@blamejs/blamejs-shop 0.5.1 → 0.5.3

package/CHANGELOG.md

@@ -8,6 +8,10 @@ upgrading across more than a few patches at a time.
 
 ## v0.5.x
 
+- v0.5.3 (2026-06-27) — **Vendored framework refreshed to 0.15.37 — non-finite numeric options can no longer silently disable a security check.** Updates the vendored blamejs framework to 0.15.37. The upstream release closes a class of fail-open configuration bugs: several numeric options validated a value only as `typeof === number && >= 0`, which accepts `Infinity`. Where the value is a clock-skew tolerance or a resource cap, an `Infinity` (or `NaN`) silently turned off the very protection it tunes — an `Infinity` CWT / OCSP-staple / ARC clock-skew made the expiry and freshness comparisons unsatisfiable (so an expired token, a replayed pre-revocation OCSP `good` response, or an expired ARC seal would be accepted), and an `Infinity` WebSocket message/frame cap, inbox/flag-cache size cap, or audit-chain fan-out cap disabled the bound. These options now route through the framework's finite-bounds validator, refusing a non-finite value at the entry point (or falling back to the safe default), while options where unbounded is deliberate (reconnect-indefinitely, retain-indefinitely) still accept it. This storefront configures these options with finite values, so there is no runtime or behavior change for it; the hardened framework rides along and no operator action is required. **Changed:** *Vendored framework refreshed to 0.15.37 (non-finite option values rejected)* — Refreshes the vendored blamejs framework to 0.15.37. The upstream fix makes a clock-skew tolerance or resource cap of `Infinity` / `NaN` a rejected value rather than one that silently disables the check it configures — covering the CWT / OCSP-staple / ARC time checks, the WebSocket-client inbound size and handshake caps, and the inbox / flag-cache / audit-chain size and count caps, with deliberately-unbounded options (reconnect/retain indefinitely) unaffected. The shipped storefront passes finite values to these options, so its runtime, public API, and wire format are unchanged; the hardened framework simply rides along.
+
+- v0.5.2 (2026-06-27) — **Vendored framework refreshed to 0.15.36.** Updates the vendored blamejs framework to 0.15.36. The upstream release is internal test-suite tooling only: it re-verifies the guard-suite class that allows a bare comma/semicolon split on token-only RFC header grammars (RRULE, RFC 9421 signature components, TLS-RPT rua, SCIM attribute paths), renames its marker to a descriptive token, and prunes five inert marker comments. No runtime code, public API, or wire format changed upstream, so there is no runtime or behavior change for this storefront and no operator action is required. **Changed:** *Vendored framework refreshed to 0.15.36* — Refreshes the vendored blamejs framework to 0.15.36, an upstream release scoped to test-suite tooling — a guard-suite class re-verified and its marker renamed, plus five inert marker comments removed. The shipped framework runtime, public API, and wire format are unchanged, so no operator action is required.
+
 - v0.5.1 (2026-06-27) — **Vendored framework refreshed to 0.15.35 — Prometheus label-injection fix in the metrics shadow registry.** Updates the vendored blamejs framework to 0.15.35. The upstream release fixes a label-injection in the framework's metrics shadow registry: it built a metric's cardinality key by joining label pairs with commas and re-split that string when rendering the Prometheus exposition, so a comma (or `=`) inside a label VALUE forged additional label pairs in the scrape output — which downstream tenant-scoping filters, authorization selectors, recording rules, and alerting trust as a boundary — and two distinct label sets could collide into one cardinality bucket. The key now uses canonical-JSON of the label set and the render emits the structured labels instead of re-splitting, so a value's commas/equals stay inside the value and a label named `constructor` / `prototype` / `__proto__` is preserved. This storefront does not compose the metrics shadow registry, so there is no runtime change for it; the fix ships in the vendored framework regardless and no operator action is required. **Changed:** *Vendored framework refreshed to 0.15.35 (Prometheus label-injection fix)* — Refreshes the vendored blamejs framework to 0.15.35. The upstream fix stops a comma or `=` in a metric label value from forging extra Prometheus label pairs in the shadow registry's scrape output — the cardinality key is now canonical-JSON of the label set and the render emits the structured labels rather than splitting a joined string, so distinct label sets stay distinct and reserved-name labels survive. The shipped storefront does not expose the metrics shadow registry, so its runtime, public API, and wire format are unchanged; the hardened framework simply rides along.
 
 - v0.5.0 (2026-06-27) — **Affiliate commissions gain a tamper-evident hash chain, joining the gift-card, store-credit, and loyalty ledgers.** The affiliate-commission ledger was the last money ledger without tamper-evidence. Each commission is now linked into a per-affiliate SHA3-512 hash chain: a row names its predecessor, a uniqueness fence allows exactly one child per chain tip (so concurrent commissions for the same affiliate serialize instead of forking), and editing a commission's money fields or deleting a row from the middle breaks the linkage. Unlike the append-only gift-card / store-credit / loyalty ledgers, an affiliate commission walks a pending → paid → voided payout lifecycle in place, so the chain hashes only the immutable money facts — order, affiliate, order total, commission, currency, and time — and leaves the lifecycle columns out, meaning a legitimate payout or void never breaks the chain while an inflated amount or a removed row still does. A new `affiliates.verifyChain(affiliateId)` recomputes an affiliate's chain end to end and reports the first divergence, and accepts a trusted anchor (row count + head hash from an earlier snapshot) to also catch a truncation that deletes the most-recent commissions. Migration 0238 adds the chain columns + fence; commissions recorded before it are tolerated as an unverifiable legacy prefix, and the chain anchors fresh from the first commission recorded afterward. **Added:** *Affiliate commissions are a verifiable, fork-proof per-affiliate hash chain* — Recording a commission now links it into the affiliate's SHA3-512 hash chain — `row_hash = SHA3-512(prev_hash || canonical-json(immutable fields))` — under a `UNIQUE(affiliate_id, prev_hash)` parent fence, so a commission derived from a stale tip collides and retries instead of forking the chain, and concurrent commissions for one affiliate serialize. Because a commission's status, paid-at, payout reference, and void reason are stamped in place over its lifetime, only the immutable money facts are hashed, so a `pending → paid → voided` transition leaves the chain valid while tampering with the order total or commission amount, or deleting a commission, is detected. `affiliates.verifyChain(affiliateId)` walks the chain and reports the first break; pass `{ anchor: { count, head } }` to also rule out a tail truncation. Commissions written before this release are tolerated as an unverifiable legacy prefix and the chain anchors fresh from the next one — no backfill required. Migration 0238 adds the columns and the fence.

package/lib/asset-manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.5.1",
+  "version": "0.5.3",
   "assets": {
     "css/admin.css": {
       "integrity": "sha384-imfe0otYErcB8rr2h6KLSGTtStirysptpXETSPY4zLv3bZoIT75Lo1dOvkOav+xL",

package/lib/vendor/MANIFEST.json

@@ -3,8 +3,8 @@
   "_about": "blamejs.shop vendors a single framework — blamejs — which itself bundles every server-side crypto/identity dependency. The transitive packages blamejs ships are surfaced in its own MANIFEST.json at lib/vendor/blamejs/lib/vendor/MANIFEST.json — Trivy / Grype rely on that nested data for CVE attribution.",
   "packages": {
     "blamejs": {
-      "version": "0.15.35",
-      "tag": "v0.15.35",
+      "version": "0.15.37",
+      "tag": "v0.15.37",
       "license": "Apache-2.0",
       "author": "blamejs contributors",
       "source": "https://github.com/blamejs/blamejs",
@@ -858,6 +858,8 @@
         "release-notes/v0.15.33.json": "lib/vendor/blamejs/release-notes/v0.15.33.json",
         "release-notes/v0.15.34.json": "lib/vendor/blamejs/release-notes/v0.15.34.json",
         "release-notes/v0.15.35.json": "lib/vendor/blamejs/release-notes/v0.15.35.json",
+        "release-notes/v0.15.36.json": "lib/vendor/blamejs/release-notes/v0.15.36.json",
+        "release-notes/v0.15.37.json": "lib/vendor/blamejs/release-notes/v0.15.37.json",
         "release-notes/v0.15.4.json": "lib/vendor/blamejs/release-notes/v0.15.4.json",
         "release-notes/v0.15.5.json": "lib/vendor/blamejs/release-notes/v0.15.5.json",
         "release-notes/v0.15.6.json": "lib/vendor/blamejs/release-notes/v0.15.6.json",
@@ -1566,7 +1568,7 @@
         ".npmrc": "sha256:66f104e7d07c496d2d0409988225e8c0e4ceb8d247dbcac3be75b2128d20ce66",
         ".pinact.yaml": "sha256:0213ffda55961dc49b64c0a5dfa3c0567419633b1499d57eaf7c8d842d7da6c7",
         "ARCHITECTURE.md": "sha256:9b1c8d2b1b7a41838eb348b0a008e4b4369718fd72bfe2974b37155f7536d35b",
-        "CHANGELOG.md": "sha256:52a0cf964a432750c3cfb566dd024b55286cb1036a0e5c4c3cbaf56c6b7a1da6",
+        "CHANGELOG.md": "sha256:e14e4572e0a057f9633365e55eb176592f766006a4392009a25c9060d9b17cc0",
         "CODE_OF_CONDUCT.md": "sha256:148a281960fff7c2fe6554dab66da572c72245ddeb00b0d14811558397bff386",
         "CONTRIBUTING.md": "sha256:bb4dbdbc8598da31dbce653a8ed322e08ff46560173f2eb67a4d684653948332",
         "GOVERNANCE.md": "sha256:906df6afb1f552b27b9acb50f7f96c47b917a2f1021cd4e987dbf4ee0e0a821b",
@@ -1576,7 +1578,7 @@
         "NOTICE": "sha256:f487fa47a11aca0f89e2615cdd3c713e9842abf7a30d8d328eeeae1c864aa774",
         "README.md": "sha256:3ddcc197b003da0b02db8bdd1aef1e943c94f7eab613c633d6a45bb11d0a80e9",
         "SECURITY.md": "sha256:77d8c2bcc04b425a08ef30e51204cebddbd48954b028a259c7a8412dbfeab40a",
-        "api-snapshot.json": "sha256:097e1361a6d64b9b25830f0ba1c0440b39f7efce8770d5b7a9d0545d73cc5439",
+        "api-snapshot.json": "sha256:8665f75a6befdc47255199601827a9642aa9f1662f271c35325068482edb11ad",
         "assets/BlameJS_Logo.png": "sha256:3c65699753c771b48ef9ac7f45bb40815ec19a23afcdd0cd30ef4601bbbe293e",
         "assets/BlameJS_Logo.svg": "sha256:dda44f3fb1343d5de9db6b1fcdb75fc649c57e7a99a8e8239fcf852e3841e1a8",
         "bench/README.md": "sha256:74202f2507fd840bfc1ac6c681975d9273cf36cca6e0f72655f138337304033c",
@@ -1784,7 +1786,7 @@
         "lib/agent-event-bus.js": "sha256:c8b21e11f0b6596ddfc36cd87a7ee26185e41ff59e3bb65c0fb4b02e525ee1e4",
         "lib/agent-idempotency.js": "sha256:dc3f9f82d129a844812a042e6730f167df471fc0792d60b0dc2bb174604d896e",
         "lib/agent-orchestrator.js": "sha256:517f672eefbfc430cabf06f3162ab5fd2212996d17366909d9eff7aa514363b2",
-        "lib/agent-posture-chain.js": "sha256:2e09b38742194b5823d174315c6ae2dd89857d9e662286f37c46c14627243b1a",
+        "lib/agent-posture-chain.js": "sha256:450f0ebe438b4e99d7017a498ae1f705b54c472145111d145348be2ea78490d7",
         "lib/agent-saga.js": "sha256:1a239892fe534d16e5567b731730bebc073057fe7d3bae63e0c49d989648c501",
         "lib/agent-snapshot.js": "sha256:eac77c6c771b31ced5ce01937ee0cab301bc97a5b96d9db949471296029da769",
         "lib/agent-stream.js": "sha256:8e519cba5505ad8e89bfe827483c16fe577ad39742e17f8f01d30b430a4bbf0b",
@@ -1822,7 +1824,7 @@
         "lib/asyncapi-traits.js": "sha256:82ec58b77f0a65ef1b5e8b67ee9555e9cb984de769c3393fe5c6d4d0640546f0",
         "lib/asyncapi.js": "sha256:cd48847ed363023e248cf0fbe275b545b0002b85e93ed91315990ef8a6abe483",
         "lib/atomic-file.js": "sha256:b93b008c121f785d149d4450681467b18785781c3a82b9b001bb2a7d636c3ad1",
-        "lib/audit-chain.js": "sha256:1c9895a2bbf6ce3b4c546b1b3c95ac9d5ed55d82a2b58c0de4e3ecc1947c3c31",
+        "lib/audit-chain.js": "sha256:c8c4bfb7abf0a4f2288b56404f30c1d8311c22f3c71f6c9c3a606a142744f3ea",
         "lib/audit-daily-review.js": "sha256:61cebe47d6e5eeeedcab45515473acfaab623217810a7ab3629b3aeca5028519",
         "lib/audit-emit.js": "sha256:1171699027269e154fd247141a549e65bcdb566e52ed00b993c7dfb9a293ba0f",
         "lib/audit-sign.js": "sha256:b8ddef053fca28c1e6cf265f73ecd254290a9c2e0759250342e926280205342f",
@@ -1873,7 +1875,7 @@
         "lib/cache-redis.js": "sha256:661ba39417085682cee1e5524685c9cb1e1277c6f1cef9ca4ae808e457d5499e",
         "lib/cache-status.js": "sha256:f82bf22698c9b4fa10b7dc581fd39b83709267f105195908eee29612a14df15d",
         "lib/cache.js": "sha256:e38929b261a6c9ea2dd822f39f2669c2ee5bbc6729517ced49471227d1d5ddb9",
-        "lib/calendar.js": "sha256:08896ec0e8e07e7da3a94c18046cba9ea082e5a5af16ab459604862f70fd11ef",
+        "lib/calendar.js": "sha256:040bcf1385ffea3eb5779f1192f7f01889e498a3773de4c81d3cd37fc5b98307",
         "lib/canonical-json.js": "sha256:3546e2a4b7692c4f8c77602e8804a8aaebff29b2183329588578c1d6f0df3eee",
         "lib/cbor.js": "sha256:9b6a6799b10646e50705f9e0839fbac2f3b8df6e41943170c15e308215936feb",
         "lib/cdn-cache-control.js": "sha256:adc1e5bdc59492de9e2f688dbee279a0ab09166adba609c4b5355028c4d3e0d1",
@@ -1919,7 +1921,7 @@
         "lib/crypto.js": "sha256:0884094cdfc52e577c10b51622b940e9acc1ce2ef8dd8996d790e51e80b2f9b5",
         "lib/csp.js": "sha256:b7a4d24f721767edecb7bc0c7a28c7824b7dda596c2edb3be387304684a8698a",
         "lib/csv.js": "sha256:eca5d01409e72f5f73c5a954f3019826ed5da06f72103a5117016aeb0654f17c",
-        "lib/cwt.js": "sha256:1c39f6ea999ecdb2cb119933b497af9cbfd512aeaa73261076f12018f0393e80",
+        "lib/cwt.js": "sha256:b0156f9098c3eb336221949c838b25f2eb9d4f765af6e293df225493f64c12a4",
         "lib/daemon.js": "sha256:9441d845c9a2d4b2808cdd6bf18915d89338a3dd75fa304c4b38c047b9f47a54",
         "lib/dark-patterns.js": "sha256:e54cc6fb591748b937627560ccdfd84da0e84974da5189e15b911e00b3c7e51b",
         "lib/data-act.js": "sha256:9d8f276393bef93e90ddf471f6c424cf95728a9c67fc8416fc5e3ccc99f690ee",
@@ -1946,14 +1948,14 @@
         "lib/error-page.js": "sha256:4ed2e8a118b35d3dc76a072b233713ae1fdaedb54334df68ad081e19f765cb88",
         "lib/events.js": "sha256:b5f0034fda33285f571b9b247db50bff08f632762d9bf69b83784b435eeea75c",
         "lib/external-db-migrate.js": "sha256:990014016e71a818672b3f2c32eaa2ff6815553feb52efafb88ec765df9a570a",
-        "lib/external-db.js": "sha256:d39513c1ef842397374218d8416c62ff0ec36e73ab0e9c507298dcfb9d0bda63",
+        "lib/external-db.js": "sha256:309a6bf0156f609dd3f143eaae1f41eec5a22a49f9d83eaf7c8f6f28d82b2d76",
         "lib/fapi2.js": "sha256:6ae4679931675a629fa3f9e9efba71172fe69251dec2dd5d8c995cfb9dcad8f7",
         "lib/fda-21cfr11.js": "sha256:9256bcea7d526a7280d5d3b1beed5be1daf2402ded2d5a18d602466d01a7884c",
         "lib/fdx.js": "sha256:67a29b140b6d07a767da31d6b55d1db0c2219cdaa780531fdec0fec63a5c551c",
         "lib/fedcm.js": "sha256:4b0f1e3d8e762353a28b2d42e00678c120d6e8ad574ecb9d94d4aa8dead0f7f7",
         "lib/file-type.js": "sha256:158d798f8204cc96038b4fda2a215bb4ba79232476e31195f15d4fee8f790a00",
         "lib/file-upload.js": "sha256:436b763fd928f286fb7faba8e2e9373cd37dcf677cb19e12afee61f00413e420",
-        "lib/flag-cache.js": "sha256:7bf41923bb42df59a41df37f7baa5b8b67172ba9ca71eeab47841dd0e4c9b64f",
+        "lib/flag-cache.js": "sha256:4333ce5105e2a2970b7277fa77f6664d1c6d2e3c6e7c3fa6094c228d305df4dc",
         "lib/flag-evaluation-context.js": "sha256:fa8846a9a97a9d773dc08dd0da664d1d6d3fead4e12dc9982b33fa45b59d47a8",
         "lib/flag-providers.js": "sha256:d85ff62c2d599634c3d2dc9d4e4a8cfcecec8178ce63a2800438434cc365f84a",
         "lib/flag-targeting.js": "sha256:c2b5096e04dcaa98435c66cfa6b1aae02d0da708ca7e96f810627ef38e669309",
@@ -2029,17 +2031,17 @@
         "lib/handlers.js": "sha256:860d07682bc6199c5d06f2d91f4ba9ab26ff5e2d9a97c72af6a700505d0e44e2",
         "lib/honeytoken.js": "sha256:288a69a6c22107d41185c88ec86ca1bf424b3c10d349d90d5fc5037749db0568",
         "lib/html-balance.js": "sha256:da49a83a2b17e9e5feb3f061e59bb595ceb37d8dfb6a7c1da7ab230705b7259f",
-        "lib/http-client-cache.js": "sha256:a4d41376c761d731427844e1aba76822ffb597e1d892b6df93d5ef807489ede3",
+        "lib/http-client-cache.js": "sha256:52a0ef4ce9bfa99886f0e26c7fd4649b6cb6294c0f7e46279f23c76437a8fc64",
         "lib/http-client-cookie-jar.js": "sha256:50aee1674d2c2ac73fc153fffd6be6d2628326cf85ac15e7d19b9bcd1e727826",
         "lib/http-client.js": "sha256:99f1a4faf97e858794d4422a8cc9a813154d251413ffce328635a7e93e85d62b",
-        "lib/http-message-signature.js": "sha256:45fbc4462af19f6237ba678aed38341c8702301220c79d61a05d08114aafcf63",
+        "lib/http-message-signature.js": "sha256:3d5faf7637ceea9dfa1d281848d11e790100e113f5ef3366fc4c733d5f29b4b9",
         "lib/http2-teardown.js": "sha256:61d291c34e321e18b64d60a4c0253e638550fff7dc32568b980d3aa13bb178e2",
         "lib/i18n-messageformat.js": "sha256:2c5012ac3fbc6f56191765bda090889ab58206d130cf05c81963d965744d63d6",
         "lib/i18n.js": "sha256:e2663046590798f2dde5cb73f14973ca509070841dff7c9697546e5dc0ec195a",
         "lib/iab-mspa.js": "sha256:64d45d2f8b8373efe4daa0584f72b1a50940c9118aeb4f0925c38d3fdb3d64f3",
         "lib/iab-tcf.js": "sha256:c21467eced77bce0bc28ca08a7ef5ea5f7a99b4f3f5fad36c1cb70b773e0f7c3",
         "lib/importmap-integrity.js": "sha256:addabb8fb49c9ce94e768d8f6d32ac05dc096b2c036eff3ad3528ba65b84292b",
-        "lib/inbox.js": "sha256:dd603479a72420288f5aa65d4b50a147f02e135d8e2899a3ac7760cb2af56261",
+        "lib/inbox.js": "sha256:40e662386d56d4f2b3fbad02f1fed8a33f75e88596e12f5f88a7acfff94de588",
         "lib/incident-report.js": "sha256:03729af0dcaba8aadd709c7c3036776c6155b012bd7b80ffc2a13a42609d2a0f",
         "lib/ip-utils.js": "sha256:cc7a40523a25f3732f8f9ce3b52d725a981ca831a973888abd059ef8e5dfa459",
         "lib/jobs.js": "sha256:f8e273bdd25b172cff189a8b5b56748828216fdb5d5f445634477c7b2686e7c2",
@@ -2067,9 +2069,9 @@
         "lib/log.js": "sha256:8268967e7f45bf59b131ba7e651b48a15656850f5585efe98001af4406c7c495",
         "lib/lro.js": "sha256:da9baf47f27c422c32d51495b2896c887ec3ac283875712efcd7528fd396868b",
         "lib/mail-agent.js": "sha256:4ca93408c03873796d285d002067ffa54fa70859ad5437215d6001d90c0f76ea",
-        "lib/mail-arc-sign.js": "sha256:872f31e16321f8629e3af3cac31d3deb460804748b25a7fbb427164a2ad88f84",
+        "lib/mail-arc-sign.js": "sha256:68e71b313e7f44924c60ad668a101897db4c9966222793eed69bc1c868788d59",
         "lib/mail-arf.js": "sha256:47d02905b58c6c0733114e58594034adedd73799de39b93420459dbb04d22050",
-        "lib/mail-auth.js": "sha256:da409e8f2b3bae1308f1d008b6df27f468075a83ceaeae8ee7cda0ab9c4a1027",
+        "lib/mail-auth.js": "sha256:2e7e72ca6dcc5598cb5a27ffb20b2fa43869d5a27aaf95fcf41b170dbafdea8a",
         "lib/mail-bimi.js": "sha256:b22afc5e8ad04503fee7e41f3b34c05c9f0759579436bfbe5f7706180c466155",
         "lib/mail-bounce.js": "sha256:461e885dd2ea0664e9a4af39ae5c36f3a5d9c7dc914dad4c40641b705952fd04",
         "lib/mail-crypto-pgp.js": "sha256:2e94f51d2cb13b92c612e84f73cf96e83eb17843d57b9dc9aef688ce55a1f9b4",
@@ -2109,14 +2111,14 @@
         "lib/mcp.js": "sha256:c65af74fdb3cf30436699aba5051c4d6e8cb972887cbaaecc46250d557599953",
         "lib/mdoc.js": "sha256:bc31d38d6fdfac8db8f040dfa4d33ab40405f56340bb4ec978f3ba98e93f6433",
         "lib/metrics.js": "sha256:55d445b738b2cfc8ceb1bfa7a1e69b306497e8065ea86d61e4f4087873acce1b",
-        "lib/middleware/age-gate.js": "sha256:dc8c61a4d41f4a781220c9c97eb475fb2867f5ee444eb2756badcbc5b8411795",
+        "lib/middleware/age-gate.js": "sha256:4d4967beef100e2e58f1565de770e31fb8dd50dab2f04fa8251972fea5607826",
         "lib/middleware/ai-act-disclosure.js": "sha256:6fc62940d85813019b31c586fc86853570329a939565a6947f81052d50977c42",
         "lib/middleware/api-encrypt.js": "sha256:f90210bfc4fe04b50f6d72e14676a140c5759e255ed359567066a1e80ab5fb63",
         "lib/middleware/assetlinks.js": "sha256:bb36f8d53991668b4ae1557d0cab3ec8b479a16f9133c43f9adc07963c8b4750",
         "lib/middleware/asyncapi-serve.js": "sha256:a0f0b62b264a5cd8a24e3cfddae722a84b5e2206729f77403906a1d1cfcd7c7b",
         "lib/middleware/attach-user.js": "sha256:776424918bf302378da99a85ff20c91a42f8c9f528ab435cd7a06b95ec523d6d",
         "lib/middleware/bearer-auth.js": "sha256:d0cb9d65a724a0badf9a5164397d12bf6a3afa9a2ae5e75922799b832741ee59",
-        "lib/middleware/body-parser.js": "sha256:488ec4572f7208d05a664b285ad3b6c888f623127d6bb50bbc1659a67a259f73",
+        "lib/middleware/body-parser.js": "sha256:a2a0af8ac8cecd9e6c842680029d6b409122d0639e33cc7204089e9c0daf6b73",
         "lib/middleware/bot-disclose.js": "sha256:2b98da494ee51ba7c8efc0d5fccbf11ba335649e71726d83847116c340720bf0",
         "lib/middleware/bot-guard.js": "sha256:ba724a897f646fcab7c384eb6e5c076e77e83b8e1c8d82a5aab79e8df616af8c",
         "lib/middleware/clear-site-data.js": "sha256:9b489c42aa6d4ee9f4b1e6e410b211f5d28134fc1d3933502f7504d64bc68c26",
@@ -2155,7 +2157,7 @@
         "lib/middleware/require-methods.js": "sha256:3b1b7ee5844969e813a46f26e78ed116ccfa28d2c6a9b821bb5d8c998ae95ea9",
         "lib/middleware/require-mtls.js": "sha256:f823a6d26af0969f28bced4ab166533dc6a5547df2f9120392d77acdbff3ba97",
         "lib/middleware/require-step-up.js": "sha256:dd8967633dc9133e54b1c4965247c77be087d6d34c395746d319b3af8e81e2eb",
-        "lib/middleware/scim-server.js": "sha256:2f38d77c7e949df9e219e4b351a6eb047dc85a7337aca932ac4b598e953c471d",
+        "lib/middleware/scim-server.js": "sha256:edb2b85326310247c19e2b9005df6b9af92d689d611759a824649f67b8283b15",
         "lib/middleware/security-headers.js": "sha256:87506e572454033b33955d58d9f0cbfdc14edc63c1cbe7e01f0dc4f07753c64d",
         "lib/middleware/security-txt.js": "sha256:3140d6537aa09a7052d83088840358949dd36393697fa2215f8f915d31aaa112",
         "lib/middleware/span-http-server.js": "sha256:8f22bf4feb5f05a201da20b89425f0e904ed6368c91b2fcd1be9a0f5cb067696",
@@ -2180,8 +2182,8 @@
         "lib/network-heartbeat.js": "sha256:f14ec7fa4667cbb04477d91ae59d6253b6c9ccc43071bc558e737cc672f43975",
         "lib/network-nts.js": "sha256:90ce47584ad58c171e8029eb1d5df8ba4ba130c4038d1fe260109685c34c8f75",
         "lib/network-proxy.js": "sha256:9342c534863f905000d2432b67c26dd7a5ea02be25aaf9ebe05976079e61d4c9",
-        "lib/network-smtp-policy.js": "sha256:95927f23bb7cafaf716dee869bb89d1a3d84bc307167365d08c12e9db9c50370",
-        "lib/network-tls.js": "sha256:554b64c77389e1c961da8d061c63c806be994960466fb26f2b2268dbec0a369b",
+        "lib/network-smtp-policy.js": "sha256:4d10a339d5c471cdff217c5514038eb2e30f4ecb97a38cb4405165ee0f9dcf7e",
+        "lib/network-tls.js": "sha256:bfd58cf11c307151c98044d8b7ac43f7fefc8f8d36fee61789e88e7435aafbe0",
         "lib/network-tsig.js": "sha256:41dc85a6e816cce1c58c36891dfc6bafc612b68978936107a09a5a553563e0d7",
         "lib/network.js": "sha256:40cb01627bf45741cac22ef79f5985f69323e47732d54cf3ce28c06882830c25",
         "lib/nis2-report.js": "sha256:fa106a4f95dd9301d7da966c5792197bdbebac477a4f1d2fd2ac2481fbd818fd",
@@ -2340,14 +2342,14 @@
         "lib/wiki-concepts.js": "sha256:54789790b950d926cbd0657dd51b32435c4988012b520819615df93673680de5",
         "lib/worker-pool.js": "sha256:fc35b3c9f83a4c72be0981400f5294b566472bfe187df0500775e37dd71afa4c",
         "lib/worm.js": "sha256:f17e24f8ca39295f396f40bd0c4ad1c946f5e41ff646ef1b33e8d50dc8b9435e",
-        "lib/ws-client.js": "sha256:5a854921c96500d504c731d302a7d338d93400b41bbe12056aa1c38494ac7497",
+        "lib/ws-client.js": "sha256:3ac479017e1199f1b69300b81e473f8303f6782161b73e95b17e47cf494ee066",
         "lib/x509-chain.js": "sha256:fdc0ecd264d9de0e039f348e819675fdf3838d61097a97a0e3e119def338722a",
         "lib/xml-c14n.js": "sha256:01a27d20df99ebd6eaefbff0aad933a2231049f65a54ae994236694d4146ce5d",
         "oss-fuzz/projects/blamejs/Dockerfile": "sha256:6c48ec4d81f4b1836a6b43701a2497cf737002413dd0da6a10892be1498b0766",
         "oss-fuzz/projects/blamejs/README.md": "sha256:ae13b7bb79ed8d69b1b3276e5562807a0349fb6e6b7d11cf1f683aad1eafdb4b",
         "oss-fuzz/projects/blamejs/build.sh": "sha256:0ced1cf21782c97be7f8d74faf5e27a308b60b2f858836fb5ca3b8c4e939a8f7",
         "oss-fuzz/projects/blamejs/project.yaml": "sha256:59f2cb83aa622325a175b77416fe155be15b70a9c798bd1a78bba05763b1b03d",
-        "package.json": "sha256:680de6ef3cb4b04dc38a51d9671f5bc817199fe7724290a05b6404af36318b45",
+        "package.json": "sha256:ffb1cef6e0b19b328852007de2c92144fdb0a08f4627a4b3bf048eeb3857bee4",
         "release-notes/v0.0.x.json": "sha256:7a49819f30068ee119000cad7010194882bb8bfaa12acbdab4dfc066efb7982f",
         "release-notes/v0.1.x.json": "sha256:6742a8c17f947c5cb76f69dead7eea86b942d80621d914b774ba5488e09937e5",
         "release-notes/v0.10.x.json": "sha256:fe498045daf88337bd3d987e5964aa42c99a50e1685b6f09e51f698b8687726f",
@@ -2385,6 +2387,8 @@
         "release-notes/v0.15.33.json": "sha256:295ea9939b74498c7f0be6afdc8bc511f97cb2383a436c3040c58b0600598b19",
         "release-notes/v0.15.34.json": "sha256:2a1b36d897d8e9f2cece051c098030f08d9c6ee6bef136800bd19453ad65f188",
         "release-notes/v0.15.35.json": "sha256:e317b2252734aace7a0f734e3ab40c3a0c4ac208d678c0e9834be34eb424d15b",
+        "release-notes/v0.15.36.json": "sha256:392c15724efc02fad5825aaf93b3f5dcef90a0cb9909d61f86e777f3061045ec",
+        "release-notes/v0.15.37.json": "sha256:b696debed024bed09c59eaeb467d6dde93d7f30ad33f46af8a37d07534df09d8",
         "release-notes/v0.15.4.json": "sha256:6ac7fa0ef1728c27e71b2050d1b07a810f9b4b1440ccddbf28ad56e2f54d8585",
         "release-notes/v0.15.5.json": "sha256:cca1d0edd5d6fc41b512d19d98be224b990dcab41478622c11962f0fcb1bb09a",
         "release-notes/v0.15.6.json": "sha256:0e3b9e5e43b70b61dd258c3003d1b8729cd3c26c62a34dedcca81bbec5d31077",
@@ -2631,7 +2635,7 @@
         "test/layer-0-primitives/cluster-storage.test.js": "sha256:238b3b3db0eba3e6312a863710533178f566347b90e161e564481aa826707647",
         "test/layer-0-primitives/cluster-vault-rotation.test.js": "sha256:3514e9e71d6c39e805248f58ad2f41528d091e196c0f3766a032675677161b2d",
         "test/layer-0-primitives/cms-codec.test.js": "sha256:7e46078ed82be5b69d22c48f22dba37ea5015371c2a8cf5f94fb1a792fb7bb78",
-        "test/layer-0-primitives/codebase-patterns.test.js": "sha256:69d9da97b002a40c9edb39a6848d7369c2b43e2e09b935bdf9e9e8228765f40a",
+        "test/layer-0-primitives/codebase-patterns.test.js": "sha256:ae47993e4fb7be4bb52b4c71a178cd47928b853dec9935c6445d8966da04ed4f",
         "test/layer-0-primitives/codepoint-class.test.js": "sha256:19d1b69efa7e0e9f7ef2392ca264167767a5ec5890ee339b2cfd8a7818035d27",
         "test/layer-0-primitives/compliance-ai-act.test.js": "sha256:5ee4ad05d12233cb3c5457ef10a727833710bbc1ce1318838f9f9ef5d2cb8d4b",
         "test/layer-0-primitives/compliance-cascade.test.js": "sha256:ee02cf14541a837a9d7977c6ea6bf7f9210bed293925d93c976e31f270aebec4",
@@ -2674,7 +2678,7 @@
         "test/layer-0-primitives/csp-report.test.js": "sha256:8bb2e54a31fd4317a6a39a4dc3358147a0102dbfa58b71d85a5743008289a2ff",
         "test/layer-0-primitives/csrf-protect.test.js": "sha256:802a8de2fee57c01a03b523cd6701780c181838006356c30a01452b30381225b",
         "test/layer-0-primitives/csv.test.js": "sha256:6a9ed5a3fc6fd315261ad0bf7788047de5323fe09c36bb52d6e599a761b18085",
-        "test/layer-0-primitives/cwt.test.js": "sha256:1e642b69cbd6a5b33b7755df3a17d5cecfb96e071560e4b384437ce05ab25e4d",
+        "test/layer-0-primitives/cwt.test.js": "sha256:74b06a3278eacbaed102ae9e966fac8d43e3fc609c288fde4f535566df78a5ed",
         "test/layer-0-primitives/daemon.test.js": "sha256:a118c7a6d738115ea4590ef1d639e4c06f139732bcaf8545d649452dfdb3979e",
         "test/layer-0-primitives/daily-byte-quota.test.js": "sha256:c4683ef74d205ba8ebabf3c9f0ce60d0e86824cf0c8a0f23c1e6b8c5b5b70f23",
         "test/layer-0-primitives/dane.test.js": "sha256:59d01acff1a81f0d691ecb28920f5c22e30ef416bf84a52c853c1a00e64cf783",
@@ -2735,7 +2739,7 @@
         "test/layer-0-primitives/fido-mds3.test.js": "sha256:91893e57258f91386ea3baedf8727dac08b5c75725a74b74ecdfbc5d99bb4adc",
         "test/layer-0-primitives/file-type.test.js": "sha256:ba6bb725857cbf7b165f4391e3aa126c9fc4286c5afb92d1964ff1d0dfd2b57c",
         "test/layer-0-primitives/file-upload-content-safety-skip-audit.test.js": "sha256:ad13f7f84a33899b4f4e66b74c896f606e070bfe5df769b0acd109cfb7ab38c7",
-        "test/layer-0-primitives/flag.test.js": "sha256:8b58826342b8c28d90e11e4cfe1a7e266c2296615a90558221cad12e9f6ecb4e",
+        "test/layer-0-primitives/flag.test.js": "sha256:37f17c037220ef60bb0afb79cbddd359a9b5784ed6ce8efd3dc04063fbc09176",
         "test/layer-0-primitives/forensic-snapshot.test.js": "sha256:629a8af1ccd0396e2b30f8e46d76fe19eab9f33c156c0db78e3e76649e21030c",
         "test/layer-0-primitives/fsm.test.js": "sha256:7037831083426478ed4efd7d1c17d4b96c3609816a41819b5c9da71d2b6187e8",
         "test/layer-0-primitives/gate-contract-content-gate.test.js": "sha256:d9f8b94231efb0e02a94b7934bf58a3f8e343829ce11346b7302e69e13efd551",
@@ -2796,7 +2800,7 @@
         "test/layer-0-primitives/iab-tcf.test.js": "sha256:34e5f9b2740c0b96e3f84d003fbbf55a4d366f3d08f6baedca0109573eead9b6",
         "test/layer-0-primitives/idempotency-key.test.js": "sha256:0214b68cbb3f50a0c7cbc7fcb92b1edf86a714dd6040c3a1a2be34b31eb9c631",
         "test/layer-0-primitives/importmap-integrity.test.js": "sha256:babd21e2356c7d1d7916ae89fc228105290bf8c99371f0cde68512a62bea45dd",
-        "test/layer-0-primitives/inbox.test.js": "sha256:d0865782d10cb9a72bbf39223c5499d5b1ec50967173e2dfe3cd1bf88b279d8c",
+        "test/layer-0-primitives/inbox.test.js": "sha256:b8c16ba0cd5f2453ef9cc242dfc1af85e88f8d65a361c02ec2209225a0e67b99",
         "test/layer-0-primitives/incident-report.test.js": "sha256:57bc8d037e6a3f84fcefe0a95205e5ac0f83c6dbb8b1f935c3c5184d2456c857",
         "test/layer-0-primitives/ip-utils.test.js": "sha256:0ca865e21be6a8815a5c0dd772497b3e0ab4cedd67e7dbabf9518c82af789132",
         "test/layer-0-primitives/jose-jwe-experimental.test.js": "sha256:fabd155817296fbac7cea4ccaaf5e1740471fe97b431fe46e13e6a30d13784ef",
@@ -2820,7 +2824,7 @@
         "test/layer-0-primitives/mail-agent.test.js": "sha256:51725784bab6849cb02f1e94e0ba97c2b8e7e101780a26ae7ec19f9d894640ef",
         "test/layer-0-primitives/mail-arf.test.js": "sha256:2279aebee547903a8c1415c9fc1c9c194757b3917e869bfddb43dd0375e68a93",
         "test/layer-0-primitives/mail-auth-dmarc-policy-failclosed.test.js": "sha256:22066c238cdb9c4f84377f56f2d69e387bcb4a601ef384cc874fc55249fbfaa6",
-        "test/layer-0-primitives/mail-auth.test.js": "sha256:4b967c9921ad3e9e84f87eca1a6077d7d089750c4e919ec3ea09e4a11cd06884",
+        "test/layer-0-primitives/mail-auth.test.js": "sha256:36f434e2ddb65b3f4cae76be48a917971254959d2312c1f87a6dfd5144d54560",
         "test/layer-0-primitives/mail-bimi-cert-validity-unparseable.test.js": "sha256:d14d66d801b5767372ce7014617841f8710f7ad95107984da058ade794fd4d8f",
         "test/layer-0-primitives/mail-bimi.test.js": "sha256:3e12e211e1f75f07d1ba43ada69c9adcd205902194f983d8ae24293b1acd1cd5",
         "test/layer-0-primitives/mail-bounce.test.js": "sha256:d4ef09adc71e1c9e336a9fc5b059e6b264d9abcd0c032023bfa7b15a9173a4b7",
@@ -3023,7 +3027,7 @@
         "test/layer-0-primitives/time.test.js": "sha256:59f6dcd5753b9bb97508044c30cfca948c4707dd8d107dab5eab53f0dcd91e84",
         "test/layer-0-primitives/tls-exporter.test.js": "sha256:3224b12f18619fa805e933c8eef18356e42f8554d75d7c4e23ebd8b5b993ca6b",
         "test/layer-0-primitives/tls-ocsp-ct.test.js": "sha256:7c98ddde33095683a3be527fee9e868501ca99eac74cc40fe1c56ca6018f1660",
-        "test/layer-0-primitives/tls-ocsp-freshness.test.js": "sha256:0d979ecdbc7d9c62bcb32e0f2594fa5425bed4a25ef3793915ad0890398fabf7",
+        "test/layer-0-primitives/tls-ocsp-freshness.test.js": "sha256:ddf2723551337d3859add255644e322c74d5e55df07be181795484be0835ee2d",
         "test/layer-0-primitives/tls-ocsp-verify.test.js": "sha256:f726bb9387c570cee945a2b927070899bc7ae933ec09ba481c3aa5f0d11d2ba6",
         "test/layer-0-primitives/tls-pinset-drift.test.js": "sha256:6b7c530326a1025819257daec21711d6f889a8523f2766595f7cc28563f5badc",
         "test/layer-0-primitives/tls-preferred-groups.test.js": "sha256:7d3620cbde85289a98a385a3c3ba9d17f0bb2b8e5f5f9398b5641ff9d1e2b181",
@@ -3052,7 +3056,7 @@
         "test/layer-0-primitives/worker-pool-recycle-race.test.js": "sha256:0e9f12256864334bf49de0b0d62b9d4f9cfeb34e9fe598f9299b811dc4ac4719",
         "test/layer-0-primitives/worker-pool.test.js": "sha256:0a3698d862346f64f98eb1c954694ad6a6b4cedbfc569a1f4d93233b7bfa733a",
         "test/layer-0-primitives/worm.test.js": "sha256:0908cfbf7228de39ab68796505c29071d3117571b8a6c07cef7d1fa27d0380b8",
-        "test/layer-0-primitives/ws-client.test.js": "sha256:e604a0ac206825ec307624ae6df59a644c2dde2c51b965a3b51fce05990cfbde",
+        "test/layer-0-primitives/ws-client.test.js": "sha256:004f5f231e7396fd8b32c7f41e7cd36becaa8919584c740497a9b08c242414c8",
         "test/layer-0-primitives/x509-chain-ca-enforcement.test.js": "sha256:8d68ffe4f8655af99682927524ae5a6c5336f32a57eb7c5c78fef5f2d1b2e6e3",
         "test/layer-1-state/api-key.test.js": "sha256:48d641b673a181746adf80dfa995f0ca29187af17aa4735590557fda4350dcb8",
         "test/layer-5-integration/bundler-output.test.js": "sha256:023f0504a5ae60fb39d347d05e8fe7e9d8fee685eb1bb89dd40406cf01691d22",

package/lib/vendor/blamejs/CHANGELOG.md

@@ -8,6 +8,10 @@ upgrading across more than a few patches at a time.
 
 ## v0.15.x
 
+- v0.15.37 (2026-06-27) — **Several numeric options that silently accepted a non-finite value — disabling a clock-skew / freshness check or a resource cap — now reject it, so an `Infinity` skew or limit can no longer turn off the protection it configures.** A number of configuration options validated a numeric value with a bare `typeof === "number" && value >= 0` check, which accepts `Infinity`. Where the value is a clock-skew tolerance or a resource cap, an `Infinity` (or `NaN`) silently disabled the very check it tunes: a CWT / OCSP-staple / ARC clock-skew of `Infinity` made the expiry, freshness, and expiration comparisons unsatisfiable (an expired token / a replayed pre-revocation "good" response / an expired ARC seal would be accepted); a WebSocket-client `maxMessageBytes` / `maxFrameBytes` / `handshakeTimeoutMs` of `Infinity` disabled the inbound-OOM and stalled-handshake defenses; and inbox / flag-cache / audit-chain size and count caps of `Infinity` admitted unbounded data. These options now route through the finite-bounds validator: a present non-finite value is refused at the entry point (or falls back to the safe default on the result-returning paths). Options where an unbounded value is a deliberate intent — reconnect "retry indefinitely", inbox "retain indefinitely" — continue to accept `Infinity`. **Security:** *A non-finite clock-skew no longer disables CWT / OCSP / ARC time checks* — b.cwt.verify, the OCSP-staple freshness check in b.network.tls, and b.mail.arc.verify each took an operator clock-skew tolerance validated as `typeof === "number" && >= 0`, which accepts `Infinity`. Because each check is of the form `now > deadline + skew`, a skew of `Infinity` made it unsatisfiable and silently turned the check off: an expired CWT verified, a stale (post-nextUpdate) OCSP "good" response — the exact reply an attacker replays after the certificate is revoked — was accepted, and an expired ARC seal passed. A present clock-skew that is not a non-negative finite integer is now refused (b.cwt.verify throws cwt/bad-clock-skew; the OCSP and ARC paths fall back to their safe default). Regression tests assert an expired token / stale staple / expired ARC seal is still rejected when the skew is `Infinity`. · *WebSocket-client inbound caps can no longer be disabled by an Infinity value* — b.wsClient.connect validated maxMessageBytes, maxFrameBytes, and handshakeTimeoutMs (and the ping/pong keepalive intervals) with a bare numeric check that accepted `Infinity`, which disabled the inbound-message and frame size limits — the defenses against a malicious server sending an unbounded message — and the handshake timeout. A present non-finite value for these is now refused at connect time. The reconnect maxAttempts still accepts `Infinity` (a deliberate "reconnect indefinitely" intent). · *Inbox, flag-cache, and audit-chain caps reject a non-finite limit* — The inbox maxPayloadBytes / messageIdMaxLen / sourceMaxLen caps, the flag-cache ttlMs / maxEntries, and the audit-chain partition fan-out cap each accepted `Infinity`, disabling the cap (unbounded stored payloads, a never-expiring or unbounded cache, unbounded fan-out). These now require a positive finite integer — refused at create time, or clamped to the bounded default on the result-returning verify path. The inbox retentionDays still accepts `Infinity` (retain indefinitely).
+
+- v0.15.36 (2026-06-27) — **Internal test-suite hardening only — the published library's runtime behavior and public API are unchanged (source-comment marker text aside).** The codebase-patterns guard class that allows a bare comma/semicolon split on token-only RFC header grammars was re-verified from scratch and renamed to a descriptive token, with its old name recorded as retired. Each live marked site (RRULE, RFC 9421 component identifiers, TLS-RPT rua, SCIM attribute paths) was re-read and confirmed to split a grammar with no quoted-string members. Five marker comments that suppressed nothing were removed or turned into plain explanatory comments. No runtime code, public API, or wire format changed. **Detectors:** *Bare token-only header-split suppression class re-verified, renamed, and pruned of inert markers* — Each marked bare `.split(",")` / `.split(";")` on an RFC header value was re-read and confirmed to operate on a token-only grammar (no quoted-string members, so a quote-aware splitter is unnecessary): RFC 5545 RRULE, RFC 9421 signature component identifiers, RFC 8460 TLS-RPT rua, and RFC 7644 SCIM attribute paths. The guard class was renamed to a descriptive token and its old name added to the retired-token set. Five marker comments that the detector never actually evaluated (two sat on a date-normalizing `.replace`, three in header parsers the guard intentionally does not scan) were removed or converted to plain comments. This is test-suite tooling plus source-comment text; no shipped framework behavior changed.
+
 - v0.15.35 (2026-06-26) — **`b.metrics` shadow registry no longer lets a comma in a label value forge extra Prometheus label pairs — a label-injection that downstream tenant-scoping or authorization selectors could be tricked by.** The shadow registry serialized a metric's label set into a `name=value,name=value` string key and re-split it on `,` to build the Prometheus exposition. A label VALUE containing a comma therefore split into multiple label pairs, so a single operator-set label could forge additional label pairs in the scrape output (for example turning one `route` label into a `route` plus an attacker-named label), which downstream tenant-scoping filters, authorization selectors, recording rules, and alerting trust as a boundary; two distinct label sets could also collide into one cardinality bucket. The label key now uses canonical-JSON of the string-coerced label set (the same approach the main registry already used) and the render path emits the structured label set kept alongside that key rather than splitting or re-parsing, so a `,` or `=` inside a label value stays inside the value and a label NAMED `constructor`, `prototype`, or `__proto__` (all valid Prometheus label names) is preserved instead of being dropped. Note: the cardinality keys exposed by `shadowRegistry().snapshot()` are now canonical-JSON strings (e.g. `{"route":"/api"}`) rather than `route=/api`. **Changed:** *shadowRegistry().snapshot() cardinality keys are canonical-JSON* — As a consequence of the label-injection fix, the per-series cardinality keys in a shadow-registry snapshot are now canonical-JSON strings (e.g. `{"tenant":"a"}`) instead of the previous `tenant=a` form. Code that reads those keys directly from snapshot() should parse them as JSON; the Prometheus render output is unchanged for conforming label values. **Security:** *Label values can no longer forge extra Prometheus label pairs in the shadow registry* — b.metrics shadowRegistry built a metric's cardinality key by joining `name=value` pairs with commas, then split that string on commas when rendering the Prometheus exposition. A comma (and `=`) in a label value therefore broke one value into several forged label pairs in the scrape output, and two different label sets could collide into the same cardinality bucket. The key is now canonical-JSON of the string-coerced label set and the render emits the structured label set kept alongside that key rather than splitting or re-parsing, so a label value is emitted as a single quoted value with its commas/equals intact, distinct label sets get distinct keys, and a label NAMED `constructor`, `prototype`, or `__proto__` (each a valid Prometheus label name) is preserved rather than dropped. Deterministic regression tests assert a comma-bearing label value produces exactly one label pair and that the reserved-name labels survive render.
 
 - v0.15.34 (2026-06-26) — **`b.mail.crypto.pgp.verify` now accepts every valid RSA OpenPGP signature — one whose value happened to have a high zero byte (about 1 in 256) was being rejected.** An OpenPGP RSA signature is an integer modulo the key's modulus, and ~1 in 256 signatures have a value that begins with a zero byte. The MPI encoding strips those leading zero bytes (RFC 9580 §3.2), but b.mail.crypto.pgp.verify passed the stripped value straight to the RSA verification, which requires a signature exactly the modulus byte length — so a perfectly valid signature was intermittently reported invalid. The signature is now left-padded back to the modulus width before verification, exactly as the Ed25519 path already pads its components. Verification of every valid RSA signature is now reliable, including signatures produced by other OpenPGP implementations. Also includes internal test-tooling: two more guard-suite suppression classes were re-verified and their tokens retired. **Fixed:** *RSA OpenPGP signatures with a high zero byte now verify reliably* — b.mail.crypto.pgp.verify read the RSA signature MPI (whose leading zero bytes the OpenPGP wire format strips) and handed it to the RSA verification without restoring the stripped bytes. Node's RSA verify requires the signature to be exactly the modulus byte length, so a signature whose value had one or more high zero bytes — about 1 in 256 of all signatures, for any key — was rejected as invalid even though it was correct. The signature is now left-padded to the modulus width before verification (the same correction the Ed25519 verification path already applied to its R/S components). This affects signatures the framework produces and signatures from other OpenPGP implementations alike. A deterministic regression test searches for a short-MPI signature and asserts it verifies. **Detectors:** *Two more suppression-marker classes re-verified and their tokens retired* — The raw-hash-compare and seal-without-aad guard classes were re-read and confirmed (a data-residency region tag compared with === — not a secret; and two intentional non-AEAD-bound seals — a non-regulated plain-mode column whose AAD is enforced by the posture seal-envelope floor where it matters, and a throwaway vault-readiness probe), then renamed to descriptive tokens with their old names added to the retired-token set. Test-suite tooling only.

package/lib/vendor/blamejs/api-snapshot.json

@@ -1,7 +1,7 @@
 {
   "version": 1,
-  "frameworkVersion": "0.15.35",
-  "createdAt": "2026-06-27T05:20:14.742Z",
+  "frameworkVersion": "0.15.37",
+  "createdAt": "2026-06-27T08:30:34.621Z",
   "exports": {
     "a2a": {
       "type": "object",

package/lib/vendor/blamejs/lib/agent-posture-chain.js

@@ -124,7 +124,7 @@ function create(opts) {
   var auditImpl = opts.audit || audit();
   var declaredRegimes = Object.create(null);
   for (var i = 0; i < BUILTIN_REGIMES.length; i += 1) declaredRegimes[BUILTIN_REGIMES[i]] = true;
-  // allow:numeric-opt-Infinity — operator opt clamped to [1, DEFAULT_MAX_HOP_COUNT]; bad input falls back to default
+  // allow:numeric-opt-Infinity-intentional — operator opt clamped to [1, DEFAULT_MAX_HOP_COUNT] (the `<= DEFAULT_MAX_HOP_COUNT` upper bound rejects Infinity); bad input falls back to default
   var maxHopCount = typeof opts.maxHopCount === "number" && opts.maxHopCount > 0 &&
                     opts.maxHopCount <= DEFAULT_MAX_HOP_COUNT
                       ? Math.floor(opts.maxHopCount)

package/lib/vendor/blamejs/lib/audit-chain.js

@@ -37,6 +37,7 @@ var canonicalJson = require("./canonical-json");
 var C = require("./constants");
 var clusterStorage = require("./cluster-storage");
 var frameworkSchema = require("./framework-schema");
+var numericBounds = require("./numeric-bounds");
 var sql = require("./sql");
 var safeSql = require("./safe-sql");
 var safeBuffer = require("./safe-buffer");
@@ -305,7 +306,10 @@ async function verifyChain(queryAllAsync, tableName, opts) {
     // coerce so a Postgres INTEGER/BIGINT chainKey is type-stable in the
     // reported break-shape and the per-key WHERE bind, matching SQLite.
     var keyRows = frameworkSchema.coerceRows(await queryAllAsync(keysBuilt.sql, keysBuilt.params));
-    var maxChains = (typeof opts.maxChains === "number" && opts.maxChains > 0) ? opts.maxChains : 100000;   // allow:numeric-opt-Infinity — partition fan-out cap; non-number / <=0 falls back to the default
+    // Partition fan-out cap; a non-finite / <= 0 / non-integer value (Infinity
+    // would make the `keyRows.length > maxChains` cap unsatisfiable) falls back
+    // to the bounded default rather than disabling the cap.
+    var maxChains = numericBounds.isPositiveFiniteInt(opts.maxChains) ? opts.maxChains : 100000;
     if (keyRows.length > maxChains) {
       return {
         ok:           false,

package/lib/vendor/blamejs/lib/calendar.js

@@ -1119,7 +1119,7 @@ function _firstParamValue(prop, paramName) {
 
 function _icalRruleToJscal(rrule) {
   var out = { "@type": "RecurrenceRule", frequency: "daily" };
-  var parts = String(rrule).split(";");                                                                // allow:bare-split-on-quoted-header — RFC 5545 RRULE grammar has no quoted-string members; values are token-only
+  var parts = String(rrule).split(";");                                                                // allow:bare-split-on-quoted-header-token-grammar — RFC 5545 RRULE grammar has no quoted-string members; values are token-only
   for (var i = 0; i < parts.length; i += 1) {
     var kv = parts[i].split("=");
     if (kv.length !== 2) continue;
@@ -1129,11 +1129,11 @@ function _icalRruleToJscal(rrule) {
     else if (key === "INTERVAL") out.interval = parseInt(val, 10);
     else if (key === "COUNT") out.count = parseInt(val, 10);
     else if (key === "UNTIL") out.until = _icalDateTimeToUtc(val);
-    else if (key === "BYDAY") out.byDay = val.split(",").map(function (d) {                            // allow:bare-split-on-quoted-header — RFC 5545 BYDAY values are token-only
+    else if (key === "BYDAY") out.byDay = val.split(",").map(function (d) {                            // allow:bare-split-on-quoted-header-token-grammar — RFC 5545 BYDAY values are token-only
       return { "@type": "NDay", day: d.slice(-2).toLowerCase() };
     });
-    else if (key === "BYMONTH") out.byMonth = val.split(",");                                          // allow:bare-split-on-quoted-header — RFC 5545 BYMONTH values are integer-only
-    else if (key === "BYMONTHDAY") out.byMonthDay = val.split(",").map(function (n) { return parseInt(n, 10); }); // allow:bare-split-on-quoted-header — RFC 5545 BYMONTHDAY values are integer-only
+    else if (key === "BYMONTH") out.byMonth = val.split(",");                                          // allow:bare-split-on-quoted-header-token-grammar — RFC 5545 BYMONTH values are integer-only
+    else if (key === "BYMONTHDAY") out.byMonthDay = val.split(",").map(function (n) { return parseInt(n, 10); }); // allow:bare-split-on-quoted-header-token-grammar — RFC 5545 BYMONTHDAY values are integer-only
   }
   return out;
 }
@@ -1168,13 +1168,13 @@ function _utcDateTimeToIcal(s) {
   // JSCalendar UTCDateTime "2026-05-22T10:00:00.123Z" →
   // "20260522T100000Z" (RFC 5545 §3.3.5 form 2 has NO fractional
   // seconds; strict ICS consumers reject `T100000.123Z`).
-  return String(s).replace(/\.\d+/, "").replace(/[-:]/g, "");                                          // allow:bare-split-on-quoted-header — not a header split
+  return String(s).replace(/\.\d+/, "").replace(/[-:]/g, "");
 }
 
 function _localDateTimeToIcal(s) {
   // JSCalendar LocalDateTime "2026-05-22T09:00:00.123" →
   // "20260522T090000" (same fractional-second strip as the UTC form).
-  return String(s).replace(/\.\d+/, "").replace(/[-:]/g, "");                                          // allow:bare-split-on-quoted-header — not a header split
+  return String(s).replace(/\.\d+/, "").replace(/[-:]/g, "");
 }
 
 function _isUtcDateTime(s) {

package/lib/vendor/blamejs/lib/cwt.js

@@ -39,6 +39,7 @@
 var cose = require("./cose");
 var cbor = require("./cbor");
 var C = require("./constants");
+var numericBounds = require("./numeric-bounds");
 var validateOpts = require("./validate-opts");
 var { defineClass } = require("./framework-error");
 
@@ -191,7 +192,11 @@ async function verify(cwt, opts) {
   }
 
   // Time claims (NumericDate, seconds). Skew tolerance both directions.
-  var skew = (typeof opts.clockSkewSec === "number" && opts.clockSkewSec >= 0) ? opts.clockSkewSec : 60;   // allow:numeric-opt-Infinity — clamped non-negative, else default / allow:raw-time-literal — clock-skew in seconds (NumericDate units), not a ms duration
+  // A present clockSkewSec must be a non-negative finite integer — an
+  // Infinity / NaN / negative skew would otherwise make `now > exp + skew`
+  // unsatisfiable and silently disable the expiry / not-before checks.
+  numericBounds.requireNonNegativeFiniteIntIfPresent(opts.clockSkewSec, "cwt.verify: opts.clockSkewSec", CwtError, "cwt/bad-clock-skew");
+  var skew = (typeof opts.clockSkewSec === "number") ? opts.clockSkewSec : 60;   // allow:raw-time-literal — clock-skew in seconds (NumericDate units), not a ms duration
   var now = _nowSec(opts);
   // A present exp / nbf MUST be a well-formed NumericDate — a non-numeric
   // value would otherwise bypass the time check entirely (a token could

package/lib/vendor/blamejs/lib/external-db.js

@@ -1338,8 +1338,9 @@ async function transaction(fn, opts) {
   // (serialization_failure) are transient — retry with capped attempts
   // and a small jittered backoff. Operators tune retries via opts.deadlockRetries (default 3).
   // numeric-bounds doesn't have a non-negative-int helper; use a
-  // direct check with allow marker (zero is permitted to disable
-  // retries entirely).
+  // Explicit isFinite/integer guard (zero is permitted to disable retries
+  // entirely); a non-finite deadlockRetries is refused here, so Math.floor
+  // below only ever sees a validated finite integer.
   if (opts.deadlockRetries !== undefined) {
     if (typeof opts.deadlockRetries !== "number" || !isFinite(opts.deadlockRetries) ||
         opts.deadlockRetries < 0 || (opts.deadlockRetries | 0) !== opts.deadlockRetries) {
@@ -1348,7 +1349,7 @@ async function transaction(fn, opts) {
     }
   }
   var maxRetries = (typeof opts.deadlockRetries === "number")
-    ? Math.floor(opts.deadlockRetries) : 3;                                       // allow:numeric-opt-Infinity
+    ? Math.floor(opts.deadlockRetries) : 3;
   // Validate the transaction-level residency tag shape at entry (the
   // sessionGucs / deadlockRetries discipline) so an empty-string tag
   // fails before BEGIN rather than at the first statement.

package/lib/vendor/blamejs/lib/flag-cache.js

@@ -24,6 +24,7 @@
 var validateOpts = require("./validate-opts");
 var lazyRequire  = require("./lazy-require");
 var C            = require("./constants");
+var numericBounds = require("./numeric-bounds");
 var { defineClass } = require("./framework-error");
 var FlagError = defineClass("FlagError", { alwaysPermanent: true });
 
@@ -36,18 +37,17 @@ function cache(downstream, opts) {
     throw new FlagError("flag/bad-cache",
       "cache: downstream provider must implement .evaluate()");
   }
-  // allow:numeric-opt-Infinity — defaults clamped + ttl-floor enforced below
-  var ttlMs = (typeof opts.ttlMs === "number" && opts.ttlMs > 0)
-    ? opts.ttlMs
-    : C.TIME.seconds(30);
+  // A present ttlMs / maxEntries must be a positive finite integer — Infinity
+  // would pass a bare `typeof === "number" && > 0` check and give a
+  // never-expiring entry (ttlMs) or an unbounded cache (maxEntries).
+  numericBounds.requirePositiveFiniteIntIfPresent(opts.ttlMs, "flag.cache: opts.ttlMs", FlagError, "flag/bad-cache");
+  var ttlMs = (typeof opts.ttlMs === "number") ? opts.ttlMs : C.TIME.seconds(30);
   if (ttlMs < C.TIME.seconds(1)) {
     throw new FlagError("flag/bad-cache",
       "cache: ttlMs must be >= 1000ms - got " + ttlMs);
   }
-  // allow:numeric-opt-Infinity — maxEntries default + Math.floor coerce; throws on bad type at config time
-  var maxEntries = (typeof opts.maxEntries === "number" && opts.maxEntries > 0)
-    ? Math.floor(opts.maxEntries)
-    : 10000;                                       // entry-count default
+  numericBounds.requirePositiveFiniteIntIfPresent(opts.maxEntries, "flag.cache: opts.maxEntries", FlagError, "flag/bad-cache");
+  var maxEntries = (typeof opts.maxEntries === "number") ? opts.maxEntries : 10000;   // entry-count default
   var auditOn = opts.audit === true;            // off by default — too chatty
   var entries = new Map();
   var hits   = 0;

package/lib/vendor/blamejs/lib/http-client-cache.js

@@ -212,7 +212,7 @@ function _buildCacheKey(method, url, varyHeaderValues) {
 // uncacheable.
 function _extractVaryValues(varyHeader, requestHeaders) {
   if (typeof varyHeader !== "string" || varyHeader.length === 0) return [];
-  var names = varyHeader.split(",").map(function (s) {                                          // allow:bare-split-on-quoted-header — RFC 9110 §12.5.5 Vary is a comma-list of field-names (token grammar); no quoted-string
+  var names = varyHeader.split(",").map(function (s) {                                          // RFC 9110 §12.5.5 Vary is a comma-list of field-names (token grammar); no quoted-string, so a bare split is correct
     return s.trim().toLowerCase();
   }).filter(function (s) { return s.length > 0; });
   if (names.indexOf("*") !== -1) return null;  // sentinel: "uncacheable"
@@ -262,7 +262,7 @@ function _evaluateStorage(method, statusCode, responseHeaders, sharedCache) {
 
   // Vary: * is uncacheable per RFC 9110 §12.5.5.
   if (typeof varyHeader === "string" && varyHeader.indexOf("*") !== -1) {
-    var trimmed = varyHeader.split(",").map(function (s) { return s.trim(); });                  // allow:bare-split-on-quoted-header — RFC 9110 §12.5.5 Vary field-names; token grammar only
+    var trimmed = varyHeader.split(",").map(function (s) { return s.trim(); });                  // RFC 9110 §12.5.5 Vary field-names; token grammar only, so a bare split is correct
     if (trimmed.indexOf("*") !== -1) {
       return { cacheable: false, reason: "vary-star", freshnessMs: -1, directives: directives, varyHeader: varyHeader };
     }

package/lib/vendor/blamejs/lib/http-message-signature.js

@@ -319,7 +319,7 @@ function sign(msg, opts) {
   // header isn't already supplied. Operators wanting to use the
   // RFC 9530 "sha-512" identifier (SHA-512 instead of SHA3-512) supply
   // the header themselves; the framework emits SHA3-512.
-  var coveredLower = opts.covered.map(function (c) { return c.split(";")[0].toLowerCase(); });  // allow:bare-split-on-quoted-header — opts.covered is operator-supplied component-id list (e.g. "content-digest;sf"); component identifiers are RFC 9421 §2.1 derived-field names with token-only grammar; no quoted-string
+  var coveredLower = opts.covered.map(function (c) { return c.split(";")[0].toLowerCase(); });  // allow:bare-split-on-quoted-header-token-grammar — opts.covered is operator-supplied component-id list (e.g. "content-digest;sf"); component identifiers are RFC 9421 §2.1 derived-field names with token-only grammar; no quoted-string
   if (coveredLower.indexOf("content-digest") !== -1 &&
       _resolveHeader(m.headers, "content-digest") === null) {
     if (m.body == null) {
@@ -451,7 +451,7 @@ function _parseSignature(headerValue, label) {
   if (headerValue.indexOf(prefix) !== 0) {
     // Multiple signature labels can appear; comma-separated. Find the
     // matching label.
-    var parts = headerValue.split(",");                                                        // allow:bare-split-on-quoted-header — RFC 9421 §2.4 Signature header values are `label=:b64:` form; base64 alphabet excludes `,` and the label tokens are RFC 8941 §3.3.4 sf-token (no DQUOTE in practice)
+    var parts = headerValue.split(",");                                                        // allow:bare-split-on-quoted-header-token-grammar — RFC 9421 §2.4 Signature header values are `label=:b64:` form; base64 alphabet excludes `,` and the label tokens are RFC 8941 §3.3.4 sf-token (no DQUOTE in practice)
     for (var i = 0; i < parts.length; i++) {
       var p = parts[i].trim();
       if (p.indexOf(prefix) === 0) {
@@ -519,7 +519,7 @@ function verify(msg, opts) {
   // If content-digest is covered, recompute and compare. RFC 9421 §B.2.5
   // mandates that verifiers re-run the digest over the body — a stale
   // header from a proxy would otherwise verify trivially.
-  var coveredLower = parsedInput.covered.map(function (c) { return c.split(";")[0].toLowerCase(); });  // allow:bare-split-on-quoted-header — same as sign() above: covered items are RFC 9421 §2.1 component-ids, token grammar
+  var coveredLower = parsedInput.covered.map(function (c) { return c.split(";")[0].toLowerCase(); });  // allow:bare-split-on-quoted-header-token-grammar — same as sign() above: covered items are RFC 9421 §2.1 component-ids, token grammar
   if (coveredLower.indexOf("content-digest") !== -1) {
     if (m.body == null) {
       return { valid: false, reason: "content-digest-no-body" };

package/lib/vendor/blamejs/lib/inbox.js

@@ -44,6 +44,7 @@
 
 var C = require("./constants");
 var codepointClass = require("./codepoint-class");
+var numericBounds = require("./numeric-bounds");
 var lazyRequire = require("./lazy-require");
 var safeJson = require("./safe-json");
 var safeSql = require("./safe-sql");
@@ -155,15 +156,17 @@ function create(opts) {
   // The table identifier reaches SQL through b.sql, which validates +
   // quotes it by construction on every emitted statement; _validateTableName
   // above fails fast at create() time on a bad name.
-  var retentionDays  = (typeof opts.retentionDays === "number" && opts.retentionDays > 0)        // allow:numeric-opt-Infinity
+  var retentionDays  = (typeof opts.retentionDays === "number" && opts.retentionDays > 0)        // allow:numeric-opt-Infinity-intentional — Infinity = retain indefinitely, a supported intent
     ? opts.retentionDays : 30;                                                                   // default retention days
   var auditOn        = opts.audit !== false;
-  var maxPayloadBytes = (typeof opts.maxPayloadBytes === "number" && opts.maxPayloadBytes > 0)   // allow:numeric-opt-Infinity
-    ? opts.maxPayloadBytes : C.BYTES.kib(64);
-  var messageIdMaxLen = (typeof opts.messageIdMaxLen === "number" && opts.messageIdMaxLen > 0)   // allow:numeric-opt-Infinity
-    ? opts.messageIdMaxLen : 256;                                                                // message-id length cap
-  var sourceMaxLen = (typeof opts.sourceMaxLen === "number" && opts.sourceMaxLen > 0)            // allow:numeric-opt-Infinity
-    ? opts.sourceMaxLen : 256;                                                                   // source length cap
+  // The byte / length caps must be positive finite integers — Infinity would
+  // disable the cap and admit unbounded stored payloads / identifiers.
+  numericBounds.requireAllPositiveFiniteIntIfPresent(opts,
+    ["maxPayloadBytes", "messageIdMaxLen", "sourceMaxLen"],
+    "inbox.create", InboxError, "inbox/bad-opt");
+  var maxPayloadBytes = (typeof opts.maxPayloadBytes === "number") ? opts.maxPayloadBytes : C.BYTES.kib(64);
+  var messageIdMaxLen = (typeof opts.messageIdMaxLen === "number") ? opts.messageIdMaxLen : 256;   // message-id length cap
+  var sourceMaxLen = (typeof opts.sourceMaxLen === "number") ? opts.sourceMaxLen : 256;            // source length cap
 
   function _emitAudit(action, outcome, metadata) {
     if (!auditOn) return;
@@ -346,6 +349,14 @@ function create(opts) {
   }
 
   async function sweep() {
+    // retentionDays: Infinity is the documented "retain indefinitely" intent —
+    // there is no horizon to age past, so sweep deletes nothing. (Computing a
+    // cutoff would otherwise throw: `new Date(Date.now() - Infinity)` is an
+    // Invalid Date, and "Infinity days" is not a valid Postgres interval.)
+    if (!isFinite(retentionDays)) {
+      _emitAudit("inbox.swept", "success", { deleted: 0, retentionDays: retentionDays });
+      return 0;
+    }
     var dialect = _sqlDialect(externalDb);
     var deleted = 0;
     await externalDb.transaction(async function (xdb) {

package/lib/vendor/blamejs/lib/mail-arc-sign.js

@@ -51,6 +51,7 @@
 var nodeCrypto = require("node:crypto");
 var lazyRequire = require("./lazy-require");
 var validateOpts = require("./validate-opts");
+var numericBounds = require("./numeric-bounds");
 var safeBuffer = require("./safe-buffer");
 var dkim = require("./mail-dkim");
 var { defineClass } = require("./framework-error");
@@ -246,8 +247,11 @@ function sign(opts) {
         "sign: headersToSign[" + hi + "] must be a non-empty string");
     }
   }
-  var timestamp = (typeof opts.timestamp === "number" && opts.timestamp > 0)            // allow:numeric-opt-Infinity
-    ? Math.floor(opts.timestamp) : Math.floor(Date.now() / 1000);                       // Unix epoch seconds divisor
+  // A present t= timestamp must be a positive finite integer (NumericDate
+  // seconds) — an Infinity / NaN value would serialize into a malformed t= tag.
+  numericBounds.requirePositiveFiniteIntIfPresent(opts.timestamp, "arc.sign: opts.timestamp", MailAuthError, "arc-sign/bad-timestamp");
+  var timestamp = (typeof opts.timestamp === "number")
+    ? opts.timestamp : Math.floor(Date.now() / 1000);                                   // Unix epoch seconds divisor
   var auditOn = opts.audit !== false;
 
   var keyObject;

package/lib/vendor/blamejs/lib/mail-auth.js

@@ -52,6 +52,7 @@ var structuredFields = require("./structured-fields");
 var markupEscape = require("./markup-escape").markupEscape;
 var bCrypto = require("./crypto");
 var C = require("./constants");
+var numericBounds = require("./numeric-bounds");
 var dkim = require("./mail-dkim");
 var mimeParse = require("./mime-parse");
 var safeXml = require("./parsers/safe-xml");
@@ -1575,7 +1576,11 @@ async function arcVerify(rfc822, opts) {
   var anyFail = false;
   // RFC 8617 §5.2 — operator-tunable clock skew on t= (signing
   // timestamp) and x= (expiration) tags. Default 5 min.
-  var arcClockSkewMs = typeof opts.clockSkewMs === "number" && opts.clockSkewMs >= 0           // allow:numeric-opt-Infinity — operator-supplied skew, default 5 min
+  // A present clockSkewMs must be a non-negative finite integer; an Infinity /
+  // NaN / negative skew makes `amsX + skewSec < nowSec` (and the t= future
+  // check) unsatisfiable and silently disables the RFC 8617 §5.2 expiry /
+  // future-timestamp gate. Non-finite falls to the default.
+  var arcClockSkewMs = numericBounds.isNonNegativeFiniteInt(opts.clockSkewMs)
     ? opts.clockSkewMs : C.TIME.minutes(5);
   var nowSec = Math.floor(Date.now() / 1000);                                                  // Unix epoch seconds divisor
 

package/lib/vendor/blamejs/lib/middleware/age-gate.js

@@ -101,9 +101,9 @@ function create(opts) {
       "middleware.ageGate: opts.getAge must be a function (req) -> number | null");
   }
   var getAge = opts.getAge;
-  var requireAge = (typeof opts.requireAge === "number" && opts.requireAge > 0)            // allow:numeric-opt-Infinity — age is operator domain, not a bytes/time-shaped opt
+  var requireAge = (typeof opts.requireAge === "number" && opts.requireAge > 0)            // allow:numeric-opt-Infinity-intentional — age threshold; an Infinity bound is fail-closed (denies everyone), never a bypass
     ? opts.requireAge : null;
-  var consentRequired = (typeof opts.consentRequired === "number" && opts.consentRequired > 0)  // allow:numeric-opt-Infinity — age threshold, not a bytes/time-shaped opt
+  var consentRequired = (typeof opts.consentRequired === "number" && opts.consentRequired > 0)  // allow:numeric-opt-Infinity-intentional — age threshold; an Infinity bound is fail-closed (classifies everyone below-threshold), never a bypass
     ? opts.consentRequired : null;
   var hasParentalConsent = typeof opts.hasParentalConsent === "function" ? opts.hasParentalConsent : null;
   var skipPaths = Array.isArray(opts.skipPaths) ? opts.skipPaths.slice() : [];

package/lib/vendor/blamejs/lib/middleware/body-parser.js

@@ -351,7 +351,7 @@ function _detectSmuggling(req) {
   //    (RFC 9112 §6.1). Anything else is a smuggling vector or
   //    server-side decode error.
   if (typeof te === "string" && te.length > 0) {
-    var tokens = te.toLowerCase().split(",").map(function (t) { return t.trim(); });               // allow:bare-split-on-quoted-header — RFC 9112 §6.1 Transfer-Encoding values (chunked / gzip / deflate / identity) are token-only; no quoted-string in the grammar
+    var tokens = te.toLowerCase().split(",").map(function (t) { return t.trim(); });               // RFC 9112 §6.1 Transfer-Encoding values (chunked / gzip / deflate / identity) are token-only; no quoted-string in the grammar, so a bare split is correct
     var last = tokens[tokens.length - 1];
     if (last !== "chunked") {
       return {

package/lib/vendor/blamejs/lib/middleware/scim-server.js

@@ -237,8 +237,8 @@ async function _dispatch(req, res, basePath, bearer, opts, maxPageSize, bulkCfg)
       count:              pageSize,
       sortBy:             query.sortBy || null,
       sortOrder:          query.sortOrder || null,
-      attributes:         query.attributes ? query.attributes.split(",") : null,                  // allow:bare-split-on-quoted-header — RFC 7644 §3.9 attributes/excludedAttributes are SCIM attribute paths (URN-ish identifiers); grammar excludes DQUOTE
-      excludedAttributes: query.excludedAttributes ? query.excludedAttributes.split(",") : null,    // allow:bare-split-on-quoted-header — same SCIM attribute-name grammar
+      attributes:         query.attributes ? query.attributes.split(",") : null,                  // allow:bare-split-on-quoted-header-token-grammar — RFC 7644 §3.9 attributes/excludedAttributes are SCIM attribute paths (URN-ish identifiers); grammar excludes DQUOTE
+      excludedAttributes: query.excludedAttributes ? query.excludedAttributes.split(",") : null,    // allow:bare-split-on-quoted-header-token-grammar — same SCIM attribute-name grammar
     }, ctx);
     _writeJson(res, H.OK, {
       schemas:      [SCIM_MESSAGE_LIST],

package/lib/vendor/blamejs/lib/network-smtp-policy.js

@@ -613,7 +613,7 @@ async function tlsRptFetchPolicy(domain, opts) {
   var rua = [];
   for (var p = 0; p < pairs.length; p += 1) {
     if (pairs[p][0] === "rua") {
-      var uris = pairs[p][1].split(",");                                                      // allow:bare-split-on-quoted-header — allow:raw-time-literal — TLS-RPT rua grammar (RFC 8460 §3): rua = tlsrpt-uri *("," tlsrpt-uri); URIs percent-encode reserved chars, no quoted-string
+      var uris = pairs[p][1].split(",");                                                      // allow:bare-split-on-quoted-header-token-grammar — allow:raw-time-literal — TLS-RPT rua grammar (RFC 8460 §3): rua = tlsrpt-uri *("," tlsrpt-uri); URIs percent-encode reserved chars, no quoted-string
       for (var u = 0; u < uris.length; u += 1) {
         var uri = uris[u].trim();
         if (uri.length > 0) rua.push(uri);

package/lib/vendor/blamejs/lib/network-tls.js

@@ -1204,7 +1204,11 @@ function evaluateOcspResponse(ocspDer, opts) {
   // gets revoked, the attacker keeps presenting the cached "good" and
   // the framework keeps accepting it. requireGood postures depend on
   // freshness — reject expired or future-dated responses outright.
-  var clockSkewMs = typeof opts.clockSkewMs === "number" && opts.clockSkewMs >= 0           // allow:numeric-opt-Infinity — operator-supplied skew, default 5 min if absent or invalid
+  // A present clockSkewMs must be a non-negative finite integer; an Infinity /
+  // NaN / negative skew would make the staleness check `now > nextUpdate + skew`
+  // unsatisfiable and silently disable the freshness window — accepting a
+  // replayed pre-revocation "good" response. Non-finite falls to the default.
+  var clockSkewMs = numericBounds.isNonNegativeFiniteInt(opts.clockSkewMs)
     ? opts.clockSkewMs : C.TIME.minutes(5);
   var now = typeof opts.now === "number" ? opts.now : Date.now();
   // thisUpdate / nextUpdate are already unix-ms NUMBERS (parseOcspResponse →

package/lib/vendor/blamejs/lib/ws-client.js

@@ -52,6 +52,7 @@ var { EventEmitter } = require("node:events");
 
 var lazyRequire    = require("./lazy-require");
 var validateOpts   = require("./validate-opts");
+var numericBounds  = require("./numeric-bounds");
 var safeAsync      = require("./safe-async");
 var safeBuffer     = require("./safe-buffer");
 var bCrypto        = lazyRequire(function () { return require("./crypto"); });
@@ -217,16 +218,18 @@ function connect(target, opts) {
         "wsClient.connect: subprotocols[" + sp + "] must be a non-empty string");
     }
   }
-  var pingMs = (typeof opts.pingMs === "number" && opts.pingMs > 0)              // allow:numeric-opt-Infinity
-    ? opts.pingMs : DEFAULT_PING_MS;
-  var pongMs = (typeof opts.pongMs === "number" && opts.pongMs > 0)              // allow:numeric-opt-Infinity
-    ? opts.pongMs : DEFAULT_PONG_MS;
-  var maxMessageBytes = (typeof opts.maxMessageBytes === "number" && opts.maxMessageBytes > 0)   // allow:numeric-opt-Infinity
-    ? opts.maxMessageBytes : DEFAULT_MAX_BYTES;
-  var maxFrameBytes = (typeof opts.maxFrameBytes === "number" && opts.maxFrameBytes > 0)         // allow:numeric-opt-Infinity
-    ? opts.maxFrameBytes : DEFAULT_MAX_FRAME;
-  var handshakeTimeoutMs = (typeof opts.handshakeTimeoutMs === "number" && opts.handshakeTimeoutMs > 0)  // allow:numeric-opt-Infinity
-    ? opts.handshakeTimeoutMs : DEFAULT_HANDSHAKE_TIMEOUT_MS;
+  // These are keepalive/timeout intervals and inbound-OOM caps; a present
+  // value must be a positive finite integer. A bare `typeof === "number" && > 0`
+  // check accepts Infinity, which silently disables the cap (a malicious server
+  // could then send an unbounded message/frame, or stall the handshake forever).
+  numericBounds.requireAllPositiveFiniteIntIfPresent(opts,
+    ["pingMs", "pongMs", "maxMessageBytes", "maxFrameBytes", "handshakeTimeoutMs"],
+    "wsClient.connect", WsClientError, "ws-client/bad-opt");
+  var pingMs = (typeof opts.pingMs === "number") ? opts.pingMs : DEFAULT_PING_MS;
+  var pongMs = (typeof opts.pongMs === "number") ? opts.pongMs : DEFAULT_PONG_MS;
+  var maxMessageBytes = (typeof opts.maxMessageBytes === "number") ? opts.maxMessageBytes : DEFAULT_MAX_BYTES;
+  var maxFrameBytes = (typeof opts.maxFrameBytes === "number") ? opts.maxFrameBytes : DEFAULT_MAX_FRAME;
+  var handshakeTimeoutMs = (typeof opts.handshakeTimeoutMs === "number") ? opts.handshakeTimeoutMs : DEFAULT_HANDSHAKE_TIMEOUT_MS;
 
   var reconnectOpts = _normaliseReconnect(opts.reconnect);
   var permessageDeflate = opts.permessageDeflate !== false;
@@ -281,14 +284,18 @@ function _normaliseReconnect(input) {
       "wsClient.connect: reconnect must be false / null / object");
   }
   validateOpts(input, ["maxAttempts", "baseMs", "maxMs", "enabled"], "wsClient.connect.reconnect");
+  // baseMs / maxMs are backoff durations; a present value must be a positive
+  // finite integer (an Infinity base would stall the first reconnect forever).
+  numericBounds.requireAllPositiveFiniteIntIfPresent(input, ["baseMs", "maxMs"],
+    "wsClient.connect.reconnect", WsClientError, "ws-client/bad-reconnect-opt");
   return {
     enabled:     input.enabled !== false,
-    maxAttempts: (typeof input.maxAttempts === "number" && input.maxAttempts >= 0)            // allow:numeric-opt-Infinity
+    // maxAttempts: Infinity is a deliberate "reconnect indefinitely" intent, so
+    // a non-finite value is accepted here (unlike the bounded caps above).
+    maxAttempts: (typeof input.maxAttempts === "number" && input.maxAttempts >= 0)            // allow:numeric-opt-Infinity-intentional — Infinity = reconnect indefinitely, a supported intent
       ? input.maxAttempts : DEFAULT_RECONNECT_MAX_ATTEMPTS,
-    baseMs:      (typeof input.baseMs === "number" && input.baseMs > 0)                       // allow:numeric-opt-Infinity
-      ? input.baseMs : DEFAULT_RECONNECT_BASE_MS,
-    maxMs:       (typeof input.maxMs === "number" && input.maxMs > 0)                         // allow:numeric-opt-Infinity
-      ? input.maxMs : DEFAULT_RECONNECT_MAX_MS,
+    baseMs:      (typeof input.baseMs === "number") ? input.baseMs : DEFAULT_RECONNECT_BASE_MS,
+    maxMs:       (typeof input.maxMs === "number") ? input.maxMs : DEFAULT_RECONNECT_MAX_MS,
   };
 }
 

package/lib/vendor/blamejs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.15.35",
+  "version": "0.15.37",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/lib/vendor/blamejs/release-notes/v0.15.36.json

@@ -0,0 +1,18 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.15.36",
+  "date": "2026-06-27",
+  "headline": "Internal test-suite hardening only — the published library's runtime behavior and public API are unchanged (source-comment marker text aside)",
+  "summary": "The codebase-patterns guard class that allows a bare comma/semicolon split on token-only RFC header grammars was re-verified from scratch and renamed to a descriptive token, with its old name recorded as retired. Each live marked site (RRULE, RFC 9421 component identifiers, TLS-RPT rua, SCIM attribute paths) was re-read and confirmed to split a grammar with no quoted-string members. Five marker comments that suppressed nothing were removed or turned into plain explanatory comments. No runtime code, public API, or wire format changed.",
+  "sections": [
+    {
+      "heading": "Detectors",
+      "items": [
+        {
+          "title": "Bare token-only header-split suppression class re-verified, renamed, and pruned of inert markers",
+          "body": "Each marked bare `.split(\",\")` / `.split(\";\")` on an RFC header value was re-read and confirmed to operate on a token-only grammar (no quoted-string members, so a quote-aware splitter is unnecessary): RFC 5545 RRULE, RFC 9421 signature component identifiers, RFC 8460 TLS-RPT rua, and RFC 7644 SCIM attribute paths. The guard class was renamed to a descriptive token and its old name added to the retired-token set. Five marker comments that the detector never actually evaluated (two sat on a date-normalizing `.replace`, three in header parsers the guard intentionally does not scan) were removed or converted to plain comments. This is test-suite tooling plus source-comment text; no shipped framework behavior changed."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/release-notes/v0.15.37.json

@@ -0,0 +1,26 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.15.37",
+  "date": "2026-06-27",
+  "headline": "Several numeric options that silently accepted a non-finite value — disabling a clock-skew / freshness check or a resource cap — now reject it, so an `Infinity` skew or limit can no longer turn off the protection it configures",
+  "summary": "A number of configuration options validated a numeric value with a bare `typeof === \"number\" && value >= 0` check, which accepts `Infinity`. Where the value is a clock-skew tolerance or a resource cap, an `Infinity` (or `NaN`) silently disabled the very check it tunes: a CWT / OCSP-staple / ARC clock-skew of `Infinity` made the expiry, freshness, and expiration comparisons unsatisfiable (an expired token / a replayed pre-revocation \"good\" response / an expired ARC seal would be accepted); a WebSocket-client `maxMessageBytes` / `maxFrameBytes` / `handshakeTimeoutMs` of `Infinity` disabled the inbound-OOM and stalled-handshake defenses; and inbox / flag-cache / audit-chain size and count caps of `Infinity` admitted unbounded data. These options now route through the finite-bounds validator: a present non-finite value is refused at the entry point (or falls back to the safe default on the result-returning paths). Options where an unbounded value is a deliberate intent — reconnect \"retry indefinitely\", inbox \"retain indefinitely\" — continue to accept `Infinity`.",
+  "sections": [
+    {
+      "heading": "Security",
+      "items": [
+        {
+          "title": "A non-finite clock-skew no longer disables CWT / OCSP / ARC time checks",
+          "body": "b.cwt.verify, the OCSP-staple freshness check in b.network.tls, and b.mail.arc.verify each took an operator clock-skew tolerance validated as `typeof === \"number\" && >= 0`, which accepts `Infinity`. Because each check is of the form `now > deadline + skew`, a skew of `Infinity` made it unsatisfiable and silently turned the check off: an expired CWT verified, a stale (post-nextUpdate) OCSP \"good\" response — the exact reply an attacker replays after the certificate is revoked — was accepted, and an expired ARC seal passed. A present clock-skew that is not a non-negative finite integer is now refused (b.cwt.verify throws cwt/bad-clock-skew; the OCSP and ARC paths fall back to their safe default). Regression tests assert an expired token / stale staple / expired ARC seal is still rejected when the skew is `Infinity`."
+        },
+        {
+          "title": "WebSocket-client inbound caps can no longer be disabled by an Infinity value",
+          "body": "b.wsClient.connect validated maxMessageBytes, maxFrameBytes, and handshakeTimeoutMs (and the ping/pong keepalive intervals) with a bare numeric check that accepted `Infinity`, which disabled the inbound-message and frame size limits — the defenses against a malicious server sending an unbounded message — and the handshake timeout. A present non-finite value for these is now refused at connect time. The reconnect maxAttempts still accepts `Infinity` (a deliberate \"reconnect indefinitely\" intent)."
+        },
+        {
+          "title": "Inbox, flag-cache, and audit-chain caps reject a non-finite limit",
+          "body": "The inbox maxPayloadBytes / messageIdMaxLen / sourceMaxLen caps, the flag-cache ttlMs / maxEntries, and the audit-chain partition fan-out cap each accepted `Infinity`, disabling the cap (unbounded stored payloads, a never-expiring or unbounded cache, unbounded fan-out). These now require a positive finite integer — refused at create time, or clamped to the bounded default on the result-returning verify path. The inbox retentionDays still accepts `Infinity` (retain indefinitely)."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/test/layer-0-primitives/codebase-patterns.test.js

@@ -319,7 +319,7 @@ var VALID_ALLOW_CLASSES = {
   "backup-adapter-storage-without-posture-check": 1,
   "bare-canonicalize-walk": 1,
   "bare-error-throw": 1,
-  "bare-split-on-quoted-header": 1,
+  "bare-split-on-quoted-header-token-grammar": 1,
   "console-direct": 1,
   "deny-path-hardcoded-response": 1,
   "duplicate-regex": 1,
@@ -340,7 +340,7 @@ var VALID_ALLOW_CLASSES = {
   "list-without-pagination": 1,
   "math-random-noncrypto-jitter-sampling": 1,
   "no-number-money-arithmetic": 1,
-  "numeric-opt-Infinity": 1,
+  "numeric-opt-Infinity-intentional": 1,
   "primitive-unreachable": 1,
   "process-exit-operator-optin": 1,
   "raw-byte-literal": 1,
@@ -389,6 +389,8 @@ var RETIRED_ALLOW_TOKENS = {
   "dynamic-require": "renamed to 'dynamic-require-operator-module' (2026-06-26 re-verify pass) — every site loads an operator-supplied path (migration / seed / extensibility entry, centralized in module-loader.js) or is diagnostic message text; re-verify before reusing",
   "raw-hash-compare": "renamed to 'raw-hash-compare-nonsecret-tag' (2026-06-26 re-verify pass) — the one site compares a data-residency region tag with ===, not a secret hash; re-verify before reusing",
   "seal-without-aad": "renamed to 'seal-without-aad-by-design' (2026-06-26 re-verify pass) — both sites intentionally seal without AAD (a non-regulated plain-mode table whose AAD is enforced by the posture sealEnvelopeFloor where required, and a throwaway vault-readiness probe sentinel); re-verify before reusing",
+  "bare-split-on-quoted-header": "renamed to 'bare-split-on-quoted-header-token-grammar' (2026-06-26 re-verify pass) — every live marker splits an RFC token-only header grammar with no quoted-string members (RRULE / RFC 9421 component-ids / TLS-RPT rua / SCIM attribute paths), so a bare comma/semicolon split is correct; re-verify the grammar before reusing. The re-verify also found 5 markers were inert (detector pre-filter skips their file, or the line is a .replace not a split) and cleared them",
+  "numeric-opt-Infinity": "renamed to 'numeric-opt-Infinity-intentional' (2026-06-27 re-verify pass) — only the markers where Infinity is genuinely SAFE remain: clamped to a max (agent-posture-chain maxHopCount), fail-closed (age-gate requireAge / consentRequired), or a deliberate unbounded intent (inbox retentionDays = retain indefinitely, ws-client reconnect maxAttempts = retry forever). The re-verify found 13 sites where Infinity SILENTLY DISABLED a cap or security check (clock-skew → expiry/OCSP-freshness/ARC-expiry; ws-client maxMessageBytes/maxFrameBytes/handshakeTimeoutMs; inbox/flag-cache/audit-chain caps; mail-arc-sign timestamp) — those now route through numeric-bounds (throw / safe-default on non-finite) and lost the marker. re-verify each remaining site before reusing",
 };
 
 function testNoRetiredAllowTokenReRegistered() {
@@ -693,13 +695,13 @@ function testNoRawTimeLiterals() {
 }
 
 function testNumericOptsValidate() {
-  // class: numeric-opt-Infinity
+  // class: numeric-opt-Infinity-intentional
   var matches = _scan(
     /typeof\s+opts\.\w+\s*===\s*"number"\s*&&\s*opts\.\w+\s*>=?\s*0\b/);
   // numeric-bounds itself contains the helper definitions that look
   // like the pattern.
   matches = matches.filter(function (m) { return m.file !== "lib/numeric-bounds.js"; });
-  matches = _filterMarkers(matches, "numeric-opt-Infinity");
+  matches = _filterMarkers(matches, "numeric-opt-Infinity-intentional");
   _report("numeric opts route through lib/numeric-bounds (or have an allow marker)",
     matches);
 }
@@ -10320,7 +10322,7 @@ function testNoBoolStringCoerceShape() {
 //
 // Surfaced 2026-05-11 — `b.cdnCacheControl.parse` did this.
 function testNoBareCommaSplitOnQuotedHeader() {
-  // class: bare-split-on-quoted-header
+  // class: bare-split-on-quoted-header-token-grammar
   var files = _libFiles();
   var bad = [];
   for (var fi = 0; fi < files.length; fi++) {
@@ -10342,7 +10344,7 @@ function testNoBareCommaSplitOnQuotedHeader() {
       });
     }
   }
-  bad = _filterMarkers(bad, "bare-split-on-quoted-header");
+  bad = _filterMarkers(bad, "bare-split-on-quoted-header-token-grammar");
   _report("RFC structured-fields parser must use quote-aware top-level splitter, not bare `.split(\",\") / .split(\";\")` (RFC 8941 §3.3.3 quoted-string values can contain delimiter chars — cdn-cache-control.parse bug class)",
     bad);
 }

package/lib/vendor/blamejs/test/layer-0-primitives/cwt.test.js

@@ -105,6 +105,34 @@ async function testRobustTagAndMalformedClaims() {
   check("verify: malformed (non-numeric) nbf refused", e2 && e2.code === "cwt/malformed-claim");
 }
 
+async function testClockSkewInfinityRejected() {
+  // A non-finite clockSkewSec must be a config error, NOT a silent
+  // expiry-disable: the check is `now > exp + skew`, so skew === Infinity
+  // makes it `now > Infinity` (always false) and ANY expired token would
+  // verify. A present-but-invalid skew (Infinity / NaN / negative /
+  // non-integer) is refused at the entry point.
+  var now = _now();
+  var expired = await b.cwt.sign({ exp: now - 100000 }, { alg: "ES256", privateKey: EC.privateKey });
+  var errInf = null;
+  try {
+    await b.cwt.verify(expired, { algorithms: ["ES256"], publicKey: EC.publicKey, clockSkewSec: Infinity });
+  } catch (e) { errInf = e; }
+  check("verify: clockSkewSec Infinity refused (does not disable expiry)",
+    errInf && errInf.code === "cwt/bad-clock-skew");
+
+  var errNeg = null;
+  try {
+    await b.cwt.verify(expired, { algorithms: ["ES256"], publicKey: EC.publicKey, clockSkewSec: -1 });
+  } catch (e) { errNeg = e; }
+  check("verify: negative clockSkewSec refused", errNeg && errNeg.code === "cwt/bad-clock-skew");
+
+  // Absent skew still applies the default (marginally-expired tolerated),
+  // and a valid finite skew still works — the fix must not regress those.
+  var justExpired = await b.cwt.sign({ exp: now - 30 }, { alg: "ES256", privateKey: EC.privateKey });
+  var ok = await b.cwt.verify(justExpired, { algorithms: ["ES256"], publicKey: EC.publicKey, clockSkewSec: 60 });
+  check("verify: a valid finite skew still tolerates a marginally-expired token", ok.claims.exp === now - 30);
+}
+
 async function testValidation() {
   var bad = null;
   try { await b.cwt.sign({ exp: "not-a-number" }, { alg: "ES256", privateKey: EC.privateKey }); } catch (e) { bad = e; }
@@ -124,6 +152,7 @@ async function run() {
   await testIssuerAudience();
   await testTaggedAndTamper();
   await testRobustTagAndMalformedClaims();
+  await testClockSkewInfinityRejected();
   await testValidation();
 }
 

package/lib/vendor/blamejs/test/layer-0-primitives/flag.test.js

@@ -496,6 +496,12 @@ function run() {
     function () { b.flag.cache({}); }, /must implement/);
   rejects("cache: ttlMs too small",
     function () { b.flag.cache(memProvider, { ttlMs: 100 }); }, /ttlMs/);
+  // A non-finite ttlMs / maxEntries must be refused (Infinity would otherwise
+  // give a never-expiring entry / an unbounded cache, not be clamped).
+  rejects("cache: maxEntries Infinity refused (unbounded cache)",
+    function () { b.flag.cache(memProvider, { ttlMs: 5000, maxEntries: Infinity }); }, /maxEntries|finite/);
+  rejects("cache: ttlMs Infinity refused",
+    function () { b.flag.cache(memProvider, { ttlMs: Infinity }); }, /ttlMs|finite/);
 
   var cachedProvider = b.flag.cache(memProvider, { ttlMs: 5000, maxEntries: 50 });
   check("cache: kind",                           cachedProvider.kind === "cache:memory");

package/lib/vendor/blamejs/test/layer-0-primitives/inbox.test.js

@@ -118,6 +118,12 @@ async function run() {
   var fake = _makeFakeExternalDb();
   rejects("inbox.create: bad table name",
     function () { b.inbox.create({ externalDb: fake.db, table: "bad-name" }); }, /not a safe SQL identifier/);
+  // A non-finite byte/length cap must be refused — Infinity would disable the
+  // cap and admit unbounded stored payloads / identifiers.
+  rejects("inbox.create: maxPayloadBytes Infinity refused",
+    function () { b.inbox.create({ externalDb: fake.db, table: "t", maxPayloadBytes: Infinity }); }, /maxPayloadBytes|finite/);
+  rejects("inbox.create: messageIdMaxLen Infinity refused",
+    function () { b.inbox.create({ externalDb: fake.db, table: "t", messageIdMaxLen: Infinity }); }, /messageIdMaxLen|finite/);
 
   var inbox = b.inbox.create({
     externalDb: fake.db,
@@ -182,6 +188,16 @@ async function run() {
 
   var deleted = await inbox.sweep();
   check("inbox.sweep: returns deleted count",     typeof deleted === "number");
+
+  // retentionDays: Infinity means "retain indefinitely" — sweep() must be a
+  // no-op (delete nothing), not compute an invalid horizon. Before the fix the
+  // sqlite path threw RangeError on `new Date(now - Infinity).toISOString()`.
+  var foreverInbox = b.inbox.create({
+    externalDb: fake.db, table: "forever_inbox", audit: false, retentionDays: Infinity,
+  });
+  await foreverInbox.declareSchema(fake.xdb);
+  var foreverDeleted = await foreverInbox.sweep();
+  check("inbox.sweep: retentionDays Infinity retains all (no-op, no throw)", foreverDeleted === 0);
 }
 
 module.exports = { run: run };

package/lib/vendor/blamejs/test/layer-0-primitives/mail-auth.test.js

@@ -367,6 +367,36 @@ async function testArcVerifyBadSignatures() {
         rv.hops[0].asResult !== "pass");
 }
 
+async function testArcInfinityClockSkewDoesNotDisableExpiry() {
+  // RFC 8617 §5.2 — a past x= (expiration) MUST be rejected with operator
+  // skew tolerance. The expiry gate is `amsX + skewSec < nowSec`; a non-finite
+  // clockSkewMs makes skewSec === Infinity, so `amsX + Infinity < nowSec` is
+  // always false and the expiry check is silently disabled. A present
+  // non-finite skew must fall back to the safe default instead. RED before the
+  // fix: the expired x= slips through and amsErrors carries a signature error,
+  // not the x-expired fault.
+  var nowSec = Math.floor(Date.now() / 1000);
+  var expiredX = nowSec - 86400;   // expired a day ago
+  var pastT    = nowSec - 90000;
+  var msg = "ARC-Seal: i=1; a=rsa-sha256; cv=none; d=example.com; s=arc; b=AAAA\r\n" +
+            "ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=example.com; s=arc; t=" + pastT + "; x=" + expiredX + "; bh=AAAA; h=from; b=AAAA\r\n" +
+            "ARC-Authentication-Results: i=1; example.com; spf=pass\r\n" +
+            "From: alice@example.com\r\nTo: bob@example.com\r\n\r\nbody\r\n";
+  var dnsLookup = async function (qname) {
+    if (qname === "arc._domainkey.example.com") {
+      var nodeCrypto = require("crypto");
+      var pair = nodeCrypto.generateKeyPairSync("rsa", { modulusLength: 2048 });
+      var spki = pair.publicKey.export({ type: "spki", format: "der" });
+      return [["v=DKIM1; k=rsa; p=" + spki.toString("base64")]];
+    }
+    var err = new Error("ENOTFOUND"); err.code = "ENOTFOUND"; throw err;
+  };
+  var rv = await b.mail.arc.verify(msg, { dnsLookup: dnsLookup, clockSkewMs: Infinity });
+  var amsErrs = ((rv.hops && rv.hops[0] && rv.hops[0].amsErrors) || []).join(" ; ");
+  check("ARC Infinity skew: expired x= still enforced (expiry not disabled)",
+        /x-expired/.test(amsErrs));
+}
+
 function _arcHopHeaders(i, cv) {
   // Synthetic ARC headers — signatures are dummy; the cv= edge tests
   // exercise the chain-rule validator, not the signature verifier.
@@ -615,6 +645,10 @@ function testArcSignChain() {
   _rejects("arc.sign: bad instance (0)",
     function () { b.mail.arc.sign({ rfc822: rfc822, instance: 0, authservId: "x", domain: "x", selector: "x", privateKey: arcKeyPem, algorithm: "rsa-sha256", cv: "none", authResults: "spf=pass" }); },
     /instance must be/);
+  // A non-finite t= timestamp must be refused, not floored into a malformed tag.
+  _rejects("arc.sign: timestamp Infinity refused",
+    function () { b.mail.arc.sign({ rfc822: rfc822, instance: 1, authservId: "x", domain: "x", selector: "x", privateKey: arcKeyPem, algorithm: "rsa-sha256", cv: "none", authResults: "spf=pass", timestamp: Infinity }); },
+    /timestamp|finite/);
 }
 
 // ---- DMARCbis (B1) — psd= / np= / org-domain via PSL ----
@@ -1474,6 +1508,7 @@ async function run() {
   await testArcVerifyMissing();
   await testArcVerifyNone();
   await testArcVerifyBadSignatures();
+  await testArcInfinityClockSkewDoesNotDisableExpiry();
   await testArcVerifyDuplicateInstance();
   await testArcVerifyNonContiguous();
   await testArcVerifyTooManyHops();

package/lib/vendor/blamejs/test/layer-0-primitives/tls-ocsp-freshness.test.js

@@ -175,11 +175,39 @@ function testAcceptsFreshNoNextUpdate() {
   check("no-nextUpdate fresh: certStatus good", rv.certStatus === "good");
 }
 
+// A non-finite clockSkewMs must NOT disable the freshness window. The stale
+// check is `now > nextUpdate + skew`; skew === Infinity makes it `now >
+// Infinity` (always false), so a STALE (past-nextUpdate) response — exactly
+// the pre-revocation "good" reply an attacker replays after the cert is
+// revoked — would be accepted. A present-but-non-finite skew falls back to
+// the safe default instead of being honored. RED before the fix: rv.ok===true.
+function testInfinityClockSkewDoesNotDisableFreshness() {
+  var fx = _buildSignedOcsp({
+    thisUpdateMs: FIXED_NOW - 3 * 86400000,   // 3 days ago
+    nextUpdateMs: FIXED_NOW - 2 * 86400000,   // 2 days ago → STALE
+  });
+  var rv = b.network.tls.ocsp.evaluate(fx.der, {
+    issuerPem: fx.issuerPem, serialHex: fx.serialHex, now: FIXED_NOW,
+    clockSkewMs: Infinity,
+  });
+  check("Infinity skew: stale response still rejected (freshness not disabled)", rv.ok === false);
+  check("Infinity skew: rejected for the STALE reason",
+        /nextUpdate|stale/i.test((rv.errors || []).join(" ; ")));
+  // A negative skew is likewise treated as invalid → safe default, so the
+  // stale response stays rejected.
+  var rvNeg = b.network.tls.ocsp.evaluate(fx.der, {
+    issuerPem: fx.issuerPem, serialHex: fx.serialHex, now: FIXED_NOW,
+    clockSkewMs: -1,
+  });
+  check("negative skew: stale response still rejected", rvNeg.ok === false);
+}
+
 async function run() {
   testRejectsStaleResponse();
   testAcceptsFreshResponse();
   testRejectsFutureThisUpdate();
   testAcceptsFreshNoNextUpdate();
+  testInfinityClockSkewDoesNotDisableFreshness();
 }
 
 module.exports = { run: run };

package/lib/vendor/blamejs/test/layer-0-primitives/ws-client.test.js

@@ -205,6 +205,22 @@ async function _runTests() {
     function () { b.wsClient.connect("ws://localhost:1", { reconnect: 42 }); },
     /reconnect must be/);
 
+  // ---- non-finite resource caps ----
+  // maxMessageBytes / maxFrameBytes / handshakeTimeoutMs are inbound-OOM and
+  // hang defenses. An Infinity value passes a bare `typeof === "number" && > 0`
+  // check and silently DISABLES the cap (a malicious server can then send an
+  // unbounded message / frame, or stall the handshake forever). A present
+  // non-finite value is refused at connect time.
+  rejects("connect: maxMessageBytes Infinity refused (OOM cap not disabled)",
+    function () { b.wsClient.connect("ws://localhost:1", { maxMessageBytes: Infinity }); },
+    /maxMessageBytes|finite/);
+  rejects("connect: maxFrameBytes Infinity refused",
+    function () { b.wsClient.connect("ws://localhost:1", { maxFrameBytes: Infinity }); },
+    /maxFrameBytes|finite/);
+  rejects("connect: handshakeTimeoutMs Infinity refused",
+    function () { b.wsClient.connect("ws://localhost:1", { handshakeTimeoutMs: Infinity }); },
+    /handshakeTimeoutMs|finite/);
+
   // ---- happy path: connect + send + echo ----
   var server = await _makeServer({});
   var port = server.address().port;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/blamejs-shop",
-  "version": "0.5.1",
+  "version": "0.5.3",
   "description": "Open-source framework built on blamejs. Vendored stack, zero npm runtime deps, PQC-first crypto, security-on by default.",
   "main": "lib/index.js",
   "scripts": {