@blamejs/blamejs-shop 0.4.91 → 0.4.93

package/lib/vendor/blamejs/lib/ws-client.js

@@ -64,7 +64,33 @@ var structuredFields = require("./structured-fields");
 var C              = require("./constants");
 var { defineClass } = require("./framework-error");
 
-var WsClientError = defineClass("WsClientError", { alwaysPermanent: true });
+// Codes that are TRANSIENT — a consumer's reconnect loop (and the client's own
+// auto-reconnect) SHOULD retry. Everything else is terminal: a bad URL / config
+// error, a 4xx handshake rejection, an accept-mismatch, or a protocol-violation
+// / oversized / malicious frame, where redialing the same hopeless target
+// forever is the worse failure. bad-status is split by status below (5xx
+// transient, 4xx terminal). Default-terminal so a new/forgotten code fails
+// closed (no infinite redial) rather than open.
+var WS_TRANSIENT_CODES = {
+  "ws-client/handshake-timeout": true,   // server slow to complete the upgrade
+  "ws-client/pong-timeout":      true,   // keepalive lapse on an otherwise-live link
+};
+
+function _wsErrorIsPermanent(code, statusCode) {
+  if (code === "ws-client/bad-status") {
+    // 5xx handshake rejection is transient (server overloaded / restarting);
+    // 4xx (and any non-5xx) is terminal (auth / bad request / not-found).
+    return !(typeof statusCode === "number" && statusCode >= 500 && statusCode < 600);
+  }
+  // hasOwnProperty membership so a code of "__proto__" / "constructor" can't
+  // index the prototype and be misread as transient.
+  return !Object.prototype.hasOwnProperty.call(WS_TRANSIENT_CODES, code);
+}
+
+// permanent is DERIVED per-error from the code (+ status) at every construction
+// — so err.permanent is a usable terminal/transient signal for a consumer's
+// reconnect loop, not a blanket sentinel. Constructor: (code, message, status).
+var WsClientError = defineClass("WsClientError", { permanentClassifier: _wsErrorIsPermanent });
 
 var WS_GUID = "258EAFA5-E914-47DA-95CA-C5AB0DC85B11";   // RFC 6455 §1.3
 
@@ -88,33 +114,15 @@ var CLOSE_NORMAL          = 1000;                        // RFC 6455 close code
 var CLOSE_GOING_AWAY      = 1001;                        // RFC 6455 close code
 var CLOSE_ABNORMAL        = 1006;                        // RFC 6455 close code (synthetic — never on wire)
 
-// Permanent vs transient error classifier — used by reconnect logic
-// so client doesn't hammer the server on credentials / handshake
-// errors that won't resolve by retrying.
-var PERMANENT_CODES = {
-  "ws-client/bad-url":              true,
-  "ws-client/bad-status":           true,           // HTTP 4xx during handshake
-  "ws-client/accept-mismatch":      true,
-  "ws-client/bad-upgrade":          true,
-  "ws-client/bad-status-line":      true,
-  "ws-client/bad-subprotocol":      true,
-  "ws-client/bad-header":           true,
-  "ws-client/handshake-too-large":  true,
-  "ws-client/control-too-big":      true,
-  "ws-client/control-fragmented":   true,
-  "ws-client/protocol-error":       true,
-  "ws-client/invalid-utf8":         true,
-  "ws-client/rsv1-on-continuation": true,
-  "ws-client/message-too-big":      true,
-  "ws-client/deflate-error":        true,
-  "ws-client/payload-too-big":      true,
-};
-
+// Permanent vs transient classifier for the reconnect logic. WsClientError now
+// carries a per-code permanent flag (see _wsErrorIsPermanent), so this reads it
+// directly. A raw socket error (ECONNRESET / ECONNREFUSED mid-dial, no
+// .permanent) is treated as transient — the connection dropped, retrying (up to
+// reconnect.maxAttempts) is correct. Previously WsClientError was alwaysPermanent
+// so this returned true for EVERY framework error, silently disabling the
+// advertised auto-reconnect for transient handshake/keepalive failures.
 function _isPermanentError(err) {
-  if (!err) return false;
-  if (err.permanent === true) return true;            // defineClass-marked
-  if (err.code && PERMANENT_CODES[err.code]) return true;
-  return false;
+  return !!(err && err.permanent === true);
 }
 
 // Synchronous bounded inflate — runs zlib.inflateRawSync with
@@ -513,8 +521,11 @@ class WsClient extends EventEmitter {
       // the message string.
       var bodyText = "";
       try { bodyText = rest.toString("utf8"); } catch (_e) { /* drop-silent */ }
+      // Pass status as the 3rd arg so the classifier derives permanent from it
+      // (4xx terminal, 5xx transient) and statusCode is set; keep .status as the
+      // pre-existing alias callers may already read.
       var statusErr = new WsClientError("ws-client/bad-status",
-        "handshake response status was " + status + " (expected 101 Switching Protocols)");
+        "handshake response status was " + status + " (expected 101 Switching Protocols)", status);
       statusErr.status = status;
       statusErr.body = bodyText;
       this._handleSocketError(statusErr);

package/lib/vendor/blamejs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.15.20",
+  "version": "0.15.23",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/lib/vendor/blamejs/release-notes/v0.15.21.json

@@ -0,0 +1,51 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.15.21",
+  "date": "2026-06-24",
+  "headline": "Adds a portable compare-and-swap UPDATE, an IPv6 /64 rate-limit key, a verify-only legacy-TOTP path, request-id AsyncLocalStorage scoping, schema-agnostic backup signing, side-effect-free FSM transition resolution, and the public codepoint-threat catalog — and fixes an FSM state transition that committed without an audit record when its entry hook threw",
+  "summary": "A batch of additive primitives that close gaps operators hit composing the framework: b.sql.guardedUpdate builds the cross-instance-safe compare-and-swap UPDATE (the conditional-INSERT sibling) with b.sql.casWon reading the won/lost result; b.requestHelpers.ipKey (and a rateLimit ipKeyMode) key an IPv6 client by its routing-significant /64 so one end-site can't rotate the low 64 bits to evade a per-IP limit; b.auth.totp gains an opt-in verify-only SHA-1 path for one-final-login legacy-secret migration while generation stays SHA-512-only; b.middleware.requestId can bind the id into an AsyncLocalStorage scope that survives the awaited route chain; b.backupManifest.signBytes/verifyBytes authenticate a consumer's own canonical bytes with the framework signing key; b.fsm gains a side-effect-free instance.target() and a way to defer its transition audit when composed with an external claim; and the codepoint-threat catalog the guard family composes is exposed as b.codepointClass. A correctness fix: an FSM transition whose onEnter hook threw left the state committed but emitted no audit record — the record now always fires (stamped a failure outcome with the hook error) so a state change is never unaudited.",
+  "sections": [
+    {
+      "heading": "Added",
+      "items": [
+        {
+          "title": "b.sql.guardedUpdate + b.sql.casWon — portable compare-and-swap UPDATE",
+          "body": "b.sql.guardedUpdate(table) builds an UPDATE whose required guardWhere(col, expected) fence makes it land only when the row is still in the expected value — the cross-instance-safe way to advance a status or version on a single-statement-per-request backend (a D1-over-HTTP bridge or any autocommit-only adapter without interactive transactions), and the conditional-UPDATE sibling of b.sql.insertSelectWhere. It refuses to render without a fence (an unfenced guardedUpdate is just a plain update). b.sql.casWon(result) reads the won/lost verdict from the affected-row count, normalizing the rowCount / changes / affectedRows field-name divergence across adapters and throwing on an indeterminate result so a phantom win can't ship. Standard SQL across SQLite / Postgres / MySQL; guardWhereOp(col, op, expected) supports a non-equality fence (an optimistic-version or balance guard), and a null fence renders IS NULL."
+        },
+        {
+          "title": "b.requestHelpers.ipKey + rateLimit ipKeyMode — IPv6 /64 keying",
+          "body": "b.requestHelpers.ipKey(ip, { ipv6Bits }) derives a stable rate-limit / blocklist key: an IPv4 address verbatim (one IPv4 is one host) but an IPv6 address collapsed to its routing-significant /64 prefix. A single IPv6 end-site is allocated a whole /64 (RFC 6177 / RFC 4291) and freely rotates the low 64 bits, so keying on the full 128-bit address lets one site mint unlimited fresh keys and walk a per-IP throttle or evade an exact-address block; keying on the /64 closes that while still distinguishing real end-sites. b.middleware.rateLimit gains ipKeyMode: \"prefix64\" to apply this to its default key (the audit record still logs the full client IP)."
+        },
+        {
+          "title": "b.auth.totp verify-only SHA-1 path for legacy-secret migration",
+          "body": "b.auth.totp.verify(secret, code, { algorithm: \"sha1\", verifyOnly: true }) authenticates a single legacy code during a re-enrollment flow, so a consumer migrating pre-existing RFC-6238-default (SHA-1) secrets can reuse the maintained verifier — separator stripping, 64-bit counter, drift / replay semantics — instead of hand-rolling a parallel HOTP. SHA-1 is still refused on every generation path (compute / generate / uri), so new-enrollment posture stays SHA-512-only, and the flag is honored only by verify(); each such verification emits an auth.totp.legacy_sha1_verify audit signal."
+        },
+        {
+          "title": "b.middleware.requestId AsyncLocalStorage scoping",
+          "body": "b.middleware.requestId({ asyncContext: true }) binds the request id into the framework's AsyncLocalStorage scope so b.log.getRequestId() (and every b.log.create-built logger) returns it inside awaited route-handler code, not just on req.requestId. Because the b.router dispatch model runs the route handler after the middleware returns, the binding uses AsyncLocalStorage.enterWith (which persists forward across the awaited chain) rather than a callback wrap that would close before the handler runs; each request runs in its own async context so the binding stays request-scoped. The underlying b.log.enterRequestId(id) is exposed for callers wiring their own middleware."
+        },
+        {
+          "title": "b.backupManifest.signBytes / verifyBytes — schema-agnostic signing",
+          "body": "b.backupManifest.signBytes(canonicalBytes) and verifyBytes(canonicalBytes, signatureBlock, { expectedFingerprint }) sign and verify a consumer's own canonical bytes with the same audit-sign keypair and fingerprint pinning as the v1-manifest sign() / verifySignature(), without adopting the framework's manifest schema — so a bespoke backup-header format can authenticate itself against the framework signing key. Fingerprint pinning is bound to the key the signature actually verifies under: the pin is checked against the fingerprint recomputed from the signature block's own public key (the new b.auditSign.fingerprintOf(publicKeyPem) helper), not the block's self-asserted fingerprint field, so a block can't claim a trusted fingerprint while being signed by a different key. The same binding now also applies to the v1-manifest verifySignature(). b.auditSign.verify additionally no longer requires init() when given an explicit public key, so a downstream verifier that holds only a trusted public key can check a detached signature."
+        },
+        {
+          "title": "b.fsm side-effect-free transition resolution + deferrable audit",
+          "body": "instance.target(event) resolves a transition's destination state side-effect-free — the same edge and guard check as can() but returning the to-state (or null when the edge is illegal or guard-refused) — so a consumer composing an external compare-and-swap (b.sql.guardedUpdate on an autocommit-only substrate) can build the SET status = <to> claim without calling transition(), which would mutate state and emit an audit before the cross-instance claim is known to land. transition(event, { audit: false }) suppresses the built-in emit so that composition can emit its own enriched record once the claim resolves."
+        },
+        {
+          "title": "b.codepointClass — the codepoint-threat catalog on the public surface",
+          "body": "The Unicode bidi-override / C0-control / zero-width / null-byte / Unicode-Tags tables and the UTS #39 confusable-script detector that the b.guard* family composes internally are now exposed as b.codepointClass, so a consumer can build a custom unconstrained-free-text screen — detectCharThreats / assertNoCharThreats / applyCharStripPolicies / scriptFor / detectMixedScripts plus the compiled regexes — without re-rolling the regexes (where the zero-width class is mistyped and the astral Unicode-Tags block forgotten) or coupling to an internal module path. For a ready-made free-text guard, b.guardText remains the first-class entry point."
+        }
+      ]
+    },
+    {
+      "heading": "Fixed",
+      "items": [
+        {
+          "title": "An FSM transition committed its state change without an audit record when the entry hook threw",
+          "body": "b.fsm commits the new state and pushes the history entry before running the destination state's onEnter hook. When that hook threw, control skipped the audit emission entirely — leaving a committed state transition with no audit record, a compliance gap for any regime that requires state changes to be auditable. The transition audit now always fires even when onEnter throws: it records the committed transition stamped with a failure outcome and the hook error, and still re-raises the error to the caller (the documented contract that an onEnter throw surfaces so the operator can roll back is unchanged)."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/release-notes/v0.15.22.json

@@ -0,0 +1,18 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.15.22",
+  "date": "2026-06-24",
+  "headline": "Internal test-harness reliability only — the published library is byte-for-byte identical to 0.15.21",
+  "summary": "This release changes only the repository's own test harness and test files; nothing under the shipped tarball (index.js, bin/, lib/) is touched, so the API, behavior, and published files are identical to 0.15.21 and operators have nothing to do. The smoke worker now attributes a fire-and-forget failure — an unawaited promise or an unreleased handle (a retry timer, a shutdown wait, a watcher/reload restart) that throws AFTER a test's assertions already passed — to the exact test that caused it and retries it once, instead of the prior unattributable, intermittent failure that only surfaced on a resource-starved CI runner. Five test files that invoked their run() at module scope (re-running and, in some cases, exiting the worker before it could report a result) are corrected to run only under require.main === module, and a test-discipline check keeps the pattern from returning. An opt-in handle-leak audit (SMOKE_AUDIT_HANDLES) surfaces tests that hold a timer / socket / server / worker past completion, for a follow-up cleanup pass.",
+  "sections": [
+    {
+      "heading": "Changed",
+      "items": [
+        {
+          "title": "Smoke test harness attributes late-async-error failures and fixes module-level test self-execution",
+          "body": "The forked smoke worker installs unhandledRejection / uncaughtException handlers and a settle tick so a failure that fires after a test's assertions pass — a leaked handle's callback or an unawaited promise from retry / shutdown / reload logic — is reported against the test that caused it and retried once (a transient passes, a persistent one fails again and names the bug), replacing the prior intermittent, unattributable 'fork failed' that only appeared on a starved CI runner. Five test files (two integration, three layer-0, plus two wiki-suite harnesses) that called run() at module scope are corrected to execute only under require.main === module so they no longer double-run or exit the worker prematurely when required, and a codebase-patterns test-discipline detector prevents the unguarded-module-level-run shape from recurring. A SMOKE_AUDIT_HANDLES opt-in reports per-file handle leaks for a tracked cleanup. None of this is in the published package."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/release-notes/v0.15.23.json

@@ -0,0 +1,22 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.15.23",
+  "date": "2026-06-24",
+  "headline": "`b.wsClient` error objects now carry a usable terminal-vs-transient signal (and the client's auto-reconnect, previously dead, works again), and `b.safePath` resolves cross-platform containment with the target platform's path semantics — fixing both a false refusal of in-base paths and a backslash-traversal escape when validating for Windows on a POSIX host",
+  "summary": "Two correctness fixes. b.wsClient marked every WsClientError permanent, so a consumer driving its own reconnect loop could not tell a terminal handshake failure (a bad URL, a 4xx rejection, an accept-mismatch, a protocol-violation frame) from a transient one (a 5xx handshake rejection, a pong/handshake timeout, a dropped socket) and had to re-derive the taxonomy from error codes. err.permanent now reflects the actual transience of each error, the single bad-status code is split by the carried HTTP status (4xx terminal, 5xx transient) with the status exposed as err.statusCode, and — because the client's own auto-reconnect keyed off the same always-true flag — auto-reconnect was silently disabled for every transient failure and now fires correctly. Separately, b.safePath.resolve / resolveOrNull / validate performed its lexical containment with the runtime path module while the per-segment naming walk used opts.platform. The two disagreeing broke cross-platform validation both ways: every legitimate in-base path was refused with safe-path/escapes-base when opts.platform differed from the host, and — more seriously — a POSIX host validating opts.platform: \"windows\" accepted a backslash traversal (ok\\..\\..\\outside), because the runtime resolver treats \\ as an ordinary filename character and never collapsed the .. segments, so the path escaped the base once a Windows consumer read the backslashes. The lexical resolve and containment boundary now use the target platform's path module (node:path.win32 / node:path.posix), matching the segment walk, so in-base paths resolve and cross-platform traversals are refused under any opts.platform override; the realpath check, which touches the live filesystem, keeps its runtime resolve.",
+  "sections": [
+    {
+      "heading": "Fixed",
+      "items": [
+        {
+          "title": "b.wsClient: WsClientError carries a real terminal/transient signal, and auto-reconnect works again",
+          "body": "WsClientError was declared always-permanent, so err.permanent was true for every error — a consumer's reconnect loop could not distinguish a terminal handshake failure (bad URL, bad subprotocol, malformed handshake header, accept-mismatch, bad upgrade, bad status line, a 4xx rejection, an oversized/protocol-violation frame) from a transient one (a 5xx handshake rejection, a pong- or handshake-timeout, a dropped socket) and had to maintain its own error-code list tracking the framework's taxonomy. err.permanent now reflects each error's actual transience, derived from its code (a new/unknown code defaults to terminal, so it fails closed rather than redialing a hopeless target forever); the single ws-client/bad-status code is split by the response status (4xx terminal, 5xx transient) and the status is exposed as err.statusCode (the existing err.status alias is preserved). The same always-permanent flag also drove the client's built-in auto-reconnect, which therefore never retried any framework-surfaced transient failure (a 5xx handshake or a keepalive timeout); reconnect now fires for transient failures and still skips terminal ones."
+        },
+        {
+          "title": "b.safePath: cross-platform containment resolves with the target platform's path semantics",
+          "body": "b.safePath.resolve / resolveOrNull / validate performed its lexical containment (resolve rel under base, then bound the result with a separator slice) using the runtime path module, while the per-segment naming walk used opts.platform. When the two disagreed, validation broke both ways. Benign direction: a Linux service validating server-origin names against the stricter Windows ruleset (the recommended cross-platform pattern) had every legitimate in-base path refused with safe-path/escapes-base, because the runtime-separated resolved path could never match a Windows-separator boundary. Security direction: a POSIX host validating opts.platform: \"windows\" accepted a backslash traversal such as ok\\..\\..\\outside — the segment walk splits on \\ for Windows, but the runtime resolver on POSIX treats \\ as an ordinary filename character and never collapsed the .. segments, so the path passed containment and resolved to <base>/ok\\..\\..\\outside, which escapes the base once a Windows consumer interprets the backslashes. The lexical resolve and the containment boundary now use the target platform's path module (node:path.win32 when validating for Windows, node:path.posix otherwise), matching the segment walk, so in-base paths resolve correctly and a genuine traversal is refused under any opts.platform override. The realpath check, which resolves symlinks on the live filesystem, keeps a separate runtime resolve because a foreign-platform path cannot be symlink-resolved on the host. opts.platform continues to gate the per-segment naming rules (reserved names, trailing dot/space, NTFS ADS colon)."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/test/00-primitives.js

@@ -944,6 +944,85 @@ function testAuthTotpBadAlgorithmRejected() {
         threwSha1 && threwSha1.code === "auth-totp/bad-alg");
 }
 
+// #354 — verify-only SHA-1 path for legacy-secret migration. SHA-1 stays
+// refused on every generation path (compute/generate/uri); verify() accepts
+// it ONLY when the caller passes { verifyOnly: true }, so a consumer can
+// authenticate a final legacy code during re-enrollment without hand-rolling
+// a parallel HOTP that drifts from the maintained verifier.
+function testAuthTotpVerifyOnlySha1() {
+  var t = b.auth.totp;
+  // RFC 6238 Appendix B SHA-1 key K = ASCII("12345678901234567890") (20 B)
+  // and its 8-digit reference codes.
+  var KEY_SHA1 = "GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ";
+  var nowMs    = 59 * 1000;                 // RFC T=59
+  var stepAt59 = Math.floor(59 / 30);       // = 1
+
+  // GREEN: verify-only SHA-1 authenticates the RFC vector.
+  var matched = t.verify(KEY_SHA1, "94287082", {
+    algorithm: "sha1", verifyOnly: true, digits: 8, driftSteps: 0, now: nowMs,
+  });
+  check("verify-only SHA-1 accepts RFC 6238 vector T=59", matched === stepAt59);
+
+  // Separator stripping / maintained verifier semantics carry over.
+  check("verify-only SHA-1 strips paste separators",
+        t.verify(KEY_SHA1, "9428-7082", {
+          algorithm: "sha1", verifyOnly: true, digits: 8, driftSteps: 0, now: nowMs,
+        }) === stepAt59);
+  check("verify-only SHA-1 rejects a wrong code",
+        t.verify(KEY_SHA1, "00000000", {
+          algorithm: "sha1", verifyOnly: true, digits: 8, now: nowMs,
+        }) === false);
+
+  // verify() with sha1 but WITHOUT verifyOnly must THROW bad-alg — never a
+  // silent accept, so a config typo can't quietly downgrade the verifier.
+  var threw = null;
+  try {
+    t.verify(KEY_SHA1, "94287082", { algorithm: "sha1", digits: 8, now: nowMs });
+  } catch (e) { threw = e; }
+  check("verify(sha1) without verifyOnly throws bad-alg",
+        threw && threw.code === "auth-totp/bad-alg");
+
+  // Every generation path refuses SHA-1 even with verifyOnly:true — the flag
+  // is meaningless outside verify(); new-enrollment posture stays SHA-512.
+  threw = null;
+  try { t.compute(KEY_SHA1, stepAt59, { algorithm: "sha1", verifyOnly: true, digits: 8 }); }
+  catch (e) { threw = e; }
+  check("compute refuses sha1 even with verifyOnly:true",
+        threw && threw.code === "auth-totp/bad-alg");
+
+  threw = null;
+  try { t.generate(KEY_SHA1, { algorithm: "sha1", verifyOnly: true }); }
+  catch (e) { threw = e; }
+  check("generate refuses sha1 even with verifyOnly:true",
+        threw && threw.code === "auth-totp/bad-alg");
+
+  threw = null;
+  try { t.uri(KEY_SHA1, "alice@example.com", { issuer: "X", algorithm: "sha1", verifyOnly: true }); }
+  catch (e) { threw = e; }
+  check("uri refuses sha1 even with verifyOnly:true",
+        threw && threw.code === "auth-totp/bad-alg");
+
+  // Replay defense (lastUsedStep) still binds on the legacy path.
+  check("verify-only SHA-1 honors the replay guard",
+        t.verify(KEY_SHA1, "94287082", {
+          algorithm: "sha1", verifyOnly: true, digits: 8, driftSteps: 0,
+          now: nowMs, lastUsedStep: stepAt59,
+        }) === false);
+
+  // A still-unsupported generation algorithm (md5) is not silently allowed by
+  // verifyOnly — only the curated VERIFY_ONLY_ALGORITHMS set (sha1) is.
+  threw = null;
+  try { t.verify(KEY_SHA1, "94287082", { algorithm: "md5", verifyOnly: true, digits: 8, now: nowMs }); }
+  catch (e) { threw = e; }
+  check("verify-only does not widen to md5 (only the curated set)",
+        threw && threw.code === "auth-totp/bad-alg");
+
+  check("auth.totp.VERIFY_ONLY_ALGORITHMS = [sha1]",
+        Array.isArray(t.VERIFY_ONLY_ALGORITHMS) &&
+        t.VERIFY_ONLY_ALGORITHMS.length === 1 &&
+        t.VERIFY_ONLY_ALGORITHMS[0] === "sha1");
+}
+
 function testAuthTotpSurface() {
   var t = b.auth.totp;
   check("auth.totp namespace present",                   typeof b.auth.totp === "object");
@@ -18260,6 +18339,7 @@ async function run() {
   testAuthTotpUriShape();
   testAuthTotpBackupCodes();
   testAuthTotpBadAlgorithmRejected();
+  testAuthTotpVerifyOnlySha1();
   // auth.passkey — WebAuthn
   await testAuthPasskeySurface();
   await testAuthPasskeyStartRegistrationOptions();

package/lib/vendor/blamejs/test/_smoke-worker.js

@@ -20,6 +20,58 @@ if (!modulePath) {
   process.exit(2);
 }
 
+// Capture a FIRE-AND-FORGET async failure — an unawaited promise that rejects,
+// or a handle callback (socket / timer / server) that throws — that fires
+// AFTER the test's assertions have already passed. Without this, Node's default
+// unhandled-rejection handling bumps the exit code to 1 and RACES the worker's
+// own process.exit(0): on a fast runner exit(0) usually wins (the leak is
+// invisible), but on a slow / starved runner (macos-latest, 3 cores) the
+// rejection wins first and the file reads as an unattributable "fork failed".
+// Recording it lets the worker report it DETERMINISTICALLY, named to this test,
+// on every runner — turning an intermittent CI flake into a reproducible bug.
+var _lateError = null;
+function _recordLate(kind, err) { if (!_lateError) _lateError = { kind: kind, err: err }; }
+process.on("unhandledRejection", function (reason) { _recordLate("unhandledRejection", reason); });
+process.on("uncaughtException",  function (err)    { _recordLate("uncaughtException", err); });
+
+// Leaked-handle audit. A test that schedules async work it never cancels — a
+// retry timer, a shutdown wait, a watcher/reload restart, an unclosed server /
+// socket / db connection / worker thread — leaves a handle that keeps the
+// event loop alive. process.exit(0) hides it locally (it force-exits), but the
+// lingering handle is what delays a slow CI runner and is the same root that,
+// when its callback later throws, becomes a late "fork failed". Snapshot the
+// handles the module holds BEFORE run() (load-time handles are legitimate),
+// then diff AFTER run() so only handles created-and-not-released during the
+// test are reported. Report-only (a leak doesn't fail the file) so the sweep
+// surfaces the population without a flag-day; Immediate/TickObject are the
+// worker's own exit scheduling and are ignored.
+function _handleCounts() {
+  if (typeof process.getActiveResourcesInfo !== "function") return null;
+  var c = {};
+  process.getActiveResourcesInfo().forEach(function (t) { c[t] = (c[t] || 0) + 1; });
+  return c;
+}
+// Infrastructure resource types that are NOT leaks: the worker's own exit
+// scheduling (Immediate / TickObject) and the stdio + IPC pipes (PipeWrap /
+// TTYWrap), which only register as "active" once written to — a test writing
+// its own "OK" line activates stdout AFTER the baseline snapshot, so they would
+// otherwise show as a phantom +1. The leaks we care about keep the event loop
+// alive across the grace tick: Timeout, TCP*/Server, FSEvent/StatWatcher,
+// MessagePort (un-terminated Worker), TLSWrap, FSReqCallback, etc.
+var _HANDLE_IGNORE = { Immediate: 1, TickObject: 1, PipeWrap: 1, TTYWrap: 1 };
+function _leakedHandles(baseline) {
+  var now = _handleCounts();
+  if (!now || !baseline) return [];
+  var out = [];
+  Object.keys(now).forEach(function (t) {
+    if (_HANDLE_IGNORE[t]) return;
+    var delta = now[t] - (baseline[t] || 0);
+    if (delta > 0) out.push(t + (delta > 1 ? " x" + delta : ""));
+  });
+  return out;
+}
+var _baselineHandles = null;
+
 (async function () {
   var helpers, mod;
   try {
@@ -34,6 +86,9 @@ if (!modulePath) {
     process.exit(1);
   }
   try {
+    // Snapshot load-time handles so the post-run diff only reports handles the
+    // TEST created and never released (not ones the module legitimately holds).
+    _baselineHandles = _handleCounts();
     if (typeof mod.run === "function") await mod.run();
     if (Array.isArray(mod.groups) && mod.groups.length > 0) {
       for (var i = 0; i < mod.groups.length; i++) {
@@ -52,9 +107,35 @@ if (!modulePath) {
         }
       }
     }
+    // Let fire-and-forget microtasks / immediates settle so a late rejection or
+    // teardown throw surfaces HERE, attributed to this test, instead of racing
+    // process.exit(0) and reading as an unattributable "fork failed" on a slow
+    // runner. Registering the handlers above also suppresses Node's default
+    // exit-on-unhandled-rejection, so the worker — not a race — decides.
+    await new Promise(function (r) { setImmediate(r); });
+    await new Promise(function (r) { setImmediate(r); });
+    if (_lateError) {
+      var le = _lateError.err;
+      process.stdout.write("\n" + JSON.stringify({
+        ok:     false,
+        checks: helpers.getChecks(),
+        // lateError flags this as a process-level transient (a fire-and-forget
+        // promise / unreleased handle that threw after the assertions passed),
+        // so the parent retries it ONCE — a transient passes on retry, a
+        // persistent one fails again and surfaces a real, reproducible bug.
+        // Either way the file is now NAMED, not an unattributable "fork failed".
+        lateError: true,
+        error:  "assertions passed but a late " + _lateError.kind + " fired after run() — a " +
+                "fire-and-forget promise or unreleased handle (retry timer, shutdown wait, " +
+                "watcher/reload restart): " + ((le && le.message) || String(le)),
+        stack:  le && le.stack,
+      }));
+      process.exit(1);
+    }
     process.stdout.write("\n" + JSON.stringify({
       ok:     true,
       checks: helpers.getChecks(),
+      leaks:  _leakedHandles(_baselineHandles),
     }));
     process.exit(0);
   } catch (err) {

package/lib/vendor/blamejs/test/integration/federation-auth.test.js

@@ -605,7 +605,10 @@ async function run() {
   check("OIDC Native SSO: deferred (Keycloak's device_secret support is preview-only)",   true);
 }
 
-run().then(
-  function () { console.log("[federation-auth] OK"); },
-  function (e) { console.error("[federation-auth] FAIL:", e.stack || e); process.exit(1); }
-);
+module.exports = { run: run };
+if (require.main === module) {
+  run().then(
+    function () { console.log("[federation-auth] OK"); },
+    function (e) { console.error("[federation-auth] FAIL:", e.stack || e); process.exit(1); }
+  );
+}

package/lib/vendor/blamejs/test/integration/mail-crypto-smime.test.js

@@ -314,7 +314,10 @@ async function run() {
   }
 }
 
-run().then(
-  function () { console.log("[mail-crypto-smime] OK"); },
-  function (e) { console.error("[mail-crypto-smime] FAIL:", e.stack || e); process.exit(1); }
-);
+module.exports = { run: run };
+if (require.main === module) {
+  run().then(
+    function () { console.log("[mail-crypto-smime] OK"); },
+    function (e) { console.error("[mail-crypto-smime] FAIL:", e.stack || e); process.exit(1); }
+  );
+}

package/lib/vendor/blamejs/test/layer-0-primitives/backup-manifest-signature.test.js

@@ -5,6 +5,7 @@
  */
 
 var helpers = require("../helpers");
+var nodeCrypto = require("node:crypto");
 var b     = helpers.b;
 var check = helpers.check;
 
@@ -12,6 +13,8 @@ async function run() {
   check("backupManifest.sign is fn",            typeof b.backupManifest.sign === "function");
   check("backupManifest.verifySignature is fn", typeof b.backupManifest.verifySignature === "function");
   check("backupManifest.signingPayload is fn",  typeof b.backupManifest.signingPayload === "function");
+  check("backupManifest.signBytes is fn",       typeof b.backupManifest.signBytes === "function");
+  check("backupManifest.verifyBytes is fn",     typeof b.backupManifest.verifyBytes === "function");
   check("backupBundle.verifyManifestSignature is fn",
     typeof b.backup.verifyManifestSignature === "function");
 
@@ -89,6 +92,43 @@ async function run() {
   var viaWrapper = b.backup.verifyManifestSignature({ manifest: reparsed });
   check("backup.verifyManifestSignature accepts parsed manifest", viaWrapper.ok === true);
 
+  // #351 — schema-agnostic signBytes/verifyBytes: a consumer with a bespoke
+  // (non-manifest) format signs its OWN canonical bytes with the same keypair +
+  // fingerprint pinning, without adopting the v1 manifest schema.
+  var customBytes = Buffer.from("custom-header\x00v=2\x00payload=" + "ab".repeat(40), "utf8");
+  var sigBlock = b.backupManifest.signBytes(customBytes);
+  check("signBytes returns a detached signature block",
+    sigBlock && typeof sigBlock.algorithm === "string" &&
+    sigBlock.publicKey.indexOf("-----BEGIN") === 0 &&
+    typeof sigBlock.fingerprint === "string" &&
+    typeof sigBlock.value === "string" && sigBlock.value.length > 0);
+
+  var okBytes = b.backupManifest.verifyBytes(customBytes, sigBlock);
+  check("verifyBytes on the exact bytes → ok", okBytes.ok === true && okBytes.fingerprint === sigBlock.fingerprint);
+
+  // A string with the SAME bytes verifies too (UTF-8 normalization parity).
+  var okStr = b.backupManifest.verifyBytes(customBytes.toString("utf8"), sigBlock);
+  check("verifyBytes accepts an equivalent string payload", okStr.ok === true);
+
+  // Tamper one byte → verification fails.
+  var tamperedBytes = Buffer.from(customBytes); tamperedBytes[0] = tamperedBytes[0] ^ 0x01;
+  var badBytes = b.backupManifest.verifyBytes(tamperedBytes, sigBlock);
+  check("verifyBytes on tampered bytes → ok=false", badBytes.ok === false);
+
+  // Fingerprint pinning: a wrong expected fingerprint refuses even valid bytes.
+  var pinned = b.backupManifest.verifyBytes(customBytes, sigBlock, { expectedFingerprint: sigBlock.fingerprint });
+  check("verifyBytes with the correct pinned fingerprint → ok", pinned.ok === true);
+  var pinnedBad = b.backupManifest.verifyBytes(customBytes, sigBlock, { expectedFingerprint: "deadbeef" });
+  check("verifyBytes with a wrong pinned fingerprint → ok=false", pinnedBad.ok === false);
+
+  // A malformed signature block is refused, not thrown.
+  var noBlock = b.backupManifest.verifyBytes(customBytes, { algorithm: "x" });
+  check("verifyBytes with an incomplete block → ok=false", noBlock.ok === false);
+  // signBytes rejects a non-string/Buffer payload at the boundary.
+  var threwIn = null;
+  try { b.backupManifest.signBytes({ not: "bytes" }); } catch (e) { threwIn = e; }
+  check("signBytes rejects a non-bytes payload", threwIn && threwIn.code === "backup-manifest/bad-input");
+
   // Manifest without signature returns ok:false (no signature to verify)
   var unsigned = b.backupManifest.create({
     vaultKeySalt: "0011",
@@ -100,6 +140,57 @@ async function run() {
   });
   var noSig = b.backupManifest.verifySignature(unsigned);
   check("verifySignature on unsigned manifest → ok=false", noSig.ok === false);
+
+  // Fingerprint-pinning substitution attack: an attacker signs arbitrary bytes
+  // with their OWN key, then sets the block's self-asserted `fingerprint` field
+  // to the trusted value. The pin MUST be checked against the fingerprint
+  // recomputed from the block's publicKey (the key the signature verifies
+  // under), not the attacker-controlled `fingerprint` string, or the forged
+  // block passes pinning.
+  var trustedFp = b.auditSign.getPublicKeyFingerprint();
+  var atkBytes = Buffer.from("attacker-controlled-payload", "utf8");
+  var atk = nodeCrypto.generateKeyPairSync("ed25519");
+  var atkPubPem = atk.publicKey.export({ type: "spki", format: "pem" }).toString();
+  var atkSig = nodeCrypto.sign(null, atkBytes, atk.privateKey);
+  var forged = {
+    algorithm: "ed25519", publicKey: atkPubPem,
+    fingerprint: trustedFp,                     // the lie
+    value: atkSig.toString("base64"), signedAt: new Date(0).toISOString(),
+  };
+  // The forged signature genuinely verifies under the attacker's own key.
+  check("forged signature verifies under the attacker key (precondition)",
+        nodeCrypto.verify(null, atkBytes, atkPubPem, atkSig) === true);
+  // ...but pinning to the trusted fingerprint MUST reject it.
+  var forgedRes = b.backupManifest.verifyBytes(atkBytes, forged, { expectedFingerprint: trustedFp });
+  check("verifyBytes rejects a forged-fingerprint block under pinning", forgedRes.ok === false);
+  check("verifyBytes forged-rejection cites the fingerprint mismatch",
+        /does not match expectedFingerprint/.test(forgedRes.reason || ""));
+  // verifySignature (manifest path) shares the fix — same substitution refused.
+  var forgedManifest = JSON.parse(JSON.stringify(fixture));
+  forgedManifest.signature = forged;
+  var forgedMRes = b.backupManifest.verifySignature(forgedManifest, { expectedFingerprint: trustedFp });
+  check("verifySignature rejects a forged-fingerprint manifest under pinning", forgedMRes.ok === false);
+
+  // b.auditSign.fingerprintOf recomputes the fingerprint from a PEM, no init.
+  check("auditSign.fingerprintOf is a function", typeof b.auditSign.fingerprintOf === "function");
+  check("auditSign.fingerprintOf(active pubkey) == active fingerprint",
+        b.auditSign.fingerprintOf(b.auditSign.getPublicKey()) === trustedFp);
+
+  // Verifier-only path: a process that never ran auditSign.init() must still be
+  // able to verify a detached block (it holds only a trusted public key). Reset
+  // LAST so earlier checks keep their initialized signer.
+  var honestBytes = Buffer.from("downstream-verifier-payload", "utf8");
+  var honestBlock = b.backupManifest.signBytes(honestBytes);
+  b.auditSign._resetForTest();
+  var reThrew = null;
+  try { b.auditSign.getPublicKey(); } catch (e) { reThrew = e; }
+  check("verifier-only precondition: audit-sign is uninitialized", reThrew !== null);
+  check("verifyBytes works in a verifier-only process (no init)",
+        b.backupManifest.verifyBytes(honestBytes, honestBlock).ok === true);
+  check("verifyBytes pinned works in a verifier-only process",
+        b.backupManifest.verifyBytes(honestBytes, honestBlock, { expectedFingerprint: trustedFp }).ok === true);
+  check("verifyBytes still rejects tampered bytes in a verifier-only process",
+        b.backupManifest.verifyBytes(Buffer.from("tampered"), honestBlock).ok === false);
 }
 
 module.exports = { run: run };