@blamejs/blamejs-shop 0.4.85 → 0.4.87

package/lib/vendor/blamejs/test/layer-0-primitives/atomic-file-open-append-nofollow.test.js

@@ -0,0 +1,87 @@
+"use strict";
+// b.atomicFile.openAppendNoFollowSync — O_NOFOLLOW append open for long-lived
+// append sinks (active log file kept open across appends + reopened on
+// rotation). Creates the file if absent and appends if it is a regular file,
+// but refuses a symlink at the final path component (ELOOP) instead of
+// following it — so log writes cannot be redirected to an attacker-chosen
+// file (CWE-59). RED before 0.15.16: log-stream-local opened the active log
+// with a bare `openSync(path, "a")`, following a symlink planted at the path.
+
+var fs   = require("node:fs");
+var os   = require("node:os");
+var path = require("node:path");
+var helpers = require("../helpers");
+var b     = helpers.b;
+var check = helpers.check;
+var localProto = require("../../lib/log-stream-local");
+
+function run() {
+  check("b.atomicFile.openAppendNoFollowSync is a function",
+        typeof b.atomicFile.openAppendNoFollowSync === "function");
+
+  var dir = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-append-nofollow-"));
+  try {
+    // --- primitive: create-if-absent + append to a regular file ---
+    var p = path.join(dir, "active.log");
+    var fd = b.atomicFile.openAppendNoFollowSync(p, 0o600);
+    check("returns a numeric fd, creating the file if absent",
+          typeof fd === "number" && fd >= 0 && fs.existsSync(p));
+    fs.writeSync(fd, Buffer.from("line-1\n"));
+    fs.closeSync(fd);
+    var fd2 = b.atomicFile.openAppendNoFollowSync(p, 0o600);
+    fs.writeSync(fd2, Buffer.from("line-2\n"));
+    fs.closeSync(fd2);
+    check("appends rather than truncates an existing regular file",
+          fs.readFileSync(p, "utf8") === "line-1\nline-2\n");
+
+    // --- primitive: symlink at the final component is refused (POSIX) ---
+    if (process.platform !== "win32") {
+      var victim = path.join(dir, "victim.txt");
+      fs.writeFileSync(victim, "ORIGINAL");
+      var linkPath = path.join(dir, "evil.log");
+      var symlinkMade = false;
+      try { fs.symlinkSync(victim, linkPath); symlinkMade = true; } catch (_e) { /* no symlink priv */ }
+      if (symlinkMade) {
+        var loopCode = null;
+        try {
+          var bad = b.atomicFile.openAppendNoFollowSync(linkPath, 0o600);
+          fs.closeSync(bad);
+        } catch (e) { loopCode = e && e.code; }
+        check("symlink final component refused with ELOOP (not followed)", loopCode === "ELOOP");
+        check("the symlink target was never written through",
+              fs.readFileSync(victim, "utf8") === "ORIGINAL");
+      }
+
+      // --- consumer path (#356): log-stream-local refuses a symlinked active log ---
+      var logDir = path.join(dir, "logs");
+      fs.mkdirSync(logDir, { recursive: true });
+      var logVictim = path.join(dir, "log-victim.txt");
+      fs.writeFileSync(logVictim, "VICTIM-LOG");
+      var activePath = path.join(logDir, "blamejs.log");   // <prefix>.log
+      var planted = false;
+      try { fs.symlinkSync(logVictim, activePath); planted = true; } catch (_e) { /* no priv */ }
+      if (planted) {
+        var refusedCode = null;
+        var sink = null;
+        try { sink = localProto.create({ dir: logDir }); }
+        catch (e) { refusedCode = e && e.code; }
+        if (sink) { try { sink.close(); } catch (_c) { /* ignore */ } }
+        check("log-stream-local refuses to open a symlinked active log path",
+              refusedCode === "SYMLINK_REFUSED");
+        check("log-stream-local never writes through the symlink to the victim",
+              fs.readFileSync(logVictim, "utf8") === "VICTIM-LOG");
+      }
+    }
+  } finally {
+    try { fs.rmSync(dir, { recursive: true, force: true }); } catch (_e) { /* best-effort */ }
+  }
+  return Promise.resolve();
+}
+
+module.exports = { run: run };
+if (require.main === module) {
+  Promise.resolve(run()).then(
+    function () { console.log("OK — atomicFile.openAppendNoFollowSync + log-stream-local symlink refusal (" + helpers.getChecks() + " checks)"); process.exit(0); },
+    function (e) { console.error("FAIL: " + (e && e.message)); process.exit(1); }
+  );
+}

package/lib/vendor/blamejs/test/layer-0-primitives/codebase-patterns.test.js

@@ -8546,6 +8546,54 @@ var KNOWN_ANTIPATTERNS = [
     ],
     reason: "Symlink-follow / torn-write class (CWE-59 / CWE-377). A raw nodeFs.writeFileSync / nodeFs.createWriteStream to a destination path follows a symlink an attacker pre-planted there and can leave a half-written file on a crash. The §1 sweep routed every hand-rolled write through an atomic-file primitive: writeSync (buffer payloads — cookie-jar flush, archive/tar extract, backup payloads, p12 export, api-snapshot, sealed-pem marker), writeStream (object-store streaming put — staged into a no-follow exclusive temp + atomic rename, capped by maxBytes), and writeExclSync (the vault seal/unseal/rotate staged write that must re-read + verify the bytes before the rename — clears any stale entry then O_EXCL|O_NOFOLLOW creates so a re-planted symlink fails closed). The three allowlisted files are the genuinely-safe forms: atomic-file.js owns the primitives (its createWriteStream binds an _openExclTemp fd); backup/index.js writeFileSync passes { flag: 'wx' } (O_EXCL refuses a pre-planted target); http-client.js opens its download temp with explicit O_WRONLY|O_CREAT|O_EXCL|O_NOFOLLOW flags. Any new raw nodeFs.writeFileSync/createWriteStream elsewhere trips this — call the matching atomic-file primitive instead.",
   },
+  {
+    id: "raw-fs-append-open-without-nofollow",
+    primitive: "b.atomicFile.openAppendNoFollowSync — O_WRONLY|O_APPEND|O_CREAT|O_NOFOLLOW append open",
+    // The append-sink sibling of raw-fs-write-without-exclusive-nofollow. A
+    // long-lived append target (an active log file kept open across appends and
+    // reopened on rotation) can't use a one-shot atomic write, but a bare
+    // nodeFs.openSync(path, "a") / appendFileSync(path, ...) still FOLLOWS a
+    // symlink an attacker pre-planted at `path` (CWE-59) — redirecting the
+    // append stream to a victim file. openAppendNoFollowSync adds O_NOFOLLOW so
+    // the symlink is refused (ELOOP) atomically with the open, closing the
+    // caller-pre-check-then-unlink race. The primitive itself opens with a
+    // numeric flags variable (not the "a" string), so its own home does not
+    // match and needs no allowlist.
+    scanScope: "lib",
+    skipCommentLines: true,
+    regex: /\bnodeFs\.(?:openSync\s*\(\s*[^,]+,\s*"a"|appendFileSync\s*\(|appendFile\s*\()/,
+    allowlist: [],
+    reason: "Symlink-follow append class (CWE-59). A bare nodeFs.openSync(path, \"a\") or nodeFs.appendFileSync(path, ...) follows a symlink an attacker pre-planted at the append target and redirects the log/append stream to an attacker-chosen file; a caller's pre-check-then-unlink can't close the race because the sink's own open is what follows the link. The fix routes every long-lived append open through b.atomicFile.openAppendNoFollowSync (O_WRONLY|O_APPEND|O_CREAT|O_NOFOLLOW): the file is created/appended normally but a symlink at the final component fails the open closed with ELOOP. The v0.15.16 sweep converted log-stream-local.js (active log sink) and daemon.js (detached-process stdout/stderr log). Zero allowlist — the primitive opens with a numeric flags variable, so any new nodeFs.openSync(..., \"a\") / appendFileSync / appendFile in lib/ trips this; call b.atomicFile.openAppendNoFollowSync instead.",
+  },
+  {
+    id: "httpclient-request-idle-timeout-without-wall-clock",
+    primitive: "forward BOTH timeoutMs (overall wall-clock) and idleTimeoutMs to httpClient.request — never idle-only",
+    // #355 class. httpClient distinguishes timeoutMs (overall wall-clock cap)
+    // from idleTimeoutMs (zero-progress cap). A consumer that maps its single
+    // configured timeout to idleTimeoutMs ONLY has no overall bound: a peer
+    // trickling bytes within the idle window holds the request open forever
+    // (slow-loris). Every httpClient request object that sets idleTimeoutMs must
+    // also set timeoutMs on the line immediately before it. This detector flags
+    // an `idleTimeoutMs:` property (identifier/member value) whose preceding line
+    // is NOT a `timeoutMs:` line. The allowlist is the SERVER-side / pool idle
+    // timeouts — inbound connection inactivity disconnect (RFC 5321 §4.5.3.2.7
+    // for SMTP, IMAP/POP3/ManageSieve/submission/TLS) and the external-db
+    // connection pool — a structurally different concept (a long-lived server
+    // socket has no per-request wall-clock to cap), NOT an outbound httpClient
+    // request.
+    scanScope: "lib",
+    skipCommentLines: true,
+    regex: /\n[ \t]*(?!timeoutMs\b)[A-Za-z_$][\w$]*:[^\n]*\n[ \t]*idleTimeoutMs:[ \t]*[A-Za-z_$]/,
+    allowlist: [
+      "lib/mail-server-imap.js",        // inbound IMAP server socket idle disconnect
+      "lib/mail-server-managesieve.js", // inbound ManageSieve server socket idle disconnect
+      "lib/mail-server-mx.js",          // inbound SMTP/MX server socket idle (RFC 5321 §4.5.3.2.7)
+      "lib/mail-server-pop3.js",        // inbound POP3 server socket idle disconnect
+      "lib/mail-server-submission.js",  // inbound submission server socket idle disconnect
+      "lib/mail-server-tls.js",         // inbound TLS server socket idle (re-armed post-handshake)
+    ],
+    reason: "Slow-trickle hold-open class (#355, CWE-400). httpClient.request takes timeoutMs (overall wall-clock cap) AND idleTimeoutMs (zero-progress cap) as DISTINCT bounds. A consumer wrapping httpClient that forwards only idleTimeoutMs leaves the request unbounded in wall-clock time: a peer that emits one byte just under the idle window keeps resetting the idle timer forever, holding the call open indefinitely. The v0.15.16 sweep set timeoutMs alongside idleTimeoutMs in every httpClient consumer (api-encrypt httpClient, the object-store shared request wrapper + azure/gcs bucket-ops, queue-sqs, the cloudwatch/otlp/webhook log sinks, the HIBP password breach check). The detector requires timeoutMs on the line immediately before every idleTimeoutMs property; the only allowlisted files are inbound SERVER socket idle timeouts and the external-db pool idle — a long-lived server connection's inactivity disconnect, not an outbound request needing a per-request wall-clock cap. A new httpClient consumer forwarding idle-only trips this — set timeoutMs too.",
+  },
   {
     id: "allowlist-map-indexed-by-untrusted-key-without-hasown",
     primitive: "Object.prototype.hasOwnProperty.call(MAP, key) — proto-shadow-safe allowlist membership",

package/lib/vendor/blamejs/test/layer-0-primitives/external-db-non-atomic-backend.test.js

@@ -0,0 +1,200 @@
+"use strict";
+// #343: externalDb.transaction (and the b.outbox built on it) silently
+// non-atomic on a stateless / autocommit-per-statement adapter.
+//
+// transaction(fn) defaults its tx verbs to query(client,"BEGIN") /
+// query(client,"COMMIT") when the adapter supplies no beginTx/commit/
+// rollback. On a stateless adapter — connect() returns a sentinel and
+// every query() is an independent round-trip (e.g. an HTTP bridge to
+// Cloudflare D1) — BEGIN, the body statements, and COMMIT each land on a
+// DIFFERENT session: no isolation, no rollback. Yet the call resolves, so
+// the consumer believes the block was atomic. b.outbox is built entirely
+// on this (enqueue requires the txClient), so its dual-write guarantee is
+// void on such a backend.
+//
+// FIX: a backend declares supportsTransactions:false (the stateless
+// declaration). transaction() and outbox.create() then REFUSE LOUDLY with
+// a typed error (fail closed) instead of running BEGIN/COMMIT as separate
+// no-ops and resolving.
+//
+// RED on the buggy tree: transaction(fn) runs (BEGIN/COMMIT as independent
+// no-op round-trips) and RESOLVES; outbox.create() succeeds. GREEN after
+// the fix: both throw NON_ATOMIC_BACKEND / outbox/non-atomic-backend.
+
+var helpers = require("../helpers");
+var b     = helpers.b;
+var check = helpers.check;
+
+// A faithful STATELESS adapter: connect() returns a fresh sentinel each
+// call, every query() is an independent round-trip against a shared store,
+// and there is NO beginTx/commit/rollback hook. BEGIN/COMMIT/ROLLBACK are
+// accepted as harmless no-ops (exactly what an autocommit bridge does).
+function _makeStatelessAdapter() {
+  var store = {};
+  var connectCount = 0;
+  var sawBegin = false;
+  return {
+    sawBegin: function () { return sawBegin; },
+    connect: async function () { connectCount += 1; return { sentinel: connectCount }; },
+    query: async function (_client, sql, params) {
+      if (/^\s*(BEGIN|COMMIT|ROLLBACK)/i.test(sql)) { sawBegin = true; return { rows: [], rowCount: 0 }; }
+      if (/^INSERT INTO kv/i.test(sql)) { store[params[0]] = params[1]; return { rows: [], rowCount: 1 }; }
+      if (/^SELECT/i.test(sql)) {
+        var v = store[params && params[0]];
+        return v === undefined ? { rows: [], rowCount: 0 } : { rows: [{ value: v }], rowCount: 1 };
+      }
+      return { rows: [], rowCount: 0 };
+    },
+    close: async function () {},
+  };
+}
+
+async function run() {
+  // ---- transaction() refuses a stateless backend ----
+  b.externalDb._resetForTest();
+  var stateless = _makeStatelessAdapter();
+  b.externalDb.init({
+    backends: {
+      d1: {
+        dialect:              "sqlite",
+        connect:              stateless.connect,
+        query:                stateless.query,
+        close:                stateless.close,
+        supportsTransactions: false,   // stateless / autocommit-per-statement declaration
+      },
+    },
+  });
+
+  var threw = null;
+  var bodyRan = false;
+  try {
+    await b.externalDb.transaction(async function (tx) {
+      bodyRan = true;
+      await tx.query("INSERT INTO kv (id, value) VALUES ($1, $2)", ["k", "v"]);
+    });
+  } catch (e) { threw = e; }
+  check("#343 transaction() refuses a stateless backend (typed NON_ATOMIC_BACKEND)",
+        threw && /NON_ATOMIC_BACKEND/.test(threw.code || ""));
+  check("#343 transaction() refuses BEFORE running the body / any BEGIN",
+        bodyRan === false && stateless.sawBegin() === false);
+
+  // write.transaction routes through transaction() — must refuse too.
+  var threwWrite = null;
+  try {
+    await b.externalDb.write.transaction(async function (tx) { await tx.query("SELECT 1", []); });
+  } catch (e) { threwWrite = e; }
+  check("#343 write.transaction() also refuses a stateless backend",
+        threwWrite && /NON_ATOMIC_BACKEND/.test(threwWrite.code || ""));
+
+  // supportsTransactions probe reflects the declaration.
+  check("#343 supportsTransactions() probe returns false for the stateless backend",
+        b.externalDb.supportsTransactions() === false);
+
+  // ---- outbox.create() refuses a stateless backend ----
+  var outboxThrew = null;
+  try {
+    b.outbox.create({
+      externalDb: b.externalDb,
+      table:      "outbox_events",
+      publisher:  async function () {},
+      audit:      false,
+    });
+  } catch (e) { outboxThrew = e; }
+  check("#343 outbox.create() refuses a stateless backend (typed error)",
+        outboxThrew && /non-atomic-backend/.test(outboxThrew.code || ""));
+
+  // A custom externalDb object that declares supportsTransactions:false is
+  // refused identically (outbox accepts the namespace OR a faithful object).
+  var customOutboxThrew = null;
+  try {
+    b.outbox.create({
+      externalDb: {
+        dialect:              "sqlite",
+        query:                async function () { return { rows: [] }; },
+        transaction:          async function (fn) { return fn({ query: async function () { return { rows: [] }; } }); },
+        supportsTransactions: false,
+      },
+      table:     "outbox_events",
+      publisher: async function () {},
+      audit:     false,
+    });
+  } catch (e) { customOutboxThrew = e; }
+  check("#343 outbox.create() refuses a custom externalDb declaring supportsTransactions:false",
+        customOutboxThrew && /non-atomic-backend/.test(customOutboxThrew.code || ""));
+
+  // ---- no regression: a STATEFUL backend (the historical default) still works ----
+  b.externalDb._resetForTest();
+  var stateful = helpers._makeFakeDriver();
+  b.externalDb.init({
+    backends: { main: { connect: stateful.connect, query: stateful.query, close: stateful.close, ping: stateful.ping } },
+  });
+  var statefulOk = false;
+  var got = await b.externalDb.transaction(async function (tx) {
+    await tx.query("INSERT INTO kv (id, value) VALUES ($1, $2)", ["a", "1"]);
+    var r = await tx.query("SELECT id, value FROM kv WHERE id = $1", ["a"]);
+    statefulOk = r.rowCount === 1;
+    return r.rows[0];
+  });
+  check("#343 a stateful backend (no flag, no hooks) still runs transactions",
+        statefulOk && got && got.value === "1");
+  check("#343 supportsTransactions() probe returns true for a stateful backend",
+        b.externalDb.supportsTransactions() === true);
+  check("#343 outbox.create() succeeds on a stateful backend",
+        (function () {
+          try {
+            b.outbox.create({ externalDb: b.externalDb, table: "outbox_events",
+              publisher: async function () {}, audit: false });
+            return true;
+          } catch (_e) { return false; }
+        })());
+
+  // ---- an explicit supportsTransactions:true (stateful operator assertion) is permitted ----
+  b.externalDb._resetForTest();
+  var asserted = helpers._makeFakeDriver();
+  b.externalDb.init({
+    backends: {
+      mainAsserted: {
+        connect:              asserted.connect,
+        query:                asserted.query,
+        close:                asserted.close,
+        ping:                 asserted.ping,
+        supportsTransactions: true,   // operator asserts the default BEGIN/COMMIT runs on a stateful client
+      },
+    },
+  });
+  check("#343 supportsTransactions:true is honored (transaction not refused)",
+        b.externalDb.supportsTransactions() === true);
+
+  // ---- a stateless adapter declaring supportsTransactions:false is refused even WITH a batch hook ----
+  // (batch is a separate static-statement atomic path; it cannot make an
+  //  interactive transaction(fn) safe, so it does NOT flip the capability.)
+  b.externalDb._resetForTest();
+  var batchAdapter = _makeStatelessAdapter();
+  b.externalDb.init({
+    backends: {
+      d1batch: {
+        dialect:              "sqlite",
+        connect:              batchAdapter.connect,
+        query:                batchAdapter.query,
+        close:                batchAdapter.close,
+        supportsTransactions: false,
+        batch:                async function () { return; },
+      },
+    },
+  });
+  var batchThrew = null;
+  try {
+    await b.externalDb.transaction(async function (tx) { await tx.query("SELECT 1", []); });
+  } catch (e) { batchThrew = e; }
+  check("#343 a stateless adapter with only a batch hook still refuses interactive transaction()",
+        batchThrew && /NON_ATOMIC_BACKEND/.test(batchThrew.code || ""));
+
+  b.externalDb._resetForTest();
+  console.log("OK — externalDb non-atomic backend refusal (#343)");
+}
+
+module.exports = { run: run };
+if (require.main === module) {
+  run().then(function () { process.exit(0); })
+       .catch(function (err) { process.stderr.write(String(err && err.stack || err) + "\n"); process.exit(1); });
+}

package/lib/vendor/blamejs/test/layer-0-primitives/fido-mds3-cert-bad-validity.test.js

@@ -0,0 +1,159 @@
+"use strict";
+/**
+ * b.auth.fidoMds3 — x5c cert validity-window must fail closed when the
+ * notBefore / notAfter dates are present but unparseable.
+ *
+ * _validateChain reads chain[v].validFrom / .validTo and feeds them to
+ * Date.parse. A cert whose encoded validity dates parse to NaN (e.g. a
+ * malformed / hand-forged DER) makes isFinite(notBefore) /
+ * isFinite(notAfter) false, which — pre-fix — SKIPS both the
+ * not-yet-valid and the expired checks, so the cert sails through the
+ * validity window unchecked. The verifier must instead refuse with
+ * fido-mds3/cert-bad-validity.
+ *
+ * The test drives the real fetch() consumer path with a mocked
+ * httpClient serving a genuine RS256-signed BLOB whose self-signed leaf
+ * is also the operator-supplied caCertificate, so absent the validity
+ * bug the chain anchors and the JWS verifies — the validity-window
+ * check is the only gate left. node:crypto's X509Certificate is
+ * overridden so the parsed leaf reports an unparseable validFrom while
+ * every other cert behaviour (verify / checkIssued / publicKey /
+ * fingerprint256) stays real.
+ */
+
+var nodeCrypto = require("node:crypto");
+var helpers = require("../helpers");
+var check   = helpers.check;
+
+// Mint an RSA self-signed cert + matching private-key PEM via the
+// vendored pki bundle, mirroring the sibling fido-mds3 test fixture.
+async function _makeSelfSignedRsaCert() {
+  var pki  = require("../../lib/vendor/pki.cjs");
+  var x509 = pki.x509;
+  var keys = await nodeCrypto.webcrypto.subtle.generateKey(
+    { name:           "RSASSA-PKCS1-v1_5",
+      modulusLength:  2048,
+      publicExponent: new Uint8Array([1, 0, 1]),
+      hash:           "SHA-256" },
+    true, ["sign", "verify"]);
+  var now      = new Date();
+  var notAfter = new Date(now.getTime() + 7 * 86400000);
+  var cert = await x509.X509CertificateGenerator.createSelfSigned({
+    serialNumber:     "01",
+    name:             "CN=blamejs-mds3-test-root",
+    notBefore:        now,
+    notAfter:         notAfter,
+    signingAlgorithm: { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" },
+    keys:             keys,
+    extensions:       [
+      new x509.BasicConstraintsExtension(true, 0, true),
+      new x509.KeyUsagesExtension(
+        x509.KeyUsageFlags.keyCertSign | x509.KeyUsageFlags.digitalSignature,
+        true),
+    ],
+  });
+  var pkcs8  = await nodeCrypto.webcrypto.subtle.exportKey("pkcs8", keys.privateKey);
+  var pkB64  = Buffer.from(pkcs8).toString("base64").match(/.{1,64}/g).join("\n");
+  var keyPem = "-----BEGIN PRIVATE KEY-----\n" + pkB64 + "\n-----END PRIVATE KEY-----\n";
+  return { keyPem: keyPem, certPem: cert.toString("pem") };
+}
+
+function _b64url(buf) {
+  return Buffer.from(buf).toString("base64url");
+}
+
+function _makeBlob(payload, keyPem, certPem) {
+  var derB64 = certPem
+    .replace(/-----BEGIN CERTIFICATE-----/g, "")
+    .replace(/-----END CERTIFICATE-----/g, "")
+    .replace(/\s+/g, "");
+  var header     = { alg: "RS256", typ: "JWT", x5c: [derB64] };
+  var headerB64  = _b64url(JSON.stringify(header));
+  var payloadB64 = _b64url(JSON.stringify(payload));
+  var signingInput = headerB64 + "." + payloadB64;
+  var sig = nodeCrypto.sign("sha256", Buffer.from(signingInput, "ascii"), {
+    key:     keyPem,
+    padding: nodeCrypto.constants.RSA_PKCS1_PADDING,
+  });
+  return signingInput + "." + _b64url(sig);
+}
+
+function _futureDateString(daysFromNow) {
+  var d = new Date(Date.now() + daysFromNow * 86400000);
+  return d.toISOString().slice(0, 10);
+}
+
+// Make every freshly-parsed X509Certificate report an unparseable
+// validFrom (Date.parse -> NaN) while keeping all real cert behaviour.
+async function _withUnparseableValidFrom(fn) {
+  var realX509 = nodeCrypto.X509Certificate;
+  function Wrapped(arg) {
+    var c = new realX509(arg);
+    Object.defineProperty(c, "validFrom", {
+      configurable: true,
+      get: function () { return "GARBAGE-NOT-A-DATE"; },
+    });
+    return c;
+  }
+  nodeCrypto.X509Certificate = Wrapped;
+  try { return await fn(); }
+  finally { nodeCrypto.X509Certificate = realX509; }
+}
+
+async function run() {
+  var pair = await _makeSelfSignedRsaCert();
+  var payload = {
+    legalHeader: "Test BLOB",
+    no: 1,
+    nextUpdate: _futureDateString(7),
+    entries: [{
+      aaguid: "01234567-89ab-cdef-0123-456789abcdef",
+      metadataStatement: { description: "Test entry" },
+      statusReports: [{ status: "FIDO_CERTIFIED_L2" }],
+    }],
+  };
+  var token = _makeBlob(payload, pair.keyPem, pair.certPem);
+
+  // Mock httpClient.request via require-cache override (sibling pattern).
+  var hcPath = require.resolve("../../lib/http-client");
+  var origHc = require.cache[hcPath].exports;
+  require.cache[hcPath].exports = Object.assign({}, origHc, {
+    request: async function () {
+      return { statusCode: 200, headers: {}, body: Buffer.from(token, "ascii") };
+    },
+  });
+
+  // Re-require the verifier so it captures both the mocked httpClient and
+  // the wrapped X509Certificate through its module-level references.
+  var fmPath = require.resolve("../../lib/auth/fido-mds3");
+  delete require.cache[fmPath];
+  var fm = require(fmPath);
+
+  var threw = null;
+  try {
+    await _withUnparseableValidFrom(async function () {
+      await fm.fetch({
+        url:           "https://test.invalid/mds3",
+        caCertificate: pair.certPem,
+        force:         true,
+      });
+    });
+  } catch (e) {
+    threw = e;
+  } finally {
+    require.cache[hcPath].exports = origHc;
+    delete require.cache[fmPath];
+  }
+
+  check("fetch rejects a cert with present-but-unparseable validity dates",
+        threw !== null);
+  check("rejection is fido-mds3/cert-bad-validity (fail closed, not silently accepted)",
+        threw && /cert-bad-validity/.test(threw.code || ""));
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  run().then(function () { console.log("OK"); })
+       .catch(function (e) { console.error(e.stack || e); process.exit(1); });
+}

package/lib/vendor/blamejs/test/layer-0-primitives/graphql-federation.test.js

@@ -38,14 +38,61 @@ async function run() {
 
   // nonceHeader override — the replay nonce can be read from a custom
   // request header (not just the Apollo-vendor default), for operators
-  // fronting the gateway with a non-Apollo router.
+  // fronting the gateway with a non-Apollo router. The replay store speaks
+  // the framework's ATOMIC checkAndInsert(nonce, expireAt) contract.
   var withNonce = b.graphqlFederation.guardSdl({
     routerToken: "a".repeat(64),
-    nonceStore:  { has: function () { return false; }, remember: function () {} },
+    nonceStore:  { checkAndInsert: function () { return true; } },
     nonceHeader: "x-my-nonce",
   });
   check("guardSdl: accepts custom nonceHeader", typeof withNonce === "function");
 
+  // #328 sibling — the replay nonceStore must speak the framework's ATOMIC
+  // checkAndInsert(nonce, expireAt) contract (was a racy non-atomic
+  // has()-then-remember() check-then-set). A store lacking checkAndInsert —
+  // including the legacy { has, remember } shape — is refused at config time.
+  var racyStoreThrew = null;
+  try {
+    b.graphqlFederation.guardSdl({
+      routerToken: "a".repeat(64),
+      nonceStore:  { has: function () { return false; }, remember: function () {} },
+    });
+  } catch (e) { racyStoreThrew = e; }
+  check("guardSdl: refuses a nonceStore lacking checkAndInsert (legacy racy has/remember)",
+        racyStoreThrew && racyStoreThrew.code === "graphql-federation/bad-nonce-store");
+
+  // The framework's own b.nonceStore.create drops straight in, and a replay of
+  // the SAME nonce on a valid bearer _service probe is refused (401) — driving
+  // the REAL consumer path through the atomic store.
+  var nonceStore = b.nonceStore.create({ backend: "memory" });
+  var nguard = b.graphqlFederation.guardSdl({
+    routerToken: "a".repeat(64), nonceStore: nonceStore, audit: false,
+  });
+  function _driveNonce(nonce) {
+    return new Promise(function (resolve) {
+      var out = { status: null, nextCalled: false };
+      var res = {
+        statusCode: 200,
+        setHeader: function () {}, getHeader: function () { return undefined; },
+        writeHead: function (s) { out.status = s; },
+        end: function () { if (out.status === null) out.status = res.statusCode; resolve(out); },
+      };
+      nguard({
+        method:  "POST",
+        headers: { authorization: "Bearer " + "a".repeat(64),
+                   "x-apollographql-router-nonce": nonce },
+        body:    { query: "{ _service { sdl } }" },
+        on:      function () {},
+      }, res, function () { out.nextCalled = true; resolve(out); });
+    });
+  }
+  var freshNonce = await _driveNonce("nonce-aaaaaaaaaaaaaaaa");
+  check("guardSdl: fresh nonce on a valid bearer _service probe is forwarded",
+        freshNonce.nextCalled === true && freshNonce.status === null);
+  var replayNonce = await _driveNonce("nonce-aaaaaaaaaaaaaaaa");
+  check("guardSdl: a replayed nonce is refused (401), not forwarded",
+        replayNonce.status === 401 && replayNonce.nextCalled === false);
+
   // ---- guardSdl drives: a batched ARRAY body whose SECOND operation probes
   // _service must be refused (401) without a router token, not forwarded. ----
   function _drive(mw, body) {