@blamejs/blamejs-shop 0.5.12 → 0.5.13

package/lib/vendor/blamejs/test/layer-0-primitives/jsdoc-example-execution.test.js

@@ -0,0 +1,177 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+/**
+ * End-to-end @example validation (approach A-v1). The comment-block validator
+ * only PARSE-checks each @example (vm.Script — never runs it), so an example can
+ * compile yet be semantically dead: a renamed method, a removed API, a wrong
+ * argument shape. This walks the SAME parseTree the validator uses and actually
+ * EXECUTES the SELF-CONTAINED @examples, asserting they do not throw.
+ *
+ * Safety (naive execution is destructive — examples start daemons, open dbs,
+ * generate keypairs, touch the filesystem, hit the network):
+ *  - Examples matching STATEFUL_OR_IO are NOT executed — skipped + counted.
+ *  - Execution runs inside a SACRIFICIAL TEMP CWD so any stray write lands in
+ *    temp, never the repo, and behind an unhandledRejection guard + a timeout.
+ *  - A ReferenceError (undefined external identifier like req/res/client) or a
+ *    require of a non-framework module = illustrative → skip + count.
+ *  - Every OTHER throw (TypeError, a framework error, `b.x is not a function`)
+ *    is a REAL defect → fails with file:primitive + the error.
+ * Output-checking the `// →` comments is the planned fast-follow; executing the
+ * 552 stateful/IO examples via child-process isolation is the planned A-v2.
+ *
+ * Run standalone: `node test/layer-0-primitives/jsdoc-example-execution.test.js`
+ * Or via smoke:   `node test/smoke.js`
+ */
+
+var path    = require("path");
+var fs      = require("node:fs");
+var os      = require("node:os");
+var vm      = require("node:vm");
+var helpers = require("../helpers");
+var check   = helpers.check;
+
+var ROOT   = path.resolve(__dirname, "..", "..");
+var b      = require(ROOT);
+var parser = require(path.join(ROOT, "examples", "wiki", "lib", "source-doc-parser"));
+var { setupTestDb, teardownTestDb } = require("../helpers/db");
+
+// Any example that could perform real I/O or long-lived / stateful work: never
+// executed. Broad on purpose — a false skip is safe, a false run is not.
+var STATEFUL_OR_IO = new RegExp([
+  "daemon", "vault", "\\bdb\\b", "\\.open\\(", "listen", "server", "\\bmail\\b",
+  "deliver", "network", "\\bhttp", "fetch", "\\bdns\\b", "audit", "queue", "cron",
+  "\\.watch\\(", "spawn", "exec\\(", "writeFile", "readFile", "mkdir", "unlink",
+  "upload", "\\.start\\(", "\\.stop\\(", "generateKey", "keypair", "getKeys",
+  "\\.sign\\(", "\\.send\\(", "fileUpload", "static\\(", "\\.pipe\\(",
+  "\\.subscribe\\(", "createServer", "\\.connect\\(", "\\.request\\(", "\\.bind\\(",
+  "process\\.", "require\\(\"node:", "require\\(\"fs", "require\\(\"net",
+  "require\\(\"child_process", "require\\(\"dns", "require\\(\"http",
+  "hashFile", "createReadStream", "createWriteStream", "etc/hosts",
+  "template", "\\brender\\b", "viewsDir", "listBackends",
+  "workerThread", "makeSkipMatcher",
+].join("|"), "i");
+
+var SAFE_BUILTINS = { crypto: 1, "node:crypto": 1, path: 1, "node:path": 1,
+  buffer: 1, "node:buffer": 1, util: 1, "node:util": 1, url: 1, "node:url": 1,
+  querystring: 1, "node:querystring": 1, assert: 1, "node:assert": 1, zlib: 1, "node:zlib": 1 };
+
+// require() seen by an example: framework alias → a FRESH object (never `b`
+// itself, so an example writing to the export can't mutate the real surface —
+// and no extra members: an example calling a method the shipped export
+// doesn't have must FAIL, that drift is exactly what this test catches);
+// safe builtins pass through; anything else classifies as an external
+// (illustrative) module.
+function sandboxRequire(name) {
+  if (name === "blamejs" || name === "@blamejs/core") {
+    return Object.assign({}, b);
+  }
+  if (Object.prototype.hasOwnProperty.call(SAFE_BUILTINS, name)) return require(name);
+  var e = new Error("example references external module '" + name + "'");
+  e.code = "EXAMPLE_EXTERNAL_MODULE";
+  throw e;
+}
+
+function makeContext() {
+  var noop = function () {};
+  var sandbox = {
+    b: b,
+    require: sandboxRequire,
+    console: { log: noop, error: noop, warn: noop, info: noop, debug: noop },
+    Buffer: Buffer,
+    JSON: JSON, Math: Math, Date: Date, Promise: Promise, Object: Object, Array: Array,
+    Map: Map, Set: Set, Symbol: Symbol, RegExp: RegExp, Error: Error, TypeError: TypeError,
+    URL: URL, URLSearchParams: URLSearchParams, TextEncoder: TextEncoder, TextDecoder: TextDecoder,
+    structuredClone: (typeof structuredClone === "function" ? structuredClone : undefined),
+  };
+  return vm.createContext(sandbox);
+}
+
+function classify(e) {
+  // Errors thrown INSIDE the vm context are instances of the context's own
+  // constructors, so cross-realm `instanceof` fails — classify by name/flag.
+  var name = e && e.name;
+  if (name === "ReferenceError") return { outcome: "skip", reason: "external identifier" };
+  if (e && e.code === "EXAMPLE_EXTERNAL_MODULE") return { outcome: "skip", reason: "external module" };
+  if (e && /^test timed out:|Script execution timed out/.test(String(e.message || ""))) return { outcome: "skip", reason: "timeout" };
+  // A framework typed error means the API RESOLVED + ran + threw its own error
+  // (a precondition / needs-init / input-validation demo) — the API exists, so
+  // it is NOT the renamed/removed-API drift A-v1 targets. (Regressions where the
+  // framework WRONGLY throws are B's marker-convention job, not auto-classify.)
+  if (e && e.isFrameworkError) return { outcome: "skip", reason: "framework error (precondition/input demo)" };
+  // Node/fs errors from I/O the skip filter didn't catch.
+  if (e && /^E[A-Z]+$/.test(String(e.code || ""))) return { outcome: "skip", reason: "filesystem/OS error" };
+  // The example assumes an operator-declared table/column the isolated test db
+  // doesn't have (e.g. subject.rectify over a `users` table) — illustrative.
+  if (e && /no such (table|column)/i.test(String(e.message || ""))) return { outcome: "skip", reason: "needs operator-specific schema" };
+  return { outcome: "fail", error: (e && (e.stack || e.message)) || String(e) };
+}
+
+async function runExample(body) {
+  if (STATEFUL_OR_IO.test(body)) return { outcome: "skip", reason: "stateful/IO (not executed)" };
+  var wrapped = "(async function () {\n" + body + "\n})();";
+  try {
+    // Bound each @example with a wall-clock ceiling via the shared primitive —
+    // the vm `timeout` caps only SYNCHRONOUS execution, so an awaiting example
+    // that never settles would otherwise wedge the suite.
+    await helpers.withTestTimeout("jsdoc @example execution", function () {
+      return new vm.Script(wrapped, { filename: "example.js" }).runInContext(makeContext(), { timeout: 1000 });
+    }, { timeoutMs: 1500 });
+    return { outcome: "ran" };
+  } catch (e) { return classify(e); }
+}
+
+async function run() {
+  var docs = parser.parseTree(path.join(ROOT, "lib"));
+  // Contain any stray write: run inside a sacrificial temp cwd, restore after.
+  var origCwd = process.cwd();
+  var tmp = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-example-exec-"));
+  var onReject = function () {};
+  process.on("unhandledRejection", onReject);
+  process.chdir(tmp);
+  // Isolate the framework's default db/vault into this run's own temp dir, so
+  // examples that internally touch them (subject.export, retention, …) don't
+  // race concurrent smoke forks on the shared default data path.
+  await setupTestDb(tmp, [{ name: "widget", columns: { id: "TEXT PRIMARY KEY" } }]);
+
+  var ran = 0, skipped = 0, failures = [];
+  try {
+    var files = Object.keys(docs);
+    for (var fi = 0; fi < files.length; fi += 1) {
+      var prims = docs[files[fi]].primitives || [];
+      for (var pi = 0; pi < prims.length; pi += 1) {
+        var sig = (prims[pi].tags && prims[pi].tags.primitive) || files[fi];
+        var exs = (prims[pi].tags && prims[pi].tags.examples) || [];
+        for (var ei = 0; ei < exs.length; ei += 1) {
+          var res = await runExample(exs[ei]);
+          if (res.outcome === "ran") ran += 1;
+          else if (res.outcome === "skip") skipped += 1;
+          else failures.push({ sig: sig, error: String(res.error).split("\n").slice(0, 2).join(" ") });
+        }
+      }
+    }
+  } finally {
+    try { await teardownTestDb(tmp); } catch (_e) { /* best-effort */ }
+    process.chdir(origCwd);
+    process.removeListener("unhandledRejection", onReject);
+    try { fs.rmSync(tmp, { recursive: true, force: true }); } catch (_e2) { /* best-effort */ }
+  }
+
+  var summary = "[jsdoc-example-execution] executed " + ran + ", skipped " + skipped +
+    " (stateful/IO + illustrative), failed " + failures.length;
+  console.log(summary);
+  // Persist the detail: a failure under a forked smoke worker whose stdout the
+  // parent does NOT fold into .test-output/smoke.log would otherwise be lost.
+  var report = summary + "\n" +
+    failures.map(function (f) { return "  FAIL " + f.sig + " :: " + f.error; }).join("\n") + "\n";
+  try { fs.writeFileSync(path.join(ROOT, ".test-output", "jsdoc-example-execution.log"), report); } catch (_e3) { /* best-effort */ }
+  if (failures.length) failures.slice(0, 50).forEach(function (f) { console.log("  FAIL " + f.sig + " :: " + f.error); });
+  check("every executed @example runs without throwing (renamed/removed API, wrong shape)", failures.length === 0);
+}
+
+if (require.main === module) {
+  run().then(function () { console.log("jsdoc-example-execution OK — " + helpers.getChecks() + " checks"); },
+    function (e) { console.error(e && e.stack || e); process.exit(1); });
+}
+
+module.exports = { run: run };

package/lib/vendor/blamejs/test/layer-0-primitives/json-path.test.js

@@ -98,11 +98,114 @@ function testSurface() {
   check("b.jsonPath.JsonPathError is the typed error", typeof b.jsonPath.JsonPathError === "function");
 }
 
+// Every malformed / adversarial path must be REFUSED with a typed error —
+// never an uncaught crash and never a silent mis-evaluation.
+function testMalformedRejected() {
+  var bad = [
+    // argument-type guard (not a parse error — a bad-arg refusal)
+    { p: 123, doc: {}, want: "json-path/bad-arg", n: "non-string path" },
+    { p: null, doc: {}, want: "json-path/bad-arg", n: "null path" },
+    // structural parse failures
+    { p: "a.b", want: "json-path/invalid", n: "missing root $" },
+    { p: "$.a extra", want: "json-path/invalid", n: "trailing characters" },
+    { p: "$[a]", want: "json-path/invalid", n: "bare unquoted name in bracket" },
+    { p: "$[?]", want: "json-path/invalid", n: "empty filter" },
+    { p: "$.", want: "json-path/invalid", n: "dot with no member" },
+    { p: "$..", want: "json-path/invalid", n: "bald descendant" },
+    { p: "$[1", want: "json-path/invalid", n: "unclosed bracket" },
+    { p: "$['a", want: "json-path/invalid", n: "unterminated string" },
+    // integer-token rules
+    { p: "$[01]", want: "json-path/invalid", n: "leading zero index" },
+    { p: "$[-0]", want: "json-path/invalid", n: "negative-zero index" },
+    { p: "$[99999999999999999999]", want: "json-path/invalid", n: "index out of safe range" },
+    // string-escape rules
+    { p: "$['\\u12']", want: "json-path/invalid", n: "short \\u escape" },
+    { p: "$['\\uD83D']", want: "json-path/invalid", n: "lone high surrogate" },
+    { p: "$['\\x']", want: "json-path/invalid", n: "unknown escape" },
+    { p: "$['a" + String.fromCharCode(1) + "b']", want: "json-path/invalid", n: "raw control char in string" },
+    // number-literal rules inside filters
+    { p: "$[?@.a==1.]", want: "json-path/invalid", n: "trailing dot in number" },
+    { p: "$[?@.a==1e]", want: "json-path/invalid", n: "empty exponent" },
+    // function well-typedness
+    { p: "$[?bogus(@.a)]", want: "json-path/invalid", n: "unknown function" },
+    { p: "$[?match(@.a)]", want: "json-path/invalid", n: "match arity (needs 2)" },
+    { p: "$[?count('x')]", want: "json-path/invalid", n: "count nodes-arg type mismatch" },
+    { p: "$[?length(@.a)]", want: "json-path/invalid", n: "value-func not a valid test" },
+    { p: "$[?count(@.a) < length(@)]", want: null, n: "value funcs ARE comparable" }, // sanity control
+    // non-singular query as a comparable
+    { p: "$[?@.*==1]", want: "json-path/invalid", n: "wildcard (non-singular) in comparison" },
+    { p: "$[?@..a==1]", want: "json-path/invalid", n: "descendant (non-singular) in comparison" },
+  ];
+  bad.forEach(function (t) {
+    var got = code(function () { jp.query(t.doc || {}, t.p); });
+    if (t.want === null) check("adversarial accepted: " + t.n, got === "NO-THROW");
+    else check("adversarial refused (" + t.want + "): " + t.n, got === t.want);
+  });
+}
+
+// Deeply-nested filter recursion must hit the typed DoS guard, not a raw
+// V8 RangeError that escapes JsonPathError handling.
+function testFilterDepthGuard() {
+  var deep = "$[?" + Array(220).join("!") + "@.a]";
+  check("over-deep filter → typed filter-too-deep", code(function () { jp.query({}, deep); }) === "json-path/filter-too-deep");
+  var ok = "$[?" + Array(50).join("!") + "@.a]";
+  check("moderately-nested filter still parses", Array.isArray(jp.query({ a: 1 }, ok)));
+}
+
+// Type-mismatch / out-of-range selections evaluate to an EMPTY nodelist
+// (a well-typed no-match), never an error or a wrong value.
+function testTypeAndRangeEdges() {
+  check("name selector on array → empty", JSON.stringify(jp.query([1, 2, 3], "$.a")) === "[]");
+  check("index selector on object → empty", JSON.stringify(jp.query({ a: 1 }, "$[0]")) === "[]");
+  check("wildcard on scalar → empty", JSON.stringify(jp.query(5, "$.*")) === "[]");
+  check("slice on non-array → empty", JSON.stringify(jp.query({ a: 1 }, "$[0:2]")) === "[]");
+  check("descendant-wildcard on scalar → empty", JSON.stringify(jp.query(7, "$..*")) === "[]");
+  check("positive index past end → empty", JSON.stringify(jp.query([1, 2], "$[9]")) === "[]");
+  check("negative index past start → empty", JSON.stringify(jp.query([1, 2], "$[-9]")) === "[]");
+  check("slice step 0 → empty", JSON.stringify(jp.query([1, 2, 3], "$[::0]")) === "[]");
+  check("explicit-step slice", JSON.stringify(jp.query([0, 1, 2, 3, 4], "$[0:5:2]")) === "[0,2,4]");
+  check("negative-start slice", JSON.stringify(jp.query([0, 1, 2, 3], "$[-2:]")) === "[2,3]");
+  // Reading __proto__ as a name selector must not leak the prototype.
+  check("__proto__ name selector reads nothing", JSON.stringify(jp.query({ a: 1 }, "$['__proto__']")) === "[]");
+  // hostile match() pattern: invalid I-Regexp → no match, no crash.
+  check("invalid regex in match() → no match, no throw", JSON.stringify(jp.query([{ a: "x" }], "$[?match(@.a, '(')]")) === "[]");
+  check("match() anchors whole string", JSON.stringify(jp.query([{ a: "ab" }], "$[?match(@.a, 'a')]")) === "[]");
+  check("search() is substring", JSON.stringify(jp.query([{ a: "zab" }], "$[?search(@.a, 'a')]")) === JSON.stringify([{ a: "zab" }]));
+  check("match() on non-string field → no match", JSON.stringify(jp.query([{ a: 5 }], "$[?match(@.a, '5')]")) === "[]");
+  // filter over object members; Nothing (missing @.a on z) compares false.
+  check("filter over object members", JSON.stringify(jp.query({ x: { a: 1 }, y: { a: 1 }, z: { b: 2 } }, "$[?@.a == 1]")) === JSON.stringify([{ a: 1 }, { a: 1 }]));
+}
+
+// paths() must emit RFC-9535 normalized paths whose control characters are
+// ESCAPED, so the location round-trips back through query().
+function testNormalizedPathEscaping() {
+  var doc = {}; doc["a\nb"] = 1;          // key containing a newline
+  var p = jp.paths(doc, "$.*");
+  check("newline key escaped (no raw \\n)", p[0].indexOf("\n") === -1);
+  check("newline key emits \\n escape", p[0] === "$['a\\nb']");
+  // The normalized path must round-trip: query at that location finds the node.
+  check("normalized path round-trips", JSON.stringify(jp.query(doc, p[0])) === "[1]");
+
+  var doc2 = {}; doc2["t\tq'x\\y"] = 2;   // tab, apostrophe, backslash together
+  var p2 = jp.paths(doc2, "$.*");
+  check("tab/quote/backslash all escaped", p2[0] === "$['t\\tq\\'x\\\\y']");
+  check("mixed-escape path round-trips", JSON.stringify(jp.query(doc2, p2[0])) === "[2]");
+
+  var doc3 = {}; doc3[String.fromCharCode(1)] = 3;   // generic control char -> XXXX
+  var p3 = jp.paths(doc3, "$.*");
+  check("control char emits \\u escape", p3[0] === "$['\\u0001']");
+  check("control-char path round-trips", JSON.stringify(jp.query(doc3, p3[0])) === "[3]");
+}
+
 async function run() {
   testSurface();
   testCts();
   testFeatures();
   testRegressionAndSafety();
+  testMalformedRejected();
+  testFilterDepthGuard();
+  testTypeAndRangeEdges();
+  testNormalizedPathEscaping();
 }
 
 module.exports = { run: run };

package/lib/vendor/blamejs/test/layer-0-primitives/json-schema.test.js

@@ -144,6 +144,204 @@ function testDepthCap() {
     b.jsonSchema.validate(wide, obj).valid === true);
 }
 
+function testInstanceTypes() {
+  // _typeOf across every JSON type + the "unknown" fallback (undefined).
+  check("null instance matches type:null", b.jsonSchema.isValid({ type: "null" }, null));
+  check("null rejected by type:string", !b.jsonSchema.isValid({ type: "string" }, null));
+  check("boolean instance matches type:boolean", b.jsonSchema.isValid({ type: "boolean" }, true));
+  check("array instance matches type:array", b.jsonSchema.isValid({ type: "array" }, [1, 2]));
+  check("object instance matches type:object", b.jsonSchema.isValid({ type: "object" }, { a: 1 }));
+  // undefined has no JSON type ("unknown"); an empty schema accepts it but a
+  // typed schema rejects it (the type never matches "unknown").
+  check("undefined accepted by empty schema", b.jsonSchema.isValid({}, undefined));
+  check("undefined rejected by type:string", !b.jsonSchema.isValid({ type: "string" }, undefined));
+  // type as an array — a match plus the joined mismatch message.
+  check("type array matches a member", b.jsonSchema.isValid({ type: ["string", "number"] }, 5));
+  var r = b.jsonSchema.validate({ type: ["string", "number"] }, true);
+  check("type array mismatch names both", !r.valid && r.errors[0].keyword === "type" && r.errors[0].message.indexOf("string/number") >= 0);
+}
+
+function testDeepEqualEdges() {
+  // const uses JSON deep-equality — exercise each early-out branch.
+  check("const type-mismatch fails", !b.jsonSchema.isValid({ const: 5 }, "5"));
+  check("const array length-mismatch fails", !b.jsonSchema.isValid({ const: [1, 2] }, [1, 2, 3]));
+  check("const object key-count mismatch fails", !b.jsonSchema.isValid({ const: { a: 1 } }, { a: 1, b: 2 }));
+  check("const object same-count different-keys fails", !b.jsonSchema.isValid({ const: { a: 1 } }, { b: 1 }));
+  check("const deep-equal object passes", b.jsonSchema.isValid({ const: { a: 1 } }, { a: 1 }));
+}
+
+function testNumericBounds() {
+  check("maximum rejects over", !b.jsonSchema.isValid({ maximum: 5 }, 6));
+  check("maximum accepts at bound", b.jsonSchema.isValid({ maximum: 5 }, 5));
+  check("exclusiveMaximum rejects at bound", !b.jsonSchema.isValid({ exclusiveMaximum: 5 }, 5));
+  check("exclusiveMaximum accepts under", b.jsonSchema.isValid({ exclusiveMaximum: 5 }, 4));
+  check("minimum rejects under", !b.jsonSchema.isValid({ minimum: 5 }, 4));
+  check("minimum accepts at bound", b.jsonSchema.isValid({ minimum: 5 }, 5));
+  check("exclusiveMinimum rejects at bound", !b.jsonSchema.isValid({ exclusiveMinimum: 5 }, 5));
+  check("exclusiveMinimum accepts over", b.jsonSchema.isValid({ exclusiveMinimum: 5 }, 6));
+}
+
+function testStringBounds() {
+  check("maxLength rejects longer", !b.jsonSchema.isValid({ maxLength: 2 }, "abc"));
+  check("maxLength accepts equal", b.jsonSchema.isValid({ maxLength: 3 }, "abc"));
+  // A surrogate-pair emoji counts as one code point, not two UTF-16 units.
+  check("maxLength counts astral code points once", b.jsonSchema.isValid({ maxLength: 1 }, String.fromCodePoint(0x1F600)));
+}
+
+function testRegexFallback() {
+  // A pattern valid without the /u flag but invalid with it — the compiler
+  // falls back to a non-unicode RegExp rather than dropping the constraint.
+  check("pattern retries without /u flag", b.jsonSchema.isValid({ pattern: "a\\-z" }, "a-z") && !b.jsonSchema.isValid({ pattern: "a\\-z" }, "qqq"));
+  // A pattern invalid under both flags compiles to null → constraint skipped.
+  check("uncompilable pattern is skipped", b.jsonSchema.isValid({ pattern: "[" }, "anything"));
+  check("uncompilable patternProperties key is skipped", b.jsonSchema.isValid({ patternProperties: { "[": { type: "number" } } }, { x: "str" }));
+}
+
+function testArrayApplicatorEdges() {
+  check("prefixItems mismatch fails", !b.jsonSchema.isValid({ prefixItems: [{ type: "string" }] }, [5]));
+  check("minContains not met fails", !b.jsonSchema.isValid({ contains: { type: "number" }, minContains: 2 }, [1, "a"]));
+  check("minContains met passes", b.jsonSchema.isValid({ contains: { type: "number" }, minContains: 2 }, [1, 2, "a"]));
+  check("maxContains exceeded fails", !b.jsonSchema.isValid({ contains: { type: "number" }, maxContains: 1 }, [1, 2, 3]));
+}
+
+function testObjectApplicatorEdges() {
+  check("maxProperties exceeded fails", !b.jsonSchema.isValid({ maxProperties: 1 }, { a: 1, b: 2 }));
+  check("minProperties not met fails", !b.jsonSchema.isValid({ minProperties: 2 }, { a: 1 }));
+  // additionalProperties skips keys owned by properties even when that
+  // property's own schema failed — no double-count as an additional prop.
+  var r1 = b.jsonSchema.validate({ properties: { a: { type: "string" } }, additionalProperties: false }, { a: 123 });
+  check("addlProps ignores properties-owned key", !r1.valid && r1.errors.length === 1 && r1.errors[0].keyword === "type");
+  // ...and keys matched by patternProperties, even when that pattern failed.
+  var r2 = b.jsonSchema.validate({ patternProperties: { "^x": { type: "string" } }, additionalProperties: false }, { xa: 123 });
+  check("addlProps ignores pattern-matched key", !r2.valid && r2.errors.length === 1 && r2.errors[0].keyword === "type");
+  // An additionalProperties schema that passes marks the key evaluated.
+  check("addlProps success accepts", b.jsonSchema.isValid({ additionalProperties: { type: "number" } }, { x: 5 }));
+  check("addlProps failure rejects", !b.jsonSchema.isValid({ additionalProperties: { type: "number" } }, { x: "no" }));
+  // A key matching NO patternProperties pattern falls through to
+  // additionalProperties (here false → rejected).
+  var r3 = b.jsonSchema.validate({ patternProperties: { "^x": { type: "number" } }, additionalProperties: false }, { y: 1 });
+  check("addlProps applies to non-pattern-matched key", !r3.valid && r3.errors[0].keyword === "false");
+}
+
+function testUnevaluatedSuccess() {
+  // An unevaluated property/item that VALIDATES against the unevaluated*
+  // schema is accepted (and recorded as evaluated).
+  var so = { properties: { a: true }, unevaluatedProperties: { type: "string" } };
+  check("unevaluatedProperties accepts matching extra", b.jsonSchema.isValid(so, { a: 1, b: "ok" }));
+  check("unevaluatedProperties rejects non-matching extra", !b.jsonSchema.isValid(so, { a: 1, b: 2 }));
+  var sa = { prefixItems: [{ type: "number" }], unevaluatedItems: { type: "number" } };
+  check("unevaluatedItems accepts matching tail", b.jsonSchema.isValid(sa, [1, 2]));
+  check("unevaluatedItems rejects non-matching tail", !b.jsonSchema.isValid(sa, [1, "x"]));
+}
+
+function testConditionalElse() {
+  var s = { if: { type: "string" }, else: { type: "number" } };
+  check("if-fails-else-fails rejects", !b.jsonSchema.isValid(s, true));
+  check("if-fails-else-passes accepts", b.jsonSchema.isValid(s, 5));
+  check("if-passes accepts", b.jsonSchema.isValid(s, "hi"));
+}
+
+function testRefResolution() {
+  // Empty $ref points at the current schema; a root that is only {$ref:""}
+  // is an infinite self-reference caught fail-closed by the depth cap —
+  // both with no base and with a resolved $id base.
+  check("empty self-$ref caught by depth cap", code(function () { b.jsonSchema.validate({ $ref: "" }, 1); }) === "json-schema/ref-loop");
+  check("empty $ref under a base still self-loops", code(function () { b.jsonSchema.validate({ $id: "https://ex/x", allOf: [{ $ref: "" }] }, 5); }) === "json-schema/ref-loop");
+  // A $id that is a bare name carrying a fragment: relative fragment refs
+  // resolve against the fragment-stripped base (an unusual, discouraged
+  // shape — child refs do not cleanly resolve, reported fail-closed).
+  var r125 = b.jsonSchema.validate({ $id: "mybase#sec", $defs: { foo: { type: "string" } }, $ref: "#/$defs/foo" }, "hi");
+  check("bare-name $id with fragment reports unresolved child ref", !r125.valid && r125.errors[0].keyword === "$ref");
+  // A boolean schema is registerable and referenceable by an external URI.
+  check("boolean schema addressable by URI", b.jsonSchema.isValid({ $ref: "https://ex/bool" }, 42, { schemas: { "https://ex/bool": true } }) && !b.jsonSchema.isValid({ $ref: "https://ex/bool" }, 42, { schemas: { "https://ex/bool": false } }));
+  // A $id that is a bare name (not a URL): a fragment $ref resolves by
+  // fragment-aware concatenation against that base.
+  var bare = { $id: "mybase", $defs: { foo: { type: "string" } }, $ref: "#/$defs/foo" };
+  check("bare-name base fragment $ref resolves", b.jsonSchema.isValid(bare, "hi") && !b.jsonSchema.isValid(bare, 5));
+  // A relative nested $id under a urn: base (URL resolution throws → falls
+  // back to keeping the relative name).
+  check("urn base + relative nested $id validates", b.jsonSchema.isValid({ $id: "urn:ex:root", $defs: { leaf: { $id: "leaf", type: "string" } }, $ref: "#/$defs/leaf" }, "hi"));
+  // A document is addressable by its retrieval URI even when its own $id is
+  // a different canonical URI.
+  var ext = { "https://retrieval.example/x": { $id: "https://canonical.example/y", type: "integer" } };
+  check("retrieval URI addressable", b.jsonSchema.isValid({ $ref: "https://retrieval.example/x" }, 3, { schemas: ext }) && !b.jsonSchema.isValid({ $ref: "https://retrieval.example/x" }, "no", { schemas: ext }));
+  check("canonical $id addressable", b.jsonSchema.isValid({ $ref: "https://canonical.example/y" }, 3, { schemas: ext }));
+  // A schema keyed by "base#" is reachable by a $ref written without the #.
+  var hk = { "https://ex/x#": { type: "string" } };
+  check("base#-keyed schema reachable without fragment", b.jsonSchema.isValid({ $ref: "https://ex/x" }, "hi", { schemas: hk }) && !b.jsonSchema.isValid({ $ref: "https://ex/x" }, 5, { schemas: hk }));
+}
+
+function testRefUnresolvable() {
+  function err(schema, inst, opts) {
+    var r = b.jsonSchema.validate(schema, inst, opts);
+    return !r.valid && r.errors.length === 1 && r.errors[0].keyword === "$ref";
+  }
+  check("fragment-less unknown $ref reports unresolved", err({ $ref: "https://nowhere.example/x" }, 1));
+  check("pointer past a primitive reports unresolved", err({ xdata: [10, 20, 30], $ref: "#/xdata/0/toodeep" }, "x"));
+  check("pointer array-index OOB reports unresolved", err({ xdata: [10, 20, 30], $ref: "#/xdata/9" }, "x"));
+  check("pointer missing object key reports unresolved", err({ xmap: { a: 1 }, $ref: "#/nope" }, "x"));
+  check("unknown plain-name anchor reports unresolved", err({ $defs: { p: { $anchor: "pos" } }, $ref: "#nonexistent" }, 1));
+}
+
+function testRefIntoNonSchema() {
+  // A JSON Pointer into non-schema data (arrays, maps, escaped tokens)
+  // resolves the raw value; a non-object value imposes no constraint.
+  check("$ref into a data array index imposes no constraint", b.jsonSchema.isValid({ xdata: [10, 20, 30], $ref: "#/xdata/1" }, "anything"));
+  check("$ref into a data map is an empty schema", b.jsonSchema.isValid({ xmap: { a: 1 }, $ref: "#/xmap" }, "anything"));
+  var esc = { xmap: { "a/b": { type: "string" } }, $ref: "#/xmap/a~1b" };
+  check("$ref pointer with ~1 escape resolves", b.jsonSchema.isValid(esc, "hi") && !b.jsonSchema.isValid(esc, 5));
+  // A pointed-to object carrying a $id exercises the base-resolution
+  // fallback for a node the registry did not index as a schema.
+  check("$ref into a data object carrying $id", b.jsonSchema.isValid({ xmap: { $id: "http://x/y", a: 1 }, $ref: "#/xmap" }, "anything"));
+}
+
+function testWalkNonSchemaValues() {
+  // A schema keyword whose value is not a schema (a bare number) imposes no
+  // constraint rather than crashing the walker/validator.
+  check("items:<number> imposes no constraint", b.jsonSchema.isValid({ items: 5 }, [1, 2, 3]));
+  // not:<non-schema> — the non-schema is treated as always-pass, so 'not'
+  // always fails.
+  check("not:<number> always fails (non-schema is always-pass)", !b.jsonSchema.isValid({ not: 5 }, "x"));
+  // A $id carrying a fragment still validates.
+  check("$id with fragment validates", b.jsonSchema.isValid({ $id: "https://ex.example/a#sec", type: "string" }, "hi"));
+}
+
+function testDynamicRefEdges() {
+  // Unresolvable $dynamicRef reports a located error (fail-closed).
+  var r = b.jsonSchema.validate({ $dynamicRef: "#nope" }, 1);
+  check("unresolvable $dynamicRef reports error", !r.valid && r.errors[0].keyword === "$dynamicRef");
+  // $dynamicRef to a plain $anchor (no $dynamicAnchor) behaves like $ref,
+  // resolving with an empty base.
+  var s = { $defs: { x: { $anchor: "a", type: "string" } }, properties: { p: { $dynamicRef: "#a" } } };
+  check("$dynamicRef to plain $anchor validates", b.jsonSchema.isValid(s, { p: "hi" }) && !b.jsonSchema.isValid(s, { p: 5 }));
+  // A resolved $dynamicRef target that rejects the instance propagates fail.
+  var tree = { $id: "https://ex/tree", $dynamicAnchor: "node", type: "object", properties: { children: { type: "array", items: { $dynamicRef: "#node" } } } };
+  check("$dynamicRef recursion rejects bad child", !b.jsonSchema.isValid(tree, { children: ["notobject"] }));
+}
+
+function testMaxErrorsOpt() {
+  // A valid maxErrors caps error collection; the option is honored.
+  var v = b.jsonSchema.compile({ type: "object", properties: {}, additionalProperties: false }, { maxErrors: 2 });
+  check("maxErrors caps collected errors", v.validate({ a: 1, b: 2, c: 3, d: 4 }).errors.length === 2);
+  // An out-of-range maxErrors falls back to the default (does not throw).
+  check("invalid maxErrors falls back to default", b.jsonSchema.validate({ type: "string" }, "x", { maxErrors: -1 }).valid === true);
+}
+
+function testFormatAssertions() {
+  var af = { assertFormat: true };
+  // format only asserts on strings — a non-string instance passes.
+  check("format assertion skips non-string", b.jsonSchema.isValid({ format: "email" }, 123, af));
+  check("uri rejects malformed percent-escape", !b.jsonSchema.isValid({ format: "uri" }, "http://x/%zz", af));
+  check("uri rejects scheme-valid-but-unparseable", !b.jsonSchema.isValid({ format: "uri" }, "http://[", af));
+  check("uuid accepts canonical", b.jsonSchema.isValid({ format: "uuid" }, "12345678-1234-1234-1234-123456789abc", af));
+  check("uuid rejects non-uuid", !b.jsonSchema.isValid({ format: "uuid" }, "not-a-uuid", af));
+  check("ipv4 accepts dotted-quad", b.jsonSchema.isValid({ format: "ipv4" }, "1.2.3.4", af));
+  check("ipv4 rejects out-of-range octet", !b.jsonSchema.isValid({ format: "ipv4" }, "999.1.1.1", af));
+  check("regex accepts valid pattern", b.jsonSchema.isValid({ format: "regex" }, "[a-z]+", af));
+  check("regex rejects invalid pattern", !b.jsonSchema.isValid({ format: "regex" }, "[", af));
+  check("unknown format is annotation-valid", b.jsonSchema.isValid({ format: "totally-unknown" }, "x", af));
+}
+
 async function run() {
   testSurface();
   testAssertions();
@@ -155,6 +353,22 @@ async function run() {
   testErrorsShape();
   testFormat();
   testDepthCap();
+  testInstanceTypes();
+  testDeepEqualEdges();
+  testNumericBounds();
+  testStringBounds();
+  testRegexFallback();
+  testArrayApplicatorEdges();
+  testObjectApplicatorEdges();
+  testUnevaluatedSuccess();
+  testConditionalElse();
+  testRefResolution();
+  testRefUnresolvable();
+  testRefIntoNonSchema();
+  testWalkNonSchemaValues();
+  testDynamicRefEdges();
+  testMaxErrorsOpt();
+  testFormatAssertions();
 }
 module.exports = { run: run };
 if (require.main === module) { run().then(function () { console.log("[json-schema] OK — " + helpers.getChecks() + " checks passed"); }, function (e) { console.error("FAIL:", e && e.stack || e); process.exit(1); }); }

package/lib/vendor/blamejs/test/layer-0-primitives/jwk.test.js

@@ -55,6 +55,45 @@ function testErrors() {
   check("non-object throws", code(function () { b.jwk.thumbprint("nope"); }) === "jwk/bad-jwk");
 }
 
+function testUnsupportedKtyPrototypeNames() {
+  // An attacker-controlled `kty` that names an Object.prototype member
+  // (`__proto__`, `toString`, `valueOf`, `toLocaleString`, `constructor`,
+  // `hasOwnProperty`) must be refused as an unsupported key type — the
+  // required-member table is a plain-object lookup, so an inherited member
+  // name must NOT be treated as a supported kty. Left unguarded, the
+  // zero-`length`-prototype names (`__proto__` / `toString` / `valueOf` /
+  // `toLocaleString`) silently thumbprint the empty object, collapsing four
+  // distinct inputs onto base64url(SHA-256("{}")) — a shared, predictable
+  // thumbprint that breaks RFC 7638's "distinct keys → distinct identifiers"
+  // contract behind DPoP jkt / ACME account-key / DBSC session pins.
+  var protoNames = ["__proto__", "toString", "valueOf", "toLocaleString",
+                    "constructor", "hasOwnProperty", "isPrototypeOf"];
+  var emptyObjThumb = b.jwk.thumbprint({ kty: "oct", k: "AA" });
+  void emptyObjThumb;
+  for (var i = 0; i < protoNames.length; i++) {
+    var kty = protoNames[i];
+    check("canonicalize refuses prototype-named kty `" + kty + "`",
+          code(function () { b.jwk.canonicalize({ kty: kty }); }) === "jwk/unsupported-kty");
+    check("thumbprint refuses prototype-named kty `" + kty + "`",
+          code(function () { b.jwk.thumbprint({ kty: kty }); }) === "jwk/unsupported-kty");
+  }
+}
+
+function testHashOptionPrototypeNames() {
+  // Sibling root: the `hash` option indexes the HASHES lookup table by a
+  // caller-controlled key. A prototype-member name (`toString`, `valueOf`,
+  // `constructor`, `__proto__`) must surface the typed `jwk/bad-hash`
+  // refusal — not leak a raw Node ERR_INVALID_ARG_TYPE from createHash when
+  // the inherited member (a function/object, truthy) slips past the `!hash`
+  // guard.
+  var badHashes = ["toString", "valueOf", "constructor", "__proto__", "hasOwnProperty"];
+  for (var i = 0; i < badHashes.length; i++) {
+    var h = badHashes[i];
+    check("thumbprint refuses prototype-named hash `" + h + "` with jwk/bad-hash",
+          code(function () { b.jwk.thumbprint(RFC_RSA, { hash: h }); }) === "jwk/bad-hash");
+  }
+}
+
 function testComposition() {
   // DPoP and DBSC compute their thumbprints through b.jwk.
   var ec = { kty: "EC", crv: "P-256", x: "f83OJ3D2xF1Bg8vub9tLe1gHMzV76e8Tus9uPHvRVEU", y: "x_FEzRu9m36HLN_tue659LNpXW6pCyStikYjKIWI5a0" };
@@ -68,6 +107,8 @@ async function run() {
   testKtys();
   testHashOption();
   testErrors();
+  testUnsupportedKtyPrototypeNames();
+  testHashOptionPrototypeNames();
   testComposition();
 }
 module.exports = { run: run };