@blamejs/blamejs-shop 0.4.56 → 0.4.58

package/lib/vendor/blamejs/test/layer-0-primitives/mail-auth.test.js

@@ -11,6 +11,7 @@
 var helpers = require("../helpers");
 var b       = helpers.b;
 var check   = helpers.check;
+var arcSign = require("../../lib/mail-arc-sign");
 
 function testSurface() {
   check("mail.spf.verify is a function",       typeof b.mail.spf.verify === "function");
@@ -1376,8 +1377,46 @@ async function testSpfMechanismPtrRemainsDeferred() {
         rv.result === "permerror" && /5\.5/.test(rv.explanation || ""));
 }
 
+// ARC canon-source header parser — byte-exact golden lock. The AMS/AS
+// signatures are computed over the bytes this parser extracts; a sign->verify
+// round-trip shares the parser and so cannot catch a byte-error (it would only
+// surface as a rejection at a real ARC verifier). ARC's relaxed-canon parser
+// STRIPS leading WSP from the value (vs DKIM's simple-canon parser, which
+// preserves it) and PRESERVES the raw CRLF of a folded continuation.
+function testArcHeaderParserGolden() {
+  var ph = arcSign._parseHeaderBlockForTest;
+  function eq(label, raw, expected) {
+    check("arc parser: " + label, JSON.stringify(ph(raw)) === JSON.stringify(expected));
+  }
+  eq("relaxed parser STRIPS leading WSP from value",
+     "From: a@b.com",
+     [{ name: "From", value: "a@b.com" }]);
+  eq("leading SP + TAB stripped",
+     "X: \tvalue",
+     [{ name: "X", value: "value" }]);
+  eq("folded continuation keeps raw CRLF + line",
+     "From: a@b.com\r\nSubject: hello\r\n world",
+     [{ name: "From", value: "a@b.com" },
+      { name: "Subject", value: "hello\r\n world" }]);
+  eq("exact name, order preserved across a colon-less line",
+     "From: a@b.com\r\ngarbage\r\nTo: c@d.com",
+     [{ name: "From", value: "a@b.com" },
+      { name: "To", value: "c@d.com" }]);
+}
+
+function testByteCapMultibyte() {
+  // dmarc.parseForensicReport maxBytes is a BYTE cap; it returns an error
+  // object (does not throw) on refusal.
+  var report = String.fromCharCode(0x4e2d).repeat(20); // 60 UTF-8 bytes; cap 30
+  var r = b.mail.dmarc.parseForensicReport(report, { maxBytes: 30 });
+  check("dmarc-ruf byte-cap: multibyte report over byte cap rejected",
+    r && r.ok === false && r.error && r.error.code === "mail-auth/dmarc-ruf-too-large");
+}
+
 async function run() {
+  testByteCapMultibyte();
   testSurface();
+  testArcHeaderParserGolden();
   testSpfParse();
   testSpfBadRecord();
   await testSpfVerifyMockedDns();

package/lib/vendor/blamejs/test/layer-0-primitives/mail-dkim.test.js

@@ -90,6 +90,41 @@ function testDkimCanonicalization() {
   check("simple body: keeps interior WSP",        sb("hello   world\r\n") === "hello   world\r\n");
 }
 
+// ---- Header-block parser (the bytes the canonicalizers consume) ----
+//
+// The sign->verify round-trip CANNOT catch a parser byte-error: both sides run
+// this same parser, so a wrong { name, value } extraction is self-consistent
+// and the round-trip still passes — it would only surface as a signature
+// rejection at a real external verifier (Gmail / opendkim) computing from the
+// raw message. So pin the parser's byte-exact output directly. The two
+// signature-critical invariants: the value PRESERVES its leading SP/WSP (simple
+// canon signs those bytes verbatim), and a folded continuation PRESERVES the
+// raw CRLF + continuation line (relaxed canon unfolds it itself; collapsing it
+// in the parser would change the signed bytes).
+function testDkimHeaderParserGolden() {
+  var ph = b.mail.dkim._parseHeadersForTest;
+  function eq(label, raw, expected) {
+    check("parser: " + label, JSON.stringify(ph(raw)) === JSON.stringify(expected));
+  }
+  eq("simple field preserves leading SP in value",
+     "From: a@b.com",
+     [{ name: "From", value: " a@b.com" }]);
+  eq("value preserves leading SP + TAB verbatim",
+     "X: \tvalue",
+     [{ name: "X", value: " \tvalue" }]);
+  eq("SP-folded continuation keeps raw CRLF + line",
+     "From: a@b.com\r\nSubject: hello\r\n world",
+     [{ name: "From", value: " a@b.com" },
+      { name: "Subject", value: " hello\r\n world" }]);
+  eq("TAB-folded continuation keeps raw CRLF + TAB line",
+     "Subject: a\r\n\tb",
+     [{ name: "Subject", value: " a\r\n\tb" }]);
+  eq("exact field name (no trim), order preserved across a colon-less line",
+     "From: a@b.com\r\ngarbage-no-colon\r\nTo: c@d.com",
+     [{ name: "From", value: " a@b.com" },
+      { name: "To", value: " c@d.com" }]);
+}
+
 // ---- RSA-SHA256 sign + verify round-trip ----
 
 function _splitSignedRfc822(signed) {
@@ -594,6 +629,7 @@ function testDkimStripBTagValueAnchored() {
 async function run() {
   testDkimSurfaceAndValidation();
   testDkimCanonicalization();
+  testDkimHeaderParserGolden();
   testDkimRsaSignProducesHeader();
   testDkimEd25519Sign();
   testDkimSignerRejectsBadInput();

package/lib/vendor/blamejs/test/layer-0-primitives/mail-greylist.test.js

@@ -180,6 +180,22 @@ async function testGc() {
   check("gc removed at least 1",        r.removed >= 1);
 }
 
+async function testMaxEntriesEvictsOldest() {
+  // The in-memory backend caps entry count via boundedMap (evict-oldest). At
+  // maxEntries=2, recording a 3rd distinct triplet evicts the 1st — so the 1st
+  // is first-seen again on re-check rather than retry-too-soon. Distinct /24
+  // subnets so the triplets don't CIDR-aggregate into one fingerprint.
+  var gl = b.mail.greylist.create({ maxEntries: 2 });
+  await gl.check(_ctx({ ip: "198.51.100.1" }));   // entry 1
+  await gl.check(_ctx({ ip: "203.0.113.1" }));    // entry 2 — at cap
+  await gl.check(_ctx({ ip: "192.0.2.1" }));      // entry 3 — evicts entry 1
+  var v = await gl.check(_ctx({ ip: "198.51.100.1" }));
+  check("maxEntries: oldest triplet evicted → first-seen again", v.reason === "first-seen");
+  // Entry 3 (most recent) is still present → retry-too-soon, not evicted.
+  var v3 = await gl.check(_ctx({ ip: "192.0.2.1" }));
+  check("maxEntries: newest triplet retained", v3.reason === "retry-too-soon");
+}
+
 async function testFingerprintHashStable() {
   var fp1 = b.mail.greylist._hashFingerprint("203.0.113.0/24", "a@b.com", "c@d.com");
   var fp2 = b.mail.greylist._hashFingerprint("203.0.113.0/24", "a@b.com", "c@d.com");
@@ -206,6 +222,7 @@ async function run() {
   await testCompliancePosture();
   await testProfileResolution();
   await testGc();
+  await testMaxEntriesEvictsOldest();
   await testFingerprintHashStable();
 }
 

package/lib/vendor/blamejs/test/layer-0-primitives/mail-server-tls.test.js

@@ -28,6 +28,45 @@ async function run() {
   var modSurface = b.mail.server.tls;
   check("surface: context is fn",            typeof modSurface.context === "function");
   check("surface: MailServerTlsError class", typeof modSurface.MailServerTlsError === "function");
+  check("surface: upgradeSocket is fn",       typeof modSurface.upgradeSocket === "function");
+  check("surface: upgradeLineProtocol is fn", typeof modSurface.upgradeLineProtocol === "function");
+
+  // ---- upgradeLineProtocol: config-time validation (§8 entry-point) ----
+  var ulpBad = [];
+  try { modSurface.upgradeLineProtocol(); }              catch (e) { ulpBad.push(e); }
+  try { modSurface.upgradeLineProtocol({}); }            catch (e) { ulpBad.push(e); }
+  try { modSurface.upgradeLineProtocol({ state: {} }); } catch (e) { ulpBad.push(e); }
+  check("upgradeLineProtocol throws on missing opts",  ulpBad[0] && /opts required/.test(ulpBad[0].message));
+  check("upgradeLineProtocol throws on missing state", ulpBad[1] && /state/.test(ulpBad[1].message));
+  check("upgradeLineProtocol throws on missing drain", ulpBad[2] && /drain/.test(ulpBad[2].message));
+
+  // ---- upgradeLineProtocol: the STARTTLS-injection drain runs BEFORE the
+  // upgrade (CVE-2021-33515 / CVE-2021-38371). With a non-socket the inner
+  // upgradeSocket throws, but the pre-handshake state MUST already be wiped.
+  var injState = {
+    lineBuffer:     Buffer.from("A001 LOGIN pipelined-pre-handshake\r\n"),
+    pendingLiteral: { bytes: 42 },
+    authPending:    "half-sasl-token",
+    tls:            false,
+  };
+  var injThrew = null;
+  try {
+    modSurface.upgradeLineProtocol({
+      state:         injState,
+      socket:        {},               // not a net.Socket → inner upgradeSocket throws
+      secureContext: {},
+      idleTimeoutMs: 1000,
+      clearFields:   ["pendingLiteral", "authPending"],
+      drain:         function () {},
+      onError:       function () {},
+    });
+  } catch (e) { injThrew = e; }
+  check("upgradeLineProtocol rejects a non-socket (via upgradeSocket)",
+    injThrew && /plainSocket/.test(injThrew.message));
+  check("injection drain: lineBuffer emptied even when the upgrade fails",
+    injState.lineBuffer.length === 0);
+  check("injection drain: clearFields[0] (pendingLiteral) nulled", injState.pendingLiteral === null);
+  check("injection drain: clearFields[1] (authPending) nulled",    injState.authPending === null);
 
   // ---- happy path: plain PEM files load + return a SecureContext ----
   var tmp1 = _mkTmpDir("happy");

package/lib/vendor/blamejs/test/layer-0-primitives/mail-store.test.js

@@ -371,7 +371,24 @@ async function testRefusesBadBackend() {
         threw && (threw.code || "").indexOf("mail-store/bad-backend") !== -1);
 }
 
+async function testByteCapMultibyte() {
+  // maxBodyBytes is a BYTE cap on the decoded body text. A multibyte body
+  // under the char count but over the byte cap must be refused.
+  var fx = await _setupStore("bytecap");
+  try {
+    var store = b.mailStore.create({ backend: fx.db, maxBodyBytes: 30 });
+    var mb = String.fromCharCode(0x4e2d).repeat(15); // 15 chars / 45 UTF-8 bytes; cap 30
+    var msg = _msg(["From: a@example.com", "To: b@example.com", "Subject: x",
+      "Date: Wed, 14 May 2026 12:00:00 +0000", "Content-Type: text/plain; charset=utf-8"], mb);
+    var threw = null;
+    try { store.appendMessage("INBOX", msg); } catch (e) { threw = e; }
+    check("mailStore byte-cap: multibyte body over byte cap refused",
+      threw && threw.code === "mail-store/oversize-body");
+  } finally { _teardown(fx); }
+}
+
 async function run() {
+  await testByteCapMultibyte();
   testSurface();
   await testBootstrap();
   await testAppendFetchRoundtrip();

package/lib/vendor/blamejs/test/layer-0-primitives/mime-parse.test.js

@@ -0,0 +1,106 @@
+"use strict";
+/**
+ * mime-parse — RFC 5322 / 2045 header-block + MIME structure parsing shared by
+ * the mail stack (email, dsn, arf, auth, bounce). Covers the header-block
+ * classifier (fields / malformed / folding / header-body boundary), the
+ * parseHeaderBlock fields view, header/body bisection, Content-Type parsing,
+ * case-insensitive header lookup, and multipart partitioning.
+ *
+ * classifyHeaderBlock.malformed is the header-injection signal (a header-section
+ * line that is neither a `name: value` field nor a folding continuation) that
+ * the silent-skip parsers used to drop; guard-email consumes it.
+ */
+
+var helpers = require("../helpers");
+var check   = helpers.check;
+var mp      = require("../../lib/mime-parse");
+
+function _eq(label, actual, expected) {
+  check(label, JSON.stringify(actual) === JSON.stringify(expected));
+}
+
+function testClassifyHeaderBlockFields() {
+  var r = mp.classifyHeaderBlock("A: 1\r\nB: 2\r\n boldfold\r\n\r\nbody");
+  _eq("classify: fields parsed, folding collapsed to single SP",
+    r.fields, [{ name: "A", value: "1" }, { name: "B", value: "2 boldfold" }]);
+  check("classify: clean block has no malformed lines", r.malformed.length === 0);
+}
+
+function testClassifyHeaderBlockMalformed() {
+  var r = mp.classifyHeaderBlock("garbage\r\nTo: x@y.com");
+  _eq("classify: a colon-less header-section line is malformed (injection signal)",
+    r.malformed, [{ lineIndex: 0, line: "garbage", reason: "no-colon" }]);
+  _eq("classify: the valid field after it still parses",
+    r.fields, [{ name: "To", value: "x@y.com" }]);
+}
+
+function testClassifyHeaderBlockBoundary() {
+  // A non-field line AFTER the blank header/body boundary is BODY — not flagged.
+  var r = mp.classifyHeaderBlock("A: 1\r\n\r\nnot-a-header-line");
+  check("classify: boundary-aware — body lines are not malformed", r.malformed.length === 0);
+  _eq("classify: only the header section is parsed into fields",
+    r.fields, [{ name: "A", value: "1" }]);
+}
+
+function testClassifyHeaderBlockBadInput() {
+  check("classify: null → empty structure", mp.classifyHeaderBlock(null).fields.length === 0);
+  check("classify: undefined → empty structure", mp.classifyHeaderBlock(undefined).malformed.length === 0);
+}
+
+function testParseHeaderBlockIsFieldsView() {
+  _eq("parseHeaderBlock returns the classifier's fields",
+    mp.parseHeaderBlock("From: a\r\nTo: b"),
+    [{ name: "From", value: "a" }, { name: "To", value: "b" }]);
+  // Equivalence with classifyHeaderBlock.fields on the same input.
+  var raw = "Subject: hi\r\n there\r\nFrom: a@b.com";
+  _eq("parseHeaderBlock === classifyHeaderBlock(x).fields",
+    mp.parseHeaderBlock(raw), mp.classifyHeaderBlock(raw).fields);
+}
+
+function testSplitHeadersAndBody() {
+  var s = mp.splitHeadersAndBody("H: v\r\n\r\nthe body\r\nline2");
+  _eq("split: header section parsed", s.headers, [{ name: "H", value: "v" }]);
+  check("split: body preserved verbatim after the blank line", s.body === "the body\r\nline2");
+  var none = mp.splitHeadersAndBody("H: v\r\nI: w");
+  check("split: no blank line → empty body", none.body === "");
+}
+
+function testParseContentType() {
+  var ct = mp.parseContentType("text/html; charset=utf-8; boundary=xyz");
+  check("parseContentType: type lowercased", ct.type === "text/html");
+  check("parseContentType: charset param", ct.params.charset === "utf-8");
+  check("parseContentType: boundary param", ct.params.boundary === "xyz");
+}
+
+function testFindHeader() {
+  var hs = [{ name: "From", value: "a" }, { name: "to", value: "b" }];
+  check("findHeader: case-insensitive match", mp.findHeader(hs, "TO") === "b");
+  check("findHeader: missing → null/undefined", !mp.findHeader(hs, "Subject"));
+}
+
+function testSplitMimeParts() {
+  _eq("splitMimeParts: partitions on --boundary, drops preamble + close",
+    mp.splitMimeParts("preamble\r\n--bnd\r\npart1\r\n--bnd\r\npart2\r\n--bnd--\r\n", "bnd"),
+    ["part1", "part2"]);
+  _eq("splitMimeParts: empty boundary → no parts",
+    mp.splitMimeParts("anything", ""), []);
+}
+
+function run() {
+  testClassifyHeaderBlockFields();
+  testClassifyHeaderBlockMalformed();
+  testClassifyHeaderBlockBoundary();
+  testClassifyHeaderBlockBadInput();
+  testParseHeaderBlockIsFieldsView();
+  testSplitHeadersAndBody();
+  testParseContentType();
+  testFindHeader();
+  testSplitMimeParts();
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  try { run(); console.log("[mime-parse] OK — " + helpers.getChecks() + " checks passed"); }
+  catch (e) { console.error("FAIL:", e.stack || e); process.exit(1); }
+}

package/lib/vendor/blamejs/test/layer-0-primitives/money.test.js

@@ -20,7 +20,24 @@ function run() {
   check("b.money.convert function",         typeof b.money.convert === "function");
   check("b.money.CURRENCIES exposed",       typeof b.money.CURRENCIES === "object");
   check("b.money.MoneyError exposed",       typeof b.money.MoneyError === "function");
+  check("b.money.roundMinor function",      typeof b.money.roundMinor === "function");
   check("b.money.Money class exposed",      typeof b.money.Money === "function");
+
+  // ---- roundMinor: cash-rounding to an increment (BigInt minor units) ----
+  check("roundMinor: CHF 12.32 → nearest 0.05 (half-even)", b.money.roundMinor(1232n, 5n) === 1230n);
+  check("roundMinor: tie → half-even picks even multiple",  b.money.roundMinor(25n, 10n, "half-even") === 20n);
+  check("roundMinor: tie → half-up away from zero",         b.money.roundMinor(25n, 10n, "half-up") === 30n);
+  check("roundMinor: negative tie → half-up away from zero", b.money.roundMinor(-25n, 10n, "half-up") === -30n);
+  check("roundMinor: floor toward -inf",                    b.money.roundMinor(27n, 10n, "floor") === 20n);
+  check("roundMinor: ceiling toward +inf",                  b.money.roundMinor(21n, 10n, "ceiling") === 30n);
+  check("roundMinor: exact multiple returns unchanged",     b.money.roundMinor(30n, 10n) === 30n);
+  check("roundMinor: safe-integer Number coerced to BigInt", b.money.roundMinor(25, 10n, "half-up") === 30n);
+  check("roundMinor: bad mode throws money/bad-rounding-mode",
+        (function () { try { b.money.roundMinor(10n, 5n, "nope"); return null; } catch (e) { return e.code; } })()
+          === "money/bad-rounding-mode");
+  check("roundMinor: non-integer minor throws money/bad-minor-units",
+        (function () { try { b.money.roundMinor(1.5, 5n); return null; } catch (e) { return e.code; } })()
+          === "money/bad-minor-units");
   check("b.money.Money is the prototype",   b.money.of("1.00", "USD") instanceof b.money.Money);
   check("CURRENCIES is frozen",             Object.isFrozen(b.money.CURRENCIES));
   check("CURRENCIES.USD exponent",          b.money.CURRENCIES.USD === 2);

package/lib/vendor/blamejs/test/layer-0-primitives/mtls-ca-revocation.test.js

@@ -0,0 +1,98 @@
+"use strict";
+/**
+ * b.mtlsCa revocation + issuance identity (#322).
+ *
+ * The require-mtls gate denies by SHA3-512 fingerprint, but revocation used to
+ * be keyed only by serial, the registry could only be a plaintext file, and
+ * issuance discarded the serial + fingerprint. This proves the three additive
+ * fixes: fingerprint-addressable revoke()/isRevoked(), a bring-your-own
+ * revocation store, and serial+fingerprint surfaced from issuance.
+ */
+
+var helpers = require("../helpers");
+var b     = helpers.b;
+var check = helpers.check;
+var fs   = require("fs");
+var os   = require("os");
+var path = require("path");
+
+async function run() {
+  var dir = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-mtls-revoke-"));
+  var ca = b.mtlsCa.create({ dataDir: dir, caKeySealedMode: "disabled", generation: 1 });
+
+  // ---- #322 part 3: issuance surfaces serial + fingerprint ----
+  var issued = await ca.generateClientCert({ cn: "client-1" });
+  check("issuance surfaces a hex serialNumber",
+    typeof issued.serialNumber === "string" && /^[0-9a-f]+$/.test(issued.serialNumber));
+  check("issuance surfaces a 128-hex SHA3-512 fingerprint",
+    typeof issued.fingerprint === "string" && issued.fingerprint.length === 128);
+  check("the surfaced fingerprint equals the gate's b.crypto.sha3Hash(cert)",
+    issued.fingerprint === b.crypto.sha3Hash(issued.cert));
+
+  // ---- #322 part 1: revoke + isRevoked by serial (backward-compat) ----
+  ca.revoke(issued.serialNumber, { reason: "superseded" });
+  check("revoke(serial) then isRevoked(serial) is true", ca.isRevoked(issued.serialNumber) === true);
+  check("a serial that was never revoked reads false", ca.isRevoked("00ff") === false);
+  var first = ca.revoke(issued.serialNumber);
+  var again = ca.revoke(issued.serialNumber);
+  check("revoke is idempotent (revokedAt unchanged)", first.revokedAt === again.revokedAt);
+
+  // ---- #322 part 1: revoke + isRevoked by fingerprint (the gate's key) ----
+  var issued2 = await ca.generateClientCert({ cn: "client-2" });
+  ca.revoke({ fingerprint: issued2.fingerprint, reason: "keyCompromise" });
+  check("revoke({fingerprint}) then isRevoked(fingerprint) is true",
+    ca.isRevoked(issued2.fingerprint) === true);
+  check("isRevoked tolerates separator/case formatting",
+    ca.isRevoked(issued2.fingerprint.toUpperCase()) === true);
+
+  var threwNoKey = false;
+  try { ca.revoke({ reason: "x" }); } catch (e) { threwNoKey = /no-revocation-key/.test(e.code || ""); }
+  check("revoke with neither serial nor fingerprint throws", threwNoKey);
+
+  // ---- #322 part 2: bring-your-own revocation store ----
+  var rows = [];
+  var store = { list: function () { return rows.slice(); }, add: function (e) { rows.push(e); } };
+  var dir2 = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-mtls-byostore-"));
+  var ca2 = b.mtlsCa.create({ dataDir: dir2, caKeySealedMode: "disabled", revocationStore: store });
+  ca2.revoke("AB:CD:EF", { reason: "cessationOfOperation" });
+  check("BYO store: revoke writes through the operator store (normalized serial)",
+    rows.length === 1 && rows[0].serialNumber === "abcdef");
+  check("BYO store: isRevoked reads through the operator store", ca2.isRevoked("abcdef") === true);
+  check("BYO store: the default revocations.json was not written",
+    !fs.existsSync(path.join(dir2, "revocations.json")));
+
+  var threwBadStore = false;
+  try {
+    b.mtlsCa.create({ dataDir: dir2, caKeySealedMode: "disabled", revocationStore: { list: 1 } });
+  } catch (e) { threwBadStore = /bad-revocation-store/.test(e.code || ""); }
+  check("a revocationStore missing list()/add() is refused at create()", threwBadStore);
+
+  // ---- #322 part 3: a custom engine may return a non-X.509 cert shape ----
+  // The serial comes from an X.509 parse (best-effort); the fingerprint is a
+  // hash of the returned bytes (always available). Optional identity
+  // enrichment must never crash issuance.
+  var dir3 = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-mtls-stub-"));
+  var stubEngine = {
+    generateCa: async function () {
+      return { caCertPem: "ENGINE-CA", caKeyPem: "ENGINE-KEY", generation: 1 };
+    },
+    signClientCert: async function (a) {
+      return { cert: "-----BEGIN CERTIFICATE-----\nNOT-X509-" + a.cn + "\n-----END CERTIFICATE-----\n", key: "k" };
+    },
+  };
+  var ca3 = b.mtlsCa.create({ dataDir: dir3, engine: stubEngine, caKeySealedMode: "disabled" });
+  var stub = await ca3.generateClientCert({ cn: "stub-client" });
+  check("non-X.509 engine cert does not crash issuance", typeof stub.cert === "string");
+  check("unparseable cert yields serialNumber null (best-effort)", stub.serialNumber === null);
+  check("fingerprint is still surfaced for a non-X.509 cert", stub.fingerprint === b.crypto.sha3Hash(stub.cert));
+  ca3.revoke({ fingerprint: stub.fingerprint });
+  check("a non-X.509 cert is still revocable by fingerprint", ca3.isRevoked(stub.fingerprint) === true);
+
+  try {
+    fs.rmSync(dir, { recursive: true, force: true });
+    fs.rmSync(dir2, { recursive: true, force: true });
+    fs.rmSync(dir3, { recursive: true, force: true });
+  } catch (_e) { /* best-effort */ }
+}
+
+module.exports = { run: run };

package/lib/vendor/blamejs/test/layer-0-primitives/nonce-store-release.test.js

@@ -0,0 +1,77 @@
+"use strict";
+/**
+ * b.nonceStore.release(nonce) — the rollback half of reserve -> commit ->
+ * rollback (#325).
+ *
+ * An eager checkAndInsert claim with no un-claim inverts the at-least-once
+ * contract: when downstream processing fails and the provider redelivers, the
+ * already-claimed id reads as a replay and the event is dropped. release()
+ * un-claims so the redelivery is reprocessed. The cluster backend's release
+ * (DELETE by nonce hash) is exercised in the live-integration suite; here we
+ * cover the memory + custom backends.
+ */
+
+var helpers = require("../helpers");
+var b     = helpers.b;
+var check = helpers.check;
+
+async function run() {
+  var exp = Date.now() + 60000;
+
+  // ---- memory backend: reserve -> replay -> release -> re-reserve ----
+  var s = b.nonceStore.create({ backend: "memory" });
+  check("#325 first claim wins (reserve)", (await s.checkAndInsert("evt-1", exp)) === true);
+  check("#325 a concurrent duplicate reads as replay", (await s.checkAndInsert("evt-1", exp)) === false);
+  check("#325 release un-claims a live nonce (returns true)", (await s.release("evt-1")) === true);
+  check("#325 a redelivery after release is reprocessed (re-claim wins)",
+    (await s.checkAndInsert("evt-1", exp)) === true);
+  check("#325 commit path: WITHOUT release the duplicate stays suppressed",
+    (await s.checkAndInsert("evt-1", exp)) === false);
+  check("#325 release of a never-claimed nonce returns false", (await s.release("never-seen")) === false);
+
+  var threwBad = false;
+  try { await s.release(""); } catch (e) { threwBad = /INVALID_NONCE/.test(e.code || ""); }
+  check("#325 release rejects an empty nonce", threwBad);
+  s.close();
+
+  // ---- custom backend: release forwarded when present, loud when absent ----
+  var forwarded = null;
+  var withRelease = b.nonceStore.create({ backend: {
+    checkAndInsert: function () { return Promise.resolve(true); },
+    release:        function (n) { forwarded = n; return Promise.resolve(true); },
+  } });
+  await withRelease.release("evt-Z");
+  check("#325 a custom backend's release() is forwarded", forwarded === "evt-Z");
+
+  var withoutRelease = b.nonceStore.create({ backend: {
+    checkAndInsert: function () { return Promise.resolve(true); },
+  } });
+  var threwNoRel = false;
+  try { await withoutRelease.release("x"); } catch (e) { threwNoRel = /BACKEND_NO_RELEASE/.test(e.code || ""); }
+  check("#325 a custom backend without release() fails loudly (no silent dropped rollback)", threwNoRel);
+
+  // ---- enforceReplay: first use passes; replay refused; store-throw fails closed ----
+  function RErr(code, message) { this.code = code; this.message = message; }
+  var ropts = { errorClass: RErr, storeFailedCode: "x/store-failed", replayCode: "x/replay", tokenLabel: "token" };
+  var rs = b.nonceStore.create({ backend: "memory" });
+  await b.nonceStore.enforceReplay(rs, "jti-A", exp, ropts);
+  check("enforceReplay: first use of a jti passes (no throw)", true);
+  var replayErr = null;
+  try { await b.nonceStore.enforceReplay(rs, "jti-A", exp, ropts); } catch (e) { replayErr = e; }
+  check("enforceReplay: a re-used jti is refused with the replay code + message",
+    replayErr instanceof RErr && replayErr.code === "x/replay" &&
+    replayErr.message === "token jti='jti-A' has been seen before — replay refused");
+  rs.close();
+
+  // A store failure must fail CLOSED (store-failed error), never silently pass.
+  var failStore = b.nonceStore.create({ backend: {
+    checkAndInsert: function () { return Promise.reject(new Error("db down")); },
+  } });
+  var storeErr = null;
+  try { await b.nonceStore.enforceReplay(failStore, "jti-B", exp, ropts); } catch (e) { storeErr = e; }
+  check("enforceReplay: a store failure fails closed (store-failed code, not a pass)",
+    storeErr instanceof RErr && storeErr.code === "x/store-failed" &&
+    storeErr.message.indexOf("replayStore.checkAndInsert threw: db down") === 0);
+}
+
+module.exports = { run: run };

package/lib/vendor/blamejs/test/layer-0-primitives/observability.test.js

@@ -201,6 +201,52 @@ function testObservabilitySemconvK8sAttributes() {
   check("SEMCONV.K8S_REPLICASET_NAME", S.K8S_REPLICASET_NAME === "k8s.replicaset.name");
 }
 
+// b.observability.namespaced — the drop-silent prefixed metric emitter every
+// primitive used to hand-roll as a private _emitMetric closure.
+function testObservabilityNamespaced() {
+  check("b.observability.namespaced is a function",
+        typeof b.observability.namespaced === "function");
+  var seen = [];
+  var orig = b.observability.safeEvent;            // late-bound — the stub is observed
+  b.observability.safeEvent = function (name, n, labels) {
+    seen.push({ name: name, n: n, labels: labels });
+  };
+  try {
+    var emit = b.observability.namespaced("network.byte_quota");
+    emit("exceeded", 5, { key: "k" });
+    emit("reset");                                 // value → 1, labels → {}
+    var gated = b.observability.namespaced("middleware.tusUpload", false);
+    gated("create.ok");                            // gateFlag false → no-op
+  } finally {
+    b.observability.safeEvent = orig;
+  }
+  check("namespaced prefixes the name + passes value/labels through",
+        seen[0].name === "network.byte_quota.exceeded" && seen[0].n === 5 && seen[0].labels.key === "k");
+  check("namespaced defaults value to 1 and labels to {}",
+        seen[1].name === "network.byte_quota.reset" && seen[1].n === 1 &&
+        JSON.stringify(seen[1].labels) === "{}");
+  check("namespaced(prefix, false) is a no-op",
+        !seen.some(function (e) { return e.name === "middleware.tusUpload.create.ok"; }));
+}
+
+// b.observability.makeCounterEmitter — the per-instance counter sibling of
+// namespaced, every primitive used to hand-roll as a private _emitObs closure.
+function testObservabilityMakeCounterEmitter() {
+  check("b.observability.makeCounterEmitter is a function",
+        typeof b.observability.makeCounterEmitter === "function");
+  var sinkSeen = [];
+  var sink = { event: function (name, value, labels) { sinkSeen.push({ name: name, value: value, labels: labels }); } };
+  var emit = b.observability.makeCounterEmitter(sink);
+  emit("auth.lockout.tripped", { actor: "alice" });
+  check("makeCounterEmitter emits value 1 + name + labels to the sink",
+        sinkSeen.length === 1 && sinkSeen[0].name === "auth.lockout.tripped" &&
+        sinkSeen[0].value === 1 && sinkSeen[0].labels.actor === "alice");
+  var threw = false;
+  try { b.observability.makeCounterEmitter({ event: function () { throw new Error("sink down"); } })("x"); }
+  catch (_e) { threw = true; }
+  check("makeCounterEmitter is drop-silent on a sink throw", threw === false);
+}
+
 async function run() {
   testObservabilitySurface();
   testObservabilityTapRunsFnWithoutRegistries();
@@ -217,6 +263,8 @@ async function run() {
   testObservabilityEventDropsBadName();
   testObservabilitySemconvResourceAttributes();
   testObservabilitySemconvK8sAttributes();
+  testObservabilityNamespaced();
+  testObservabilityMakeCounterEmitter();
 }
 
 module.exports = { run: run };