@blamejs/blamejs-shop 0.2.15 → 0.2.18

package/lib/vendor/blamejs/test/layer-0-primitives/codebase-patterns.test.js

@@ -6871,8 +6871,17 @@ var KNOWN_ANTIPATTERNS = [
       // shared runSql; re-routing through runInTransaction would change
       // semantics (passing module.exports vs database). Keep as-is.
       "lib/db.js",
+      // clusterStorage.transaction(fn) is the cluster-aware ASYNC
+      // transaction primitive (v0.13.38). dbSchema.runInTransaction is
+      // synchronous (BEGIN -> fn() -> COMMIT) and cannot wrap the async fn
+      // the atomic-RMW callers (cache, dual-control) need. The cluster path
+      // delegates to externalDb.transaction; the single-node path issues
+      // BEGIN/COMMIT/ROLLBACK around an awaited fn with shared-connection
+      // serialization (no other statement may interleave). Same legitimate-
+      // primitive justification as db.js.
+      "lib/cluster-storage.js",
     ],
-    reason: "Extracted to dbSchema.runInTransaction. Replaces the inline BEGIN / COMMIT / ROLLBACK try/catch boilerplate in migrations / seeders / db-schema. Handles both raw better-sqlite3 and b.db framework wrapper handles via runSqlOnHandle.",
+    reason: "Extracted to dbSchema.runInTransaction. Replaces the inline BEGIN / COMMIT / ROLLBACK try/catch boilerplate in migrations / seeders / db-schema. Handles both raw better-sqlite3 and b.db framework wrapper handles via runSqlOnHandle. db.js + cluster-storage.js are allowlisted transaction primitives (sync public + async cluster-aware) that can't route through the sync helper.",
   },
   {
     id: "inline-numeric-bounds-cascade",
@@ -9787,6 +9796,86 @@ function testWikiPortAgreesAcrossArtifacts() {
     bad);
 }
 
+// v0.13.34 — the wiki compose stop_grace_period MUST exceed the app
+// shutdown orchestrator's total grace budget (graceMs) plus the forced-
+// exit watchdog margin. Otherwise `docker stop` / a rolling redeploy
+// SIGKILLs the container before the DB re-encrypt phase finishes, losing
+// every write since the last periodic flush — the encrypted-DB data-loss
+// class. Cross-artifact guard so raising graceMs in lib/app-shutdown.js
+// without bumping the compose (or dropping the setting) can't silently
+// reopen the hole.
+function testWikiStopGraceExceedsShutdownBudget() {
+  var bad = [];
+  var shutdownSrc;
+  try { shutdownSrc = fs.readFileSync("lib/app-shutdown.js", "utf8"); }
+  catch (_e) { return; }
+  var graceM  = /DEFAULT_GRACE_MS\s*=\s*C\.TIME\.seconds\((\d+)\)/.exec(shutdownSrc);
+  if (!graceM) return;
+  var marginM = /FORCE_EXIT_MARGIN_MS\s*=\s*C\.TIME\.seconds\((\d+)\)/.exec(shutdownSrc);
+  var graceS  = parseInt(graceM[1], 10);
+  var marginS = marginM ? parseInt(marginM[1], 10) : 0;
+  var minGrace = graceS + marginS;
+  var composeFiles = ["examples/wiki/docker-compose.yml", "examples/wiki/docker-compose.prod.yml"];
+  for (var i = 0; i < composeFiles.length; i += 1) {
+    var cf = composeFiles[i];
+    var text;
+    try { text = fs.readFileSync(cf, "utf8"); }
+    catch (_e) { continue; }
+    var m = /stop_grace_period:\s*'?(\d+)\s*s'?/.exec(text);
+    if (!m) {
+      bad.push({ file: cf, line: 1,
+        content: cf + " declares no stop_grace_period — Docker's 10s default SIGKILLs before " +
+                 "the " + graceS + "s shutdown budget finishes the DB re-encrypt. Set " +
+                 "stop_grace_period to at least " + minGrace + "s." });
+      continue;
+    }
+    var graceSet = parseInt(m[1], 10);
+    if (graceSet < minGrace) {
+      bad.push({ file: cf, line: 1,
+        content: cf + " stop_grace_period is " + graceSet + "s but the shutdown budget (graceMs " +
+                 graceS + "s + watchdog margin " + marginS + "s) needs at least " + minGrace +
+                 "s, or the DB re-encrypt is SIGKILLed mid-flush." });
+    }
+  }
+  bad = _filterMarkers(bad, "wiki-stop-grace-below-shutdown-budget");
+  _report("wiki compose stop_grace_period exceeds the app shutdown grace budget " +
+          "(v0.13.34 — no SIGKILL-before-DB-re-encrypt data loss on docker stop / redeploy)",
+    bad);
+}
+
+// v0.13.41 — the agent-orchestrator registry-read paths (_list / _lookup)
+// MUST consult the tenant gate (_tenantAllows) so an actor can't enumerate
+// or acquire a handle to another tenant's agent when tenant scoping is on.
+// agent-event-bus enforces this on subscribe/delivery; the orchestrator now
+// mirrors it. Encoded so a refactor can't silently drop the gate from
+// either read path.
+function testOrchestratorRegistryReadsTenantScoped() {
+  var bad = [];
+  var src;
+  try { src = fs.readFileSync("lib/agent-orchestrator.js", "utf8"); }
+  catch (_e) { return; }
+  ["_list", "_lookup"].forEach(function (fn) {
+    var start = src.indexOf("function " + fn + "(");
+    if (start === -1) {
+      bad.push({ file: "lib/agent-orchestrator.js", line: 1,
+        content: fn + " not found — tenant-scope detector can't verify it" });
+      return;
+    }
+    // Body = from this function to the next top-level function declaration.
+    var rest = src.slice(start + 1);
+    var next = rest.search(/\nasync function |\nfunction /);
+    var body = next === -1 ? rest : rest.slice(0, next);
+    if (body.indexOf("_tenantAllows") === -1) {
+      bad.push({ file: "lib/agent-orchestrator.js", line: 1,
+        content: fn + " does not consult _tenantAllows — registry reads must be tenant-scoped " +
+                 "(cross-tenant enumeration / handle acquisition leak)" });
+    }
+  });
+  bad = _filterMarkers(bad, "orchestrator-registry-tenant-scope");
+  _report("agent-orchestrator _list/_lookup consult the tenant gate " +
+          "(v0.13.41 — no cross-tenant registry enumeration / handle acquisition)", bad);
+}
+
 // v0.13.19 — a CI job that runs the long test suites (smoke / wiki
 // e2e) MUST declare `timeout-minutes`. Without it a hung child (a
 // leaked timer / socket / fs.watch handle — the macOS smoke-hang
@@ -10372,6 +10461,8 @@ async function run() {
   // WIKI_PORT default must match the release-container.yml smoke
   // step's port mapping + curl host.
   testWikiPortAgreesAcrossArtifacts();
+  testWikiStopGraceExceedsShutdownBudget();
+  testOrchestratorRegistryReadsTenantScoped();
   // v0.13.19 CI hang backstop: every workflow job that runs the test
   // suite must declare timeout-minutes so a hung child can't ride
   // GitHub's 6-hour default.

package/lib/vendor/blamejs/test/layer-0-primitives/dual-control.test.js

@@ -83,6 +83,38 @@ async function run() {
   });
   check("approve: revoked grant rejected",   revokedApprove.error === "grant-revoked");
 
+  // ---- Concurrency: the quorum-bypass + double-consume races ----
+  // The get/set version read a snapshot, mutated, and wrote back with an
+  // await in between, so two concurrent operations could each act on stale
+  // state. cache.update makes the read-modify-write atomic. These pin the
+  // invariants that broke before.
+  var reqC = await approvals.request({ action: "<test>.concurrent", requestedBy: { id: "alice" } });
+
+  // (a) The SAME approver firing two approvals in parallel must count ONCE.
+  // A stale-snapshot double-append would reach the 2-of-2 quorum with one
+  // human — the dual-control bypass.
+  var dupResults = await Promise.all([
+    approvals.approve({ grantId: reqC.grantId, approver: { id: "bob" } }),
+    approvals.approve({ grantId: reqC.grantId, approver: { id: "bob" } }),
+  ]);
+  var stC = await approvals.status(reqC.grantId);
+  check("concurrent same-approver: counted once (no quorum bypass)",
+        stC.approvedBy.length === 1 && stC.status === "pending");
+  var okN  = dupResults.filter(function (r) { return !r.error; }).length;
+  var dupN = dupResults.filter(function (r) { return r.error === "already-approved-by-this-actor"; }).length;
+  check("concurrent same-approver: exactly one succeeds, one rejected duplicate",
+        okN === 1 && dupN === 1);
+
+  // (b) Two parallel consumes of a quorum-reached grant: exactly ONE wins
+  // ready:true — never two (single-use).
+  await approvals.approve({ grantId: reqC.grantId, approver: { id: "carol" } });   // 2/2 → approved
+  var consumeResults = await Promise.all([
+    approvals.consume(reqC.grantId),
+    approvals.consume(reqC.grantId),
+  ]);
+  var readyN = consumeResults.filter(function (r) { return r.ready === true; }).length;
+  check("concurrent consume: exactly one ready (no double-consume)", readyN === 1);
+
   // ---- Validation ----
   var threwBadCache = null;
   try { b.dualControl.create({ namespace: "x", cache: {} }); }

package/lib/vendor/blamejs/test/layer-0-primitives/mail-crypto-smime.test.js

@@ -269,8 +269,39 @@ function testSmimeDocBlockCitations() {
 
 // ---- Run ----
 
+// ---- trust-chain leaf is bound to the verified signer key ----
+//
+// _verifyTrustChain must select the chain leaf as the cert whose public
+// key matches signerPublicKey (the key that actually verified the
+// signature) — not chain[0] unconditionally. Otherwise a validly-chained
+// cert for a DIFFERENT identity passes chain validation. _certKeyMatches
+// is that binding decision; a mock { publicKey } is all it touches.
+function testSmimeCertKeyBinding() {
+  var kpA = nodeCrypto.generateKeyPairSync("ec", { namedCurve: "P-256" });
+  var kpB = nodeCrypto.generateKeyPairSync("ec", { namedCurve: "P-256" });
+  var certA = { publicKey: kpA.publicKey };
+  var spkiA = Buffer.from(kpA.publicKey.export({ format: "der", type: "spki" }));
+  check("smime binding: cert matches its own full SPKI key",
+        smime._certKeyMatches(certA, spkiA) === true);
+  // Production form: signerPublicKey is the raw subjectPublicKey (the
+  // uncompressed EC point 0x04||x||y), which is the SPKI's suffix.
+  var jwkA = kpA.publicKey.export({ format: "jwk" });
+  var rawA = Buffer.concat([Buffer.from([0x04]),
+    Buffer.from(jwkA.x, "base64url"), Buffer.from(jwkA.y, "base64url")]);
+  check("smime binding: cert matches its raw subjectPublicKey (suffix)",
+        smime._certKeyMatches(certA, rawA) === true);
+  // The gap this closes: a DIFFERENT key must not match.
+  var spkiB = Buffer.from(kpB.publicKey.export({ format: "der", type: "spki" }));
+  check("smime binding: cert does NOT match a different cert's key",
+        smime._certKeyMatches(certA, spkiB) === false);
+  // Unextractable / absent key → no match (caller fails closed).
+  check("smime binding: unextractable key → no match",
+        smime._certKeyMatches({ publicKey: { export: function () { throw new Error("nope"); } } }, spkiA) === false);
+}
+
 function run() {
   testSmimeSurface();
+  testSmimeCertKeyBinding();
   testSmimeSignVerifyRoundtrip();
   testSmimeVerifyTamperRefused();
   testSmimeVerifyWrongKeyRefused();

package/lib/vendor/blamejs/test/layer-0-primitives/redis-client.test.js

@@ -118,6 +118,20 @@ async function run() {
   var efv = redis._frameToValue(redis._parseFrame(_bytes("-ERR boom\r\n"), 0));
   check("frameToValue: error becomes _redisError marker",
         efv && efv._redisError === true && efv.message === "ERR boom");
+
+  // ---- close()/reconnect leak guard (v0.13.40) ----
+  // After close(), a reconnect timer scheduled during backoff must be
+  // cancelled and _connect() must refuse to re-open — otherwise a post-
+  // close reconnect leaks a fresh socket (and the un-unref'd backoff timer
+  // would hold the event loop alive). We test the closing guard directly:
+  // connect() after close() is a no-op, so no socket is opened. (The timer
+  // is also tracked + unref'd + cleared in close(), mirroring ws-client.)
+  var client = redis.create({ url: "redis://127.0.0.1:1/0" });   // port 1 — nothing listens
+  await client.close();
+  check("redis: closing flag set after close()", client._state().closing === true);
+  try { await client.connect(); } catch (_e) { /* closing guard should prevent any connect attempt */ }
+  check("redis: connect() after close is a no-op (closing guard — no socket opened)",
+        client._state().connected === false);
 }
 
 module.exports = { run: run };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/blamejs-shop",
-  "version": "0.2.15",
+  "version": "0.2.18",
   "description": "Open-source framework built on blamejs. Vendored stack, zero npm runtime deps, PQC-first crypto, security-on by default.",
   "main": "lib/index.js",
   "scripts": {