@blamejs/blamejs-shop 0.4.68 → 0.4.70

package/lib/vendor/blamejs/test/layer-0-primitives/codebase-patterns.test.js

@@ -1647,12 +1647,16 @@ function testFormatValidatorLengthCap() {
       var line = lines[li];
       if (/^\s*(\/\/|\*|\/\*)/.test(line)) continue;
       if (!/\b[A-Z_]+_RE\.test\(/.test(line)) continue;
-      // Look for `length` mention in surrounding 5 lines (any
-      // comparison: <, >, =, !=, !==, including the explicit-length
-      // shape `s.length !== expectedLength`).
+      // Look for a length bound in the surrounding 5 lines (any comparison:
+      // <, >, =, !=, !==, including the explicit-length shape `s.length !==
+      // expectedLength`). A byte-length bound (Buffer.byteLength /
+      // safeBuffer.byteLengthOf) counts too — the byte-cap-vs-char-length
+      // hardening replaces `.length` caps with byte-length on multibyte input,
+      // and `byteLength(x) > MAX || RE.test(x)` short-circuits the regex on
+      // anything over the cap just as `.length` does.
       var window = (lines[li-2] || "") + (lines[li-1] || "") +
                    line + (lines[li+1] || "") + (lines[li+2] || "");
-      if (/\.length\s*[><=!]/.test(window)) continue;
+      if (/\.length\s*[><=!]/.test(window) || /byteLength/.test(window)) continue;
       bad.push({
         file:    _relPath(files[fi]),
         line:    li + 1,
@@ -3850,13 +3854,24 @@ async function testNoDuplicateCodeBlocks() {
     { mode: "family-subset", files: ["lib/ai-dp.js:mechanism", "lib/dora.js:_validateReportInput", "lib/guard-snapshot-envelope.js:validate"] },                        // fp:b0dceb3bd2fe
     { mode: "family-subset", files: ["lib/auth/sd-jwt-vc-issuer.js:create", "lib/fsm.js:define", "lib/mail.js:_validateMessage"] },                                      // fp:dff4eab2b4e0
     { mode: "family-subset", files: ["lib/csp.js:_parsePermissionsPolicyString", "lib/http-message-signature.js:_parseSignatureInput", "lib/network-tls.js:_parseSanString"] }, // fp:c998d327f9c0
-    { mode: "family-subset", files: ["lib/middleware/idempotency-key.js:resealMigrate", "lib/object-store/http-request.js:notModifiedGetResult", "lib/validate-opts.js:observabilityShape"] }, // fp:711a58281dd7
+    { mode: "family-subset", files: ["lib/middleware/idempotency-key.js:resealMigrate", "lib/object-store/http-request.js:promiseToStream", "lib/validate-opts.js:observabilityShape"] }, // fp:824f10cf9f10 (was notModifiedGetResult/fp:711a58281dd7 before promiseToStream landed adjacent — coincidental object-literal/return shingle across 3 unrelated fns)
     { mode: "family-subset", files: ["lib/auth/sd-jwt-vc-issuer.js:create", "lib/guard-saga-config.js:validate", "lib/network-heartbeat.js:_validateTarget"] },          // fp:c8f43d4d1941
     { mode: "family-subset", files: ["lib/auth/oauth.js:deviceAuthorization", "lib/auth/oauth.js:parseCallback", "lib/ddl-change-control.js:_hashSql", "lib/mail-rbl.js:query"] }, // fp:882fd32d8e11
     { mode: "family-subset", files: ["lib/auth/oid4vp.js:matchDcql", "lib/gate-contract.js:_ctxValueForKind", "lib/http-message-signature.js:_parseUrl"] },              // fp:726ed545b065
     { mode: "family-subset", files: ["lib/archive-adapters.js:close", "lib/crypto-field.js:listPerRowResidency", "lib/tracing.js:spanSync"] },                           // fp:c4617588ed77
     { mode: "family-subset", files: ["lib/backup/bundle.js:create", "lib/mail-greylist.js:check", "lib/safe-buffer.js:makeByteCoercer"] },                               // fp:d4c06878dcda
     { mode: "family-subset", files: ["lib/breach-deadline.js:trackReport", "lib/guard-snapshot-envelope.js:validate", "lib/incident-report.js:open"] },                  // fp:d7d8a89732c8
+    // Proto-shadow hardening converged these allowlist gates onto the framework's
+    // canonical `!Object.prototype.hasOwnProperty.call(MAP, key)` membership idiom
+    // (the 312-use convention), which pushed the shared validation preamble past
+    // the 50-token shingle. Shape-only: the maps, error classes, codes, and
+    // messages diverge per domain (mail-spam-score lists the valid profiles in
+    // its bad-profile message; guard-envelope does not — a deliberate per-caller
+    // choice, see gate-contract.resolveProfileName which owns only the resolution
+    // expression and leaves each caller its bespoke typed throw).
+    { mode: "family-subset", files: ["lib/guard-envelope.js:check", "lib/mail-greylist.js:create", "lib/mail-helo.js:evaluate", "lib/mail-rbl.js:create", "lib/mail-scan.js:create", "lib/mail-spam-score.js:create"] }, // fp:958143c0319d (was fp:59fd2e7ac678 before mail-scan's profile gate joined)
+    { mode: "family-subset", files: ["lib/mail-journal.js:_validateRegimes", "lib/middleware/tus-upload.js:create", "lib/safe-sieve.js:_parseCommand"] },                  // fp:2524f7ddf5a1
+    { mode: "family-subset", files: ["lib/breach-deadline.js:open", "lib/breach-deadline.js:trackReport", "lib/cms-codec.js:encodeEnvelopedData", "lib/cms-codec.js:encodeSignedData", "lib/mail-deploy.js:mtaStsPublish"] }, // fp:32fba36fb64e
     {
       // presigned-policy expiry-range validation + structure — shape-only. `var
       // ttl = opts.expiresIn != null ? opts.expiresIn : <default>; if (typeof ttl
@@ -5092,6 +5107,89 @@ var KNOWN_ANTIPATTERNS = [
     allowlist: ["lib/guard-auth.js"],
     reason: "v0.15.0 #103 — the guard sanitize/parse refuse-on-critical|high throw (err(issue.ruleId || '<x>.refused', 'guard<Name>.<op>: ' + issue.snippet)) is owned by gateContract.throwOnRefusalSeverity; 18 guards reuse it (this was the failing STRONG-DUP fp:f349a8d1f51b before extraction). A hand-rolled `issues[i].ruleId || '<x>.refused'` throw re-implements it. lib/guard-auth.js is the one genuine holdout (its message embeds issues[i].source: 'guardAuth.sanitize [<source>]:') pending task #104; the primitive itself uses a `fallback` variable (no .refused literal) so it does not match. Any other lib file with this shape must call gateContract.throwOnRefusalSeverity (the severities / op options cover the critical-only + parse variants).",
   },
+  {
+    id: "html-comment-scan-must-use-htmlCommentEnd",
+    primitive: "b.markupTokenizer.htmlCommentEnd",
+    scanScope: "lib",
+    skipCommentLines: true,
+    // The WHATWG HTML tokenizer closes a comment at "--!>" and ABRUPTLY at
+    // "<!-->" / "<!--->", not only "-->". An HTML/SVG-in-HTML scanner that
+    // searches indexOf("-->") disagrees with the browser on the comment
+    // boundary, so an element after an early terminator is swallowed as inert
+    // comment by the sanitizer but parsed LIVE by the browser (mXSS, the
+    // comment-parser differential). markupTokenizer.htmlCommentEnd owns the
+    // correct scan; guard-html / guard-svg / mail-bimi / html-balance route
+    // through it. XML comment scanners (safe-xml, xml-c14n) legitimately use
+    // "-->" because XML has neither "--!>" nor abrupt-close forms.
+    regex: /\.indexOf\("-->"/,
+    allowlist: ["lib/markup-tokenizer.js", "lib/parsers/safe-xml.js", "lib/xml-c14n.js"],
+    reason: "HTML/SVG-in-HTML comment scanning must use markupTokenizer.htmlCommentEnd (covers --!> + abrupt <!-->/<!--->), not a bare indexOf('-->'). XML scanners are exempt (XML has no such forms); markup-tokenizer.js is the primitive's home.",
+  },
+  {
+    id: "x509-issuer-check-must-enforce-ca",
+    primitive: "b.x509Chain.issuerValidlyIssued",
+    scanScope: "lib",
+    skipCommentLines: true,
+    // node:crypto X509Certificate.checkIssued() does NOT enforce
+    // basicConstraints cA:TRUE, so `subject.checkIssued(issuer)` used to
+    // accept a leaf / end-entity cert (cA:FALSE, no keyUsage) as a signing
+    // CA — the basicConstraints bypass (CVE-2002-0862 class) that hit
+    // tsa.js / mail-bimi.js / mail-crypto-smime.js. Every chain walker now
+    // routes its issuer test through x509Chain.issuerValidlyIssued (which
+    // adds the cA check). A hand-rolled `receiver.checkIssued(otherArg)`
+    // re-introduces the gap. The negative backref skips the legitimate
+    // self-signed-root probe `current.checkIssued(current)` (same receiver
+    // + arg), which is not an issuer-acceptance use.
+    regex: /\b(\w+)\.checkIssued\s*\(\s*(?!\1[\s,)])\w/,
+    allowlist: ["lib/x509-chain.js"],
+    reason: "basicConstraints cA:TRUE enforcement is owned by x509Chain.issuerValidlyIssued / x509Chain.isCaCert; tsa/mail-bimi/mail-crypto-smime route through it. Any lib file calling X.checkIssued(Y) (Y!=X) directly bypasses the cA check and must use x509Chain instead. lib/x509-chain.js is the home of the primitive.",
+  },
+  {
+    id: "trusted-proxy-cidr-must-canonicalize-peer",
+    primitive: "b.requestHelpers.trustedClientIp",
+    scanScope: "lib",
+    skipCommentLines: true,
+    // The peer-gating trustedProxies predicate matches the immediate peer
+    // address against operator CIDRs. cidrContains refuses a cross-family
+    // compare, so an IPv4-mapped IPv6 peer (::ffff:a.b.c.d from a dual-stack
+    // listener) silently fails an IPv4 CIDR and the proxy reads as untrusted —
+    // X-Forwarded-* is then ignored and the gate keys on the proxy. The peer
+    // MUST be folded through ssrfGuard.canonicalizeHost (var canon) first; a
+    // raw `cidrContains(trustedProxies[i], addr)` re-introduces the bypass.
+    regex: /cidrContains\(trustedProxies\[\w+\],\s*(?!canon\b)\w/,
+    allowlist: [],
+    reason: "Match the immediate peer against trustedProxies only after folding IPv4-mapped IPv6 via ssrfGuard.canonicalizeHost (the `canon` local) — cidrContains rejects a cross-family compare, so a raw peer addr lets a dual-stack proxy read as untrusted. request-helpers.js's _trustedProxyPredicate owns this.",
+  },
+  {
+    id: "http-upload-content-length-must-guard-transform",
+    primitive: "b.httpClient.request",
+    scanScope: "lib",
+    skipCommentLines: true,
+    // A Content-Length set from a Buffer body's length is wrong once a
+    // size-changing uploadTransform (gzip / encrypt / frame) is interposed —
+    // the server truncates extra bytes or waits for bytes that never arrive.
+    // The assignment must be guarded by `uploadTransforms.length === 0` so a
+    // transformed body is framed (chunked / DATA frames) on its real size.
+    regex: /Buffer\.isBuffer\(opts\.body\)(?:(?!uploadTransforms)[\s\S]){0,400}?content-length"\]\s*=\s*(?:String\()?opts\.body\.length/i,
+    allowlist: [],
+    reason: "Set Content-Length from opts.body.length only when uploadTransforms.length === 0 — a size-changing uploadTransform makes the original length wrong (truncation / hang). Omit it (chunked / H2 DATA frames) when a transform is present. lib/http-client.js owns both legs.",
+  },
+  {
+    id: "http-response-collect-must-use-download-pipeline",
+    primitive: "b.httpClient.request",
+    scanScope: "lib",
+    skipCommentLines: true,
+    // The buffered (non-stream) response collector must read from the
+    // _buildDownloadStream pipeline tail, not the raw socket stream — reading
+    // `res`/`stream` directly bypasses maxBytesPerSec + downloadTransform in
+    // buffer / always-resolve mode (the documented default), so a configured
+    // throttle / transform silently no-ops. Anchored on the full-response
+    // collector (maxResponseBytes) so the bounded error-prefix reader is not
+    // matched.
+    regex: /boundedChunkCollector\(\{ maxBytes: maxResponseBytes \}\)(?:(?!_buildDownloadStream)[\s\S]){0,300}?\b(?:res|stream)\.on\("data"/,
+    allowlist: [],
+    reason: "Feed the full-response collector from _buildDownloadStream(...) (the dlSource / dlH2 tail), never raw res/stream .on('data') — otherwise maxBytesPerSec / downloadTransform apply only in stream mode. lib/http-client.js owns both H1 + H2 paths.",
+  },
   {
     // A hard quota / rate / budget ceiling must be enforced with an
     // atomic conditional reserve — the limit test and the charge are
@@ -8390,6 +8488,49 @@ var KNOWN_ANTIPATTERNS = [
     allowlist: ["lib/atomic-file.js"],
     reason: "A TOCTOU-safe synchronous file read (open fd → fstat → read-fully loop, binding size/content/integrity to the fd's inode against a swap, CWE-367) is owned by b.atomicFile.fdSafeReadSync — with optional guards (maxBytes cap, refuseSymlink + inodeCheck, expectedHash, encoding, allowShortRead) and a per-caller errorFor(kind, detail) so each domain keeps its typed error. The §1 sweep routed the four hand-rolled read-fully loops: atomic-file._readSyncCore (the home; now the wrapper that supplies AtomicFileError messages), network-tls._readPathFile (utf8 + slice-on-short-read + raw ENOENT), vault/seal-pem-file._resealNow (the strongest posture: refuseSymlink + inodeCheck + maxSourceBytes, SealPemFileError codes wrapped by its outer audit/onError catch), backup/bundle.create (BackupBundleError short-read with per-entry relativePath). Allowlist is lib/atomic-file.js (fdSafeReadSync's own loop is the single home); a re-introduced `readSync(fd, buf, read, size - read, null)` read-loop anywhere else trips this — call b.atomicFile.fdSafeReadSync instead.",
   },
+  {
+    id: "raw-fs-write-without-exclusive-nofollow",
+    primitive: "b.atomicFile.writeSync / writeStream / writeExclSync — atomic, O_EXCL|O_NOFOLLOW write-replace",
+    // The write-side sibling of fd-read-loop-hand-rolled. A bare
+    // nodeFs.writeFileSync(path, ...) / nodeFs.createWriteStream(path) follows
+    // a symlink an attacker pre-planted at `path` (CWE-59 arbitrary write) and
+    // leaves a torn file at the canonical name on a crash. Every framework
+    // write-replace goes through an atomic-file primitive that stages into a
+    // CSPRNG temp opened O_EXCL|O_NOFOLLOW and renames: writeSync (buffer),
+    // writeStream (streaming source), writeExclSync (staged write→verify→rename
+    // for the vault seal/unseal/rotate round-trip).
+    scanScope: "lib",
+    skipCommentLines: true,
+    regex: /\bnodeFs\.(?:writeFileSync|createWriteStream)\s*\(/,
+    allowlist: [
+      "lib/atomic-file.js",   // primitives' home: createWriteStream(null, { fd }) over an _openExclTemp fd (the fd already carries O_EXCL|O_NOFOLLOW)
+      "lib/backup/index.js",  // fsAdapter.writeFile uses writeFileSync(..., { flag: "wx" }) — O_CREAT|O_EXCL refuses (EEXIST) a pre-planted file/symlink
+      "lib/http-client.js",   // downloadStream: createWriteStream(tmpPath, { flags: O_WRONLY|O_CREAT|O_EXCL|O_NOFOLLOW }) — explicit exclusive no-follow create
+    ],
+    reason: "Symlink-follow / torn-write class (CWE-59 / CWE-377). A raw nodeFs.writeFileSync / nodeFs.createWriteStream to a destination path follows a symlink an attacker pre-planted there and can leave a half-written file on a crash. The §1 sweep routed every hand-rolled write through an atomic-file primitive: writeSync (buffer payloads — cookie-jar flush, archive/tar extract, backup payloads, p12 export, api-snapshot, sealed-pem marker), writeStream (object-store streaming put — staged into a no-follow exclusive temp + atomic rename, capped by maxBytes), and writeExclSync (the vault seal/unseal/rotate staged write that must re-read + verify the bytes before the rename — clears any stale entry then O_EXCL|O_NOFOLLOW creates so a re-planted symlink fails closed). The three allowlisted files are the genuinely-safe forms: atomic-file.js owns the primitives (its createWriteStream binds an _openExclTemp fd); backup/index.js writeFileSync passes { flag: 'wx' } (O_EXCL refuses a pre-planted target); http-client.js opens its download temp with explicit O_WRONLY|O_CREAT|O_EXCL|O_NOFOLLOW flags. Any new raw nodeFs.writeFileSync/createWriteStream elsewhere trips this — call the matching atomic-file primitive instead.",
+  },
+  {
+    id: "allowlist-map-indexed-by-untrusted-key-without-hasown",
+    primitive: "Object.prototype.hasOwnProperty.call(MAP, key) — proto-shadow-safe allowlist membership",
+    // Prototype-pollution / proto-shadow class. An object-literal allowlist
+    // (`var MAP = { a: 1 }`) inherits Object.prototype, so MAP["constructor"],
+    // MAP["__proto__"], MAP["toString"], MAP["valueOf"], MAP["hasOwnProperty"]
+    // are all TRUTHY (and !== undefined) even though never added. A membership
+    // gate `if (!MAP[key])` (reject-if-absent) or `if (MAP[key] === undefined)`
+    // is therefore BYPASSED by a proto-named key when `key` is attacker- or
+    // caller-controlled, and `var v = MAP[key]` then hands back a Function /
+    // prototype member. The framework's 312-use idiom is
+    // `Object.prototype.hasOwnProperty.call(MAP, key)` (own-key only). This
+    // detector forbids the bare negated-bracket and `=== undefined` membership
+    // shapes against a SCREAMING_CASE allowlist; reject-if-PRESENT gates
+    // (`if (DROP[tag]) drop`) are a DIFFERENT, fail-safe polarity and use the
+    // positive `if (MAP[key])` form this regex does not match.
+    scanScope: "lib",
+    skipCommentLines: true,
+    regex: /!\s*(?:[a-zA-Z_$][\w$]*\.)?[A-Z][A-Z0-9_]{2,}\[\s*[a-z]|[A-Z][A-Z0-9_]{2,}\[[a-z][\w.]*\]\s*===\s*undefined/,
+    allowlist: [],
+    reason: "Proto-shadow allowlist-bypass class (CWE-1321 prototype pollution / unsafe reflection). A reject-if-absent membership check on an object-literal allowlist — `if (!MAP[key])` or `if (MAP[key] === undefined)` — passes for any Object.prototype member name (constructor / __proto__ / toString / valueOf / hasOwnProperty) when `key` is attacker- or caller-supplied, bypassing the allowlist and (for value-lookup callers) handing a Function downstream. The v0.15.14 sweep converted every such gate across lib/ to the framework's canonical `Object.prototype.hasOwnProperty.call(MAP, key)` membership idiom (already 312 uses). Zero allowlist: a re-introduced `!SCREAMING_MAP[lowercaseKey]` or `SCREAMING_MAP[key] === undefined` membership gate anywhere in lib/ trips this — use hasOwnProperty.call instead. Reject-if-PRESENT gates (`if (DANGEROUS[scheme]) refuse`) are the opposite, fail-safe polarity and are written with the positive `if (MAP[key])` form, which this detector deliberately does not match (adding hasOwnProperty there would weaken them).",
+  },
   {
     id: "inline-optional-non-empty-string-array-validation",
     primitive: "validateOpts.optionalNonEmptyStringArray(value, label, ErrorClass, code?)",

package/lib/vendor/blamejs/test/layer-0-primitives/compliance-sanctions.test.js

@@ -231,6 +231,20 @@ function testScreenTypeFilter() {
   var r = screener.screen({ name: "Acme Corporation", type: "individual" });
   check("screen type filter: entity matches still allowed",
         r.match === true && r.hits[0].type === "entity");
+
+  // A sanctions screen MUST over-match on the NAME: a sanctioned INDIVIDUAL
+  // screened with a DIFFERING operator-asserted type (the counterparty's
+  // unverified self-classification) must STILL match — previously the type
+  // filter `continue`d past it, an under-match / fail-open false negative.
+  var rv = screener.screen({ name: "JOHN ALEXANDER SMITH", type: "vessel" });
+  check("screen: sanctioned individual still matches under a differing type",
+        rv.match === true && rv.hits.length >= 1 && rv.hits[0].type === "individual");
+  check("screen: type mismatch surfaced as non-dispositive typeMatch:false",
+        rv.hits[0].typeMatch === false);
+  var rmatch = screener.screen({ name: "JOHN ALEXANDER SMITH", type: "individual" });
+  check("screen: typeMatch true when asserted type matches", rmatch.hits[0].typeMatch === true);
+  var rnotype = screener.screen({ name: "JOHN ALEXANDER SMITH" });
+  check("screen: typeMatch null when no type asserted", rnotype.hits[0].typeMatch === null);
 }
 
 function testScreenCorrectAlgorithmEcho() {

package/lib/vendor/blamejs/test/layer-0-primitives/compression-range.test.js

@@ -0,0 +1,115 @@
+"use strict";
+/**
+ * b.middleware.compression — range/partial-content pass-through.
+ *
+ * A 206 Partial Content or any Content-Range response must NOT be
+ * transformed (RFC 7233 §4.1): compressing it drops Content-Length but
+ * leaves Content-Range advertising an uncompressed byte interval over a
+ * now-compressed body, corrupting range-assembling clients.
+ */
+
+var helpers = require("../helpers");
+var b       = helpers.b;
+var check   = helpers.check;
+
+function _fakeRes() {
+  var headers = {};
+  var chunks  = [];
+  var ended   = false;
+  return {
+    statusCode: 200,
+    writeHead: function (status, a, c) {
+      this.statusCode = status;
+      var hdrs = (c && typeof c === "object") ? c
+               : (a && typeof a === "object" && !Array.isArray(a)) ? a : null;
+      if (hdrs) {
+        var keys = Object.keys(hdrs);
+        for (var i = 0; i < keys.length; i++) headers[keys[i].toLowerCase()] = hdrs[keys[i]];
+      }
+      return this;
+    },
+    write: function (chunk) {
+      if (chunk != null) chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk)));
+      return true;
+    },
+    end: function (chunk) {
+      if (chunk != null) chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk)));
+      ended = true;
+      return this;
+    },
+    setHeader:    function (k, v) { headers[k.toLowerCase()] = v; },
+    getHeader:    function (k) { return headers[k.toLowerCase()]; },
+    removeHeader: function (k) { delete headers[k.toLowerCase()]; },
+    emit:         function () {},
+    _headers: headers,
+    _body:    function () { return Buffer.concat(chunks); },
+    _ended:   function () { return ended; },
+  };
+}
+
+function testPartialContent206NotCompressed() {
+  var mw   = b.middleware.compression({ threshold: 0 });
+  var req  = { headers: { "accept-encoding": "gzip" } };
+  var res  = _fakeRes();
+  var body = Buffer.from("X".repeat(4096));
+  mw(req, res, function () {});
+  res.writeHead(206, {
+    "Content-Type":   "text/plain",
+    "Content-Range":  "bytes 0-4095/100000",
+    "Content-Length": String(body.length),
+  });
+  res.end(body);
+  check("206 response carries no Content-Encoding", !res.getHeader("content-encoding"));
+  check("206 body passes through verbatim (uncompressed)", res._body().equals(body));
+}
+
+function testContentRange200NotCompressed() {
+  // A 200 that still carries a Content-Range header (multi-range / explicit
+  // single range over 200) must also pass through untransformed.
+  var mw   = b.middleware.compression({ threshold: 0 });
+  var req  = { headers: { "accept-encoding": "gzip" } };
+  var res  = _fakeRes();
+  var body = Buffer.from("Y".repeat(4096));
+  mw(req, res, function () {});
+  res.writeHead(200, {
+    "Content-Type":  "text/plain",
+    "Content-Range": "bytes 0-4095/8192",
+  });
+  res.end(body);
+  check("Content-Range 200 carries no Content-Encoding", !res.getHeader("content-encoding"));
+  check("Content-Range 200 body passes through verbatim", res._body().equals(body));
+}
+
+async function testPlain200StillCompresses() {
+  // Control: a normal compressible 200 still gets compressed, so the
+  // range guard isn't disabling compression wholesale.
+  var mw   = b.middleware.compression({ threshold: 0 });
+  var req  = { headers: { "accept-encoding": "gzip" } };
+  var res  = _fakeRes();
+  var body = Buffer.from("Z".repeat(4096));
+  mw(req, res, function () {});
+  res.writeHead(200, { "Content-Type": "text/plain" });
+  res.end(body);
+  check("plain compressible 200 sets Content-Encoding: gzip",
+    res.getHeader("content-encoding") === "gzip");
+  // zlib flushes asynchronously; wait for the wrapped end before asserting.
+  await helpers.waitUntil(function () { return res._ended(); }, {
+    timeoutMs: 5000,
+    label: "compression-range: compressed response flushed",
+  });
+  check("plain compressible 200 body is transformed (smaller than source)",
+    res._body().length > 0 && res._body().length < body.length);
+}
+
+async function run() {
+  testPartialContent206NotCompressed();
+  testContentRange200NotCompressed();
+  await testPlain200StillCompresses();
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  run().then(function () { console.log("OK compression-range — " + helpers.getChecks() + " checks"); })
+       .catch(function (e) { console.error("FAIL:", e && e.stack || e); process.exit(1); });
+}

package/lib/vendor/blamejs/test/layer-0-primitives/content-credentials.test.js

@@ -51,7 +51,7 @@ function _makeTsaCert() {
 // self-signed (issuer null). Used to assemble a real [leaf, intermediate,
 // root] chain so the identity-assertion chain walk is exercised through
 // an intermediate CA, not only a direct-root / self-signed leaf.
-function _makeCert(cn, issuer) {
+function _makeCert(cn, issuer, isCa) {
   var kp = nodeCrypto.generateKeyPairSync("rsa", { modulusLength: 2048 });
   var spki = kp.publicKey.export({ type: "spki", format: "der" });
   var subjName  = _certName(cn);
@@ -62,7 +62,19 @@ function _makeCert(cn, issuer) {
   var serial = asn1.writeInteger(Buffer.from([0x2b]));
   var now = Date.now();
   var validity = asn1.writeSequence([_utcTime(new Date(now - 86400000)), _utcTime(new Date(now + 86400000 * 3650))]);
-  var tbs = asn1.writeSequence([version, serial, sigAlgId, issuerName, validity, subjName, spki]);
+  var tbsChildren = [version, serial, sigAlgId, issuerName, validity, subjName, spki];
+  // Issuer (root / intermediate) certs carry basicConstraints cA:TRUE so the
+  // chain walk's cA enforcement (x509Chain.issuerValidlyIssued) accepts them;
+  // a leaf omits it (cA:FALSE) as a real end-entity cert does.
+  if (isCa) {
+    var bcExt = asn1.writeSequence([
+      asn1.writeOid("2.5.29.19"),                                  // basicConstraints
+      asn1.writeBoolean(true),                                     // critical
+      asn1.writeOctetString(asn1.writeSequence([asn1.writeBoolean(true)])),  // { cA TRUE }
+    ]);
+    tbsChildren.push(asn1.writeContextExplicit(3, asn1.writeSequence([bcExt])));
+  }
+  var tbs = asn1.writeSequence(tbsChildren);
   var tbsSig = nodeCrypto.sign("sha256", tbs, issuerKey);
   var certDer = asn1.writeSequence([tbs, sigAlgId, asn1.writeBitString(tbsSig, 0)]);
   return { name: subjName, key: kp.privateKey, pem: new nodeCrypto.X509Certificate(certDer).toString() };
@@ -321,8 +333,8 @@ async function run() {
   // x509 chain through an INTERMEDIATE CA: chain [leaf, intermediate]
   // with the root as the trust anchor must verify — the chain walk uses
   // chain[1..], not only a direct leaf-vs-anchor test.
-  var caRoot  = _makeCert("CAWG Test Root", null);
-  var caInter = _makeCert("CAWG Test Intermediate", { name: caRoot.name, key: caRoot.key });
+  var caRoot  = _makeCert("CAWG Test Root", null, true);
+  var caInter = _makeCert("CAWG Test Intermediate", { name: caRoot.name, key: caRoot.key }, true);
   var caLeaf  = _makeCert("Acme Newsroom Leaf", { name: caInter.name, key: caInter.key });
   var iaChain = b.contentCredentials.verifyIdentityAssertion(ia, orgPair.publicKey, {
     referencedAssertions: refs,
@@ -332,7 +344,7 @@ async function run() {
   check("verifyIdentityAssertion: [leaf,intermediate]→root anchor verified (walks intermediates)",
     iaChain.valid === true && iaChain.verified === true);
   // The same chain against an unrelated anchor must NOT verify.
-  var caRogue = _makeCert("Rogue Root", null);
+  var caRogue = _makeCert("Rogue Root", null, true);
   var iaWrongAnchor = b.contentCredentials.verifyIdentityAssertion(ia, orgPair.publicKey, {
     referencedAssertions: refs,
     identityCertChainPem: [caLeaf.pem, caInter.pem],

package/lib/vendor/blamejs/test/layer-0-primitives/cors.test.js

@@ -112,10 +112,11 @@ async function testCorsExplicitSiteOriginRejectsInferredOrigin() {
 }
 
 async function testCorsXForwardedProtoRespected() {
-  // Behind a TLS terminator: socket is HTTP but Origin claims https.
-  // With `trustProxy: true`, X-Forwarded-Proto: https flips the inferred
-  // scheme so same-origin detection matches.
-  var mw = b.middleware.cors({ origins: [], refuseUnknown: true, trustProxy: true });
+  // Behind a TLS terminator: socket is HTTP but Origin claims https. With
+  // trustedProxies covering the proxy peer, X-Forwarded-Proto: https flips the
+  // inferred scheme so same-origin detection matches — peer-gated, so only a
+  // request arriving via the trusted proxy gets the header honored.
+  var mw = b.middleware.cors({ origins: [], refuseUnknown: true, trustedProxies: ["127.0.0.0/8"] });
   var req = _req({
     method:  "POST",
     headers: {
@@ -126,8 +127,29 @@ async function testCorsXForwardedProtoRespected() {
     socket:  { remoteAddress: "127.0.0.1", encrypted: false },
   });
   var out = await _drive(mw, req);
-  check("X-Forwarded-Proto: https + trustProxy → same-origin pass-through",
+  check("X-Forwarded-Proto: https via trusted proxy → same-origin pass-through",
         out.nextCalled === true);
+
+  // A bare trustProxy is refused at construction (spoofable).
+  var threwBare = false;
+  try { b.middleware.cors({ origins: [], refuseUnknown: true, trustProxy: true }); }
+  catch (_e) { threwBare = true; }
+  check("cors: bare trustProxy refused (spoofable)", threwBare === true);
+
+  // Forged X-Forwarded-Proto from an UNTRUSTED peer is ignored → inferred
+  // origin stays http://… so the https Origin is cross-origin → blocked.
+  var forged = _req({
+    method:  "POST",
+    headers: {
+      host:   "wiki.example.com",
+      origin: "https://wiki.example.com",
+      "x-forwarded-proto": "https",
+    },
+    socket:  { remoteAddress: "198.51.100.66", encrypted: false },
+  });
+  var outForged = await _drive(mw, forged);
+  check("forged X-Forwarded-Proto from untrusted peer ignored → blocked",
+        outForged.nextCalled === false);
 }
 
 async function testCorsXForwardedProtoIgnoredWithoutTrustProxy() {

package/lib/vendor/blamejs/test/layer-0-primitives/crypto-field-per-row-key.test.js

@@ -169,6 +169,41 @@ async function run() {
     var shredded = b.db.from("pr_keyed").where({ _id: "row-3" }).first();
     check("shredded cell reads as absent (null), no crash", shredded.ssn === null && shredded.note === null);
 
+    // ---- B3a: a SHREDDED read must NOT trip the unseal-failure rate cap ----
+    // A crypto-shredded key is an EXPECTED absence (the wrap is gone — no oracle
+    // to brute-force), not a forged-ciphertext attack. Bulk-reading erased rows
+    // (GDPR eraseHard) must not accrue rate-cap failures, else the cap trips and
+    // DoS's the live rows (self-DoS). Configure a low threshold and read the
+    // shredded row many times for one (actor, table, column): none must throw
+    // crypto-field/unseal-rate-exceeded.
+    var rateAudits = [];
+    b.cryptoField.configureUnsealRateCap({
+      threshold: 2, windowMs: 60000, cooldownMs: 300000,
+      onAudit: function (ev) { rateAudits.push(ev); },
+    });
+    var shredTrip = null;
+    for (var sr = 0; sr < 8; sr++) {
+      try {
+        var srRow = b.db.prepare('SELECT * FROM "pr_keyed" WHERE _id = ?').get("row-3");
+        b.cryptoField.unsealRow("pr_keyed", srRow, "shred-reader");
+      } catch (e) { if (e.code === "crypto-field/unseal-rate-exceeded") shredTrip = e; }
+    }
+    check("8 shredded reads do NOT trip the rate cap (shred is exempt)", shredTrip === null);
+    check("shredded reads emit no rate-exceeded audit",
+      rateAudits.every(function (a) { return a.action !== "system.crypto.unseal_rate_exceeded"; }));
+    // CONTROL: a genuine forged-ciphertext read on the same tuple still trips —
+    // the exemption is specific to the shredded-key case, not a cap bypass.
+    var FORGED_ROW = "vault.aad:Zm9yZ2VkLWdhcmJhZ2U=";
+    var forgedTrip = null;
+    for (var fr = 0; fr < 8; fr++) {
+      try {
+        b.cryptoField.unsealRow("pr_keyed", { _id: "row-3", ssn: FORGED_ROW }, "forge-reader");
+      } catch (e) { if (e.code === "crypto-field/unseal-rate-exceeded") forgedTrip = e; }
+    }
+    check("forged-ciphertext reads STILL trip the rate cap (exemption is shred-specific)",
+      forgedTrip !== null);
+    b.cryptoField.clearRateCapForTest();
+
     // ---- FORENSIC RESIDUAL PROOF (the crypto-shred guarantee) ----
     // Advertised (crypto-field.js destroyPerRowKey): destroying the wrapped
     // row-secret makes residual ciphertext (WAL / replica / backup)
@@ -243,6 +278,9 @@ async function run() {
 
     // ---- ROTATION ROUND-TRIP ----
     await _rotationRoundTrip();
+
+    // ---- B3b: crypto-shred under a CUSTOM tablePrefix ----
+    await _customPrefixShredLifecycle();
   } finally {
     try { b.cryptoField.clearResidencyForTest(); } catch (_e) {}
     try { fs.rmSync(dir, { recursive: true, force: true }); } catch (_e) {}
@@ -250,6 +288,51 @@ async function run() {
   console.log("OK — crypto-field per-row-key tests");
 }
 
+// The per-row-key registry is ALWAYS local (the crypto-shred substrate lives in
+// the local sqlite even in cluster mode). A custom tablePrefix rewrites only the
+// cluster-mode EXTERNAL names; the local table stays raw (_blamejs_per_row_keys).
+// Regression: crypto-field resolved the registry name through the cluster-prefix
+// resolver, so under a custom prefix it targeted a nonexistent <prefix>per_row_keys
+// table — destroyPerRowKey deleted 0 rows and sealed cells stayed decryptable
+// after eraseHard (a SILENT crypto-shred failure). Prove the full lifecycle
+// (seal -> read -> shred -> read-absent) holds under a custom prefix.
+async function _customPrefixShredLifecycle() {
+  var dir = fs.mkdtempSync(path.join(os.tmpdir(), "prk-prefix-"));
+  try {
+    process.env.BLAMEJS_SKIP_NTP_CHECK = "1";
+    b.cluster._resetForTest(); b.audit._resetForTest(); b.vault._resetForTest(); b.db._resetForTest();
+    helpers.setTestPassphraseEnv ? helpers.setTestPassphraseEnv() : (function () {
+      process.env.BLAMEJS_VAULT_PASSPHRASE = "x".repeat(40);
+      process.env.BLAMEJS_AUDIT_SIGNING_PASSPHRASE = "x".repeat(40);
+    })();
+    await b.vault.init({ dataDir: dir });
+    await b.db.init({
+      dataDir: dir, tmpDir: path.join(dir, "tmpfs"), allowNonTmpfsTmpDir: true,
+      tablePrefix: "acme_",                                   // <-- CUSTOM PREFIX
+      schema: KEYED_SCHEMA,
+    });
+    b.cryptoField.clearResidencyForTest();
+    b.cryptoField.declarePerRowKey("pr_keyed", { keySize: 32 });
+    b.cryptoField.declarePerRowResidency("pr_keyed", {
+      residencyColumn: "dataRegion", allowedTags: ["eu", "us", "global"],
+    });
+    b.db.from("pr_keyed").insertOne({
+      _id: "p1", subjectId: "subj-P", dataRegion: "eu", ssn: "123-45-6789", note: "n",
+    });
+    check("custom-prefix: keyed read round-trips before shred",
+      b.db.from("pr_keyed").where({ _id: "p1" }).first().ssn === "123-45-6789");
+    var res = b.cryptoField.destroyPerRowKey("pr_keyed", "p1", b.db);
+    check("custom-prefix: destroyPerRowKey deletes the wrap (destroyed === 1)", res.destroyed === 1);
+    check("custom-prefix: sealed cell is UNREADABLE after shred (crypto-shred holds)",
+      b.db.from("pr_keyed").where({ _id: "p1" }).first().ssn === null);
+    b.db.close();
+  } finally {
+    try { b.cryptoField.clearResidencyForTest(); } catch (_e) {}
+    try { b.db._resetForTest(); } catch (_e) {}
+    try { fs.rmSync(dir, { recursive: true, force: true }); } catch (_e) {}
+  }
+}
+
 // A vault keypair rotation must reseal the wrapped row-secret in
 // _blamejs_per_row_keys old-root -> new-root (registerTable({aad:true})
 // wires rotate._rotateColumn). After the swap, the wrap unwraps under the

package/lib/vendor/blamejs/test/layer-0-primitives/csrf-protect.test.js

@@ -137,11 +137,69 @@ async function testFirstOccurrenceWinsForDuplicateCookie() {
         r2.outcome === "denied" && r2.status === 403);
 }
 
+function testMethodsEmptyThrows() {
+  // An empty methods array would silently disable the primary CSRF method-gate
+  // for all state-changing requests — refuse it at config time.
+  var threw = null;
+  try { b.middleware.csrfProtect({ cookie: true, methods: [] }); } catch (e) { threw = e; }
+  check("csrfProtect({ methods: [] }) refused at config time (no silent CSRF disable)",
+        threw && /non-empty array/.test(threw.message || ""));
+}
+
+// Two distinct csrf instances on the same response (createApp wires csrf
+// globally AND an operator re-mounts it at the route level) must issue a
+// SINGLE Set-Cookie for the same cookie name — cookie issuance is a
+// response-level resource, deduped by name. Enforcement stays per instance
+// (the next test).
+async function testRedundantMountIssuesSingleCookie() {
+  var req = _mockReq({ method: "GET", url: "/", headers: { host: "example.com" } });
+  var res = _mockRes();
+  var mw1 = b.middleware.csrfProtect({ cookie: true });
+  var mw2 = b.middleware.csrfProtect({ cookie: true });
+  await new Promise(function (r) { mw1(req, res, r); });
+  await new Promise(function (r) { mw2(req, res, r); });
+  var sc = res.getHeader("set-cookie");
+  var arr = Array.isArray(sc) ? sc : (sc ? [sc] : []);
+  var csrfCookies = arr.filter(function (c) { return /^csrf=/.test(c); });
+  check("csrf: redundant same-name mount issues a single Set-Cookie",
+        csrfCookies.length === 1);
+  check("csrf: both instances expose the same req.csrfToken",
+        typeof req.csrfToken === "string" && req.csrfToken.length === 64);
+}
+
+// The cookie-issuance dedup must NOT disable per-instance enforcement: two
+// distinct instances each validate the double-submit token on a POST. A bad
+// token reaches a deny regardless of which instance runs first — a shared
+// "already handled" flag (the bug the per-instance gate fixed) would let the
+// first instance mark the request handled and skip the second's check.
+async function testDistinctInstancesBothEnforce() {
+  var good = b.forms.generateCsrfToken();
+  var req = _mockReq({
+    method: "POST", url: "/submit",
+    headers: { host: "example.com", cookie: "csrf=" + good, "x-csrf-token": "deadbeef" },
+  });
+  var res = _mockRes();
+  var denied = false;
+  var origEnd = res.end;
+  res.end = function () { denied = true; return origEnd.apply(res, arguments); };
+  var mw = b.middleware.csrfProtect({ cookie: true });
+  var nextCalled = false;
+  await new Promise(function (r) { mw(req, res, function () { nextCalled = true; r(); }); if (denied) r(); });
+  // The instance denies the mismatched token (cookie != header), proving
+  // enforcement runs per instance and the cookie-dedup did not mark the
+  // request "already handled".
+  check("csrf: distinct instance enforces double-submit (bad token denied)",
+        denied === true && nextCalled === false);
+}
+
 async function run() {
   await testSuccessPathDoubleSubmit();
   await testMismatchDenied();
   await testPoisonedCookieNamesDoNotPollute();
   await testFirstOccurrenceWinsForDuplicateCookie();
+  await testRedundantMountIssuesSingleCookie();
+  await testDistinctInstancesBothEnforce();
+  testMethodsEmptyThrows();
 }
 
 module.exports = { run: run };

package/lib/vendor/blamejs/test/layer-0-primitives/data-act.test.js

@@ -41,6 +41,36 @@ function run() {
   } catch (e) { threw = /gatekeeper-refused/.test(e.code); }
   check("dataAct: designated gatekeeper share refused (Art 32 §1)",  threw);
 
+  // B10: a gatekeeper as the FINAL domain label must still be refused. The old
+  // substring `indexOf(g + ".")` test missed "blog.google" / "data.amazon" (the
+  // gatekeeper token is the last label, e.g. the real ".google" TLD), letting an
+  // Art 32 §1 share through. Label matching closes the bypass.
+  ["blog.google", "drive.google", "data.amazon", "play.google.com",
+   "https://meta.com/share", "user@booking.com"].forEach(function (recip) {
+    var bypassed = false, refused = false;
+    try {
+      b.dataAct.shareWithThirdParty({
+        productId: "thermo-v3", userId: "user-1", recipient: recip, scope: "x",
+      });
+      bypassed = true;   // no throw → the gate let a gatekeeper through
+    } catch (e) { refused = /gatekeeper-refused/.test(e.code); }
+    check("B10: gatekeeper recipient '" + recip + "' refused (no final-label bypass)",
+          refused && !bypassed);
+  });
+
+  // B10: a NON-gatekeeper whose name merely CONTAINS a gatekeeper token must NOT
+  // be over-refused (the substring test false-flagged "notgoogle.com").
+  ["notgoogle.com", "evilgoogle.com", "google-partners.example.com"].forEach(function (recip) {
+    var ok = false;
+    try {
+      b.dataAct.shareWithThirdParty({
+        productId: "thermo-v3", userId: "user-1", recipient: recip, scope: "x",
+      });
+      ok = true;
+    } catch (_e) { ok = false; }
+    check("B10: non-gatekeeper '" + recip + "' is NOT over-refused", ok);
+  });
+
   // Override accepted with audited reason.
   b.dataAct.shareWithThirdParty({
     productId: "thermo-v3", userId: "user-1",