@blamejs/blamejs-shop 0.4.68 → 0.4.70

package/lib/vendor/blamejs/test/layer-0-primitives/db-raw-residency-gate.test.js

@@ -108,6 +108,80 @@ async function run() {
       quotedWhereRefusedCode === "db-query/row-residency-local-mismatch");
     check("the quoted-WHERE update did not move the row cross-border",
       (b.db.from("residents").where({ _id: "raw-eu" }).first() || {}).dataRegion === "eu-west-1");
+
+    // RAW PATH 5: a LEADING SQL COMMENT must not hide the write keyword from the
+    // ^-anchored gate. A "/* hint */ INSERT ..." or "-- hint\nUPDATE ..." that
+    // the gate fails to recognize as a write skips residency enforcement
+    // entirely — a cross-border-write bypass. Strip leading comments before the
+    // write-detection so the gate still fires.
+    var blockCommentRefusedCode = codeOf(function () {
+      b.db.runSql(
+        "/* region hint */ INSERT INTO residents (_id, name, dataRegion) VALUES ('raw-bc', 'x', 'us-east-1')");
+    });
+    check("leading block-comment write is recognized + refused (no comment bypass)",
+      blockCommentRefusedCode === "db-query/row-residency-local-mismatch");
+    check("leading block-comment cross-border row did not persist",
+      b.db.from("residents").where({ _id: "raw-bc" }).first() === null);
+
+    var lineCommentRefusedCode = codeOf(function () {
+      b.db.runSql(
+        "-- region hint\nUPDATE residents SET dataRegion='us-east-1' WHERE _id='raw-eu'");
+    });
+    check("leading line-comment write is recognized + refused (no comment bypass)",
+      lineCommentRefusedCode === "db-query/row-residency-local-mismatch");
+    check("the leading line-comment update did not move the row cross-border",
+      (b.db.from("residents").where({ _id: "raw-eu" }).first() || {}).dataRegion === "eu-west-1");
+
+    // Stacked comment + whitespace before the keyword is also stripped.
+    var stackedRefusedCode = codeOf(function () {
+      b.db.runSql(
+        "/* a */  -- b\n  /* c */ INSERT INTO residents (_id, name, dataRegion) VALUES ('raw-st', 'x', 'us-east-1')");
+    });
+    check("stacked leading comments are stripped + the write is refused",
+      stackedRefusedCode === "db-query/row-residency-local-mismatch");
+
+    // An in-region leading-comment write still persists (no over-rejection).
+    b.db.runSql(
+      "/* in-region */ INSERT INTO residents (_id, name, dataRegion) VALUES ('raw-bc-ok', 'z', 'eu-west-1')");
+    check("in-region leading-comment write still persists (gate does not over-reject)",
+      (b.db.from("residents").where({ _id: "raw-bc-ok" }).first() || {}).dataRegion === "eu-west-1");
+
+    // RAW PATH 6: a writable-CTE write hides its effective verb behind a `WITH`
+    // prefix, so the ^-anchored write-keyword detector misses it — node:sqlite
+    // executes `WITH c AS (...) INSERT INTO residents ...` / `WITH ... UPDATE
+    // residents SET ...` and would persist a cross-border row UNGATED. The gate
+    // now recognizes the residency-table write target behind the CTE prefix and
+    // FAILS CLOSED (can't parse a CTE body) — directing the operator to the
+    // structured builder. (Sibling of RAW PATH 5.)
+    var cteInsertCode = codeOf(function () {
+      b.db.runSql(
+        "WITH src AS (SELECT 'us-east-1' AS r) INSERT INTO residents (_id, name, dataRegion) SELECT 'cte-i', 'x', r FROM src");
+    });
+    check("writable-CTE INSERT to a residency table is refused (no CTE-prefix bypass)",
+      cteInsertCode === "db-query/row-residency-raw-unparseable");
+    check("writable-CTE INSERT cross-border row did not persist",
+      b.db.from("residents").where({ _id: "cte-i" }).first() === null);
+
+    var cteUpdateCode = codeOf(function () {
+      b.db.prepare(
+        "WITH RECURSIVE t AS (SELECT 1) UPDATE residents SET dataRegion = 'us-east-1' WHERE _id = 'raw-eu'").run();
+    });
+    check("WITH RECURSIVE UPDATE to a residency table is refused (no CTE-prefix bypass)",
+      cteUpdateCode === "db-query/row-residency-raw-unparseable");
+    check("the writable-CTE update did not move the row cross-border",
+      (b.db.from("residents").where({ _id: "raw-eu" }).first() || {}).dataRegion === "eu-west-1");
+
+    // A read-only CTE (WITH ... SELECT) is NOT a write → not gated (no over-reject).
+    var cteReadErr = codeOf(function () {
+      b.db.runSql("WITH c AS (SELECT _id FROM residents WHERE dataRegion = 'eu-west-1') SELECT _id FROM c");
+    });
+    check("read-only WITH...SELECT is not gated (no residency error)", cteReadErr === null);
+
+    // A writable-CTE write to a NON-residency table is not over-rejected.
+    b.db.runSql("CREATE TABLE IF NOT EXISTS notes (_id TEXT PRIMARY KEY, body TEXT)");
+    b.db.runSql("WITH s AS (SELECT 'hi' AS b) INSERT INTO notes (_id, body) SELECT 'n1', b FROM s");
+    check("writable-CTE write to a NON-residency table still persists (no over-reject)",
+      (b.db.from("notes").where({ _id: "n1" }).first() || {}).body === "hi");
   } finally {
     b.compliance.clear();
     b.cryptoField.clearResidencyForTest();

package/lib/vendor/blamejs/test/layer-0-primitives/dora.test.js

@@ -16,8 +16,17 @@ function testSurface() {
   check("dora.create is a function", typeof b.dora.create === "function");
   check("dora.MAJOR_INCIDENT_THRESHOLDS exposed",
         typeof b.dora.MAJOR_INCIDENT_THRESHOLDS === "object");
-  check("dora.INITIAL_REPORT_DEADLINE_MS = 24h",
-        b.dora.INITIAL_REPORT_DEADLINE_MS === b.constants.TIME.hours(24));
+  // RTS (EU) 2024/1772 Art. 5: initial notification within 4h of classifying
+  // the incident as major; the 24h-from-awareness outer bound is exposed
+  // separately. (Was asserted as 24h, contradicting the framework's own
+  // incident-report DORA regime which correctly uses 4h.)
+  check("dora.INITIAL_REPORT_DEADLINE_MS = 4h (operative from classification)",
+        b.dora.INITIAL_REPORT_DEADLINE_MS === b.constants.TIME.hours(4));
+  check("dora.INITIAL_REPORT_OUTER_DEADLINE_MS = 24h (outer, from awareness)",
+        b.dora.INITIAL_REPORT_OUTER_DEADLINE_MS === b.constants.TIME.hours(24));
+  check("dora agrees with incident-report REGIME_DEADLINES.dora",
+        b.dora.INITIAL_REPORT_DEADLINE_MS === require("../../lib/incident-report").REGIME_DEADLINES.dora.initial &&
+        b.dora.INTERMEDIATE_REPORT_DEADLINE_MS === require("../../lib/incident-report").REGIME_DEADLINES.dora.intermediate);
   check("frameworkError.DoraError exposed",
         typeof b.frameworkError.DoraError === "function");
 }
@@ -32,8 +41,10 @@ function testClassifyMajor() {
   });
   check("classify with critical severity → major",
         rv.classification === "major" && rv.mustReport === true);
-  check("major incident → 24h initial-report deadline",
-        rv.mustReportInitialByMs === b.constants.TIME.hours(24));
+  check("major incident → 4h initial-report deadline (from classification)",
+        rv.mustReportInitialByMs === b.constants.TIME.hours(4));
+  check("major incident → 24h outer initial deadline (from awareness)",
+        rv.mustReportInitialOuterByMs === b.constants.TIME.hours(24));
 }
 
 function testClassifySignificant() {
@@ -91,8 +102,11 @@ function testReportInitial() {
   check("report initial: returns RTS-shaped record with reportedAt set",
         record && record.incidentId === "INC-2026-0001" &&
         typeof record.reportedAt === "number");
-  check("report initial: nextStageDueAt = detectedAt + 72h",
-        record.nextStageDueAt === detectedAt + b.constants.TIME.hours(72));
+  // The intermediate deadline anchors on the INITIAL report's SUBMISSION time
+  // (record.reportedAt), not detectedAt — a report filed late must not get a
+  // deadline measured from detection (RTS 2024/1772 reporting timeline).
+  check("report initial: nextStageDueAt = reportedAt + 72h (submission-anchored)",
+        record.nextStageDueAt === record.reportedAt + b.constants.TIME.hours(72));
 }
 
 function testReportFinal() {

package/lib/vendor/blamejs/test/layer-0-primitives/dpop-alg-kty.test.js

@@ -0,0 +1,64 @@
+"use strict";
+/**
+ * b.auth.dpop.verify — alg/kty cross-check (alg-confusion family,
+ * CVE-2026-22817 class).
+ *
+ * The DPoP proof embeds its own public key (header.jwk) and declares the
+ * signing alg (header.alg). Every other JWS verifier in the framework calls
+ * jwtExternal._assertAlgKtyMatch(alg, jwk) before handing the self-asserted
+ * key to node:crypto; the DPoP verifier omitted it. A proof declaring
+ * alg:"ES256" while embedding an RSA jwk must be refused with a clean
+ * alg/kty mismatch — not run through node:crypto with mismatched params.
+ */
+
+var helpers = require("../helpers");
+var b       = helpers.b;
+var check   = helpers.check;
+var nodeCrypto = require("crypto");
+
+function _b64url(buf) {
+  return Buffer.from(buf).toString("base64")
+    .replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+
+async function run() {
+  var rsa = nodeCrypto.generateKeyPairSync("rsa", { modulusLength: 2048 });
+  var rsaJwk = rsa.publicKey.export({ format: "jwk" });   // { kty:"RSA", n, e }
+
+  // Hand-craft a proof: header.alg="ES256" but header.jwk is the RSA key,
+  // signed (RS256) with the matching RSA private key. The embedded jwk and
+  // the declared alg disagree on key type.
+  var header  = { typ: "dpop+jwt", alg: "ES256", jwk: rsaJwk };
+  var payload = { htm: "POST", htu: "https://api.example.com/r",
+                  jti: "jti-" + rsaJwk.n.slice(0, 8), iat: Math.floor(Date.now() / 1000) };
+  var signingInput = _b64url(JSON.stringify(header)) + "." + _b64url(JSON.stringify(payload));
+  var sig = nodeCrypto.sign("sha256", Buffer.from(signingInput, "ascii"), rsa.privateKey);
+  var proof = signingInput + "." + _b64url(sig);
+
+  var threw = null;
+  try {
+    await b.auth.dpop.verify(proof, { htm: "POST", htu: "https://api.example.com/r" });
+  } catch (e) { threw = e; }
+  check("dpop.verify: alg/kty mismatch (ES256 alg, RSA jwk) is refused with alg-kty-mismatch",
+        threw && (threw.code === "auth-jwt-external/alg-kty-mismatch" ||
+                  threw.code === "auth-jwt-external/alg-crv-mismatch"));
+  check("dpop.verify: it is NOT mis-reported as a plain invalid-signature",
+        threw && threw.code !== "auth-dpop/invalid-signature");
+
+  // Control: a well-formed ES256 proof (alg matches the EC jwk) still verifies.
+  var ec = nodeCrypto.generateKeyPairSync("ec", { namedCurve: "prime256v1" });
+  var goodProof = await b.auth.dpop.buildProof({
+    htm: "POST", htu: "https://api.example.com/r", privateKey: ec.privateKey,
+  });
+  var rv = await b.auth.dpop.verify(goodProof, { htm: "POST", htu: "https://api.example.com/r" });
+  check("dpop.verify: matching ES256/EC proof still verifies", rv && rv.header.jwk.kty === "EC");
+
+  console.log("OK — dpop alg/kty cross-check (" + helpers.getChecks() + " checks)");
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  run().then(function () { process.exit(0); })
+       .catch(function (err) { process.exitCode = 1; throw err; });
+}

package/lib/vendor/blamejs/test/layer-0-primitives/dsr.test.js

@@ -923,6 +923,37 @@ async function testDbStoreUpgradePath() {
   }
 }
 
+async function testDbStoreFindsLegacyKeyedMacRows() {
+  // A ticket written BEFORE the keyed-MAC default flip stored the LEGACY
+  // salted-sha3 digest in subject_email_hash (non-NULL, so the NULL-only
+  // backfill never migrates it). list-by-subject must still FIND it via the
+  // dual-read (keyed-MAC + legacy candidates) — otherwise an Art.17 erasure
+  // purge (list → delete) skips the subject's prior PII-bearing tickets.
+  var cryptoField = require("../../lib/crypto-field");
+  var tmpDir = _tmp();
+  await setupTestDb(tmpDir);
+  try {
+    var h = _dbDsr();
+    var t = await h.dsr.submit({
+      type: "access", subject: { email: "alice@example.com" }, reason: "pre-flip ticket",
+    });
+    // Simulate a pre-flip row: overwrite the keyed-MAC hash with the legacy
+    // salted-sha3 digest the old default would have stored.
+    var d = cryptoField.computeDerived("dsr_tickets", "subject_email", "alice@example.com");
+    check("dsr legacy: a legacy digest distinct from the keyed-MAC exists",
+          d && d.legacyValue && d.legacyValue !== d.value);
+    b.db.prepare("UPDATE dsr_tickets SET subject_email_hash = $h WHERE id = $id")
+      .run({ $h: d.legacyValue, $id: t.id });
+    // RED before the dual-read fix: the keyed-MAC single-value equality never
+    // matches the legacy digest, so this returns 0 rows.
+    var found = await h.store.list({ subject: { email: "alice@example.com" } });
+    check("dsr legacy: list-by-subject finds the pre-flip legacy-hashed ticket",
+          found.some(function (x) { return x.id === t.id; }));
+  } finally {
+    await teardownTestDb(tmpDir);
+  }
+}
+
 // ---- AAD_ROTATION descriptor + reseal ----
 
 function testAadRotationDescriptor() {
@@ -1027,6 +1058,7 @@ async function testResealValidationAndStore() {
   await testDbStoreSealsAtRest();
   await testDbStoreErasurePurgesPriorTickets();
   await testDbStoreUpgradePath();
+  await testDbStoreFindsLegacyKeyedMacRows();
   // AAD_ROTATION descriptor + reseal
   testAadRotationDescriptor();
   await testResealValidationAndStore();

package/lib/vendor/blamejs/test/layer-0-primitives/fda-21cfr11.test.js

@@ -136,16 +136,59 @@ function testNonModificationBypassesShape() {
   check("read-shape audit bypasses before/after requirement", ok === true);
 }
 
+function testOffListModificationVerbsRequireShape() {
+  // §11.10(e) must fail closed: a modifying verb NOT on the legacy denylist
+  // (anonymize / revoke / overwrite / merge / withdraw_consent / restrict)
+  // must still require before/after — previously it bypassed the check.
+  var mods = ["subject.anonymize", "consent.revoke", "subject.overwrite",
+              "db.merge", "subject.withdraw_consent", "subject.restrict"];
+  for (var i = 0; i < mods.length; i += 1) {
+    var r = b.fda21cfr11.checkGxpAudit({
+      action: mods[i], recordedAt: Date.now(), actorUserId: "u",
+    });
+    check("checkGxpAudit requires §11.10(e) shape for " + mods[i], r.ok === false);
+  }
+  // A genuinely complete modification row (before/after/reason) passes.
+  var full = b.fda21cfr11.checkGxpAudit({
+    action: "subject.anonymize", recordedAt: Date.now(), actorUserId: "u",
+    reason: "GDPR Art.17", metadata: { before: { name: "Alice" }, after: { name: null } },
+  });
+  check("checkGxpAudit accepts a complete anonymize row", full.ok === true);
+}
+
+function testSignatureStrippedRefusedWhenVerifierWired() {
+  // #B0 — with verifyWith wired, a record whose signature is null/empty must
+  // NOT verify on recordHash alone (recordHash is self-consistency, not
+  // authentication). Accepting it is alg:none-style signature stripping.
+  var nc  = require("node:crypto");
+  var key = nc.randomBytes(32);
+  var sign   = function (buf) { return nc.createHmac("sha256", key).update(buf).digest(); };
+  var verify = function (buf, sig) { try { return nc.timingSafeEqual(sign(buf), sig); } catch (_e) { return false; } };
+  var fda = b.fda21cfr11.posture({ audit: _fakeAudit(), interceptAudit: false, signWith: sign, verifyWith: verify });
+  var rec = fda.electronicSignature.create({
+    printedName: "Jane Doe, M.D.", signatureMeaning: "approval",
+    predicateRule: "21 CFR 312.62", boundRecord: Buffer.from("trial-data"),
+  });
+  check("FDA properly-signed record verifies",
+    fda.electronicSignature.verify(rec, Buffer.from("trial-data")).ok === true);
+  var stripped = Object.assign({}, rec, { signature: null });
+  var v = fda.electronicSignature.verify(stripped, Buffer.from("trial-data"));
+  check("FDA signature-stripped record refused when verifier wired",
+    v.ok === false && v.reason === "signature-required");
+}
+
 async function run() {
   testSurface();
   testSignatureCreate();
   testSignatureBadMeaning();
   testSignatureMissingPredicate();
+  testSignatureStrippedRefusedWhenVerifierWired();
   testAssertGxpAuditOk();
   testAssertGxpAuditMissingBefore();
   testAssertGxpAuditMetadataAsString();
   testCheckGxpAuditMissingActor();
   testNonModificationBypassesShape();
+  testOffListModificationVerbsRequireShape();
 }
 
 module.exports = { run: run };

package/lib/vendor/blamejs/test/layer-0-primitives/fetch-metadata.test.js

@@ -185,12 +185,42 @@ async function testExactMembershipNoBypass() {
         plain.next === true);
 }
 
+function testMethodsEmptyThrows() {
+  var threw = null;
+  try { b.middleware.fetchMetadata({ methods: [] }); } catch (e) { threw = e; }
+  check("fetchMetadata({ methods: [] }) refused at config time (no silent pass-through)",
+        threw && /non-empty array/.test(threw.message || ""));
+}
+
+async function testLayeredStricterGateRuns() {
+  // A lenient app-level mount must NOT silently disable a STRICTER sub-route
+  // mount sharing the request — each instance gates independently.
+  var lenient = b.middleware.fetchMetadata({});                 // allowSameSite default true
+  var strict  = b.middleware.fetchMetadata({ allowSameSite: false });
+  var req = _post({ "sec-fetch-site": "same-site", "sec-fetch-mode": "cors", "sec-fetch-dest": "empty" });
+  var r1 = await _run(lenient, req, _bodyRes());
+  check("lenient app-level gate passes the same-site request", r1.next === true);
+  // The SAME req now carries the lenient gate's flag; the stricter instance
+  // must still evaluate (previously a shared boolean made it a no-op).
+  var r2 = await _run(strict, req, _bodyRes());
+  check("stricter sub-route gate still refuses (not disabled by the earlier mount)",
+        r2.next === false && r2.status === 403);
+  // The SAME stricter instance run twice on a request IS idempotent.
+  var req2 = _post({ "sec-fetch-site": "same-site", "sec-fetch-mode": "cors", "sec-fetch-dest": "empty" });
+  var s1 = await _run(strict, req2, _bodyRes());
+  var s2 = await _run(strict, req2, _bodyRes());
+  check("same instance is idempotent (first refuses, second no-ops to next)",
+        s1.next === false && s2.next === true);
+}
+
 async function run() {
   await testDefaultUnchanged();
   await testDeniedDestWebIdentity();
   await testStorageAccessGate();
   testStrictDestThrows();
   await testExactMembershipNoBypass();
+  testMethodsEmptyThrows();
+  await testLayeredStricterGateRuns();
 }
 
 module.exports = { run: run };

package/lib/vendor/blamejs/test/layer-0-primitives/graphql-federation.test.js

@@ -16,6 +16,14 @@ async function run() {
   check("probes _entities",       b.graphqlFederation.queryProbesSdl("{ _entities(representations:[...]) { ... } }") === true);
   check("clean query",            b.graphqlFederation.queryProbesSdl("{ user { name } }") === false);
   check("non-string query",       b.graphqlFederation.queryProbesSdl(null) === false);
+  // Aliased _service with NO leading whitespace must still probe true — the
+  // prefix-char-class form let `query{x:_service{sdl}}` slip the SDL gate.
+  check("probes aliased _service (no space)", b.graphqlFederation.queryProbesSdl("query{x:_service{sdl}}") === true);
+  check("probes single-char-alias _service",  b.graphqlFederation.queryProbesSdl("{s:_service{sdl}}") === true);
+  check("probes aliased _entities (no space)", b.graphqlFederation.queryProbesSdl("{a:_entities(r:[]){__typename}}") === true);
+  // \b still excludes substring field names.
+  check("does NOT probe my_service substring",  b.graphqlFederation.queryProbesSdl("query{my_service{x}}") === false);
+  check("does NOT probe userservice substring", b.graphqlFederation.queryProbesSdl("query{userservice{x}}") === false);
 
   // ---- guardSdl opts validation ----
   var threw = null;
@@ -37,6 +45,31 @@ async function run() {
     nonceHeader: "x-my-nonce",
   });
   check("guardSdl: accepts custom nonceHeader", typeof withNonce === "function");
+
+  // ---- guardSdl drives: a batched ARRAY body whose SECOND operation probes
+  // _service must be refused (401) without a router token, not forwarded. ----
+  function _drive(mw, body) {
+    return new Promise(function (resolve) {
+      var out = { status: null, nextCalled: false };
+      var res = {
+        statusCode: 200,
+        setHeader: function () {}, getHeader: function () { return undefined; },
+        writeHead: function (s) { out.status = s; },
+        end: function () { if (out.status === null) out.status = res.statusCode; resolve(out); },
+      };
+      mw({ method: "POST", headers: {}, body: body, on: function () {} }, res,
+        function () { out.nextCalled = true; resolve(out); });
+    });
+  }
+  var guard = b.graphqlFederation.guardSdl({ routerToken: "a".repeat(64) });
+  var batched = await _drive(guard, [{ query: "{ ok }" }, { query: "{ _service { sdl } }" }]);
+  check("guardSdl: batched-array _service probe is refused (401), not forwarded",
+        batched.status === 401 && batched.nextCalled === false);
+  var aliased = await _drive(guard, { query: "query{x:_service{sdl}}" });
+  check("guardSdl: aliased _service probe is refused (401)",
+        aliased.status === 401 && aliased.nextCalled === false);
+  var clean = await _drive(guard, { query: "{ user { name } }" });
+  check("guardSdl: a clean query is forwarded (next)", clean.nextCalled === true);
 }
 
 module.exports = { run: run };

package/lib/vendor/blamejs/test/layer-0-primitives/guard-html.test.js

@@ -124,6 +124,14 @@ function testGuardHtmlUrlSchemes() {
   check("entity-encoded javascript: detected after entity decode",
         rvEnc.issues.some(function (issue) { return issue.kind === "dangerous-url-scheme"; }));
 
+  // #B7 — NO-semicolon decimal entity `&#106avascript:` (106='j', terminates at
+  // the non-digit 'a') is browser-decoded to javascript:. A semicolon-required
+  // decoder let this bypass the scheme allowlist as clean.
+  var rvNoSemi = b.guardHtml.validate(
+    '<a href="&#106avascript:alert(1)">x</a>', { profile: "balanced" });
+  check("no-semicolon entity javascript: detected",
+        rvNoSemi.issues.some(function (issue) { return issue.kind === "dangerous-url-scheme"; }));
+
   // Image-context data URL allowed under balanced when allowImageData true.
   var rvImg = b.guardHtml.validate(
     '<img src="data:image/png;base64,iVBORw0KG" alt="x">',
@@ -281,6 +289,31 @@ function testGuardHtmlByteCaps() {
 
 // ---- Sanitize round-trip ----
 
+function testGuardHtmlCommentEndDifferential() {
+  // mXSS comment-parser differential: the WHATWG HTML parser closes a comment
+  // at "--!>" (comment-end-bang) and ABRUPTLY at "<!-->" / "<!--->". A
+  // tokenizer honouring only "-->" treats the trailing <img onerror> as part
+  // of an inert comment; the browser parses it as a LIVE element. With the
+  // comment boundary fixed, the <img> is a real token the sanitizer disarms
+  // and validate flags — even in the permissive (allowComments) profile.
+  var payloads = [
+    "<!-- a --!><img src=x onerror=alert(1)>",
+    "<!--><img src=x onerror=alert(1)>-->",
+    "<!---><img src=x onerror=alert(1)>",
+  ];
+  for (var i = 0; i < payloads.length; i += 1) {
+    var p = payloads[i];
+    var s = b.guardHtml.sanitize(p, { profile: "permissive" });
+    check("comment-differential: sanitize strips smuggled onerror (" + i + ")",
+          s.indexOf("onerror=alert") === -1);
+    check("comment-differential: sanitize is not a verbatim pass-through (" + i + ")",
+          s !== p);
+    var v = b.guardHtml.validate(p, { profile: "permissive" });
+    check("comment-differential: validate flags the smuggled element (" + i + ")",
+          v.ok === false);
+  }
+}
+
 function testGuardHtmlSanitizeBasic() {
   var clean = b.guardHtml.sanitize("<p>hello <b>world</b></p>",
                                    { profile: "strict" });
@@ -404,6 +437,7 @@ async function run() {
   testGuardHtmlControlChar();
   testGuardHtmlSizeCaps();
   testGuardHtmlByteCaps();
+  testGuardHtmlCommentEndDifferential();
   testGuardHtmlSanitizeBasic();
   testGuardHtmlEscape();
   testGuardHtmlBadProfile();

package/lib/vendor/blamejs/test/layer-0-primitives/guard-json.test.js

@@ -203,6 +203,17 @@ function testGuardJsonStringLengthCap() {
         rv.issues.some(function (i) { return i.kind === "string-too-long"; }));
 }
 
+function testGuardJsonStringLengthByteCap() {
+  // maxStringLength is a per-string BYTE cap (strict 8 KiB). A multibyte string
+  // whose UTF-16 code-unit count is UNDER the cap but whose UTF-8 byte length
+  // EXCEEDS it must still be refused — value.length (code units) under-enforces.
+  // 4100 'é' = 4100 code units (< 8192) but 8200 UTF-8 bytes (> 8192).
+  var multibyte = "é".repeat(4100);
+  var rv = b.guardJson.validate('{"k":"' + multibyte + '"}', { profile: "strict" });
+  check("per-string maxStringLength measured in UTF-8 bytes (multibyte not under-enforced)",
+        rv.issues.some(function (i) { return i.kind === "string-too-long"; }));
+}
+
 function testGuardJsonByteCap() {
   // maxBytes is a BYTE cap — multibyte input must be measured by UTF-8
   // byte length, not UTF-16 code-unit count (.length). "é" is one code
@@ -356,6 +367,7 @@ async function run() {
   testGuardJsonKeyCountCap();
   testGuardJsonArrayLengthCap();
   testGuardJsonStringLengthCap();
+  testGuardJsonStringLengthByteCap();
   testGuardJsonByteCap();
   testGuardJsonNumericPrecision();
   testGuardJsonTopLevelKeyAllowlist();

package/lib/vendor/blamejs/test/layer-0-primitives/http-client-stream.test.js

@@ -396,8 +396,80 @@ function testSurface() {
         b.httpClient.ALLOWED_DOWNLOAD_HASH_ALGS.indexOf("sha3-512") !== -1);
 }
 
+async function _drainStream(s) {
+  return await new Promise(function (resolve, reject) {
+    var chunks = [];
+    s.on("data", function (c) { chunks.push(c); });
+    s.on("end", function () { resolve(Buffer.concat(chunks)); });
+    s.on("error", reject);
+  });
+}
+
+async function testBandwidthThrottle() {
+  // #342: maxBytesPerSec paces a download with real backpressure. The token
+  // bucket starts full (a 1s burst = RATE bytes), so a transfer LARGER than the
+  // burst is paced: SIZE 20000 @ RATE 10000 → ~10000 free + ~10000 at 10KB/s ≈ 1s.
+  var SIZE = 20000, RATE = 10000;
+  var payload = Buffer.alloc(SIZE, 0x61);
+  await _withServer(function (req, res) {
+    res.writeHead(200, { "Content-Type": "application/octet-stream", "Content-Length": String(SIZE) });
+    res.end(payload);
+  }, async function (baseUrl) {
+    var started = Date.now();
+    var resp = await b.httpClient.request({
+      url: baseUrl + "/big", method: "GET", responseMode: "stream",
+      maxBytesPerSec: RATE, allowedProtocols: b.safeUrl.ALLOW_HTTP_ALL, allowInternal: true,
+    });
+    var got = await _drainStream(resp.body);
+    var elapsed = Date.now() - started;
+    check("throttle: received all bytes intact", got.length === SIZE && got.equals(payload));
+    check("throttle: paced (elapsed >= 700ms for 20KB @ 10KB/s)", elapsed >= 700);
+  });
+}
+
+async function testDownloadTransformInterpose() {
+  // #342: downloadTransform (factory form) interposes on the response stream.
+  var nodeStream = require("stream");
+  var payload = Buffer.from("transform me", "utf8");
+  await _withServer(function (req, res) {
+    res.writeHead(200, { "Content-Length": String(payload.length) });
+    res.end(payload);
+  }, async function (baseUrl) {
+    var resp = await b.httpClient.request({
+      url: baseUrl + "/x", method: "GET", responseMode: "stream",
+      downloadTransform: function () {
+        return new nodeStream.Transform({
+          transform: function (chunk, _e, cb) { cb(null, Buffer.from(chunk.toString("utf8").toUpperCase())); },
+        });
+      },
+      allowedProtocols: b.safeUrl.ALLOW_HTTP_ALL, allowInternal: true,
+    });
+    var got = await _drainStream(resp.body);
+    check("downloadTransform: response is transformed (uppercased)", got.toString("utf8") === "TRANSFORM ME");
+  });
+}
+
+async function testThrottleTransformValidation() {
+  function _rejects(label, opts) {
+    return b.httpClient.request(opts).then(
+      function () { check(label + " (did not reject)", false); },
+      function (e) { check(label, e && /maxBytesPerSec|Transform/i.test(e.message || "")); });
+  }
+  await _rejects("maxBytesPerSec: non-number refused",
+    { url: "https://x.example/", maxBytesPerSec: "fast" });
+  await _rejects("maxBytesPerSec: <= 0 refused",
+    { url: "https://x.example/", maxBytesPerSec: 0 });
+  await _rejects("downloadTransform: non-Transform refused",
+    { url: "https://x.example/", downloadTransform: 123 });
+  await _rejects("uploadTransform: non-Transform refused",
+    { url: "https://x.example/", uploadTransform: { not: "a stream" } });
+}
+
 async function run() {
   testSurface();
+  await testBandwidthThrottle();
+  await testDownloadTransformInterpose();
+  await testThrottleTransformValidation();
   await testDownloadHappyPath();
   await testDownloadExpectedHashMatch();
   await testDownloadHashMismatch();

package/lib/vendor/blamejs/test/layer-0-primitives/http-client-throttle-transform.test.js

@@ -0,0 +1,88 @@
+"use strict";
+/**
+ * b.httpClient — download/upload transform correctness outside stream mode.
+ *
+ *   - A downloadTransform must apply in the default "buffer" responseMode, not
+ *     only when responseMode is "stream": the buffered body is the transformed
+ *     bytes.
+ *   - A size-changing uploadTransform on a Buffer body must NOT leave a stale
+ *     Content-Length: the request is framed (chunked) on the transformed bytes
+ *     so the server receives the whole body, not a truncated prefix.
+ *
+ * No live network — a local http.Server on a random port.
+ */
+
+var http        = require("http");
+var nodeStream  = require("stream");
+
+var helpers = require("../helpers");
+var b       = helpers.b;
+var check   = helpers.check;
+
+async function _withServer(handler, fn) {
+  var server = http.createServer(handler);
+  var port = await b.testing.listenOnRandomPort(server, "127.0.0.1");
+  try { return await fn("http://127.0.0.1:" + port); }
+  finally { await new Promise(function (resolve) { server.close(function () { resolve(); }); }); }
+}
+
+function _upperTransform() {
+  return new nodeStream.Transform({
+    transform: function (chunk, _enc, cb) { cb(null, Buffer.from(chunk.toString("utf8").toUpperCase())); },
+  });
+}
+
+// Appends a fixed suffix on flush — the transformed body is strictly larger
+// than the source, so a stale Content-Length would truncate it.
+function _appendTransform() {
+  return new nodeStream.Transform({
+    transform: function (chunk, _enc, cb) { cb(null, chunk); },
+    flush:     function (cb) { this.push(Buffer.from("-XFORM")); cb(); },
+  });
+}
+
+async function testDownloadTransformAppliesInBufferMode() {
+  await _withServer(function (req, res) {
+    res.writeHead(200, { "Content-Type": "text/plain" });
+    res.end("hello world");
+  }, async function (base) {
+    var r = await b.httpClient.request({
+      url: base + "/", allowedProtocols: b.safeUrl.ALLOW_HTTP_ALL, allowInternal: true,
+      downloadTransform: _upperTransform,                 // default responseMode = "buffer"
+    });
+    check("buffer-mode downloadTransform applied to the buffered body",
+      r.body.toString("utf8") === "HELLO WORLD");
+  });
+}
+
+async function testUploadTransformSizeChangeNotTruncated() {
+  var received = null;
+  await _withServer(function (req, res) {
+    var chunks = [];
+    req.on("data", function (c) { chunks.push(c); });
+    req.on("end", function () {
+      received = Buffer.concat(chunks).toString("utf8");
+      res.writeHead(200); res.end("ok");
+    });
+  }, async function (base) {
+    await b.httpClient.request({
+      url: base + "/", method: "POST", body: Buffer.from("payload"),
+      allowedProtocols: b.safeUrl.ALLOW_HTTP_ALL, allowInternal: true,
+      uploadTransform: _appendTransform,                  // grows the body past the Buffer length
+    });
+    check("size-changing uploadTransform delivers the whole transformed body",
+      received === "payload-XFORM");
+  });
+}
+
+async function run() {
+  await testDownloadTransformAppliesInBufferMode();
+  await testUploadTransformSizeChangeNotTruncated();
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  run().then(function () { console.log("OK http-client-throttle-transform — " + helpers.getChecks() + " checks"); })
+       .catch(function (e) { console.error("FAIL:", e && e.stack || e); process.exit(1); });
+}