@blamejs/blamejs-shop 0.4.68 → 0.4.70

package/lib/vendor/blamejs/test/layer-0-primitives/importmap-integrity.test.js

@@ -42,11 +42,36 @@ function testImportmapErrorClass() {
   check("ImportmapError carries code", e.code === "importmap/test");
 }
 
+function testScriptTagEscapesScriptBreakout() {
+  // A module url containing "</script>" must NOT close the injected
+  // <script type="importmap"> element. scriptTag uses the <script>-safe
+  // serializer; raw JSON.stringify would leave the "</script>" literal.
+  var im = b.importmapIntegrity.build({
+    modules: { "x": { url: "/a</script><script>alert(1)</script>", body: "code" } },
+  });
+  var tag = b.importmapIntegrity.scriptTag(im);
+  // Exactly one "</script>" — the tag's own close. The url's "</script>"
+  // must be escaped.
+  check("scriptTag: only the tag's own </script> is present (url breakout escaped)",
+        tag.split("</script>").length - 1 === 1);
+  check("scriptTag: the url's < is escaped to \\u003c",
+        tag.indexOf("u003c/script") !== -1 && tag.indexOf("/a</script>") === -1);
+  // The embedded JSON still parses and yields the original url.
+  var jsonText = tag.replace(/^<script[^>]*>/, "").replace(/<\/script>$/, "");
+  check("scriptTag: embedded JSON round-trips to the original url",
+        JSON.parse(jsonText).imports.x === "/a</script><script>alert(1)</script>");
+  // nonce validation: a malformed nonce is refused, not escaped into the tag.
+  var threw = null;
+  try { b.importmapIntegrity.scriptTag(im, { nonce: '" onload="x' }); } catch (e) { threw = e; }
+  check("scriptTag: malformed nonce is refused", threw && threw.code === "importmap/bad-nonce");
+}
+
 function run() {
   testBuildShape();
   testBuildSha256();
   testRefusesBadHash();
   testImportmapErrorClass();
+  testScriptTagEscapesScriptBreakout();
 }
 
 if (require.main === module) {

package/lib/vendor/blamejs/test/layer-0-primitives/legal-hold.test.js

@@ -137,6 +137,34 @@ async function run() {
   var resRaw = JSON.stringify(b.db.prepare("SELECT reason FROM \"_blamejs_subject_restrictions\"").all());
   check("#114 subject-restriction reason is sealed at rest (not plaintext)", resRaw.indexOf(RES_SECRET) === -1);
 
+  // ---- B8b: a LAPSED hold must be renewable via place() ----
+  // place() rejected "already-held" whenever ANY row existed — including a hold
+  // whose retainUntil sunset had passed (isHeld already false). That left a
+  // subject both unprotected (isHeld false) AND unable to receive a fresh hold
+  // when new litigation arose. A lapsed hold must be replaceable; an ACTIVE one
+  // still rejects.
+  var lapsedPlace = holds.place("lapse-user", {
+    reason: "original matter (sunset already passed)",
+    retainUntil: Date.now() - b.constants.TIME.days(1),   // born lapsed
+  });
+  check("B8b: placing a hold with a past retainUntil succeeds", lapsedPlace.placed === true);
+  check("B8b: a lapsed hold reads as NOT held", holds.isHeld("lapse-user") === false);
+
+  var renew = holds.place("lapse-user", {
+    reason:    "fresh litigation — renewed hold",
+    citation:  "FRCP-26",
+  });
+  check("B8b: place() RENEWS a lapsed hold (not rejected already-held)", renew.placed === true);
+  check("B8b: renewal is flagged renewedFromLapsed", renew.renewedFromLapsed === true);
+  check("B8b: subject is held again after renewal", holds.isHeld("lapse-user") === true);
+  check("B8b: the renewed hold carries the new reason",
+        holds.get("lapse-user").reason === "fresh litigation — renewed hold");
+
+  // Control: an ACTIVE (non-lapsed) hold still rejects a second place().
+  var activeReplace = holds.place("lapse-user", { reason: "duplicate attempt" });
+  check("B8b: re-placing an ACTIVE hold is still rejected already-held",
+        activeReplace.error === "already-held");
+
   await dbHelper.teardownTestDb(tmpDir);
 }
 

package/lib/vendor/blamejs/test/layer-0-primitives/mail-crypto-smime.test.js

@@ -299,8 +299,28 @@ function testSmimeCertKeyBinding() {
         smime._certKeyMatches({ publicKey: { export: function () { throw new Error("nope"); } } }, spkiA) === false);
 }
 
+function testSmimeContentTypeAttrExtraction() {
+  // RFC 5652 §11.1: verify() binds the contentType signed-attr to the
+  // eContentType. _extractContentTypeOid must surface a present contentType
+  // OID and return null when the attribute is absent (which verify rejects).
+  var asn1 = require("../../lib/asn1-der");
+  var OID_CT_ATTR = "1.2.840.113549.1.9.3";
+  var OID_MD_ATTR = "1.2.840.113549.1.9.4";
+  var OID_ID_DATA = "1.2.840.113549.1.7.1";
+  function setOf(buf) { return asn1.writeNode(0x31, buf); }            // SET
+  var ctAttr = asn1.writeSequence([asn1.writeOid(OID_CT_ATTR), setOf(asn1.writeOid(OID_ID_DATA))]);
+  var mdAttr = asn1.writeSequence([asn1.writeOid(OID_MD_ATTR), setOf(asn1.writeOctetString(Buffer.alloc(32)))]);
+  var withCt    = setOf(Buffer.concat([mdAttr, ctAttr]));
+  var withoutCt = setOf(mdAttr);
+  check("smime contentType: present attribute extracts its eContentType OID",
+        smime._extractContentTypeOid(withCt) === OID_ID_DATA);
+  check("smime contentType: absent attribute yields null (verify then refuses)",
+        smime._extractContentTypeOid(withoutCt) === null);
+}
+
 function run() {
   testSmimeSurface();
+  testSmimeContentTypeAttrExtraction();
   testSmimeCertKeyBinding();
   testSmimeSignVerifyRoundtrip();
   testSmimeVerifyTamperRefused();

package/lib/vendor/blamejs/test/layer-0-primitives/mail-header-injection.test.js

@@ -0,0 +1,58 @@
+"use strict";
+/**
+ * b.mail — outbound header injection (CWE-93 / RFC 5322). Reply-To and custom
+ * header KEYS reach the wire in _buildRfc822; a CRLF in either smuggles
+ * arbitrary headers (Bcc / Reply-To override / Content-Type). _validateMessage
+ * must fail closed on CRLF in replyTo, header keys, and header values.
+ */
+
+var helpers = require("../helpers");
+var b       = helpers.b;
+var check   = helpers.check;
+
+function _mailer() {
+  return b.mail.create({
+    transport: function () { return Promise.resolve({ ok: true }); },
+    audit:     false,
+  });
+}
+function _base() {
+  return { from: "sender@example.com", to: "rcpt@example.com", subject: "hi", text: "hello" };
+}
+async function _expectThrow(label, message, codeMatch) {
+  var m = _mailer();
+  try { await m.send(message); check(label + " (did not throw)", false); }
+  catch (e) { check(label, (e && e.code || "").indexOf(codeMatch) !== -1); }
+}
+
+async function testCleanSends() {
+  var m = _mailer();
+  var sent = true;
+  try { await m.send(_base()); } catch (_e) { sent = false; }
+  check("clean message sends", sent === true);
+}
+async function testReplyToCrlfRefused() {
+  await _expectThrow("Reply-To CRLF refused (header injection)",
+    Object.assign(_base(), { replyTo: "a@b.com\r\nBcc: evil@x.com" }), "mail/invalid-reply-to");
+}
+async function testHeaderKeyCrlfRefused() {
+  await _expectThrow("header KEY CRLF refused (header injection)",
+    Object.assign(_base(), { headers: { "X-Foo\r\nBcc: evil@x.com": "v" } }), "mail/invalid-header");
+}
+async function testHeaderValueCrlfRefused() {
+  await _expectThrow("header VALUE CRLF refused (header injection)",
+    Object.assign(_base(), { headers: { "X-Foo": "v\r\nBcc: evil@x.com" } }), "mail/invalid-header");
+}
+
+async function run() {
+  await testCleanSends();
+  await testReplyToCrlfRefused();
+  await testHeaderKeyCrlfRefused();
+  await testHeaderValueCrlfRefused();
+  console.log("[mail-header-injection] OK — " + helpers.getChecks() + " checks passed");
+}
+
+module.exports = { run: run };
+if (require.main === module) {
+  run().then(function () {}, function (e) { console.error("FAIL: " + helpers.formatErr(e)); process.exit(1); });
+}

package/lib/vendor/blamejs/test/layer-0-primitives/mail-journal.test.js

@@ -32,14 +32,14 @@ function testBadInput() {
     function () { b.mail.journal.create({
       storage: { putObject: function () {} },
       vault:   { seal: function () {} },
-      legalHold: { isOnHold: function () {} },
+      legalHold: { isHeld: function () {} },
       db: { runSql: function () {} },
     }); });
   expectThrow("refuses unknown regime",
     function () { b.mail.journal.create({
       storage:   { putObject: function () {} },
       vault:     { seal: function () {} },
-      legalHold: { isOnHold: function () {} },
+      legalHold: { isHeld: function () {} },
       db:        { runSql: function () {} },
       regimes:   ["bogus-regime"],
     }); });
@@ -47,7 +47,7 @@ function testBadInput() {
     function () { b.mail.journal.create({
       storage:   { putObject: function () {} },
       vault:     { seal: function () {} },
-      legalHold: { isOnHold: function () {} },
+      legalHold: { isHeld: function () {} },
       db:        { runSql: function () {} },
       regimes:   ["hipaa"],
       namespace: "bad/slash",
@@ -64,7 +64,7 @@ function testRegimeFloorMath() {
   var calls = [];
   var db = { runSql: function (sql, args) { calls.push({ sql: sql.slice(0, 40), args: args }); return []; } };
   var vault     = { seal: function (x) { return x; } };
-  var legalHold = { isOnHold: function () { return false; } };
+  var legalHold = { isHeld: function () { return false; } };
 
   var j = b.mail.journal.create({
     storage: storage, vault: vault, legalHold: legalHold, db: db,
@@ -94,7 +94,7 @@ function testCreatesIndexTable() {
   b.mail.journal.create({
     storage:   { putObject: async function () {} },
     vault:     { seal: function () {} },
-    legalHold: { isOnHold: function () { return false; } },
+    legalHold: { isHeld: function () { return false; } },
     db:        db,
     regimes:   ["hipaa"],
     namespace: "compliance",
@@ -120,7 +120,7 @@ function testIndexNamesValidSql() {
   b.mail.journal.create({
     storage:   { putObject: async function () {} },
     vault:     { seal: function () {} },
-    legalHold: { isOnHold: function () { return false; } },
+    legalHold: { isHeld: function () { return false; } },
     db:        db,
     regimes:   ["hipaa"],
     namespace: "compliance",
@@ -154,11 +154,14 @@ function testSealUnsealRoundTrip() {
   var db = {
     runSql: function (sql, args) {
       if (/INSERT INTO/.test(sql)) {
+        // INSERT value order (b.sql binds in object-key order): journal_id,
+        // direction, actor_id, message_id, archived_at, size_bytes, regimes,
+        // floor_until, legal_hold, storage_key, sealed_payload.
         insertedRow = {
           journal_id: args[0], direction: args[1], actor_id: args[2],
           message_id: args[3], archived_at: args[4], size_bytes: args[5],
-          regimes: args[6], floor_until: args[7], legal_hold: 0,
-          storage_key: args[8], sealed_payload: args[9],
+          regimes: args[6], floor_until: args[7], legal_hold: args[8],
+          storage_key: args[9], sealed_payload: args[10],
         };
         return [];
       }
@@ -172,7 +175,7 @@ function testSealUnsealRoundTrip() {
   };
   var j = b.mail.journal.create({
     storage: storage, vault: fakeVault,
-    legalHold: { isOnHold: function () { return false; } },
+    legalHold: { isHeld: function () { return false; } },
     db: db, regimes: ["hipaa"], namespace: "rt",
   });
   return j.record({
@@ -200,6 +203,56 @@ function testSealUnsealRoundTrip() {
   });
 }
 
+// B8c: the real b.legalHold handle exposes isHeld, NOT isOnHold. create()
+// required isOnHold, so the documented `legalHold: b.legalHold` wiring threw
+// mail-journal/bad-legal-hold and the handle could never be used; the legal_hold
+// flag was also hardcoded 0, never derived from the registry. Fix: require
+// isHeld and auto-flag an entry whose actor is under an active hold. The prior
+// tests stubbed { isOnHold } — fabricating the broken contract — so they never
+// exercised the real handle's shape; this drives the actual consumer contract.
+async function testRealLegalHoldContractAndAutoFlag() {
+  var fakeDb = { prepare: function () {
+    return { get: function () { return null; }, run: function () {}, all: function () { return []; } };
+  } };
+  var realHandle = b.legalHold.create({ db: fakeDb, audit: false });
+  check("a real b.legalHold handle exposes isHeld (the method create() consumes)",
+    typeof realHandle.isHeld === "function");
+  check("a real b.legalHold handle does NOT expose the old isOnHold name",
+    typeof realHandle.isOnHold === "undefined");
+
+  var heldActor = "held-subject";
+  var legalHold = { isHeld: function (sid) { return sid === heldActor; } };
+  var inserted = [];
+  var fakeVault = { seal: function (s) { return "vault:" + s; }, unseal: function (s) { return s.slice(6); } };
+  var storage = { putObject: async function () {} };
+  var db = { runSql: function (sqlText, args) { if (/INSERT INTO/.test(sqlText)) inserted.push(args); return []; } };
+
+  var j = b.mail.journal.create({
+    storage: storage, vault: fakeVault, legalHold: legalHold, db: db,
+    regimes: ["hipaa"], namespace: "hold",
+  });
+  // legal_hold is the 9th bound value (index 8) — see the INSERT order above.
+  await j.record({ direction: "inbound", actorId: heldActor, messageId: "<h@x>",
+    headers: {}, envelope: {}, bodyBytes: Buffer.from("x") });
+  check("entry whose actor is on legal hold is auto-flagged (legal_hold = 1)",
+    inserted.length === 1 && inserted[0][8] === 1);
+  await j.record({ direction: "inbound", actorId: "free-subject", messageId: "<f@x>",
+    headers: {}, envelope: {}, bodyBytes: Buffer.from("y") });
+  check("entry whose actor is NOT held is legal_hold = 0",
+    inserted.length === 2 && inserted[1][8] === 0);
+
+  // create() must REJECT a legacy { isOnHold } handle (the wrong contract).
+  var threw = null;
+  try {
+    b.mail.journal.create({
+      storage: storage, vault: fakeVault, db: db, regimes: ["hipaa"], namespace: "legacy",
+      legalHold: { isOnHold: function () { return false; } },
+    });
+  } catch (e) { threw = e; }
+  check("create() rejects a handle exposing only the legacy isOnHold",
+    threw && (threw.code || "").indexOf("mail-journal/bad-legal-hold") === 0);
+}
+
 async function run() {
   testSurface();
   testBadInput();
@@ -207,6 +260,7 @@ async function run() {
   testCreatesIndexTable();
   testIndexNamesValidSql();
   await testSealUnsealRoundTrip();
+  await testRealLegalHoldContractAndAutoFlag();
 }
 
 module.exports = { run: run };

package/lib/vendor/blamejs/test/layer-0-primitives/mdoc.test.js

@@ -99,7 +99,7 @@ function testSurface() {
 async function testRoundTrip() {
   var cert = _makeCert();
   var mdoc = await _makeMdoc(cert);
-  var out = await b.mdoc.verifyIssuerSigned(mdoc, { algorithms: ["ES256"], expectedDocType: DOCTYPE });
+  var out = await b.mdoc.verifyIssuerSigned(mdoc, { algorithms: ["ES256"], expectedDocType: DOCTYPE, trustAnchorsPem: cert.pem });
   check("verify: docType", out.docType === DOCTYPE);
   check("verify: alg reported", out.alg === "ES256");
   check("verify: digestAlgorithm", out.digestAlgorithm === "SHA-256");
@@ -125,7 +125,7 @@ async function testDigestAndSignatureRefusals() {
   items[0] = new cbor.Tag(24, cbor.encode(inner0));
   var tampered = cbor.encode(top);
   var e1 = null;
-  try { await b.mdoc.verifyIssuerSigned(tampered, { algorithms: ["ES256"] }); } catch (e) { e1 = e; }
+  try { await b.mdoc.verifyIssuerSigned(tampered, { algorithms: ["ES256"], trustAnchorsPem: cert.pem }); } catch (e) { e1 = e; }
   check("verify: tampered element refused (digest-mismatch)", e1 && e1.code === "mdoc/digest-mismatch");
 
   // Tamper the COSE signature deterministically (flip a byte in the
@@ -135,19 +135,19 @@ async function testDigestAndSignatureRefusals() {
   ia[3] = Buffer.from(ia[3]); ia[3][0] ^= 0xff;
   var bad = cbor.encode(top2);
   var e2 = null;
-  try { await b.mdoc.verifyIssuerSigned(bad, { algorithms: ["ES256"] }); } catch (e) { e2 = e; }
+  try { await b.mdoc.verifyIssuerSigned(bad, { algorithms: ["ES256"], trustAnchorsPem: cert.pem }); } catch (e) { e2 = e; }
   check("verify: tampered COSE signature refused", e2 && e2.code === "cose/bad-signature");
 
   // A malformed x5chain certificate surfaces a clean error (not raw OpenSSL).
   var top3 = cbor.decode(mdoc, { allowedTags: [0, 1, 24, 1004] });
   top3.get("issuerAuth")[1].set(33, Buffer.from([0x30, 0x03, 0x02, 0x01, 0x01]));
   var e6 = null;
-  try { await b.mdoc.verifyIssuerSigned(cbor.encode(top3), { algorithms: ["ES256"] }); } catch (e) { e6 = e; }
+  try { await b.mdoc.verifyIssuerSigned(cbor.encode(top3), { algorithms: ["ES256"], trustAnchorsPem: cert.pem }); } catch (e) { e6 = e; }
   check("verify: malformed x5chain cert refused cleanly", e6 && e6.code === "mdoc/bad-cert");
 
   // alg outside allowlist
   var e3 = null;
-  try { await b.mdoc.verifyIssuerSigned(mdoc, { algorithms: ["EdDSA"] }); } catch (e) { e3 = e; }
+  try { await b.mdoc.verifyIssuerSigned(mdoc, { algorithms: ["EdDSA"], trustAnchorsPem: cert.pem }); } catch (e) { e3 = e; }
   check("verify: alg outside allowlist refused", e3 && (e3.code === "cose/alg-not-allowed"));
 }
 
@@ -157,40 +157,43 @@ async function testValidityAndDocType() {
   // expired (valid window 10 days ago .. 1 day ago)
   var expired = await _makeMdoc(cert, { validFrom: Date.now() - 86400000 * 10, validUntil: Date.now() - 86400000 });
   var e1 = null;
-  try { await b.mdoc.verifyIssuerSigned(expired, { algorithms: ["ES256"] }); } catch (e) { e1 = e; }
+  try { await b.mdoc.verifyIssuerSigned(expired, { algorithms: ["ES256"], trustAnchorsPem: cert.pem }); } catch (e) { e1 = e; }
   check("verify: expired credential refused", e1 && e1.code === "mdoc/expired");
 
   // not yet valid
   var future = await _makeMdoc(cert, { validFrom: Date.now() + 86400000 * 30 });
   var e2 = null;
-  try { await b.mdoc.verifyIssuerSigned(future, { algorithms: ["ES256"] }); } catch (e) { e2 = e; }
+  try { await b.mdoc.verifyIssuerSigned(future, { algorithms: ["ES256"], trustAnchorsPem: cert.pem }); } catch (e) { e2 = e; }
   check("verify: not-yet-valid credential refused", e2 && e2.code === "mdoc/not-yet-valid");
 
   // opts.at within window accepts an otherwise-expired credential
-  var ok = await b.mdoc.verifyIssuerSigned(expired, { algorithms: ["ES256"], at: new Date(Date.now() - 86400000 * 2) });
+  // allowUntrustedIssuer (not trustAnchorsPem): this asserts the MSO validity
+  // window honors opts.at — anchoring would instead chain-validate the cert at
+  // the past `at`, where the (created-now) cert isn't yet valid.
+  var ok = await b.mdoc.verifyIssuerSigned(expired, { algorithms: ["ES256"], at: new Date(Date.now() - 86400000 * 2), allowUntrustedIssuer: true });
   check("verify: opts.at within window accepts", ok.docType === DOCTYPE);
 
   // docType mismatch
   var e3 = null;
-  try { await b.mdoc.verifyIssuerSigned(await _makeMdoc(cert), { algorithms: ["ES256"], expectedDocType: "org.iso.18013.5.1.photoID" }); } catch (e) { e3 = e; }
+  try { await b.mdoc.verifyIssuerSigned(await _makeMdoc(cert), { algorithms: ["ES256"], expectedDocType: "org.iso.18013.5.1.photoID", trustAnchorsPem: cert.pem }); } catch (e) { e3 = e; }
   check("verify: docType mismatch refused", e3 && e3.code === "mdoc/doctype-mismatch");
 
   // malformed validUntil (a non-date) fails closed
   var badValidity = await _makeMdoc(cert, { validUntilRaw: new cbor.Tag(0, "not-a-date") });
   var e4 = null;
-  try { await b.mdoc.verifyIssuerSigned(badValidity, { algorithms: ["ES256"] }); } catch (e) { e4 = e; }
+  try { await b.mdoc.verifyIssuerSigned(badValidity, { algorithms: ["ES256"], trustAnchorsPem: cert.pem }); } catch (e) { e4 = e; }
   check("verify: malformed validUntil refused (fail closed)", e4 && e4.code === "mdoc/bad-validity");
 
   // invalid opts.at refused (lesson carried from b.tsa / b.vc)
   var e5 = null;
-  try { await b.mdoc.verifyIssuerSigned(await _makeMdoc(cert), { algorithms: ["ES256"], at: new Date("nope") }); } catch (e) { e5 = e; }
+  try { await b.mdoc.verifyIssuerSigned(await _makeMdoc(cert), { algorithms: ["ES256"], at: new Date("nope"), trustAnchorsPem: cert.pem }); } catch (e) { e5 = e; }
   check("verify: invalid opts.at refused", e5 && e5.code === "mdoc/bad-at");
 
   // Two signed IssuerSignedItems with the same elementIdentifier (each
   // with a valid MSO digest) is ambiguous → fail closed, not last-wins.
   var dup = await _makeMdoc(cert, { elements: [["family_name", "Doe"], ["family_name", "Roe"]] });
   var e6 = null;
-  try { await b.mdoc.verifyIssuerSigned(dup, { algorithms: ["ES256"] }); } catch (e) { e6 = e; }
+  try { await b.mdoc.verifyIssuerSigned(dup, { algorithms: ["ES256"], trustAnchorsPem: cert.pem }); } catch (e) { e6 = e; }
   check("verify: duplicate elementIdentifier refused", e6 && e6.code === "mdoc/duplicate-element");
 }
 
@@ -211,7 +214,7 @@ async function testChainAndInputGuards() {
 
   // garbage input → not CBOR / malformed
   var e3 = null;
-  try { await b.mdoc.verifyIssuerSigned(Buffer.from([0x00, 0x01]), { algorithms: ["ES256"] }); } catch (e) { e3 = e; }
+  try { await b.mdoc.verifyIssuerSigned(Buffer.from([0x00, 0x01]), { algorithms: ["ES256"], trustAnchorsPem: cert.pem }); } catch (e) { e3 = e; }
   check("verify: garbage input refused", e3 && (e3.code === "mdoc/malformed" || e3.code === "mdoc/bad-input" || /cbor/.test(e3.code || "")));
 
   // missing algorithms
@@ -226,7 +229,7 @@ async function testDeviceAuth() {
   var deviceJwk = device.publicKey.export({ format: "jwk" });
   // issuer-signed mdoc carrying the device key in the MSO
   var mdoc = await _makeMdoc(cert, { deviceJwk: deviceJwk });
-  var issuer = await b.mdoc.verifyIssuerSigned(mdoc, { algorithms: ["ES256"] });
+  var issuer = await b.mdoc.verifyIssuerSigned(mdoc, { algorithms: ["ES256"], trustAnchorsPem: cert.pem });
   check("verifyIssuerSigned: returns the deviceKey", issuer.deviceKey instanceof Map || (issuer.deviceKey && typeof issuer.deviceKey === "object"));
 
   // build a DeviceSigned: detached COSE_Sign1 over DeviceAuthentication
@@ -263,12 +266,36 @@ async function testDeviceAuth() {
   check("verifyDeviceAuth: missing sessionTranscript refused", e4 && e4.code === "mdoc/no-session-transcript");
 }
 
+async function testTrustAnchorFailClosedByDefault() {
+  // The signer cert rides in the attacker-supplied x5chain, so verifying the
+  // COSE_Sign1 against that embedded key only proves the MSO is self-consistent.
+  // A forged mDL (attacker keypair + self-signed leaf + self-signed MSO) must be
+  // REFUSED by default — issuer trust is not opt-in.
+  var forged = _makeCert();                    // an arbitrary self-signed issuer
+  var mdoc = await _makeMdoc(forged);
+
+  var e1 = null;
+  try { await b.mdoc.verifyIssuerSigned(mdoc, { algorithms: ["ES256"] }); } catch (e) { e1 = e; }
+  check("verify: refuses a self-signed mDL with no trust anchor (no fail-open)",
+    e1 && e1.code === "mdoc/trust-anchors-required");
+
+  // The explicit, audited opt-out accepts it but marks it unauthenticated.
+  var out = await b.mdoc.verifyIssuerSigned(mdoc, { algorithms: ["ES256"], allowUntrustedIssuer: true });
+  check("verify: allowUntrustedIssuer opt-out accepts but flags issuerTrusted:false",
+    out.docType === DOCTYPE && out.issuerTrusted === false);
+
+  // Anchored to its own cert → trusted.
+  var anchored = await b.mdoc.verifyIssuerSigned(mdoc, { algorithms: ["ES256"], trustAnchorsPem: forged.pem });
+  check("verify: anchored verification reports issuerTrusted:true", anchored.issuerTrusted === true);
+}
+
 async function run() {
   testSurface();
   await testRoundTrip();
   await testDigestAndSignatureRefusals();
   await testValidityAndDocType();
   await testChainAndInputGuards();
+  await testTrustAnchorFailClosedByDefault();
   await testDeviceAuth();
 }
 

package/lib/vendor/blamejs/test/layer-0-primitives/network-allowlist.test.js

@@ -94,6 +94,67 @@ async function run() {
   req5.socket = { remoteAddress: "192.168.1.1" };
   var r5 = await _runMw(fence403, req5);
   check("custom denyStatus = 403",                  r5.res._captured().status === 403);
+
+  // ---- X-Forwarded-For spoofing (CWE-290/348) ----
+  // A bare trustProxy honored the leftmost XFF hop, which a direct caller
+  // fully controls — forging an allowed IP walked through the gate. The gate
+  // now refuses that spoofable config at construction and peer-gates XFF.
+
+  // Construction fails closed: trustProxy without trustedProxies/resolver.
+  var threwBareTrust = null;
+  try { b.middleware.networkAllowlist({ paths: ["/admin"], allowedCidrs: ["203.0.113.0/24"], trustProxy: true }); }
+  catch (e) { threwBareTrust = e; }
+  check("create: bare trustProxy refused (spoofable gate)", threwBareTrust !== null);
+  var threwBareNum = null;
+  try { b.middleware.networkAllowlist({ paths: ["/admin"], allowedCidrs: ["203.0.113.0/24"], trustProxy: 1 }); }
+  catch (e) { threwBareNum = e; }
+  check("create: bare trustProxy:N refused too",            threwBareNum !== null);
+  var threwBadResolver = null;
+  try { b.middleware.networkAllowlist({ paths: ["/admin"], allowedCidrs: ["203.0.113.0/24"], clientIpResolver: 123 }); }
+  catch (e) { threwBadResolver = e; }
+  check("create: non-function clientIpResolver refused",    threwBadResolver !== null);
+
+  function _xffReq(sock, xff) {
+    var rq = _mockReq({ url: "/admin/x", method: "GET" });
+    rq.pathname = "/admin/x";
+    rq.socket = { remoteAddress: sock };
+    rq.headers["x-forwarded-for"] = xff;
+    return rq;
+  }
+
+  // Peer-gated via trustedProxies.
+  var pgFence = b.middleware.networkAllowlist({
+    paths:          ["/admin"],
+    allowedCidrs:   ["203.0.113.0/24"],
+    trustedProxies: ["10.0.0.0/8"],
+  });
+  // Direct attacker (untrusted peer) forging an allowed IP → DENIED.
+  var rSpoof = await _runMw(pgFence, _xffReq("198.51.100.66", "203.0.113.7"));
+  check("spoofed XFF from untrusted peer → blocked",    rSpoof.next === false);
+  // Trusted proxy forwarding a real allowed client → allowed.
+  var rTrusted = await _runMw(pgFence, _xffReq("10.0.0.9", "203.0.113.7"));
+  check("trusted proxy + allowed client → next()",      rTrusted.next === true);
+  // Trusted proxy forwarding a non-allowed client → blocked (real IP honored).
+  var rTrustedBad = await _runMw(pgFence, _xffReq("10.0.0.9", "198.51.100.66"));
+  check("trusted proxy + non-allowed client → blocked", rTrustedBad.next === false);
+
+  // clientIpResolver: operator owns resolution entirely.
+  var resFence = b.middleware.networkAllowlist({
+    paths:            ["/admin"],
+    allowedCidrs:     ["203.0.113.0/24"],
+    clientIpResolver: function (rq) { return rq.headers["true-client-ip"]; },
+  });
+  var resReq = _mockReq({ url: "/admin/x", method: "GET" });
+  resReq.pathname = "/admin/x";
+  resReq.socket = { remoteAddress: "1.2.3.4" };
+  resReq.headers["true-client-ip"] = "203.0.113.50";
+  var rRes = await _runMw(resFence, resReq);
+  check("clientIpResolver resolves allowed client → next()", rRes.next === true);
+
+  // Default (no trust config): socket address governs, forged XFF ignored.
+  var defFence = b.middleware.networkAllowlist({ paths: ["/admin"], allowedCidrs: ["203.0.113.0/24"] });
+  var rDefSpoof = await _runMw(defFence, _xffReq("198.51.100.66", "203.0.113.7"));
+  check("default: forged XFF ignored, attacker socket blocked", rDefSpoof.next === false);
 }
 
 module.exports = { run: run };

package/lib/vendor/blamejs/test/layer-0-primitives/object-store-range-header.test.js

@@ -0,0 +1,51 @@
+"use strict";
+/**
+ * b.objectStore conditional-GET Range header (shared across sigv4 / gcs / azure).
+ * The documented + shipped contract is `range: [start, end]` (array) — see
+ * b.archive.adapters.objectStore and b.backup. Reading .start/.end off an array
+ * yielded "bytes=undefined-undefined", which every store IGNORES, silently
+ * returning the FULL object instead of the requested byte range.
+ */
+
+var helpers = require("../helpers");
+var check   = helpers.check;
+
+var httpReq = require("../../lib/object-store/http-request");
+var apply   = httpReq.applyConditionalGetHeaders;
+
+function run() {
+  // Array contract [start, end] → correct bytes= header (the real caller shape).
+  var t1 = apply({}, { range: [0, 1023] }, "Range");
+  check("array range [0,1023] → bytes=0-1023", t1.Range === "bytes=0-1023");
+
+  // Honors the backend-specific range header name (Azure x-ms-range).
+  var t2 = apply({}, { range: [100, 199] }, "x-ms-range");
+  check("array range honors azure header name", t2["x-ms-range"] === "bytes=100-199");
+
+  // { start, end } object form still accepted (compatibility).
+  var t3 = apply({}, { range: { start: 5, end: 9 } }, "Range");
+  check("object {start,end} compat → bytes=5-9", t3.Range === "bytes=5-9");
+
+  // No range → no Range header at all.
+  var t4 = apply({}, {}, "Range");
+  check("no range → no Range header emitted", !("Range" in t4));
+
+  // Malformed range must throw, not emit a garbage header that over-fetches.
+  var threw = null;
+  try { apply({}, { range: [undefined, 10] }, "Range"); } catch (e) { threw = e; }
+  check("malformed range ([undefined,10]) throws, not bytes=undefined",
+        threw && /range must be|INVALID_RANGE/.test((threw.message || "") + " " + (threw.code || "")));
+  var threwInv = null;
+  try { apply({}, { range: [10, 5] }, "Range"); } catch (e) { threwInv = e; }
+  check("inverted range (end < start) throws", threwInv !== null);
+  var threwNeg = null;
+  try { apply({}, { range: [-1, 5] }, "Range"); } catch (e) { threwNeg = e; }
+  check("negative start throws", threwNeg !== null);
+
+  console.log("[object-store-range-header] OK — " + helpers.getChecks() + " checks passed");
+}
+
+module.exports = { run: run };
+if (require.main === module) {
+  try { run(); } catch (e) { console.error("FAIL: " + helpers.formatErr(e)); process.exit(1); }
+}

package/lib/vendor/blamejs/test/layer-0-primitives/otlp-attr-redaction.test.js

@@ -78,6 +78,24 @@ async function run() {
   check("redactAttrs scrubs sensitive keys", ra.authorization === "[REDACTED]" && ra.password === "[REDACTED]");
   check("redactAttrs keeps non-sensitive keys", ra["http.method"] === CONTROL_VAL);
 
+  // A sensitive KEY whose VALUE is an array or object must STILL be scrubbed —
+  // the field-name rule has to fire before descending into the composite, or an
+  // opaque token reaches the collector verbatim (CWE-532). OTLP serializes
+  // arrays/objects natively, so these are real wire shapes.
+  var raComposite = b.observability.redactAttrs({
+    authorization: ["Bearer " + SECRET_TOKEN], password: { nested: SECRET_PW },
+    session: [SECRET_API], "http.methods": ["GET", "POST"],
+  });
+  check("redactAttrs scrubs a sensitive key with an ARRAY value",  raComposite.authorization === "[REDACTED]");
+  check("redactAttrs scrubs a sensitive key with an OBJECT value", raComposite.password === "[REDACTED]");
+  check("redactAttrs scrubs a sensitive key with a single-elem array", raComposite.session === "[REDACTED]");
+  check("redactAttrs preserves a NON-sensitive array value",
+        Array.isArray(raComposite["http.methods"]) && raComposite["http.methods"][1] === "POST");
+  // Value-shape detectors still run inside a non-sensitive composite.
+  var raCc = b.observability.redactAttrs({ cards: ["4111 1111 1111 1111"] });
+  check("redactAttrs still detects a CC inside a non-sensitive array",
+        Array.isArray(raCc.cards) && raCc.cards[0] === "[REDACTED-CC]");
+
   var jsonWire = await captureBody("json");
   check("json: bearer token redacted on the OTLP wire", jsonWire.indexOf(SECRET_TOKEN) === -1);
   check("json: password redacted on the OTLP wire",     jsonWire.indexOf(SECRET_PW) === -1);
@@ -91,6 +109,23 @@ async function run() {
   check("protobuf: api key redacted on the OTLP wire",      protoWire.indexOf(SECRET_API) === -1);
   check("protobuf: non-sensitive control attribute survives", protoWire.indexOf(CONTROL_VAL) !== -1);
 
+  // span status.message + name are EGRESS too — the tracer's canonical
+  // setStatus("error", e.message) routinely carries a connection string. Both
+  // the message AND the name now route through the telemetry redactor, so a
+  // value-shape secret (connection string) in either is scrubbed on the wire.
+  var CONN = "connect failed: postgres://app:" + SECRET_PW + "@db:5432/prod";
+  var spanJson = JSON.stringify(otlp._spanToOtlp({
+    traceId: "t", spanId: "s", name: "span " + CONN,
+    status: { code: 2, message: CONN }, attributes: {},
+  }));
+  check("json: span status.message connection-string redacted",
+        spanJson.indexOf(SECRET_PW) === -1 && spanJson.indexOf("[REDACTED-CONN-STRING]") !== -1);
+  var spanProto = Buffer.from(otlp._spanToProto({
+    traceId: "t", spanId: "s", name: "span " + CONN,
+    status: { code: 2, message: CONN }, attributes: {},
+  })).toString("latin1");
+  check("protobuf: span status.message + name connection-string redacted", spanProto.indexOf(SECRET_PW) === -1);
+
   // ---- OTLP LOG sinks are EGRESS too: record-meta + resource attrs must redact ----
   // The span/metric exporters redact; the log sinks (HTTP-JSON + gRPC) shipped
   // the same attribute maps to the collector UNREDACTED — a log line carrying a