@blamejs/blamejs-shop 0.1.36 → 0.1.38

package/lib/vendor/blamejs/test/layer-0-primitives/archive-read.test.js

@@ -223,8 +223,58 @@ async function testBundleAdapterStorageRoundTrip() {
   }
 }
 
+// In-memory extraction (serverless / read-only FS): reader.extractEntries()
+// yields decompressed bytes without ever writing to disk, and those bytes are
+// byte-identical to what disk extract() produces.
+async function testExtractEntriesInMemory() {
+  var z = b.archive.zip();
+  z.addFile("readme.txt", "Hello, in-memory!\n");
+  z.addFile("data/nums.csv", "n,sq\n2,4\n");
+  z.addFile("docs/deep.bin", Buffer.from([0, 1, 2, 3, 255]));
+  var bytes = z.toBuffer();
+
+  // Spy: no fs write may happen during the in-memory path.
+  var wrote = false;
+  var origWrite = fs.writeFileSync;
+  fs.writeFileSync = function () { wrote = true; return origWrite.apply(fs, arguments); };
+  var collected = {};
+  try {
+    var reader = b.archive.read.zip(b.archive.adapters.buffer(bytes));
+    for await (var e of reader.extractEntries()) { collected[e.name] = e.bytes; }
+  } finally {
+    fs.writeFileSync = origWrite;
+  }
+  check("zip extractEntries: no disk write", wrote === false);
+  check("zip extractEntries: 3 file entries (dir skipped)", Object.keys(collected).length === 3);
+  check("zip extractEntries: text bytes match", collected["readme.txt"].toString("utf8") === "Hello, in-memory!\n");
+  check("zip extractEntries: binary bytes match", collected["docs/deep.bin"].equals(Buffer.from([0, 1, 2, 3, 255])));
+
+  // Byte-equality with disk extract().
+  var dest = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-archive-mem-"));
+  try {
+    await b.safeArchive.extract({ source: bytes, destination: dest, guardProfile: "balanced" });
+    var diskBin = fs.readFileSync(path.join(dest, "docs/deep.bin"));
+    check("zip extractEntries bytes == disk extract bytes", collected["docs/deep.bin"].equals(diskBin));
+  } finally {
+    fs.rmSync(dest, { recursive: true, force: true });
+  }
+
+  // tar in-memory.
+  var t = b.archive.tar();
+  t.addFile("x.txt", "world\n");
+  t.addFile("sub/y.dat", Buffer.from([9, 8, 7]));
+  var tbytes = t.toBuffer();
+  var tcollected = {};
+  var tr = b.archive.read.tar(b.archive.adapters.buffer(tbytes));
+  for await (var te of tr.extractEntries()) { tcollected[te.name] = te.bytes; }
+  check("tar extractEntries: 2 entries", Object.keys(tcollected).length === 2);
+  check("tar extractEntries: text matches", tcollected["x.txt"].toString("utf8") === "world\n");
+  check("tar extractEntries: binary matches", tcollected["sub/y.dat"].equals(Buffer.from([9, 8, 7])));
+}
+
 async function run() {
   await testRoundTripExtract();
+  await testExtractEntriesInMemory();
   testSafeArchiveErrorClass();
   await testSafeArchiveInspect();
   await testZipBombPolicy();

package/lib/vendor/blamejs/test/layer-0-primitives/codebase-patterns.test.js

@@ -510,6 +510,80 @@ function testNoUnresolvedMarkers() {
     matches);
 }
 
+// ---- Pattern: overdue defers (promised landing version already shipped) ----
+//
+// A comment/string that promises a feature "lands in vX" / "deferred to vX" /
+// "not supported in vX" is fine while vX is in the future. Once the package
+// version reaches vX, that promise is OVERDUE: either the feature shipped (and
+// the comment is stale and should be corrected) or it never shipped (a real
+// gap to close or an explicit defer-with-condition to record here). This gate
+// surfaces the iabTcf-class "advertised-but-missing / stale-landing" shape on
+// every release rather than letting promised-landing comments rot silently.
+//
+// STALE_DEFER_ALLOWLIST entries are acknowledged overdue mentions: each is
+// either a deliberate defer-with-condition (no operator demand + escape hatch)
+// or an item on the gap backlog being worked down. The key is the file; the
+// value is a list of distinctive content substrings to permit. Remove an entry
+// when the comment is corrected or the gap is closed — that is the backlog.
+var STALE_DEFER_ALLOWLIST = {
+  // Deliberate defer-with-condition: needs an envelope-semantics decision
+  // (per-tenant KEM keypair vs symmetric); explicit escape hatch is passing
+  // { publicKey, ecPublicKey } directly. Tracked for design, not overdue work.
+  "lib/archive-wrap.js": [
+    // quote-free phrases (source has escaped \" so avoid quote chars here)
+    "deferred to v0.12.11",
+    "lands in v0.12.11",
+  ],
+  // Deliberate: Sieve extension refused per RFC 5228 §3.2 — script-declared
+  // capability gating, defer-with-condition (operator demand).
+  "lib/safe-sieve.js": ["not implemented in v0.9.55 — script refused"],
+  // Conditional on a future vendoring decision (no bundled EXIF/IPTC reader);
+  // operator-feeds-metadata escape hatch. Defer-with-condition.
+  "lib/ai-content-detect.js": ["IPTC PhotoMetadata reader lands in v0.10.9"],
+  // GAP BACKLOG (being worked down — these are real overdue items):
+  //   archive-read ZIP64 read + fromTrustedStream (promised v0.12.8) — building.
+  "lib/archive-read.js": [
+    "not supported in v0.12.7. Will land",
+    "switch to tar — lands v0.12.8",
+    "carries ZIP64 sentinel sizes (not supported in v0.12.7)",
+    "deferred to v0.12.8 alongside the tar reader",
+    "fromTrustedStream.inspect() is deferred to v0.12.8",
+    "fromTrustedStream.entries() is deferred to v0.12.8",
+    "fromTrustedStream.extract() is deferred to v0.12.8",
+  ],
+  "lib/safe-archive.js": [
+    "tar lands v0.12.8, gz v0.12.9",
+    "fromTrustedStream` is deferred to v0.12.8",
+  ],
+  // STALE comments (feature shipped; phrased as future) — correcting to past
+  // tense as the backlog is worked; allowlisted until then.
+  "lib/break-glass.js": ["passkey lands in v0.5.2"],
+};
+
+function testNoStaleDefers() {
+  var path = require("node:path");
+  var pkgVersion = require(path.resolve(__dirname, "..", "..", "package.json")).version.split(".").map(Number);
+  function cmp(a, b) { for (var i = 0; i < 3; i += 1) { if ((a[i] || 0) !== (b[i] || 0)) return (a[i] || 0) - (b[i] || 0); } return 0; }
+  // Promised-landing phrasings only ("X lands in vN" / "deferred to vN" / "not
+  // supported in vN"). NOT "deferred FROM vN" (that is an origin, not a deadline).
+  var PROMISE = /(?:deferred to|lands(?: in)?|will land(?: in)?|not supported in)\s+v?(\d+\.\d+\.\d+)/i;
+  var matches = _scan(PROMISE, { skipComments: false });
+  var overdue = [];
+  matches.forEach(function (m) {
+    var mm = m.content.match(PROMISE);
+    if (!mm) return;
+    // Only a STRICTLY-FUTURE promise is exempt. A promise for the current
+    // version is due in the release being cut now — if the feature isn't here,
+    // the comment is overdue and must be fixed in this release, not a later one.
+    if (cmp(mm[1].split(".").map(Number), pkgVersion) > 0) return;
+    var allow = STALE_DEFER_ALLOWLIST[m.file] || [];
+    if (allow.some(function (sub) { return m.content.indexOf(sub) !== -1; })) return;
+    overdue.push({ file: m.file, line: m.line, content: "overdue defer (promised v" + mm[1] + ", now v" + pkgVersion.join(".") + "): " + m.content.slice(0, 100) });
+  });
+  _report("no overdue defers in lib/ (promised-landing version already shipped — close the gap, fix the stale comment, or record it in STALE_DEFER_ALLOWLIST)",
+    overdue);
+}
+
 // ---- Pattern: literal NUL bytes (0x00) in source files ----
 //
 // The Edit / Write tooling decodes JSON `\u0000` escape sequences into
@@ -2195,6 +2269,20 @@ async function testNoDuplicateCodeBlocks() {
       ],
       reason: "v0.12.7 + v0.12.8 — Per-module `_emitAudit(opts, action, outcome, metadata)` shape repeats across primitives that drop-silently emit to opts.audit.safeEmit if present. Each module's audit events carry a primitive-specific `action:` namespace (archive.read.*, archive.zip.*, archive.read.tar.*, http-client.*) + per-primitive metadata fields; consolidating would lose the namespace + force every consumer to import the same audit helper. Four-file repetition is the expected shape per `feedback_audit_safeEmit_per_module_emitAudit_shape`. archive-tar.js (write) does NOT carry _emitAudit — the read side lives in sibling archive-tar-read.js so the @primitive validator can pair both `b.archive.tar` (write) and `b.archive.read.tar` (read) cleanly.",
     },
+    {
+      mode:  "family-subset",
+      files: [
+        "lib/archive-read.js:_assertGuardMetadata",
+        "lib/archive-tar-read.js:_assertGuardMetadata",
+        "lib/auth/ciba.js:_registerInitialInterval",
+        "lib/auth/oauth.js:exchangeToken",
+        "lib/auth/oauth.js:pollDeviceCode",
+        "lib/auth/oid4vci.js:createCredentialOffer",
+        "lib/auth/oid4vci.js:exchangePreAuthorizedCode",
+        "lib/restore-rollback.js:swap",
+      ],
+      reason: "v0.13.8 — the shared shingle is the framework's emit-audit-then-throw-typed-error idiom (validate/poll/guard → emit a namespaced audit row → throw a primitive-specific FrameworkError), not behaviour. archive-read/archive-tar-read `_assertGuardMetadata` run the b.guardArchive metadata cascade and throw ArchiveReadError/TarError (factored so disk `extract` + in-memory `extractEntries` share one refusal path); ciba/oauth/oid4vci are OAuth/OIDC device-code + credential-offer polling/exchange; restore-rollback.swap is the backup restore swap. Each body is domain-divergent (different inputs, error classes, audit namespaces); consolidating would couple unrelated subsystems to one helper.",
+    },
     {
       mode:  "family-subset",
       files: [
@@ -10012,6 +10100,7 @@ async function run() {
   testHttp2TeardownPaired();
   testNoStrayConsoleCalls();
   testNoUnresolvedMarkers();
+  testNoStaleDefers();
   testNoLiteralNulBytesInSource();
   testParserPrimitivesHaveFuzzHarness();
   testSafeGuardWiredInIndex();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/blamejs-shop",
-  "version": "0.1.36",
+  "version": "0.1.38",
   "description": "Open-source framework built on blamejs. Vendored stack, zero npm runtime deps, PQC-first crypto, security-on by default.",
   "main": "lib/index.js",
   "scripts": {