@blamejs/blamejs-shop 0.3.56 → 0.3.58

package/lib/vendor/blamejs/test/layer-0-primitives/codebase-patterns.test.js

@@ -2571,6 +2571,25 @@ async function testNoDuplicateCodeBlocks() {
       ],
       reason: "v0.14.12 — generic validate/derive/byte-walk control-flow shingle the vault-rotation reseal work tipped over the 3-file threshold. Members are unrelated primitives (agent-idempotency arg-check, agent-tenant per-tenant AEAD seal, archive-wrap explicit-root tenant-key derive, atomic-file recursive dir-copy, ddl-change-control dual-control approve/reject, deprecate alias, guard-filename path-segment safety walk, jose-jwe decrypt, mail-deploy TLS-RPT validate, totp otpauth URI build). No shared behaviour to extract; consolidating would couple ten unrelated subsystems.",
     },
+    {
+      mode:  "family-subset",
+      files: [
+        "lib/mail-auth.js:_xmlEscapeText",
+        "lib/mail-deploy.js:_xmlEscape",
+        "lib/object-store/azure-blob-bucket-ops.js:_xmlEscape",
+      ],
+      reason: "v0.14.18 — coincidental shingle of the five-metacharacter XML text-node escaper (String(s).replace chain for & < > \" '). The three live in unrelated domains: mail-auth._xmlEscapeText neutralizes RFC 7489 DMARC aggregate-report text nodes (attacker-influenced envelope-from / source-IP bytes), mail-deploy._xmlEscape escapes Autoconfig / Autodiscover provider-XML fields, object-store/azure-blob-bucket-ops._xmlEscape escapes Azure Blob service-properties / CORS-rule XML. The codebase intentionally keeps XML/HTML escaping inline per context — the four-metacharacter HTML variants (mail._htmlEscape, compliance-ai-act-transparency._escapeHtml) and the RFC 3741 c14n numeric-reference escapers (xml-c14n._escapeText / _escapeAttrValue, which emit &#xD; / &#xA; / &#x9; and differ by attr-vs-text position) are deliberately distinct operations, so there is no single shared escaper these three could compose without coupling unrelated serializers on the trivial replace chain.",
+    },
+    {
+      mode:  "family-subset",
+      files: [
+        "lib/auth/oid4vci.js:_verifyProofJwt",
+        "lib/auth/openid-federation.js:verifyEntityStatement",
+        "lib/auth/saml.js:_decryptEncryptedAssertion",
+        "lib/auth/saml.js:verifyResponse",
+      ],
+      reason: "v0.14.18 — coincidental shingle of the import-public-key-then-wrap-failure idiom (try { keyObj = nodeCrypto.createPublicKey({ key, format }); } catch (e) { throw new AuthError(code, msg + ((e && e.message) || String(e))); }). The alg/key-type cross-check (CVE-2026-22817) is ALREADY routed through the shared jwtExternal._assertAlgKtyMatch helper; what repeats here is only the per-primitive createPublicKey + typed-catch shell. oid4vci._verifyProofJwt imports an OID4VCI proof-JWT holder key and throws auth-oid4vci/*; openid-federation.verifyEntityStatement imports an entity-statement JWS key and throws auth-openid-federation/*; saml._decryptEncryptedAssertion / verifyResponse import SAML XML-DSig / EncryptedAssertion keys (a different signature mechanism entirely) and throw auth-saml/*. Each carries a primitive-local error code namespace operators grep for; consolidating would couple three unrelated credential formats on the createPublicKey boilerplate.",
+    },
     {
       files: ["lib/api-key.js:issue", "lib/db-query.js:<top>", "lib/session.js:create"],
       reason: "Generic JS array helper / lambda shape — Object.keys(...).map(fn) + similar functional idioms appearing in any code that walks a column-or-key list.",
@@ -4080,6 +4099,7 @@ async function testNoDuplicateCodeBlocks() {
         "lib/openapi-paths-builder.js:_normaliseRequestBody",
         "lib/openapi-paths-builder.js:_normaliseResponses",
         "lib/openapi.js:_validateServerEntry",
+        "lib/openapi.js:_validateItemOperations",
         "lib/openapi.js:parse",
         "lib/asyncapi.js:_addChannel",
         "lib/asyncapi.js:_normaliseMessage",
@@ -4106,7 +4126,7 @@ async function testNoDuplicateCodeBlocks() {
         "lib/db-file-lifecycle.js:fileLifecycle",
         "lib/middleware/protected-resource-metadata.js:create",
       ],
-      reason: "validateOpts.requireNonEmptyString-prelude scaffold — primitives gate operator-supplied opts with the same `validateOpts.requireNonEmptyString(opts.X, ..., ErrorClass, code)` cascade. Each domain's error class differs (DeprecateError / OpenApiError / AsyncApiError / MailError / InboxError / A2aError / BudrError / AuthError / DbFileLifecycleError); consolidating would lose the per-module error code.",
+      reason: "validateOpts.requireNonEmptyString-prelude scaffold — primitives gate operator-supplied opts with the same `validateOpts.requireNonEmptyString(opts.X, ..., ErrorClass, code)` cascade. Each domain's error class differs (DeprecateError / OpenApiError / AsyncApiError / MailError / InboxError / A2aError / BudrError / AuthError / DbFileLifecycleError); consolidating would lose the per-module error code. The same family carries the spec-doc walk shingle (`for (var k in obj) { hasOwnProperty guard; var entry = obj[k]; if (!entry || typeof entry !== \"object\") ... }`) shared by the OpenAPI 3.1/3.2 external-doc validators (openapi.parse / _validateItemOperations, which accumulate spec-distinct error strings) and the AsyncAPI 3.0 parser (asyncapi.parse) alongside the OpenAPI builder normalizers (_normaliseRequestBody / _normaliseResponses, which throw typed errors and construct a normalized media-type map). Validator-accumulate vs builder-throw-and-construct are different output contracts across two specs; extracting one walk helper would couple the OpenAPI and AsyncAPI namespaces and lose the per-spec refusal vocabulary.",
     },
     {
       mode:  "family-subset",
@@ -5679,6 +5699,21 @@ async function testNoDuplicateCodeBlocks() {
       ],
       reason: "v0.11.25 — defensive object-shape read pattern: each primitive accepts a raw object (siteverify JSON response / agent-orchestrator opts / WebSocket close-frame payload) and normalises it into a typed internal shape via per-field `typeof === 'string' ? raw.X : null` guards. Bot-challenge bodies normalise Cloudflare/hCaptcha success+hostname+action+challenge_ts+error-codes; agent-orchestrator bodies normalise opts.topology+opts.leader+opts.health; ws-client bodies normalise the close-frame {code, reason}. The shared shape is the per-field typeof-then-null defensive read; the bodies enforce entirely different spec contracts (Cloudflare siteverify JSON vs b.agent.orchestrator topology vs RFC 6455 close-frame).",
     },
+    {
+      mode:  "family-subset",
+      files: [
+        "lib/breach-deadline.js:trackReport",
+        "lib/auth/oid4vp.js:_validateDcql",
+        "lib/cms-codec.js:encodeEnvelopedData",
+        "lib/cms-codec.js:encodeSignedData",
+        "lib/mail-crypto-pgp.js:experimentalEncrypt",
+        "lib/auth/dpop.js:thumbprint",
+        "lib/incident-report.js:track",
+        "lib/incident-report.js:open",
+        "lib/guard-snapshot-envelope.js:validate",
+      ],
+      reason: "breach-deadline.createClock composes incident-report.createDeadlineClock; the matched 50-token shingle is the coincidental validate/register/threshold idiom shared with unrelated domains (cms-codec/oid4vp/dpop/guard-snapshot-envelope), not extractable duplication. trackReport validates a breach.report record then registers each per-state deadline onto the inner clock it does NOT own; oid4vp._validateDcql validates a DCQL query; cms-codec.encodeEnvelopedData/encodeSignedData build CMS BER/DER structures; mail-crypto-pgp.experimentalEncrypt assembles an OpenPGP message; dpop.thumbprint derives a JWK thumbprint; incident-report.track/open register synthetic incidents; guard-snapshot-envelope.validate gates a snapshot envelope. Each enforces a distinct spec (US state breach statutes / OID4VP DCQL / RFC 5652 CMS / RFC 9580 OpenPGP / RFC 9449 DPoP / breach-notification regimes / snapshot envelope contract); consolidating would couple unrelated wire grammars. breach-deadline already delegates the tick loop + timer lifecycle to incident-report, so there is no timer to extract.",
+    },
   ];
   // Each KNOWN_CLUSTERS entry's `files` is a list of `path:fn` strings.
   // Build per-entry matchers and reject malformed entries (bare path
@@ -6552,6 +6587,20 @@ var KNOWN_ANTIPATTERNS = [
 
   { id: "connect-entry-point-port-must-compose-optionalPort", primitive: "a connection entry point reading opts.port / opts.kePort / opts.ntpPort with a `|| <default>` fallback must first validate it via validateOpts.optionalPort (or, where a permanent typed error is needed, the equivalent numericBounds.isPositiveFiniteInt(opts.port) + 65535 cap) — an unvalidated opts.port || N silently accepts a string / negative / NaN / out-of-range port", scanScope: "lib", regex: /\bopts\.(?:port|kePort|ntpPort)\s*\|\|/, requires: /validateOpts\.optionalPort\(|isPositiveFiniteInt\(opts\.port\)/, allowlist: [], reason: "v0.14.15 — the connection entry points (mail.smtpTransport, ntpCheck.querySingle, dns.useDnsOverTls, nts.performKeHandshake / querySingle / query, redis.create) read opts.port || <default>, silently coercing a string / negative / NaN / >65535 port; rule §5 says config-time entry points THROW so the operator catches the typo at boot. Each now composes validateOpts.optionalPort (RFC 6335 §6 [1,65535]; allowZero for the app.listen ephemeral bind) — or, where a MailError-permanent typed error is needed, the same numericBounds.isPositiveFiniteInt + 65535 rule inline. The requires-companion clears a file once it validates; a new entry point reading opts.port || N without composing the validator trips the gate." },
 
+  { id: "deny-response-guards-headers-sent", primitive: "the deny-path writer in lib/middleware/deny-response.js must guard the default res.writeHead(ctx.status, ...) on res.headersSent (not res.writableEnded alone) — a wrapping consumer that already sent headers without flipping writableEnded would otherwise re-enter writeHead and throw \"headers already sent\", turning a refusal into a 500", scanScope: "lib", regex: /res\.writeHead\s*\(\s*ctx\.status\b/, requires: /res\.headersSent/, allowlist: [], reason: "denyResponse's pre-writeHead terminal guard once checked only res.writableEnded; a consumer that committed headers via res.setHeader/writeHead without setting writableEnded slipped past it and re-entered the default writeHead(ctx.status), throwing on already-sent headers. The guard now reads `res.writableEnded || res.headersSent || !_isFn(res.writeHead)`. File-scoped via the writeHead(ctx.status anchor unique to deny-response.js; the requires-companion fails if a future edit drops the headersSent term. Empty allowlist — losing the headersSent guard is a real defect." },
+
+  { id: "mw-uses-real-appshutdown-addphase", primitive: "the app-shutdown handle exposes addPhase(phase) — a .registerPhase( call is a silently-dead phase registration against a method that does not exist, so the phase never runs at shutdown", scanScope: "lib", regex: /\.registerPhase\s*\(/, allowlist: [], reason: "b.appShutdown.create returns a handle whose phase-registration method is addPhase, not registerPhase. A caller that wrote handle.registerPhase(...) would get a no-op (or a TypeError at call time) and its teardown phase would never fire — the kind of silent miswiring where a documented shutdown step simply never runs. No lib site calls registerPhase today; this detector keeps the wrong method name from entering lib/. Empty allowlist — a registerPhase call is always the miswire." },
+
+  { id: "body-parser-write-error-connection-close", primitive: "lib/middleware/body-parser.js's _writeError(res, status, message, code) response must set Connection: close — a body-parse rejection abandons the request stream mid-body, so the 4xx must force a socket teardown (RFC 9112 §9.6) to close the request-smuggling reuse window", scanScope: "lib", skipCommentLines: true, regex: /function _writeError\s*\(\s*res\s*,\s*status\s*,\s*message\s*,\s*code\s*\)[\s\S]{0,500}?res\.writeHead\s*\((?:(?!res\.end\b)(?!Connection)[\s\S]){0,500}?res\.end\b/, allowlist: [], reason: "_writeError is the generic body-parse rejection writer (malformed JSON, poisoned key, oversize payload); pairing the 4xx with Connection: close stops an upstream proxy reusing a socket whose request stream the parser abandoned mid-body (request-smuggling desync, RFC 9112 §9.6). Block-scoped to the _writeError(res, status, message, code) signature unique to body-parser.js (tus-upload / static / webhook _writeError carry different signatures): the regex matches the function's writeHead(...)…res.end window ONLY when that window carries no Connection token, so removing Connection: close from THIS writer fires even though the inline smuggling/chunked writers keep theirs. Empty allowlist — dropping Connection: close here re-opens the desync window." },
+
+  { id: "queue-local-no-raw-jobs-table", primitive: "every jobs-table SQL reference must flow through the configured, safeSql-quoted qTable variable (resolved by _resolveTableRef via safeSql.quoteIdentifier / quoteQualified) — a raw `FROM _blamejs_jobs` / `INTO _blamejs_jobs` / `UPDATE _blamejs_jobs` literal hardcodes the default name and bypasses BYO-table + dialect quoting", scanScope: "lib", skipCommentLines: true, regex: /\b(?:FROM|INTO|UPDATE|DELETE FROM|JOIN)\s+_blamejs_jobs\b/, allowlist: [], reason: "queue-local now supports an operator-supplied config.table (validated + dialect-quoted by _resolveTableRef, held in qTable); every enqueue/lease/dlq statement interpolates qTable. A statement that hardcodes the raw `_blamejs_jobs` literal after a SQL keyword would ignore the BYO table and skip identifier quoting. The DEFAULT_TABLE / SEAL_TABLE constant declarations (`var X = \"_blamejs_jobs\"`) carry no preceding SQL keyword so they don't match, and skipCommentLines blanks the doc references — no per-file allowlist needed; any match is a real raw reference." },
+
+  { id: "breach-clock-composes-incident-clock", primitive: "b.breach.deadline.createClock must compose b.incident.report.createDeadlineClock (one underlying timer) — it must NOT re-roll its own setInterval tick loop; the breach clock delegates the timer lifecycle to incident-report so there is a single tick source to drive + stop", scanScope: "lib", skipCommentLines: true, regex: /setInterval[\s\S]{0,8000}?breach\.deadline\.createClock|breach\.deadline\.createClock[\s\S]{0,8000}?setInterval/, allowlist: [], reason: "breach-deadline.createDeadlineClock wraps incidentReport().createDeadlineClock and forwards trackReport / acknowledgeSubmission / cancel / stop onto that inner clock; it owns no timer of its own. A setInterval inside breach-deadline.js means the tick loop was re-rolled instead of delegated — two independent timers drifting, and a stop() that no longer tears the real one down. File-scoped via co-occurrence of setInterval with the breach.deadline.createClock token unique to breach-deadline.js (incident-report.js owns the legitimate setInterval but never names breach.deadline.createClock, so it is not flagged). Empty allowlist — a timer here is the miswire." },
+
+  { id: "bounded-chunk-collector-not-a-stream-consumer", primitive: "b.safeBuffer.boundedChunkCollector(opts) takes a SINGLE options object and returns a { push, result, bytesCollected } collector — it is not a stream consumer. To read a Readable (request body, upstream response) use b.safeBuffer.collectStream(stream, opts), which pumps the stream into a bounded collector and resolves a Buffer. A boundedChunkCollector(req, ...) call passes the stream as opts (maxBytes undefined → buffer/bad-arg throw) and then awaits / .then()s a non-Promise collector.", scanScope: "lib", skipCommentLines: true, regex: /boundedChunkCollector\s*\(\s*\w+\s*,/, allowlist: [], reason: "csp-report (413 on EVERY POST) and scim-server (every streamed body broke) both called safeBuffer.boundedChunkCollector(req, { maxBytes }) / (req, MAX, ErrClass, code): the request stream was passed as the opts argument (maxBytes undefined → synchronous buffer/bad-arg, surfaced as 413/500) and the returned push-collector was treated as a thenable. boundedChunkCollector has no (stream, opts) overload; b.safeBuffer.collectStream is the stream-reading sibling. The regex flags a call whose first argument is a bare identifier immediately followed by a comma (the multi-arg / stream-first misuse); single-object boundedChunkCollector({ ... }) and single-var boundedChunkCollector(opts) / boundedChunkCollector(opts || {}) calls do not match. Empty allowlist — there is no valid multi-arg form. This is the detector that would have caught both endpoints before smoke." },
+
+  { id: "regex-polynomial-whitespace-in-repeated-group", primitive: "a regex literal must not place an optional-whitespace `\\s*` / `\\s+` at the END of a repeated group (the `(?:…\\s*)*` / `…\\s*)+` shape) — the same whitespace can be consumed either inside the group or by surrounding whitespace, so a crafted input backtracks polynomially (CWE-1333 ReDoS). Consume whitespace as a single disjoint alternative `(?:\\s|…)*` instead, and match block comments with the star-not-slash form, never a lazy `[\\s\\S]*?`.", scanScope: "lib", skipCommentLines: true, regex: /\\s[*+]\)[*+]/, allowlist: [], reason: "CodeQL js/polynomial-redos (alert 330) flagged lib/external-db.js's leading-keyword classifier `/^\\s*(?:\\/\\*…\\s*|--…\\s*)*([A-Za-z]+)/` — the `\\s*` both before AND at the tail of the repeated group gives two ways to consume the same whitespace run, so a SQL string of nested `/**/` or `*/--` comment runs backtracks polynomially; reused by the new OTel db.operation path it became a taint sink. Rewritten to `/^(?:\\s|\\/\\*(?:[^*]|\\*(?!\\/))*\\*\\/|--[^\\n]*\\n)*([A-Za-z]+)/` (disjoint single-char alternatives). codebase-patterns is a curated detector set, not a taint/ReDoS analyzer like CodeQL — this closes the specific shape locally so the next agent-authored comment-skip regex trips the gate before CI. Empty allowlist — a `\\s*)*` / `\\s+)+` tail in a lib regex is the ReDoS tell; allowlist a genuinely-anchored case with its structural reason." },
+
   {
     // ROTATION-EPOCH ACCEPT (v0.14.x): a vault-key rotation (b.vault.rotate)
     // re-keys the local dataDir, which changes the SHA3-512 fingerprint of

package/lib/vendor/blamejs/test/layer-0-primitives/compliance-ai-act.test.js

@@ -389,6 +389,69 @@ function run() {
   check("middleware: custom headerPrefix on Article",    res5._headers["X-AI-Article"] === "Art. 50(1)");
   check("middleware: custom headerPrefix replaces default", res5._headers["AI-Act-Notice"] == null);
 
+  // html mode — the banner injects whether res.end() is handed a STRING or
+  // a Buffer. b.render serves a Buffer (res.end(Buffer.from(html))); a
+  // string-only injection path silently dropped the disclosure on that
+  // common server-render route.
+  function _captureEnd(res) {
+    var captured = { chunk: null };
+    var realEnd = res.end;
+    res.end = function (chunk) { captured.chunk = chunk; return realEnd.call(res, chunk); };
+    return captured;
+  }
+
+  var mwHtml = b.middleware.aiActDisclosure({
+    kind:         "ai-interaction",
+    deployerName: "myco",
+    mode:         "html",
+    audit:        false,
+  });
+
+  // String body — injects after <body>.
+  var resStr = _mockRes();
+  var capStr = _captureEnd(resStr);
+  mwHtml({ headers: {}, url: "/html-str" }, resStr, function () {});
+  resStr.setHeader("Content-Type", "text/html; charset=utf-8");
+  resStr.writeHead(200, {});
+  resStr.end("<html><body><h1>hi</h1></body></html>");
+  check("middleware html: string body injects banner",   typeof capStr.chunk === "string" &&
+                                                          capStr.chunk.indexOf("data-blamejs-aiAct") !== -1 &&
+                                                          capStr.chunk.indexOf("<body>") !== -1);
+
+  // Buffer body, utf-8 — decodes, injects, re-encodes to a Buffer.
+  var resBuf = _mockRes();
+  var capBuf = _captureEnd(resBuf);
+  mwHtml({ headers: {}, url: "/html-buf" }, resBuf, function () {});
+  resBuf.setHeader("Content-Type", "text/html; charset=utf-8");
+  resBuf.writeHead(200, {});
+  resBuf.end(Buffer.from("<html><body><h1>hi</h1></body></html>", "utf8"));
+  check("middleware html: Buffer body stays a Buffer",    Buffer.isBuffer(capBuf.chunk));
+  check("middleware html: Buffer body injects banner",    Buffer.isBuffer(capBuf.chunk) &&
+                                                          capBuf.chunk.toString("utf8").indexOf("data-blamejs-aiAct") !== -1);
+
+  // Buffer body, no explicit charset — defaults to utf-8, still injects.
+  var resBufNoCs = _mockRes();
+  var capBufNoCs = _captureEnd(resBufNoCs);
+  mwHtml({ headers: {}, url: "/html-buf-nocs" }, resBufNoCs, function () {});
+  resBufNoCs.setHeader("Content-Type", "text/html");
+  resBufNoCs.writeHead(200, {});
+  resBufNoCs.end(Buffer.from("<html><body>x</body></html>", "utf8"));
+  check("middleware html: Buffer body default-utf8 injects", Buffer.isBuffer(capBufNoCs.chunk) &&
+                                                          capBufNoCs.chunk.toString("utf8").indexOf("data-blamejs-aiAct") !== -1);
+
+  // Buffer body in an unsupported charset — served untouched (no corruption),
+  // and the disclosure header still carries the machine-readable notice.
+  var resUtf16 = _mockRes();
+  var capUtf16 = _captureEnd(resUtf16);
+  mwHtml({ headers: {}, url: "/html-utf16" }, resUtf16, function () {});
+  resUtf16.setHeader("Content-Type", "text/html; charset=utf-16le");
+  resUtf16.writeHead(200, {});
+  var utf16Body = Buffer.from("<html><body>x</body></html>", "utf16le");
+  resUtf16.end(utf16Body);
+  check("middleware html: unsupported charset served untouched", Buffer.isBuffer(capUtf16.chunk) &&
+                                                          capUtf16.chunk.equals(utf16Body));
+  check("middleware html: unsupported charset still sets header", resUtf16._headers["AI-Act-Notice"] === "ai-interaction");
+
   // ---- expanded prohibited classifier ----
   var hits7 = aiAct.prohibited.classify({
     purpose: "predictive-policing", usesProfileOnly: true,

package/lib/vendor/blamejs/test/layer-0-primitives/csp-report.test.js

@@ -5,8 +5,19 @@
  */
 
 var helpers = require("../helpers");
-var b      = helpers.b;
-var check  = helpers.check;
+var b       = helpers.b;
+var check   = helpers.check;
+var _bodyReq = helpers._bodyReq;
+
+function _capRes() {
+  var sent = {};
+  return {
+    headersSent: false,
+    writeHead: function (s, h) { sent.status = s; sent.headers = h; },
+    end:       function () { sent.ended = true; },
+    _sent:     sent,
+  };
+}
 
 async function run() {
   var middleware = b.middleware.cspReport({});
@@ -22,6 +33,100 @@ async function run() {
   await middleware(req, res, function () {});
   check("middleware.cspReport: GET returns 405",
     sent.status === 405 && sent.ended === true);
+
+  await testOnRejectFiresOnEveryRejection();
+  testOnRejectRejectsNonFunction();
+  await testValidPostReachesOnReport();
+  await testOversizedPostRefused();
+}
+
+// The SUCCESS path: a valid POST with a parseable report body must reach
+// the normalize / audit / onReport pipeline and return 204. A prior
+// collector-call bug turned EVERY POST into a 413 (the endpoint never
+// parsed anything); no test exercised an end-to-end POST-with-body, so
+// smoke stayed green while the endpoint was dead. This is that test.
+async function testValidPostReachesOnReport() {
+  var reports = [];
+  var res = _capRes();
+  var mw = b.middleware.cspReport({ onReport: function (r) { reports.push(r); } });
+  var payload = JSON.stringify([{
+    type: "csp-violation",
+    url:  "https://app.example.com/",
+    body: { effectiveDirective: "script-src", blockedURL: "https://evil.example/x.js" },
+  }]);
+  await mw(_bodyReq("POST", { "content-type": "application/reports+json" }, payload), res, function () {});
+  check("cspReport: valid POST returns 204",
+        res._sent.status === 204 && res._sent.ended === true);
+  check("cspReport: valid POST reaches onReport with the normalized report",
+        reports.length === 1 && reports[0].body.effectiveDirective === "script-src");
+}
+
+// The byte cap still fires through the collector: a body over maxBytes
+// is refused 413 and surfaces onReject "payload-too-large".
+async function testOversizedPostRefused() {
+  var rejected = null;
+  var res = _capRes();
+  var mw = b.middleware.cspReport({
+    maxBytes:  8,
+    onReject:  function (req, res, info) { rejected = info; },
+  });
+  await mw(_bodyReq("POST", {}, "[{\"type\":\"csp-violation\",\"body\":{}}]"), res, function () {});
+  check("cspReport: body over maxBytes returns 413", res._sent.status === 413);
+  check("cspReport: oversize fires onReject payload-too-large",
+        rejected !== null && rejected.reason === "payload-too-large");
+}
+
+// onReject surfaces the otherwise-empty-bodied 405 / 413 / 400 refusals
+// to the operator (W3C Reporting API §3.1 — the browser ignores the
+// rejection body, so onReject is the only signal a metrics sink gets).
+// reason ∈ { method-not-allowed (405), payload-too-large (413),
+// invalid-json (400) } and always matches the status that was written.
+var REASON_FOR_STATUS = { 405: "method-not-allowed", 413: "payload-too-large", 400: "invalid-json" };
+
+async function testOnRejectFiresOnEveryRejection() {
+  // 405 — non-POST. Short-circuits before the body collector, so this
+  // path is deterministic.
+  var got405 = null;
+  var mw405 = b.middleware.cspReport({
+    onReject: function (req, res, info) { got405 = info; },
+  });
+  var res405 = _capRes();
+  await mw405({ method: "GET", headers: {} }, res405, function () {});
+  check("onReject: fired on 405",
+        got405 && got405.status === 405 && got405.reason === "method-not-allowed");
+  check("onReject: response still written on 405",
+        res405._sent.status === 405 && res405._sent.ended === true);
+
+  // POST refusal — onReject fires and its {status, reason} agrees with
+  // the status the middleware wrote. Asserting the mapping (rather than a
+  // hard-coded status) keeps this test correct independent of which body
+  // refusal a given input lands on.
+  var gotPost = null;
+  var postRes = _capRes();
+  var mwPost = b.middleware.cspReport({
+    onReject: function (req, res, info) { gotPost = info; },
+  });
+  await mwPost(_bodyReq("POST", {}, "{bad"), postRes, function () {});
+  check("onReject: fired on POST refusal",            gotPost !== null);
+  check("onReject: reason maps to written status",
+        gotPost && REASON_FOR_STATUS[gotPost.status] === gotPost.reason &&
+        gotPost.status === postRes._sent.status);
+
+  // A throwing hook is swallowed — the endpoint still writes the refusal.
+  var resThrow = _capRes();
+  var mwThrow = b.middleware.cspReport({
+    onReject: function () { throw new Error("sink broke"); },
+  });
+  await mwThrow({ method: "GET", headers: {} }, resThrow, function () {});
+  check("onReject: throwing hook does not crash the endpoint",
+        resThrow._sent.status === 405 && resThrow._sent.ended === true);
+}
+
+function testOnRejectRejectsNonFunction() {
+  var threw = false;
+  try { b.middleware.cspReport({ onReject: "nope" }); }
+  catch (e) { threw = e instanceof TypeError; }
+  check("onReject: non-function rejected at config time", threw);
 }
 
 module.exports = { run: run };

package/lib/vendor/blamejs/test/layer-0-primitives/db-schema-drift.test.js

@@ -0,0 +1,145 @@
+"use strict";
+/**
+ * dbSchema.reconcile / reconcileTable — opt-in schema-drift detection.
+ *
+ * reconcile is additive-only (CREATE IF NOT EXISTS + ALTER ADD COLUMN);
+ * it never drops columns. The onDrift opt adds detection of config-vs-
+ * live divergence without changing that non-destructive contract:
+ *
+ *   - default (onDrift unset / "ignore") = pre-detection behavior; a
+ *     live table with an extra column is tolerated silently.
+ *   - "warn"   = detect, never throw (report returned to the caller).
+ *   - "refuse" = throw at boot on the first drifted table (strict-schema
+ *     posture).
+ *
+ * Drift cases covered: an undeclared (extra) live column and a clean
+ * schema (no drift). Tested directly against a node:sqlite handle — the
+ * same handle shape db.init drives — so the unit under test is the
+ * reconcile diff, not the full vault/audit boot.
+ */
+
+var helpers = require("../helpers");
+var check = helpers.check;
+var fs   = helpers.fs;
+var os   = helpers.os;
+var path = helpers.path;
+var sqlite = require("node:sqlite");
+var dbSchema = require("../../lib/db-schema");
+
+function _openDb(tmpDir) {
+  return new sqlite.DatabaseSync(path.join(tmpDir, "drift.db"));
+}
+
+function _liveColumns(db, table) {
+  return db.prepare('PRAGMA table_info("' + table + '")').all()
+    .map(function (r) { return r.name; });
+}
+
+function threwMatching(fn, pattern) {
+  try { fn(); } catch (e) { return pattern.test(e.message) ? e : null; }
+  return null;
+}
+
+var SCHEMA = [{
+  name: "widgets",
+  columns: {
+    _id:    "TEXT PRIMARY KEY",
+    label:  "TEXT",
+    status: "TEXT DEFAULT 'active'",
+  },
+  indexes: ["status"],
+}];
+
+async function run() {
+  var tmp = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-schema-drift-"));
+
+  // ---- DRIFT_MODES exported ----
+  check("DRIFT_MODES exported as the three reaction modes",
+    Array.isArray(dbSchema.DRIFT_MODES) &&
+    dbSchema.DRIFT_MODES.join(",") === "ignore,warn,refuse");
+
+  // ---- clean schema → no drift in any mode ----
+  var dbClean = _openDb(tmp);
+  var cleanReport = dbSchema.reconcile(dbClean, SCHEMA, { onDrift: "refuse" });
+  check("clean schema reconcile reports no drift", cleanReport.drifted === false);
+  check("clean schema reconcile reports zero drifted tables", cleanReport.tables.length === 0);
+  // re-running refuse on a freshly-reconciled DB must not throw
+  check("clean schema refuse mode does not throw",
+    threwMatching(function () { dbSchema.reconcile(dbClean, SCHEMA, { onDrift: "refuse" }); }, /.*/) === null);
+  dbClean.close();
+
+  // ---- introduce an undeclared (extra) live column out of band ----
+  var dbDrift = _openDb(tmp);
+  dbSchema.reconcile(dbDrift, SCHEMA); // default: ignore (back-compat path)
+  dbSchema.runSql(dbDrift, 'ALTER TABLE "widgets" ADD COLUMN "rogue" TEXT');
+  check("setup: rogue column is present in the live table",
+    _liveColumns(dbDrift, "widgets").indexOf("rogue") !== -1);
+
+  // default (no opts) tolerates drift silently — return value present,
+  // not drifted is irrelevant; the key assertion is it does NOT throw.
+  check("default reconcile (no opts) tolerates the extra column",
+    threwMatching(function () { dbSchema.reconcile(dbDrift, SCHEMA); }, /.*/) === null);
+
+  // explicit "ignore" is identical to default — no throw, not flagged.
+  var ignoreReport = dbSchema.reconcile(dbDrift, SCHEMA, { onDrift: "ignore" });
+  check("onDrift:'ignore' does not flag the extra column", ignoreReport.drifted === false);
+
+  // "warn" detects but does NOT throw, and reports the extra column.
+  var warnReport;
+  check("onDrift:'warn' does not throw on the extra column",
+    threwMatching(function () { warnReport = dbSchema.reconcile(dbDrift, SCHEMA, { onDrift: "warn" }); }, /.*/) === null);
+  check("onDrift:'warn' flags drift", warnReport.drifted === true);
+  check("onDrift:'warn' identifies the drifted table",
+    warnReport.tables.length === 1 && warnReport.tables[0].table === "widgets");
+  check("onDrift:'warn' lists the undeclared column as extra",
+    warnReport.tables[0].extra.indexOf("rogue") !== -1);
+  check("onDrift:'warn' reports no missing declared columns",
+    warnReport.tables[0].missing.length === 0);
+
+  // "refuse" throws on the same drift.
+  var refuseErr = threwMatching(
+    function () { dbSchema.reconcile(dbDrift, SCHEMA, { onDrift: "refuse" }); },
+    /schema drift on table 'widgets'/);
+  check("onDrift:'refuse' throws on the extra column", !!refuseErr);
+  check("onDrift:'refuse' error names the undeclared column",
+    refuseErr && /undeclared column\(s\) \[rogue\]/.test(refuseErr.message));
+
+  // refuse mode never drops the column — non-destructive contract holds.
+  check("refuse mode left the rogue column in place (non-destructive)",
+    _liveColumns(dbDrift, "widgets").indexOf("rogue") !== -1);
+  dbDrift.close();
+
+  // ---- reconcileTable surfaced directly carries the same modes ----
+  var dbT = _openDb(tmp);
+  dbSchema.reconcileTable(dbT, SCHEMA[0]);
+  dbSchema.runSql(dbT, 'ALTER TABLE "widgets" ADD COLUMN "sneaky" TEXT');
+  var tReport = dbSchema.reconcileTable(dbT, SCHEMA[0], { onDrift: "warn" });
+  check("reconcileTable warn returns a drift report",
+    tReport && tReport.drift && tReport.drift.extra.indexOf("sneaky") !== -1);
+  check("reconcileTable refuse throws on drift",
+    !!threwMatching(function () { dbSchema.reconcileTable(dbT, SCHEMA[0], { onDrift: "refuse" }); },
+      /schema drift on table 'widgets'/));
+  dbT.close();
+
+  // ---- bad onDrift value is a config-time throw ----
+  var dbBad = _openDb(tmp);
+  var enumErr = threwMatching(
+    function () { dbSchema.reconcile(dbBad, SCHEMA, { onDrift: "loud" }); },
+    /onDrift must be one of/);
+  check("bad onDrift enum value throws at config time", !!enumErr);
+  check("bad onDrift enum value throws a TypeError",
+    enumErr instanceof TypeError);
+  check("non-string onDrift value throws",
+    !!threwMatching(function () { dbSchema.reconcile(dbBad, SCHEMA, { onDrift: 3 }); },
+      /onDrift must be one of/));
+  dbBad.close();
+
+  fs.rmSync(tmp, { recursive: true, force: true });
+  console.log("OK — db schema-drift detection tests");
+}
+
+module.exports = { run: run };
+if (require.main === module) {
+  run().then(function () { process.exit(0); })
+       .catch(function (err) { process.exitCode = 1; throw err; });
+}

package/lib/vendor/blamejs/test/layer-0-primitives/deny-response.test.js

@@ -132,6 +132,38 @@ async function run() {
     });
     check("denyResponse onDeny no-op -> default written (no hang)",
       res5.statusCode === 403 && res5.body === "default-after-noop");
+
+    // problem mode with problemCode but no problemType -> type derives
+    // <base>/<code> (RFC 9457 §3.1.1), not "about:blank". This is the
+    // shape rate-limit.js emits for a 429.
+    var res6 = _mkRes();
+    denyResponse(_mkReq(), res6, {
+      problem: true, status: 429, contentType: "text/plain", body: "no",
+      problemCode: "rate-limit-exceeded", problemTitle: "Too Many Requests",
+      info: { status: 429, reason: "rate-limit-exceeded" },
+    });
+    var p6 = _json(res6.body);
+    check("denyResponse problem: problemCode (no problemType) -> type ends with /rate-limit-exceeded",
+      res6.statusCode === 429 && typeof p6.type === "string" &&
+      p6.type !== "about:blank" && /\/rate-limit-exceeded$/.test(p6.type));
+
+    // onDeny commits via headersSent only (no writableEnded flip) ->
+    // deny-response must treat it as terminal and NOT call writeHead
+    // again ("headers already sent" otherwise). A wrapping consumer's
+    // streaming onDeny is the real-world shape.
+    var wroteHeadAgain = false;
+    var res7 = _mkRes();
+    res7.writeHead = function () { wroteHeadAgain = true; throw new Error("ERR_HTTP_HEADERS_SENT"); };
+    var caught = null;
+    try {
+      denyResponse(_mkReq(), res7, {
+        onDeny: function (req, rs) { rs.headersSent = true; /* commits headers, does not end */ },
+        status: 403, contentType: "text/plain", body: "should-not-write",
+        info: { status: 403, reason: "x" },
+      });
+    } catch (e) { caught = e; }
+    check("denyResponse onDeny sets headersSent (no writableEnded) -> no second writeHead, no throw",
+      caught === null && wroteHeadAgain === false);
   })();
 
   // ---- require-methods (405 / text/plain) ----

package/lib/vendor/blamejs/test/layer-0-primitives/external-db-hardening.test.js

@@ -221,6 +221,125 @@ async function run() {
   });
   check("auth-failure audit carries attemptedTable", payrollRow.length >= 1);
 
+  // ---- requireTls posture gate (PCI-DSS v4.0 Req 4 / HIPAA §164.312(e)) ----
+  // Opt-in transport posture: refuse a non-TLS external-db connection at
+  // config time. Default OFF — a backend that omits requireTls is used
+  // exactly as supplied (back-compat preserved).
+  function _noopDriver() {
+    return {
+      connect: async function () { return {}; },
+      query:   async function () { return { rows: [], rowCount: 0 }; },
+      close:   async function () {},
+    };
+  }
+  function _initThrows(label, cfg, codeRe) {
+    b.externalDb._resetForTest();
+    var threw = null;
+    try { b.externalDb.init({ backends: { main: cfg } }); }
+    catch (e) { threw = e; }
+    check("requireTls rejects: " + label,
+      threw && (codeRe.test(threw.code || "") || codeRe.test(threw.message || "")));
+    b.externalDb._resetForTest();
+  }
+  function _initOk(label, cfg) {
+    b.externalDb._resetForTest();
+    var threw = null;
+    try { b.externalDb.init({ backends: { main: cfg } }); }
+    catch (e) { threw = e; }
+    check("requireTls accepts: " + label, threw === null);
+    b.externalDb._resetForTest();
+  }
+
+  // Default OFF — no requireTls → plaintext connection used as-is.
+  var nd = _noopDriver();
+  _initOk("absent requireTls (default off, back-compat)",
+    { connect: nd.connect, query: nd.query, close: nd.close });
+
+  // requireTls:false is an explicit no-gate.
+  _initOk("requireTls:false explicit off",
+    { connect: nd.connect, query: nd.query, requireTls: false });
+
+  // requireTls:true with no TLS declaration → refused.
+  _initThrows("requireTls true, no TLS declared",
+    { connect: nd.connect, query: nd.query, requireTls: true }, /TLS_REQUIRED/);
+
+  // requireTls:true with sslmode that permits plaintext fallback → refused.
+  _initThrows("requireTls true, sslmode 'prefer' (plaintext fallback)",
+    { connect: nd.connect, query: nd.query, requireTls: true, sslmode: "prefer" }, /TLS_REQUIRED/);
+  _initThrows("requireTls true, sslmode 'disable'",
+    { connect: nd.connect, query: nd.query, requireTls: true, sslmode: "disable" }, /TLS_REQUIRED/);
+
+  // requireTls:true with explicit non-TLS transport → refused.
+  _initThrows("requireTls true, tls:false",
+    { connect: nd.connect, query: nd.query, requireTls: true, tls: false }, /TLS_REQUIRED/);
+
+  // requireTls:true satisfied by tls:true.
+  _initOk("requireTls true, tls:true",
+    { connect: nd.connect, query: nd.query, requireTls: true, tls: true });
+
+  // requireTls:true satisfied by an ssl object.
+  _initOk("requireTls true, ssl object",
+    { connect: nd.connect, query: nd.query, requireTls: true, ssl: { rejectUnauthorized: true } });
+
+  // requireTls:true satisfied by guaranteed sslmode values.
+  _initOk("requireTls true, sslmode 'require'",
+    { connect: nd.connect, query: nd.query, requireTls: true, sslmode: "require" });
+  _initOk("requireTls true, sslmode 'verify-full'",
+    { connect: nd.connect, query: nd.query, requireTls: true, sslmode: "verify-full" });
+
+  // requireTls must be a boolean — non-boolean refused at config time.
+  _initThrows("requireTls non-boolean",
+    { connect: nd.connect, query: nd.query, requireTls: "yes" }, /INVALID_CONFIG|must be a boolean/);
+
+  // ---- OTel db.* semantic-convention attributes on the data emit path ----
+  // db.system / db.operation / db.statement / db.name ride the audit
+  // metadata so OTel dashboards correlate without a per-framework adapter.
+  // Mirrors the db.ddl.executed shape on the local SQLite side.
+  var otelRows = [];
+  var origEmit2 = b.audit && b.audit.safeEmit;
+  if (origEmit2) {
+    b.audit.safeEmit = function (rec) {
+      if (rec && typeof rec.action === "string" &&
+          rec.action.indexOf("system.externaldb.") === 0) otelRows.push(rec);
+      return origEmit2.apply(b.audit, arguments);
+    };
+  }
+  try {
+    var od = _instrumentingDriver();
+    b.externalDb._resetForTest();
+    b.externalDb.init({
+      backends: { pgmain: { dialect: "postgres", connect: od.connect, query: od.query, close: od.close } },
+    });
+    await b.externalDb.query("SELECT id FROM users WHERE id = $1", [7]);                              // default — no includeSqlInAudit
+    await b.externalDb.query("SELECT id FROM users WHERE id = $1", [7], { includeSqlInAudit: true }); // opted in
+    await b.externalDb.transaction(async function (tx) { await tx.query("SELECT 1"); });
+    await new Promise(function (r) { setImmediate(r); });
+  } finally {
+    if (origEmit2) b.audit.safeEmit = origEmit2;
+  }
+  var qRow = otelRows.filter(function (r) { return r.action === "system.externaldb.query"; });
+  check("OTel: db.system maps dialect to OTel registry value (postgres→postgresql)",
+    qRow.length >= 2 && qRow[0].metadata["db.system"] === "postgresql");
+  check("OTel: db.name carries the backend name",
+    qRow.length >= 2 && qRow[0].metadata["db.name"] === "pgmain");
+  check("OTel: db.operation is the leading SQL keyword (always emitted)",
+    qRow.length >= 2 && qRow[0].metadata["db.operation"] === "SELECT");
+  // db.statement carries the SQL text (which can hold operator-inlined PII /
+  // secrets), so it is gated behind the includeSqlInAudit opt-out: omitted by
+  // default, present only when the operator opts in. This is the regression
+  // guard for the privacy gate.
+  check("OTel: db.statement OMITTED by default (respects includeSqlInAudit opt-out)",
+    qRow.length >= 2 && qRow[0].metadata["db.statement"] === undefined);
+  check("OTel: db.statement present + sanitized only when includeSqlInAudit:true",
+    qRow.length >= 2 &&
+    qRow[1].metadata["db.statement"] === "SELECT id FROM users WHERE id = $1" &&
+    qRow[1].metadata["db.statement"].indexOf("7") === -1);
+  var txRow = otelRows.filter(function (r) { return r.action === "system.externaldb.transaction"; });
+  check("OTel: transaction span carries db.system + db.operation BEGIN",
+    txRow.length >= 1 &&
+    txRow[0].metadata["db.system"] === "postgresql" &&
+    txRow[0].metadata["db.operation"] === "BEGIN");
+
   b.externalDb._resetForTest();
 }