@blamejs/blamejs-shop 0.3.15 → 0.3.17

package/lib/vendor/blamejs/lib/network-tsig.js

@@ -41,7 +41,7 @@ var TsigError = defineClass("TsigError", { alwaysPermanent: true });
 
 var TYPE_TSIG = 250;                                        // IANA RR type TSIG
 var CLASS_ANY = 255;                                        // TSIG RRs use CLASS ANY
-var DEFAULT_FUDGE = 300;                                    // allow:raw-time-literal — RFC 8945 recommended fudge window (seconds)
+var DEFAULT_FUDGE = 300;
 
 // Algorithm name → Node hash. The strong HMAC-SHA-2 family is the safe set;
 // HMAC-MD5 and HMAC-SHA-1 are refused unless allowLegacy (kept only for
@@ -225,7 +225,7 @@ function sign(message, opts) {
   var secret = _secretBuf(opts.secret);
   var fudge = opts.fudge == null ? DEFAULT_FUDGE : opts.fudge;
   if (typeof fudge !== "number" || !isFinite(fudge) || fudge < 0 || fudge > 0xffff) throw new TsigError("tsig/bad-opt", "tsig.sign: fudge must be 0..65535 seconds");   // 16-bit fudge field
-  var time = opts.time == null ? Math.floor(Date.now() / 1000) : opts.time;   // allow:raw-time-literal — ms→s
+  var time = opts.time == null ? Math.floor(Date.now() / 1000) : opts.time;
   if (typeof time !== "number" || !isFinite(time) || time < 0) throw new TsigError("tsig/bad-opt", "tsig.sign: time must be a non-negative Unix-seconds number");
   var error = opts.error == null ? 0 : opts.error;
   var otherData = Buffer.isBuffer(opts.otherData) ? opts.otherData : Buffer.alloc(0);
@@ -379,7 +379,7 @@ function verify(message, opts) {
     macValid = timingSafeEqual(rr.mac, expected.slice(0, rr.mac.length));
   }
 
-  var now = opts.now == null ? Math.floor(Date.now() / 1000) : opts.now;   // allow:raw-time-literal — ms→s
+  var now = opts.now == null ? Math.floor(Date.now() / 1000) : opts.now;
   var timeValid = Math.abs(now - rr.timeSigned) <= rr.fudge;
 
   var reason = null;

package/lib/vendor/blamejs/lib/rfc3339.js

@@ -25,11 +25,11 @@ function isValidDateTime(s) {
   if (!m) return false;
   var mo = +m[2], d = +m[3], h = +m[4], mi = +m[5], se = +m[6];
   if (mo < 1 || mo > 12 || d < 1 || d > 31 || h > 23 || mi > 59 || se > 60) return false;   // allow:raw-time-literal — RFC 3339 field ranges (60 = leap second)
-  var days = [31, ((+m[1] % 4 === 0 && +m[1] % 100 !== 0) || +m[1] % 400 === 0) ? 29 : 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];   // allow:raw-time-literal — days per month (Gregorian)
+  var days = [31, ((+m[1] % 4 === 0 && +m[1] % 100 !== 0) || +m[1] % 400 === 0) ? 29 : 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
   if (d > days[mo - 1]) return false;
   var tz = m[8];
   if (tz !== "Z" && tz !== "z") {
-    if (+tz.slice(1, 3) > 23 || +tz.slice(4, 6) > 59) return false;   // allow:raw-time-literal — RFC 3339 offset hour/minute ranges
+    if (+tz.slice(1, 3) > 23 || +tz.slice(4, 6) > 59) return false;
   }
   return true;
 }

package/lib/vendor/blamejs/lib/safe-decompress.js

@@ -105,7 +105,7 @@ var _algorithms = {
 // classic bomb shapes (1000:1) while leaving headroom for legitimate
 // text / JSON / XML payloads (which compress 20-50:1 commonly). Per
 // RFC 8460 §5.2 community guidance for TLS-RPT report decompression.
-var DEFAULT_MAX_RATIO = 50;                                                          // allow:raw-time-literal — RFC number not seconds
+var DEFAULT_MAX_RATIO = 50;
 
 // Default input cap when operator omits opts.maxCompressedBytes —
 // 4 MiB matches the TLS-RPT receive surface and is a reasonable

package/lib/vendor/blamejs/lib/standard-webhooks.js

@@ -32,7 +32,7 @@ var { defineClass } = require("./framework-error");
 
 var StandardWebhooksError = defineClass("StandardWebhooksError", { alwaysPermanent: true });
 
-var DEFAULT_TOLERANCE_SEC = 300;                                                                      // allow:raw-time-literal — 5min default per StandardWebhooks §3.2
+var DEFAULT_TOLERANCE_SEC = 300;
 
 /**
  * @primitive b.standardWebhooks.sign
@@ -70,7 +70,7 @@ function sign(opts) {
   var id = opts.id || ("msg_" + bCrypto.generateToken(32));                                           // 32-char id token
   var timestamp = typeof opts.timestamp === "number"
     ? opts.timestamp
-    : Math.floor(Date.now() / 1000);                                                                  // allow:raw-time-literal — wall-clock seconds
+    : Math.floor(Date.now() / 1000);
   if (timestamp <= 0 || !isFinite(timestamp)) {
     throw new StandardWebhooksError("standard-webhooks/bad-timestamp",
       "sign: timestamp must be a positive finite integer");
@@ -148,7 +148,7 @@ function verify(opts) {
   numericBounds.requirePositiveFiniteIntIfPresent(opts.toleranceSec, "toleranceSec",
     StandardWebhooksError, "standard-webhooks/bad-tolerance");
   var tolerance = typeof opts.toleranceSec === "number" ? opts.toleranceSec : DEFAULT_TOLERANCE_SEC;
-  var nowSec = Math.floor(Date.now() / 1000);                                                         // allow:raw-time-literal — wall-clock seconds
+  var nowSec = Math.floor(Date.now() / 1000);
   if (Math.abs(nowSec - ts) > tolerance) {
     throw new StandardWebhooksError("standard-webhooks/timestamp-skew",
       "verify: timestamp skew " + Math.abs(nowSec - ts) + "s exceeds tolerance " + tolerance + "s");

package/lib/vendor/blamejs/lib/stream-throttle.js

@@ -71,9 +71,9 @@ var StreamThrottleError = defineClass("StreamThrottleError", { alwaysPermanent:
 // (bytes/sec ↔ wait-ms). This is a unit-conversion constant, not a
 // memory cap or protocol-byte literal; the framework's C.TIME / C.BYTES
 // helpers don't apply.
-var MS_PER_SECOND = 1000;                                                                             // allow:raw-time-literal — ms/sec unit conversion
+var MS_PER_SECOND = 1000;
 var NS_PER_MS     = 1e6;                                                                              // ns/ms unit conversion
-var MS_PER_SECOND_HRTIME = 1000;                                                                      // allow:raw-time-literal — hrtime seconds→ms
+var MS_PER_SECOND_HRTIME = 1000;
 
 /**
  * @primitive b.streamThrottle.create

package/lib/vendor/blamejs/lib/structured-fields.js

@@ -542,7 +542,7 @@ function parse(input, type, opts) {
 
 function _serDecimal(v, E) {
   if (!isFinite(v)) throw E("structured-fields/serialize", "cannot serialize a non-finite decimal");
-  var n = Math.round(v * 1000) / 1000;                   // allow:raw-time-literal — RFC 8941 §4.1.5 decimal scale 10^3 (3 fractional digits), not a size or duration
+  var n = Math.round(v * 1000) / 1000;                   // allow:raw-time-literal — RFC 8941 4.1.5 decimal-scale 10^3 rounding; coincidental * 1000, not a duration, C.TIME N/A
   if (Math.abs(Math.trunc(n)).toString().length > 12) throw E("structured-fields/serialize", "decimal integer part exceeds 12 digits");   // §4.1.5 cap
   var s = n.toString();
   if (s.indexOf(".") === -1) s += ".0";                  // a Decimal must carry a fractional part

package/lib/vendor/blamejs/lib/vault/seal-pem-file.js

@@ -81,7 +81,7 @@ var SealPemFileError = defineClass("SealPemFileError", { alwaysPermanent: true }
 // doesn't sneak past the watcher. Operators with extremely-quiet
 // renewal cycles can override via opts.pollInterval; the cost of
 // 500ms polling on an idle PEM file is ~2 stat() syscalls/sec.
-var DEFAULT_POLL_MS = 500;                                                         // allow:raw-time-literal — 500ms watchFile cadence (sub-second)
+var DEFAULT_POLL_MS = 500;
 
 // PEM files are tiny — 4 KiB for an ECDSA key, ~8 KiB for a 4096-bit
 // RSA key, ~64 KiB for a long cert chain. Cap at 1 MiB so an operator

package/lib/vendor/blamejs/lib/web-push-vapid.js

@@ -134,7 +134,7 @@ function buildVapidAuthHeader(opts) {
       "buildVapidAuthHeader: subscription.endpoint is not a parseable URL");
   }
   var aud = endpointUrl.origin;
-  var now = Math.floor(Date.now() / 1000);                                                            // allow:raw-time-literal — wall-clock seconds for JWT exp
+  var now = Math.floor(Date.now() / 1000);
   // Inline JWT sign with ES256 — VAPID strictly mandates ECDSA-P256
   // (RFC 8292 §3.1). The framework jwt.sign is PQC-first and refuses
   // ES256 by design; VAPID is a wire-protocol constraint outside

package/lib/vendor/blamejs/lib/webhook.js

@@ -955,7 +955,7 @@ function sign(input) {
     }
     ts = Math.floor(input.timestamp);
   } else {
-    ts = Math.floor(Date.now() / 1000);                                                                // allow:raw-time-literal — unix-seconds conversion, Stripe spec uses seconds-not-ms
+    ts = Math.floor(Date.now() / 1000);
   }
   var hex = _hmacSha256Hex(secretBytes, ts + "." + bodyStr);
   return "t=" + ts + ",v1=" + hex;

package/lib/vendor/blamejs/lib/websocket.js

@@ -191,7 +191,7 @@ var CLOSE_GRACE_MS            = C.TIME.seconds(2);
 function _isValidCloseCode(code) {
   if (code === 1004 || code === 1005 || code === 1006 || code === 1015) return false;        // RFC 6455 §7.4.2 reserved codes
   if (code >= 1000 && code <= 1011) return true;                                              // allow:raw-time-literal — code is a numeric, not seconds
-  if (code >= 3000 && code <= 4999) return true;                                              // allow:raw-time-literal — code is a numeric, not seconds
+  if (code >= 3000 && code <= 4999) return true;                                              // allow:raw-time-literal — WebSocket close-code range bound (RFC 6455 7.4.2); coincidental multiple-of-60, C.TIME N/A
   return false;
 }
 

package/lib/vendor/blamejs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.14.7",
+  "version": "0.14.8",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/lib/vendor/blamejs/release-notes/v0.14.8.json

@@ -0,0 +1,27 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.14.8",
+  "date": "2026-05-30",
+  "headline": "Source-comment and codebase-check hygiene, plus a new require-block alignment check; no API or behaviour changes",
+  "summary": "Internal lint and comment cleanup with no operator-facing surface change. Several codebase-check comments and one stub helper name that described behaviour the check no longer has are corrected; an unused lint-suppression class and a set of stale duplicate-cluster qualifiers (functions that were since renamed or extracted) are pruned or re-pointed. Fifty-nine `// allow:` markers that named the byte-size or time-literal check on values those checks no longer flag are removed, and twenty self-negating rationales on markers the time check genuinely fires on are rewritten to say why the value coincidentally matches. A new codebase check holds top-of-file require blocks to consistent `=` column alignment, with the files that currently carry drift listed as a migration allowlist. No exported API, error code, wire format, or runtime behaviour changes.",
+  "sections": [
+    {
+      "heading": "Changed",
+      "items": [
+        {
+          "title": "Lint-suppression and codebase-check comment cleanup",
+          "body": "Corrected codebase-check comments that overstated their check's scope (a duplicate-code threshold described as three files when the advisory threshold is two, a narrowed byte-literal check carrying its pre-narrowing description, and a deferred-scan helper named as though it enforced a guarantee it does not yet provide). Removed an unused lint-suppression class and its one dead in-code marker, and pruned or re-pointed stale duplicate-cluster qualifiers that named functions since renamed or extracted into shared helpers. Removed fifty-nine `// allow:` markers that suppressed nothing, and rewrote twenty self-negating marker rationales (which read \"not seconds\" while sitting on a value the time check fires on) to explain the coincidental match. Source-comment and test hygiene only."
+        }
+      ]
+    },
+    {
+      "heading": "Detectors",
+      "items": [
+        {
+          "title": "Require-block `=` alignment check",
+          "body": "A new codebase check flags a top-of-file require block that mixes its `=` column alignment — a fittable line whose `=` drifts off the column the rest of the block shares. Compact single-space blocks are exempt (only blocks that declare alignment intent are checked), as are destructures and long names physically too wide to reach the column, and blank- or comment-separated tiers align independently. The files that currently carry such drift are an explicit migration allowlist, reflowed over time; new code is held to the rule."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/test/layer-0-primitives/codebase-patterns.test.js

@@ -314,7 +314,6 @@ var VALID_ALLOW_CLASSES = {
   "math-random-noncrypto": 1,
   "no-number-money-arithmetic": 1,
   "numeric-opt-Infinity": 1,
-  "numeric-opt-no-bounds-check": 1,
   "primitive-unreachable": 1,
   "process-exit": 1,
   "raw-byte-literal": 1,
@@ -460,14 +459,10 @@ function testNoRawByteLiterals() {
         // those are protocol constants, decoded to integers in the
         // PQC_GROUPS table and elsewhere. (0x11EC = 4588 not multiple
         // of 8, 0x11ED = 4589 not multiple of 8 — none trip anyway.)
-        // Skip commonly-decimal protocol constants where
-        // multiple-of-8 is coincidence:
-        //   - 256, 64, 32, 16 — bit-widths (which ARE byte-aligned;
-        //     fundamental fix routes them through C.BYTES.bit-arithmetic
-        //     or names them as protocol constants).
-        // No skip — flag every multiple of 8 strictly. The fundamental
-        // fix path is to use C.BYTES helpers or rename + comment as a
-        // protocol constant where 8-multiple is coincidence.
+        // After the `* 1024` gate above, this multiple-of-8 scan only
+        // runs on byte-scale arithmetic lines, so a multiple-of-8
+        // operand here is genuine byte math — the fix path is to route
+        // it through the C.BYTES helpers.
         hit = true;
         break;
       }
@@ -1048,6 +1043,213 @@ function testNoInternalBindingNameInProse() {
     bad);
 }
 
+// ---- Pattern: require-block `=` column alignment ----
+//
+// class: require-block-misaligned
+//
+// Within a contiguous top-of-file run of `var <name> = require(...)` /
+// `var { ... } = require(...)` lines, the `=` signs share a column WHEN
+// the block is written in the aligned style. Two styles ship in lib/
+// and BOTH are legitimate:
+//
+//   compact (single space — never flagged):
+//     var C = require("./constants");
+//     var audit = require("./audit");
+//
+//   aligned (padded to a shared column):
+//     var lazyRequire = require("./lazy-require");
+//     var C           = require("./constants");
+//
+// The detector fires only on a sub-block that DECLARES alignment intent
+// (at least one require line carries 2+ spaces before its `=`) and only
+// on a line that COULD reach the block's shared column but doesn't.
+//
+// The shared column is the MODAL `=` column — the column the majority
+// of the block's require lines actually use. A line is a violation when
+// its `=` is off the modal column AND its left-hand side is short enough
+// to reach it: `lhsLen + 1 <= modalCol`. A `var { LongDestructure } =`
+// or a long plain name whose LHS is as wide as (or wider than) the modal
+// column can only ever get a single space — it physically can't align,
+// so that overshoot is house style, not drift, and is EXEMPT. (This is
+// the classic `var guardAgentRegistry = ...` / `var { defineClass } = ...`
+// shape: unfittable, correctly ignored. The target is the fittable line
+// that drifts one column anyway — the stray extra space, or the short
+// `var C =` that didn't get padded to the column.)
+//
+// Sub-blocks align INDEPENDENTLY. A blank line OR an interior `//` /
+// `/* */` comment divider between require lines splits the run: a tier
+// of node: builtins or a lazyRequire tier separated from the relative-
+// require tier by an explanatory comment is its own group, checked on
+// its own column. Only the leading top-of-file require region is
+// inspected — array/object element order, later constant blocks, and
+// every non-require `=` are out of scope.
+//
+// REQUIRE_ALIGN_ALLOWLIST below is the migration backlog: files that
+// align today but carry a fittable drifted line. As each is reflowed to
+// a uniform column (or to compact single-space), drop its entry.
+var REQUIRE_ALIGN_ALLOWLIST = [
+  "lib/ai-pref.js",
+  "lib/archive.js",
+  "lib/auth/oid4vci.js",
+  "lib/cdn-cache-control.js",
+  "lib/compliance-ai-act-logging.js",
+  "lib/compliance-ai-act.js",
+  "lib/db-file-lifecycle.js",
+  "lib/flag-providers.js",
+  "lib/http-client-cookie-jar.js",
+  "lib/http-client.js",
+  "lib/local-db-thin.js",
+  "lib/log-stream-syslog.js",
+  "lib/mail-require-tls.js",
+  "lib/mail-scan.js",
+  "lib/mail-server-imap.js",
+  "lib/mail-server-mx.js",
+  "lib/mail-server-submission.js",
+  "lib/mail-srs.js",
+  "lib/metrics.js",
+  "lib/middleware/body-parser.js",
+  "lib/middleware/tus-upload.js",
+  "lib/pqc-agent.js",
+  "lib/public-suffix.js",
+  "lib/queue.js",
+  "lib/router.js",
+  "lib/scheduler.js",
+  "lib/session-device-binding.js",
+  "lib/test-harness.js",
+  "lib/websocket.js",
+];
+
+// A top-of-file require-assignment line. Plain identifier OR a `{ ... }`
+// destructure on the left; require / lazyRequire on the right.
+var _REQUIRE_ALIGN_LINE = /^\s*var\s+(?:\{[^}]*\}|[A-Za-z_$][\w$]*)\s*=\s*(?:require|lazyRequire)\s*\(/;
+
+// For a require-assignment line: lhsLen (length of the LHS up to and
+// including its last non-space token char), col (the `=` column = lhsLen
+// + the padding spaces), and pad (the padding-space count). Returns null
+// for any line that is not a require-assignment.
+function _requireEqInfo(line) {
+  var m = line.match(/^(.*?[^\s=!<>+\-*/%&|^])(\s*)=\s*(?:require|lazyRequire)\s*\(/);
+  if (!m) return null;
+  return { lhsLen: m[1].length, col: m[1].length + m[2].length, pad: m[2].length };
+}
+
+// The modal `=` column of a sub-block: the column the most require lines
+// land on. Ties break to the wider column (the deliberately-padded one,
+// not a short outlier), so a block of two aligned lines plus a stray
+// short `var C =` resolves to the aligned column.
+function _requireModalColumn(infos) {
+  var counts = {};
+  var best   = null;
+  var bestN  = -1;
+  for (var i = 0; i < infos.length; i++) {
+    var c = infos[i].info.col;
+    counts[c] = (counts[c] || 0) + 1;
+    if (counts[c] > bestN || (counts[c] === bestN && c > best)) {
+      bestN = counts[c];
+      best  = c;
+    }
+  }
+  return best;
+}
+
+function testRequireBlockAlignment() {
+  // class: require-block-misaligned
+  var files = _libFiles();
+  var bad = [];
+
+  for (var fi = 0; fi < files.length; fi++) {
+    var rel = _relPath(files[fi]);
+    if (REQUIRE_ALIGN_ALLOWLIST.indexOf(rel) !== -1) continue;
+    var content;
+    try { content = fs.readFileSync(files[fi], "utf8"); }
+    catch (_e) { continue; }
+    var lines = content.split(/\r?\n/);
+
+    // Locate the first leading require line. Skip the shebang,
+    // "use strict", and the top docblock / comments + blanks. Bail the
+    // moment real code appears before any require (no leading region).
+    var firstReq = -1;
+    for (var j = 0; j < lines.length; j++) {
+      if (_REQUIRE_ALIGN_LINE.test(lines[j])) { firstReq = j; break; }
+      var t = lines[j].trim();
+      if (t === "") continue;
+      if (/^("use strict"|'use strict');?$/.test(t)) continue;
+      if (/^#!/.test(t)) continue;
+      if (/^\/\//.test(t)) continue;
+      if (/^\/\*/.test(t) || /^\*/.test(t) || /\*\//.test(t)) continue;
+      break;
+    }
+    if (firstReq === -1) continue;
+
+    // Collect the contiguous leading require region: require lines,
+    // blank lines (sub-block separators), and interior comment lines
+    // (also sub-block separators). Stop at the first real-code line
+    // that is not a require.
+    var region = [];
+    var inBlockComment = false;
+    for (var k = firstReq; k < lines.length; k++) {
+      var line = lines[k];
+      var tt = line.trim();
+      if (inBlockComment) {
+        region.push({ n: k + 1, line: line, kind: "comment" });
+        if (/\*\//.test(tt)) inBlockComment = false;
+        continue;
+      }
+      if (_REQUIRE_ALIGN_LINE.test(line)) { region.push({ n: k + 1, line: line, kind: "req" }); continue; }
+      if (tt === "") { region.push({ n: k + 1, line: line, kind: "blank" }); continue; }
+      if (/^\/\//.test(tt)) { region.push({ n: k + 1, line: line, kind: "comment" }); continue; }
+      if (/^\/\*/.test(tt)) {
+        region.push({ n: k + 1, line: line, kind: "comment" });
+        if (!/\*\//.test(tt)) inBlockComment = true;
+        continue;
+      }
+      break;
+    }
+
+    // Split the region into sub-blocks separated by a blank line OR a
+    // comment divider; each aligns independently. For every sub-block of
+    // >=3 require lines that shows alignment intent (some line padded
+    // with 2+ spaces before `=`), flag every line whose `=` is off the
+    // modal column yet whose LHS is short enough to reach it.
+    var sub = [];
+    var flush = function () {
+      var infos = [];
+      for (var s = 0; s < sub.length; s++) {
+        if (sub[s].kind !== "req") continue;
+        var info = _requireEqInfo(sub[s].line);
+        if (info) infos.push({ entry: sub[s], info: info });
+      }
+      sub = [];
+      if (infos.length < 3) return;
+      var anyPadded = infos.some(function (e) { return e.info.pad >= 2; });
+      if (!anyPadded) return;                      // compact single-space style — not aligned, not flagged
+      var modalCol = _requireModalColumn(infos);
+      for (var z = 0; z < infos.length; z++) {
+        var e = infos[z];
+        if (e.info.col === modalCol) continue;     // already on the column — fine
+        if (e.info.lhsLen + 1 > modalCol) continue; // LHS too wide to reach the column — house-style overshoot, exempt
+        bad.push({
+          file:    rel,
+          line:    e.entry.n,
+          content: e.entry.line.trim() +
+                   "  — `=` off the require-block column (align every `=` in this " +
+                   "sub-block to one column, or reflow the group to compact single-space)",
+        });
+      }
+    };
+    for (var r = 0; r < region.length; r++) {
+      if (region[r].kind === "blank" || region[r].kind === "comment") { flush(); continue; }
+      sub.push(region[r]);
+    }
+    flush();
+  }
+
+  _report("top-of-file require blocks keep their `=` signs column-aligned " +
+          "(per blank-or-comment-separated sub-block; compact single-space " +
+          "blocks and unfittable-LHS lines exempt)",
+    bad);
+}
+
 function testRequireBindingConsistency() {
   // class: require-binding-name
   // For each module imported via the plain `var <name> = require("<module>")`
@@ -2104,15 +2306,16 @@ async function testNoDuplicateCodeBlocks() {
   //   SHINGLE_SIZES — token-window sizes scanned. Smaller catches
   //     finer-grain idiom (3-call chains); larger catches whole
   //     function bodies. Multi-pass produces both.
-  //   MIN_DISTINCT_FILES — threshold for cross-file repetition. 3+
-  //     means "appears in at least 3 files" (drift candidate).
+  //   MIN_DISTINCT_FILES — min files for a shingle to enter the
+  //     advisory inventory (2+). The hard-fail gate is the separate
+  //     STRONG_MIN_FILES = 3 (a shape in 3+ files fails the build).
   //   MIN_DISTINCT_TOKENS — skip shingles whose tokens are mostly
   //     punctuation / repeated closer chars.
   //   MAX_REPORTED_PER_LENGTH — cap to keep the report scannable;
   //     biggest-N hits are surfaced first because they represent the
   //     largest primitive opportunities.
   var SHINGLE_SIZES = [60, 50, 40, 30, 22, 16, 12, 8];
-  var MIN_DISTINCT_FILES = 2;          // ≥ 3 files share the shape
+  var MIN_DISTINCT_FILES = 2;          // 2+ files → advisory inventory (STRONG_MIN_FILES = 3 hard-fails)
   var MIN_DISTINCT_TOKENS = 5;
   var _MAX_REPORTED_PER_LENGTH = 5000;
 
@@ -2590,7 +2793,6 @@ async function testNoDuplicateCodeBlocks() {
       mode:  "family-subset",
       files: [
         "lib/ai-disclosure.js:chatbot",
-        "lib/auth/dpop.js:_canonicalJwk",
         "lib/auth/sd-jwt-vc-holder.js:store",
         "lib/compliance-sanctions.js:screen",
         "lib/dora.js:_validateReportInput",
@@ -2992,7 +3194,6 @@ async function testNoDuplicateCodeBlocks() {
       files: [
         "lib/guard-email.js:_detectAddressIssues",
         "lib/middleware/scim-server.js:_parseQuery",
-        "lib/self-update.js:_splitSemver",
       ],
       reason: "Three unrelated string-parser primitives that incidentally share a 50-token charCodeAt-driven scan shingle. _detectAddressIssues walks RFC 5322 addr-spec bytes; _parseQuery walks SCIM filter tokens (RFC 7644 §3.4.2.2); _splitSemver walks SemVer 2.0.0 §2 version-core + pre-release + build identifiers. Each owns a domain-specific error class. Consolidation would couple RFC 5322 / RFC 7644 / SemVer parsing into one primitive none of them want.",
     },
@@ -3081,7 +3282,6 @@ async function testNoDuplicateCodeBlocks() {
         "lib/mail-dkim.js:bootstrap",
         "lib/mail-dkim.js:dualSigner",
         "lib/mail-mdn.js:_generateBoundary",
-        "lib/mail-mdn.js:_validateOpts",
         "lib/mail-mdn.js:build",
         "lib/self-update.js:poll",
         "lib/watcher.js:_detectAutoMode",
@@ -3409,7 +3609,6 @@ async function testNoDuplicateCodeBlocks() {
         // the RFC 8620 / RFC 8621 wire-protocol shape.
         "lib/guard-jmap.js:<top>",
         "lib/guard-jmap.js:validate",
-        "lib/guard-jmap.js:_resolveProfile",
         "lib/guard-jmap.js:compliancePosture",
       ],
       reason: "Guard-family scaffolding required by `b.gateContract` — every guard ships PROFILES (strict/balanced/permissive) + COMPLIANCE_POSTURES (hipaa/pci-dss/gdpr/soc2) + _resolveProfile dispatcher + a top-level @module JSDoc block. Each member's profile body / posture vocab / validate() body is domain-distinct; the surrounding skeleton is the family contract. Consolidation would erase the per-guard validation rules and break the `b.guardAll` registration pattern.",
@@ -3551,7 +3750,6 @@ async function testNoDuplicateCodeBlocks() {
         "lib/agent-tenant.js:_checkDestroyPreconditions",
         "lib/agent-idempotency.js:_put",
         "lib/auth/dpop.js:verify",
-        "lib/auth/dpop.js:_canonicalJwk",
         "lib/auth/sd-jwt-vc-holder.js:store",
         "lib/backup/index.js:scheduleTest",
         "lib/break-glass.js:_validatePolicySet",
@@ -3632,7 +3830,6 @@ async function testNoDuplicateCodeBlocks() {
       // jwk canonicalization). Distinct error classes.
       mode:  "family-subset",
       files: [
-        "lib/auth/dpop.js:_canonicalJwk",
         "lib/auth/dpop.js:verify",
         "lib/auth/sd-jwt-vc-holder.js:store",
         "lib/compliance-sanctions.js:screen",
@@ -3727,16 +3924,6 @@ async function testNoDuplicateCodeBlocks() {
       ],
       reason: "Comma-separated header value parser walking pieces and splitting on `=` per piece. Each enforces a different grammar (RFC 9213 directive list, RFC 9111 Cache-Control directives, Sec-CH-UA brand-member params, RFC 7240/tus.io upload metadata, RFC 9110 quality-list / Accept-* header). Consolidating would couple unrelated header families.",
     },
-    {
-      mode: "family-subset",
-      files: [
-        "lib/cdn-cache-control.js:_splitTopLevelCommas",
-        "lib/client-hints.js:_splitTopLevelSemis",
-        "lib/http-client-cache.js:_splitTopLevelCommas",
-        "lib/http-message-signature.js:_splitTopLevelSemis",
-      ],
-      reason: "Quote-aware top-level structured-fields splitter — walks a string respecting RFC 8941 §3.3.3 quoted-string state with backslash-escape so `,` (cdn-cache-control / http-client-cache) or `;` (client-hints brand-member params / http-message-signature Signature-Input params) inside quoted-string values doesn't split mid-value. Same shape replicated across four parsers because they each split on a different delimiter for a different RFC; consolidation candidate via a shared `b.structuredFields.splitTopLevel(s, sep)` helper but the per-file copy is intentional pending the extraction (operator-grep finds the splitter inside the file that uses it).",
-    },
     {
       mode: "family-subset",
       files: [
@@ -4129,7 +4316,6 @@ async function testNoDuplicateCodeBlocks() {
     {
       mode:  "family-subset",
       files: [
-        "lib/auth/dpop.js:_canonicalJwk",
         "lib/compliance-sanctions.js:_emitAudit",
         "lib/compliance-sanctions.js:_emitMetric",
         "lib/compliance-sanctions.js:create",
@@ -4403,7 +4589,7 @@ async function testNoDuplicateCodeBlocks() {
         "lib/auth/fido-mds3.js:_b64urlDecode",
         "lib/auth/fido-mds3.js:_parseJws",
         "lib/auth/fido-mds3.js:_verifyJws",
-        "lib/auth/fido-mds3.js:_verifyJwsSignature",
+        "lib/auth/fido-mds3.js:_verifyJws",
         "lib/auth/fido-mds3.js:_verifyParamsForAlg",
         "lib/auth/fido-mds3.js:fetch",
         "lib/auth/fido-mds3.js:verifyAuthenticator",
@@ -4620,7 +4806,7 @@ async function testNoDuplicateCodeBlocks() {
       files: [
         "lib/guard-list-id.js:_refuse",
         "lib/guard-list-unsubscribe.js:_verdict",
-        "lib/guard-smtp-command.js:_validateAuth",
+        "lib/guard-smtp-command.js:_parseAuthCommandSyntax",
         "lib/safe-dns.js:_decodeOpt",
       ],
       reason: "Three independently-domain'd helpers (List-Unsubscribe verdict assembly / SMTP AUTH mech validation / DNS OPT pseudo-RR decode) share local-var declaration + return-shape token sequence. Bodies are domain-distinct (different field names, different error checks). Consolidation would couple unrelated parsers.",
@@ -5029,7 +5215,6 @@ async function testNoDuplicateCodeBlocks() {
     },
     {
       files: [
-        "lib/auth/dpop.js:_canonicalJwk",
         "lib/auth/sd-jwt-vc-holder.js:store",
         "lib/compliance-sanctions.js:screen",
         "lib/dora.js:_validateReportInput",
@@ -5743,7 +5928,7 @@ function testNoDeniedVendors() {
 
 // ---- Pattern 42: state-stamps in user-facing docs (smoke test the wiki) ----
 
-function testNoStateStampsInPublicDocs() {
+function testStateStampScanningDeferred() {
   // feedback_no_state_stamps_in_docs.md — version numbers / test counts
   // in README / SECURITY / CONTRIBUTING etc. rot the moment the next
   // release ships. We can't easily grep these via the lib walker, but
@@ -7974,7 +8159,7 @@ var KNOWN_ANTIPATTERNS = [
     requires: /_checkDualControlGate|_resolveDualControlGate|dualControlGrant/,
     skipCommentLines: true,
     allowlist: [],
-    reason: "v0.14.7 — audit-chain purge is irreversible and tamper-evidence-destroying. The discipline: the chain may only be truncated under a two-authorizer dual-control grant. db.js defines the gate (_checkDualControlGate) and audit-tools.js purge() resolves+enforces it (_resolveDualControlGate) before calling db().purgeAuditChain; both files satisfy the companion check. A future file that calls purgeAuditChain without naming the gate would let a single operator delete evidence — exactly the shape this blocks.",
+    reason: "v0.14.7 — audit-chain purge is irreversible and tamper-evidence-destroying. The discipline: the chain may only be truncated under a two-authorizer dual-control grant. db.js defines the gate (_checkDualControlGate) and audit-tools.js purge() resolves+enforces it (_resolveDualControlGate) before calling db().purgeAuditChain — the only live call site, which satisfies the companion check (db.js's own purgeAuditChain references are its definition + JSDoc, not call sites, so it never matches). A future file that calls purgeAuditChain without naming the gate would let a single operator delete evidence — exactly the shape this blocks.",
   },
 
   {
@@ -10788,6 +10973,7 @@ async function run() {
   testNoTierTerminologyInLib();
   testNoInlineRequires();
   testRequireBindingConsistency();
+  testRequireBlockAlignment();
   testNodeBuiltinPrefixConsistency();
   testNoInternalBindingNameInProse();
   testNoDynamicRequires();
@@ -10827,7 +11013,7 @@ async function run() {
   testNoHandrolledUrlBuild();
   testNoHandrolledRetryLoop();
   await testNoDuplicateCodeBlocks();
-  testNoStateStampsInPublicDocs();
+  testStateStampScanningDeferred();
   testNoLegacyUrlFormat();
   testNoRawHeadersDistinct();
   testNoDenseWildcardRunsInLib();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/blamejs-shop",
-  "version": "0.3.15",
+  "version": "0.3.17",
   "description": "Open-source framework built on blamejs. Vendored stack, zero npm runtime deps, PQC-first crypto, security-on by default.",
   "main": "lib/index.js",
   "scripts": {