@blamejs/blamejs-shop 0.5.19 → 0.5.21

package/lib/vendor/blamejs/lib/testing.js

@@ -262,10 +262,10 @@ function bodyRes() {
 
 /**
  * @primitive b.testing.streamingRes
- * @signature b.testing.streamingRes()
+ * @signature b.testing.streamingRes(opts?)
  * @since     0.1.0
  * @status    stable
- * @related   b.testing.mockRes, b.testing.bodyRes
+ * @related   b.testing.mockRes, b.testing.bodyRes, b.render.stream
  *
  * Build an EventEmitter-backed response that buffers every `write()`
  * chunk into `res._chunks` and exposes `res._captured()` as a single
@@ -273,6 +273,16 @@ function bodyRes() {
  * via repeated `res.write(chunk)` calls (gzip, server-sent events,
  * NDJSON producers, range responses).
  *
+ * Pass `highWaterMark` to exercise back-pressure. Without it `write()`
+ * always returns `true`, which is the one thing a real socket does not
+ * do — so a consumer that discards the return value and buffers without
+ * limit looks correct here and fails against a slow client. With it the
+ * double reports "full" once that many bytes are outstanding and emits
+ * `drain` on the next tick, which is the sequence a real socket produces.
+ *
+ * @opts
+ *   highWaterMark: 0,   // bytes outstanding before write() returns false; 0 disables
+ *
  * @example
  *   var res = b.testing.streamingRes();
  *   res.writeHead(200, { "content-type": "application/octet-stream" });
@@ -281,9 +291,21 @@ function bodyRes() {
  *   res.end();
  *   res._captured().toString("utf8");   // → "hello"
  *   res._statusCode;                    // → 200
+ *
+ *   var slow = b.testing.streamingRes({ highWaterMark: 4 });
+ *   slow.write("12345");                // → false, then emits "drain"
  */
-function streamingRes() {
+function streamingRes(opts) {
+  opts = opts || {};
+  var highWaterMark = opts.highWaterMark === undefined ? 0 : opts.highWaterMark;
+  if (typeof highWaterMark !== "number" || !isFinite(highWaterMark) || highWaterMark < 0) {
+    throw new TypeError("testing.streamingRes: opts.highWaterMark must be a non-negative number");
+  }
   var res = new EventEmitter();
+  res._drainedAt = 0;
+  res._written = 0;
+  res._pending = 0;
+  res._drainScheduled = false;
   res._chunks = [];
   res._headers = {};
   res._statusCode = 200;
@@ -305,9 +327,34 @@ function streamingRes() {
   res.getHeader    = function (k)    { return res._headers[k.toLowerCase()]; };
   res.removeHeader = function (k)    { delete res._headers[k.toLowerCase()]; };
   res.write = function (chunk) {
-    if (Buffer.isBuffer(chunk)) res._chunks.push(chunk);
-    else if (typeof chunk === "string") res._chunks.push(Buffer.from(chunk));
-    return true;
+    // The running total, counted as each chunk arrives. Asking `_captured()`
+    // for it concatenated every chunk written so far, so a test that streamed
+    // many small ones copied the whole response for each — quadratic in the
+    // output, in the very helper written to test streaming a lot of it.
+    if (Buffer.isBuffer(chunk)) { res._chunks.push(chunk); res._written += chunk.length; }
+    else if (typeof chunk === "string") {
+      var encoded = Buffer.from(chunk);
+      res._chunks.push(encoded);
+      res._written += encoded.length;
+    }
+    // Always returning true left the back-pressure path untestable: a consumer
+    // that ignores the return value looks correct against this double and
+    // buffers without limit against a slow client. With a highWaterMark the
+    // double says "full" once that many bytes are outstanding and emits
+    // `drain` on the next tick, which is the sequence a real socket produces.
+    if (highWaterMark <= 0) return true;
+    res._pending = res._written - res._drainedAt;
+    if (res._pending < highWaterMark) return true;
+    if (!res._drainScheduled) {
+      res._drainScheduled = true;
+      setImmediate(function () {
+        res._drainScheduled = false;
+        res._drainedAt = res._written;
+        res._pending = 0;
+        res.emit("drain");
+      });
+    }
+    return false;
   };
   res.end = function (chunk) {
     if (chunk != null) res.write(chunk);
@@ -940,7 +987,7 @@ function request(target) {
   if (target && typeof target.handle === "function") {
     server = http.createServer(function (req, res) {
       Promise.resolve(target.handle(req, res)).catch(function (err) {
-        if (!res.headersSent) res.writeHead(500, { "Content-Type": "text/plain" });
+        if (!res.headersSent) res.writeHead(C.HTTP.STATUS.INTERNAL_SERVER_ERROR, { "Content-Type": "text/plain" });
         try { res.end((err && err.message) || "Internal Server Error"); } catch (_e) { /* response may already be ended */ }
       });
     });

package/lib/vendor/blamejs/lib/validate-opts.js

@@ -572,6 +572,61 @@ function assignOwnEnumerable(target, source, reservedKeys) {
   return Object.assign(target, Object.fromEntries(entries));
 }
 
+// outboundHttpOpts — the `{ client, allowedHosts }` an operator hands a
+// primitive that dials out on their behalf.
+//
+// A consumer that already owns an instrumented HTTP client — one circuit
+// breaker, one retry policy, one transcript their tests drive — otherwise has
+// every dial a framework primitive makes fall outside all of it, and no way to
+// narrow a mangled or attacker-influenced base URL down to the host they
+// expect. Both halves default to the framework's behaviour: an absent `client`
+// means the caller's own default, an absent `allowedHosts` means the SSRF gate
+// alone. Naming one is a NARROWING, never a widening.
+//
+// `client` is duck-typed on `request` so a consumer's wrapper qualifies without
+// inheriting from anything. `allowedHosts` is passed through to
+// `b.httpClient.request`, which already enforces it.
+//
+// Returns `{ client, allowedHosts }`, each null when not supplied. Codes are
+// derived from `codePrefix` so each primitive keeps its own error namespace:
+// `<prefix>/bad-http`, `<prefix>/bad-http-client`,
+// `<prefix>/bad-http-allowed-hosts`.
+function outboundHttpOpts(value, callerLabel, errorClass, codePrefix) {
+  var label  = callerLabel || "opts";
+  var prefix = codePrefix || "validate-opts";
+  if (value === undefined || value === null) return { client: null, allowedHosts: null };
+  optionalPlainObject(value, label + ": http", errorClass, prefix + "/bad-http",
+                      "must be a plain object of { client, allowedHosts }");
+  var known = { client: true, allowedHosts: true };
+  var keys  = Object.keys(value);
+  for (var i = 0; i < keys.length; i += 1) {
+    if (!Object.prototype.hasOwnProperty.call(known, keys[i])) {
+      _throw(errorClass, prefix + "/bad-http",
+             label + ": http has unknown option '" + keys[i] +
+             "' — expected client, allowedHosts",
+             "validate-opts/bad-http");
+    }
+  }
+  optionalObjectWithMethod(value.client, "request", label + ": http.client",
+                           errorClass, prefix + "/bad-http-client",
+                           "must be a b.httpClient-shaped object (request fn)");
+  optionalNonEmptyStringArray(value.allowedHosts, label + ": http.allowedHosts",
+                              errorClass, prefix + "/bad-http-allowed-hosts");
+  if (value.allowedHosts !== undefined && value.allowedHosts !== null &&
+      value.allowedHosts.length === 0) {
+    // An empty pin reads as "allow nothing" but would behave as "no pin at
+    // all" downstream — refuse it rather than let it quietly widen.
+    _throw(errorClass, prefix + "/bad-http-allowed-hosts",
+           label + ": http.allowedHosts must name at least one host",
+           "validate-opts/bad-http-allowed-hosts");
+  }
+  return {
+    client:       value.client || null,
+    allowedHosts: (value.allowedHosts && value.allowedHosts.length)
+                    ? value.allowedHosts.slice() : null,
+  };
+}
+
 // observabilityShape — operator-supplied `opts.observability` must
 // expose an `event` function. Parallel to auditShape; the n=1 catalog
 // tracks both inline-shape regexes.
@@ -599,6 +654,7 @@ module.exports.optionalNonEmptyString = optionalNonEmptyString;
 module.exports.optionalNonEmptyStringArray = optionalNonEmptyStringArray;
 module.exports.optionalObjectWithMethod = optionalObjectWithMethod;
 module.exports.optionalPlainObject = optionalPlainObject;
+module.exports.outboundHttpOpts = outboundHttpOpts;
 module.exports.requireNonEmptyString = requireNonEmptyString;
 module.exports.observabilityShape = observabilityShape;
 module.exports.requireObject = requireObject;

package/lib/vendor/blamejs/lib/vendor/MANIFEST.json

@@ -6,19 +6,49 @@
       "license": "MIT",
       "author": "Paul Miller",
       "source": "https://github.com/paulmillr/noble-ciphers",
+      "_about": "The server and browser bundles are built from ONE npm install in a single vendor-update run, so the two halves of a hybrid exchange cannot be different versions of the same cipher. One `version` field covers both files.",
       "exports": [
         "xchacha20poly1305"
       ],
       "files": {
-        "server": "lib/vendor/noble-ciphers.cjs"
+        "server": "lib/vendor/noble-ciphers.cjs",
+        "browser": "lib/vendor/browser/noble-ciphers.mjs"
       },
-      "bundler": "esbuild --format=cjs --platform=node",
-      "bundledAt": "2026-08-08T00:00:00Z",
+      "bundler": "esbuild --format=cjs --platform=node (server), esbuild --format=esm --platform=browser (browser)",
+      "bundledAt": "2026-08-10T00:00:00Z",
       "cpe": "cpe:2.3:a:paulmillr:noble-ciphers:2.3.0:*:*:*:*:node.js:*:*",
       "hashes": {
-        "server": "sha256:f3325f480cb8eb814fcb0baaa19336cbbf2b993f48624c6aa9600ffd69d0be5e"
+        "server": "sha256:f3325f480cb8eb814fcb0baaa19336cbbf2b993f48624c6aa9600ffd69d0be5e",
+        "browser": "sha256:0ffd91540bcb586a29b56e52ee1c29df69097b50776beb4036a07558f7a4e12e"
       },
-      "refreshedAt": "2026-08-08T08:35:00.179Z"
+      "refreshedAt": "2026-08-10T18:39:35.028Z"
+    },
+    "@noble/hashes": {
+      "version": "2.3.0",
+      "license": "MIT",
+      "author": "Paul Miller",
+      "source": "https://github.com/paulmillr/noble-hashes",
+      "_about": "Browser build only. The server side reaches SHAKE256, SHA3-512, HMAC and HKDF through node:crypto, which has carried all four since the Node floor — a .cjs here would be a bundle nothing requires. A browser has no node:crypto, so the client half of a hybrid exchange needs its own copy, and this is the one blamejs owns, hashes, currency-checks and lists in its SBOM rather than a second vendoring path maintained consumer-side. The version matches the copy that @noble/curves and @noble/post-quantum already inline, so the browser hash and the hash inside the server's PQC bundle are the same code.",
+      "exports": [
+        "shake128",
+        "shake256",
+        "sha3_256",
+        "sha3_512",
+        "sha256",
+        "sha512",
+        "hmac",
+        "hkdf"
+      ],
+      "files": {
+        "browser": "lib/vendor/browser/noble-hashes.mjs"
+      },
+      "bundler": "esbuild --format=esm --platform=browser (browser only)",
+      "bundledAt": "2026-08-10T00:00:00Z",
+      "cpe": "cpe:2.3:a:paulmillr:noble-hashes:2.3.0:*:*:*:*:node.js:*:*",
+      "hashes": {
+        "browser": "sha256:dfe4b7ae3c9880e388c8da4b68f44742b229b53afacd1e674179527e33da62b0"
+      },
+      "refreshedAt": "2026-08-10T18:39:35.028Z"
     },
     "@noble/curves": {
       "version": "2.3.0",
@@ -40,7 +70,7 @@
       "hashes": {
         "server": "sha256:b5fe88d1ea780d0581dee6145d666f89d46fc9531b5db35db2e5b16627840890"
       },
-      "refreshedAt": "2026-08-08T08:35:00.179Z",
+      "refreshedAt": "2026-08-10T18:39:35.028Z",
       "components": {
         "@noble/hashes": {
           "url": "https://github.com/paulmillr/noble-hashes",
@@ -49,7 +79,7 @@
       }
     },
     "@noble/post-quantum": {
-      "version": "0.6.1",
+      "version": "0.7.0",
       "license": "MIT",
       "author": "Paul Miller",
       "source": "https://github.com/paulmillr/noble-post-quantum",
@@ -68,28 +98,35 @@
         "slh_dsa_shake_192f",
         "slh_dsa_shake_256f"
       ],
+      "browser_exports": [
+        "ml_kem512",
+        "ml_kem768",
+        "ml_kem1024"
+      ],
       "files": {
-        "server": "lib/vendor/noble-post-quantum.cjs"
+        "server": "lib/vendor/noble-post-quantum.cjs",
+        "browser": "lib/vendor/browser/noble-post-quantum.mjs"
       },
-      "bundler": "esbuild --format=cjs --platform=node",
-      "bundledAt": "2026-07-13T00:00:00Z",
-      "cpe": "cpe:2.3:a:paulmillr:noble-post-quantum:0.6.1:*:*:*:*:node.js:*:*",
+      "bundler": "esbuild --format=cjs --platform=node (server), esbuild --format=esm --platform=browser (browser)",
+      "bundledAt": "2026-08-10T00:00:00Z",
+      "cpe": "cpe:2.3:a:paulmillr:noble-post-quantum:0.7.0:*:*:*:*:node.js:*:*",
       "hashes": {
-        "server": "sha256:f9c94094b3c10fe73dac5343289da582454ea6053494fab2bf66099d9103d6c3"
+        "server": "sha256:fab7ebe5737793862c473444f4ee5912f79dd1edec86683acbb4eecbca0f5892",
+        "browser": "sha256:cae1d5bbdc7184b202b6ca68df6e1db7b0d0f668c77809ded189ca7f271accc9"
       },
-      "refreshedAt": "2026-08-08T08:35:00.179Z",
+      "refreshedAt": "2026-08-10T18:39:35.028Z",
       "components": {
         "@noble/hashes": {
           "url": "https://github.com/paulmillr/noble-hashes",
-          "version": "2.2.0"
+          "version": "2.3.0"
         },
         "@noble/curves": {
           "url": "https://github.com/paulmillr/noble-curves",
-          "version": "2.2.0"
+          "version": "2.3.0"
         },
         "@noble/ciphers": {
           "url": "https://github.com/paulmillr/noble-ciphers",
-          "version": "2.2.0"
+          "version": "2.3.0"
         }
       }
     },
@@ -114,7 +151,7 @@
       "hashes": {
         "server": "sha256:e83195dc9f189385da9c856ef38843f4466f93ea8f3d7fc2efcb1e1b18da6f20"
       },
-      "refreshedAt": "2026-08-08T08:35:00.179Z"
+      "refreshedAt": "2026-08-10T18:39:35.028Z"
     },
     "SecLists-common-passwords-top-10000": {
       "version": "10k-most-common (master)",
@@ -134,7 +171,7 @@
       },
       "runtime_artifact": "lib/vendor/common-passwords-top-10000.data.js",
       "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
-      "refreshedAt": "2026-08-08T08:35:00.179Z"
+      "refreshedAt": "2026-08-10T18:39:35.028Z"
     },
     "bimi-trust-anchors": {
       "version": "operator-managed",
@@ -159,7 +196,7 @@
       },
       "runtime_artifact": "lib/vendor/bimi-trust-anchors.data.js",
       "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
-      "refreshedAt": "2026-08-08T08:35:00.179Z"
+      "refreshedAt": "2026-08-10T18:39:35.028Z"
     },
     "publicsuffix-list": {
       "version": "master",
@@ -179,10 +216,10 @@
       },
       "runtime_artifact": "lib/vendor/public-suffix-list.data.js",
       "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
-      "refreshedAt": "2026-08-08T08:35:00.179Z"
+      "refreshedAt": "2026-08-10T18:39:35.028Z"
     },
     "@blamejs/pki": {
-      "version": "0.4.3",
+      "version": "0.4.13",
       "license": "Apache-2.0",
       "author": "blamejs",
       "source": "https://github.com/blamejs/pki",
@@ -202,12 +239,12 @@
         "server": "lib/vendor/blamejs-pki.cjs"
       },
       "bundler": "esbuild --format=cjs --platform=node --external:crypto --external:node:crypto",
-      "bundledAt": "2026-08-08T00:00:00Z",
-      "cpe": "cpe:2.3:a:blamejs:pki:0.4.3:*:*:*:*:node.js:*:*",
+      "bundledAt": "2026-08-10T00:00:00Z",
+      "cpe": "cpe:2.3:a:blamejs:pki:0.4.13:*:*:*:*:node.js:*:*",
       "hashes": {
-        "server": "sha256:153ed8ad45c78cd9590878a185730fd382bf94f4ed2d6c260ee95a41c7887f43"
+        "server": "sha256:067ac05899ef04f7851a8d010dc4289e7a01706d5fd2cdc1ce59860631bba284"
       },
-      "refreshedAt": "2026-08-08T08:35:00.179Z"
+      "refreshedAt": "2026-08-10T18:39:35.028Z"
     }
   }
 }