@blamejs/blamejs-shop 0.3.11 → 0.3.13

package/lib/vendor/blamejs/lib/db.js

@@ -70,6 +70,7 @@ var safeJson = require("./safe-json");
 var safeSql = require("./safe-sql");
 var validateOpts = require("./validate-opts");
 var vault = require("./vault");
+var vaultAad = require("./vault-aad");
 
 var DbError = defineClass("DbError", { alwaysPermanent: true });
 var WormViolationError = require("./framework-error").WormViolationError;
@@ -153,12 +154,18 @@ var initialized = false;
 var dataResidency = null;   // operator's declared region config (validated by storage backends)
 var subjectTables = [];     // [{ name, subjectField, personalDataCategories }] — for subject.export/erase
 var tableMetadata = {};     // table name → metadata snapshot (PK/FK/sealed/derived) for getTableMetadata
-// D-M5 — streamLimit ceiling. db.stream() / Query.stream() consult this
+// StreamLimit ceiling. db.stream() / Query.stream() consult this
 // (overridden per-call via opts.streamLimit). Default cap matches a
 // generous-but-bounded 1M rows so an accidentally-unbounded export
 // surfaces a thrown error instead of OOM. v0.7.67's maxRowsPerQuery
 // bounds .all() / .first() — this is its streaming counterpart.
 var streamLimit = C.BYTES.bytes(1000000);                                                              // row-count ceiling, not bytes
+// Column-membership gate mode, set by db.init({ columnGate }). Default
+// "reject" (security-on): a query that orders / selects / filters on a
+// column that is not declared in the table's schema is refused before
+// the identifier interpolates into SQL. "warn" audits + allows; "off"
+// disables the gate.
+var columnGateMode = "reject";
 
 // ---- Framework-baked tables ----
 //
@@ -287,7 +294,7 @@ var FRAMEWORK_SCHEMA = [
     indexes: ["placedAt"],
   },
   {
-    // Per-row crypto-erasure key registry — F-RTBF-3 per-row keys.
+    // Per-row crypto-erasure key registry — per-row keys.
     // Each entry holds a sealed wrapped K_row keyed by (table,
     // rowId). b.subject.eraseHard deletes the entry, leaving WAL /
     // replica residuals undecryptable.
@@ -614,8 +621,8 @@ var FRAMEWORK_SCHEMA = [
   {
     // _blamejs_break_glass_grants — issued grants. Each successful
     // step-up creates one row; each row read decrements rowsRemaining.
-    // Default maxRowsPerGrant=1 enforces "row by row" auth per the
-    // operator-confirmed shape (each row access = its own grant).
+    // Default maxRowsPerGrant=1 enforces "row by row" auth
+    // (each row access = its own grant).
     // Sealed columns hold reason + scopeColumns so audit-readable
     // metadata doesn't leak in cleartext.
     name: "_blamejs_break_glass_grants",
@@ -661,25 +668,58 @@ function resolveTmpDir(optsTmpDir) {
 
 // ---- DB encryption key management ----
 
+// AAD binds the sealed DB encryption key to the deployment's dataDir
+// + key-file path, so a key file substituted from another deployment
+// fails the AEAD tag check on unseal (cross-deployment ciphertext
+// substitution / silent re-key — CWE-345 / CWE-441; the AAD itself is
+// NIST SP 800-38D additional-authenticated-data over the XChaCha20-
+// Poly1305 seal). nodePath.resolve (not realpathSync) — the key file
+// may not exist yet at first-run seal.
+function _dbKeyAad(dataDirPath, keyPath) {
+  return vaultAad.buildContextAad({
+    purpose: "blamejs/db-encryption-key/v1",
+    dataDir: nodePath.resolve(dataDirPath),
+    keyPath: nodePath.resolve(keyPath),
+  });
+}
+
 function loadOrCreateDbKey(dataDirPath, keyPathOverride) {
   // Operator opt: `opts.dbKeyPath` — useful when the encryption key
   // needs to live outside `dataDir` (e.g. a separate volume mounted
   // from a KMS-fronted secret store). Default places it next to the
   // encrypted DB so backup capture is one-tarball.
   var keyPath = keyPathOverride || nodePath.join(dataDirPath, "db.key.enc");
+  var aad = _dbKeyAad(dataDirPath, keyPath);
   if (nodeFs.existsSync(keyPath)) {
     var sealed = atomicFile.readSync(keyPath, { encoding: "utf8" }).trim();
-    var b64 = vault.unseal(sealed);
+    var b64;
+    // isAadSealed is checked FIRST and is load-bearing: AAD_PREFIX
+    // ("vault.aad:") is NOT a prefix of VAULT_PREFIX ("vault:"), so a
+    // plain vault.unseal would silently pass an AAD-sealed value
+    // through unchanged. AAD-bound keys verify the deployment context;
+    // a key file lifted from another deployment fails the tag check.
+    if (vaultAad.isAadSealed(sealed)) {
+      b64 = vaultAad.unseal(sealed, aad);
+    } else {
+      // Legacy plain-sealed key (pre-AAD): unseal with the classic
+      // path, then re-seal in place with the deployment-path binding so
+      // the next boot is AAD-verified. Read-migration preserves the key
+      // bytes — no re-key, no operator action.
+      b64 = vault.unseal(sealed);
+      if (b64) {
+        atomicFile.writeSync(keyPath, vaultAad.seal(b64, aad), { fileMode: 0o600 });
+        log("re-sealed DB encryption key with deployment-path binding at " + keyPath);
+      }
+    }
     if (!b64) {
       throw _dbErr("db/key-unseal-empty",
         "FATAL: db.key.enc unseal returned empty — vault may not be initialized or key file corrupted");
     }
     return Buffer.from(b64, "base64");
   }
-  // First run — generate, seal, persist (atomic)
+  // First run — generate, AAD-seal, persist (atomic).
   var raw = generateBytes(C.BYTES.bytes(32));
-  // allow:seal-without-aad — whole-file DB encryption key, not a row column
-  var sealedKey = vault.seal(raw.toString("base64"));
+  var sealedKey = vaultAad.seal(raw.toString("base64"), aad);
   atomicFile.writeSync(keyPath, sealedKey, { fileMode: 0o600 });
   log("generated DB encryption key at " + keyPath);
   return raw;
@@ -918,6 +958,7 @@ function cleanStaleTmpDbs(tmpDir) {
  *   tmpDir:                  string,            // override the encrypted-mode tmpfs path (default /dev/shm or BLAMEJS_TMPDIR)
  *   migrationDir:            string,            // optional — path to ./migrations/ (run-once each)
  *   streamLimit:             number,            // default 1_000_000 — db.stream row ceiling
+ *   columnGate:              "reject"|"warn"|"off", // default "reject" — refuse queries on columns not declared in the table schema
  *   skipBootIntegrityCheck:  boolean,           // default false — skip PRAGMA integrity_check
  *   skipIntegrityCheck:      boolean,           // default false — alias
  *   auditSigning:            { mode, algorithm }, // default { mode: "wrapped" }
@@ -966,7 +1007,7 @@ async function init(opts) {
     throw new DbError("db/bad-at-rest",
       "db.init: atRest must be 'encrypted' or 'plain', got: " + opts.atRest);
   }
-  // D-M5 — operator-tunable streamLimit ceiling. Throw at config-time
+  // Operator-tunable streamLimit ceiling. Throw at config-time
   // on bad shape so a typo surfaces at boot rather than as an
   // unbounded stream at first export.
   if (opts.streamLimit !== undefined) {
@@ -978,6 +1019,15 @@ async function init(opts) {
     }
     streamLimit = opts.streamLimit;
   }
+  // Column-membership gate mode — throw at config-time on a typo so it
+  // surfaces at boot, not as a query that silently bypasses the gate.
+  if (opts.columnGate !== undefined &&
+      opts.columnGate !== "reject" && opts.columnGate !== "warn" && opts.columnGate !== "off") {
+    throw new DbError("db/bad-init",
+      "db.init: columnGate must be 'reject' (default), 'warn', or 'off'; got " +
+      JSON.stringify(opts.columnGate));
+  }
+  columnGateMode = opts.columnGate || "reject";
   dataDir = opts.dataDir;
   if (!nodeFs.existsSync(dataDir)) nodeFs.mkdirSync(dataDir, { recursive: true });
 
@@ -990,7 +1040,7 @@ async function init(opts) {
     }
     if (!nodeFs.existsSync(tmpDir)) nodeFs.mkdirSync(tmpDir, { recursive: true });
 
-    // D-H7 — if the resolved tmpDir is NOT actually tmpfs, the
+    // If the resolved tmpDir is NOT actually tmpfs, the
     // plaintext DB file lives on persistent storage. We check that tmpDir
     // resolves under /dev/shm or /run/shm on Linux as a heuristic; on other
     // platforms we warn that the operator must verify tmpfs binding
@@ -1264,9 +1314,10 @@ async function init(opts) {
   for (var i = 0; i < fullSchema.length; i++) {
     var t = fullSchema[i];
     cryptoField.registerTable(t.name, {
-      sealedFields:   t.sealedFields,
-      derivedHashes:  t.derivedHashes,
-      hashNamespaces: t.hashNamespaces,
+      sealedFields:    t.sealedFields,
+      derivedHashes:   t.derivedHashes,
+      hashNamespaces:  t.hashNamespaces,
+      derivedHashMode: t.derivedHashMode,
     });
     tableMetadata[t.name] = {
       primaryKey:             _normalizePk(t),
@@ -1349,7 +1400,7 @@ async function init(opts) {
   // is BELOW tip — the DB was rolled back to an older snapshot. Refuse boot.
   _checkRollback(dataDir);
 
-  // ---- F-RET-2 — WORM posture assertion ----
+  // ---- WORM posture assertion ----
   // Under sec-17a-4 / finra-4511 / fda-21cfr11 postures the operator
   // MUST have declared row-level WORM on at least one business-record
   // table. Refuse boot otherwise so missing-declaration drift is
@@ -1491,10 +1542,41 @@ async function init(opts) {
  */
 function from(tableName) {
   _requireInit();
-  return new Query(database, tableName);
+  return new Query(database, tableName, {
+    declaredColumns: getDeclaredColumns(tableName),
+    columnGateMode:  columnGateMode,
+  });
+}
+
+/**
+ * @primitive b.db.getDeclaredColumns
+ * @signature b.db.getDeclaredColumns(tableName)
+ * @since     0.14.7
+ * @status    stable
+ * @related   b.db.from, b.db.getTableMetadata
+ *
+ * Returns the declared column names for a table as an array, or `null`
+ * when the table has no registered schema metadata (a cross- or
+ * attached-schema table — the column-membership gate is a no-op for
+ * those). The declared set includes `_id` and any derived-hash columns,
+ * so sealed-field queries (which rewrite to the hash column) and `_id`
+ * lookups pass the gate. Backs the `db.init({ columnGate })` gate that
+ * refuses queries ordering / selecting / filtering on an undeclared
+ * column before the identifier interpolates into SQL.
+ *
+ * @example
+ *   b.db.getDeclaredColumns("orders");
+ *   // → ["_id", "customerId", "total", "createdAt"]
+ */
+// The declared set includes `_id` and any derived-hash columns, so
+// sealed-field queries (which rewrite to the hash column) and `_id`
+// lookups pass membership.
+function getDeclaredColumns(tableName) {
+  var md = tableMetadata[tableName];
+  return (md && md.columns) ? Object.keys(md.columns) : null;
 }
 
-// D-M6 — bounded prepared-statement cache for SQLite. Long-running
+// Bounded prepared-statement cache for SQLite. Long-running
 // daemons with diverse query shapes accumulate node:sqlite Statement
 // handles indefinitely; the LRU here caps at PREPARE_CACHE_MAX (256)
 // distinct SQL strings and finalizes the oldest when over. Reuse of
@@ -1611,7 +1693,7 @@ function stream(sql) {
   var table = opts && typeof opts.table === "string" ? opts.table : null;
   var unseal = table ? cryptoField : null;
 
-  // D-M5 — streamLimit ceiling. Per-call opts.streamLimit overrides
+  // StreamLimit ceiling. Per-call opts.streamLimit overrides
   // the module-level default; bad shape throws at call time so the
   // typo surfaces instead of an unbounded stream.
   var perCallLimit = streamLimit;
@@ -1661,10 +1743,10 @@ function stream(sql) {
 
 // DDL_RE — case-insensitive prefix match for the eight statement
 // shapes that MUTATE schema. Audited individually so a forensic
-// review can reconstruct schema evolution from the chain alone (D-M1).
+// review can reconstruct schema evolution from the chain alone.
 var DDL_RE = /^\s*(CREATE|DROP|ALTER|TRUNCATE|RENAME|ATTACH|DETACH|REINDEX)\b/i;
 
-// D-L7 — slow-query observability buckets for the local SQLite nodePath.
+// Slow-query observability buckets for the local SQLite nodePath.
 // Highest matched bucket wins so the per-query emit is single-shot;
 // operators dashboard on the `bucket` label.
 var _SLOW_QUERY_BUCKETS_LOCAL = Object.freeze([
@@ -1712,7 +1794,7 @@ function execRaw(sql) {
         action:   "db.ddl.executed",
         outcome:  "success",
         metadata: {
-          // OTel db.* semconv (F-RFC-4) — emit framework-conventional
+          // OTel db.* semconv — emit framework-conventional
           // attributes alongside the audit row so dashboards built on
           // OTel can correlate without an adapter.
           "db.system":     "sqlite",
@@ -2701,7 +2783,7 @@ function vacuumAfterErase(opts) {
   } catch (_e) { /* audit best-effort */ }
 }
 
-// F-POSTURE-1 — cascade-installed posture name. b.compliance.set(p)
+// Cascade-installed posture name. b.compliance.set(p)
 // calls applyPosture(p) which records the posture; the downstream
 // cryptoField.eraseRow path consults this via getActivePosture() to
 // auto-vacuum under postures whose POSTURE_DEFAULTS sets
@@ -3054,10 +3136,12 @@ module.exports = {
   getActivePosture:    getActivePosture,
   vacuumAfterErase:    vacuumAfterErase,
   from:                from,
+  getDeclaredColumns:  getDeclaredColumns,
+  _checkDualControlGate: _checkDualControlGate,
   collection:          require("./db-collection").collection,                              // allow:inline-require — db-collection lazy-requires db.js back; the inline require here breaks the cycle without needing a stub
   prepare:             prepare,
   stream:              stream,
-  // D-M5 — runtime read-only accessor so Query.stream picks up the
+  // Runtime read-only accessor so Query.stream picks up the
   // configured ceiling without re-importing module state.
   getStreamLimit:      function () { return streamLimit; },
   runSql:              execRaw,

package/lib/vendor/blamejs/lib/external-db.js

@@ -57,7 +57,7 @@ function _emitMetric(name, value, labels) {
   catch (_e) { /* hot-path observability sink — drop silent by design */ }
 }
 
-// Statement-class classifier for auth-failure forensics (D-M2). Inspects
+// Statement-class classifier for auth-failure forensics. Inspects
 // the leading keyword only so an attacker-controlled trailing fragment
 // can't smuggle a false classification. Skips leading whitespace plus
 // SQL line / block comments before reading the keyword.
@@ -83,8 +83,49 @@ function _classifyStatement(sql) {
   return _STATEMENT_CLASS_MAP[m[1].toUpperCase()] || "OTHER";
 }
 
+// Best-effort target-relation extractor for auth-failure forensics: the
+// table the denied role attempted to touch, so the audit row records
+// the OBJECT (SOC2 CC7.2 / NIST SP 800-53 AU-3 "what was accessed"),
+// not just the statement class. Defensive reader — returns null on
+// anything unparseable and NEVER throws: it runs in the live failure
+// path and must not mask the real 28000 / 42501 error. The extracted
+// identifier is captured into audit METADATA (a JSON string, never
+// re-executed as SQL), so the only sink risk is log-injection: any
+// segment carrying a control / NUL character is refused. Spaces and
+// ordinary punctuation inside a quoted identifier are kept so a
+// legitimately-quoted relation name still surfaces in the audit row.
+var _RELATION_RE = /\b(?:FROM|INTO|UPDATE|JOIN|TABLE|COPY)\s+((?:"[^"]+"|`[^`]+`|[A-Za-z_][\w$]*)(?:\.(?:"[^"]+"|`[^`]+`|[A-Za-z_][\w$]*))?)/ig;
+function _hasControlChar(s) {
+  for (var i = 0; i < s.length; i += 1) {
+    var c = s.charCodeAt(i);
+    if (c < 0x20 || c === 0x7f) return true;
+  }
+  return false;
+}
+function _extractTargetRelation(sql) {
+  if (typeof sql !== "string" || sql.length === 0) return null;
+  var clean = sql.replace(/--[^\n]*/g, " ").replace(/\/\*[\s\S]*?\*\//g, " ");
+  _RELATION_RE.lastIndex = 0;
+  var m = _RELATION_RE.exec(clean);
+  if (!m) return null;
+  var segs = m[1].split(".").map(function (s) { return s.replace(/^["`]|["`]$/g, ""); });
+  for (var i = 0; i < segs.length; i += 1) {
+    if (segs[i].length === 0 || _hasControlChar(segs[i])) return null;
+  }
+  return segs.join(".");
+}
+
+function _countTargetRelations(sql) {
+  if (typeof sql !== "string") return 0;
+  var clean = sql.replace(/--[^\n]*/g, " ").replace(/\/\*[\s\S]*?\*\//g, " ");
+  _RELATION_RE.lastIndex = 0;
+  var n = 0;
+  while (_RELATION_RE.exec(clean) !== null) n += 1;
+  return n;
+}
+
 // Postgres SQLSTATE classes that indicate authentication / authorization
-// failure at the DB level. SOC2 forensic gap (D-M2) — every match emits
+// failure at the DB level. SOC2 forensic gap — every match emits
 // db.auth.failed with the SQL identity attempted, the database, and
 // the statement class.
 var _AUTH_FAILURE_CODES = Object.freeze({
@@ -97,18 +138,24 @@ function _emitAuthFailureAudit(backend, role, sql, e) {
   if (!e || !e.code) return;
   var kind = _AUTH_FAILURE_CODES[e.code];
   if (!kind) return;
+  var attemptedTable = _extractTargetRelation(sql);
+  var relationCount  = _countTargetRelations(sql);
+  var resource = { kind: "db.backend", id: backend.name };
+  if (attemptedTable !== null) resource.attemptedTable = attemptedTable;
   audit().safeEmit({
     action:   "db.auth.failed",
     actor:    {},
-    resource: { kind: "db.backend", id: backend.name },
+    resource: resource,
     outcome:  "denied",
     reason:   kind,
     metadata: {
-      backend:        backend.name,
-      dialect:        backend.dialect,
-      sqlIdentity:    role || null,
-      sqlstate:       e.code,
-      statementClass: _classifyStatement(sql),
+      backend:               backend.name,
+      dialect:               backend.dialect,
+      sqlIdentity:           role || null,
+      sqlstate:              e.code,
+      statementClass:        _classifyStatement(sql),
+      attemptedTable:        attemptedTable,
+      attemptedRelationCount: relationCount,
     },
   });
   _emitMetric("db.auth.failed", 1, {
@@ -118,7 +165,7 @@ function _emitAuthFailureAudit(backend, role, sql, e) {
   });
 }
 
-// Slow-query bucket emitter (D-L7). Single-shot per query — highest
+// Slow-query bucket emitter. Single-shot per query — highest
 // matched bucket wins. Operators dashboard on the `bucket` label
 // rather than separate counters per threshold.
 var _SLOW_QUERY_BUCKETS = Object.freeze([
@@ -628,7 +675,7 @@ async function query(sql, params, opts) {
       _emitMetric("db.role.denied", 1,
         { backend: b.name, role: role || "(none)" });
     }
-    // D-M2 — DB-auth audit visibility. Every 28000 / 28P01 / 42501
+    // DB-auth audit visibility. Every 28000 / 28P01 / 42501
     // surfaces an auditable db.auth.failed row tagged with the SQL
     // identity and the statement class so SOC2 reviewers can
     // reconstruct the denial timeline.
@@ -693,13 +740,13 @@ async function transaction(fn, opts) {
   var prebuiltGucs = _buildSessionGucsStatements(opts.sessionGucs);
 
   var t0 = Date.now();
-  // D-H4 — per-statement timeout. SET LOCAL statement_timeout binds
-  // the query-cancel ceiling to this transaction; D-M7 wires
+  // Per-statement timeout. SET LOCAL statement_timeout binds
+  // the query-cancel ceiling to this transaction; this wires
   // idle_in_transaction_session_timeout from the same opt. Both
   // emit at SET LOCAL scope so the next pool checkout starts clean.
   var stmtTimeoutMs = opts.statementTimeoutMs;
   var idleTimeoutMs = opts.idleInTransactionTimeoutMs;
-  // D-M8 — deadlock-retry policy. 40P01 (deadlock_detected) and 40001
+  // Deadlock-retry policy. 40P01 (deadlock_detected) and 40001
   // (serialization_failure) are transient — retry with capped attempts
   // and a small jittered backoff. Operators tune retries via opts.deadlockRetries (default 3).
   // numeric-bounds doesn't have a non-negative-int helper; use a
@@ -771,7 +818,7 @@ async function transaction(fn, opts) {
             _emitMetric("db.role.denied", 1,
               { backend: b.name, role: role || "(none)" });
           }
-          // D-M2 — DB-auth audit visibility on transaction-shaped denials.
+          // DB-auth audit visibility on transaction-shaped denials.
           // Statement class always reads as "TX" since the failure
           // surface inside a transaction body could be any statement;
           // operators correlate via the transaction's audit row.
@@ -1017,7 +1064,7 @@ function _requireInit() {
 
 var REPLICA_UNHEALTHY_COOLDOWN_MS = C.TIME.seconds(30);
 
-// F-CBT-2 — replica residency-tag compatibility.
+// Replica residency-tag compatibility.
 //
 // A primary tagged "EU" replicating to a "US" replica is a GDPR
 // Article 46 cross-border transfer; without an explicit operator
@@ -1194,7 +1241,7 @@ async function _readQuery(sql, params, opts) {
       _emitMetric("db.role.denied", 1,
         { backend: b.name, role: role || "(none)" });
     }
-    // D-M2 — DB-auth audit visibility for read-replica denials too.
+    // DB-auth audit visibility for read-replica denials too.
     _emitAuthFailureAudit(b, role, sql, e);
     // Fallback to primary on a failed replica read when allowed.
     if (b.replicaFallbackToPrimary) {
@@ -1874,4 +1921,5 @@ module.exports = {
   migrate:        externalDbMigrate,
   Pool:           Pool,
   _resetForTest:  _resetForTest,
+  _extractTargetRelation: _extractTargetRelation,
 };

package/lib/vendor/blamejs/lib/framework-schema.js

@@ -648,8 +648,8 @@ function _breakGlassPoliciesDDL(dialect) {
 }
 
 // _blamejs_break_glass_grants — issued grants. One row per successful
-// step-up. Default maxRowsPerGrant=1 enforces row-by-row auth per the
-// operator-confirmed shape ("each row access = its own grant").
+// step-up. Default maxRowsPerGrant=1 enforces row-by-row auth
+// ("each row access = its own grant").
 function _breakGlassGrantsDDL(dialect) {
   var t = _types(dialect);
   var name = LOCAL_TO_EXTERNAL._blamejs_break_glass_grants;
@@ -766,7 +766,7 @@ async function ensureSchema(opts) {
     created.push(d.create.match(/CREATE TABLE IF NOT EXISTS\s+(\S+)/)[1]);
   }
 
-  // D-M11 — append-only WORM enforcement on audit_log / consent_log /
+  // Append-only WORM enforcement on audit_log / consent_log /
   // audit_checkpoints in cluster mode. Local-SQLite path already
   // installs CREATE TRIGGER IF NOT EXISTS via lib/db.js's
   // _installAppendOnlyTriggers; Postgres needs equivalent rules
@@ -779,7 +779,7 @@ async function ensureSchema(opts) {
   return { tables: created };
 }
 
-// D-M11 — WORM enforcement helper. Idempotent: rebuilding triggers
+// WORM enforcement helper. Idempotent: rebuilding triggers
 // per boot is cheap and any operator-applied DROP TRIGGER is restored
 // at the next ensureSchema pass.
 async function _installWormTriggers(backend, dialect) {

package/lib/vendor/blamejs/lib/guard-list-id.js

@@ -203,8 +203,8 @@ function validate(headerValue, opts) {
   // recover the boundary without Public Suffix List awareness
   // (`team.example.com` could be label=team / ns=example.com OR
   // label=team.example / ns=com). The earlier last-2-segment
-  // heuristic produced empty `label` for 2-label IDs (Codex P1 on
-  // PR #64), which violates RFC 2919 §2's required label "."
+  // heuristic produced empty `label` for 2-label IDs
+  // which violates RFC 2919 §2's required label "."
   // namespace decomposition.
   //
   // Drop the heuristic split — surface only the raw `listId` (and

package/lib/vendor/blamejs/lib/guard-list-unsubscribe.js

@@ -349,8 +349,7 @@ function _extractUris(raw, maxUris) {
   // bracket pairs directly via String.matchAll so URIs containing
   // commas (legitimate, e.g. `<https://x/u?tags=a,b>`) parse
   // correctly. Earlier split(",")-based scan misclassified such
-  // URIs as "no <URI> elements" and refused legitimate mail
-  // (Codex P1 on PR #63).
+  // URIs as "no <URI> elements" and refused legitimate mail.
   var matches = raw.matchAll(/<([^<>]*)>/g);                                                             // allow:regex-no-length-cap — input length-bounded by maxBytes check upstream
   var uris = [];
   for (var m of matches) {

package/lib/vendor/blamejs/lib/incident-report.js

@@ -305,8 +305,158 @@ function create(opts) {
   };
 }
 
+// Breach detection -> notification running clock. The reporter
+// (`create`) computes the static per-stage deadlines; this clock turns
+// them into a live escalation loop: it tracks open incident records and,
+// on each tick, fires "approaching" warnings as a stage's deadline nears
+// and a "passed" alert when it elapses — once per (incident, stage,
+// state) so a busy tick interval can't storm the operator. It re-uses
+// the reporter's REGIME_DEADLINES / dueBy timestamps and re-encodes no
+// jurisdiction hour-counts (GDPR Art.33 72h, NIS2 Art.23(4) 24h, DORA
+// Art.19 + RTS 2024/1772 4h, CRA Art.14, HIPAA 45 CFR 164.404/408).
+// `approachThresholds` are unitless proportions of detected-to-due.
+function createDeadlineClock(opts) {
+  opts = opts || {};
+  validateOpts(opts, [
+    "audit", "notify", "approachThresholds", "intervalMs", "autoStart", "now",
+  ], "incident.report.createDeadlineClock");
+
+  var auditOn = opts.audit !== false;
+  var notify  = (opts.notify && typeof opts.notify.send === "function") ? opts.notify : null;
+  var thresholds = Array.isArray(opts.approachThresholds) ? opts.approachThresholds.slice() : [0.5, 0.75, 0.9];
+  for (var ti = 0; ti < thresholds.length; ti += 1) {
+    if (typeof thresholds[ti] !== "number" || !(thresholds[ti] > 0 && thresholds[ti] < 1)) {
+      throw new IncidentReportError("incident-report/bad-threshold",
+        "createDeadlineClock: approachThresholds must be numbers strictly between 0 and 1");
+    }
+  }
+  thresholds.sort(function (a, b) { return a - b; });
+  var now = typeof opts.now === "function" ? opts.now : function () { return Date.now(); };
+  var intervalMs = (typeof opts.intervalMs === "number" && isFinite(opts.intervalMs) && opts.intervalMs > 0)
+    ? opts.intervalMs : C.TIME.minutes(1);
+  var autoStart = opts.autoStart !== false;
+
+  var tracked = new Map();   // incidentId -> { detectedAt, dueBy, regime, acked, fired }
+  var timer = null;
+
+  function _emit(action, outcome, metadata) {
+    if (!auditOn) return;
+    try {
+      audit().safeEmit({ action: "incident.report.clock." + action, outcome: outcome, metadata: metadata || {} });
+    } catch (_e) { /* drop-silent — by design */ }
+  }
+  function _notify(payload) {
+    if (!notify) return;
+    try {
+      var r = notify.send(payload);
+      if (r && typeof r.then === "function") r.then(null, function () {});
+    } catch (_e) { /* drop-silent — escalation is best-effort, never crashes a tick */ }
+  }
+
+  function track(record) {
+    if (!record || typeof record !== "object" || typeof record.id !== "string" || record.id.length === 0) {
+      throw new IncidentReportError("incident-report/bad-record",
+        "createDeadlineClock.track: record must be an incident.report record with a string id");
+    }
+    if (!record.dueBy || typeof record.dueBy !== "object" ||
+        typeof record.detectedAt !== "number") {
+      throw new IncidentReportError("incident-report/bad-record",
+        "createDeadlineClock.track: record must carry detectedAt + dueBy { initial, intermediate, final }");
+    }
+    tracked.set(record.id, {
+      detectedAt: record.detectedAt,
+      dueBy:      record.dueBy,
+      regime:     record.regime || null,
+      acked:      {},
+      fired:      {},
+    });
+    return record.id;
+  }
+
+  function untrack(id) { return tracked.delete(id); }
+
+  function acknowledgeSubmission(id, stage, info) {
+    if (!VALID_STAGES[stage]) {
+      throw new IncidentReportError("incident-report/bad-stage",
+        "createDeadlineClock.acknowledgeSubmission: stage must be one of " + Object.keys(VALID_STAGES).join(", "));
+    }
+    var t = tracked.get(id);
+    if (!t) {
+      throw new IncidentReportError("incident-report/unknown-incident",
+        "createDeadlineClock.acknowledgeSubmission: no tracked incident '" + id + "'");
+    }
+    t.acked[stage] = true;
+    _emit("submission_acknowledged", "success", { incidentId: id, regime: t.regime, stage: stage, info: info || null });
+    return true;
+  }
+
+  // Pure evaluation seam — operators (and tests) can pass an explicit
+  // nowMs. Each (incident, stage, state) fires AT MOST once; a stage
+  // that has been acknowledged is skipped entirely.
+  function tick(nowMsArg) {
+    var nowMs = typeof nowMsArg === "number" ? nowMsArg : now();
+    tracked.forEach(function (t, id) {
+      var stages = ["initial", "intermediate", "final"];
+      for (var si = 0; si < stages.length; si += 1) {
+        var stage = stages[si];
+        if (t.acked[stage]) continue;
+        var due = t.dueBy[stage];
+        if (typeof due !== "number") continue;
+        var span = due - t.detectedAt;
+        if (span <= 0) continue;
+        if (nowMs >= due) {
+          var pk = stage + ":passed";
+          if (!t.fired[pk]) {
+            t.fired[pk] = true;
+            _emit("deadline_passed", "failure", { incidentId: id, regime: t.regime, stage: stage, dueBy: due });
+            _notify({ kind: "deadline_passed", incidentId: id, regime: t.regime, stage: stage, dueBy: due });
+          }
+          continue;
+        }
+        var proportion = (nowMs - t.detectedAt) / span;
+        for (var thi = thresholds.length - 1; thi >= 0; thi -= 1) {
+          if (proportion >= thresholds[thi]) {
+            var ak = stage + ":approaching:" + thresholds[thi];
+            if (!t.fired[ak]) {
+              t.fired[ak] = true;
+              _emit("deadline_approaching", "warning",
+                { incidentId: id, regime: t.regime, stage: stage, dueBy: due, threshold: thresholds[thi] });
+              _notify({ kind: "deadline_approaching", incidentId: id, regime: t.regime, stage: stage, dueBy: due, threshold: thresholds[thi] });
+            }
+            break;
+          }
+        }
+      }
+    });
+  }
+
+  function start() {
+    if (timer) return;
+    timer = setInterval(function () { tick(); }, intervalMs);
+    if (timer && typeof timer.unref === "function") timer.unref();
+  }
+  function stop() {
+    if (timer) { clearInterval(timer); timer = null; }
+  }
+  function status() {
+    return { tracked: tracked.size, running: timer !== null, intervalMs: intervalMs };
+  }
+
+  if (autoStart) start();
+  return {
+    track:                 track,
+    untrack:               untrack,
+    acknowledgeSubmission: acknowledgeSubmission,
+    tick:                  tick,
+    start:                 start,
+    stop:                  stop,
+    status:                status,
+  };
+}
+
 module.exports = {
   create:                create,
+  createDeadlineClock:   createDeadlineClock,
   IncidentReportError:   IncidentReportError,
   REGIME_DEADLINES:      REGIME_DEADLINES,
   DEFAULT_DEADLINES:     DEFAULT_DEADLINES,

package/lib/vendor/blamejs/lib/mail-crypto-smime.js

@@ -763,7 +763,7 @@ function checkCert(opts) {
   }
 
   // Validity window — refuse certs outside their notBefore / notAfter
-  // window. Codex P1: checkCert's docstring promises this throws
+  // window. checkCert's docstring promises this throws
   // `mail-crypto/smime/expired-cert` but the impl was missing, letting
   // expired or not-yet-valid signing certs pass boot-time preflight
   // and fail interop later when peers verify signatures against the