@blamejs/blamejs-shop 0.4.91 → 0.4.92

package/lib/vendor/blamejs/test/layer-0-primitives/codebase-patterns.test.js

@@ -5170,6 +5170,48 @@ var KNOWN_ANTIPATTERNS = [
     allowlist: ["lib/x509-chain.js"],
     reason: "basicConstraints cA:TRUE enforcement is owned by x509Chain.issuerValidlyIssued / x509Chain.isCaCert; tsa/mail-bimi/mail-crypto-smime route through it. Any lib file calling X.checkIssued(Y) (Y!=X) directly bypasses the cA check and must use x509Chain instead. lib/x509-chain.js is the home of the primitive.",
   },
+  {
+    id: "fingerprint-pin-against-claimed-field-not-recomputed",
+    primitive: "b.auditSign.fingerprintOf",
+    scanScope: "lib",
+    skipCommentLines: true,
+    // A fingerprint PIN (expectedFingerprint, supplied out-of-band by the
+    // verifier) must be checked against a fingerprint RECOMPUTED from the
+    // signature block's own publicKey — fingerprintOf(block.publicKey) — NOT
+    // the block's self-asserted `.fingerprint` field. An attacker controls that
+    // field: sign arbitrary bytes with their OWN key, set `fingerprint` to the
+    // trusted value, and a `block.fingerprint === expectedFingerprint` check
+    // passes while the signature still verifies under the attacker's key (the
+    // backup-manifest verifyBytes/verifySignature P1 substitution bug). Binding
+    // the pin to fingerprintOf(publicKey) — the key the signature is actually
+    // verified under — closes the substitution. Fires on either argument order.
+    regex: /(?:[\w.]+\.fingerprint\s*[!=]==\s*[\w.]*\bexpectedFingerprint\b|\bexpectedFingerprint\b\s*[!=]==\s*[\w.]+\.fingerprint\b)/,
+    allowlist: [],
+    reason: "A fingerprint pin must be compared against auditSign.fingerprintOf(<the block's publicKey>) — the key the signature verifies under — never the block's untrusted self-asserted `.fingerprint` field (an attacker sets that to the trusted value while signing with their own key). backup/manifest.js _verifyPayloadAgainstBlock recomputes via derivedFingerprint = fingerprintOf(sig.publicKey). Any `X.fingerprint === expectedFingerprint` (either order) re-introduces the substitution bypass and must recompute instead.",
+  },
+  {
+    id: "platform-parameterized-containment-resolves-with-runtime-path-module",
+    primitive: "b.safePath (target-platform lexical resolve)",
+    scanScope: "lib",
+    skipCommentLines: true,
+    // A path validator parameterized by opts.platform must resolve AND bound its
+    // LEXICAL containment with the TARGET platform's path module
+    // (`pathMod = isWin ? nodePath.win32 : nodePath.posix`), not the runtime
+    // node:path. The per-segment walk already splits on the target separator
+    // (`sep = isWin ? /[\\/]/ : /\//`); if the lexical resolve uses runtime
+    // semantics they disagree. On a POSIX host validating opts.platform:
+    // "windows", runtime node:path treats `\` as an ordinary filename char, so
+    // `ok\..\..\outside` was NOT collapsed and slipped past the boundary slice —
+    // resolving to `<base>/ok\..\..\outside`, a path that escapes the base once a
+    // Windows consumer reads the backslashes (Codex P1, PR #372). The realpath
+    // check hits the live filesystem and legitimately keeps a SEPARATE runtime
+    // resolve under distinctly-named vars (rtBaseResolved / rtJoined / rtSep), so
+    // those don't match this anchor. Fires if the lexical `joined` reverts to
+    // `nodePath.resolve(baseResolved, ...)` or `sepChar` to `nodePath.sep`.
+    regex: /\bjoined\s*=\s*nodePath\.resolve\s*\(\s*baseResolved|\bvar\s+sepChar\s*=\s*nodePath\.sep\b/,
+    allowlist: [],
+    reason: "b.safePath.resolve refuses traversal lexically by resolving rel under base and slicing on the containment boundary. When validating for a non-runtime platform (opts.platform), the lexical resolve + boundary separator MUST come from the target module (pathMod = isWin ? nodePath.win32 : nodePath.posix) so they share the per-segment walk's platform semantics — otherwise a separator the target treats as a delimiter (the Windows backslash) is treated as a filename char by the runtime resolver and a cross-platform `ok\\..\\..\\outside` traversal escapes the base. The realpath check keeps a separate runtime resolve (rtBaseResolved/rtJoined/rtSep) because it touches the live FS. Reverting the lexical `joined`/`sepChar` to runtime nodePath re-opens the cross-platform traversal hole.",
+  },
   {
     id: "compose-pipeline-settle-on-response-ended-not-return",
     primitive: "b.middleware.composePipeline",
@@ -9360,6 +9402,29 @@ var KNOWN_ANTIPATTERNS = [
     allowlist: [],
     reason: "#123 macOS codebase-patterns watchdog hang. _scanShardInWorker rejected on worker error/exit without w.terminate(), so an errored worker thread stayed alive holding open handles; the parent then could not exit and the smoke run ran to the 25-min watchdog on memory-starved macOS-arm64 runners (it hung this very release's CI). Every settle path must reap the worker via w.terminate() first; the fix funnels message/error/exit through a settle() guard that terminates before resolve/reject. Fires on the bare `w.once(\"error\", reject)` shape; silent once error/exit route through settle().",
   },
+  {
+    // A test file must invoke its run()/IIFE ONLY under
+    // `if (require.main === module)`. The smoke worker REQUIRES each test
+    // module and then awaits its exported run(); a module-level `run()` (or
+    // `run().then(...process.exit...)`) at column 0 fires a SECOND, unawaited
+    // run() at require-time that races the worker's result print — and if it
+    // calls process.exit() it exits the worker BEFORE the result line is
+    // written, which the parent reports as the unattributable "no result line"
+    // / "fork failed". Found via the worker's late-error + leaked-handle audit
+    // sweep (defineguard-default-gate-posture-caps / dpop-middleware-
+    // replaystore-required / otlp-attr-redaction + two integration files), the
+    // same slow-runner-flake root as #123. Export run and guard the
+    // self-execution. Structural test-harness-contract drift a behavioral test
+    // can't assert (the race only surfaces under require, intermittently on a
+    // slow runner) — the detector is the guard.
+    id: "test-unguarded-module-level-run",
+    primitive: "a test file's run()/self-execution must sit under `if (require.main === module)` (export run for the smoke worker to await) — a bare module-level run() at column 0 re-runs at require-time and races / exits the worker",
+    scanScope: "test",
+    regex: /^run\s*\(/m,
+    skipCommentLines: true,
+    allowlist: [],
+    reason: "The smoke worker requires each test module and awaits its exported run(); a column-0 `run()` / `run().then(...process.exit...)` fires a second unawaited run() at require-time that races the worker's result print (and process.exit() exits before the result line, read as 'no result line' / 'fork failed' on a slow runner). Export `run` and wrap the invocation in `if (require.main === module)`. Fires on any `run(` at the start of a line; `function run()`, `module.exports = { run }`, and an indented `run()` inside the require-main guard stay silent.",
+  },
   {
     // `Promise + setTimeout` direct sleep in tests is forbidden;
     // tests waiting on an asynchronous condition MUST use

package/lib/vendor/blamejs/test/layer-0-primitives/codepoint-class.test.js

@@ -65,9 +65,67 @@ function testFirstControlCharOffset() {
   check("firstControlCharOffset: CR found when only allowLf", g("a\rb", { allowLf: true }) === 1);
 }
 
+// #332 — the catalog is now exported on the public b. surface so a consumer
+// can build a custom free-text screen without reaching into the internal
+// module path or re-rolling the bidi / control / zero-width regexes.
+function testPublicSurface() {
+  var b = helpers.b;
+  check("b.codepointClass is on the public surface", typeof b.codepointClass === "object");
+  // The detectors / classifier the issue names are reachable + functional.
+  check("b.codepointClass.detectCharThreats is a function", typeof b.codepointClass.detectCharThreats === "function");
+  check("b.codepointClass.assertNoCharThreats is a function", typeof b.codepointClass.assertNoCharThreats === "function");
+  check("b.codepointClass.applyCharStripPolicies is a function", typeof b.codepointClass.applyCharStripPolicies === "function");
+  check("b.codepointClass.scriptFor is a function", typeof b.codepointClass.scriptFor === "function");
+  check("b.codepointClass.detectMixedScripts is a function", typeof b.codepointClass.detectMixedScripts === "function");
+  // The compiled regexes / constants are reachable.
+  check("b.codepointClass.BIDI_RE is a RegExp", b.codepointClass.BIDI_RE instanceof RegExp);
+  check("b.codepointClass.C0_CTRL_RE is a RegExp", b.codepointClass.C0_CTRL_RE instanceof RegExp);
+  check("b.codepointClass.ZERO_WIDTH_RE is a RegExp", b.codepointClass.ZERO_WIDTH_RE instanceof RegExp);
+  check("b.codepointClass.NULL_BYTE is the NUL char", b.codepointClass.NULL_BYTE === "\x00");
+
+  // Functional smoke: a bidi-override Trojan-source payload is detected; a
+  // Cyrillic confusable mixed into a Latin label is flagged.
+  var bidi = "abc" + b.codepointClass.fromCp(0x202E) + "def";
+  var issues = b.codepointClass.detectCharThreats(bidi, { bidiPolicy: "reject" }, "free-text");
+  check("public detectCharThreats flags a bidi override", issues.length >= 1 && issues[0].kind === "bidi-override");
+
+  var spoof = "pa" + b.codepointClass.fromCp(0x0443) + "pal";   // Cyrillic u (U+0443)
+  var scripts = b.codepointClass.detectMixedScripts(spoof);
+  check("public detectMixedScripts flags a Latin/Cyrillic confusable",
+        Array.isArray(scripts) && scripts.indexOf("latin") !== -1 && scripts.indexOf("cyrillic") !== -1);
+
+  // strip policy removes the override (sanitize path).
+  var cleaned = b.codepointClass.applyCharStripPolicies(bidi, { bidiPolicy: "strip" });
+  check("public applyCharStripPolicies strips the override", cleaned === "abcdef");
+
+  // The composition helpers are reachable + correct on the public surface too,
+  // so a consumer building its own screen doesn't reach into the internal path.
+  check("b.codepointClass.hex4", b.codepointClass.hex4(0x202E) === "\\u202E");
+  check("b.codepointClass.charClass",
+        b.codepointClass.charClass([0x200E, [0x202A, 0x202E]]) === "\\u200E\\u202A-\\u202E");
+  check("b.codepointClass.fromCp", b.codepointClass.fromCp(0x41) === "A");
+  check("b.codepointClass.escapeRegExp",
+        b.codepointClass.escapeRegExp("a.b*c") === "a\\.b\\*c");
+  check("b.codepointClass.isAsciiAlnum",
+        b.codepointClass.isAsciiAlnum(0x5a) === true && b.codepointClass.isAsciiAlnum(0x2d) === false);
+  check("b.codepointClass.isUnreserved",
+        b.codepointClass.isUnreserved(0x7e) === true && b.codepointClass.isUnreserved(0x2f) === false);
+  check("b.codepointClass.isForbiddenControlChar",
+        b.codepointClass.isForbiddenControlChar(0x00) === true && b.codepointClass.isForbiddenControlChar(0x41) === false);
+  check("b.codepointClass.firstControlCharOffset",
+        b.codepointClass.firstControlCharOffset("ok\x00bad") === 2 && b.codepointClass.firstControlCharOffset("clean") === -1);
+  check("b.codepointClass.decodeNumericEntities",
+        b.codepointClass.decodeNumericEntities("javascript:") === "javascript:" &&
+        b.codepointClass.decodeNumericEntities("&#106avascript:") === "javascript:");
+  // The remaining catalog constants the issue lists are reachable.
+  check("b.codepointClass.BOM_CHAR",
+        typeof b.codepointClass.BOM_CHAR === "string" && b.codepointClass.BOM_CHAR.charCodeAt(0) === 0xFEFF);
+}
+
 async function run() {
   testIsForbiddenControlChar();
   testFirstControlCharOffset();
+  testPublicSurface();
 }
 
 module.exports = { run: run };

package/lib/vendor/blamejs/test/layer-0-primitives/defineguard-default-gate-posture-caps.test.js

@@ -26,5 +26,8 @@ async function run() {
   process.stdout.write("OK — defineGuard default-gate posture-cap tests\n");
 }
 
-run().then(function () { process.exit(0); })
-     .catch(function (e) { process.stderr.write((e && e.stack ? e.stack : String(e)) + "\n"); process.exit(1); });
+module.exports = { run: run };
+if (require.main === module) {
+  run().then(function () { process.exit(0); })
+       .catch(function (e) { process.stderr.write((e && e.stack ? e.stack : String(e)) + "\n"); process.exit(1); });
+}

package/lib/vendor/blamejs/test/layer-0-primitives/dpop-middleware-replaystore-required.test.js

@@ -43,4 +43,12 @@ function run() {
   process.stdout.write("OK — dpop middleware replayStore-required tests\n");
 }
 
-run();
+module.exports = { run: run };
+if (require.main === module) {
+  // run() is synchronous here — wrap in Promise.resolve().then so the standalone
+  // CLI path works whether run is sync or async (a bare run().catch throws
+  // "Cannot read properties of undefined" on a sync run that returns undefined).
+  Promise.resolve().then(run).catch(function (e) {
+    process.stderr.write((e && e.stack ? e.stack : String(e)) + "\n"); process.exit(1);
+  });
+}

package/lib/vendor/blamejs/test/layer-0-primitives/fsm.test.js

@@ -255,6 +255,102 @@ async function testAuditEmission() {
   check("transition succeeded under best-effort audit", i.state === "paid");
 }
 
+// Tap b.audit.safeEmit (the sink namespaced(...) routes through) for the
+// duration of `fn`, returning the captured records. Restores in a finally so
+// a thrown assertion never leaves the global sink monkeypatched.
+async function _withAuditCapture(fn) {
+  var events = [];
+  var orig = b.audit.safeEmit;
+  b.audit.safeEmit = function (rec) { events.push(rec); return orig.apply(this, arguments); };
+  try {
+    await fn(events);
+    // namespaced emit fires on setImmediate via safeEmit's wrapper path — let
+    // the microtask/immediate queue flush before reading.
+    await new Promise(function (r) { setImmediate(r); });
+  } finally {
+    b.audit.safeEmit = orig;
+  }
+  return events;
+}
+
+// #345 Gap 1 — side-effect-free destination resolver. Mirrors can() but
+// returns the to-state so a consumer can build an external compare-and-swap's
+// `SET status = <to>` without calling transition() (which mutates + audits).
+async function testTargetResolver() {
+  var f = _orderFactory();
+  var i = f.create({ initialContext: {} });               // no address → ship guard refuses
+  check("target(pay) → paid",              i.target("pay") === "paid");
+  check("target(cancel) → canceled",       i.target("cancel") === "canceled");
+  check("target(ship) illegal from placed → null", i.target("ship") === null);
+  check("target(unknown) → null",          i.target("teleport") === null);
+  check("target(non-string) → null",       i.target(42) === null);
+  check("target did not mutate state",     i.state === "placed");
+  check("target did not push history",     i.history.length === 0);
+
+  await i.transition("pay");
+  // From paid: ship is guard-refused (no address) → target null, matching can().
+  check("target(ship) guard-refused → null",   i.target("ship") === null);
+  check("can(ship) guard-refused → false",     i.can("ship") === false);
+  i.context.address = "addr";
+  check("target(ship) guard-pass → shipped",   i.target("ship") === "shipped");
+  check("can/target agree after guard flip",   i.can("ship") === (i.target("ship") !== null));
+}
+
+// #345 Gap 2 — { audit: false } suppresses the built-in emit so a composition
+// driving an external claim can emit its own enriched record after the claim.
+async function testAuditSuppression() {
+  var f = _orderFactory();
+  var events = await _withAuditCapture(async function () {
+    var i = f.create({ initialContext: { address: "addr" } });
+    await i.transition("pay", { audit: false });
+    check("transition still committed under audit:false", i.state === "paid");
+  });
+  var fsmEvents = events.filter(function (e) {
+    return e && /\.transition$/.test(String(e.action || e.event || ""));
+  });
+  check("audit:false suppressed the fsm transition emit", fsmEvents.length === 0);
+
+  // Default (audit on) DOES emit.
+  var events2 = await _withAuditCapture(async function () {
+    var i2 = f.create({ initialContext: { address: "addr" } });
+    await i2.transition("pay");
+  });
+  check("default transition emits an audit record", events2.length >= 1);
+}
+
+// Hunt finding (HIGH) — a throwing onEnter commits the state change but used
+// to skip the audit emit entirely, leaving an unaudited state transition (a
+// compliance hole). The emit must still fire, stamped failure + the error.
+async function testOnEnterThrowStillAudits() {
+  var f = b.fsm.define({
+    name: "hooky", initial: "a",
+    states: { a: {}, b: { onEnter: function () { throw new Error("hook boom"); } } },
+    transitions: [ { from: "a", to: "b", on: "go" } ],
+  });
+  var events = await _withAuditCapture(async function () {
+    var i = f.create();
+    var threw = null;
+    try { await i.transition("go"); } catch (e) { threw = e; }
+    check("onEnter throw still propagates to caller", !!threw && threw.message === "hook boom");
+    check("state committed despite onEnter throw",    i.state === "b");
+    check("history recorded the transition",          i.history.length === 1);
+  });
+  var ev = events[events.length - 1] || {};
+  check("onEnter-throw now emits an audit record", events.length >= 1);
+  check("onEnter-throw audit outcome = failure",   ev.outcome === "failure");
+  check("onEnter-throw audit carries the error",
+        ev.metadata && /hook boom/.test(JSON.stringify(ev.metadata)));
+
+  // Happy path keeps outcome success.
+  var f2 = _orderFactory();
+  var okEvents = await _withAuditCapture(async function () {
+    var i = f2.create({ initialContext: { address: "addr" } });
+    await i.transition("pay");
+  });
+  check("happy-path audit outcome = success",
+        (okEvents[okEvents.length - 1] || {}).outcome === "success");
+}
+
 function testDefineBadStateName() {
   var threw = null;
   try {
@@ -358,6 +454,9 @@ async function run() {
   await testToJsonRestoreRoundtrip();
   await testConcurrentTransitionsSerialize();
   await testAuditEmission();
+  await testTargetResolver();
+  await testAuditSuppression();
+  await testOnEnterThrowStillAudits();
   testDefineBadStateName();
   testDefineBadTransitionName();
   testDefineMissingInitial();

package/lib/vendor/blamejs/test/layer-0-primitives/money.test.js

@@ -38,6 +38,36 @@ function run() {
   check("roundMinor: non-integer minor throws money/bad-minor-units",
         (function () { try { b.money.roundMinor(1.5, 5n); return null; } catch (e) { return e.code; } })()
           === "money/bad-minor-units");
+
+  // ---- Money.roundToIncrement: cash rounding on a Money value (#336) ----
+  // The issue's primary ask: snap a Money total to a coarser cash increment
+  // (Swiss Rappenrundung to 0.05, Swedish öre to 0.10, psychological steps)
+  // and get a NEW Money in the SAME currency — integer-only, negative-safe.
+  check("roundToIncrement is a Money method",
+        typeof b.money.of("12.32", "CHF").roundToIncrement === "function");
+  var chf = b.money.of("12.32", "CHF").roundToIncrement(5, { mode: "half-up" });
+  check("roundToIncrement: CHF 12.32 → nearest 0.05 half-up = 12.30",
+        chf instanceof b.money.Money && chf.toMinorUnits() === 1230n && chf.currency === "CHF");
+  check("roundToIncrement: returns same currency tag",
+        b.money.of("19.97", "SEK").roundToIncrement(10).currency === "SEK");
+  check("roundToIncrement: SEK 19.97 → nearest 0.10 (default half-even) = 20.00",
+        b.money.of("19.97", "SEK").roundToIncrement(10).toMinorUnits() === 2000n);
+  check("roundToIncrement: JPY psychological 100-step",
+        b.money.fromMinorUnits(1234n, "JPY").roundToIncrement(100, { mode: "half-up" }).toMinorUnits() === 1200n);
+  // Negative amount (refund preview) — remainder sign handled correctly.
+  check("roundToIncrement: negative CHF -12.32 half-up → -12.30",
+        b.money.of("-12.32", "CHF").roundToIncrement(5, { mode: "half-up" }).toMinorUnits() === -1230n);
+  // Modes carry through to the Money method.
+  check("roundToIncrement: floor toward -inf",
+        b.money.fromMinorUnits(27n, "USD").roundToIncrement(10, { mode: "floor" }).toMinorUnits() === 20n);
+  check("roundToIncrement: ceiling toward +inf",
+        b.money.fromMinorUnits(21n, "USD").roundToIncrement(10, { mode: "ceiling" }).toMinorUnits() === 30n);
+  check("roundToIncrement: immutable — original unchanged",
+        (function () { var m = b.money.of("12.32", "CHF"); m.roundToIncrement(5, { mode: "half-up" }); return m.toMinorUnits(); })() === 1232n);
+  check("roundToIncrement: bad mode throws money/bad-rounding-mode",
+        (function () { try { b.money.of("1.00", "CHF").roundToIncrement(5, { mode: "nope" }); return null; } catch (e) { return e.code; } })()
+          === "money/bad-rounding-mode");
+
   check("b.money.Money is the prototype",   b.money.of("1.00", "USD") instanceof b.money.Money);
   check("CURRENCIES is frozen",             Object.isFrozen(b.money.CURRENCIES));
   check("CURRENCIES.USD exponent",          b.money.CURRENCIES.USD === 2);

package/lib/vendor/blamejs/test/layer-0-primitives/otlp-attr-redaction.test.js

@@ -167,9 +167,12 @@ async function run() {
   process.stdout.write("OK — otlp attribute redaction tests\n");
 }
 
-run().then(function () {
-  process.exit(0);
-}).catch(function (e) {
-  process.stderr.write((e && e.stack ? e.stack : String(e)) + "\n");
-  process.exit(1);
-});
+module.exports = { run: run };
+if (require.main === module) {
+  run().then(function () {
+    process.exit(0);
+  }).catch(function (e) {
+    process.stderr.write((e && e.stack ? e.stack : String(e)) + "\n");
+    process.exit(1);
+  });
+}

package/lib/vendor/blamejs/test/layer-0-primitives/rate-limit-xff-spoofing.test.js

@@ -66,6 +66,42 @@ async function run() {
   var c2again = await _runMw(proxMw, _req("10.0.0.9", "203.0.113.1"));
   check("trusted proxy: client A second request blocked", c2again.next === false);
 
+  // #352 — ipKeyMode "prefix64": an IPv6 end-site owns a whole /64 and can
+  // rotate the low 64 bits freely. Under the default exact key each rotated
+  // address is a fresh bucket (the bypass); under prefix64 they share the
+  // /64 bucket, so the per-IP limit actually binds. IPv4 stays exact.
+  var v6a = "2001:db8:1:2:dead:beef:0:1";
+  var v6b = "2001:db8:1:2:ffff:ffff:ffff:ffff";   // same /64, rotated low bits
+  var v6c = "2001:db8:1:3::1";                      // different /64
+
+  // Baseline (exact): rotating the low 64 bits evades the limit.
+  var exactMw = b.middleware.rateLimit({ backend: "memory", burst: 1, refillPerSecond: 0.001 });
+  var e1 = await _runMw(exactMw, _req(v6a));
+  var e2 = await _runMw(exactMw, _req(v6b));
+  check("exact key: low-64 rotation mints a fresh bucket (the bypass)",
+        e1.next === true && e2.next === true);
+
+  // prefix64: the rotated address shares the /64 bucket → second blocked.
+  var p64Mw = b.middleware.rateLimit({ backend: "memory", burst: 1, refillPerSecond: 0.001, ipKeyMode: "prefix64" });
+  var f1 = await _runMw(p64Mw, _req(v6a));
+  var f2 = await _runMw(p64Mw, _req(v6b));
+  var f3 = await _runMw(p64Mw, _req(v6c));
+  check("prefix64: first /64 request allowed", f1.next === true);
+  check("prefix64: low-64 rotation hits the SAME /64 bucket (blocked)", f2.next === false);
+  check("prefix64: a different /64 gets its own bucket (allowed)", f3.next === true);
+
+  // prefix64 keeps IPv4 exact — two distinct IPv4 hosts are distinct buckets.
+  var p64v4 = b.middleware.rateLimit({ backend: "memory", burst: 1, refillPerSecond: 0.001, ipKeyMode: "prefix64" });
+  var g1 = await _runMw(p64v4, _req("198.51.100.10"));
+  var g2 = await _runMw(p64v4, _req("198.51.100.11"));
+  check("prefix64: distinct IPv4 hosts stay distinct (v4 exact)", g1.next === true && g2.next === true);
+
+  // Bad ipKeyMode refused at construction.
+  var threwMode = null;
+  try { b.middleware.rateLimit({ backend: "memory", burst: 1, refillPerSecond: 0.001, ipKeyMode: "bogus" }); }
+  catch (e) { threwMode = e; }
+  check("create: bad ipKeyMode refused", threwMode !== null && /ipKeyMode/.test(threwMode.message));
+
   console.log("[rate-limit-xff-spoofing] OK — " + helpers.getChecks() + " checks passed");
 }
 

package/lib/vendor/blamejs/test/layer-0-primitives/request-helpers.test.js

@@ -15,6 +15,7 @@ function testSurface() {
   check("b.requestHelpers exposed",                  typeof b.requestHelpers === "object");
   check("resolveRoute is a function",                typeof b.requestHelpers.resolveRoute === "function");
   check("captureResponseStatus is a function",       typeof b.requestHelpers.captureResponseStatus === "function");
+  check("ipKey is a function",                       typeof b.requestHelpers.ipKey === "function");
 }
 
 function testResolveRoutePrefersRoutePattern() {
@@ -460,10 +461,42 @@ function testIpPrefixMasking() {
   check("ipPrefix rejects an out-of-range v4 octet", ip("999.0.0.1") === "");
 }
 
+// #352 — ipKey: IPv4 verbatim (exact host), IPv6 collapsed to /64 so one
+// end-site can't rotate the low 64 bits to mint unlimited rate-limit keys.
+function testIpKeyForRateLimit() {
+  var k = b.requestHelpers.ipKey;
+  check("ipKey is a function", typeof k === "function");
+  // IPv4 kept exact (no /24 masking, no /32 suffix) — one IPv4 is one host.
+  check("ipKey v4 exact verbatim", k("203.0.113.47") === "203.0.113.47");
+  check("ipKey v4 distinct hosts → distinct keys", k("203.0.113.47") !== k("203.0.113.48"));
+  // IPv6 → /64; rotating the low 64 bits yields the SAME key (the defense).
+  var k64 = k("2001:db8:1:2:dead:beef:0:1");
+  check("ipKey v6 → /64 suffix, low bits zeroed",
+        /\/64$/.test(k64) && k64.indexOf("dead") === -1);
+  check("ipKey v6 low-64 rotation → same key (rotation defeated)",
+        k("2001:db8:1:2:dead:beef:0:1") === k("2001:db8:1:2:ffff:ffff:ffff:ffff"));
+  check("ipKey v6 different /64 → different key",
+        k("2001:db8:1:2::1") !== k("2001:db8:1:3::1"));
+  // Configurable width.
+  check("ipKey v6 ipv6Bits=48 widens the bucket", /\/48$/.test(k("2001:db8:1:2::1", { ipv6Bits: 48 })));
+  // IPv4-mapped IPv6 folds to its exact dotted host.
+  check("ipKey folds ::ffff: mapped v4 to the exact v4 host",
+        k("::ffff:203.0.113.47") === "203.0.113.47");
+  // Defensive defaults — never throws, "" on bad input (caller falls back).
+  check("ipKey '' for non-string", k(null) === "" && k(12345) === "");
+  check("ipKey '' for empty", k("") === "");
+  check("ipKey '' for unparseable", k("not-an-ip") === "");
+  check("ipKey '' for out-of-range v4 octet", k("999.0.0.1") === "");
+  // Distinct from ipPrefix: ipKey keeps v4 exact where ipPrefix masks to /24.
+  check("ipKey v4 != ipPrefix v4 (exact vs /24)",
+        k("203.0.113.47") !== b.requestHelpers.ipPrefix("203.0.113.47"));
+}
+
 async function run() {
   testSurface();
   testSafeHeadersDistinct();
   testIpPrefixMasking();
+  testIpKeyForRateLimit();
   testClientIpDefaultIgnoresXff();
   testClientIpPeerGatedTrustedPeer();
   testClientIpPeerGatedUntrustedPeerIgnoresXff();

package/lib/vendor/blamejs/test/layer-0-primitives/request-id-async-context.test.js

@@ -0,0 +1,117 @@
+"use strict";
+/**
+ * b.middleware.requestId({ asyncContext: true }) — #353.
+ *
+ * The b.router dispatch model is boolean-`next`: the router awaits each
+ * middleware, then runs the route handler in its own loop AFTER the middleware
+ * returns. A middleware that wraps `next()` in an AsyncLocalStorage callback
+ * (`als.run(store, () => next())`) therefore loses the binding the instant
+ * `next()` returns — before any awaited handler code runs — so
+ * `b.log.getRequestId()` reads null inside the handler. asyncContext:true binds
+ * the id with `AsyncLocalStorage.enterWith` (via b.log.enterRequestId) so it
+ * persists forward across the awaited route chain, while each request stays
+ * isolated because the HTTP server runs each request in its own async context.
+ *
+ * Every request below goes through a real http.Server so the enterWith binding
+ * is scoped to the request's own async context (driving app.handle() directly
+ * from the test would leak the binding into the test runner's context — the
+ * exact non-isolated manual-dispatch case enterWith is NOT meant for).
+ */
+
+var helpers = require("../helpers");
+var http    = require("node:http");
+var b       = helpers.b;
+var check   = helpers.check;
+
+// Spin up a one-route app on an ephemeral port, fire a single GET with the
+// given inbound id, resolve { body, hdr }, then close the server.
+function _serveOnce(mwOpts, id) {
+  var app = b.router.create();
+  app.use(b.middleware.requestId(mwOpts));
+  app.get("/x", async function (req, res) {
+    // Cross an event-loop turn (a real awaited gap) before reading the ALS, so
+    // this exercises the boolean-next-dispatch survival the issue is about.
+    await new Promise(function (r) { setImmediate(r); });
+    res.end(JSON.stringify({ reqField: req.requestId, als: b.log.getRequestId() }));
+  });
+  var srv = http.createServer(function (req, res) { app.handle(req, res); });
+  return new Promise(function (resolve, reject) {
+    srv.listen(0, function () {
+      var port = srv.address().port;
+      http.get({ port: port, path: "/x", agent: false, headers: id ? { "x-request-id": id } : {} }, function (r) {
+        var d = ""; r.on("data", function (c) { d += c; });
+        // Await the server close so the listening handle is released before the
+        // test resolves — a fire-and-forget srv.close() leaves a TCPServerWrap
+        // lingering (the leak the harness audit flags).
+        r.on("end", function () { srv.close(function () { resolve({ body: JSON.parse(d), hdr: r.headers["x-request-id"] }); }); });
+      }).on("error", function (e) { srv.close(function () { reject(e); }); });
+    });
+  });
+}
+
+function testSurface() {
+  check("b.log.enterRequestId is a function", typeof b.log.enterRequestId === "function");
+  check("requestId factory is a function",    typeof b.middleware.requestId === "function");
+}
+
+// asyncContext:true binds the id into the log ALS so an awaited handler reads
+// it via b.log.getRequestId().
+async function testAsyncContextBindsAls() {
+  var r = await _serveOnce({ asyncContext: true }, "abcdefgh-async-1");
+  check("asyncContext: req.requestId set",                       r.body.reqField === "abcdefgh-async-1");
+  check("asyncContext: getRequestId() works in awaited handler", r.body.als === "abcdefgh-async-1");
+  check("asyncContext: response header reflected",               r.hdr === "abcdefgh-async-1");
+}
+
+// Default mode binds nothing — req.requestId is set but the ALS stays null.
+async function testDefaultModeDoesNotBindAls() {
+  var r = await _serveOnce({}, "plain-no-async-2");
+  check("default: req.requestId still set", r.body.reqField === "plain-no-async-2");
+  check("default: ALS NOT bound (null)",    r.body.als === null);
+}
+
+// The correctness crux: concurrent requests through a real server each see
+// their OWN id via the ALS, with no cross-request bleed.
+async function testConcurrentRequestsIsolated() {
+  var app = b.router.create();
+  app.use(b.middleware.requestId({ asyncContext: true }));
+  app.get("/x", async function (req, res) {
+    // A real awaited gap; the concurrency comes from the concurrent http.get
+    // calls below (each request its own async context on a real server).
+    await new Promise(function (r) { setImmediate(r); });
+    res.end(JSON.stringify({ als: b.log.getRequestId() }));
+  });
+  var srv = http.createServer(function (req, res) { app.handle(req, res); });
+  await new Promise(function (r) { srv.listen(0, r); });
+  var port = srv.address().port;
+  function get(id) {
+    return new Promise(function (resolve) {
+      http.get({ port: port, path: "/x", agent: false, headers: { "x-request-id": id } }, function (r) {
+        var d = ""; r.on("data", function (c) { d += c; });
+        r.on("end", function () { resolve({ id: id, body: JSON.parse(d), hdr: r.headers["x-request-id"] }); });
+      });
+    });
+  }
+  var results = await Promise.all([
+    get("req-AAAAAA01"), get("req-BBBBBB02"), get("req-CCCCCC03"),
+    get("req-DDDDDD04"), get("req-EEEEEE05"),
+  ]);
+  await new Promise(function (r) { srv.close(r); });   // release the listening handle
+  var allIsolated = results.every(function (r) { return r.body.als === r.id; });
+  check("concurrent: every request's ALS id is its own (no bleed)", allIsolated);
+  var hdrsMatch = results.every(function (r) { return r.hdr === r.id; });
+  check("concurrent: every response header matches its request", hdrsMatch);
+}
+
+async function run() {
+  testSurface();
+  await testAsyncContextBindsAls();
+  await testDefaultModeDoesNotBindAls();
+  await testConcurrentRequestsIsolated();
+}
+
+module.exports = { run: run };
+if (require.main === module) {
+  run().then(function () { console.log("OK"); })
+       .catch(function (e) { console.error(e); process.exit(1); });
+}

package/lib/vendor/blamejs/test/layer-0-primitives/safe-path.test.js

@@ -65,6 +65,68 @@ function testErrorClassExported() {
   check("SafePathError exported", typeof b.safePath.SafePathError === "function");
 }
 
+// #371 — opts.platform gates the per-segment naming rules AND the lexical
+// containment resolution. The lexical resolve + boundary use the TARGET
+// platform's path module (nodePath.win32 / nodePath.posix) so the resolved
+// output's separator matches the boundary slice. Validating against the
+// OPPOSITE platform's rules (the recommended cross-platform pattern) used to
+// refuse every in-base path with safe-path/escapes-base because the boundary
+// slice compared the runtime-separated nodePath.resolve output against the
+// opts.platform separator. With target-platform resolution the in-base path is
+// accepted AND a genuine traversal is still refused under any override.
+function testCrossPlatformContainment() {
+  var nodePath = require("node:path");
+  var other = process.platform === "win32" ? "linux" : "windows";
+  var pathMod = other === "windows" ? nodePath.win32 : nodePath.posix;
+  // Drive-prefixed base on Windows, posix base elsewhere.
+  var base = process.platform === "win32" ? "C:/srv/uploads" : "/srv/uploads";
+
+  var inBase = b.safePath.resolveOrNull(base, "file.txt", { platform: other });
+  check("opposite-platform override resolves an in-base file (not null)",
+    typeof inBase === "string" && inBase.indexOf("file.txt") !== -1);
+  var nested = b.safePath.resolveOrNull(base, "a/b/file.txt", { platform: other });
+  check("opposite-platform override resolves a nested in-base path",
+    typeof nested === "string" && nested.indexOf("file.txt") !== -1);
+  var v = b.safePath.validate(base, "data/x.json", { platform: other });
+  check("opposite-platform override validate() ok=true", v.ok === true && typeof v.resolved === "string");
+  // Containment is still ENFORCED under the override — a real traversal refused.
+  check("opposite-platform override still refuses a forward-slash traversal",
+    b.safePath.resolveOrNull(base, "../../etc/passwd", { platform: other }) === null);
+  // The containment boundary uses the TARGET platform's separator, so the
+  // resolved path begins with the target-resolved base.
+  check("resolved path begins with the target-resolved base",
+    typeof inBase === "string" && inBase.indexOf(pathMod.resolve(base)) === 0);
+}
+
+// #371 P1 — cross-platform backslash traversal. A POSIX host validating with
+// opts.platform: "windows" must collapse Windows separators (\) and `..` the
+// SAME way the per-segment walk does. The lexical resolve previously used the
+// runtime path module: on POSIX, node:path treats \ as an ordinary filename
+// character, so `ok\..\..\outside` slipped past containment and resolved to
+// `<base>/ok\..\..\outside` — a path that escapes the base once a Windows
+// consumer interprets the backslashes. Validating FOR windows now resolves with
+// nodePath.win32 on every host, so the traversal is refused. (On a Windows host
+// win32 IS the runtime, so this also guards the same case there.)
+function testCrossPlatformBackslashTraversalRefused() {
+  var BS = String.fromCharCode(92); // backslash without source-escaping ambiguity
+  var base = "/srv/uploads";
+  var trav = "ok" + BS + ".." + BS + ".." + BS + "outside"; // ok\..\..\outside
+  check("windows-target backslash traversal refused (resolveOrNull → null)",
+    b.safePath.resolveOrNull(base, trav, { platform: "windows" }) === null);
+  var v = b.safePath.validate(base, trav, { platform: "windows" });
+  check("windows-target backslash traversal refused (validate ok=false)",
+    v.ok === false && v.code === "safe-path/escapes-base");
+  var threw = false, code = null;
+  try { b.safePath.resolve(base, trav, { platform: "windows" }); }
+  catch (e) { threw = true; code = e && e.code; }
+  check("windows-target backslash traversal refused (resolve throws escapes-base)",
+    threw === true && code === "safe-path/escapes-base");
+  // A nested-but-in-base Windows path with backslashes still resolves.
+  var ok = b.safePath.resolveOrNull(base, "a" + BS + "b" + BS + "c.txt", { platform: "windows" });
+  check("windows-target in-base backslash path resolves",
+    typeof ok === "string" && ok.indexOf("c.txt") !== -1);
+}
+
 function run() {
   testHappyPath();
   testRefusalClasses();
@@ -72,6 +134,8 @@ function run() {
   testResolveOrNullReturnsNull();
   testValidateReturnsVerdict();
   testErrorClassExported();
+  testCrossPlatformContainment();
+  testCrossPlatformBackslashTraversalRefused();
 }
 
 if (require.main === module) run();