@blamejs/blamejs-shop 0.2.2 → 0.2.4

package/lib/vendor/blamejs/lib/network-dnssec.js

@@ -101,7 +101,16 @@ function _canonicalName(name) {
     parts.push(Buffer.from([lab.length]), lab);
   }
   parts.push(Buffer.from([0]));
-  return Buffer.concat(parts);
+  var wire = Buffer.concat(parts);
+  // RFC 1035 §2.3.4 — a domain name is at most 255 octets on the wire.
+  // Enforcing it here also bounds the per-label count (and thus the NSEC3
+  // closest-encloser candidate enumeration, CVE-2023-50868 class), since
+  // each label costs at least 2 octets.
+  if (wire.length > 255) {                                                               // allow:raw-byte-literal — RFC 1035 total-name octet cap
+    throw new DnssecError("dnssec/bad-name",
+      "dnssec: name '" + name + "' encodes to " + wire.length + " octets, exceeds RFC 1035 cap of 255");
+  }
+  return wire;
 }
 
 function _u16(n) { return Buffer.from([(n >> 8) & 0xff, n & 0xff]); }                    // allow:raw-byte-literal — 16-bit big-endian split
@@ -340,7 +349,28 @@ var BASE32HEX = "0123456789ABCDEFGHIJKLMNOPQRSTUV";          // allow:raw-byte-l
 var TYPE_DS = 43;                                            // allow:raw-byte-literal — IANA RR type DS
 var TYPE_CNAME = 5;
 var NSEC3_HASH_SHA1 = 1;                                     // RFC 5155 §5 — the only registered NSEC3 hash
-var DEFAULT_MAX_NSEC3_ITERATIONS = 500;                      // allow:raw-time-literal — DoS ceiling on iterated SHA-1 (RFC 9276 wants 0; deployed zones still use >0)
+var DEFAULT_MAX_NSEC3_ITERATIONS = 150;                      // allow:raw-time-literal — DoS ceiling on iterated SHA-1; matches BIND 9.16.33+/Unbound 1.17.1 post-CVE-2023-50868 (RFC 9276 wants 0; deployed zones still use >0)
+
+// KeyTrap (CVE-2023-50387) amplification caps. A hostile zone can publish
+// many DNSKEYs sharing one 16-bit key tag and many RRSIGs, forcing a
+// validator into O(keys x sigs) full signature verifications from a single
+// query. Bound both factors: the colliding-candidate fan-out per RRSIG, and
+// the total signature-validation work. Matches the BIND
+// `max-key-tag-collisions` + Unbound validation-budget mitigations.
+//
+// The per-response budget SCALES with declared chain depth so a legitimate
+// deep delegation isn't false-rejected: a valid N-link chain does ~2N-1
+// signature verifies (1 root DNSKEY + parent-DS + child-DNSKEY per child),
+// so the budget is links.length * MAX_VALIDATIONS_PER_LINK (= 2 RRSIGs/link
+// x MAX_COLLIDING_KEYS candidates), which always covers the legitimate work
+// while still bounding the bounded-collision amplification. Chain length
+// itself is capped (a delegation can't be deeper than a DNS name's label
+// count, RFC 1035), so the scaled budget can't be inflated arbitrarily.
+var MAX_COLLIDING_KEYS       = 4;                            // allow:raw-byte-literal — same-tag DNSKEY candidates tried per RRSIG
+var MAX_VALIDATIONS_PER_LINK = 8;                            // allow:raw-byte-literal — 2 RRSIGs/link x MAX_COLLIDING_KEYS; budget = links.length x this
+var MAX_CHAIN_LINKS          = 128;                          // allow:raw-byte-literal — max delegation depth (>= RFC 1035 max label count)
+var MAX_DNSKEYS_PER_ZONE     = 64;                           // allow:raw-byte-literal — DNSKEY RRset size cap per zone link
+var MAX_DS_RECORDS           = 16;                           // allow:raw-byte-literal — DS RRset size cap (parent-supplied)
 
 // RFC 4648 §7 base32hex decode (no padding, case-insensitive) — the
 // label encoding of an NSEC3 owner-name hash.
@@ -757,12 +787,31 @@ function _keysByTag(dnskeys, tag) {
 // returning the key that validated. A wrong colliding key yields
 // `dnssec/bad-signature` — that is not terminal, the next candidate is
 // tried; any other error (expired, alg) is terminal. RFC 4035 §5.3.1.
-function _verifyRrsetWithAnyKey(rrsetBase, rrsig, candidates, noKeyCode, noKeyMsg) {
+function _verifyRrsetWithAnyKey(rrsetBase, rrsig, candidates, noKeyCode, noKeyMsg, budget) {
   if (candidates.length === 0) throw new DnssecError(noKeyCode, noKeyMsg);
+  // KeyTrap (CVE-2023-50387): refuse an absurd same-tag fan-out outright —
+  // legitimate zones have 1-2 keys per tag; hundreds is an amplification
+  // attack, not a real collision.
+  if (candidates.length > MAX_COLLIDING_KEYS) {
+    throw new DnssecError("dnssec/too-many-colliding-keys",
+      "dnssec.verifyChain: " + candidates.length + " DNSKEYs share key tag " +
+      rrsig.keyTag + " (cap " + MAX_COLLIDING_KEYS +
+      ") — refused as a KeyTrap (CVE-2023-50387) amplification vector");
+  }
   var lastErr = null;
   for (var i = 0; i < candidates.length; i++) {
     var kp = _dnskeyParts(candidates[i]);
     if (kp.algorithm !== rrsig.algorithm) { lastErr = new DnssecError("dnssec/alg-mismatch", "dnssec.verifyChain: candidate key algorithm does not match the RRSIG"); continue; }
+    // Per-response signature-validation budget — bound the total expensive
+    // pubkey verifies across the whole chain walk, not just per RRSIG.
+    if (budget) {
+      if (budget.remaining <= 0) {
+        throw new DnssecError("dnssec/validation-budget-exceeded",
+          "dnssec.verifyChain: per-response signature-validation budget " +
+          "exhausted — refused as a KeyTrap (CVE-2023-50387) amplification vector");
+      }
+      budget.remaining -= 1;
+    }
     try {
       verifyRrset(Object.assign({}, rrsetBase, { rrsig: rrsig, dnskey: { algorithm: kp.algorithm, publicKey: kp.publicKey } }));
       return candidates[i];
@@ -795,6 +844,20 @@ function _verifyRrsetWithAnyKey(rrsetBase, rrsig, candidates, noKeyCode, noKeyMs
  * passes to <code>verifyRrset</code> / <code>verifyDenial</code> for the
  * actual answer.
  *
+ * KeyTrap (CVE-2023-50387) amplification is bounded with non-configurable
+ * caps: at most 4 same-tag DNSKEY candidates are tried per RRSIG, at most
+ * 64 DNSKEYs per zone link and 16 DS records per delegation are accepted,
+ * the chain is at most 128 links deep, and the whole response is held to a
+ * signature-validation budget that scales with chain depth (so a
+ * legitimate deep delegation always fits while bounded collisions stay
+ * bounded). A hostile zone publishing many colliding keys / signatures is
+ * refused with <code>dnssec/too-many-colliding-keys</code> /
+ * <code>dnssec/too-many-dnskeys</code> / <code>dnssec/too-many-ds</code> /
+ * <code>dnssec/too-many-links</code> /
+ * <code>dnssec/validation-budget-exceeded</code> rather than driving
+ * O(keys x sigs) verifications. (NSEC3 iteration counts are separately
+ * capped at 150 per RFC 9276 / the CVE-2023-50868 fix.)
+ *
  * @opts
  *   {
  *     links: [ {                        // ordered root-first
@@ -816,14 +879,35 @@ function verifyChain(opts) {
   validateOpts.requireObject(opts, "dnssec.verifyChain", DnssecError);
   validateOpts(opts, ["links", "trustAnchors", "at"], "dnssec.verifyChain");
   if (!Array.isArray(opts.links) || opts.links.length === 0) throw new DnssecError("dnssec/bad-arg", "dnssec.verifyChain: opts.links must be a non-empty array");
+  // Cap delegation depth — a real chain can't be deeper than a DNS name's
+  // label count (RFC 1035), and the per-response validation budget below
+  // scales with this, so it must be bounded.
+  if (opts.links.length > MAX_CHAIN_LINKS) {
+    throw new DnssecError("dnssec/too-many-links",
+      "dnssec.verifyChain: " + opts.links.length + " chain links (cap " +
+      MAX_CHAIN_LINKS + ") — refused as an amplification vector");
+  }
   var anchors = opts.trustAnchors !== undefined ? opts.trustAnchors : DEFAULT_ROOT_ANCHORS;
   if (!Array.isArray(anchors) || anchors.length === 0) throw new DnssecError("dnssec/bad-arg", "dnssec.verifyChain: opts.trustAnchors must be a non-empty array");
 
+  // KeyTrap budget shared across every signature-validation in this
+  // response, scaled to the declared chain depth so a legitimate deep
+  // delegation (2N-1 verifies) always fits while bounded collisions stay
+  // bounded. Chain length is capped above, so this can't be inflated.
+  var budget = { remaining: opts.links.length * MAX_VALIDATIONS_PER_LINK };
+
   var trustedKeys = null, path = [];
   for (var i = 0; i < opts.links.length; i++) {
     var link = opts.links[i];
     if (!link || typeof link.zone !== "string" || link.zone === "") throw new DnssecError("dnssec/bad-link", "dnssec.verifyChain: links[" + i + "].zone is required");
     if (!Array.isArray(link.dnskeys) || link.dnskeys.length === 0) throw new DnssecError("dnssec/bad-link", "dnssec.verifyChain: links[" + i + "].dnskeys must be a non-empty array");
+    // KeyTrap: bound the DNSKEY RRset size per zone so a giant key set
+    // can't blow up the key-tag scan / candidate fan-out.
+    if (link.dnskeys.length > MAX_DNSKEYS_PER_ZONE) {
+      throw new DnssecError("dnssec/too-many-dnskeys",
+        "dnssec.verifyChain: links[" + i + "] has " + link.dnskeys.length +
+        " DNSKEYs (cap " + MAX_DNSKEYS_PER_ZONE + ") — refused as a KeyTrap (CVE-2023-50387) amplification vector");
+    }
     if (!link.dnskeyRrsig || typeof link.dnskeyRrsig !== "object") throw new DnssecError("dnssec/bad-link", "dnssec.verifyChain: links[" + i + "].dnskeyRrsig is required");
 
     // 1. The DNSKEY RRset is self-signed by one of its own keys (trying
@@ -832,7 +916,8 @@ function verifyChain(opts) {
       { name: link.zone, type: "DNSKEY", rdatas: link.dnskeys, at: opts.at },
       link.dnskeyRrsig,
       _keysByTag(link.dnskeys, link.dnskeyRrsig.keyTag),
-      "dnssec/chain-no-signing-key", "dnssec.verifyChain: no DNSKEY in '" + link.zone + "' verifies the DNSKEY RRSIG"
+      "dnssec/chain-no-signing-key", "dnssec.verifyChain: no DNSKEY in '" + link.zone + "' verifies the DNSKEY RRSIG",
+      budget
     );
 
     // 2. Establish trust in the signing key.
@@ -851,11 +936,19 @@ function verifyChain(opts) {
       if (!Array.isArray(link.dsRdatas) || link.dsRdatas.length === 0 || !link.dsRrsig || typeof link.dsRrsig !== "object") {
         throw new DnssecError("dnssec/bad-link", "dnssec.verifyChain: links[" + i + "] needs dsRdatas + dsRrsig (DS served by the parent)");
       }
+      // Bound the parent-supplied DS RRset — the DS-match loop below
+      // iterates it, and an oversize set is an amplification vector.
+      if (link.dsRdatas.length > MAX_DS_RECORDS) {
+        throw new DnssecError("dnssec/too-many-ds",
+          "dnssec.verifyChain: links[" + i + "] has " + link.dsRdatas.length +
+          " DS records (cap " + MAX_DS_RECORDS + ") — refused as an amplification vector");
+      }
       _verifyRrsetWithAnyKey(
         { name: link.zone, type: "DS", rdatas: link.dsRdatas, at: opts.at },
         link.dsRrsig,
         _keysByTag(trustedKeys, link.dsRrsig.keyTag),
-        "dnssec/chain-no-parent-key", "dnssec.verifyChain: no trusted parent key verifies the DS RRSIG for '" + link.zone + "'"
+        "dnssec/chain-no-parent-key", "dnssec.verifyChain: no trusted parent key verifies the DS RRSIG for '" + link.zone + "'",
+        budget
       );
       var dsMatched = false;
       for (var d = 0; d < link.dsRdatas.length; d++) {

package/lib/vendor/blamejs/lib/parsers/safe-toml.js

@@ -681,6 +681,14 @@ function parse(input, opts) {
               "toml/redefine");
           }
           t = sub[sub.length - 1];
+          // The array's last element must itself be a table to descend
+          // into. A plain VALUE array (e.g. `a = [3]` then `[a.s]`) has a
+          // scalar last element — descending would set a property on a
+          // number and throw a raw TypeError; refuse it cleanly instead.
+          if (t === null || typeof t !== "object" || Array.isArray(t)) {
+            throw _err("cannot descend into '" + seg +
+              "' — it is a value array, not an array of tables", "toml/redefine");
+          }
           continue;
         }
         if (typeof sub !== "object" || sub === null) {

package/lib/vendor/blamejs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.13.13",
+  "version": "0.13.16",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/lib/vendor/blamejs/release-notes/v0.13.14.json

@@ -0,0 +1,22 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.13.14",
+  "date": "2026-05-27",
+  "headline": "DNSSEC chain validation now bounds KeyTrap (CVE-2023-50387) amplification with hard caps",
+  "summary": "b.network.dns.dnssec.verifyChain tried every DNSKEY whose 16-bit key tag matched an RRSIG, with no cap on how many candidates or total signature verifications a single response could drive. A hostile zone publishing many DNSKEYs sharing one key tag (plus matching RRSIGs) could force O(keys x signatures) full public-key verifications from one query — the KeyTrap denial-of-service (CVE-2023-50387). Validation is now bounded by non-configurable caps that match the BIND / Unbound mitigations: at most 4 same-tag candidate keys are tried per RRSIG, at most 64 DNSKEYs per zone link and 16 DS records per delegation are accepted, the chain is at most 128 links deep, and the whole response is held to a signature-validation budget that scales with chain depth (so a legitimate deep delegation is never false-rejected while bounded collisions stay bounded); exceeding any of these refuses the response rather than performing the work. Separately, a domain name that encodes to more than 255 octets is now refused at canonicalization (RFC 1035 §2.3.4), which also bounds the NSEC3 closest-encloser label enumeration, and the NSEC3 iteration ceiling is lowered from 500 to 150 to match the BIND 9.16.33+ / Unbound 1.17.1 fix for the sibling CVE-2023-50868.",
+  "sections": [
+    {
+      "heading": "Security",
+      "items": [
+        {
+          "title": "`verifyChain` caps colliding-key fan-out and total signature validations (KeyTrap / CVE-2023-50387)",
+          "body": "A zone advertising many same-key-tag DNSKEYs and RRSIGs can no longer drive unbounded public-key verifications. New refusals: `dnssec/too-many-colliding-keys` (>4 same-tag candidates per RRSIG), `dnssec/too-many-dnskeys` (>64 DNSKEYs per zone link), `dnssec/too-many-ds` (>16 DS records per delegation), `dnssec/too-many-links` (chain deeper than 128), and `dnssec/validation-budget-exceeded` (signature validations beyond the depth-scaled budget). The caps are intentionally non-configurable — they sit well above any legitimate zone, and the budget scales with chain depth so deep delegations validate normally."
+        },
+        {
+          "title": "Domain-name octet cap + lower NSEC3 iteration ceiling",
+          "body": "A name that canonicalizes to more than 255 octets is refused (`dnssec/bad-name`, RFC 1035 §2.3.4), which bounds the per-label NSEC3 closest-encloser enumeration (CVE-2023-50868 class). The default NSEC3 iteration ceiling drops from 500 to 150, matching the BIND 9.16.33+ / Unbound 1.17.1 post-CVE defaults (RFC 9276 recommends 0)."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/release-notes/v0.13.15.json

@@ -0,0 +1,27 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.13.15",
+  "date": "2026-05-27",
+  "headline": "Corrected more source citations and made deferred/reserved options honest in their docs",
+  "summary": "A second accuracy pass over source threat-annotations and option docs. Three citation corrections: the base64url strict-decode guard cited CVE-2022-0235 (which is actually a node-fetch cookie-leak, unrelated) — it now names the weakness class it defends (CWE-347 / CWE-1286 signature canonicalization); the glob consecutive-wildcard ReDoS cap cited the wrong library (the CVE-2026-26996 ReDoS is minimatch, not picomatch — the adjacent picomatch one is CVE-2026-33671); and CVE-2026-32178 is reframed to the CWE-138 header-injection-spoofing class the public record actually documents (and dropped from the end-of-data SMTP-smuggling list, which is a different class). Several options/statuses are now honest about not-yet-implemented surface: b.archive.read.zip.fromTrustedStream is marked experimental (its methods throw and its options aren't honored yet — the example now shows the supported buffer-then-random-access path); b.acme revokeCert's useCertKey / certPrivateKey are marked reserved (the cert-key path throws; account-key signing is the supported default); and a stale message claiming passkey break-glass factors were a future feature is removed (passkeys are a live allowed factor). No runtime behaviour changes beyond message/doc text.",
+  "sections": [
+    {
+      "heading": "Fixed",
+      "items": [
+        {
+          "title": "Corrected misattributed CVE citations in source threat-annotations",
+          "body": "`b.crypto.fromBase64Url`'s strict-decode guard cited CVE-2022-0235 (a node-fetch header-leak, unrelated to base64/JWT decoding); it now cites the weakness class it actually defends — CWE-347 / CWE-1286 signature canonicalization. `b.guardRegex`'s consecutive-`*` cap attributed CVE-2026-26996 to picomatch; that ReDoS is in minimatch (the picomatch ReDoS it also defends is CVE-2026-33671) — the library name is corrected. CVE-2026-32178 is reframed to the CWE-138 header-injection spoofing class the public advisory documents, and removed from the end-of-data SMTP-smuggling trio (a distinct class). No behaviour change — the defenses are unchanged."
+        }
+      ]
+    },
+    {
+      "heading": "Changed",
+      "items": [
+        {
+          "title": "Deferred / reserved surface now documented honestly",
+          "body": "`b.archive.read.zip.fromTrustedStream` is marked `experimental` — its `inspect`/`entries`/`extract` throw and its `bombPolicy`/`audit` options aren't honored yet; the documented example now shows the supported path (buffer the stream, then use the random-access reader). `b.acme` `revokeCert`'s `useCertKey` / `certPrivateKey` options are marked reserved (the cert-key-signed-revocation path throws; account-key signing, the default, covers mainstream CAs). A `b.breakGlass` policy error and comment that called passkey factors a future feature are corrected — passkeys are a live allowed factor."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/release-notes/v0.13.16.json

@@ -0,0 +1,27 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.13.16",
+  "date": "2026-05-27",
+  "headline": "`b.mail.agent` docs now describe the facade accurately, and not-yet-wired verbs point to the primitive to use",
+  "summary": "b.mail.agent's module documentation claimed it was \"the standardization contract for every mail protocol\" that JMAP / IMAP / POP3 all route through — but no protocol server actually dispatches through the agent (the framework's own JMAP EmailSubmission handler composes b.mail.send.deliver directly), and the compose / send / reply / forward, sieve.list / sieve.activate, identity / vacation / mdn.* and export / job / import verbs throw mail-agent/not-implemented. The docs are corrected to describe what the agent is: a mailbox-access facade (RBAC + posture + audit + dispatch around a mail store) whose read surface plus the mailbox-mutation and Sieve-upload methods are wired, with the remaining verbs not yet routed through it. Those verbs' error message now names the underlying primitive to compose directly (b.mail.send.deliver, b.mail.sieve, b.mailMdn, …) instead of citing a version tag that had long passed. The public WIRED_AT export (a method→version map that no longer reflected reality) is replaced by COMPOSE_HINT (a method→primitive-to-compose map). No behaviour change: the same methods are wired or throw exactly as before.",
+  "sections": [
+    {
+      "heading": "Changed",
+      "items": [
+        {
+          "title": "`b.mail.agent` documentation corrected; not-implemented errors point to the primitive to compose",
+          "body": "The `@module` / `@card` no longer claim the agent is the universal protocol-dispatch contract — it's documented as a mailbox-access facade with a wired read + mutation + Sieve-upload surface, and the compose/send/identity/vacation/MDN/export verbs documented as not yet routed through it (compose the underlying primitive directly until a protocol server adopts the agent). The `mail-agent/not-implemented` error now names that primitive (e.g. `b.mail.send.deliver`) rather than a passed version tag."
+        }
+      ]
+    },
+    {
+      "heading": "Removed",
+      "items": [
+        {
+          "title": "`b.mail.agent.WIRED_AT` export replaced by `COMPOSE_HINT`",
+          "body": "The `WIRED_AT` export mapped each method to a framework version that was supposed to \"light it up\" — versions that have all shipped without the wiring, so the map was misleading. It is replaced by `COMPOSE_HINT`, mapping each not-yet-wired method to the primitive an operator composes directly. Operators reading `b.mail.agent.WIRED_AT` should read `b.mail.agent.COMPOSE_HINT` instead (pre-1.0: no compatibility shim)."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/test/00-primitives.js

@@ -13545,6 +13545,15 @@ function testTomlSecurityRejections() {
   catch (e) { threwRedefine = e.code === "toml/redefine"; }
   check("toml: table redefinition rejected",       threwRedefine);
 
+  // Table header descending through a VALUE array (not an array-of-tables)
+  // — `a = [3]` then `[a.s]` walks into the array's scalar element. A fuzz
+  // input hit this; it must refuse cleanly, not throw a raw TypeError.
+  var threwValueArrayDescend = null;
+  try { b.parsers.toml.parse("a = [3]\n[a.s]\n"); }
+  catch (e) { threwValueArrayDescend = e.code; }
+  check("toml: table header descending into a value array rejected cleanly",
+        threwValueArrayDescend === "toml/redefine");
+
   // Size cap
   var threwSize = false;
   try { b.parsers.toml.parse("a = \"" + "x".repeat(2000) + "\"", { maxBytes: 1000 }); }

package/lib/vendor/blamejs/test/layer-0-primitives/codebase-patterns.test.js

@@ -541,23 +541,19 @@ var STALE_DEFER_ALLOWLIST = {
   // operator-feeds-metadata escape hatch. Defer-with-condition.
   "lib/ai-content-detect.js": ["IPTC PhotoMetadata reader lands in v0.10.9"],
   // GAP BACKLOG (being worked down — these are real overdue items):
-  //   archive-read ZIP64 read + fromTrustedStream (promised v0.12.8) — building.
+  //   archive-read ZIP64 read (promised v0.12.8) — building. (The
+  //   fromTrustedStream defer was reworded to a version-free "not
+  //   implemented / re-opens when needed" in v0.13.15, so it no longer
+  //   needs an allowlist entry.)
   "lib/archive-read.js": [
     "not supported in v0.12.7. Will land",
     "switch to tar — lands v0.12.8",
     "carries ZIP64 sentinel sizes (not supported in v0.12.7)",
-    "deferred to v0.12.8 alongside the tar reader",
-    "fromTrustedStream.inspect() is deferred to v0.12.8",
-    "fromTrustedStream.entries() is deferred to v0.12.8",
-    "fromTrustedStream.extract() is deferred to v0.12.8",
   ],
   "lib/safe-archive.js": [
     "tar lands v0.12.8, gz v0.12.9",
     "fromTrustedStream` is deferred to v0.12.8",
   ],
-  // STALE comments (feature shipped; phrased as future) — correcting to past
-  // tense as the backlog is worked; allowlisted until then.
-  "lib/break-glass.js": ["passkey lands in v0.5.2"],
 };
 
 function testNoStaleDefers() {

package/lib/vendor/blamejs/test/layer-0-primitives/dnssec.test.js

@@ -390,12 +390,106 @@ function testKeyTagCollision() {
   check("verifyChain: validates despite a colliding-tag key in the signed set", out.ok === true);
 }
 
+// Sign a DS RRset (type 43) with a parent EC key — mirrors
+// _signDnskeyRrset but for the DS record type.
+function _signDsRrset(zone, dsRdatas, parentPriv, parentSignerRdata, inc, exp) {
+  var owner = _canonName(zone), ttl = _u32b(3600);
+  var labels = zone.replace(/\.$/, "") === "" ? 0 : zone.replace(/\.$/, "").split(".").length;
+  var keyTag = b.network.dns.dnssec.keyTag(parentSignerRdata);
+  var sorted = dsRdatas.slice().sort(Buffer.compare);
+  var rrs = [];
+  sorted.forEach(function (rd) { rrs.push(owner, _u16b(43), _u16b(1), ttl, _u16b(rd.length), rd); });
+  var prefix = Buffer.concat([_u16b(43), Buffer.from([13, labels]), ttl, _u32b(exp), _u32b(inc), _u16b(keyTag), _canonName(zone)]);
+  var signed = Buffer.concat([prefix].concat(rrs));
+  var signature = nodeCrypto.sign("sha256", signed, { key: parentPriv, dsaEncoding: "ieee-p1363" });
+  return { algorithm: 13, labels: labels, originalTtl: 3600, expiration: exp, inception: inc, keyTag: keyTag, signerName: zone, signature: signature };
+}
+function _dsRdata(tag, alg, digest) {
+  return Buffer.concat([_u16b(tag), Buffer.from([alg, 2]), digest]);   // keyTag || alg || digestType=2(SHA-256) || digest
+}
+
+// The per-response signature-validation budget scales with chain depth, so
+// a legitimate deep delegation (here 11 links → ~21 verifies, well past the
+// old fixed 16) validates rather than hitting dnssec/validation-budget-
+// exceeded (the regression Codex flagged on PR #236).
+function testDeepChainBudget() {
+  var now = Math.floor(Date.now() / 1000), inc = now - 60, exp = now + 86400;
+  var N = 11;
+  var keys = [];
+  for (var i = 0; i < N; i++) {
+    var kp = nodeCrypto.generateKeyPairSync("ec", { namedCurve: "prime256v1" });
+    keys.push({ rd: _ecDnskey(kp.publicKey), priv: kp.privateKey, zone: "z" + i + "." });
+  }
+  var links = [];
+  for (var j = 0; j < N; j++) {
+    var k = keys[j];
+    var link = {
+      zone:        k.zone,
+      dnskeys:     [k.rd],
+      dnskeyRrsig: _signDnskeyRrset(k.zone, [k.rd], k.priv, k.rd, inc, exp),
+    };
+    if (j > 0) {
+      // DS of THIS zone's key, signed by the PARENT (previous link's key).
+      var digest = nodeCrypto.createHash("sha256").update(Buffer.concat([_canonName(k.zone), k.rd])).digest();
+      var dsRd = _dsRdata(b.network.dns.dnssec.keyTag(k.rd), 13, digest);
+      link.dsRdatas = [dsRd];
+      link.dsRrsig  = _signDsRrset(k.zone, [dsRd], keys[j - 1].priv, keys[j - 1].rd, inc, exp);
+    }
+    links.push(link);
+  }
+  // Trust anchor = DS digest of the root (link 0) key.
+  var rootDigest = nodeCrypto.createHash("sha256").update(Buffer.concat([_canonName(keys[0].zone), keys[0].rd])).digest();
+  var anchor = [{ keyTag: b.network.dns.dnssec.keyTag(keys[0].rd), algorithm: 13, digestType: 2, digest: rootDigest }];
+  var out = b.network.dns.dnssec.verifyChain({ links: links, trustAnchors: anchor, at: new Date(now * 1000) });
+  check("deep chain (11 links, ~21 verifies) validates under the depth-scaled budget",
+    out.ok === true && out.path.length === N);
+}
+
+// KeyTrap (CVE-2023-50387) amplification caps. The caps fire on COUNT
+// checks before any signature verification, so a single real EC DNSKEY
+// rdata repeated to hit each threshold is enough.
+function testKeyTrapCaps() {
+  function code(fn) { try { fn(); return "NO-THROW"; } catch (e) { return e.code; } }
+  var kp = nodeCrypto.generateKeyPairSync("ec", { namedCurve: "prime256v1" });
+  var rd = _ecDnskey(kp.publicKey);
+  var tag = b.network.dns.dnssec.keyTag(rd);
+  var now = Math.floor(Date.now() / 1000);
+  var rrsig = { algorithm: 13, labels: 1, originalTtl: 3600, expiration: now + 86400,
+    inception: now - 60, keyTag: tag, signerName: "test.", signature: Buffer.alloc(64) };
+  var anchor = [{ keyTag: tag, algorithm: 13, digestType: 2, digest: Buffer.alloc(32) }];
+
+  // > MAX_COLLIDING_KEYS (4) keys sharing one tag (5 identical rdatas all
+  // resolve to the same tag) → refused before any verify.
+  var fiveSameTag = [rd, rd, rd, rd, rd];
+  check("KeyTrap: >4 same-tag DNSKEY candidates refused",
+    code(function () { b.network.dns.dnssec.verifyChain({
+      links: [{ zone: "test.", dnskeys: fiveSameTag, dnskeyRrsig: rrsig }],
+      trustAnchors: anchor, at: new Date(now * 1000) }); }) === "dnssec/too-many-colliding-keys");
+
+  // > MAX_DNSKEYS_PER_ZONE (64) in one zone's RRset → refused.
+  var bigSet = []; for (var i = 0; i < 65; i++) bigSet.push(rd);
+  check("KeyTrap: oversize DNSKEY RRset (>64) refused",
+    code(function () { b.network.dns.dnssec.verifyChain({
+      links: [{ zone: "test.", dnskeys: bigSet, dnskeyRrsig: rrsig }],
+      trustAnchors: anchor, at: new Date(now * 1000) }); }) === "dnssec/too-many-dnskeys");
+
+  // A name encoding to > 255 octets (128 single-char labels = 257 octets)
+  // is refused at canonicalization (RFC 1035 §2.3.4) — bounds the NSEC3
+  // closest-encloser label enumeration.
+  var longName = new Array(129).join("a.") + "a";   // 129 labels of "a"
+  check("KeyTrap: name exceeding 255 octets refused",
+    code(function () { b.network.dns.dnssec.verifyDs({ ownerName: longName,
+      dnskeyRdata: rd, ds: { keyTag: tag, algorithm: 13, digestType: 2, digest: Buffer.alloc(32) } }); }) === "dnssec/bad-name");
+}
+
 async function run() {
   testSurface();
   testRealVectors();
   testRefusals();
   testVerifyDs();
   testVerifyChain();
+  testKeyTrapCaps();
+  testDeepChainBudget();
   testNsec3Real();
   testNsec3Caps();
   testNsec3OptOut();

package/lib/vendor/blamejs/test/layer-0-primitives/mail-agent.test.js

@@ -46,7 +46,7 @@ function testSurface() {
   check("mail.agent.consumer is fn", typeof b.mail.agent.consumer === "function");
   check("MailAgentError is fn",      typeof b.mail.agent.MailAgentError === "function");
   check("SCOPE_FOR_METHOD frozen",   Object.isFrozen(b.mail.agent.SCOPE_FOR_METHOD));
-  check("WIRED_AT frozen",           Object.isFrozen(b.mail.agent.WIRED_AT));
+  check("COMPOSE_HINT frozen",       Object.isFrozen(b.mail.agent.COMPOSE_HINT));
 }
 
 async function testCreateRequiresStore() {

package/lib/vendor/blamejs/test/layer-0-primitives/watcher.test.js

@@ -100,8 +100,14 @@ async function run() {
     // Poll until the watcher surfaces the target event. macOS fs.watch
     // on CI runners can take 2-3s to deliver write events under load;
     // the helper widens the default wait budget to 15s for that drift.
+    // Re-write a.txt on every poll: FSEvents may not be listening yet
+    // when the initial write (above) lands, and an event for a write
+    // that happened before the watch primed is dropped entirely — no
+    // amount of polling recovers it. Re-touching until the watch
+    // catches one closes that start-up race without a fixed prime-sleep.
     try {
       await waitForWatcher(function () {
+        fs.writeFileSync(path.join(tmpDir, "a.txt"), "hello");
         w._flushForTest();
         return changes.some(function (e) {
           return e.relativePath === "a.txt" && e.type === "file";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/blamejs-shop",
-  "version": "0.2.2",
+  "version": "0.2.4",
   "description": "Open-source framework built on blamejs. Vendored stack, zero npm runtime deps, PQC-first crypto, security-on by default.",
   "main": "lib/index.js",
   "scripts": {