@blamejs/blamejs-shop 0.4.56 → 0.4.57

package/lib/vendor/blamejs/test/layer-0-primitives/rate-limit-memory-getorinsert.test.js

@@ -0,0 +1,100 @@
+"use strict";
+/**
+ * Memory rate-limit backends — get-or-insert routing regression guard.
+ *
+ * Both in-memory backends keep a request-keyed Map (token buckets /
+ * fixed-window counters) and lazily create the per-key record on first
+ * sight. This pins the observable verdict behaviour across the
+ * insert path AND the existing-record path (token refill / window
+ * rollover) so the routing of those get-or-insert sites through
+ * b.boundedMap.getOrInsert stays behaviour-identical.
+ */
+
+var helpers = require("../helpers");
+var b     = helpers.b;
+var check = helpers.check;
+
+async function run() {
+  var rateLimitMod = b.middleware._modules.rateLimit;
+
+  // ---- token-bucket backend ----
+  var tb = rateLimitMod._memoryTokenBucketBackend({ burst: 3, refillPerSecond: 1 });
+
+  // First take on a brand-new key inserts the bucket and spends one token.
+  var t1 = tb.take("ip-a", 1);
+  check("token-bucket: first take allowed", t1.allowed === true);
+  check("token-bucket: first take reports full burst as limit", t1.limit === 3);
+  check("token-bucket: first take remaining = burst - 1", t1.remaining === 2);
+
+  // Subsequent takes on the SAME key hit the existing-bucket branch and
+  // keep decrementing (no refill in the same millisecond window).
+  var t2 = tb.take("ip-a", 1);
+  check("token-bucket: second take allowed", t2.allowed === true);
+  check("token-bucket: second take remaining decremented", t2.remaining === 1);
+  var t3 = tb.take("ip-a", 1);
+  check("token-bucket: third take allowed", t3.allowed === true);
+  var t4 = tb.take("ip-a", 1);
+  check("token-bucket: fourth take denied (bucket drained)", t4.allowed === false);
+  check("token-bucket: denied verdict has retryAfter", t4.retryAfter >= 1);
+
+  // A different key gets its own fresh bucket (independent insert).
+  var u1 = tb.take("ip-b", 1);
+  check("token-bucket: distinct key gets fresh bucket", u1.allowed === true && u1.remaining === 2);
+
+  // reset drops the key; the next take re-inserts a full bucket.
+  tb.reset("ip-a");
+  var t5 = tb.take("ip-a", 1);
+  check("token-bucket: after reset, bucket re-inserted full", t5.allowed === true && t5.remaining === 2);
+  tb.close();
+
+  // ---- fixed-window backend ----
+  var fw = rateLimitMod._memoryFixedWindowBackend({ max: 2, windowMs: 60000 });
+
+  // First take inserts the counter (count -> 1).
+  var f1 = fw.take("ip-c", 1);
+  check("fixed-window: first take allowed", f1.allowed === true);
+  check("fixed-window: first take limit = max", f1.limit === 2);
+  check("fixed-window: first take remaining = max - 1", f1.remaining === 1);
+
+  // Same window increments the existing counter.
+  var f2 = fw.take("ip-c", 1);
+  check("fixed-window: second take allowed (at max)", f2.allowed === true);
+  check("fixed-window: second take remaining 0", f2.remaining === 0);
+  var f3 = fw.take("ip-c", 1);
+  check("fixed-window: third take over max denied", f3.allowed === false);
+  check("fixed-window: denied verdict has retryAfter", f3.retryAfter >= 1);
+
+  // Distinct key inserts its own counter.
+  var g1 = fw.take("ip-d", 1);
+  check("fixed-window: distinct key gets fresh counter", g1.allowed === true && g1.remaining === 1);
+
+  // reset drops the key; next take re-inserts.
+  fw.reset("ip-c");
+  var f4 = fw.take("ip-c", 1);
+  check("fixed-window: after reset, counter re-inserted", f4.allowed === true && f4.remaining === 1);
+  fw.close();
+
+  // ---- fixed-window: window rollover re-seeds the existing key ----
+  // Drive a 1ms window so a real wall-clock advance rolls the window and
+  // exercises the "key present but window changed -> re-seed" branch.
+  var fwRoll = rateLimitMod._memoryFixedWindowBackend({ max: 1, windowMs: 1 });
+  var r1 = fwRoll.take("ip-e", 1);
+  check("fixed-window rollover: first take allowed", r1.allowed === true);
+  await helpers.waitUntil(function () {
+    // Once the wall clock advances past the 1ms window, a fresh take
+    // re-seeds count to 1 and is allowed again on the SAME key.
+    var v = fwRoll.take("ip-e", 1);
+    return v.allowed === true;
+  }, { timeoutMs: 5000, label: "fixed-window rollover: same key allowed in new window" });
+  check("fixed-window rollover: same key re-seeded in new window", true);
+  fwRoll.close();
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  run().then(
+    function () { console.log("OK — " + helpers.getChecks() + " checks passed"); },
+    function (e) { console.error("FAIL:", e && e.stack || e); process.exit(1); }
+  );
+}

package/lib/vendor/blamejs/test/layer-0-primitives/request-helpers.test.js

@@ -323,6 +323,94 @@ async function run() {
   testExtractBearerMultipleAuthHeaders();
   testExtractBearerNonString();
   testExtractBearerLeadingTrailingSpaces();
+  testMakeSkipMatcher();
+  testMakeResourceAuditEmitter();
+}
+
+function testMakeResourceAuditEmitter() {
+  var events = [];
+  var sink = { safeEmit: function (e) { events.push(e); } };
+
+  // idFor derives the resource id; no req → no actor.
+  var emit = b.requestHelpers.makeResourceAuditEmitter(sink, "auth.lockout",
+    function (key) { return "ns:" + key; });
+  check("makeResourceAuditEmitter: returns an emitter", typeof emit === "function");
+  emit("locked", "k1", "denied", { attempts: 3 }, null);
+  check("makeResourceAuditEmitter: event action/outcome",
+    events[0] && events[0].action === "locked" && events[0].outcome === "denied");
+  check("makeResourceAuditEmitter: resource kind + idFor-derived id",
+    events[0].resource && events[0].resource.kind === "auth.lockout" && events[0].resource.id === "ns:k1");
+  check("makeResourceAuditEmitter: metadata passed through", events[0].metadata.attempts === 3);
+  check("makeResourceAuditEmitter: no req → no actor", events[0].actor === undefined);
+
+  // default idFor = key verbatim; req → actor stamped.
+  var emit2 = b.requestHelpers.makeResourceAuditEmitter(sink, "session.device");
+  emit2("rotated", "tok-hash", "success", {}, { socket: { remoteAddress: "1.2.3.4" }, headers: {} });
+  check("makeResourceAuditEmitter: default idFor is the key verbatim", events[1].resource.id === "tok-hash");
+  check("makeResourceAuditEmitter: req → actor stamped", events[1].actor !== undefined);
+
+  // falsy sink → disabled (operator opted out).
+  var n = events.length;
+  b.requestHelpers.makeResourceAuditEmitter(null, "x")("a", "k", "o", {}, null);
+  check("makeResourceAuditEmitter: falsy sink disables emit", events.length === n);
+
+  // a throwing sink is swallowed (never breaks the request).
+  var threw = false;
+  try {
+    b.requestHelpers.makeResourceAuditEmitter({ safeEmit: function () { throw new Error("boom"); } }, "x")
+      ("a", "k", "o", {}, null);
+  } catch (_e) { threw = true; }
+  check("makeResourceAuditEmitter: throwing sink is drop-silent", threw === false);
+}
+
+function testMakeSkipMatcher() {
+  var shouldSkip = b.requestHelpers.makeSkipMatcher(
+    { skipPaths: ["/healthz", /^\/webhooks\//] }, "test.makeSkipMatcher");
+  check("makeSkipMatcher: returns a predicate", typeof shouldSkip === "function");
+  check("makeSkipMatcher: string-prefix match",     shouldSkip({ pathname: "/healthz" }) === true);
+  check("makeSkipMatcher: regexp match",            shouldSkip({ pathname: "/webhooks/stripe" }) === true);
+  check("makeSkipMatcher: non-matching path",       shouldSkip({ pathname: "/account" }) === false);
+  check("makeSkipMatcher: falls back to req.url",   shouldSkip({ url: "/healthz" }) === true);
+  check("makeSkipMatcher: falls back to req.originalUrl", shouldSkip({ originalUrl: "/healthz" }) === true);
+  check("makeSkipMatcher: missing path → '/' (no skip)", shouldSkip({}) === false);
+
+  // SEGMENT-BOUNDARY (not raw startsWith) — the guard-bypass fix. "/healthz"
+  // must NOT skip the sibling "/healthzzz", but MUST skip the descendant.
+  check("makeSkipMatcher: segment boundary — sibling NOT skipped", shouldSkip({ pathname: "/healthzzz" }) === false);
+  check("makeSkipMatcher: segment boundary — descendant skipped",  shouldSkip({ pathname: "/healthz/ready" }) === true);
+  // Query string is stripped before matching (match on path, never the query).
+  check("makeSkipMatcher: query string stripped", shouldSkip({ url: "/healthz?ready=1" }) === true);
+  check("makeSkipMatcher: query can't fake a match", shouldSkip({ url: "/account?x=/healthz" }) === false);
+
+  // A string entry ending in "/" is itself a segment prefix.
+  var slashEntry = b.requestHelpers.makeSkipMatcher({ skipPaths: ["/api/"] }, "test.slash");
+  check("makeSkipMatcher: trailing-slash entry matches descendant", slashEntry({ pathname: "/api/v1" }) === true);
+  check("makeSkipMatcher: trailing-slash entry rejects sibling",    slashEntry({ pathname: "/apixyz" }) === false);
+
+  // exact:true — whole-path equality only, no descendant.
+  var exactM = b.requestHelpers.makeSkipMatcher({ skipPaths: ["/foo"], exact: true }, "test.exact");
+  check("makeSkipMatcher: exact matches whole path", exactM({ pathname: "/foo" }) === true);
+  check("makeSkipMatcher: exact rejects descendant",  exactM({ pathname: "/foo/bar" }) === false);
+
+  // skip(req) predicate composes; a throwing predicate fails CLOSED (keeps guard ON).
+  var withFn = b.requestHelpers.makeSkipMatcher(
+    { skip: function (req) { return req.method === "OPTIONS"; } }, "test.skipFn");
+  check("makeSkipMatcher: skip predicate true",     withFn({ method: "OPTIONS" }) === true);
+  check("makeSkipMatcher: skip predicate false",    withFn({ method: "POST" }) === false);
+  var throwing = b.requestHelpers.makeSkipMatcher(
+    { skip: function () { throw new Error("boom"); } }, "test.skipThrow");
+  check("makeSkipMatcher: throwing predicate fails closed (no skip)", throwing({}) === false);
+
+  // Build-time validation: a bad skipPaths entry dies at boot, not on first request.
+  check("makeSkipMatcher: non-array skipPaths throws",
+        (function () { try { b.requestHelpers.makeSkipMatcher({ skipPaths: "x" }); return false; }
+                       catch (e) { return e instanceof TypeError; } })());
+  check("makeSkipMatcher: bad skipPaths entry throws",
+        (function () { try { b.requestHelpers.makeSkipMatcher({ skipPaths: [123] }); return false; }
+                       catch (e) { return e instanceof TypeError; } })());
+  check("makeSkipMatcher: non-function skip throws",
+        (function () { try { b.requestHelpers.makeSkipMatcher({ skip: "x" }); return false; }
+                       catch (e) { return e instanceof TypeError; } })());
 }
 
 module.exports = { run: run };

package/lib/vendor/blamejs/test/layer-0-primitives/safe-async-loops.test.js

@@ -2,6 +2,10 @@
 /**
  * b.safeAsync.repeating + b.safeAsync.flushLoop — bounded-cadence + flush
  * loop primitives that replace ad-hoc setInterval / setTimeout chains.
+ * Also covers b.safeAsync.makeBufferedEnqueue + b.safeAsync.makeDrainingClose
+ * + b.safeAsync.makeBatchDrain — the backpressure enqueue, graceful
+ * drain-then-close, and single-flight drain loop shared by the batching
+ * log-stream sinks.
  */
 
 var helpers = require("../helpers");
@@ -151,6 +155,280 @@ async function run() {
   rejectsF("bad ms (NaN)",    function () { b.safeAsync.flushLoop(function () {}, NaN); }, /async\/bad-arg/);
   rejectsF("bad ms (zero)",   function () { b.safeAsync.flushLoop(function () {}, 0); }, /async\/bad-arg/);
   rejectsF("bad ms (string)", function () { b.safeAsync.flushLoop(function () {}, "x"); }, /async\/bad-arg/);
+
+  // ---- makeBufferedEnqueue: backpressure enqueue for batching sinks ----
+  check("safeAsync.makeBufferedEnqueue is fn",
+        typeof b.safeAsync.makeBufferedEnqueue === "function");
+
+  // Partial batch defers to schedule; full batch fires flush; result shape.
+  var beBuf = [];
+  var flushes = 0, schedules = 0;
+  var beEnqueue = b.safeAsync.makeBufferedEnqueue(beBuf, {
+    batchSize:   3,
+    bufferLimit: 5,
+    // Drain on a microtask, mirroring the sinks' async _flush — the enqueue
+    // return value must see the pre-drain depth.
+    flush:       function () { flushes += 1; return Promise.resolve().then(function () { beBuf.length = 0; }); },
+    schedule:    function () { schedules += 1; },
+  });
+  var r1 = await beEnqueue({ n: 1 });
+  check("bufferedEnqueue: accepted result + queued depth",  r1.accepted === true && r1.queued === 1);
+  check("bufferedEnqueue: partial batch schedules, no flush", schedules === 1 && flushes === 0);
+  await beEnqueue({ n: 2 });
+  var r3 = await beEnqueue({ n: 3 });            // batch full → flush, no schedule
+  check("bufferedEnqueue: full batch triggers flush",        flushes === 1);
+  check("bufferedEnqueue: queued depth reported pre-flush",  r3.queued === 3);
+  check("bufferedEnqueue: full-batch turn does not schedule", schedules === 2);
+
+  // Overflow: drop oldest once bufferLimit is reached, evicted record to onOverflow.
+  var ovBuf = [];
+  var ovDrops = [];
+  var ovEnqueue = b.safeAsync.makeBufferedEnqueue(ovBuf, {
+    batchSize:   100,            // never flush via batch — isolate overflow
+    bufferLimit: 2,
+    flush:       function () { return Promise.resolve(); },
+    schedule:    function () {},
+    onOverflow:  function (dropped) { ovDrops.push(dropped); },
+  });
+  await ovEnqueue({ id: "a" });
+  await ovEnqueue({ id: "b" });
+  await ovEnqueue({ id: "c" });   // len 2 >= limit 2 → evict "a", push "c"
+  check("bufferedEnqueue: overflow drops oldest",
+        ovBuf.length === 2 && ovBuf[0].id === "b" && ovBuf[1].id === "c");
+  check("bufferedEnqueue: onOverflow receives evicted record",
+        ovDrops.length === 1 && ovDrops[0].id === "a");
+
+  // onOverflow is optional — overflow without it must stay silent.
+  var noCbBuf = [];
+  var noCbEnqueue = b.safeAsync.makeBufferedEnqueue(noCbBuf, {
+    batchSize: 100, bufferLimit: 1,
+    flush: function () { return Promise.resolve(); },
+    schedule: function () {},
+  });
+  await noCbEnqueue({ x: 1 });
+  await noCbEnqueue({ x: 2 });    // overflow, no onOverflow → silent
+  check("bufferedEnqueue: overflow without onOverflow is silent",
+        noCbBuf.length === 1 && noCbBuf[0].x === 2);
+
+  // Config-time validation (TypeError) so sink-wiring typos surface at setup.
+  function beRejects(label, fn) {
+    var threw = null;
+    try { fn(); } catch (e) { threw = e; }
+    check("bufferedEnqueue: rejects " + label, threw instanceof TypeError);
+  }
+  var okOpts = { batchSize: 1, bufferLimit: 1, flush: function () {}, schedule: function () {} };
+  function withOpt(over) { return Object.assign({}, okOpts, over); }
+  beRejects("non-array buffer",  function () { b.safeAsync.makeBufferedEnqueue({}, okOpts); });
+  beRejects("missing opts",      function () { b.safeAsync.makeBufferedEnqueue([]); });
+  beRejects("bad batchSize",     function () { b.safeAsync.makeBufferedEnqueue([], withOpt({ batchSize: 0 })); });
+  beRejects("bad bufferLimit",   function () { b.safeAsync.makeBufferedEnqueue([], withOpt({ bufferLimit: -1 })); });
+  beRejects("non-fn flush",      function () { b.safeAsync.makeBufferedEnqueue([], withOpt({ flush: null })); });
+  beRejects("non-fn schedule",   function () { b.safeAsync.makeBufferedEnqueue([], withOpt({ schedule: null })); });
+  beRejects("non-fn onOverflow", function () { b.safeAsync.makeBufferedEnqueue([], withOpt({ onOverflow: 5 })); });
+
+  // ---- makeDrainingClose: graceful drain-then-close for batching sinks ----
+  check("safeAsync.makeDrainingClose is fn",
+        typeof b.safeAsync.makeDrainingClose === "function");
+
+  // Order is load-bearing: cancel → await inflight → flush → markClosed.
+  var seq = [];
+  var dcInflight = Promise.resolve().then(function () { seq.push("inflight"); });
+  var dcClose = b.safeAsync.makeDrainingClose({
+    scheduler:   { cancel: function () { seq.push("cancel"); } },
+    getInflight: function () { return dcInflight; },
+    flush:       function () { seq.push("flush"); return Promise.resolve(); },
+    markClosed:  function () { seq.push("closed"); },
+  });
+  await dcClose();
+  check("drainingClose: drains in order cancel->inflight->flush->closed",
+        seq.join(",") === "cancel,inflight,flush,closed");
+
+  // No in-flight drain → still flushes + marks closed.
+  var seq2 = [];
+  var dcClose2 = b.safeAsync.makeDrainingClose({
+    scheduler:   { cancel: function () { seq2.push("cancel"); } },
+    getInflight: function () { return null; },
+    flush:       function () { seq2.push("flush"); return Promise.resolve(); },
+    markClosed:  function () { seq2.push("closed"); },
+  });
+  await dcClose2();
+  check("drainingClose: no inflight still flushes + closes",
+        seq2.join(",") === "cancel,flush,closed");
+
+  // In-flight rejection is swallowed — close still flushes + marks closed.
+  var dcClosedFlag = false;
+  var dcClose3 = b.safeAsync.makeDrainingClose({
+    scheduler:   { cancel: function () {} },
+    getInflight: function () { return Promise.reject(new Error("drain boom")); },
+    flush:       function () { return Promise.resolve(); },
+    markClosed:  function () { dcClosedFlag = true; },
+  });
+  await dcClose3();
+  check("drainingClose: in-flight rejection swallowed, close completes", dcClosedFlag === true);
+
+  // Config-time validation.
+  function dcRejects(label, fn) {
+    var threw = null;
+    try { fn(); } catch (e) { threw = e; }
+    check("drainingClose: rejects " + label, threw instanceof TypeError);
+  }
+  var okClose = {
+    scheduler: { cancel: function () {} }, getInflight: function () {},
+    flush: function () {}, markClosed: function () {},
+  };
+  function withClose(over) { return Object.assign({}, okClose, over); }
+  dcRejects("missing opts",         function () { b.safeAsync.makeDrainingClose(); });
+  dcRejects("scheduler w/o cancel", function () { b.safeAsync.makeDrainingClose(withClose({ scheduler: {} })); });
+  dcRejects("non-fn getInflight",   function () { b.safeAsync.makeDrainingClose(withClose({ getInflight: null })); });
+  dcRejects("non-fn flush",         function () { b.safeAsync.makeDrainingClose(withClose({ flush: null })); });
+  dcRejects("non-fn markClosed",    function () { b.safeAsync.makeDrainingClose(withClose({ markClosed: null })); });
+
+  // ---- makeBatchDrain: single-flight drain loop for batching sinks ----
+  check("safeAsync.makeBatchDrain is fn",
+        typeof b.safeAsync.makeBatchDrain === "function");
+
+  // Drains the whole buffer in batchSize chunks via sendBatch.
+  var bdBuf = [1, 2, 3, 4, 5];
+  var bdSent = [];
+  var bdDrain = b.safeAsync.makeBatchDrain({
+    buffer:    bdBuf,
+    batchSize: 2,
+    scheduler: b.safeAsync.makeScheduledFlush(20, function () {}),
+    isClosed:  function () { return false; },
+    sendBatch: function (batch) { bdSent.push(batch.slice()); return Promise.resolve(); },
+    onRetryExhausted: function () {},
+  });
+  await bdDrain.flush();
+  check("batchDrain: drains whole buffer in batchSize chunks",
+        bdBuf.length === 0 && bdSent.length === 3 &&
+        bdSent[0].join() === "1,2" && bdSent[2].join() === "5");
+  check("batchDrain: isInFlight false after drain", bdDrain.isInFlight() === false);
+
+  // retry-exhausted: a sendBatch throw reports + stops the loop, remainder kept.
+  var reBuf = [1, 2, 3, 4];
+  var reExhausted = null;
+  var reDrain = b.safeAsync.makeBatchDrain({
+    buffer:    reBuf,
+    batchSize: 2,
+    scheduler: b.safeAsync.makeScheduledFlush(20, function () {}),
+    isClosed:  function () { return false; },
+    sendBatch: function () { return Promise.reject(new Error("send boom")); },
+    onRetryExhausted: function (batch, e) { reExhausted = { n: batch.length, msg: e.message }; },
+  });
+  await reDrain.flush();
+  check("batchDrain: retry-exhausted reported, loop stops, remainder kept",
+        reExhausted && reExhausted.n === 2 && reExhausted.msg === "send boom" && reBuf.length === 2);
+
+  // beforeDrain failure drains the WHOLE buffer as a drop, no send attempted.
+  var bfBuf = [1, 2, 3];
+  var bfFailed = null, bfSends = 0;
+  var bfDrain = b.safeAsync.makeBatchDrain({
+    buffer:      bfBuf,
+    batchSize:   2,
+    scheduler:   b.safeAsync.makeScheduledFlush(20, function () {}),
+    isClosed:    function () { return false; },
+    beforeDrain: function () { return Promise.reject(new Error("autocreate boom")); },
+    onBeforeDrainFail: function (records, e) { bfFailed = { n: records.length, msg: e.message }; },
+    sendBatch:   function () { bfSends += 1; return Promise.resolve(); },
+    onRetryExhausted: function () {},
+  });
+  await bfDrain.flush();
+  check("batchDrain: beforeDrain failure drops whole buffer, no send",
+        bfFailed && bfFailed.n === 3 && bfFailed.msg === "autocreate boom" &&
+        bfSends === 0 && bfBuf.length === 0);
+
+  // Custom takeBatch governs the batch shape (byte-cap style — one per batch).
+  var tbBuf = [10, 20, 30];
+  var tbSent = [];
+  var tbDrain = b.safeAsync.makeBatchDrain({
+    buffer:    tbBuf,
+    batchSize: 100,
+    scheduler: b.safeAsync.makeScheduledFlush(20, function () {}),
+    isClosed:  function () { return false; },
+    takeBatch: function (buf) { return buf.splice(0, 1); },
+    sendBatch: function (batch) { tbSent.push(batch[0]); return Promise.resolve(); },
+    onRetryExhausted: function () {},
+  });
+  await tbDrain.flush();
+  check("batchDrain: custom takeBatch governs batch shape",
+        tbSent.join() === "10,20,30" && tbBuf.length === 0);
+
+  // Single-flight: concurrent flushes drain the buffer once (no double-send).
+  var sfBuf = [1, 2, 3];
+  var sfSent = 0;
+  var sfDrain = b.safeAsync.makeBatchDrain({
+    buffer:    sfBuf,
+    batchSize: 1,
+    scheduler: b.safeAsync.makeScheduledFlush(20, function () {}),
+    isClosed:  function () { return false; },
+    sendBatch: function () { sfSent += 1; return Promise.resolve(); },
+    onRetryExhausted: function () {},
+  });
+  check("batchDrain: isInFlight false before flush", sfDrain.isInFlight() === false);
+  var p1 = sfDrain.flush();
+  check("batchDrain: isInFlight true synchronously after flush()", sfDrain.isInFlight() === true);
+  var p2 = sfDrain.flush();          // in-flight → must not start a second drain
+  await Promise.all([p1, p2]);
+  check("batchDrain: concurrent flush drains buffer exactly once",
+        sfSent === 3 && sfBuf.length === 0 && sfDrain.isInFlight() === false);
+
+  // isClosed stops the loop between batches.
+  var clBuf = [1, 2, 3, 4];
+  var clSent = 0, clClosed = false;
+  var clDrain = b.safeAsync.makeBatchDrain({
+    buffer:    clBuf,
+    batchSize: 1,
+    scheduler: b.safeAsync.makeScheduledFlush(20, function () {}),
+    isClosed:  function () { return clClosed; },
+    sendBatch: function () { clSent += 1; clClosed = true; return Promise.resolve(); },
+    onRetryExhausted: function () {},
+  });
+  await clDrain.flush();
+  check("batchDrain: isClosed halts the loop after the current batch",
+        clSent === 1 && clBuf.length === 3);
+
+  // Config-time validation.
+  function bdRejects(label, fn) {
+    var threw = null;
+    try { fn(); } catch (e) { threw = e; }
+    check("batchDrain: rejects " + label, threw instanceof TypeError);
+  }
+  var okDrain = {
+    buffer: [], batchSize: 1, scheduler: { schedule: function () {} },
+    isClosed: function () {}, sendBatch: function () {}, onRetryExhausted: function () {},
+  };
+  function withDrain(over) { return Object.assign({}, okDrain, over); }
+  bdRejects("non-array buffer",        function () { b.safeAsync.makeBatchDrain(withDrain({ buffer: {} })); });
+  bdRejects("bad batchSize",           function () { b.safeAsync.makeBatchDrain(withDrain({ batchSize: 0 })); });
+  bdRejects("scheduler w/o schedule",  function () { b.safeAsync.makeBatchDrain(withDrain({ scheduler: {} })); });
+  bdRejects("non-fn isClosed",         function () { b.safeAsync.makeBatchDrain(withDrain({ isClosed: null })); });
+  bdRejects("non-fn sendBatch",        function () { b.safeAsync.makeBatchDrain(withDrain({ sendBatch: null })); });
+  bdRejects("non-fn onRetryExhausted", function () { b.safeAsync.makeBatchDrain(withDrain({ onRetryExhausted: null })); });
+  bdRejects("non-fn takeBatch",        function () { b.safeAsync.makeBatchDrain(withDrain({ takeBatch: 5 })); });
+
+  // makeBatchingSink — the top-level composer (buffered enqueue + batch
+  // drain + draining close). batchSize flush + final-drain-on-close: every
+  // emitted record reaches sendBatch, none stranded on shutdown.
+  var bsSent = [];
+  var bsSink = b.safeAsync.makeBatchingSink({
+    batchSize:     2,
+    bufferLimit:   100,
+    maxBatchAgeMs: 50,
+    sendBatch:     function (batch) { bsSent.push(batch.slice()); return Promise.resolve(); },
+  });
+  await bsSink.emit({ message: "a" });
+  await bsSink.emit({ message: "b" });
+  await bsSink.emit({ message: "c" });
+  await bsSink.close();
+  var bsTotal = bsSent.reduce(function (n, batch) { return n + batch.length; }, 0);
+  check("makeBatchingSink batches and drains all records on close (3 in -> 3 out)",
+    bsTotal === 3 && bsSent.length >= 1);
+
+  // config-time validation: sendBatch is required.
+  var bsThrew = false;
+  try { b.safeAsync.makeBatchingSink({ batchSize: 2 }); }
+  catch (e) { bsThrew = /sendBatch/.test(e.message); }
+  check("makeBatchingSink requires opts.sendBatch", bsThrew);
 }
 
 module.exports = { run: run };

package/lib/vendor/blamejs/test/layer-0-primitives/safe-buffer-linear-scans.test.js

@@ -84,6 +84,43 @@ function run() {
   check("indexAfterOpenTag: linear on 80K <body starts (< 500ms; regex was ~8.6s)", msIdx < 500);
   check("indexAfterOpenTag: degenerate input → -1 (no terminated tag)",
     sb.indexAfterOpenTag(bigBody, "body") === -1);
+
+  // ---- makeByteCoercer: bind toBuffer to a module's error contract ----
+  function FakeErr(code, message) { this.code = code; this.message = message; }
+  var coerce = sb.makeByteCoercer({
+    errorClass:    FakeErr,
+    typeCode:      "fake/bad-bytes",
+    messagePrefix: "fake: ",
+    messageSuffix: " must be bytes",
+    allowString:   false,
+  });
+  check("makeByteCoercer: passes a Buffer through",
+    Buffer.isBuffer(coerce(Buffer.from([1, 2]), "field")) &&
+    coerce(Buffer.from([1, 2]), "field").length === 2);
+  check("makeByteCoercer: coerces a Uint8Array to Buffer",
+    Buffer.isBuffer(coerce(new Uint8Array([3, 4]), "field")));
+  var bcErr = null;
+  try { coerce("nope", "myField"); } catch (e) { bcErr = e; }
+  check("makeByteCoercer: type mismatch throws the bound class with interpolated message",
+    bcErr instanceof FakeErr && bcErr.code === "fake/bad-bytes" &&
+    bcErr.message === "fake: myField must be bytes");
+
+  // encoding variant: an encoded string is accepted + decoded.
+  var hexCoerce = sb.makeByteCoercer({
+    errorClass: FakeErr, typeCode: "fake/hex",
+    messagePrefix: "fake: ", messageSuffix: " must be hex", encoding: "hex",
+  });
+  check("makeByteCoercer: encoding accepts + decodes an encoded string",
+    hexCoerce("0102", "h").length === 2 && hexCoerce("0102", "h")[0] === 1);
+
+  // config-time validation.
+  function bcRejects(label, fn) {
+    var threw = null; try { fn(); } catch (e) { threw = e; }
+    check("makeByteCoercer: rejects " + label, threw && threw.code === "buffer/bad-arg");
+  }
+  bcRejects("missing opts",      function () { sb.makeByteCoercer(); });
+  bcRejects("non-fn errorClass", function () { sb.makeByteCoercer({ errorClass: 5, typeCode: "x" }); });
+  bcRejects("empty typeCode",    function () { sb.makeByteCoercer({ errorClass: FakeErr, typeCode: "" }); });
 }
 
 module.exports = { run: run };

package/lib/vendor/blamejs/test/layer-0-primitives/safe-jsonpath.test.js

@@ -23,7 +23,21 @@ function _throws(label, fn, codeRe) {
     threw && (codeRe ? codeRe.test(threw.code || "") || codeRe.test(threw.message || "") : true));
 }
 
+function testByteCapMultibyte() {
+  // MAX_KEY_BYTES / MAX_EXPRESSION_BYTES (and opts.maxBytes) are BYTE caps.
+  var mb = String.fromCharCode(0x4e2d); // one 3-byte UTF-8 char
+  var t1 = null;
+  try { b.safeJsonPath.validateKey(mb.repeat(5), { maxBytes: 10 }); } catch (e) { t1 = e; }
+  check("safeJsonPath byte-cap: multibyte key over byte cap refused",
+    t1 && t1.code === "safe-jsonpath/key-too-long");
+  var t2 = null;
+  try { b.safeJsonPath.validateExpression("$." + mb.repeat(5), { maxBytes: 10 }); } catch (e) { t2 = e; }
+  check("safeJsonPath byte-cap: multibyte expression over byte cap refused",
+    t2 && t2.code === "safe-jsonpath/expression-too-long");
+}
+
 function run() {
+  testByteCapMultibyte();
   // ---- validateKey ----
   check("validateKey accepts plain key",
     safeJsonPath.validateKey("role") === "role");

package/lib/vendor/blamejs/test/layer-0-primitives/sandbox.test.js

@@ -200,7 +200,26 @@ function testErrorClassExposed() {
         typeof b.sandbox.SandboxError === "function");
 }
 
+async function testByteCapMultibyte() {
+  // maxBytes (input) and maxResultBytes (= maxBytes/4) are BYTE caps. A
+  // multibyte payload under the char count but over the byte cap must be refused.
+  var sandboxC = require("../../lib/constants");
+  var floor = sandboxC.BYTES.mib(4); // MIN_MAX_BYTES
+  var bigInput = String.fromCharCode(0x4e2d).repeat(1500000); // 1.5M chars / 4.5M UTF-8 bytes
+  var t1 = null;
+  try { await b.sandbox.run({ source: "return null;", input: bigInput, maxBytes: floor, timeoutMs: 10000 }); }
+  catch (e) { t1 = e; }
+  check("sandbox byte-cap: oversize multibyte input refused as input-too-large",
+    t1 && t1.code === "sandbox/input-too-large");
+  var t2 = null;
+  try { await b.sandbox.run({ source: "return String.fromCharCode(0x4e2d).repeat(400000);", maxBytes: floor, timeoutMs: 10000 }); }
+  catch (e) { t2 = e; }
+  check("sandbox byte-cap: oversize multibyte result refused as oversized-result",
+    t2 && t2.code === "sandbox/oversized-result");
+}
+
 async function run() {
+  await testByteCapMultibyte();
   testErrorClassExposed();
   await testHappyPath();
   await testAllowedBuiltins();

package/lib/vendor/blamejs/test/layer-0-primitives/security-headers.test.js

@@ -310,6 +310,6 @@ module.exports = { run: run };
 if (require.main === module) {
   run().then(
     function () { console.log("OK — " + helpers.getChecks() + " checks passed"); },
-    function (e) { console.error("FAIL:", e.message); process.exit(1); }
+    function (e) { console.error("FAIL: " + helpers.formatErr(e)); process.exit(1); }
   );
 }

package/lib/vendor/blamejs/test/layer-0-primitives/self-update.test.js

@@ -24,8 +24,9 @@ var helpers = require("../helpers");
 var b       = helpers.b;
 var check   = helpers.check;
 
+var _tmpBase = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-selfupdate-"));
 function _tmp(name) {
-  return path.join(os.tmpdir(), "blamejs-selfupdate-" + Date.now() + "-" +
+  return path.join(_tmpBase, Date.now() + "-" +
     Math.random().toString(36).slice(2, 8) + "-" + name);
 }
 

package/lib/vendor/blamejs/test/layer-0-primitives/session-device-binding.test.js

@@ -222,8 +222,26 @@ async function testUnbind() {
   check("store cleared after unbind", !store.data.has(token));
 }
 
+function testNamespaceFingerprint() {
+  // The namespace-level b.sessionDeviceBinding.fingerprint(req, opts?) is the
+  // stateless device-hash helper (distinct from an instance's bound method):
+  // deterministic for identical request shape, divergent when a bound
+  // component changes.
+  check("b.sessionDeviceBinding.fingerprint is a function",
+    typeof b.sessionDeviceBinding.fingerprint === "function");
+  var fp1 = b.sessionDeviceBinding.fingerprint(_mockReq());
+  var fp2 = b.sessionDeviceBinding.fingerprint(_mockReq());
+  check("namespace fingerprint: returns a Buffer", Buffer.isBuffer(fp1));
+  check("namespace fingerprint: deterministic for identical requests", fp1.equals(fp2));
+  var other = _mockReq();
+  other.headers = Object.assign({}, other.headers, { "user-agent": "Totally-Different/9.9" });
+  var fp3 = b.sessionDeviceBinding.fingerprint(other);
+  check("namespace fingerprint: diverges when a bound component changes", !fp1.equals(fp3));
+}
+
 async function run() {
   testSurface();
+  testNamespaceFingerprint();
   testCreateRejectsBadOpts();
   await testBindAndVerifyHappyPath();
   await testVerifyDriftRefuses();

package/lib/vendor/blamejs/test/layer-0-primitives/session-extensions.test.js

@@ -189,7 +189,7 @@ async function testPluggableStoreValidation() {
 
   threw = false;
   try { b.session.useStore("not-an-object"); }
-  catch (e) { threw = /must expose execute/.test(e.message); }
+  catch (e) { threw = /must be an object exposing/.test(e.message) && e.code === "INVALID_ARG" && e.permanent === true; }
   check("useStore: non-object refused", threw);
 
   threw = false;