> returns the expanded string;
+ *   <code>compile(template)</code> parses once and returns a reusable
+ *   <code>{ expand }</code> for templates applied to many variable sets. A
+ *   malformed template (an unclosed expression, an unknown operator, or a
+ *   non-numeric prefix) throws <code>UriTemplateError</code>.
+ *
+ * @card
+ *   RFC 6570 URI Template expansion (full Level 4 — every operator, the
+ *   <code>:N</code> prefix and <code>*</code> explode modifiers) — the
+ *   <code>{var}</code> syntax behind OpenAPI links and HAL hypermedia.
+ */
+
+var { defineClass } = require("./framework-error");
+
+var UriTemplateError = defineClass("UriTemplateError", { alwaysPermanent: true });
+
+var MAX_PREFIX = 10000;                                     // allow:raw-byte-literal — RFC 6570 caps prefix length at 9999
+
+// Operator table (RFC 6570 §2.2 / §3.2.1). first = prefix when any value is
+// present; sep = separator between values; named = emit "name=value";
+// ifemp = string used when a named value is empty; reserved = allow the
+// reserved set through unencoded.
+var OPERATORS = {
+  "":  { first: "",  sep: ",", named: false, ifemp: "",  reserved: false },
+  "+": { first: "",  sep: ",", named: false, ifemp: "",  reserved: true },
+  "#": { first: "#", sep: ",", named: false, ifemp: "",  reserved: true },
+  ".": { first: ".", sep: ".", named: false, ifemp: "",  reserved: false },
+  "/": { first: "/", sep: "/", named: false, ifemp: "",  reserved: false },
+  ";": { first: ";", sep: ";", named: true,  ifemp: "",  reserved: false },
+  "?": { first: "?", sep: "&", named: true,  ifemp: "=", reserved: false },
+  "&": { first: "&", sep: "&", named: true,  ifemp: "=", reserved: false },
+};
+
+var UNRESERVED = /[A-Za-z0-9\-._~]/;
+// Reserved = gen-delims + sub-delims (RFC 3986 §2.2).
+var RESERVED = /[:/?#[\]@!$&'()*+,;=]/;
+
+function _pctEncode(str, allowReserved) {
+  var out = "";
+  for (var i = 0; i < str.length; i++) {
+    var ch = str.charAt(i);
+    // Preserve existing percent-encoded triplets when the reserved set is
+    // allowed (operators "+" and "#").
+    if (allowReserved && ch === "%" && /^[0-9A-Fa-f]{2}$/.test(str.substr(i + 1, 2))) {
+      out += str.substr(i, 3); i += 2; continue;
+    }
+    if (UNRESERVED.test(ch) || (allowReserved && RESERVED.test(ch))) { out += ch; continue; }
+    // Percent-encode the character's raw UTF-8 bytes (handles surrogate
+    // pairs). encodeURIComponent is not used — it leaves !*'() unencoded,
+    // which RFC 6570 unreserved-only expansion must escape.
+    var cp = str.codePointAt(i);
+    var bytes = Buffer.from(String.fromCodePoint(cp), "utf8");
+    for (var b = 0; b < bytes.length; b++) out += "%" + bytes[b].toString(16).toUpperCase().padStart(2, "0");   // allow:raw-byte-literal — hex radix
+    if (cp > 0xFFFF) i++;   // consumed a surrogate pair   // allow:raw-byte-literal — BMP boundary for surrogate-pair detection
+  }
+  return out;
+}
+
+function _allDigits(s) {
+  if (s.length === 0) return false;
+  for (var i = 0; i < s.length; i++) { var c = s.charCodeAt(i); if (c < 48 || c > 57) return false; }   // allow:raw-byte-literal — ASCII '0'..'9' code-point bounds
+  return true;
+}
+
+// A composite member/value is "defined" unless it is undefined or null
+// (an empty string, 0, or false is defined and expands).
+function _memberDefined(v) { return v !== undefined && v !== null; }
+
+function _isDefined(v) {
+  if (v === undefined || v === null) return false;
+  if (Array.isArray(v)) return v.length > 0;
+  if (typeof v === "object") return Object.keys(v).length > 0;
+  return true;
+}
+function _toStr(v) {
+  if (typeof v === "string") return v;
+  if (typeof v === "number" || typeof v === "boolean") return String(v);
+  return String(v);
+}
+
+// A literal run may not contain a stray "}" (an unmatched expression close)
+// — RFC 6570 literals exclude "{" and "}".
+function _checkLiteral(lit) {
+  if (lit.indexOf("}") !== -1) throw new UriTemplateError("uri-template/unmatched-brace", "uriTemplate: unmatched '}' in template literal");
+}
+
+// Parse a template into an array of literal strings + expression objects.
+function _parse(template) {
+  if (typeof template !== "string") throw new UriTemplateError("uri-template/bad-template", "uriTemplate: template must be a string");
+  var parts = [];
+  var i = 0;
+  while (i < template.length) {
+    var open = template.indexOf("{", i);
+    if (open === -1) { _checkLiteral(template.slice(i)); parts.push({ literal: template.slice(i) }); break; }
+    if (open > i) { _checkLiteral(template.slice(i, open)); parts.push({ literal: template.slice(i, open) }); }
+    var close = template.indexOf("}", open);
+    if (close === -1) throw new UriTemplateError("uri-template/unclosed", "uriTemplate: unclosed expression at index " + open);
+    parts.push(_parseExpr(template.slice(open + 1, close)));
+    i = close + 1;
+  }
+  return parts;
+}
+
+function _parseExpr(body) {
+  if (body.length === 0) throw new UriTemplateError("uri-template/empty-expression", "uriTemplate: empty expression {}");
+  var op = "";
+  var c0 = body.charAt(0);
+  if ("+#./;?&".indexOf(c0) !== -1) { op = c0; body = body.slice(1); }
+  else if ("=,!@|".indexOf(c0) !== -1) {
+    // Operators reserved by RFC 6570 §2.2 for future extensions → error.
+    throw new UriTemplateError("uri-template/reserved-operator", "uriTemplate: operator '" + c0 + "' is reserved");
+  }
+  var specs = body.split(",").map(function (raw) {
+    if (raw.length === 0) throw new UriTemplateError("uri-template/bad-varspec", "uriTemplate: empty variable name");
+    var explode = false, prefix = null;
+    var name = raw;
+    if (raw.charAt(raw.length - 1) === "*") { explode = true; name = raw.slice(0, -1); }
+    else {
+      var colon = raw.indexOf(":");
+      if (colon !== -1) {
+        name = raw.slice(0, colon);
+        var n = raw.slice(colon + 1);
+        if (!_allDigits(n)) throw new UriTemplateError("uri-template/bad-prefix", "uriTemplate: prefix length must be a non-negative integer");
+        prefix = parseInt(n, 10);
+        if (prefix >= MAX_PREFIX) throw new UriTemplateError("uri-template/bad-prefix", "uriTemplate: prefix length exceeds 9999");
+      }
+    }
+    if (!/^(?:[A-Za-z0-9_]|%[0-9A-Fa-f]{2})(?:\.?(?:[A-Za-z0-9_]|%[0-9A-Fa-f]{2}))*$/.test(name)) {
+      throw new UriTemplateError("uri-template/bad-varname", "uriTemplate: invalid variable name '" + name + "'");
+    }
+    return { name: name, explode: explode, prefix: prefix };
+  });
+  return { op: op, specs: specs };
+}
+
+function _expandExpr(expr, vars) {
+  var o = OPERATORS[expr.op];
+  var pieces = [];
+  expr.specs.forEach(function (spec) {
+    var value = vars[spec.name];
+    if (!_isDefined(value)) return;
+
+    if (typeof value !== "object") {
+      // Simple string/number/boolean value.
+      var s = _toStr(value);
+      if (spec.prefix !== null) s = _sliceChars(s, spec.prefix);
+      pieces.push(_named(o, spec.name, _pctEncode(s, o.reserved), s.length === 0));
+    } else if (Array.isArray(value)) {
+      if (spec.prefix !== null) throw new UriTemplateError("uri-template/prefix-on-list", "uriTemplate: prefix modifier cannot apply to a list");
+      // Undefined / null members are ignored (RFC 6570 §3.2.1); a list with
+      // no defined members is treated as undefined and omitted entirely.
+      var members = value.filter(_memberDefined);
+      if (members.length === 0) return;
+      if (!spec.explode) {
+        var joined = members.map(function (m) { return _pctEncode(_toStr(m), o.reserved); }).join(",");
+        pieces.push(_named(o, spec.name, joined, false));
+      } else {
+        members.forEach(function (m) {
+          pieces.push(_named(o, spec.name, _pctEncode(_toStr(m), o.reserved), _toStr(m).length === 0));
+        });
+      }
+    } else {
+      // Associative array (object). Pairs whose value is undefined / null
+      // are omitted (RFC 6570 §3.2.1).
+      if (spec.prefix !== null) throw new UriTemplateError("uri-template/prefix-on-map", "uriTemplate: prefix modifier cannot apply to a map");
+      var keys = Object.keys(value).filter(function (k) { return _memberDefined(value[k]); });
+      if (keys.length === 0) return;
+      if (!spec.explode) {
+        var pairs = [];
+        keys.forEach(function (k) { pairs.push(_pctEncode(k, o.reserved)); pairs.push(_pctEncode(_toStr(value[k]), o.reserved)); });
+        pieces.push(_named(o, spec.name, pairs.join(","), false));
+      } else {
+        keys.forEach(function (k) {
+          // Exploded map: the key becomes the name.
+          pieces.push(_namedPair(o, _pctEncode(k, o.reserved), _pctEncode(_toStr(value[k]), o.reserved)));
+        });
+      }
+    }
+  });
+  if (pieces.length === 0) return "";
+  return o.first + pieces.join(o.sep);
+}
+
+// Build one "name=value" (or bare value) piece for a non-exploded or
+// string varspec.
+function _named(o, name, encodedValue, isEmpty) {
+  if (!o.named) return encodedValue;
+  if (isEmpty) return name + o.ifemp;
+  return name + "=" + encodedValue;
+}
+// Exploded map pair: key is already the name.
+function _namedPair(o, encodedKey, encodedValue) {
+  if (!o.named) return encodedKey + "=" + encodedValue;
+  if (encodedValue.length === 0) return encodedKey + o.ifemp;
+  return encodedKey + "=" + encodedValue;
+}
+
+// Truncate to N Unicode code points (RFC 6570 prefix length is in chars).
+function _sliceChars(s, n) {
+  var out = "", count = 0;
+  for (var i = 0; i < s.length && count < n; i++) {
+    var cp = s.codePointAt(i);
+    out += String.fromCodePoint(cp);
+    if (cp > 0xFFFF) i++;   // allow:raw-byte-literal — BMP boundary for surrogate pairs
+    count++;
+  }
+  return out;
+}
+
+/**
+ * @primitive  b.uriTemplate.compile
+ * @signature  b.uriTemplate.compile(template)
+ * @since      0.12.66
+ * @status     stable
+ * @related    b.uriTemplate.expand, b.hal, b.linkHeader
+ *
+ * Parse an RFC 6570 URI Template once and return a reusable
+ * <code>{ expand(vars) }</code>, so a template applied to many variable
+ * sets is parsed a single time. Throws <code>UriTemplateError</code> if the
+ * template is malformed.
+ *
+ * @example
+ *   var t = b.uriTemplate.compile("/users/{id}{?fields*}");
+ *   t.expand({ id: 7, fields: ["name", "email"] });
+ *   // → "/users/7?fields=name&fields=email"
+ */
+function compile(template) {
+  var parts = _parse(template);
+  return {
+    expand: function (vars) {
+      vars = vars || {};
+      var out = "";
+      for (var i = 0; i < parts.length; i++) {
+        out += Object.prototype.hasOwnProperty.call(parts[i], "literal") ? parts[i].literal : _expandExpr(parts[i], vars);
+      }
+      return out;
+    },
+  };
+}
+
+/**
+ * @primitive  b.uriTemplate.expand
+ * @signature  b.uriTemplate.expand(template, vars)
+ * @since      0.12.66
+ * @status     stable
+ * @related    b.uriTemplate.compile
+ *
+ * Expand an RFC 6570 URI Template against a set of variables and return the
+ * resulting URI string. Variable values may be strings, numbers, booleans,
+ * arrays (lists), or plain objects (associative arrays); an undefined,
+ * null, or empty list/map variable is omitted. Reserved-set encoding,
+ * <code>:N</code> prefixes, and <code>*</code> explosion follow RFC 6570
+ * §3.2. Throws <code>UriTemplateError</code> on a malformed template.
+ *
+ * @example
+ *   b.uriTemplate.expand("{/path}/here{?q,limit}",
+ *     { path: "search", q: "json schema", limit: 10 });
+ *   // → "/search/here?q=json%20schema&limit=10"
+ */
+function expand(template, vars) {
+  return compile(template).expand(vars);
+}
+
+module.exports = {
+  expand:           expand,
+  compile:          compile,
+  UriTemplateError: UriTemplateError,
+};

package/lib/vendor/blamejs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.12.63",
+  "version": "0.12.66",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/lib/vendor/blamejs/release-notes/v0.12.64.json

@@ -0,0 +1,18 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.12.64",
+  "date": "2026-05-25",
+  "headline": "`b.jsonSchema` — JSON Schema 2020-12 validation",
+  "summary": "Validate JSON against a JSON Schema 2020-12 document — the dialect OpenAPI 3.1 adopted and the most widely implemented schema language. b.jsonSchema.compile(schema) returns a reusable validator; b.jsonSchema.validate(schema, instance) compiles and runs in one call, returning { valid, errors } where each error names the failing instance location, keyword, and schema path. The full 2020-12 vocabulary is supported: every applicator (allOf / anyOf / oneOf / not / if-then-else, properties / patternProperties / additionalProperties / prefixItems / items / contains), the annotation-aware unevaluatedProperties / unevaluatedItems, every assertion keyword, and reference resolution ($ref / $anchor / $dynamicRef / $dynamicAnchor / $defs / $id base URIs). format is an annotation by default (opt in to assertion with assertFormat). External references resolve through an operator-supplied schema map — never a network fetch. Verified against the official JSON-Schema-Test-Suite (1292 of 1295 draft2020-12 cases; the remainder need the bundled dialect metaschema or $vocabulary selection, both opt-in). This is the standards-track counterpart to the fluent b.safeSchema builder and the portable b.jtd.",
+  "sections": [
+    {
+      "heading": "Added",
+      "items": [
+        {
+          "title": "`b.jsonSchema` — JSON Schema 2020-12",
+          "body": "`compile(schema, opts)` returns `{ validate, isValid }`; `validate(schema, instance, opts)` and `isValid(schema, instance, opts)` compile and run in one call. `validate` returns `{ valid, errors }`, each error a `{ instancePath, keyword, schemaPath, message }`. The full 2020-12 vocabulary is implemented — applicators, annotation-aware `unevaluatedProperties` / `unevaluatedItems`, every assertion keyword, and `$ref` / `$anchor` / `$dynamicRef` / `$dynamicAnchor` / `$defs` / `$id` resolution. `format` is an annotation by default (`assertFormat: true` to assert). External references resolve through `opts.schemas` (a URI→schema map), never a network fetch. Reach for it when the schema is an existing JSON Schema document (an API contract, OpenAPI component, or config schema); `b.safeSchema` remains the fluent in-process builder and `b.jtd` the portable codegen-friendly option. Validating a schema document against the dialect metaschema requires supplying that metaschema via `opts.schemas`, and `$vocabulary`-based keyword selection is not honored (every standard keyword always asserts)."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/release-notes/v0.12.65.json

@@ -0,0 +1,27 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.12.65",
+  "date": "2026-05-26",
+  "headline": "`b.base32` — RFC 4648 Base32 encode / decode",
+  "summary": "Encode and decode RFC 4648 Base32 — the case-insensitive alphabet behind TOTP / 2FA secrets, DNSSEC NSEC3 hashes, and human-transcribable identifiers. Both RFC 4648 variants are supported: the standard alphabet (the default) and the extended-hex alphabet. b.base32.encode pads to an 8-character boundary by default (pass padding: false for the bare form TOTP key URIs use); b.base32.decode is strict by default but accepts the real-world shapes humans produce — lower-case, embedded spaces and dashes, missing padding — under loose: true. Verified against the RFC 4648 §10 test vectors for both alphabets. The TOTP primitive now composes this codec instead of carrying its own Base32 implementation.",
+  "sections": [
+    {
+      "heading": "Added",
+      "items": [
+        {
+          "title": "`b.base32.encode` / `b.base32.decode`",
+          "body": "RFC 4648 Base32 codec. `encode(buf, opts)` takes a Buffer or Uint8Array and returns a Base32 string, padded to an 8-character boundary unless `padding: false`; `decode(str, opts)` returns a Buffer. The `variant` option selects the standard (`\"rfc4648\"`, default) or extended-hex (`\"rfc4648-hex\"`) alphabet. Decoding is strict by default — any character outside the alphabet throws `Base32Error` — and `loose: true` up-cases the input and ignores embedded spaces, dashes, and missing padding, which is how copied TOTP keys and hand-typed codes arrive."
+        }
+      ]
+    },
+    {
+      "heading": "Changed",
+      "items": [
+        {
+          "title": "TOTP composes `b.base32`",
+          "body": "`b.auth.totp` now encodes and decodes its secrets through `b.base32` rather than a private Base32 implementation. Behavior is unchanged — secrets are still emitted unpadded and parsed leniently (case-insensitive, ignoring spaces and dashes)."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/release-notes/v0.12.66.json

@@ -0,0 +1,18 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.12.66",
+  "date": "2026-05-26",
+  "headline": "`b.uriTemplate` — RFC 6570 URI Template expansion",
+  "summary": "Expand RFC 6570 URI Templates — the {var} syntax that OpenAPI links, HAL _links, and hypermedia API clients use to turn a template plus a set of variables into a concrete URI. The full Level 4 grammar is supported: every operator ({+var} reserved, {#var} fragment, {.var} label, {/var} path, {;var} path-style parameters, {?var} query, {&var} query continuation), the {var:3} prefix modifier, and the {var*} explode modifier for lists and associative arrays. b.uriTemplate.expand(template, vars) returns the expanded string; b.uriTemplate.compile(template) parses once for templates applied to many variable sets. A malformed template (unclosed expression, reserved operator, non-numeric prefix, unmatched brace) throws UriTemplateError. Verified against the official uritemplate-test conformance suite (all 135 spec, extended, and negative cases).",
+  "sections": [
+    {
+      "heading": "Added",
+      "items": [
+        {
+          "title": "`b.uriTemplate.expand` / `b.uriTemplate.compile`",
+          "body": "RFC 6570 URI Template expansion, full Level 4. `expand(template, vars)` substitutes variables into a template and returns the URI; `compile(template)` returns a reusable `{ expand }` for repeated use. Variable values may be strings, numbers, booleans, arrays (lists), or plain objects (associative arrays); undefined, null, and empty list/map variables are omitted. All eight operators, the `:N` prefix modifier, and the `*` explode modifier follow §3.2, including reserved-set encoding for `{+var}` / `{#var}`. Composes naturally with `b.hal`, `b.linkHeader`, and `b.openapi` link objects. A malformed template throws `UriTemplateError`."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/test/layer-0-primitives/base32.test.js

@@ -0,0 +1,79 @@
+"use strict";
+/**
+ * Layer 0 — b.base32 (RFC 4648).
+ * Oracle: the RFC 4648 §10 test vectors for both the standard Base32
+ * alphabet and the extended-hex alphabet.
+ */
+
+var b = require("../../index");
+var helpers = require("../helpers");
+var check = helpers.check;
+function code(fn) { try { fn(); return "NO-THROW"; } catch (e) { return e.code; } }
+
+// RFC 4648 §10 — standard Base32.
+var STD = [["", ""], ["f", "MY======"], ["fo", "MZXQ===="], ["foo", "MZXW6==="],
+  ["foob", "MZXW6YQ="], ["fooba", "MZXW6YTB"], ["foobar", "MZXW6YTBOI======"]];
+// RFC 4648 §10 — Base32 extended hex.
+var HEX = [["", ""], ["f", "CO======"], ["fo", "CPNG===="], ["foo", "CPNMU==="],
+  ["foob", "CPNMUOG="], ["fooba", "CPNMUOJ1"], ["foobar", "CPNMUOJ1E8======"]];
+
+function testSurface() {
+  check("b.base32.encode is a function", typeof b.base32.encode === "function");
+  check("b.base32.decode is a function", typeof b.base32.decode === "function");
+  check("b.base32.Base32Error is a class", typeof b.base32.Base32Error === "function");
+}
+
+function testVectors() {
+  var ep = 0, dp = 0;
+  STD.forEach(function (t) {
+    if (b.base32.encode(Buffer.from(t[0])) === t[1]) ep++; else check("std encode " + JSON.stringify(t[0]), false);
+    if (b.base32.decode(t[1]).toString() === t[0]) dp++; else check("std decode " + t[1], false);
+  });
+  check("RFC 4648 standard: all encode vectors", ep === STD.length);
+  check("RFC 4648 standard: all decode vectors", dp === STD.length);
+  var hep = 0, hdp = 0;
+  HEX.forEach(function (t) {
+    if (b.base32.encode(Buffer.from(t[0]), { variant: "rfc4648-hex" }) === t[1]) hep++; else check("hex encode " + JSON.stringify(t[0]), false);
+    if (b.base32.decode(t[1], { variant: "rfc4648-hex" }).toString() === t[0]) hdp++; else check("hex decode " + t[1], false);
+  });
+  check("RFC 4648 hex: all encode vectors", hep === HEX.length);
+  check("RFC 4648 hex: all decode vectors", hdp === HEX.length);
+}
+
+function testOptions() {
+  check("padding:false omits =", b.base32.encode(Buffer.from("f"), { padding: false }) === "MY");
+  check("round-trip random 20 bytes", (function () {
+    var buf = require("crypto").randomBytes(20);
+    return b.base32.decode(b.base32.encode(buf)).equals(buf);
+  })());
+  // loose decode: lower-case, spaces, dashes, missing padding.
+  check("loose decodes lower-case + separators", b.base32.decode("mzxw 6ytb-oi", { loose: true }).toString() === "foobar");
+  check("strict rejects lower-case", code(function () { b.base32.decode("mzxw6ytb"); }) === "base32/bad-char");
+  check("strict rejects bad char", code(function () { b.base32.decode("MZXW60TB"); }) === "base32/bad-char");
+  check("bad variant throws", code(function () { b.base32.encode(Buffer.from("x"), { variant: "nope" }); }) === "base32/bad-variant");
+  check("non-buffer encode throws", code(function () { b.base32.encode("not a buffer"); }) === "base32/bad-input");
+  check("non-string decode throws", code(function () { b.base32.decode(123); }) === "base32/bad-input");
+  // Embedded / non-trailing padding is malformed and must be rejected
+  // (not silently truncated at the first "=").
+  check("rejects embedded padding then data", code(function () { b.base32.decode("MZXW=6YTB"); }) === "base32/bad-char");
+  check("rejects padding then data (loose)", code(function () { b.base32.decode("mz=xw", { loose: true }); }) === "base32/bad-char");
+  check("accepts valid trailing padding", b.base32.decode("MZXW6YQ=").toString() === "foob");
+}
+
+function testTotpComposition() {
+  // The TOTP secret produced by generateSecret must decode through b.base32.
+  var secret = b.auth.totp.generateSecret();
+  check("totp secret decodes via b.base32 (loose)", b.base32.decode(secret, { loose: true }).length > 0);
+  // The TOTP secret is unpadded standard Base32 → re-encoding the decoded
+  // bytes (unpadded) reproduces the secret exactly.
+  check("totp secret round-trips through b.base32", b.base32.encode(b.base32.decode(secret, { loose: true }), { padding: false }) === secret);
+}
+
+async function run() {
+  testSurface();
+  testVectors();
+  testOptions();
+  testTotpComposition();
+}
+module.exports = { run: run };
+if (require.main === module) { run().then(function () { console.log("[base32] OK — " + helpers.getChecks() + " checks passed"); }, function (e) { console.error("FAIL:", e && e.stack || e); process.exit(1); }); }

package/lib/vendor/blamejs/test/layer-0-primitives/json-schema.test.js

@@ -0,0 +1,134 @@
+"use strict";
+/**
+ * Layer 0 — b.jsonSchema (JSON Schema 2020-12).
+ * Oracle: the official json-schema-org/JSON-Schema-Test-Suite draft2020-12
+ * (1292 of 1295 cases pass during development; the 3 skipped require the
+ * bundled dialect metaschema or $vocabulary selection — both opt-in). This
+ * file embeds a representative slice across the vocabulary plus the surface
+ * + reference-resolution + annotation cases that exercise the tricky paths.
+ */
+
+var b = require("../../index");
+var helpers = require("../helpers");
+var check = helpers.check;
+function code(fn) { try { fn(); return "NO-THROW"; } catch (e) { return e.code; } }
+
+function testSurface() {
+  check("b.jsonSchema.validate is a function", typeof b.jsonSchema.validate === "function");
+  check("b.jsonSchema.compile is a function", typeof b.jsonSchema.compile === "function");
+  check("b.jsonSchema.isValid is a function", typeof b.jsonSchema.isValid === "function");
+  check("b.jsonSchema.DIALECT is 2020-12", b.jsonSchema.DIALECT === "https://json-schema.org/draft/2020-12/schema");
+  check("b.jsonSchema.JsonSchemaError is a class", typeof b.jsonSchema.JsonSchemaError === "function");
+  check("compile rejects non-schema", code(function () { b.jsonSchema.compile(42); }) === "json-schema/bad-schema");
+  var v = b.jsonSchema.compile({ type: "integer" });
+  check("compiled validator has validate + isValid", typeof v.validate === "function" && typeof v.isValid === "function");
+}
+
+function testAssertions() {
+  check("type integer accepts int", b.jsonSchema.isValid({ type: "integer" }, 3));
+  check("type integer rejects float", !b.jsonSchema.isValid({ type: "integer" }, 3.5));
+  check("type rejects wrong type", !b.jsonSchema.isValid({ type: "string" }, 1));
+  check("enum", b.jsonSchema.isValid({ enum: ["a", "b"] }, "b") && !b.jsonSchema.isValid({ enum: ["a"] }, "z"));
+  check("const deep-equal", b.jsonSchema.isValid({ const: { a: [1, 2] } }, { a: [1, 2] }) && !b.jsonSchema.isValid({ const: { a: [1] } }, { a: [2] }));
+  check("multipleOf", b.jsonSchema.isValid({ multipleOf: 3 }, 9) && !b.jsonSchema.isValid({ multipleOf: 3 }, 10));
+  check("maximum/exclusiveMaximum", b.jsonSchema.isValid({ maximum: 5 }, 5) && !b.jsonSchema.isValid({ exclusiveMaximum: 5 }, 5));
+  check("minLength counts code points", !b.jsonSchema.isValid({ minLength: 2 }, "😀") && b.jsonSchema.isValid({ maxLength: 1 }, "😀"));
+  check("pattern", b.jsonSchema.isValid({ pattern: "^a+$" }, "aaa") && !b.jsonSchema.isValid({ pattern: "^a+$" }, "b"));
+}
+
+function testArrays() {
+  check("prefixItems + items", b.jsonSchema.isValid({ prefixItems: [{ type: "number" }], items: { type: "string" } }, [1, "a", "b"]));
+  check("items rejects bad tail", !b.jsonSchema.isValid({ prefixItems: [{ type: "number" }], items: { type: "string" } }, [1, 2]));
+  check("uniqueItems", b.jsonSchema.isValid({ uniqueItems: true }, [1, 2, 3]) && !b.jsonSchema.isValid({ uniqueItems: true }, [1, 1]));
+  check("contains + minContains", b.jsonSchema.isValid({ contains: { const: 2 }, minContains: 2 }, [2, 2, 3]) && !b.jsonSchema.isValid({ contains: { const: 2 }, minContains: 2 }, [2, 3]));
+  check("maxItems/minItems", !b.jsonSchema.isValid({ maxItems: 1 }, [1, 2]) && !b.jsonSchema.isValid({ minItems: 2 }, [1]));
+}
+
+function testObjects() {
+  var s = { type: "object", properties: { n: { type: "integer" } }, required: ["n"], additionalProperties: false };
+  check("properties + required pass", b.jsonSchema.isValid(s, { n: 1 }));
+  check("required missing fails", !b.jsonSchema.isValid(s, {}));
+  check("additionalProperties:false rejects extra", !b.jsonSchema.isValid(s, { n: 1, x: 2 }));
+  check("patternProperties", b.jsonSchema.isValid({ patternProperties: { "^x": { type: "number" } } }, { x1: 1 }) && !b.jsonSchema.isValid({ patternProperties: { "^x": { type: "number" } } }, { x1: "a" }));
+  check("propertyNames", !b.jsonSchema.isValid({ propertyNames: { pattern: "^a" } }, { b: 1 }));
+  check("dependentRequired", !b.jsonSchema.isValid({ dependentRequired: { a: ["b"] } }, { a: 1 }));
+  check("dependentSchemas", !b.jsonSchema.isValid({ dependentSchemas: { a: { required: ["b"] } } }, { a: 1 }));
+}
+
+function testApplicators() {
+  check("allOf", b.jsonSchema.isValid({ allOf: [{ type: "number" }, { minimum: 0 }] }, 5) && !b.jsonSchema.isValid({ allOf: [{ type: "number" }, { minimum: 0 }] }, -1));
+  check("anyOf", b.jsonSchema.isValid({ anyOf: [{ type: "string" }, { type: "number" }] }, 1) && !b.jsonSchema.isValid({ anyOf: [{ type: "string" }] }, 1));
+  check("oneOf exactly one", b.jsonSchema.isValid({ oneOf: [{ multipleOf: 2 }, { multipleOf: 3 }] }, 4) && !b.jsonSchema.isValid({ oneOf: [{ multipleOf: 2 }, { multipleOf: 3 }] }, 6));
+  check("not", b.jsonSchema.isValid({ not: { type: "string" } }, 1) && !b.jsonSchema.isValid({ not: { type: "string" } }, "x"));
+  check("if/then/else", b.jsonSchema.isValid({ if: { type: "number" }, then: { minimum: 0 }, else: { type: "string" } }, 5) && b.jsonSchema.isValid({ if: { type: "number" }, then: { minimum: 0 }, else: { type: "string" } }, "x") && !b.jsonSchema.isValid({ if: { type: "number" }, then: { minimum: 0 } }, -1));
+  check("boolean schema true/false", b.jsonSchema.isValid(true, 42) && !b.jsonSchema.isValid(false, 42));
+}
+
+function testUnevaluated() {
+  // unevaluatedProperties sees annotations from $ref inside allOf.
+  var s = {
+    $defs: { one: { properties: { a: true } } },
+    allOf: [{ $ref: "#/$defs/one" }, { properties: { b: true } }],
+    unevaluatedProperties: false,
+  };
+  check("unevaluatedProperties + ref-in-allOf accepts evaluated", b.jsonSchema.isValid(s, { a: 1, b: 2 }));
+  check("unevaluatedProperties + ref-in-allOf rejects unevaluated", !b.jsonSchema.isValid(s, { a: 1, c: 3 }));
+  check("unevaluatedItems", b.jsonSchema.isValid({ prefixItems: [{ type: "number" }], unevaluatedItems: false }, [1]) && !b.jsonSchema.isValid({ prefixItems: [{ type: "number" }], unevaluatedItems: false }, [1, 2]));
+}
+
+function testRefs() {
+  // $ref to $defs + $anchor.
+  check("$ref to $defs", b.jsonSchema.isValid({ $defs: { pos: { minimum: 0 } }, $ref: "#/$defs/pos" }, 5));
+  check("$anchor ref", b.jsonSchema.isValid({ $defs: { p: { $anchor: "pos", minimum: 0 } }, $ref: "#pos" }, 5));
+  // External schema via opts.schemas (no network).
+  var ext = { "https://example.com/int": { type: "integer" } };
+  check("external $ref via opts.schemas", b.jsonSchema.isValid({ $ref: "https://example.com/int" }, 3, { schemas: ext }));
+  check("external $ref rejects", !b.jsonSchema.isValid({ $ref: "https://example.com/int" }, "x", { schemas: ext }));
+  // $dynamicRef / $dynamicAnchor (the recursive bookend pattern).
+  var dyn = {
+    $id: "https://example.com/tree",
+    $dynamicAnchor: "node",
+    type: "object",
+    properties: { data: true, children: { type: "array", items: { $dynamicRef: "#node" } } },
+  };
+  check("$dynamicRef recursion validates", b.jsonSchema.isValid(dyn, { data: 1, children: [{ data: 2, children: [] }] }));
+}
+
+function testErrorsShape() {
+  var r = b.jsonSchema.validate({ type: "object", properties: { n: { type: "integer" } } }, { n: "bad" });
+  check("validate returns {valid, errors}", r.valid === false && Array.isArray(r.errors) && r.errors.length >= 1);
+  check("error names instancePath + keyword", r.errors[0].instancePath === "/n" && r.errors[0].keyword === "type");
+}
+
+function testFormat() {
+  // format is an annotation by default (does not assert).
+  check("format annotation by default", b.jsonSchema.isValid({ type: "string", format: "email" }, "not-an-email"));
+  // assertFormat:true turns it into an assertion.
+  check("assertFormat rejects bad email", !b.jsonSchema.isValid({ type: "string", format: "email" }, "nope", { assertFormat: true }));
+  check("assertFormat accepts good date-time", b.jsonSchema.isValid({ type: "string", format: "date-time" }, "2020-01-01T00:00:00Z", { assertFormat: true }));
+  // time requires an offset and valid ranges (RFC 3339 full-time).
+  check("time rejects missing offset", !b.jsonSchema.isValid({ format: "time" }, "12:00:00", { assertFormat: true }));
+  check("time rejects out-of-range", !b.jsonSchema.isValid({ format: "time" }, "25:61:61Z", { assertFormat: true }));
+  check("time accepts offset form", b.jsonSchema.isValid({ format: "time" }, "12:00:00+05:30", { assertFormat: true }));
+  // date enforces real field ranges.
+  check("date rejects month 13", !b.jsonSchema.isValid({ format: "date" }, "2020-13-01", { assertFormat: true }));
+  check("date accepts valid", b.jsonSchema.isValid({ format: "date" }, "2020-02-29", { assertFormat: true }));
+  // uri rejects raw spaces and relative refs.
+  check("uri rejects raw space", !b.jsonSchema.isValid({ format: "uri" }, "http://e xample.com", { assertFormat: true }));
+  check("uri rejects relative", !b.jsonSchema.isValid({ format: "uri" }, "/relative/path", { assertFormat: true }));
+  check("uri accepts absolute", b.jsonSchema.isValid({ format: "uri" }, "https://example.com/x", { assertFormat: true }));
+}
+
+async function run() {
+  testSurface();
+  testAssertions();
+  testArrays();
+  testObjects();
+  testApplicators();
+  testUnevaluated();
+  testRefs();
+  testErrorsShape();
+  testFormat();
+}
+module.exports = { run: run };
+if (require.main === module) { run().then(function () { console.log("[json-schema] OK — " + helpers.getChecks() + " checks passed"); }, function (e) { console.error("FAIL:", e && e.stack || e); process.exit(1); }); }