@blamejs/blamejs-shop 0.4.56 → 0.4.57

package/lib/vendor/blamejs/lib/middleware/bot-disclose.js

@@ -30,6 +30,7 @@ var defineClass = require("../framework-error").defineClass;
 var lazyRequire = require("../lazy-require");
 var validateOpts = require("../validate-opts");
 var safeBuffer = require("../safe-buffer");
+var requestHelpers = require("../request-helpers");
 
 var audit = lazyRequire(function () { return require("../audit"); });
 
@@ -93,17 +94,13 @@ function create(opts) {
   var actionBase = typeof opts.auditAction === "string" && opts.auditAction.length > 0
     ? opts.auditAction : "middleware.bot_disclose";
 
+  // null mountPaths = apply to every route; otherwise reuse the shared
+  // segment-boundary matcher (built once).
+  var _mountMatch = mountPaths
+    ? requestHelpers.makeSkipMatcher({ skipPaths: mountPaths }, "middleware.botDisclose")
+    : null;
   function _matches(req) {
-    if (!mountPaths) return true;                                                        // null = match every path
-    var p = req.url || "";
-    var qpos = p.indexOf("?");
-    if (qpos !== -1) p = p.slice(0, qpos);
-    for (var i = 0; i < mountPaths.length; i++) {
-      var m = mountPaths[i];
-      if (typeof m === "string" && (p === m || p.indexOf(m + "/") === 0)) return true;
-      if (m instanceof RegExp && m.test(p)) return true;
-    }
-    return false;
+    return _mountMatch ? _mountMatch(req) : true;
   }
 
   function _emitAudit(action, outcome, metadata) {

package/lib/vendor/blamejs/lib/middleware/bot-guard.js

@@ -144,21 +144,13 @@ function create(opts) {
   var blockedAgents = DEFAULT_BLOCKED_AGENTS.concat((opts.blockedAgents || []).map(function (r, i) {
     return _coerceAgentPattern(r, "middleware.botGuard: blockedAgents[" + i + "]");
   }));
-  var skipPaths = opts.skipPaths || [];
   var statusOnBlock = opts.statusOnBlock || 403;
   var bodyOnBlock = opts.bodyOnBlock !== undefined ? opts.bodyOnBlock : "Forbidden";
   var onDeny = typeof opts.onDeny === "function" ? opts.onDeny : null;
   var problemMode = opts.problemDetails === true;
 
-  function _shouldSkip(req) {
-    var path = req.pathname || req.url || "/";
-    for (var i = 0; i < skipPaths.length; i++) {
-      if (typeof skipPaths[i] === "string" ? path.indexOf(skipPaths[i]) === 0 : skipPaths[i].test(path)) {
-        return true;
-      }
-    }
-    return false;
-  }
+  // Path-exemption predicate (string-prefix or RegExp), validated at create().
+  var _shouldSkip = requestHelpers.makeSkipMatcher(opts, "middleware.botGuard");
 
   function _looksLikeApi(req) {
     var path = req.pathname || req.url || "/";

package/lib/vendor/blamejs/lib/middleware/csrf-protect.js

@@ -67,6 +67,7 @@
  *   }
  */
 var lazyRequire = require("../lazy-require");
+var pick = require("../pick");
 var forms = require("../forms");
 var requestHelpers = require("../request-helpers");
 var validateOpts = require("../validate-opts");
@@ -111,7 +112,7 @@ function _parseCookieHeader(header) {
     if (eq === -1) continue;
     var k = p.slice(0, eq).trim();
     if (k.length === 0) continue;
-    if (k === "__proto__" || k === "constructor" || k === "prototype") continue;
+    if (pick.isPoisonedKey(k)) continue;
     if (seen.has(k)) continue;  // first-occurrence wins
     seen.add(k);
     var v = p.slice(eq + 1).trim();
@@ -296,7 +297,7 @@ function create(opts) {
   validateOpts(opts, [
     "cookie", "tokenLookup", "fieldName", "headerName", "methods", "audit",
     "trustProxy", "checkOrigin", "allowedOrigins", "requireJsonContentType",
-    "requireOrigin", "skipStateless", "onDeny", "problemDetails",
+    "requireOrigin", "skipStateless", "skipPaths", "skip", "onDeny", "problemDetails",
   ], "middleware.csrfProtect");
   var onDeny = typeof opts.onDeny === "function" ? opts.onDeny : null;
   var problemMode = opts.problemDetails === true;
@@ -368,6 +369,13 @@ function create(opts) {
   // request always carries a Cookie header and is validated.
   var skipStateless = opts.skipStateless === true;
 
+  // Per-path exemption (string-prefix / RegExp / skip predicate), validated at
+  // create(). Lets one route (an RFC 8058 List-Unsubscribe-Post endpoint, a
+  // webhook, a bearer-token API path on the same app) opt out of the
+  // double-submit check while the app-level mount stays in place — the token is
+  // still issued for any later browser flow.
+  var _shouldSkip = requestHelpers.makeSkipMatcher(opts, "middleware.csrfProtect");
+
   // Cookie issuance config (only when opts.cookie is set).
   var cookieCfg = null;
   if (hasCookie) {
@@ -480,6 +488,9 @@ function create(opts) {
     // (e.g. error response) still need req.csrfToken populated.
     var expected = _issueIfNeeded(req, res);
 
+    // Exempt routes skip the double-submit check (token still issued above).
+    if (_shouldSkip(req)) return next();
+
     if (methods.indexOf(req.method) === -1) return next();
 
     // Stateless / token-authenticated requests are not CSRF-able — the

package/lib/vendor/blamejs/lib/middleware/daily-byte-quota.js

@@ -107,7 +107,6 @@ function create(opts) {
   }
   var bytesPerDay = opts.bytesPerDay;
   var getKey = typeof opts.getKey === "function" ? opts.getKey : _defaultGetKey;
-  var auditOn = opts.audit !== false;
   // onDeny is the canonical hook across the deny-path middleware
   // family; onExceeded is the original name kept working as an alias.
   var onDeny = typeof opts.onDeny === "function" ? opts.onDeny
@@ -127,33 +126,14 @@ function create(opts) {
   });
   var backend = quota._backend;
 
-  function _shouldSkip(req) {
-    if (skipPaths.length === 0) return false;
-    var p = req.url || req.originalUrl || "";
-    var qpos = p.indexOf("?");
-    if (qpos !== -1) p = p.slice(0, qpos);
-    for (var i = 0; i < skipPaths.length; i++) {
-      if (typeof skipPaths[i] === "string" && p === skipPaths[i]) return true;
-      if (skipPaths[i] instanceof RegExp && skipPaths[i].test(p)) return true;
-    }
-    return false;
-  }
+  // exact:true preserves this guard's whole-path skip semantics (no descendant
+  // match); makeSkipMatcher strips the query + resolves url || originalUrl.
+  var _shouldSkip = requestHelpers().makeSkipMatcher(
+    { skipPaths: skipPaths, exact: true }, "middleware.dailyByteQuota");
 
-  function _emitAudit(action, outcome, metadata) {
-    if (!auditOn) return;
-    try {
-      audit().safeEmit({
-        action:   "middleware.daily_byte_quota." + action,
-        outcome:  outcome,
-        metadata: metadata || {},
-      });
-    } catch (_e) { /* drop-silent — audit is best-effort */ }
-  }
+  var _emitAudit = audit().namespaced("middleware.daily_byte_quota", opts.audit);
 
-  function _emitMetric(verb, n, labels) {
-    try { observability().safeEvent("middleware.daily_byte_quota." + verb, n || 1, labels || {}); }
-    catch (_e) { /* drop-silent */ }
-  }
+  var _emitMetric = observability().namespaced("middleware.daily_byte_quota");
 
   return async function dailyByteQuotaMiddleware(req, res, next) {
     if (_shouldSkip(req)) return next();

package/lib/vendor/blamejs/lib/middleware/deny-response.js

@@ -147,6 +147,24 @@ function denyResponse(req, res, ctx) {
   return undefined;
 }
 
+// methodNotAllowed(res, allow) — write the bare HTTP 405 refusal the
+// single-file static-content middlewares (assetlinks / security.txt / web-app-
+// manifest) share: an `Allow` header plus a `text/plain` "Method Not Allowed"
+// body with an explicit Content-Length. Kept separate from denyResponse() (the
+// hook-aware, problem+json-capable refusal path) so the static handlers emit a
+// fixed, minimal response — `allow` is the comma-joined method list (e.g.
+// "GET, HEAD").
+function methodNotAllowed(res, allow) {
+  var bodyMsg = "Method Not Allowed";
+  res.writeHead(405, {                                                           // HTTP 405 status
+    "Allow":          allow,
+    "Content-Type":   "text/plain; charset=utf-8",
+    "Content-Length": Buffer.byteLength(bodyMsg),
+  });
+  res.end(bodyMsg);
+}
+
 module.exports = {
-  denyResponse: denyResponse,
+  denyResponse:     denyResponse,
+  methodNotAllowed: methodNotAllowed,
 };

package/lib/vendor/blamejs/lib/middleware/fetch-metadata.js

@@ -165,6 +165,7 @@ function create(opts) {
     "allowSameSite", "allowCrossSite", "allowMissing",
     "allowedDest", "deniedDest", "allowStorageAccess", "strictDest",
     "allowedNavigate", "methods", "audit", "onDeny", "problemDetails",
+    "skipPaths", "skip",
   ], "middleware.fetchMetadata");
   validateOpts.optionalBoolean(opts.allowStorageAccess, "middleware.fetchMetadata: allowStorageAccess");
   validateOpts.optionalBoolean(opts.strictDest, "middleware.fetchMetadata: strictDest");
@@ -174,6 +175,11 @@ function create(opts) {
     _validateDestList(opts.deniedDest, "deniedDest");
   }
 
+  // Per-path exemption (string-prefix / RegExp / skip predicate), validated at
+  // create() — exempt a webhook / cookieless edge-cached route from the
+  // fetch-metadata gate without disabling the app-level mount.
+  var _shouldSkip = requestHelpers.makeSkipMatcher(opts, "middleware.fetchMetadata");
+
   var onDeny = typeof opts.onDeny === "function" ? opts.onDeny : null;
   var problemMode = opts.problemDetails === true;
   var allowSameSite      = opts.allowSameSite !== false;
@@ -220,6 +226,7 @@ function create(opts) {
     // Idempotent: a second fetch-metadata mount this request is a no-op.
     if (req._fetchMetadataChecked) return next();
     req._fetchMetadataChecked = true;
+    if (_shouldSkip(req)) return next();
     if (methods.indexOf(req.method) === -1) return next();
 
     var headers = req.headers || {};

package/lib/vendor/blamejs/lib/middleware/idempotency-key.js

@@ -53,7 +53,7 @@ var cryptoField   = require("../crypto-field");
 var vault         = require("../vault");
 var { defineClass } = require("../framework-error");
 
-var audit          = lazyRequire(function () { return require("../audit"); });
+var auditEmit      = require("../audit-emit");
 var problemDetails = lazyRequire(function () { return require("../problem-details"); });
 var C              = require("../constants");
 
@@ -533,16 +533,8 @@ function dbStore(opts) {
 }
 
 function _validateStore(store, where) {
-  if (!store || typeof store !== "object") {
-    throw new IdempotencyError("idempotency/bad-store",
-      where + ": store must be an object", true);
-  }
-  if (typeof store.get !== "function" ||
-      typeof store.set !== "function" ||
-      typeof store.delete !== "function") {
-    throw new IdempotencyError("idempotency/bad-store",
-      where + ": store must implement { get, set, delete }", true);
-  }
+  validateOpts.requireMethods(store, ["get", "set", "delete"],
+    where + ": store", IdempotencyError, "idempotency/bad-store", true);
 }
 
 function _fingerprintRequest(req, bodyBytes, store) {
@@ -568,15 +560,7 @@ function _fingerprintRequest(req, bodyBytes, store) {
   return nodeCrypto.createHash("sha3-256").update(preimage).digest("hex");
 }
 
-function _emitAudit(action, metadata, outcome) {
-  try {
-    audit().safeEmit({
-      action:   action,
-      outcome:  outcome || "success",
-      metadata: metadata,
-    });
-  } catch (_e) { /* best-effort */ }
-}
+var _emitAudit = auditEmit.emit;
 
 /**
  * @primitive b.middleware.idempotencyKey

package/lib/vendor/blamejs/lib/middleware/rate-limit.js

@@ -56,6 +56,7 @@
  *
  * Audit: every limit hit emits system.ratelimit.block with the key + path.
  */
+var boundedMap = require("../bounded-map");
 var C = require("../constants");
 var frameworkSchema = require("../framework-schema");
 var lazyRequire = require("../lazy-require");
@@ -178,11 +179,14 @@ function _memoryTokenBucketBackend(opts) {
   // microtask cost per request.
   function take(key, _cost) {
     var now = Date.now();
-    var b = buckets.get(key);
-    if (!b) {
-      b = { tokens: burst, lastRefillAt: now };
-      buckets.set(key, b);
-    } else {
+    // Insert a fresh full bucket on first sight; only an already-present
+    // bucket refills (a brand-new bucket starts at `burst`, so refilling
+    // it would be a no-op clamped to `burst` anyway).
+    var existed = buckets.has(key);
+    var b = boundedMap.getOrInsert(buckets, key, function () {
+      return { tokens: burst, lastRefillAt: now };
+    });
+    if (existed) {
       var elapsed = (now - b.lastRefillAt) / C.TIME.seconds(1);
       b.tokens = Math.min(burst, b.tokens + elapsed * refillPerSecond);
       b.lastRefillAt = now;
@@ -254,10 +258,15 @@ function _memoryFixedWindowBackend(opts) {
   function take(key, _cost) {
     var now = Date.now();
     var windowStart = Math.floor(now / windowMs) * windowMs;
-    var c = counters.get(key);
-    if (!c || c.windowStart !== windowStart) {
-      c = { windowStart: windowStart, count: 0 };
-      counters.set(key, c);
+    var c = boundedMap.getOrInsert(counters, key, function () {
+      return { windowStart: windowStart, count: 0 };
+    });
+    // A key carried over from a prior window re-seeds to the current
+    // window (count restarts) — getOrInsert only handles first-sight, so
+    // the rollover case resets the existing record in place.
+    if (c.windowStart !== windowStart) {
+      c.windowStart = windowStart;
+      c.count = 0;
     }
     c.count += 1;
     if (c.count <= max) {
@@ -489,29 +498,12 @@ function create(opts) {
     ? opts.headerPrefix : "X-RateLimit-";
   var limitHeader = headerPrefix + "Limit";   // allow:hand-rolled-sql — HTTP response-header name (X-RateLimit-Limit), not a SQL LIMIT clause
   var remainingHeader = headerPrefix + "Remaining";
-  var skipPaths = opts.skipPaths || [];
-  // Throw at create(): each entry must be a string prefix or a RegExp.
-  // Anything else would crash _shouldSkip with TypeError on the first request.
-  for (var sp = 0; sp < skipPaths.length; sp++) {
-    if (typeof skipPaths[sp] !== "string" && !(skipPaths[sp] instanceof RegExp)) {
-      throw new Error("middleware.rateLimit: skipPaths[" + sp +
-        "] must be a string prefix or RegExp, got " + typeof skipPaths[sp]);
-    }
-  }
+  // Path-exemption predicate (string-prefix or RegExp), validated at create().
+  var _shouldSkip = requestHelpers.makeSkipMatcher(opts, "middleware.rateLimit");
   var scope = opts.scope || "global";
 
   var backend = _resolveBackend(opts);
 
-  function _shouldSkip(req) {
-    var path = req.pathname || req.url || "/";
-    for (var i = 0; i < skipPaths.length; i++) {
-      if (typeof skipPaths[i] === "string" ? path.indexOf(skipPaths[i]) === 0 : skipPaths[i].test(path)) {
-        return true;
-      }
-    }
-    return false;
-  }
-
   function _writeBlocked(req, res, k, verdict) {
     if (emitHeaders && typeof res.setHeader === "function") {
       res.setHeader(limitHeader, String(verdict.limit));

package/lib/vendor/blamejs/lib/middleware/scim-server.js

@@ -4,6 +4,7 @@
 // + /Schemas surfaces backed by operator-supplied CRUD callbacks.
 
 var framework_error = require("../framework-error");
+var pick            = require("../pick");
 var validateOpts    = require("../validate-opts");
 var safeJson        = require("../safe-json");
 var safeBuffer      = require("../safe-buffer");
@@ -516,7 +517,7 @@ function _walkBulkIdRefs(value, out) {
   if (value && typeof value === "object") {
     var keys = Object.keys(value);
     for (var k = 0; k < keys.length; k++) {
-      if (keys[k] === "__proto__" || keys[k] === "constructor" || keys[k] === "prototype") continue;
+      if (pick.isPoisonedKey(keys[k])) continue;
       _walkBulkIdRefs(value[keys[k]], out);
     }
   }
@@ -753,7 +754,7 @@ function _resolveBulkIdRefs(value, bulkIdMap) {
     var out = {};
     var keys = Object.keys(value);
     for (var k = 0; k < keys.length; k++) {
-      if (keys[k] === "__proto__" || keys[k] === "constructor" || keys[k] === "prototype") continue;
+      if (pick.isPoisonedKey(keys[k])) continue;
       out[keys[k]] = _resolveBulkIdRefs(value[keys[k]], bulkIdMap);
     }
     return out;

package/lib/vendor/blamejs/lib/middleware/security-headers.js

@@ -151,7 +151,15 @@ var PP_POLICY_RE =
   /^[a-z][a-z0-9-]*=(?:\*|\([^)]*\)|self)$/;
 function _validatePermissionsPolicy(value) {
   if (typeof value !== "string" || value.length === 0) return;
-  var parts = String(value).split(/\s*,\s*/);
+  // Split on the literal comma, then strip whitespace adjacent to each comma —
+  // the semantics of /\s*,\s*/ without that pattern's O(n^2) backtracking on a
+  // long comma-less run of whitespace. trimStart/trimEnd use the same Unicode
+  // whitespace set as \s.
+  var parts = String(value).split(",");
+  for (var s = 0; s < parts.length; s += 1) {
+    if (s > 0) parts[s] = parts[s].trimStart();
+    if (s < parts.length - 1) parts[s] = parts[s].trimEnd();
+  }
   for (var i = 0; i < parts.length; i += 1) {
     var p = parts[i];
     if (!p) continue;

package/lib/vendor/blamejs/lib/middleware/security-txt.js

@@ -27,6 +27,7 @@
 
 var lazyRequire = require("../lazy-require");
 var validateOpts = require("../validate-opts");
+var denyResponse = require("./deny-response");
 var { defineClass } = require("../framework-error");
 
 var SecurityTxtError = defineClass("SecurityTxtError", { alwaysPermanent: true });
@@ -143,12 +144,7 @@ function create(opts) {
                   (alsoAtRoot && path === "/security.txt");
     if (!matches) return next();
     if (req.method !== "GET" && req.method !== "HEAD") {
-      res.writeHead(405, {                                                       // HTTP 405 status
-        "Allow":          "GET, HEAD",
-        "Content-Type":   "text/plain; charset=utf-8",
-        "Content-Length": 18,                                                    // len of "Method Not Allowed"
-      });
-      res.end("Method Not Allowed");
+      denyResponse.methodNotAllowed(res, "GET, HEAD");
       return;
     }
     res.writeHead(200, {                                                         // HTTP 200 status

package/lib/vendor/blamejs/lib/middleware/tus-upload.js

@@ -150,10 +150,10 @@ function _parseChecksumHeader(headerValue, allowedSet) {
   // alphabet); refuse those on the RAW value BEFORE the slice/trim
   // normalisation (same v0.8.90 trim-before-validate bug class).
   if (structuredFields.containsControlBytes(headerValue)) return { error: "malformed" };
-  var sp = headerValue.indexOf(" ");
-  if (sp === -1) return { error: "malformed" };
-  var algo = headerValue.slice(0, sp).trim().toLowerCase();
-  var digestB64 = headerValue.slice(sp + 1).trim();
+  var kvp = structuredFields.parseKeyValuePiece(headerValue, " ");
+  if (kvp.value === null) return { error: "malformed" };
+  var algo = kvp.key;
+  var digestB64 = kvp.value.trim();
   if (algo.length === 0 || digestB64.length === 0) return { error: "malformed" };
   if (!allowedSet[algo]) return { error: "algo-unsupported" };
   if (!/^[A-Za-z0-9+/=]+$/.test(digestB64)) return { error: "malformed" };
@@ -311,19 +311,11 @@ function _emitTusBaseHeaders(res, extra) {
 }
 
 function _readChunk(req, maxChunkSize) {
-  return new Promise(function (resolve, reject) {
-    var collector = safeBuffer.boundedChunkCollector({
-      maxBytes:    maxChunkSize,
-      errorClass:  TusError,
-      sizeCode:    "tus/chunk-too-large",
-      sizeMessage: "PATCH body exceeded maxChunkSize",
-    });
-    req.on("data", function (c) {
-      try { collector.push(c); }
-      catch (e) { req.removeAllListeners("data"); reject(e); }
-    });
-    req.on("end", function () { resolve(collector.result()); });
-    req.on("error", function (e) { reject(e); });
+  return safeBuffer.collectStream(req, {
+    maxBytes:    maxChunkSize,
+    errorClass:  TusError,
+    sizeCode:    "tus/chunk-too-large",
+    sizeMessage: "PATCH body exceeded maxChunkSize",
   });
 }
 
@@ -388,11 +380,8 @@ function create(opts) {
   }
 
   var store = opts.store;
-  if (!store || typeof store.create !== "function" || typeof store.head !== "function" ||
-      typeof store.append !== "function" || typeof store.terminate !== "function") {
-    throw new TusError("tus/bad-store",
-      "middleware.tusUpload: store must implement { create, head, append, terminate }");
-  }
+  validateOpts.requireMethods(store, ["create", "head", "append", "terminate"],
+    "middleware.tusUpload: store", TusError, "tus/bad-store");
 
   var maxSize = opts.maxSize;
   if (maxSize !== undefined && (typeof maxSize !== "number" || !isFinite(maxSize) || maxSize <= 0)) {
@@ -451,11 +440,7 @@ function create(opts) {
     return new Date(rec.expireAt).toUTCString();
   }
 
-  function _emitMetric(verb, _outcome, _metadata) {
-    if (!auditOn) return;
-    try { observability().safeEvent("middleware.tusUpload." + verb, 1, {}); }
-    catch (_e) { /* drop-silent — observability sink */ }
-  }
+  var _emitMetric = observability().namespaced("middleware.tusUpload", auditOn);
 
   async function _handleOptions(req, res) {
     var headers = _emitTusBaseHeaders(res, {

package/lib/vendor/blamejs/lib/middleware/web-app-manifest.js

@@ -29,6 +29,7 @@
 var lazyRequire = require("../lazy-require");
 var safeJson = require("../safe-json");
 var validateOpts = require("../validate-opts");
+var denyResponse = require("./deny-response");
 var { defineClass } = require("../framework-error");
 
 var WebAppManifestError = defineClass("WebAppManifestError", { alwaysPermanent: true });
@@ -135,13 +136,7 @@ function create(opts) {
                   (alsoAtJsonPath && path === "/manifest.json");
     if (!matches) return next();
     if (req.method !== "GET" && req.method !== "HEAD") {
-      var bodyMsg = "Method Not Allowed";
-      res.writeHead(405, {                                                       // HTTP 405 status
-        "Allow":          "GET, HEAD",
-        "Content-Type":   "text/plain; charset=utf-8",
-        "Content-Length": Buffer.byteLength(bodyMsg),
-      });
-      res.end(bodyMsg);
+      denyResponse.methodNotAllowed(res, "GET, HEAD");
       return;
     }
     res.writeHead(200, {                                                         // HTTP 200 status

package/lib/vendor/blamejs/lib/migrations.js

@@ -39,6 +39,7 @@
  */
 
 var nodePath = require("node:path");
+var moduleLoader = require("./module-loader");
 var atomicFile = require("./atomic-file");
 var dbSchema = require("./db-schema");
 var frameworkSchema = require("./framework-schema");
@@ -269,21 +270,11 @@ function _resolveDb(opts) {
 }
 
 function _loadMigration(file, dir) {
-  var fullPath = nodePath.join(dir, file);
-  // Drop the require cache for this path before loading so a test that
-  // changes a migration file between calls picks up the new content.
-  // Production deployments would always restart the process, but this
-  // keeps test fixtures sane.
-  try { delete require.cache[require.resolve(fullPath)]; } catch (_e) { /* not yet cached */ }
-  var mod;
-  // Operator-supplied migration — dynamic by design, can't be bundle-
-  // traced. Host-CLI scope; deploying via SEA / pkg drops this surface.
-  try { mod = require(fullPath); }   // allow:dynamic-require — operator-supplied migration
-  catch (e) {
-    throw new MigrationError("migrations/load-failed",
+  var mod = moduleLoader.requireFresh(nodePath.join(dir, file), function (e) {
+    return new MigrationError("migrations/load-failed",
       "migration '" + file + "' failed to load: " + ((e && e.message) || String(e)),
       true);
-  }
+  });
   if (!mod || typeof mod.up !== "function") {
     throw new MigrationError("migrations/missing-up",
       "migration '" + file + "' must export an `up(db)` function", true);

package/lib/vendor/blamejs/lib/mime-parse.js

@@ -37,32 +37,48 @@
  * mdn: 1 MiB) so this module's hot-path doesn't add its own cap.
  */
 
-function parseHeaderBlock(text) {
-  // RFC 5322 §2.2.3 — continuation lines (lines starting with WSP)
-  // fold onto the previous header value. The header section ends at
-  // the first empty line; subsequent lines belong to the body.
-  var lines = text.split(/\r?\n/);
-  var unfolded = [];
+function classifyHeaderBlock(text) {
+  // RFC 5322 §2.2 — every line of a header section is either a header field
+  // (`name: value`), a folding continuation (leading WSP), or the empty line
+  // that ends the section. Anything else is MALFORMED — and a colon-less line
+  // sitting in the header section is the header-injection / SMTP-smuggling
+  // signal (attacker content on a bare line followed by an injected
+  // Bcc/To/From header). `fields` is the parsed headers (boundary-aware,
+  // continuation-unfolded); `malformed` is the injection/structure evidence the
+  // silent-skip parsers (email, mime, dsn, arc) all dropped on the floor.
+  var lines = String(text == null ? "" : text).split(/\r?\n/);
+  var unfolded = [];                                                            // [{ line, lineIndex }]
   for (var i = 0; i < lines.length; i += 1) {
     var line = lines[i];
-    if (line.length === 0) break;
+    if (line.length === 0) break;                                              // header/body boundary
     if ((line.charAt(0) === " " || line.charAt(0) === "\t") && unfolded.length > 0) {
-      unfolded[unfolded.length - 1] += " " + line.replace(/^\s+/, "");
+      unfolded[unfolded.length - 1].line += " " + line.replace(/^\s+/, "");
     } else {
-      unfolded.push(line);
+      unfolded.push({ line: line, lineIndex: i });
     }
   }
-  var headers = [];
+  var fields = [];
+  var malformed = [];
   for (var j = 0; j < unfolded.length; j += 1) {
-    var l = unfolded[j];
-    var colonAt = l.indexOf(":");
-    if (colonAt === -1) continue;
-    headers.push({
-      name:  l.slice(0, colonAt).trim(),
-      value: l.slice(colonAt + 1).trim(),
+    var entry = unfolded[j];
+    var colonAt = entry.line.indexOf(":");
+    if (colonAt === -1) {
+      malformed.push({ lineIndex: entry.lineIndex, line: entry.line, reason: "no-colon" });
+      continue;
+    }
+    fields.push({
+      name:  entry.line.slice(0, colonAt).trim(),
+      value: entry.line.slice(colonAt + 1).trim(),
     });
   }
-  return headers;
+  return { fields: fields, malformed: malformed };
+}
+
+function parseHeaderBlock(text) {
+  // The fields view of the shared classifier — kept for every caller that only
+  // wants the parsed headers (the malformed lines are reached via
+  // classifyHeaderBlock for structure/injection validation).
+  return classifyHeaderBlock(text).fields;
 }
 
 function splitHeadersAndBody(text) {
@@ -189,6 +205,7 @@ function addressType(addr) {
 
 module.exports = {
   parseHeaderBlock:    parseHeaderBlock,
+  classifyHeaderBlock: classifyHeaderBlock,
   splitHeadersAndBody: splitHeadersAndBody,
   findHeader:          findHeader,
   parseContentType:    parseContentType,

package/lib/vendor/blamejs/lib/module-loader.js

@@ -0,0 +1,44 @@
+"use strict";
+/**
+ * lib/module-loader.js — the single audited entry point for loading an
+ * operator-supplied module file (a migration or a seed) by path.
+ *
+ * Operator modules execute arbitrary code on `require`, so the dynamic
+ * `require()` lives here behind ONE `allow:dynamic-require` marker rather
+ * than scattered across every host-CLI loader (`b.migrations`,
+ * `b.seeders`, `b.externalDb.migrate`). The require cache is busted first
+ * so a dev / test rewriting a fixture between calls picks up the new
+ * content (production deployments restart the process). The dynamic
+ * require does not survive SEA / esbuild bundling — operator migrations
+ * and seeds are host-CLI scope, not framework-internal scope.
+ *
+ * The caller owns path construction (it knows its own directory layout)
+ * and the typed, domain-specific error it throws on a load failure
+ * (parse error, throwing top-level code), so resolution stays identical
+ * to the per-loader form it replaces.
+ */
+
+/**
+ * requireFresh(absPath, onLoadError) — bust the require cache for
+ * `absPath`, then require it fresh. `absPath` MUST be absolute (a bare
+ * relative path would resolve against node_modules, which is never an
+ * operator file). On a load failure, `onLoadError(err)` builds the
+ * caller's typed error, which is thrown.
+ *
+ *   var mod = moduleLoader.requireFresh(path.join(dir, file), function (e) {
+ *     return new MigrationError("migrations/load-failed",
+ *       "migration '" + file + "' failed to load: " + ((e && e.message) || String(e)), true);
+ *   });
+ */
+function requireFresh(absPath, onLoadError) {
+  try { delete require.cache[require.resolve(absPath)]; } catch (_e) { /* not yet cached */ }
+  try {
+    return require(absPath);   // allow:dynamic-require — operator-supplied module (migration / seed)
+  } catch (e) {
+    throw onLoadError(e);
+  }
+}
+
+module.exports = {
+  requireFresh: requireFresh,
+};