@blamejs/blamejs-shop 0.3.42 → 0.3.44

package/lib/vendor/blamejs/release-notes/v0.14.16.json

@@ -0,0 +1,45 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.14.16",
+  "date": "2026-05-31",
+  "headline": "Connection entry-point ports are validated at config time",
+  "summary": "Six connection entry points previously read opts.port with a bare `|| <default>` fallback, silently coercing a string, negative, NaN, or out-of-range port instead of catching the operator's typo. A new b.validateOpts.optionalPort enforces the RFC 6335 §6 wire-valid range and is wired into b.mail.smtpTransport, b.ntpCheck.querySingle, b.networkDns.useDnsOverTls, b.networkNts (KE handshake / query / facade), b.redisClient.create, and createApp().listen — each now throws at construction with a clear message naming the bad value. The app.listen / createApp bind site opts into allowZero so port 0 (the legitimate ephemeral-bind sentinel) still works; the five outbound-connect sites require [1,65535].",
+  "sections": [
+    {
+      "heading": "Added",
+      "items": [
+        {
+          "title": "`b.validateOpts.optionalPort`",
+          "body": "A config-time port validator: `optionalPort(value, label, errorClass, code, opts?)` returns an omitted (`undefined` / `null`) port unchanged, and otherwise requires an integer in the RFC 6335 §6 wire-valid range [1,65535] — rejecting a string, negative, NaN, Infinity, fractional, or out-of-range value. Pass `{ allowZero: true }` for a listen-bind site where port 0 is the OS ephemeral-bind sentinel. The thrown message reports the offending shape (so `Infinity` / `\"443\"` stay visible), and routes a caller-supplied typed framework error (or a plain Error when none is given), matching the existing `optionalPositiveFinite` family."
+        }
+      ]
+    },
+    {
+      "heading": "Changed",
+      "items": [
+        {
+          "title": "Connection entry points reject a malformed port at construction",
+          "body": "`b.mail.smtpTransport`, `b.ntpCheck.querySingle`, `b.networkDns.useDnsOverTls`, `b.networkNts.performKeHandshake` / `query` / `querySingle`, `b.redisClient.create`, and `createApp().listen` (plus the `createApp` constructor's default port) now validate `opts.port` and throw synchronously on a non-integer / out-of-range value rather than coercing it through `||` to a default. This is a behavior change for a caller that was passing a non-canonical port (e.g. the string `\"587\"` or a NaN) and relying on the silent fallback — pass an integer in [1,65535] instead (or `0` for an ephemeral `createApp().listen` bind). `b.ntpCheck` gains a typed `NtpCheckError` for this (it had no error class before)."
+        }
+      ]
+    },
+    {
+      "heading": "Detectors",
+      "items": [
+        {
+          "title": "Connection entry points must compose the port validator",
+          "body": "A new check flags a lib connection entry point that reads `opts.port` / `opts.kePort` / `opts.ntpPort` with a `|| <default>` fallback without composing `b.validateOpts.optionalPort` (or the equivalent `numericBounds.isPositiveFiniteInt` + 65535 cap), so an unvalidated port read can't slip back in."
+        }
+      ]
+    },
+    {
+      "heading": "Migration",
+      "items": [
+        {
+          "title": "Pass an integer port to connection primitives",
+          "body": "If you were passing a non-integer or out-of-range `opts.port` to a mail / NTP / NTS / DNS-over-TLS / Redis transport or to `createApp().listen` and relying on the silent `|| default` fallback, that now throws at construction. Pass an integer in [1,65535]; for an ephemeral `createApp().listen` bind, pass `0` (still accepted)."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/test/layer-0-primitives/codebase-patterns.test.js

@@ -2743,6 +2743,33 @@ async function testNoDuplicateCodeBlocks() {
       ],
       reason: "v0.12.42 — validateOpts-then-guard prelude shared by three builder-style functions: cert.create mints a certificate, mail-send-deliver.deliver sends a message, vc.present builds + signs a Verifiable Presentation. The common shingle is the `validateOpts(allowedKeys) + required-field / non-empty-array guards + typed-error throw` idiom; the bodies diverge entirely (X.509 minting / SMTP delivery / VC-JOSE-COSE presentation envelope). Same validate-then-guard family as the v0.12.29 / v0.12.33 / v0.12.40 clusters.",
     },
+    {
+      mode:  "family-subset",
+      files: [
+        "lib/api-key.js:_validateIssueOpts",
+        "lib/http-client-cache.js:create",
+        "lib/network-dns.js:useDnsOverTls",
+      ],
+      reason: "v0.14.15 — validateOpts config-validation prelude (validateOpts(allowedKeys) + requireNonEmptyString + the new optionalPort port-range guard + typed-error throw). api-key._validateIssueOpts validates an API-key issue spec; http-client-cache.create validates a cache config; network-dns.useDnsOverTls validates a DoT endpoint. Wiring validateOpts.optionalPort into the DoT site tipped its preamble past the 50-token shingle threshold against two unrelated config-time primitives. Bodies diverge entirely; the shared primitive IS validateOpts (already extracted) — coupling these specs would couple three unrelated standards on a syntactic accident. Verified coincidental (absent on clean main; the 3 functions are unrelated). Same validate-then-guard family as the v0.12.29 / v0.12.42 clusters.",
+    },
+    {
+      mode:  "family-subset",
+      files: [
+        "lib/agent-idempotency.js:_safeAudit",
+        "lib/agent-orchestrator.js:_safeAudit",
+        "lib/redis-client.js:_frameToValue",
+      ],
+      reason: "v0.14.15 — coincidental boilerplate shingle surfaced when the validateOpts.optionalPort wiring was added to redis-client.create: the file's token stream shifted enough that a 50-token window in redis-client.js clusters with the identical _safeAudit audit-emit wrappers in agent-idempotency / agent-orchestrator (a try/catch around audit().safeEmit). _safeAudit drop-silently emits an audit event; redis-client._frameToValue parses a RESP wire frame — entirely unrelated behaviour sharing only a generic guard/try-catch idiom. Verified absent on clean main; no shared logic to extract.",
+    },
+    {
+      mode:  "family-subset",
+      files: [
+        "lib/compliance-sanctions-fetcher.js:create",
+        "lib/network-nts.js:performKeHandshake",
+        "lib/web-push-vapid.js:buildVapidAuthHeader",
+      ],
+      reason: "v0.14.15 — validateOpts config-validation prelude again: network-nts.performKeHandshake gained the optionalPort port-range guard, tipping its preamble past the shingle threshold against compliance-sanctions-fetcher.create (sanctions-list fetch config) and web-push-vapid.buildVapidAuthHeader (VAPID JWT auth header build). Three unrelated specs (NTS-KE handshake / sanctions fetch / Web-Push VAPID) sharing only the validateOpts-then-guard idiom; the shared primitive is validateOpts. Verified coincidental (absent on clean main). Same family as the v0.12.29 / v0.12.42 clusters.",
+    },
     {
       mode:  "family-subset",
       files: [
@@ -6523,6 +6550,8 @@ var KNOWN_ANTIPATTERNS = [
 
   { id: "consent-purposes-null-proto", primitive: "the recognized-purpose map (PURPOSES) must be a null-prototype object so an operator-supplied free-form purpose colliding with an Object.prototype member (toString / constructor / __proto__) resolves to undefined, not the prototype value", scanScope: "lib", regex: /var PURPOSES\s*=\s*Object\.freeze\(/, requires: /Object\.create\(null\)/, allowlist: [], reason: "v0.14.14 Codex P2 on PR #295 (CWE-1321) — recognizedPurpose(name) + grant() index PURPOSES[purpose] with an operator-controlled value; a plain-prototype map returns Object.prototype.toString (truthy) for purpose \"toString\", breaking the null-for-free-form contract and entering grant()'s recognized branch for a value listPurposes() never exposes. PURPOSES is now Object.freeze(Object.assign(Object.create(null), {...})) so every unrecognized key resolves to undefined. Detector requires the null-prototype declaration so the lookup can't silently revert to a plain object." },
 
+  { id: "connect-entry-point-port-must-compose-optionalPort", primitive: "a connection entry point reading opts.port / opts.kePort / opts.ntpPort with a `|| <default>` fallback must first validate it via validateOpts.optionalPort (or, where a permanent typed error is needed, the equivalent numericBounds.isPositiveFiniteInt(opts.port) + 65535 cap) — an unvalidated opts.port || N silently accepts a string / negative / NaN / out-of-range port", scanScope: "lib", regex: /\bopts\.(?:port|kePort|ntpPort)\s*\|\|/, requires: /validateOpts\.optionalPort\(|isPositiveFiniteInt\(opts\.port\)/, allowlist: [], reason: "v0.14.15 — the connection entry points (mail.smtpTransport, ntpCheck.querySingle, dns.useDnsOverTls, nts.performKeHandshake / querySingle / query, redis.create) read opts.port || <default>, silently coercing a string / negative / NaN / >65535 port; rule §5 says config-time entry points THROW so the operator catches the typo at boot. Each now composes validateOpts.optionalPort (RFC 6335 §6 [1,65535]; allowZero for the app.listen ephemeral bind) — or, where a MailError-permanent typed error is needed, the same numericBounds.isPositiveFiniteInt + 65535 rule inline. The requires-companion clears a file once it validates; a new entry point reading opts.port || N without composing the validator trips the gate." },
+
   {
     // ROTATION-EPOCH ACCEPT (v0.14.x): a vault-key rotation (b.vault.rotate)
     // re-keys the local dataDir, which changes the SHA3-512 fingerprint of

package/lib/vendor/blamejs/test/layer-0-primitives/validate-opts-port.test.js

@@ -0,0 +1,70 @@
+"use strict";
+// b.validateOpts.optionalPort — RFC 6335 §6 port-range validator — plus the
+// representative connection entry-point wiring (ntpCheck.querySingle; the other
+// five sites compose the identical guard).
+
+var helpers     = require("../helpers");
+var b           = helpers.b;
+var check       = helpers.check;
+var redisClient = require("../../lib/redis-client");
+
+function _thrCode(fn) { try { fn(); return null; } catch (e) { return e.code || e.message; } }
+
+function run() {
+  var vo = b.validateOpts;
+  check("optionalPort is a function", typeof vo.optionalPort === "function");
+
+  // pass-through + valid ports
+  check("optionalPort(undefined) → undefined", vo.optionalPort(undefined) === undefined);
+  check("optionalPort(null) → null",           vo.optionalPort(null) === null);
+  check("optionalPort(443) → 443",             vo.optionalPort(443, "p") === 443);
+  check("optionalPort(1) accepted",            vo.optionalPort(1, "p") === 1);
+  check("optionalPort(65535) accepted",        vo.optionalPort(65535, "p") === 65535);
+
+  // 0 rejected by default, accepted with allowZero (ephemeral listen-bind)
+  check("optionalPort(0) throws by default",   _thrCode(function () { vo.optionalPort(0, "p"); }) !== null);
+  check("optionalPort(0, allowZero) → 0",      vo.optionalPort(0, "p", undefined, undefined, { allowZero: true }) === 0);
+
+  // out-of-range / non-integer / wrong-type all throw
+  [65536, -1, 0.5, "443", NaN, Infinity, "x", true, {}].forEach(function (bad, i) {
+    check("optionalPort rejects bad value #" + i + " (" + String(bad) + ")",
+          _thrCode(function () { vo.optionalPort(bad, "p"); }) !== null);
+  });
+  // 65536 is out of range even with allowZero
+  check("optionalPort(65536, allowZero) still throws",
+        _thrCode(function () { vo.optionalPort(65536, "p", undefined, undefined, { allowZero: true }); }) !== null);
+
+  // message carries numericBounds.shape() so Infinity / "443" stay visible
+  var msg = _thrCode(function () { vo.optionalPort(Infinity, "p"); });
+  check("optionalPort message shows the bad shape", typeof msg === "string" && /Infinity/.test(msg));
+
+  // typed-error class + code via a defineClass-built framework error
+  check("optionalPort routes a typed error class + code",
+        _thrCode(function () { vo.optionalPort(-1, "p", b.ntpCheck.NtpCheckError, "ntp/bad-port"); }) === "ntp/bad-port");
+
+  // plain Error when no errorClass is supplied
+  var plain = null;
+  try { vo.optionalPort(-1, "p"); } catch (e) { plain = e; }
+  check("optionalPort throws a plain Error with no errorClass", (plain instanceof Error) && !plain.code);
+
+  // representative entry-point wiring: ntpCheck.querySingle rejects a bad port
+  // synchronously (before the Promise) with a typed NtpCheckError.
+  check("b.ntpCheck.NtpCheckError is a constructor", typeof b.ntpCheck.NtpCheckError === "function");
+  check("ntpCheck.querySingle({port:-1}) throws ntp/bad-port",
+        _thrCode(function () { b.ntpCheck.querySingle("pool.ntp.org", { port: -1 }); }) === "ntp/bad-port");
+  check("ntpCheck.querySingle({port:70000}) throws ntp/bad-port",
+        _thrCode(function () { b.ntpCheck.querySingle("pool.ntp.org", { port: 70000 }); }) === "ntp/bad-port");
+
+  // A url-supplied connection port must be range-checked too — the opts.port
+  // guard alone misses a port resolved from the url, so redis://h:0 (parsed to
+  // port 0) would otherwise reach an outbound connect. create() is inert until
+  // .connect(), so a valid url throws nothing.
+  check("redis url-port 0 rejected at create (resolved-port guard)",
+        _thrCode(function () { redisClient.create({ url: "redis://localhost:0" }); }) !== null);
+  check("redis url-port out-of-range rejected at create",
+        _thrCode(function () { redisClient.create({ url: "redis://localhost:99999" }); }) !== null);
+  check("redis valid url-port accepted (no throw at create)",
+        _thrCode(function () { redisClient.create({ url: "redis://localhost:6379" }); }) === null);
+}
+
+module.exports = { run: run };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/blamejs-shop",
-  "version": "0.3.42",
+  "version": "0.3.44",
   "description": "Open-source framework built on blamejs. Vendored stack, zero npm runtime deps, PQC-first crypto, security-on by default.",
   "main": "lib/index.js",
   "scripts": {