@blamejs/blamejs-shop 0.3.55 → 0.3.57

package/lib/vendor/blamejs/test/layer-0-primitives/archive.test.js

@@ -128,6 +128,185 @@ async function run() {
   var emptyBuf = b.archive.zip().toBuffer();
   check("empty archive: just EOCD (22 bytes)",  emptyBuf.length === 22);
   check("empty archive: EOCD signature",        _readU32LE(emptyBuf, 0) === 0x06054b50);
+
+  await testZip64Write();
+}
+
+// ZIP64 write (APPNOTE 6.3.10 §4.3.14 EOCD64 / §4.3.15 locator / §4.4.8
+// size fields / §4.5.3 extended-information extra). The writer emits
+// ZIP64 only when needed; small archives stay classic byte-for-byte, and
+// what it emits round-trips through the v0.14.18 random-access reader.
+var SIG_EOCD64         = Buffer.from([0x50, 0x4b, 0x06, 0x06]);
+var SIG_EOCD64_LOCATOR = Buffer.from([0x50, 0x4b, 0x06, 0x07]);
+var METHOD_STORE       = 0;
+
+async function testZip64Write() {
+  // ---- Classic archives carry no ZIP64 trailer or per-entry extra ----
+  var classic = b.archive.zip();
+  classic.addFile("readme.txt", "Hello, world!\n");
+  classic.addFile("data/users.csv", "id,name\n1,alice\n2,bob\n");
+  var classicBuf = classic.toBuffer();
+  check("zip64-write: small archive has no ZIP64 EOCD",
+        classicBuf.indexOf(SIG_EOCD64) === -1);
+  check("zip64-write: small archive has no ZIP64 locator",
+        classicBuf.indexOf(SIG_EOCD64_LOCATOR) === -1);
+  check("zip64-write: small archive ends in classic 22-byte EOCD",
+        _readU32LE(classicBuf, classicBuf.length - 22) === 0x06054b50);
+  check("zip64-write: first LFH carries no extra field",
+        _readU16LE(classicBuf, 28) === 0);
+
+  // ---- Byte-stable: same inputs + mtimes emit identical bytes ----
+  var fixedMtime = new Date(Date.UTC(2026, 0, 1, 0, 0, 0));
+  function buildFixed() {
+    var z = b.archive.zip();
+    z.addFile("a.txt", "alpha", { mtime: fixedMtime });
+    z.addFile("b.txt", "beta",  { mtime: fixedMtime });
+    return z.toBuffer();
+  }
+  check("zip64-write: classic output is byte-stable",
+        buildFixed().equals(buildFixed()));
+
+  // ---- >65535 entries forces the ZIP64 EOCD record + locator, and the
+  //      classic EOCD entry-count fields carry the 0xFFFF sentinel. The
+  //      reader resolves the true count from the ZIP64 EOCD record. ----
+  var many = b.archive.zip();
+  var manyCount = 65536;
+  for (var i = 0; i < manyCount; i++) many.addFile("f" + i + ".txt", "x");
+  check("zip64-write: entryCount tracks 65536 entries", many.entryCount === manyCount);
+  var manyBuf = many.toBuffer();
+  check("zip64-write: >65535 entries emits ZIP64 EOCD record",
+        manyBuf.indexOf(SIG_EOCD64) !== -1);
+  check("zip64-write: >65535 entries emits ZIP64 EOCD locator",
+        manyBuf.indexOf(SIG_EOCD64_LOCATOR) !== -1);
+  check("zip64-write: classic EOCD entry count is 0xFFFF sentinel",
+        _readU16LE(manyBuf, manyBuf.length - 22 + 10) === 0xffff);
+
+  var manyReader = b.archive.read.zip(b.archive.adapters.buffer(manyBuf), {
+    bombPolicy: { maxEntries: 2000000 },
+  });
+  var manyEntries = await manyReader.inspect();
+  check("zip64-write: reader resolves true count from ZIP64 EOCD",
+        manyEntries.length === manyCount);
+  check("zip64-write: first/last names round-trip",
+        manyEntries[0].name === "f0.txt" &&
+        manyEntries[manyCount - 1].name === "f65535.txt");
+
+  // Round-trip recovers byte-identical content for a sampled entry.
+  var firstBytes = null;
+  for await (var rEnt of manyReader.extractEntries({ allowEncrypted: false })) {
+    firstBytes = rEnt.bytes;
+    break;
+  }
+  check("zip64-write: extractEntries recovers content from a ZIP64 archive",
+        firstBytes && firstBytes.equals(Buffer.from("x")));
+
+  // ---- Per-entry ZIP64 extended-information extra field (§4.5.3) ----
+  // Real >4 GiB entries are impractical in a unit test; the writer's
+  // extra-field builder is exercised at logical sizes/offsets above the
+  // 32-bit limit, and the produced extra is fed to the v0.14.18 reader,
+  // which resolves the full 64-bit value back. The entry-count + EOCD64
+  // paths above already round-trip the EOCD64/locator end to end.
+  var z64 = b.archive._zip64ForTest;
+  check("zip64-write: U32_MAX is NOT an overflow (boundary)",
+        z64.entryNeedsZip64(z64.U32_MAX, 0, 0) === false);
+  check("zip64-write: size above U32_MAX overflows",
+        z64.entryNeedsZip64(0, z64.U32_MAX + 1, 0) === true);
+  check("zip64-write: offset above U32_MAX overflows",
+        z64.entryNeedsZip64(0, 0, z64.U32_MAX + 1) === true);
+
+  // No overflow → empty extra (classic stays classic).
+  check("zip64-write: no-overflow extra is empty",
+        z64.buildExtra(100, 100, 100, true).length === 0);
+
+  // CD extra (offset included) at overflowing usize+csize → 16-byte data
+  // block (uncompressedSize, compressedSize), header id 0x0001.
+  var big = z64.U32_MAX + 1234;
+  var cdExtra = z64.buildExtra(big, big, 0, true);
+  check("zip64-write: CD extra header id is 0x0001",
+        cdExtra.readUInt16LE(0) === z64.EXTRA_HEADER_ID);
+  check("zip64-write: CD extra data length is 16 (usize+csize)",
+        cdExtra.readUInt16LE(2) === 16);
+  check("zip64-write: CD extra carries usize then csize (APPNOTE order)",
+        cdExtra.readBigUInt64LE(4) === BigInt(big) &&
+        cdExtra.readBigUInt64LE(12) === BigInt(big));
+
+  // Offset overflow too → 24-byte data block (usize, csize, offset).
+  var bigOff = z64.U32_MAX + 7;
+  var cdExtraOff = z64.buildExtra(big, big, bigOff, true);
+  check("zip64-write: CD extra widens to 24 bytes when offset overflows",
+        cdExtraOff.readUInt16LE(2) === 24 &&
+        cdExtraOff.readBigUInt64LE(20) === BigInt(bigOff));
+
+  // LFH extra never carries the offset (§4.5.3) — 16 bytes even when the
+  // offset overflows.
+  var lfhExtra = z64.buildExtra(big, big, bigOff, false);
+  check("zip64-write: LFH extra omits the offset field",
+        lfhExtra.readUInt16LE(2) === 16);
+
+  // End to end: a synthetic single-entry archive whose LFH + CD ZIP64
+  // extra blocks come from the writer's builder, with the classic size
+  // fields set to the sentinel, resolves through the real reader to the
+  // full 64-bit logical size.
+  var payload = Buffer.from("ZIP64 writer-extra resolution payload.\n", "utf8");
+  var name    = "z64w.txt";
+  var nameBuf = Buffer.from(name, "utf8");
+  var crc     = b.archive._crc32ForTest(payload);
+  var logical = z64.U32_MAX + payload.length;  // > 4 GiB
+
+  var lfhExtraBig = z64.buildExtra(logical, logical, 0, false);
+  var lfh = Buffer.alloc(30);
+  lfh.writeUInt32LE(0x04034b50, 0);
+  lfh.writeUInt16LE(45, 4);
+  lfh.writeUInt16LE(0, 6);
+  lfh.writeUInt16LE(METHOD_STORE, 8);
+  lfh.writeUInt16LE(0, 10);
+  lfh.writeUInt16LE(0x21, 12);
+  lfh.writeUInt32LE(crc >>> 0, 14);
+  lfh.writeUInt32LE(z64.U32_SENTINEL, 18);
+  lfh.writeUInt32LE(z64.U32_SENTINEL, 22);
+  lfh.writeUInt16LE(nameBuf.length, 26);
+  lfh.writeUInt16LE(lfhExtraBig.length, 28);
+
+  var cdExtraBig = z64.buildExtra(logical, logical, 0, true);
+  var cd = Buffer.alloc(46);
+  cd.writeUInt32LE(0x02014b50, 0);
+  cd.writeUInt16LE(45, 4);
+  cd.writeUInt16LE(45, 6);
+  cd.writeUInt16LE(0, 8);
+  cd.writeUInt16LE(METHOD_STORE, 10);
+  cd.writeUInt16LE(0, 12);
+  cd.writeUInt16LE(0x21, 14);
+  cd.writeUInt32LE(crc >>> 0, 16);
+  cd.writeUInt32LE(z64.U32_SENTINEL, 20);
+  cd.writeUInt32LE(z64.U32_SENTINEL, 24);
+  cd.writeUInt16LE(nameBuf.length, 28);
+  cd.writeUInt16LE(cdExtraBig.length, 30);
+  cd.writeUInt16LE(0, 32);
+  cd.writeUInt16LE(0, 34);
+  cd.writeUInt16LE(0, 36);
+  cd.writeUInt32LE(0, 38);
+  cd.writeUInt32LE(0, 42);
+
+  var localPart = Buffer.concat([lfh, nameBuf, lfhExtraBig, payload]);
+  var cdOffset  = localPart.length;
+  var cdRecord  = Buffer.concat([cd, nameBuf, cdExtraBig]);
+  var eocd = Buffer.alloc(22);
+  eocd.writeUInt32LE(0x06054b50, 0);
+  eocd.writeUInt16LE(1, 8);
+  eocd.writeUInt16LE(1, 10);
+  eocd.writeUInt32LE(cdRecord.length, 12);
+  eocd.writeUInt32LE(cdOffset, 16);
+  var synthetic = Buffer.concat([localPart, cdRecord, eocd]);
+
+  var z64Reader = b.archive.read.zip(b.archive.adapters.buffer(synthetic), {
+    bombPolicy: {
+      maxEntryDecompressedBytes: logical + 16,
+      maxTotalDecompressedBytes: logical + 16,
+    },
+  });
+  var z64Entries = await z64Reader.inspect();
+  check("zip64-write: reader resolves writer-built extra to 64-bit size",
+        z64Entries.length === 1 && z64Entries[0].size === logical);
 }
 
 module.exports = { run: run };

package/lib/vendor/blamejs/test/layer-0-primitives/asyncapi.test.js

@@ -495,6 +495,25 @@ function run() {
           function () {});
   check("asyncapiServe: same-origin omits CORS", sentSO.headers["Access-Control-Allow-Origin"] == null);
 
+  // accessControl={ allowOrigin } echoes one validated origin + Vary: Origin
+  var serveAO = b.middleware.asyncapiServe({
+    document: realApi, accessControl: { allowOrigin: "https://docs.example.com" }, audit: false,
+  });
+  var sentAO = { headers: null };
+  serveAO({ method: "GET", url: "/asyncapi.json", pathname: "/asyncapi.json", headers: {} },
+          { writeHead: function (s, h) { sentAO.headers = h; }, end: function () {} },
+          function () {});
+  check("asyncapiServe: allowOrigin echoed",     sentAO.headers["Access-Control-Allow-Origin"] === "https://docs.example.com");
+  check("asyncapiServe: allowOrigin sets Vary",  sentAO.headers["Vary"] === "Origin");
+
+  // A bad allowOrigin throws at config time
+  rejects("asyncapiServe: allowOrigin with path rejected",
+    function () { b.middleware.asyncapiServe({ document: realApi, accessControl: { allowOrigin: "https://x.example.com/docs" } }); },
+    /bare origin/);
+  rejects("asyncapiServe: allowOrigin CRLF rejected",
+    function () { b.middleware.asyncapiServe({ document: realApi, accessControl: { allowOrigin: "https://x.example.com\r\nX-Evil: 1" } }); },
+    /valid|bare origin/);
+
   check("asyncapiServe.forceRebuild is fn",      typeof serve.forceRebuild === "function");
 
   // ---- operation messages with $ref form ----

package/lib/vendor/blamejs/test/layer-0-primitives/attach-user-bearer-scheme.test.js

@@ -0,0 +1,154 @@
+"use strict";
+/**
+ * attach-user — configurable Authorization scheme + token extractor.
+ *
+ * Covers the bearerScheme / tokenExtractor escape hatches: the default
+ * "Bearer" scheme (RFC 6750 §2.1), operator-configured schemes
+ * ("Token", "DPoP" per RFC 9449), regex-metacharacter-safe matching,
+ * config-time opt validation, and the tokenExtractor override that
+ * fully owns header extraction.
+ *
+ * Run standalone: `node test/layer-0-primitives/attach-user-bearer-scheme.test.js`
+ * Or via smoke:   `node test/smoke.js`
+ */
+
+var helpers   = require("../helpers");
+var b         = helpers.b;
+var check     = helpers.check;
+
+var attachUser = b.middleware._modules.attachUser;
+
+async function _drive(mw, req) {
+  // attachUser always calls next() — synchronously for no-token paths,
+  // after session.verify resolves otherwise. Poll the next()-called flag
+  // instead of racing a fixed sleep that drifts under runner contention.
+  var called = false;
+  mw(req, {}, function () { called = true; });
+  await helpers.waitUntil(function () { return called; }, {
+    timeoutMs: 5000,
+    label:     "attach-user-bearer-scheme: middleware called next()",
+  });
+}
+
+function _req(headers) {
+  return {
+    headers:    headers || {},
+    socket:     { remoteAddress: "127.0.0.1" },
+    connection: { remoteAddress: "127.0.0.1" },
+  };
+}
+
+function testReadBearerDefaultScheme() {
+  check("default scheme extracts after Bearer",
+        attachUser._readBearer("Bearer abc123") === "abc123");
+  check("default scheme is case-insensitive (RFC 9110 §11.1)",
+        attachUser._readBearer("bearer abc123") === "abc123");
+  check("default scheme ignores a Token header",
+        attachUser._readBearer("Token abc123") === null);
+  check("no header → null",
+        attachUser._readBearer(undefined) === null);
+}
+
+function testReadBearerCustomScheme() {
+  check("custom Token scheme extracts the credential",
+        attachUser._readBearer("Token abc123", "Token") === "abc123");
+  check("DPoP scheme (RFC 9449) extracts the credential",
+        attachUser._readBearer("DPoP xyz", "DPoP") === "xyz");
+  // A scheme containing regex metacharacters must match literally, not
+  // as an injected pattern — "a.b" must not match "axb".
+  check("regex-meta scheme matches literally",
+        attachUser._readBearer("a.b qqq", "a.b") === "qqq");
+  check("regex-meta scheme does NOT match a wildcard expansion",
+        attachUser._readBearer("axb qqq", "a.b") === null);
+}
+
+function testCreateValidatesOpts() {
+  function threw(fn) { try { fn(); return null; } catch (e) { return e; } }
+  var loader = async function () { return null; };
+
+  var e1 = threw(function () {
+    attachUser.create({ userLoader: loader, bearerScheme: "" });
+  });
+  check("empty bearerScheme → throws", e1 && /bearerScheme/.test(e1.message));
+
+  var e2 = threw(function () {
+    attachUser.create({ userLoader: loader, bearerScheme: 42 });
+  });
+  check("non-string bearerScheme → throws", e2 && /bearerScheme/.test(e2.message));
+
+  var e3 = threw(function () {
+    attachUser.create({ userLoader: loader, tokenExtractor: "nope" });
+  });
+  check("non-function tokenExtractor → throws", e3 && /tokenExtractor/.test(e3.message));
+
+  var ok = threw(function () {
+    attachUser.create({ userLoader: loader, bearerScheme: "Token", tokenExtractor: function () { return null; } });
+  });
+  check("valid bearerScheme + tokenExtractor accepted", ok === null);
+}
+
+async function testCustomSchemeHeaderConsumed() {
+  // With bearerScheme "Token", a "Token <x>" header is read; a "Bearer
+  // <x>" header is ignored. A bogus token fails session.verify
+  // gracefully (no throw) → req.user stays null and next() runs.
+  var mw = attachUser.create({
+    userLoader: async function (s) { return { id: s.userId }; },
+    tokenFrom:  "header",
+    bearerScheme: "Token",
+    audit:      false,
+  });
+  var req = _req({ authorization: "Token bogus-session-id" });
+  await _drive(mw, req);
+  check("custom scheme: middleware ran, attached req.user (null for bogus token)",
+        req.user === null && req.session === null);
+}
+
+async function testTokenExtractorOwnsExtraction() {
+  // tokenExtractor fully owns header extraction: it is invoked and its
+  // result is the token handed to session.verify.
+  var calls = 0;
+  var seenReq = null;
+  var mw = attachUser.create({
+    userLoader: async function (s) { return { id: s.userId }; },
+    tokenFrom:  "header",
+    tokenExtractor: function (req) { calls += 1; seenReq = req; return "extractor-token"; },
+    audit:      false,
+  });
+  var req = _req({ authorization: "Bearer should-be-ignored" });
+  await _drive(mw, req);
+  check("tokenExtractor was invoked exactly once", calls === 1);
+  check("tokenExtractor received the request object", seenReq === req);
+  check("tokenExtractor path: bogus token → req.user null + next() ran", req.user === null);
+}
+
+async function testTokenExtractorNullSkipsAuth() {
+  // tokenExtractor returning null/undefined means "no token" — the
+  // middleware short-circuits to next() with req.user = null.
+  var mw = attachUser.create({
+    userLoader: async function () { throw new Error("userLoader must not run with no token"); },
+    tokenFrom:  "header",
+    tokenExtractor: function () { return null; },
+    audit:      false,
+  });
+  var req = _req({ authorization: "Bearer ignored" });
+  await _drive(mw, req);
+  check("tokenExtractor null → req.user null, no userLoader call", req.user === null);
+}
+
+async function run() {
+  testReadBearerDefaultScheme();
+  testReadBearerCustomScheme();
+  testCreateValidatesOpts();
+  await testCustomSchemeHeaderConsumed();
+  await testTokenExtractorOwnsExtraction();
+  await testTokenExtractorNullSkipsAuth();
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  run().then(
+    function () { console.log("[attach-user-bearer-scheme] OK — " + helpers.getChecks() + " checks passed"); },
+    function (e) { console.error("FAIL:", e.stack || e); process.exit(1); }
+  );
+}

package/lib/vendor/blamejs/test/layer-0-primitives/body-parser-chunked-malformed.test.js

@@ -100,27 +100,29 @@ async function testInvalidEofStateRefused() {
                        rv.headers["connection"] === "close"));
 }
 
-async function testNonChunkedErrorPreservesNoCloseHeader() {
-  // Generic parser error (not chunked-malformed) — body parser still
-  // returns 400 but does NOT add Connection: close (the smuggling
-  // socket-reuse path only applies to the chunked-decode case).
+async function testNonChunkedErrorAlsoClosesConnection() {
+  // A generic body-parse 4xx (here a read-abort routed through the
+  // generic _writeError) also sets Connection: close — defense in depth
+  // against an upstream proxy reusing a socket whose request stream the
+  // parser abandoned mid-body (RFC 9112 §9.6), matching the chunked
+  // writers above rather than leaving the generic path uncovered.
   var err = new Error("read aborted");
   err.code = "ECONNRESET";
   var rv = await _runWithError(
     { "content-type": "application/json", "content-length": "5" },
     err
   );
-  check("non-chunked error -> 400 without Connection: close",
+  check("non-chunked 4xx error -> 400 with Connection: close",
         rv.next === false && rv.status === 400 &&
-        rv.headers && rv.headers["Connection"] !== "close" &&
-        rv.headers["connection"] !== "close");
+        rv.headers && (rv.headers["Connection"] === "close" ||
+                       rv.headers["connection"] === "close"));
 }
 
 async function run() {
   await testInvalidChunkSizeRefused();
   await testInvalidTransferEncodingRefused();
   await testInvalidEofStateRefused();
-  await testNonChunkedErrorPreservesNoCloseHeader();
+  await testNonChunkedErrorAlsoClosesConnection();
 }
 
 module.exports = { run: run };

package/lib/vendor/blamejs/test/layer-0-primitives/body-parser-smuggling.test.js

@@ -15,27 +15,24 @@ var check     = helpers.check;
 var _bodyReq  = helpers._bodyReq;
 var _bodyRes  = helpers._bodyRes;
 
-function _runMiddleware(req, res) {
-  var bp = b.middleware.bodyParser();
-  return new Promise(function (resolve) {
-    var settled = false;
-    bp(req, res, function () {
-      if (settled) return;
-      settled = true;
-      resolve({ next: true, status: res._endedStatus });
-    });
-    res.on("finish", function () {
-      if (settled) return;
-      settled = true;
-      resolve({ next: false, status: res._endedStatus });
-    });
-    // Safety timeout so a missing finish/next doesn't hang the suite.
-    setTimeout(function () {
-      if (settled) return;
-      settled = true;
-      resolve({ next: false, status: res._endedStatus, timeout: true });
-    }, 1500);
+async function _runMiddleware(req, res, bp) {
+  bp = bp || b.middleware.bodyParser();
+  // bodyParser settles by calling next() (parse succeeded) or by writing
+  // the error response (res.writeHead/end → _endedStatus set, "finish"
+  // emitted). Both can happen synchronously inside bp(), so the next()
+  // flag is captured by callback and the response-write path is read off
+  // res._endedStatus rather than relying on catching the finish event.
+  // Poll the settled condition instead of racing a fixed sleep that
+  // drifts under runner contention.
+  var nextCalled = false;
+  bp(req, res, function () { nextCalled = true; });
+  await helpers.waitUntil(function () {
+    return nextCalled || res._endedStatus !== null;
+  }, {
+    timeoutMs: 5000,
+    label:     "body-parser-smuggling: bodyParser settled (next or response written)",
   });
+  return { next: nextCalled, status: res._endedStatus };
 }
 
 async function testTeAndClConflictRejected() {
@@ -102,12 +99,94 @@ async function testCleanRequestPasses() {
         rv.next === true);
 }
 
+// A malformed-JSON 400 flows through the generic _writeError path (not
+// the smuggling/chunked inline writers). It must also carry Connection:
+// close so an upstream proxy can't reuse a socket whose request stream
+// the parser abandoned mid-body (RFC 9112 §9.6).
+async function testGenericErrorSetsConnectionClose() {
+  var body = "{ not valid json";
+  var req = _bodyReq("POST", {
+    "content-length": String(Buffer.byteLength(body)),
+    "content-type":   "application/json",
+  }, body);
+  var res = _bodyRes();
+  var rv = await _runMiddleware(req, res);
+  check("malformed JSON → 400 via _writeError",
+        rv.next === false && rv.status === 400);
+  check("malformed JSON 400 → Connection: close set",
+        res._headers["Connection"] === "close" ||
+        res._headers["connection"] === "close");
+}
+
+// RFC 5987 / 2231 filename* charset gating. utf-8 is always decoded; a
+// `filename*=ISO-8859-1''...` part is refused by default (falls back to
+// the legacy `filename=` companion) and decoded only when the operator
+// opts iso-8859-1 into multipart.filenameCharsets.
+function _multipartIso8859Body(boundary) {
+  // filename* uses ISO-8859-1 percent-encoding: r%E9sum%E9 → "résumé".
+  // A legacy filename= companion provides the default-path fallback.
+  return Buffer.from(
+    "--" + boundary + "\r\n" +
+    "Content-Disposition: form-data; name=\"doc\"; " +
+      "filename=\"fallback.txt\"; filename*=ISO-8859-1''r%E9sum%E9.txt\r\n" +
+    "Content-Type: text/plain\r\n" +
+    "\r\n" +
+    "hello\r\n" +
+    "--" + boundary + "--\r\n",
+    "latin1"
+  );
+}
+
+async function _runMultipart(bp, boundary, body) {
+  var req = _bodyReq("POST", {
+    "content-type":   "multipart/form-data; boundary=" + boundary,
+    "content-length": String(body.length),
+  }, body);
+  var res = _bodyRes();
+  // bodyParser settles by calling next() (parse succeeded) or by writing
+  // the error response (res "finish"). Poll the settled flag instead of
+  // racing a fixed sleep that drifts under runner contention.
+  var settled = false;
+  bp(req, res, function () { settled = true; });
+  res.on("finish", function () { settled = true; });
+  await helpers.waitUntil(function () { return settled; }, {
+    timeoutMs: 5000,
+    label:     "body-parser-smuggling: bodyParser settled (next or response finish)",
+  });
+  return req;
+}
+
+async function testFilenameCharsetsDefaultRefusesIso8859() {
+  var boundary = "bptest1";
+  var bp = b.middleware.bodyParser({ multipart: { storage: "memory" } });
+  var req = await _runMultipart(bp, boundary, _multipartIso8859Body(boundary));
+  check("default: a file part was parsed",
+        Array.isArray(req.files) && req.files.length === 1);
+  check("default: iso-8859-1 filename* refused → legacy filename= wins",
+        req.files[0].filename === "fallback.txt");
+}
+
+async function testFilenameCharsetsOptInDecodesIso8859() {
+  var boundary = "bptest2";
+  var bp = b.middleware.bodyParser({
+    multipart: { storage: "memory", filenameCharsets: ["utf-8", "iso-8859-1"] },
+  });
+  var req = await _runMultipart(bp, boundary, _multipartIso8859Body(boundary));
+  check("opt-in: a file part was parsed",
+        Array.isArray(req.files) && req.files.length === 1);
+  check("opt-in: iso-8859-1 filename* decoded to résumé.txt",
+        req.files[0].filename === "résumé.txt");
+}
+
 async function run() {
   await testTeAndClConflictRejected();
   await testMultipleContentLengthRejected();
   await testTeNotChunkedRejected();
   await testTeDuplicateChunkedRejected();
   await testCleanRequestPasses();
+  await testGenericErrorSetsConnectionClose();
+  await testFilenameCharsetsDefaultRefusesIso8859();
+  await testFilenameCharsetsOptInDecodesIso8859();
 }
 
 module.exports = { run: run };

package/lib/vendor/blamejs/test/layer-0-primitives/breach-deadline.test.js

@@ -34,5 +34,90 @@ var check = helpers.check;
   check("after both filings, none pending", reporter.pending(rec.id).length === 0);
   check("breach closed after all filed",   reporter.get(rec.id).closedAt !== null);
 
+  // ---- running clock (composes incident.report.createDeadlineClock) ----
+  // Injected clock so escalation timing is deterministic, no wall-clock sleep.
+  var detectedAt = 0;
+  var clockNow = detectedAt;
+  var events = [];
+
+  var clockReporter = b.breach.report.create({ audit: false, now: function () { return clockNow; } });
+  var clockRec = clockReporter.open({
+    detectedAt: detectedAt,
+    affectedStates: ["CA", "TX"],   // CA = asap-ceiling 60d, TX = hard 60d
+    impact: { individualsAffected: 9000 },
+  });
+
+  var clock = b.breach.deadline.createClock({
+    audit:    false,
+    autoStart: false,
+    approachThresholds: [0.5, 0.9],
+    notify:   { send: function (p) { events.push(p); } },
+    now:      function () { return clockNow; },
+  });
+
+  var trackedId = clock.trackReport(clockRec);
+  check("trackReport returns the breach id", trackedId === clockRec.id);
+  check("clock tracks both states", clock.status().tracked === 2);
+  check("clock counts one breach",  clock.status().breaches === 1);
+
+  // Day 0: nothing has elapsed, no escalation.
+  clock.tick();
+  check("no escalation at detection time", events.length === 0);
+
+  // Advance past the 50% threshold of the 60-day window (31 days).
+  clockNow = detectedAt + 31 * 24 * 60 * 60 * 1000;
+  clock.tick();
+  var approaching = events.filter(function (e) { return e.kind === "deadline_approaching"; });
+  check("approaching fired for both states at 50%", approaching.length === 2);
+
+  // Re-ticking at the same proportion must NOT re-fire (once per phase).
+  var beforeReTick = events.length;
+  clock.tick();
+  check("approaching does not re-fire on repeat tick", events.length === beforeReTick);
+
+  // Acknowledge CA's filing — CA must go silent even past its deadline.
+  clock.acknowledgeSubmission(clockRec.id, "ca");
+
+  // Advance past the deadline (61 days). TX should fire "passed"; CA must not.
+  clockNow = detectedAt + 61 * 24 * 60 * 60 * 1000;
+  clock.tick();
+  var passed = events.filter(function (e) { return e.kind === "deadline_passed"; });
+  check("exactly one state fired passed (TX, not acked CA)", passed.length === 1);
+  check("passed carries the statute regime", typeof passed[0].regime === "string" && passed[0].regime.length > 0);
+
+  var ackUnknownThrew = false;
+  try { clock.acknowledgeSubmission(clockRec.id, "NY"); }
+  catch (e) { ackUnknownThrew = e.code === "breach-clock/unknown-tracked-state"; }
+  check("acknowledgeSubmission refuses an untracked state", ackUnknownThrew);
+
+  var badReportThrew = false;
+  try { clock.trackReport({ id: 42 }); }
+  catch (e) { badReportThrew = e.code === "breach-clock/bad-report"; }
+  check("trackReport refuses a non-record", badReportThrew);
+
+  check("untrack removes the breach", clock.untrack(clockRec.id) === true);
+  check("clock empty after untrack", clock.status().tracked === 0);
+
+  // Auto-start timer path: poll the notify sink (no fixed-budget sleep).
+  var autoEvents = [];
+  var autoNow = 0;
+  var autoReporter = b.breach.report.create({ audit: false, now: function () { return autoNow; } });
+  var autoRec = autoReporter.open({ detectedAt: 0, affectedStates: ["TX"], impact: {} });
+  autoNow = 61 * 24 * 60 * 60 * 1000;   // already past TX's 60-day wall
+  var autoClock = b.breach.deadline.createClock({
+    audit:    false,
+    autoStart: true,
+    intervalMs: 10,
+    notify:   { send: function (p) { autoEvents.push(p); } },
+    now:      function () { return autoNow; },
+  });
+  autoClock.trackReport(autoRec);
+  await helpers.waitUntil(function () {
+    return autoEvents.some(function (e) { return e.kind === "deadline_passed"; });
+  }, { timeoutMs: 5000, label: "breach-clock: auto-tick fires deadline_passed" });
+  check("auto-tick timer fired the passed alert", true);
+  autoClock.stop();
+  check("clock stops cleanly", autoClock.status().running === false);
+
   console.log("OK — breach-deadline tests");
 })().catch(function (e) { console.error(e); process.exit(1); });