@blamejs/blamejs-shop 0.2.13 → 0.2.14

package/lib/vendor/blamejs/lib/calendar.js

@@ -107,8 +107,9 @@ var MAX_EXPAND_SPAN_MS   = 10 * 365 * 24 * 60 * 60 * 1000;
  * @since     0.11.31
  * @status    stable
  *
- * Validate a JSCalendar Event / Task object's required-field shape per
- * RFC 8984 §5 (Event) + §6 (Task). Returns the input on success; throws
+ * Validate a JSCalendar Event / Task / Note / Group object's
+ * required-field shape per RFC 8984 §5 (Event) / §6 (Task) / §7 (Note) /
+ * §1.4.4 (Group). Returns the input on success; throws
  * `CalendarError` on refusal with a `.code` naming the specific shape
  * rule that failed.
  *
@@ -337,10 +338,11 @@ function validate(jsCal) {
  * @since     0.11.31
  * @status    stable
  *
- * Parse iCalendar text (RFC 5545) via `b.safeIcal.parse` and map the
- * first VEVENT into a JSCalendar Event object (RFC 8984 §5). Returns
- * a single Event when the VCALENDAR contains exactly one VEVENT, or
- * an array when multiple VEVENTs are present.
+ * Parse iCalendar text (RFC 5545) via `b.safeIcal.parse` and map each
+ * VEVENT → JSCalendar Event, VTODO → Task, and VJOURNAL → Note
+ * (RFC 8984 §5 / §6 / §7). Returns a single object when the VCALENDAR
+ * holds exactly one component, or an array across all components when
+ * there are several.
  *
  * @opts
  *   safeIcalOpts: object,   // forwarded to b.safeIcal.parse (caps, allowExperimental, etc.)
@@ -381,10 +383,12 @@ function fromIcal(text, opts) {
  * @since     0.11.31
  * @status    stable
  *
- * Render a JSCalendar Event back to RFC 5545 iCalendar text. Returns a
- * CRLF-terminated string wrapped in a `BEGIN:VCALENDAR / VERSION:2.0 /
- * PRODID:-//blamejs//Calendar//EN / BEGIN:VEVENT ... END:VEVENT /
- * END:VCALENDAR` envelope per RFC 5545 §3.4.
+ * Render a JSCalendar object back to RFC 5545 iCalendar text — Event →
+ * VEVENT, Task → VTODO, Note → VJOURNAL, and a Group to a VCALENDAR
+ * carrying each member component. Returns a CRLF-terminated string
+ * wrapped in a `BEGIN:VCALENDAR / VERSION:2.0 /
+ * PRODID:-//blamejs//Calendar//EN / … / END:VCALENDAR` envelope per
+ * RFC 5545 §3.4.
  *
  * @opts
  *   prodid: string,   // PRODID value to emit; default "-//blamejs//Calendar//EN"

package/lib/vendor/blamejs/lib/circuit-breaker.js

@@ -36,8 +36,10 @@ var retryHelper = require("./retry");
  * Build a circuit-breaker. Returns a CircuitBreaker instance with
  * `wrap(fn)` (executes `fn` if the breaker is closed; throws an
  * `Error` with `code: "CIRCUIT_OPEN"` + `isObjectStoreError: true` +
- * `permanent: false` when open), `state()`, `reset()`, and
- * `onStateChange(handler)` listener registration. Pass-through
+ * `permanent: false` when open), `getState()`, `reset()`, and
+ * `onStateChange(handler)` listener registration (the handler, and the
+ * `onStateChange` opt, receive `{ name, from, to, at }` on every
+ * transition). Pass-through
  * factory: identical instance shape to `b.retry.CircuitBreaker`,
  * with the framework's `create(opts)` vocabulary.
  *
@@ -53,8 +55,8 @@ var retryHelper = require("./retry");
  *   failureThreshold: number,    // failures in the closed state before opening
  *   cooldownMs:       number,    // milliseconds the breaker stays open before probing
  *   successThreshold: number,    // probe successes required to close from half-open
- *   audit:            Object,    // optional b.audit instance for state-change emission
- *   onStateChange:    Function,  // ({ name, from, to, at }) → void
+ *   onStateChange:    Function,  // ({ name, from, to, at }) → void; also emits the
+ *                                //   `breaker.state.change` observability event
  *
  * @example
  *   var cb = b.circuitBreaker.create({

package/lib/vendor/blamejs/lib/compliance-ai-act-transparency.js

@@ -31,8 +31,8 @@
  * The framework provides:
  *
  *   - banner({ kind })           → builder for the standard disclosure banner
- *   - watermark({ kind, ... })   → builder for content-marking tags
- *   - cspMetaTag({ ... })        → meta tag pair for HTML pages
+ *   - watermark({ mediaKind, ... }) → builder for content-marking tags
+ *   - metaTags({ ... })          → meta tag pair for HTML pages
  *   - jsonLdDisclosure({ ... })  → JSON-LD <script> for structured-data emit
  *   - C2pa-stub                  → operator-feeds-claims pattern for
  *                                  C2PA Content Credentials integration

package/lib/vendor/blamejs/lib/compliance.js

@@ -1407,14 +1407,11 @@ function postureDefault(posture, key) {
  *
  * @example
  *   b.compliance.posturesByDomain("privacy");
- *   // → ["ccpa", "gdpr", "lgpd-br", "pipl-cn", "appi-jp",
- *   //    "pdpa-sg", "pipeda-ca", "uk-gdpr"]
+ *   // → ["ccpa", "gdpr", "lgpd-br", ...] — every posture whose
+ *   //    domain is "privacy" (the full set grows as regimes are added)
  *
  *   b.compliance.posturesByDomain("health");
- *   // → ["hipaa", "wmhmda"]
- *
- *   b.compliance.posturesByDomain("payment");
- *   // → ["pci-dss"]
+ *   // → ["hipaa", "wmhmda", ...] — every "health"-domain posture
  *
  *   b.compliance.posturesByDomain("not-a-domain");
  *   // → []
@@ -1450,13 +1447,14 @@ function posturesByDomain(domain) {
  *
  * @example
  *   b.compliance.posturesByJurisdiction("EU");
- *   // → ["gdpr", "dora", "nis2", "cra", "ai-act"]
+ *   // → ["gdpr", "dora", "nis2", ...] — every EU-jurisdiction posture
+ *   //    (the full set grows as regimes are added)
  *
  *   b.compliance.posturesByJurisdiction("US");
- *   // → ["hipaa", "soc2", "sox"]
+ *   // → ["hipaa", "soc2", "sox", ...] — every US-jurisdiction posture
  *
  *   b.compliance.posturesByJurisdiction("US-CA");
- *   // → ["ccpa"]
+ *   // → ["ccpa", ...] — every US-CA (California) posture
  *
  *   b.compliance.posturesByJurisdiction("XX");
  *   // → []

package/lib/vendor/blamejs/lib/cookies.js

@@ -127,8 +127,8 @@ function _scrubAttr(s) {
  * `parseSafe`.
  *
  * @example
- *   var jar = b.cookies.parse("session=abc; theme=%22dark%22");
- *   // → { session: "abc", theme: "dark" }
+ *   var jar = b.cookies.parse("session=abc; theme=dark%20mode");
+ *   // → { session: "abc", theme: "dark mode" }   // percent-decoded
  */
 function parse(cookieHeader) {
   var out = {};

package/lib/vendor/blamejs/lib/crypto-field.js

@@ -495,9 +495,14 @@ function unsealRow(table, row) {
         } catch (_e) { /* drop-silent */ }
         unsealed = null;
       }
-      // If the value wasn't actually sealed, vault.unseal returns the input
-      // unchanged — keep the original.
-      out[field] = unsealed !== undefined && unsealed !== null ? unsealed : out[field];
+      // Assign unconditionally. `unsealed` already carries the right value
+      // for every branch: the plaintext on success, the original value on
+      // the not-actually-sealed pass-through (set above), and `null` on an
+      // unseal failure. The failure case MUST null the column so downstream
+      // sees "no value" rather than the attacker-crafted `vault:<…>` string
+      // (a prior `... ? unsealed : out[field]` guard silently kept the
+      // forged ciphertext on failure, defeating the documented defense).
+      out[field] = unsealed;
     }
   }
 

package/lib/vendor/blamejs/lib/data-act.js

@@ -20,8 +20,9 @@
  *
  *     - Art 4 §1 — let the user access "readily available product
  *       data" generated by their use of the connected product.
- *       `b.dataAct.userAccessible(productId, userId)` returns the
- *       operator-supplied data slice.
+ *       `b.dataAct.recordUserAccess({ productId, userId, dataSlice })`
+ *       records the operator-supplied data slice for the regulator
+ *       record.
  *     - Art 5 §1 — share that data with a third-party data
  *       recipient on the user's request, "without undue delay,
  *       free of charge to the user, of the same quality as is
@@ -46,7 +47,7 @@
  *     b.dataAct.declareProduct({ productId, dataHolder, ... })
  *     b.dataAct.recordUserAccess({ productId, userId, dataSlice, ... })
  *     b.dataAct.shareWithThirdParty({ productId, userId, recipient, scope })
- *     b.dataAct.refuseGatekeeper({ recipient })
+ *       — refuses a DMA-gatekeeper recipient per Art 32 §1
  *     b.dataAct.recordSwitchRequest({ customerId, targetProvider, dataSlices })
  *
  *   The framework does NOT host the connected-product data itself;

package/lib/vendor/blamejs/lib/file-upload.js

@@ -18,7 +18,14 @@
  *   for content gating and `b.guardFilename.gate({ profile: "strict" })`
  *   for filename gating. Operators opt out via `contentSafety: null`
  *   / `filenameSafety: null` (audited at create time so a security
- *   review can find the disabled-on-deploy rows). Per-chunk hooks
+ *   review can find the disabled-on-deploy rows). The byte-level
+ *   content gate inspects the reassembled buffer, so it runs on uploads
+ *   up to `maxStreamReassemblyBytes` (default 64 MiB); a larger upload
+ *   is handed to `onFinalize` as a stream and the byte-content gate is
+ *   skipped (MIME-sniff + filename gates still run, and the skip emits a
+ *   `fileUpload.content_safety_skipped` warning audit). To guarantee
+ *   content-gating of a type, cap `maxFileBytes` at or below
+ *   `maxStreamReassemblyBytes`. Per-chunk hooks
  *   (`onChunk`) are the integration point for virus scanners and
  *   schema-shape checks; rejecting from the hook surfaces as a
  *   permanent `FileUploadError`.
@@ -1076,6 +1083,16 @@ function create(opts) {
           // Clear the streaming alias if present — sanitized fits in memory.
           bodyStream = null;
         }
+      } else if (safetyGate && typeof safetyGate.check === "function" && !bodyBuffer) {
+        // A content-safety gate is configured for this extension, but the
+        // upload streamed past maxStreamReassemblyBytes and was never
+        // reassembled into a buffer the byte-level gate can inspect. The
+        // MIME-sniff and filename gates still ran; the per-extension
+        // content gate did NOT. Surface it (rather than skipping silently)
+        // via an observability counter so operators can alert, lower
+        // maxStreamReassemblyBytes, or cap maxFileBytes to force
+        // content-gating of this type.
+        _emitObs("fileUpload.content_safety_skipped_streamed", 1, { ext: safetyExt });
       }
     }
 

package/lib/vendor/blamejs/lib/mail-bimi.js

@@ -34,8 +34,9 @@
  *   subjectAltName URI matches the BIMI domain, and confirms the
  *   cert carries the BIMI mark-verification policy OID
  *   (1.3.6.1.5.5.7.3.31). The verified mark is returned as
- *   { svg, evidenceDocument } pulled from RFC 3709 logotype extension
- *   when present.
+ *   { svg, evidenceDocument } — `svg` pulled from the RFC 3709
+ *   logotype extension when present, `evidenceDocument` echoed from the
+ *   operator-supplied opts.evidenceDocument.
  *
  *   `validateTinyPsSvg` enforces the AuthIndicators-WG Tiny PS subset:
  *   single root <svg>, version="1.2", baseProfile="tiny-ps", viewBox

package/lib/vendor/blamejs/lib/mail-crypto-pgp.js

@@ -57,19 +57,15 @@
  *       to a known operator key rather than trusting any key that
  *       happens to match the signature.
  *
- *   Deferred from v1 (each with the documented condition for opting in):
+ *   Now live (promoted to the stable top-level surface in v0.11.32):
  *     - In-process encrypt + decrypt (Message Encrypted Session Key +
  *       Symmetrically Encrypted Integrity Protected Data packets,
- *       RFC 9580 §5.1 / §5.13) and WKD key discovery (draft-koch-
- *       openpgp-webkey-service). Defer condition: ships in v0.10.14
- *       alongside `b.mail.crypto.smime` sign + verify — the CMS
- *       substrate `b.cms` landed in v0.10.13 unblocked the S/MIME
- *       side, and OpenPGP encrypt rides the same release so the
- *       mail-crypto surface lights up coherently rather than half-
- *       on-each-side across two patches. Cheap escape hatch (pre-
- *       v0.10.14): operators wire a third-party OpenPGP library in
- *       their own consumer code and call this module's sign() /
- *       verify() on the resulting cleartext blob.
+ *       RFC 9580 §5.1 / §5.13) as `b.mail.crypto.pgp.encrypt` /
+ *       `.decrypt`, and WKD key discovery (draft-koch-openpgp-webkey-
+ *       service) as `b.mail.crypto.pgp.wkd` — all on the same `b.cms`
+ *       substrate that backs S/MIME sign/verify.
+ *
+ *   Deferred (with the documented condition for opting in):
  *     - v6 signature packets (RFC 9580 §5.2.3, packet version 6 with
  *       SHA2-512 fingerprints and salted hashes). Defer condition: v6
  *       is not yet emitted by GnuPG 2.4 LTS or by Sequoia stable, so

package/lib/vendor/blamejs/lib/mail-crypto-smime.js

@@ -670,14 +670,15 @@ function _wrapBase64(s) {
  * Operator-side cert preflight that lights up at boot: refuses
  * SHA-1 / MD5 signatures, RSA keys < 2048 bits, MD2 / MD5 / SHA-1
  * as the certificate-signature algorithm. Returns the parsed cert
- * shape (subject CN, issuer CN, validFrom / validTo, key algorithm
- * + size, signature algorithm). Throws `mail-crypto/smime/bad-cert`
- * on any of the above; throws `mail-crypto/smime/expired-cert` if
- * the cert is outside its validity window.
+ * shape: the full subject / issuer DN strings, the validity window,
+ * the signature algorithm (name + OID), the key type, and the SHA-256
+ * fingerprint. Throws `mail-crypto/smime/bad-cert` on any of the above;
+ * throws `mail-crypto/smime/expired-cert` if the cert is outside its
+ * validity window.
  *
  * @example
  *   var info = b.mail.crypto.smime.checkCert({ certPem: pem });
- *   // → { subjectCN, issuerCN, validFrom, validTo, keyAlg, keyBits, sigAlg }
+ *   // → { subject, issuer, validFrom, validTo, sigAlgName, sigAlgOid, keyType, fingerprint256 }
  */
 function checkCert(opts) {
   opts = validateOpts.requireObject(opts, "mail.crypto.smime.checkCert",

package/lib/vendor/blamejs/lib/mail-crypto.js

@@ -22,11 +22,11 @@
  *       (pub-alg 1, EMSA-PKCS1-v1_5 + SHA-256, 2048-bit floor per
  *       RFC 8301).
  *     - `b.mail.crypto.smime` — S/MIME 4.0 per RFC 8551 with CMS
- *       SignedData per RFC 5652. v1 surface: checkCert() — the
- *       operator-side preflight that refuses SHA-1 / MD5 / < 2048-bit
- *       RSA certs at boot. sign() + verify() are DEFERRED in v1; see
- *       the @intro block in lib/mail-crypto-smime.js for the deferral
- *       conditions and the operator escape hatch.
+ *       SignedData per RFC 5652. Surface: sign() + verify() + verifyAll()
+ *       (built on the `b.cms` substrate — digest recompute + timing-safe
+ *       compare + PQC signature verify + X.509 chain walk) plus
+ *       checkCert(), the operator-side preflight that refuses SHA-1 /
+ *       MD5 / < 2048-bit RSA certs at boot.
  *
  *   Both sub-namespaces share `MailCryptoError` (FrameworkError
  *   subclass via defineClass with alwaysPermanent: true) so operator

package/lib/vendor/blamejs/lib/mail-store.js

@@ -90,8 +90,9 @@ var DEFAULT_FOLDERS = Object.freeze([
  * @related   b.safeMime, b.guardMessageId, b.cryptoField
  *
  * Build a mail-store handle. Returns an object with `appendMessage` /
- * `fetchByObjectId` / `queryByModseq` / `setFlags` / `createFolder` /
- * `listFolders` / `threadFor` / `quota` / `setLegalHold` / `destroy`.
+ * `fetchByObjectId` / `search` / `queryByModseq` / `setFlags` /
+ * `createFolder` / `listFolders` / `threadFor` / `quota` /
+ * `moveMessages` / `setLegalHold` / `hardExpunge`.
  *
  * @opts
  *   backend:     object,   // required — sqlite-shaped { prepare(sql) → { run, get, all }, transaction(fn) }

package/lib/vendor/blamejs/lib/mcp.js

@@ -399,10 +399,10 @@ function serverGuard(opts) {
  * exfiltration endpoints. The framework's defense:
  *
  *   - Strip / refuse executable HTML (`<script>` / `<iframe>` /
- *     `javascript:` URLs) — composes b.guardHtml's strict profile
+ *     `javascript:` URLs) via built-in dangerous-HTML detection
  *   - Refuse known prompt-injection markers ("ignore previous
  *     instructions", "system: you are now ...", role-claim prefixes)
- *     — composes b.ai.input.classify
+ *     via a built-in injection-marker matcher
  *   - Cap text length so a tool can't blow the host's context window
  *     out from under it
  *   - Refuse content with `image_url` / `audio_url` / `resource_link`
@@ -418,7 +418,6 @@ function serverGuard(opts) {
  *     posture?:        "refuse" | "sanitize" | "audit-only",  // default "refuse"
  *     maxTextBytes?:   number,    // default 64 KiB per content block
  *     allowedHosts?:   string[],  // for image/audio/resource_link refs
- *     classifyInput?:  fn(text)→{verdict, score} | null,      // default b.ai.input.classify
  *   }
  *
  * @example

package/lib/vendor/blamejs/lib/middleware/age-gate.js

@@ -53,16 +53,20 @@ var AgeGateError = defineClass("AgeGateError", { alwaysPermanent: true });
  * Classifies the request against an operator-supplied age predicate
  * and applies COPPA / UK Children's Code / California AADC defaults
  * (no-store cache, no-referrer, X-Privacy-Posture header) for
- * below-threshold + unknown-age requests. When `requireAge` is set
- * and the request is below threshold without a parental-consent
- * record, refuses with HTTP 451. Every classification decision is
- * audited.
+ * below-threshold + unknown-age requests. `requireAge` is the hard
+ * legal floor: a request classified below threshold without a
+ * parental-consent record is refused with HTTP 451. It is evaluated
+ * within the consent classification, so it takes effect only when
+ * `consentRequired` is also set (that is what classifies a request as
+ * below-threshold); `requireAge` alone, with `consentRequired: null`,
+ * never classifies a request as below-threshold and so the 451 never
+ * fires. Every classification decision is audited.
  *
  * @opts
  *   {
  *     getAge:             function(req): number|null,  // required
- *     requireAge:         number|null,                  // 451 below this
- *     consentRequired:    number|null,                  // require consent below
+ *     requireAge:         number|null,                  // 451 floor; requires consentRequired set
+ *     consentRequired:    number|null,                  // require consent below; enables below-threshold classification
  *     hasParentalConsent: function(req): boolean,
  *     skipPaths:          string[],
  *     errorMessage:       string,

package/lib/vendor/blamejs/lib/middleware/ai-act-disclosure.js

@@ -60,7 +60,7 @@ var audit     = lazyRequire(function () { return require("../audit"); });
  *
  * @opts
  *   {
- *     kind:         "ai-interaction"|"deepfake"|"emotion-recognition"|"biometric-categorisation"|"synthetic-content",
+ *     kind:         "ai-interaction"|"ai-generated-content"|"emotion-recognition"|"biometric-categorisation"|"deep-fake"|"ai-text-public-interest",
  *     deployerName: string,
  *     policyUri:    string,
  *     mode:         "header"|"html",   // default "header"

package/lib/vendor/blamejs/lib/middleware/api-encrypt.js

@@ -250,11 +250,11 @@ function _writeRejection(res, code, body) {
  *
  * @opts
  *   {
- *     keypair:             { publicKey, secretKey, ecPublicKey, ecSecretKey },
+ *     keypair:             { publicKey, privateKey, ecPublicKey, ecPrivateKey },
  *     keypairs:            [...]            // multi-key rotation set; first = active
  *     replayWindowMs:      number,
  *     pruneIntervalMs:     number,
- *     nonceStore:          { has, add, prune },
+ *     nonceStore:          { checkAndInsert, purgeExpired, close },
  *     exemptPaths:         string[],
  *     contentTypes:        string[],         // default ["application/json"]
  *     audit:               boolean,
@@ -270,7 +270,7 @@ function _writeRejection(res, code, body) {
  * @example
  *   var b = require("@blamejs/core");
  *   var app = b.router.create();
- *   var kp = b.crypto.keypair();
+ *   var kp = b.crypto.generateEncryptionKeyPair();
  *   app.use(b.middleware.apiEncrypt({
  *     keypair:        kp,
  *     replayWindowMs: 30000,

package/lib/vendor/blamejs/lib/middleware/compose-pipeline.js

@@ -104,7 +104,7 @@ var CANONICAL_POSITIONS = Object.freeze({
 /**
  * @primitive b.middleware.composePipeline
  * @signature b.middleware.composePipeline(entries, opts?)
- * @since     0.9.44
+ * @since     0.9.43
  * @status    stable
  * @related   b.middleware.requestId, b.middleware.requireAuth, b.middleware.idempotencyKey
  *

package/lib/vendor/blamejs/lib/middleware/csp-nonce.js

@@ -8,7 +8,7 @@
  * browser refuses to execute them. This middleware closes the gap:
  *
  *   1. Generate a fresh random nonce per request (base64, default
- *      16 bytes / 22 chars).
+ *      16 bytes / 24 chars).
  *   2. Attach it to `req.cspNonce` (handler-readable) AND
  *      `res.locals.cspNonce` (template-data-readable — render.js
  *      auto-merges res.locals into template data).
@@ -233,7 +233,7 @@ function _injectNonce(cspHeader, nonce, directives, strictDynamic) {
  * Per-request CSP nonce + render integration. Constructed via
  * `b.middleware.cspNonce(opts)`; the resulting middleware has the
  * `(req, res, next)` shape shown above. Generates a fresh
- * random nonce (16 bytes / 22 chars base64 by default), attaches it
+ * random nonce (16 bytes / 24 chars base64 by default), attaches it
  * to `req.cspNonce` and `res.locals.cspNonce` (auto-merged into
  * template data), and patches the existing Content-Security-Policy
  * header to append `'nonce-XYZ'` to the configured directives

package/lib/vendor/blamejs/lib/middleware/flag-context.js

@@ -34,7 +34,7 @@ var contextMod = lazyRequire(function () { return require("../flag-evaluation-co
  * @primitive b.middleware.flagContext
  * @signature b.middleware.flagContext(opts)
  * @since     0.1.0
- * @related   b.flagClient.getBoolean
+ * @related   b.flag.create
  *
  * Extracts an OpenFeature evaluation context onto `req.flagCtx` so
  * downstream handlers and multiple flag clients read a consistent

package/lib/vendor/blamejs/lib/middleware/require-auth.js

@@ -30,7 +30,8 @@
  *                                   when set, prefersJson()=false rejections
  *                                   produce 302 instead of 401 text/plain)
  *     prefersJson:   function     (optional override; defaults to checking
- *                                   Accept / X-Requested-With / Content-Type)
+ *                                   Accept / X-Requested-With — NOT
+ *                                   Content-Type, see the note above)
  *     errorMessage:  'Authentication required.'
  *     audit:         true         (emit auth.required.denied on reject)
  *   }

package/lib/vendor/blamejs/lib/queue-redis.js

@@ -582,6 +582,15 @@ function create(opts) {
   async function fail(jobId, errorMessage, retryDelayMs) {
     await _ensureConnected();
     var nowMs = Date.now();
+    // b.queue.consume passes the object form `{ retryDelayMs }` (matching
+    // the queue-local backend); accept it as well as a bare-number third
+    // arg. Without this the object failed the `typeof === "number"` test
+    // below and the delay was forced to 0, so the documented exponential
+    // backoff was silently discarded and a failing job re-leased
+    // immediately on the redis backend (retry storm).
+    if (retryDelayMs && typeof retryDelayMs === "object") {
+      retryDelayMs = retryDelayMs.retryDelayMs;
+    }
     if (typeof retryDelayMs !== "number" || !isFinite(retryDelayMs) || retryDelayMs < 0) {
       retryDelayMs = 0;
     }

package/lib/vendor/blamejs/lib/queue.js

@@ -17,6 +17,18 @@
  *   and `nats` are listed as deferred and surface a clear error if
  *   selected.
  *
+ *   `local` and `redis` are driven by the generic `b.queue.consume`
+ *   loop and the lifecycle below (framework-side leasing, deterministic
+ *   backoff, DLQ, and the sweep timer). `sqs` is an SQS-native adapter
+ *   with a different model: `complete` / `fail` delete or re-deliver by
+ *   the message's `receiptHandle` (returned by `lease()`, threaded back
+ *   by the caller), and DLQ + visibility-expiry are handled server-side
+ *   by the SQS queue's RedrivePolicy — so `sqs` is driven directly
+ *   (lease → handle → complete/fail), not by `b.queue.consume`, and it
+ *   does not use the framework DLQ / sweep described below. See
+ *   `lib/queue-sqs.js` for its action map and the features that require
+ *   operator wiring.
+ *
  *   Job lifecycle:
  *     enqueued (status='pending', availableAt set by delaySeconds)
  *       ↓ availableAt reached + consumer leases
@@ -271,7 +283,11 @@ function enqueue(queueName, payload, opts) {
  * through `handler(job, ctx)`. Handler resolution marks the job
  * `done`; rejection bumps the attempt counter and either re-pends
  * with deterministic exponential backoff (1s base, 5min cap, no
- * jitter) or routes to the DLQ when `attempts >= maxAttempts`.
+ * jitter) or routes to the DLQ when `attempts >= maxAttempts`. This
+ * loop drives the `local` and `redis` backends; the `sqs` backend uses
+ * SQS-native receipt-handle complete/fail and server-side redrive and
+ * is driven directly rather than by this consumer (see the module
+ * intro).
  *
  * Returns a consumer state handle whose `.cancel()` aborts the poll
  * loop immediately (without waiting for the next `pollIntervalMs`

package/lib/vendor/blamejs/lib/retry.js

@@ -187,6 +187,10 @@ function _validateBreakerOpts(name, opts) {
     throw new TypeError("retry.CircuitBreaker: successThreshold must be a positive integer, got " +
       typeof opts.successThreshold + " " + JSON.stringify(opts.successThreshold));
   }
+  if (opts.onStateChange != null && typeof opts.onStateChange !== "function") {
+    throw new TypeError("retry.CircuitBreaker: onStateChange must be a function, got " +
+      typeof opts.onStateChange);
+  }
 }
 
 // ---- Public surface ----
@@ -381,6 +385,19 @@ class CircuitBreaker {
     this.consecutiveFailures = 0;
     this.consecutiveSuccesses = 0;
     this.openedAt = 0;
+    this._stateListeners = [];
+    if (typeof merged.onStateChange === "function") this._stateListeners.push(merged.onStateChange);
+  }
+
+  // Register a state-change listener. Called with { name, from, to, at }
+  // on every transition (same payload the constructor's onStateChange
+  // opt receives). Returns this for chaining.
+  onStateChange(handler) {
+    if (typeof handler !== "function") {
+      throw new TypeError("retry.CircuitBreaker.onStateChange: handler must be a function, got " + typeof handler);
+    }
+    this._stateListeners.push(handler);
+    return this;
   }
 
   // Wrap an async function. The breaker observes outcomes and may fail-fast.
@@ -415,7 +432,16 @@ class CircuitBreaker {
   _transition(from, to) {
     if (from === to) return;
     this.state = to;
+    var at = Date.now();
     _emitEvent("breaker.state.change", 1, { name: this.name, from: from, to: to });
+    if (this._stateListeners.length > 0) {
+      var payload = { name: this.name, from: from, to: to, at: at };
+      for (var i = 0; i < this._stateListeners.length; i++) {
+        // Best-effort: a throwing listener must not derail the breaker's
+        // own state machine (the transition has already been applied).
+        try { this._stateListeners[i](payload); } catch (_e) { /* drop-silent */ }
+      }
+    }
   }
 
   _onSuccess() {

package/lib/vendor/blamejs/lib/router.js

@@ -1229,7 +1229,10 @@ function serveStatic(dir) {
     var rel = req.pathname;
     if (rel.includes("\0")) return next();
     var filePath = nodePath.resolve(nodePath.join(root, rel));
-    if (!filePath.startsWith(root)) return next();
+    // Anchor on `root + sep` (not a bare prefix) so a sibling directory
+    // that shares the root's name as a prefix — e.g. root `/srv/public`
+    // vs `/srv/public-evil` — cannot satisfy the containment check.
+    if (filePath !== root && !filePath.startsWith(root + nodePath.sep)) return next();
     if (!nodeFs.existsSync(filePath) || nodeFs.statSync(filePath).isDirectory()) return next();
 
     var ext = nodePath.extname(filePath).toLowerCase();

package/lib/vendor/blamejs/lib/safe-decompress.js

@@ -37,8 +37,9 @@
  *     - Any algorithm not in the allowlist (including operator-typo'd).
  *
  *   Refusal posture:
- *     - `safe-decompress/output-too-large`     — bomb-by-absolute-size
- *       (zlib's own `maxOutputLength` already refuses before alloc)
+ *     - `safe-decompress/decompress-failed`    — bomb-by-absolute-size
+ *       (zlib's own `maxOutputLength` refuses before alloc; the throw is
+ *       caught and surfaced under this code)
  *     - `safe-decompress/ratio-exceeded`       — expansion > `maxRatio`
  *       (zlib accepted the bytes; our post-decompress ratio check
  *       refuses, freeing the bytes immediately)

package/lib/vendor/blamejs/lib/safe-icap.js

@@ -37,8 +37,9 @@
  *       `\r\n`; intermediaries that accept bare-LF then desync against
  *       this parser).
  *     - **Status-code allowlist** — only `100` / `200` / `204` / `400`
- *       / `403` / 5xx are honored. RFC 3507 §4.3.3 enumerates these as
- *       the legal ICAP response codes; an unexpected `1xx` continuation
+ *       / `403` / `404` / `405` / `408` / 5xx are honored. RFC 3507
+ *       §4.3.3 enumerates these as the legal ICAP response codes; an
+ *       unexpected `1xx` continuation
  *       or `3xx` redirect is refused because it's a classic header-
  *       injection class (attacker smuggles `ICAP/1.0 100 X-Inject:`
  *       through a permissive proxy).

package/lib/vendor/blamejs/lib/safe-mime.js

@@ -125,7 +125,7 @@ var DEFAULT_TRANSFER_ENCODINGS = Object.freeze([
  *   maxBodyBytes:             number,     // default 25 MiB
  *   maxMessageBytes:          number,     // default 50 MiB
  *   charsetAllowlist:         string[],   // default UTF-8 / US-ASCII / common legacy 8-bit
- *   transferEncodingAllowlist: string[],  // default 7bit/8bit/binary/qp/base64
+ *   transferEncodingAllowlist: string[],  // default 7bit/8bit/quoted-printable/base64 (binary is opt-in, RFC 3030 BINARYMIME)
  *
  * @example
  *   var msg = b.safeMime.parse(messageBuffer);

package/lib/vendor/blamejs/lib/safe-smtp.js

@@ -61,7 +61,7 @@ var SafeSmtpError = defineClass("SafeSmtpError", { alwaysPermanent: true });
  * @example
  *   var body = Buffer.from("Hello world.\r\n.\r\n");
  *   b.safeSmtp.findDotTerminator(body);
- *   // → 13  (index of \r in \r\n.\r\n)
+ *   // → 12  (index of \r in the terminating \r\n.\r\n)
  *
  *   b.safeSmtp.findDotTerminator(Buffer.from("incomplete body"));
  *   // → -1

package/lib/vendor/blamejs/lib/sec-cyber.js

@@ -32,7 +32,7 @@
  *
  * Public API:
  *
- *   b.secCyber.eightKArtifact(opts) -> { artifact, deadline, audit }
+ *   b.secCyber.eightKArtifact(opts) -> { artifact, deadline, deadlineBusinessDays }
  *     opts:
  *       incidentId:        operator-supplied incident reference (string).
  *       registrant:        { name, cik, filer }