@blamejs/blamejs-shop 0.4.68 → 0.4.70

package/lib/vendor/blamejs/lib/safe-json.js

@@ -354,6 +354,49 @@ function stringify(value, opts) {
   }
 }
 
+/**
+ * @primitive b.safeJson.stringifyForScript
+ * @signature b.safeJson.stringifyForScript(value, opts?)
+ * @since     0.15.14
+ * @status    stable
+ * @related   b.safeJson.stringify
+ *
+ * Like `b.safeJson.stringify` but safe to embed verbatim inside an
+ * inline `<script>` element. Raw `JSON.stringify` does not escape `<`,
+ * `>`, or `&`, so a string value containing `</script>` (or `<!--`)
+ * closes the surrounding script element and injects markup; the
+ * Unicode line/paragraph separators U+2028 / U+2029 are also illegal
+ * unescaped in a script context on older parsers. This escapes all of
+ * them to their equivalent `\uXXXX` JSON escapes — the parsed value is
+ * byte-identical, but no substring can break out of a `<script>` block.
+ *
+ * @opts
+ *   indent:    number | string,   // forwarded to b.safeJson.stringify
+ *   allowProto:boolean,           // forwarded
+ *
+ * @example
+ *   var json = b.safeJson.stringifyForScript({ url: "/a</script>x" });
+ *   res.end('<script type="importmap">' + json + '</script>');
+ *   // → the "</script>" inside the value is emitted as "</script>"
+ */
+function stringifyForScript(value, opts) {
+  var json = stringify(value, opts);
+  // BS is a single backslash built at runtime so this source carries no
+  // escape literals (they round-trip badly through tooling). Escape < > &
+  // so the JSON cannot close / comment-open the surrounding inline
+  // <script>; escape U+2028 / U+2029 (illegal unescaped in a script on
+  // older parsers). The parsed value is unchanged.
+  var BS = String.fromCharCode(92);
+  json = json.replace(/[<>&]/g, function (c) {
+    if (c === "<") return BS + "u003c";
+    if (c === ">") return BS + "u003e";
+    return BS + "u0026";
+  });
+  json = json.split(String.fromCharCode(0x2028)).join(BS + "u2028");
+  json = json.split(String.fromCharCode(0x2029)).join(BS + "u2029");
+  return json;
+}
+
 // Walk the value, substituting any references that would create a cycle
 // with `replacement`. Uses an active-stack Set so SHARED non-circular
 // subtrees are preserved (only true cycles are replaced).
@@ -930,6 +973,7 @@ module.exports = {
   parse:          parse,
   parseOrDefault: parseOrDefault,
   stringify:      stringify,
+  stringifyForScript: stringifyForScript,
   canonical:      canonical,
   validate:       validate,
   registerFormat: registerFormat,

package/lib/vendor/blamejs/lib/safe-sieve.js

@@ -133,7 +133,7 @@ function _resolveProfile(opts) {
   if (!opts) return "strict";
   if (typeof opts.profile === "string") return opts.profile;
   if (typeof opts.compliancePosture === "string") {
-    return COMPLIANCE_POSTURES[opts.compliancePosture] || "strict";
+    return (Object.prototype.hasOwnProperty.call(COMPLIANCE_POSTURES, opts.compliancePosture) && COMPLIANCE_POSTURES[opts.compliancePosture]) || "strict";
   }
   return "strict";
 }

package/lib/vendor/blamejs/lib/safe-vcard.js

@@ -361,7 +361,7 @@ function _parseVcard(lines, startIdx, caps, extraProps) {
         "safeVcard.parse: nested BEGIN inside VCARD (vCard does not support sub-components)");
     }
     var pn = ln.name;
-    if (!KNOWN_PROPERTIES[pn] && !extraProps[pn] && pn.indexOf("X-") !== 0) {
+    if (!Object.prototype.hasOwnProperty.call(KNOWN_PROPERTIES, pn) && !extraProps[pn] && pn.indexOf("X-") !== 0) {
       throw new SafeVcardError("safe-vcard/unknown-property",
         "safeVcard.parse: unknown property '" + pn +
         "' (extend via opts.extraProperties or use X- prefix)");

package/lib/vendor/blamejs/lib/sandbox-worker.js

@@ -63,6 +63,12 @@ var workerThreads = require("node:worker_threads");
     "setInterval", "clearInterval",
     "queueMicrotask",
     "global",
+    // WebAssembly linear memory is allocated OUTSIDE the V8 heap, so the
+    // worker's maxOldGenerationSizeMb cap (derived from opts.maxBytes) does
+    // NOT bound `new WebAssembly.Memory(...).grow(N)` — operator source could
+    // commit multi-GiB of off-heap RAM under a tiny maxBytes (CWE-770). It is
+    // not in KNOWN_SAFE_BUILTINS so no `allowed` opt can re-expose it.
+    "WebAssembly",
   ];
   for (var k = 0; k < NODE_BUILTINS.length; k += 1) {
     var nm = NODE_BUILTINS[k];

package/lib/vendor/blamejs/lib/sandbox.js

@@ -133,7 +133,7 @@ function _validateAllowed(allowed) {
       throw new SandboxError("sandbox/bad-allowed",
         "sandbox.run: opts.allowed[" + i + "] must be a non-empty identifier string");
     }
-    if (!KNOWN_SAFE_BUILTINS[name]) {
+    if (!Object.prototype.hasOwnProperty.call(KNOWN_SAFE_BUILTINS, name)) {
       throw new SandboxError("sandbox/bad-allowed",
         "sandbox.run: opts.allowed[" + i + "] = " + JSON.stringify(name) +
         " is not in the sandbox built-in allowlist " +

package/lib/vendor/blamejs/lib/scheduler.js

@@ -177,7 +177,7 @@ function parseCron(expr) {
       "cron expression must be a non-empty string", true);
   }
   var trimmed = expr.trim();
-  if (CRON_SHORTHANDS[trimmed.toLowerCase()]) {
+  if (Object.prototype.hasOwnProperty.call(CRON_SHORTHANDS, trimmed.toLowerCase())) {
     trimmed = CRON_SHORTHANDS[trimmed.toLowerCase()];
   }
   var fields = trimmed.split(/\s+/);
@@ -711,8 +711,24 @@ function create(opts) {
     });
   }
 
+  // Node coerces a setTimeout delay greater than the 32-bit signed max
+  // (2147483647 ms ≈ 24.8 days) to 1 ms — so a far-future task would fire
+  // immediately, and an interval longer than the max would tight-loop. Wait
+  // the max chunk, then re-arm for the remainder WITHOUT firing.
+  var TIMEOUT_MAX_MS = 2147483647;
+
   function _arm(task) {
     var delay = Math.max(0, task.nextRun - Date.now());
+    if (delay > TIMEOUT_MAX_MS) {
+      var tc = setTimeout(function () {
+        timers.delete(tc);
+        if (!started) return;
+        _arm(task);                                // re-arm for the remaining delay; do NOT fire yet
+      }, TIMEOUT_MAX_MS);
+      if (typeof tc.unref === "function") tc.unref();
+      timers.add(tc);
+      return;
+    }
     var t = setTimeout(function () {
       timers.delete(t);
       if (!started) return;

package/lib/vendor/blamejs/lib/self-update-standalone-verifier.js

@@ -181,6 +181,14 @@ function verify(assetPath, signaturePath, pubkeyPem) {
   var signature;
   try {
     var sigStat = nodeFs.fstatSync(sigFd);
+    // Bound the alloc: the largest supported signature (ML-DSA-87) is ~4.6 KB;
+    // 64 KiB is far above any legitimate sig and stops Buffer.allocUnsafe(stat.size)
+    // from OOM-ing if signaturePath is pointed at a giant file. Zero-dep by
+    // contract — inline literal, cannot import C.BYTES.
+    if (sigStat.size > 64 * 1024) {   // allow:raw-byte-literal — zero-dep module
+      throw new Error("standalone-verifier.verify: signature file implausibly large (" +
+                      sigStat.size + " bytes)");
+    }
     signature = Buffer.allocUnsafe(sigStat.size);
     if (sigStat.size > 0) nodeFs.readSync(sigFd, signature, 0, sigStat.size, 0);
   } finally {
@@ -219,6 +227,14 @@ function verify(assetPath, signaturePath, pubkeyPem) {
   // to come from the same {0..assetStat.size} range fixed at open
   // time.
   var assetStat = nodeFs.fstatSync(assetFd);
+  // Bound the asset alloc before Buffer.allocUnsafe(assetStat.size): a self-update
+  // bundle (SEA) is intentionally large, so the ceiling is generous (2 GiB), but
+  // it stops a signaturePath/assetPath pointed at an unbounded file from OOM-ing
+  // the verifier before any byte is hashed. Zero-dep by contract — inline literal.
+  if (assetStat.size > 2 * 1024 * 1024 * 1024) {   // allow:raw-byte-literal — zero-dep module, 2 GiB asset ceiling
+    throw new Error("standalone-verifier.verify: asset implausibly large (" +
+                    assetStat.size + " bytes) — exceeds the 2 GiB self-update ceiling");
+  }
   var sha256 = nodeCrypto.createHash("sha256");
   var sha3   = nodeCrypto.createHash("sha3-512");
   var verifier = (alg === "ecdsa-p384") ? nodeCrypto.createVerify("sha3-512") : null;

package/lib/vendor/blamejs/lib/session.js

@@ -843,8 +843,16 @@ async function destroyAllForUser(userId) {
   // userId is sealed; look up via derived userIdHash.
   var lookup = cryptoField.lookupHash(SESSION_TABLE, "userId", userId);
   if (!lookup) {
+    // The session table's userIdHash derived-hash schema is registered during
+    // b.db.init(). A pluggable-store consumer (b.session.useStore) who never
+    // called b.db.init() lands here first — surface that, not just an opaque
+    // "framework misconfigured", since destroyAllForUser still needs b.db for
+    // the userIdHash index + the stateless valid-from boundary.
     throw _err("MISCONFIGURED",
-      "the session table schema is missing the userIdHash derived hash — framework misconfigured",
+      "session.destroyAllForUser: the session table's userIdHash derived-hash schema is " +
+      "not registered. It is registered during b.db.init() — call b.db.init() at boot even " +
+      "when session data lives in a pluggable store (b.session.useStore). If b.db is already " +
+      "initialized, the session table schema is misconfigured.",
       true);
   }
   // Dual-read across the keyed-MAC flip: a pre-v0.15.0 session row carries
@@ -860,8 +868,24 @@ async function destroyAllForUser(userId) {
   var result = await _currentStore().execute(built.sql, built.params);
   // Also raise the stateless valid-from boundary so a "logout everywhere"
   // revokes the operator's stateless tokens (sealed cookies / JWTs checked via
-  // b.session.check) too, not only the store-backed rows just deleted.
-  await bump(userId);
+  // b.session.check) too, not only the store-backed rows just deleted. This
+  // bump writes to the FRAMEWORK db (clusterStorage); a pluggable-store consumer
+  // (b.session.useStore) who never ran b.db.init() would otherwise surface the
+  // opaque "db/not-initialized" here, after the store delete already succeeded.
+  // Rethrow it as a session-specific, actionable error.
+  try {
+    await bump(userId);
+  } catch (e) {
+    if (e && e.code === "db/not-initialized") {
+      throw _err("MISCONFIGURED",
+        "session.destroyAllForUser raises the stateless valid-from boundary (so a " +
+        "logout-everywhere also revokes sealed-cookie / JWT sessions), which requires " +
+        "b.db.init() — call it at boot even when session data lives in a pluggable " +
+        "store (b.session.useStore). The store-backed rows were already deleted; rerun " +
+        "after b.db.init() to also raise the stateless boundary.", true);
+    }
+    throw e;
+  }
   return result.rowCount || 0;
 }
 

package/lib/vendor/blamejs/lib/sql.js

@@ -439,7 +439,7 @@ class SqlFunction {
       throw _err("b.sql.fn(name): name must be a string", "sql-builder/bad-fn");
     }
     var key = name.toUpperCase();
-    if (SQL_FUNCTIONS[key] === undefined) {
+    if (!Object.prototype.hasOwnProperty.call(SQL_FUNCTIONS, key)) {
       throw _err("b.sql.fn(name): '" + name + "' is not an allowlisted SQL function " +
         "(NOW / CURRENT_TIMESTAMP / CURRENT_DATE / CURRENT_TIME); a bound value uses a ? " +
         "placeholder, an arbitrary expression uses a guarded raw fragment", "sql-builder/bad-fn");
@@ -513,7 +513,7 @@ function _castType(type, dialect) {
     throw _err("cast type must be a non-empty string", "sql-builder/bad-cast");
   }
   var key = type.toLowerCase();
-  if (CAST_TYPES[key] === undefined) {
+  if (!Object.prototype.hasOwnProperty.call(CAST_TYPES, key)) {
     throw _err("cast type '" + type + "' is not on the allowlist (jsonb / json / " +
       "interval / uuid / text / int / bigint / timestamptz / boolean)", "sql-builder/bad-cast");
   }
@@ -3519,7 +3519,7 @@ var catalog = Object.freeze({
  *   b.sql.pragma("journal_mode").sql;             // -> 'PRAGMA journal_mode'  (read)
  */
 function pragma(verb, arg) {
-  if (typeof verb !== "string" || CATALOG_PRAGMA_VERBS[verb] === undefined) {
+  if (typeof verb !== "string" || !Object.prototype.hasOwnProperty.call(CATALOG_PRAGMA_VERBS, verb)) {
     throw _err("pragma: verb '" + verb + "' is not on the allowlist (journal_mode / " +
       "synchronous / wal_checkpoint); a PRAGMA outside this set is refused by design",
       "sql-builder/bad-pragma");

package/lib/vendor/blamejs/lib/static.js

@@ -42,6 +42,7 @@ var nodeFs = require("node:fs");
 var fsp = require("node:fs/promises");
 var nodeCrypto = require("node:crypto");
 var nodePath = require("node:path");
+var atomicFile = require("./atomic-file");
 var C = require("./constants");
 var gateContract = require("./gate-contract");
 var lazyRequire = require("./lazy-require");
@@ -240,10 +241,16 @@ async function _readMeta(root, candidate) {
   var sri = nodeCrypto.createHash("sha384");
   var sha3 = nodeCrypto.createHash("sha3-512");
   await new Promise(function (resolve, reject) {
-    // The path handed to createReadStream is the confined output of
-    // `_assertInsideRoot(root, candidate)` above (lexical resolve +
-    // root-prefix containment), not the request-derived candidate.
-    var s = nodeFs.createReadStream(absPath);
+    // The path is the confined output of `_assertInsideRoot(root, candidate)`
+    // above (lexical resolve + root-prefix containment). Open it O_NOFOLLOW and
+    // stream from that fd: lexical confinement still leaves a window where a
+    // symlink swapped in at the final component after the check would be
+    // followed by a plain createReadStream (CWE-22 / CWE-367); O_NOFOLLOW refuses
+    // it. The open throws synchronously on a symlink (ELOOP) / missing file —
+    // reject the hash promise so the caller falls back exactly as on a read error.
+    var s;
+    try { s = nodeFs.createReadStream(absPath, { fd: atomicFile.openNoFollowSync(absPath) }); }
+    catch (e) { reject(e); return; }
     s.on("data", function (chunk) { sri.update(chunk); sha3.update(chunk); });
     s.on("end", resolve);
     s.on("error", reject);
@@ -399,7 +406,7 @@ function _shouldForceAttachment(contentType, ext, contentSafetyMap, allowSvgRend
     return true;
   }
   if (bare.indexOf("text/") === 0) return false;
-  if (SAFE_RENDER_RASTER_MIMES[bare]) return false;
+  if (Object.prototype.hasOwnProperty.call(SAFE_RENDER_RASTER_MIMES, bare)) return false;
   if (bare === "image/svg+xml") {
     if (!allowSvgRender) return true;
     if (!contentSafetyMap || typeof contentSafetyMap !== "object") return true;
@@ -884,10 +891,21 @@ function create(opts) {
     // `_assertInsideRoot`, not the request-derived candidate.
     var confined = _assertInsideRoot(root, absPath);
     if (!confined) return { ok: false, reason: "read-failed" };
+    // Only the first 64 KiB is ever inspected, so read JUST that prefix from an
+    // O_NOFOLLOW fd: the previous fsp.readFile slurped the WHOLE file into memory
+    // just to sniff its header — a request-reachable OOM on a user-content mount
+    // — and followed a post-confinement symlink swap. A PREFIX read (not a
+    // maxBytes refusal) is required so a large but allowed file still serves.
     var sample;
-    try { sample = await fsp.readFile(confined, { flag: "r" }); }
-    catch (_e) { return { ok: false, reason: "read-failed" }; }
-    var detected = fileType.detect(sample.slice(0, C.BYTES.kib(64))) || {};
+    try {
+      var sniffFd = atomicFile.openNoFollowSync(confined);
+      try {
+        var sniffBuf = Buffer.alloc(C.BYTES.kib(64));
+        var sniffN = nodeFs.readSync(sniffFd, sniffBuf, 0, sniffBuf.length, 0);
+        sample = sniffBuf.slice(0, sniffN);
+      } finally { nodeFs.closeSync(sniffFd); }
+    } catch (_e) { return { ok: false, reason: "read-failed" }; }
+    var detected = fileType.detect(sample) || {};
     if (!detected.mime) return { ok: false, reason: "indeterminate" };
     if (allowedFileTypes.indexOf(detected.mime) === -1) {
       return { ok: false, reason: "not-allowed", detected: detected.mime };
@@ -1051,6 +1069,23 @@ function create(opts) {
           // creation can ever ride this code path.
           gateHandle = await fsp.open(gateConfined, gateOpenFlags, 0o600);
           var gateStat = await gateHandle.stat();
+          // Cap before Buffer.alloc(gateStat.size): the gate buffers the WHOLE
+          // file to inspect it, so a multi-GiB file on a user-content mount is a
+          // request-reachable OOM lever. A file too large for the gate to vet is
+          // refused (the gate's own "refuse" disposition) rather than buffered.
+          if (gateStat.size > C.BYTES.mib(16)) {
+            stats.failures += 1;
+            _emitObs("staticServe.content_safety_refused", 1, { route: urlPath });
+            try { await gateHandle.close(); } catch (_ce) { /* close best-effort */ }
+            if (auditFailures) {
+              emitAudit("staticServe.serve.failure", Object.assign({
+                outcome: "failure", reason: "content_safety_too_large",
+                resource: urlPath, ext: ext, sizeBytes: gateStat.size,
+              }, actorCtx));
+            }
+            return writeErr(res, HTTP.UNSUPPORTED_MEDIA_TYPE,
+              "content_safety_refused", "Unsupported Media Type");
+          }
           gateBuf = Buffer.alloc(gateStat.size);
           var gateRead = 0;
           while (gateRead < gateStat.size) {
@@ -1135,8 +1170,11 @@ function create(opts) {
         "precondition_failed", "Precondition Failed");
     }
 
-    // Conditional: If-Modified-Since (304)
-    var ifModSince = headersIn["if-modified-since"];
+    // Conditional: If-Modified-Since (304) — RFC 7232 §6: evaluated ONLY when
+    // If-None-Match is absent. Otherwise a changed-ETag resource rewritten
+    // within the same wall-clock second (mtime compared at second granularity)
+    // would be falsely reported 304 despite the content hash differing.
+    var ifModSince = !ifNone && headersIn["if-modified-since"];
     if (ifModSince) {
       var ims = Date.parse(ifModSince);
       if (isFinite(ims) && Math.floor(meta.mtimeMs / C.TIME.seconds(1)) <= Math.floor(ims / C.TIME.seconds(1))) {
@@ -1151,8 +1189,9 @@ function create(opts) {
       }
     }
 
-    // Conditional: If-Unmodified-Since (412)
-    var ifUnmodSince = headersIn["if-unmodified-since"];
+    // Conditional: If-Unmodified-Since (412) — RFC 7232 §6: evaluated ONLY
+    // when If-Match is absent.
+    var ifUnmodSince = !ifMatch && headersIn["if-unmodified-since"];
     if (ifUnmodSince) {
       var ius = Date.parse(ifUnmodSince);
       if (isFinite(ius) && Math.floor(meta.mtimeMs / C.TIME.seconds(1)) > Math.floor(ius / C.TIME.seconds(1))) {
@@ -1348,7 +1387,20 @@ function create(opts) {
     }
 
     var streamOpts = range ? { start: range.start, end: range.end } : {};
-    var fileStream = nodeFs.createReadStream(streamTarget, streamOpts);
+    // Open streamTarget (the re-confined _assertInsideRoot output) O_NOFOLLOW and
+    // stream from that fd, so a symlink swapped in at the final component after
+    // confinement is refused (ELOOP) rather than followed (CWE-22 / CWE-367).
+    // Headers are already committed here, so a sync refusal can't re-issue a 404
+    // — abort the connection instead of serving the swapped target.
+    var fileStream;
+    try {
+      fileStream = nodeFs.createReadStream(streamTarget,
+        Object.assign({ fd: atomicFile.openNoFollowSync(streamTarget) }, streamOpts));
+    } catch (_openErr) {
+      releaseSlot();
+      try { res.destroy(); } catch (_d) { /* already torn down */ }
+      return;
+    }
 
     // Idle timeout — close the connection if the client stalls. Pattern is
     // a deadline-style debounce (clearTimeout + setTimeout) tied directly

package/lib/vendor/blamejs/lib/template.js

@@ -93,6 +93,7 @@ var nodeFs = require("node:fs");
 var nodePath = require("node:path");
 var lazyRequire = require("./lazy-require");
 var validateOpts = require("./validate-opts");
+var markupEscape = require("./markup-escape").markupEscape;
 
 // Lazy because b.template can be loaded before b.sandbox (which pulls
 // in node:worker_threads). Operators not opting into sandboxed helpers
@@ -116,9 +117,6 @@ var DEFAULT_STRING_TEMPLATE_BYTES = require("./constants").BYTES.kib(256);
 // HTML escape (exported)
 // ============================================================
 
-var ESCAPE_MAP = { "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#x27;" };
-var ESCAPE_RE = /[&<>"']/g;
-
 /**
  * @primitive b.template.escapeHtml
  * @signature b.template.escapeHtml(value)
@@ -141,8 +139,12 @@ var ESCAPE_RE = /[&<>"']/g;
  */
 function escapeHtml(value) {
   if (value === null || value === undefined) return "";
-  var s = typeof value === "string" ? value : String(value);
-  return s.replace(ESCAPE_RE, function (c) { return ESCAPE_MAP[c]; });
+  // Delegate the actual escaping to the centralized markup escaper so the
+  // five-character HTML set (& < > " ') is defined in one place — a divergence
+  // between this and the shared escaper is an XSS / XML-injection surface. The
+  // apostrophe is escaped to its numeric form for safety in single-quoted
+  // attribute contexts (the historical behavior of this primitive).
+  return markupEscape(value, { apos: "&#x27;" });
 }
 
 // ============================================================

package/lib/vendor/blamejs/lib/tenant-quota.js

@@ -52,6 +52,7 @@
 
 var C = require("./constants");
 var lazyRequire = require("./lazy-require");
+var boundedMap = require("./bounded-map");
 var validateOpts = require("./validate-opts");
 var { defineClass } = require("./framework-error");
 
@@ -354,18 +355,47 @@ function budget(opts) {
   }
   var auditOn = opts.audit !== false;
 
-  // tenantId → { windowStart, calls, rowsRead }
+  // TRUE sliding window (RFC-ish rolling counter, as advertised) — the prior
+  // first-call-pinned fixed window admitted ~2x the cap in a boundary burst.
+  // The window is split into BINS sub-bins; each observe lands in the current
+  // bin and the cap is enforced against the trailing-window SUM, so a burst
+  // straddling the reset can't double the rate. Mirrors network-byte-quota's
+  // _slideAndSum ring (here with two counters + a configurable bin width).
+  var BINS = 12;
+  var binMs = Math.max(1, Math.floor(windowMs / BINS));
+
+  // tenantId → { calls: number[BINS], rows: number[BINS], startBin }
   var counters = new Map();
 
-  function _slot(tenantId, now) {
-    var c = counters.get(tenantId);
-    if (!c || (now - c.windowStart) >= windowMs) {
-      c = { windowStart: now, calls: 0, rowsRead: 0 };
-      counters.set(tenantId, c);
+  // Advance the ring so its BINS bins cover the trailing [nowBin-BINS+1 .. nowBin],
+  // zeroing bins that scrolled out of the window. Returns the tenant's ring.
+  function _slide(tenantId, now) {
+    var nowBin = Math.floor(now / binMs);
+    // A freshly-created ring is anchored at the current bin, so the advance
+    // below evaluates to 0 (no-op) on the create path — get-or-insert and the
+    // slide stay one code path.
+    var c = boundedMap.getOrInsert(counters, tenantId, function () {
+      return { calls: new Array(BINS).fill(0), rows: new Array(BINS).fill(0), startBin: nowBin - (BINS - 1) };
+    });
+    var advance = nowBin - (c.startBin + (BINS - 1));
+    if (advance > 0) {
+      if (advance >= BINS) {
+        c.calls.fill(0); c.rows.fill(0);
+      } else {
+        for (var i = 0; i < BINS - advance; i++) { c.calls[i] = c.calls[i + advance]; c.rows[i] = c.rows[i + advance]; }
+        for (var k = BINS - advance; k < BINS; k++) { c.calls[k] = 0; c.rows[k] = 0; }
+      }
+      c.startBin = nowBin - (BINS - 1);
     }
     return c;
   }
 
+  function _sum(c) {
+    var calls = 0, rows = 0;
+    for (var i = 0; i < BINS; i++) { calls += c.calls[i]; rows += c.rows[i]; }
+    return { calls: calls, rowsRead: rows };
+  }
+
   var _emitAudit = audit().namespaced(null, { audit: auditOn });
 
   function _emitMetric(name, n) {
@@ -378,16 +408,19 @@ function budget(opts) {
       "tenantQuota.budget.observe: tenantId", TenantQuotaError, "tenant-quota/bad-tenant");
     info = info || {};
     var rowsRead = (typeof info.rowsRead === "number" && info.rowsRead >= 0) ? info.rowsRead : 0;
-    var now = Date.now();
-    var c = _slot(tenantId, now);
-    c.calls += 1;
-    c.rowsRead += rowsRead;
+    // info.now lets a caller / test supply a deterministic clock (idiomatic —
+    // mirrors auth verifiers' opts.now); defaults to wall-clock.
+    var now = (typeof info.now === "number") ? info.now : Date.now();
+    var c = _slide(tenantId, now);
+    c.calls[BINS - 1] += 1;
+    c.rows[BINS - 1] += rowsRead;
+    var tot = _sum(c);
     var maxCalls = Math.max(1, Math.floor(qpsCap * (windowMs / C.TIME.seconds(1))));
-    if (c.calls > maxCalls || c.rowsRead > rowsCap) {
+    if (tot.calls > maxCalls || tot.rowsRead > rowsCap) {
       _emitAudit("tenant.budget.exceeded", "denied", {
         tenantId: tenantId,
-        calls:    c.calls,
-        rowsRead: c.rowsRead,
+        calls:    tot.calls,
+        rowsRead: tot.rowsRead,
         qpsCap:   qpsCap,
         rowsCap:  rowsCap,
         windowMs: windowMs,
@@ -395,19 +428,19 @@ function budget(opts) {
       _emitMetric("tenant.budget.exceeded", 1);
       throw new TenantQuotaError("tenant-quota/budget-exceeded",
         "tenantQuota.budget: tenant '" + tenantId + "' exceeded budget " +
-        "(calls=" + c.calls + "/" + maxCalls + ", rowsRead=" + c.rowsRead +
+        "(calls=" + tot.calls + "/" + maxCalls + ", rowsRead=" + tot.rowsRead +
         "/" + rowsCap + ", windowMs=" + windowMs + ")");
     }
-    return { calls: c.calls, rowsRead: c.rowsRead, windowMs: windowMs };
+    return { calls: tot.calls, rowsRead: tot.rowsRead, windowMs: windowMs };
   }
 
   function snapshot(tenantId) {
-    var now = Date.now();
-    var c = counters.get(tenantId);
-    if (!c || (now - c.windowStart) >= windowMs) {
+    if (!counters.has(tenantId)) {
       return { tenantId: tenantId, calls: 0, rowsRead: 0, windowMs: windowMs };
     }
-    return { tenantId: tenantId, calls: c.calls, rowsRead: c.rowsRead, windowMs: windowMs };
+    var c = _slide(tenantId, Date.now());
+    var tot = _sum(c);
+    return { tenantId: tenantId, calls: tot.calls, rowsRead: tot.rowsRead, windowMs: windowMs };
   }
 
   function reset(tenantId) {

package/lib/vendor/blamejs/lib/tsa.js

@@ -56,6 +56,7 @@ var bCrypto = require("./crypto");
 var safeBuffer = require("./safe-buffer");
 var asn1 = require("./asn1-der");
 var cms = require("./cms-codec");
+var x509Chain = require("./x509-chain");
 var validateOpts = require("./validate-opts");
 var { defineClass } = require("./framework-error");
 
@@ -539,8 +540,10 @@ function _verifyChain(signerCertDer, tokenCerts, trustAnchorsPem, at) {
   throw new TsaError("tsa/chain-loop", "tsa.verifyToken: certificate chain did not terminate");
 }
 function _issued(issuer, subject) {
-  try { return subject.checkIssued(issuer) && subject.verify(issuer.publicKey); }
-  catch (_e) { return false; }
+  // Enforces basicConstraints cA:TRUE on the issuer in addition to the
+  // checkIssued + signature linkage — a non-CA cert can never be a chain
+  // issuer (basicConstraints bypass, CVE-2002-0862 class).
+  return x509Chain.issuerValidlyIssued(issuer, subject);
 }
 function _assertValidAt(cert, atMs) {
   if (atMs < cert.validFromDate.getTime() || atMs > cert.validToDate.getTime()) {

package/lib/vendor/blamejs/lib/vault/index.js

@@ -681,6 +681,11 @@ module.exports = {
   init:                  init,
   seal:                  seal,
   unseal:                unseal,
+  // The default sealed-storage Store: a { seal, unseal } pair backed by the
+  // in-process vault key. b.cert.create (and other sealed-disk consumers)
+  // resolve `opts.vault || getDefaultStore()`; documented in their @opts.
+  getDefaultStore:       function () { return { seal: seal, unseal: unseal }; },
+  Store:                 { seal: seal, unseal: unseal },
   getDerivedHashSalt:    getDerivedHashSalt,
   getDerivedHashMacKey:  getDerivedHashMacKey,
   _zeroizeAndReplace:    _zeroizeAndReplace,