npm - @blamejs/blamejs-shop - Versions diffs - 0.4.55 → 0.4.57 - Mend

@blamejs/blamejs-shop 0.4.55 → 0.4.57

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (399) hide show

package/lib/vendor/blamejs/lib/webhook.js CHANGED Viewed

@@ -59,6 +59,10 @@ var numericChecks = require("./numeric-checks");
 var requestHelpers = require("./request-helpers");
 var validateOpts = require("./validate-opts");
 var { WebhookError } = require("./framework-error");
+// b.webhook.dispatcher — durable signed-webhook delivery store. Lives in its
+// own module (distinct domain: persistence) and lazyRequires this file back,
+// so this top-level require is cycle-safe.
+var webhookDispatcher = require("./webhook-dispatcher");
 var observability = lazyRequire(function () { return require("./observability"); });
@@ -832,16 +836,28 @@ function _coerceBodyString(body) {
  * HMAC-SHA-256 over the literal `<t>.<rawBody>` string using the
  * operator's `whsec_...` secret bytes verbatim (the prefix IS the key).
  * Refuses signatures older than the tolerance window (default 5 min,
- * minimum 30 s). When `nonceStore` is supplied the verifier records
- * the accepted v1 signature so a replay within the tolerance window
- * is refused. Constant-time compare via `b.crypto.timingSafeEqual`.
+ * minimum 30 s). When `nonceStore` is supplied the verifier atomically
+ * records the accepted v1 signature so a replay within the tolerance window
+ * is refused; the store speaks the same `checkAndInsert(nonce, expireAt) →
+ * bool` contract as `b.webhook.verifier` and `b.nonceStore.create`, so the
+ * framework's own replay store plugs in directly and concurrent redeliveries
+ * cannot race. Constant-time compare via `b.crypto.timingSafeEqual`.
+ *
+ * @opts
+ *   alg:        "hmac-sha256-stripe",
+ *   secret:     string | Buffer,                      // whsec_... bytes verbatim
+ *   header:     string,                               // Stripe-Signature value
+ *   body:       string | Buffer,                      // raw request body
+ *   toleranceMs: number,                              // default 5 min, min 30 s
+ *   nonceStore: { checkAndInsert(nonce, expireAt) },  // optional atomic replay defense
  *
  * @example
- *   b.webhook.verify({
- *     alg:    "hmac-sha256-stripe",
- *     secret: "whsec_abc...",
- *     header: req.headers["stripe-signature"],
- *     body:   rawBodyBuffer,
+ *   await b.webhook.verify({
+ *     alg:        "hmac-sha256-stripe",
+ *     secret:     "whsec_abc...",
+ *     header:     req.headers["stripe-signature"],
+ *     body:       rawBodyBuffer,
+ *     nonceStore: b.nonceStore.create({ backend: "memory" }),
  *   });
  *   // → { ok: true, timestamp: 1700000000, scheme: "v1" }
  */
@@ -889,24 +905,30 @@ async function verify(input) {
       "verify: no v1 signature matched HMAC-SHA-256 of <t>.<body>");
   }
-  // Optional replay defense — the nonceStore is operator-supplied
-  // (e.g. `b.kv` or a Redis-shaped { has, set, expire }) so the
-  // primitive doesn't own retention. `has` / `set` MAY return a
-  // Promise — we always `await` them so async backends (Redis, KV,
-  // DynamoDB) work without falsely flagging a Promise as truthy.
+  // Optional replay defense — the nonceStore speaks the SAME atomic
+  // `checkAndInsert(nonce, expireAt) → bool` contract as b.webhook.verifier
+  // and b.nonceStore.create, so the framework's own replay store drops in
+  // with no adapter. The check + insert is one atomic step: a non-atomic
+  // check-then-set would race two concurrent redeliveries of the same event
+  // (both observe "unseen", both proceed) — the exact failure replay defense
+  // exists to prevent. checkAndInsert MAY return a Promise (Redis / KV /
+  // cluster SQL); we always await it. `expireAt` is the absolute epoch-ms at
+  // which the signature itself falls outside the tolerance window, so a stored
+  // nonce is retained exactly as long as a replay of it could still be fresh.
   if (input.nonceStore) {
     var ns = input.nonceStore;
-    if (typeof ns.has !== "function" || typeof ns.set !== "function") {
+    if (typeof ns.checkAndInsert !== "function") {
       throw new WebhookError("webhook/bad-nonce-store",
-        "verify: nonceStore must expose { has(key), set(key, ttlMs) }");
+        "verify: nonceStore must expose checkAndInsert(nonce, expireAt) — the " +
+        "b.nonceStore contract shared with b.webhook.verifier");
     }
     var nonceKey = "stripe:" + parsed.timestamp + ":" + expectedHex;
-    var seen = await ns.has(nonceKey);
-    if (seen) {
+    var expireAt = C.TIME.seconds(parsed.timestamp) + tolerance;
+    var fresh = await ns.checkAndInsert(nonceKey, expireAt);
+    if (!fresh) {
       throw new WebhookError("webhook/replay",
         "verify: signature already seen within tolerance window (replay)");
     }
-    await ns.set(nonceKey, tolerance);
   }
   return { ok: true, timestamp: parsed.timestamp, scheme: "v1" };
@@ -974,4 +996,7 @@ module.exports = {
   // v0.11.25 — Stripe-shaped inbound HMAC-SHA-256 verifier + signer.
   verify:         verify,
   sign:           sign,
+  // Durable signed-webhook delivery store (sign + persist + deliver + retry +
+  // dead-letter + operator replay). Defined in lib/webhook-dispatcher.js.
+  dispatcher:     webhookDispatcher.dispatcher,
 };

package/lib/vendor/blamejs/lib/websocket-channels.js CHANGED Viewed

@@ -60,6 +60,7 @@
 var lazyRequire = require("./lazy-require");
 var pubsub = require("./pubsub");
+var boundedMap = require("./bounded-map");
 var validateOpts = require("./validate-opts");
 var { defineClass } = require("./framework-error");
@@ -187,17 +188,18 @@ function create(opts) {
     if (typeof channel !== "string" || channel.length === 0) {
       throw _err("INVALID_CHANNEL", "subscribe: channel must be a non-empty string");
     }
-    if (!connToChannels.has(conn)) {
+    boundedMap.requirePresent(connToChannels, conn, function () {
       throw _err("NOT_ATTACHED", "subscribe: connection must be attach()-ed first");
-    }
-    if (!channelToConns.has(channel)) {
-      channelToConns.set(channel, new Set());
+    });
+    var subs = boundedMap.getOrInsert(channelToConns, channel, function () {
       // First local listener for this channel — open a pubsub
-      // subscription so cross-node fan-out reaches us.
+      // subscription so cross-node fan-out reaches us, recording the
+      // token under the same key the new Set is stored at.
       var token = ps.subscribe(channel, _onPubsubMessage);
       channelToToken.set(channel, token);
-    }
-    channelToConns.get(channel).add(conn);
+      return new Set();
+    });
+    subs.add(conn);
     connToChannels.get(conn).add(channel);
   }

package/lib/vendor/blamejs/lib/websocket.js CHANGED Viewed

@@ -82,6 +82,7 @@ var C                = require("./constants");
 var requestHelpers   = require("./request-helpers");
 var safeAsync        = require("./safe-async");
 var safeBuffer       = require("./safe-buffer");
+var pick             = require("./pick");
 var structuredFields = require("./structured-fields");
 var { FrameworkError } = require("./framework-error");
 var { boot } = require("./log");
@@ -543,7 +544,7 @@ function _parseExtensionHeader(header) {
       var kv = parts[j].split("=");
       var k = kv[0].trim().toLowerCase();
       if (!k) continue;
-      if (k === "__proto__" || k === "constructor" || k === "prototype") continue;
+      if (pick.isPoisonedKey(k)) continue;
       var v = kv.length > 1 ? kv.slice(1).join("=").trim() : true;
       // Strip surrounding quotes per the token-or-quoted-string grammar.
       if (typeof v === "string") {
@@ -1128,7 +1129,7 @@ class WebSocketConnection extends EventEmitter {
         return this._abort(CLOSE_INVALID_PAYLOAD,
           "permessage-deflate inflate failed: " + ((e && e.message) || String(e)));
       }
-      if (data.length > this.maxMessageBytes) {
+      if (safeBuffer.byteLengthOf(data) > this.maxMessageBytes) {
         return this._abort(CLOSE_MESSAGE_TOO_BIG,
           "decompressed message exceeds maxMessageBytes");
       }
@@ -1241,8 +1242,11 @@ class WebSocketConnection extends EventEmitter {
     } else if (Buffer.isBuffer(data)) {
       this._sendDataFrame(OPCODE_BINARY, data);
     } else {
+      // WebSocketError's constructor is (code, message, closeCode) — code
+      // first — so the (message, code) errorClass path would swap the two.
+      // errorFactory hands toBuffer a (code, message) constructor instead.
       data = safeBuffer.toBuffer(data, {
-        errorClass: WebSocketError,
+        errorFactory: function (code, message) { return new WebSocketError(code, message); },
         typeCode:   "ws/invalid-payload",
         typeMessage: "send() requires Buffer, Uint8Array, or string",
       });

package/lib/vendor/blamejs/lib/worm.js CHANGED Viewed

@@ -113,10 +113,9 @@ function create(opts) {
     throw new WormError("worm/bad-opt", "worm.create: defaultRetentionMs must be a non-negative finite number");
   }
+  var _baseAudit = audit().namespaced("worm");
   function _emit(action, outcome, id, metadata) {
-    try {
-      audit().safeEmit({ action: "worm." + action, actor: { type: "system" }, outcome: outcome, metadata: Object.assign({ id: id, mode: mode }, metadata || {}) });
-    } catch (_e) { /* audit is drop-silent by design */ }
+    _baseAudit(action, outcome, Object.assign({ id: id, mode: mode }, metadata || {}), { actor: { type: "system" } });
   }
   function _resolveRetainUntil(now, putOpts) {

package/lib/vendor/blamejs/lib/ws-client.js CHANGED Viewed

@@ -60,6 +60,7 @@ var audit          = lazyRequire(function () { return require("./audit"); });
 var networkTls     = lazyRequire(function () { return require("./network-tls"); });
 var safeJson       = lazyRequire(function () { return require("./safe-json"); });
 var ssrfGuard      = require("./ssrf-guard");
+var structuredFields = require("./structured-fields");
 var C              = require("./constants");
 var { defineClass } = require("./framework-error");
@@ -492,7 +493,7 @@ class WsClient extends EventEmitter {
     this._handshakeBuf = Buffer.concat([this._handshakeBuf, chunk]);
     var headerEnd = this._handshakeBuf.indexOf("\r\n\r\n");
     if (headerEnd === -1) {
-      if (this._handshakeBuf.length > C.BYTES.kib(64)) {
+      if (safeBuffer.byteLengthOf(this._handshakeBuf) > C.BYTES.kib(64)) {
         this._handleSocketError(new WsClientError("ws-client/handshake-too-large",
           "handshake response exceeded 64 KiB before CRLFCRLF"));
       }
@@ -526,13 +527,10 @@ class WsClient extends EventEmitter {
     }
     var headers = Object.create(null);
-    for (var i = 1; i < lines.length; i += 1) {
-      var idx = lines[i].indexOf(":");
-      if (idx === -1) continue;
-      var hkey = lines[i].slice(0, idx).trim().toLowerCase();
-      var hval = lines[i].slice(idx + 1).trim();
-      headers[hkey] = hval;
-    }
+    var hkvps = structuredFields.parseKeyValuePieces(lines, 1, ":");
+    structuredFields.forEachKeyValue(hkvps, function (key, value) {
+      headers[key] = value;
+    });
     if ((headers["upgrade"] || "").toLowerCase() !== "websocket" ||
         (headers["connection"] || "").toLowerCase().indexOf("upgrade") === -1) {
@@ -698,7 +696,7 @@ class WsClient extends EventEmitter {
     }
     if (frame.fin) {
       var fullPayload = Buffer.concat(this._fragmentChunks);                              // allow:handrolled-buffer-collect — bounded by maxMessageBytes below
-      if (fullPayload.length > this._opts.maxMessageBytes) {
+      if (safeBuffer.byteLengthOf(fullPayload) > this._opts.maxMessageBytes) {
         this._handleSocketError(new WsClientError("ws-client/message-too-big",
           "incoming message exceeds maxMessageBytes (" + this._opts.maxMessageBytes + ")"));
         return;
@@ -797,7 +795,7 @@ class WsClient extends EventEmitter {
     } else {
       payload = Buffer.from(JSON.stringify(data), "utf8");
     }
-    if (payload.length > this._opts.maxMessageBytes) {
+    if (safeBuffer.byteLengthOf(payload) > this._opts.maxMessageBytes) {
       throw new WsClientError("ws-client/payload-too-big",
         "send: payload exceeds maxMessageBytes (" + this._opts.maxMessageBytes + ")");
     }

package/lib/vendor/blamejs/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.15.12",
+  "version": "0.15.13",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/lib/vendor/blamejs/release-notes/v0.15.13.json ADDED Viewed

@@ -0,0 +1,81 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.15.13",
+  "date": "2026-06-19",
+  "headline": "Consolidates a large set of duplicated, security-sensitive code paths — injected-dependency validation, positive-integer option caps, TOCTOU-safe file reads, markup escaping, audit emission, structured-field parsing, and untrusted-JWK import — onto shared hardened primitives, so a fix or guard now applies everywhere at once; adds a TOCTOU-safe file reader; and makes several configuration errors throw typed framework errors instead of a bare Error",
+  "summary": "Across the framework, logic that had been hand-rolled in many places (and had quietly drifted between copies) is now single-sourced through shared primitives. The practical effect for operators is consistency: the strongest available guard is applied everywhere a given operation happens, rather than in whichever copy happened to have it. Injected dependencies (stores, backends, vaults, db handles, query objects) are validated through one contract; operator-tunable positive-integer options (pool sizes, byte caps, timeouts, stream limits) validate through one bounds primitive that forwards the caller's non-retryable / HTTP-status flags; the open-fd → fstat → read-fully pattern that several call sites used to defend file reads against a swap-after-stat race (CWE-367) is now the b.atomicFile.fdSafeReadSync primitive, with symlink refusal, inode-equality, a byte cap, and an integrity hash available as options and each caller's exact typed error preserved; and the XML/HTML markup escapers (including the b.guardHtml / b.guardSvg sanitizer output) route through one b.markupEscape so the base & < > \" chain can't drift between them. A few configuration-validation paths that threw a bare Error (httpClient.configurePool, b.db stream-limit validation) now throw the module's typed framework error. No security defaults change; this release tightens and unifies existing protections rather than adding opt-ins.",
+  "sections": [
+    {
+      "heading": "Added",
+      "items": [
+        {
+          "title": "b.atomicFile.fdSafeReadSync(filepath, opts?)",
+          "body": "A TOCTOU-safe synchronous file read (CWE-367 / js/file-system-race): it opens the path read-only, then binds the size, content, and integrity measurement to the inode the fd holds open, so a swap between stat and read can't change which bytes are returned. Optional guards layer on top — maxBytes (refuse an over-cap file), refuseSymlink + inodeCheck (refuse a symlink source and any inode swap, the strongest posture for operator-writable paths), expectedHash (SHA3-512), encoding (return a string), allowShortRead — and an errorFor(kind, detail) callback lets each caller keep its own typed error. The framework's own file reads (atomic-file, the TLS certificate-path loader, the sealed-PEM source reader, the backup bundle reader) all route through it."
+        },
+        {
+          "title": "Shared substrate primitives for previously-duplicated logic",
+          "body": "A set of shared primitives now back call sites that had each re-implemented the same logic: validateOpts.requireMethods (gains a `permanent` flag) for injected-dependency contract checks; numericBounds positive-finite-int validators (gain an errorOpts { permanent, statusCode }) for tunable integer options; b.markupEscape for the & < > \" markup chain; structured-field parsing helpers (parseTagList, forEachKeyValue, splitUnquoted, stripDoubleQuotes, unfoldHeaderContinuations); crypto.importPublicJwk and crypto.makeBase64UrlDecoder; safeSql.toPositional; safeBuffer.makeByteCoercer; nonceStore.enforceReplay; and the audit/observability namespaced emitters. These are mostly invisible substrate — the operator-visible benefit is that a guard or fix added to one of them now covers every caller."
+        }
+      ]
+    },
+    {
+      "heading": "Changed",
+      "items": [
+        {
+          "title": "Configuration errors throw typed framework errors",
+          "body": "Two configuration-validation paths that threw a bare `Error` now throw the module's typed framework error: httpClient.configurePool (bad maxSockets / maxFreeSockets / keepAliveMsecs → HttpClientError, code httpclient/bad-opts) and the b.db stream-limit validation (Query.stream → DbQueryError). The thrown error remains an Error subclass, so existing `instanceof Error` / try-catch handling is unaffected; code that matched the old free-text message should match the typed error's `code` instead. Several routed validators also report a slightly more precise message (\"positive finite integer\" instead of \"positive integer\")."
+        }
+      ]
+    },
+    {
+      "heading": "Security",
+      "items": [
+        {
+          "title": "TOCTOU-safe file reads applied uniformly",
+          "body": "The open-fd → fstat → read pattern that anchors a file read to one inode against a swap-after-stat race is now centralized in b.atomicFile.fdSafeReadSync, and every framework file read routes through it. The sealed-PEM source reader keeps the strongest posture (symlink refusal + inode-equality + byte cap), and those guards are now available as options to any caller — a re-introduced hand-rolled read-loop is flagged by a codebase-pattern detector."
+        },
+        {
+          "title": "Injected-dependency and integer-option validation can't silently drift",
+          "body": "Injected stores / backends / vaults / db handles / query objects are validated through one contract (validateOpts.requireMethods), and operator-tunable positive-integer options through one bounds primitive (numericBounds), both forwarding the caller's non-retryable / HTTP-status error flags so a config error stays permanent / carries its 4xx. Inverse detectors flag any re-introduced inline check, so the validation can no longer be partially copied or weakened in one place."
+        },
+        {
+          "title": "Single markup-escape chain for the HTML/SVG sanitizers",
+          "body": "The b.guardHtml and b.guardSvg sanitizer output escapers, the AI-Act transparency and mail HTML escapers, and the XML report escapers now share one b.markupEscape for the base & < > \" chain (apostrophe form as a parameter; each caller keeps its own input coercion and any extra escapes such as guardHtml.escapeAttr's backtick / = IE-attribute-injection hardening). Byte-for-byte parity with the prior escapers was verified across an XSS-vector corpus, so the consolidation cannot have introduced an escaping gap; a re-inlined & < > \" chain anywhere else is flagged by a detector."
+        },
+        {
+          "title": "One hardening point for untrusted public-JWK import",
+          "body": "The createPublicKey-from-JWK call that imports attacker-controlled key material (DID publicKeyJwk, DNSKEY, COSE_Key, DPoP / OAuth / OIDC / DBSC proof JWKs) is centralized in b.crypto.importPublicJwk, so the untrusted-key import has a single audited home; each caller keeps its own kty/crv pre-validation and typed error."
+        },
+        {
+          "title": "Linear-time Content-Security-Policy header parsing",
+          "body": "The CSP response-header parser split directives on a `/\\s*,\\s*/` regex that ran in O(n^2) on a long comma-less run of whitespace, letting a crafted header stall a worker (js/polynomial-redos). It now splits on the literal comma and trims each item, which is linear and byte-for-byte equivalent."
+        },
+        {
+          "title": "Parsed INI and OpenAPI path maps can't reach Object.prototype",
+          "body": "The INI parser already refuses a `__proto__` / `constructor` / `prototype` section or key (it throws before any write); as defense-in-depth, every parsed node — and the OpenAPI paths map keyed by URL pattern — is now a null-prototype object, so even a future gap could only ever set an own property, never mutate Object.prototype (CWE-1321)."
+        }
+      ]
+    },
+    {
+      "heading": "Fixed",
+      "items": [
+        {
+          "title": "Webhook deliveries retry transient transport failures instead of dead-lettering them",
+          "body": "A delivery that failed with a transient transport error (connection reset, timeout, 5xx) was recorded as permanently failed and dead-lettered rather than retried. The destination-safety check (SSRF / blocked-host guard) now runs in its own step and is the only permanent failure; a transport failure backs off and retries up to the configured limit."
+        },
+        {
+          "title": "Webhook deliveries table creates on MySQL",
+          "body": "The pending-delivery index used a partial-index (WHERE) clause that MySQL does not support, so the deliveries table failed to create on a MySQL backend. The index is now dialect-aware — partial on PostgreSQL / SQLite, plain on MySQL."
+        },
+        {
+          "title": "Inline webhook delivery can't be double-sent by concurrent retry processing",
+          "body": "An inline delivery is now claimed (status set to in-flight with a claim timestamp) before the POST, so a concurrent retry pass can't pick up and re-send the same delivery; a row left in-flight by a crash is reclaimed after the stale-claim window."
+        },
+        {
+          "title": "Audit checkpoint can never be anchored against a replaced database",
+          "body": "close() fires a best-effort final checkpoint as the database shuts down. In a narrow close-then-reopen window that checkpoint's write could resume after a fresh database had opened and anchor the prior database's chain tip into it. checkpoint() now binds to the database it read the tip from and refuses to write (returns null, fail-closed) if that handle has since been closed or replaced — so a checkpoint is only ever written against the database it measured."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/scripts/check-changelog-extract.js CHANGED Viewed

@@ -88,7 +88,7 @@ function main() {
   // The first line must match the canonical shape — `- vX.Y.Z (date) — summary`.
   var firstLine = section[0];
   var canonical = new RegExp(
-    "^- v" + version.replace(/\./g, "\\.") +
+    "^- v" + version.replace(/[.*+?^${}()|[\]\\]/g, "\\$&") +
     " \\(\\d{4}-\\d{2}-\\d{2}\\) — \\S.+$"
   );
   if (!canonical.test(firstLine)) {

package/lib/vendor/blamejs/test/00-primitives.js CHANGED Viewed

@@ -91,6 +91,25 @@ function testSqlSafeIdentifierValidation() {
   try { b.safeSql.validateIdentifier("a".repeat(70)); }
   catch (e) { threwLong = e.code === "sql/too-long"; }
   check("safeSql rejects over-long identifier",             threwLong);
+  // assertNoRawStringLiteral — the shared raw-SQL string-literal scanner.
+  check("assertNoRawStringLiteral: clean parameterized SQL passes",
+        b.safeSql.assertNoRawStringLiteral("WHERE id = ? AND name = ?", "x") === undefined);
+  var threwLit = false;
+  try { b.safeSql.assertNoRawStringLiteral("WHERE name = 'x'", "where"); }
+  catch (e) { threwLit = e.code === "sql/raw-literal"; }
+  check("assertNoRawStringLiteral: refuses a raw '...' literal", threwLit);
+  // A double-quoted identifier (even one containing an apostrophe) and -- / slash-star
+  // comments are skipped, not refused.
+  var skipOk = true;
+  try { b.safeSql.assertNoRawStringLiteral("SELECT \"o'col\" FROM t -- 'note'", "x"); }
+  catch (_e) { skipOk = false; }
+  check("assertNoRawStringLiteral: skips quoted identifiers + comments", skipOk);
+  // A caller-supplied makeError is honored (the per-caller error contract).
+  var customMsg = null;
+  try { b.safeSql.assertNoRawStringLiteral("a = 'b'", "build", function (w) { return new Error(w + ":custom"); }); }
+  catch (e) { customMsg = e.message; }
+  check("assertNoRawStringLiteral: honors caller makeError", customMsg === "build:custom");
 }
 function testSqlSafeQuoteIdentifier() {
@@ -7127,7 +7146,10 @@ function _spawnFakeIdpServer(routes) {
       req.body = Buffer.concat(bodyChunks).toString("utf8");
       try { handler(req, res, u); }
       catch (e) {
-        res.writeHead(500); res.end(String(e));
+        // Fixed-shape, bounded diagnostic — never surface the raw exception
+        // (its message/stack) verbatim into the response body.
+        var emsg = (e && typeof e.message === "string") ? e.message : "error";
+        res.writeHead(500); res.end("fake-idp handler error: " + emsg.slice(0, 120));
       }
     });
   });
@@ -9218,6 +9240,55 @@ function testSafeSchemaPrototypePollutionDefense() {
   check("discUnion rejects __proto__ discriminator", threw && threw.code === "safe-schema/poisoned-discriminator");
 }
+function testPickPoisonedKeyPrimitive() {
+  // The single prototype-pollution key guard every parser/decoder/middleware
+  // routes through (lib/pick.js): predicate, throw-guard, add-only extension.
+  var pick = require("../lib/pick");
+  // isPoisonedKey — the core JS pollution vectors, nothing else.
+  check("isPoisonedKey __proto__",      pick.isPoisonedKey("__proto__") === true);
+  check("isPoisonedKey constructor",    pick.isPoisonedKey("constructor") === true);
+  check("isPoisonedKey prototype",      pick.isPoisonedKey("prototype") === true);
+  check("isPoisonedKey safe key false", pick.isPoisonedKey("displayName") === false);
+  check("isPoisonedKey non-string false", pick.isPoisonedKey(42) === false &&
+                                          pick.isPoisonedKey(null) === false &&
+                                          pick.isPoisonedKey(undefined) === false);
+  // POISONED_KEYS — the frozen core snapshot.
+  check("POISONED_KEYS frozen core",    Object.isFrozen(pick.POISONED_KEYS) &&
+                                          pick.POISONED_KEYS.join(",") === "__proto__,constructor,prototype");
+  // assertSafeKey — throw-guard form; the caller throws its own typed error.
+  var blocked = null;
+  try { pick.assertSafeKey("__proto__", function () { throw new TypeError("BLOCKED"); }); }
+  catch (e) { blocked = e.message; }
+  check("assertSafeKey fires onPoisoned for poisoned key", blocked === "BLOCKED");
+  var fired = false;
+  pick.assertSafeKey("safe", function () { fired = true; });
+  check("assertSafeKey silent for safe key",   fired === false);
+  var badCb = null;
+  try { pick.assertSafeKey("x", 7); } catch (e) { badCb = e.constructor.name; }
+  check("assertSafeKey rejects non-function onPoisoned", badCb === "TypeError");
+  // registerPoisonedKeys — add-only defense-in-depth extension. Use a unique
+  // sentinel so registering it can't perturb any other test's data keys
+  // (registration is process-global by design).
+  var SENTINEL = "__blamejs_test_poison_sentinel__";
+  check("sentinel not poisoned by default",     pick.isPoisonedKey(SENTINEL) === false);
+  pick.registerPoisonedKeys([SENTINEL]);
+  check("registerPoisonedKeys adds extra key",  pick.isPoisonedKey(SENTINEL) === true);
+  check("core vectors still poisoned after extend", pick.isPoisonedKey("__proto__") === true);
+  var badReg = null;
+  try { pick.registerPoisonedKeys("not-array"); } catch (e) { badReg = e.constructor.name; }
+  check("registerPoisonedKeys rejects non-array", badReg === "TypeError");
+  // pick() itself strips poisoned keys (built via Object.fromEntries so the
+  // key is a real own property, not a prototype set).
+  var stripped = pick(Object.fromEntries([["a", 1], ["__proto__", { x: 1 }]]), ["a", "__proto__"]);
+  check("pick() strips __proto__ even if allowlisted", stripped.a === 1 &&
+                                                         !Object.prototype.hasOwnProperty.call(stripped, "__proto__"));
+}
 function testSafeSchemaErrorIssues() {
   var s = b.safeSchema;
   var threw = null;
@@ -14359,6 +14430,20 @@ function testBufferSafeToBuffer() {
   try { bs.toBuffer(123); }
   catch (e) { threwType = e.code === "buffer/wrong-input-type"; }
   check("toBuffer: number rejected", threwType);
+  // byteLengthOf — the byte-cap measurement primitive: UTF-8 bytes for a
+  // string, .length for a Buffer/Uint8Array (whose .length already IS bytes).
+  check("byteLengthOf is a function", typeof bs.byteLengthOf === "function");
+  check("byteLengthOf: ASCII string", bs.byteLengthOf("abc") === 3);
+  var cjk = String.fromCharCode(0x4e2d); // one 3-byte UTF-8 char, 1 UTF-16 unit
+  check("byteLengthOf: multibyte string measures UTF-8 bytes, not UTF-16 units",
+        bs.byteLengthOf(cjk) === 3 && cjk.length === 1);
+  check("byteLengthOf: Buffer .length is bytes", bs.byteLengthOf(Buffer.from([1, 2, 3, 4])) === 4);
+  check("byteLengthOf: Uint8Array length is bytes", bs.byteLengthOf(new Uint8Array(5)) === 5);
+  check("byteLengthOf: encoding honored (hex)", bs.byteLengthOf("ff00", "hex") === 2);
+  var threwBL = false;
+  try { bs.byteLengthOf({}); } catch (e) { threwBL = e instanceof TypeError; }
+  check("byteLengthOf: non-string/non-bytes throws TypeError", threwBL);
 }
 function testBufferSafeBoundedChunkCollector() {
@@ -14657,9 +14742,9 @@ async function testHttpClientConfigurePool() {
   }
   rejects("non-object input",          function () { b.httpClient.configurePool("nope"); }, /must be an object/);
   rejects("unknown key",               function () { b.httpClient.configurePool({ bogus: 1 }); }, /unknown option/);
-  rejects("negative maxSockets",       function () { b.httpClient.configurePool({ maxSockets: -1 }); }, /positive integer/);
-  rejects("non-integer keepAliveMsecs",function () { b.httpClient.configurePool({ keepAliveMsecs: 1.5 }); }, /positive integer/);
-  rejects("Infinity maxFreeSockets",   function () { b.httpClient.configurePool({ maxFreeSockets: Infinity }); }, /positive integer/);
+  rejects("negative maxSockets",       function () { b.httpClient.configurePool({ maxSockets: -1 }); }, /positive finite integer/);
+  rejects("non-integer keepAliveMsecs",function () { b.httpClient.configurePool({ keepAliveMsecs: 1.5 }); }, /positive finite integer/);
+  rejects("Infinity maxFreeSockets",   function () { b.httpClient.configurePool({ maxFreeSockets: Infinity }); }, /positive finite integer/);
   rejects("non-boolean keepAlive",     function () { b.httpClient.configurePool({ keepAlive: "yes" }); }, /must be a boolean/);
   rejects("bad scheduling",            function () { b.httpClient.configurePool({ scheduling: "rr" }); }, /lifo.*fifo/);
 }
@@ -15016,8 +15101,13 @@ async function testHttpClientRedirectFollow() {
 async function testHttpClientRedirectMaxHops() {
   var http = require("http");
+  // Each hop redirects to a fresh, fixed-shape path (a per-request counter),
+  // never one derived from the incoming request URL — so the location never
+  // repeats and the client keeps following until it hits maxRedirects.
+  var hop = 0;
   var server = http.createServer(function (req, res) {
-    res.writeHead(302, { "Location": req.url + "x" });
+    hop += 1;
+    res.writeHead(302, { "Location": "/loop-" + hop });
     res.end();
   });
   var port = await listenOnRandomPort(server);
@@ -16399,14 +16489,15 @@ async function testWebSocketConnection() {
       // Parse HTTP headers (very crude — enough for tests).
       var headerLines = headerBuffer.substring(0, idx).split("\r\n");
       var requestLine = headerLines[0].split(" ");
-      var headers = {};
+      var headerPairs = [];
       for (var i = 1; i < headerLines.length; i++) {
         var p = headerLines[i].indexOf(":");
         if (p === -1) continue;
         var k = headerLines[i].substring(0, p).trim().toLowerCase();
         var v = headerLines[i].substring(p + 1).trim();
-        headers[k] = v; // lgtm[js/remote-property-injection] test fixture; not a runtime path
+        headerPairs.push([k, v]);
       }
+      var headers = Object.fromEntries(headerPairs);
       var req = { method: requestLine[0], url: requestLine[1], headers: headers };
       var head = Buffer.from(headerBuffer.substring(idx + 4), "binary");
       var conn = ws.handleUpgrade(req, socket, head, { closeGraceMs: 50 });
@@ -16490,6 +16581,42 @@ async function testWebSocketConnection() {
   }
 }
+async function testWebSocketSendBadPayloadErrorOrder() {
+  var EE = require("node:events").EventEmitter;
+  var ws = b.websocket;
+  // Minimal socket stand-in: WebSocketConnection only needs the
+  // EventEmitter surface plus write/destroy. send() throws synchronously
+  // on a non-byte payload BEFORE any frame is written, so write/destroy
+  // are never reached on this path.
+  var socket = new EE();
+  socket.write = function () { return true; };
+  socket.destroy = function () {};
+  var conn = new ws.WebSocketConnection(socket, { pingIntervalMs: 60000, pongTimeoutMs: 120000 });
+  try {
+    var threw = null;
+    try {
+      // Plain object is not Buffer / Uint8Array / string — toBuffer refuses.
+      conn.send({ not: "bytes" });
+    } catch (e) { threw = e; }
+    check("ws send bad payload throws WebSocketError",
+          threw !== null && threw.isWebSocketError === true);
+    // The bug was a swapped (message, code) construction: .code became the
+    // human message and .message became the code string. Assert the correct
+    // order — code is the dotted ws/* identifier, message is the prose.
+    check("ws send bad payload: .code is the ws/* code",
+          threw && threw.code === "ws/invalid-payload");
+    check("ws send bad payload: .message is the prose",
+          threw && threw.message === "send() requires Buffer, Uint8Array, or string");
+  } finally {
+    // Stop the connection's ping timer (it is unref'd, but tidy teardown
+    // keeps the suite's open-handle count clean).
+    socket.emit("close");
+  }
+}
 // Test helpers — local to the websocket suite. nodeCrypto for the
 // random key, _readUntil/_readNBytes/_readSome for incremental client
 // socket reads.
@@ -18399,6 +18526,7 @@ async function run() {
   testSafeSchemaRefineTransform();
   testSafeSchemaLazyAndPreprocess();
   testSafeSchemaPrototypePollutionDefense();
+  testPickPoisonedKeyPrimitive();
   testSafeSchemaErrorIssues();
   testSafeSchemaImmutability();
   // events — moved to test/layer-0-primitives/events.test.js
@@ -18709,6 +18837,7 @@ async function run() {
   testWebSocketHandshake();
   testWebSocketFrames();
   await testWebSocketConnection();
+  await testWebSocketSendBadPayloadErrorOrder();
   testRouterWsValidation();
   await testRouterSetsRoutePattern();

package/lib/vendor/blamejs/test/10-state.js CHANGED Viewed

@@ -484,10 +484,16 @@ async function testFrameworkSchemaEnsure() {
       externalDbBackend: "ops",
       dialect:           "sqlite",
     });
-    check("ensureSchema returns 19 tables (added _blamejs_cache_tags in v0.6.21)",
-          result.tables.length === 19);
+    check("ensureSchema returns 20 tables (_blamejs_session_valid_from is the 20th)",
+          result.tables.length === 20);
     check("ensureSchema includes _blamejs_cache_tags",
           result.tables.indexOf("_blamejs_cache_tags") !== -1);
+    check("ensureSchema includes _blamejs_session_valid_from",
+          result.tables.indexOf("_blamejs_session_valid_from") !== -1);
+    check("ensureSchema includes _blamejs_break_glass_policies",
+          result.tables.indexOf("_blamejs_break_glass_policies") !== -1);
+    check("ensureSchema includes _blamejs_break_glass_grants",
+          result.tables.indexOf("_blamejs_break_glass_grants") !== -1);
     check("ensureSchema includes _blamejs_audit_log",
           result.tables.indexOf("_blamejs_audit_log") !== -1);
     check("ensureSchema includes _blamejs_consent_log",
@@ -538,7 +544,7 @@ async function testFrameworkSchemaEnsure() {
       externalDbBackend: "ops",
       dialect:           "sqlite",
     });
-    check("ensureSchema is idempotent",             second.tables.length === 19);
+    check("ensureSchema is idempotent",             second.tables.length === 20);
     // Indexes exist
     var idxRow = await b.externalDb.query(