@blamejs/blamejs-shop 0.3.11 → 0.3.13

package/lib/vendor/blamejs/test/layer-0-primitives/crypto-field-derived-hash.test.js

@@ -0,0 +1,102 @@
+"use strict";
+/**
+ * b.cryptoField derived-hash modes.
+ *
+ * Equality-lookup ("derived") hashes for sealed columns can be computed
+ * two ways:
+ *   - salted-sha3   (default) — SHA3-512 over a per-deployment salt.
+ *   - hmac-shake256 (opt-in)  — keyed MAC off vault.getDerivedHashMacKey,
+ *                               so the hash is unforgeable without the
+ *                               per-deployment MAC key.
+ *
+ * The mode is chosen per-table (derivedHashMode) or per-column
+ * (spec.mode). The decision lives in _computeDerivedHash; call sites
+ * must never hand-roll the hash.
+ */
+
+var helpers = require("../helpers");
+var b     = helpers.b;
+var check = helpers.check;
+var fs   = require("fs");
+var os   = require("os");
+var path = require("path");
+
+async function run() {
+  var dir = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-cf-dh-"));
+  await b.vault.init({ mode: "plaintext", dataDir: dir });
+
+  // ---- salted-sha3 is the default: SHA3-512 → 128 hex chars ----
+  b.cryptoField.registerTable("cf_dh_t1", {
+    sealedFields: ["email"],
+    derivedHashes: { emailHash: { from: "email" } },
+  });
+  var saltedH = b.cryptoField.lookupHash("cf_dh_t1", "email", "a@b.com").value;
+  check("salted-sha3 default is 128 hex (SHA3-512)", saltedH.length === 128);
+  check("salted-sha3 is deterministic",
+    saltedH === b.cryptoField.lookupHash("cf_dh_t1", "email", "a@b.com").value);
+
+  // ---- hmac-shake256 table mode: SHAKE256/32 → 64 hex chars ----
+  b.cryptoField.registerTable("cf_dh_t2", {
+    sealedFields: ["email"],
+    derivedHashes: { emailHash: { from: "email" } },
+    derivedHashMode: "hmac-shake256",
+  });
+  var keyedH = b.cryptoField.lookupHash("cf_dh_t2", "email", "a@b.com").value;
+  check("hmac-shake256 is 64 hex (SHAKE256/32)", keyedH.length === 64);
+  check("hmac-shake256 is deterministic",
+    keyedH === b.cryptoField.lookupHash("cf_dh_t2", "email", "a@b.com").value);
+  check("keyed hash differs from salted hash", keyedH !== saltedH);
+
+  // ---- per-column mode override on a salted-default table ----
+  b.cryptoField.registerTable("cf_dh_t3", {
+    sealedFields: ["ssn"],
+    derivedHashes: { ssnHash: { from: "ssn", mode: "hmac-shake256" } },
+  });
+  check("per-column hmac-shake256 override → 64 hex",
+    b.cryptoField.lookupHash("cf_dh_t3", "ssn", "x").value.length === 64);
+
+  // ---- MAC key surface: 32 bytes, per-deployment ----
+  var macKey = b.vault.getDerivedHashMacKey();
+  check("getDerivedHashMacKey is a 32-byte Buffer",
+    Buffer.isBuffer(macKey) && macKey.length === 32);
+
+  // A fresh deployment (new vault dir + MAC key) yields a different
+  // keyed hash for the same input — the keyed hash is bound to the MAC
+  // key, not just the input.
+  var dir2 = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-cf-dh2-"));
+  b.vault._resetForTest();
+  await b.vault.init({ mode: "plaintext", dataDir: dir2 });
+  b.cryptoField.registerTable("cf_dh_t2", {
+    sealedFields: ["email"],
+    derivedHashes: { emailHash: { from: "email" } },
+    derivedHashMode: "hmac-shake256",
+  });
+  var keyedH2 = b.cryptoField.lookupHash("cf_dh_t2", "email", "a@b.com").value;
+  check("new deployment MAC key → different keyed hash", keyedH2 !== keyedH);
+
+  // ---- input validation: unknown modes are rejected at registerTable ----
+  var badTableMode = false;
+  try { b.cryptoField.registerTable("cf_dh_bad", { derivedHashMode: "md5" }); }
+  catch (e) { badTableMode = /derivedHashMode must be/.test(e.message); }
+  check("bad derivedHashMode throws at registerTable", badTableMode);
+
+  var badColMode = false;
+  try {
+    b.cryptoField.registerTable("cf_dh_bad2", {
+      derivedHashes: { h: { from: "x", mode: "rot13" } },
+    });
+  } catch (e) { badColMode = /mode must be/.test(e.message); }
+  check("bad per-column mode throws at registerTable", badColMode);
+
+  console.log("OK — crypto-field derived-hash tests");
+}
+
+module.exports = { run: run };
+if (require.main === module) {
+  // Rethrow on failure so Node surfaces the error and exits non-zero,
+  // instead of logging the caught error object — a taint analyzer traces
+  // a logged error back to the test passphrase fixture (a non-secret
+  // constant) and raises a false clear-text-logging alert.
+  run().then(function () { process.exit(0); })
+       .catch(function (err) { process.exitCode = 1; throw err; });
+}

package/lib/vendor/blamejs/test/layer-0-primitives/db-column-gate.test.js

@@ -0,0 +1,150 @@
+"use strict";
+/**
+ * b.db column-membership gate + whereRaw string-literal refusal.
+ *
+ * Column gate: a Query may only reference columns the table declared in
+ * its schema. The default mode is "reject" (throw), so a typo'd or
+ * attacker-influenced column name fails closed rather than silently
+ * matching nothing (or, for a raw fragment, opening an injection path).
+ * Modes: reject (default) | warn (audit, allow) | off (no gate).
+ * .allowedColumns([...]) narrows further and is ALWAYS enforced.
+ *
+ * whereRaw / WhereBuilder.raw refuse an embedded string literal
+ * ('...') unless { allowLiterals: true } — every value must bind
+ * through the params array.
+ */
+
+var helpers = require("../helpers");
+var b     = helpers.b;
+var check = helpers.check;
+var fs   = helpers.fs;
+var os   = helpers.os;
+var path = helpers.path;
+
+var SCHEMA = [{
+  name: "things",
+  columns: {
+    _id:    "TEXT PRIMARY KEY",
+    name:   "TEXT",
+    status: "TEXT DEFAULT 'active'",
+  },
+  indexes: ["status"],
+}];
+
+async function initDb(tmpDir, columnGate) {
+  process.env.BLAMEJS_SKIP_NTP_CHECK = "1";
+  helpers.setTestPassphraseEnv();
+  b.cluster._resetForTest();
+  b.audit._resetForTest();
+  b.vault._resetForTest();
+  b.db._resetForTest();
+  await b.vault.init({ dataDir: tmpDir });
+  var opts = { dataDir: tmpDir, tmpDir: path.join(tmpDir, "tmpfs"), schema: SCHEMA };
+  if (columnGate !== undefined) opts.columnGate = columnGate;
+  await b.db.init(opts);
+}
+
+function threwMatching(fn, pattern) {
+  try { fn(); } catch (e) { return pattern.test(e.message) ? e : null; }
+  return null;
+}
+
+async function run() {
+  var tmp = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-colgate-"));
+
+  // ---- default mode is reject ----
+  await initDb(tmp);
+  b.db.from("things").insertOne({ _id: "t1", name: "a", status: "active" });
+
+  // declared columns pass
+  check("declared column where() passes",
+    b.db.from("things").where({ name: "a" }).first().status === "active");
+  check("declared column select() passes",
+    b.db.from("things").select(["name", "status"]).where({ _id: "t1" }).first().name === "a");
+
+  // undeclared column is rejected (fail-closed)
+  check("undeclared where() column rejected",
+    !!threwMatching(function () { b.db.from("things").where({ nope: 1 }); },
+      /not a declared column of 'things'/));
+  check("undeclared orderBy() column rejected",
+    !!threwMatching(function () { b.db.from("things").orderBy("bogus"); },
+      /not a declared column/));
+  check("undeclared select() column rejected",
+    !!threwMatching(function () { b.db.from("things").select(["ghost"]); },
+      /not a declared column/));
+
+  // ---- getDeclaredColumns ----
+  check("b.db.getDeclaredColumns is fn", typeof b.db.getDeclaredColumns === "function");
+  var declared = b.db.getDeclaredColumns("things");
+  check("getDeclaredColumns lists schema columns",
+    declared.indexOf("_id") !== -1 && declared.indexOf("name") !== -1 && declared.indexOf("status") !== -1);
+  check("getDeclaredColumns on unknown table → null",
+    b.db.getDeclaredColumns("no_such_table") === null);
+
+  // ---- allowedColumns() narrows + is always enforced ----
+  check("allowedColumns() allows a member",
+    b.db.from("things").allowedColumns(["name"]).where({ name: "a" }).first().name === "a");
+  check("allowedColumns() rejects a declared-but-not-allowed column",
+    !!threwMatching(function () {
+      b.db.from("things").allowedColumns(["name"]).where({ status: "active" });
+    }, /not in the allowedColumns\(\) set/));
+  check("allowedColumns([]) rejected (non-empty array required)",
+    !!threwMatching(function () { b.db.from("things").allowedColumns([]); },
+      /non-empty array/));
+
+  // ---- A5: whereRaw refuses embedded string literals ----
+  var litErr = threwMatching(function () { b.db.from("things").whereRaw("status = 'active'"); },
+    /string literal/);
+  check("whereRaw refuses embedded string literal", !!litErr);
+  check("whereRaw literal error code is sql/raw-literal", litErr && litErr.code === "sql/raw-literal");
+  check("whereRaw with bound params is accepted",
+    b.db.from("things").whereRaw("status = ?", ["active"]).first().name === "a");
+  check("whereRaw allowLiterals opt-in is accepted",
+    b.db.from("things").whereRaw("status = 'active'", [], { allowLiterals: true }).first().name === "a");
+
+  b.db.close();
+  fs.rmSync(tmp, { recursive: true, force: true });
+
+  // ---- warn mode: audited, not thrown ----
+  var tmp2 = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-colgate-warn-"));
+  await initDb(tmp2, "warn");
+  var warnThrew = false;
+  try { b.db.from("things").where({ nope: 1 }); } catch (_e) { warnThrew = true; }
+  check("warn mode does not throw on undeclared column", warnThrew === false);
+  b.db.close();
+  fs.rmSync(tmp2, { recursive: true, force: true });
+
+  // ---- off mode: no gate ----
+  var tmp3 = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-colgate-off-"));
+  await initDb(tmp3, "off");
+  var offThrew = false;
+  try { b.db.from("things").where({ nope: 1 }); } catch (_e) { offThrew = true; }
+  check("off mode does not gate undeclared column", offThrew === false);
+  b.db.close();
+  fs.rmSync(tmp3, { recursive: true, force: true });
+
+  // ---- bad columnGate value rejected at db.init ----
+  var tmp4 = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-colgate-bad-"));
+  var initThrew = false;
+  try { await initDb(tmp4, "loud"); } catch (e) { initThrew = /columnGate/.test(e.message); }
+  check("db.init rejects unknown columnGate mode", initThrew);
+  try { b.db.close(); } catch (_e) {}
+  fs.rmSync(tmp4, { recursive: true, force: true });
+
+  b.audit._resetForTest();
+  b.db._resetForTest();
+  b.vault._resetForTest();
+  b.cluster._resetForTest();
+
+  console.log("OK — db column-gate tests");
+}
+
+module.exports = { run: run };
+if (require.main === module) {
+  // Rethrow on failure so Node surfaces the error and exits non-zero,
+  // instead of logging the caught error object — a taint analyzer traces
+  // a logged error back to the test passphrase fixture (a non-secret
+  // constant) and raises a false clear-text-logging alert.
+  run().then(function () { process.exit(0); })
+       .catch(function (err) { process.exitCode = 1; throw err; });
+}

package/lib/vendor/blamejs/test/layer-0-primitives/db-key-aad.test.js

@@ -0,0 +1,109 @@
+"use strict";
+/**
+ * b.db encryption-key AAD binding.
+ *
+ * The database encryption key (db.key.enc) is sealed with additional
+ * authenticated data bound to its purpose, data directory, and key
+ * path. That binding means a sealed key blob cannot be silently
+ * relocated to a different deployment / path and unsealed there — the
+ * AEAD authentication fails. A legacy plain-sealed key (pre-binding)
+ * is transparently upgraded to the AAD-sealed format on next load.
+ */
+
+var helpers = require("../helpers");
+var b              = helpers.b;
+var check          = helpers.check;
+var fs             = helpers.fs;
+var os             = helpers.os;
+var path           = helpers.path;
+var setupTestDb    = helpers.setupTestDb;
+
+var DB_KEY_PURPOSE = "blamejs/db-encryption-key/v1";
+var SCHEMA = [{
+  name: "things",
+  columns: { _id: "TEXT PRIMARY KEY", v: "TEXT" },
+}];
+
+function dbKeyAad(tmp, keyPath) {
+  return b.vault.aad.buildContextAad({
+    purpose: DB_KEY_PURPOSE,
+    dataDir: path.resolve(tmp),
+    keyPath: path.resolve(keyPath),
+  });
+}
+
+async function reinitDbOnly(tmp) {
+  helpers.setTestPassphraseEnv();
+  b.db._resetForTest();
+  await b.db.init({ dataDir: tmp, tmpDir: path.join(tmp, "tmpfs"), schema: SCHEMA });
+}
+
+async function run() {
+  var tmp = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-dbkey-aad-"));
+  // setupTestDb resets + inits vault and db; vault stays initialized
+  // through every phase below (we only reset db between phases).
+  await setupTestDb(tmp, SCHEMA);
+  b.db.from("things").insertOne({ _id: "x", v: "secret" });
+
+  var keyPath = path.join(tmp, "db.key.enc");
+  var sealed = fs.readFileSync(keyPath, "utf8");
+
+  // ---- on-disk key is AAD-sealed ----
+  check("db.key.enc is AAD-sealed", b.vault.aad.isAadSealed(sealed) === true);
+
+  // ---- correct AAD unseals to a non-empty key ----
+  var b64 = b.vault.aad.unseal(sealed, dbKeyAad(tmp, keyPath));
+  check("correct AAD unseals db key to non-empty base64", typeof b64 === "string" && b64.length > 0);
+
+  // ---- binding: a different keyPath / dataDir fails to unseal ----
+  var bindKeyPathThrew = false;
+  try { b.vault.aad.unseal(sealed, dbKeyAad(tmp, path.join(tmp, "elsewhere.enc"))); }
+  catch (_e) { bindKeyPathThrew = true; }
+  check("db key won't unseal under a different keyPath", bindKeyPathThrew);
+
+  var bindDirThrew = false;
+  try {
+    b.vault.aad.unseal(sealed, b.vault.aad.buildContextAad({
+      purpose: DB_KEY_PURPOSE,
+      dataDir: path.resolve(tmp, "..", "some-other-deployment"),
+      keyPath: path.resolve(keyPath),
+    }));
+  } catch (_e) { bindDirThrew = true; }
+  check("db key won't unseal under a different dataDir", bindDirThrew);
+
+  // ---- round-trip: re-init at the same dir decrypts the row ----
+  b.db.close();
+  await reinitDbOnly(tmp);
+  check("re-init at same dir decrypts row through AAD-sealed key",
+    b.db.from("things").where({ _id: "x" }).first().v === "secret");
+
+  // ---- legacy plain-sealed key is upgraded to AAD on next load ----
+  b.db.close();
+  fs.writeFileSync(keyPath, b.vault.seal(b64), { mode: 0o600 });
+  check("legacy seed: db.key.enc is NOT AAD-sealed",
+    b.vault.aad.isAadSealed(fs.readFileSync(keyPath, "utf8")) === false);
+  await reinitDbOnly(tmp);
+  check("legacy plain-sealed key upgraded to AAD on load",
+    b.vault.aad.isAadSealed(fs.readFileSync(keyPath, "utf8")) === true);
+  check("row still decrypts after legacy key upgrade",
+    b.db.from("things").where({ _id: "x" }).first().v === "secret");
+
+  b.db.close();
+  b.audit._resetForTest();
+  b.db._resetForTest();
+  b.vault._resetForTest();
+  b.cluster._resetForTest();
+  try { fs.rmSync(tmp, { recursive: true, force: true }); } catch (_e) {}
+
+  console.log("OK — db-key AAD tests");
+}
+
+module.exports = { run: run };
+if (require.main === module) {
+  // Rethrow on failure so Node surfaces the error and exits non-zero,
+  // instead of logging the caught error object — a taint analyzer traces
+  // a logged error back to the test passphrase fixture (a non-secret
+  // constant) and raises a false clear-text-logging alert.
+  run().then(function () { process.exit(0); })
+       .catch(function (err) { process.exitCode = 1; throw err; });
+}

package/lib/vendor/blamejs/test/layer-0-primitives/external-db-hardening.test.js

@@ -168,6 +168,59 @@ async function run() {
   await new Promise(function (r) { setImmediate(r); });
   check("D-M2: 42501 emit completes without crashing", true);
 
+  // ---- attempted-relation extraction for auth-failure audits ----
+  // A rejected credential's audit row records WHICH relation it tried
+  // to reach, so triage can scope blast radius without the raw SQL log.
+  // _extractTargetRelation is the defensive parser behind that field.
+  var xr = b.externalDb._extractTargetRelation;
+  check("extractRelation: bare table after FROM",
+    xr("SELECT * FROM accounts WHERE id = $1") === "accounts");
+  check("extractRelation: INTO target",
+    xr("INSERT INTO audit_log (a) VALUES ($1)") === "audit_log");
+  check("extractRelation: UPDATE target",
+    xr("UPDATE users SET x = 1") === "users");
+  check("extractRelation: schema-qualified",
+    xr("SELECT * FROM public.secrets") === "public.secrets");
+  check("extractRelation: double-quoted identifier (quotes stripped)",
+    xr('SELECT * FROM "Order Items"') === "Order Items");
+  check("extractRelation: backtick-quoted identifier (ticks stripped)",
+    xr("SELECT * FROM `weird table`") === "weird table");
+  check("extractRelation: JOIN target picks first relation",
+    xr("SELECT * FROM a JOIN b ON a.id = b.id") === "a");
+  // Defensive: unparseable / control-char input returns null rather
+  // than leaking a partial fragment into the audit metadata.
+  check("extractRelation: no relation keyword returns null", xr("SELECT 1") === null);
+  check("extractRelation: non-SQL input returns null",
+    xr("just some words here") === null);
+  check("extractRelation: empty input returns null", xr("") === null);
+
+  // The audit hook stamps attemptedTable from the parser. Drive a
+  // rejection through the query path and confirm the field is present
+  // on the captured audit row.
+  var auditRows = [];
+  var origEmit = b.audit && b.audit.safeEmit;
+  if (origEmit) {
+    b.audit.safeEmit = function (rec) {
+      if (rec && rec.action === "db.auth.failed") auditRows.push(rec);
+      return origEmit.apply(b.audit, arguments);
+    };
+  }
+  try {
+    var d6 = _instrumentingDriver({
+      failOnce: { match: /^SELECT \* FROM payroll/i, code: "28000", message: "auth failed" },
+    });
+    b.externalDb._resetForTest();
+    b.externalDb.init({ backends: { main: { connect: d6.connect, query: d6.query, close: d6.close } } });
+    try { await b.externalDb.query("SELECT * FROM payroll WHERE id = $1", [1]); } catch (_e) { /* expected */ }
+    await new Promise(function (r) { setImmediate(r); });
+  } finally {
+    if (origEmit) b.audit.safeEmit = origEmit;
+  }
+  var payrollRow = auditRows.filter(function (r) {
+    return r.metadata && r.metadata.attemptedTable === "payroll";
+  });
+  check("auth-failure audit carries attemptedTable", payrollRow.length >= 1);
+
   b.externalDb._resetForTest();
 }
 

package/lib/vendor/blamejs/test/layer-0-primitives/incident-report.test.js

@@ -25,5 +25,70 @@ var check = helpers.check;
   try { await ir2.open({}); } catch (e) { threwBadSpec = e.code === "incident-report/bad-regime"; }
   check("incident.open refuses bad spec", threwBadSpec);
 
+  // ---- createDeadlineClock — running-clock approaching/passed alerts ----
+  // Manual-tick mode (autoStart:false) keeps the test deterministic and
+  // sleep-free; thresholds fire as the injected "now" crosses fractions
+  // of each stage deadline.
+  check("createDeadlineClock is fn", typeof b.incident.report.createDeadlineClock === "function");
+
+  var sent = [];
+  var clk = b.incident.report.createDeadlineClock({
+    notify: { send: function (m) { sent.push(m); } },
+    autoStart: false,
+    approachThresholds: [0.5, 0.9],
+  });
+  // detectedAt=0; stage deadlines initial=100, intermediate=200, final=300.
+  clk.track({ id: "inc-1", detectedAt: 0, regime: "gdpr", dueBy: { initial: 100, intermediate: 200, final: 300 } });
+  check("deadline clock: tracked=1", clk.status().tracked === 1);
+
+  clk.tick(50);   // 50% of initial → approaching@0.5
+  check("tick@50: one approaching@0.5 (initial)",
+    sent.length === 1 && sent[0].kind === "deadline_approaching" &&
+    sent[0].stage === "initial" && sent[0].threshold === 0.5);
+
+  clk.tick(55);   // still <0.9 of initial → dedupe, no new alert
+  check("tick@55: dedupe (no new alert)", sent.length === 1);
+
+  clk.tick(95);   // 95% of initial → approaching@0.9
+  check("tick@95: approaching@0.9 fires", sent.length === 2 && sent[1].threshold === 0.9);
+
+  clk.tick(150);  // initial(100) passed
+  check("tick@150: initial passed fires once",
+    sent.filter(function (m) { return m.kind === "deadline_passed" && m.stage === "initial"; }).length === 1);
+
+  clk.tick(160);  // no duplicate passed for initial
+  check("tick@160: no duplicate passed",
+    sent.filter(function (m) { return m.kind === "deadline_passed" && m.stage === "initial"; }).length === 1);
+
+  // Acknowledging a stage suppresses its further alerts.
+  clk.acknowledgeSubmission("inc-1", "intermediate");
+  clk.tick(250);  // intermediate(200) would be passed, but acked → suppressed
+  check("acknowledged stage: no passed alert",
+    sent.filter(function (m) { return m.stage === "intermediate" && m.kind === "deadline_passed"; }).length === 0);
+
+  // Construction-time + track-time input validation.
+  var badThresh = false;
+  try { b.incident.report.createDeadlineClock({ approachThresholds: [1.5] }); }
+  catch (e) { badThresh = /between 0 and 1/.test(e.message); }
+  check("createDeadlineClock rejects threshold > 1", badThresh);
+
+  var badTrack = false;
+  try { clk.track({ id: "x" }); } catch (e) { badTrack = /dueBy/.test(e.message); }
+  check("deadline clock: track without dueBy rejected", badTrack);
+
+  // Faster regime crosses before slower one on the same tick
+  // (registry windows differ — DORA vs GDPR here).
+  var sent2 = [];
+  var clk2 = b.incident.report.createDeadlineClock({
+    notify: { send: function (m) { sent2.push(m); } }, autoStart: false,
+  });
+  clk2.track({ id: "dora-1", detectedAt: 0, regime: "dora", dueBy: { initial: 4, intermediate: 8, final: 12 } });
+  clk2.track({ id: "gdpr-1", detectedAt: 0, regime: "gdpr", dueBy: { initial: 72, intermediate: 100, final: 200 } });
+  clk2.tick(5);  // DORA initial(4) passed; GDPR initial(72) only ~7% → nothing
+  check("deadline clock: faster regime crosses first",
+    sent2.filter(function (m) { return m.incidentId === "dora-1" && m.kind === "deadline_passed"; }).length === 1 &&
+    sent2.filter(function (m) { return m.incidentId === "gdpr-1"; }).length === 0);
+  clk2.stop();
+
   console.log("OK — incident.report tests");
 })().catch(function (e) { console.error(e); process.exit(1); });

package/lib/webhook-subscriptions.js

@@ -49,6 +49,7 @@
  */
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 var OWNER_TYPES         = Object.freeze(["operator", "app", "customer"]);
 var MAX_OWNER_ID_LEN    = 200;
@@ -116,15 +117,6 @@ function _ownerId(s) {
   return s;
 }
 
-// Hostnames that name an internal/metadata destination by name rather
-// than by IP literal — the same denylist the delivery primitive
-// (lib/webhooks.js) applies. A literal-IP host is classified directly via
-// b.ssrfGuard.classify (no DNS); these names cover the by-name reach.
-var SUBSCRIPTION_BLOCKED_HOSTS = Object.freeze({
-  "localhost":                1,
-  "metadata.google.internal": 1,
-});
-
 function _endpointUrl(url) {
   if (typeof url !== "string" || url.length === 0) {
     throw new TypeError("webhookSubscriptions: endpoint_url must be a non-empty string");
@@ -143,21 +135,16 @@ function _endpointUrl(url) {
   }
   // SSRF: refuse internal / loopback / link-local / cloud-metadata
   // destinations so a registered subscription can't probe the host's own
-  // network or the instance-credential metadata service. A literal-IP host
-  // is classified via b.ssrfGuard.classify (no DNS); a hostname is matched
-  // against the by-name metadata/loopback denylist plus *.internal.
-  // DNS-rebinding (a public name resolving to a private IP) is out of scope
-  // here by design — resolving the name would add a DNS dependency the
-  // registration path avoids; the resolving guard belongs on the delivery
-  // dial.
-  // Strip a trailing FQDN dot (and IPv6 brackets) BEFORE every check: a
-  // trailing dot is semantically the same host but otherwise evades both the
-  // by-name denylist ("localhost." / "metadata.google.internal.") and the
-  // literal-IP classifier ("169.254.169.254." won't parse as an IP).
-  var host = (parsed.hostname || "").replace(/^\[|\]$/g, "").toLowerCase().replace(/\.+$/, "");
-  if (b.ssrfGuard.classify(host) ||
-      SUBSCRIPTION_BLOCKED_HOSTS[host] ||
-      host === "internal" || /\.internal$/.test(host)) {
+  // network or the instance-credential metadata service. textGuard.hostLabel
+  // classifies a literal-IP host via the framework SSRF guard (no DNS) and
+  // matches a hostname against the by-name metadata / loopback denylist plus
+  // the *.internal suffix, after stripping a trailing FQDN dot + IPv6
+  // brackets so neither check is evaded. DNS-rebinding (a public name
+  // resolving to a private IP) is out of scope here by design — the
+  // resolving guard belongs on the delivery dial.
+  try {
+    textGuard.hostLabel(parsed.hostname, "webhookSubscriptions: endpoint_url host");
+  } catch (_e) {
     throw new TypeError("webhookSubscriptions: endpoint_url host is not allowed (internal/loopback/metadata address)");
   }
   return url;

package/lib/webhooks.js

@@ -37,6 +37,7 @@
  */
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 var C = b.constants;
 
@@ -85,16 +86,6 @@ var RATE_WINDOW_MS = C.TIME.minutes(1);
 
 function _now() { return Date.now(); }
 
-// Hostnames that name an internal/metadata destination by name rather
-// than by IP literal. The cloud-metadata services answer on a hostname
-// as well as the 169.254.169.254 link-local IP; localhost resolves to
-// loopback. A literal-IP host is classified directly via b.ssrfGuard
-// (no DNS); these names cover the by-name reach of the same targets.
-var WEBHOOK_BLOCKED_HOSTS = Object.freeze({
-  "localhost":                1,
-  "metadata.google.internal": 1,
-});
-
 function _validateUrl(url) {
   if (typeof url !== "string" || url.length === 0) {
     throw new TypeError("webhooks: url must be a non-empty string");
@@ -110,29 +101,17 @@ function _validateUrl(url) {
   // SSRF: refuse any internal / loopback / link-local / cloud-metadata
   // destination so a registered receiver can't be turned into a probe of
   // the host's own network or the instance-credential metadata service.
-  // A literal-IP host is classified directly via b.ssrfGuard.classify
-  // (loopback / private / link-local / reserved / cloud-metadata all
-  // refused, IPv4 + IPv6 + IPv4-mapped); a hostname is matched against
-  // the by-name metadata/loopback denylist plus the *.internal suffix.
-  // DNS-rebinding (a public name that resolves to a private IP) is OUT OF
-  // SCOPE here by design — resolving the name would add a DNS dependency
-  // the outbound path otherwise avoids, and the delivery send path is the
-  // place a resolving guard belongs. This gate stops the literal-IP and
-  // known-name SSRF reachable directly from operator-supplied input.
-  // Strip a trailing FQDN dot (and IPv6 brackets) BEFORE every check: a
-  // trailing dot is semantically the same host but otherwise evades both the
-  // by-name denylist ("localhost." / "metadata.google.internal.") and the
-  // literal-IP classifier ("169.254.169.254." won't parse as an IP).
-  var host = (parsed.hostname || "").replace(/^\[|\]$/g, "").toLowerCase().replace(/\.+$/, "");
-  var isBlocked = false;
-  if (b.ssrfGuard.classify(host)) {
-    isBlocked = true;                                   // literal IP in a refused range
-  } else if (WEBHOOK_BLOCKED_HOSTS[host]) {
-    isBlocked = true;                                   // localhost / metadata.google.internal
-  } else if (host === "internal" || /\.internal$/.test(host)) {
-    isBlocked = true;                                   // any *.internal cloud-private name
-  }
-  if (isBlocked) {
+  // textGuard.hostLabel classifies a literal-IP host directly via the
+  // framework SSRF guard (loopback / private / link-local / reserved /
+  // cloud-metadata, IPv4 + IPv6 + IPv4-mapped) and matches a hostname
+  // against the by-name metadata / loopback denylist plus the *.internal
+  // suffix, after stripping a trailing FQDN dot + IPv6 brackets so neither
+  // check is evaded. DNS-rebinding (a public name that resolves to a
+  // private IP) is OUT OF SCOPE here by design — the resolving guard
+  // belongs on the delivery dial.
+  try {
+    textGuard.hostLabel(parsed.hostname, "webhooks: url host");
+  } catch (_e) {
     throw new TypeError("webhooks: url host is not allowed (internal/loopback/metadata address)");
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/blamejs-shop",
-  "version": "0.3.11",
+  "version": "0.3.13",
   "description": "Open-source framework built on blamejs. Vendored stack, zero npm runtime deps, PQC-first crypto, security-on by default.",
   "main": "lib/index.js",
   "scripts": {