@blamejs/blamejs-shop 0.5.4 → 0.5.6

package/lib/vendor/blamejs/lib/restore-bundle.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.restoreBundle

package/lib/vendor/blamejs/lib/restore-rollback.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.restoreRollback

package/lib/vendor/blamejs/lib/restore.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * restore — operator-facing restore from a backup bundle in storage.

package/lib/vendor/blamejs/lib/retention.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.retention

package/lib/vendor/blamejs/lib/retry.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.retry

package/lib/vendor/blamejs/lib/rfc3339.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * rfc3339 — strict RFC 3339 date-time validation, shared by the primitives

package/lib/vendor/blamejs/lib/router.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.router
@@ -42,6 +44,7 @@ var requestHelpers = require("./request-helpers");
 var lazyRequire = require("./lazy-require");
 var safeAsync = require("./safe-async");
 var safeEnv = require("./parsers/safe-env");
+var safeJson = require("./safe-json");
 var safeUrl = require("./safe-url");
 var validateOpts = require("./validate-opts");
 var websocket = require("./websocket");
@@ -161,9 +164,25 @@ function _makeSchemaValidator(spec) {
   };
 }
 
+// True when a res.end body structurally looks like a JSON document — the
+// first non-whitespace byte is an object/array opener. Narrow on purpose:
+// a plain-text / HTML body on a response-schema route (leading "<", a bare
+// word, etc.) is skipped so the validator never throws on a non-JSON
+// response, and a JSON scalar (a bare number / quoted string) is not
+// mistaken for a schema-shaped document.
+function _bodyLooksLikeJson(text) {
+  for (var i = 0; i < text.length; i += 1) {
+    var ch = text.charCodeAt(i);
+    if (ch === 0x20 || ch === 0x09 || ch === 0x0A || ch === 0x0D) continue;   // skip leading whitespace
+    return ch === 0x7B || ch === 0x5B;                                        // "{" or "["
+  }
+  return false;
+}
+
 function _makeResponseValidator(spec) {
-  // Wraps res.json (and res.end when called with a JSON-shaped buffer)
-  // to validate the response body against spec.response. Mode:
+  // Validate the response body against spec.response no matter which exit
+  // the handler used — res.json OR a raw res.end(JSON.stringify(...)) that
+  // ships a JSON-shaped buffer. Mode:
   //   - BLAMEJS_VALIDATE_RESPONSES=throw (or per-route validateResponse: "throw")
   //     → throw a SafeSchemaError-shaped error; route handler's caller sees a 500.
   //   - BLAMEJS_VALIDATE_RESPONSES=warn (or per-route validateResponse: "warn")
@@ -175,21 +194,59 @@ function _makeResponseValidator(spec) {
   if (!mode) return function passthrough(_req, _res, next) { next(); };
 
   return function responseValidator(req, res, next) {
+    // One request-scoped check shared by both the res.json and res.end
+    // wrappers so a single failure shape covers every exit.
+    var validated = false;
+    function runCheck(value, headersAlreadySent) {
+      var rr = spec.response.safeParse(value);
+      if (rr.ok) return;
+      if (mode === "throw") {
+        // A raw res.end after writeHead cannot be un-sent — throwing there
+        // would abort mid-flush and can't reach a clean 500. Degrade to a
+        // logged error in that case; res.json (and a pre-writeHead res.end)
+        // still throw before any header is committed.
+        if (!headersAlreadySent) {
+          throw new Error("router response-validation failed for " +
+            (req.method + " " + req.routePattern) + ": " +
+            JSON.stringify(rr.errors));
+        }
+        log.error("response-validation failed after headers sent on " +
+                  req.method + " " + req.routePattern + ": " +
+                  JSON.stringify(rr.errors).slice(0, 500));
+        return;
+      }
+      // warn mode
+      log.warn("response-validation drift on " + req.method + " " + req.routePattern +
+               ": " + JSON.stringify(rr.errors).slice(0, 500));
+    }
+
     var origJson = typeof res.json === "function" ? res.json.bind(res) : null;
     if (origJson) {
       res.json = function (value) {
-        var rr = spec.response.safeParse(value);
-        if (!rr.ok) {
-          if (mode === "throw") {
-            throw new Error("router response-validation failed for " +
-              (req.method + " " + req.routePattern) + ": " +
-              JSON.stringify(rr.errors));
+        runCheck(value, false);   // res.json validates before it writes headers
+        validated = true;         // res.json delegates to res.end internally — don't re-check
+        return origJson(value);
+      };
+    }
+
+    var origEnd = typeof res.end === "function" ? res.end.bind(res) : null;
+    if (origEnd) {
+      res.end = function (chunk) {
+        if (!validated) {
+          var text = null;
+          if (typeof chunk === "string") text = chunk;
+          else if (Buffer.isBuffer(chunk)) text = chunk.toString("utf8");
+          if (text !== null && _bodyLooksLikeJson(text)) {
+            var parsed;
+            var parsedOk = true;
+            try { parsed = safeJson.parse(text); } catch (_e) { parsedOk = false; }
+            if (parsedOk) {
+              validated = true;
+              runCheck(parsed, res.headersSent === true);
+            }
           }
-          // warn mode
-          log.warn("response-validation drift on " + req.method + " " + req.routePattern +
-                   ": " + JSON.stringify(rr.errors).slice(0, 500));
         }
-        return origJson(value);
+        return origEnd.apply(res, arguments);
       };
     }
     next();
@@ -698,7 +755,32 @@ class Router {
     var parsed = safeUrl.parse(absolute, {
       allowedProtocols: safeUrl.ALLOW_HTTP_ALL,
     });
-    req.pathname = parsed.pathname;
+    // Canonicalize the path to a single decoded form BEFORE any path-scoped
+    // decision runs. safeUrl.parse preserves percent-escapes in the path, but
+    // path-scoped middleware (`router.use("/admin", guard)` — requireAal,
+    // bearerAuth, requireMtls, csrfProtect) matches req.pathname segment-for-
+    // segment while downstream consumers (b.staticServe, router.serveStatic)
+    // percent-decode the path before resolving the resource. If the gate and
+    // the consumer disagree on decoding, an attacker percent-encodes a
+    // character in the guarded segment ("/%61dmin/secret") or hides a
+    // separator ("/admin%2fsecret") so the guard's compare misses while the
+    // consumer still reaches the protected resource — an authn/authz/CSRF/
+    // mTLS bypass. Refuse an encoded path separator or NUL (no legitimate
+    // routing use — the consumer would treat them as a separator/terminator),
+    // then decode the remaining escapes exactly once so the guard, the route
+    // matcher, and every consumer share one canonical path.
+    if (/%2[fF]|%5[cC]|%00/.test(parsed.pathname)) {
+      res.statusCode = 400;
+      res.end("400 Bad Request: encoded path separator or null byte");
+      return;
+    }
+    try {
+      req.pathname = decodeURIComponent(parsed.pathname);
+    } catch (_decodeErr) {
+      res.statusCode = 400;
+      res.end("400 Bad Request: malformed percent-encoding in path");
+      return;
+    }
     // CVE-2026-21717 V8 HashDoS defense — cap distinct query keys
     // before forming the dense object. Integer-shaped keys past 1000
     // entries degrade V8 hidden-class transitions to O(n²).
@@ -931,16 +1013,24 @@ class Router {
             "res.redirect: target must be a non-empty string"
           );
         }
-        // Reject embedded CR / LF / NUL early — header injection class.
-        // Node's writeHead would refuse these too, but the explicit
-        // refusal here gives operators a router-shaped error rather than
-        // a generic ERR_INVALID_CHAR.
+        // Reject every byte a header line or a URL-parsing user agent
+        // treats specially. CR / LF / NUL are the header-injection class
+        // (Node's writeHead would refuse them too — the explicit refusal
+        // gives operators a router-shaped error over ERR_INVALID_CHAR).
+        // TAB (0x09) is the open-redirect class: Node PERMITS a horizontal
+        // tab in a header value, but WHATWG URL removes ASCII TAB / LF / CR
+        // from a URL before parsing it, so "/<TAB>/evil.example" — which
+        // the same-origin heuristic below reads as a rooted path — collapses
+        // to the protocol-relative "//evil.example" in the browser and
+        // bounces to an attacker origin. Refuse the whole browser-stripped
+        // set here so the byte the heuristic inspects is the byte the user
+        // agent parses.
         for (var ci = 0; ci < url.length; ci += 1) {
           var cc = url.charCodeAt(ci);
-          if (cc === 0x00 || cc === 0x0A || cc === 0x0D) {
+          if (cc === 0x00 || cc === 0x09 || cc === 0x0A || cc === 0x0D) {
             throw new RouterError(
               "router/redirect-target-has-control-chars",
-              "res.redirect: target must not contain CR / LF / NUL bytes"
+              "res.redirect: target must not contain CR / LF / TAB / NUL bytes"
             );
           }
         }

package/lib/vendor/blamejs/lib/safe-archive.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.safeArchive

package/lib/vendor/blamejs/lib/safe-async.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.safeAsync
@@ -1611,6 +1613,47 @@ function flushLoop(fn, intervalMs, opts) {
 // We re-export them here under safe-async-shaped names so call sites
 // reaching for async safety primitives find them in one place.
 
+/**
+ * @primitive b.safeAsync.keyedSerializer
+ * @signature b.safeAsync.keyedSerializer()
+ * @since     0.15.42
+ * @status    stable
+ * @related   b.safeAsync.parallel
+ *
+ * Serializes async work per key: `run(key, fn)` queues `fn` behind any in-flight
+ * or queued work for the same `key` and runs it once they settle, so a
+ * read-modify-write or a check-then-create on a shared store cannot interleave
+ * with another call for the same key in the same process. Different keys run
+ * concurrently. The per-key chain is dropped once it drains, so the map does not
+ * grow without bound.
+ *
+ * In-process only: it serializes calls within ONE process. A registry shared
+ * across processes still needs its backend's own atomic create / unique
+ * constraint to refuse a cross-process duplicate.
+ *
+ * @example
+ *   var reg = b.safeAsync.keyedSerializer();
+ *   // concurrent register("acme") calls apply one-at-a-time, so the second
+ *   // sees the first's row and is refused as a duplicate:
+ *   await reg.run("acme", function () { return register("acme", row); });
+ */
+function keyedSerializer() {
+  var chains = new Map();
+  function run(key, fn) {
+    var prev = chains.get(key) || Promise.resolve();
+    // Run fn after prev settles (resolved OR rejected) so one failure does not
+    // wedge the key's queue. Wrap so prev's settled value/reason is NOT leaked
+    // into fn as an argument — fn runs as a thunk with its own closure, never
+    // the previous task's result.
+    var result = prev.then(function () { return fn(); }, function () { return fn(); });
+    var tail = result.then(function () {}, function () {});
+    chains.set(key, tail);
+    tail.then(function () { if (chains.get(key) === tail) chains.delete(key); });
+    return result;
+  }
+  return { run: run };
+}
+
 var retryHelper = require("./retry");
 
 var asyncRetry     = retryHelper.withRetry;
@@ -1632,6 +1675,7 @@ module.exports = {
   makeBatchDrain:     makeBatchDrain,
   makeBatchingSink:   makeBatchingSink,
   parallel:           parallel,
+  keyedSerializer:    keyedSerializer,
   Mutex:              Mutex,
   Semaphore:          Semaphore,
   Once:               Once,

package/lib/vendor/blamejs/lib/safe-buffer.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.safeBuffer
@@ -798,6 +800,68 @@ function stripCrlf(s, replacement) {
   return s.replace(CRLF_RE_GLOBAL, replacement === undefined ? "" : replacement);
 }
 
+/**
+ * @primitive b.safeBuffer.foldHeaderText
+ * @signature b.safeBuffer.foldHeaderText(value, replacement?)
+ * @since     0.15.68
+ * @status    stable
+ * @related   b.safeBuffer.assertHeaderSafe, b.safeBuffer.stripCrlf
+ *
+ * Neutralize free-text bound for a CRLF-delimited protocol line: replace
+ * every CR and LF with <code>replacement</code> (default a single space) so
+ * the text folds onto one line, AND remove every NUL byte. Use this for a
+ * value that may LEGITIMATELY wrap — a multi-line SMTP 5xx reply folded into
+ * one diagnostic line — where <code>assertHeaderSafe</code> (reject) would
+ * be too strict. Unlike bare <code>stripCrlf</code>, this also strips NUL,
+ * which is never valid in an RFC 5322 header value and which downstream
+ * SMTP / mail parsers treat specially. Non-string input passes through
+ * unchanged.
+ *
+ * @example
+ *   b.safeBuffer.foldHeaderText("550 mailbox full\r\nX-Injected: evil");
+ *   // → "550 mailbox full X-Injected: evil"
+ */
+function foldHeaderText(value, replacement) {
+  if (typeof value !== "string") return value;
+  var rep = replacement === undefined ? " " : replacement;
+  return value.replace(CRLF_RE_GLOBAL, rep).split("\u0000").join("");
+}
+
+/**
+ * @primitive b.safeBuffer.assertHeaderSafe
+ * @signature b.safeBuffer.assertHeaderSafe(value, label, ErrorClass, code)
+ * @since     0.15.68
+ * @status    stable
+ * @related   b.safeBuffer.hasCrlf, b.safeBuffer.stripCrlf
+ *
+ * Throw when a string bound for a CRLF-delimited protocol line — an SMTP /
+ * RFC 5322 header value, an HTTP header — contains CR, LF, or a NUL byte,
+ * the canonical header-injection / smuggling vector. Route every
+ * <code>Name: value\r\n</code> builder's STRUCTURED fields (addresses,
+ * domains, identifiers, MTA names) through this; they can never
+ * legitimately carry those bytes. For free-text that may legitimately wrap
+ * (a multi-line SMTP reply folded into one diagnostic line), fold it with
+ * <code>stripCrlf</code> instead of rejecting. Throws
+ * <code>new ErrorClass(code, ...)</code> so each caller reports in its own
+ * error domain (the <code>validateOpts</code> convention). A non-string
+ * value passes through untouched — callers type-check separately.
+ *
+ * @example
+ *   b.safeBuffer.assertHeaderSafe("rcpt@example.com", "to", MailError, "mail/bad-header");
+ *   // → "rcpt@example.com"
+ *
+ *   b.safeBuffer.assertHeaderSafe("rcpt\r\nBcc: evil@x", "to", MailError, "mail/bad-header");
+ *   // → throws MailError("mail/bad-header")
+ */
+function assertHeaderSafe(value, label, ErrorClass, code) {
+  if (typeof value === "string" &&
+      (CRLF_RE.test(value) || value.indexOf("\u0000") !== -1)) {
+    throw new ErrorClass(code,
+      label + ": must not contain CR, LF, or NUL (header injection)");
+  }
+  return value;
+}
+
 module.exports = {
   normalizeText:         normalizeText,
   toBuffer:              toBuffer,
@@ -809,6 +873,8 @@ module.exports = {
   isHex:                 isHex,
   hasCrlf:               hasCrlf,
   stripCrlf:             stripCrlf,
+  foldHeaderText:        foldHeaderText,
+  assertHeaderSafe:      assertHeaderSafe,
   stripTrailingHspace:   stripTrailingHspace,
   indexAfterOpenTag:     indexAfterOpenTag,
   HEX_RE:                HEX_RE,

package/lib/vendor/blamejs/lib/safe-decompress.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.safeDecompress

package/lib/vendor/blamejs/lib/safe-dns.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.safeDns

package/lib/vendor/blamejs/lib/safe-ical.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.safeIcal

package/lib/vendor/blamejs/lib/safe-icap.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 // codebase-patterns:allow-file raw-byte-literal — RFC 3507 ICAP status-code
 // table (200 / 204 / 400 / 403 / 404 / 405 / 408 / 500 / 504). These are
@@ -77,6 +79,7 @@
 
 var C                  = require("./constants");
 var { defineClass }    = require("./framework-error");
+var pick               = require("./pick");
 var gateContract       = require("./gate-contract");
 
 var SafeIcapError = defineClass("SafeIcapError", { alwaysPermanent: true });
@@ -395,6 +398,10 @@ function _parseHeaderLine(line, maxValueBytes) {
 }
 
 function _addHeader(headers, name, value) {
+  // A header named __proto__ / constructor / prototype would pollute or
+  // shadow the plain-object header map; drop it (ICAP headers are echoed
+  // from an untrusted upstream response).
+  if (pick.isPoisonedKey(name)) return;
   if (headers[name] === undefined) {
     headers[name] = value;
   } else if (Array.isArray(headers[name])) {

package/lib/vendor/blamejs/lib/safe-json.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.safeJson

package/lib/vendor/blamejs/lib/safe-jsonpath.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * safe-jsonpath — Postgres SQL/JSON path validator for JSONB query

package/lib/vendor/blamejs/lib/safe-mime.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.safeMime

package/lib/vendor/blamejs/lib/safe-mount-info.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.safeMountInfo

package/lib/vendor/blamejs/lib/safe-path.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.safePath

package/lib/vendor/blamejs/lib/safe-redirect.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * safe-redirect — open-redirect (CWE-601) defense for operator-supplied

package/lib/vendor/blamejs/lib/safe-schema.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.safeSchema

package/lib/vendor/blamejs/lib/safe-sieve.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 
 /**

package/lib/vendor/blamejs/lib/safe-smtp.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.safeSmtp

package/lib/vendor/blamejs/lib/safe-sql.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.safeSql

package/lib/vendor/blamejs/lib/safe-url.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.safeUrl

package/lib/vendor/blamejs/lib/safe-vcard.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.safeVcard

package/lib/vendor/blamejs/lib/sandbox-worker.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * sandbox-worker — bootstrap module loaded inside the worker_threads

package/lib/vendor/blamejs/lib/sandbox.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.sandbox - isolation harness for operator-supplied transforms.

package/lib/vendor/blamejs/lib/scheduler.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.scheduler

package/lib/vendor/blamejs/lib/scitt.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.scitt

package/lib/vendor/blamejs/lib/sd-notify.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.sdNotify

package/lib/vendor/blamejs/lib/sec-cyber.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.secCyber — SEC Cybersecurity Disclosure Item 1.05 (Form 8-K)

package/lib/vendor/blamejs/lib/security-assert.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * security-assert — boot-time policy assertions for production posture.

package/lib/vendor/blamejs/lib/seeders.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.seeders — DB seeders.

package/lib/vendor/blamejs/lib/self-update-standalone-verifier.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.selfUpdate.standaloneVerifier