@blamejs/blamejs-shop 0.4.31 → 0.4.32

package/lib/vendor/blamejs/test/layer-0-primitives/sse-backpressure.test.js

@@ -0,0 +1,91 @@
+"use strict";
+// #126: SSE _writeRaw wrote to the response with no regard for backpressure
+// and no bound on the outbound buffer. res.write() returns false when the
+// socket's send buffer is full; a slow/stalled client never drains, so the
+// server's writable buffer (res.writableLength) grows without bound — one
+// stuck connection can exhaust the server heap (memory-exhaustion DoS).
+//
+// The fix caps the per-channel buffered bytes (maxBufferedBytes) and evicts
+// the slow consumer (closes the channel + throws sse/backpressure) once the
+// buffer blows the cap, instead of buffering indefinitely.
+//
+// RED on the buggy tree: send() can be called unbounded against a stalled
+// client and never refuses; the channel stays open. GREEN after the fix:
+// send() throws sse/backpressure once the buffer exceeds the cap and the
+// channel is closed.
+
+var EventEmitter = require("events");
+var helpers = require("../helpers");
+var b     = helpers.b;
+var check = helpers.check;
+
+// A response whose socket never drains: every write accumulates into
+// writableLength and write() reports backpressure (false) past the highwater.
+function _stalledRes(highWaterBytes) {
+  var res = new EventEmitter();
+  var buffered = 0;
+  res.writableLength = 0;
+  res.setHeader   = function () {};
+  res.flushHeaders = function () {};
+  res.write = function (chunk) {
+    buffered += Buffer.byteLength(chunk, "utf8");
+    res.writableLength = buffered;        // stalled client: nothing is ever flushed
+    return buffered < highWaterBytes;     // false once over the socket highwater
+  };
+  res.end = function () {};
+  return res;
+}
+
+async function run() {
+  var req = { method: "GET", url: "/events", headers: {}, httpVersionMajor: 1, on: function () {} };
+  var res = _stalledRes(b.constants.BYTES.kib(64));
+
+  var capBytes = b.constants.BYTES.kib(8);
+  var channel = b.sse.create(req, res, {
+    heartbeatMs:      0,           // no heartbeat noise
+    audit:            false,
+    maxBufferedBytes: capBytes,
+  });
+
+  var threw = null;
+  var sends = 0;
+  var event = { data: "x".repeat(512) };   // ~520 bytes serialized
+  try {
+    for (var i = 0; i < 100000 && threw === null; i++) {
+      channel.send(event);
+      sends += 1;
+    }
+  } catch (e) { threw = e; }
+
+  check("#126 send() refuses once the outbound buffer blows maxBufferedBytes",
+        threw !== null && threw.code === "sse/backpressure");
+  check("#126 the slow-consumer channel is closed on eviction",
+        channel.closed === true);
+  // The buffer cap is ~8 KiB and events are ~520 B, so eviction must fire
+  // within a few dozen sends — never the full 100k unbounded loop.
+  check("#126 buffering is bounded (evicted well before the unbounded loop ended)",
+        sends > 0 && sends < 1000);
+  check("#126 res.writableLength stayed near the cap, not unbounded",
+        res.writableLength < capBytes + b.constants.BYTES.kib(2));
+
+  // A HEALTHY client (write() drains, writableLength stays ~0) is never evicted.
+  var healthyRes = new EventEmitter();
+  healthyRes.writableLength = 0;
+  healthyRes.setHeader = function () {};
+  healthyRes.flushHeaders = function () {};
+  healthyRes.write = function () { healthyRes.writableLength = 0; return true; };
+  healthyRes.end = function () {};
+  var healthy = b.sse.create(req, healthyRes, { heartbeatMs: 0, audit: false, maxBufferedBytes: capBytes });
+  for (var j = 0; j < 5000; j++) healthy.send(event);
+  check("#126 a healthy (draining) client is never evicted by the cap",
+        healthy.closed === false);
+  healthy.close();
+
+  console.log("OK — sse backpressure / bounded-buffer tests");
+}
+
+module.exports = { run: run };
+if (require.main === module) {
+  run().then(function () { process.exit(0); })
+       .catch(function (err) { process.stderr.write(String(err && err.stack || err) + "\n"); process.exit(1); });
+}

package/lib/vendor/blamejs/test/layer-0-primitives/ssrf-guard.test.js

@@ -206,6 +206,75 @@ async function run() {
   check("checkUrl: public IP passes",
         r2 && r2.ips[0].address === "93.184.216.34");
 
+  // ---- cloud-metadata IPv6 matched on canonical bytes, not string ----
+  // The IMDS-over-IPv6 address fd00:ec2::254 has many textual spellings.
+  // A non-canonical / mixed-case spelling must still classify as
+  // cloud-metadata — a string-equality membership test caught one
+  // spelling only, and the DoH resolver decodes AAAA to the expanded
+  // fd00:ec2:0:0:0:0:0:254 form, which slipped past as "private".
+  check("classify fd00:ec2:0:0:0:0:0:254 → cloud-metadata (expanded zero-run)",
+        ssrf.classify("fd00:ec2:0:0:0:0:0:254") === "cloud-metadata");
+  check("classify FD00:EC2::254 → cloud-metadata (mixed-case compressed)",
+        ssrf.classify("FD00:EC2::254") === "cloud-metadata");
+  check("classify fd00:0ec2::0254 → cloud-metadata (leading-zero groups)",
+        ssrf.classify("fd00:0ec2::0254") === "cloud-metadata");
+  // A genuine ULA private address that is NOT metadata must stay "private".
+  check("classify fd00::1 → private (NOT metadata)",
+        ssrf.classify("fd00::1") === "private");
+
+  // PoC: allowInternal:true MUST NOT override the unconditional metadata
+  // block, even when DNS resolves to the non-canonical IMDS-over-IPv6
+  // spelling. Pre-fix this RESOLVED (credentials reachable); now refused.
+  threw = null;
+  try {
+    await ssrf.checkUrl("http://imds.attacker.example/latest/meta-data/iam/", {
+      allowInternal: true,
+      dnsLookup: _stubLookup("fd00:ec2:0:0:0:0:0:254", 6),
+    });
+  } catch (e) { threw = e; }
+  check("checkUrl: allowInternal:true does NOT override non-canonical IMDS-over-IPv6",
+        threw && threw.code === "ssrf-guard/blocked-cloud-metadata");
+
+  // Compressed + mixed-case spellings refused too (wire not reached).
+  threw = null;
+  try {
+    await ssrf.checkUrl("http://imds.attacker.example/", {
+      allowInternal: true,
+      dnsLookup: _stubLookup("FD00:EC2::254", 6),
+    });
+  } catch (e) { threw = e; }
+  check("checkUrl: allowInternal:true does NOT override mixed-case IMDS-over-IPv6",
+        threw && threw.code === "ssrf-guard/blocked-cloud-metadata");
+
+  // A genuine private IPv6 (fd00::1, NOT metadata) still respects
+  // allowInternal — the metadata gate is the only unconditional class.
+  threw = null;
+  var rPriv6 = null;
+  try {
+    rPriv6 = await ssrf.checkUrl("http://internal.mesh/", {
+      allowInternal: true,
+      dnsLookup: _stubLookup("fd00::1", 6),
+    });
+  } catch (e) { threw = e; }
+  check("checkUrl: genuine private IPv6 still honors allowInternal:true",
+        threw === null && rPriv6 && rPriv6.ips[0].address === "fd00::1");
+
+  // checkUrlTextual: the same byte-canonical gate at the textual layer.
+  threw = null;
+  try { ssrf.checkUrlTextual("http://[fd00:ec2:0:0:0:0:0:254]/x"); }
+  catch (e) { threw = e; }
+  check("checkUrlTextual: non-canonical IMDS-over-IPv6 refused",
+        threw && threw.code === "ssrf-guard/blocked-cloud-metadata");
+  threw = null;
+  try { ssrf.checkUrlTextual("http://[FD00:EC2::254]/x"); }
+  catch (e) { threw = e; }
+  check("checkUrlTextual: mixed-case IMDS-over-IPv6 refused",
+        threw && threw.code === "ssrf-guard/blocked-cloud-metadata");
+  // A non-metadata internal host stays accepted at the textual layer.
+  var txtOk = ssrf.checkUrlTextual("http://[fd00::1]/x");
+  check("checkUrlTextual: non-metadata IPv6 literal accepted",
+        txtOk && txtOk.host === "fd00::1");
+
   // ---- checkUrl: bad input ----
   threw = null;
   try { await ssrf.checkUrl("not-a-url"); }

package/lib/vendor/blamejs/test/layer-0-primitives/static.test.js

@@ -1,7 +1,9 @@
 "use strict";
 /**
- * static — forceAttachmentForNonText opt-in defense for stored-XSS via
- * user-upload directories.
+ * static — forceAttachmentForNonText defense for stored-XSS via
+ * user-upload directories, plus the mountType typing that drives its
+ * default (v0.15.0: "user-content" mounts force-download by default;
+ * "curated" mounts keep inline render).
  *
  * Run standalone: `node test/layer-0-primitives/static.test.js`
  * Or via smoke:   `node test/smoke.js`
@@ -233,6 +235,73 @@ async function testForceAttachmentPdfOptInInline() {
   }
 }
 
+// mountType drives the forceAttachmentForNonText default (v0.15.0).
+// A mount TYPED "user-content" forces risky inline MIMEs to download with
+// NO explicit forceAttachmentForNonText (the new default-on behavior); a
+// "curated" mount (or unset) keeps inline render (the opt-out preserved).
+async function testMountTypeUserContentForcesDownloadByDefault() {
+  var ctx = await _server();
+  _writeFile(ctx.dir, "evil.html", "<script>alert(1)</script>");
+  // No forceAttachmentForNonText passed — the default comes from mountType.
+  var srv = await ctx.start({ contentSafety: null, mountType: "user-content" });
+  try {
+    var r = await _get(srv.port, "/evil.html");
+    check("mountType user-content: html forced to attachment by default",
+          r.statusCode === 200 &&
+          /^attachment;/.test(r.headers["content-disposition"] || ""));
+    check("mountType user-content: nosniff added by default",
+          r.headers["x-content-type-options"] === "nosniff");
+  } finally {
+    srv.close();
+    ctx.cleanup();
+  }
+}
+
+async function testMountTypeCuratedKeepsInline() {
+  var ctx = await _server();
+  _writeFile(ctx.dir, "evil.html", "<script>alert(1)</script>");
+  // Explicit "curated" is the documented opt-out — inline render preserved.
+  var srv = await ctx.start({ contentSafety: null, mountType: "curated" });
+  try {
+    var r = await _get(srv.port, "/evil.html");
+    check("mountType curated: html served inline (opt-out preserved)",
+          r.statusCode === 200 && !r.headers["content-disposition"]);
+  } finally {
+    srv.close();
+    ctx.cleanup();
+  }
+}
+
+async function testMountTypeExplicitOverrideWins() {
+  var ctx = await _server();
+  _writeFile(ctx.dir, "evil.html", "<script>alert(1)</script>");
+  // An explicit forceAttachmentForNonText:false overrides the
+  // user-content-derived default either way.
+  var srv = await ctx.start({
+    contentSafety: null, mountType: "user-content",
+    forceAttachmentForNonText: false,
+  });
+  try {
+    var r = await _get(srv.port, "/evil.html");
+    check("explicit forceAttachmentForNonText:false overrides user-content default",
+          r.statusCode === 200 && !r.headers["content-disposition"]);
+  } finally {
+    srv.close();
+    ctx.cleanup();
+  }
+}
+
+function testMountTypeBadValueThrows() {
+  var threw = null;
+  var dir = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-static-mt-"));
+  try {
+    b.staticServe.create({ root: dir, mountType: "uploads" });
+  } catch (e) { threw = e; }
+  finally { fs.rmSync(dir, { recursive: true, force: true }); }
+  check("bad mountType value throws at config time",
+        threw && /mountType must be 'curated'/.test(threw.message));
+}
+
 function testRejectsUnknownOpts() {
   var threw = null;
   var dir = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-static-fa-"));
@@ -299,6 +368,122 @@ function testOnErrorRejectsNonFunction() {
   fs.rmSync(dir, { recursive: true, force: true });
 }
 
+// Send a raw (un-normalized-by-node) request path. http.request normalizes
+// "/../" on the client side, so build the request line by hand over a raw
+// socket to deliver the traversal bytes verbatim to the server.
+function _getRaw(port, rawPath) {
+  var net = require("node:net");
+  return new Promise(function (resolve, reject) {
+    var sock = net.connect(port, "127.0.0.1", function () {
+      sock.write("GET " + rawPath + " HTTP/1.1\r\nHost: 127.0.0.1\r\nConnection: close\r\n\r\n");
+    });
+    var chunks = [];
+    sock.on("data", function (c) { chunks.push(c); });
+    sock.on("end", function () {
+      var raw = Buffer.concat(chunks).toString("utf8");
+      var statusLine = raw.split("\r\n")[0] || "";
+      var m = /^HTTP\/1\.\d (\d{3})/.exec(statusLine);
+      var sep = raw.indexOf("\r\n\r\n");
+      var body = sep === -1 ? "" : raw.slice(sep + 4);
+      resolve({ statusCode: m ? parseInt(m[1], 10) : 0, body: body, raw: raw });
+    });
+    sock.on("error", reject);
+  });
+}
+
+// Path-traversal refusal — a file OUTSIDE the served root must never be
+// reachable via `../` escapes, percent-encoded escapes, or NUL injection.
+// The secret is written to the parent of `root` so any successful escape
+// would disclose it.
+async function testPathTraversalRefused() {
+  var ctx = await _server();
+  // Sibling secret one level above the served root.
+  var parent = path.dirname(ctx.dir);
+  var secretName = "blamejs-static-secret-" + process.pid + ".txt";
+  var secretAbs = path.join(parent, secretName);
+  var secretBody = "TOP-SECRET-" + Date.now();
+  fs.writeFileSync(secretAbs, secretBody);
+  // A legit in-root file to prove the server is otherwise functional.
+  _writeFile(ctx.dir, "ok.txt", "in-root");
+  var srv = await ctx.start({ contentSafety: null });
+  try {
+    // Raw `../` traversal (delivered verbatim over a raw socket).
+    var rawTrav = await _getRaw(srv.port, "/../" + secretName);
+    check("traversal: raw ../ does not disclose the sibling secret",
+          rawTrav.body.indexOf(secretBody) === -1);
+    check("traversal: raw ../ refused (not 200-with-secret)",
+          rawTrav.statusCode !== 200 || rawTrav.body.indexOf(secretBody) === -1);
+
+    // Deeper raw traversal.
+    var rawDeep = await _getRaw(srv.port, "/sub/../../" + secretName);
+    check("traversal: nested raw ../../ does not disclose the secret",
+          rawDeep.body.indexOf(secretBody) === -1);
+
+    // Percent-encoded `..%2f` traversal (the server decodes, then must
+    // still refuse).
+    var encTrav = await _get(srv.port, "/%2e%2e%2f" + secretName);
+    check("traversal: percent-encoded %2e%2e%2f refused (404/next)",
+          encTrav.statusCode === 404);
+    check("traversal: percent-encoded escape does not disclose the secret",
+          encTrav.body.toString("utf8").indexOf(secretBody) === -1);
+
+    // Double percent-encoded dot-dot.
+    var encTrav2 = await _get(srv.port, "/%2e%2e/%2e%2e/" + secretName);
+    check("traversal: %2e%2e/%2e%2e/ does not disclose the secret",
+          encTrav2.body.toString("utf8").indexOf(secretBody) === -1);
+
+    // NUL-byte injection — refused before any fs op.
+    var nul = await _get(srv.port, "/ok.txt%00.png");
+    check("traversal: NUL-byte path refused (404/next)",
+          nul.statusCode === 404);
+
+    // Sanity: the legit in-root file still serves.
+    var ok = await _get(srv.port, "/ok.txt");
+    check("traversal: in-root file still serves after refusals",
+          ok.statusCode === 200 && ok.body.toString("utf8") === "in-root");
+  } finally {
+    srv.close();
+    fs.rmSync(secretAbs, { force: true });
+    ctx.cleanup();
+  }
+}
+
+// Success path — a legitimately nested file under root is served with its
+// bytes intact. Confirms the confinement barrier does not over-refuse.
+async function testNestedFileServed() {
+  var ctx = await _server();
+  _writeFile(ctx.dir, "assets/css/site.css", "body{color:#000}");
+  var srv = await ctx.start({ contentSafety: null });
+  try {
+    var r = await _get(srv.port, "/assets/css/site.css");
+    check("nested: deep in-root file serves 200",
+          r.statusCode === 200);
+    check("nested: bytes intact",
+          r.body.toString("utf8") === "body{color:#000}");
+    check("nested: correct content-type",
+          /text\/css/.test(r.headers["content-type"] || ""));
+  } finally {
+    srv.close();
+    ctx.cleanup();
+  }
+}
+
+// A directory-index request resolves to the index file inside root and
+// serves it — exercises the re-confinement after the index-file join.
+async function testDirectoryIndexServed() {
+  var ctx = await _server();
+  _writeFile(ctx.dir, "docs/index.html", "<h1>docs</h1>");
+  var srv = await ctx.start({ contentSafety: null });
+  try {
+    var r = await _get(srv.port, "/docs/");
+    check("dir-index: index.html served for a directory request",
+          r.statusCode === 200 && /docs/.test(r.body.toString("utf8")));
+  } finally {
+    srv.close();
+    ctx.cleanup();
+  }
+}
+
 async function run() {
   await testForceAttachmentDefaultOff();
   await testForceAttachmentOnHtml();
@@ -309,10 +494,17 @@ async function run() {
   await testForceAttachmentSvgWithSanitizerInlineAllowed();
   await testForceAttachmentPdfDefaultDownload();
   await testForceAttachmentPdfOptInInline();
+  await testMountTypeUserContentForcesDownloadByDefault();
+  await testMountTypeCuratedKeepsInline();
+  await testMountTypeExplicitOverrideWins();
+  testMountTypeBadValueThrows();
   testRejectsUnknownOpts();
   await testOnErrorFiresOnRefusal();
   await testOnErrorThrowDoesNotCorruptResponse();
   testOnErrorRejectsNonFunction();
+  await testPathTraversalRefused();
+  await testNestedFileServed();
+  await testDirectoryIndexServed();
 }
 
 module.exports = { run: run };

package/lib/vendor/blamejs/test/layer-0-primitives/websocket-extension-header.test.js

@@ -0,0 +1,88 @@
+"use strict";
+/**
+ * websocket _parseExtensionHeader — Sec-WebSocket-Extensions parser
+ * (RFC 7692 permessage-deflate negotiation feeds off this).
+ *
+ * Focus: the extension-parameter name is client-controlled, so the
+ * params map is built from [name, value] pairs through Object.fromEntries
+ * onto a null-prototype object — never a computed-write (`params[name] =
+ * value`) sink. Verifies a hostile `__proto__` / `constructor` /
+ * `prototype` parameter name does NOT pollute Object.prototype
+ * (CWE-915 / CWE-1321) and that the legitimate parameter shape is
+ * unchanged.
+ *
+ * Run standalone: `node test/layer-0-primitives/websocket-extension-header.test.js`
+ * Or via smoke:   `node test/smoke.js`
+ */
+
+var helpers = require("../helpers");
+var b       = helpers.b;
+var check   = helpers.check;
+
+var _parseExtensionHeader = b.websocket._parseExtensionHeader;
+
+function testParsesParamsSuccessPath() {
+  var out = _parseExtensionHeader(
+    "permessage-deflate; client_max_window_bits=12; server_no_context_takeover, foo; bar=baz"
+  );
+  check("ext: two extensions parsed", Array.isArray(out) && out.length === 2);
+  check("ext: first name lower-cased", out[0].name === "permessage-deflate");
+  check("ext: param value parsed", out[0].params.client_max_window_bits === "12");
+  check("ext: valueless param is boolean true",
+        out[0].params.server_no_context_takeover === true);
+  check("ext: second extension name", out[1].name === "foo");
+  check("ext: second extension param", out[1].params.bar === "baz");
+}
+
+function testParamsMapHasNullPrototype() {
+  var out = _parseExtensionHeader("permessage-deflate; client_max_window_bits=15");
+  check("ext: params map has null prototype",
+        Object.getPrototypeOf(out[0].params) === null);
+}
+
+function testRejectsPoisonedParamNames() {
+  var out = _parseExtensionHeader(
+    "permessage-deflate; __proto__=evil; constructor=evil2; prototype=evil3; client_max_window_bits=10"
+  );
+  var params = out[0].params;
+  check("ext: __proto__ param dropped",
+        !Object.prototype.hasOwnProperty.call(params, "__proto__"));
+  check("ext: constructor param dropped",
+        !Object.prototype.hasOwnProperty.call(params, "constructor"));
+  check("ext: prototype param dropped",
+        !Object.prototype.hasOwnProperty.call(params, "prototype"));
+  check("ext: legitimate param still present alongside dropped ones",
+        params.client_max_window_bits === "10");
+  check("ext: Object.prototype not polluted",
+        ({}).evil === undefined && Object.prototype.evil === undefined);
+}
+
+function testProtoValueViaFromEntriesDoesNotEscalate() {
+  // Even if a future grammar change let `__proto__` reach the pair list,
+  // a null-prototype accumulator + Object.fromEntries materialization
+  // can only create an OWN `__proto__` property — it can never mutate the
+  // prototype chain. The current parser drops the name outright; this is
+  // the structural backstop.
+  var before = Object.prototype.toString;
+  _parseExtensionHeader("permessage-deflate; __proto__=x");
+  check("ext: Object.prototype.toString intact after parse",
+        Object.prototype.toString === before);
+  check("ext: a fresh object still inherits toString",
+        typeof ({}).toString === "function");
+}
+
+async function run() {
+  testParsesParamsSuccessPath();
+  testParamsMapHasNullPrototype();
+  testRejectsPoisonedParamNames();
+  testProtoValueViaFromEntriesDoesNotEscalate();
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  run().then(
+    function () { console.log("OK — " + helpers.getChecks() + " checks passed"); },
+    function (e) { console.error("FAIL:", e.message); process.exit(1); }
+  );
+}

package/lib/vendor/blamejs/test/layer-0-primitives/worker-pool-recycle-race.test.js

@@ -0,0 +1,66 @@
+"use strict";
+// #127: a task queued behind a timing-out (or erroring) task must not be
+// dropped by slot recycling. _onTaskTimeout / _onWorkerError called
+// _finishTask BEFORE marking the slot recycling. _finishTask sets slot.busy
+// = false and drains the queue, so _findIdleSlot handed the freshly-queued
+// task to the very slot whose worker was about to be terminated — the task's
+// message went to a dying worker and came back as workerpool/worker-exit
+// (or hung), even though a healthy replacement worker was about to spawn.
+//
+// This is deterministic (not a flaky race): _finishTask -> _drainQueue runs
+// synchronously inside _onTaskTimeout, before _recycleWorker. The fix marks
+// the slot recycling BEFORE _finishTask, so the drain skips the dying slot
+// and the queued task waits for the replacement worker.
+//
+// RED on the buggy tree: the queued echo rejects with workerpool/worker-exit.
+// GREEN after the fix: it runs on the replacement worker and returns its
+// result.
+
+var path = require("path");
+var helpers = require("../helpers");
+var b     = helpers.b;
+var check = helpers.check;
+
+var FIXTURE = path.resolve(__dirname, "..", "fixtures", "worker-pool", "echo.js");
+
+async function run() {
+  // Single worker so the second task MUST queue behind the first, and a
+  // short timeout so the busy-loop task is reaped quickly.
+  var pool = b.workerPool.create(FIXTURE, { size: 1, taskTimeoutMs: 400 });
+  try {
+    // Task A occupies the only worker and busy-loops until it is reaped by
+    // taskTimeoutMs. Its rejection (workerpool/timeout) is expected.
+    var aErr = null;
+    var aPromise = pool.run({ kind: "loop" }).catch(function (e) { aErr = e; });
+
+    // Task B queues behind A (worker busy). It is a trivial echo that must
+    // succeed once a healthy worker is available.
+    var bResult = null;
+    var bError  = null;
+    var bPromise = pool.run({ kind: "echo", payload: { v: 42 } })
+      .then(function (r) { bResult = r; })
+      .catch(function (e) { bError = e; });
+
+    // Bound the wait so a hung B fails the test rather than hanging the suite.
+    await Promise.race([
+      Promise.all([aPromise, bPromise]),
+      helpers.waitUntil(function () { return bResult !== null || bError !== null; },
+        { timeoutMs: 8000, label: "#127: queued task settles after the slot recycles" }),
+    ]);
+
+    check("#127 the timing-out task A is reaped (timeout, as expected)",
+          aErr && aErr.code === "workerpool/timeout");
+    check("#127 the task queued behind it is NOT dropped by slot recycling",
+          bError === null);
+    check("#127 the queued task runs on the replacement worker and returns its result",
+          bResult && bResult.v === 42);
+  } finally {
+    pool.terminate();
+  }
+}
+
+module.exports = { run: run };
+if (require.main === module) {
+  run().then(function () { process.exit(0); })
+       .catch(function (err) { process.stderr.write(String(err && err.stack || err) + "\n"); process.exit(1); });
+}

package/lib/vendor/blamejs/test/layer-1-state/api-key.test.js

@@ -259,6 +259,88 @@ async function testHashAlgoOptArgon2id() {
   check("argon2id: wrong secret returns null", wrong === null);
 }
 
+async function testRotateOnVerifyUpgradesHashAlgo() {
+  // A row stored under a non-active hash algorithm is transparently
+  // re-hashed to the active algorithm on the next successful (leader)
+  // verify — the rotate-on-next-verify that credentialHash documents.
+  var ns = "rehash-mig";
+  // A store configured for argon2id issues the key (the "legacy" shape).
+  var legacy = b.apiKey.create({ namespace: ns, hashAlgo: "argon2id" });
+  var issued = await legacy.issue({ ownerId: "u1" });
+  var pre = await b.clusterStorage.executeOne(
+    "SELECT secretHash FROM _blamejs_api_keys WHERE id = ?", [ns + ":" + issued.id]);
+  check("rotate-on-verify: stored under argon2id before verify",
+        b.credentialHash.inspect(pre.secretHash).algoName === "argon2id");
+
+  // A default (shake256) store verifies the SAME key on the same table.
+  var active = b.apiKey.create({ namespace: ns });   // hashAlgo defaults to shake256
+  var record = await active.verify(issued.key);
+  check("rotate-on-verify: credential still verifies under the legacy hash",
+        record !== null && record.id === issued.id);
+
+  // The at-rest hash is now the active shake256 envelope — upgraded in place,
+  // with no API/return-value change for the caller.
+  var post = await b.clusterStorage.executeOne(
+    "SELECT secretHash FROM _blamejs_api_keys WHERE id = ?", [ns + ":" + issued.id]);
+  var info = b.credentialHash.inspect(post.secretHash);
+  check("rotate-on-verify: stored hash upgraded to shake256", info.algoName === "shake256");
+  check("rotate-on-verify: upgraded envelope no longer needs rehash",
+        b.credentialHash.needsRehash(post.secretHash, { algo: "shake256" }) === false);
+
+  // The original secret still verifies under the upgraded hash.
+  var again = await active.verify(issued.key);
+  check("rotate-on-verify: re-verify under the upgraded hash succeeds",
+        again !== null && again.id === issued.id);
+}
+
+async function testRehashOnVerifyDoesNotClobberConcurrentRotate() {
+  // Rotate-on-verify reads the stored hash, then writes the upgraded hash in a
+  // later UPDATE. If a rotate() lands between the read and the write, a
+  // row-id-only UPDATE would overwrite the freshly rotated secret with the OLD
+  // secret's re-hash — invalidating the new token while the old one keeps
+  // working. The upgrade write carries a compare-and-swap on the exact hash
+  // that was verified, so a row whose secretHash changed under it is untouched.
+  var credentialHashMod = require("../../lib/credential-hash");
+  var ns = "rehash-race";
+  var legacy = b.apiKey.create({ namespace: ns, hashAlgo: "argon2id" });
+  var issued = await legacy.issue({ ownerId: "u1" });
+  var rowId  = ns + ":" + issued.id;
+
+  // The hash a concurrent rotate() would install mid-flight (a distinct envelope).
+  var rotatedHash = await credentialHashMod.hash("ab".repeat(32), { algo: "shake256" });
+
+  var active   = b.apiKey.create({ namespace: ns });   // active algo shake256 → triggers the re-hash
+  var realHash = credentialHashMod.hash;
+  var injected = false;
+  // Land a concurrent rotation inside the re-hash's async window: overwrite the
+  // stored secretHash after the OLD value was read but before the upgrade UPDATE.
+  // api-key reads credentialHash.hash off this module object at call time, so the
+  // patch intercepts exactly the rotate-on-verify re-hash (issue() above ran
+  // before the patch and is unaffected).
+  credentialHashMod.hash = async function (secretHex, opts) {
+    var out = await realHash.call(credentialHashMod, secretHex, opts);
+    if (!injected) {
+      injected = true;
+      await b.clusterStorage.execute(
+        "UPDATE _blamejs_api_keys SET secretHash = ? WHERE id = ?", [rotatedHash, rowId]);
+    }
+    return out;
+  };
+  var record;
+  try {
+    record = await active.verify(issued.key);
+  } finally {
+    credentialHashMod.hash = realHash;
+  }
+  check("rehash-race: the credential still verifies under the legacy hash",
+        record !== null && record.id === issued.id);
+
+  var post = await b.clusterStorage.executeOne(
+    "SELECT secretHash FROM _blamejs_api_keys WHERE id = ?", [rowId]);
+  check("rehash-race: the concurrent rotation's hash survives — re-hash did NOT clobber it",
+        post.secretHash === rotatedHash);
+}
+
 async function testGetById() {
   var keys = b.apiKey.create({ namespace: "get-test" });
   var issued = await keys.issue({ ownerId: "u1" });
@@ -690,6 +772,8 @@ async function run() {
     await testHardRotateClearsSecondary();
     await testEnvelopeFormatPersisted();
     await testHashAlgoOptArgon2id();
+    await testRotateOnVerifyUpgradesHashAlgo();
+    await testRehashOnVerifyDoesNotClobberConcurrentRotate();
     await testListForOwner();
     await testGetById();
     await testTrackLastUsedAt();