@blamejs/blamejs-shop 0.4.74 → 0.4.76

package/lib/vendor/blamejs/test/layer-0-primitives/middleware-compose-pipeline.test.js

@@ -253,6 +253,77 @@ async function testFinalNextFallbackOnUnhandledError() {
     capturedErr === sentinel);
 }
 
+async function testHaltingMiddlewareSettlesPromise() {
+  // A regular (3-arg) middleware that writes the response and returns
+  // WITHOUT calling next() halts the chain — the documented "this
+  // middleware handled the request" pattern (auth/rate-limit/bot block).
+  // The composed promise MUST still settle; a permanently-pending
+  // promise retains its req/res closure forever (memory leak under
+  // sustained blocked traffic). finalNext must NOT fire — the chain was
+  // halted, so the caller's next-flag stays false and the router does
+  // not proceed to the route handler.
+  var finalCalled = false;
+  var pipe = b.middleware.composePipeline([
+    { name: "pass", mw: _passMw("a") },
+    { name: "halt", mw: function (req, res, next) { res.writableEnded = true; /* ended response, no next() */ } },
+    { name: "after", mw: _passMw("z") },
+  ]);
+  var req = {}; var res = {};
+  var settled = false;
+  pipe(req, res, function () { finalCalled = true; }).then(function () { settled = true; });
+  try {
+    await helpers.waitUntil(function () { return settled; },
+      { timeoutMs: 2000, label: "compose-pipeline: halting middleware settles the composed promise" });
+  } catch (_e) { /* stays false on the buggy tree → check fails RED */ }
+  check("halting middleware settles the composed promise", settled === true);
+  check("downstream middleware not run after a halt",
+    !req._tags || req._tags.indexOf("z") === -1);
+  check("finalNext NOT called when a middleware halts the chain", finalCalled === false);
+}
+
+async function testHandledErrorSettlesWithoutFinalNext() {
+  // An error handler that consumes the error WITHOUT calling next has
+  // handled the request (same halt contract as a 3-arg middleware): the
+  // promise settles but finalNext must not fire, so the caller does not
+  // proceed to the route handler on top of an already-sent error page.
+  var finalCalled = false;
+  var sentinel = new Error("boom");
+  var pipe = b.middleware.composePipeline([
+    { name: "failing",      mw: _bailMw(sentinel),                                                            position: 10 },
+    { name: "errorHandler", mw: function (err, req, res, _next) { res._handled = err; res.writableEnded = true; }, position: 20 },
+  ]);
+  var req = {}; var res = {};
+  var settled = false;
+  pipe(req, res, function () { finalCalled = true; }).then(function () { settled = true; });
+  try {
+    await helpers.waitUntil(function () { return settled; },
+      { timeoutMs: 2000, label: "compose-pipeline: handled error settles the composed promise" });
+  } catch (_e) { /* RED if it hangs */ }
+  check("handled error settles the composed promise", settled === true);
+  check("error handler consumed the error", res._handled === sentinel);
+  check("finalNext NOT called when an error handler halts the chain", finalCalled === false);
+}
+
+async function testDeferredNextContinuesChain() {
+  // A callback-style middleware that calls next() LATER (from a timer, stream,
+  // or legacy callback) returns before next() runs. The pipeline must NOT treat
+  // that bare return as a halt: the chain continues when the deferred next()
+  // fires, downstream middleware run, and finalNext is called.
+  var finalCalled = false;
+  var pipe = b.middleware.composePipeline([
+    { name: "a", mw: _passMw("a") },
+    { name: "deferred", mw: function (req, res, next) {
+      setTimeout(function () { req._tags.push("deferred"); next(); }, 5);
+    } },
+    { name: "c", mw: _passMw("c") },
+  ]);
+  var req = {}; var res = {};
+  await pipe(req, res, function (err) { finalCalled = !err; });
+  check("deferred next() continues the chain (callback-style middleware)",
+    req._tags && req._tags.join("") === "adeferredc");
+  check("finalNext called after a deferred next()", finalCalled === true);
+}
+
 async function run() {
   testSurface();
   testSequentialDispatch();
@@ -269,6 +340,9 @@ async function run() {
   await testAsyncMiddlewareAwaited();
   await testErrorMiddlewareReceivesError();
   await testFinalNextFallbackOnUnhandledError();
+  await testHaltingMiddlewareSettlesPromise();
+  await testHandledErrorSettlesWithoutFinalNext();
+  await testDeferredNextContinuesChain();
 }
 
 module.exports = { run: run };

package/lib/vendor/blamejs/test/layer-0-primitives/pipl-cn.test.js

@@ -95,6 +95,18 @@ function run() {
     midBand.mechanismRequired === "standard-contract" &&
     midBand.securityAssessmentRequired === false);
 
+  // Same band reached via the cumulativePI field: 100,001 prior + 50,000 this
+  // transfer = 150,001 effective (in the 100k–1M band) is still SCC — the
+  // documented boundary is 1,000,000, not 100,000.
+  var cumMid = b.pipl.sccFilingAssessment({
+    assessmentId: "xfer-3d", transferType: "processor", recipientJurisdiction: "US",
+    dataCategories: ["contact"], legalBasis: "standard-contract",
+    volume: 50000, sensitivePI: false, cumulativePI: 100001, recordedAt: recordedAt,
+  });
+  check("scc: 150,001 cumulative non-sensitive stays standard-contract (boundary is 1M)",
+    cumMid.mechanismRequired === "standard-contract" &&
+    cumMid.securityAssessmentRequired === false);
+
   // ---- THIS transfer's volume counts toward the cumulative sensitive
   //      threshold: a first transfer of 10,001 sensitive subjects forces it
   //      even with cumulativeSensitivePI omitted (defaults 0) ----

package/lib/vendor/blamejs/test/layer-0-primitives/request-helpers.test.js

@@ -133,6 +133,27 @@ function testParseListHeader() {
         JSON.stringify(rh.parseListHeader("\ta\t,\tb\n")) === '["a","b"]');
 }
 
+function testParseQualityListQuoteAware() {
+  var rh = b.requestHelpers;
+  // The q-value must come from the parameter literally named `q`, parsed
+  // quote-aware — never a `q=`-shaped substring inside a quoted parameter value,
+  // and a quoted value's ',' / ';' must not split the list.
+  var quoted = rh.parseQualityList('text/html;title="x;q=0.1";q=0.9');
+  check("parseQualityList: q= inside a quoted value is not the q-value",
+        quoted.length === 1 && quoted[0].value === "text/html" && quoted[0].q === 0.9);
+  var commaInQuote = rh.parseQualityList('a/b;p="x,y";q=0.3');
+  check("parseQualityList: comma inside a quoted value does not split the list",
+        commaInQuote.length === 1 && commaInQuote[0].value === "a/b" && commaInQuote[0].q === 0.3);
+  var leveled = rh.parseQualityList("text/html;level=1;q=0.5");
+  check("parseQualityList: a media-type param before q is ignored",
+        leveled.length === 1 && leveled[0].q === 0.5);
+  var ranked = rh.parseQualityList("br;q=1.0, gzip;q=0.5, *;q=0");
+  check("parseQualityList: ranks by descending q",
+        ranked[0].value === "br" && ranked[1].value === "gzip" && ranked[2].q === 0);
+  check("parseQualityList: missing q defaults to 1",
+        rh.parseQualityList("en")[0].q === 1);
+}
+
 function testSafeHeadersDistinct() {
   check("safeHeadersDistinct is fn", typeof b.requestHelpers.safeHeadersDistinct === "function");
 
@@ -416,9 +437,33 @@ function testTrustedClientIpValidates() {
   check("trustedClientIp rejects malformed CIDR", threwCidr === true);
 }
 
+function testIpPrefixMasking() {
+  var ip = b.requestHelpers.ipPrefix;
+  check("ipPrefix is a function", typeof ip === "function");
+  // IPv4 → /24 (network address, low octet zeroed).
+  check("ipPrefix v4 masks to /24", ip("203.0.113.47") === "203.0.113.0/24");
+  check("ipPrefix v4 same /24 → same bucket", ip("203.0.113.47") === ip("203.0.113.250"));
+  check("ipPrefix v4 cross-/24 → different bucket", ip("203.0.113.1") !== ip("198.51.100.1"));
+  // IPv6 → /64 (low 64 bits zeroed), deterministic uncompressed emit.
+  check("ipPrefix v6 masks to /64", ip("2001:db8:1234:5678::1") === "2001:db8:1234:5678:0:0:0:0/64");
+  check("ipPrefix v6 same /64 → same bucket",
+    ip("2001:db8:1234:5678::1") === ip("2001:db8:1234:5678:abcd:ef01:2345:6789"));
+  check("ipPrefix v6 cross-/64 → different bucket",
+    ip("2001:db8:1234:5678::1") !== ip("2001:db8:1234:9999::1"));
+  // IPv4-mapped IPv6 folds to the v4 /24 bucket.
+  check("ipPrefix folds ::ffff: mapped v4 to the v4 bucket",
+    ip("::ffff:203.0.113.5") === ip("203.0.113.99"));
+  // Garbage / non-string → "" (never throws).
+  check("ipPrefix returns '' for a non-string", ip(null) === "" && ip(12345) === "");
+  check("ipPrefix returns '' for an empty string", ip("") === "");
+  check("ipPrefix returns '' for an unparseable address", ip("not-an-ip") === "");
+  check("ipPrefix rejects an out-of-range v4 octet", ip("999.0.0.1") === "");
+}
+
 async function run() {
   testSurface();
   testSafeHeadersDistinct();
+  testIpPrefixMasking();
   testClientIpDefaultIgnoresXff();
   testClientIpPeerGatedTrustedPeer();
   testClientIpPeerGatedUntrustedPeerIgnoresXff();
@@ -439,6 +484,7 @@ async function run() {
   await testCaptureStatusOnEndThrowDoesntBreakResponse();
   testCaptureStatusValidatesArgs();
   testParseListHeader();
+  testParseQualityListQuoteAware();
   testExtractBearerSurface();
   testExtractBearerHappyPath();
   testExtractBearerCaseInsensitiveScheme();

package/lib/vendor/blamejs/test/layer-0-primitives/saml-subjectconfirmation-notonorafter.test.js

@@ -164,6 +164,21 @@ function _hokScd(notOnOrAfterAttr, holderCertPem) {
     "</saml:SubjectConfirmationData>";
 }
 
+// Same shape, Recipient attribute OMITTED — the Web SSO profile (§4.1.4.2)
+// makes Recipient mandatory for a Bearer/HoK confirmation delivered to an ACS.
+function _bearerScdNoRecipient(notOnOrAfterAttr, inResponseTo) {
+  return "<saml:SubjectConfirmationData" + notOnOrAfterAttr +
+    " InResponseTo=\"" + inResponseTo + "\"/>";
+}
+
+function _hokScdNoRecipient(notOnOrAfterAttr, holderCertPem) {
+  return "<saml:SubjectConfirmationData" + notOnOrAfterAttr + ">" +
+    "<ds:KeyInfo xmlns:ds=\"" + DS + "\"><ds:X509Data><ds:X509Certificate>" +
+    _certBodyB64(holderCertPem) +
+    "</ds:X509Certificate></ds:X509Data></ds:KeyInfo>" +
+    "</saml:SubjectConfirmationData>";
+}
+
 function _newSp(idp) {
   return b.auth.saml.sp.create({
     entityId:                    SP_ENTITY_ID,
@@ -274,6 +289,41 @@ async function testHolderOfKeyNotOnOrAfterRefused() {
     _verifyThrows(sp, b64bad, vopts) === "auth-saml/no-valid-confirmation");
 }
 
+// SAML 2.0 Profiles §4.1.4.2 — a Bearer SubjectConfirmationData delivered to
+// an ACS MUST carry a Recipient equal to the SP's ACS URL. An assertion whose
+// Bearer confirmation omits Recipient must be refused; accepting it lets an
+// assertion relayed to an unintended endpoint pass the recipient-binding axis.
+async function testBearerMissingRecipientRefused() {
+  var idp = await _mintRsaCert("idp.example");
+  var sp  = _newSp(idp);
+  var inResponseTo = "_req-no-recip";
+  var b64 = _buildSignedResponse(idp, {
+    tag:    "bearer-no-recip",
+    method: "urn:oasis:names:tc:SAML:2.0:cm:bearer",
+    nameId: "alice@example.com",
+    scd:    _bearerScdNoRecipient(" NotOnOrAfter=\"" + _isoFromNow(5 * 60 * 1000) + "\"", inResponseTo),   // allow:raw-time-literal — 5m future
+  });
+  check("Bearer with no Recipient is refused (§4.1.4.2 mandatory)",
+    _verifyThrows(sp, b64, { expectedInResponseTo: inResponseTo }) === "auth-saml/no-valid-confirmation");
+}
+
+// The Holder-of-Key sibling incorporates the same Web SSO Recipient requirement
+// (Profile §3.1 by reference). An HoK confirmation delivered to an ACS with no
+// Recipient must be refused too.
+async function testHolderOfKeyMissingRecipientRefused() {
+  var idp    = await _mintRsaCert("idp.example");
+  var holder = await _mintRsaCert("holder.example");
+  var sp     = _newSp(idp);
+  var b64 = _buildSignedResponse(idp, {
+    tag:    "hok-no-recip",
+    method: "urn:oasis:names:tc:SAML:2.0:cm:holder-of-key",
+    nameId: "bob@example.com",
+    scd:    _hokScdNoRecipient(" NotOnOrAfter=\"" + _isoFromNow(5 * 60 * 1000) + "\"", holder.certPem),    // allow:raw-time-literal — 5m future
+  });
+  check("HoK with no Recipient is refused (§3.1 incorporates §4.1.4.2)",
+    _verifyThrows(sp, b64, { holderOfKey: { presentedCertPem: holder.certPem } }) === "auth-saml/no-valid-confirmation");
+}
+
 // #B0 — a signed assertion with NO AudienceRestriction is not bound to THIS
 // SP. Accepting it is audience-confusion: an IdP-signed assertion minted for
 // another SP is replayed here. Must fail closed (default on).
@@ -314,12 +364,39 @@ async function testUnparseableConditionsTimestampRefused() {
     _verifyThrows(sp, b64, { expectedInResponseTo: inResponseTo }) === "auth-saml/conditions-bad-timestamp");
 }
 
+// SAML core §2.5.1.4 — multiple <AudienceRestriction> elements are AND-combined:
+// the SP must be a member of EVERY one. An assertion whose first restriction
+// lists this SP but whose second narrows to a DIFFERENT audience must be refused
+// (checking only the first let it through — audience-confusion).
+async function testSecondAudienceRestrictionEnforced() {
+  var idp = await _mintRsaCert("idp.example");
+  var sp  = _newSp(idp);
+  var inResponseTo = "_req-2aud";
+  var b64 = _buildSignedResponse(idp, {
+    tag:    "two-aud",
+    method: "urn:oasis:names:tc:SAML:2.0:cm:bearer",
+    nameId: "u@example.com",
+    scd:    _bearerScd(" NotOnOrAfter=\"" + _isoFromNow(5 * 60 * 1000) + "\"", inResponseTo),    // allow:raw-time-literal — 5m future
+    conditions: "<saml:Conditions NotBefore=\"" + _isoFromNow(-5 * 60 * 1000) +                  // allow:raw-time-literal — 5m skew
+      "\" NotOnOrAfter=\"" + _isoFromNow(5 * 60 * 1000) + "\">" +                                 // allow:raw-time-literal — 5m future
+      "<saml:AudienceRestriction><saml:Audience>" + SP_ENTITY_ID +
+      "</saml:Audience></saml:AudienceRestriction>" +
+      "<saml:AudienceRestriction><saml:Audience>https://other-sp.example/different" +
+      "</saml:Audience></saml:AudienceRestriction></saml:Conditions>",
+  });
+  check("second AudienceRestriction (different audience) refused (AND-combined)",
+    _verifyThrows(sp, b64, { expectedInResponseTo: inResponseTo }) === "auth-saml/wrong-audience");
+}
+
 async function run() {
   await testBearerValidNotOnOrAfterAccepted();
   await testBearerMissingNotOnOrAfterRefused();
   await testBearerUnparseableNotOnOrAfterRefused();
   await testHolderOfKeyNotOnOrAfterRefused();
+  await testBearerMissingRecipientRefused();
+  await testHolderOfKeyMissingRecipientRefused();
   await testMissingAudienceRestrictionRefused();
+  await testSecondAudienceRestrictionEnforced();
   await testUnparseableConditionsTimestampRefused();
 }
 

package/lib/vendor/blamejs/test/layer-0-primitives/session-extensions.test.js

@@ -152,6 +152,79 @@ async function testClientIpPrefixV4MappedV6() {
   }
 }
 
+// A request whose immediate peer is a reverse proxy: the socket peer is the
+// proxy, the real client arrives in X-Forwarded-For.
+function _makeProxiedReq(proxyAddr, clientIp) {
+  return {
+    headers: { "x-forwarded-for": clientIp, "user-agent": "ua1" },
+    socket:  { remoteAddress: proxyAddr },
+  };
+}
+
+async function testFingerprintPeerGatedClientIp() {
+  // Behind a trusted proxy the client IP arrives in X-Forwarded-For while the
+  // socket peer is the proxy. The bare-socket default binds the fingerprint to
+  // the PROXY, so two different real clients behind the same proxy share a
+  // fingerprint — the IP component is silently defeated. The { trustedProxies }
+  // option peer-gates the resolve (consistent with trustedClientIp) so the real
+  // client is bound. Both halves are proven here: the default still binds the
+  // proxy (a different real client does NOT drift), and the opt makes a
+  // different real client DRIFT.
+  var tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "ses-peergate-"));
+  try {
+    await setupTestDb(tmpDir);
+    var PROXY = "10.0.0.7";
+    var TP = ["10.0.0.0/8"];
+
+    // --- Legacy default (no trustedProxies): binds to the proxy address, so a
+    // different real client behind the same proxy does NOT drift.
+    var sLegacy = await b.session.create({
+      userId: "u-legacy", req: _makeProxiedReq(PROXY, "203.0.113.10"),
+      fingerprintFields: ["clientIp"],
+    });
+    var legacy = await b.session.verify(sLegacy.token, {
+      req: _makeProxiedReq(PROXY, "198.51.100.9"), fingerprintFields: ["clientIp"],
+    });
+    check("bare-socket default: different real client behind proxy does NOT drift (proxy-bound)",
+      legacy && legacy.fingerprintDrift === false);
+
+    // --- Peer-gated (trustedProxies): resolves the real client from XFF.
+    var sGated = await b.session.create({
+      userId: "u-gated", req: _makeProxiedReq(PROXY, "203.0.113.10"),
+      fingerprintFields: ["clientIp"], trustedProxies: TP,
+    });
+    var sameClient = await b.session.verify(sGated.token, {
+      req: _makeProxiedReq(PROXY, "203.0.113.10"),
+      fingerprintFields: ["clientIp"], trustedProxies: TP,
+    });
+    check("peer-gated: same real client behind proxy does not drift",
+      sameClient && sameClient.fingerprintDrift === false);
+    var diffClient = await b.session.verify(sGated.token, {
+      req: _makeProxiedReq(PROXY, "198.51.100.9"),
+      fingerprintFields: ["clientIp"], trustedProxies: TP,
+    });
+    check("peer-gated: different real client behind proxy DRIFTS (real client bound)",
+      diffClient && diffClient.fingerprintDrift === true);
+
+    // A forged XFF from a NON-trusted peer must be ignored (peer-gating) — the
+    // resolve falls back to the untrusted socket address, so a forged header
+    // can't make the real-client binding drift on its own.
+    var sDirect = await b.session.create({
+      userId: "u-direct", req: _makeProxiedReq("203.0.113.50", "203.0.113.10"),
+      fingerprintFields: ["clientIp"], trustedProxies: TP,
+    });
+    var forged = await b.session.verify(sDirect.token, {
+      // same untrusted socket peer, attacker varies the forgeable XFF.
+      req: _makeProxiedReq("203.0.113.50", "8.8.8.8"),
+      fingerprintFields: ["clientIp"], trustedProxies: TP,
+    });
+    check("peer-gated: forged XFF from an untrusted peer is ignored (no drift on header alone)",
+      forged && forged.fingerprintDrift === false);
+  } finally {
+    await teardownTestDb(tmpDir);
+  }
+}
+
 async function testPluggableStore() {
   var tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "ses-store-"));
   try {
@@ -403,6 +476,7 @@ async function run() {
   await testClientIpPrefixV4();
   await testClientIpPrefixV6();
   await testClientIpPrefixV4MappedV6();
+  await testFingerprintPeerGatedClientIp();
   await testPluggableStore();
   await testDestroyAllForUserPluggableNoDb();
   await testPluggableStoreValidation();

package/lib/vendor/blamejs/test/layer-0-primitives/sql.test.js

@@ -128,6 +128,25 @@ async function run() {
   check("LIKE escapes wildcards with ~", likeq.sql.indexOf("ESCAPE '~'") !== -1 &&
         likeq.params[0].indexOf("~%") !== -1 && likeq.params[0].indexOf("~_") !== -1);
 
+  // ---- NULL-equality footgun: `col = NULL` is UNKNOWN in SQL ----
+  rejects("where(col, '=', null) refused (use whereNull)", function () {
+    return sql.select("t").where("c", "=", null).toSql();
+  }, "sql-builder/null-equality");
+  rejects("where({ col: null }) refused (object form is = null)", function () {
+    return sql.select("t").where({ c: null }).toSql();
+  }, "sql-builder/null-equality");
+  var isNullq = sql.select("t").whereNull("c").toSql();
+  check("whereNull emits IS NULL with no bound param",
+        isNullq.sql.indexOf('"c" IS NULL') !== -1 && isNullq.params.length === 0);
+
+  // ---- whereInArray: per-element validation parity across dialects ----
+  rejects("whereInArray undefined element refused (PG = ANY would bind it silently)", function () {
+    return sql.select("t", { dialect: "postgres" }).whereInArray("id", [1, undefined, 3]).toSql();
+  }, "sql-builder/bad-in-value");
+  var anyq = sql.select("t", { dialect: "postgres" }).whereInArray("id", [1, 2]).toSql();
+  check("whereInArray PG path binds the array as one = ANY(?) param",
+        anyq.sql.indexOf("= ANY(?)") !== -1 && anyq.params.length === 1);
+
   // ---- JSONB guard + jsonb_exists emission (inherited from db-query) ----
   var jc = sql.select("docs", { dialect: "postgres" }).where("meta", "@>", { a: 1 }).toSql();
   check("@> binds canonical JSON", jc.sql.indexOf('"meta" @> ?') !== -1 && jc.params[0] === '{"a":1}');

package/lib/vendor/blamejs/test/layer-0-primitives/ws-client.test.js

@@ -54,6 +54,19 @@ function _makeServer(opts) {
     socket.write(headerLines.join("\r\n"));
 
     var ws = b.websocket;
+    // Memory-exhaustion mode: stream a text frame + continuation frames with
+    // fin:false whose running total exceeds the client's maxMessageBytes, and
+    // never send FIN. A client that only checks the cap at FIN would buffer
+    // them without bound.
+    if (opts.floodFragments) {
+      var part = Buffer.alloc(opts.floodFragments.partBytes || 600, 0x61);
+      socket.write(ws.serializeFrame(0x01, part, { fin: false }));            // text start
+      var fcount = opts.floodFragments.count || 4;
+      for (var fk = 0; fk < fcount; fk += 1) {
+        socket.write(ws.serializeFrame(0x00, part, { fin: false }));          // continuation, never FIN
+      }
+      return;
+    }
     var fp = new ws.FrameParser({ maxFrameBytes: 1024 * 1024 });
     socket.on("data", function (chunk) {
       var frames = fp.push(chunk) || [];
@@ -248,6 +261,25 @@ async function run() {
   await _sleep(50);
   server7.close();
 
+  // ---- maxMessageBytes guard on RECEIVE across non-FIN fragments ----
+  // A peer that streams continuation frames and never sends FIN must not be
+  // able to grow the reassembly buffer past maxMessageBytes — the cap is
+  // enforced on the running fragment total, not only at FIN (CWE-770).
+  var serverFlood = await _makeServer({ floodFragments: { partBytes: 600, count: 4 } });
+  var portFlood = serverFlood.address().port;
+  var cFlood = b.wsClient.connect("ws://127.0.0.1:" + portFlood, {
+    maxMessageBytes: 1024,            // 600 + 600 = 1200 > 1024 before any FIN
+    reconnect: false, audit: false, allowInternal: true,
+  });
+  var floodErr = null;
+  cFlood.on("error", function (e) { floodErr = e; });
+  await _sleep(400);
+  check("receive: running fragment total over maxMessageBytes errors before FIN",
+    floodErr !== null && /maxMessageBytes/.test(floodErr.message || ""));
+  try { cFlood.close(); } catch (_e) { /* already torn down */ }
+  await _sleep(50);
+  serverFlood.close();
+
   // ---- url + readyState getters ----
   var server8 = await _makeServer({});
   var port8 = server8.address().port;

package/lib/vendor/blamejs/test/layer-0-primitives/x509-chain-ca-enforcement.test.js

@@ -97,6 +97,17 @@ function _stubHttpClient(body) {
 }
 
 async function run() {
+  // ---- 0. Public surface: the CA-bit issuer test is reachable on `b` so a
+  // consumer validating a chain outside a TLS handshake uses the hardened,
+  // fail-closed test instead of raw X509Certificate.checkIssued().
+  check("b.x509Chain is exposed on the public surface", b.x509Chain && typeof b.x509Chain === "object");
+  check("b.x509Chain.isCaCert is the internal helper", b.x509Chain.isCaCert === x509Chain.isCaCert);
+  check("b.x509Chain.issuerValidlyIssued is the internal helper",
+        b.x509Chain.issuerValidlyIssued === x509Chain.issuerValidlyIssued);
+  check("b.x509Chain.isCaCert fails closed on a missing cert", b.x509Chain.isCaCert(null) === false);
+  check("b.x509Chain.issuerValidlyIssued fails closed on garbage input",
+        b.x509Chain.issuerValidlyIssued(null, null) === false);
+
   // ---- 1. Shared primitive: the cA enforcement every walker routes through.
   var c = await _mintChain({ interCa: false });        // intermediate is cA:FALSE
   check("isCaCert: root (cA:TRUE) is a CA", x509Chain.isCaCert(c.root) === true);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/blamejs-shop",
-  "version": "0.4.74",
+  "version": "0.4.76",
   "description": "Open-source framework built on blamejs. Vendored stack, zero npm runtime deps, PQC-first crypto, security-on by default.",
   "main": "lib/index.js",
   "scripts": {