@blamejs/blamejs-shop 0.5.12 → 0.5.13

package/lib/vendor/blamejs/NOTICE

@@ -25,6 +25,16 @@ Used for:    XChaCha20-Poly1305 authenticated encryption (lib/crypto.js,
              lib/vault-wrap.js, via lib/vendor/noble-ciphers.cjs).
              Thank you to Paul Miller for the audited noble-ciphers suite.
 --------------------------------------------------------------------------------
+Component:   @noble/curves
+Version:     2.2.0
+Source:      https://github.com/paulmillr/noble-curves
+License:     MIT
+Copyright:   Copyright (c) 2022 Paul Miller (https://paulmillr.com)
+Used for:    RFC 9497 Oblivious Pseudo-Random Function (OPRF / VOPRF / POPRF)
+             over ristretto255 / P-256 / P-384 / P-521 (lib/crypto-oprf.js,
+             via lib/vendor/noble-curves.cjs). Thank you to Paul Miller for the
+             audited noble-curves suite.
+--------------------------------------------------------------------------------
 Component:   @noble/post-quantum
 Version:     0.6.1
 Source:      https://github.com/paulmillr/noble-post-quantum
@@ -41,7 +51,7 @@ Used for:    FIPS 203 ML-KEM (ml_kem_512 / ml_kem_768 / ml_kem_1024),
              reference implementation.
 --------------------------------------------------------------------------------
 Component:   @simplewebauthn/server
-Version:     13.3.0
+Version:     13.3.2
 Source:      https://github.com/MasterKale/SimpleWebAuthn
 License:     MIT
 Copyright:   Copyright (c) Matthew Miller
@@ -79,3 +89,18 @@ Used for:    Top-10000 most-common (breach-derived) passwords. Loaded by
              project maintainers for keeping a curated, freely-redistributable
              baseline.
 --------------------------------------------------------------------------------
+Component:   publicsuffix-list (Mozilla Public Suffix List)
+Version:     master snapshot (bundled 2026-07-24)
+Source:      https://publicsuffix.org/list/public_suffix_list.dat
+License:     MPL-2.0
+Copyright:   Copyright (c) Mozilla Foundation and Public Suffix List contributors
+Used for:    Canonical catalog of effective top-level domains. Loaded at module
+             init by b.publicSuffix to derive organizational domains for
+             DMARCbis (psd= / np=) alignment, BIMI issuer scoping, cookie-scope
+             confinement, and same-site policy (lib/public-suffix.js, via
+             lib/vendor/public-suffix-list.dat). This is data, not a code
+             bundle. The list is vendored verbatim and unmodified and remains
+             licensed under the Mozilla Public License 2.0; its complete source
+             is available at the canonical URL above, satisfying MPL-2.0 §3.2.
+             The full MPL-2.0 text is at https://www.mozilla.org/MPL/2.0/.
+--------------------------------------------------------------------------------

package/lib/vendor/blamejs/SECURITY.md

@@ -203,7 +203,7 @@ What blamejs defends against, by design:
 - **Online brute-force against credentials** — `b.auth.lockout` tracks failed attempts per account (or any operator-chosen key) and engages an exponential-backoff lockout (1m → 5m → 15m → 1h → 6h+, clamped). State lives in `b.cache` so it shares across cluster nodes when the cluster backend is wired. Operator-driven `unlock(key, { req, reason })` audits with the admin's 5 W's. Backend errors fail open (the framework's job is to slow attackers, not to lock operators out of their own admin accounts when Redis dies).
 - **Inline-script injection** — strict CSP default (`script-src 'self' 'nonce-...'`) blocks anything an XSS payload could ship.
 - **Algorithm-substitution attacks** — every encrypted blob carries a 4-byte algorithm-ID header; `b.crypto.decrypt` dispatches on the header bytes, not on a guess at the active default. An attacker swapping a weaker algorithm into the envelope fails the AEAD tag check.
-- **Supply-chain compromise via npm transitive deps** — zero npm runtime dependencies. Every external library is vendored under `lib/vendor/` with a manifest pinning version + license + provenance. Build reproducibility is verified via the GHCR image's SLSA provenance attestation (see DEPLOY.md → "Release verification").
+- **Supply-chain compromise via npm transitive deps** — zero npm runtime dependencies. Every external library is vendored under `lib/vendor/` as an unminified, reviewable bundle, with a manifest pinning version + license + provenance. Build reproducibility is verified via the GHCR image's SLSA provenance attestation (see DEPLOY.md → "Release verification").
 - **A published CVE in a vendored library going unnoticed** — because the crypto is vendored rather than installed, `npm audit` / Dependabot / Socket never see it. Every PR builds a CycloneDX SBOM of `lib/vendor/` (each library carries an npm purl) and runs it through OSV-Scanner, matching the exact pinned version against the OSV vulnerability database (CVE + GHSA). A match fails the build — the vendored copy is refreshed before merge. This runs alongside CodeQL (semantic SAST), a complementary Semgrep pass (registry security-audit + javascript packs at ERROR severity), gitleaks (secret scan over full history), and actionlint (workflow static analysis).
 - **Replay of API requests** — `apiEncrypt` middleware nonce-stores + replay-windows the `_ek` field; old session keys can't be reused.
 - **Error-detail leakage on an encrypted channel** — when `apiEncrypt` is active, terminal error responses (the error page, schema-validation refusals, RFC 9457 problem+json, deny-middleware bodies) are sealed in the same `{ _ct }` envelope as successes via `req.apiEncryptEncode`, so error detail (paths, field names, refusal reasons) doesn't ship in plaintext while the surrounding traffic is encrypted. Errors raised before a session exists (Bearer 401, handshake reject, replay refusal) stay plaintext so the caller can read them; the client opts into reading a non-2xx with `b.httpClient.encrypted({ responseMode: "passthrough" })` instead of throwing on the shape.

package/lib/vendor/blamejs/api-snapshot.json

@@ -1,7 +1,7 @@
 {
   "version": 1,
-  "frameworkVersion": "0.16.3",
-  "createdAt": "2026-07-03T20:45:25.445Z",
+  "frameworkVersion": "0.17.22",
+  "createdAt": "2026-07-25T13:46:32.462Z",
   "exports": {
     "a2a": {
       "type": "object",
@@ -2126,7 +2126,7 @@
         },
         "parseRaw": {
           "type": "function",
-          "arity": 1
+          "arity": 2
         }
       }
     },
@@ -6827,6 +6827,127 @@
           "type": "instance",
           "ctorName": "RegExp"
         },
+        "NAMED_ENTITY_ASCII": {
+          "type": "object",
+          "members": {
+            "NewLine": {
+              "type": "primitive",
+              "valueType": "string"
+            },
+            "Tab": {
+              "type": "primitive",
+              "valueType": "string"
+            },
+            "amp": {
+              "type": "primitive",
+              "valueType": "string"
+            },
+            "apos": {
+              "type": "primitive",
+              "valueType": "string"
+            },
+            "ast": {
+              "type": "primitive",
+              "valueType": "string"
+            },
+            "bsol": {
+              "type": "primitive",
+              "valueType": "string"
+            },
+            "colon": {
+              "type": "primitive",
+              "valueType": "string"
+            },
+            "commat": {
+              "type": "primitive",
+              "valueType": "string"
+            },
+            "dollar": {
+              "type": "primitive",
+              "valueType": "string"
+            },
+            "excl": {
+              "type": "primitive",
+              "valueType": "string"
+            },
+            "gt": {
+              "type": "primitive",
+              "valueType": "string"
+            },
+            "hyphen": {
+              "type": "primitive",
+              "valueType": "string"
+            },
+            "lcub": {
+              "type": "primitive",
+              "valueType": "string"
+            },
+            "lowbar": {
+              "type": "primitive",
+              "valueType": "string"
+            },
+            "lpar": {
+              "type": "primitive",
+              "valueType": "string"
+            },
+            "lsqb": {
+              "type": "primitive",
+              "valueType": "string"
+            },
+            "lt": {
+              "type": "primitive",
+              "valueType": "string"
+            },
+            "nbsp": {
+              "type": "primitive",
+              "valueType": "string"
+            },
+            "num": {
+              "type": "primitive",
+              "valueType": "string"
+            },
+            "percnt": {
+              "type": "primitive",
+              "valueType": "string"
+            },
+            "period": {
+              "type": "primitive",
+              "valueType": "string"
+            },
+            "plus": {
+              "type": "primitive",
+              "valueType": "string"
+            },
+            "quest": {
+              "type": "primitive",
+              "valueType": "string"
+            },
+            "quot": {
+              "type": "primitive",
+              "valueType": "string"
+            },
+            "rcub": {
+              "type": "primitive",
+              "valueType": "string"
+            },
+            "rpar": {
+              "type": "primitive",
+              "valueType": "string"
+            },
+            "rsqb": {
+              "type": "primitive",
+              "valueType": "string"
+            },
+            "semi": {
+              "type": "primitive",
+              "valueType": "string"
+            },
+            "sol": {
+              "type": "primitive",
+              "valueType": "string"
+            }
+          }
+        },
         "NULL_BYTE": {
           "type": "primitive",
           "valueType": "string"
@@ -6920,6 +7041,10 @@
           "type": "function",
           "arity": 1
         },
+        "decodeMarkupEntities": {
+          "type": "function",
+          "arity": 1
+        },
         "decodeNumericEntities": {
           "type": "function",
           "arity": 1
@@ -6963,6 +7088,10 @@
         "scriptFor": {
           "type": "function",
           "arity": 1
+        },
+        "stripUrlSchemeWhitespace": {
+          "type": "function",
+          "arity": 1
         }
       }
     },
@@ -14630,6 +14759,14 @@
           "type": "function",
           "arity": 2
         },
+        "spkiPin": {
+          "type": "function",
+          "arity": 1
+        },
+        "spkiPinVerifier": {
+          "type": "function",
+          "arity": 1
+        },
         "sri": {
           "type": "function",
           "arity": 2
@@ -15004,6 +15141,10 @@
           "type": "function",
           "arity": 1
         },
+        "status": {
+          "type": "function",
+          "arity": 1
+        },
         "stop": {
           "type": "function",
           "arity": 1
@@ -42369,7 +42510,7 @@
           "members": {
             "verify": {
               "type": "function",
-              "arity": 1
+              "arity": 2
             }
           }
         },
@@ -49274,6 +49415,10 @@
           "type": "function",
           "arity": 2
         },
+        "redactText": {
+          "type": "function",
+          "arity": 1
+        },
         "registerFieldRule": {
           "type": "function",
           "arity": 2
@@ -49903,6 +50048,10 @@
           "type": "function",
           "arity": 2
         },
+        "byteLengthOfIfMeasurable": {
+          "type": "function",
+          "arity": 1
+        },
         "collectStream": {
           "type": "function",
           "arity": 2
@@ -49931,6 +50080,10 @@
           "type": "function",
           "arity": 2
         },
+        "quoteString": {
+          "type": "function",
+          "arity": 1
+        },
         "secureZero": {
           "type": "function",
           "arity": 1
@@ -51066,6 +51219,19 @@
         }
       }
     },
+    "safeObject": {
+      "type": "object",
+      "members": {
+        "ownProp": {
+          "type": "function",
+          "arity": 2
+        },
+        "ownSet": {
+          "type": "function",
+          "arity": 3
+        }
+      }
+    },
     "safePath": {
       "type": "object",
       "members": {
@@ -51073,6 +51239,10 @@
           "type": "function",
           "arity": 4
         },
+        "confineToBase": {
+          "type": "function",
+          "arity": 3
+        },
         "resolve": {
           "type": "function",
           "arity": 3
@@ -51544,6 +51714,10 @@
           "type": "function",
           "arity": 1
         },
+        "normalizeForScan": {
+          "type": "function",
+          "arity": 1
+        },
         "quoteIdentifier": {
           "type": "function",
           "arity": 3
@@ -52304,10 +52478,22 @@
           "type": "function",
           "arity": 4
         },
+        "beginProbation": {
+          "type": "function",
+          "arity": 1
+        },
         "compareTags": {
           "type": "function",
           "arity": 2
         },
+        "confirmHealthy": {
+          "type": "function",
+          "arity": 1
+        },
+        "evaluateOnBoot": {
+          "type": "function",
+          "arity": 1
+        },
         "poll": {
           "type": "function",
           "arity": 1
@@ -52325,7 +52511,7 @@
             },
             "verify": {
               "type": "function",
-              "arity": 3
+              "arity": 4
             }
           }
         },
@@ -52751,6 +52937,10 @@
           "type": "function",
           "arity": 1
         },
+        "isExactLoopbackName": {
+          "type": "function",
+          "arity": 1
+        },
         "isLinkLocal": {
           "type": "function",
           "arity": 1
@@ -52759,6 +52949,10 @@
           "type": "function",
           "arity": 1
         },
+        "isLoopbackHost": {
+          "type": "function",
+          "arity": 1
+        },
         "isPrivate": {
           "type": "function",
           "arity": 1
@@ -53981,6 +54175,14 @@
     "watcher": {
       "type": "object",
       "members": {
+        "MAX_IGNORE_PATTERN_LEN": {
+          "type": "primitive",
+          "valueType": "number"
+        },
+        "MAX_IGNORE_STAR_COUNT": {
+          "type": "primitive",
+          "valueType": "number"
+        },
         "WatcherError": {
           "type": "function",
           "arity": 4

package/lib/vendor/blamejs/docker/keycloak/realm-blamejs-test.json

@@ -82,6 +82,35 @@
         "saml.authnstatement":                 "true"
       },
       "defaultClientScopes": ["role_list"]
+    },
+    {
+      "clientId": "https://sp-enc.blamejs-test.example",
+      "name": "blamejs SAML SP encrypted (integration test)",
+      "description": "SP entityID for the EncryptedAssertion decrypt-interop stage. Keycloak encrypts the assertion CEK to saml.encryption.certificate; the integration test overrides that cert with a runtime-generated one (via the admin API) so it holds the matching private key. The algorithm attributes request AES-GCM + RSA-OAEP-SHA256, which Keycloak >= 26.2 honors; Keycloak 26.0.x ignores them and emits aes128-cbc + rsa-oaep-mgf1p(SHA-1), which the framework refuses by design.",
+      "enabled": true,
+      "protocol": "saml",
+      "publicClient": true,
+      "redirectUris": [
+        "http://127.0.0.1:18099/saml/acs"
+      ],
+      "frontchannelLogout": false,
+      "attributes": {
+        "saml.assertion.signature":               "true",
+        "saml.server.signature":                  "false",
+        "saml.signature.algorithm":               "RSA_SHA256",
+        "saml.client.signature":                  "false",
+        "saml.encrypt":                           "true",
+        "saml.encryption.certificate":            "MIIDJTCCAg2gAwIBAgIUJ7mxaTrHZabJZAzkMg4eMDoFQRcwDQYJKoZIhvcNAQELBQAwIjEgMB4GA1UEAwwXc3AuYmxhbWVqcy10ZXN0LmV4YW1wbGUwHhcNMjYwNzE3MDQ1NjUzWhcNMzYwNzE0MDQ1NjUzWjAiMSAwHgYDVQQDDBdzcC5ibGFtZWpzLXRlc3QuZXhhbXBsZTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKm+j361HUDN3Ii1mTVy+zLJosG0NbR1AGbd2HiD8IxdogG4qg6/K5sNQ/qPMDszC596dqPKnIZFCj+xf6GwRxN83Eetbn8dq7BJJjuRrifEDrW7E+xMvYyecKuNccDOzOlQ4fsy2UKjP50XCZyosXUT02I7mm93IKVDy4KWBOizrTXOiD7Mfx/rUTarFObzxrOMBIFOhfeDxg+hRJjN6+LC/lzpbpxQZglkBhUq2gUU3/jTQPdEyCpFJ3gyndUufi7Drxlqp7Taod/jINbL1sHScsHapth1JB8836uOAuXPQ1NAKvLcQEDmd6Y+08N++hkO4PRDFPbGnKwNEzZYDqUCAwEAAaNTMFEwHQYDVR0OBBYEFOaSe3V7aicztXNyr/D67j/bZUvBMB8GA1UdIwQYMBaAFOaSe3V7aicztXNyr/D67j/bZUvBMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAEIIw7N99KMxgLDz7ZLesUupzNX+M5iWx9Ip3RVaRzf//nTQQUvGsaFgCeoFzAZ3TsfCtAqWu51pLmnox4bgyC+q1cPfFGjbfieF6VcK1+gnMRAQuDF7TSB98CIkIum+Y2jFXFnrP5nwplW6L00SFWaeqT9x8whNT0QEHbQ05IVeCn+IDUZwNLf+XIZWD3xpfilQ7KBE1USznYH9bqVQljWqPnUphnU2izIgQ/Ggsq9sZSmN1qcFl9QSJVJAmNXaddeQSXNUf7NtLs4OmuXZye66KJWg4W7oHb92sEiZIkKVHTlJSFzzumMToJsgBzvbkIvOy5mTP/JgrbOwTczIu40=",
+        "saml.encryption.algorithm":              "AES_256_GCM",
+        "saml.encryption.keyAlgorithm":           "RSA-OAEP",
+        "saml.encryption.digestMethod":           "SHA-256",
+        "saml.encryption.maskGenerationFunction": "MGF1-SHA256",
+        "saml.force.post.binding":                "true",
+        "saml_assertion_consumer_url_post":       "http://127.0.0.1:18099/saml/acs",
+        "saml_name_id_format":                    "username",
+        "saml.authnstatement":                    "true"
+      },
+      "defaultClientScopes": ["role_list"]
     }
   ]
 }

package/lib/vendor/blamejs/examples/wiki/DEPLOY.md

@@ -97,6 +97,7 @@ Every passphrase / webhook secret in the table above is **never** ENV-baked into
 - The wiki container persists state in the `wiki-data` named volume — vault key, sealed audit-signing key, sqlite database, audit chain. **Back this up.** Losing it loses the audit chain and admin credentials.
 - Caddy persists ACME state in the `caddy-data` named volume. Deleting it forces a re-issuance from scratch — Let's Encrypt rate limits apply, so don't.
 - All TLS is Caddy's. The wiki container only speaks HTTP on the compose network.
+- Prefer nginx? [`nginx.conf`](./nginx.conf) is an equivalent reference config — same TLS 1.3 floor, `www.`→apex 308 redirect, `X-Forwarded-Proto https` / `X-Forwarded-For`, and HSTS `max-age=63072000; includeSubDomains; preload`. nginx does not issue certificates itself; pair it with certbot for the cert paths it references, and set `WIKI_ADMIN_TRUSTED_PROXIES` to the proxy's CIDR so the wiki trusts the forwarded headers.
 
 ## Updating to a new version
 

package/lib/vendor/blamejs/examples/wiki/lib/build-app.js

@@ -494,6 +494,37 @@ async function buildApp(opts) {
         nonceMw:      nonceMw,
         siteUrl:      opts.siteUrl || "https://blamejs.com",
       };
+      // ---- Age-gated demo route ----
+      // Demonstrates b.middleware.ageGate riding the full wired stack
+      // (securityHeaders, compression, rate limit). The age is derived
+      // from the ?age= query field via Number(): a value that fails to
+      // parse yields NaN, which the gate classifies as "unknown" and
+      // answers with the child-safety privacy defaults (Cache-Control:
+      // private, no-store; Referrer-Policy: no-referrer;
+      // X-Privacy-Posture) instead of admitting the request as an
+      // adult. consentRequired follows the COPPA threshold (13 and
+      // under); requireAge stays null so the route classifies + sets
+      // headers without refusing. Registered as a literal path so it
+      // wins over the /:group catch-all.
+      var ageGateDemo = b.middleware.ageGate({
+        getAge: function (req) {
+          return Number(req.query && req.query.age);
+        },
+        consentRequired: 13,
+      });
+      router.get("/age-check", function (req, res, next) {
+        // ageGate publishes its classification on req.locals when the
+        // object exists; seed it so the handler below can echo the
+        // decision back to the caller.
+        if (!req.locals || typeof req.locals !== "object") req.locals = {};
+        return next();
+      }, ageGateDemo, function (req, res) {
+        res.setHeader("Content-Type", "application/json; charset=utf-8");
+        res.end(JSON.stringify({
+          classification: (req.locals && req.locals.ageGateClassification) || null,
+        }));
+      });
+
       pagesRoute.registerSpecific(router, routeCtx);
       adminRoute.register(router, routeCtx);
       pagesRoute.registerCatchAll(router, routeCtx);

package/lib/vendor/blamejs/examples/wiki/lib/source-comment-block-validator.js

@@ -88,6 +88,97 @@ function _moduleNs(modTag) {
 function _firstSegment(primTag) {
   return _bare(primTag).split(".")[0];
 }
+function _reEscape(s) {
+  return String(s).replace(/[.*+?^${}()|[\]\\]/g, "\\$&");                                           // allow:regex-no-length-cap — escapes short in-repo identifiers
+}
+
+// ---- primitive-without-test (config.testDirs) ----
+//
+// Every @primitive block must be exercised somewhere in the repo's test
+// corpus. "Referenced" is keyed on BOTH the namespace and the method —
+// a bare `.parse(` match alone would false-green half the catalog:
+//
+//   1. the full dotted form `b.<ns>.<method>` appears verbatim, OR
+//   2. the namespace is referenced (`b.<ns>` verbatim, or a require()
+//      of the primitive's own lib module) AND the method is invoked
+//      (`.<method>(`) — covers handle / instance methods
+//      (`var q = b.queue.init(...); q.enqueue(...)`).
+//
+// Static "referenced" only — whether the reference actually EXECUTES is
+// the coverage gate's job (c8), not a static validator's.
+//
+// TEST_REF_ALLOWLIST: the register of primitives the test corpus does
+// not yet reference. Currently empty — every documented @primitive is
+// exercised by a test. Add an entry ONLY with a specific reason coverage
+// is indirect (a runbook-only key, a fixture-dependent path); a new
+// primitive must land with its own test reference, not an entry here.
+var TEST_REF_ALLOWLIST = {
+};
+
+function _walkJsFiles(dir, out) {
+  var entries;
+  try { entries = fs.readdirSync(dir, { withFileTypes: true }); }
+  catch (_e) { return out; }
+  for (var i = 0; i < entries.length; i += 1) {
+    var ent = entries[i];
+    var p = path.join(dir, ent.name);
+    if (ent.isDirectory()) {
+      if (ent.name === "node_modules" || ent.name === ".test-output" || ent.name.indexOf("data") === 0) continue;
+      _walkJsFiles(p, out);
+    } else if (ent.isFile() && /\.(js|cjs|mjs)$/.test(ent.name)) {
+      out.push(p);
+    }
+  }
+  return out;
+}
+
+function _readTestCorpus(testDirs) {
+  // Per-file contents, not one concatenated blob: the split signal in
+  // _testReferenced requires the namespace and the method to co-occur
+  // in the SAME test file — corpus-wide matching would count a
+  // primitive as covered when one test names the namespace and an
+  // unrelated test happens to call the same common method name
+  // (`.create(`, `.parse(`).
+  var files = [];
+  for (var d = 0; d < testDirs.length; d += 1) {
+    var paths = _walkJsFiles(testDirs[d], []);
+    for (var i = 0; i < paths.length; i += 1) {
+      try { files.push(fs.readFileSync(paths[i], "utf8")); }
+      catch (_e) { /* drop unreadable */ }
+    }
+  }
+  return { files: files };
+}
+
+// primBare: the @primitive without the `b.` prefix (e.g.
+// "metrics.snapshot.render"). moduleRel: the primitive's home file
+// relative to lib/ (e.g. "auth/oauth.js") — a require() of that module
+// counts as a namespace reference.
+function _testReferenced(corpus, primBare, moduleRel) {
+  var files = corpus.files;
+  var full = new RegExp("\\bb\\." + _reEscape(primBare) + "(?![A-Za-z0-9_$])");                      // allow:dynamic-regex — built from the in-repo @primitive tag, _reEscape'd; no operator input
+  var i;
+  for (i = 0; i < files.length; i += 1) {
+    if (full.test(files[i])) return true;
+  }
+
+  var segs = primBare.split(".");
+  if (segs.length < 2) return false;   // single-segment: only the verbatim form counts
+  var ns = segs.slice(0, -1).join(".");
+  var method = segs[segs.length - 1];
+
+  var nsRef = new RegExp("\\bb\\." + _reEscape(ns) + "(?![A-Za-z0-9_$])");                           // allow:dynamic-regex — built from the in-repo @primitive tag, _reEscape'd; no operator input
+  var modNoExt = String(moduleRel).replace(/\\/g, "/").replace(/\.js$/, "");
+  var modRef = new RegExp("require\\([^)]*[\\\\/]" + _reEscape(modNoExt).replace(/\//g, "[\\\\/]") + "(?:\\.js)?[\"']"); // allow:dynamic-regex — built from the lib-relative file path of the primitive's own module, _reEscape'd; no operator input
+  var methodRef = new RegExp("\\." + _reEscape(method) + "\\s*\\(");                                 // allow:dynamic-regex — built from the in-repo @primitive tag's method segment, _reEscape'd; no operator input
+  // Namespace (or owning-module require) and method invocation must
+  // co-occur in the SAME file — a namespace reference in one test and
+  // an unrelated `.create(` in another is not coverage of b.<ns>.create.
+  for (i = 0; i < files.length; i += 1) {
+    if ((nsRef.test(files[i]) || modRef.test(files[i])) && methodRef.test(files[i])) return true;
+  }
+  return false;
+}
 
 // Probe the universe of primitive signatures available for @related
 // cross-reference. Sources: every @primitive block under lib/, plus
@@ -345,6 +436,14 @@ function validate(config) {
   var docs = parser.parseTree(libDir);
   var known = _knownPrimitiveSet(docs, seederIndex, parser);
 
+  // Optional test-corpus for the primitive-without-test check. When
+  // config.testDirs is absent the check silently skips (mirrors
+  // optsResolver) — every other check still runs.
+  var testCorpus = null;
+  if (Array.isArray(config.testDirs) && config.testDirs.length > 0) {
+    testCorpus = _readTestCorpus(config.testDirs);
+  }
+
   var declaredNs = {};
   curationPages.forEach(function (page) {
     (page.namespaces || []).forEach(function (ns) { declaredNs[ns] = page.slug; });
@@ -493,6 +592,16 @@ function validate(config) {
         }
       }
 
+      if (testCorpus) {
+        var testBare = _bare(primTag);
+        if (!TEST_REF_ALLOWLIST[testBare] && !_testReferenced(testCorpus, testBare, rel)) {
+          findings.push({
+            kind: "primitive-without-test", file: rel, primitive: primTag,
+            msg: "no test reference — need `b." + testBare + "` verbatim, or the namespace / owning module referenced plus `." + testBare.split(".").pop() + "(` invoked, anywhere in the test corpus. Add a test, or a TEST_REF_ALLOWLIST entry with the reason coverage is indirect.",
+          });
+        }
+      }
+
       var ns = _firstSegment(primTag);
       if (declaredNs[ns]) nsHasPrimitive[ns] = true;
       // Nested-namespace match — declared namespaces like