@blamejs/blamejs-shop 0.4.68 → 0.4.70

package/lib/vendor/blamejs/lib/http-client.js

@@ -716,6 +716,9 @@ function _stripCrossOriginAuth(headers) {
  *   responseMode:     "buffer",      // "buffer" | "stream" | "always-resolve"
  *   maxResponseBytes: undefined,     // 16 MiB control / 1 GiB GET defaults; ignored in "stream"
  *   onChunk:          undefined,     // (chunk: Buffer) => void — fires per response chunk
+ *   maxBytesPerSec:   undefined,     // token-bucket bandwidth cap (bytes/sec) — paces BOTH the download response and the upload body with backpressure
+ *   downloadTransform: undefined,    // Transform | () => Transform | array — interpose on the response stream (e.g. a hashing or progress Transform)
+ *   uploadTransform:  undefined,     // Transform | () => Transform | array — interpose on the request body before the wire
  *   signal:           undefined,     // AbortSignal — propagated to req / stream
  *   errorClass:       HttpClientError, // FrameworkError subclass for thrown errors
  *   observer:         undefined,     // (stage, info) => void — lifecycle hook
@@ -733,6 +736,132 @@ function _stripCrossOriginAuth(headers) {
  *   });
  *   // → { statusCode: 200, headers: { "content-type": "application/json", ... }, body: <Buffer> }
  */
+// Token-bucket bandwidth throttle as a Transform. Splits each chunk to the
+// credit available, releasing at most `bytesPerSec` per second (1s burst
+// capacity). Because `_transform`'s callback is not called until the whole
+// chunk has been released, backpressure propagates upstream — on a download
+// the socket pauses, on an upload the body source pauses. Wired into both the
+// response (download) and request-body (upload) pipelines so the helpers'
+// SSRF guard / DNS pinning / byte caps / atomic-rename are preserved.
+function _throttleStream(bytesPerSec) {
+  var capacity = bytesPerSec;          // allow at most 1s worth of burst
+  var tokens   = capacity;
+  var last     = Date.now();
+  function refill() {
+    var now = Date.now();
+    if (now > last) {
+      tokens = Math.min(capacity, tokens + ((now - last) / 1000) * bytesPerSec);
+      last = now;
+    }
+  }
+  return new nodeStream.Transform({
+    transform: function (chunk, _enc, cb) {
+      var self = this;
+      var offset = 0;
+      function pump() {
+        refill();
+        if (offset >= chunk.length) { cb(); return; }
+        var avail = Math.floor(tokens);
+        if (avail >= 1) {
+          var n = Math.min(chunk.length - offset, avail);
+          tokens -= n;
+          self.push(chunk.subarray(offset, offset + n));
+          offset += n;
+          if (offset >= chunk.length) { cb(); return; }
+          setImmediate(pump);          // more bytes, maybe more credit already
+        } else {
+          // ms to accrue one more byte of credit = (deficit / rate) seconds.
+          var waitMs = Math.ceil(C.TIME.seconds((1 - tokens) / bytesPerSec)) + 1;
+          var t = setTimeout(pump, waitMs);
+          if (t && typeof t.unref === "function") t.unref();
+        }
+      }
+      pump();
+    },
+  });
+}
+
+// Validate + normalize a transform opt into an array. Each entry may be a
+// Transform stream instance OR a `() => Transform` factory (the factory form is
+// retry/redirect-safe — a single Transform instance can only be piped once, so
+// a fresh one is built per attempt). Returns { ok: [...] } or { err: Error }.
+function _coerceTransforms(value, errorClass, name) {
+  if (value === undefined || value === null) return { ok: [] };
+  var list = Array.isArray(value) ? value : [value];
+  for (var i = 0; i < list.length; i++) {
+    var t = list[i];
+    var isFactory   = typeof t === "function";
+    var isTransform = t && typeof t.pipe === "function" && typeof t.write === "function";
+    if (!isFactory && !isTransform) {
+      return { err: _makeError(errorClass, "BAD_ARG",
+        name + " must be a Transform stream or a () => Transform factory (or an array of them)", true) };
+    }
+  }
+  return { ok: list };
+}
+
+// Resolve a transform entry to a fresh stream instance (call the factory form).
+function _resolveStage(t) { return typeof t === "function" ? t() : t; }
+
+// Compose the response (download) stream: source → [throttle?] → [transforms…]
+// → observe(progress + onChunk). Every stage is a Transform so backpressure
+// flows from the consumer back to the socket (the throttle paces it). Returns
+// `source` unchanged when nothing is interposed (preserves the bare-stream
+// contract). A stage error propagates downstream so the returned body emits it.
+function _buildDownloadStream(source, emitDownload, onChunk, throttleBps, transforms) {
+  var stages = [];
+  if (throttleBps) stages.push(_throttleStream(throttleBps));
+  for (var i = 0; i < transforms.length; i++) stages.push(_resolveStage(transforms[i]));
+  if (stages.length === 0 && !emitDownload && !onChunk) return source;
+  var observe = new nodeStream.Transform({
+    transform: function (chunk, _enc, cb) {
+      if (emitDownload) emitDownload(chunk.length);
+      if (onChunk) { try { onChunk(chunk); } catch (_e) { /* operator hook — drop-silent */ } }
+      cb(null, chunk);
+    },
+  });
+  var chain = [source].concat(stages).concat([observe]);
+  for (var c = 0; c < chain.length - 1; c++) {
+    var src = chain[c], dst = chain[c + 1];
+    src.on("error", (function (d) { return function (e) { d.destroy(e); }; })(dst));
+    src.pipe(dst);
+  }
+  return observe;
+}
+
+// Build the upload throttle/transform stages (parallel to the download side).
+function _uploadStages(throttleBps, transforms) {
+  var stages = [];
+  if (throttleBps) stages.push(_throttleStream(throttleBps));
+  for (var i = 0; i < transforms.length; i++) stages.push(_resolveStage(transforms[i]));
+  return stages;
+}
+
+// Pipe a body (stream | Buffer | string) through throttle/transform stages into
+// the request sink, pacing the upload and emitting progress on bytes delivered
+// to the sink. Used only when a throttle/transform is configured; the plain
+// no-stages path keeps its original direct write. A stage/source error tears
+// down the request via onBodyError.
+function _pipeThrottledUpload(body, sink, stages, emitUpload, onBodyError) {
+  var source = (body && typeof body.pipe === "function")
+    ? body
+    : nodeStream.Readable.from(Buffer.isBuffer(body) ? body : Buffer.from(String(body), "utf8"));
+  var observe = new nodeStream.Transform({
+    transform: function (chunk, _enc, cb) {
+      if (emitUpload) emitUpload(chunk.length);
+      cb(null, chunk);
+    },
+  });
+  var chain = [source].concat(stages).concat([observe]);
+  for (var c = 0; c < chain.length - 1; c++) {
+    var s = chain[c], d = chain[c + 1];
+    s.on("error", (function (dd) { return function (e) { dd.destroy(e); }; })(d));
+    s.pipe(d);
+  }
+  observe.on("error", onBodyError);
+  observe.pipe(sink);
+}
+
 function request(opts) {
   if (!opts || !opts.url) {
     return Promise.reject(_makeError(opts && opts.errorClass, "BAD_ARG", "url is required", true));
@@ -765,6 +894,20 @@ function request(opts) {
     return Promise.reject(_makeError(opts.errorClass, "BAD_ARG",
       "onChunk must be a function (chunk: Buffer) -> void", true));
   }
+  // Bandwidth cap + transform interpose (download response + upload request
+  // body) — validated here, derived per-attempt in _requestSingle. maxBytesPerSec
+  // paces BOTH legs; downloadTransform / uploadTransform interpose custom
+  // Transform(s) (instance or () => Transform factory) on the respective leg.
+  if (opts.maxBytesPerSec !== undefined && opts.maxBytesPerSec !== null) {
+    if (typeof opts.maxBytesPerSec !== "number" || !isFinite(opts.maxBytesPerSec) || opts.maxBytesPerSec <= 0) {
+      return Promise.reject(_makeError(opts.errorClass, "BAD_ARG",
+        "maxBytesPerSec must be a positive finite number (bytes/sec)", true));
+    }
+  }
+  var _dlChk = _coerceTransforms(opts.downloadTransform, opts.errorClass, "downloadTransform");
+  if (_dlChk.err) return Promise.reject(_dlChk.err);
+  var _ulChk = _coerceTransforms(opts.uploadTransform, opts.errorClass, "uploadTransform");
+  if (_ulChk.err) return Promise.reject(_ulChk.err);
   if (opts.jar !== undefined && opts.jar !== null) {
     if (typeof opts.jar !== "object" ||
         typeof opts.jar.cookieHeaderFor !== "function" ||
@@ -1379,6 +1522,12 @@ function _requestSingle(opts) {
 // ---- _requestH1: existing node:http(s) path ----
 
 function _requestH1(transport, u, opts) {
+  // Bandwidth/transform interpose — opts validated in request(); derived fresh
+  // per attempt (each builds its own throttle + resolves transform factories, so
+  // a retry / redirect never reuses a consumed Transform).
+  var throttleBps = opts.maxBytesPerSec || null;   // validated in request(); positive number or absent
+  var downloadTransforms = _coerceTransforms(opts.downloadTransform, opts.errorClass, "downloadTransform").ok;
+  var uploadTransforms = _coerceTransforms(opts.uploadTransform, opts.errorClass, "uploadTransform").ok;
   return new Promise(function (resolve, reject) {
     var method = (opts.method || "GET").toUpperCase();
     var headers = Object.assign({}, opts.headers || {});
@@ -1397,7 +1546,12 @@ function _requestH1(transport, u, opts) {
       return;
     }
 
-    if (Buffer.isBuffer(opts.body)) {
+    if (Buffer.isBuffer(opts.body) && uploadTransforms.length === 0) {
+      // A size-changing uploadTransform (gzip / encrypt / frame) makes the
+      // original buffer length wrong, so the server would truncate extra bytes
+      // or wait for bytes that never arrive. Omit Content-Length in that case
+      // and let the body be chunked, framed on the actual transformed bytes. A
+      // throttle alone preserves size, so Content-Length stays valid then.
       headers["Content-Length"] = opts.body.length;
     }
     // CVE-2026-22036 mitigation — refuse compressed responses by
@@ -1465,35 +1619,30 @@ function _requestH1(transport, u, opts) {
           _rejectStreamHttpError(res, opts.errorClass, res.statusCode, res.statusMessage || "", _reject);
           return;
         }
-        if (onDownloadProgress || onChunk) {
-          // Wrap the stream so chunks emit progress + onChunk to the
-          // operator. The framework's contract is to hand back the
-          // response stream unmodified; fix-up via a passthrough keeps
-          // that contract while observing the chunk sizes. onChunk
-          // gets the buffer itself (for hash-as-you-go); a throw from
-          // it is caught and dropped so a hash-mismatch detector can
-          // raise without breaking the response stream — caller
-          // surfaces the error through their own pipe handler.
-          var passthrough = new nodeStream.PassThrough();
-          res.on("data", function (chunk) {
-            _emitDownload(chunk.length);
-            if (onChunk) {
-              try { onChunk(chunk); }
-              catch (_e) { /* operator-supplied hook — drop-silent */ }
-            }
-            passthrough.write(chunk);
-          });
-          res.on("end",  function () { passthrough.end(); });
-          res.on("error", function (e) { passthrough.destroy(e); });
-          return _resolve({ statusCode: res.statusCode, headers: res.headers, body: passthrough });
-        }
-        return _resolve({ statusCode: res.statusCode, headers: res.headers, body: res });
+        // Compose the response stream with the optional bandwidth throttle +
+        // custom transforms + progress/onChunk observation. Each is a Transform
+        // so backpressure reaches the socket; onChunk sees the bytes in order
+        // (for hash-as-you-go) and a throw from it is dropped. Returns `res`
+        // unchanged when nothing is interposed (bare-stream contract).
+        var body = _buildDownloadStream(
+          res, onDownloadProgress ? _emitDownload : null, onChunk, throttleBps, downloadTransforms);
+        return _resolve({ statusCode: res.statusCode, headers: res.headers, body: body });
       }
 
       var collector = safeBuffer.boundedChunkCollector({ maxBytes: maxResponseBytes });
       var capExceeded = false;
 
-      res.on("data", function (chunk) {
+      // Route the buffered read through the SAME throttle + transform pipeline
+      // as stream mode, so maxBytesPerSec and downloadTransform apply in buffer
+      // and always-resolve modes too (both documented to pace / transform the
+      // download regardless of how the body is consumed). With nothing
+      // interposed this returns `res` unchanged, so the plain path is identical.
+      // The cap now bounds post-transform bytes — strictly safer for a
+      // decompressing transform. Progress + onChunk fire inside the pipeline.
+      var dlSource = _buildDownloadStream(
+        res, onDownloadProgress ? _emitDownload : null, onChunk, throttleBps, downloadTransforms);
+
+      dlSource.on("data", function (chunk) {
         if (capExceeded) return;
         try { collector.push(chunk); }
         catch (_e) {
@@ -1503,13 +1652,8 @@ function _requestH1(transport, u, opts) {
             "response body exceeds " + maxResponseBytes + " bytes", true));
           return;
         }
-        _emitDownload(chunk.length);
-        if (onChunk) {
-          try { onChunk(chunk); }
-          catch (_e) { /* operator-supplied hook — drop-silent */ }
-        }
       });
-      res.on("end", function () {
+      dlSource.on("end", function () {
         if (capExceeded) return;
         var buf = collector.result();
         if (observer) observer("response:end", {
@@ -1539,7 +1683,7 @@ function _requestH1(transport, u, opts) {
             _isPermanentStatus(res.statusCode), res.statusCode));
         }
       });
-      res.on("error", function (e) {
+      dlSource.on("error", function (e) {
         if (capExceeded) return;
         if (observer) observer("error", { phase: "response", message: e.message });
         _reject(_makeError(opts.errorClass, e.code || "RES_ERROR", e.message, false));
@@ -1583,7 +1727,17 @@ function _requestH1(transport, u, opts) {
       catch (_e) { /* progress hooks are best-effort */ }
     }
 
-    if (opts.body && typeof opts.body.pipe === "function") {
+    var ulStages = _uploadStages(throttleBps, uploadTransforms);
+    if (opts.body != null && opts.body !== "" && ulStages.length > 0) {
+      // Pace / transform the upload body through the stages, into req.
+      _pipeThrottledUpload(opts.body, req, ulStages,
+        onUploadProgress ? _emitUpload : null,
+        function (e) {
+          try { req.destroy(); } catch (_) { /* best-effort req teardown */ }
+          _reject(_makeError(opts.errorClass, "REQ_BODY_ERROR",
+            "request body stream error: " + e.message, false));
+        });
+    } else if (opts.body && typeof opts.body.pipe === "function") {
       if (onUploadProgress) {
         opts.body.on("data", function (c) { _emitUpload(c.length); });
       }
@@ -1618,6 +1772,10 @@ function _requestH1(transport, u, opts) {
 // ---- _requestH2: node:http2 path ----
 
 function _requestH2(transport, u, opts) {
+  // Bandwidth/transform interpose — see _requestH1; derived fresh per attempt.
+  var throttleBps = opts.maxBytesPerSec || null;   // validated in request(); positive number or absent
+  var downloadTransforms = _coerceTransforms(opts.downloadTransform, opts.errorClass, "downloadTransform").ok;
+  var uploadTransforms = _coerceTransforms(opts.uploadTransform, opts.errorClass, "uploadTransform").ok;
   return new Promise(function (resolve, reject) {
     var method = (opts.method || "GET").toUpperCase();
     var responseMode = opts.responseMode || "buffer";
@@ -1637,7 +1795,13 @@ function _requestH2(transport, u, opts) {
     }
 
     var headers = _toH2Headers(method, u, opts.headers || {});
-    if (Buffer.isBuffer(opts.body)) headers["content-length"] = String(opts.body.length);
+    // Omit content-length when a size-changing uploadTransform is interposed —
+    // the original buffer length no longer frames the transformed body (HTTP/2
+    // frames via DATA + END_STREAM, so no header is required). A throttle alone
+    // keeps the size, so the length stays valid then.
+    if (Buffer.isBuffer(opts.body) && uploadTransforms.length === 0) {
+      headers["content-length"] = String(opts.body.length);
+    }
 
     if (observer) observer("request:start", { method: method, url: String(opts.url), protocol: "h2" });
 
@@ -1681,24 +1845,29 @@ function _requestH2(transport, u, opts) {
           _rejectStreamHttpError(stream, opts.errorClass, statusCode, "", _reject);
           return;
         }
-        if (onChunkH2) {
-          var passthroughH2 = new nodeStream.PassThrough();
-          stream.on("data", function (chunk) {
-            try { onChunkH2(chunk); }
-            catch (_e) { /* operator-supplied hook — drop-silent */ }
-            passthroughH2.write(chunk);
-          });
-          stream.on("end",  function () { passthroughH2.end(); });
-          stream.on("error", function (e) { passthroughH2.destroy(e); });
-          return _resolve({ statusCode: statusCode, headers: responseHeaders, body: passthroughH2 });
-        }
-        return _resolve({ statusCode: statusCode, headers: responseHeaders, body: stream });
+        var bodyH2 = _buildDownloadStream(stream, null, onChunkH2, throttleBps, downloadTransforms);
+        return _resolve({ statusCode: statusCode, headers: responseHeaders, body: bodyH2 });
       }
 
       var collector = safeBuffer.boundedChunkCollector({ maxBytes: maxResponseBytes });
       var capExceeded = false;
 
-      stream.on("data", function (chunk) {
+      // Apply the throttle + transform pipeline in buffer / always-resolve mode
+      // too (matches H1 + the documented contract); returns `stream` unchanged
+      // when nothing is interposed. onChunk fires inside the pipeline.
+      var dlH2 = _buildDownloadStream(stream, null, onChunkH2, throttleBps, downloadTransforms);
+      // When a stage is interposed, a transform error surfaces on the pipeline
+      // tail, not the raw h2 stream — reject on it. The plain path (dlH2 ===
+      // stream) is already covered by the stream-level error handler below.
+      if (dlH2 !== stream) {
+        dlH2.on("error", function (e) {
+          if (capExceeded) return;
+          if (observer) observer("error", { phase: "stream", message: e.message });
+          _reject(_makeError(opts.errorClass, e.code || "H2_STREAM_ERROR", e.message, false));
+        });
+      }
+
+      dlH2.on("data", function (chunk) {
         if (capExceeded) return;
         try { collector.push(chunk); }
         catch (_e) {
@@ -1708,12 +1877,8 @@ function _requestH2(transport, u, opts) {
             "response body exceeds " + maxResponseBytes + " bytes", true));
           return;
         }
-        if (onChunkH2) {
-          try { onChunkH2(chunk); }
-          catch (_e) { /* operator-supplied hook — drop-silent */ }
-        }
       });
-      stream.on("end", function () {
+      dlH2.on("end", function () {
         if (capExceeded) return;
         var buf = collector.result();
         if (observer) observer("response:end", {
@@ -1751,7 +1916,14 @@ function _requestH2(transport, u, opts) {
       signal.addEventListener("abort", onAbort, { once: true });
     }
 
-    if (opts.body && typeof opts.body.pipe === "function") {
+    var ulStagesH2 = _uploadStages(throttleBps, uploadTransforms);
+    if (opts.body != null && opts.body !== "" && ulStagesH2.length > 0) {
+      _pipeThrottledUpload(opts.body, stream, ulStagesH2, null, function (e) {
+        try { stream.close(http2.constants.NGHTTP2_INTERNAL_ERROR); } catch (_) { /* best-effort h2 stream cancel */ }
+        _reject(_makeError(opts.errorClass, "REQ_BODY_ERROR",
+          "request body stream error: " + e.message, false));
+      });
+    } else if (opts.body && typeof opts.body.pipe === "function") {
       opts.body.on("error", function (e) {
         try { stream.close(http2.constants.NGHTTP2_INTERNAL_ERROR); } catch (_) { /* best-effort h2 stream cancel */ }
         _reject(_makeError(opts.errorClass, "REQ_BODY_ERROR",

package/lib/vendor/blamejs/lib/iab-tcf.js

@@ -96,6 +96,7 @@
 
 var audit = require("./audit");
 var bCrypto = require("./crypto");
+var numericBounds = require("./numeric-bounds");
 var { defineClass } = require("./framework-error");
 var IabTcfError = defineClass("IabTcfError", { alwaysPermanent: true });
 
@@ -521,7 +522,7 @@ function _idArray(x) {
   var seen = Object.create(null);
   var out = [];
   list.forEach(function (id) {
-    if (typeof id !== "number" || !isFinite(id) || id < 1 || Math.floor(id) !== id) {
+    if (!numericBounds.isPositiveFiniteInt(id)) {
       throw IabTcfError.factory("iab-tcf/bad-value", "iabTcf.encode: vendor/purpose ids must be positive integers, got " + id);
     }
     if (!seen[id]) { seen[id] = 1; out.push(id); }
@@ -554,7 +555,7 @@ function _decisec(t) {
 function _bitWriter() {
   var bits = "";
   function writeInt(v, n) {
-    if (typeof v !== "number" || !isFinite(v) || v < 0 || Math.floor(v) !== v) throw IabTcfError.factory("iab-tcf/bad-value", "iabTcf.encode: expected a non-negative integer, got " + v);
+    if (!numericBounds.isNonNegativeFiniteInt(v)) throw IabTcfError.factory("iab-tcf/bad-value", "iabTcf.encode: expected a non-negative integer, got " + v);
     if (v >= Math.pow(2, n)) throw IabTcfError.factory("iab-tcf/value-overflow", "iabTcf.encode: " + v + " does not fit in " + n + " bits");
     bits += v.toString(2).padStart(n, "0");
   }

package/lib/vendor/blamejs/lib/importmap-integrity.js

@@ -22,6 +22,7 @@
 
 var validateOpts = require("./validate-opts");
 var bCrypto      = require("./crypto");
+var safeJson     = require("./safe-json");
 var { defineClass } = require("./framework-error");
 
 var ImportmapError = defineClass("ImportmapError", { alwaysPermanent: true });
@@ -46,7 +47,9 @@ var ImportmapError = defineClass("ImportmapError", { alwaysPermanent: true });
  *       "@org/lib": { url: "/static/lib.js", body: fileBytes },
  *     },
  *   });
- *   res.end("<script type=\"importmap\">" + JSON.stringify(im) + "</script>");
+ *   // Embed with the <script>-safe helper — NEVER raw JSON.stringify, which
+ *   // does not escape "</script>" in a module url and breaks out of the tag.
+ *   res.end(b.importmapIntegrity.scriptTag(im));
  */
 function build(opts) {
   opts = validateOpts.requireObject(opts, "importmapIntegrity.build",
@@ -84,7 +87,44 @@ function build(opts) {
   return { imports: imports, integrity: integrity };
 }
 
+/**
+ * @primitive b.importmapIntegrity.scriptTag
+ * @signature b.importmapIntegrity.scriptTag(importmap, opts?)
+ * @since     0.15.14
+ * @status    stable
+ * @related   b.importmapIntegrity.build, b.safeJson.stringifyForScript
+ *
+ * Render an import-map object (from `build`) as a ready-to-embed
+ * `<script type="importmap">…</script>` tag using the `<script>`-safe
+ * JSON serializer. Raw `JSON.stringify` does not escape `</script>` in a
+ * module url, so concatenating it into the page lets a `</script>` in a
+ * url close the element and inject markup — this escapes `< > &` (and the
+ * U+2028 / U+2029 separators) so no url can break out.
+ *
+ * @opts
+ *   nonce:  string,   // CSP nonce added as nonce="…" on the <script>
+ *
+ * @example
+ *   res.end(b.importmapIntegrity.scriptTag(im, { nonce: req.cspNonce }));
+ */
+function scriptTag(importmap, opts) {
+  opts = opts || {};
+  var nonceAttr = "";
+  if (typeof opts.nonce === "string" && opts.nonce.length > 0) {
+    // The nonce is operator-supplied (a CSP per-request token); reject any
+    // value that could itself break the attribute rather than escape it.
+    if (/[^A-Za-z0-9+/=_-]/.test(opts.nonce)) {
+      throw new ImportmapError("importmap/bad-nonce",
+        "scriptTag: opts.nonce must be a base64/token string");
+    }
+    nonceAttr = ' nonce="' + opts.nonce + '"';
+  }
+  return '<script type="importmap"' + nonceAttr + '>' +
+    safeJson.stringifyForScript(importmap) + "</script>";
+}
+
 module.exports = {
   build:           build,
+  scriptTag:       scriptTag,
   ImportmapError:  ImportmapError,
 };

package/lib/vendor/blamejs/lib/incident-report.js

@@ -93,12 +93,15 @@ var REGIME_DEADLINES = Object.freeze({
     intermediate: C.TIME.hours(72),
     final:        C.TIME.days(30),
   }),
-  // DORA (EU Digital Operational Resilience Act) Article 19: initial
-  // within 4h of classification, intermediate within 24h, final
-  // within 1 month.
+  // DORA (EU Digital Operational Resilience Act) Art. 19 + RTS (EU)
+  // 2024/1772 Art. 5: initial within 4h of classifying the incident as
+  // major (outer bound 24h from awareness), intermediate within 72h of the
+  // initial notification, final within 1 month of the intermediate report.
+  // (intermediate was 24h here, contradicting lib/dora.js's 72h — the RTS
+  // value is 72h from the initial notification; aligned.)
   dora: Object.freeze({
     initial:      C.TIME.hours(4),
-    intermediate: C.TIME.hours(24),
+    intermediate: C.TIME.hours(72),
     final:        C.TIME.days(30),
   }),
   // CRA (EU Cyber Resilience Act) Article 14: early warning within
@@ -206,7 +209,7 @@ function create(opts) {
   }
 
   async function _recordStage(incidentId, stage, payload) {
-    if (!VALID_STAGES[stage]) {
+    if (!Object.prototype.hasOwnProperty.call(VALID_STAGES, stage)) {
       throw new IncidentReportError("incident-report/bad-stage",
         "incident.report._recordStage: stage must be one of " + Object.keys(VALID_STAGES).join(", "));
     }
@@ -358,7 +361,7 @@ function createDeadlineClock(opts) {
   function untrack(id) { return tracked.delete(id); }
 
   function acknowledgeSubmission(id, stage, info) {
-    if (!VALID_STAGES[stage]) {
+    if (!Object.prototype.hasOwnProperty.call(VALID_STAGES, stage)) {
       throw new IncidentReportError("incident-report/bad-stage",
         "createDeadlineClock.acknowledgeSubmission: stage must be one of " + Object.keys(VALID_STAGES).join(", "));
     }

package/lib/vendor/blamejs/lib/json-patch.js

@@ -157,7 +157,7 @@ function apply(doc, operations) {
   var work = structuredClone(doc);
   for (var i = 0; i < operations.length; i += 1) {
     var op = operations[i];
-    if (!op || typeof op !== "object" || typeof op.op !== "string" || !OPS[op.op]) {
+    if (!op || typeof op !== "object" || typeof op.op !== "string" || !Object.prototype.hasOwnProperty.call(OPS, op.op)) {
       throw new JsonPatchError("json-patch/bad-op", "jsonPatch.apply: operations[" + i + "] has an invalid 'op'");
     }
     if (typeof op.path !== "string") throw new JsonPatchError("json-patch/bad-op", "jsonPatch.apply: operations[" + i + "] is missing 'path'");

package/lib/vendor/blamejs/lib/json-path.js

@@ -35,6 +35,7 @@ var { defineClass } = require("./framework-error");
 var JsonPathError = defineClass("JsonPathError", { alwaysPermanent: true });
 
 var MAX_DESCEND_NODES = 1000000;                             // DoS ceiling on nodes visited by a descendant walk
+var MAX_TOTAL_NODES = 1000000;                              // DoS ceiling on the running nodelist across ALL segments (chained wildcard/slice/filter cross-product)
 
 // ---------------------------------------------------------------------------
 // Parser — recursive descent over the RFC 9535 ABNF.
@@ -46,7 +47,20 @@ function _isDigit(c) { return c >= "0" && c <= "9"; }
 function _isNameFirst(c) { var cc = c.charCodeAt(0); return (c >= "A" && c <= "Z") || (c >= "a" && c <= "z") || c === "_" || cc >= 0x80; }
 function _isNameChar(c) { return _isNameFirst(c) || _isDigit(c); }
 
-function _Parser(s) { this.s = s; this.i = 0; }
+function _Parser(s) { this.s = s; this.i = 0; this._depth = 0; }
+
+// Nesting-depth cap for the filter-expression recursion (parens + `!`). Without
+// it, a deeply-nested filter like `?(((((...)))))` recurses until V8 throws a
+// raw RangeError ("Maximum call stack size exceeded") that escapes JsonPathError
+// handling — a DoS / unhandled-crash lever on attacker-supplied JSONPath.
+var MAX_FILTER_DEPTH = 200;
+_Parser.prototype._descend = function () {
+  if (++this._depth > MAX_FILTER_DEPTH) {
+    throw new JsonPathError("json-path/filter-too-deep",
+      "jsonPath: filter expression nesting exceeds " + MAX_FILTER_DEPTH);
+  }
+};
+_Parser.prototype._ascend = function () { this._depth -= 1; };
 _Parser.prototype.err = function (msg) { throw new JsonPathError("json-path/invalid", "jsonPath: " + msg + " at index " + this.i); };
 _Parser.prototype.peek = function () { return this.i < this.s.length ? this.s.charAt(this.i) : ""; };
 _Parser.prototype.eat = function (c) { if (this.peek() !== c) this.err("expected '" + c + "'"); this.i += 1; };
@@ -226,9 +240,9 @@ _Parser.prototype.parseLogicalAnd = function () {
 };
 _Parser.prototype.parseBasic = function () {
   this.skipBlank();
-  if (this.peek() === "!") { this.i += 1; this.skipBlank(); var inner = this.parseBasic(); this._requireTestable(inner); return { type: "not", e: inner, vtype: "logical" }; }
+  if (this.peek() === "!") { this.i += 1; this.skipBlank(); this._descend(); var inner = this.parseBasic(); this._ascend(); this._requireTestable(inner); return { type: "not", e: inner, vtype: "logical" }; }
   if (this.peek() === "(") {
-    this.i += 1; this.skipBlank(); var e = this.parseLogicalOr(); this.skipBlank(); this.eat(")");
+    this.i += 1; this.skipBlank(); this._descend(); var e = this.parseLogicalOr(); this._ascend(); this.skipBlank(); this.eat(")");
     return e;
   }
   // comparison or test
@@ -436,6 +450,13 @@ function _evalSegments(segments, root) {
       base = acc;
     }
     base.forEach(function (nd) { seg.selectors.forEach(function (sel) { _applySelector(sel, nd, root, next); }); });
+    // Cap the running nodelist across the WHOLE query, not just per descendant
+    // walk: chained wildcard/slice/filter selectors multiply the nodelist each
+    // segment ([*][*][*]…), an OOM lever the per-`_descend` budget never sees.
+    if (next.length > MAX_TOTAL_NODES) {
+      throw new JsonPathError("json-path/too-large",
+        "jsonPath: nodelist exceeded " + MAX_TOTAL_NODES + " nodes (chained selector cross-product)");
+    }
     nodes = next;
   }
   return nodes;

package/lib/vendor/blamejs/lib/jtd.js

@@ -58,7 +58,7 @@ function _checkSchema(schema, root, isRoot) {
   if (!_isPlainObject(schema)) throw new JtdError("jtd/bad-schema", "jtd: schema must be an object");
   if (!isRoot && Object.prototype.hasOwnProperty.call(schema, "definitions")) throw new JtdError("jtd/bad-schema", "jtd: 'definitions' is allowed only at the root");
   Object.keys(schema).forEach(function (k) {
-    if (FORM_KEYWORDS.indexOf(k) === -1 && !SHARED_KEYWORDS[k] && k !== "additionalProperties" && k !== "mapping") throw new JtdError("jtd/bad-schema", "jtd: unknown keyword '" + k + "'");
+    if (FORM_KEYWORDS.indexOf(k) === -1 && !Object.prototype.hasOwnProperty.call(SHARED_KEYWORDS, k) && k !== "additionalProperties" && k !== "mapping") throw new JtdError("jtd/bad-schema", "jtd: unknown keyword '" + k + "'");
   });
   if (Object.prototype.hasOwnProperty.call(schema, "nullable") && typeof schema.nullable !== "boolean") throw new JtdError("jtd/bad-schema", "jtd: 'nullable' must be a boolean");
   if (Object.prototype.hasOwnProperty.call(schema, "metadata") && !_isPlainObject(schema.metadata)) throw new JtdError("jtd/bad-schema", "jtd: 'metadata' must be an object");
@@ -75,7 +75,7 @@ function _checkSchema(schema, root, isRoot) {
   if ("ref" in schema) {
     if (typeof schema.ref !== "string" || !root.definitions || !Object.prototype.hasOwnProperty.call(root.definitions, schema.ref)) throw new JtdError("jtd/bad-schema", "jtd: 'ref' must name a key in the root definitions");
   }
-  if ("type" in schema && !TYPES[schema.type]) throw new JtdError("jtd/bad-schema", "jtd: unknown type '" + schema.type + "'");
+  if ("type" in schema && !Object.prototype.hasOwnProperty.call(TYPES, schema.type)) throw new JtdError("jtd/bad-schema", "jtd: unknown type '" + schema.type + "'");
   if ("enum" in schema) {
     if (!Array.isArray(schema.enum) || schema.enum.length === 0) throw new JtdError("jtd/bad-schema", "jtd: 'enum' must be a non-empty array");
     var seen = Object.create(null);

package/lib/vendor/blamejs/lib/legal-hold.js

@@ -210,19 +210,34 @@ function create(opts) {
     _ensureSchema();
     var hash = _hashSubject(sid);
     var placeSelBuilt = sql.select(HOLD_TABLE, SQL_OPTS)
-      .columns(["placedAt"])
+      .columns(["placedAt", "retainUntil"])
       .where("subjectIdHash", hash)
       .toSql();
     var placeSelStmt = db.prepare(placeSelBuilt.sql);
     var existing = placeSelStmt.get.apply(placeSelStmt, placeSelBuilt.params);
+    var nowMs = Date.now();
+    var renewedFromLapsed = false;
     if (existing) {
-      _emit("legalhold.place_rejected",
-        { subjectId: sid, reason: "already-held",
-          existingSince: existing.placedAt },
-        "denied");
-      return { error: "already-held", placedAt: existing.placedAt };
+      // A LAPSED hold (retainUntil sunset already passed → isHeld() is already
+      // false) must not block a fresh placement: otherwise a subject whose hold
+      // expired cannot be re-held when new litigation arises, leaving the data
+      // both unprotected (isHeld false) and erasable by retention. Replace the
+      // lapsed row with the new hold. An ACTIVE hold still rejects as before.
+      var existingLapsed = existing.retainUntil && existing.retainUntil < nowMs;
+      if (!existingLapsed) {
+        _emit("legalhold.place_rejected",
+          { subjectId: sid, reason: "already-held",
+            existingSince: existing.placedAt },
+          "denied");
+        return { error: "already-held", placedAt: existing.placedAt };
+      }
+      renewedFromLapsed = true;
+      var lapseDelBuilt = sql.delete(HOLD_TABLE, SQL_OPTS)
+        .where("subjectIdHash", hash)
+        .toSql();
+      var lapseDelStmt = db.prepare(lapseDelBuilt.sql);
+      lapseDelStmt.run.apply(lapseDelStmt, lapseDelBuilt.params);
     }
-    var nowMs = Date.now();
     var placeInsBuilt = sql.insert(HOLD_TABLE, SQL_OPTS)
       .values(cryptoField.sealRow(HOLD_TABLE, {
         subjectIdHash: hash,
@@ -242,9 +257,10 @@ function create(opts) {
         citation:  args.citation  || null,
         retainUntil: args.retainUntil || null,
         placedBy: args.placedBy || null,
+        renewedFromLapsed: renewedFromLapsed,
         knownCitation: args.citation && KNOWN_CITATIONS.indexOf(args.citation) !== -1 },
       "success");
-    return { placed: true, placedAt: nowMs };
+    return { placed: true, placedAt: nowMs, renewedFromLapsed: renewedFromLapsed };
   }
 
   function release(subjectId, args) {