@blamejs/blamejs-shop 0.4.85 → 0.4.86

package/lib/vendor/blamejs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.15.15",
+  "version": "0.15.16",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/lib/vendor/blamejs/release-notes/v0.15.16.json

@@ -0,0 +1,94 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.15.16",
+  "date": "2026-06-22",
+  "headline": "A correctness and hardening release: a broad set of credential and certificate verifiers now fail closed on a present-but-unparseable timestamp instead of silently skipping the check, outbound network clients gain an overall wall-clock timeout and a bounded framing buffer, DMARC refuses a record with no usable policy, append-only log sinks refuse a symlinked path, and the interactive-transaction and replay-store contracts refuse a backend that cannot honor them",
+  "summary": "This release closes a family of fail-open and resource-exhaustion gaps without adding opt-ins to the request path. A recurring pattern across the verifiers — a timestamp parsed with a lenient parser, then gated by isFinite() so an unparseable value disables the check — is converted to fail-closed everywhere it appears: DKIM x=/t=/l=, ARC AMS/AS t=/x=, SAML Bearer and holder-of-key NotBefore, and the FIDO MDS3 / BIMI / S/MIME certificate validity windows now refuse a malformed value rather than accepting the credential. DMARC now validates and requires a usable p= policy and never recommends delivery for a failing message with an absent or unrecognized policy. Outbound clients that exposed a single timeout but applied it only as an idle (zero-progress) timer now also enforce it as an overall wall-clock cap, so a peer that trickles bytes within the idle window can no longer hold a request open indefinitely: the encrypted HTTP client, the object-store and SQS request paths, the CloudWatch / OTLP / webhook log sinks, and the password breach check. The DNS resolver and the lower-level DNS client gain a per-query wall-clock deadline that also tears the socket down, the SMTP client and the proxy CONNECT tunnel bound their framing buffers and add an overall deadline, and the NTS key-establishment handshake bounds its accumulator. The append-only local log sink and the daemon log open with O_NOFOLLOW so a symlink planted at the path is refused rather than followed. b.externalDb.transaction and b.outbox now refuse a backend that declares it cannot provide an interactive transaction instead of silently running a non-atomic block, and the GraphQL-federation replay store adopts the framework's atomic check-and-insert contract.",
+  "sections": [
+    {
+      "heading": "Security",
+      "items": [
+        {
+          "title": "Certificate and credential verifiers fail closed on an unparseable timestamp",
+          "body": "A present-but-unparseable date no longer silently disables a validity check. DKIM x= / t= (signature expiry, future-date, ordering) and l= (body-length cap), ARC AMS/AS t= / x=, SAML Bearer and holder-of-key SubjectConfirmationData NotBefore, and the FIDO MDS3, BIMI, and S/MIME certificate validity windows previously parsed the value, then guarded the comparison with isFinite() — so a value that did not parse (NaN) skipped the check and the credential was accepted. Each now refuses a present-but-unparseable value (a permerror / not-valid result) and only an absent optional field is ignored, matching the existing fail-closed handling of the SAML Conditions block."
+        },
+        {
+          "title": "DMARC refuses a record with no usable policy",
+          "body": "The DMARC policy tag p= (and the subdomain sp=) were taken verbatim with no validation and p= was never required, so the disposition mapped a null or typo'd policy to the catch-all \"deliver\". A failing, unaligned message against a domain whose record omitted p= or carried an unrecognized value was therefore delivered. p= and sp= are now validated against none|quarantine|reject, p= is required for a record to carry a policy at all, an invalid record is a permerror (not a transient temperror), and the disposition is an explicit fail-closed mapping that never delivers a failing message on an absent or unrecognized policy."
+        },
+        {
+          "title": "Outbound clients enforce an overall wall-clock timeout, not only an idle timeout",
+          "body": "Several clients exposed a single timeout but forwarded it to the underlying request only as idleTimeoutMs (a zero-progress cap that resets on every received byte), leaving no overall bound — a peer that trickles one byte inside each idle window holds the call open indefinitely. b.httpClient.encrypted (which dropped timeoutMs entirely, and now also forwards the caller's AbortSignal), the object-store request path and Azure/GCS bucket operations, the SQS queue client, the CloudWatch / OTLP / webhook log sinks, and the password HIBP breach check now set the overall wall-clock timeout alongside the idle timeout."
+        },
+        {
+          "title": "DNS lookups gain a default wall-clock deadline and tear the socket down",
+          "body": "The DNS resolver's DoH transport had no time bound of any kind and the lower-level DNS client defaulted its lookup timeout to zero (no deadline). A non-responsive or slow-trickle upstream — reachable while resolving DKIM/SPF/BIMI records for inbound mail — held the lookup pending forever. The resolver now takes a per-query timeout (default 10s) wrapping every query and CNAME hop, the DNS client defaults its lookup timeout to 10s (operators opt out with a zero timeout), and the raw DoH/DoT request paths arm a socket timeout that destroys the connection on a stall rather than leaking the descriptor."
+        },
+        {
+          "title": "SMTP, proxy-CONNECT, and NTS clients bound their read buffers and add deadlines",
+          "body": "The SMTP client accumulated the server's reply without a byte cap and relied on an idle timer alone; a hostile or broken MX that never sent a line terminator could exhaust memory, and a slow trickle held the transaction open. It now caps the accumulated reply (refusing once it exceeds the response ceiling) and enforces an overall transaction deadline. The proxy CONNECT-tunnel client, which accumulated the proxy's reply unbounded with no socket timeout, now caps the header buffer and times out the connect. The NTS key-establishment handshake reader caps its record accumulator so a server streaming non-terminating records cannot exhaust memory before the handshake timer fires."
+        },
+        {
+          "title": "Append-only log sinks refuse a symlinked path",
+          "body": "The local log sink and the daemon log opened the active file in append mode without O_NOFOLLOW, so a symlink planted at the log path (including one re-planted in the race window after a caller's pre-check) was followed, redirecting log writes to an attacker-chosen file. Both now open with O_NOFOLLOW via the new b.atomicFile.openAppendNoFollowSync, refusing a symlinked final path component."
+        },
+        {
+          "title": "Transaction and replay-store contracts refuse a backend that cannot honor them",
+          "body": "b.externalDb.transaction and b.outbox.create now refuse a backend that declares it cannot provide an interactive transaction (a stateless / autocommit-per-statement adapter) instead of silently running BEGIN, the body, and COMMIT on different sessions — no isolation, no rollback — while reporting success. b.graphqlFederation.guardSdl now consults its replay nonce store through the framework's atomic checkAndInsert(nonce, expireAt) contract (the same one b.webhook and b.nonceStore use) rather than a non-atomic has()-then-remember() check that raced concurrent redeliveries; a store lacking checkAndInsert is refused at construction."
+        }
+      ]
+    },
+    {
+      "heading": "Fixed",
+      "items": [
+        {
+          "title": "b.session.destroyAllForUser works for pluggable-store consumers",
+          "body": "A consumer configuring sessions through b.session.useStore without calling b.db.init() got a db/not-initialized error from destroyAllForUser — every \"log out everywhere\" / suspend / delete path rejected with a 500 after the store rows had already been deleted, because the stateless valid-from boundary write was routed only to the framework database. The boundary now prefers the framework database when one is initialized and otherwise falls back to the configured session store (provisioning its table on demand), so store-backed deployments raise the stateless boundary successfully; it still fails closed when neither a framework database nor a store is available."
+        }
+      ]
+    },
+    {
+      "heading": "Added",
+      "items": [
+        {
+          "title": "b.atomicFile.openAppendNoFollowSync — symlink-refusing append open",
+          "body": "Opens a long-lived append target (an active log file kept open across appends and reopened on rotation) with O_WRONLY | O_APPEND | O_CREAT | O_NOFOLLOW: the file is created or appended normally, but a symlink at the final path component fails the open closed (ELOOP) rather than redirecting writes. The append-sink counterpart to openNoFollowSync (read) and the exclusive-create temp open."
+        },
+        {
+          "title": "b.externalDb.supportsTransactions() and stateless-adapter declaration",
+          "body": "A backend adapter may declare supportsTransactions: false (a stateless / autocommit-per-statement adapter) and/or provide a batch(client, statements) hook for an atomic multi-statement path. b.externalDb.supportsTransactions() reports whether the picked backend can provide an interactive transaction, so a consumer built on the dual-write guarantee can refuse a non-atomic backend up front."
+        },
+        {
+          "title": "Store-free device fingerprint",
+          "body": "b.sessionDeviceBinding.fingerprint(req, opts) is now a static entry point returning the request-shape digest with no store, and b.sessionDeviceBinding.create() with neither a bindingStore nor storeInSession returns an instance whose stateless fingerprint() works while bind()/verify() throw a clear \"no store configured\". Soft device binding for self-validating tokens (a sealed cookie or JWT carrying the fingerprint) no longer needs a fabricated no-op store."
+        }
+      ]
+    },
+    {
+      "heading": "Changed",
+      "items": [
+        {
+          "title": "Device fingerprint IP masking is canonical",
+          "body": "b.sessionDeviceBinding masked the client IP into its prefix bucket by textual group slicing with no IPv6 normalization, so equivalent forms of one address (a ::-compressed form vs its fully-expanded form) hashed to different fingerprints and a roaming client could be logged out on a false drift. It now masks through the same canonical prefix helper b.session uses, preserving the configured prefix width (the IPv6 default stays /48, and ipPrefixBits is honored). b.requestHelpers.ipPrefix accepts { v4Bits, v6Bits } to override the /24 + /64 default for a function-form fingerprint or other reuse."
+        }
+      ]
+    },
+    {
+      "heading": "Migration",
+      "items": [
+        {
+          "title": "DNS lookups now time out by default",
+          "body": "The lower-level DNS client's lookup timeout previously defaulted to zero (no deadline); it now defaults to 10 seconds. A deployment that intentionally ran DNS lookups with no wall-clock bound must set the lookup timeout to zero explicitly to restore the old behavior. The b.network.dns.resolver default timeout is also 10 seconds and is configurable via its timeoutMs option."
+        },
+        {
+          "title": "b.graphqlFederation.guardSdl nonceStore contract",
+          "body": "guardSdl's optional replay nonceStore now requires the atomic checkAndInsert(nonce, expireAt) contract (b.nonceStore.create is the reference store) and refuses the previous { has, remember } shape at construction. Operators using the old shape should pass b.nonceStore.create(...) or an adapter exposing checkAndInsert."
+        },
+        {
+          "title": "Interactive transactions on a stateless backend are refused",
+          "body": "If an externalDb backend adapter declares supportsTransactions: false, b.externalDb.transaction and b.outbox.create now throw rather than running a silently non-atomic block. Existing stateful adapters (Postgres / MySQL / SQLite, and any adapter that supplies beginTx/commit/rollback or omits the flag) are unaffected. A stateless / autocommit-per-statement adapter should supply interactive transaction hooks or a batch adapter."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/test/layer-0-primitives/api-encrypt.test.js

@@ -1508,6 +1508,7 @@ async function run() {
   await testApiEncryptDerivedPruneInterval();
   await testApiEncryptHttpClientHelperShape();
   await testApiEncryptHttpClientRoundTrip();
+  await testApiEncryptHttpClientWallClockTimeout();
   await testApiEncryptEncryptedErrorReadback();
 
   // v0.7.3 — per-session keying mode
@@ -1530,6 +1531,56 @@ async function run() {
   await testApiEncryptObservabilityCounters();
 }
 
+// #355 — b.httpClient.encrypted must forward timeoutMs (overall wall-clock cap),
+// not only idleTimeoutMs. A peer that trickles bytes within the idle window
+// (never tripping the idle timeout) but never completes the response would
+// otherwise hold the encrypted call open indefinitely. RED before the fix
+// (timeoutMs absent from the passable forwarding set): the request never settles
+// inside the wall-clock bound. GREEN after: it rejects at ~timeoutMs.
+async function testApiEncryptHttpClientWallClockTimeout() {
+  var http = require("http");
+  var keypair = _serverKeypair();
+  var timer = null;
+  var server = http.createServer(function (req, res) {
+    req.on("data", function () {});
+    req.on("end", function () {
+      res.writeHead(200, { "Content-Type": "application/json" });
+      // Trickle one byte every 50ms forever — socket never idle long enough to
+      // trip idleTimeoutMs, response never ends → only a wall-clock cap bounds it.
+      timer = setInterval(function () { try { res.write("x"); } catch (_e) { /* socket gone */ } }, 50);
+      res.on("close", function () { if (timer) { clearInterval(timer); timer = null; } });
+    });
+  });
+  var port = await helpers.listenOnRandomPort(server);
+  try {
+    var enc = b.httpClient.encrypted({
+      pubkey:  keypair,
+      baseUrl: "http://127.0.0.1:" + port,
+      method:  "POST",
+    });
+    var started = Date.now();
+    var rejected = false;
+    try {
+      await enc.request({
+        path:             "/slow",
+        body:             { user: "alice" },
+        timeoutMs:        400,                       // overall wall-clock cap
+        allowedProtocols: b.safeUrl.ALLOW_HTTP_ALL,
+        allowInternal:    true,
+      });
+    } catch (_e) {
+      rejected = true;
+    }
+    var elapsed = Date.now() - started;
+    check("httpClient.encrypted: slow-trickle request is bounded (rejects)", rejected === true);
+    check("httpClient.encrypted: bounded by the wall-clock cap (~timeoutMs, not idle)",
+          elapsed < 3000);
+  } finally {
+    if (timer) clearInterval(timer);
+    server.close();
+  }
+}
+
 module.exports = { run: run };
 
 if (require.main === module) {

package/lib/vendor/blamejs/test/layer-0-primitives/atomic-file-open-append-nofollow.test.js

@@ -0,0 +1,87 @@
+"use strict";
+// b.atomicFile.openAppendNoFollowSync — O_NOFOLLOW append open for long-lived
+// append sinks (active log file kept open across appends + reopened on
+// rotation). Creates the file if absent and appends if it is a regular file,
+// but refuses a symlink at the final path component (ELOOP) instead of
+// following it — so log writes cannot be redirected to an attacker-chosen
+// file (CWE-59). RED before 0.15.16: log-stream-local opened the active log
+// with a bare `openSync(path, "a")`, following a symlink planted at the path.
+
+var fs   = require("node:fs");
+var os   = require("node:os");
+var path = require("node:path");
+var helpers = require("../helpers");
+var b     = helpers.b;
+var check = helpers.check;
+var localProto = require("../../lib/log-stream-local");
+
+function run() {
+  check("b.atomicFile.openAppendNoFollowSync is a function",
+        typeof b.atomicFile.openAppendNoFollowSync === "function");
+
+  var dir = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-append-nofollow-"));
+  try {
+    // --- primitive: create-if-absent + append to a regular file ---
+    var p = path.join(dir, "active.log");
+    var fd = b.atomicFile.openAppendNoFollowSync(p, 0o600);
+    check("returns a numeric fd, creating the file if absent",
+          typeof fd === "number" && fd >= 0 && fs.existsSync(p));
+    fs.writeSync(fd, Buffer.from("line-1\n"));
+    fs.closeSync(fd);
+    var fd2 = b.atomicFile.openAppendNoFollowSync(p, 0o600);
+    fs.writeSync(fd2, Buffer.from("line-2\n"));
+    fs.closeSync(fd2);
+    check("appends rather than truncates an existing regular file",
+          fs.readFileSync(p, "utf8") === "line-1\nline-2\n");
+
+    // --- primitive: symlink at the final component is refused (POSIX) ---
+    if (process.platform !== "win32") {
+      var victim = path.join(dir, "victim.txt");
+      fs.writeFileSync(victim, "ORIGINAL");
+      var linkPath = path.join(dir, "evil.log");
+      var symlinkMade = false;
+      try { fs.symlinkSync(victim, linkPath); symlinkMade = true; } catch (_e) { /* no symlink priv */ }
+      if (symlinkMade) {
+        var loopCode = null;
+        try {
+          var bad = b.atomicFile.openAppendNoFollowSync(linkPath, 0o600);
+          fs.closeSync(bad);
+        } catch (e) { loopCode = e && e.code; }
+        check("symlink final component refused with ELOOP (not followed)", loopCode === "ELOOP");
+        check("the symlink target was never written through",
+              fs.readFileSync(victim, "utf8") === "ORIGINAL");
+      }
+
+      // --- consumer path (#356): log-stream-local refuses a symlinked active log ---
+      var logDir = path.join(dir, "logs");
+      fs.mkdirSync(logDir, { recursive: true });
+      var logVictim = path.join(dir, "log-victim.txt");
+      fs.writeFileSync(logVictim, "VICTIM-LOG");
+      var activePath = path.join(logDir, "blamejs.log");   // <prefix>.log
+      var planted = false;
+      try { fs.symlinkSync(logVictim, activePath); planted = true; } catch (_e) { /* no priv */ }
+      if (planted) {
+        var refusedCode = null;
+        var sink = null;
+        try { sink = localProto.create({ dir: logDir }); }
+        catch (e) { refusedCode = e && e.code; }
+        if (sink) { try { sink.close(); } catch (_c) { /* ignore */ } }
+        check("log-stream-local refuses to open a symlinked active log path",
+              refusedCode === "SYMLINK_REFUSED");
+        check("log-stream-local never writes through the symlink to the victim",
+              fs.readFileSync(logVictim, "utf8") === "VICTIM-LOG");
+      }
+    }
+  } finally {
+    try { fs.rmSync(dir, { recursive: true, force: true }); } catch (_e) { /* best-effort */ }
+  }
+  return Promise.resolve();
+}
+
+module.exports = { run: run };
+if (require.main === module) {
+  Promise.resolve(run()).then(
+    function () { console.log("OK — atomicFile.openAppendNoFollowSync + log-stream-local symlink refusal (" + helpers.getChecks() + " checks)"); process.exit(0); },
+    function (e) { console.error("FAIL: " + (e && e.message)); process.exit(1); }
+  );
+}

package/lib/vendor/blamejs/test/layer-0-primitives/codebase-patterns.test.js

@@ -8546,6 +8546,54 @@ var KNOWN_ANTIPATTERNS = [
     ],
     reason: "Symlink-follow / torn-write class (CWE-59 / CWE-377). A raw nodeFs.writeFileSync / nodeFs.createWriteStream to a destination path follows a symlink an attacker pre-planted there and can leave a half-written file on a crash. The §1 sweep routed every hand-rolled write through an atomic-file primitive: writeSync (buffer payloads — cookie-jar flush, archive/tar extract, backup payloads, p12 export, api-snapshot, sealed-pem marker), writeStream (object-store streaming put — staged into a no-follow exclusive temp + atomic rename, capped by maxBytes), and writeExclSync (the vault seal/unseal/rotate staged write that must re-read + verify the bytes before the rename — clears any stale entry then O_EXCL|O_NOFOLLOW creates so a re-planted symlink fails closed). The three allowlisted files are the genuinely-safe forms: atomic-file.js owns the primitives (its createWriteStream binds an _openExclTemp fd); backup/index.js writeFileSync passes { flag: 'wx' } (O_EXCL refuses a pre-planted target); http-client.js opens its download temp with explicit O_WRONLY|O_CREAT|O_EXCL|O_NOFOLLOW flags. Any new raw nodeFs.writeFileSync/createWriteStream elsewhere trips this — call the matching atomic-file primitive instead.",
   },
+  {
+    id: "raw-fs-append-open-without-nofollow",
+    primitive: "b.atomicFile.openAppendNoFollowSync — O_WRONLY|O_APPEND|O_CREAT|O_NOFOLLOW append open",
+    // The append-sink sibling of raw-fs-write-without-exclusive-nofollow. A
+    // long-lived append target (an active log file kept open across appends and
+    // reopened on rotation) can't use a one-shot atomic write, but a bare
+    // nodeFs.openSync(path, "a") / appendFileSync(path, ...) still FOLLOWS a
+    // symlink an attacker pre-planted at `path` (CWE-59) — redirecting the
+    // append stream to a victim file. openAppendNoFollowSync adds O_NOFOLLOW so
+    // the symlink is refused (ELOOP) atomically with the open, closing the
+    // caller-pre-check-then-unlink race. The primitive itself opens with a
+    // numeric flags variable (not the "a" string), so its own home does not
+    // match and needs no allowlist.
+    scanScope: "lib",
+    skipCommentLines: true,
+    regex: /\bnodeFs\.(?:openSync\s*\(\s*[^,]+,\s*"a"|appendFileSync\s*\(|appendFile\s*\()/,
+    allowlist: [],
+    reason: "Symlink-follow append class (CWE-59). A bare nodeFs.openSync(path, \"a\") or nodeFs.appendFileSync(path, ...) follows a symlink an attacker pre-planted at the append target and redirects the log/append stream to an attacker-chosen file; a caller's pre-check-then-unlink can't close the race because the sink's own open is what follows the link. The fix routes every long-lived append open through b.atomicFile.openAppendNoFollowSync (O_WRONLY|O_APPEND|O_CREAT|O_NOFOLLOW): the file is created/appended normally but a symlink at the final component fails the open closed with ELOOP. The v0.15.16 sweep converted log-stream-local.js (active log sink) and daemon.js (detached-process stdout/stderr log). Zero allowlist — the primitive opens with a numeric flags variable, so any new nodeFs.openSync(..., \"a\") / appendFileSync / appendFile in lib/ trips this; call b.atomicFile.openAppendNoFollowSync instead.",
+  },
+  {
+    id: "httpclient-request-idle-timeout-without-wall-clock",
+    primitive: "forward BOTH timeoutMs (overall wall-clock) and idleTimeoutMs to httpClient.request — never idle-only",
+    // #355 class. httpClient distinguishes timeoutMs (overall wall-clock cap)
+    // from idleTimeoutMs (zero-progress cap). A consumer that maps its single
+    // configured timeout to idleTimeoutMs ONLY has no overall bound: a peer
+    // trickling bytes within the idle window holds the request open forever
+    // (slow-loris). Every httpClient request object that sets idleTimeoutMs must
+    // also set timeoutMs on the line immediately before it. This detector flags
+    // an `idleTimeoutMs:` property (identifier/member value) whose preceding line
+    // is NOT a `timeoutMs:` line. The allowlist is the SERVER-side / pool idle
+    // timeouts — inbound connection inactivity disconnect (RFC 5321 §4.5.3.2.7
+    // for SMTP, IMAP/POP3/ManageSieve/submission/TLS) and the external-db
+    // connection pool — a structurally different concept (a long-lived server
+    // socket has no per-request wall-clock to cap), NOT an outbound httpClient
+    // request.
+    scanScope: "lib",
+    skipCommentLines: true,
+    regex: /\n[ \t]*(?!timeoutMs\b)[A-Za-z_$][\w$]*:[^\n]*\n[ \t]*idleTimeoutMs:[ \t]*[A-Za-z_$]/,
+    allowlist: [
+      "lib/mail-server-imap.js",        // inbound IMAP server socket idle disconnect
+      "lib/mail-server-managesieve.js", // inbound ManageSieve server socket idle disconnect
+      "lib/mail-server-mx.js",          // inbound SMTP/MX server socket idle (RFC 5321 §4.5.3.2.7)
+      "lib/mail-server-pop3.js",        // inbound POP3 server socket idle disconnect
+      "lib/mail-server-submission.js",  // inbound submission server socket idle disconnect
+      "lib/mail-server-tls.js",         // inbound TLS server socket idle (re-armed post-handshake)
+    ],
+    reason: "Slow-trickle hold-open class (#355, CWE-400). httpClient.request takes timeoutMs (overall wall-clock cap) AND idleTimeoutMs (zero-progress cap) as DISTINCT bounds. A consumer wrapping httpClient that forwards only idleTimeoutMs leaves the request unbounded in wall-clock time: a peer that emits one byte just under the idle window keeps resetting the idle timer forever, holding the call open indefinitely. The v0.15.16 sweep set timeoutMs alongside idleTimeoutMs in every httpClient consumer (api-encrypt httpClient, the object-store shared request wrapper + azure/gcs bucket-ops, queue-sqs, the cloudwatch/otlp/webhook log sinks, the HIBP password breach check). The detector requires timeoutMs on the line immediately before every idleTimeoutMs property; the only allowlisted files are inbound SERVER socket idle timeouts and the external-db pool idle — a long-lived server connection's inactivity disconnect, not an outbound request needing a per-request wall-clock cap. A new httpClient consumer forwarding idle-only trips this — set timeoutMs too.",
+  },
   {
     id: "allowlist-map-indexed-by-untrusted-key-without-hasown",
     primitive: "Object.prototype.hasOwnProperty.call(MAP, key) — proto-shadow-safe allowlist membership",

package/lib/vendor/blamejs/test/layer-0-primitives/external-db-non-atomic-backend.test.js

@@ -0,0 +1,200 @@
+"use strict";
+// #343: externalDb.transaction (and the b.outbox built on it) silently
+// non-atomic on a stateless / autocommit-per-statement adapter.
+//
+// transaction(fn) defaults its tx verbs to query(client,"BEGIN") /
+// query(client,"COMMIT") when the adapter supplies no beginTx/commit/
+// rollback. On a stateless adapter — connect() returns a sentinel and
+// every query() is an independent round-trip (e.g. an HTTP bridge to
+// Cloudflare D1) — BEGIN, the body statements, and COMMIT each land on a
+// DIFFERENT session: no isolation, no rollback. Yet the call resolves, so
+// the consumer believes the block was atomic. b.outbox is built entirely
+// on this (enqueue requires the txClient), so its dual-write guarantee is
+// void on such a backend.
+//
+// FIX: a backend declares supportsTransactions:false (the stateless
+// declaration). transaction() and outbox.create() then REFUSE LOUDLY with
+// a typed error (fail closed) instead of running BEGIN/COMMIT as separate
+// no-ops and resolving.
+//
+// RED on the buggy tree: transaction(fn) runs (BEGIN/COMMIT as independent
+// no-op round-trips) and RESOLVES; outbox.create() succeeds. GREEN after
+// the fix: both throw NON_ATOMIC_BACKEND / outbox/non-atomic-backend.
+
+var helpers = require("../helpers");
+var b     = helpers.b;
+var check = helpers.check;
+
+// A faithful STATELESS adapter: connect() returns a fresh sentinel each
+// call, every query() is an independent round-trip against a shared store,
+// and there is NO beginTx/commit/rollback hook. BEGIN/COMMIT/ROLLBACK are
+// accepted as harmless no-ops (exactly what an autocommit bridge does).
+function _makeStatelessAdapter() {
+  var store = {};
+  var connectCount = 0;
+  var sawBegin = false;
+  return {
+    sawBegin: function () { return sawBegin; },
+    connect: async function () { connectCount += 1; return { sentinel: connectCount }; },
+    query: async function (_client, sql, params) {
+      if (/^\s*(BEGIN|COMMIT|ROLLBACK)/i.test(sql)) { sawBegin = true; return { rows: [], rowCount: 0 }; }
+      if (/^INSERT INTO kv/i.test(sql)) { store[params[0]] = params[1]; return { rows: [], rowCount: 1 }; }
+      if (/^SELECT/i.test(sql)) {
+        var v = store[params && params[0]];
+        return v === undefined ? { rows: [], rowCount: 0 } : { rows: [{ value: v }], rowCount: 1 };
+      }
+      return { rows: [], rowCount: 0 };
+    },
+    close: async function () {},
+  };
+}
+
+async function run() {
+  // ---- transaction() refuses a stateless backend ----
+  b.externalDb._resetForTest();
+  var stateless = _makeStatelessAdapter();
+  b.externalDb.init({
+    backends: {
+      d1: {
+        dialect:              "sqlite",
+        connect:              stateless.connect,
+        query:                stateless.query,
+        close:                stateless.close,
+        supportsTransactions: false,   // stateless / autocommit-per-statement declaration
+      },
+    },
+  });
+
+  var threw = null;
+  var bodyRan = false;
+  try {
+    await b.externalDb.transaction(async function (tx) {
+      bodyRan = true;
+      await tx.query("INSERT INTO kv (id, value) VALUES ($1, $2)", ["k", "v"]);
+    });
+  } catch (e) { threw = e; }
+  check("#343 transaction() refuses a stateless backend (typed NON_ATOMIC_BACKEND)",
+        threw && /NON_ATOMIC_BACKEND/.test(threw.code || ""));
+  check("#343 transaction() refuses BEFORE running the body / any BEGIN",
+        bodyRan === false && stateless.sawBegin() === false);
+
+  // write.transaction routes through transaction() — must refuse too.
+  var threwWrite = null;
+  try {
+    await b.externalDb.write.transaction(async function (tx) { await tx.query("SELECT 1", []); });
+  } catch (e) { threwWrite = e; }
+  check("#343 write.transaction() also refuses a stateless backend",
+        threwWrite && /NON_ATOMIC_BACKEND/.test(threwWrite.code || ""));
+
+  // supportsTransactions probe reflects the declaration.
+  check("#343 supportsTransactions() probe returns false for the stateless backend",
+        b.externalDb.supportsTransactions() === false);
+
+  // ---- outbox.create() refuses a stateless backend ----
+  var outboxThrew = null;
+  try {
+    b.outbox.create({
+      externalDb: b.externalDb,
+      table:      "outbox_events",
+      publisher:  async function () {},
+      audit:      false,
+    });
+  } catch (e) { outboxThrew = e; }
+  check("#343 outbox.create() refuses a stateless backend (typed error)",
+        outboxThrew && /non-atomic-backend/.test(outboxThrew.code || ""));
+
+  // A custom externalDb object that declares supportsTransactions:false is
+  // refused identically (outbox accepts the namespace OR a faithful object).
+  var customOutboxThrew = null;
+  try {
+    b.outbox.create({
+      externalDb: {
+        dialect:              "sqlite",
+        query:                async function () { return { rows: [] }; },
+        transaction:          async function (fn) { return fn({ query: async function () { return { rows: [] }; } }); },
+        supportsTransactions: false,
+      },
+      table:     "outbox_events",
+      publisher: async function () {},
+      audit:     false,
+    });
+  } catch (e) { customOutboxThrew = e; }
+  check("#343 outbox.create() refuses a custom externalDb declaring supportsTransactions:false",
+        customOutboxThrew && /non-atomic-backend/.test(customOutboxThrew.code || ""));
+
+  // ---- no regression: a STATEFUL backend (the historical default) still works ----
+  b.externalDb._resetForTest();
+  var stateful = helpers._makeFakeDriver();
+  b.externalDb.init({
+    backends: { main: { connect: stateful.connect, query: stateful.query, close: stateful.close, ping: stateful.ping } },
+  });
+  var statefulOk = false;
+  var got = await b.externalDb.transaction(async function (tx) {
+    await tx.query("INSERT INTO kv (id, value) VALUES ($1, $2)", ["a", "1"]);
+    var r = await tx.query("SELECT id, value FROM kv WHERE id = $1", ["a"]);
+    statefulOk = r.rowCount === 1;
+    return r.rows[0];
+  });
+  check("#343 a stateful backend (no flag, no hooks) still runs transactions",
+        statefulOk && got && got.value === "1");
+  check("#343 supportsTransactions() probe returns true for a stateful backend",
+        b.externalDb.supportsTransactions() === true);
+  check("#343 outbox.create() succeeds on a stateful backend",
+        (function () {
+          try {
+            b.outbox.create({ externalDb: b.externalDb, table: "outbox_events",
+              publisher: async function () {}, audit: false });
+            return true;
+          } catch (_e) { return false; }
+        })());
+
+  // ---- an explicit supportsTransactions:true (stateful operator assertion) is permitted ----
+  b.externalDb._resetForTest();
+  var asserted = helpers._makeFakeDriver();
+  b.externalDb.init({
+    backends: {
+      mainAsserted: {
+        connect:              asserted.connect,
+        query:                asserted.query,
+        close:                asserted.close,
+        ping:                 asserted.ping,
+        supportsTransactions: true,   // operator asserts the default BEGIN/COMMIT runs on a stateful client
+      },
+    },
+  });
+  check("#343 supportsTransactions:true is honored (transaction not refused)",
+        b.externalDb.supportsTransactions() === true);
+
+  // ---- a stateless adapter declaring supportsTransactions:false is refused even WITH a batch hook ----
+  // (batch is a separate static-statement atomic path; it cannot make an
+  //  interactive transaction(fn) safe, so it does NOT flip the capability.)
+  b.externalDb._resetForTest();
+  var batchAdapter = _makeStatelessAdapter();
+  b.externalDb.init({
+    backends: {
+      d1batch: {
+        dialect:              "sqlite",
+        connect:              batchAdapter.connect,
+        query:                batchAdapter.query,
+        close:                batchAdapter.close,
+        supportsTransactions: false,
+        batch:                async function () { return; },
+      },
+    },
+  });
+  var batchThrew = null;
+  try {
+    await b.externalDb.transaction(async function (tx) { await tx.query("SELECT 1", []); });
+  } catch (e) { batchThrew = e; }
+  check("#343 a stateless adapter with only a batch hook still refuses interactive transaction()",
+        batchThrew && /NON_ATOMIC_BACKEND/.test(batchThrew.code || ""));
+
+  b.externalDb._resetForTest();
+  console.log("OK — externalDb non-atomic backend refusal (#343)");
+}
+
+module.exports = { run: run };
+if (require.main === module) {
+  run().then(function () { process.exit(0); })
+       .catch(function (err) { process.stderr.write(String(err && err.stack || err) + "\n"); process.exit(1); });
+}