@blamejs/blamejs-shop 0.1.38 → 0.2.1

package/lib/vendor/blamejs/release-notes/v0.13.10.json

@@ -0,0 +1,44 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.13.10",
+  "date": "2026-05-27",
+  "headline": "Documented-but-inert options wired up, a non-existent CVE reference removed, and a silent iCalendar cap-bypass fixed",
+  "summary": "A sweep for places where a documented option or citation did not match what the code does. The most operator-relevant fix: b.calendar.fromIcal documented a safeIcalOpts option that forwards parser caps (byte size, RRULE limits, nesting depth) to b.safeIcal.parse, but the value was never forwarded — so an operator who set tight caps through it got the default profile instead, silently. That is corrected; the nested options now reach the parser. b.archive.read.zip documented an AbortSignal option that was never honored; it now aborts the read at the entry boundary. b.auth.fal documented a bearerOnly alias that had no effect; it now forces the no-proof-of-possession path and refuses the contradictory combination of bearerOnly:true with a holder-of-key binding. Separately, the auth verification paths cited CVE-2026-23993 (13 places) for the \"reject an unknown alg before key lookup\" guard — that CVE id does not exist (the registry has no record of it); the citation is replaced with the weakness class (CWE-347 / CWE-757) and the real, verifiable neighboring CVEs. The circuit-breaker error-code note that promised a rename \"in v0.10\" is corrected to the actual plan (v1.0), and the build gate that catches overdue version promises now also catches two-part version numbers.",
+  "sections": [
+    {
+      "heading": "Fixed",
+      "items": [
+        {
+          "title": "`b.calendar.fromIcal` now forwards `safeIcalOpts` to the parser",
+          "body": "The documented `safeIcalOpts` option (parser caps: max bytes, RRULE COUNT/BYxxx limits, nesting depth) was not being passed to `b.safeIcal.parse` — when supplied under the documented nested key it was silently ignored and the parser ran with its default profile. Both forms now reach the parser: the documented nested `{ safeIcalOpts: { ... } }` and the top-level `{ profile, ... }` that earlier releases accepted, with the nested form winning on conflict. No caller regresses."
+        },
+        {
+          "title": "`b.archive.read.zip` honors the documented `signal` (AbortSignal)",
+          "body": "The `signal` option was documented but never read. A large or slow archive read can now be aborted cooperatively — the reader checks the signal at each entry boundary (`inspect`, `entries`, `extractEntries`, `extract`) and rejects with an `archive-read/aborted` error."
+        },
+        {
+          "title": "Removed a non-existent CVE reference from the JWT/JWE verification paths",
+          "body": "The \"reject an unknown/unsupported `alg` before any key lookup\" guard in `b.auth.jwt.verifyExternal`, `b.auth.oauth.verifyIdToken`, `b.auth.oid4vci`, and `b.auth.sd-jwt-vc` cited a CVE id that the registry has no record of. The behaviour is unchanged; the citation is now the weakness class it defends (CWE-347 improper signature verification / CWE-757 algorithm downgrade) alongside the real, verifiable alg-confusion / JWE-bypass CVEs already cited beside it."
+        }
+      ]
+    },
+    {
+      "heading": "Changed",
+      "items": [
+        {
+          "title": "`b.auth.fal` `bearerOnly` is now a real alias and refuses contradictions",
+          "body": "`bearerOnly: true` now forces the no-proof-of-possession path (equivalent to `hokBinding: null`), as documented. Passing `bearerOnly: true` together with a non-null `hokBinding` is a contradictory assurance request and is now refused at the call rather than silently resolved one way."
+        }
+      ]
+    },
+    {
+      "heading": "Detectors",
+      "items": [
+        {
+          "title": "Overdue-version-promise gate now catches two-part version numbers",
+          "body": "The build gate that flags a deferral whose promised landing version has already shipped previously matched only three-part versions (`vN.N.N`); a two-part promise (`vN.N`) slipped past it. It now matches both. The `b.circuitBreaker` `CIRCUIT_OPEN` error-code note that pointed at a passed version is corrected to its actual plan (rename at v1.0, with a deprecation warning a minor ahead)."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/release-notes/v0.13.11.json

@@ -0,0 +1,27 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.13.11",
+  "date": "2026-05-27",
+  "headline": "Test-suite reliability: replaced fixed-delay waits in the rate-limiter and scheduler suites with condition polling",
+  "summary": "No runtime behaviour changes. The rate-limiter, scheduler, and websocket-channel test suites waited for asynchronous work to settle by draining a fixed number of event-loop ticks before asserting. Under heavily parallel CI that budget was occasionally too short, so an assertion read state before the async work (a cluster-backend counter update, a scheduler tick-claim) had landed — an intermittent failure unrelated to the code under test. Those waits now poll the observable condition (helpers.waitUntil) and exit as soon as it holds, with a generous upper bound, so they pass quickly on fast machines and reliably under load. A build gate is added so the fixed-tick-drain shape cannot be reintroduced.",
+  "sections": [
+    {
+      "heading": "Fixed",
+      "items": [
+        {
+          "title": "Flaky fixed-budget waits in the rate-limiter / scheduler / sandbox test suites made contention-tolerant",
+          "body": "The rate-limit-cluster and scheduler-exactly-once suites drained a fixed count of event-loop ticks before asserting on asynchronously-updated state; under contended CI the budget could expire before the work settled, producing intermittent failures. They now wait on the actual observable condition (a written response, a settled counter). The sandbox suite's success-path cases gave the worker a 5 s execution budget that cold worker-thread startup under heavily parallel Windows CI could just exceed; those are raised to the framework's 10 s ceiling. Affects test code only — no change to shipped framework behaviour. The unused tick-drain helper in the websocket-channel suite was removed."
+        }
+      ]
+    },
+    {
+      "heading": "Detectors",
+      "items": [
+        {
+          "title": "Build gate rejects the fixed-tick-drain wait shape in tests",
+          "body": "A new test-suite lint rule flags the counted microtask/tick-drain idiom (reassigning a promise to its own `.then()` in a loop to wait a fixed number of ticks), the sibling of the existing fixed-`setTimeout`-sleep rule. A single event-loop yield is unaffected; only the drain-as-wait shape is rejected, directing the wait to condition polling instead."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/release-notes/v0.13.12.json

@@ -0,0 +1,36 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.13.12",
+  "date": "2026-05-27",
+  "headline": "Inbound MX listener now runs the connection-level gate cascade it documented — HELO identity, DNS blocklist, and greylisting",
+  "summary": "b.mail.server.mx.create documented helo / rbl / greylist gate options, but the listener never invoked them — an operator who wired them got silent acceptance of mail those gates would have rejected. They are now wired into the live SMTP state machine: the HELO-identity gate evaluates at HELO/EHLO and refuses a spoofed or malformed identity with 550; the DNS-blocklist gate evaluates the connecting IP once per connection and refuses a listed source with 554; the greylisting gate defers a first-seen (ip, sender, recipient) tuple with a 450 tempfail so legitimate senders retry and pass. Each gate is skipped when the operator doesn't wire it. Because these gates do DNS and store lookups, the per-connection command pump was reworked to process commands asynchronously and strictly in arrival order, so pipelined commands (RFC 2920) cannot overtake a gate still resolving and the existing SMTP-smuggling and STARTTLS-stripping defenses are unchanged. The message-authentication gate (SPF/DKIM/DMARC alignment via b.guardEnvelope) needs the inbound SPF + DKIM verification results as inputs; that inbound-auth pipeline lands as a follow-up, and the documentation no longer implies that gate is active today.",
+  "sections": [
+    {
+      "heading": "Added",
+      "items": [
+        {
+          "title": "HELO-identity / RBL / greylist gates wired into `b.mail.server.mx`",
+          "body": "When wired, `opts.helo` (FCrDNS / HELO-shape / self-name checks) refuses a bad HELO identity at HELO/EHLO with 550; `opts.rbl` refuses a connecting IP found on a DNS blocklist with 554 (evaluated once per connection); `opts.greylist` defers a first-seen (ip, sender, recipient) tuple with 450 4.7.1. Their verdicts surface on the `rcpt_to` event (`rblListed`, `greylist`) and the `helo` event (`heloVerdict`), with dedicated `helo_gate_refused` / `rbl_refused` / `greylist_deferred` audit events. A gate the operator doesn't supply is skipped, never synthesized."
+        }
+      ]
+    },
+    {
+      "heading": "Changed",
+      "items": [
+        {
+          "title": "MX command pump processes commands asynchronously and in arrival order",
+          "body": "Gate evaluation involves DNS and store lookups, so the per-connection command pump now awaits each command before the next. Pipelined commands are serialized so a gate resolving cannot let a later command answer ahead of an earlier one; reply ordering, the bare-LF SMTP-smuggling refusal, and the STARTTLS-stripping defense are unchanged. No change to the listener's external behaviour when no gates are wired."
+        }
+      ]
+    },
+    {
+      "heading": "Deprecated",
+      "items": [
+        {
+          "title": "SPF/DKIM/DMARC-alignment gate documentation corrected to match what is active",
+          "body": "The `envelope` (SPF/DKIM/DMARC alignment) and `dmarc` gate options were documented as wireable but require inbound SPF + DKIM verification results the listener does not yet produce. They are removed from the documented option set until the inbound-authentication pipeline (composing `b.mail.spf` + `b.mail.dmarc` + DKIM verification) lands; run those checks on the delivered message via the agent handoff in the meantime."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/release-notes/v0.13.13.json

@@ -0,0 +1,18 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.13.13",
+  "date": "2026-05-27",
+  "headline": "Archive extraction-path verification now refuses Windows reserved names, NTFS data streams, and trailing-dot/space per segment",
+  "summary": "b.guardFilename.verifyExtractionPath (the per-entry gate b.archive.read.zip.extract / b.safeArchive run on every extracted file) checked traversal, absolute paths, drive-letter and UNC prefixes, null bytes, PATH_MAX overflow, and realpath containment — but not the per-segment Windows write-target hazards the disk validate / sanitize paths already reject. An archive entry named CON, NUL.txt, subdir/LPT1, file.txt:hidden, or secret.txt. stayed inside the extraction root, so the containment and realpath checks passed it, yet on Windows it would resolve to a device, write a hidden NTFS stream, or (after Windows strips the trailing dot/space) overwrite a sibling file. These are now refused: any path segment that collides with a Windows reserved device name, uses NTFS alternate-data-stream syntax (name:stream), or carries a trailing dot or leading/trailing whitespace. The checks are platform-unconditional — a verifier running on Linux still refuses names that are only dangerous on the Windows host that ultimately extracts the archive — with a per-check opt-out (reservedNamePolicy / adsPolicy / leadingTrailingPolicy: \"allow\") for Linux-only targets.",
+  "sections": [
+    {
+      "heading": "Security",
+      "items": [
+        {
+          "title": "`verifyExtractionPath` refuses per-segment Windows extraction hazards (reserved names / NTFS ADS / trailing dot-space)",
+          "body": "Closes a within-root write-target-redirection gap: an extracted entry could stay inside the destination yet, on Windows, resolve to a device (`CON` / `NUL` / `COM1` / `LPT1`), write a hidden alternate data stream (`file.txt:payload`), or overwrite a sibling after Windows strips a trailing dot/space (`config.`). The verification gate now rejects all three per path segment. Refusal is platform-unconditional (the verifier may run on a different OS than the extractor); set `reservedNamePolicy` / `adsPolicy` / `leadingTrailingPolicy` to `\"allow\"` to opt a check out on a Linux-only target. Single-entry, name-only residuals — 8.3 short-name aliasing, case-insensitive cross-entry collisions, and archive symlink/hardlink entry-target validation — remain the extract orchestrator's responsibility (it owns the case-folded seen-set and the link-target gate)."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/release-notes/v0.13.9.json

@@ -0,0 +1,27 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.13.9",
+  "date": "2026-05-26",
+  "headline": "Corrected CVE citations in source threat annotations + a build gate that refuses malformed CVE identifiers",
+  "summary": "Several source-comment threat annotations cited CVE identifiers that were rejected by the numbering authority (never assigned to a real issue), attributed to the wrong product, or structurally malformed (a placeholder with a non-numeric sequence). The annotated defenses are unchanged — every cap, refusal, and constant-time comparison behaves exactly as before; only the reference labels were corrected, each to a verifiable CVE or to the underlying weakness class (CWE / RFC) where no single CVE fits. Notable corrections: the S/MIME SHA-1 / MD5 certificate-signature refusal now cites the SHAttered collision and RFC 8551 §2.5 instead of a rejected candidate id; decompression-output caps cite CWE-409 and CVE-2025-0725 instead of a fabricated placeholder; the iCalendar RRULE / nesting / byte caps describe the calendar-bomb recursion-DoS class instead of an unrelated SSRF advisory; and the SAML signature-wrapping (XSW) defense now cites the actively-exploited CVE-2024-45409 (ruby-saml, CVSS 10.0) and CVE-2025-25291 / -25292 that the duplicate-element refusal defeats. A new build-time detector refuses any CVE token whose sequence number is not all-numeric, so a placeholder identifier can never reach a release again.",
+  "sections": [
+    {
+      "heading": "Fixed",
+      "items": [
+        {
+          "title": "Corrected rejected / misattributed / malformed CVE references in source threat annotations",
+          "body": "Threat-annotation comments across the mail, crypto, auth, guard, and safe modules carried CVE identifiers that were rejected by the CVE numbering authority, attributed to the wrong product, or written as non-numeric placeholders. Each was corrected to a verifiable CVE or to the weakness class (CWE / RFC) it defends. No runtime behaviour changed — the defenses these comments describe are unchanged. The S/MIME certificate check's SHA-1 / MD5 refusal message now names the SHAttered collision and RFC 8551 §2.5; the SAML XSW defense now names CVE-2024-45409 and CVE-2025-25291 / -25292."
+        }
+      ]
+    },
+    {
+      "heading": "Detectors",
+      "items": [
+        {
+          "title": "`malformed-cve-identifier` — refuses structurally-invalid CVE tokens at build time",
+          "body": "A CVE identifier's sequence number is always numeric (`CVE-<year>-<digits>`). The new detector refuses any CVE token whose post-year segment contains a letter — the placeholder shape that lets a fabricated reference slip past review. It cannot verify that a well-formed id is real or correctly attributed (that stays a review responsibility), but it makes the structurally-invalid class impossible to ship."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/test/layer-0-primitives/archive-read.test.js

@@ -125,6 +125,49 @@ function testVerifyExtractionPathRefusals() {
   check("verifyExtractionPath: 4 refusals", refusals === 4);
 }
 
+// Per-segment Windows-extraction hazards — refused even though they stay
+// inside the extraction root (within-root write-target redirection /
+// collision that the containment + realpath checks can't see). Platform-
+// unconditional, with per-check opt-outs for Linux-only targets.
+function testVerifyExtractionPathWindowsHazards() {
+  function expectCode(name, code, opts) {
+    var e = null;
+    try { b.guardFilename.verifyExtractionPath(name, "/tmp", opts); }
+    catch (err) { e = err; }
+    check("verifyExtractionPath refuses " + JSON.stringify(name) + " (" + code + ")",
+      e && (e.code || "").indexOf(code) !== -1);
+  }
+  // Windows reserved device names (bare + with extension + nested segment).
+  expectCode("CON", "filename.extraction-reserved-name");
+  expectCode("aux.txt", "filename.extraction-reserved-name");
+  expectCode("subdir/NUL", "filename.extraction-reserved-name");
+  expectCode("logs/COM1.log", "filename.extraction-reserved-name");
+  // Superscript-digit COM/LPT spoof (U+00B9/B2/B3 — Windows folds to 1/2/3).
+  // Built from codepoints so the test source stays pure-ASCII.
+  expectCode("COM" + String.fromCharCode(0xB9), "filename.extraction-reserved-name");
+  expectCode("sub/LPT" + String.fromCharCode(0xB3), "filename.extraction-reserved-name");
+  // NTFS alternate data streams.
+  expectCode("file.txt:evil.exe", "filename.extraction-ntfs-ads");
+  expectCode("dir/data.bin:$DATA", "filename.extraction-ntfs-ads");
+  // Trailing dot / leading-or-trailing whitespace (Windows strips → collision).
+  expectCode("secret.txt.", "filename.extraction-leading-trailing");
+  expectCode("name with trailing space ", "filename.extraction-leading-trailing");
+
+  // Opt-outs accept the name (then pass the realpath leg into a real root).
+  function expectAccept(name, opts) {
+    var dest = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-vx-"));
+    var ok = false, code = null;
+    try { ok = b.guardFilename.verifyExtractionPath(name, dest, opts).indexOf(dest) === 0; }
+    catch (e) { code = e && e.code; }
+    finally { fs.rmSync(dest, { recursive: true, force: true }); }
+    check("verifyExtractionPath accepts " + JSON.stringify(name) + " with opt-out" +
+      (code ? " (threw " + code + ")" : ""), ok === true);
+  }
+  expectAccept("CON", { reservedNamePolicy: "allow" });
+  expectAccept("file.txt:evil.exe", { adsPolicy: "allow" });
+  expectAccept("secret.txt.", { leadingTrailingPolicy: "allow" });
+}
+
 async function testExtractRefusesOverwrite() {
   // Codex P1 on v0.12.7 PR #158 — the catch-block cleanup deleted
   // PRE-EXISTING destination files on abort because the rename-onto-
@@ -272,15 +315,48 @@ async function testExtractEntriesInMemory() {
   check("tar extractEntries: binary matches", tcollected["sub/y.dat"].equals(Buffer.from([9, 8, 7])));
 }
 
+// opts.signal (AbortSignal) is documented on b.archive.read.zip — verify
+// it actually aborts the read at the entry boundary rather than being a
+// dead doc opt.
+async function testSignalAbort() {
+  var z = b.archive.zip();
+  z.addFile("a.txt", "one\n");
+  z.addFile("b.txt", "two\n");
+  var bytes = z.toBuffer();
+
+  var ac = new AbortController();
+  ac.abort();   // already aborted before any read
+  var reader = b.archive.read.zip(b.archive.adapters.buffer(bytes), { signal: ac.signal });
+
+  var inspectThrew = null;
+  try { await reader.inspect(); } catch (e) { inspectThrew = e; }
+  check("zip inspect honors an aborted signal",
+        inspectThrew && (inspectThrew.code || "").indexOf("archive-read/aborted") !== -1);
+
+  var extractThrew = null;
+  try { for await (var _e of reader.extractEntries()) { void _e; } }
+  catch (e) { extractThrew = e; }
+  check("zip extractEntries honors an aborted signal",
+        extractThrew && (extractThrew.code || "").indexOf("archive-read/aborted") !== -1);
+
+  // Sanity: with no signal the same reader works.
+  var ok = b.archive.read.zip(b.archive.adapters.buffer(bytes));
+  var n = 0;
+  for await (var e2 of ok.extractEntries()) { void e2; n += 1; }
+  check("zip extractEntries with no signal still yields entries", n === 2);
+}
+
 async function run() {
   await testRoundTripExtract();
   await testExtractEntriesInMemory();
+  await testSignalAbort();
   testSafeArchiveErrorClass();
   await testSafeArchiveInspect();
   await testZipBombPolicy();
   testEntryTypePolicy();
   testVerifyExtractionPathHappy();
   testVerifyExtractionPathRefusals();
+  testVerifyExtractionPathWindowsHazards();
   await testExtractRefusesOverwrite();
   await testSafeArchiveRefusesTrustedStreamSource();
   await testGuardArchiveInspect();

package/lib/vendor/blamejs/test/layer-0-primitives/auth-jwt-defenses.test.js

@@ -4,7 +4,7 @@
  *
  *   CVE-2026-22817 — alg/kty confusion (RS256→HS256, ES256↔RSA, etc.)
  *   CVE-2026-23552 — cross-realm JWT acceptance (constant-time iss)
- *   CVE-2026-23993 — unknown-alg paths skipping verify
+ *   Alg-allowlist gate (CWE-347 / CWE-757) — unknown-alg paths skipping verify
  *
  * Plus the larger AUTH-2…AUTH-36 findings closed in the same batch:
  *
@@ -137,7 +137,7 @@ async function testCrossRealmIssRefused() {
         threw && /iss-mismatch/.test(threw.code || ""));
 }
 
-// -------- CVE-2026-23993 — unknown alg refused before key lookup --------
+// -------- Alg-allowlist gate — unknown alg refused before key lookup --------
 
 async function testUnknownAlgRefusedBeforeLookup() {
   // Caller's allowlist is ES256 only; token declares HS256. Verifier
@@ -156,8 +156,8 @@ async function testUnknownAlgRefusedBeforeLookup() {
   } catch (e) { threw = e; }
   // HS256 is in REFUSED_ALGS so the operator-allowlist refusal fires
   // FIRST; but the underlying mechanic — token alg refused before key
-  // resolution — is what CVE-2026-23993 closes.
-  check("CVE-2026-23993 — token alg refused before key lookup",
+  // resolution — is what the alg-allowlist gate (CWE-347 / CWE-757) closes.
+  check("alg-allowlist gate — token alg refused before key lookup",
         threw && /alg-not-allowed|refused-alg/.test(threw.code || ""));
 }
 

package/lib/vendor/blamejs/test/layer-0-primitives/calendar.test.js

@@ -83,6 +83,36 @@ function testFromIcalRoundTrip() {
   check("toIcal preserves DTSTART",        /DTSTART:20260522T090000/.test(back));
 }
 
+function testFromIcalSafeIcalOptsForwarded() {
+  // @opts documents safeIcalOpts as forwarded to b.safeIcal.parse.
+  // Proof it actually reaches the parser: an unknown profile inside
+  // safeIcalOpts must surface safeIcal's bad-opt refusal. If the opts
+  // were dropped (or the whole outer opts passed instead), safeIcal
+  // would default to "strict" and never throw.
+  var ical =
+    "BEGIN:VCALENDAR\r\nVERSION:2.0\r\nPRODID:-//test//EN\r\n" +
+    "BEGIN:VEVENT\r\nUID:a@b\r\nDTSTAMP:20260521T100000Z\r\n" +
+    "DTSTART:20260522T090000\r\nDURATION:PT1H\r\nSUMMARY:x\r\n" +
+    "END:VEVENT\r\nEND:VCALENDAR\r\n";
+  var threw = null;
+  try { b.calendar.fromIcal(ical, { safeIcalOpts: { profile: "bogus" } }); }
+  catch (e) { threw = e; }
+  check("fromIcal forwards safeIcalOpts to safeIcal.parse (bad profile refused)",
+        threw && (threw.code || "").indexOf("safe-ical/bad-opt") !== -1);
+  // And a VALID nested profile parses cleanly (no accidental refusal).
+  var ev = b.calendar.fromIcal(ical, { safeIcalOpts: { profile: "balanced" } });
+  check("fromIcal honors a valid nested safeIcalOpts profile", ev && ev["@type"] === "Event");
+  // Backward-compat: the historically-working TOP-LEVEL parser-options
+  // form must keep working (no patch-release regression).
+  var threwTop = null;
+  try { b.calendar.fromIcal(ical, { profile: "bogus" }); }
+  catch (e) { threwTop = e; }
+  check("fromIcal still honors a top-level profile (no regression)",
+        threwTop && (threwTop.code || "").indexOf("safe-ical/bad-opt") !== -1);
+  var evTop = b.calendar.fromIcal(ical, { profile: "balanced" });
+  check("fromIcal parses with a valid top-level profile", evTop && evTop["@type"] === "Event");
+}
+
 function testFromIcalNoVevent() {
   var threw = null;
   try { b.calendar.fromIcal("BEGIN:VCALENDAR\r\nVERSION:2.0\r\nPRODID:-//x//EN\r\nEND:VCALENDAR\r\n"); }
@@ -840,6 +870,7 @@ function run() {
   testValidateHappyPath();
   testValidateRefusalCases();
   testFromIcalRoundTrip();
+  testFromIcalSafeIcalOptsForwarded();
   testFromIcalNoVevent();
   testRrulePreserved();
   testExpandRecurrenceDaily();

package/lib/vendor/blamejs/test/layer-0-primitives/codebase-patterns.test.js

@@ -566,7 +566,9 @@ function testNoStaleDefers() {
   function cmp(a, b) { for (var i = 0; i < 3; i += 1) { if ((a[i] || 0) !== (b[i] || 0)) return (a[i] || 0) - (b[i] || 0); } return 0; }
   // Promised-landing phrasings only ("X lands in vN" / "deferred to vN" / "not
   // supported in vN"). NOT "deferred FROM vN" (that is an origin, not a deadline).
-  var PROMISE = /(?:deferred to|lands(?: in)?|will land(?: in)?|not supported in)\s+v?(\d+\.\d+\.\d+)/i;
+  // Accept 2-part (vN.N) AND 3-part (vN.N.N) promised-landing versions —
+  // a 2-part "v0.10" promise slipped past the old 3-part-only pattern.
+  var PROMISE = /(?:deferred to|lands(?: in)?|will land(?: in)?|not supported in)\s+v?(\d+\.\d+(?:\.\d+)?)/i;
   var matches = _scan(PROMISE, { skipComments: false });
   var overdue = [];
   matches.forEach(function (m) {
@@ -2259,6 +2261,10 @@ async function testNoDuplicateCodeBlocks() {
       files: ["lib/api-key.js:issue", "lib/db-query.js:<top>", "lib/session.js:create"],
       reason: "Generic JS array helper / lambda shape — Object.keys(...).map(fn) + similar functional idioms appearing in any code that walks a column-or-key list.",
     },
+    {
+      files: ["lib/guard-filename.js:verifyExtractionPath", "lib/hal.js:resource", "lib/vault-aad.js:_canonicalize"],
+      reason: "v0.13.13 — coincidental token shingle of the generic split-then-walk-segments idiom (`x.split(sep); for (...) { var seg = ...; if (...) throw/continue }`). guard-filename verifyExtractionPath walks path components refusing per-segment Windows-extraction hazards (reserved names / NTFS-ADS / trailing-dot); hal.js:resource builds a HAL resource by walking link/embedded keys; vault-aad.js:_canonicalize canonicalizes AAD key-value segments. Three unrelated domains (path safety / hypermedia link assembly / crypto AAD canonicalization) — no shared behaviour to extract; the only commonality is the universal split-and-loop control-flow shape.",
+    },
     {
       mode:  "family-subset",
       files: [
@@ -5788,7 +5794,7 @@ var KNOWN_ANTIPATTERNS = [
   {
     // v0.10.15 — `zlib.gunzipSync` / `zlib.createGunzip` /
     // `zlib.brotliDecompress` without an output-size cap is the
-    // CVE-2025-0725 / CVE-2024-zlib decompression-amplification
+    // CVE-2025-0725 / CWE-409 decompression-amplification
     // class. Attackers craft a kilobyte of compressed input that
     // explodes to gigabytes of output, exhausting memory before the
     // request handler sees the bytes. The defense is either the
@@ -5831,7 +5837,67 @@ var KNOWN_ANTIPATTERNS = [
     requires: /\bmaxOutputLength\b/,
     skipCommentLines: true,
     allowlist: [],
-    reason: "CVE-2025-0725 (libcurl + zlib decompression amplification) + CVE-2024-zlib bomb class. Every gunzip / brotli decompress on operator-supplied bytes MUST bound the output. Use `zlib.gunzipSync(buf, { maxOutputLength: <C.BYTES.* constant> })` so the operator sees the cap at config time; refusal becomes a typed error before the bomb reaches memory.",
+    reason: "CVE-2025-0725 (libcurl + zlib decompression amplification) + CWE-409 (uncontrolled-resource decompression bomb) class. Every gunzip / brotli decompress on operator-supplied bytes MUST bound the output. Use `zlib.gunzipSync(buf, { maxOutputLength: <C.BYTES.* constant> })` so the operator sees the cap at config time; refusal becomes a typed error before the bomb reaches memory.",
+  },
+  {
+    // Citation hygiene — a CVE identifier is always
+    // CVE-<4-digit-year>-<sequence>, where the sequence is purely
+    // numeric (CVE numbering spec). Two malformed shapes ship past
+    // review: a non-numeric sequence (`CVE-2024-zlib` — a library
+    // name dropped in as a placeholder), and a real id with a
+    // hyphen-attached word (`CVE-2024-39687-class` — reads as if
+    // `-class` is part of the id). The first is a fabricated
+    // reference; the second is a parse hazard for any tool that
+    // extracts CVE tokens. The annotation convention is a SPACE
+    // before the descriptor (`CVE-2024-39687 class`), which leaves
+    // the id token well-formed. This detector refuses both shapes:
+    // a letter immediately after the year separator, OR a
+    // hyphen-then-letter after the numeric sequence. It cannot
+    // verify that a well-formed id is real or correctly attributed —
+    // that stays a reviewer responsibility — but it makes the
+    // structurally-invalid class impossible to ship. Real CVE
+    // ranges (`CVE-2023-51764 / -51765`) and id-then-space-descriptor
+    // forms pass unchanged.
+    id: "malformed-cve-identifier",
+    primitive: "cite a real CVE as CVE-<year>-<digits> (all-numeric sequence) then a SPACE before any descriptor — never a non-numeric sequence or a hyphen-attached word",
+    regex: /CVE-[0-9]{4}-(?:[0-9]*[A-Za-z]|[0-9]+-[A-Za-z])/,
+    allowlist: [],
+    reason: "A CVE identifier's sequence number is always numeric and the token ends at the sequence (CVE-<year>-<digits>). A non-numeric sequence (CVE-2024-zlib) is a fabricated placeholder; a hyphen-attached word (CVE-2024-39687-class) makes the id un-parseable. Cite a verifiable CVE followed by a space before any class/descriptor word, or name the weakness class (CWE / RFC).",
+  },
+
+  {
+    // Codex P1 on v0.13.12 PR #234 — the MX listener's command pump was
+    // made async (gates do DNS / store lookups), and the plaintext
+    // socket.on("data") path was routed through a per-connection
+    // serialization chain (`_feedChunk`). But the post-STARTTLS TLSSocket
+    // fed `_ingestBytes` directly from a sync onData callback that ignored
+    // the returned promise — so on the upgraded socket (where the default
+    // strict/balanced profiles actually run the gates) async gate awaits
+    // could overlap later TLS chunks and gate rejections went unhandled
+    // instead of producing the 421 path. The invariant: the async command
+    // pump (`_ingestBytes`) is fed ONLY through `_feedChunk` (the
+    // `return _ingestBytes(...)` form), so every transport — plaintext and
+    // TLS — shares the one serialized chain. A bare `_ingestBytes(` call
+    // anywhere else is a second, un-serialized feed path. The lookbehind
+    // exempts the function definition (`function _ingestBytes`) and the
+    // single legitimate caller (`return _ingestBytes`); `_ingestBytes` is
+    // unique to lib/mail-server-mx.js so this is effectively file-scoped.
+    id: "mx-ingest-bytes-bypasses-feed-pump",
+    primitive: "feed the MX command pump only via _feedChunk (`return _ingestBytes(...)`); never call _ingestBytes directly from a sync callback — it drops the async pump's promise and breaks command serialization + the 421 error path",
+    regex: /(?<!function )(?<!return )\b_ingestBytes\s*\(/,
+    allowlist: [
+      // The submission listener has its OWN _ingestBytes, and it is
+      // SYNCHRONOUS — its only async work (SASL AUTH) is handled via
+      // internal .then() chains inside the command handler, and RFC 4954
+      // §4 forbids clients pipelining commands across AUTH until the
+      // response is received, so a sync pump is spec-acceptable there.
+      // There is no async-promise to drop, so the bare `_ingestBytes(`
+      // call is safe. This invariant guards the MX listener's async pump
+      // specifically; if the submission pump is ever made async, route it
+      // through a _feedChunk equivalent and drop this allowlist entry.
+      "lib/mail-server-submission.js",
+    ],
+    reason: "Codex P1 on PR #234: the async MX command pump must be fed through the single per-connection serialization chain (_feedChunk → `return _ingestBytes`). A bare `_ingestBytes(` call from a sync callback (the original post-STARTTLS onData) ignores the returned promise, letting async HELO/RBL/greylist gate awaits overlap later chunks and turning gate rejections into unhandled rejections instead of the 421 path. Route every transport (plaintext + TLS) through _feedChunk.",
   },
 
   {
@@ -6444,9 +6510,10 @@ var KNOWN_ANTIPATTERNS = [
     reason: "CVE-2026-23552 — JWT iss comparisons against attacker-controlled payload values leak prefix-timing via `!==`. Every JWT verifier in the framework (oauth.verifyIdToken / jwt-external.verifyExternal / oauth.parseFrontchannelLogoutRequest / sd-jwt-vc.verify) routes through jwtExternal._issuerMatches for constant-time comparison. Detection is precise: `payload.iss !== ...` / `claims.iss !== ...` / `token.iss !== ...` is the JWT-verify-side shape. Non-JWT iss checks (e.g. discovery-document self-consistency where iss came from the same TLS-fetched body) are not in scope and don't match the regex.",
   },
   {
-    // CVE-2026-23993 — accepting unknown JOSE alg values via a
-    // `switch (alg) { default: ... }` permissive default-branch is
-    // the canonical shape. Verifiers MUST throw in the default
+    // Alg-allowlist gate (CWE-347 improper-sig-verification /
+    // CWE-757 algorithm-downgrade) — accepting unknown JOSE alg
+    // values via a `switch (alg) { default: ... }` permissive
+    // default-branch is the canonical shape. Verifiers MUST throw in the default
     // branch (no fall-through to a permissive "any signature"
     // path). The detector catches `switch (...alg)` (case-
     // insensitive) where the default branch returns/falls through
@@ -6462,7 +6529,7 @@ var KNOWN_ANTIPATTERNS = [
       // branch, so it doesn't match. Other auth files use
       // explicit if-cascades that throw, also not matched.
     ],
-    reason: "CVE-2026-23993 — JWT verifiers that accept unknown alg values via a permissive switch-default branch are the canonical bypass class. Every alg-dispatch primitive in the framework throws in the default branch (`throw new AuthError('.../unsupported-alg', ...)`) so an unrecognized alg can never reach a signature-verify call. The detector specifically flags `switch (alg)` (or `switch (header.alg)` / `switch (sigAlgo)`) whose default-branch returns / breaks rather than throwing. New alg-dispatch code throws in the default — no exceptions.",
+    reason: "Alg-allowlist gate (CWE-347 / CWE-757) — JWT verifiers that accept unknown alg values via a permissive switch-default branch are the canonical bypass class. Every alg-dispatch primitive in the framework throws in the default branch (`throw new AuthError('.../unsupported-alg', ...)`) so an unrecognized alg can never reach a signature-verify call. The detector specifically flags `switch (alg)` (or `switch (header.alg)` / `switch (sigAlgo)`) whose default-branch returns / breaks rather than throwing. New alg-dispatch code throws in the default — no exceptions.",
   },
   {
     id: "inline-codepoint-class-table",
@@ -7351,6 +7418,36 @@ var KNOWN_ANTIPATTERNS = [
     reason: "Every 'test passes alone, fails under SMOKE_PARALLEL=64' flake (macOS watcher, log-stream-otlp, safe-async-loops, rate-limit-cluster, sandbox flake) is the same root cause: a fixed-budget setTimeout sleep that's too short for runner-contention reality. `helpers.waitUntil(predicate, opts?)` polls the actual condition every 25ms up to a 5000ms cap, exiting early when the predicate returns truthy. Fast platforms finish in milliseconds; contended platforms get the full budget. `helpers.passiveObserve(ms, label)` is the sibling primitive for the rare case of verifying ABSENCE of an event over a window (work simulators, TTL-elapse before assertion). The allowlist's structural FPs are permanent; the migration-backlog files drain to zero in subsequent patches.",
   },
 
+  {
+    // Sibling to test-promise-settimeout-sleep, for the timer the
+    // setTimeout regex misses: a COUNTED DRAIN-LOOP that reassigns a
+    // promise to its own `.then()` over and over to "flush N
+    // microtasks/ticks" before asserting — the `_waitMicrotasks(n)`
+    // helper shape (`var p = Promise.resolve(); for (...) p = p.then(
+    // () => new Promise(r => setImmediate(r)));`). Like the fixed
+    // setTimeout sleep it guesses a budget; under SMOKE_PARALLEL=64
+    // contention the awaited async work (a cluster-backend DB take,
+    // a scheduler tick-claim) hasn't resolved within the tick count,
+    // so the next assertion reads stale state. This was the recurring
+    // rate-limit-cluster "4th blocked with 429" flake and the
+    // scheduler-exactly-once tick-claim race. A single `await new
+    // Promise(r => setImmediate(r))` event-loop yield is legitimate
+    // and is NOT matched — only the self-reassigning `<x> = <x>.then(`
+    // drain idiom paired with a timer is. Poll the observable
+    // condition with helpers.waitUntil instead.
+    id: "test-microtask-drain-loop-sleep",
+    primitive: "helpers.waitUntil(predicate, { timeoutMs, label }) — poll the observable condition; never drain a fixed count of microtasks/ticks by reassigning a promise to its own .then() in a loop",
+    scanScope: "test",
+    regex: /\b(\w+)\s*=\s*\1\.then\([\s\S]{0,80}?set(?:Immediate|Timeout)\s*\(/,
+    skipCommentLines: true,
+    allowlist: [
+      // The catalog itself carries this pattern as a regex literal +
+      // in this entry's own prose/reason describing the antipattern.
+      "test/layer-0-primitives/codebase-patterns.test.js",
+    ],
+    reason: "A for-loop that reassigns a promise to its own `.then(() => new Promise(r => setImmediate(r)))` to drain a fixed number of microtask ticks is the same fixed-budget anti-pattern as a setTimeout sleep, just timed in event-loop turns instead of milliseconds — and it flakes the same way: when the async work under test hasn't resolved within the tick count (cluster DB take, scheduler tick-claim) the following assertion reads stale state. Poll the observable condition with helpers.waitUntil(predicate, { timeoutMs, label }); a lone `await new Promise(r => setImmediate(r))` yield is fine and isn't matched.",
+  },
+
   {
     // v0.10.13 PR #102 macOS hang — stream-throttle.test.js used
     // `setTimeout`-based rate enforcement plus `node:stream.pipeline`

package/lib/vendor/blamejs/test/layer-0-primitives/fal.test.js

@@ -58,6 +58,31 @@ function testFromAssertion() {
         b.auth.fal.fromAssertion({ channel: "back" }) === "FAL1");
 }
 
+function testBearerOnlyAlias() {
+  // bearerOnly:true is the documented alias for hokBinding === null —
+  // it forces the bearer path. With replay + injection-protection on a
+  // back-channel it still classifies as FAL2 (not FAL3), proving no
+  // proof-of-possession binding is applied.
+  check("bearerOnly:true → no HoK (back + replay + bcAuth = FAL2)",
+        b.auth.fal.fromAssertion({
+          channel: "back", replayProtected: true,
+          backChannelAuthenticated: true, bearerOnly: true,
+        }) === "FAL2");
+  // bearerOnly:true with mTLS even + replay must NOT reach FAL3 —
+  // bearerOnly wins is a contradiction, so it's refused (config-time).
+  var threw = null;
+  try {
+    b.auth.fal.fromAssertion({ channel: "back", hokBinding: "mtls",
+      replayProtected: true, bearerOnly: true });
+  } catch (e) { threw = e; }
+  check("bearerOnly:true + hokBinding refused",
+        threw && (threw.code || "").indexOf("auth/bad-fal-opts") !== -1);
+  // bearerOnly:false is a no-op (hokBinding still honored → FAL3).
+  check("bearerOnly:false is inert (mTLS + replay = FAL3)",
+        b.auth.fal.fromAssertion({ channel: "back", hokBinding: "mtls",
+          replayProtected: true, bearerOnly: false }) === "FAL3");
+}
+
 function testFromAssertionRefusesBadShape() {
   function expectCode(label, fn, code) {
     var threw = null;
@@ -105,6 +130,7 @@ function testRequireFal() {
 async function run() {
   testSurface();
   testFromAssertion();
+  testBearerOnlyAlias();
   testFromAssertionRefusesBadShape();
   testMeets();
   testRequireFal();

package/lib/vendor/blamejs/test/layer-0-primitives/mail-crypto-smime.test.js

@@ -12,8 +12,8 @@
  *   - the doc-block contains the required RFC citations + CVE
  *     references + deferral conditions + escape hatch (per the
  *     project's defer-with-condition rule),
- *   - checkCert() refuses SHA-1 / MD5 cert signatures (CVE-2017-9006
- *     class) and < 2048-bit RSA (RFC 8301 §3.1).
+ *   - checkCert() refuses SHA-1 / MD5 cert signatures (SHAttered SHA-1
+ *     collision; RFC 8551 §2.5) and < 2048-bit RSA (RFC 8301 §3.1).
  *
  * Run standalone: `node test/layer-0-primitives/mail-crypto-smime.test.js`
  * Or via smoke:   `node test/smoke.js`
@@ -203,8 +203,8 @@ function testSmimeCheckCertRefusesSha1() {
   try { smime.checkCert({ certPem: certPem }); } catch (e) { threw = e; }
   check("checkCert refuses SHA-1 cert signature",
     threw && threw.code === "mail-crypto/smime/refused-hash");
-  check("checkCert SHA-1 refusal names CVE class",
-    threw && /CVE-2017-9006/.test(threw.message));
+  check("checkCert SHA-1 refusal names the weakness class",
+    threw && /SHAttered|RFC 8551/.test(threw.message));
 }
 
 // ---- checkCert: RSA < 2048 refusal ----
@@ -260,7 +260,7 @@ function testSmimeDocBlockCitations() {
   check("smime doc block names RFC 8550",        src.indexOf("RFC 8550") !== -1);
   check("smime doc block names RFC 8301",        src.indexOf("RFC 8301") !== -1);
   check("smime doc block names CVE-2017-17688",  src.indexOf("CVE-2017-17688") !== -1);
-  check("smime doc block names CVE-2017-9006",   src.indexOf("CVE-2017-9006") !== -1);
+  check("smime doc block names SHAttered SHA-1 class", src.indexOf("SHAttered") !== -1);
   // v0.10.16 — sign/verify went live; deferred-conditions language
   // was replaced with "LIVE on b.cms substrate".
   check("smime doc block names live status",

package/lib/vendor/blamejs/test/layer-0-primitives/mail-dav.test.js

@@ -276,7 +276,7 @@ async function testCaldavPutValidIcal() {
 async function testCaldavPutRefusesInvalidIcal() {
   var dav = mailDav.create({ storage: _makeStorage() });
   var res = _makeRes();
-  // RRULE with COUNT > 10000 — CVE-2024-39687 defense.
+  // RRULE with COUNT > 10000 — calendar-bomb / recursion-DoS defense.
   var bad = "BEGIN:VCALENDAR\r\nVERSION:2.0\r\nPRODID:-//B//\r\n" +
     "BEGIN:VEVENT\r\nUID:b@x\r\nDTSTAMP:20260101T120000Z\r\nDTSTART:20260101T130000Z\r\n" +
     "RRULE:FREQ=DAILY;COUNT=999999\r\nEND:VEVENT\r\nEND:VCALENDAR\r\n";