@blamejs/blamejs-shop 0.5.12 → 0.5.13

package/lib/vendor/blamejs/test/layer-0-primitives/safe-async.test.js

@@ -0,0 +1,133 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+/**
+ * b.safeAsync.withSignal + b.safeAsync.makeDropCallback.
+ *
+ * withSignal races a Promise against an AbortSignal: when the signal
+ * aborts, the wrapper rejects with SafeAsyncError (.code = "async/
+ * aborted", .cause = signal.reason) while the underlying Promise keeps
+ * running in the background — only the wrapper's resolution is short-
+ * circuited. makeDropCallback is the canonical log-stream-sink onDrop
+ * wrapper: it invokes onDrop with the framework-canonical
+ * { reason, batch, error } payload and, per the drop-silent contract,
+ * routes any throw from the operator callback to onError instead of
+ * letting it bubble into the request that triggered the drop.
+ *
+ * All async waits poll via helpers.waitUntil — no fixed setTimeout.
+ */
+
+var helpers   = require("../helpers");
+var b         = helpers.b;
+var check     = helpers.check;
+var waitUntil = helpers.waitUntil;
+
+async function run() {
+  // ---- withSignal: a real abort produces the typed rejection ----
+  // Drive a genuine AbortController and assert the wrapper rejects with
+  // the advertised SafeAsyncError shape. The underlying work is a real
+  // framework sleep that flips a flag when it completes, so we can also
+  // prove it kept running in the background after the abort.
+  var backgroundDone = false;
+  var underlying = b.safeAsync.sleep(30).then(function () {
+    backgroundDone = true;
+    return "underlying-finished";
+  });
+
+  var ctrl = new AbortController();
+  var wrapped = b.safeAsync.withSignal(underlying, ctrl.signal);
+  ctrl.abort(new Error("caller-cancelled"));
+
+  var aborted = null;
+  try { await wrapped; }
+  catch (e) { aborted = e; }
+  check("b.safeAsync.withSignal: aborting the signal rejects the wrapper", aborted !== null);
+  check("withSignal: rejection is a SafeAsyncError",
+    aborted instanceof b.safeAsync.SafeAsyncError);
+  check("withSignal: rejection .code is async/aborted", aborted && aborted.code === "async/aborted");
+  check("withSignal: .cause is the signal.reason passed to abort()",
+    aborted && aborted.cause instanceof Error && aborted.cause.message === "caller-cancelled");
+
+  // The underlying Promise is NOT cancelled — only the wrapper settled.
+  // Poll (never sleep) until the background work reports completion.
+  await waitUntil(function () { return backgroundDone; }, {
+    timeoutMs: 5000,
+    label: "safe-async withSignal: underlying promise continues after wrapper aborts",
+  });
+  check("withSignal: underlying promise keeps running in the background", backgroundDone === true);
+
+  // ---- withSignal: an already-aborted signal rejects immediately ----
+  var pre = new AbortController();
+  pre.abort();
+  var preAborted = null;
+  try { await b.safeAsync.withSignal(Promise.resolve("x"), pre.signal); }
+  catch (e) { preAborted = e; }
+  check("withSignal: a pre-aborted signal rejects with async/aborted",
+    preAborted instanceof b.safeAsync.SafeAsyncError && preAborted.code === "async/aborted");
+
+  // ---- withSignal: no signal / un-aborted signal resolve through ----
+  check("withSignal: no signal resolves the underlying value unchanged",
+    (await b.safeAsync.withSignal(Promise.resolve("passthru"), undefined)) === "passthru");
+
+  var live = new AbortController();
+  check("withSignal: an un-aborted signal resolves the underlying value",
+    (await b.safeAsync.withSignal(Promise.resolve("ok"), live.signal)) === "ok");
+
+  // Underlying rejection (signal never aborts) surfaces the ORIGINAL
+  // error, not a synthesized async/aborted one.
+  var origErr = null;
+  var live2 = new AbortController();
+  try { await b.safeAsync.withSignal(Promise.reject(new Error("underlying-fail")), live2.signal); }
+  catch (e) { origErr = e; }
+  check("withSignal: underlying rejection surfaces the original error",
+    origErr && origErr.message === "underlying-fail" && origErr.code === undefined);
+
+  // ---- makeDropCallback: canonical payload shape ----
+  var dropped = [];
+  var emit = b.safeAsync.makeDropCallback(
+    function (info) { dropped.push(info); },
+    function (e) { dropped.push({ onError: e.message }); }
+  );
+  emit("buffer-full", [{ id: 1 }], new Error("queue overflow"));
+  check("b.safeAsync.makeDropCallback: onDrop receives the canonical { reason, batch, error } payload",
+    dropped.length === 1 &&
+    dropped[0].reason === "buffer-full" &&
+    Array.isArray(dropped[0].batch) && dropped[0].batch[0].id === 1 &&
+    dropped[0].error instanceof Error && dropped[0].error.message === "queue overflow");
+
+  // An omitted error argument normalizes to error:null (not undefined).
+  emit("flush-timeout", [{ id: 2 }]);
+  check("makeDropCallback: omitted error normalizes to error:null",
+    dropped.length === 2 && dropped[1].error === null);
+
+  // ---- makeDropCallback: drop-silent contract ----
+  // A throwing onDrop must route to onError and NEVER bubble into the
+  // caller (the request/flush path that triggered the drop stays alive).
+  var onErrCaught = null;
+  var emitThrows = b.safeAsync.makeDropCallback(
+    function () { throw new Error("onDrop-boom"); },
+    function (e) { onErrCaught = e; }
+  );
+  var bubbled = false;
+  try { emitThrows("reason", []); }
+  catch (_e) { bubbled = true; }
+  check("makeDropCallback: a throwing onDrop does not bubble to the caller", bubbled === false);
+  check("makeDropCallback: the throw is routed to onError",
+    onErrCaught instanceof Error && onErrCaught.message === "onDrop-boom");
+
+  // A missing / non-function onDrop is a silent no-op — the drop-silent
+  // contract holds even when the operator wired nothing.
+  var nullThrew = false;
+  try { b.safeAsync.makeDropCallback(null, null)("reason", []); }
+  catch (_e) { nullThrew = true; }
+  check("makeDropCallback: a null onDrop is a silent no-op", nullThrew === false);
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  run().then(
+    function () { console.log("OK — " + helpers.getChecks() + " checks passed"); },
+    function (e) { console.error("FAIL:", e && e.stack || e); process.exit(1); }
+  );
+}

package/lib/vendor/blamejs/test/layer-0-primitives/safe-buffer-linear-scans.test.js

@@ -134,6 +134,20 @@ function run() {
   check("foldHeaderText: CR/LF and NUL together neutralized",
     sb.foldHeaderText("x\r\ny" + String.fromCharCode(0) + "z") === "x  yz");
   check("foldHeaderText: non-string passthrough", sb.foldHeaderText(42) === 42);
+
+  // ---- quoteString: RFC quoted-string serialization (escape \ and ", wrap) ----
+  check("quoteString: plain value wrapped in DQUOTEs",
+    b.safeBuffer.quoteString("edge") === "\"edge\"");
+  check("quoteString: DQUOTE escaped — value cannot terminate the string early",
+    sb.quoteString("say \"hi\"") === "\"say \\\"hi\\\"\"");
+  check("quoteString: backslash doubled — cannot un-escape the next char",
+    sb.quoteString("a\\b") === "\"a\\\\b\"");
+  check("quoteString: backslash-then-quote stays inside the string",
+    sb.quoteString("\\\"") === "\"\\\\\\\"\"");
+  check("quoteString: non-string coerced via String()",
+    sb.quoteString(42) === "\"42\"");
+  check("quoteString: empty string is a valid empty quoted-string",
+    sb.quoteString("") === "\"\"");
 }
 
 module.exports = { run: run };

package/lib/vendor/blamejs/test/layer-0-primitives/safe-buffer.test.js

@@ -0,0 +1,80 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+/**
+ * b.safeBuffer.stripCrlf — remove every CR and LF from a string,
+ * substituting the replacement argument (default ""). Used to
+ * neutralize header-injection / smuggling vectors when the framework
+ * must serialize an operator-supplied string into a CRLF-delimited
+ * protocol line and prefers silent stripping over rejecting. Non-string
+ * input passes through unchanged.
+ */
+
+var helpers = require("../helpers");
+var b     = helpers.b;
+var check = helpers.check;
+
+function run() {
+  var sb = b.safeBuffer;
+
+  // ---- default replacement drops CR/LF entirely ----
+  check("b.safeBuffer.stripCrlf: CRLF removed with the empty-string default",
+    b.safeBuffer.stripCrlf("ok\r\nbad") === "okbad");
+  check("stripCrlf: a bare CR is removed", sb.stripCrlf("a\rb") === "ab");
+  check("stripCrlf: a bare LF is removed", sb.stripCrlf("a\nb") === "ab");
+  check("stripCrlf: every CR/LF in a run is removed",
+    sb.stripCrlf("h\r\ni\rj\nk") === "hijk");
+
+  // ---- header-injection scenario the primitive exists for ----
+  // An operator value carrying a CRLF + a forged header must collapse
+  // onto one line so it can't smuggle a second header.
+  check("stripCrlf: neutralizes a CRLF header-injection payload",
+    b.safeBuffer.stripCrlf("value\r\nX-Injected: evil") === "valueX-Injected: evil");
+
+  // ---- custom replacement ----
+  check("stripCrlf: custom replacement substitutes each CR/LF",
+    b.safeBuffer.stripCrlf("a\nb\nc", " ") === "a b c");
+  check("stripCrlf: each CR and LF is replaced individually",
+    sb.stripCrlf("h\r\ni", "-") === "h--i");
+  check("stripCrlf: an explicit empty replacement matches the default",
+    sb.stripCrlf("a\nb", "") === "ab");
+
+  // ---- no CR/LF present → unchanged ----
+  check("stripCrlf: a clean string is returned unchanged",
+    sb.stripCrlf("no-newlines-here") === "no-newlines-here");
+  check("stripCrlf: an empty string stays empty", sb.stripCrlf("") === "");
+
+  // ---- non-string passthrough (advertised) ----
+  check("stripCrlf: a number passes through unchanged", b.safeBuffer.stripCrlf(42) === 42);
+  check("stripCrlf: undefined passes through unchanged", sb.stripCrlf(undefined) === undefined);
+  check("stripCrlf: null passes through unchanged", sb.stripCrlf(null) === null);
+  var obj = { a: 1 };
+  check("stripCrlf: a non-string object passes through by identity", sb.stripCrlf(obj) === obj);
+
+  // ---- byteLengthOfIfMeasurable: measures byte-carriers, null for the rest ----
+  check("byteLengthOfIfMeasurable: string → UTF-8 byte length",
+    b.safeBuffer.byteLengthOfIfMeasurable("中") === 3);
+  check("byteLengthOfIfMeasurable: Buffer → length",
+    b.safeBuffer.byteLengthOfIfMeasurable(Buffer.from([1, 2, 3, 4])) === 4);
+  check("byteLengthOfIfMeasurable: Uint8Array → length",
+    b.safeBuffer.byteLengthOfIfMeasurable(new Uint8Array(5)) === 5);
+  // The non-byte-carrier cases the guard-family byte cap must skip rather than
+  // crash on — a plain Array, an array-like object, a number, null/undefined.
+  check("byteLengthOfIfMeasurable: plain Array → null",
+    b.safeBuffer.byteLengthOfIfMeasurable([1, 2, 3]) === null);
+  check("byteLengthOfIfMeasurable: array-like object → null",
+    b.safeBuffer.byteLengthOfIfMeasurable({ length: 1e9 }) === null);
+  check("byteLengthOfIfMeasurable: number → null",
+    b.safeBuffer.byteLengthOfIfMeasurable(42) === null);
+  check("byteLengthOfIfMeasurable: null → null",
+    b.safeBuffer.byteLengthOfIfMeasurable(null) === null);
+  check("byteLengthOfIfMeasurable: undefined → null",
+    b.safeBuffer.byteLengthOfIfMeasurable(undefined) === null);
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  try { run(); console.log("OK — " + helpers.getChecks() + " checks passed"); }
+  catch (e) { console.error("FAIL:", e.stack || e); process.exit(1); }
+}

package/lib/vendor/blamejs/test/layer-0-primitives/safe-decompress.test.js

@@ -45,6 +45,33 @@ function testAlgorithmAllowlistRefusesUnknown() {
         threw && /unsupported-algorithm/.test(threw.code || ""));
 }
 
+// A non-own Object.prototype key ("constructor", "toString", …) is NOT in
+// the allowlist and MUST refuse exactly like any other typo'd algorithm.
+// A truthiness/`in`-style lookup (`!_algorithms[algo]`) inherits
+// Object.prototype members, so `algorithm: "constructor"` resolves to the
+// `Object` function and gets INVOKED — `Object(buf)` returns the raw
+// compressed buffer, so the primitive silently returns un-decompressed
+// bytes with no error (allowlist fail-open). The guard must use an
+// own-property check.
+function testAlgorithmAllowlistRefusesPrototypeKeys() {
+  var gz = zlib.gzipSync(Buffer.from("hello world hello world", "utf8"));
+  var protoKeys = [
+    "constructor", "__proto__", "hasOwnProperty", "toString",
+    "valueOf", "isPrototypeOf", "toLocaleString", "propertyIsEnumerable",
+  ];
+  for (var i = 0; i < protoKeys.length; i++) {
+    var algo = protoKeys[i];
+    var threw = null;
+    var returned = null;
+    try {
+      returned = b.safeDecompress(gz, { algorithm: algo, maxOutputBytes: C.BYTES.kib(64) });
+    } catch (e) { threw = e; }
+    check("prototype-key algorithm '" + algo + "' → refused (unsupported-algorithm), not silently accepted",
+          threw !== null && /safe-decompress\/unsupported-algorithm/.test(threw.code || "") &&
+          returned === null);
+  }
+}
+
 // ---- Happy path ----
 
 function testGzipRoundTrip() {
@@ -227,6 +254,7 @@ async function run() {
   testSurface();
   testAlgorithmRequired();
   testAlgorithmAllowlistRefusesUnknown();
+  testAlgorithmAllowlistRefusesPrototypeKeys();
   testGzipRoundTrip();
   testDeflateRawRoundTrip();
   testBrotliRoundTrip();

package/lib/vendor/blamejs/test/layer-0-primitives/safe-dns.test.js

@@ -417,6 +417,231 @@ function testBadProfileRefused() {
   check("bad profile refused",     threw && threw.code === "safe-dns/bad-profile");
 }
 
+// Capture the error code a thrown SafeDnsError carries (or null on success).
+function _codeOf(fn) {
+  try { fn(); return null; }
+  catch (e) { return e && e.code; }
+}
+
+// n length-prefixed labels each 63 bytes of 'a' (0x61) — max-width labels.
+function _wideLabels(n) {
+  var parts = [];
+  for (var i = 0; i < n; i += 1) { parts.push(Buffer.from([63])); parts.push(Buffer.alloc(63, 0x61)); }
+  return Buffer.concat(parts);
+}
+
+// n length-prefixed 1-byte labels ('a') — smallest legal label.
+function _tinyLabels(n) {
+  var parts = [];
+  for (var i = 0; i < n; i += 1) { parts.push(Buffer.from([1])); parts.push(Buffer.from("a", "ascii")); }
+  return Buffer.concat(parts);
+}
+
+// RED — a compression-pointer chain must not decompress to a name larger
+// than the RFC 1035 §3.1 255-octet cap. Question name is a pointer to block A
+// (3 x 63-octet labels), block A ends in a pointer to block B (3 more), which
+// terminates. Each block alone is under 255 octets, but the composite
+// decompressed name is ~385 octets. Before the accountants threaded through
+// the chain, the parser returned a 383-char name (cap bypassed); it must
+// instead fail closed with oversize-name.
+function testRefusesCompressionNameByteBomb() {
+  var h     = _hdr(0, 0x8180, 1, 0, 0, 0);
+  var qptr  = Buffer.from([0xc0, 18]);                     // question name -> block A at offset 18
+  var qtail = Buffer.alloc(4); qtail.writeUInt16BE(1, 0); qtail.writeUInt16BE(1, 2);
+  var blockA = _wideLabels(3);                             // offsets 18..209 (192 octets)
+  var ptrAB  = Buffer.from([0xc0, 212]);                   // block A tail -> block B at offset 212
+  var blockB = _wideLabels(3);                             // offsets 212..403
+  var term   = Buffer.from([0]);
+  var buf    = Buffer.concat([h, qptr, qtail, blockA, ptrAB, blockB, term]);
+  var code = _codeOf(function () { b.safeDns.parseResponse(buf); });
+  check("compression byte-bomb: fails closed (oversize-name)", code === "safe-dns/oversize-name");
+}
+
+// RED — the maxLabels cap (127) must also thread through compression. Two
+// 100-label blocks joined by a pointer: each block is under the cap, the
+// composite is 200 labels. Before the fix the parser returned a 200-label
+// name; it must refuse the over-cap composite.
+function testRefusesCompressionLabelBomb() {
+  var h     = _hdr(0, 0x8180, 1, 0, 0, 0);
+  var qptr  = Buffer.from([0xc0, 18]);                     // question name -> block A at offset 18
+  var qtail = Buffer.alloc(4); qtail.writeUInt16BE(1, 0); qtail.writeUInt16BE(1, 2);
+  var blockA = _tinyLabels(100);                           // offsets 18..217 (200 octets, 100 labels)
+  var ptrAB  = Buffer.from([0xc0, 220]);                   // block A tail -> block B at offset 220
+  var blockB = _tinyLabels(100);
+  var term   = Buffer.from([0]);
+  var buf    = Buffer.concat([h, qptr, qtail, blockA, ptrAB, blockB, term]);
+  var code = _codeOf(function () { b.safeDns.parseResponse(buf); });
+  check("compression label-bomb: fails closed (oversize-labels)", code === "safe-dns/oversize-labels");
+}
+
+// A legitimate compression pointer (composite name well under the caps) must
+// still decompress correctly — the fix must not over-reject. The answer RR's
+// NAME is a pointer back to the question name.
+function testCompressionPointerResolves() {
+  var h     = _hdr(0, 0x8180, 1, 1, 0, 0);
+  var qn    = _encName("example.com");                    // offsets 12..24 (13 octets)
+  var qtail = Buffer.alloc(4); qtail.writeUInt16BE(1, 0); qtail.writeUInt16BE(1, 2);
+  var aptr  = Buffer.from([0xc0, 12]);                    // answer name -> question name
+  var fixed = Buffer.alloc(10);
+  fixed.writeUInt16BE(1, 0); fixed.writeUInt16BE(1, 2); fixed.writeUInt32BE(300, 4); fixed.writeUInt16BE(4, 8);
+  var rdata = Buffer.from([192, 0, 2, 7]);
+  var buf   = Buffer.concat([h, qn, qtail, aptr, fixed, rdata]);
+  var p = b.safeDns.parseResponse(buf);
+  check("compression resolve: answer name decompressed", p.answer[0].name === "example.com");
+  check("compression resolve: A decoded",                p.answer[0].decoded === "192.0.2.7");
+}
+
+function testRefusesTruncatedNameLabelPastEnd() {
+  // Question label claims 5 bytes but the buffer ends after 2.
+  var buf = Buffer.concat([_hdr(0, 0x8180, 1, 0, 0, 0), Buffer.from([5, 0x61, 0x62])]);
+  check("truncated-name (label past end)",
+    _codeOf(function () { b.safeDns.parseResponse(buf); }) === "safe-dns/truncated-name");
+}
+
+function testRefusesTruncatedNamePointerByte() {
+  // A compression-pointer's high byte is the last byte in the message.
+  var buf = Buffer.concat([_hdr(0, 0x8180, 1, 0, 0, 0), Buffer.from([0xc0])]);
+  check("truncated-name (pointer truncated)",
+    _codeOf(function () { b.safeDns.parseResponse(buf); }) === "safe-dns/truncated-name");
+}
+
+function testRefusesPointerOffsetPastEnd() {
+  // Pointer resolves to offset 255, past the 14-byte message.
+  var buf = Buffer.concat([_hdr(0, 0x8180, 1, 0, 0, 0), Buffer.from([0xc0, 0xff])]);
+  check("truncated-name (pointer offset past end)",
+    _codeOf(function () { b.safeDns.parseResponse(buf); }) === "safe-dns/truncated-name");
+}
+
+function testRefusesTruncatedRrFixedPrefix() {
+  // Answer RR: valid name, then fewer than 10 octets of the fixed prefix.
+  var buf = Buffer.concat([_hdr(0, 0x8180, 0, 1, 0, 0), _encName("a.b"), Buffer.from([0, 1, 0])]);
+  check("truncated-rr (mid fixed-prefix)",
+    _codeOf(function () { b.safeDns.parseResponse(buf); }) === "safe-dns/truncated-rr");
+}
+
+function testRefusesOversizeAuthorityRrs() {
+  check("oversize-authority-rrs",
+    _codeOf(function () { b.safeDns.parseResponse(_hdr(0, 0x8180, 0, 0, 999, 0)); }) ===
+      "safe-dns/oversize-authority-rrs");
+}
+
+function testRefusesOversizeAdditionalRrs() {
+  check("oversize-additional-rrs",
+    _codeOf(function () { b.safeDns.parseResponse(_hdr(0, 0x8180, 0, 0, 0, 999)); }) ===
+      "safe-dns/oversize-additional-rrs");
+}
+
+function testRefusesTxtCharStringPastRdata() {
+  // TXT character-string length byte (5) overruns the 3-octet rdata.
+  var buf = Buffer.concat([_hdr(0, 0x8180, 0, 1, 0, 0), _rr("ex.com", 16, Buffer.from([5, 0x61, 0x62]))]);
+  check("txt char-string past rdata -> malformed-rdlength",
+    _codeOf(function () { b.safeDns.parseResponse(buf); }) === "safe-dns/malformed-rdlength");
+}
+
+function testRefusesSoaTailTruncated() {
+  // SOA rdata carries both names but fewer than the 20-octet fixed tail.
+  var soaRdata = Buffer.concat([_encName("m.ex"), _encName("r.ex"), Buffer.alloc(5)]);
+  var buf = Buffer.concat([_hdr(0, 0x8180, 0, 1, 0, 0), _rr("ex.com", 6, soaRdata)]);
+  check("soa tail truncated -> malformed-rdlength",
+    _codeOf(function () { b.safeDns.parseResponse(buf); }) === "safe-dns/malformed-rdlength");
+}
+
+function testDecodesSrv() {
+  var srvRdata = Buffer.concat([Buffer.from([0, 1, 0, 5, 0x1f, 0x90]), _encName("srv.example.com")]);
+  var buf = Buffer.concat([_hdr(0, 0x8180, 0, 1, 0, 0), _rr("ex.com", 33, srvRdata)]);
+  var d = b.safeDns.parseResponse(buf).answer[0].decoded;
+  check("SRV: priority", d.priority === 1);
+  check("SRV: weight",   d.weight === 5);
+  check("SRV: port",     d.port === 8080);
+  check("SRV: target",   d.target === "srv.example.com");
+}
+
+function testDecodesDs() {
+  var dsRdata = Buffer.concat([Buffer.from([0x12, 0x34, 8, 2]), Buffer.from([0xde, 0xad, 0xbe, 0xef])]);
+  var buf = Buffer.concat([_hdr(0, 0x8180, 0, 1, 0, 0), _rr("ex.com", 43, dsRdata)]);
+  var d = b.safeDns.parseResponse(buf).answer[0].decoded;
+  check("DS: keyTag",      d.keyTag === 0x1234);
+  check("DS: algorithm",   d.algorithm === 8);
+  check("DS: digestType",  d.digestType === 2);
+  check("DS: digest bytes", d.digest.length === 4 && d.digest[0] === 0xde);
+}
+
+function testDecodesDnskey() {
+  var dnskeyRdata = Buffer.concat([Buffer.from([0x01, 0x00, 3, 8]), Buffer.from([0xaa, 0xbb])]);
+  var buf = Buffer.concat([_hdr(0, 0x8180, 0, 1, 0, 0), _rr("ex.com", 48, dnskeyRdata)]);
+  var d = b.safeDns.parseResponse(buf).answer[0].decoded;
+  check("DNSKEY: flags",     d.flags === 256);
+  check("DNSKEY: protocol",  d.protocol === 3);
+  check("DNSKEY: algorithm", d.algorithm === 8);
+  check("DNSKEY: publicKey", d.publicKey.length === 2 && d.publicKey[0] === 0xaa);
+}
+
+function testDecodesTlsa() {
+  var tlsaRdata = Buffer.concat([Buffer.from([3, 1, 1]), Buffer.from([0xca, 0xfe])]);
+  var buf = Buffer.concat([_hdr(0, 0x8180, 0, 1, 0, 0), _rr("ex.com", 52, tlsaRdata)]);
+  var d = b.safeDns.parseResponse(buf).answer[0].decoded;
+  check("TLSA: usage",        d.usage === 3);
+  check("TLSA: selector",     d.selector === 1);
+  check("TLSA: matchingType", d.matchingType === 1);
+  check("TLSA: certData",     d.certData.length === 2 && d.certData[0] === 0xca);
+}
+
+function testDecodesRrsig() {
+  var fixed = Buffer.alloc(18);
+  fixed.writeUInt16BE(1, 0);      // typeCovered = A
+  fixed.writeUInt8(8, 2);         // algorithm
+  fixed.writeUInt8(2, 3);         // labels
+  fixed.writeUInt32BE(3600, 4);   // originalTtl
+  fixed.writeUInt32BE(1000, 8);   // sigExpiry
+  fixed.writeUInt32BE(500, 12);   // sigInception
+  fixed.writeUInt16BE(0xabcd, 16); // keyTag
+  var rrsigRdata = Buffer.concat([fixed, _encName("ex.com"), Buffer.from([0x11, 0x22, 0x33])]);
+  var buf = Buffer.concat([_hdr(0, 0x8180, 0, 1, 0, 0), _rr("ex.com", 46, rrsigRdata)]);
+  var d = b.safeDns.parseResponse(buf).answer[0].decoded;
+  check("RRSIG: typeCovered",  d.typeCovered === 1);
+  check("RRSIG: keyTag",       d.keyTag === 0xabcd);
+  check("RRSIG: signerName",   d.signerName === "ex.com");
+  check("RRSIG: signature",    d.signature.length === 3 && d.signature[0] === 0x11);
+}
+
+function testFormatIpv6NoCompression() {
+  // No zero run of length >= 2 — every group emitted, no "::".
+  var rdata = _aaaa(1, 2, 3, 4, 5, 6, 7, 8);
+  var buf = Buffer.concat([_hdr(0, 0x8180, 0, 1, 0, 0), _rr("ex.com", 28, rdata)]);
+  check("AAAA: no-compression full form",
+    b.safeDns.parseResponse(buf).answer[0].decoded === "1:2:3:4:5:6:7:8");
+}
+
+function testParseResponsePostureResolvesStrict() {
+  // ancount=100 is under balanced/permissive answer caps but over strict (64).
+  // posture "hipaa" maps to strict, so it must refuse.
+  check("posture hipaa -> strict answer cap fires",
+    _codeOf(function () { b.safeDns.parseResponse(_hdr(0, 0x8180, 0, 100, 0, 0), { posture: "hipaa" }); }) ===
+      "safe-dns/oversize-answer-rrs");
+  // posture wins over an explicit profile (resolver checks posture first).
+  check("posture beats profile (permissive+hipaa still strict)",
+    _codeOf(function () { b.safeDns.parseResponse(_hdr(0, 0x8180, 0, 100, 0, 0), { profile: "permissive", posture: "hipaa" }); }) ===
+      "safe-dns/oversize-answer-rrs");
+  // permissive alone accepts ancount=100 (cap 256) — it fails later on the
+  // empty RR body, not on the answer-count guard.
+  check("permissive alone does not trip answer cap at 100",
+    _codeOf(function () { b.safeDns.parseResponse(_hdr(0, 0x8180, 0, 100, 0, 0), { profile: "permissive" }); }) !==
+      "safe-dns/oversize-answer-rrs");
+}
+
+function testBoundEdns0NegativeAndNonFinite() {
+  check("boundEdns0 negative refused",  _codeOf(function () { b.safeDns.boundEdns0(-1); }) === "safe-dns/bad-input");
+  check("boundEdns0 Infinity refused",  _codeOf(function () { b.safeDns.boundEdns0(Infinity); }) === "safe-dns/bad-input");
+  check("boundEdns0 NaN refused",       _codeOf(function () { b.safeDns.boundEdns0(NaN); }) === "safe-dns/bad-input");
+  check("boundEdns0 exactly at cap",    b.safeDns.boundEdns0(b.safeDns.PROFILES.strict.maxEdns0Bytes) === b.safeDns.PROFILES.strict.maxEdns0Bytes);
+}
+
+function testCheckCnameChainDepthBadInput() {
+  check("cnameDepth negative refused", _codeOf(function () { b.safeDns.checkCnameChainDepth(-1); }) === "safe-dns/bad-input");
+  check("cnameDepth NaN refused",      _codeOf(function () { b.safeDns.checkCnameChainDepth(NaN); }) === "safe-dns/bad-input");
+  check("cnameDepth string refused",   _codeOf(function () { b.safeDns.checkCnameChainDepth("5"); }) === "safe-dns/bad-input");
+}
+
 function run() {
   testSurface();
   testParsesARecord();
@@ -446,6 +671,26 @@ function run() {
   testProfileBalanced();
   testProfilePermissive();
   testBadProfileRefused();
+  testRefusesCompressionNameByteBomb();
+  testRefusesCompressionLabelBomb();
+  testCompressionPointerResolves();
+  testRefusesTruncatedNameLabelPastEnd();
+  testRefusesTruncatedNamePointerByte();
+  testRefusesPointerOffsetPastEnd();
+  testRefusesTruncatedRrFixedPrefix();
+  testRefusesOversizeAuthorityRrs();
+  testRefusesOversizeAdditionalRrs();
+  testRefusesTxtCharStringPastRdata();
+  testRefusesSoaTailTruncated();
+  testDecodesSrv();
+  testDecodesDs();
+  testDecodesDnskey();
+  testDecodesTlsa();
+  testDecodesRrsig();
+  testFormatIpv6NoCompression();
+  testParseResponsePostureResolvesStrict();
+  testBoundEdns0NegativeAndNonFinite();
+  testCheckCnameChainDepthBadInput();
 }
 
 module.exports = { run: run };

package/lib/vendor/blamejs/test/layer-0-primitives/safe-ical.test.js

@@ -238,6 +238,37 @@ function testProfileBalancedAcceptsLargerInput() {
     ast.vcalendar.vevent[0].properties["X-PADDING-0"][0].value === pad);
 }
 
+function testProtoKeyProfileRejected() {
+  // A prototype-member name as the profile must be refused, not resolved to an
+  // inherited member ("constructor" -> Object.prototype.constructor,
+  // "__proto__" -> Object.prototype, "toString" -> a Function). The own-property
+  // guard in _resolveCaps rejects it; a bare `if (!PROFILES[name])` truthiness
+  // check would pass the inherited member as a known profile (fail-open).
+  expectRefused("refuses prototype-key profile 'constructor'",
+    function () { safeIcal.parse(_ical(_event()), { profile: "constructor" }); },
+    "safe-ical/bad-opt");
+  expectRefused("refuses prototype-key profile '__proto__'",
+    function () { safeIcal.parse(_ical(_event()), { profile: "__proto__" }); },
+    "safe-ical/bad-opt");
+  expectRefused("refuses prototype-key profile 'toString'",
+    function () { safeIcal.parse(_ical(_event()), { profile: "toString" }); },
+    "safe-ical/bad-opt");
+  // A prototype-member name as the compliancePosture must not resolve to an
+  // inherited member either. The own-property guard skips the unknown posture
+  // and falls back to the strict profile, parsing cleanly — a bare
+  // `COMPLIANCE_POSTURES[name] || "strict"` read would surface a Function as
+  // the profile name and refuse spuriously (or, without the profile guard,
+  // run under it). Assert the secure fall-back holds.
+  var postureThrew = null, ast = null;
+  try { ast = safeIcal.parse(_ical(_event()), { compliancePosture: "toString" }); }
+  catch (e) { postureThrew = e; }
+  check("prototype-key posture falls back to strict (no fail-open)",
+    postureThrew === null && !!(ast && ast.vcalendar));
+  // A valid profile still parses.
+  var ok = safeIcal.parse(_ical(_event()), { profile: "balanced" });
+  check("valid profile 'balanced' still parses", !!ok.vcalendar);
+}
+
 function testHipaaPosture() {
   // hipaa posture maps to strict.
   expectRefused("hipaa posture refuses oversize (mapped to strict)",
@@ -279,6 +310,7 @@ async function run() {
   testRefusesUnterminatedComponent();
   testRefusesBadInput();
   testRefusesBadProfile();
+  testProtoKeyProfileRejected();
   testProfileBalancedAcceptsLargerInput();
   testHipaaPosture();
 }