@blamejs/blamejs-shop 0.1.37 → 0.2.0

package/lib/vendor/blamejs/test/layer-0-primitives/codebase-patterns.test.js

@@ -510,6 +510,82 @@ function testNoUnresolvedMarkers() {
     matches);
 }
 
+// ---- Pattern: overdue defers (promised landing version already shipped) ----
+//
+// A comment/string that promises a feature "lands in vX" / "deferred to vX" /
+// "not supported in vX" is fine while vX is in the future. Once the package
+// version reaches vX, that promise is OVERDUE: either the feature shipped (and
+// the comment is stale and should be corrected) or it never shipped (a real
+// gap to close or an explicit defer-with-condition to record here). This gate
+// surfaces the iabTcf-class "advertised-but-missing / stale-landing" shape on
+// every release rather than letting promised-landing comments rot silently.
+//
+// STALE_DEFER_ALLOWLIST entries are acknowledged overdue mentions: each is
+// either a deliberate defer-with-condition (no operator demand + escape hatch)
+// or an item on the gap backlog being worked down. The key is the file; the
+// value is a list of distinctive content substrings to permit. Remove an entry
+// when the comment is corrected or the gap is closed — that is the backlog.
+var STALE_DEFER_ALLOWLIST = {
+  // Deliberate defer-with-condition: needs an envelope-semantics decision
+  // (per-tenant KEM keypair vs symmetric); explicit escape hatch is passing
+  // { publicKey, ecPublicKey } directly. Tracked for design, not overdue work.
+  "lib/archive-wrap.js": [
+    // quote-free phrases (source has escaped \" so avoid quote chars here)
+    "deferred to v0.12.11",
+    "lands in v0.12.11",
+  ],
+  // Deliberate: Sieve extension refused per RFC 5228 §3.2 — script-declared
+  // capability gating, defer-with-condition (operator demand).
+  "lib/safe-sieve.js": ["not implemented in v0.9.55 — script refused"],
+  // Conditional on a future vendoring decision (no bundled EXIF/IPTC reader);
+  // operator-feeds-metadata escape hatch. Defer-with-condition.
+  "lib/ai-content-detect.js": ["IPTC PhotoMetadata reader lands in v0.10.9"],
+  // GAP BACKLOG (being worked down — these are real overdue items):
+  //   archive-read ZIP64 read + fromTrustedStream (promised v0.12.8) — building.
+  "lib/archive-read.js": [
+    "not supported in v0.12.7. Will land",
+    "switch to tar — lands v0.12.8",
+    "carries ZIP64 sentinel sizes (not supported in v0.12.7)",
+    "deferred to v0.12.8 alongside the tar reader",
+    "fromTrustedStream.inspect() is deferred to v0.12.8",
+    "fromTrustedStream.entries() is deferred to v0.12.8",
+    "fromTrustedStream.extract() is deferred to v0.12.8",
+  ],
+  "lib/safe-archive.js": [
+    "tar lands v0.12.8, gz v0.12.9",
+    "fromTrustedStream` is deferred to v0.12.8",
+  ],
+  // STALE comments (feature shipped; phrased as future) — correcting to past
+  // tense as the backlog is worked; allowlisted until then.
+  "lib/break-glass.js": ["passkey lands in v0.5.2"],
+};
+
+function testNoStaleDefers() {
+  var path = require("node:path");
+  var pkgVersion = require(path.resolve(__dirname, "..", "..", "package.json")).version.split(".").map(Number);
+  function cmp(a, b) { for (var i = 0; i < 3; i += 1) { if ((a[i] || 0) !== (b[i] || 0)) return (a[i] || 0) - (b[i] || 0); } return 0; }
+  // Promised-landing phrasings only ("X lands in vN" / "deferred to vN" / "not
+  // supported in vN"). NOT "deferred FROM vN" (that is an origin, not a deadline).
+  // Accept 2-part (vN.N) AND 3-part (vN.N.N) promised-landing versions —
+  // a 2-part "v0.10" promise slipped past the old 3-part-only pattern.
+  var PROMISE = /(?:deferred to|lands(?: in)?|will land(?: in)?|not supported in)\s+v?(\d+\.\d+(?:\.\d+)?)/i;
+  var matches = _scan(PROMISE, { skipComments: false });
+  var overdue = [];
+  matches.forEach(function (m) {
+    var mm = m.content.match(PROMISE);
+    if (!mm) return;
+    // Only a STRICTLY-FUTURE promise is exempt. A promise for the current
+    // version is due in the release being cut now — if the feature isn't here,
+    // the comment is overdue and must be fixed in this release, not a later one.
+    if (cmp(mm[1].split(".").map(Number), pkgVersion) > 0) return;
+    var allow = STALE_DEFER_ALLOWLIST[m.file] || [];
+    if (allow.some(function (sub) { return m.content.indexOf(sub) !== -1; })) return;
+    overdue.push({ file: m.file, line: m.line, content: "overdue defer (promised v" + mm[1] + ", now v" + pkgVersion.join(".") + "): " + m.content.slice(0, 100) });
+  });
+  _report("no overdue defers in lib/ (promised-landing version already shipped — close the gap, fix the stale comment, or record it in STALE_DEFER_ALLOWLIST)",
+    overdue);
+}
+
 // ---- Pattern: literal NUL bytes (0x00) in source files ----
 //
 // The Edit / Write tooling decodes JSON `\u0000` escape sequences into
@@ -2195,6 +2271,20 @@ async function testNoDuplicateCodeBlocks() {
       ],
       reason: "v0.12.7 + v0.12.8 — Per-module `_emitAudit(opts, action, outcome, metadata)` shape repeats across primitives that drop-silently emit to opts.audit.safeEmit if present. Each module's audit events carry a primitive-specific `action:` namespace (archive.read.*, archive.zip.*, archive.read.tar.*, http-client.*) + per-primitive metadata fields; consolidating would lose the namespace + force every consumer to import the same audit helper. Four-file repetition is the expected shape per `feedback_audit_safeEmit_per_module_emitAudit_shape`. archive-tar.js (write) does NOT carry _emitAudit — the read side lives in sibling archive-tar-read.js so the @primitive validator can pair both `b.archive.tar` (write) and `b.archive.read.tar` (read) cleanly.",
     },
+    {
+      mode:  "family-subset",
+      files: [
+        "lib/archive-read.js:_assertGuardMetadata",
+        "lib/archive-tar-read.js:_assertGuardMetadata",
+        "lib/auth/ciba.js:_registerInitialInterval",
+        "lib/auth/oauth.js:exchangeToken",
+        "lib/auth/oauth.js:pollDeviceCode",
+        "lib/auth/oid4vci.js:createCredentialOffer",
+        "lib/auth/oid4vci.js:exchangePreAuthorizedCode",
+        "lib/restore-rollback.js:swap",
+      ],
+      reason: "v0.13.8 — the shared shingle is the framework's emit-audit-then-throw-typed-error idiom (validate/poll/guard → emit a namespaced audit row → throw a primitive-specific FrameworkError), not behaviour. archive-read/archive-tar-read `_assertGuardMetadata` run the b.guardArchive metadata cascade and throw ArchiveReadError/TarError (factored so disk `extract` + in-memory `extractEntries` share one refusal path); ciba/oauth/oid4vci are OAuth/OIDC device-code + credential-offer polling/exchange; restore-rollback.swap is the backup restore swap. Each body is domain-divergent (different inputs, error classes, audit namespaces); consolidating would couple unrelated subsystems to one helper.",
+    },
     {
       mode:  "family-subset",
       files: [
@@ -5700,7 +5790,7 @@ var KNOWN_ANTIPATTERNS = [
   {
     // v0.10.15 — `zlib.gunzipSync` / `zlib.createGunzip` /
     // `zlib.brotliDecompress` without an output-size cap is the
-    // CVE-2025-0725 / CVE-2024-zlib decompression-amplification
+    // CVE-2025-0725 / CWE-409 decompression-amplification
     // class. Attackers craft a kilobyte of compressed input that
     // explodes to gigabytes of output, exhausting memory before the
     // request handler sees the bytes. The defense is either the
@@ -5743,7 +5833,67 @@ var KNOWN_ANTIPATTERNS = [
     requires: /\bmaxOutputLength\b/,
     skipCommentLines: true,
     allowlist: [],
-    reason: "CVE-2025-0725 (libcurl + zlib decompression amplification) + CVE-2024-zlib bomb class. Every gunzip / brotli decompress on operator-supplied bytes MUST bound the output. Use `zlib.gunzipSync(buf, { maxOutputLength: <C.BYTES.* constant> })` so the operator sees the cap at config time; refusal becomes a typed error before the bomb reaches memory.",
+    reason: "CVE-2025-0725 (libcurl + zlib decompression amplification) + CWE-409 (uncontrolled-resource decompression bomb) class. Every gunzip / brotli decompress on operator-supplied bytes MUST bound the output. Use `zlib.gunzipSync(buf, { maxOutputLength: <C.BYTES.* constant> })` so the operator sees the cap at config time; refusal becomes a typed error before the bomb reaches memory.",
+  },
+  {
+    // Citation hygiene — a CVE identifier is always
+    // CVE-<4-digit-year>-<sequence>, where the sequence is purely
+    // numeric (CVE numbering spec). Two malformed shapes ship past
+    // review: a non-numeric sequence (`CVE-2024-zlib` — a library
+    // name dropped in as a placeholder), and a real id with a
+    // hyphen-attached word (`CVE-2024-39687-class` — reads as if
+    // `-class` is part of the id). The first is a fabricated
+    // reference; the second is a parse hazard for any tool that
+    // extracts CVE tokens. The annotation convention is a SPACE
+    // before the descriptor (`CVE-2024-39687 class`), which leaves
+    // the id token well-formed. This detector refuses both shapes:
+    // a letter immediately after the year separator, OR a
+    // hyphen-then-letter after the numeric sequence. It cannot
+    // verify that a well-formed id is real or correctly attributed —
+    // that stays a reviewer responsibility — but it makes the
+    // structurally-invalid class impossible to ship. Real CVE
+    // ranges (`CVE-2023-51764 / -51765`) and id-then-space-descriptor
+    // forms pass unchanged.
+    id: "malformed-cve-identifier",
+    primitive: "cite a real CVE as CVE-<year>-<digits> (all-numeric sequence) then a SPACE before any descriptor — never a non-numeric sequence or a hyphen-attached word",
+    regex: /CVE-[0-9]{4}-(?:[0-9]*[A-Za-z]|[0-9]+-[A-Za-z])/,
+    allowlist: [],
+    reason: "A CVE identifier's sequence number is always numeric and the token ends at the sequence (CVE-<year>-<digits>). A non-numeric sequence (CVE-2024-zlib) is a fabricated placeholder; a hyphen-attached word (CVE-2024-39687-class) makes the id un-parseable. Cite a verifiable CVE followed by a space before any class/descriptor word, or name the weakness class (CWE / RFC).",
+  },
+
+  {
+    // Codex P1 on v0.13.12 PR #234 — the MX listener's command pump was
+    // made async (gates do DNS / store lookups), and the plaintext
+    // socket.on("data") path was routed through a per-connection
+    // serialization chain (`_feedChunk`). But the post-STARTTLS TLSSocket
+    // fed `_ingestBytes` directly from a sync onData callback that ignored
+    // the returned promise — so on the upgraded socket (where the default
+    // strict/balanced profiles actually run the gates) async gate awaits
+    // could overlap later TLS chunks and gate rejections went unhandled
+    // instead of producing the 421 path. The invariant: the async command
+    // pump (`_ingestBytes`) is fed ONLY through `_feedChunk` (the
+    // `return _ingestBytes(...)` form), so every transport — plaintext and
+    // TLS — shares the one serialized chain. A bare `_ingestBytes(` call
+    // anywhere else is a second, un-serialized feed path. The lookbehind
+    // exempts the function definition (`function _ingestBytes`) and the
+    // single legitimate caller (`return _ingestBytes`); `_ingestBytes` is
+    // unique to lib/mail-server-mx.js so this is effectively file-scoped.
+    id: "mx-ingest-bytes-bypasses-feed-pump",
+    primitive: "feed the MX command pump only via _feedChunk (`return _ingestBytes(...)`); never call _ingestBytes directly from a sync callback — it drops the async pump's promise and breaks command serialization + the 421 error path",
+    regex: /(?<!function )(?<!return )\b_ingestBytes\s*\(/,
+    allowlist: [
+      // The submission listener has its OWN _ingestBytes, and it is
+      // SYNCHRONOUS — its only async work (SASL AUTH) is handled via
+      // internal .then() chains inside the command handler, and RFC 4954
+      // §4 forbids clients pipelining commands across AUTH until the
+      // response is received, so a sync pump is spec-acceptable there.
+      // There is no async-promise to drop, so the bare `_ingestBytes(`
+      // call is safe. This invariant guards the MX listener's async pump
+      // specifically; if the submission pump is ever made async, route it
+      // through a _feedChunk equivalent and drop this allowlist entry.
+      "lib/mail-server-submission.js",
+    ],
+    reason: "Codex P1 on PR #234: the async MX command pump must be fed through the single per-connection serialization chain (_feedChunk → `return _ingestBytes`). A bare `_ingestBytes(` call from a sync callback (the original post-STARTTLS onData) ignores the returned promise, letting async HELO/RBL/greylist gate awaits overlap later chunks and turning gate rejections into unhandled rejections instead of the 421 path. Route every transport (plaintext + TLS) through _feedChunk.",
   },
 
   {
@@ -6356,9 +6506,10 @@ var KNOWN_ANTIPATTERNS = [
     reason: "CVE-2026-23552 — JWT iss comparisons against attacker-controlled payload values leak prefix-timing via `!==`. Every JWT verifier in the framework (oauth.verifyIdToken / jwt-external.verifyExternal / oauth.parseFrontchannelLogoutRequest / sd-jwt-vc.verify) routes through jwtExternal._issuerMatches for constant-time comparison. Detection is precise: `payload.iss !== ...` / `claims.iss !== ...` / `token.iss !== ...` is the JWT-verify-side shape. Non-JWT iss checks (e.g. discovery-document self-consistency where iss came from the same TLS-fetched body) are not in scope and don't match the regex.",
   },
   {
-    // CVE-2026-23993 — accepting unknown JOSE alg values via a
-    // `switch (alg) { default: ... }` permissive default-branch is
-    // the canonical shape. Verifiers MUST throw in the default
+    // Alg-allowlist gate (CWE-347 improper-sig-verification /
+    // CWE-757 algorithm-downgrade) — accepting unknown JOSE alg
+    // values via a `switch (alg) { default: ... }` permissive
+    // default-branch is the canonical shape. Verifiers MUST throw in the default
     // branch (no fall-through to a permissive "any signature"
     // path). The detector catches `switch (...alg)` (case-
     // insensitive) where the default branch returns/falls through
@@ -6374,7 +6525,7 @@ var KNOWN_ANTIPATTERNS = [
       // branch, so it doesn't match. Other auth files use
       // explicit if-cascades that throw, also not matched.
     ],
-    reason: "CVE-2026-23993 — JWT verifiers that accept unknown alg values via a permissive switch-default branch are the canonical bypass class. Every alg-dispatch primitive in the framework throws in the default branch (`throw new AuthError('.../unsupported-alg', ...)`) so an unrecognized alg can never reach a signature-verify call. The detector specifically flags `switch (alg)` (or `switch (header.alg)` / `switch (sigAlgo)`) whose default-branch returns / breaks rather than throwing. New alg-dispatch code throws in the default — no exceptions.",
+    reason: "Alg-allowlist gate (CWE-347 / CWE-757) — JWT verifiers that accept unknown alg values via a permissive switch-default branch are the canonical bypass class. Every alg-dispatch primitive in the framework throws in the default branch (`throw new AuthError('.../unsupported-alg', ...)`) so an unrecognized alg can never reach a signature-verify call. The detector specifically flags `switch (alg)` (or `switch (header.alg)` / `switch (sigAlgo)`) whose default-branch returns / breaks rather than throwing. New alg-dispatch code throws in the default — no exceptions.",
   },
   {
     id: "inline-codepoint-class-table",
@@ -7263,6 +7414,36 @@ var KNOWN_ANTIPATTERNS = [
     reason: "Every 'test passes alone, fails under SMOKE_PARALLEL=64' flake (macOS watcher, log-stream-otlp, safe-async-loops, rate-limit-cluster, sandbox flake) is the same root cause: a fixed-budget setTimeout sleep that's too short for runner-contention reality. `helpers.waitUntil(predicate, opts?)` polls the actual condition every 25ms up to a 5000ms cap, exiting early when the predicate returns truthy. Fast platforms finish in milliseconds; contended platforms get the full budget. `helpers.passiveObserve(ms, label)` is the sibling primitive for the rare case of verifying ABSENCE of an event over a window (work simulators, TTL-elapse before assertion). The allowlist's structural FPs are permanent; the migration-backlog files drain to zero in subsequent patches.",
   },
 
+  {
+    // Sibling to test-promise-settimeout-sleep, for the timer the
+    // setTimeout regex misses: a COUNTED DRAIN-LOOP that reassigns a
+    // promise to its own `.then()` over and over to "flush N
+    // microtasks/ticks" before asserting — the `_waitMicrotasks(n)`
+    // helper shape (`var p = Promise.resolve(); for (...) p = p.then(
+    // () => new Promise(r => setImmediate(r)));`). Like the fixed
+    // setTimeout sleep it guesses a budget; under SMOKE_PARALLEL=64
+    // contention the awaited async work (a cluster-backend DB take,
+    // a scheduler tick-claim) hasn't resolved within the tick count,
+    // so the next assertion reads stale state. This was the recurring
+    // rate-limit-cluster "4th blocked with 429" flake and the
+    // scheduler-exactly-once tick-claim race. A single `await new
+    // Promise(r => setImmediate(r))` event-loop yield is legitimate
+    // and is NOT matched — only the self-reassigning `<x> = <x>.then(`
+    // drain idiom paired with a timer is. Poll the observable
+    // condition with helpers.waitUntil instead.
+    id: "test-microtask-drain-loop-sleep",
+    primitive: "helpers.waitUntil(predicate, { timeoutMs, label }) — poll the observable condition; never drain a fixed count of microtasks/ticks by reassigning a promise to its own .then() in a loop",
+    scanScope: "test",
+    regex: /\b(\w+)\s*=\s*\1\.then\([\s\S]{0,80}?set(?:Immediate|Timeout)\s*\(/,
+    skipCommentLines: true,
+    allowlist: [
+      // The catalog itself carries this pattern as a regex literal +
+      // in this entry's own prose/reason describing the antipattern.
+      "test/layer-0-primitives/codebase-patterns.test.js",
+    ],
+    reason: "A for-loop that reassigns a promise to its own `.then(() => new Promise(r => setImmediate(r)))` to drain a fixed number of microtask ticks is the same fixed-budget anti-pattern as a setTimeout sleep, just timed in event-loop turns instead of milliseconds — and it flakes the same way: when the async work under test hasn't resolved within the tick count (cluster DB take, scheduler tick-claim) the following assertion reads stale state. Poll the observable condition with helpers.waitUntil(predicate, { timeoutMs, label }); a lone `await new Promise(r => setImmediate(r))` yield is fine and isn't matched.",
+  },
+
   {
     // v0.10.13 PR #102 macOS hang — stream-throttle.test.js used
     // `setTimeout`-based rate enforcement plus `node:stream.pipeline`
@@ -10012,6 +10193,7 @@ async function run() {
   testHttp2TeardownPaired();
   testNoStrayConsoleCalls();
   testNoUnresolvedMarkers();
+  testNoStaleDefers();
   testNoLiteralNulBytesInSource();
   testParserPrimitivesHaveFuzzHarness();
   testSafeGuardWiredInIndex();

package/lib/vendor/blamejs/test/layer-0-primitives/fal.test.js

@@ -58,6 +58,31 @@ function testFromAssertion() {
         b.auth.fal.fromAssertion({ channel: "back" }) === "FAL1");
 }
 
+function testBearerOnlyAlias() {
+  // bearerOnly:true is the documented alias for hokBinding === null —
+  // it forces the bearer path. With replay + injection-protection on a
+  // back-channel it still classifies as FAL2 (not FAL3), proving no
+  // proof-of-possession binding is applied.
+  check("bearerOnly:true → no HoK (back + replay + bcAuth = FAL2)",
+        b.auth.fal.fromAssertion({
+          channel: "back", replayProtected: true,
+          backChannelAuthenticated: true, bearerOnly: true,
+        }) === "FAL2");
+  // bearerOnly:true with mTLS even + replay must NOT reach FAL3 —
+  // bearerOnly wins is a contradiction, so it's refused (config-time).
+  var threw = null;
+  try {
+    b.auth.fal.fromAssertion({ channel: "back", hokBinding: "mtls",
+      replayProtected: true, bearerOnly: true });
+  } catch (e) { threw = e; }
+  check("bearerOnly:true + hokBinding refused",
+        threw && (threw.code || "").indexOf("auth/bad-fal-opts") !== -1);
+  // bearerOnly:false is a no-op (hokBinding still honored → FAL3).
+  check("bearerOnly:false is inert (mTLS + replay = FAL3)",
+        b.auth.fal.fromAssertion({ channel: "back", hokBinding: "mtls",
+          replayProtected: true, bearerOnly: false }) === "FAL3");
+}
+
 function testFromAssertionRefusesBadShape() {
   function expectCode(label, fn, code) {
     var threw = null;
@@ -105,6 +130,7 @@ function testRequireFal() {
 async function run() {
   testSurface();
   testFromAssertion();
+  testBearerOnlyAlias();
   testFromAssertionRefusesBadShape();
   testMeets();
   testRequireFal();

package/lib/vendor/blamejs/test/layer-0-primitives/mail-crypto-smime.test.js

@@ -12,8 +12,8 @@
  *   - the doc-block contains the required RFC citations + CVE
  *     references + deferral conditions + escape hatch (per the
  *     project's defer-with-condition rule),
- *   - checkCert() refuses SHA-1 / MD5 cert signatures (CVE-2017-9006
- *     class) and < 2048-bit RSA (RFC 8301 §3.1).
+ *   - checkCert() refuses SHA-1 / MD5 cert signatures (SHAttered SHA-1
+ *     collision; RFC 8551 §2.5) and < 2048-bit RSA (RFC 8301 §3.1).
  *
  * Run standalone: `node test/layer-0-primitives/mail-crypto-smime.test.js`
  * Or via smoke:   `node test/smoke.js`
@@ -203,8 +203,8 @@ function testSmimeCheckCertRefusesSha1() {
   try { smime.checkCert({ certPem: certPem }); } catch (e) { threw = e; }
   check("checkCert refuses SHA-1 cert signature",
     threw && threw.code === "mail-crypto/smime/refused-hash");
-  check("checkCert SHA-1 refusal names CVE class",
-    threw && /CVE-2017-9006/.test(threw.message));
+  check("checkCert SHA-1 refusal names the weakness class",
+    threw && /SHAttered|RFC 8551/.test(threw.message));
 }
 
 // ---- checkCert: RSA < 2048 refusal ----
@@ -260,7 +260,7 @@ function testSmimeDocBlockCitations() {
   check("smime doc block names RFC 8550",        src.indexOf("RFC 8550") !== -1);
   check("smime doc block names RFC 8301",        src.indexOf("RFC 8301") !== -1);
   check("smime doc block names CVE-2017-17688",  src.indexOf("CVE-2017-17688") !== -1);
-  check("smime doc block names CVE-2017-9006",   src.indexOf("CVE-2017-9006") !== -1);
+  check("smime doc block names SHAttered SHA-1 class", src.indexOf("SHAttered") !== -1);
   // v0.10.16 — sign/verify went live; deferred-conditions language
   // was replaced with "LIVE on b.cms substrate".
   check("smime doc block names live status",

package/lib/vendor/blamejs/test/layer-0-primitives/mail-dav.test.js

@@ -276,7 +276,7 @@ async function testCaldavPutValidIcal() {
 async function testCaldavPutRefusesInvalidIcal() {
   var dav = mailDav.create({ storage: _makeStorage() });
   var res = _makeRes();
-  // RRULE with COUNT > 10000 — CVE-2024-39687 defense.
+  // RRULE with COUNT > 10000 — calendar-bomb / recursion-DoS defense.
   var bad = "BEGIN:VCALENDAR\r\nVERSION:2.0\r\nPRODID:-//B//\r\n" +
     "BEGIN:VEVENT\r\nUID:b@x\r\nDTSTAMP:20260101T120000Z\r\nDTSTART:20260101T130000Z\r\n" +
     "RRULE:FREQ=DAILY;COUNT=999999\r\nEND:VEVENT\r\nEND:VCALENDAR\r\n";

package/lib/vendor/blamejs/test/layer-0-primitives/mail-server-mx.test.js

@@ -3,7 +3,7 @@
  * b.mail.server.mx — inbound SMTP / MX listener.
  *
  * Tests cover the wire-protocol state machine, SMTP-smuggling defense
- * (CVE-2023-51764 / CVE-2024-32178 — bare-LF dot-terminator), open-
+ * (CVE-2023-51764 / -51765 / -51766 — bare-LF dot-terminator), open-
  * relay refusal by default, STARTTLS-stripping defense, and the
  * helper byte-scan primitives (_detectSmugglingShape /
  * _findDotTerminator / _dotUnstuff).
@@ -263,6 +263,169 @@ async function testStrictProfileRequiresStartTls() {
   }
 }
 
+// Connection-level gates (helo / rbl / greylist) wired into the live
+// state machine. Each gate is an operator-supplied object; we drive the
+// real wire protocol with mock gates and assert the SMTP verdict.
+async function testConnectionGates() {
+  var ctx;
+  try { ctx = await _makeTestTlsContext(); }
+  catch (_e) {
+    check("connection gates (skipped — test cert fixture unavailable)", true);
+    return;
+  }
+
+  async function _connect(srv) {
+    var info = await srv.listen({ port: 0, address: "127.0.0.1" });
+    var socket = nodeNet.connect(info.port, "127.0.0.1");
+    await new Promise(function (r) { socket.once("connect", r); });
+    await _readGreeting(socket);
+    return socket;
+  }
+
+  // ---- greylist defer → 450 tempfail at RCPT ----
+  var greySrv = b.mail.server.mx.create({
+    tlsContext: ctx, profile: "permissive", localDomains: ["example.com"],
+    greylist: { check: async function () { return { action: "defer", reason: "first-seen" }; } },
+  });
+  var grerr = null, greySock;
+  try {
+    greySock = await _connect(greySrv);
+    await _sendCommand(greySock, "EHLO sender.example.com");
+    await _sendCommand(greySock, "MAIL FROM:<s@external.com>");
+    var greyRcpt = await _sendCommand(greySock, "RCPT TO:<alice@example.com>");
+    check("greylist defer → 450 tempfail", /^450 4\.7\.1/.test(greyRcpt));
+    greySock.destroy();
+  } catch (e) { grerr = e; } finally { await greySrv.close({ timeoutMs: 1000 }); }   // allow:raw-time-literal — test-only short drain
+  check("greylist gate ran without error", grerr === null);
+
+  // ---- RBL listed → 554 at RCPT ----
+  var rblSrv = b.mail.server.mx.create({
+    tlsContext: ctx, profile: "permissive", localDomains: ["example.com"],
+    rbl: { query: async function () {
+      return { listed: [{ zone: "zen.spamhaus.org" }], allowed: [], neutral: [], errors: [] };
+    } },
+  });
+  try {
+    var rblSock = await _connect(rblSrv);
+    await _sendCommand(rblSock, "EHLO sender.example.com");
+    await _sendCommand(rblSock, "MAIL FROM:<s@external.com>");
+    var rblRcpt = await _sendCommand(rblSock, "RCPT TO:<alice@example.com>");
+    check("RBL-listed IP → 554 at RCPT", /^554 5\.7\.1/.test(rblRcpt));
+    rblSock.destroy();
+  } finally { await rblSrv.close({ timeoutMs: 1000 }); }                              // allow:raw-time-literal — test-only short drain
+
+  // ---- helo hard-reject → 550 at EHLO ----
+  var heloSrv = b.mail.server.mx.create({
+    tlsContext: ctx, profile: "permissive", localDomains: ["example.com"],
+    helo: { evaluate: async function () { return { action: "reject-shape" }; } },
+  });
+  try {
+    var heloSock = await _connect(heloSrv);
+    // A syntactically-valid domain (passes guardDomain) so the refusal
+    // comes from the helo GATE (reject-shape), not domain hardening.
+    var heloReply = await _sendCommand(heloSock, "EHLO sender.example.com");
+    check("helo hard-reject → 550 at EHLO", /^550 5\.7\.1/.test(heloReply));
+    heloSock.destroy();
+  } finally { await heloSrv.close({ timeoutMs: 1000 }); }                             // allow:raw-time-literal — test-only short drain
+
+  // ---- gates that accept → normal flow (gate ran + passed) ----
+  var passSrv = b.mail.server.mx.create({
+    tlsContext: ctx, profile: "permissive", localDomains: ["example.com"],
+    helo:     { evaluate: async function () { return { action: "accept" }; } },
+    rbl:      { query:    async function () { return { listed: [], allowed: [], neutral: [], errors: [] }; } },
+    greylist: { check:    async function () { return { action: "accept", reason: "known" }; } },
+  });
+  try {
+    var passSock = await _connect(passSrv);
+    await _sendCommand(passSock, "EHLO sender.example.com");
+    await _sendCommand(passSock, "MAIL FROM:<s@external.com>");
+    var passRcpt = await _sendCommand(passSock, "RCPT TO:<alice@example.com>");
+    check("accepting gates → RCPT 250", /^250 /.test(passRcpt));
+    passSock.destroy();
+  } finally { await passSrv.close({ timeoutMs: 1000 }); }                             // allow:raw-time-literal — test-only short drain
+
+  // ---- async-serial pump: pipelined commands (RFC 2920) keep ordering
+  // even though the greylist gate awaits between RCPTs. Send EHLO + MAIL
+  // + RCPT in a single write; the deferred RCPT must still answer 450
+  // and replies must arrive in order. ----
+  var slowCount = 0;
+  var pipeSrv = b.mail.server.mx.create({
+    tlsContext: ctx, profile: "permissive", localDomains: ["example.com"],
+    greylist: { check: async function () {
+      slowCount += 1;
+      await helpers.waitUntil(function () { return true; }, { timeoutMs: 100, label: "gate async yield" });
+      return { action: "defer", reason: "first-seen" };
+    } },
+  });
+  try {
+    var pipeInfo = await pipeSrv.listen({ port: 0, address: "127.0.0.1" });
+    var pipeSock = nodeNet.connect(pipeInfo.port, "127.0.0.1");
+    await new Promise(function (r) { pipeSock.once("connect", r); });
+    await _readGreeting(pipeSock);
+    // Pipeline EHLO + MAIL + RCPT in one TCP write.
+    var combined = await new Promise(function (resolve, reject) {
+      var buf = "";
+      function onData(chunk) {
+        buf += chunk.toString("utf8");
+        if (/^450 /m.test(buf)) { pipeSock.removeListener("data", onData); resolve(buf); }
+      }
+      pipeSock.on("data", onData);
+      pipeSock.once("error", reject);
+      pipeSock.write("EHLO sender.example.com\r\nMAIL FROM:<s@external.com>\r\nRCPT TO:<alice@example.com>\r\n");
+    });
+    var idx250ehlo = combined.indexOf("250");
+    var idx450 = combined.indexOf("450");
+    check("pipelined commands answered in order (250… before 450)",
+      idx250ehlo !== -1 && idx450 !== -1 && idx250ehlo < idx450);
+    check("greylist gate ran exactly once for the pipelined RCPT", slowCount === 1);
+    pipeSock.destroy();
+  } finally { await pipeSrv.close({ timeoutMs: 1000 }); }                             // allow:raw-time-literal — test-only short drain
+}
+
+// Gates must run + serialize on the POST-STARTTLS path too — the default
+// strict/balanced profiles require STARTTLS before MAIL, so that's where
+// the gates actually fire. Mint a CA so the client can trust the upgraded
+// connection (no rejectUnauthorized bypass), do a real STARTTLS handshake,
+// and assert the greylist gate produces 450 over TLS.
+async function testGateOverStartTls() {
+  var ca, leaf;
+  try {
+    ca = await b.mtlsEngine.generateCa({ name: "mx-starttls-test-ca" });
+    leaf = await b.mtlsEngine.signClientCert({
+      cn: "localhost", caCertPem: ca.caCertPem, caKeyPem: ca.caKeyPem,
+      usage: "server", sans: ["DNS:localhost", "IP:127.0.0.1"], validityDays: 1,
+    });
+  } catch (_e) {
+    check("gate over STARTTLS (skipped — cert fixture unavailable)", true);
+    return;
+  }
+  var ctx = nodeTls.createSecureContext({ key: leaf.key, cert: leaf.cert });
+  var srv = b.mail.server.mx.create({
+    tlsContext: ctx, profile: "strict", localDomains: ["example.com"],
+    greylist: { check: async function () { return { action: "defer", reason: "first-seen" }; } },
+  });
+  var info = await srv.listen({ port: 0, address: "127.0.0.1" });
+  var plain, tlsSock;
+  try {
+    plain = nodeNet.connect(info.port, "127.0.0.1");
+    await new Promise(function (r) { plain.once("connect", r); });
+    await _readGreeting(plain);
+    await _sendCommand(plain, "EHLO sender.example.com");
+    var stReply = await _sendCommand(plain, "STARTTLS");
+    check("STARTTLS → 220 ready", /^220 /.test(stReply));
+    tlsSock = nodeTls.connect({ socket: plain, ca: [ca.caCertPem], servername: "localhost" });
+    await new Promise(function (r, j) {
+      tlsSock.once("secureConnect", r); tlsSock.once("error", j);
+    });
+    await _sendCommand(tlsSock, "EHLO sender.example.com");   // re-issue per RFC 3207 §4.2
+    await _sendCommand(tlsSock, "MAIL FROM:<s@external.com>");
+    var rcpt = await _sendCommand(tlsSock, "RCPT TO:<alice@example.com>");
+    check("greylist gate runs on the post-STARTTLS serialized pump → 450",
+      /^450 4\.7\.1/.test(rcpt));
+    tlsSock.destroy();
+  } finally { await srv.close({ timeoutMs: 1000 }); }                                 // allow:raw-time-literal — test-only short drain
+}
+
 async function run() {
   testSurface();
   testCreateRequiresTlsContext();
@@ -273,6 +436,8 @@ async function run() {
   await testEhloFlow();
   await testRelayRefused();
   await testStrictProfileRequiresStartTls();
+  await testConnectionGates();
+  await testGateOverStartTls();
 }
 
 module.exports = { run: run };

package/lib/vendor/blamejs/test/layer-0-primitives/rate-limit-cluster.test.js

@@ -25,16 +25,23 @@ var teardownTestDb = helpers.teardownTestDb;
 var _mockReq       = helpers._mockReq;
 var _mockRes       = helpers._mockRes;
 
-function _waitMicrotasks(n) {
-  // Default to 20 ticks (was 5). CI runners under SMOKE_PARALLEL=64
-  // contention need many more setImmediate ticks before the rate-limit
-  // middleware's async take() against the cluster-backend DB has
-  // finished bumping the counter — without enough ticks the next
-  // fire() reads a stale count and the 4th-request-blocked assertion
-  // misfires.
-  var p = Promise.resolve();
-  for (var i = 0; i < (n || 20); i++) p = p.then(function () { return new Promise(function (r) { setImmediate(r); }); });
-  return p;
+// Poll until the rate-limit middleware has resolved a request — either
+// next() ran (the okGetter flips true) or a response was captured (a
+// status was set on the mock res). Replaces a fixed setImmediate-tick
+// drain that flaked under SMOKE_PARALLEL=64 contention: the async take()
+// against the cluster-backend DB sometimes hadn't bumped the counter
+// within the tick budget, so the next fire() read a stale count and the
+// "4th-request-blocked" assertion misfired (§11b — poll the observable
+// condition, never guess a tick/time budget).
+function _settle(res, okGetter) {
+  return helpers.waitUntil(function () {
+    // `ended` is the unambiguous "a response was written" signal —
+    // it flips true only when the mock's end() runs. (status starts
+    // null, so a `status != null` check would read true before any
+    // response and defeat the poll.) A passed request sets ok via
+    // next(); a blocked one ends the response.
+    return okGetter() || res._captured().ended === true;
+  }, { timeoutMs: 5000, label: "rate-limit-cluster: request settled (next ran or response ended)" });
 }
 
 async function testClusterBackendBasicLimit() {
@@ -53,7 +60,7 @@ async function testClusterBackendBasicLimit() {
       var res = _mockRes();
       var nextCalled = false;
       mw(req, res, function () { nextCalled = true; });
-      await _waitMicrotasks(20);
+      await _settle(res, function () { return nextCalled; });
       return { passed: nextCalled, status: res._captured().status };
     }
 
@@ -92,7 +99,7 @@ async function testClusterBackendIndependentKeys() {
       var res = _mockRes();
       var ok = false;
       mw(req, res, function () { ok = true; });
-      await _waitMicrotasks(20);
+      await _settle(res, function () { return ok; });
       return ok;
     }
 
@@ -128,7 +135,7 @@ async function testClusterBackendWindowRollover() {
       var res = _mockRes();
       var ok = false;
       mw(req, res, function () { ok = true; });
-      await _waitMicrotasks(20);
+      await _settle(res, function () { return ok; });
       return ok;
     }
 
@@ -170,7 +177,7 @@ async function testClusterBackendAuditEmit() {
       var res = _mockRes();
       var ok = false;
       mw(req, res, function () { ok = true; });
-      await _waitMicrotasks(20);
+      await _settle(res, function () { return ok; });
       return ok;
     }
     await fire();   // pass
@@ -208,7 +215,7 @@ async function testCustomBackendObject() {
     var res = _mockRes();
     var ok = false;
     mw(req, res, function () { ok = true; });
-    await _waitMicrotasks(20);
+    await _settle(res, function () { return ok; });
     return ok;
   }
   check("custom backend: 1st passes",           await fire());
@@ -239,7 +246,7 @@ async function testFailOpenOnBackendError() {
   var res = _mockRes();
   var ok = false;
   mw(req, res, function () { ok = true; });
-  await _waitMicrotasks(20);
+  await _settle(res, function () { return ok; });
   check("backend error → middleware fails open",  ok === true);
 }
 
@@ -259,7 +266,7 @@ async function testMemoryFixedWindowBasicLimit() {
     var res = _mockRes();
     var ok = false;
     mw(req, res, function () { ok = true; });
-    await _waitMicrotasks(20);
+    await _settle(res, function () { return ok; });
     return { passed: ok, status: res._captured().status };
   }
 
@@ -286,7 +293,7 @@ async function testMemoryFixedWindowIndependentKeys() {
     var res = _mockRes();
     var ok = false;
     mw(req, res, function () { ok = true; });
-    await _waitMicrotasks(20);
+    await _settle(res, function () { return ok; });
     return ok;
   }
 

package/lib/vendor/blamejs/test/layer-0-primitives/safe-ical.test.js

@@ -1,7 +1,7 @@
 "use strict";
 /**
  * b.safeIcal — bounded RFC 5545 iCalendar parser. Tests the AST
- * surface, line unfolding, RRULE caps (CVE-2024-39687 defense),
+ * surface, line unfolding, RRULE caps (calendar-bomb defense),
  * control-char refusal, property allowlist, profile / posture
  * cascades.
  */
@@ -131,7 +131,7 @@ function testRefusesOversizeBytes() {
 }
 
 function testRefusesRecursiveRrule() {
-  // CVE-2024-39687: RRULE COUNT > 10000 refused regardless of profile.
+  // Calendar-bomb defense: RRULE COUNT > 10000 refused regardless of profile.
   expectRefused("refuses RRULE COUNT > 10000",
     function () {
       safeIcal.parse(_ical(_event("RRULE:FREQ=DAILY;COUNT=999999\r\n")));