@blamejs/blamejs-shop 0.2.15 → 0.2.17

package/lib/vendor/blamejs/test/layer-0-primitives/cert.test.js

@@ -49,6 +49,30 @@ function _ephemeralVault() {
   };
 }
 
+function _authVault() {
+  // Unlike the XOR _ephemeralVault (which silently produces garbage on a
+  // tampered blob), this unseal THROWS on corruption — mirroring the real
+  // XChaCha20-Poly1305 vault's authenticated decrypt. Needed to exercise
+  // the manager's corrupt-sealed-file recovery path, which keys off an
+  // unseal throw.
+  var key = crypto.randomBytes(32);
+  return {
+    seal: function (buf) {
+      var tag = crypto.createHmac("sha3-512", key).update(buf).digest();
+      return Buffer.concat([tag, Buffer.from(buf)]);
+    },
+    unseal: function (sealed) {
+      var tag = sealed.subarray(0, 64);
+      var body = sealed.subarray(64);
+      var expect = crypto.createHmac("sha3-512", key).update(body).digest();
+      if (tag.length !== expect.length || !crypto.timingSafeEqual(tag, expect)) {
+        throw new Error("vault: authentication tag mismatch");
+      }
+      return Buffer.from(body);
+    },
+  };
+}
+
 async function _selfSignedCert(domains, validityDays) {
   // Generate a parseable self-signed X.509 cert via the vendored
   // @peculiar/x509 bundle. The cert manager only parses cert PEM (to
@@ -529,6 +553,149 @@ function testAcmeBuildCsrRoundtrip() {
 
 // ---- Run ----
 
+// ---- Corrupt-sealed-state recovery (no boot crash loop) ----
+
+async function testCorruptSealedCertReissues() {
+  // A corrupt sealed cert/key is RECOVERABLE state — the CA re-issues. The
+  // manager must treat an unreadable sealed file like an absent one and
+  // re-issue, NOT let a raw unseal/decrypt error escape out of start(): on
+  // a managed restart the same corrupt file is read on every boot, so a
+  // throw here is an unrecoverable crash loop. (Same shape as the
+  // encrypted-DB tmpfs working-copy recovery.)
+  var tmp = _tmpDir();
+  var vault = _authVault();
+  var pem = await _selfSignedCert(["example.com"], 90);
+
+  fs.mkdirSync(path.join(tmp, "main"), { recursive: true });
+  // Cache-fresh cert + meta, so the ONLY reason start() would reach ACME
+  // is the corruption — not expiry.
+  fs.writeFileSync(path.join(tmp, "main", "cert.pem.sealed"), vault.seal(Buffer.from(pem.certPem)));
+  fs.writeFileSync(path.join(tmp, "main", "key.pem.sealed"),  vault.seal(Buffer.from(pem.keyPem)));
+  fs.writeFileSync(path.join(tmp, "main", "meta.json"), JSON.stringify({
+    expiresAt: Date.now() + 90 * 86400000, issuedAt: Date.now(),
+    fingerprintSha256: "ff", subject: "CN=example.com",
+    lastRenewedAt: Date.now(), keyAlg: "ecdsa-p256",
+  }));
+  // Corrupt the sealed cert in place so unseal throws an auth error.
+  var blob = fs.readFileSync(path.join(tmp, "main", "cert.pem.sealed"));
+  blob[blob.length - 1] ^= 0xff;
+  fs.writeFileSync(path.join(tmp, "main", "cert.pem.sealed"), blob);
+
+  var mgr = b.cert.create({
+    storage: { type: "sealed-disk", rootDir: tmp, vault: vault },
+    acme:    { directory: "https://example/", accountKey: "auto" },
+    certs:   [{ name: "main", domains: ["example.com"],
+      challenge: { type: "http-01", provision: async function () {}, cleanup: async function () {} } }],
+    audit: false,
+  });
+
+  var threw = null;
+  try { await mgr.start(); } catch (e) { threw = e; }
+  var msg = (threw && (threw.message || String(threw))) || "";
+  // With no reachable CA the re-issue fails with a NETWORK error — which
+  // proves start() recovered PAST the corrupt file (rather than crashing
+  // on the unseal error before it ever reached the issue path).
+  check("corrupt sealed cert → no raw unseal crash",
+    threw && !/authentication tag|unseal|decrypt|malformed/i.test(msg));
+  check("corrupt sealed cert → routed to ACME re-issue",
+    threw && /dns lookup|EAI_AGAIN|ENOTFOUND|getaddrinfo|failed|fetch/i.test(msg));
+  try { await mgr.stop(); } catch (_e) { /* never started cleanly */ }
+
+  // Corrupt meta.json (derived index) must ALSO route to re-issue, not
+  // throw cert/bad-meta out of start().
+  var tmp2 = _tmpDir();
+  var v2 = _authVault();
+  fs.mkdirSync(path.join(tmp2, "main"), { recursive: true });
+  fs.writeFileSync(path.join(tmp2, "main", "cert.pem.sealed"), v2.seal(Buffer.from(pem.certPem)));
+  fs.writeFileSync(path.join(tmp2, "main", "key.pem.sealed"),  v2.seal(Buffer.from(pem.keyPem)));
+  fs.writeFileSync(path.join(tmp2, "main", "meta.json"), "{ this is not json ");
+  var mgr2 = b.cert.create({
+    storage: { type: "sealed-disk", rootDir: tmp2, vault: v2 },
+    acme:    { directory: "https://example/", accountKey: "auto" },
+    certs:   [{ name: "main", domains: ["example.com"],
+      challenge: { type: "http-01", provision: async function () {}, cleanup: async function () {} } }],
+    audit: false,
+  });
+  var threw2 = null;
+  try { await mgr2.start(); } catch (e) { threw2 = e; }
+  // With a VALID sealed cert present, a corrupt meta.json is advisory:
+  // expiry + fingerprint are re-derived from the cert itself, so start()
+  // loads the cert cleanly — no cert/bad-meta throw, and no needless
+  // re-issue (a corrupt derived index must not force a network round-trip).
+  check("corrupt meta.json → no cert/bad-meta throw",
+    !threw2 || threw2.code !== "cert/bad-meta");
+  check("corrupt meta.json → cert still loads from the sealed cert",
+    !threw2 && mgr2.getContext("main") && typeof mgr2.getContext("main").cert === "string");
+  try { await mgr2.stop(); } catch (_e) {}
+}
+
+async function testStaleMetaDoesNotServeExpiringCert() {
+  // The renewal decision must trust the SEALED cert's own notAfter, not the
+  // plaintext meta.json index. A meta.expiresAt that disagrees with the cert
+  // — drifted, or tampered far-future over an actually-expiring cert — must
+  // NOT let start() short-circuit and serve a cert that is in fact due for
+  // renewal.
+  var tmp = _tmpDir();
+  var vault = _authVault();
+  var pem = await _selfSignedCert(["example.com"], 5);   // real notAfter ~5d out (< 14-day renew window)
+
+  fs.mkdirSync(path.join(tmp, "main"), { recursive: true });
+  fs.writeFileSync(path.join(tmp, "main", "cert.pem.sealed"), vault.seal(Buffer.from(pem.certPem)));
+  fs.writeFileSync(path.join(tmp, "main", "key.pem.sealed"),  vault.seal(Buffer.from(pem.keyPem)));
+  // meta claims a FAR-FUTURE expiry, disagreeing with the real cert.
+  fs.writeFileSync(path.join(tmp, "main", "meta.json"), JSON.stringify({
+    expiresAt: Date.now() + 90 * 86400000, issuedAt: Date.now(),
+    fingerprintSha256: "stale", subject: "CN=example.com",
+    lastRenewedAt: Date.now(), keyAlg: "ecdsa-p256",
+  }));
+
+  var mgr = b.cert.create({
+    storage: { type: "sealed-disk", rootDir: tmp, vault: vault },
+    acme:    { directory: "https://example/", accountKey: "auto" },
+    certs:   [{ name: "main", domains: ["example.com"],
+      challenge: { type: "http-01", provision: async function () {}, cleanup: async function () {} } }],
+    audit: false,
+  });
+  var threw = null;
+  try { await mgr.start(); } catch (e) { threw = e; }
+  var msg = (threw && (threw.message || String(threw))) || "";
+  // The real cert is inside the 14-day renewal window, so start() must
+  // attempt renewal (network-fail here) rather than trusting the stale
+  // far-future meta and serving the expiring cert.
+  check("stale far-future meta does not skip renewal of an expiring cert",
+        threw && /dns lookup|EAI_AGAIN|ENOTFOUND|getaddrinfo|failed|fetch/i.test(msg));
+  try { await mgr.stop(); } catch (_e) {}
+}
+
+async function testCorruptAccountKeyClearError() {
+  // The ACME account key binds order history, so a corrupt one is NOT
+  // auto-regenerated (that would silently abandon the account). It must
+  // fail with an actionable cert/account-key-unreadable error, not a raw
+  // decrypt throw.
+  var tmp = _tmpDir();
+  var vault = _authVault();
+  fs.mkdirSync(path.join(tmp, "account"), { recursive: true });
+  // A well-formed sealed account key, then corrupted so unseal throws.
+  var realJwk = JSON.stringify({ kty: "EC", crv: "P-256", x: "a", y: "b",
+    privatePem: "p", publicPem: "q" });
+  var sealed = vault.seal(Buffer.from(realJwk));
+  sealed[sealed.length - 1] ^= 0xff;
+  fs.writeFileSync(path.join(tmp, "account", "jwk.json.sealed"), sealed);
+
+  var mgr = b.cert.create({
+    storage: { type: "sealed-disk", rootDir: tmp, vault: vault },
+    acme:    { directory: "https://example/", accountKey: "auto" },
+    certs:   [{ name: "main", domains: ["example.com"],
+      challenge: { type: "http-01", provision: async function () {}, cleanup: async function () {} } }],
+    audit: false,
+  });
+  var threw = null;
+  try { await mgr.start(); } catch (e) { threw = e; }
+  check("corrupt account key → actionable cert/account-key-unreadable",
+    threw && threw.code === "cert/account-key-unreadable");
+  try { await mgr.stop(); } catch (_e) {}
+}
+
 async function run() {
   testSurface();
   testFactoryRefusesBadOpts();
@@ -538,6 +705,9 @@ async function run() {
   await testRefreshForcesIssue();
   await testKeyEscrow();
   testAcmeBuildCsrRoundtrip();
+  await testCorruptSealedCertReissues();
+  await testStaleMetaDoesNotServeExpiringCert();
+  await testCorruptAccountKeyClearError();
 }
 
 module.exports = { run: run };

package/lib/vendor/blamejs/test/layer-0-primitives/cluster-storage.test.js

@@ -0,0 +1,125 @@
+"use strict";
+/**
+ * cluster-storage — cluster-aware framework-state SQL dispatch.
+ *
+ * Focus: the transaction() primitive (added v0.13.38) — atomic commit,
+ * rollback-on-throw, and single-node serialization so a concurrent
+ * execute() can't interleave a statement into an open transaction on the
+ * shared SQLite connection.
+ *
+ * Run standalone: `node test/layer-0-primitives/cluster-storage.test.js`
+ * Or via smoke:   `node test/smoke.js`
+ */
+
+var fs      = require("node:fs");
+var os      = require("node:os");
+var path    = require("node:path");
+var helpers = require("../helpers");
+var b       = helpers.b;
+var check   = helpers.check;
+var setupTestDb    = helpers.setupTestDb;
+var teardownTestDb = helpers.teardownTestDb;
+
+var SCHEMA = [{ name: "cs_tx_t", columns: { k: "TEXT PRIMARY KEY", v: "INTEGER" } }];
+
+function testSurface() {
+  check("clusterStorage namespace",      typeof b.clusterStorage === "object");
+  check("clusterStorage.transaction fn", typeof b.clusterStorage.transaction === "function");
+}
+
+async function testTransactionCommits() {
+  var tmp = fs.mkdtempSync(path.join(os.tmpdir(), "cs-tx-commit-"));
+  try {
+    await setupTestDb(tmp, SCHEMA);
+    var cs = b.clusterStorage;
+    await cs.transaction(async function (tx) {
+      await tx.execute("INSERT INTO cs_tx_t (k, v) VALUES (?, ?)", ["a", 1]);
+      await tx.execute("INSERT INTO cs_tx_t (k, v) VALUES (?, ?)", ["b", 2]);
+      var seen = await tx.executeOne("SELECT COUNT(*) AS n FROM cs_tx_t");
+      check("tx: rows visible inside the transaction", seen.n === 2);
+    });
+    var after = await cs.executeOne("SELECT COUNT(*) AS n FROM cs_tx_t");
+    check("tx: commit persisted both rows", after.n === 2);
+  } finally {
+    b.db._resetForTest();
+    await teardownTestDb(tmp);
+  }
+}
+
+async function testTransactionRollsBackOnThrow() {
+  var tmp = fs.mkdtempSync(path.join(os.tmpdir(), "cs-tx-rollback-"));
+  try {
+    await setupTestDb(tmp, SCHEMA);
+    var cs = b.clusterStorage;
+    await cs.execute("INSERT INTO cs_tx_t (k, v) VALUES (?, ?)", ["keep", 1]);
+    var threw = null;
+    try {
+      await cs.transaction(async function (tx) {
+        await tx.execute("INSERT INTO cs_tx_t (k, v) VALUES (?, ?)", ["gone", 2]);
+        throw new Error("boom");
+      });
+    } catch (e) { threw = e; }
+    check("tx: throw propagates to caller",       threw && threw.message === "boom");
+    var rows = await cs.executeAll("SELECT k FROM cs_tx_t ORDER BY k");
+    check("tx: rolled-back row absent",            rows.length === 1 && rows[0].k === "keep");
+  } finally {
+    b.db._resetForTest();
+    await teardownTestDb(tmp);
+  }
+}
+
+async function testTransactionSerializesExecute() {
+  // A concurrent execute() must NOT interleave a statement into an open
+  // single-node transaction on the shared connection — it waits until the
+  // transaction commits.
+  var tmp = fs.mkdtempSync(path.join(os.tmpdir(), "cs-tx-serial-"));
+  try {
+    await setupTestDb(tmp, SCHEMA);
+    var cs = b.clusterStorage;
+    var order = [];
+    var txP = cs.transaction(async function (tx) {
+      order.push("tx-begin");
+      await tx.execute("INSERT INTO cs_tx_t (k, v) VALUES (?, ?)", ["d", 4]);
+      await helpers.passiveObserve(40, "cluster-storage tx: hold the transaction open");
+      order.push("tx-end");
+    });
+    var exP = cs.execute("INSERT INTO cs_tx_t (k, v) VALUES (?, ?)", ["e", 5])
+      .then(function () { order.push("exec-done"); });
+    await Promise.all([txP, exP]);
+    check("tx: concurrent execute waited for commit (no mid-tx interleave)",
+          order.join(",") === "tx-begin,tx-end,exec-done");
+    var n = await cs.executeOne("SELECT COUNT(*) AS n FROM cs_tx_t");
+    check("tx: both writes landed", n.n === 2);
+  } finally {
+    b.db._resetForTest();
+    await teardownTestDb(tmp);
+  }
+}
+
+async function testTransactionRejectsBadArg() {
+  var threw = null;
+  try { await b.clusterStorage.transaction("not-a-fn"); } catch (e) { threw = e; }
+  check("tx: non-function arg rejected", threw && threw.code === "cluster-storage/bad-arg");
+}
+
+async function run() {
+  testSurface();
+  await testTransactionCommits();
+  await testTransactionRollsBackOnThrow();
+  await testTransactionSerializesExecute();
+  await testTransactionRejectsBadArg();
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  run().then(
+    function () { console.log("[cluster-storage] OK — " + helpers.getChecks() + " checks passed"); },
+    // Rethrow rather than console.error(e.stack): this test seeds a vault
+    // passphrase via setupTestDb, and logging the error object trips
+    // CodeQL's clear-text-logging taint (passphrase -> error -> log). The
+    // rethrow lets Node print the uncaught error + stack itself and exit
+    // non-zero, with no logging sink for the taint to reach.
+    function (e) { process.exitCode = 1; throw e; }
+  );
+}

package/lib/vendor/blamejs/test/layer-0-primitives/codebase-patterns.test.js

@@ -6871,8 +6871,17 @@ var KNOWN_ANTIPATTERNS = [
       // shared runSql; re-routing through runInTransaction would change
       // semantics (passing module.exports vs database). Keep as-is.
       "lib/db.js",
+      // clusterStorage.transaction(fn) is the cluster-aware ASYNC
+      // transaction primitive (v0.13.38). dbSchema.runInTransaction is
+      // synchronous (BEGIN -> fn() -> COMMIT) and cannot wrap the async fn
+      // the atomic-RMW callers (cache, dual-control) need. The cluster path
+      // delegates to externalDb.transaction; the single-node path issues
+      // BEGIN/COMMIT/ROLLBACK around an awaited fn with shared-connection
+      // serialization (no other statement may interleave). Same legitimate-
+      // primitive justification as db.js.
+      "lib/cluster-storage.js",
     ],
-    reason: "Extracted to dbSchema.runInTransaction. Replaces the inline BEGIN / COMMIT / ROLLBACK try/catch boilerplate in migrations / seeders / db-schema. Handles both raw better-sqlite3 and b.db framework wrapper handles via runSqlOnHandle.",
+    reason: "Extracted to dbSchema.runInTransaction. Replaces the inline BEGIN / COMMIT / ROLLBACK try/catch boilerplate in migrations / seeders / db-schema. Handles both raw better-sqlite3 and b.db framework wrapper handles via runSqlOnHandle. db.js + cluster-storage.js are allowlisted transaction primitives (sync public + async cluster-aware) that can't route through the sync helper.",
   },
   {
     id: "inline-numeric-bounds-cascade",
@@ -9787,6 +9796,86 @@ function testWikiPortAgreesAcrossArtifacts() {
     bad);
 }
 
+// v0.13.34 — the wiki compose stop_grace_period MUST exceed the app
+// shutdown orchestrator's total grace budget (graceMs) plus the forced-
+// exit watchdog margin. Otherwise `docker stop` / a rolling redeploy
+// SIGKILLs the container before the DB re-encrypt phase finishes, losing
+// every write since the last periodic flush — the encrypted-DB data-loss
+// class. Cross-artifact guard so raising graceMs in lib/app-shutdown.js
+// without bumping the compose (or dropping the setting) can't silently
+// reopen the hole.
+function testWikiStopGraceExceedsShutdownBudget() {
+  var bad = [];
+  var shutdownSrc;
+  try { shutdownSrc = fs.readFileSync("lib/app-shutdown.js", "utf8"); }
+  catch (_e) { return; }
+  var graceM  = /DEFAULT_GRACE_MS\s*=\s*C\.TIME\.seconds\((\d+)\)/.exec(shutdownSrc);
+  if (!graceM) return;
+  var marginM = /FORCE_EXIT_MARGIN_MS\s*=\s*C\.TIME\.seconds\((\d+)\)/.exec(shutdownSrc);
+  var graceS  = parseInt(graceM[1], 10);
+  var marginS = marginM ? parseInt(marginM[1], 10) : 0;
+  var minGrace = graceS + marginS;
+  var composeFiles = ["examples/wiki/docker-compose.yml", "examples/wiki/docker-compose.prod.yml"];
+  for (var i = 0; i < composeFiles.length; i += 1) {
+    var cf = composeFiles[i];
+    var text;
+    try { text = fs.readFileSync(cf, "utf8"); }
+    catch (_e) { continue; }
+    var m = /stop_grace_period:\s*'?(\d+)\s*s'?/.exec(text);
+    if (!m) {
+      bad.push({ file: cf, line: 1,
+        content: cf + " declares no stop_grace_period — Docker's 10s default SIGKILLs before " +
+                 "the " + graceS + "s shutdown budget finishes the DB re-encrypt. Set " +
+                 "stop_grace_period to at least " + minGrace + "s." });
+      continue;
+    }
+    var graceSet = parseInt(m[1], 10);
+    if (graceSet < minGrace) {
+      bad.push({ file: cf, line: 1,
+        content: cf + " stop_grace_period is " + graceSet + "s but the shutdown budget (graceMs " +
+                 graceS + "s + watchdog margin " + marginS + "s) needs at least " + minGrace +
+                 "s, or the DB re-encrypt is SIGKILLed mid-flush." });
+    }
+  }
+  bad = _filterMarkers(bad, "wiki-stop-grace-below-shutdown-budget");
+  _report("wiki compose stop_grace_period exceeds the app shutdown grace budget " +
+          "(v0.13.34 — no SIGKILL-before-DB-re-encrypt data loss on docker stop / redeploy)",
+    bad);
+}
+
+// v0.13.41 — the agent-orchestrator registry-read paths (_list / _lookup)
+// MUST consult the tenant gate (_tenantAllows) so an actor can't enumerate
+// or acquire a handle to another tenant's agent when tenant scoping is on.
+// agent-event-bus enforces this on subscribe/delivery; the orchestrator now
+// mirrors it. Encoded so a refactor can't silently drop the gate from
+// either read path.
+function testOrchestratorRegistryReadsTenantScoped() {
+  var bad = [];
+  var src;
+  try { src = fs.readFileSync("lib/agent-orchestrator.js", "utf8"); }
+  catch (_e) { return; }
+  ["_list", "_lookup"].forEach(function (fn) {
+    var start = src.indexOf("function " + fn + "(");
+    if (start === -1) {
+      bad.push({ file: "lib/agent-orchestrator.js", line: 1,
+        content: fn + " not found — tenant-scope detector can't verify it" });
+      return;
+    }
+    // Body = from this function to the next top-level function declaration.
+    var rest = src.slice(start + 1);
+    var next = rest.search(/\nasync function |\nfunction /);
+    var body = next === -1 ? rest : rest.slice(0, next);
+    if (body.indexOf("_tenantAllows") === -1) {
+      bad.push({ file: "lib/agent-orchestrator.js", line: 1,
+        content: fn + " does not consult _tenantAllows — registry reads must be tenant-scoped " +
+                 "(cross-tenant enumeration / handle acquisition leak)" });
+    }
+  });
+  bad = _filterMarkers(bad, "orchestrator-registry-tenant-scope");
+  _report("agent-orchestrator _list/_lookup consult the tenant gate " +
+          "(v0.13.41 — no cross-tenant registry enumeration / handle acquisition)", bad);
+}
+
 // v0.13.19 — a CI job that runs the long test suites (smoke / wiki
 // e2e) MUST declare `timeout-minutes`. Without it a hung child (a
 // leaked timer / socket / fs.watch handle — the macOS smoke-hang
@@ -10372,6 +10461,8 @@ async function run() {
   // WIKI_PORT default must match the release-container.yml smoke
   // step's port mapping + curl host.
   testWikiPortAgreesAcrossArtifacts();
+  testWikiStopGraceExceedsShutdownBudget();
+  testOrchestratorRegistryReadsTenantScoped();
   // v0.13.19 CI hang backstop: every workflow job that runs the test
   // suite must declare timeout-minutes so a hung child can't ride
   // GitHub's 6-hour default.

package/lib/vendor/blamejs/test/layer-0-primitives/dual-control.test.js

@@ -83,6 +83,38 @@ async function run() {
   });
   check("approve: revoked grant rejected",   revokedApprove.error === "grant-revoked");
 
+  // ---- Concurrency: the quorum-bypass + double-consume races ----
+  // The get/set version read a snapshot, mutated, and wrote back with an
+  // await in between, so two concurrent operations could each act on stale
+  // state. cache.update makes the read-modify-write atomic. These pin the
+  // invariants that broke before.
+  var reqC = await approvals.request({ action: "<test>.concurrent", requestedBy: { id: "alice" } });
+
+  // (a) The SAME approver firing two approvals in parallel must count ONCE.
+  // A stale-snapshot double-append would reach the 2-of-2 quorum with one
+  // human — the dual-control bypass.
+  var dupResults = await Promise.all([
+    approvals.approve({ grantId: reqC.grantId, approver: { id: "bob" } }),
+    approvals.approve({ grantId: reqC.grantId, approver: { id: "bob" } }),
+  ]);
+  var stC = await approvals.status(reqC.grantId);
+  check("concurrent same-approver: counted once (no quorum bypass)",
+        stC.approvedBy.length === 1 && stC.status === "pending");
+  var okN  = dupResults.filter(function (r) { return !r.error; }).length;
+  var dupN = dupResults.filter(function (r) { return r.error === "already-approved-by-this-actor"; }).length;
+  check("concurrent same-approver: exactly one succeeds, one rejected duplicate",
+        okN === 1 && dupN === 1);
+
+  // (b) Two parallel consumes of a quorum-reached grant: exactly ONE wins
+  // ready:true — never two (single-use).
+  await approvals.approve({ grantId: reqC.grantId, approver: { id: "carol" } });   // 2/2 → approved
+  var consumeResults = await Promise.all([
+    approvals.consume(reqC.grantId),
+    approvals.consume(reqC.grantId),
+  ]);
+  var readyN = consumeResults.filter(function (r) { return r.ready === true; }).length;
+  check("concurrent consume: exactly one ready (no double-consume)", readyN === 1);
+
   // ---- Validation ----
   var threwBadCache = null;
   try { b.dualControl.create({ namespace: "x", cache: {} }); }

package/lib/vendor/blamejs/test/layer-0-primitives/mail-crypto-smime.test.js

@@ -269,8 +269,39 @@ function testSmimeDocBlockCitations() {
 
 // ---- Run ----
 
+// ---- trust-chain leaf is bound to the verified signer key ----
+//
+// _verifyTrustChain must select the chain leaf as the cert whose public
+// key matches signerPublicKey (the key that actually verified the
+// signature) — not chain[0] unconditionally. Otherwise a validly-chained
+// cert for a DIFFERENT identity passes chain validation. _certKeyMatches
+// is that binding decision; a mock { publicKey } is all it touches.
+function testSmimeCertKeyBinding() {
+  var kpA = nodeCrypto.generateKeyPairSync("ec", { namedCurve: "P-256" });
+  var kpB = nodeCrypto.generateKeyPairSync("ec", { namedCurve: "P-256" });
+  var certA = { publicKey: kpA.publicKey };
+  var spkiA = Buffer.from(kpA.publicKey.export({ format: "der", type: "spki" }));
+  check("smime binding: cert matches its own full SPKI key",
+        smime._certKeyMatches(certA, spkiA) === true);
+  // Production form: signerPublicKey is the raw subjectPublicKey (the
+  // uncompressed EC point 0x04||x||y), which is the SPKI's suffix.
+  var jwkA = kpA.publicKey.export({ format: "jwk" });
+  var rawA = Buffer.concat([Buffer.from([0x04]),
+    Buffer.from(jwkA.x, "base64url"), Buffer.from(jwkA.y, "base64url")]);
+  check("smime binding: cert matches its raw subjectPublicKey (suffix)",
+        smime._certKeyMatches(certA, rawA) === true);
+  // The gap this closes: a DIFFERENT key must not match.
+  var spkiB = Buffer.from(kpB.publicKey.export({ format: "der", type: "spki" }));
+  check("smime binding: cert does NOT match a different cert's key",
+        smime._certKeyMatches(certA, spkiB) === false);
+  // Unextractable / absent key → no match (caller fails closed).
+  check("smime binding: unextractable key → no match",
+        smime._certKeyMatches({ publicKey: { export: function () { throw new Error("nope"); } } }, spkiA) === false);
+}
+
 function run() {
   testSmimeSurface();
+  testSmimeCertKeyBinding();
   testSmimeSignVerifyRoundtrip();
   testSmimeVerifyTamperRefused();
   testSmimeVerifyWrongKeyRefused();

package/lib/vendor/blamejs/test/layer-0-primitives/redis-client.test.js

@@ -118,6 +118,20 @@ async function run() {
   var efv = redis._frameToValue(redis._parseFrame(_bytes("-ERR boom\r\n"), 0));
   check("frameToValue: error becomes _redisError marker",
         efv && efv._redisError === true && efv.message === "ERR boom");
+
+  // ---- close()/reconnect leak guard (v0.13.40) ----
+  // After close(), a reconnect timer scheduled during backoff must be
+  // cancelled and _connect() must refuse to re-open — otherwise a post-
+  // close reconnect leaks a fresh socket (and the un-unref'd backoff timer
+  // would hold the event loop alive). We test the closing guard directly:
+  // connect() after close() is a no-op, so no socket is opened. (The timer
+  // is also tracked + unref'd + cleared in close(), mirroring ws-client.)
+  var client = redis.create({ url: "redis://127.0.0.1:1/0" });   // port 1 — nothing listens
+  await client.close();
+  check("redis: closing flag set after close()", client._state().closing === true);
+  try { await client.connect(); } catch (_e) { /* closing guard should prevent any connect attempt */ }
+  check("redis: connect() after close is a no-op (closing guard — no socket opened)",
+        client._state().connected === false);
 }
 
 module.exports = { run: run };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/blamejs-shop",
-  "version": "0.2.15",
+  "version": "0.2.17",
   "description": "Open-source framework built on blamejs. Vendored stack, zero npm runtime deps, PQC-first crypto, security-on by default.",
   "main": "lib/index.js",
   "scripts": {