@blamejs/blamejs-shop 0.4.69 → 0.4.70

package/lib/vendor/blamejs/test/layer-0-primitives/step-up.test.js

@@ -181,6 +181,13 @@ async function run() {
   check("parseChallenge: maxAge",                 rt.maxAge === 300);
   check("parseChallenge: non-Bearer → null",      b.auth.stepUp.parseChallenge("Basic realm=x") === null);
 
+  // A malformed max_age from the server must not land as NaN (a downstream
+  // `age > maxAge` against NaN is always false) — it's omitted so the caller
+  // falls back to its own default.
+  var badMa = b.auth.stepUp.parseChallenge('Bearer error="insufficient_user_authentication", max_age="not-a-number"');
+  check("parseChallenge: non-numeric max_age stays null (not NaN)",
+        badMa && badMa.maxAge === null);
+
   // ---- parseAuthorizationDetails (RFC 9396) ----
   var rar = b.auth.stepUp.parseAuthorizationDetails(JSON.stringify([
     { type: "payment_initiation", actions: ["initiate"], amount: { currency: "USD", value: 100 } },

package/lib/vendor/blamejs/test/layer-0-primitives/template-escape-html.test.js

@@ -0,0 +1,43 @@
+"use strict";
+// b.template.escapeHtml — the {{ expr }} interpolation escaper (XSS boundary).
+// Now delegates to the centralized markup-escape so the five-character HTML set
+// is defined in ONE place; a divergence between this and the shared escaper is
+// an XSS / XML-injection surface. This pins the contract (all five chars, &
+// first so emitted entities aren't double-escaped, null/undefined → "",
+// non-string coercion) so the delegation can't silently regress.
+
+var helpers = require("../helpers");
+var b     = helpers.b;
+var check = helpers.check;
+
+function run() {
+  var esc = b.template.escapeHtml;
+
+  check("escapes <", esc("<script>") === "&lt;script&gt;");
+  check("escapes & first (no double-escape of emitted entities)", esc("a&b") === "a&amp;b");
+  check("escapes double-quote", esc('say "hi"') === "say &quot;hi&quot;");
+  check("escapes apostrophe to numeric form (single-quoted attr safety)",
+        esc("it's") === "it&#x27;s");
+  check("all five together", esc("<a href='x' title=\"y\">&</a>") ===
+        "&lt;a href=&#x27;x&#x27; title=&quot;y&quot;&gt;&amp;&lt;/a&gt;");
+
+  // & is escaped first so a literal "&lt;" in the input becomes "&amp;lt;",
+  // not "&lt;" (which would let an attacker inject a pre-formed entity).
+  check("pre-formed entity in input is neutralized (& escaped first)",
+        esc("&lt;") === "&amp;lt;");
+
+  check("null → empty string", esc(null) === "");
+  check("undefined → empty string", esc(undefined) === "");
+  check("number coerced + returned", esc(42) === "42");
+  check("boolean coerced", esc(true) === "true");
+  check("plain string unchanged", esc("hello world") === "hello world");
+  check("empty string → empty string", esc("") === "");
+
+  console.log("OK — template.escapeHtml (" + helpers.getChecks() + " checks)");
+}
+
+module.exports = { run: run };
+if (require.main === module) {
+  try { run(); process.exit(0); }
+  catch (e) { console.error("FAIL: " + (e && e.message)); process.exit(1); }
+}

package/lib/vendor/blamejs/test/layer-0-primitives/tenant-quota.test.js

@@ -41,6 +41,21 @@ async function run() {
   var snapReset = budget.snapshot("tenant-acme");
   check("reset clears counters", snapReset.calls === 0);
 
+  // ---- budget — TRUE sliding window (no fixed-window boundary doubling) ----
+  // maxCalls = floor(qpsCap * window/1s) = 5. Fill 5 near the window's tail,
+  // then 1 more just past the nominal reset: a fixed window would admit it
+  // (~2x burst), a sliding window refuses (trailing window still covers them).
+  var sw = b.tenantQuota.budget({ tenantField: "tenantId", perTenantQpsCap: 5, window: 1000, audit: false });
+  for (var i = 0; i < 5; i++) sw.observe("t-burst", { now: 900 });
+  var threwBoundary = null;
+  try { sw.observe("t-burst", { now: 1001 }); } catch (e) { threwBoundary = e; }
+  check("sliding window refuses the boundary-straddling burst (not a fixed window)",
+        threwBoundary && threwBoundary.code === "tenant-quota/budget-exceeded");
+  // After a full window has elapsed, the old calls scroll out → admitted again.
+  var allowedAfterGap = true;
+  try { sw.observe("t-burst", { now: 2600 }); } catch (_e) { allowedAfterGap = false; }
+  check("sliding window admits again once the prior calls age out", allowedAfterGap === true);
+
   // ---- instrumentQuery — tenant-isolation breach ----
   var goodCheck = b.tenantQuota.instrumentQuery({
     rows: [

package/lib/vendor/blamejs/test/layer-0-primitives/vault-default-store.test.js

@@ -0,0 +1,48 @@
+"use strict";
+/**
+ * b.vault.getDefaultStore — the default sealed-storage Store ({ seal, unseal })
+ * that b.cert.create and other sealed-disk consumers resolve when no explicit
+ * vault is passed. It previously did not exist, so the documented cert default
+ * path threw `TypeError: vault(...).getDefaultStore is not a function`.
+ */
+
+var b = require("../..");
+var check = require("../helpers/check").check;
+var fs = require("fs");
+var path = require("path");
+var os = require("os");
+
+async function run() {
+  var tmp = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-vault-defstore-"));
+  try {
+    await b.vault.init({ dataDir: tmp, mode: "plaintext" });
+
+    check("vault.getDefaultStore is a function", typeof b.vault.getDefaultStore === "function");
+    var store = b.vault.getDefaultStore();
+    check("getDefaultStore() exposes seal + unseal",
+          store && typeof store.seal === "function" && typeof store.unseal === "function");
+
+    // Round-trip a payload through the default store (the load-bearing
+    // guarantee; at-rest encryption strength is mode-dependent and covered by
+    // the wrapped-mode vault tests — here the vault is plaintext for speed).
+    var plain = "default-store-secret-not-real";
+    var sealed = store.seal(plain);
+    check("default store seal emits a vault-prefixed value",
+          typeof sealed === "string" && sealed.indexOf("vault:") === 0);
+    check("default store unseals back to the original", store.unseal(sealed) === plain);
+
+    check("vault.Store exposes the same seal/unseal pair",
+          b.vault.Store && typeof b.vault.Store.seal === "function" && typeof b.vault.Store.unseal === "function");
+
+    console.log("OK — vault.getDefaultStore (" + (require("../helpers").getChecks ? require("../helpers").getChecks() : "?") + " checks)");
+  } finally {
+    try { fs.rmSync(tmp, { recursive: true, force: true }); } catch (_e) { /* best-effort */ }
+  }
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  run().then(function () { process.exit(0); })
+       .catch(function (e) { console.error(e); process.exit(1); });
+}

package/lib/vendor/blamejs/test/layer-0-primitives/vendor-currency-classify.test.js

@@ -0,0 +1,77 @@
+"use strict";
+/**
+ * Vendor-currency content classifier — the logic that makes Public Suffix
+ * List drift visible to the release gate. The PSL (and other bare-URL data
+ * vendors) carry no npm semver, so the currency checker compares an
+ * embedded `// COMMIT:` sha (primary) or `// VERSION:` timestamp (fallback)
+ * between the live upstream and our bundled copy. This drift was previously
+ * invisible: the checker queried npm, got a 404, and still printed "OK".
+ *
+ * Pure unit test (no network) — drives _classifyContentCurrency directly.
+ */
+
+var helpers = require("../helpers");
+var check   = helpers.check;
+
+var cur = require("../../scripts/check-vendor-currency.js");
+
+var PSL = cur.SPECIAL_MAP["publicsuffix-list"];
+
+function _doc(commit, version) {
+  var head = "// This Source Code Form is subject to the terms of the MPL 2.0.\n";
+  if (version) head += "// VERSION: " + version + "\n";
+  if (commit)  head += "// COMMIT: " + commit + "\n";
+  return head + "com\nnet\norg\n";
+}
+
+function testCommitMatchIsCurrent() {
+  var v = cur._classifyContentCurrency(_doc("abc1234", "2026-06-13_x"), _doc("abc1234", "2026-06-13_x"), PSL);
+  check("matching COMMIT -> not stale", v.stale === false && v.basis === "commit");
+}
+
+function testCommitDifferIsStale() {
+  // Upstream moved (new commit) but our bundled copy is pinned to the old
+  // sha — this is exactly the PSL-rot case the gate must now catch.
+  var v = cur._classifyContentCurrency(_doc("9186eee", "2026-06-13_x"), _doc("ee780bc", "2026-05-07_y"), PSL);
+  check("differing COMMIT -> stale", v.stale === true && v.basis === "commit");
+  check("stale verdict carries both ids", v.upstreamId === "9186eee" && v.localId === "ee780bc");
+}
+
+function testVersionFallbackWhenNoCommit() {
+  // Older list snapshots predate the COMMIT header — fall back to VERSION.
+  var up = cur._classifyContentCurrency(_doc(null, "2026-06-13_x"), _doc(null, "2026-05-07_y"), PSL);
+  check("no COMMIT, differing VERSION -> stale via version", up.stale === true && up.basis === "version");
+  var same = cur._classifyContentCurrency(_doc(null, "2026-06-13_x"), _doc(null, "2026-06-13_x"), PSL);
+  check("no COMMIT, matching VERSION -> current via version", same.stale === false && same.basis === "version");
+}
+
+function testNoIdentifierThrows() {
+  // Neither side yields a comparable id (e.g. upstream format changed) —
+  // must throw so the caller reports registry-error, never a silent pass.
+  var threw = false;
+  try { cur._classifyContentCurrency(_doc(null, null), _doc(null, null), PSL); }
+  catch (_e) { threw = true; }
+  check("no comparable identifier -> throws (loud, not silent pass)", threw === true);
+}
+
+function testGateConfigLockedIn() {
+  // The whole point: PSL is content-tracked, BIMI is an intentional skip.
+  check("publicsuffix-list mapped to http-content", PSL && PSL.type === "http-content");
+  check("publicsuffix-list has an upstream URL", typeof PSL.url === "string" && PSL.url.indexOf("publicsuffix.org") !== -1);
+  var bimi = cur.SPECIAL_MAP["bimi-trust-anchors"];
+  check("bimi-trust-anchors is a documented skip", bimi && bimi.type === "skip" && typeof bimi.reason === "string");
+}
+
+function run() {
+  testCommitMatchIsCurrent();
+  testCommitDifferIsStale();
+  testVersionFallbackWhenNoCommit();
+  testNoIdentifierThrows();
+  testGateConfigLockedIn();
+  console.log("[vendor-currency-classify] OK — " + helpers.getChecks() + " checks passed");
+}
+
+module.exports = { run: run };
+if (require.main === module) {
+  run();
+}

package/lib/vendor/blamejs/test/layer-0-primitives/webhook.test.js

@@ -256,6 +256,54 @@ async function testNonceStoreErrorPropagates() {
         threw && /redis down/.test(threw.message));
 }
 
+async function testStripeVerifyReplayAtomic() {
+  // #328: b.webhook.verify (Stripe HMAC-SHA-256) speaks the SAME atomic
+  // checkAndInsert nonce contract as b.webhook.verifier / b.nonceStore — so the
+  // framework's own replay store drops in, and concurrent redeliveries can't
+  // race a non-atomic check-then-set.
+  var secret = "whsec_test_328";
+  var body = '{"id":"evt_328"}';
+  var header = b.webhook.sign({ alg: "hmac-sha256-stripe", secret: secret, body: body });
+  var seen = new Map();
+  var ns = { checkAndInsert: function (nonce, expireAt) { if (seen.has(nonce)) return false; seen.set(nonce, expireAt); return true; } };
+  var base = { alg: "hmac-sha256-stripe", secret: secret, body: body, header: header, nonceStore: ns };
+
+  var first = await b.webhook.verify(base);
+  check("Stripe verify: first delivery accepted", first && first.ok === true);
+
+  var threw = null;
+  try { await b.webhook.verify(base); } catch (e) { threw = e; }
+  check("Stripe verify: replay → webhook/replay", threw && threw.code === "webhook/replay");
+
+  // The framework's own b.nonceStore plugs in directly, no adapter.
+  var fwStore = b.nonceStore.create({ backend: "memory" });
+  var body2 = '{"id":"evt_328b"}';
+  var header2 = b.webhook.sign({ alg: "hmac-sha256-stripe", secret: secret, body: body2 });
+  var okFw = await b.webhook.verify({ alg: "hmac-sha256-stripe", secret: secret, body: body2, header: header2, nonceStore: fwStore });
+  check("Stripe verify: b.nonceStore drops in (no adapter)", okFw && okFw.ok === true);
+
+  // A legacy { has, set } store (no checkAndInsert) is refused at construction.
+  var threw2 = null;
+  try {
+    await b.webhook.verify({ alg: "hmac-sha256-stripe", secret: secret, body: body, header: header,
+      nonceStore: { has: function () {}, set: function () {} } });
+  } catch (e) { threw2 = e; }
+  check("Stripe verify: non-checkAndInsert store → bad-nonce-store",
+        threw2 && threw2.code === "webhook/bad-nonce-store");
+}
+
+async function testSignerSendRefusesSsrf() {
+  // signer.send refuses a private / cloud-metadata destination (SSRF) up front,
+  // before the retry loop and any network — webhook-layer gate + the transport's.
+  var s = b.webhook.signer({ algo: "hmac-sha3-512", keys: { v1: "secret" } });
+  var threw = null;
+  try { await s.send({ url: "https://169.254.169.254/hook", body: "{}", kid: "v1" }); }
+  catch (e) { threw = e; }
+  check("signer.send refuses cloud-metadata IP (SSRF)",
+        threw && (threw.code === "SSRF_REFUSED" ||
+                  /ssrf|metadata|blocked|internal|private/i.test((threw.code || "") + " " + (threw.message || ""))));
+}
+
 // ---- Middleware ----
 
 async function testMiddlewareSuccess() {
@@ -704,6 +752,8 @@ async function run() {
   await testHeaderCaseInsensitive();
   await testNonceStoreReplay();
   await testNonceStoreErrorPropagates();
+  await testStripeVerifyReplayAtomic();
+  await testSignerSendRefusesSsrf();
   await testMiddlewareSuccess();
   await testMiddlewareMissingRawBody();
   await testMiddlewareBadSignature();

package/lib/vendor/blamejs/test/layer-0-primitives/ws-client.test.js

@@ -342,6 +342,28 @@ async function run() {
   await _sleep(150);
   check("wsClient: custom handshakeGuid accepted at config time", true);
 
+  // ---- urlFor swap is SSRF re-validated (awaited) before connect ----
+  // checkUrl is async; the dial used to call it synchronously and discard the
+  // Promise, so a urlFor that pointed at a private / cloud-metadata address was
+  // connected anyway (the rejection surfaced only as an unhandled rejection).
+  // A swap to the metadata IP must now be refused with an SSRF error, and the
+  // dial must NOT reach the metadata host.
+  var sawUnhandled = null;
+  function _onUnhandled(e) { sawUnhandled = e; }
+  process.on("unhandledRejection", _onUnhandled);
+  var ssrfErr = null;
+  var cSwap = b.wsClient.connect("ws://127.0.0.1:1", {
+    urlFor: function () { return "ws://169.254.169.254:1/"; },   // cloud-metadata — hard-deny
+    reconnect: false, audit: false, allowInternal: true,        // allowInternal must NOT bypass metadata
+  });
+  cSwap.on("error", function (e) { if (!ssrfErr) ssrfErr = e; });
+  await helpers.waitUntil(function () { return ssrfErr !== null; },
+    { timeoutMs: 5000, label: "ws-client: urlFor-swap SSRF refusal emitted" });
+  check("urlFor swap to metadata IP refused with SSRF error",
+    ssrfErr && /metadata|ssrf|blocked|private|internal/i.test((ssrfErr.code || "") + " " + (ssrfErr.message || "")));
+  check("urlFor swap did not surface an unhandled rejection", sawUnhandled === null);
+  process.removeListener("unhandledRejection", _onUnhandled);
+
   console.log("OK — ws-client tests");
 }
 

package/lib/vendor/blamejs/test/layer-0-primitives/x509-chain-ca-enforcement.test.js

@@ -0,0 +1,149 @@
+"use strict";
+/**
+ * X.509 basicConstraints cA enforcement across the framework's cert-chain
+ * walkers (b.tsa.verifyToken, b.mail.bimi, b.mail.crypto.smime.verify).
+ *
+ * node:crypto X509Certificate.checkIssued() does NOT enforce basicConstraints
+ * cA:TRUE, so a leaf / end-entity cert (cA:FALSE) that omits keyUsage is
+ * wrongly accepted as a signing CA — the classic basicConstraints bypass
+ * (CVE-2002-0862 class). All three walkers route their issuer test through
+ * lib/x509-chain.js, which adds the cA check. This proves:
+ *   1. the shared primitive (isCaCert / issuerValidlyIssued) — the exact
+ *      logic every walker now depends on — rejects a non-CA issuer; and
+ *   2. an end-to-end consumer path (b.mail.bimi.fetchAndVerifyMark) refuses
+ *      a forged mark whose chain hangs off a cA:FALSE intermediate.
+ *
+ * The intermediate deliberately OMITS keyUsage: checkIssued already rejects
+ * keyUsage-without-keyCertSign, so a keyUsage-bearing intermediate would pass
+ * even on the buggy code — only the missing basicConstraints check is under
+ * test here.
+ */
+
+var helpers = require("../helpers");
+var b       = helpers.b;
+var check   = helpers.check;
+
+var nodeCrypto = require("crypto");
+var pki  = require("../../lib/vendor/pki.cjs");
+var x509 = pki.x509;
+var x509Chain = require("../../lib/x509-chain");
+
+var BIMI_EKU_OID = "1.3.6.1.5.5.7.3.31";
+
+// Mint root(CA:TRUE) -> intermediate(cA per opts) -> leaf, returning PEMs and
+// node X509Certificate objects. The intermediate omits keyUsage so the cA
+// check is the only thing that can reject it as an issuer.
+async function _mintChain(opts) {
+  opts = opts || {};
+  var interCa = opts.interCa === true;          // default cA:FALSE (the attack)
+  var leafSan = opts.leafSan || "victim.example";
+  var now = new Date();
+  var notAfter = new Date(now.getTime() + 365 * 24 * 60 * 60 * 1000);
+  var alg = { name: "ECDSA", namedCurve: "P-256" };
+  var sigAlg = { name: "ECDSA", hash: "SHA-256" };
+
+  var rootKeys  = await pki.crypto.subtle.generateKey(alg, true, ["sign", "verify"]);
+  var interKeys = await pki.crypto.subtle.generateKey(alg, true, ["sign", "verify"]);
+  var leafKeys  = await pki.crypto.subtle.generateKey(alg, true, ["sign", "verify"]);
+
+  var root = await x509.X509CertificateGenerator.createSelfSigned({
+    serialNumber: "01", name: "CN=Test Root CA", notBefore: now, notAfter: notAfter,
+    signingAlgorithm: sigAlg, keys: rootKeys,
+    extensions: [
+      new x509.BasicConstraintsExtension(true, 2, true),
+      new x509.KeyUsagesExtension(x509.KeyUsageFlags.keyCertSign | x509.KeyUsageFlags.cRLSign, true),
+    ],
+  });
+
+  // The intermediate: cA per opts, and NO keyUsage extension at all.
+  var inter = await x509.X509CertificateGenerator.create({
+    serialNumber: "02", issuer: root.subject, subject: "CN=Test Intermediate",
+    notBefore: now, notAfter: notAfter, signingAlgorithm: sigAlg,
+    publicKey: interKeys.publicKey, signingKey: rootKeys.privateKey,
+    extensions: [ new x509.BasicConstraintsExtension(interCa, interCa ? 0 : undefined, true) ],
+  });
+
+  var leaf = await x509.X509CertificateGenerator.create({
+    serialNumber: "03", issuer: inter.subject, subject: "CN=" + leafSan,
+    notBefore: now, notAfter: notAfter, signingAlgorithm: sigAlg,
+    publicKey: leafKeys.publicKey, signingKey: interKeys.privateKey,
+    extensions: [
+      new x509.BasicConstraintsExtension(false, undefined, true),
+      new x509.KeyUsagesExtension(x509.KeyUsageFlags.digitalSignature, true),
+      new x509.SubjectAlternativeNameExtension([{ type: "dns", value: leafSan }]),
+      new x509.ExtendedKeyUsageExtension([BIMI_EKU_OID], false),
+    ],
+  });
+
+  return {
+    rootPem:  root.toString("pem"),
+    interPem: inter.toString("pem"),
+    leafPem:  leaf.toString("pem"),
+    root:  new nodeCrypto.X509Certificate(root.toString("pem")),
+    inter: new nodeCrypto.X509Certificate(inter.toString("pem")),
+    leaf:  new nodeCrypto.X509Certificate(leaf.toString("pem")),
+  };
+}
+
+function _stubHttpClient(body) {
+  return {
+    request: function () {
+      return Promise.resolve({
+        statusCode: 200, headers: {},
+        body: Buffer.isBuffer(body) ? body : Buffer.from(String(body), "utf8"),
+      });
+    },
+  };
+}
+
+async function run() {
+  // ---- 1. Shared primitive: the cA enforcement every walker routes through.
+  var c = await _mintChain({ interCa: false });        // intermediate is cA:FALSE
+  check("isCaCert: root (cA:TRUE) is a CA", x509Chain.isCaCert(c.root) === true);
+  check("isCaCert: intermediate (cA:FALSE) is NOT a CA", x509Chain.isCaCert(c.inter) === false);
+  check("isCaCert: leaf (cA:FALSE) is NOT a CA", x509Chain.isCaCert(c.leaf) === false);
+  check("issuerValidlyIssued: root validly issued the intermediate",
+        x509Chain.issuerValidlyIssued(c.root, c.inter) === true);
+  // THE FIX: the intermediate genuinely issued + signed the leaf, but it is
+  // not a CA, so it must be refused as a chain issuer.
+  check("issuerValidlyIssued: cA:FALSE intermediate is REFUSED as the leaf's issuer",
+        x509Chain.issuerValidlyIssued(c.inter, c.leaf) === false);
+
+  // Control: when the intermediate IS a CA, the same call accepts it.
+  var ok = await _mintChain({ interCa: true });
+  check("issuerValidlyIssued: cA:TRUE intermediate is ACCEPTED as the leaf's issuer",
+        x509Chain.issuerValidlyIssued(ok.inter, ok.leaf) === true);
+
+  // ---- 2. Consumer path: b.mail.bimi.fetchAndVerifyMark must refuse a mark
+  // whose chain hangs off the cA:FALSE intermediate (leaf + intermediate
+  // served from the VMC URL, root as the trust anchor).
+  var threw = null;
+  try {
+    await b.mail.bimi.fetchAndVerifyMark({
+      domain:          "victim.example",
+      vmcUrl:          "https://victim.example/cert.pem",
+      trustAnchorsPem: c.rootPem,
+      httpClient:      _stubHttpClient(c.leafPem + "\n" + c.interPem),
+    });
+  } catch (e) { threw = e; }
+  check("bimi.fetchAndVerifyMark: forged mark via cA:FALSE intermediate is REJECTED",
+        threw && threw.code === "bimi/vmc-chain-invalid");
+
+  // Control: the same wiring with a cA:TRUE intermediate verifies.
+  var rv = await b.mail.bimi.fetchAndVerifyMark({
+    domain:          "victim.example",
+    vmcUrl:          "https://victim.example/cert.pem",
+    trustAnchorsPem: ok.rootPem,
+    httpClient:      _stubHttpClient(ok.leafPem + "\n" + ok.interPem),
+  });
+  check("bimi.fetchAndVerifyMark: valid CA chain still verifies", rv.ok === true);
+
+  console.log("OK — x509 cA enforcement (" + helpers.getChecks() + " checks)");
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  run().then(function () { process.exit(0); })
+       .catch(function (err) { process.exitCode = 1; throw err; });
+}

package/lib/vendor/blamejs/test/layer-5-integration/external-db-residency.test.js

@@ -520,6 +520,40 @@ async function run() {
   check("omitted-tag read → us-replica wire NOT reached (gate fail-closed)",
         usReplicaOmit.seen.every(function (s) { return !/SELECT id FROM orders/.test(s); }));
 
+  // ---- read-replica gate must NOT over-reject an UNRESTRICTED replica ----
+  // A replica with no residencyTag defaults to "unrestricted" (no residency
+  // constraint — it may serve any region's rows). Under a cross-border-regulated
+  // posture a read to it WITHOUT opts.rowResidencyTag must still pass: there is
+  // no constraint to enforce. (Was: the fail-closed tag-required gate fired on
+  // any truthy replica.residencyTag, and "unrestricted" is truthy → it refused
+  // every regulated read to an untagged replica that omitted rowResidencyTag.)
+  b.externalDb._resetForTest();
+  var roPrimaryFree = _trackingDriver("ro-primary-free");
+  var freeReplica   = _trackingDriver("free-replica");
+  b.externalDb.init({
+    backends: {
+      main: {
+        connect: roPrimaryFree.connect, query: roPrimaryFree.query,
+        close: roPrimaryFree.close,   // primary unrestricted
+        replicas: [
+          {
+            connect: freeReplica.connect, query: freeReplica.query,
+            close: freeReplica.close,   // no residencyTag → "unrestricted"
+            allowCrossBorder: false,
+          },
+        ],
+        replicaFallbackToPrimary: false,
+      },
+    },
+  });
+  await _underGdpr(async function () {
+    var res = await b.externalDb.read.query("SELECT id FROM orders WHERE id = $1", ["o-1"]);
+    check("gdpr + unrestricted replica + omitted tag → passes (no over-reject)",
+          res && res.rowCount === 1);
+  });
+  check("unrestricted-replica untagged read → replica wire reached",
+        _saw(freeReplica, /SELECT id FROM orders/));
+
   // ---- write verbs that wear a harmless leading keyword must still be
   // gated: WITH (CTE) / COPY FROM / EXPLAIN ANALYZE / CALL / EXECUTE /
   // REPLACE / DO all PLACE rows, so under gdpr + eu backend they require

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/blamejs-shop",
-  "version": "0.4.69",
+  "version": "0.4.70",
   "description": "Open-source framework built on blamejs. Vendored stack, zero npm runtime deps, PQC-first crypto, security-on by default.",
   "main": "lib/index.js",
   "scripts": {